394 files changed, 40408 insertions, 44456 deletions

diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index d7a764a2fc1a..588943660755 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -5,6 +5,7 @@
 menuconfig WLAN
         bool "Wireless LAN"
         depends on !S390
+        select WIRELESS
         default y
         ---help---
           This section contains all the pre 802.11 and 802.11 wireless
@@ -15,114 +16,12 @@ menuconfig WLAN
 
 if WLAN
 
-menuconfig WLAN_PRE80211
-        bool "Wireless LAN (pre-802.11)"
-        depends on NETDEVICES
-        ---help---
-          Say Y if you have any pre-802.11 wireless LAN hardware.
-
-          This option does not affect the kernel build, it only
-          lets you choose drivers.
-
-config STRIP
-        tristate "STRIP (Metricom starmode radio IP)"
-        depends on INET && WLAN_PRE80211
-        select WIRELESS_EXT
-        ---help---
-          Say Y if you have a Metricom radio and intend to use Starmode Radio
-          IP. STRIP is a radio protocol developed for the MosquitoNet project
-          to send Internet traffic using Metricom radios.  Metricom radios are
-          small, battery powered, 100kbit/sec packet radio transceivers, about
-          the size and weight of a cellular telephone. (You may also have heard
-          them called "Metricom modems" but we avoid the term "modem" because
-          it misleads many people into thinking that you can plug a Metricom
-          modem into a phone line and use it as a modem.)
-
-          You can use STRIP on any Linux machine with a serial port, although
-          it is obviously most useful for people with laptop computers. If you
-          think you might get a Metricom radio in the future, there is no harm
-          in saying Y to STRIP now, except that it makes the kernel a bit
-          bigger.
-
-          To compile this as a module, choose M here: the module will be
-          called strip.
-
-config ARLAN
-        tristate "Aironet Arlan 655 & IC2200 DS support"
-        depends on ISA && !64BIT && WLAN_PRE80211
-        select WIRELESS_EXT
-        ---help---
-          Aironet makes Arlan, a class of wireless LAN adapters. These use the
-          www.Telxon.com chip, which is also used on several similar cards.
-          This driver is tested on the 655 and IC2200 series cards. Look at
-          <http://www.ylenurme.ee/~elmer/655/> for the latest information.
-
-          The driver is built as two modules, arlan and arlan-proc. The latter
-          is the /proc interface and is not needed most of time.
-
-          On some computers the card ends up in non-valid state after some
-          time. Use a ping-reset script to clear it.
-
-config WAVELAN
-        tristate "AT&T/Lucent old WaveLAN & DEC RoamAbout DS ISA support"
-        depends on ISA && WLAN_PRE80211
-        select WIRELESS_EXT
-        ---help---
-          The Lucent WaveLAN (formerly NCR and AT&T; or DEC RoamAbout DS) is
-          a Radio LAN (wireless Ethernet-like Local Area Network) using the
-          radio frequencies 900 MHz and 2.4 GHz.
-
-          If you want to use an ISA WaveLAN card under Linux, say Y and read
-          the Ethernet-HOWTO, available from
-          <http://www.tldp.org/docs.html#howto>. Some more specific
-          information is contained in
-          <file:Documentation/networking/wavelan.txt> and in the source code
-          <file:drivers/net/wireless/wavelan.p.h>.
-
-          You will also need the wireless tools package available from
-          <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>.
-          Please read the man pages contained therein.
-
-          To compile this driver as a module, choose M here: the module will be
-          called wavelan.
-
-config PCMCIA_WAVELAN
-        tristate "AT&T/Lucent old WaveLAN Pcmcia wireless support"
-        depends on PCMCIA && WLAN_PRE80211
-        select WIRELESS_EXT
-        help
-          Say Y here if you intend to attach an AT&T/Lucent Wavelan PCMCIA
-          (PC-card) wireless Ethernet networking card to your computer.  This
-          driver is for the non-IEEE-802.11 Wavelan cards.
-
-          To compile this driver as a module, choose M here: the module will be
-          called wavelan_cs.  If unsure, say N.
-
-config PCMCIA_NETWAVE
-        tristate "Xircom Netwave AirSurfer Pcmcia wireless support"
-        depends on PCMCIA && WLAN_PRE80211
-        select WIRELESS_EXT
-        help
-          Say Y here if you intend to attach this type of PCMCIA (PC-card)
-          wireless Ethernet networking card to your computer.
-
-          To compile this driver as a module, choose M here: the module will be
-          called netwave_cs.  If unsure, say N.
-
-
-menuconfig WLAN_80211
-        bool "Wireless LAN (IEEE 802.11)"
-        depends on NETDEVICES
-        ---help---
-          Say Y if you have any 802.11 wireless LAN hardware.
-
-          This option does not affect the kernel build, it only
-          lets you choose drivers.
-
 config PCMCIA_RAYCS
         tristate "Aviator/Raytheon 2.4GHz wireless support"
-        depends on PCMCIA && WLAN_80211
+        depends on PCMCIA
         select WIRELESS_EXT
+        select WEXT_SPY
+        select WEXT_PRIV
         ---help---
           Say Y here if you intend to attach an Aviator/Raytheon PCMCIA
           (PC-card) wireless Ethernet networking card to your computer.
@@ -132,49 +31,9 @@ config PCMCIA_RAYCS
           To compile this driver as a module, choose M here: the module will be
           called ray_cs.  If unsure, say N.
 
-config LIBERTAS
-        tristate "Marvell 8xxx Libertas WLAN driver support"
-        depends on WLAN_80211
-        select WIRELESS_EXT
-        select LIB80211
-        select FW_LOADER
-        ---help---
-          A library for Marvell Libertas 8xxx devices.
-
-config LIBERTAS_USB
-        tristate "Marvell Libertas 8388 USB 802.11b/g cards"
-        depends on LIBERTAS && USB
-        ---help---
-          A driver for Marvell Libertas 8388 USB devices.
-
-config LIBERTAS_CS
-        tristate "Marvell Libertas 8385 CompactFlash 802.11b/g cards"
-        depends on LIBERTAS && PCMCIA
-        select FW_LOADER
-        ---help---
-          A driver for Marvell Libertas 8385 CompactFlash devices.
-
-config LIBERTAS_SDIO
-        tristate "Marvell Libertas 8385/8686/8688 SDIO 802.11b/g cards"
-        depends on LIBERTAS && MMC
-        ---help---
-          A driver for Marvell Libertas 8385/8686/8688 SDIO devices.
-
-config LIBERTAS_SPI
-        tristate "Marvell Libertas 8686 SPI 802.11b/g cards"
-        depends on LIBERTAS && SPI
-        ---help---
-          A driver for Marvell Libertas 8686 SPI devices.
-
-config LIBERTAS_DEBUG
-        bool "Enable full debugging output in the Libertas module."
-        depends on LIBERTAS
-        ---help---
-          Debugging support.
-
 config LIBERTAS_THINFIRM
         tristate "Marvell 8xxx Libertas WLAN driver support with thin firmware"
-        depends on WLAN_80211 && MAC80211
+        depends on MAC80211
         select FW_LOADER
         ---help---
           A library for Marvell Libertas 8xxx devices using thinfirm.
@@ -187,9 +46,11 @@ config LIBERTAS_THINFIRM_USB
 
 config AIRO
         tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards"
-        depends on ISA_DMA_API && WLAN_80211 && (PCI || BROKEN)
+        depends on ISA_DMA_API && (PCI || BROKEN)
         select WIRELESS_EXT
         select CRYPTO
+        select WEXT_SPY
+        select WEXT_PRIV
         ---help---
           This is the standard Linux driver to support Cisco/Aironet ISA and
           PCI 802.11 wireless cards.
@@ -205,8 +66,9 @@ config AIRO
 
 config ATMEL
       tristate "Atmel at76c50x chipset  802.11b support"
-      depends on (PCI || PCMCIA) && WLAN_80211
+      depends on (PCI || PCMCIA)
       select WIRELESS_EXT
+      select WEXT_PRIV
       select FW_LOADER
       select CRC32
        ---help---
@@ -239,7 +101,7 @@ config PCMCIA_ATMEL
 
 config AT76C50X_USB
         tristate "Atmel at76c503/at76c505/at76c505a USB cards"
-        depends on MAC80211 && WLAN_80211 && USB
+        depends on MAC80211 && USB
         select FW_LOADER
         ---help---
           Enable support for USB Wireless devices using Atmel at76c503,
@@ -247,8 +109,10 @@ config AT76C50X_USB
 
 config AIRO_CS
         tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
-        depends on PCMCIA && (BROKEN || !M32R) && WLAN_80211
+        depends on PCMCIA && (BROKEN || !M32R)
         select WIRELESS_EXT
+        select WEXT_SPY
+        select WEXT_PRIV
         select CRYPTO
         select CRYPTO_AES
         ---help---
@@ -266,18 +130,21 @@ config AIRO_CS
           Cisco Linux utilities can be used to configure the card.
 
 config PCMCIA_WL3501
-      tristate "Planet WL3501 PCMCIA cards"
-      depends on EXPERIMENTAL && PCMCIA && WLAN_80211
-      select WIRELESS_EXT
-       ---help---
-         A driver for WL3501 PCMCIA 802.11 wireless cards made by Planet.
-         It has basic support for Linux wireless extensions and initial
-         micro support for ethtool.
+        tristate "Planet WL3501 PCMCIA cards"
+        depends on EXPERIMENTAL && PCMCIA
+        select WIRELESS_EXT
+        select WEXT_SPY
+        help
+          A driver for WL3501 PCMCIA 802.11 wireless cards made by Planet.
+          It has basic support for Linux wireless extensions and initial
+          micro support for ethtool.
 
 config PRISM54
         tristate 'Intersil Prism GT/Duette/Indigo PCI/Cardbus (DEPRECATED)'
-        depends on PCI && EXPERIMENTAL && WLAN_80211
+        depends on PCI && EXPERIMENTAL
         select WIRELESS_EXT
+        select WEXT_SPY
+        select WEXT_PRIV
         select FW_LOADER
         ---help---
           This enables support for FullMAC PCI/Cardbus prism54 devices. This
@@ -298,8 +165,9 @@ config PRISM54
 
 config USB_ZD1201
         tristate "USB ZD1201 based Wireless device support"
-        depends on USB && WLAN_80211
+        depends on USB
         select WIRELESS_EXT
+        select WEXT_PRIV
         select FW_LOADER
         ---help---
           Say Y if you want to use wireless LAN adapters based on the ZyDAS
@@ -316,7 +184,7 @@ config USB_ZD1201
 
 config USB_NET_RNDIS_WLAN
         tristate "Wireless RNDIS USB support"
-        depends on USB && WLAN_80211 && EXPERIMENTAL
+        depends on USB && EXPERIMENTAL
         depends on CFG80211
         select USB_USBNET
         select USB_NET_CDCETHER
@@ -344,7 +212,7 @@ config USB_NET_RNDIS_WLAN
 
 config RTL8180
         tristate "Realtek 8180/8185 PCI support"
-        depends on MAC80211 && PCI && WLAN_80211 && EXPERIMENTAL
+        depends on MAC80211 && PCI && EXPERIMENTAL
         select EEPROM_93CX6
         ---help---
           This is a driver for RTL8180 and RTL8185 based cards.
@@ -400,7 +268,7 @@ config RTL8180
 
 config RTL8187
         tristate "Realtek 8187 and 8187B USB support"
-        depends on MAC80211 && USB && WLAN_80211
+        depends on MAC80211 && USB
         select EEPROM_93CX6
         ---help---
           This is a driver for RTL8187 and RTL8187B based cards.
@@ -429,7 +297,7 @@ config RTL8187_LEDS
 
 config ADM8211
         tristate "ADMtek ADM8211 support"
-        depends on MAC80211 && PCI && WLAN_80211 && EXPERIMENTAL
+        depends on MAC80211 && PCI && EXPERIMENTAL
         select CRC32
         select EEPROM_93CX6
         ---help---
@@ -456,7 +324,7 @@ config ADM8211
 
 config MAC80211_HWSIM
         tristate "Simulated radio testing tool for mac80211"
-        depends on MAC80211 && WLAN_80211
+        depends on MAC80211
         ---help---
           This driver is a developer testing tool that can be used to test
           IEEE 802.11 networking stack (mac80211) functionality. This is not
@@ -469,24 +337,25 @@ config MAC80211_HWSIM
 
 config MWL8K
         tristate "Marvell 88W8xxx PCI/PCIe Wireless support"
-        depends on MAC80211 && PCI && WLAN_80211 && EXPERIMENTAL
+        depends on MAC80211 && PCI && EXPERIMENTAL
         ---help---
           This driver supports Marvell TOPDOG 802.11 wireless cards.
 
           To compile this driver as a module, choose M here: the module
           will be called mwl8k.  If unsure, say N.
 
-source "drivers/net/wireless/p54/Kconfig"
 source "drivers/net/wireless/ath/Kconfig"
-source "drivers/net/wireless/ipw2x00/Kconfig"
-source "drivers/net/wireless/iwlwifi/Kconfig"
-source "drivers/net/wireless/hostap/Kconfig"
 source "drivers/net/wireless/b43/Kconfig"
 source "drivers/net/wireless/b43legacy/Kconfig"
-source "drivers/net/wireless/zd1211rw/Kconfig"
-source "drivers/net/wireless/rt2x00/Kconfig"
+source "drivers/net/wireless/hostap/Kconfig"
+source "drivers/net/wireless/ipw2x00/Kconfig"
+source "drivers/net/wireless/iwlwifi/Kconfig"
+source "drivers/net/wireless/iwmc3200wifi/Kconfig"
+source "drivers/net/wireless/libertas/Kconfig"
 source "drivers/net/wireless/orinoco/Kconfig"
+source "drivers/net/wireless/p54/Kconfig"
+source "drivers/net/wireless/rt2x00/Kconfig"
 source "drivers/net/wireless/wl12xx/Kconfig"
-source "drivers/net/wireless/iwmc3200wifi/Kconfig"
+source "drivers/net/wireless/zd1211rw/Kconfig"
 
 endif # WLAN
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index 7a4647e78fd3..5d4ce4d2b32b 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -5,16 +5,6 @@
 obj-$(CONFIG_IPW2100) += ipw2x00/
 obj-$(CONFIG_IPW2200) += ipw2x00/
 
-obj-$(CONFIG_STRIP) += strip.o
-obj-$(CONFIG_ARLAN) += arlan.o 
-
-arlan-objs := arlan-main.o arlan-proc.o
-
-# Obsolete cards
-obj-$(CONFIG_WAVELAN)           += wavelan.o
-obj-$(CONFIG_PCMCIA_NETWAVE)    += netwave_cs.o
-obj-$(CONFIG_PCMCIA_WAVELAN)    += wavelan_cs.o
-
 obj-$(CONFIG_HERMES)            += orinoco/
 
 obj-$(CONFIG_AIRO)              += airo.o
diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index b80f514877d8..ab61d2b558d6 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -18,6 +18,7 @@
 #include <linux/init.h>
 #include <linux/if.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/etherdevice.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
@@ -39,7 +40,7 @@ static unsigned int rx_ring_size __read_mostly = 16;
 module_param(tx_ring_size, uint, 0);
 module_param(rx_ring_size, uint, 0);
 
-static struct pci_device_id adm8211_pci_id_table[] __devinitdata = {
+static DEFINE_PCI_DEVICE_TABLE(adm8211_pci_id_table) = {
         /* ADMtek ADM8211 */
         { PCI_DEVICE(0x10B7, 0x6000) }, /* 3Com 3CRSHPW796 */
         { PCI_DEVICE(0x1200, 0x8201) }, /* ? */
@@ -302,18 +303,6 @@ static int adm8211_get_stats(struct ieee80211_hw *dev,
         return 0;
 }
 
-static int adm8211_get_tx_stats(struct ieee80211_hw *dev,
-                                struct ieee80211_tx_queue_stats *stats)
-{
-        struct adm8211_priv *priv = dev->priv;
-
-        stats[0].len = priv->cur_tx - priv->dirty_tx;
-        stats[0].limit = priv->tx_ring_size - 2;
-        stats[0].count = priv->dirty_tx;
-
-        return 0;
-}
-
 static void adm8211_interrupt_tci(struct ieee80211_hw *dev)
 {
         struct adm8211_priv *priv = dev->priv;
@@ -1400,15 +1389,15 @@ static void adm8211_configure_filter(struct ieee80211_hw *dev,
 }
 
 static int adm8211_add_interface(struct ieee80211_hw *dev,
-                                 struct ieee80211_if_init_conf *conf)
+                                 struct ieee80211_vif *vif)
 {
         struct adm8211_priv *priv = dev->priv;
         if (priv->mode != NL80211_IFTYPE_MONITOR)
                 return -EOPNOTSUPP;
 
-        switch (conf->type) {
+        switch (vif->type) {
         case NL80211_IFTYPE_STATION:
-                priv->mode = conf->type;
+                priv->mode = vif->type;
                 break;
         default:
                 return -EOPNOTSUPP;
@@ -1416,8 +1405,8 @@ static int adm8211_add_interface(struct ieee80211_hw *dev,
 
         ADM8211_IDLE();
 
-        ADM8211_CSR_WRITE(PAR0, le32_to_cpu(*(__le32 *)conf->mac_addr));
-        ADM8211_CSR_WRITE(PAR1, le16_to_cpu(*(__le16 *)(conf->mac_addr + 4)));
+        ADM8211_CSR_WRITE(PAR0, le32_to_cpu(*(__le32 *)vif->addr));
+        ADM8211_CSR_WRITE(PAR1, le16_to_cpu(*(__le16 *)(vif->addr + 4)));
 
         adm8211_update_mode(dev);
 
@@ -1427,7 +1416,7 @@ static int adm8211_add_interface(struct ieee80211_hw *dev,
 }
 
 static void adm8211_remove_interface(struct ieee80211_hw *dev,
-                                     struct ieee80211_if_init_conf *conf)
+                                     struct ieee80211_vif *vif)
 {
         struct adm8211_priv *priv = dev->priv;
         priv->mode = NL80211_IFTYPE_MONITOR;
@@ -1538,7 +1527,7 @@ static int adm8211_start(struct ieee80211_hw *dev)
         adm8211_hw_init(dev);
         adm8211_rf_set_channel(dev, priv->channel);
 
-        retval = request_irq(priv->pdev->irq, &adm8211_interrupt,
+        retval = request_irq(priv->pdev->irq, adm8211_interrupt,
                              IRQF_SHARED, "adm8211", dev);
         if (retval) {
                 printk(KERN_ERR "%s: failed to register IRQ handler\n",
@@ -1773,7 +1762,6 @@ static const struct ieee80211_ops adm8211_ops = {
         .prepare_multicast      = adm8211_prepare_multicast,
         .configure_filter       = adm8211_configure_filter,
         .get_stats              = adm8211_get_stats,
-        .get_tx_stats           = adm8211_get_tx_stats,
         .get_tsf                = adm8211_get_tsft
 };
 
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index abf896a7390e..dc5018a6d9ed 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -51,13 +51,14 @@
 #include <linux/freezer.h>
 
 #include <linux/ieee80211.h>
+#include <net/iw_handler.h>
 
 #include "airo.h"
 
 #define DRV_NAME "airo"
 
 #ifdef CONFIG_PCI
-static struct pci_device_id card_ids[] = {
+static DEFINE_PCI_DEVICE_TABLE(card_ids) = {
         { 0x14b9, 1, PCI_ANY_ID, PCI_ANY_ID, },
         { 0x14b9, 0x4500, PCI_ANY_ID, PCI_ANY_ID },
         { 0x14b9, 0x4800, PCI_ANY_ID, PCI_ANY_ID, },
@@ -2310,7 +2311,7 @@ static void airo_set_multicast_list(struct net_device *dev) {
                         airo_set_promisc(ai);
         }
 
-        if ((dev->flags&IFF_ALLMULTI)||dev->mc_count>0) {
+        if ((dev->flags&IFF_ALLMULTI) || !netdev_mc_empty(dev)) {
                 /* Turn on multicast.  (Should be already setup...) */
         }
 }
@@ -4806,7 +4807,7 @@ static int airo_config_commit(struct net_device *dev,
 
 static inline int sniffing_mode(struct airo_info *ai)
 {
-        return le16_to_cpu(ai->config.rmode & RXMODE_MASK) >=
+        return (le16_to_cpu(ai->config.rmode) & le16_to_cpu(RXMODE_MASK)) >=
                 le16_to_cpu(RXMODE_RFMON);
 }
 
@@ -5254,11 +5255,8 @@ static int set_wep_key(struct airo_info *ai, u16 index, const char *key,
         WepKeyRid wkr;
         int rc;
 
-        if (keylen == 0) {
-                airo_print_err(ai->dev->name, "%s: key length to set was zero",
-                               __func__);
+        if (WARN_ON(keylen == 0))
                 return -1;
-        }
 
         memset(&wkr, 0, sizeof(wkr));
         wkr.len = cpu_to_le16(sizeof(wkr));
@@ -5659,7 +5657,8 @@ static int airo_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 
         pci_enable_wake(pdev, pci_choose_state(pdev, state), 1);
         pci_save_state(pdev);
-        return pci_set_power_state(pdev, pci_choose_state(pdev, state));
+        pci_set_power_state(pdev, pci_choose_state(pdev, state));
+        return 0;
 }
 
 static int airo_pci_resume(struct pci_dev *pdev)
@@ -6404,11 +6403,7 @@ static int airo_set_encode(struct net_device *dev,
                 if (dwrq->length > MIN_KEY_SIZE)
                         key.len = MAX_KEY_SIZE;
                 else
-                        if (dwrq->length > 0)
-                                key.len = MIN_KEY_SIZE;
-                        else
-                                /* Disable the key */
-                                key.len = 0;
+                        key.len = MIN_KEY_SIZE;
                 /* Check if the key is not marked as invalid */
                 if(!(dwrq->flags & IW_ENCODE_NOKEY)) {
                         /* Cleanup */
@@ -6589,12 +6584,22 @@ static int airo_set_encodeext(struct net_device *dev,
                 default:
                         return -EINVAL;
                 }
-                /* Send the key to the card */
-                rc = set_wep_key(local, idx, key.key, key.len, perm, 1);
-                if (rc < 0) {
-                        airo_print_err(local->dev->name, "failed to set WEP key"
-                                       " at index %d: %d.", idx, rc);
-                        return rc;
+                if (key.len == 0) {
+                        rc = set_wep_tx_idx(local, idx, perm, 1);
+                        if (rc < 0) {
+                                airo_print_err(local->dev->name,
+                                               "failed to set WEP transmit index to %d: %d.",
+                                               idx, rc);
+                                return rc;
+                        }
+                } else {
+                        rc = set_wep_key(local, idx, key.key, key.len, perm, 1);
+                        if (rc < 0) {
+                                airo_print_err(local->dev->name,
+                                               "failed to set WEP key at index %d: %d.",
+                                               idx, rc);
+                                return rc;
+                        }
                 }
         }
 
diff --git a/drivers/net/wireless/airo_cs.c b/drivers/net/wireless/airo_cs.c
index d0593ed9170e..f6036fb42319 100644
--- a/drivers/net/wireless/airo_cs.c
+++ b/drivers/net/wireless/airo_cs.c
@@ -43,21 +43,6 @@
 
 #include "airo.h"
 
-/*
-   All the PCMCIA modules use PCMCIA_DEBUG to control debugging.  If
-   you do not define PCMCIA_DEBUG at all, all the debug code will be
-   left out.  If you compile with PCMCIA_DEBUG=0, the debug code will
-   be present but disabled -- but it can then be enabled for specific
-   modules at load time with a 'pc_debug=#' option to insmod.
-*/
-#ifdef PCMCIA_DEBUG
-static int pc_debug = PCMCIA_DEBUG;
-module_param(pc_debug, int, 0);
-static char *version = "$Revision: 1.2 $";
-#define DEBUG(n, args...) if (pc_debug > (n)) printk(KERN_DEBUG args);
-#else
-#define DEBUG(n, args...)
-#endif
 
 /*====================================================================*/
 
@@ -145,11 +130,10 @@ static int airo_probe(struct pcmcia_device *p_dev)
 {
         local_info_t *local;
 
-        DEBUG(0, "airo_attach()\n");
+        dev_dbg(&p_dev->dev, "airo_attach()\n");
 
         /* Interrupt setup */
         p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        p_dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
         p_dev->irq.Handler = NULL;
 
         /*
@@ -184,7 +168,7 @@ static int airo_probe(struct pcmcia_device *p_dev)
 
 static void airo_detach(struct pcmcia_device *link)
 {
-        DEBUG(0, "airo_detach(0x%p)\n", link);
+        dev_dbg(&link->dev, "airo_detach\n");
 
         airo_release(link);
 
@@ -204,9 +188,6 @@ static void airo_detach(struct pcmcia_device *link)
 
   ======================================================================*/
 
-#define CS_CHECK(fn, ret) \
-do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
-
 static int airo_cs_config_check(struct pcmcia_device *p_dev,
                                 cistpl_cftable_entry_t *cfg,
                                 cistpl_cftable_entry_t *dflt,
@@ -275,11 +256,11 @@ static int airo_cs_config_check(struct pcmcia_device *p_dev,
                 req->Base = mem->win[0].host_addr;
                 req->Size = mem->win[0].len;
                 req->AccessSpeed = 0;
-                if (pcmcia_request_window(&p_dev, req, &p_dev->win) != 0)
+                if (pcmcia_request_window(p_dev, req, &p_dev->win) != 0)
                         return -ENODEV;
                 map.Page = 0;
                 map.CardOffset = mem->win[0].card_addr;
-                if (pcmcia_map_mem_page(p_dev->win, &map) != 0)
+                if (pcmcia_map_mem_page(p_dev, p_dev->win, &map) != 0)
                         return -ENODEV;
         }
         /* If we got this far, we're cool! */
@@ -291,11 +272,11 @@ static int airo_config(struct pcmcia_device *link)
 {
         local_info_t *dev;
         win_req_t *req;
-        int last_fn, last_ret;
+        int ret;
 
         dev = link->priv;
 
-        DEBUG(0, "airo_config(0x%p)\n", link);
+        dev_dbg(&link->dev, "airo_config\n");
 
         req = kzalloc(sizeof(win_req_t), GFP_KERNEL);
         if (!req)
@@ -315,8 +296,8 @@ static int airo_config(struct pcmcia_device *link)
          * and most client drivers will only use the CIS to fill in
          * implementation-defined details.
          */
-        last_ret = pcmcia_loop_config(link, airo_cs_config_check, req);
-        if (last_ret)
+        ret = pcmcia_loop_config(link, airo_cs_config_check, req);
+        if (ret)
                 goto failed;
 
         /*
@@ -324,21 +305,25 @@ static int airo_config(struct pcmcia_device *link)
           handler to the interrupt, unless the 'Handler' member of the
           irq structure is initialized.
         */
-        if (link->conf.Attributes & CONF_ENABLE_IRQ)
-                CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
+                ret = pcmcia_request_irq(link, &link->irq);
+                if (ret)
+                        goto failed;
+        }
 
         /*
           This actually configures the PCMCIA socket -- setting up
           the I/O windows and the interrupt mapping, and putting the
           card and host interface into "Memory and IO" mode.
         */
-        CS_CHECK(RequestConfiguration,
-                 pcmcia_request_configuration(link, &link->conf));
+        ret = pcmcia_request_configuration(link, &link->conf);
+        if (ret)
+                goto failed;
         ((local_info_t *)link->priv)->eth_dev =
                 init_airo_card(link->irq.AssignedIRQ,
-                               link->io.BasePort1, 1, &handle_to_dev(link));
+                               link->io.BasePort1, 1, &link->dev);
         if (!((local_info_t *)link->priv)->eth_dev)
-                goto cs_failed;
+                goto failed;
 
         /*
           At this point, the dev_node_t structure(s) need to be
@@ -368,8 +353,6 @@ static int airo_config(struct pcmcia_device *link)
         kfree(req);
         return 0;
 
- cs_failed:
-        cs_error(link, last_fn, last_ret);
  failed:
         airo_release(link);
         kfree(req);
@@ -386,7 +369,7 @@ static int airo_config(struct pcmcia_device *link)
 
 static void airo_release(struct pcmcia_device *link)
 {
-        DEBUG(0, "airo_release(0x%p)\n", link);
+        dev_dbg(&link->dev, "airo_release\n");
         pcmcia_disable_device(link);
 }
 
diff --git a/drivers/net/wireless/arlan-main.c b/drivers/net/wireless/arlan-main.c
deleted file mode 100644
index 921a082487a1..000000000000
--- a/drivers/net/wireless/arlan-main.c
+++ /dev/null
@@ -1,1887 +0,0 @@
-/*
- *  Copyright (C) 1997 Cullen Jennings
- *  Copyright (C) 1998 Elmer Joandiu, elmer@ylenurme.ee
- *  GNU General Public License applies
- * This module provides support for the Arlan 655 card made by Aironet
- */
-
-#include "arlan.h"
-
-#if BITS_PER_LONG != 32
-#  error FIXME: this driver requires a 32-bit platform
-#endif
-
-static const char *arlan_version = "C.Jennigs 97 & Elmer.Joandi@ut.ee  Oct'98, http://www.ylenurme.ee/~elmer/655/";
-
-struct net_device *arlan_device[MAX_ARLANS];
-
-static int SID = SIDUNKNOWN;
-static int radioNodeId = radioNodeIdUNKNOWN;
-static char encryptionKey[12] = {'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h'};
-int arlan_debug = debugUNKNOWN;
-static int spreadingCode = spreadingCodeUNKNOWN;
-static int channelNumber = channelNumberUNKNOWN;
-static int channelSet = channelSetUNKNOWN;
-static int systemId = systemIdUNKNOWN;
-static int registrationMode = registrationModeUNKNOWN;
-static int keyStart;
-static int tx_delay_ms;
-static int retries = 5;
-static int tx_queue_len = 1;
-static int arlan_EEPROM_bad;
-
-#ifdef ARLAN_DEBUGGING
-
-static int testMemory = testMemoryUNKNOWN;
-static int irq = irqUNKNOWN;
-static int txScrambled = 1;
-static int mdebug;
-
-module_param(irq, int, 0);
-module_param(mdebug, int, 0);
-module_param(testMemory, int, 0);
-module_param(txScrambled, int, 0);
-MODULE_PARM_DESC(irq, "(unused)");
-MODULE_PARM_DESC(testMemory, "(unused)");
-MODULE_PARM_DESC(mdebug, "Arlan multicast debugging (0-1)");
-#endif
-
-module_param_named(debug, arlan_debug, int, 0);
-module_param(spreadingCode, int, 0);
-module_param(channelNumber, int, 0);
-module_param(channelSet, int, 0);
-module_param(systemId, int, 0);
-module_param(registrationMode, int, 0);
-module_param(radioNodeId, int, 0);
-module_param(SID, int, 0);
-module_param(keyStart, int, 0);
-module_param(tx_delay_ms, int, 0);
-module_param(retries, int, 0);
-module_param(tx_queue_len, int, 0);
-module_param_named(EEPROM_bad, arlan_EEPROM_bad, int, 0);
-MODULE_PARM_DESC(debug, "Arlan debug enable (0-1)");
-MODULE_PARM_DESC(retries, "Arlan maximum packet retransmisions");
-#ifdef ARLAN_ENTRY_EXIT_DEBUGGING
-static int arlan_entry_debug;
-static int arlan_exit_debug;
-static int arlan_entry_and_exit_debug;
-module_param_named(entry_debug, arlan_entry_debug, int, 0);
-module_param_named(exit_debug, arlan_exit_debug, int, 0);
-module_param_named(entry_and_exit_debug, arlan_entry_and_exit_debug, int, 0);
-MODULE_PARM_DESC(entry_debug, "Arlan driver function entry debugging");
-MODULE_PARM_DESC(exit_debug, "Arlan driver function exit debugging");
-MODULE_PARM_DESC(entry_and_exit_debug, "Arlan driver function entry and exit debugging");
-#endif
-
-struct arlan_conf_stru arlan_conf[MAX_ARLANS];
-static int arlans_found;
-
-static  int     arlan_open(struct net_device *dev);
-static  netdev_tx_t arlan_tx(struct sk_buff *skb, struct net_device *dev);
-static  irqreturn_t arlan_interrupt(int irq, void *dev_id);
-static  int     arlan_close(struct net_device *dev);
-static  struct net_device_stats *
-                arlan_statistics                (struct net_device *dev);
-static  void    arlan_set_multicast             (struct net_device *dev);
-static  int     arlan_hw_tx                     (struct net_device* dev, char *buf, int length );
-static  int     arlan_hw_config                 (struct net_device * dev);
-static  void    arlan_tx_done_interrupt         (struct net_device * dev, int status);
-static  void    arlan_rx_interrupt              (struct net_device * dev, u_char rxStatus, u_short, u_short);
-static  void    arlan_process_interrupt         (struct net_device * dev);
-static  void    arlan_tx_timeout                (struct net_device *dev);
-
-static inline long us2ticks(int us)
-{
-        return us * (1000000 / HZ);
-}
-
-
-#ifdef ARLAN_ENTRY_EXIT_DEBUGGING
-#define ARLAN_DEBUG_ENTRY(name) \
-        {\
-        struct timeval timev;\
-        do_gettimeofday(&timev);\
-                if (arlan_entry_debug || arlan_entry_and_exit_debug)\
-                        printk("--->>>" name " %ld " "\n",((long int) timev.tv_sec * 1000000 + timev.tv_usec));\
-        }
-#define ARLAN_DEBUG_EXIT(name) \
-        {\
-        struct timeval timev;\
-        do_gettimeofday(&timev);\
-                if (arlan_exit_debug || arlan_entry_and_exit_debug)\
-                        printk("<<<---" name " %ld " "\n",((long int) timev.tv_sec * 1000000 + timev.tv_usec) );\
-        }
-#else
-#define ARLAN_DEBUG_ENTRY(name)
-#define ARLAN_DEBUG_EXIT(name)
-#endif
-
-
-#define arlan_interrupt_ack(dev)\
-        clearClearInterrupt(dev);\
-        setClearInterrupt(dev);
-
-static inline int arlan_drop_tx(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-
-        dev->stats.tx_errors++;
-        if (priv->Conf->tx_delay_ms)
-        {
-                priv->tx_done_delayed = jiffies + priv->Conf->tx_delay_ms * HZ / 1000 + 1;
-        }
-        else
-        {
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_TX;
-                TXHEAD(dev).offset = 0;
-                TXTAIL(dev).offset = 0;
-                priv->txLast = 0;
-                priv->bad = 0;
-                if (!priv->under_reset && !priv->under_config)
-                        netif_wake_queue (dev);
-        }
-        return 1;
-}
-
-
-int arlan_command(struct net_device *dev, int command_p)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-        struct arlan_conf_stru *conf = priv->Conf;
-        int udelayed = 0;
-        int i = 0;
-        unsigned long flags;
-
-        ARLAN_DEBUG_ENTRY("arlan_command");
-
-        if (priv->card_polling_interval)
-                priv->card_polling_interval = 1;
-
-        if (arlan_debug & ARLAN_DEBUG_CHAIN_LOCKS)
-                printk(KERN_DEBUG "arlan_command, %lx commandByte %x waiting %lx incoming %x \n",
-                jiffies, READSHMB(arlan->commandByte),
-                       priv->waiting_command_mask, command_p);
-
-        priv->waiting_command_mask |= command_p;
-
-        if (priv->waiting_command_mask & ARLAN_COMMAND_RESET)
-                if (time_after(jiffies, priv->lastReset + 5 * HZ))
-                        priv->waiting_command_mask &= ~ARLAN_COMMAND_RESET;
-
-        if (priv->waiting_command_mask & ARLAN_COMMAND_INT_ACK)
-        {
-                arlan_interrupt_ack(dev);
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_INT_ACK;
-        }
-        if (priv->waiting_command_mask & ARLAN_COMMAND_INT_ENABLE)
-        {
-                setInterruptEnable(dev);
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_INT_ENABLE;
-        }
-
-        /* Card access serializing lock */
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* Check cards status and waiting */
-
-        if (priv->waiting_command_mask & (ARLAN_COMMAND_LONG_WAIT_NOW | ARLAN_COMMAND_WAIT_NOW))
-        {
-                while (priv->waiting_command_mask & (ARLAN_COMMAND_LONG_WAIT_NOW | ARLAN_COMMAND_WAIT_NOW))
-                {
-                        if (READSHMB(arlan->resetFlag) ||
-                                READSHMB(arlan->commandByte))   /* || 
-                                                                   (readControlRegister(dev) & ARLAN_ACCESS))
-                                                                 */
-                                udelay(40);
-                        else
-                                priv->waiting_command_mask &= ~(ARLAN_COMMAND_LONG_WAIT_NOW | ARLAN_COMMAND_WAIT_NOW);
-
-                        udelayed++;
-
-                        if (priv->waiting_command_mask & ARLAN_COMMAND_LONG_WAIT_NOW)
-                        {
-                                if (udelayed * 40 > 1000000)
-                                {
-                                        printk(KERN_ERR "%s long wait too long \n", dev->name);
-                                        priv->waiting_command_mask |= ARLAN_COMMAND_RESET;
-                                        break;
-                                }
-                        }
-                        else if (priv->waiting_command_mask & ARLAN_COMMAND_WAIT_NOW)
-                        {
-                                if (udelayed * 40 > 1000)
-                                {
-                                        printk(KERN_ERR "%s short wait too long \n", dev->name);
-                                        goto bad_end;
-                                }
-                        }
-                }
-        }
-        else
-        {
-                i = 0;
-                while ((READSHMB(arlan->resetFlag) ||
-                        READSHMB(arlan->commandByte)) &&
-                        conf->pre_Command_Wait > (i++) * 10)
-                        udelay(10);
-
-
-                if ((READSHMB(arlan->resetFlag) ||
-                        READSHMB(arlan->commandByte)) &&
-                        !(priv->waiting_command_mask & ARLAN_COMMAND_RESET))
-                {
-                        goto card_busy_end;
-                }
-        }
-        if (priv->waiting_command_mask & ARLAN_COMMAND_RESET)
-                priv->under_reset = 1;
-        if (priv->waiting_command_mask & ARLAN_COMMAND_CONF)
-                priv->under_config = 1;
-
-        /* Issuing command */
-        arlan_lock_card_access(dev);
-        if (priv->waiting_command_mask & ARLAN_COMMAND_POWERUP)
-        {
-        //     if (readControlRegister(dev) & (ARLAN_ACCESS && ARLAN_POWER))
-                setPowerOn(dev);
-                arlan_interrupt_lancpu(dev);
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_POWERUP;
-                priv->waiting_command_mask |= ARLAN_COMMAND_RESET;
-                priv->card_polling_interval = HZ / 10;
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_ACTIVATE)
-        {
-                WRITESHMB(arlan->commandByte, ARLAN_COM_ACTIVATE);
-                arlan_interrupt_lancpu(dev);
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_ACTIVATE;
-                priv->card_polling_interval = HZ / 10;
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_RX_ABORT)
-        {
-                if (priv->rx_command_given)
-                {
-                        WRITESHMB(arlan->commandByte, ARLAN_COM_RX_ABORT);
-                        arlan_interrupt_lancpu(dev);
-                        priv->rx_command_given = 0;
-                }
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_RX_ABORT;
-                priv->card_polling_interval = 1;
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_TX_ABORT)
-        {
-                if (priv->tx_command_given)
-                {
-                        WRITESHMB(arlan->commandByte, ARLAN_COM_TX_ABORT);
-                        arlan_interrupt_lancpu(dev);
-                        priv->tx_command_given = 0;
-                }
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_TX_ABORT;
-                priv->card_polling_interval = 1;
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_RESET)
-        {
-                priv->under_reset=1;
-                netif_stop_queue (dev);
-
-                arlan_drop_tx(dev);
-                if (priv->tx_command_given || priv->rx_command_given)
-                {
-                        printk(KERN_ERR "%s: Reset under tx or rx command \n", dev->name);
-                }
-                netif_stop_queue (dev);
-                if (arlan_debug & ARLAN_DEBUG_RESET)
-                        printk(KERN_ERR "%s: Doing chip reset\n", dev->name);
-                priv->lastReset = jiffies;
-                WRITESHM(arlan->commandByte, 0, u_char);
-                /* hold card in reset state */
-                setHardwareReset(dev);
-                /* set reset flag and then release reset */
-                WRITESHM(arlan->resetFlag, 0xff, u_char);
-                clearChannelAttention(dev);
-                clearHardwareReset(dev);
-                priv->card_polling_interval = HZ / 4;
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_RESET;
-                priv->waiting_command_mask |= ARLAN_COMMAND_INT_RACK;
-//              priv->waiting_command_mask |= ARLAN_COMMAND_INT_RENABLE; 
-//              priv->waiting_command_mask |= ARLAN_COMMAND_RX;
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_INT_RACK)
-        {
-                clearHardwareReset(dev);
-                clearClearInterrupt(dev);
-                setClearInterrupt(dev);
-                setInterruptEnable(dev);
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_INT_RACK;
-                priv->waiting_command_mask |= ARLAN_COMMAND_CONF;
-                priv->under_config = 1;
-                priv->under_reset = 0;
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_INT_RENABLE)
-        {
-                setInterruptEnable(dev);
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_INT_RENABLE;
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_CONF)
-        {
-                if (priv->tx_command_given || priv->rx_command_given)
-                {
-                        printk(KERN_ERR "%s: Reset under tx or rx command \n", dev->name);
-                }
-                arlan_drop_tx(dev);
-                setInterruptEnable(dev);
-                arlan_hw_config(dev);
-                arlan_interrupt_lancpu(dev);
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_CONF;
-                priv->card_polling_interval = HZ / 10;
-//              priv->waiting_command_mask |= ARLAN_COMMAND_INT_RACK;   
-//              priv->waiting_command_mask |= ARLAN_COMMAND_INT_ENABLE; 
-                priv->waiting_command_mask |= ARLAN_COMMAND_CONF_WAIT;
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_CONF_WAIT)
-        {
-                if (READSHMB(arlan->configuredStatusFlag) != 0 &&
-                        READSHMB(arlan->diagnosticInfo) == 0xff)
-                {
-                        priv->waiting_command_mask &= ~ARLAN_COMMAND_CONF_WAIT;
-                        priv->waiting_command_mask |= ARLAN_COMMAND_RX;
-                        priv->waiting_command_mask |= ARLAN_COMMAND_TBUSY_CLEAR;
-                        priv->card_polling_interval = HZ / 10;
-                        priv->tx_command_given = 0;
-                        priv->under_config = 0;
-                }
-                else
-                {
-                        priv->card_polling_interval = 1;
-                        if (arlan_debug & ARLAN_DEBUG_TIMING)
-                                printk(KERN_ERR "configure delayed \n");
-                }
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_RX)
-        {
-                if (!registrationBad(dev))
-                {
-                        setInterruptEnable(dev);
-                        memset_io(arlan->commandParameter, 0, 0xf);
-                        WRITESHMB(arlan->commandByte, ARLAN_COM_INT | ARLAN_COM_RX_ENABLE);
-                        WRITESHMB(arlan->commandParameter[0], conf->rxParameter);
-                        arlan_interrupt_lancpu(dev);
-                        priv->rx_command_given = 0; // mnjah, bad
-                        priv->waiting_command_mask &= ~ARLAN_COMMAND_RX;
-                        priv->card_polling_interval = 1;
-                }
-                else
-                        priv->card_polling_interval = 2;
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_TBUSY_CLEAR)
-        {
-                if ( !registrationBad(dev) &&
-                     (netif_queue_stopped(dev) || !netif_running(dev)) )
-                        {
-                                priv->waiting_command_mask &= ~ARLAN_COMMAND_TBUSY_CLEAR;
-                                netif_wake_queue (dev);
-                        }
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_TX)
-        {
-                if (!test_and_set_bit(0, (void *) &priv->tx_command_given))
-                {
-                        if (time_after(jiffies, 
-                                       priv->tx_last_sent + us2ticks(conf->rx_tweak1))
-                            || time_before(jiffies,
-                                           priv->last_rx_int_ack_time + us2ticks(conf->rx_tweak2)))
-                        {
-                                setInterruptEnable(dev);
-                                memset_io(arlan->commandParameter, 0, 0xf);
-                                WRITESHMB(arlan->commandByte, ARLAN_COM_TX_ENABLE | ARLAN_COM_INT);
-                                memcpy_toio(arlan->commandParameter, &TXLAST(dev), 14);
-//                              for ( i=1 ; i < 15 ; i++) printk("%02x:",READSHMB(arlan->commandParameter[i]));
-                                priv->tx_last_sent = jiffies;
-                                arlan_interrupt_lancpu(dev);
-                                priv->tx_command_given = 1;
-                                priv->waiting_command_mask &= ~ARLAN_COMMAND_TX;
-                                priv->card_polling_interval = 1;
-                        }
-                        else
-                        {
-                                priv->tx_command_given = 0;
-                                priv->card_polling_interval = 1;
-                        }
-                } 
-                else if (arlan_debug & ARLAN_DEBUG_CHAIN_LOCKS)
-                        printk(KERN_ERR "tx command when tx chain locked \n");
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_NOOPINT)
-        {
-                {
-                        WRITESHMB(arlan->commandByte, ARLAN_COM_NOP | ARLAN_COM_INT);
-                }
-                arlan_interrupt_lancpu(dev);
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_NOOPINT;
-                priv->card_polling_interval = HZ / 3;
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_NOOP)
-        {
-                WRITESHMB(arlan->commandByte, ARLAN_COM_NOP);
-                arlan_interrupt_lancpu(dev);
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_NOOP;
-                priv->card_polling_interval = HZ / 3;
-        }
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_SLOW_POLL)
-        {
-                WRITESHMB(arlan->commandByte, ARLAN_COM_GOTO_SLOW_POLL);
-                arlan_interrupt_lancpu(dev);
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_SLOW_POLL;
-                priv->card_polling_interval = HZ / 3;
-        } 
-        else if (priv->waiting_command_mask & ARLAN_COMMAND_POWERDOWN)
-        {
-                setPowerOff(dev);
-                if (arlan_debug & ARLAN_DEBUG_CARD_STATE)
-                        printk(KERN_WARNING "%s: Arlan Going Standby\n", dev->name);
-                priv->waiting_command_mask &= ~ARLAN_COMMAND_POWERDOWN;
-                priv->card_polling_interval = 3 * HZ;
-        }
-        arlan_unlock_card_access(dev);
-        for (i = 0; READSHMB(arlan->commandByte) && i < 20; i++)
-                udelay(10);
-        if (READSHMB(arlan->commandByte))
-                if (arlan_debug & ARLAN_DEBUG_CARD_STATE)
-                        printk(KERN_ERR "card busy leaving command %lx\n", priv->waiting_command_mask);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-        ARLAN_DEBUG_EXIT("arlan_command");
-        priv->last_command_buff_free_time = jiffies;
-        return 0;
-
-card_busy_end:
-        if (time_after(jiffies, priv->last_command_buff_free_time + HZ))
-                priv->waiting_command_mask |= ARLAN_COMMAND_CLEAN_AND_RESET;
-
-        if (arlan_debug & ARLAN_DEBUG_CARD_STATE)
-                printk(KERN_ERR "%s arlan_command card busy end \n", dev->name);
-        spin_unlock_irqrestore(&priv->lock, flags);
-        ARLAN_DEBUG_EXIT("arlan_command");
-        return 1;
-
-bad_end:
-        printk(KERN_ERR "%s arlan_command bad end \n", dev->name);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-        ARLAN_DEBUG_EXIT("arlan_command");
-
-        return -1;
-}
-
-static inline void arlan_command_process(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-
-        int times = 0;
-        while (priv->waiting_command_mask && times < 8)
-        {
-                if (priv->waiting_command_mask)
-                {
-                        if (arlan_command(dev, 0))
-                                break;
-                        times++;
-                }
-                /* if long command, we won't repeat trying */ ;
-                if (priv->card_polling_interval > 1)
-                        break;
-                times++;
-        }
-}
-
-
-static inline void arlan_retransmit_now(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-
-
-        ARLAN_DEBUG_ENTRY("arlan_retransmit_now");
-        if (TXLAST(dev).offset == 0)
-        {
-                if (TXHEAD(dev).offset)
-                {
-                        priv->txLast = 0;
-                        IFDEBUG(ARLAN_DEBUG_TX_CHAIN) printk(KERN_DEBUG "TX buff switch to head \n");
-
-                }
-                else if (TXTAIL(dev).offset)
-                {
-                        IFDEBUG(ARLAN_DEBUG_TX_CHAIN) printk(KERN_DEBUG "TX buff switch to tail \n");
-                        priv->txLast = 1;
-                }
-                else
-                        IFDEBUG(ARLAN_DEBUG_TX_CHAIN) printk(KERN_ERR "ReTransmit buff empty");
-                netif_wake_queue (dev);
-                return;
-
-        }
-        arlan_command(dev, ARLAN_COMMAND_TX);
-
-        priv->Conf->driverRetransmissions++;
-        priv->retransmissions++;
-
-        IFDEBUG(ARLAN_DEBUG_TX_CHAIN) printk("Retransmit %d bytes \n", TXLAST(dev).length);
-
-        ARLAN_DEBUG_EXIT("arlan_retransmit_now");
-}
-
-
-
-static void arlan_registration_timer(unsigned long data)
-{
-        struct net_device *dev = (struct net_device *) data;
-        struct arlan_private *priv = netdev_priv(dev);
-        int bh_mark_needed = 0;
-        int next_tick = 1;
-        long lostTime = ((long)jiffies - (long)priv->registrationLastSeen)
-                        * (1000/HZ);
-
-        if (registrationBad(dev))
-        {
-                priv->registrationLostCount++;
-                if (lostTime > 7000 && lostTime < 7200)
-                {
-                        printk(KERN_NOTICE "%s registration Lost \n", dev->name);
-                }
-                if (lostTime / priv->reRegisterExp > 2000)
-                        arlan_command(dev, ARLAN_COMMAND_CLEAN_AND_CONF);
-                if (lostTime / (priv->reRegisterExp) > 3500)
-                        arlan_command(dev, ARLAN_COMMAND_CLEAN_AND_RESET);
-                if (priv->reRegisterExp < 400)
-                        priv->reRegisterExp += 2;
-                if (lostTime > 7200)
-                {
-                        next_tick = HZ;
-                        arlan_command(dev, ARLAN_COMMAND_CLEAN_AND_RESET);
-                }
-        }
-        else
-        {
-                if (priv->Conf->registrationMode && lostTime > 10000 &&
-                        priv->registrationLostCount)
-                {
-                        printk(KERN_NOTICE "%s registration is back after %ld milliseconds\n",
-                               dev->name, lostTime);
-                }
-                priv->registrationLastSeen = jiffies;
-                priv->registrationLostCount = 0;
-                priv->reRegisterExp = 1;
-                if (!netif_running(dev) )
-                        netif_wake_queue(dev);
-                if (time_after(priv->tx_last_sent,priv->tx_last_cleared) &&
-                    time_after(jiffies, priv->tx_last_sent * 5*HZ) ){
-                        arlan_command(dev, ARLAN_COMMAND_CLEAN_AND_RESET);              
-                        priv->tx_last_cleared = jiffies;
-                }
-        }
-
-
-        if (!registrationBad(dev) && priv->ReTransmitRequested)
-        {
-                IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
-                        printk(KERN_ERR "Retransmit from timer \n");
-                priv->ReTransmitRequested = 0;
-                arlan_retransmit_now(dev);
-        }
-        if (!registrationBad(dev) &&
-                time_after(jiffies, priv->tx_done_delayed) &&
-                priv->tx_done_delayed != 0)
-        {
-                TXLAST(dev).offset = 0;
-                if (priv->txLast)
-                        priv->txLast = 0;
-                else if (TXTAIL(dev).offset)
-                        priv->txLast = 1;
-                if (TXLAST(dev).offset)
-                {
-                        arlan_retransmit_now(dev);
-                        dev->trans_start = jiffies;
-                }
-                if (!(TXHEAD(dev).offset && TXTAIL(dev).offset))
-                {
-                        netif_wake_queue (dev);
-                }
-                priv->tx_done_delayed = 0;
-                bh_mark_needed = 1;
-        }
-        if (bh_mark_needed)
-        {
-                netif_wake_queue (dev);
-        }
-        arlan_process_interrupt(dev);
-
-        if (next_tick < priv->card_polling_interval)
-                next_tick = priv->card_polling_interval;
-
-        priv->timer.expires = jiffies + next_tick;
-
-        add_timer(&priv->timer);
-}
-
-
-#ifdef ARLAN_DEBUGGING
-
-static void arlan_print_registers(struct net_device *dev, int line)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem *arlan = priv->card;
-
-        u_char hostcpuLock, lancpuLock, controlRegister, cntrlRegImage,
-                txStatus, rxStatus, interruptInProgress, commandByte;
-
-
-        ARLAN_DEBUG_ENTRY("arlan_print_registers");
-        READSHM(interruptInProgress, arlan->interruptInProgress, u_char);
-        READSHM(hostcpuLock, arlan->hostcpuLock, u_char);
-        READSHM(lancpuLock, arlan->lancpuLock, u_char);
-        READSHM(controlRegister, arlan->controlRegister, u_char);
-        READSHM(cntrlRegImage, arlan->cntrlRegImage, u_char);
-        READSHM(txStatus, arlan->txStatus, u_char);
-        READSHM(rxStatus, arlan->rxStatus, u_char);
-        READSHM(commandByte, arlan->commandByte, u_char);
-
-        printk(KERN_WARNING "line %04d IP %02x HL %02x LL %02x CB %02x CR %02x CRI %02x TX %02x RX %02x\n",
-                line, interruptInProgress, hostcpuLock, lancpuLock, commandByte,
-                controlRegister, cntrlRegImage, txStatus, rxStatus);
-
-        ARLAN_DEBUG_EXIT("arlan_print_registers");
-}
-#endif
-
-
-static int arlan_hw_tx(struct net_device *dev, char *buf, int length)
-{
-        int i;
-
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-        struct arlan_conf_stru *conf = priv->Conf;
-
-        int tailStarts = 0x800;
-        int headEnds = 0x0;
-
-
-        ARLAN_DEBUG_ENTRY("arlan_hw_tx");
-        if (TXHEAD(dev).offset)
-                headEnds = (((TXHEAD(dev).offset + TXHEAD(dev).length - offsetof(struct arlan_shmem, txBuffer)) / 64) + 1) * 64;
-        if (TXTAIL(dev).offset)
-                tailStarts = 0x800 - (((TXTAIL(dev).offset - offsetof(struct arlan_shmem, txBuffer)) / 64) + 2) * 64;
-
-
-        if (!TXHEAD(dev).offset && length < tailStarts)
-        {
-                IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
-                        printk(KERN_ERR "TXHEAD insert, tailStart %d\n", tailStarts);
-
-                TXHEAD(dev).offset =
-                        offsetof(struct arlan_shmem, txBuffer);
-                TXHEAD(dev).length = length - ARLAN_FAKE_HDR_LEN;
-                for (i = 0; i < 6; i++)
-                        TXHEAD(dev).dest[i] = buf[i];
-                TXHEAD(dev).clear = conf->txClear;
-                TXHEAD(dev).retries = conf->txRetries;  /* 0 is use default */
-                TXHEAD(dev).routing = conf->txRouting;
-                TXHEAD(dev).scrambled = conf->txScrambled;
-                memcpy_toio((char __iomem *)arlan + TXHEAD(dev).offset, buf + ARLAN_FAKE_HDR_LEN, TXHEAD(dev).length);
-        }
-        else if (!TXTAIL(dev).offset && length < (0x800 - headEnds))
-        {
-                IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
-                        printk(KERN_ERR "TXTAIL insert, headEnd %d\n", headEnds);
-
-                TXTAIL(dev).offset =
-                        offsetof(struct arlan_shmem, txBuffer) + 0x800 - (length / 64 + 2) * 64;
-                TXTAIL(dev).length = length - ARLAN_FAKE_HDR_LEN;
-                for (i = 0; i < 6; i++)
-                        TXTAIL(dev).dest[i] = buf[i];
-                TXTAIL(dev).clear = conf->txClear;
-                TXTAIL(dev).retries = conf->txRetries;
-                TXTAIL(dev).routing = conf->txRouting;
-                TXTAIL(dev).scrambled = conf->txScrambled;
-                memcpy_toio(((char __iomem *)arlan + TXTAIL(dev).offset), buf + ARLAN_FAKE_HDR_LEN, TXTAIL(dev).length);
-        }
-        else
-        {
-                netif_stop_queue (dev);
-                IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
-                        printk(KERN_ERR "TX TAIL & HEAD full, return, tailStart %d headEnd %d\n", tailStarts, headEnds);
-                return -1;
-        }
-        priv->out_bytes += length;
-        priv->out_bytes10 += length;
-        if (conf->measure_rate < 1)
-                conf->measure_rate = 1;
-        if (time_after(jiffies, priv->out_time + conf->measure_rate * HZ))
-        {
-                conf->out_speed = priv->out_bytes / conf->measure_rate;
-                priv->out_bytes = 0;
-                priv->out_time = jiffies;
-        }
-        if (time_after(jiffies, priv->out_time10 + conf->measure_rate * 10*HZ))
-        {
-                conf->out_speed10 = priv->out_bytes10 / (10 * conf->measure_rate);
-                priv->out_bytes10 = 0;
-                priv->out_time10 = jiffies;
-        }
-        if (TXHEAD(dev).offset && TXTAIL(dev).offset)
-        {
-                netif_stop_queue (dev);
-                return 0;
-        }
-        else
-                netif_start_queue (dev);
-
-
-        IFDEBUG(ARLAN_DEBUG_HEADER_DUMP)
-                printk(KERN_WARNING "%s Transmit t %2x:%2x:%2x:%2x:%2x:%2x f %2x:%2x:%2x:%2x:%2x:%2x \n", dev->name,
-                   (unsigned char) buf[0], (unsigned char) buf[1], (unsigned char) buf[2], (unsigned char) buf[3],
-                   (unsigned char) buf[4], (unsigned char) buf[5], (unsigned char) buf[6], (unsigned char) buf[7],
-                   (unsigned char) buf[8], (unsigned char) buf[9], (unsigned char) buf[10], (unsigned char) buf[11]);
-
-        IFDEBUG(ARLAN_DEBUG_TX_CHAIN) printk(KERN_ERR "TX command prepare for buffer %d\n", priv->txLast);
-
-        arlan_command(dev, ARLAN_COMMAND_TX);
-
-        priv->tx_last_sent = jiffies;
-
-        IFDEBUG(ARLAN_DEBUG_TX_CHAIN) printk("%s TX Qued %d bytes \n", dev->name, length);
-
-        ARLAN_DEBUG_EXIT("arlan_hw_tx");
-
-        return 0;
-}
-
-
-static int arlan_hw_config(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-        struct arlan_conf_stru *conf = priv->Conf;
-
-        ARLAN_DEBUG_ENTRY("arlan_hw_config");
-
-        printk(KERN_NOTICE "%s arlan configure called \n", dev->name);
-        if (arlan_EEPROM_bad)
-                printk(KERN_NOTICE "arlan configure with eeprom bad option \n");
-
-
-        WRITESHM(arlan->spreadingCode, conf->spreadingCode, u_char);
-        WRITESHM(arlan->channelSet, conf->channelSet, u_char);
-
-        if (arlan_EEPROM_bad)
-                WRITESHM(arlan->defaultChannelSet, conf->channelSet, u_char);
-
-        WRITESHM(arlan->channelNumber, conf->channelNumber, u_char);
-
-        WRITESHM(arlan->scramblingDisable, conf->scramblingDisable, u_char);
-        WRITESHM(arlan->txAttenuation, conf->txAttenuation, u_char);
-
-        WRITESHM(arlan->systemId, conf->systemId, u_int);
-
-        WRITESHM(arlan->maxRetries, conf->maxRetries, u_char);
-        WRITESHM(arlan->receiveMode, conf->receiveMode, u_char);
-        WRITESHM(arlan->priority, conf->priority, u_char);
-        WRITESHM(arlan->rootOrRepeater, conf->rootOrRepeater, u_char);
-        WRITESHM(arlan->SID, conf->SID, u_int);
-
-        WRITESHM(arlan->registrationMode, conf->registrationMode, u_char);
-
-        WRITESHM(arlan->registrationFill, conf->registrationFill, u_char);
-        WRITESHM(arlan->localTalkAddress, conf->localTalkAddress, u_char);
-        WRITESHM(arlan->codeFormat, conf->codeFormat, u_char);
-        WRITESHM(arlan->numChannels, conf->numChannels, u_char);
-        WRITESHM(arlan->channel1, conf->channel1, u_char);
-        WRITESHM(arlan->channel2, conf->channel2, u_char);
-        WRITESHM(arlan->channel3, conf->channel3, u_char);
-        WRITESHM(arlan->channel4, conf->channel4, u_char);
-        WRITESHM(arlan->radioNodeId, conf->radioNodeId, u_short);
-        WRITESHM(arlan->SID, conf->SID, u_int);
-        WRITESHM(arlan->waitTime, conf->waitTime, u_short);
-        WRITESHM(arlan->lParameter, conf->lParameter, u_short);
-        memcpy_toio(&(arlan->_15), &(conf->_15), 3);
-        WRITESHM(arlan->_15, conf->_15, u_short);
-        WRITESHM(arlan->headerSize, conf->headerSize, u_short);
-        if (arlan_EEPROM_bad)
-                WRITESHM(arlan->hardwareType, conf->hardwareType, u_char);
-        WRITESHM(arlan->radioType, conf->radioType, u_char);
-        if (arlan_EEPROM_bad)
-                WRITESHM(arlan->radioModule, conf->radioType, u_char);
-
-        memcpy_toio(arlan->encryptionKey + keyStart, encryptionKey, 8);
-        memcpy_toio(arlan->name, conf->siteName, 16);
-
-        WRITESHMB(arlan->commandByte, ARLAN_COM_INT | ARLAN_COM_CONF);  /* do configure */
-        memset_io(arlan->commandParameter, 0, 0xf);     /* 0xf */
-        memset_io(arlan->commandParameter + 1, 0, 2);
-        if (conf->writeEEPROM)
-        {
-                  memset_io(arlan->commandParameter, conf->writeEEPROM, 1);
-//              conf->writeEEPROM=0;
-        }
-        if (conf->registrationMode && conf->registrationInterrupts)
-                memset_io(arlan->commandParameter + 3, 1, 1);
-        else
-                memset_io(arlan->commandParameter + 3, 0, 1);
-
-        priv->irq_test_done = 0;
-
-        if (conf->tx_queue_len)
-                dev->tx_queue_len = conf->tx_queue_len;
-        udelay(100);
-
-        ARLAN_DEBUG_EXIT("arlan_hw_config");
-        return 0;
-}
-
-
-static int arlan_read_card_configuration(struct net_device *dev)
-{
-        u_char tlx415;
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-        struct arlan_conf_stru *conf = priv->Conf;
-
-        ARLAN_DEBUG_ENTRY("arlan_read_card_configuration");
-
-        if (radioNodeId == radioNodeIdUNKNOWN)
-        {
-                READSHM(conf->radioNodeId, arlan->radioNodeId, u_short);
-        }
-        else
-                conf->radioNodeId = radioNodeId;
-                
-        if (SID == SIDUNKNOWN)
-        {
-                READSHM(conf->SID, arlan->SID, u_int);
-        }
-        else conf->SID = SID;
-                
-        if (spreadingCode == spreadingCodeUNKNOWN)
-        {
-                  READSHM(conf->spreadingCode, arlan->spreadingCode, u_char);
-        }
-        else
-                conf->spreadingCode = spreadingCode;
-                
-        if (channelSet == channelSetUNKNOWN)
-        {
-                READSHM(conf->channelSet, arlan->channelSet, u_char);
-        }
-        else conf->channelSet = channelSet;
-
-        if (channelNumber == channelNumberUNKNOWN)
-        {
-                READSHM(conf->channelNumber, arlan->channelNumber, u_char);
-        }
-        else conf->channelNumber = channelNumber;
-        
-        READSHM(conf->scramblingDisable, arlan->scramblingDisable, u_char);
-        READSHM(conf->txAttenuation, arlan->txAttenuation, u_char);
-        
-        if (systemId == systemIdUNKNOWN)
-        {
-                READSHM(conf->systemId, arlan->systemId, u_int);
-        } 
-        else conf->systemId = systemId;
-        
-        READSHM(conf->maxDatagramSize, arlan->maxDatagramSize, u_short);
-        READSHM(conf->maxFrameSize, arlan->maxFrameSize, u_short);
-        READSHM(conf->maxRetries, arlan->maxRetries, u_char);
-        READSHM(conf->receiveMode, arlan->receiveMode, u_char);
-        READSHM(conf->priority, arlan->priority, u_char);
-        READSHM(conf->rootOrRepeater, arlan->rootOrRepeater, u_char);
-
-        if (SID == SIDUNKNOWN)
-        {
-                  READSHM(conf->SID, arlan->SID, u_int);
-        }
-        else conf->SID = SID;
-        
-        if (registrationMode == registrationModeUNKNOWN)
-        {
-                  READSHM(conf->registrationMode, arlan->registrationMode, u_char);
-        }
-        else conf->registrationMode = registrationMode;
-        
-        READSHM(conf->registrationFill, arlan->registrationFill, u_char);
-        READSHM(conf->localTalkAddress, arlan->localTalkAddress, u_char);
-        READSHM(conf->codeFormat, arlan->codeFormat, u_char);
-        READSHM(conf->numChannels, arlan->numChannels, u_char);
-        READSHM(conf->channel1, arlan->channel1, u_char);
-        READSHM(conf->channel2, arlan->channel2, u_char);
-        READSHM(conf->channel3, arlan->channel3, u_char);
-        READSHM(conf->channel4, arlan->channel4, u_char);
-        READSHM(conf->waitTime, arlan->waitTime, u_short);
-        READSHM(conf->lParameter, arlan->lParameter, u_short);
-        READSHM(conf->_15, arlan->_15, u_short);
-        READSHM(conf->headerSize, arlan->headerSize, u_short);
-        READSHM(conf->hardwareType, arlan->hardwareType, u_char);
-        READSHM(conf->radioType, arlan->radioModule, u_char);
-        
-        if (conf->radioType == 0)
-                conf->radioType = 0xc;
-
-        WRITESHM(arlan->configStatus, 0xA5, u_char);
-        READSHM(tlx415, arlan->configStatus, u_char);
-        
-        if (tlx415 != 0xA5)
-                printk(KERN_INFO "%s tlx415 chip \n", dev->name);
-        
-        conf->txClear = 0;
-        conf->txRetries = 1;
-        conf->txRouting = 1;
-        conf->txScrambled = 0;
-        conf->rxParameter = 1;
-        conf->txTimeoutMs = 4000;
-        conf->waitCardTimeout = 100000;
-        conf->receiveMode = ARLAN_RCV_CLEAN;
-        memcpy_fromio(conf->siteName, arlan->name, 16);
-        conf->siteName[16] = '\0';
-        conf->retries = retries;
-        conf->tx_delay_ms = tx_delay_ms;
-        conf->ReTransmitPacketMaxSize = 200;
-        conf->waitReTransmitPacketMaxSize = 200;
-        conf->txAckTimeoutMs = 900;
-        conf->fastReTransCount = 3;
-
-        ARLAN_DEBUG_EXIT("arlan_read_card_configuration");
-
-        return 0;
-}
-
-
-static int lastFoundAt = 0xbe000;
-
-
-/*
- * This is the real probe routine. Linux has a history of friendly device
- * probes on the ISA bus. A good device probes avoids doing writes, and
- * verifies that the correct device exists and functions.
- */
-#define ARLAN_SHMEM_SIZE        0x2000
-static int __init arlan_check_fingerprint(unsigned long memaddr)
-{
-        static const char probeText[] = "TELESYSTEM SLW INC.    ARLAN \0";
-        volatile struct arlan_shmem __iomem *arlan = (struct arlan_shmem *) memaddr;
-        unsigned long paddr = virt_to_phys((void *) memaddr);
-        char tempBuf[49];
-
-        ARLAN_DEBUG_ENTRY("arlan_check_fingerprint");
-
-        if (!request_mem_region(paddr, ARLAN_SHMEM_SIZE, "arlan")) {
-                // printk(KERN_WARNING "arlan: memory region %lx excluded from probing \n",paddr);
-                return -ENODEV;
-        }
-
-        memcpy_fromio(tempBuf, arlan->textRegion, 29);
-        tempBuf[30] = 0;
-
-        /* check for card at this address */
-        if (0 != strncmp(tempBuf, probeText, 29)){
-                release_mem_region(paddr, ARLAN_SHMEM_SIZE);
-                return -ENODEV;
-        }
-
-//   printk(KERN_INFO "arlan found at 0x%x \n",memaddr);
-        ARLAN_DEBUG_EXIT("arlan_check_fingerprint");
-
-        return 0;
-}
-
-static int arlan_change_mtu(struct net_device *dev, int new_mtu)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-        struct arlan_conf_stru *conf = priv->Conf;
-
-        ARLAN_DEBUG_ENTRY("arlan_change_mtu");
-        if (new_mtu > 2032)
-                return -EINVAL;
-        dev->mtu = new_mtu;
-        if (new_mtu < 256)
-                new_mtu = 256;  /* cards book suggests 1600 */
-        conf->maxDatagramSize = new_mtu;
-        conf->maxFrameSize = new_mtu + 48;
-
-        arlan_command(dev, ARLAN_COMMAND_CLEAN_AND_CONF);
-        printk(KERN_NOTICE "%s mtu changed to %d \n", dev->name, new_mtu);
-
-        ARLAN_DEBUG_EXIT("arlan_change_mtu");
-
-        return 0;
-}
-
-static int arlan_mac_addr(struct net_device *dev, void *p)
-{
-        struct sockaddr *addr = p;
-
-
-        ARLAN_DEBUG_ENTRY("arlan_mac_addr");
-        return -EINVAL;
-
-        if (netif_running(dev))
-                return -EBUSY;
-        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
-
-        ARLAN_DEBUG_EXIT("arlan_mac_addr");
-        return 0;
-}
-
-static const struct net_device_ops arlan_netdev_ops = {
-        .ndo_open               = arlan_open,
-        .ndo_stop               = arlan_close,
-        .ndo_start_xmit         = arlan_tx,
-        .ndo_get_stats          = arlan_statistics,
-        .ndo_set_multicast_list = arlan_set_multicast,
-        .ndo_change_mtu         = arlan_change_mtu,
-        .ndo_set_mac_address    = arlan_mac_addr,
-        .ndo_tx_timeout         = arlan_tx_timeout,
-        .ndo_validate_addr      = eth_validate_addr,
-};
-
-static int __init arlan_setup_device(struct net_device *dev, int num)
-{
-        struct arlan_private *ap = netdev_priv(dev);
-        int err;
-
-        ARLAN_DEBUG_ENTRY("arlan_setup_device");
-
-        ap->conf = (struct arlan_shmem *)(ap+1);
-
-        dev->tx_queue_len = tx_queue_len;
-        dev->netdev_ops = &arlan_netdev_ops;
-        dev->watchdog_timeo = 3*HZ;
-        
-        ap->irq_test_done = 0;
-        ap->Conf = &arlan_conf[num];
-
-        ap->Conf->pre_Command_Wait = 40;
-        ap->Conf->rx_tweak1 = 30;
-        ap->Conf->rx_tweak2 = 0;
-
-
-        err = register_netdev(dev);
-        if (err) {
-                release_mem_region(virt_to_phys((void *) dev->mem_start), 
-                           ARLAN_SHMEM_SIZE);
-                free_netdev(dev);
-                return err;
-        }
-        arlan_device[num] = dev;
-        ARLAN_DEBUG_EXIT("arlan_setup_device");
-        return 0;
-}
-
-static int __init arlan_probe_here(struct net_device *dev, 
-                                   unsigned long memaddr)
-{
-        struct arlan_private *ap = netdev_priv(dev);
-
-        ARLAN_DEBUG_ENTRY("arlan_probe_here");
-
-        if (arlan_check_fingerprint(memaddr))
-                return -ENODEV;
-
-        printk(KERN_NOTICE "%s: Arlan found at %llx, \n ", dev->name, 
-               (u64) virt_to_phys((void*)memaddr));
-
-        ap->card = (void *) memaddr;
-        dev->mem_start = memaddr;
-        dev->mem_end = memaddr + ARLAN_SHMEM_SIZE-1;
-
-        if (dev->irq < 2)
-        {
-                READSHM(dev->irq, ap->card->irqLevel, u_char);
-        } else if (dev->irq == 2)
-                dev->irq = 9;
-
-        arlan_read_card_configuration(dev);
-
-        ARLAN_DEBUG_EXIT("arlan_probe_here");
-        return 0;
-}
-
-
-static int arlan_open(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-        int ret = 0;
-
-        ARLAN_DEBUG_ENTRY("arlan_open");
-
-        ret = request_irq(dev->irq, &arlan_interrupt, 0, dev->name, dev);
-        if (ret)
-        {
-                printk(KERN_ERR "%s: unable to get IRQ %d .\n",
-                        dev->name, dev->irq);
-                return ret;
-        }
-
-
-        priv->bad = 0;
-        priv->lastReset = 0;
-        priv->reset = 0;
-        memcpy_fromio(dev->dev_addr, arlan->lanCardNodeId, 6);
-        memset(dev->broadcast, 0xff, 6);
-        dev->tx_queue_len = tx_queue_len;
-        priv->interrupt_processing_active = 0;
-        spin_lock_init(&priv->lock);
-
-        netif_start_queue (dev);
-
-        priv->registrationLostCount = 0;
-        priv->registrationLastSeen = jiffies;
-        priv->txLast = 0;
-        priv->tx_command_given = 0;
-        priv->rx_command_given = 0;
-        
-        priv->reRegisterExp = 1;
-        priv->tx_last_sent = jiffies - 1;
-        priv->tx_last_cleared = jiffies;
-        priv->Conf->writeEEPROM = 0;
-        priv->Conf->registrationInterrupts = 1;
-
-        init_timer(&priv->timer);
-        priv->timer.expires = jiffies + HZ / 10;
-        priv->timer.data = (unsigned long) dev;
-        priv->timer.function = &arlan_registration_timer;       /* timer handler */
-
-        arlan_command(dev, ARLAN_COMMAND_POWERUP | ARLAN_COMMAND_LONG_WAIT_NOW);
-        mdelay(200);
-        add_timer(&priv->timer);
-
-        ARLAN_DEBUG_EXIT("arlan_open");
-        return 0;
-}
-
-
-static void arlan_tx_timeout (struct net_device *dev)
-{
-        printk(KERN_ERR "%s: arlan transmit timed out, kernel decided\n", dev->name);
-        /* Try to restart the adaptor. */
-        arlan_command(dev, ARLAN_COMMAND_CLEAN_AND_RESET);
-        // dev->trans_start = jiffies;
-        // netif_start_queue (dev);
-}
-
-
-static netdev_tx_t arlan_tx(struct sk_buff *skb, struct net_device *dev)
-{
-        short length;
-        unsigned char *buf;
-
-        ARLAN_DEBUG_ENTRY("arlan_tx");
-        
-        length = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
-        buf = skb->data;
-
-        if (length + 0x12 > 0x800) {
-                printk(KERN_ERR "TX RING overflow \n");
-                netif_stop_queue (dev);
-        }
-
-        if (arlan_hw_tx(dev, buf, length) == -1)
-                goto bad_end;
-
-        dev->trans_start = jiffies;
-
-        dev_kfree_skb(skb);
-
-        arlan_process_interrupt(dev);
-        ARLAN_DEBUG_EXIT("arlan_tx");
-        return NETDEV_TX_OK;
-
-bad_end:
-        arlan_process_interrupt(dev);
-        netif_stop_queue (dev);
-        ARLAN_DEBUG_EXIT("arlan_tx");
-        return NETDEV_TX_BUSY;
-}
-
-
-static inline int DoNotReTransmitCrap(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-
-        if (TXLAST(dev).length < priv->Conf->ReTransmitPacketMaxSize)
-                return 1;
-        return 0;
-
-}
-
-static inline int DoNotWaitReTransmitCrap(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-
-        if (TXLAST(dev).length < priv->Conf->waitReTransmitPacketMaxSize)
-                return 1;
-        return 0;
-}
-
-static inline void arlan_queue_retransmit(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-
-        ARLAN_DEBUG_ENTRY("arlan_queue_retransmit");
-
-        if (DoNotWaitReTransmitCrap(dev))
-        {
-                  arlan_drop_tx(dev);
-        } else
-                priv->ReTransmitRequested++;
-
-        ARLAN_DEBUG_EXIT("arlan_queue_retransmit");
-}
-
-static inline void RetryOrFail(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-
-        ARLAN_DEBUG_ENTRY("RetryOrFail");
-
-        if (priv->retransmissions > priv->Conf->retries ||
-            DoNotReTransmitCrap(dev))
-        {
-                arlan_drop_tx(dev);
-        }
-        else if (priv->bad <= priv->Conf->fastReTransCount)
-        {
-                arlan_retransmit_now(dev);
-        }
-        else arlan_queue_retransmit(dev);
-
-        ARLAN_DEBUG_EXIT("RetryOrFail");
-}
-
-
-static void arlan_tx_done_interrupt(struct net_device *dev, int status)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-
-        ARLAN_DEBUG_ENTRY("arlan_tx_done_interrupt");
-
-        priv->tx_last_cleared = jiffies;
-        priv->tx_command_given = 0;
-        switch (status)
-        {
-                case 1:
-                {
-                        IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
-                                printk("arlan intr: transmit OK\n");
-                        dev->stats.tx_packets++;
-                        priv->bad = 0;
-                        priv->reset = 0;
-                        priv->retransmissions = 0;
-                        if (priv->Conf->tx_delay_ms)
-                        {
-                                priv->tx_done_delayed = jiffies + (priv->Conf->tx_delay_ms * HZ) / 1000 + 1;
-                        }
-                        else
-                        {
-                                TXLAST(dev).offset = 0;
-                                if (priv->txLast)
-                                        priv->txLast = 0;
-                                else if (TXTAIL(dev).offset)
-                                        priv->txLast = 1;
-                                if (TXLAST(dev).offset)
-                                {
-                                        arlan_retransmit_now(dev);
-                                        dev->trans_start = jiffies;
-                                }
-                                if (!TXHEAD(dev).offset || !TXTAIL(dev).offset)
-                                {
-                                        netif_wake_queue (dev);
-                                }
-                        }
-                }
-                break;
-                
-                case 2:
-                {
-                        IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
-                                printk("arlan intr: transmit timed out\n");
-                        priv->bad += 1;
-                        //arlan_queue_retransmit(dev);
-                        RetryOrFail(dev);
-                }
-                break;
-
-                case 3:
-                {
-                        IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
-                                printk("arlan intr: transmit max retries\n");
-                        priv->bad += 1;
-                        priv->reset = 0;
-                        //arlan_queue_retransmit(dev);
-                        RetryOrFail(dev);
-                }
-                break;
-                
-                case 4:
-                {
-                        IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
-                                printk("arlan intr: transmit aborted\n");
-                        priv->bad += 1;
-                        arlan_queue_retransmit(dev);
-                        //RetryOrFail(dev);
-                }
-                break;
-
-                case 5:
-                {
-                        IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
-                                printk("arlan intr: transmit not registered\n");
-                        priv->bad += 1;
-                        //debug=101;
-                        arlan_queue_retransmit(dev);
-                }
-                break;
-
-                case 6:
-                {
-                        IFDEBUG(ARLAN_DEBUG_TX_CHAIN) 
-                                printk("arlan intr: transmit destination full\n");
-                        priv->bad += 1;
-                        priv->reset = 0;
-                        //arlan_drop_tx(dev);
-                        arlan_queue_retransmit(dev);
-                }
-                break;
-
-                case 7:
-                {
-                        IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
-                                printk("arlan intr: transmit unknown ack\n");
-                        priv->bad += 1;
-                        priv->reset = 0;
-                        arlan_queue_retransmit(dev);
-                }
-                break;
-                
-                case 8:
-                {
-                        IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
-                                printk("arlan intr: transmit dest mail box full\n");
-                        priv->bad += 1;
-                        priv->reset = 0;
-                        //arlan_drop_tx(dev);
-                        arlan_queue_retransmit(dev);
-                }
-                break;
-
-                case 9:
-                {
-                        IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
-                                printk("arlan intr: transmit root dest not reg.\n");
-                        priv->bad += 1;
-                        priv->reset = 1;
-                        //arlan_drop_tx(dev);
-                        arlan_queue_retransmit(dev);
-                }
-                break;
-
-                default:
-                {
-                        printk(KERN_ERR "arlan intr: transmit status unknown\n");
-                        priv->bad += 1;
-                        priv->reset = 1;
-                        arlan_drop_tx(dev);
-                }
-        }
-
-        ARLAN_DEBUG_EXIT("arlan_tx_done_interrupt");
-}
-
-
-static void arlan_rx_interrupt(struct net_device *dev, u_char rxStatus, u_short rxOffset, u_short pkt_len)
-{
-        char *skbtmp;
-        int i = 0;
-
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-        struct arlan_conf_stru *conf = priv->Conf;
-
-
-        ARLAN_DEBUG_ENTRY("arlan_rx_interrupt");
-        // by spec,   not                WRITESHMB(arlan->rxStatus,0x00);
-        // prohibited here              arlan_command(dev, ARLAN_COMMAND_RX);
-
-        if (pkt_len < 10 || pkt_len > 2048)
-        {
-                printk(KERN_WARNING "%s: got too short or long packet, len %d \n", dev->name, pkt_len);
-                return;
-        }
-        if (rxOffset + pkt_len > 0x2000)
-        {
-                printk("%s: got too long packet, len %d offset %x\n", dev->name, pkt_len, rxOffset);
-                return;
-        }
-        priv->in_bytes += pkt_len;
-        priv->in_bytes10 += pkt_len;
-        if (conf->measure_rate < 1)
-                conf->measure_rate = 1;
-        if (time_after(jiffies, priv->in_time + conf->measure_rate * HZ))
-        {
-                conf->in_speed = priv->in_bytes / conf->measure_rate;
-                priv->in_bytes = 0;
-                priv->in_time = jiffies;
-        }
-        if (time_after(jiffies, priv->in_time10 + conf->measure_rate * 10*HZ))
-        {
-                conf->in_speed10 = priv->in_bytes10 / (10 * conf->measure_rate);
-                priv->in_bytes10 = 0;
-                priv->in_time10 = jiffies;
-        }
-        DEBUGSHM(1, "arlan rcv pkt rxStatus= %d ", arlan->rxStatus, u_char);
-        switch (rxStatus)
-        {
-                case 1:
-                case 2:
-                case 3:
-                {
-                        /* Malloc up new buffer. */
-                        struct sk_buff *skb;
-
-                        DEBUGSHM(50, "arlan recv pkt offs=%d\n", arlan->rxOffset, u_short);
-                        DEBUGSHM(1, "arlan rxFrmType = %d \n", arlan->rxFrmType, u_char);
-                        DEBUGSHM(1, KERN_INFO "arlan rx scrambled = %d \n", arlan->scrambled, u_char);
-
-                        /* here we do multicast filtering to avoid slow 8-bit memcopy */
-#ifdef ARLAN_MULTICAST
-                        if (!(dev->flags & IFF_ALLMULTI) &&
-                                !(dev->flags & IFF_PROMISC) &&
-                                dev->mc_list)
-                        {
-                                char hw_dst_addr[6];
-                                struct dev_mc_list *dmi = dev->mc_list;
-                                int i;
-
-                                memcpy_fromio(hw_dst_addr, arlan->ultimateDestAddress, 6);
-                                if (hw_dst_addr[0] == 0x01)
-                                {
-                                        if (mdebug)
-                                                if (hw_dst_addr[1] == 0x00)
-                                                        printk(KERN_ERR "%s mcast 0x0100 \n", dev->name);
-                                                else if (hw_dst_addr[1] == 0x40)
-                                                        printk(KERN_ERR "%s m/bcast 0x0140 \n", dev->name);
-                                        while (dmi)
-                                        {
-                                                if (dmi->dmi_addrlen == 6) {
-                                                        if (arlan_debug & ARLAN_DEBUG_HEADER_DUMP)
-                                                                printk(KERN_ERR "%s mcl %pM\n",
-                                                                       dev->name, dmi->dmi_addr);
-                                                        for (i = 0; i < 6; i++)
-                                                                if (dmi->dmi_addr[i] != hw_dst_addr[i])
-                                                                        break;
-                                                        if (i == 6)
-                                                                break;
-                                                } else
-                                                        printk(KERN_ERR "%s: invalid multicast address length given.\n", dev->name);
-                                                dmi = dmi->next;
-                                        }
-                                        /* we reach here if multicast filtering is on and packet 
-                                         * is multicast and not for receive */
-                                        goto end_of_interrupt;
-                                }
-                        }
-#endif                          // ARLAN_MULTICAST
-                        /* multicast filtering ends here */
-                        pkt_len += ARLAN_FAKE_HDR_LEN;
-
-                        skb = dev_alloc_skb(pkt_len + 4);
-                        if (skb == NULL)
-                        {
-                                printk(KERN_ERR "%s: Memory squeeze, dropping packet.\n", dev->name);
-                                dev->stats.rx_dropped++;
-                                break;
-                        }
-                        skb_reserve(skb, 2);
-                        skbtmp = skb_put(skb, pkt_len);
-
-                        memcpy_fromio(skbtmp + ARLAN_FAKE_HDR_LEN, ((char __iomem *) arlan) + rxOffset, pkt_len - ARLAN_FAKE_HDR_LEN);
-                        memcpy_fromio(skbtmp, arlan->ultimateDestAddress, 6);
-                        memcpy_fromio(skbtmp + 6, arlan->rxSrc, 6);
-                        WRITESHMB(arlan->rxStatus, 0x00);
-                        arlan_command(dev, ARLAN_COMMAND_RX);
-
-                        IFDEBUG(ARLAN_DEBUG_HEADER_DUMP)
-                        {
-                                char immedDestAddress[6];
-                                char immedSrcAddress[6];
-                                memcpy_fromio(immedDestAddress, arlan->immedDestAddress, 6);
-                                memcpy_fromio(immedSrcAddress, arlan->immedSrcAddress, 6);
-
-                                printk(KERN_WARNING "%s t %pM f %pM imd %pM ims %pM\n",
-                                       dev->name, skbtmp,
-                                       &skbtmp[6],
-                                       immedDestAddress,
-                                       immedSrcAddress);
-                        }
-                        skb->protocol = eth_type_trans(skb, dev);
-                        IFDEBUG(ARLAN_DEBUG_HEADER_DUMP)
-                                if (skb->protocol != 0x608 && skb->protocol != 0x8)
-                                {
-                                        for (i = 0; i <= 22; i++)
-                                                printk("%02x:", (u_char) skbtmp[i + 12]);
-                                        printk(KERN_ERR "\n");
-                                        printk(KERN_WARNING "arlan kernel pkt type trans %x \n", skb->protocol);
-                                }
-                        netif_rx(skb);
-                        dev->stats.rx_packets++;
-                        dev->stats.rx_bytes += pkt_len;
-                }
-                break;
-                
-                default:
-                        printk(KERN_ERR "arlan intr: received unknown status\n");
-                        dev->stats.rx_crc_errors++;
-                        break;
-        }
-        ARLAN_DEBUG_EXIT("arlan_rx_interrupt");
-}
-
-static void arlan_process_interrupt(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-        u_char rxStatus = READSHMB(arlan->rxStatus);
-        u_char txStatus = READSHMB(arlan->txStatus);
-        u_short rxOffset = READSHMS(arlan->rxOffset);
-        u_short pkt_len = READSHMS(arlan->rxLength);
-        int interrupt_count = 0;
-
-        ARLAN_DEBUG_ENTRY("arlan_process_interrupt");
-
-        if (test_and_set_bit(0, (void *) &priv->interrupt_processing_active))
-        {
-                if (arlan_debug & ARLAN_DEBUG_CHAIN_LOCKS)
-                        printk(KERN_ERR "interrupt chain reentering \n");
-                goto end_int_process;
-        }
-        while ((rxStatus || txStatus || priv->interrupt_ack_requested)
-                        && (interrupt_count < 5))
-        {
-                if (rxStatus)
-                        priv->last_rx_int_ack_time = jiffies;
-
-                arlan_command(dev, ARLAN_COMMAND_INT_ACK);
-                arlan_command(dev, ARLAN_COMMAND_INT_ENABLE);
-                
-                IFDEBUG(ARLAN_DEBUG_INTERRUPT)
-                        printk(KERN_ERR "%s:  got IRQ rx %x tx %x comm %x rxOff %x rxLen %x \n",
-                                        dev->name, rxStatus, txStatus, READSHMB(arlan->commandByte),
-                                        rxOffset, pkt_len);
-
-                if (rxStatus == 0 && txStatus == 0)
-                {
-                        if (priv->irq_test_done)
-                        {
-                                if (!registrationBad(dev))
-                                        IFDEBUG(ARLAN_DEBUG_INTERRUPT) printk(KERN_ERR "%s unknown interrupt(nop? regLost ?) reason tx %d rx %d ",
-                                                                                    dev->name, txStatus, rxStatus);
-                        } else {
-                                IFDEBUG(ARLAN_DEBUG_INTERRUPT)
-                                        printk(KERN_INFO "%s irq $%d test OK \n", dev->name, dev->irq);
-
-                        }
-                        priv->interrupt_ack_requested = 0;
-                        goto ends;
-                }
-                if (txStatus != 0)
-                {
-                        WRITESHMB(arlan->txStatus, 0x00);
-                        arlan_tx_done_interrupt(dev, txStatus);
-                        goto ends;
-                }
-                if (rxStatus == 1 || rxStatus == 2)
-                {               /* a packet waiting */
-                        arlan_rx_interrupt(dev, rxStatus, rxOffset, pkt_len);
-                        goto ends;
-                }
-                if (rxStatus > 2 && rxStatus < 0xff)
-                {
-                        WRITESHMB(arlan->rxStatus, 0x00);
-                        printk(KERN_ERR "%s unknown rxStatus reason tx %d rx %d ",
-                                dev->name, txStatus, rxStatus);
-                        goto ends;
-                }
-                if (rxStatus == 0xff)
-                {
-                        WRITESHMB(arlan->rxStatus, 0x00);
-                        arlan_command(dev, ARLAN_COMMAND_RX);
-                        if (registrationBad(dev))
-                                netif_device_detach(dev);
-                        if (!registrationBad(dev))
-                        {
-                                priv->registrationLastSeen = jiffies;
-                                if (!netif_queue_stopped(dev) && !priv->under_reset && !priv->under_config)
-                                        netif_wake_queue (dev);
-                        }
-                        goto ends;
-                }
-ends:
-
-                arlan_command_process(dev);
-
-                rxStatus = READSHMB(arlan->rxStatus);
-                txStatus = READSHMB(arlan->txStatus);
-                rxOffset = READSHMS(arlan->rxOffset);
-                pkt_len = READSHMS(arlan->rxLength);
-
-
-                priv->irq_test_done = 1;
-
-                interrupt_count++;
-        }
-        priv->interrupt_processing_active = 0;
-
-end_int_process:
-        arlan_command_process(dev);
-
-        ARLAN_DEBUG_EXIT("arlan_process_interrupt");
-        return;
-}
-
-static irqreturn_t arlan_interrupt(int irq, void *dev_id)
-{
-        struct net_device *dev = dev_id;
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-        u_char rxStatus = READSHMB(arlan->rxStatus);
-        u_char txStatus = READSHMB(arlan->txStatus);
-
-        ARLAN_DEBUG_ENTRY("arlan_interrupt");
-
-
-        if (!rxStatus && !txStatus)
-                priv->interrupt_ack_requested++;
-
-        arlan_process_interrupt(dev);
-        
-        priv->irq_test_done = 1;
-
-        ARLAN_DEBUG_EXIT("arlan_interrupt");
-        return IRQ_HANDLED;
-
-}
-
-
-static int arlan_close(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-
-        ARLAN_DEBUG_ENTRY("arlan_close");
-
-        del_timer_sync(&priv->timer);
-
-        arlan_command(dev, ARLAN_COMMAND_POWERDOWN);
-
-        IFDEBUG(ARLAN_DEBUG_STARTUP)
-                printk(KERN_NOTICE "%s: Closing device\n", dev->name);
-
-        netif_stop_queue(dev);
-        free_irq(dev->irq, dev);
-
-        ARLAN_DEBUG_EXIT("arlan_close");
-        return 0;
-}
-
-#ifdef ARLAN_DEBUGGING
-static long alignLong(volatile u_char * ptr)
-{
-        long ret;
-        memcpy_fromio(&ret, (void *) ptr, 4);
-        return ret;
-}
-#endif
-
-/*
- * Get the current statistics.
- * This may be called with the card open or closed.
- */
-
-static struct net_device_stats *arlan_statistics(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-
-
-        ARLAN_DEBUG_ENTRY("arlan_statistics");
-
-        /* Update the statistics from the device registers. */
-
-        READSHM(dev->stats.collisions, arlan->numReTransmissions, u_int);
-        READSHM(dev->stats.rx_crc_errors, arlan->numCRCErrors, u_int);
-        READSHM(dev->stats.rx_dropped, arlan->numFramesDiscarded, u_int);
-        READSHM(dev->stats.rx_fifo_errors, arlan->numRXBufferOverflows, u_int);
-        READSHM(dev->stats.rx_frame_errors, arlan->numReceiveFramesLost, u_int);
-        READSHM(dev->stats.rx_over_errors, arlan->numRXOverruns, u_int);
-        READSHM(dev->stats.rx_packets, arlan->numDatagramsReceived, u_int);
-        READSHM(dev->stats.tx_aborted_errors, arlan->numAbortErrors, u_int);
-        READSHM(dev->stats.tx_carrier_errors, arlan->numStatusTimeouts, u_int);
-        READSHM(dev->stats.tx_dropped, arlan->numDatagramsDiscarded, u_int);
-        READSHM(dev->stats.tx_fifo_errors, arlan->numTXUnderruns, u_int);
-        READSHM(dev->stats.tx_packets, arlan->numDatagramsTransmitted, u_int);
-        READSHM(dev->stats.tx_window_errors, arlan->numHoldOffs, u_int);
-
-        ARLAN_DEBUG_EXIT("arlan_statistics");
-
-        return &dev->stats;
-}
-
-
-static void arlan_set_multicast(struct net_device *dev)
-{
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-        struct arlan_conf_stru *conf = priv->Conf;
-        int board_conf_needed = 0;
-
-
-        ARLAN_DEBUG_ENTRY("arlan_set_multicast");
-
-        if (dev->flags & IFF_PROMISC)
-        {
-                unsigned char recMode;
-                READSHM(recMode, arlan->receiveMode, u_char);
-                conf->receiveMode = (ARLAN_RCV_PROMISC | ARLAN_RCV_CONTROL);
-                if (conf->receiveMode != recMode)
-                        board_conf_needed = 1;
-        }
-        else
-        {
-                /* turn off promiscuous mode  */
-                unsigned char recMode;
-                READSHM(recMode, arlan->receiveMode, u_char);
-                conf->receiveMode = ARLAN_RCV_CLEAN | ARLAN_RCV_CONTROL;
-                if (conf->receiveMode != recMode)
-                        board_conf_needed = 1;
-        }
-        if (board_conf_needed)
-                arlan_command(dev, ARLAN_COMMAND_CONF);
-
-        ARLAN_DEBUG_EXIT("arlan_set_multicast");
-}
-
-
-struct net_device * __init arlan_probe(int unit)
-{
-        struct net_device *dev;
-        int err;
-        int m;
-
-        ARLAN_DEBUG_ENTRY("arlan_probe");
-
-        if (arlans_found == MAX_ARLANS)
-                return ERR_PTR(-ENODEV);
-
-        /* 
-         * Reserve space for local data and a copy of the shared memory
-         * that is used by the /proc interface.
-         */
-        dev = alloc_etherdev(sizeof(struct arlan_private)
-                             + sizeof(struct arlan_shmem));
-        if (!dev)
-                return ERR_PTR(-ENOMEM);
-
-        if (unit >= 0) {
-                sprintf(dev->name, "eth%d", unit);
-                netdev_boot_setup_check(dev);
-                
-                if (dev->mem_start) {
-                        if (arlan_probe_here(dev, dev->mem_start) == 0)
-                                goto found;
-                        goto not_found;
-                }
-                        
-        }
-
-
-        for (m = (int)phys_to_virt(lastFoundAt) + ARLAN_SHMEM_SIZE; 
-             m <= (int)phys_to_virt(0xDE000); 
-             m += ARLAN_SHMEM_SIZE)
-        {
-                if (arlan_probe_here(dev, m) == 0)
-                {
-                        lastFoundAt = (int)virt_to_phys((void*)m);
-                        goto found;
-                }
-        }
-
-        if (lastFoundAt == 0xbe000)
-                printk(KERN_ERR "arlan: No Arlan devices found \n");
-
- not_found:
-        free_netdev(dev);
-        return ERR_PTR(-ENODEV);
-
- found:
-        err = arlan_setup_device(dev, arlans_found);
-        if (err)
-                dev = ERR_PTR(err);
-        else if (!arlans_found++)
-                printk(KERN_INFO "Arlan driver %s\n", arlan_version);
-
-        return dev;
-}
-
-#ifdef  MODULE
-int __init init_module(void)
-{
-        int i = 0;
-
-        ARLAN_DEBUG_ENTRY("init_module");
-
-        if (channelSet != channelSetUNKNOWN || channelNumber != channelNumberUNKNOWN || systemId != systemIdUNKNOWN)
-                return -EINVAL;
-
-        for (i = 0; i < MAX_ARLANS; i++) {
-                struct net_device *dev = arlan_probe(i);
-
-                if (IS_ERR(dev)) 
-                        return PTR_ERR(dev);
-        }
-        init_arlan_proc();
-        printk(KERN_INFO "Arlan driver %s\n", arlan_version);
-        ARLAN_DEBUG_EXIT("init_module");
-        return 0;
-}
-
-
-void __exit cleanup_module(void)
-{
-        int i = 0;
-        struct net_device *dev;
-
-        ARLAN_DEBUG_ENTRY("cleanup_module");
-
-        IFDEBUG(ARLAN_DEBUG_SHUTDOWN)
-                printk(KERN_INFO "arlan: unloading module\n");
-
-        cleanup_arlan_proc();
-
-        for (i = 0; i < MAX_ARLANS; i++)
-        {
-                dev = arlan_device[i];
-                if (dev) {
-                        arlan_command(dev, ARLAN_COMMAND_POWERDOWN );
-
-                        unregister_netdev(dev);
-                        release_mem_region(virt_to_phys((void *) dev->mem_start), 
-                                           ARLAN_SHMEM_SIZE);
-                        free_netdev(dev);
-                        arlan_device[i] = NULL;
-                }
-        }
-
-        ARLAN_DEBUG_EXIT("cleanup_module");
-}
-
-
-#endif
-MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/arlan-proc.c b/drivers/net/wireless/arlan-proc.c
deleted file mode 100644
index a8b689635a3b..000000000000
--- a/drivers/net/wireless/arlan-proc.c
+++ /dev/null
@@ -1,1253 +0,0 @@
-#include "arlan.h"
-
-#include <linux/sysctl.h>
-
-#ifdef CONFIG_PROC_FS
-
-/* void enableReceive(struct net_device* dev);
-*/
-
-
-
-#define ARLAN_STR_SIZE  0x2ff0
-#define DEV_ARLAN_INFO  1
-#define DEV_ARLAN       1
-#define SARLG(type,var) {\
-        pos += sprintf(arlan_drive_info+pos, "%s\t=\t0x%x\n", #var, READSHMB(priva->card->var));        \
-        }
-
-#define SARLBN(type,var,nn) {\
-        pos += sprintf(arlan_drive_info+pos, "%s\t=\t0x",#var);\
-        for (i=0; i < nn; i++ ) pos += sprintf(arlan_drive_info+pos, "%02x",READSHMB(priva->card->var[i]));\
-        pos += sprintf(arlan_drive_info+pos, "\n");     \
-        }
-
-#define SARLBNpln(type,var,nn) {\
-        for (i=0; i < nn; i++ ) pos += sprintf(arlan_drive_info+pos, "%02x",READSHMB(priva->card->var[i]));\
-        }
-
-#define SARLSTR(var,nn) {\
-        char tmpStr[400];\
-        int  tmpLn = nn;\
-        if (nn > 399 ) tmpLn = 399; \
-        memcpy(tmpStr,(char *) priva->conf->var,tmpLn);\
-        tmpStr[tmpLn] = 0; \
-        pos += sprintf(arlan_drive_info+pos, "%s\t=\t%s \n",#var,priva->conf->var);\
-        }
-
-#define SARLUC(var)     SARLG(u_char, var)
-#define SARLUCN(var,nn) SARLBN(u_char,var, nn)
-#define SARLUS(var)     SARLG(u_short, var)
-#define SARLUSN(var,nn) SARLBN(u_short,var, nn)
-#define SARLUI(var)     SARLG(u_int, var)
-
-#define SARLUSA(var) {\
-        u_short tmpVar;\
-        memcpy(&tmpVar, (short *) priva->conf->var,2); \
-        pos += sprintf(arlan_drive_info+pos, "%s\t=\t0x%x\n",#var, tmpVar);\
-}
-
-#define SARLUIA(var) {\
-        u_int tmpVar;\
-        memcpy(&tmpVar, (int* )priva->conf->var,4); \
-        pos += sprintf(arlan_drive_info+pos, "%s\t=\t0x%x\n",#var, tmpVar);\
-}
-
-
-static const char *arlan_diagnostic_info_string(struct net_device *dev)
-{
-
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-        u_char diagnosticInfo;
-
-        READSHM(diagnosticInfo, arlan->diagnosticInfo, u_char);
-
-        switch (diagnosticInfo)
-        {
-                case 0xFF:
-                        return "Diagnostic info is OK";
-                case 0xFE:
-                        return "ERROR EPROM Checksum error ";
-                case 0xFD:
-                        return "ERROR Local Ram Test Failed ";
-                case 0xFC:
-                        return "ERROR SCC failure ";
-                case 0xFB:
-                        return "ERROR BackBone failure ";
-                case 0xFA:
-                        return "ERROR transceiver not found ";
-                case 0xF9:
-                        return "ERROR no more address space ";
-                case 0xF8:
-                        return "ERROR Checksum error  ";
-                case 0xF7:
-                        return "ERROR Missing SS Code";
-                case 0xF6:
-                        return "ERROR Invalid config format";
-                case 0xF5:
-                        return "ERROR Reserved errorcode F5";
-                case 0xF4:
-                        return "ERROR Invalid spreading code/channel number";
-                case 0xF3:
-                        return "ERROR Load Code Error";
-                case 0xF2:
-                        return "ERROR Reserver errorcode F2 ";
-                case 0xF1:
-                        return "ERROR Invalid command receivec by LAN card ";
-                case 0xF0:
-                        return "ERROR Invalid parameter found in command ";
-                case 0xEF:
-                        return "ERROR On-chip timer failure ";
-                case 0xEE:
-                        return "ERROR T410 timer failure ";
-                case 0xED:
-                        return "ERROR Too Many TxEnable commands ";
-                case 0xEC:
-                        return "ERROR EEPROM error on radio module ";
-                default:
-                        return "ERROR unknown Diagnostic info reply code ";
-          }
-}
-
-static const char *arlan_hardware_type_string(struct net_device *dev)
-{
-        u_char hardwareType;
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-
-        READSHM(hardwareType, arlan->hardwareType, u_char);
-        switch (hardwareType)
-        {
-                case 0x00:
-                        return "type A450";
-                case 0x01:
-                        return "type A650 ";
-                case 0x04:
-                        return "type TMA coproc";
-                case 0x0D:
-                        return "type A650E ";
-                case 0x18:
-                        return "type TMA coproc Australian";
-                case 0x19:
-                        return "type A650A ";
-                case 0x26:
-                        return "type TMA coproc European";
-                case 0x2E:
-                        return "type A655 ";
-                case 0x2F:
-                        return "type A655A ";
-                case 0x30:
-                        return "type A655E ";
-                case 0x0B:
-                        return "type A670 ";
-                case 0x0C:
-                        return "type A670E ";
-                case 0x2D:
-                        return "type A670A ";
-                case 0x0F:
-                        return "type A411T";
-                case 0x16:
-                        return "type A411TA";
-                case 0x1B:
-                        return "type A440T";
-                case 0x1C:
-                        return "type A412T";
-                case 0x1E:
-                        return "type A412TA";
-                case 0x22:
-                        return "type A411TE";
-                case 0x24:
-                        return "type A412TE";
-                case 0x27:
-                        return "type A671T ";
-                case 0x29:
-                        return "type A671TA ";
-                case 0x2B:
-                        return "type A671TE ";
-                case 0x31:
-                        return "type A415T ";
-                case 0x33:
-                        return "type A415TA ";
-                case 0x35:
-                        return "type A415TE ";
-                case 0x37:
-                        return "type A672";
-                case 0x39:
-                        return "type A672A ";
-                case 0x3B:
-                        return "type A672T";
-                case 0x6B:
-                        return "type IC2200";
-                default:
-                        return "type A672T";
-        }
-}
-#ifdef ARLAN_DEBUGGING
-static void arlan_print_diagnostic_info(struct net_device *dev)
-{
-        int i;
-        u_char diagnosticInfo;
-        u_short diagnosticOffset;
-        u_char hardwareType;
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-
-        //  ARLAN_DEBUG_ENTRY("arlan_print_diagnostic_info");
-
-        if (READSHMB(arlan->configuredStatusFlag) == 0)
-                printk("Arlan: Card NOT configured\n");
-        else
-                printk("Arlan: Card is configured\n");
-
-        READSHM(diagnosticInfo, arlan->diagnosticInfo, u_char);
-        READSHM(diagnosticOffset, arlan->diagnosticOffset, u_short);
-
-        printk(KERN_INFO "%s\n", arlan_diagnostic_info_string(dev));
-
-        if (diagnosticInfo != 0xff)
-                printk("%s arlan: Diagnostic Offset %d \n", dev->name, diagnosticOffset);
-
-        printk("arlan: LAN CODE ID = ");
-        for (i = 0; i < 6; i++)
-                DEBUGSHM(1, "%03d:", arlan->lanCardNodeId[i], u_char);
-        printk("\n");
-
-        printk("arlan: Arlan BroadCast address  = ");
-        for (i = 0; i < 6; i++)
-                DEBUGSHM(1, "%03d:", arlan->broadcastAddress[i], u_char);
-        printk("\n");
-
-        READSHM(hardwareType, arlan->hardwareType, u_char);
-        printk(KERN_INFO "%s\n", arlan_hardware_type_string(dev));
-
-
-        DEBUGSHM(1, "arlan: channelNumber=%d\n", arlan->channelNumber, u_char);
-        DEBUGSHM(1, "arlan: channelSet=%d\n", arlan->channelSet, u_char);
-        DEBUGSHM(1, "arlan: spreadingCode=%d\n", arlan->spreadingCode, u_char);
-        DEBUGSHM(1, "arlan: radioNodeId=%d\n", arlan->radioNodeId, u_short);
-        DEBUGSHM(1, "arlan: SID =%d\n", arlan->SID, u_short);
-        DEBUGSHM(1, "arlan: rxOffset=%d\n", arlan->rxOffset, u_short);
-
-        DEBUGSHM(1, "arlan: registration mode is %d\n", arlan->registrationMode, u_char);
-
-        printk("arlan: name= ");
-        IFDEBUG(1)
-        
-        for (i = 0; i < 16; i++)
-        {
-                char c;
-                READSHM(c, arlan->name[i], char);
-                if (c)
-                        printk("%c", c);
-        }
-        printk("\n");
-
-//   ARLAN_DEBUG_EXIT("arlan_print_diagnostic_info");
-
-}
-
-
-/******************************         TEST    MEMORY  **************/
-
-static int arlan_hw_test_memory(struct net_device *dev)
-{
-        u_char *ptr;
-        int i;
-        int memlen = sizeof(struct arlan_shmem) - 0xF;  /* avoid control register */
-        volatile char *arlan_mem = (char *) (dev->mem_start);
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-        char pattern;
-
-        ptr = NULL;
-
-        /* hold card in reset state */
-        setHardwareReset(dev);
-
-        /* test memory */
-        pattern = 0;
-        for (i = 0; i < memlen; i++)
-                WRITESHM(arlan_mem[i], ((u_char) pattern++), u_char);
-
-        pattern = 0;
-        for (i = 0; i < memlen; i++)
-        {
-                char res;
-                READSHM(res, arlan_mem[i], char);
-                if (res != pattern++)
-                {
-                        printk(KERN_ERR "Arlan driver memory test 1 failed \n");
-                        return -1;
-                }
-        }
-
-        pattern = 0;
-        for (i = 0; i < memlen; i++)
-                WRITESHM(arlan_mem[i], ~(pattern++), char);
-
-        pattern = 0;
-        for (i = 0; i < memlen; i++)
-        {
-                char res;
-                READSHM(res, arlan_mem[i], char);
-                if (res != ~(pattern++))
-                {
-                        printk(KERN_ERR "Arlan driver memory test 2 failed \n");
-                        return -1;
-                }
-        }
-
-        /* zero memory */
-        for (i = 0; i < memlen; i++)
-                WRITESHM(arlan_mem[i], 0x00, char);
-
-        IFDEBUG(1) printk(KERN_INFO "Arlan: memory tests ok\n");
-
-        /* set reset flag and then release reset */
-        WRITESHM(arlan->resetFlag, 0xff, u_char);
-
-        clearChannelAttention(dev);
-        clearHardwareReset(dev);
-
-        /* wait for reset flag to become zero, we'll wait for two seconds */
-        if (arlan_command(dev, ARLAN_COMMAND_LONG_WAIT_NOW))
-        {
-                printk(KERN_ERR "%s arlan: failed to come back from memory test\n", dev->name);
-                return -1;
-        }
-        return 0;
-}
-
-static int arlan_setup_card_by_book(struct net_device *dev)
-{
-        u_char irqLevel, configuredStatusFlag;
-        struct arlan_private *priv = netdev_priv(dev);
-        volatile struct arlan_shmem __iomem *arlan = priv->card;
-
-//      ARLAN_DEBUG_ENTRY("arlan_setup_card");
-
-        READSHM(configuredStatusFlag, arlan->configuredStatusFlag, u_char);
-
-        IFDEBUG(10)
-        if (configuredStatusFlag != 0)
-                IFDEBUG(10) printk("arlan: CARD IS CONFIGURED\n");
-        else
-                IFDEBUG(10) printk("arlan: card is NOT configured\n");
-
-        if (testMemory || (READSHMB(arlan->diagnosticInfo) != 0xff))
-                if (arlan_hw_test_memory(dev))
-                        return -1;
-
-        DEBUGSHM(4, "arlan configuredStatus = %d \n", arlan->configuredStatusFlag, u_char);
-        DEBUGSHM(4, "arlan driver diagnostic: 0x%2x\n", arlan->diagnosticInfo, u_char);
-
-        /* issue nop command - no interrupt */
-        arlan_command(dev, ARLAN_COMMAND_NOOP);
-        if (arlan_command(dev, ARLAN_COMMAND_WAIT_NOW) != 0)
-                return -1;
-
-        IFDEBUG(50) printk("1st Noop successfully executed !!\n");
-
-        /* try to turn on the arlan interrupts */
-        clearClearInterrupt(dev);
-        setClearInterrupt(dev);
-        setInterruptEnable(dev);
-
-        /* issue nop command - with interrupt */
-
-        arlan_command(dev, ARLAN_COMMAND_NOOPINT);
-        if (arlan_command(dev, ARLAN_COMMAND_WAIT_NOW) != 0)
-                return -1;
-
-
-        IFDEBUG(50) printk("2nd Noop successfully executed !!\n");
-
-        READSHM(irqLevel, arlan->irqLevel, u_char)
-        
-        if (irqLevel != dev->irq)
-        {
-                IFDEBUG(1) printk(KERN_WARNING "arlan dip switches set irq to %d\n", irqLevel);
-                printk(KERN_WARNING "device driver irq set to %d - does not match\n", dev->irq);
-                dev->irq = irqLevel;
-        }
-        else
-                IFDEBUG(2) printk("irq level is OK\n");
-
-
-        IFDEBUG(3) arlan_print_diagnostic_info(dev);
-
-        arlan_command(dev, ARLAN_COMMAND_CONF);
-
-        READSHM(configuredStatusFlag, arlan->configuredStatusFlag, u_char);
-        if (configuredStatusFlag == 0)
-        {
-                printk(KERN_WARNING "arlan configure failed\n");
-                return -1;
-        }
-        arlan_command(dev, ARLAN_COMMAND_LONG_WAIT_NOW);
-        arlan_command(dev, ARLAN_COMMAND_RX);
-        arlan_command(dev, ARLAN_COMMAND_LONG_WAIT_NOW);
-        printk(KERN_NOTICE "%s: arlan driver version %s loaded\n",
-               dev->name, arlan_version);
-
-//      ARLAN_DEBUG_EXIT("arlan_setup_card");
-
-        return 0;               /* no errors */
-}
-#endif
-
-#ifdef ARLAN_PROC_INTERFACE
-#ifdef ARLAN_PROC_SHM_DUMP
-
-static char arlan_drive_info[ARLAN_STR_SIZE] = "A655\n\0";
-
-static int arlan_sysctl_info(ctl_table * ctl, int write,
-                      void __user *buffer, size_t * lenp, loff_t *ppos)
-{
-        int i;
-        int retv, pos, devnum;
-        struct arlan_private *priva = NULL;
-        struct net_device *dev;
-        pos = 0;
-        if (write)
-        {
-                printk("wrirte: ");
-                for (i = 0; i < 100; i++)
-                        printk("adi %x \n", arlan_drive_info[i]);
-        }
-        if (ctl->procname == NULL || arlan_drive_info == NULL)
-        {
-                printk(KERN_WARNING " procname is NULL in sysctl_table or arlan_drive_info is NULL \n at arlan module\n ");
-                return -1;
-        }
-        devnum = ctl->procname[5] - '0';
-        if (devnum < 0 || devnum > MAX_ARLANS - 1)
-        {
-                printk(KERN_WARNING "too strange devnum in procfs parse\n ");
-                return -1;
-        }
-        else if (arlan_device[devnum] == NULL)
-        {
-                if (ctl->procname)
-                        pos += sprintf(arlan_drive_info + pos, "\t%s\n\n", ctl->procname);
-                pos += sprintf(arlan_drive_info + pos, "No device found here \n");
-                goto final;
-        }
-        else
-                priva = netdev_priv(arlan_device[devnum]);
-
-        if (priva == NULL)
-        {
-                printk(KERN_WARNING " Could not find the device private in arlan procsys, bad\n ");
-                return -1;
-        }
-        dev = arlan_device[devnum];
-
-        memcpy_fromio(priva->conf, priva->card, sizeof(struct arlan_shmem));
-
-        pos = sprintf(arlan_drive_info, "Arlan  info \n");
-        /* Header Signature */
-        SARLSTR(textRegion, 48);
-        SARLUC(resetFlag);
-        pos += sprintf(arlan_drive_info + pos, "diagnosticInfo\t=\t%s \n", arlan_diagnostic_info_string(dev));
-        SARLUC(diagnosticInfo);
-        SARLUS(diagnosticOffset);
-        SARLUCN(_1, 12);
-        SARLUCN(lanCardNodeId, 6);
-        SARLUCN(broadcastAddress, 6);
-        pos += sprintf(arlan_drive_info + pos, "hardwareType =\t  %s \n", arlan_hardware_type_string(dev));
-        SARLUC(hardwareType);
-        SARLUC(majorHardwareVersion);
-        SARLUC(minorHardwareVersion);
-        SARLUC(radioModule);
-        SARLUC(defaultChannelSet);
-        SARLUCN(_2, 47);
-
-        /* Control/Status Block - 0x0080 */
-        SARLUC(interruptInProgress);
-        SARLUC(cntrlRegImage);
-
-        SARLUCN(_3, 14);
-        SARLUC(commandByte);
-        SARLUCN(commandParameter, 15);
-
-        /* Receive Status - 0x00a0 */
-        SARLUC(rxStatus);
-        SARLUC(rxFrmType);
-        SARLUS(rxOffset);
-        SARLUS(rxLength);
-        SARLUCN(rxSrc, 6);
-        SARLUC(rxBroadcastFlag);
-        SARLUC(rxQuality);
-        SARLUC(scrambled);
-        SARLUCN(_4, 1);
-
-        /* Transmit Status - 0x00b0 */
-        SARLUC(txStatus);
-        SARLUC(txAckQuality);
-        SARLUC(numRetries);
-        SARLUCN(_5, 14);
-        SARLUCN(registeredRouter, 6);
-        SARLUCN(backboneRouter, 6);
-        SARLUC(registrationStatus);
-        SARLUC(configuredStatusFlag);
-        SARLUCN(_6, 1);
-        SARLUCN(ultimateDestAddress, 6);
-        SARLUCN(immedDestAddress, 6);
-        SARLUCN(immedSrcAddress, 6);
-        SARLUS(rxSequenceNumber);
-        SARLUC(assignedLocaltalkAddress);
-        SARLUCN(_7, 27);
-
-        /* System Parameter Block */
-
-        /* - Driver Parameters (Novell Specific) */
-
-        SARLUS(txTimeout);
-        SARLUS(transportTime);
-        SARLUCN(_8, 4);
-
-        /* - Configuration Parameters */
-        SARLUC(irqLevel);
-        SARLUC(spreadingCode);
-        SARLUC(channelSet);
-        SARLUC(channelNumber);
-        SARLUS(radioNodeId);
-        SARLUCN(_9, 2);
-        SARLUC(scramblingDisable);
-        SARLUC(radioType);
-        SARLUS(routerId);
-        SARLUCN(_10, 9);
-        SARLUC(txAttenuation);
-        SARLUIA(systemId);
-        SARLUS(globalChecksum);
-        SARLUCN(_11, 4);
-        SARLUS(maxDatagramSize);
-        SARLUS(maxFrameSize);
-        SARLUC(maxRetries);
-        SARLUC(receiveMode);
-        SARLUC(priority);
-        SARLUC(rootOrRepeater);
-        SARLUCN(specifiedRouter, 6);
-        SARLUS(fastPollPeriod);
-        SARLUC(pollDecay);
-        SARLUSA(fastPollDelay);
-        SARLUC(arlThreshold);
-        SARLUC(arlDecay);
-        SARLUCN(_12, 1);
-        SARLUS(specRouterTimeout);
-        SARLUCN(_13, 5);
-
-        /* Scrambled Area */
-        SARLUIA(SID);
-        SARLUCN(encryptionKey, 12);
-        SARLUIA(_14);
-        SARLUSA(waitTime);
-        SARLUSA(lParameter);
-        SARLUCN(_15, 3);
-        SARLUS(headerSize);
-        SARLUS(sectionChecksum);
-
-        SARLUC(registrationMode);
-        SARLUC(registrationFill);
-        SARLUS(pollPeriod);
-        SARLUS(refreshPeriod);
-        SARLSTR(name, 16);
-        SARLUCN(NID, 6);
-        SARLUC(localTalkAddress);
-        SARLUC(codeFormat);
-        SARLUC(numChannels);
-        SARLUC(channel1);
-        SARLUC(channel2);
-        SARLUC(channel3);
-        SARLUC(channel4);
-        SARLUCN(SSCode, 59);
-
-/*      SARLUCN( _16, 0x140);
- */
-        /* Statistics Block - 0x0300 */
-        SARLUC(hostcpuLock);
-        SARLUC(lancpuLock);
-        SARLUCN(resetTime, 18);
-        SARLUIA(numDatagramsTransmitted);
-        SARLUIA(numReTransmissions);
-        SARLUIA(numFramesDiscarded);
-        SARLUIA(numDatagramsReceived);
-        SARLUIA(numDuplicateReceivedFrames);
-        SARLUIA(numDatagramsDiscarded);
-        SARLUS(maxNumReTransmitDatagram);
-        SARLUS(maxNumReTransmitFrames);
-        SARLUS(maxNumConsecutiveDuplicateFrames);
-        /* misaligned here so we have to go to characters */
-        SARLUIA(numBytesTransmitted);
-        SARLUIA(numBytesReceived);
-        SARLUIA(numCRCErrors);
-        SARLUIA(numLengthErrors);
-        SARLUIA(numAbortErrors);
-        SARLUIA(numTXUnderruns);
-        SARLUIA(numRXOverruns);
-        SARLUIA(numHoldOffs);
-        SARLUIA(numFramesTransmitted);
-        SARLUIA(numFramesReceived);
-        SARLUIA(numReceiveFramesLost);
-        SARLUIA(numRXBufferOverflows);
-        SARLUIA(numFramesDiscardedAddrMismatch);
-        SARLUIA(numFramesDiscardedSIDMismatch);
-        SARLUIA(numPollsTransmistted);
-        SARLUIA(numPollAcknowledges);
-        SARLUIA(numStatusTimeouts);
-        SARLUIA(numNACKReceived);
-        SARLUS(auxCmd);
-        SARLUCN(dumpPtr, 4);
-        SARLUC(dumpVal);
-        SARLUC(wireTest);
-        
-        /* next 4 seems too long for procfs, over single page ?
-        SARLUCN( _17, 0x86);
-        SARLUCN( txBuffer, 0x800);
-        SARLUCN( rxBuffer,  0x800); 
-        SARLUCN( _18, 0x0bff);
-         */
-
-        pos += sprintf(arlan_drive_info + pos, "rxRing\t=\t0x");
-        for (i = 0; i < 0x50; i++)
-                pos += sprintf(arlan_drive_info + pos, "%02x", ((char *) priva->conf)[priva->conf->rxOffset + i]);
-        pos += sprintf(arlan_drive_info + pos, "\n");
-
-        SARLUC(configStatus);
-        SARLUC(_22);
-        SARLUC(progIOCtrl);
-        SARLUC(shareMBase);
-        SARLUC(controlRegister);
-
-        pos += sprintf(arlan_drive_info + pos, " total %d chars\n", pos);
-        if (ctl)
-                if (ctl->procname)
-                        pos += sprintf(arlan_drive_info + pos, " driver name : %s\n", ctl->procname);
-final:
-        *lenp = pos;
-
-        if (!write)
-                retv = proc_dostring(ctl, write, buffer, lenp, ppos);
-        else
-        {
-                *lenp = 0;
-                return -1;
-        }
-        return retv;
-}
-
-
-static int arlan_sysctl_info161719(ctl_table * ctl, int write,
-                            void __user *buffer, size_t * lenp, loff_t *ppos)
-{
-        int i;
-        int retv, pos, devnum;
-        struct arlan_private *priva = NULL;
-
-        pos = 0;
-        devnum = ctl->procname[5] - '0';
-        if (arlan_device[devnum] == NULL)
-        {
-                pos += sprintf(arlan_drive_info + pos, "No device found here \n");
-                goto final;
-        }
-        else
-                priva = netdev_priv(arlan_device[devnum]);
-        if (priva == NULL)
-        {
-                printk(KERN_WARNING " Could not find the device private in arlan procsys, bad\n ");
-                return -1;
-        }
-        memcpy_fromio(priva->conf, priva->card, sizeof(struct arlan_shmem));
-        SARLUCN(_16, 0xC0);
-        SARLUCN(_17, 0x6A);
-        SARLUCN(_18, 14);
-        SARLUCN(_19, 0x86);
-        SARLUCN(_21, 0x3fd);
-
-final:
-        *lenp = pos;
-        retv = proc_dostring(ctl, write, buffer, lenp, ppos);
-        return retv;
-}
-
-static int arlan_sysctl_infotxRing(ctl_table * ctl, int write,
-                            void __user *buffer, size_t * lenp, loff_t *ppos)
-{
-        int i;
-        int retv, pos, devnum;
-        struct arlan_private *priva = NULL;
-
-        pos = 0;
-        devnum = ctl->procname[5] - '0';
-        if (arlan_device[devnum] == NULL)
-        {
-                  pos += sprintf(arlan_drive_info + pos, "No device found here \n");
-                  goto final;
-        }
-        else
-                priva = netdev_priv(arlan_device[devnum]);
-        if (priva == NULL)
-        {
-                printk(KERN_WARNING " Could not find the device private in arlan procsys, bad\n ");
-                return -1;
-        }
-        memcpy_fromio(priva->conf, priva->card, sizeof(struct arlan_shmem));
-        SARLBNpln(u_char, txBuffer, 0x800);
-final:
-        *lenp = pos;
-        retv = proc_dostring(ctl, write, buffer, lenp, ppos);
-        return retv;
-}
-
-static int arlan_sysctl_inforxRing(ctl_table * ctl, int write,
-                            void __user *buffer, size_t * lenp, loff_t *ppos)
-{
-        int i;
-        int retv, pos, devnum;
-        struct arlan_private *priva = NULL;
-
-        pos = 0;
-        devnum = ctl->procname[5] - '0';
-        if (arlan_device[devnum] == NULL)
-        {
-                  pos += sprintf(arlan_drive_info + pos, "No device found here \n");
-                  goto final;
-        } else
-                priva = netdev_priv(arlan_device[devnum]);
-        if (priva == NULL)
-        {
-                printk(KERN_WARNING " Could not find the device private in arlan procsys, bad\n ");
-                return -1;
-        }
-        memcpy_fromio(priva->conf, priva->card, sizeof(struct arlan_shmem));
-        SARLBNpln(u_char, rxBuffer, 0x800);
-final:
-        *lenp = pos;
-        retv = proc_dostring(ctl, write, buffer, lenp, ppos);
-        return retv;
-}
-
-static int arlan_sysctl_info18(ctl_table * ctl, int write,
-                        void __user *buffer, size_t * lenp, loff_t *ppos)
-{
-        int i;
-        int retv, pos, devnum;
-        struct arlan_private *priva = NULL;
-
-        pos = 0;
-        devnum = ctl->procname[5] - '0';
-        if (arlan_device[devnum] == NULL)
-        {
-                pos += sprintf(arlan_drive_info + pos, "No device found here \n");
-                goto final;
-        }
-        else
-                priva = netdev_priv(arlan_device[devnum]);
-        if (priva == NULL)
-        {
-                printk(KERN_WARNING " Could not find the device private in arlan procsys, bad\n ");
-                return -1;
-        }
-        memcpy_fromio(priva->conf, priva->card, sizeof(struct arlan_shmem));
-        SARLBNpln(u_char, _18, 0x800);
-
-final:
-        *lenp = pos;
-        retv = proc_dostring(ctl, write, buffer, lenp, ppos);
-        return retv;
-}
-
-
-#endif                          /* #ifdef ARLAN_PROC_SHM_DUMP */
-
-
-static char conf_reset_result[200];
-
-static int arlan_configure(ctl_table * ctl, int write,
-                    void __user *buffer, size_t * lenp, loff_t *ppos)
-{
-        int pos = 0;
-        int devnum = ctl->procname[6] - '0';
-        struct arlan_private *priv;
-
-        if (devnum < 0 || devnum > MAX_ARLANS - 1)
-        {
-                  printk(KERN_WARNING "too strange devnum in procfs parse\n ");
-                  return -1;
-        }
-        else if (arlan_device[devnum] != NULL)
-        {
-                  priv = netdev_priv(arlan_device[devnum]);
-
-                  arlan_command(arlan_device[devnum], ARLAN_COMMAND_CLEAN_AND_CONF);
-        }
-        else
-                return -1;
-
-        *lenp = pos;
-        return proc_dostring(ctl, write, buffer, lenp, ppos);
-}
-
-static int arlan_sysctl_reset(ctl_table * ctl, int write,
-                       void __user *buffer, size_t * lenp, loff_t *ppos)
-{
-        int pos = 0;
-        int devnum = ctl->procname[5] - '0';
-        struct arlan_private *priv;
-
-        if (devnum < 0 || devnum > MAX_ARLANS - 1)
-        {
-                  printk(KERN_WARNING "too strange devnum in procfs parse\n ");
-                  return -1;
-        }
-        else if (arlan_device[devnum] != NULL)
-        {
-                priv = netdev_priv(arlan_device[devnum]);
-                arlan_command(arlan_device[devnum], ARLAN_COMMAND_CLEAN_AND_RESET);
-
-        } else
-                return -1;
-        *lenp = pos + 3;
-        return proc_dostring(ctl, write, buffer, lenp, ppos);
-}
-
-
-/* Place files in /proc/sys/dev/arlan */
-#define CTBLN(num,card,nam) \
-        { .ctl_name = num,\
-          .procname = #nam,\
-          .data = &(arlan_conf[card].nam),\
-          .maxlen = sizeof(int), .mode = 0600, .proc_handler = &proc_dointvec}
-#ifdef ARLAN_DEBUGGING
-
-#define ARLAN_PROC_DEBUG_ENTRIES \
-        { .ctl_name = 48, .procname = "entry_exit_debug",\
-          .data = &arlan_entry_and_exit_debug,\
-          .maxlen = sizeof(int), .mode = 0600, .proc_handler = &proc_dointvec},\
-        { .ctl_name = 49, .procname = "debug", .data = &arlan_debug,\
-          .maxlen = sizeof(int), .mode = 0600, .proc_handler = &proc_dointvec},
-#else 
-#define ARLAN_PROC_DEBUG_ENTRIES
-#endif
-
-#define ARLAN_SYSCTL_TABLE_TOTAL(cardNo)\
-        CTBLN(1,cardNo,spreadingCode),\
-        CTBLN(2,cardNo, channelNumber),\
-        CTBLN(3,cardNo, scramblingDisable),\
-        CTBLN(4,cardNo, txAttenuation),\
-        CTBLN(5,cardNo, systemId), \
-        CTBLN(6,cardNo, maxDatagramSize),\
-        CTBLN(7,cardNo, maxFrameSize),\
-        CTBLN(8,cardNo, maxRetries),\
-        CTBLN(9,cardNo, receiveMode),\
-        CTBLN(10,cardNo, priority),\
-        CTBLN(11,cardNo, rootOrRepeater),\
-        CTBLN(12,cardNo, SID),\
-        CTBLN(13,cardNo, registrationMode),\
-        CTBLN(14,cardNo, registrationFill),\
-        CTBLN(15,cardNo, localTalkAddress),\
-        CTBLN(16,cardNo, codeFormat),\
-        CTBLN(17,cardNo, numChannels),\
-        CTBLN(18,cardNo, channel1),\
-        CTBLN(19,cardNo, channel2),\
-        CTBLN(20,cardNo, channel3),\
-        CTBLN(21,cardNo, channel4),\
-        CTBLN(22,cardNo, txClear),\
-        CTBLN(23,cardNo, txRetries),\
-        CTBLN(24,cardNo, txRouting),\
-        CTBLN(25,cardNo, txScrambled),\
-        CTBLN(26,cardNo, rxParameter),\
-        CTBLN(27,cardNo, txTimeoutMs),\
-        CTBLN(28,cardNo, waitCardTimeout),\
-        CTBLN(29,cardNo, channelSet), \
-        {.ctl_name = 30, .procname = "name",\
-         .data = arlan_conf[cardNo].siteName,\
-         .maxlen = 16, .mode = 0600, .proc_handler = &proc_dostring},\
-        CTBLN(31,cardNo,waitTime),\
-        CTBLN(32,cardNo,lParameter),\
-        CTBLN(33,cardNo,_15),\
-        CTBLN(34,cardNo,headerSize),\
-        CTBLN(36,cardNo,tx_delay_ms),\
-        CTBLN(37,cardNo,retries),\
-        CTBLN(38,cardNo,ReTransmitPacketMaxSize),\
-        CTBLN(39,cardNo,waitReTransmitPacketMaxSize),\
-        CTBLN(40,cardNo,fastReTransCount),\
-        CTBLN(41,cardNo,driverRetransmissions),\
-        CTBLN(42,cardNo,txAckTimeoutMs),\
-        CTBLN(43,cardNo,registrationInterrupts),\
-        CTBLN(44,cardNo,hardwareType),\
-        CTBLN(45,cardNo,radioType),\
-        CTBLN(46,cardNo,writeEEPROM),\
-        CTBLN(47,cardNo,writeRadioType),\
-        ARLAN_PROC_DEBUG_ENTRIES\
-        CTBLN(50,cardNo,in_speed),\
-        CTBLN(51,cardNo,out_speed),\
-        CTBLN(52,cardNo,in_speed10),\
-        CTBLN(53,cardNo,out_speed10),\
-        CTBLN(54,cardNo,in_speed_max),\
-        CTBLN(55,cardNo,out_speed_max),\
-        CTBLN(56,cardNo,measure_rate),\
-        CTBLN(57,cardNo,pre_Command_Wait),\
-        CTBLN(58,cardNo,rx_tweak1),\
-        CTBLN(59,cardNo,rx_tweak2),\
-        CTBLN(60,cardNo,tx_queue_len),\
-
-
-
-static ctl_table arlan_conf_table0[] =
-{
-        ARLAN_SYSCTL_TABLE_TOTAL(0)
-
-#ifdef ARLAN_PROC_SHM_DUMP
-        {
-                .ctl_name       = 150,
-                .procname       = "arlan0-txRing",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_infotxRing,
-        },
-        {
-                .ctl_name       = 151,
-                .procname       = "arlan0-rxRing",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_inforxRing,
-        },
-        {
-                .ctl_name       = 152,
-                .procname       = "arlan0-18",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_info18,
-        },
-        {
-                .ctl_name       = 153,
-                .procname       = "arlan0-ring",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_info161719,
-        },
-        {
-                .ctl_name       = 154,
-                .procname       = "arlan0-shm-cpy",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_info,
-        },
-#endif
-        {
-                .ctl_name       = 155,
-                .procname       = "config0",
-                .data           = &conf_reset_result,
-                .maxlen         = 100,
-                .mode           = 0400,
-                .proc_handler   = &arlan_configure
-        },
-        {
-                .ctl_name       = 156,
-                .procname       = "reset0",
-                .data           = &conf_reset_result,
-                .maxlen         = 100,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_reset,
-        },
-        { .ctl_name = 0 }
-};
-
-static ctl_table arlan_conf_table1[] =
-{
-
-        ARLAN_SYSCTL_TABLE_TOTAL(1)
-
-#ifdef ARLAN_PROC_SHM_DUMP
-        {
-                .ctl_name       = 150,
-                .procname       = "arlan1-txRing",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_infotxRing,
-        },
-        {
-                .ctl_name       = 151,
-                .procname       = "arlan1-rxRing",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_inforxRing,
-        },
-        {
-                .ctl_name       = 152,
-                .procname       = "arlan1-18",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_info18,
-        },
-        {
-                .ctl_name       = 153,
-                .procname       = "arlan1-ring",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_info161719,
-        },
-        {
-                .ctl_name       = 154,
-                .procname       = "arlan1-shm-cpy",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_info,
-        },
-#endif
-        {
-                .ctl_name       = 155,
-                .procname       = "config1",
-                .data           = &conf_reset_result,
-                .maxlen         = 100,
-                .mode           = 0400,
-                .proc_handler   = &arlan_configure,
-        },
-        {
-                .ctl_name       = 156,
-                .procname       = "reset1",
-                .data           = &conf_reset_result,
-                .maxlen         = 100,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_reset,
-        },
-        { .ctl_name = 0 }
-};
-
-static ctl_table arlan_conf_table2[] =
-{
-
-        ARLAN_SYSCTL_TABLE_TOTAL(2)
-
-#ifdef ARLAN_PROC_SHM_DUMP
-        {
-                .ctl_name       = 150,
-                .procname       = "arlan2-txRing",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_infotxRing,
-        },
-        {
-                .ctl_name       = 151,
-                .procname       = "arlan2-rxRing",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_inforxRing,
-        },
-        {
-                .ctl_name       = 152,
-                .procname       = "arlan2-18",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_info18,
-        },
-        {
-                .ctl_name       = 153,
-                .procname       = "arlan2-ring",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_info161719,
-        },
-        {
-                .ctl_name       = 154,
-                .procname       = "arlan2-shm-cpy",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_info,
-        },
-#endif
-        {
-                .ctl_name       = 155,
-                .procname       = "config2",
-                .data           = &conf_reset_result,
-                .maxlen         = 100,
-                .mode           = 0400,
-                .proc_handler   = &arlan_configure,
-        },
-        {
-                .ctl_name       = 156,
-                .procname       = "reset2",
-                .data           = &conf_reset_result,
-                .maxlen         = 100,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_reset,
-        },
-        { .ctl_name = 0 }
-};
-
-static ctl_table arlan_conf_table3[] =
-{
-
-        ARLAN_SYSCTL_TABLE_TOTAL(3)
-
-#ifdef ARLAN_PROC_SHM_DUMP
-        {
-                .ctl_name       = 150,
-                .procname       = "arlan3-txRing",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_infotxRing,
-        },
-        {
-                .ctl_name       = 151,
-                .procname       = "arlan3-rxRing",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_inforxRing,
-        },
-        {
-                .ctl_name       = 152,
-                .procname       = "arlan3-18",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_info18,
-        },
-        {
-                .ctl_name       = 153,
-                .procname       = "arlan3-ring",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_info161719,
-        },
-        {
-                .ctl_name       = 154,
-                .procname       = "arlan3-shm-cpy",
-                .data           = &arlan_drive_info,
-                .maxlen         = ARLAN_STR_SIZE,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_info,
-        },
-#endif
-        {
-                .ctl_name       = 155,
-                .procname       = "config3",
-                .data           = &conf_reset_result,
-                .maxlen         = 100,
-                .mode           = 0400,
-                .proc_handler   = &arlan_configure,
-        },
-        {
-                .ctl_name       = 156,
-                .procname       = "reset3",
-                .data           = &conf_reset_result,
-                .maxlen         = 100,
-                .mode           = 0400,
-                .proc_handler   = &arlan_sysctl_reset,
-        },
-        { .ctl_name = 0 }
-};
-
-
-
-static ctl_table arlan_table[] =
-{
-        {
-                .ctl_name       = 0,
-                .procname       = "arlan0",
-                .maxlen         = 0,
-                .mode           = 0600,
-                .child          = arlan_conf_table0,
-        },
-        {
-                .ctl_name       = 0,
-                .procname       = "arlan1",
-                .maxlen         = 0,
-                .mode           = 0600,
-                .child          = arlan_conf_table1,
-        },
-        {
-                .ctl_name       = 0,
-                .procname       = "arlan2",
-                .maxlen         = 0,
-                .mode           = 0600,
-                .child          = arlan_conf_table2,
-        },
-        {
-                .ctl_name       = 0,
-                .procname       = "arlan3",
-                .maxlen         = 0,
-                .mode           = 0600,
-                .child          = arlan_conf_table3,
-        },
-        { .ctl_name = 0 }
-};
-
-#else
-
-static ctl_table arlan_table[MAX_ARLANS + 1] =
-{
-        { .ctl_name = 0 }
-};
-#endif
-
-
-// static int mmtu = 1234;
-
-static ctl_table arlan_root_table[] =
-{
-        {
-                .ctl_name       = CTL_ARLAN,
-                .procname       = "arlan",
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = arlan_table,
-        },
-        { .ctl_name = 0 }
-};
-
-/* Make sure that /proc/sys/dev is there */
-//static ctl_table arlan_device_root_table[] =
-//{
-//      {CTL_DEV, "dev", NULL, 0, 0555, arlan_root_table},
-//      {0}
-//};
-
-
-static struct ctl_table_header *arlan_device_sysctl_header;
-
-int __init init_arlan_proc(void)
-{
-
-        int i = 0;
-        if (arlan_device_sysctl_header)
-                return 0;
-        for (i = 0; i < MAX_ARLANS && arlan_device[i]; i++)
-                arlan_table[i].ctl_name = i + 1;
-        arlan_device_sysctl_header = register_sysctl_table(arlan_root_table);
-        if (!arlan_device_sysctl_header)
-                return -1;
-
-        return 0;
-
-}
-
-void __exit cleanup_arlan_proc(void)
-{
-        unregister_sysctl_table(arlan_device_sysctl_header);
-        arlan_device_sysctl_header = NULL;
-
-}
-#endif
diff --git a/drivers/net/wireless/arlan.h b/drivers/net/wireless/arlan.h
deleted file mode 100644
index fb3ad51a1caf..000000000000
--- a/drivers/net/wireless/arlan.h
+++ /dev/null
@@ -1,539 +0,0 @@
-/*
- *  Copyright (C) 1997 Cullen Jennings
- *  Copyright (C) 1998 Elmer.Joandi@ut.ee, +37-255-13500        
- *  GNU General Public License applies
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/types.h>
-#include <linux/skbuff.h>
-#include <linux/if_ether.h>     /* For the statistics structure. */
-#include <linux/if_arp.h>       /* For ARPHRD_ETHER */
-#include <linux/ptrace.h>
-#include <linux/ioport.h>
-#include <linux/in.h>
-#include <linux/slab.h>
-#include <linux/string.h>
-#include <linux/timer.h>
-
-#include <linux/init.h>
-#include <linux/bitops.h>
-#include <asm/system.h>
-#include <asm/io.h>
-#include <linux/errno.h>
-#include <linux/delay.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-
-
-//#define ARLAN_DEBUGGING 1
-
-#define ARLAN_PROC_INTERFACE
-#define MAX_ARLANS 4 /* not more than 4 ! */
-#define ARLAN_PROC_SHM_DUMP /* shows all card registers, makes driver way larger */
-
-#define ARLAN_MAX_MULTICAST_ADDRS 16
-#define ARLAN_RCV_CLEAN         0
-#define ARLAN_RCV_PROMISC 1
-#define ARLAN_RCV_CONTROL 2
-
-#ifdef CONFIG_PROC_FS
-extern int init_arlan_proc(void);
-extern void cleanup_arlan_proc(void);
-#else
-#define init_arlan_proc()       ({ 0; })
-#define cleanup_arlan_proc()    do { } while (0)
-#endif
-
-extern struct net_device *arlan_device[MAX_ARLANS];
-extern int      arlan_debug;
-extern int      arlan_entry_debug;
-extern int      arlan_exit_debug;
-extern int      testMemory;
-extern int     arlan_command(struct net_device * dev, int command);
- 
-#define SIDUNKNOWN -1
-#define radioNodeIdUNKNOWN -1
-#define irqUNKNOWN 0
-#define debugUNKNOWN 0
-#define testMemoryUNKNOWN 1
-#define spreadingCodeUNKNOWN 0
-#define channelNumberUNKNOWN 0
-#define channelSetUNKNOWN 0
-#define systemIdUNKNOWN -1
-#define registrationModeUNKNOWN -1
-
-
-#define IFDEBUG( L ) if ( (L) & arlan_debug ) 
-#define ARLAN_FAKE_HDR_LEN 12 
-
-#ifdef ARLAN_DEBUGGING
-        #define DEBUG 1
-        #define ARLAN_ENTRY_EXIT_DEBUGGING 1
-        #define ARLAN_DEBUG(a,b) printk(KERN_DEBUG a, b)
-#else
-        #define ARLAN_DEBUG(a,b) 
-#endif
-
-#define ARLAN_SHMEM_SIZE        0x2000
-
-struct arlan_shmem
-{
-      /* Header Signature */ 
-      volatile  char textRegion[48];
-      volatile  u_char resetFlag;
-      volatile  u_char  diagnosticInfo;
-      volatile  u_short diagnosticOffset;
-      volatile  u_char _1[12];
-      volatile  u_char lanCardNodeId[6];
-      volatile  u_char broadcastAddress[6];
-      volatile  u_char hardwareType;
-      volatile  u_char majorHardwareVersion;
-      volatile  u_char minorHardwareVersion;
-      volatile  u_char radioModule;// shows EEPROM, can be overridden at 0x111
-      volatile  u_char defaultChannelSet; // shows EEProm, can be overriiden at 0x10A
-      volatile  u_char _2[47];
-      
-      /* Control/Status Block - 0x0080 */
-      volatile  u_char interruptInProgress; /* not used by lancpu */
-      volatile  u_char cntrlRegImage; /* not used by lancpu */
-      volatile  u_char _3[13];
-      volatile  u_char dumpByte;
-      volatile  u_char commandByte; /* non-zero = active */
-      volatile  u_char commandParameter[15];
-
-      /* Receive Status - 0x00a0 */
-      volatile  u_char rxStatus; /* 1- data, 2-control, 0xff - registr change */
-      volatile  u_char rxFrmType;
-      volatile  u_short rxOffset;
-      volatile  u_short rxLength;
-      volatile  u_char rxSrc[6];
-      volatile  u_char rxBroadcastFlag;
-      volatile  u_char rxQuality;
-      volatile  u_char scrambled;
-      volatile  u_char _4[1];
-      
-      /* Transmit Status - 0x00b0 */
-      volatile  u_char txStatus;
-      volatile  u_char txAckQuality;
-      volatile  u_char numRetries;
-      volatile  u_char _5[14];
-      volatile  u_char registeredRouter[6];
-      volatile  u_char backboneRouter[6];
-      volatile  u_char registrationStatus;
-      volatile  u_char configuredStatusFlag;
-      volatile  u_char _6[1];
-      volatile  u_char ultimateDestAddress[6];
-      volatile  u_char immedDestAddress[6];
-      volatile  u_char immedSrcAddress[6];
-      volatile  u_short rxSequenceNumber;
-      volatile  u_char assignedLocaltalkAddress;
-      volatile  u_char _7[27];
-
-      /* System Parameter Block */
-
-      /* - Driver Parameters (Novell Specific) */
-
-      volatile  u_short txTimeout;
-      volatile  u_short transportTime;
-      volatile  u_char _8[4];
-
-      /* - Configuration Parameters */
-      volatile  u_char irqLevel;
-      volatile  u_char spreadingCode;
-      volatile  u_char channelSet;
-      volatile  u_char channelNumber;
-      volatile  u_short radioNodeId;
-      volatile  u_char _9[2];
-      volatile  u_char scramblingDisable;
-      volatile  u_char radioType;
-      volatile  u_short routerId;
-      volatile  u_char _10[9];
-      volatile  u_char txAttenuation;
-      volatile  u_char systemId[4]; 
-      volatile  u_short globalChecksum;
-      volatile  u_char _11[4];
-      volatile  u_short maxDatagramSize;
-      volatile  u_short maxFrameSize;
-      volatile  u_char maxRetries;
-      volatile  u_char receiveMode;
-      volatile  u_char priority;
-      volatile  u_char rootOrRepeater;
-      volatile  u_char specifiedRouter[6];
-      volatile  u_short fastPollPeriod;
-      volatile  u_char pollDecay;
-      volatile  u_char fastPollDelay[2];
-      volatile  u_char arlThreshold;
-      volatile  u_char arlDecay;
-      volatile  u_char _12[1];
-      volatile  u_short specRouterTimeout;
-      volatile  u_char _13[5];
-
-      /* Scrambled Area */
-      volatile  u_char SID[4];
-      volatile  u_char encryptionKey[12];
-      volatile  u_char _14[2];
-      volatile  u_char waitTime[2];
-      volatile  u_char lParameter[2];
-      volatile  u_char _15[3];
-      volatile  u_short headerSize;
-      volatile  u_short sectionChecksum;
-
-      volatile  u_char registrationMode;
-      volatile  u_char registrationFill;
-      volatile  u_short pollPeriod;
-      volatile  u_short refreshPeriod;
-      volatile  u_char name[16];
-      volatile  u_char NID[6];
-      volatile  u_char localTalkAddress;
-      volatile  u_char codeFormat;
-      volatile  u_char numChannels;
-      volatile  u_char channel1;
-      volatile  u_char channel2;
-      volatile  u_char channel3;
-      volatile  u_char channel4;
-      volatile  u_char SSCode[59];
-
-      volatile  u_char _16[0xC0];
-      volatile  u_short auxCmd;
-      volatile  u_char  dumpPtr[4];
-      volatile  u_char dumpVal;
-      volatile  u_char _17[0x6A];
-      volatile  u_char wireTest;
-      volatile  u_char _18[14];
-
-      /* Statistics Block - 0x0300 */
-      volatile  u_char hostcpuLock;
-      volatile  u_char lancpuLock;
-      volatile  u_char resetTime[18];
-      
-      volatile  u_char numDatagramsTransmitted[4];
-      volatile  u_char numReTransmissions[4];
-      volatile  u_char numFramesDiscarded[4];
-      volatile  u_char numDatagramsReceived[4];
-      volatile  u_char numDuplicateReceivedFrames[4];
-      volatile  u_char numDatagramsDiscarded[4];
-      
-      volatile  u_short maxNumReTransmitDatagram;
-      volatile  u_short maxNumReTransmitFrames;
-      volatile  u_short maxNumConsecutiveDuplicateFrames;
-      /* misaligned here so we have to go to characters */
-     
-      volatile  u_char numBytesTransmitted[4];
-      volatile  u_char numBytesReceived[4];
-      volatile  u_char numCRCErrors[4];
-      volatile  u_char numLengthErrors[4];
-      volatile  u_char numAbortErrors[4];
-      volatile  u_char numTXUnderruns[4];
-      volatile  u_char numRXOverruns[4];
-      volatile  u_char numHoldOffs[4];
-      volatile  u_char numFramesTransmitted[4];
-      volatile  u_char numFramesReceived[4];
-      volatile  u_char numReceiveFramesLost[4];
-      volatile  u_char numRXBufferOverflows[4];
-      volatile  u_char numFramesDiscardedAddrMismatch[4];
-      volatile  u_char numFramesDiscardedSIDMismatch[4];
-      volatile  u_char numPollsTransmistted[4];
-      volatile  u_char numPollAcknowledges[4];
-      volatile  u_char numStatusTimeouts[4];
-      volatile  u_char numNACKReceived[4];
-
-      volatile  u_char _19[0x86];
-
-      volatile  u_char txBuffer[0x800];
-      volatile  u_char rxBuffer[0x800];
-
-      volatile  u_char _20[0x800];
-      volatile  u_char _21[0x3fb];
-      volatile  u_char configStatus;
-      volatile  u_char _22;
-      volatile  u_char progIOCtrl;
-      volatile  u_char shareMBase;
-      volatile  u_char controlRegister;
-};
-
-struct arlan_conf_stru {
-      int spreadingCode;
-      int channelSet;
-      int channelNumber;
-      int scramblingDisable;
-      int txAttenuation;
-      int systemId; 
-      int maxDatagramSize;
-      int maxFrameSize;
-      int maxRetries;
-      int receiveMode;
-      int priority;
-      int rootOrRepeater;
-      int SID;
-      int radioNodeId;
-      int registrationMode;
-      int registrationFill;
-      int localTalkAddress;
-      int codeFormat;
-      int numChannels;
-      int channel1;
-      int channel2;
-      int channel3;
-      int channel4;
-      int txClear;
-      int txRetries;
-      int txRouting;
-      int txScrambled;
-      int rxParameter;
-      int txTimeoutMs;
-      int txAckTimeoutMs;
-      int waitCardTimeout;
-      int       waitTime;
-      int       lParameter;
-      int       _15;
-      int       headerSize;
-      int retries;
-      int tx_delay_ms;
-      int waitReTransmitPacketMaxSize;
-      int ReTransmitPacketMaxSize;
-      int fastReTransCount;
-      int driverRetransmissions;
-      int registrationInterrupts;
-      int hardwareType;
-      int radioType;
-      int writeRadioType;
-      int writeEEPROM;
-      char siteName[17];
-      int measure_rate;
-      int in_speed;
-      int out_speed;
-      int in_speed10;
-      int out_speed10;
-      int in_speed_max;
-      int out_speed_max;
-      int pre_Command_Wait;
-      int rx_tweak1;
-      int rx_tweak2;
-      int tx_queue_len;
-};
-
-extern struct arlan_conf_stru arlan_conf[MAX_ARLANS];
-
-struct TxParam
-{
-      volatile  short           offset;
-      volatile  short           length;
-      volatile  u_char          dest[6];
-      volatile  unsigned        char clear;
-      volatile  unsigned        char retries;
-      volatile  unsigned        char routing;
-      volatile  unsigned        char scrambled;
-};
-
-#define TX_RING_SIZE 2
-/* Information that need to be kept for each board. */
-struct arlan_private {
-      struct arlan_shmem __iomem * card;
-      struct arlan_shmem * conf;
-
-      struct arlan_conf_stru * Conf;         
-      int       bad;
-      int       reset;
-      unsigned long lastReset;
-      struct timer_list timer;
-      struct timer_list tx_delay_timer;
-      struct timer_list tx_retry_timer;
-      struct timer_list rx_check_timer;
-
-      int registrationLostCount;
-      int reRegisterExp;
-      int irq_test_done;
-
-      struct TxParam txRing[TX_RING_SIZE];
-      char reTransmitBuff[0x800];
-      int txLast;
-      unsigned ReTransmitRequested;
-      unsigned long tx_done_delayed;
-      unsigned long registrationLastSeen;
-
-      unsigned long     tx_last_sent;
-      unsigned long     tx_last_cleared;
-      unsigned long     retransmissions;
-      unsigned long     interrupt_ack_requested;
-      spinlock_t        lock;
-      unsigned long     waiting_command_mask;
-      unsigned long     card_polling_interval;
-      unsigned long     last_command_buff_free_time;
-
-      int               under_reset;
-      int               under_config;
-      int               rx_command_given;
-      int               tx_command_given;
-      unsigned  long    interrupt_processing_active;
-      unsigned long     last_rx_int_ack_time;
-      unsigned long     in_bytes;
-      unsigned long     out_bytes;
-      unsigned long     in_time;
-      unsigned long     out_time;
-      unsigned long     in_time10;
-      unsigned long     out_time10;
-      unsigned long     in_bytes10;
-      unsigned long     out_bytes10;
-      int       init_etherdev_alloc;
-};
-
-
-
-#define ARLAN_CLEAR             0x00
-#define ARLAN_RESET             0x01
-#define ARLAN_CHANNEL_ATTENTION 0x02
-#define ARLAN_INTERRUPT_ENABLE  0x04
-#define ARLAN_CLEAR_INTERRUPT   0x08
-#define ARLAN_POWER             0x40
-#define ARLAN_ACCESS            0x80
-
-#define ARLAN_COM_CONF                0x01
-#define ARLAN_COM_RX_ENABLE           0x03
-#define ARLAN_COM_RX_ABORT            0x04
-#define ARLAN_COM_TX_ENABLE           0x05
-#define ARLAN_COM_TX_ABORT            0x06
-#define ARLAN_COM_NOP                 0x07
-#define ARLAN_COM_STANDBY             0x08
-#define ARLAN_COM_ACTIVATE            0x09
-#define ARLAN_COM_GOTO_SLOW_POLL      0x0a
-#define ARLAN_COM_INT                 0x80
-
-
-#define TXLAST(dev) (((struct arlan_private *)netdev_priv(dev))->txRing[((struct arlan_private *)netdev_priv(dev))->txLast])
-#define TXHEAD(dev) (((struct arlan_private *)netdev_priv(dev))->txRing[0])
-#define TXTAIL(dev) (((struct arlan_private *)netdev_priv(dev))->txRing[1])
-
-#define TXBuffStart(dev) offsetof(struct arlan_shmem, txBuffer)
-#define TXBuffEnd(dev) offsetof(struct arlan_shmem, xxBuffer)
- 
-#define READSHM(to,from,atype) {\
-        atype tmp;\
-        memcpy_fromio(&(tmp),&(from),sizeof(atype));\
-        to = tmp;\
-        }
-
-#define READSHMEM(from,atype)\
-        atype from; \
-        READSHM(from, arlan->from, atype);
-
-#define WRITESHM(to,from,atype) \
-        { atype tmpSHM = from;\
-        memcpy_toio(&(to),&tmpSHM,sizeof(atype));\
-        }
-
-#define DEBUGSHM(levelSHM,stringSHM,stuff,atype) \
-        {       atype tmpSHM; \
-                memcpy_fromio(&tmpSHM,&(stuff),sizeof(atype));\
-                IFDEBUG(levelSHM) printk(stringSHM,tmpSHM);\
-        }
-
-#define WRITESHMB(to, val) \
-        writeb(val,&(to))
-#define READSHMB(to) \
-        readb(&(to))
-#define WRITESHMS(to, val) \
-        writew(val,&(to))
-#define READSHMS(to) \
-        readw(&(to))
-#define WRITESHMI(to, val) \
-        writel(val,&(to))
-#define READSHMI(to) \
-        readl(&(to))
-
-
-
-
-
-#define registrationBad(dev)\
-   ( (   READSHMB(((struct arlan_private *)netdev_priv(dev))->card->registrationMode)    > 0) && \
-     (   READSHMB(((struct arlan_private *)netdev_priv(dev))->card->registrationStatus) == 0)    )
-
-
-#define readControlRegister(dev)\
-        READSHMB(((struct arlan_private *)netdev_priv(dev))->card->cntrlRegImage)
-
-#define writeControlRegister(dev, v){\
-   WRITESHMB(((struct arlan_private *)netdev_priv(dev))->card->cntrlRegImage    ,((v) &0xF) );\
-   WRITESHMB(((struct arlan_private *)netdev_priv(dev))->card->controlRegister  ,(v)    );}
-
-
-#define arlan_interrupt_lancpu(dev) {\
-   int cr;   \
-   \
-   cr = readControlRegister(dev);\
-   if (cr & ARLAN_CHANNEL_ATTENTION){ \
-      writeControlRegister(dev, (cr & ~ARLAN_CHANNEL_ATTENTION));\
-   }else  \
-      writeControlRegister(dev, (cr | ARLAN_CHANNEL_ATTENTION));\
-}
-
-#define clearChannelAttention(dev){ \
-   writeControlRegister(dev,readControlRegister(dev) & ~ARLAN_CHANNEL_ATTENTION);}
-#define setHardwareReset(dev) {\
-   writeControlRegister(dev,readControlRegister(dev) | ARLAN_RESET);}
-#define clearHardwareReset(dev) {\
-   writeControlRegister(dev,readControlRegister(dev) & ~ARLAN_RESET);}
-#define setInterruptEnable(dev){\
-   writeControlRegister(dev,readControlRegister(dev) | ARLAN_INTERRUPT_ENABLE)  ;}
-#define clearInterruptEnable(dev){\
-   writeControlRegister(dev,readControlRegister(dev) & ~ARLAN_INTERRUPT_ENABLE)  ;}
-#define setClearInterrupt(dev){\
-   writeControlRegister(dev,readControlRegister(dev) | ARLAN_CLEAR_INTERRUPT)   ;}
-#define clearClearInterrupt(dev){\
-   writeControlRegister(dev,readControlRegister(dev) & ~ARLAN_CLEAR_INTERRUPT);}
-#define setPowerOff(dev){\
-   writeControlRegister(dev,readControlRegister(dev) | (ARLAN_POWER && ARLAN_ACCESS));\
-   writeControlRegister(dev,readControlRegister(dev) & ~ARLAN_ACCESS);}
-#define setPowerOn(dev){\
-   writeControlRegister(dev,readControlRegister(dev) & ~(ARLAN_POWER));   }
-#define arlan_lock_card_access(dev){\
-   writeControlRegister(dev,readControlRegister(dev) & ~ARLAN_ACCESS);}
-#define arlan_unlock_card_access(dev){\
-   writeControlRegister(dev,readControlRegister(dev) | ARLAN_ACCESS ); }  
-
-
-
-
-#define ARLAN_COMMAND_RX                0x000001
-#define ARLAN_COMMAND_NOOP              0x000002
-#define ARLAN_COMMAND_NOOPINT           0x000004
-#define ARLAN_COMMAND_TX                0x000008
-#define ARLAN_COMMAND_CONF              0x000010
-#define ARLAN_COMMAND_RESET             0x000020
-#define ARLAN_COMMAND_TX_ABORT          0x000040
-#define ARLAN_COMMAND_RX_ABORT          0x000080
-#define ARLAN_COMMAND_POWERDOWN         0x000100
-#define ARLAN_COMMAND_POWERUP           0x000200
-#define ARLAN_COMMAND_SLOW_POLL         0x000400
-#define ARLAN_COMMAND_ACTIVATE          0x000800
-#define ARLAN_COMMAND_INT_ACK           0x001000
-#define ARLAN_COMMAND_INT_ENABLE        0x002000
-#define ARLAN_COMMAND_WAIT_NOW          0x004000
-#define ARLAN_COMMAND_LONG_WAIT_NOW     0x008000
-#define ARLAN_COMMAND_STANDBY           0x010000
-#define ARLAN_COMMAND_INT_RACK          0x020000
-#define ARLAN_COMMAND_INT_RENABLE       0x040000
-#define ARLAN_COMMAND_CONF_WAIT         0x080000
-#define ARLAN_COMMAND_TBUSY_CLEAR       0x100000
-#define ARLAN_COMMAND_CLEAN_AND_CONF    (ARLAN_COMMAND_TX_ABORT\
-                                        | ARLAN_COMMAND_RX_ABORT\
-                                        | ARLAN_COMMAND_CONF)
-#define ARLAN_COMMAND_CLEAN_AND_RESET   (ARLAN_COMMAND_TX_ABORT\
-                                        | ARLAN_COMMAND_RX_ABORT\
-                                        | ARLAN_COMMAND_RESET)
-
-
- 
-#define ARLAN_DEBUG_CHAIN_LOCKS         0x00001
-#define ARLAN_DEBUG_RESET               0x00002
-#define ARLAN_DEBUG_TIMING              0x00004
-#define ARLAN_DEBUG_CARD_STATE          0x00008
-#define ARLAN_DEBUG_TX_CHAIN            0x00010
-#define ARLAN_DEBUG_MULTICAST           0x00020
-#define ARLAN_DEBUG_HEADER_DUMP         0x00040
-#define ARLAN_DEBUG_INTERRUPT           0x00080
-#define ARLAN_DEBUG_STARTUP             0x00100
-#define ARLAN_DEBUG_SHUTDOWN            0x00200
- 
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 8e1a55dec351..0fb419936dff 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -121,6 +121,14 @@ static struct fwentry firmwares[] = {
         [BOARD_505A] = { "atmel_at76c505a-rfmd2958.bin" },
         [BOARD_505AMX] = { "atmel_at76c505amx-rfmd.bin" },
 };
+MODULE_FIRMWARE("atmel_at76c503-i3861.bin");
+MODULE_FIRMWARE("atmel_at76c503-i3863.bin");
+MODULE_FIRMWARE("atmel_at76c503-rfmd.bin");
+MODULE_FIRMWARE("atmel_at76c503-rfmd-acc.bin");
+MODULE_FIRMWARE("atmel_at76c505-rfmd.bin");
+MODULE_FIRMWARE("atmel_at76c505-rfmd2958.bin");
+MODULE_FIRMWARE("atmel_at76c505a-rfmd2958.bin");
+MODULE_FIRMWARE("atmel_at76c505amx-rfmd.bin");
 
 #define USB_DEVICE_DATA(__ops)  .driver_info = (kernel_ulong_t)(__ops)
 
@@ -524,20 +532,6 @@ static char *hex2str(void *buf, int len)
         return ret;
 }
 
-#define MAC2STR_BUFFERS 4
-
-static inline char *mac2str(u8 *mac)
-{
-        static atomic_t a = ATOMIC_INIT(0);
-        static char bufs[MAC2STR_BUFFERS][6 * 3];
-        char *str;
-
-        str = bufs[atomic_inc_return(&a) & (MAC2STR_BUFFERS - 1)];
-        sprintf(str, "%02x:%02x:%02x:%02x:%02x:%02x",
-                mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
-        return str;
-}
-
 /* LED trigger */
 static int tx_activity;
 static void at76_ledtrig_tx_timerfunc(unsigned long data);
@@ -973,13 +967,13 @@ static void at76_dump_mib_mac_addr(struct at76_priv *priv)
                 goto exit;
         }
 
-        at76_dbg(DBG_MIB, "%s: MIB MAC_ADDR: mac_addr %s res 0x%x 0x%x",
+        at76_dbg(DBG_MIB, "%s: MIB MAC_ADDR: mac_addr %pM res 0x%x 0x%x",
                  wiphy_name(priv->hw->wiphy),
-                 mac2str(m->mac_addr), m->res[0], m->res[1]);
+                 m->mac_addr, m->res[0], m->res[1]);
         for (i = 0; i < ARRAY_SIZE(m->group_addr); i++)
-                at76_dbg(DBG_MIB, "%s: MIB MAC_ADDR: group addr %d: %s, "
+                at76_dbg(DBG_MIB, "%s: MIB MAC_ADDR: group addr %d: %pM, "
                          "status %d", wiphy_name(priv->hw->wiphy), i,
-                         mac2str(m->group_addr[i]), m->group_addr_status[i]);
+                         m->group_addr[i], m->group_addr_status[i]);
 exit:
         kfree(m);
 }
@@ -1042,7 +1036,7 @@ static void at76_dump_mib_mac_mgmt(struct at76_priv *priv)
         at76_dbg(DBG_MIB, "%s: MIB MAC_MGMT: beacon_period %d CFP_max_duration "
                  "%d medium_occupancy_limit %d station_id 0x%x ATIM_window %d "
                  "CFP_mode %d privacy_opt_impl %d DTIM_period %d CFP_period %d "
-                 "current_bssid %s current_essid %s current_bss_type %d "
+                 "current_bssid %pM current_essid %s current_bss_type %d "
                  "pm_mode %d ibss_change %d res %d "
                  "multi_domain_capability_implemented %d "
                  "international_roaming %d country_string %.3s",
@@ -1051,7 +1045,7 @@ static void at76_dump_mib_mac_mgmt(struct at76_priv *priv)
                  le16_to_cpu(m->medium_occupancy_limit),
                  le16_to_cpu(m->station_id), le16_to_cpu(m->ATIM_window),
                  m->CFP_mode, m->privacy_option_implemented, m->DTIM_period,
-                 m->CFP_period, mac2str(m->current_bssid),
+                 m->CFP_period, m->current_bssid,
                  hex2str(m->current_essid, IW_ESSID_MAX_SIZE),
                  m->current_bss_type, m->power_mgmt_mode, m->ibss_change,
                  m->res, m->multi_domain_capability_implemented,
@@ -1080,7 +1074,7 @@ static void at76_dump_mib_mac(struct at76_priv *priv)
                  "cwmin %d cwmax %d short_retry_time %d long_retry_time %d "
                  "scan_type %d scan_channel %d probe_delay %u "
                  "min_channel_time %d max_channel_time %d listen_int %d "
-                 "desired_ssid %s desired_bssid %s desired_bsstype %d",
+                 "desired_ssid %s desired_bssid %pM desired_bsstype %d",
                  wiphy_name(priv->hw->wiphy),
                  le32_to_cpu(m->max_tx_msdu_lifetime),
                  le32_to_cpu(m->max_rx_lifetime),
@@ -1092,7 +1086,7 @@ static void at76_dump_mib_mac(struct at76_priv *priv)
                  le16_to_cpu(m->max_channel_time),
                  le16_to_cpu(m->listen_interval),
                  hex2str(m->desired_ssid, IW_ESSID_MAX_SIZE),
-                 mac2str(m->desired_bssid), m->desired_bsstype);
+                 m->desired_bssid, m->desired_bsstype);
 exit:
         kfree(m);
 }
@@ -1194,6 +1188,9 @@ static int at76_start_monitor(struct at76_priv *priv)
         scan.channel = priv->channel;
         scan.scan_type = SCAN_TYPE_PASSIVE;
         scan.international_scan = 0;
+        scan.min_channel_time = cpu_to_le16(priv->scan_min_time);
+        scan.max_channel_time = cpu_to_le16(priv->scan_max_time);
+        scan.probe_delay = cpu_to_le16(0);
 
         ret = at76_set_card_command(priv->udev, CMD_SCAN, &scan, sizeof(scan));
         if (ret >= 0)
@@ -1792,7 +1789,7 @@ static void at76_mac80211_stop(struct ieee80211_hw *hw)
 }
 
 static int at76_add_interface(struct ieee80211_hw *hw,
-                              struct ieee80211_if_init_conf *conf)
+                              struct ieee80211_vif *vif)
 {
         struct at76_priv *priv = hw->priv;
         int ret = 0;
@@ -1801,7 +1798,7 @@ static int at76_add_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mtx);
 
-        switch (conf->type) {
+        switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 priv->iw_mode = IW_MODE_INFRA;
                 break;
@@ -1817,7 +1814,7 @@ exit:
 }
 
 static void at76_remove_interface(struct ieee80211_hw *hw,
-                                  struct ieee80211_if_init_conf *conf)
+                                  struct ieee80211_vif *vif)
 {
         at76_dbg(DBG_MAC80211, "%s()", __func__);
 }
@@ -2217,6 +2214,8 @@ static struct ieee80211_supported_band at76_supported_band = {
 static int at76_init_new_device(struct at76_priv *priv,
                                 struct usb_interface *interface)
 {
+        struct wiphy *wiphy;
+        size_t len;
         int ret;
 
         /* set up the endpoint information */
@@ -2254,6 +2253,7 @@ static int at76_init_new_device(struct at76_priv *priv,
         priv->device_unplugged = 0;
 
         /* mac80211 initialisation */
+        wiphy = priv->hw->wiphy;
         priv->hw->wiphy->max_scan_ssids = 1;
         priv->hw->wiphy->max_scan_ie_len = 0;
         priv->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
@@ -2265,6 +2265,13 @@ static int at76_init_new_device(struct at76_priv *priv,
         SET_IEEE80211_DEV(priv->hw, &interface->dev);
         SET_IEEE80211_PERM_ADDR(priv->hw, priv->mac_addr);
 
+        len = sizeof(wiphy->fw_version);
+        snprintf(wiphy->fw_version, len, "%d.%d.%d-%d",
+                 priv->fw_version.major, priv->fw_version.minor,
+                 priv->fw_version.patch, priv->fw_version.build);
+
+        wiphy->hw_version = priv->board_type;
+
         ret = ieee80211_register_hw(priv->hw);
         if (ret) {
                 printk(KERN_ERR "cannot register mac80211 hw (status %d)!\n",
@@ -2274,9 +2281,9 @@ static int at76_init_new_device(struct at76_priv *priv,
 
         priv->mac80211_registered = 1;
 
-        printk(KERN_INFO "%s: USB %s, MAC %s, firmware %d.%d.%d-%d\n",
+        printk(KERN_INFO "%s: USB %s, MAC %pM, firmware %d.%d.%d-%d\n",
                wiphy_name(priv->hw->wiphy),
-               dev_name(&interface->dev), mac2str(priv->mac_addr),
+               dev_name(&interface->dev), priv->mac_addr,
                priv->fw_version.major, priv->fw_version.minor,
                priv->fw_version.patch, priv->fw_version.build);
         printk(KERN_INFO "%s: regulatory domain 0x%02x: %s\n",
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index 11ded150b932..4e7a7fd695c8 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -1,6 +1,5 @@
 menuconfig ATH_COMMON
         tristate "Atheros Wireless Cards"
-        depends on WLAN_80211
         depends on CFG80211
         ---help---
           This will enable the support for the Atheros wireless drivers.
@@ -16,7 +15,15 @@ menuconfig ATH_COMMON
           http://wireless.kernel.org/en/users/Drivers/Atheros
 
 if ATH_COMMON
+
+config ATH_DEBUG
+        bool "Atheros wireless debugging"
+        ---help---
+          Say Y, if you want to debug atheros wireless drivers.
+          Right now only ath9k makes use of this.
+
 source "drivers/net/wireless/ath/ath5k/Kconfig"
 source "drivers/net/wireless/ath/ath9k/Kconfig"
 source "drivers/net/wireless/ath/ar9170/Kconfig"
+
 endif
diff --git a/drivers/net/wireless/ath/Makefile b/drivers/net/wireless/ath/Makefile
index 4bb0132ada37..8113a5042afa 100644
--- a/drivers/net/wireless/ath/Makefile
+++ b/drivers/net/wireless/ath/Makefile
@@ -1,6 +1,11 @@
 obj-$(CONFIG_ATH5K)             += ath5k/
-obj-$(CONFIG_ATH9K)             += ath9k/
+obj-$(CONFIG_ATH9K_HW)          += ath9k/
 obj-$(CONFIG_AR9170_USB)        += ar9170/
 
 obj-$(CONFIG_ATH_COMMON)        += ath.o
-ath-objs                := main.o regd.o
+
+ath-objs :=     main.o \
+                regd.o \
+                hw.o
+
+ath-$(CONFIG_ATH_DEBUG) += debug.o
diff --git a/drivers/net/wireless/ath/ar9170/Kconfig b/drivers/net/wireless/ath/ar9170/Kconfig
index 05918f1e685a..d7a4799d20fb 100644
--- a/drivers/net/wireless/ath/ar9170/Kconfig
+++ b/drivers/net/wireless/ath/ar9170/Kconfig
@@ -1,6 +1,6 @@
 config AR9170_USB
         tristate "Atheros AR9170 802.11n USB support"
-        depends on USB && MAC80211 && WLAN_80211
+        depends on USB && MAC80211
         select FW_LOADER
         help
           This is a driver for the Atheros "otus" 802.11n USB devices.
diff --git a/drivers/net/wireless/ath/ar9170/ar9170.h b/drivers/net/wireless/ath/ar9170/ar9170.h
index 914e4718a9a8..dc662b76a1c8 100644
--- a/drivers/net/wireless/ath/ar9170/ar9170.h
+++ b/drivers/net/wireless/ath/ar9170/ar9170.h
@@ -109,7 +109,6 @@ struct ar9170_rxstream_mpdu_merge {
         bool has_plcp;
 };
 
-#define AR9170_NUM_MAX_BA_RETRY 5
 #define AR9170_NUM_TID  16
 #define WME_BA_BMP_SIZE         64
 #define AR9170_NUM_MAX_AGG_LEN  (2 * WME_BA_BMP_SIZE)
@@ -143,7 +142,12 @@ struct ar9170_sta_tid {
         u16 tid;
         enum ar9170_tid_state state;
         bool active;
-        u8 retry;
+};
+
+struct ar9170_tx_queue_stats {
+        unsigned int len;
+        unsigned int limit;
+        unsigned int count;
 };
 
 #define AR9170_QUEUE_TIMEOUT            64
@@ -154,12 +158,15 @@ struct ar9170_sta_tid {
 
 #define AR9170_NUM_TX_STATUS            128
 #define AR9170_NUM_TX_AGG_MAX           30
+#define AR9170_NUM_TX_LIMIT_HARD       AR9170_TXQ_DEPTH
+#define AR9170_NUM_TX_LIMIT_SOFT       (AR9170_TXQ_DEPTH - 10)
 
 struct ar9170 {
         struct ieee80211_hw *hw;
         struct ath_common common;
         struct mutex mutex;
         enum ar9170_device_state state;
+        bool registered;
         unsigned long bad_hw_nagger;
 
         int (*open)(struct ar9170 *);
@@ -172,8 +179,6 @@ struct ar9170 {
 
         /* interface mode settings */
         struct ieee80211_vif *vif;
-        u8 mac_addr[ETH_ALEN];
-        u8 bssid[ETH_ALEN];
 
         /* beaconing */
         struct sk_buff *beacon;
@@ -204,6 +209,8 @@ struct ar9170 {
         u8 power_2G_ht20[8];
         u8 power_2G_ht40[8];
 
+        u8 phy_heavy_clip;
+
 #ifdef CONFIG_AR9170_LEDS
         struct delayed_work led_work;
         struct ar9170_led leds[AR9170_NUM_LEDS];
@@ -211,7 +218,7 @@ struct ar9170 {
 
         /* qos queue settings */
         spinlock_t tx_stats_lock;
-        struct ieee80211_tx_queue_stats tx_stats[5];
+        struct ar9170_tx_queue_stats tx_stats[5];
         struct ieee80211_tx_queue_params edcf[5];
 
         spinlock_t cmdlock;
@@ -231,7 +238,7 @@ struct ar9170 {
         struct sk_buff_head tx_status_ampdu;
         spinlock_t tx_ampdu_list_lock;
         struct list_head tx_ampdu_list;
-        unsigned int tx_ampdu_pending;
+        atomic_t tx_ampdu_pending;
 
         /* rxstream mpdu merge */
         struct ar9170_rxstream_mpdu_merge rx_mpdu;
@@ -248,13 +255,8 @@ struct ar9170_sta_info {
         unsigned int ampdu_max_len;
 };
 
-#define AR9170_TX_FLAG_WAIT_FOR_ACK     BIT(0)
-#define AR9170_TX_FLAG_NO_ACK           BIT(1)
-#define AR9170_TX_FLAG_BLOCK_ACK        BIT(2)
-
 struct ar9170_tx_info {
         unsigned long timeout;
-        unsigned int flags;
 };
 
 #define IS_STARTED(a)           (((struct ar9170 *)a)->state >= AR9170_STARTED)
diff --git a/drivers/net/wireless/ath/ar9170/cmd.c b/drivers/net/wireless/ath/ar9170/cmd.c
index f57a6200167b..cf6f5c4174a6 100644
--- a/drivers/net/wireless/ath/ar9170/cmd.c
+++ b/drivers/net/wireless/ath/ar9170/cmd.c
@@ -72,8 +72,7 @@ int ar9170_write_reg(struct ar9170 *ar, const u32 reg, const u32 val)
         return err;
 }
 
-static int ar9170_read_mreg(struct ar9170 *ar, int nregs,
-                            const u32 *regs, u32 *out)
+int ar9170_read_mreg(struct ar9170 *ar, int nregs, const u32 *regs, u32 *out)
 {
         int i, err;
         __le32 *offs, *res;
diff --git a/drivers/net/wireless/ath/ar9170/cmd.h b/drivers/net/wireless/ath/ar9170/cmd.h
index a4f0e50e52b4..826c45e6b274 100644
--- a/drivers/net/wireless/ath/ar9170/cmd.h
+++ b/drivers/net/wireless/ath/ar9170/cmd.h
@@ -44,6 +44,7 @@
 int ar9170_write_mem(struct ar9170 *ar, const __le32 *data, size_t len);
 int ar9170_write_reg(struct ar9170 *ar, const u32 reg, const u32 val);
 int ar9170_read_reg(struct ar9170 *ar, u32 reg, u32 *val);
+int ar9170_read_mreg(struct ar9170 *ar, int nregs, const u32 *regs, u32 *out);
 int ar9170_echo_test(struct ar9170 *ar, u32 v);
 
 /*
diff --git a/drivers/net/wireless/ath/ar9170/hw.h b/drivers/net/wireless/ath/ar9170/hw.h
index 6cbfb2f83391..0a1d4c28e68a 100644
--- a/drivers/net/wireless/ath/ar9170/hw.h
+++ b/drivers/net/wireless/ath/ar9170/hw.h
@@ -152,14 +152,14 @@ enum ar9170_cmd {
 #define         AR9170_MAC_REG_FTF_BIT14                BIT(14)
 #define         AR9170_MAC_REG_FTF_BIT15                BIT(15)
 #define         AR9170_MAC_REG_FTF_BAR                  BIT(24)
-#define         AR9170_MAC_REG_FTF_BIT25                BIT(25)
+#define         AR9170_MAC_REG_FTF_BA                   BIT(25)
 #define         AR9170_MAC_REG_FTF_PSPOLL               BIT(26)
 #define         AR9170_MAC_REG_FTF_RTS                  BIT(27)
 #define         AR9170_MAC_REG_FTF_CTS                  BIT(28)
 #define         AR9170_MAC_REG_FTF_ACK                  BIT(29)
 #define         AR9170_MAC_REG_FTF_CFE                  BIT(30)
 #define         AR9170_MAC_REG_FTF_CFE_ACK              BIT(31)
-#define         AR9170_MAC_REG_FTF_DEFAULTS             0x0500ffff
+#define         AR9170_MAC_REG_FTF_DEFAULTS             0x0700ffff
 #define         AR9170_MAC_REG_FTF_MONITOR              0xfd00ffff
 
 #define AR9170_MAC_REG_RX_TOTAL                 (AR9170_MAC_REG_BASE + 0x6A0)
@@ -276,6 +276,7 @@ struct ar9170_tx_control {
 #define AR9170_TX_MAC_RATE_PROBE                0x8000
 
 /* either-or */
+#define AR9170_TX_PHY_MOD_MASK                  0x00000003
 #define AR9170_TX_PHY_MOD_CCK                   0x00000000
 #define AR9170_TX_PHY_MOD_OFDM                  0x00000001
 #define AR9170_TX_PHY_MOD_HT                    0x00000002
@@ -311,6 +312,8 @@ struct ar9170_tx_control {
 
 #define AR9170_TX_PHY_SHORT_GI                  0x80000000
 
+#define AR5416_MAX_RATE_POWER                   63
+
 struct ar9170_rx_head {
         u8 plcp[12];
 } __packed;
diff --git a/drivers/net/wireless/ath/ar9170/mac.c b/drivers/net/wireless/ath/ar9170/mac.c
index 614e3218a2bc..857e86104295 100644
--- a/drivers/net/wireless/ath/ar9170/mac.c
+++ b/drivers/net/wireless/ath/ar9170/mac.c
@@ -35,6 +35,9 @@
  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
+
+#include <asm/unaligned.h>
+
 #include "ar9170.h"
 #include "cmd.h"
 
@@ -114,7 +117,7 @@ int ar9170_set_qos(struct ar9170 *ar)
         ar9170_regwrite(AR9170_MAC_REG_AC1_AC0_TXOP,
                         ar->edcf[0].txop | ar->edcf[1].txop << 16);
         ar9170_regwrite(AR9170_MAC_REG_AC3_AC2_TXOP,
-                        ar->edcf[1].txop | ar->edcf[3].txop << 16);
+                        ar->edcf[2].txop | ar->edcf[3].txop << 16);
 
         ar9170_regwrite_finish();
 
@@ -227,11 +230,8 @@ static int ar9170_set_mac_reg(struct ar9170 *ar, const u32 reg, const u8 *mac)
 
         ar9170_regwrite_begin(ar);
 
-        ar9170_regwrite(reg,
-                        (mac[3] << 24) | (mac[2] << 16) |
-                        (mac[1] << 8) | mac[0]);
-
-        ar9170_regwrite(reg + 4, (mac[5] << 8) | mac[4]);
+        ar9170_regwrite(reg, get_unaligned_le32(mac));
+        ar9170_regwrite(reg + 4, get_unaligned_le16(mac + 4));
 
         ar9170_regwrite_finish();
 
@@ -311,13 +311,14 @@ static int ar9170_set_promiscouous(struct ar9170 *ar)
 
 int ar9170_set_operating_mode(struct ar9170 *ar)
 {
+        struct ath_common *common = &ar->common;
         u32 pm_mode = AR9170_MAC_REG_POWERMGT_DEFAULTS;
         u8 *mac_addr, *bssid;
         int err;
 
         if (ar->vif) {
-                mac_addr = ar->mac_addr;
-                bssid = ar->bssid;
+                mac_addr = common->macaddr;
+                bssid = common->curbssid;
 
                 switch (ar->vif->type) {
                 case NL80211_IFTYPE_MESH_POINT:
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index c1f8c69db165..c53692980990 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -38,6 +38,7 @@
  */
 
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/etherdevice.h>
 #include <net/mac80211.h>
@@ -194,12 +195,15 @@ static inline u16 ar9170_get_seq(struct sk_buff *skb)
         return ar9170_get_seq_h((void *) txc->frame_data);
 }
 
+static inline u16 ar9170_get_tid_h(struct ieee80211_hdr *hdr)
+{
+        return (ieee80211_get_qos_ctl(hdr))[0] & IEEE80211_QOS_CTL_TID_MASK;
+}
+
 static inline u16 ar9170_get_tid(struct sk_buff *skb)
 {
         struct ar9170_tx_control *txc = (void *) skb->data;
-        struct ieee80211_hdr *hdr = (void *) txc->frame_data;
-
-        return (ieee80211_get_qos_ctl(hdr))[0] & IEEE80211_QOS_CTL_TID_MASK;
+        return ar9170_get_tid_h((struct ieee80211_hdr *) txc->frame_data);
 }
 
 #define GET_NEXT_SEQ(seq)       ((seq + 1) & 0x0fff)
@@ -213,10 +217,10 @@ static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
         struct ar9170_tx_info *arinfo = (void *) txinfo->rate_driver_data;
         struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 
-        printk(KERN_DEBUG "%s: => FRAME [skb:%p, q:%d, DA:[%pM] flags:%x s:%d "
+        printk(KERN_DEBUG "%s: => FRAME [skb:%p, q:%d, DA:[%pM] s:%d "
                           "mac_ctrl:%04x, phy_ctrl:%08x, timeout:[%d ms]]\n",
                wiphy_name(ar->hw->wiphy), skb, skb_get_queue_mapping(skb),
-               ieee80211_get_DA(hdr), arinfo->flags, ar9170_get_seq_h(hdr),
+               ieee80211_get_DA(hdr), ar9170_get_seq_h(hdr),
                le16_to_cpu(txc->mac_control), le32_to_cpu(txc->phy_control),
                jiffies_to_msecs(arinfo->timeout - jiffies));
 }
@@ -391,7 +395,7 @@ static void ar9170_tx_fake_ampdu_status(struct ar9170 *ar)
                 ieee80211_tx_status_irqsafe(ar->hw, skb);
         }
 
-        for_each_bit(i, &queue_bitmap, BITS_PER_BYTE) {
+        for_each_set_bit(i, &queue_bitmap, BITS_PER_BYTE) {
 #ifdef AR9170_QUEUE_STOP_DEBUG
                 printk(KERN_DEBUG "%s: wake queue %d\n",
                        wiphy_name(ar->hw->wiphy), i);
@@ -414,9 +418,9 @@ static void ar9170_tx_ampdu_callback(struct ar9170 *ar, struct sk_buff *skb)
 
         skb_queue_tail(&ar->tx_status_ampdu, skb);
         ar9170_tx_fake_ampdu_status(ar);
-        ar->tx_ampdu_pending--;
 
-        if (!list_empty(&ar->tx_ampdu_list) && !ar->tx_ampdu_pending)
+        if (atomic_dec_and_test(&ar->tx_ampdu_pending) &&
+            !list_empty(&ar->tx_ampdu_list))
                 ar9170_tx_ampdu(ar);
 }
 
@@ -430,7 +434,7 @@ void ar9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb)
         spin_lock_irqsave(&ar->tx_stats_lock, flags);
         ar->tx_stats[queue].len--;
 
-        if (skb_queue_empty(&ar->tx_pending[queue])) {
+        if (ar->tx_stats[queue].len < AR9170_NUM_TX_LIMIT_SOFT) {
 #ifdef AR9170_QUEUE_STOP_DEBUG
                 printk(KERN_DEBUG "%s: wake queue %d\n",
                        wiphy_name(ar->hw->wiphy), queue);
@@ -440,22 +444,17 @@ void ar9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb)
         }
         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 
-        if (arinfo->flags & AR9170_TX_FLAG_BLOCK_ACK) {
-                ar9170_tx_ampdu_callback(ar, skb);
-        } else if (arinfo->flags & AR9170_TX_FLAG_WAIT_FOR_ACK) {
-                arinfo->timeout = jiffies +
-                                  msecs_to_jiffies(AR9170_TX_TIMEOUT);
-
-                skb_queue_tail(&ar->tx_status[queue], skb);
-        } else if (arinfo->flags & AR9170_TX_FLAG_NO_ACK) {
+        if (info->flags & IEEE80211_TX_CTL_NO_ACK) {
                 ar9170_tx_status(ar, skb, AR9170_TX_STATUS_FAILED);
         } else {
-#ifdef AR9170_QUEUE_DEBUG
-                printk(KERN_DEBUG "%s: unsupported frame flags!\n",
-                       wiphy_name(ar->hw->wiphy));
-                ar9170_print_txheader(ar, skb);
-#endif /* AR9170_QUEUE_DEBUG */
-                dev_kfree_skb_any(skb);
+                if (info->flags & IEEE80211_TX_CTL_AMPDU) {
+                        ar9170_tx_ampdu_callback(ar, skb);
+                } else {
+                        arinfo->timeout = jiffies +
+                                  msecs_to_jiffies(AR9170_TX_TIMEOUT);
+
+                        skb_queue_tail(&ar->tx_status[queue], skb);
+                }
         }
 
         if (!ar->tx_stats[queue].len &&
@@ -850,6 +849,7 @@ static int ar9170_rx_mac_status(struct ar9170 *ar,
                 }
                 break;
 
+        case AR9170_RX_STATUS_MODULATION_DUPOFDM:
         case AR9170_RX_STATUS_MODULATION_OFDM:
                 switch (head->plcp[0] & 0xf) {
                 case 0xb:
@@ -897,8 +897,7 @@ static int ar9170_rx_mac_status(struct ar9170 *ar,
                 status->flag |= RX_FLAG_HT;
                 break;
 
-        case AR9170_RX_STATUS_MODULATION_DUPOFDM:
-                /* XXX */
+        default:
                 if (ar9170_nag_limiter(ar))
                         printk(KERN_ERR "%s: invalid modulation\n",
                                wiphy_name(ar->hw->wiphy));
@@ -1248,6 +1247,7 @@ static int ar9170_op_start(struct ieee80211_hw *hw)
         ar->global_ampdu_density = 6;
         ar->global_ampdu_factor = 3;
 
+        atomic_set(&ar->tx_ampdu_pending, 0);
         ar->bad_hw_nagger = jiffies;
 
         err = ar->open(ar);
@@ -1406,17 +1406,6 @@ static int ar9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
 
         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
              (is_valid_ether_addr(ieee80211_get_DA(hdr)))) {
-                if (info->flags & IEEE80211_TX_CTL_AMPDU) {
-                        if (unlikely(!info->control.sta))
-                                goto err_out;
-
-                        txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
-                        arinfo->flags = AR9170_TX_FLAG_BLOCK_ACK;
-
-                        goto out;
-                }
-
-                txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
                 /*
                  * WARNING:
                  * Putting the QoS queue bits into an unexplored territory is
@@ -1430,12 +1419,17 @@ static int ar9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
 
                 txc->phy_control |=
                         cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
-                arinfo->flags = AR9170_TX_FLAG_WAIT_FOR_ACK;
-        } else {
-                arinfo->flags = AR9170_TX_FLAG_NO_ACK;
+
+                if (info->flags & IEEE80211_TX_CTL_AMPDU) {
+                        if (unlikely(!info->control.sta))
+                                goto err_out;
+
+                        txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
+                } else {
+                        txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
+                }
         }
 
-out:
         return 0;
 
 err_out:
@@ -1670,8 +1664,7 @@ static bool ar9170_tx_ampdu(struct ar9170 *ar)
                  * tell the FW/HW that this is the last frame,
                  * that way it will wait for the immediate block ack.
                  */
-                if (likely(skb_peek_tail(&agg)))
-                        ar9170_tx_indicate_immba(ar, skb_peek_tail(&agg));
+                ar9170_tx_indicate_immba(ar, skb_peek_tail(&agg));
 
 #ifdef AR9170_TXAGG_DEBUG
                 printk(KERN_DEBUG "%s: generated A-MPDU looks like this:\n",
@@ -1715,6 +1708,21 @@ static void ar9170_tx(struct ar9170 *ar)
 
         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
                 spin_lock_irqsave(&ar->tx_stats_lock, flags);
+                frames = min(ar->tx_stats[i].limit - ar->tx_stats[i].len,
+                             skb_queue_len(&ar->tx_pending[i]));
+
+                if (remaining_space < frames) {
+#ifdef AR9170_QUEUE_DEBUG
+                        printk(KERN_DEBUG "%s: tx quota reached queue:%d, "
+                               "remaining slots:%d, needed:%d\n",
+                               wiphy_name(ar->hw->wiphy), i, remaining_space,
+                               frames);
+#endif /* AR9170_QUEUE_DEBUG */
+                        frames = remaining_space;
+                }
+
+                ar->tx_stats[i].len += frames;
+                ar->tx_stats[i].count += frames;
                 if (ar->tx_stats[i].len >= ar->tx_stats[i].limit) {
 #ifdef AR9170_QUEUE_DEBUG
                         printk(KERN_DEBUG "%s: queue %d full\n",
@@ -1732,25 +1740,8 @@ static void ar9170_tx(struct ar9170 *ar)
                         __ar9170_dump_txstats(ar);
 #endif /* AR9170_QUEUE_STOP_DEBUG */
                         ieee80211_stop_queue(ar->hw, i);
-                        spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
-                        continue;
                 }
 
-                frames = min(ar->tx_stats[i].limit - ar->tx_stats[i].len,
-                             skb_queue_len(&ar->tx_pending[i]));
-
-                if (remaining_space < frames) {
-#ifdef AR9170_QUEUE_DEBUG
-                        printk(KERN_DEBUG "%s: tx quota reached queue:%d, "
-                               "remaining slots:%d, needed:%d\n",
-                               wiphy_name(ar->hw->wiphy), i, remaining_space,
-                               frames);
-#endif /* AR9170_QUEUE_DEBUG */
-                        frames = remaining_space;
-                }
-
-                ar->tx_stats[i].len += frames;
-                ar->tx_stats[i].count += frames;
                 spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 
                 if (!frames)
@@ -1772,8 +1763,8 @@ static void ar9170_tx(struct ar9170 *ar)
                         arinfo->timeout = jiffies +
                                           msecs_to_jiffies(AR9170_TX_TIMEOUT);
 
-                        if (arinfo->flags == AR9170_TX_FLAG_BLOCK_ACK)
-                                ar->tx_ampdu_pending++;
+                        if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                                atomic_inc(&ar->tx_ampdu_pending);
 
 #ifdef AR9170_QUEUE_DEBUG
                         printk(KERN_DEBUG "%s: send frame q:%d =>\n",
@@ -1783,8 +1774,8 @@ static void ar9170_tx(struct ar9170 *ar)
 
                         err = ar->tx(ar, skb);
                         if (unlikely(err)) {
-                                if (arinfo->flags == AR9170_TX_FLAG_BLOCK_ACK)
-                                        ar->tx_ampdu_pending--;
+                                if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                                        atomic_dec(&ar->tx_ampdu_pending);
 
                                 frames_failed++;
                                 dev_kfree_skb_any(skb);
@@ -1931,7 +1922,7 @@ int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         if (info->flags & IEEE80211_TX_CTL_AMPDU) {
                 bool run = ar9170_tx_ampdu_queue(ar, skb);
 
-                if (run || !ar->tx_ampdu_pending)
+                if (run || !atomic_read(&ar->tx_ampdu_pending))
                         ar9170_tx_ampdu(ar);
         } else {
                 unsigned int queue = skb_get_queue_mapping(skb);
@@ -1949,9 +1940,10 @@ err_free:
 }
 
 static int ar9170_op_add_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_if_init_conf *conf)
+                                   struct ieee80211_vif *vif)
 {
         struct ar9170 *ar = hw->priv;
+        struct ath_common *common = &ar->common;
         int err = 0;
 
         mutex_lock(&ar->mutex);
@@ -1961,8 +1953,8 @@ static int ar9170_op_add_interface(struct ieee80211_hw *hw,
                 goto unlock;
         }
 
-        ar->vif = conf->vif;
-        memcpy(ar->mac_addr, conf->mac_addr, ETH_ALEN);
+        ar->vif = vif;
+        memcpy(common->macaddr, vif->addr, ETH_ALEN);
 
         if (modparam_nohwcrypt || (ar->vif->type != NL80211_IFTYPE_STATION)) {
                 ar->rx_software_decryption = true;
@@ -1982,7 +1974,7 @@ unlock:
 }
 
 static void ar9170_op_remove_interface(struct ieee80211_hw *hw,
-                                       struct ieee80211_if_init_conf *conf)
+                                       struct ieee80211_vif *vif)
 {
         struct ar9170 *ar = hw->priv;
 
@@ -2131,12 +2123,13 @@ static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
                                        u32 changed)
 {
         struct ar9170 *ar = hw->priv;
+        struct ath_common *common = &ar->common;
         int err = 0;
 
         mutex_lock(&ar->mutex);
 
         if (changed & BSS_CHANGED_BSSID) {
-                memcpy(ar->bssid, bss_conf->bssid, ETH_ALEN);
+                memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
                 err = ar9170_set_operating_mode(ar);
                 if (err)
                         goto out;
@@ -2190,22 +2183,30 @@ static u64 ar9170_op_get_tsf(struct ieee80211_hw *hw)
 {
         struct ar9170 *ar = hw->priv;
         int err;
-        u32 tsf_low;
-        u32 tsf_high;
         u64 tsf;
+#define NR 3
+        static const u32 addr[NR] = { AR9170_MAC_REG_TSF_H,
+                                    AR9170_MAC_REG_TSF_L,
+                                    AR9170_MAC_REG_TSF_H };
+        u32 val[NR];
+        int loops = 0;
 
         mutex_lock(&ar->mutex);
-        err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_L, &tsf_low);
-        if (!err)
-                err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_H, &tsf_high);
+
+        while (loops++ < 10) {
+                err = ar9170_read_mreg(ar, NR, addr, val);
+                if (err || val[0] == val[2])
+                        break;
+        }
+
         mutex_unlock(&ar->mutex);
 
         if (WARN_ON(err))
                 return 0;
-
-        tsf = tsf_high;
-        tsf = (tsf << 32) | tsf_low;
+        tsf = val[0];
+        tsf = (tsf << 32) | val[1];
         return tsf;
+#undef NR
 }
 
 static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -2329,55 +2330,55 @@ out:
         return err;
 }
 
-static void ar9170_sta_notify(struct ieee80211_hw *hw,
-                              struct ieee80211_vif *vif,
-                              enum sta_notify_cmd cmd,
-                              struct ieee80211_sta *sta)
+static int ar9170_sta_add(struct ieee80211_hw *hw,
+                          struct ieee80211_vif *vif,
+                          struct ieee80211_sta *sta)
 {
         struct ar9170 *ar = hw->priv;
         struct ar9170_sta_info *sta_info = (void *) sta->drv_priv;
         unsigned int i;
 
-        switch (cmd) {
-        case STA_NOTIFY_ADD:
-                memset(sta_info, 0, sizeof(*sta_info));
+        memset(sta_info, 0, sizeof(*sta_info));
 
-                if (!sta->ht_cap.ht_supported)
-                        break;
+        if (!sta->ht_cap.ht_supported)
+                return 0;
 
-                if (sta->ht_cap.ampdu_density > ar->global_ampdu_density)
-                        ar->global_ampdu_density = sta->ht_cap.ampdu_density;
+        if (sta->ht_cap.ampdu_density > ar->global_ampdu_density)
+                ar->global_ampdu_density = sta->ht_cap.ampdu_density;
 
-                if (sta->ht_cap.ampdu_factor < ar->global_ampdu_factor)
-                        ar->global_ampdu_factor = sta->ht_cap.ampdu_factor;
+        if (sta->ht_cap.ampdu_factor < ar->global_ampdu_factor)
+                ar->global_ampdu_factor = sta->ht_cap.ampdu_factor;
 
-                for (i = 0; i < AR9170_NUM_TID; i++) {
-                        sta_info->agg[i].state = AR9170_TID_STATE_SHUTDOWN;
-                        sta_info->agg[i].active = false;
-                        sta_info->agg[i].ssn = 0;
-                        sta_info->agg[i].retry = 0;
-                        sta_info->agg[i].tid = i;
-                        INIT_LIST_HEAD(&sta_info->agg[i].list);
-                        skb_queue_head_init(&sta_info->agg[i].queue);
-                }
+        for (i = 0; i < AR9170_NUM_TID; i++) {
+                sta_info->agg[i].state = AR9170_TID_STATE_SHUTDOWN;
+                sta_info->agg[i].active = false;
+                sta_info->agg[i].ssn = 0;
+                sta_info->agg[i].tid = i;
+                INIT_LIST_HEAD(&sta_info->agg[i].list);
+                skb_queue_head_init(&sta_info->agg[i].queue);
+        }
 
-                sta_info->ampdu_max_len = 1 << (3 + sta->ht_cap.ampdu_factor);
-                break;
+        sta_info->ampdu_max_len = 1 << (3 + sta->ht_cap.ampdu_factor);
 
-        case STA_NOTIFY_REMOVE:
-                if (!sta->ht_cap.ht_supported)
-                        break;
+        return 0;
+}
 
-                for (i = 0; i < AR9170_NUM_TID; i++) {
-                        sta_info->agg[i].state = AR9170_TID_STATE_INVALID;
-                        skb_queue_purge(&sta_info->agg[i].queue);
-                }
+static int ar9170_sta_remove(struct ieee80211_hw *hw,
+                             struct ieee80211_vif *vif,
+                             struct ieee80211_sta *sta)
+{
+        struct ar9170_sta_info *sta_info = (void *) sta->drv_priv;
+        unsigned int i;
 
-                break;
+        if (!sta->ht_cap.ht_supported)
+                return 0;
 
-        default:
-                break;
+        for (i = 0; i < AR9170_NUM_TID; i++) {
+                sta_info->agg[i].state = AR9170_TID_STATE_INVALID;
+                skb_queue_purge(&sta_info->agg[i].queue);
         }
+
+        return 0;
 }
 
 static int ar9170_get_stats(struct ieee80211_hw *hw,
@@ -2397,18 +2398,6 @@ static int ar9170_get_stats(struct ieee80211_hw *hw,
         return 0;
 }
 
-static int ar9170_get_tx_stats(struct ieee80211_hw *hw,
-                               struct ieee80211_tx_queue_stats *tx_stats)
-{
-        struct ar9170 *ar = hw->priv;
-
-        spin_lock_bh(&ar->tx_stats_lock);
-        memcpy(tx_stats, ar->tx_stats, sizeof(tx_stats[0]) * hw->queues);
-        spin_unlock_bh(&ar->tx_stats_lock);
-
-        return 0;
-}
-
 static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
                           const struct ieee80211_tx_queue_params *param)
 {
@@ -2430,6 +2419,7 @@ static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
 }
 
 static int ar9170_ampdu_action(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
                                enum ieee80211_ampdu_mlme_action action,
                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
 {
@@ -2459,7 +2449,7 @@ static int ar9170_ampdu_action(struct ieee80211_hw *hw,
                 tid_info->state = AR9170_TID_STATE_PROGRESS;
                 tid_info->active = false;
                 spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
-                ieee80211_start_tx_ba_cb_irqsafe(hw, sta->addr, tid);
+                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
 
         case IEEE80211_AMPDU_TX_STOP:
@@ -2469,7 +2459,7 @@ static int ar9170_ampdu_action(struct ieee80211_hw *hw,
                 tid_info->active = false;
                 skb_queue_purge(&tid_info->queue);
                 spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
-                ieee80211_stop_tx_ba_cb_irqsafe(hw, sta->addr, tid);
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
 
         case IEEE80211_AMPDU_TX_OPERATIONAL:
@@ -2507,9 +2497,9 @@ static const struct ieee80211_ops ar9170_ops = {
         .bss_info_changed       = ar9170_op_bss_info_changed,
         .get_tsf                = ar9170_op_get_tsf,
         .set_key                = ar9170_set_key,
-        .sta_notify             = ar9170_sta_notify,
+        .sta_add                = ar9170_sta_add,
+        .sta_remove             = ar9170_sta_remove,
         .get_stats              = ar9170_get_stats,
-        .get_tx_stats           = ar9170_get_tx_stats,
         .ampdu_action           = ar9170_ampdu_action,
 };
 
@@ -2523,7 +2513,7 @@ void *ar9170_alloc(size_t priv_size)
         /*
          * this buffer is used for rx stream reconstruction.
          * Under heavy load this device (or the transport layer?)
-         * tends to split the streams into seperate rx descriptors.
+         * tends to split the streams into separate rx descriptors.
          */
 
         skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL);
@@ -2712,7 +2702,8 @@ int ar9170_register(struct ar9170 *ar, struct device *pdev)
         dev_info(pdev, "Atheros AR9170 is registered as '%s'\n",
                  wiphy_name(ar->hw->wiphy));
 
-        return err;
+        ar->registered = true;
+        return 0;
 
 err_unreg:
         ieee80211_unregister_hw(ar->hw);
@@ -2723,11 +2714,14 @@ err_out:
 
 void ar9170_unregister(struct ar9170 *ar)
 {
+        if (ar->registered) {
 #ifdef CONFIG_AR9170_LEDS
-        ar9170_unregister_leds(ar);
+                ar9170_unregister_leds(ar);
 #endif /* CONFIG_AR9170_LEDS */
 
-        kfree_skb(ar->rx_failover);
         ieee80211_unregister_hw(ar->hw);
+        }
+
+        kfree_skb(ar->rx_failover);
         mutex_destroy(&ar->mutex);
 }
diff --git a/drivers/net/wireless/ath/ar9170/phy.c b/drivers/net/wireless/ath/ar9170/phy.c
index dbd488da18b1..45a415ea809a 100644
--- a/drivers/net/wireless/ath/ar9170/phy.c
+++ b/drivers/net/wireless/ath/ar9170/phy.c
@@ -1239,9 +1239,6 @@ static u8 ar9170_get_max_edge_power(struct ar9170 *ar,
                                     struct ar9170_calctl_edges edges[],
                                     u32 freq)
 {
-/* TODO: move somewhere else */
-#define AR5416_MAX_RATE_POWER        63
-
         int i;
         u8 rc = AR5416_MAX_RATE_POWER;
         u8 f;
@@ -1259,10 +1256,11 @@ static u8 ar9170_get_max_edge_power(struct ar9170 *ar,
                         break;
                 }
                 if (i > 0 && f < edges[i].channel) {
-                        if (f > edges[i-1].channel &&
-                            edges[i-1].power_flags & AR9170_CALCTL_EDGE_FLAGS) {
+                        if (f > edges[i - 1].channel &&
+                            edges[i - 1].power_flags &
+                            AR9170_CALCTL_EDGE_FLAGS) {
                                 /* lower channel has the inband flag set */
-                                rc = edges[i-1].power_flags &
+                                rc = edges[i - 1].power_flags &
                                         ~AR9170_CALCTL_EDGE_FLAGS;
                         }
                         break;
@@ -1270,18 +1268,48 @@ static u8 ar9170_get_max_edge_power(struct ar9170 *ar,
         }
 
         if (i == AR5416_NUM_BAND_EDGES) {
-                if (f > edges[i-1].channel &&
-                    edges[i-1].power_flags & AR9170_CALCTL_EDGE_FLAGS) {
+                if (f > edges[i - 1].channel &&
+                    edges[i - 1].power_flags & AR9170_CALCTL_EDGE_FLAGS) {
                         /* lower channel has the inband flag set */
-                        rc = edges[i-1].power_flags &
+                        rc = edges[i - 1].power_flags &
                                 ~AR9170_CALCTL_EDGE_FLAGS;
                 }
         }
         return rc;
 }
 
-/* calculate the conformance test limits and apply them to ar->power*
- * (derived from otus hal/hpmain.c, line 3706 ff.)
+static u8 ar9170_get_heavy_clip(struct ar9170 *ar,
+                                struct ar9170_calctl_edges edges[],
+                                u32 freq, enum ar9170_bw bw)
+{
+        u8 f;
+        int i;
+        u8 rc = 0;
+
+        if (freq < 3000)
+                f = freq - 2300;
+        else
+                f = (freq - 4800) / 5;
+
+        if (bw == AR9170_BW_40_BELOW || bw == AR9170_BW_40_ABOVE)
+                rc |= 0xf0;
+
+        for (i = 0; i < AR5416_NUM_BAND_EDGES; i++) {
+                if (edges[i].channel == 0xff)
+                        break;
+                if (f == edges[i].channel) {
+                        if (!(edges[i].power_flags & AR9170_CALCTL_EDGE_FLAGS))
+                                rc |= 0x0f;
+                        break;
+                }
+        }
+
+        return rc;
+}
+
+/*
+ * calculate the conformance test limits and the heavy clip parameter
+ * and apply them to ar->power* (derived from otus hal/hpmain.c, line 3706)
  */
 static void ar9170_calc_ctl(struct ar9170 *ar, u32 freq, enum ar9170_bw bw)
 {
@@ -1295,7 +1323,8 @@ static void ar9170_calc_ctl(struct ar9170 *ar, u32 freq, enum ar9170_bw bw)
                 int pwr_cal_len;
         } *modes;
 
-        /* order is relevant in the mode_list_*: we fall back to the
+        /*
+         * order is relevant in the mode_list_*: we fall back to the
          * lower indices if any mode is missed in the EEPROM.
          */
         struct ctl_modes mode_list_2ghz[] = {
@@ -1313,7 +1342,10 @@ static void ar9170_calc_ctl(struct ar9170 *ar, u32 freq, enum ar9170_bw bw)
 
 #define EDGES(c, n) (ar->eeprom.ctl_data[c].control_edges[n])
 
-        /* TODO: investigate the differences between OTUS'
+        ar->phy_heavy_clip = 0;
+
+        /*
+         * TODO: investigate the differences between OTUS'
          * hpreg.c::zfHpGetRegulatoryDomain() and
          * ath/regd.c::ath_regd_get_band_ctl() -
          * e.g. for FCC3_WORLD the OTUS procedure
@@ -1347,6 +1379,15 @@ static void ar9170_calc_ctl(struct ar9170 *ar, u32 freq, enum ar9170_bw bw)
                 if (ctl_idx < AR5416_NUM_CTLS) {
                         int f_off = 0;
 
+                        /* determine heav clip parameter from
+                           the 11G edges array */
+                        if (modes[i].ctl_mode == CTL_11G) {
+                                ar->phy_heavy_clip =
+                                        ar9170_get_heavy_clip(ar,
+                                                              EDGES(ctl_idx, 1),
+                                                              freq, bw);
+                        }
+
                         /* adjust freq for 40MHz */
                         if (modes[i].ctl_mode == CTL_2GHT40 ||
                             modes[i].ctl_mode == CTL_5GHT40) {
@@ -1360,13 +1401,15 @@ static void ar9170_calc_ctl(struct ar9170 *ar, u32 freq, enum ar9170_bw bw)
                                 ar9170_get_max_edge_power(ar, EDGES(ctl_idx, 1),
                                                           freq+f_off);
 
-                        /* TODO: check if the regulatory max. power is
+                        /*
+                         * TODO: check if the regulatory max. power is
                          *  controlled by cfg80211 for DFS
                          * (hpmain applies it to max_power itself for DFS freq)
                          */
 
                 } else {
-                        /* Workaround in otus driver, hpmain.c, line 3906:
+                        /*
+                         * Workaround in otus driver, hpmain.c, line 3906:
                          * if no data for 5GHT20 are found, take the
                          * legacy 5G value.
                          * We extend this here to fallback from any other *HT or
@@ -1390,6 +1433,19 @@ static void ar9170_calc_ctl(struct ar9170 *ar, u32 freq, enum ar9170_bw bw)
                                                        modes[i].max_power);
                 }
         }
+
+        if (ar->phy_heavy_clip & 0xf0) {
+                ar->power_2G_ht40[0]--;
+                ar->power_2G_ht40[1]--;
+                ar->power_2G_ht40[2]--;
+        }
+        if (ar->phy_heavy_clip & 0xf) {
+                ar->power_2G_ht20[0]++;
+                ar->power_2G_ht20[1]++;
+                ar->power_2G_ht20[2]++;
+        }
+
+
 #undef EDGES
 }
 
@@ -1499,8 +1555,6 @@ static int ar9170_set_power_cal(struct ar9170 *ar, u32 freq, enum ar9170_bw bw)
         /* calc. conformance test limits and apply to ar->power*[] */
         ar9170_calc_ctl(ar, freq, bw);
 
-        /* TODO: (heavy clip) regulatory domain power level fine-tuning. */
-
         /* set ACK/CTS TX power */
         ar9170_regwrite_begin(ar);
 
@@ -1643,6 +1697,17 @@ int ar9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
         if (err)
                 return err;
 
+        if (ar->phy_heavy_clip) {
+                err = ar9170_write_reg(ar, 0x1c59e0,
+                                       0x200 | ar->phy_heavy_clip);
+                if (err) {
+                        if (ar9170_nag_limiter(ar))
+                                printk(KERN_ERR "%s: failed to set "
+                                       "heavy clip\n",
+                                       wiphy_name(ar->hw->wiphy));
+                }
+        }
+
         for (i = 0; i < 2; i++) {
                 ar->noise[i] = ar9170_calc_noise_dbm(
                                 (le32_to_cpu(vals[2 + i]) >> 19) & 0x1ff);
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index e974e5829e1a..e1c2fcaa8bed 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -38,6 +38,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
@@ -68,8 +69,10 @@ static struct usb_device_id ar9170_usb_ids[] = {
         { USB_DEVICE(0x0cf3, 0x1002) },
         /* Cace Airpcap NX */
         { USB_DEVICE(0xcace, 0x0300) },
-        /* D-Link DWA 160A */
+        /* D-Link DWA 160 A1 */
         { USB_DEVICE(0x07d1, 0x3c10) },
+        /* D-Link DWA 160 A2 */
+        { USB_DEVICE(0x07d1, 0x3a09) },
         /* Netgear WNDA3100 */
         { USB_DEVICE(0x0846, 0x9010) },
         /* Netgear WN111 v2 */
@@ -82,6 +85,8 @@ static struct usb_device_id ar9170_usb_ids[] = {
         { USB_DEVICE(0x0cde, 0x0023) },
         /* Z-Com UB82 ABG */
         { USB_DEVICE(0x0cde, 0x0026) },
+        /* Sphairon Homelink 1202 */
+        { USB_DEVICE(0x0cde, 0x0027) },
         /* Arcadyan WN7512 */
         { USB_DEVICE(0x083a, 0xf522) },
         /* Planex GWUS300 */
@@ -90,6 +95,8 @@ static struct usb_device_id ar9170_usb_ids[] = {
         { USB_DEVICE(0x04bb, 0x093f) },
         /* AVM FRITZ!WLAN USB Stick N */
         { USB_DEVICE(0x057C, 0x8401) },
+        /* NEC WL300NU-G */
+        { USB_DEVICE(0x0409, 0x0249) },
         /* AVM FRITZ!WLAN USB Stick N 2.4 */
         { USB_DEVICE(0x057C, 0x8402), .driver_info = AR9170_REQ_FW1_ONLY },
 
@@ -108,15 +115,15 @@ static void ar9170_usb_submit_urb(struct ar9170_usb *aru)
                 return ;
 
         spin_lock_irqsave(&aru->tx_urb_lock, flags);
-        if (aru->tx_submitted_urbs >= AR9170_NUM_TX_URBS) {
+        if (atomic_read(&aru->tx_submitted_urbs) >= AR9170_NUM_TX_URBS) {
                 spin_unlock_irqrestore(&aru->tx_urb_lock, flags);
                 return ;
         }
-        aru->tx_submitted_urbs++;
+        atomic_inc(&aru->tx_submitted_urbs);
 
         urb = usb_get_from_anchor(&aru->tx_pending);
         if (!urb) {
-                aru->tx_submitted_urbs--;
+                atomic_dec(&aru->tx_submitted_urbs);
                 spin_unlock_irqrestore(&aru->tx_urb_lock, flags);
 
                 return ;
@@ -133,7 +140,7 @@ static void ar9170_usb_submit_urb(struct ar9170_usb *aru)
                                 err);
 
                 usb_unanchor_urb(urb);
-                aru->tx_submitted_urbs--;
+                atomic_dec(&aru->tx_submitted_urbs);
                 ar9170_tx_callback(&aru->common, urb->context);
         }
 
@@ -151,7 +158,7 @@ static void ar9170_usb_tx_urb_complete_frame(struct urb *urb)
                 return ;
         }
 
-        aru->tx_submitted_urbs--;
+        atomic_dec(&aru->tx_submitted_urbs);
 
         ar9170_tx_callback(&aru->common, skb);
 
@@ -412,7 +419,7 @@ static int ar9170_usb_exec_cmd(struct ar9170 *ar, enum ar9170_cmd cmd,
         spin_unlock_irqrestore(&aru->common.cmdlock, flags);
 
         usb_fill_int_urb(urb, aru->udev,
-                         usb_sndbulkpipe(aru->udev, AR9170_EP_CMD),
+                         usb_sndintpipe(aru->udev, AR9170_EP_CMD),
                          aru->common.cmdbuf, plen + 4,
                          ar9170_usb_tx_urb_complete, NULL, 1);
 
@@ -578,43 +585,6 @@ static int ar9170_usb_upload(struct ar9170_usb *aru, const void *data,
         return 0;
 }
 
-static int ar9170_usb_request_firmware(struct ar9170_usb *aru)
-{
-        int err = 0;
-
-        err = request_firmware(&aru->firmware, "ar9170.fw",
-                               &aru->udev->dev);
-        if (!err) {
-                aru->init_values = NULL;
-                return 0;
-        }
-
-        if (aru->req_one_stage_fw) {
-                dev_err(&aru->udev->dev, "ar9170.fw firmware file "
-                        "not found and is required for this device\n");
-                return -EINVAL;
-        }
-
-        dev_err(&aru->udev->dev, "ar9170.fw firmware file "
-                "not found, trying old firmware...\n");
-
-        err = request_firmware(&aru->init_values, "ar9170-1.fw",
-                               &aru->udev->dev);
-        if (err) {
-                dev_err(&aru->udev->dev, "file with init values not found.\n");
-                return err;
-        }
-
-        err = request_firmware(&aru->firmware, "ar9170-2.fw", &aru->udev->dev);
-        if (err) {
-                release_firmware(aru->init_values);
-                dev_err(&aru->udev->dev, "firmware file not found.\n");
-                return err;
-        }
-
-        return err;
-}
-
 static int ar9170_usb_reset(struct ar9170_usb *aru)
 {
         int ret, lock = (aru->intf->condition != USB_INTERFACE_BINDING);
@@ -753,6 +723,109 @@ err_out:
         return err;
 }
 
+static void ar9170_usb_firmware_failed(struct ar9170_usb *aru)
+{
+        struct device *parent = aru->udev->dev.parent;
+
+        complete(&aru->firmware_loading_complete);
+
+        /* unbind anything failed */
+        if (parent)
+                down(&parent->sem);
+        device_release_driver(&aru->udev->dev);
+        if (parent)
+                up(&parent->sem);
+
+        usb_put_dev(aru->udev);
+}
+
+static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
+{
+        struct ar9170_usb *aru = context;
+        int err;
+
+        aru->firmware = fw;
+
+        if (!fw) {
+                dev_err(&aru->udev->dev, "firmware file not found.\n");
+                goto err_freefw;
+        }
+
+        err = ar9170_usb_init_device(aru);
+        if (err)
+                goto err_freefw;
+
+        err = ar9170_usb_open(&aru->common);
+        if (err)
+                goto err_unrx;
+
+        err = ar9170_register(&aru->common, &aru->udev->dev);
+
+        ar9170_usb_stop(&aru->common);
+        if (err)
+                goto err_unrx;
+
+        complete(&aru->firmware_loading_complete);
+        usb_put_dev(aru->udev);
+        return;
+
+ err_unrx:
+        ar9170_usb_cancel_urbs(aru);
+
+ err_freefw:
+        ar9170_usb_firmware_failed(aru);
+}
+
+static void ar9170_usb_firmware_inits(const struct firmware *fw,
+                                      void *context)
+{
+        struct ar9170_usb *aru = context;
+        int err;
+
+        if (!fw) {
+                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                ar9170_usb_firmware_failed(aru);
+                return;
+        }
+
+        aru->init_values = fw;
+
+        /* ok so we have the init values -- get code for two-stage */
+
+        err = request_firmware_nowait(THIS_MODULE, 1, "ar9170-2.fw",
+                                      &aru->udev->dev, GFP_KERNEL, aru,
+                                      ar9170_usb_firmware_finish);
+        if (err)
+                ar9170_usb_firmware_failed(aru);
+}
+
+static void ar9170_usb_firmware_step2(const struct firmware *fw, void *context)
+{
+        struct ar9170_usb *aru = context;
+        int err;
+
+        if (fw) {
+                ar9170_usb_firmware_finish(fw, context);
+                return;
+        }
+
+        if (aru->req_one_stage_fw) {
+                dev_err(&aru->udev->dev, "ar9170.fw firmware file "
+                        "not found and is required for this device\n");
+                ar9170_usb_firmware_failed(aru);
+                return;
+        }
+
+        dev_err(&aru->udev->dev, "ar9170.fw firmware file "
+                "not found, trying old firmware...\n");
+
+        err = request_firmware_nowait(THIS_MODULE, 1, "ar9170-1.fw",
+                                      &aru->udev->dev, GFP_KERNEL, aru,
+                                      ar9170_usb_firmware_inits);
+        if (err)
+                ar9170_usb_firmware_failed(aru);
+}
+
 static bool ar9170_requires_one_stage(const struct usb_device_id *id)
 {
         if (!id->driver_info)
@@ -791,10 +864,11 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         init_usb_anchor(&aru->tx_pending);
         init_usb_anchor(&aru->tx_submitted);
         init_completion(&aru->cmd_wait);
+        init_completion(&aru->firmware_loading_complete);
         spin_lock_init(&aru->tx_urb_lock);
 
         aru->tx_pending_urbs = 0;
-        aru->tx_submitted_urbs = 0;
+        atomic_set(&aru->tx_submitted_urbs, 0);
 
         aru->common.stop = ar9170_usb_stop;
         aru->common.flush = ar9170_usb_flush;
@@ -810,33 +884,10 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         if (err)
                 goto err_freehw;
 
-        err = ar9170_usb_request_firmware(aru);
-        if (err)
-                goto err_freehw;
-
-        err = ar9170_usb_init_device(aru);
-        if (err)
-                goto err_freefw;
-
-        err = ar9170_usb_open(ar);
-        if (err)
-                goto err_unrx;
-
-        err = ar9170_register(ar, &udev->dev);
-
-        ar9170_usb_stop(ar);
-        if (err)
-                goto err_unrx;
-
-        return 0;
-
-err_unrx:
-        ar9170_usb_cancel_urbs(aru);
-
-err_freefw:
-        release_firmware(aru->init_values);
-        release_firmware(aru->firmware);
-
+        usb_get_dev(aru->udev);
+        return request_firmware_nowait(THIS_MODULE, 1, "ar9170.fw",
+                                       &aru->udev->dev, GFP_KERNEL, aru,
+                                       ar9170_usb_firmware_step2);
 err_freehw:
         usb_set_intfdata(intf, NULL);
         usb_put_dev(udev);
@@ -853,15 +904,18 @@ static void ar9170_usb_disconnect(struct usb_interface *intf)
                 return;
 
         aru->common.state = AR9170_IDLE;
+
+        wait_for_completion(&aru->firmware_loading_complete);
+
         ar9170_unregister(&aru->common);
         ar9170_usb_cancel_urbs(aru);
 
-        release_firmware(aru->init_values);
-        release_firmware(aru->firmware);
-
         usb_put_dev(aru->udev);
         usb_set_intfdata(intf, NULL);
         ieee80211_free_hw(aru->common.hw);
+
+        release_firmware(aru->init_values);
+        release_firmware(aru->firmware);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/net/wireless/ath/ar9170/usb.h b/drivers/net/wireless/ath/ar9170/usb.h
index d098f4d5d2f2..919b06046eb3 100644
--- a/drivers/net/wireless/ath/ar9170/usb.h
+++ b/drivers/net/wireless/ath/ar9170/usb.h
@@ -67,10 +67,11 @@ struct ar9170_usb {
         bool req_one_stage_fw;
 
         spinlock_t tx_urb_lock;
-        unsigned int tx_submitted_urbs;
+        atomic_t tx_submitted_urbs;
         unsigned int tx_pending_urbs;
 
         struct completion cmd_wait;
+        struct completion firmware_loading_complete;
         int readlen;
         u8 *readbuf;
 
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index a63e90cbf9e5..71fc960814f0 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -18,6 +18,35 @@
 #define ATH_H
 
 #include <linux/skbuff.h>
+#include <linux/if_ether.h>
+#include <net/mac80211.h>
+
+/*
+ * The key cache is used for h/w cipher state and also for
+ * tracking station state such as the current tx antenna.
+ * We also setup a mapping table between key cache slot indices
+ * and station state to short-circuit node lookups on rx.
+ * Different parts have different size key caches.  We handle
+ * up to ATH_KEYMAX entries (could dynamically allocate state).
+ */
+#define ATH_KEYMAX              128     /* max key cache size we handle */
+
+static const u8 ath_bcast_mac[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+struct ath_ani {
+        bool caldone;
+        int16_t noise_floor;
+        unsigned int longcal_timer;
+        unsigned int shortcal_timer;
+        unsigned int resetcal_timer;
+        unsigned int checkani_timer;
+        struct timer_list timer;
+};
+
+enum ath_device_state {
+        ATH_HW_UNAVAILABLE,
+        ATH_HW_INITIALIZED,
+};
 
 struct reg_dmn_pair_mapping {
         u16 regDmnEnum;
@@ -36,13 +65,52 @@ struct ath_regulatory {
         struct reg_dmn_pair_mapping *regpair;
 };
 
+struct ath_ops {
+        unsigned int (*read)(void *, u32 reg_offset);
+        void (*write)(void *, u32 val, u32 reg_offset);
+};
+
+struct ath_common;
+
+struct ath_bus_ops {
+        void            (*read_cachesize)(struct ath_common *common, int *csz);
+        bool            (*eeprom_read)(struct ath_common *common, u32 off, u16 *data);
+        void            (*bt_coex_prep)(struct ath_common *common);
+};
+
 struct ath_common {
+        void *ah;
+        void *priv;
+        struct ieee80211_hw *hw;
+        int debug_mask;
+        enum ath_device_state state;
+
+        struct ath_ani ani;
+
         u16 cachelsz;
+        u16 curaid;
+        u8 macaddr[ETH_ALEN];
+        u8 curbssid[ETH_ALEN];
+        u8 bssidmask[ETH_ALEN];
+
+        u8 tx_chainmask;
+        u8 rx_chainmask;
+
+        u32 rx_bufsize;
+
+        u32 keymax;
+        DECLARE_BITMAP(keymap, ATH_KEYMAX);
+        u8 splitmic;
+
         struct ath_regulatory regulatory;
+        const struct ath_ops *ops;
+        const struct ath_bus_ops *bus_ops;
 };
 
 struct sk_buff *ath_rxbuf_alloc(struct ath_common *common,
                                 u32 len,
                                 gfp_t gfp_mask);
 
+void ath_hw_setbssidmask(struct ath_common *common);
+
 #endif /* ATH_H */
diff --git a/drivers/net/wireless/ath/ath5k/Kconfig b/drivers/net/wireless/ath/ath5k/Kconfig
index 06d006675d7d..eb83b7b4d0e3 100644
--- a/drivers/net/wireless/ath/ath5k/Kconfig
+++ b/drivers/net/wireless/ath/ath5k/Kconfig
@@ -1,6 +1,6 @@
 config ATH5K
         tristate "Atheros 5xxx wireless cards support"
-        depends on PCI && MAC80211 && WLAN_80211
+        depends on PCI && MAC80211
         select MAC80211_LEDS
         select LEDS_CLASS
         select NEW_LEDS
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index 6cd5efcec417..ac67f02e26d8 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -35,6 +35,7 @@
  * TODO: Make a more generic struct (eg. add more stuff to ath5k_capabilities)
  * and clean up common bits, then introduce set/get functions in eeprom.c */
 #include "eeprom.h"
+#include "../ath.h"
 
 /* PCI IDs */
 #define PCI_DEVICE_ID_ATHEROS_AR5210            0x0007 /* AR5210 */
@@ -165,13 +166,6 @@
 #define AR5K_INI_VAL_XR                 0
 #define AR5K_INI_VAL_MAX                5
 
-/* Used for BSSID etc manipulation */
-#define AR5K_LOW_ID(_a)(                                \
-(_a)[0] | (_a)[1] << 8 | (_a)[2] << 16 | (_a)[3] << 24  \
-)
-
-#define AR5K_HIGH_ID(_a)        ((_a)[4] | (_a)[5] << 8)
-
 /*
  * Some tuneable values (these should be changeable by the user)
  * TODO: Make use of them and add more options OR use debug/configfs
@@ -204,6 +198,7 @@
 #define AR5K_TUNE_CWMAX_11B                     1023
 #define AR5K_TUNE_CWMAX_XR                      7
 #define AR5K_TUNE_NOISE_FLOOR                   -72
+#define AR5K_TUNE_CCA_MAX_GOOD_VALUE            -95
 #define AR5K_TUNE_MAX_TXPOWER                   63
 #define AR5K_TUNE_DEFAULT_TXPOWER               25
 #define AR5K_TUNE_TPC_TXPOWER                   false
@@ -540,13 +535,12 @@ struct ath5k_txq_info {
         u32     tqi_cbr_period; /* Constant bit rate period */
         u32     tqi_cbr_overflow_limit;
         u32     tqi_burst_time;
-        u32     tqi_ready_time; /* Not used */
+        u32     tqi_ready_time; /* Time queue waits after an event */
 };
 
 /*
  * Transmit packet types.
  * used on tx control descriptor
- * TODO: Use them inside base.c corectly
  */
 enum ath5k_pkt_type {
         AR5K_PKT_TYPE_NORMAL            = 0,
@@ -1012,6 +1006,14 @@ struct ath5k_capabilities {
         } cap_queues;
 };
 
+/* size of noise floor history (keep it a power of two) */
+#define ATH5K_NF_CAL_HIST_MAX   8
+struct ath5k_nfcal_hist
+{
+        s16 index;                              /* current index into nfval */
+        s16 nfval[ATH5K_NF_CAL_HIST_MAX];       /* last few noise floors */
+};
+
 
 /***************************************\
   HARDWARE ABSTRACTION LAYER STRUCTURE
@@ -1027,6 +1029,7 @@ struct ath5k_capabilities {
 /* TODO: Clean up and merge with ath5k_softc */
 struct ath5k_hw {
         u32                     ah_magic;
+        struct ath_common       common;
 
         struct ath5k_softc      *ah_sc;
         void __iomem            *ah_iobase;
@@ -1059,6 +1062,7 @@ struct ath5k_hw {
         u32                     ah_cw_min;
         u32                     ah_cw_max;
         u32                     ah_limit_tx_retries;
+        u8                      ah_coverage_class;
 
         /* Antenna Control */
         u32                     ah_ant_ctl[AR5K_EEPROM_N_MODES][AR5K_ANT_MAX];
@@ -1067,14 +1071,6 @@ struct ath5k_hw {
         u8                      ah_def_ant;
         bool                    ah_software_retry;
 
-        u8                      ah_sta_id[ETH_ALEN];
-
-        /* Current BSSID we are trying to assoc to / create.
-         * This is passed by mac80211 on config_interface() and cached here for
-         * use in resets */
-        u8                      ah_bssid[ETH_ALEN];
-        u8                      ah_bssid_mask[ETH_ALEN];
-
         int                     ah_gpio_npins;
 
         struct ath5k_capabilities ah_capabilities;
@@ -1125,6 +1121,8 @@ struct ath5k_hw {
                 struct ieee80211_channel r_last_channel;
         } ah_radar;
 
+        struct ath5k_nfcal_hist ah_nfcal_hist;
+
         /* noise floor from last periodic calibration */
         s32                     ah_noise_floor;
 
@@ -1160,7 +1158,7 @@ struct ath5k_hw {
  */
 
 /* Attach/Detach Functions */
-extern struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc);
+extern int ath5k_hw_attach(struct ath5k_softc *sc);
 extern void ath5k_hw_detach(struct ath5k_hw *ah);
 
 /* LED functions */
@@ -1202,11 +1200,11 @@ extern bool ath5k_eeprom_is_hb63(struct ath5k_hw *ah);
 
 /* Protocol Control Unit Functions */
 extern int ath5k_hw_set_opmode(struct ath5k_hw *ah);
+extern void ath5k_hw_set_coverage_class(struct ath5k_hw *ah, u8 coverage_class);
 /* BSSID Functions */
-extern void ath5k_hw_get_lladdr(struct ath5k_hw *ah, u8 *mac);
 extern int ath5k_hw_set_lladdr(struct ath5k_hw *ah, const u8 *mac);
-extern void ath5k_hw_set_associd(struct ath5k_hw *ah, const u8 *bssid, u16 assoc_id);
-extern int ath5k_hw_set_bssid_mask(struct ath5k_hw *ah, const u8 *mask);
+extern void ath5k_hw_set_associd(struct ath5k_hw *ah);
+extern void ath5k_hw_set_bssid_mask(struct ath5k_hw *ah, const u8 *mask);
 /* Receive start/stop functions */
 extern void ath5k_hw_start_rx_pcu(struct ath5k_hw *ah);
 extern void ath5k_hw_stop_rx_pcu(struct ath5k_hw *ah);
@@ -1234,6 +1232,10 @@ extern int ath5k_hw_set_ack_timeout(struct ath5k_hw *ah, unsigned int timeout);
 extern unsigned int ath5k_hw_get_ack_timeout(struct ath5k_hw *ah);
 extern int ath5k_hw_set_cts_timeout(struct ath5k_hw *ah, unsigned int timeout);
 extern unsigned int ath5k_hw_get_cts_timeout(struct ath5k_hw *ah);
+/* Clock rate related functions */
+unsigned int ath5k_hw_htoclock(struct ath5k_hw *ah, unsigned int usec);
+unsigned int ath5k_hw_clocktoh(struct ath5k_hw *ah, unsigned int clock);
+unsigned int ath5k_hw_get_clockrate(struct ath5k_hw *ah);
 /* Key table (WEP) functions */
 extern int ath5k_hw_reset_key(struct ath5k_hw *ah, u16 entry);
 extern int ath5k_hw_is_key_valid(struct ath5k_hw *ah, u16 entry);
@@ -1288,8 +1290,10 @@ extern int ath5k_hw_rfgain_opt_init(struct ath5k_hw *ah);
 extern bool ath5k_channel_ok(struct ath5k_hw *ah, u16 freq, unsigned int flags);
 extern int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *channel);
 /* PHY calibration */
+void ath5k_hw_init_nfcal_hist(struct ath5k_hw *ah);
 extern int ath5k_hw_phy_calibrate(struct ath5k_hw *ah, struct ieee80211_channel *channel);
 extern int ath5k_hw_noise_floor_calibration(struct ath5k_hw *ah, short freq);
+extern s16 ath5k_hw_get_noise_floor(struct ath5k_hw *ah);
 extern void ath5k_hw_calibration_poll(struct ath5k_hw *ah);
 /* Spur mitigation */
 bool ath5k_hw_chan_has_spur_noise(struct ath5k_hw *ah,
@@ -1311,35 +1315,21 @@ extern int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, u8 txpower);
  * Functions used internaly
  */
 
-/*
- * Translate usec to hw clock units
- * TODO: Half/quarter rate
- */
-static inline unsigned int ath5k_hw_htoclock(unsigned int usec, bool turbo)
+static inline struct ath_common *ath5k_hw_common(struct ath5k_hw *ah)
 {
-        return turbo ? (usec * 80) : (usec * 40);
+        return &ah->common;
 }
 
-/*
- * Translate hw clock units to usec
- * TODO: Half/quarter rate
- */
-static inline unsigned int ath5k_hw_clocktoh(unsigned int clock, bool turbo)
+static inline struct ath_regulatory *ath5k_hw_regulatory(struct ath5k_hw *ah)
 {
-        return turbo ? (clock / 80) : (clock / 40);
+        return &(ath5k_hw_common(ah)->regulatory);
 }
 
-/*
- * Read from a register
- */
 static inline u32 ath5k_hw_reg_read(struct ath5k_hw *ah, u16 reg)
 {
         return ioread32(ah->ah_iobase + reg);
 }
 
-/*
- * Write to a register
- */
 static inline void ath5k_hw_reg_write(struct ath5k_hw *ah, u32 val, u16 reg)
 {
         iowrite32(val, ah->ah_iobase + reg);
diff --git a/drivers/net/wireless/ath/ath5k/attach.c b/drivers/net/wireless/ath/ath5k/attach.c
index 71a1bd254517..dc0786cc2639 100644
--- a/drivers/net/wireless/ath/ath5k/attach.c
+++ b/drivers/net/wireless/ath/ath5k/attach.c
@@ -21,6 +21,7 @@
 \*************************************/
 
 #include <linux/pci.h>
+#include <linux/slab.h>
 #include "ath5k.h"
 #include "reg.h"
 #include "debug.h"
@@ -101,25 +102,15 @@ static int ath5k_hw_post(struct ath5k_hw *ah)
  * -ENODEV if the device is not supported or prints an error msg if something
  * else went wrong.
  */
-struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc)
+int ath5k_hw_attach(struct ath5k_softc *sc)
 {
-        struct ath5k_hw *ah;
+        struct ath5k_hw *ah = sc->ah;
+        struct ath_common *common = ath5k_hw_common(ah);
         struct pci_dev *pdev = sc->pdev;
         struct ath5k_eeprom_info *ee;
         int ret;
         u32 srev;
 
-        /*If we passed the test malloc a ath5k_hw struct*/
-        ah = kzalloc(sizeof(struct ath5k_hw), GFP_KERNEL);
-        if (ah == NULL) {
-                ret = -ENOMEM;
-                ATH5K_ERR(sc, "out of memory\n");
-                goto err;
-        }
-
-        ah->ah_sc = sc;
-        ah->ah_iobase = sc->iobase;
-
         /*
          * HW information
          */
@@ -278,12 +269,12 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc)
                 goto err_free;
         }
 
+        ee = &ah->ah_capabilities.cap_eeprom;
+
         /*
          * Write PCI-E power save settings
          */
         if ((ah->ah_version == AR5K_AR5212) && (pdev->is_pcie)) {
-                struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
-
                 ath5k_hw_reg_write(ah, 0x9248fc00, AR5K_PCIE_SERDES);
                 ath5k_hw_reg_write(ah, 0x24924924, AR5K_PCIE_SERDES);
 
@@ -321,7 +312,6 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc)
         }
 
         /* Crypto settings */
-        ee = &ah->ah_capabilities.cap_eeprom;
         ah->ah_aes_support = srev >= AR5K_SREV_AR5212_V4 &&
                 (ee->ee_version >= AR5K_EEPROM_VERSION_5_0 &&
                  !AR5K_EEPROM_AES_DIS(ee->ee_misc5));
@@ -336,20 +326,21 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc)
         ath5k_hw_set_lladdr(ah, (u8[ETH_ALEN]){});
 
         /* Set BSSID to bcast address: ff:ff:ff:ff:ff:ff for now */
-        memset(ah->ah_bssid, 0xff, ETH_ALEN);
-        ath5k_hw_set_associd(ah, ah->ah_bssid, 0);
+        memcpy(common->curbssid, ath_bcast_mac, ETH_ALEN);
+        ath5k_hw_set_associd(ah);
         ath5k_hw_set_opmode(ah);
 
         ath5k_hw_rfgain_opt_init(ah);
 
+        ath5k_hw_init_nfcal_hist(ah);
+
         /* turn on HW LEDs */
         ath5k_hw_set_ledstate(ah, AR5K_LED_INIT);
 
-        return ah;
+        return 0;
 err_free:
         kfree(ah);
-err:
-        return ERR_PTR(ret);
+        return ret;
 }
 
 /**
@@ -369,5 +360,4 @@ void ath5k_hw_detach(struct ath5k_hw *ah)
         ath5k_eeprom_detach(ah);
 
         /* assume interrupts are down */
-        kfree(ah);
 }
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 95a8e232b58f..3abbe7513ab5 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -50,6 +50,7 @@
 #include <linux/pci.h>
 #include <linux/ethtool.h>
 #include <linux/uaccess.h>
+#include <linux/slab.h>
 
 #include <net/ieee80211_radiotap.h>
 
@@ -83,7 +84,7 @@ MODULE_VERSION("0.6.0 (EXPERIMENTAL)");
 
 
 /* Known PCI ids */
-static const struct pci_device_id ath5k_pci_id_table[] = {
+static DEFINE_PCI_DEVICE_TABLE(ath5k_pci_id_table) = {
         { PCI_VDEVICE(ATHEROS, 0x0207) }, /* 5210 early */
         { PCI_VDEVICE(ATHEROS, 0x0007) }, /* 5210 */
         { PCI_VDEVICE(ATHEROS, 0x0011) }, /* 5311 - this is on AHB bus !*/
@@ -195,12 +196,13 @@ static int __devinit	ath5k_pci_probe(struct pci_dev *pdev,
                                 const struct pci_device_id *id);
 static void __devexit   ath5k_pci_remove(struct pci_dev *pdev);
 #ifdef CONFIG_PM
-static int              ath5k_pci_suspend(struct pci_dev *pdev,
-                                        pm_message_t state);
-static int              ath5k_pci_resume(struct pci_dev *pdev);
+static int              ath5k_pci_suspend(struct device *dev);
+static int              ath5k_pci_resume(struct device *dev);
+
+SIMPLE_DEV_PM_OPS(ath5k_pm_ops, ath5k_pci_suspend, ath5k_pci_resume);
+#define ATH5K_PM_OPS    (&ath5k_pm_ops)
 #else
-#define ath5k_pci_suspend NULL
-#define ath5k_pci_resume NULL
+#define ATH5K_PM_OPS    NULL
 #endif /* CONFIG_PM */
 
 static struct pci_driver ath5k_pci_driver = {
@@ -208,8 +210,7 @@ static struct pci_driver ath5k_pci_driver = {
         .id_table       = ath5k_pci_id_table,
         .probe          = ath5k_pci_probe,
         .remove         = __devexit_p(ath5k_pci_remove),
-        .suspend        = ath5k_pci_suspend,
-        .resume         = ath5k_pci_resume,
+        .driver.pm      = ATH5K_PM_OPS,
 };
 
 
@@ -225,9 +226,9 @@ static int ath5k_reset_wake(struct ath5k_softc *sc);
 static int ath5k_start(struct ieee80211_hw *hw);
 static void ath5k_stop(struct ieee80211_hw *hw);
 static int ath5k_add_interface(struct ieee80211_hw *hw,
-                struct ieee80211_if_init_conf *conf);
+                struct ieee80211_vif *vif);
 static void ath5k_remove_interface(struct ieee80211_hw *hw,
-                struct ieee80211_if_init_conf *conf);
+                struct ieee80211_vif *vif);
 static int ath5k_config(struct ieee80211_hw *hw, u32 changed);
 static u64 ath5k_prepare_multicast(struct ieee80211_hw *hw,
                                    int mc_count, struct dev_addr_list *mc_list);
@@ -241,8 +242,6 @@ static int ath5k_set_key(struct ieee80211_hw *hw,
                 struct ieee80211_key_conf *key);
 static int ath5k_get_stats(struct ieee80211_hw *hw,
                 struct ieee80211_low_level_stats *stats);
-static int ath5k_get_tx_stats(struct ieee80211_hw *hw,
-                struct ieee80211_tx_queue_stats *stats);
 static u64 ath5k_get_tsf(struct ieee80211_hw *hw);
 static void ath5k_set_tsf(struct ieee80211_hw *hw, u64 tsf);
 static void ath5k_reset_tsf(struct ieee80211_hw *hw);
@@ -254,6 +253,8 @@ static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
                 u32 changes);
 static void ath5k_sw_scan_start(struct ieee80211_hw *hw);
 static void ath5k_sw_scan_complete(struct ieee80211_hw *hw);
+static void ath5k_set_coverage_class(struct ieee80211_hw *hw,
+                u8 coverage_class);
 
 static const struct ieee80211_ops ath5k_hw_ops = {
         .tx             = ath5k_tx,
@@ -267,13 +268,13 @@ static const struct ieee80211_ops ath5k_hw_ops = {
         .set_key        = ath5k_set_key,
         .get_stats      = ath5k_get_stats,
         .conf_tx        = NULL,
-        .get_tx_stats   = ath5k_get_tx_stats,
         .get_tsf        = ath5k_get_tsf,
         .set_tsf        = ath5k_set_tsf,
         .reset_tsf      = ath5k_reset_tsf,
         .bss_info_changed = ath5k_bss_info_changed,
         .sw_scan_start  = ath5k_sw_scan_start,
         .sw_scan_complete = ath5k_sw_scan_complete,
+        .set_coverage_class = ath5k_set_coverage_class,
 };
 
 /*
@@ -323,10 +324,13 @@ static inline void ath5k_txbuf_free(struct ath5k_softc *sc,
 static inline void ath5k_rxbuf_free(struct ath5k_softc *sc,
                                 struct ath5k_buf *bf)
 {
+        struct ath5k_hw *ah = sc->ah;
+        struct ath_common *common = ath5k_hw_common(ah);
+
         BUG_ON(!bf);
         if (!bf->skb)
                 return;
-        pci_unmap_single(sc->pdev, bf->skbaddr, sc->rxbufsize,
+        pci_unmap_single(sc->pdev, bf->skbaddr, common->rx_bufsize,
                         PCI_DMA_FROMDEVICE);
         dev_kfree_skb_any(bf->skb);
         bf->skb = NULL;
@@ -437,6 +441,22 @@ ath5k_chip_name(enum ath5k_srev_type type, u_int16_t val)
 
         return name;
 }
+static unsigned int ath5k_ioread32(void *hw_priv, u32 reg_offset)
+{
+        struct ath5k_hw *ah = (struct ath5k_hw *) hw_priv;
+        return ath5k_hw_reg_read(ah, reg_offset);
+}
+
+static void ath5k_iowrite32(void *hw_priv, u32 val, u32 reg_offset)
+{
+        struct ath5k_hw *ah = (struct ath5k_hw *) hw_priv;
+        ath5k_hw_reg_write(ah, val, reg_offset);
+}
+
+static const struct ath_ops ath5k_common_ops = {
+        .read = ath5k_ioread32,
+        .write = ath5k_iowrite32,
+};
 
 static int __devinit
 ath5k_pci_probe(struct pci_dev *pdev,
@@ -444,6 +464,7 @@ ath5k_pci_probe(struct pci_dev *pdev,
 {
         void __iomem *mem;
         struct ath5k_softc *sc;
+        struct ath_common *common;
         struct ieee80211_hw *hw;
         int ret;
         u8 csz;
@@ -547,7 +568,6 @@ ath5k_pci_probe(struct pci_dev *pdev,
         __set_bit(ATH_STAT_INVALID, sc->status);
 
         sc->iobase = mem; /* So we can unmap it on detach */
-        sc->common.cachelsz = csz << 2; /* convert to bytes */
         sc->opmode = NL80211_IFTYPE_STATION;
         sc->bintval = 1000;
         mutex_init(&sc->lock);
@@ -565,13 +585,28 @@ ath5k_pci_probe(struct pci_dev *pdev,
                 goto err_free;
         }
 
-        /* Initialize device */
-        sc->ah = ath5k_hw_attach(sc);
-        if (IS_ERR(sc->ah)) {
-                ret = PTR_ERR(sc->ah);
+        /*If we passed the test malloc a ath5k_hw struct*/
+        sc->ah = kzalloc(sizeof(struct ath5k_hw), GFP_KERNEL);
+        if (!sc->ah) {
+                ret = -ENOMEM;
+                ATH5K_ERR(sc, "out of memory\n");
                 goto err_irq;
         }
 
+        sc->ah->ah_sc = sc;
+        sc->ah->ah_iobase = sc->iobase;
+        common = ath5k_hw_common(sc->ah);
+        common->ops = &ath5k_common_ops;
+        common->ah = sc->ah;
+        common->hw = hw;
+        common->cachelsz = csz << 2; /* convert to bytes */
+
+        /* Initialize device */
+        ret = ath5k_hw_attach(sc);
+        if (ret) {
+                goto err_free_ah;
+        }
+
         /* set up multi-rate retry capabilities */
         if (sc->ah->ah_version == AR5K_AR5212) {
                 hw->max_rates = 4;
@@ -640,6 +675,8 @@ err_ah:
         ath5k_hw_detach(sc->ah);
 err_irq:
         free_irq(pdev->irq, sc);
+err_free_ah:
+        kfree(sc->ah);
 err_free:
         ieee80211_free_hw(hw);
 err_map:
@@ -661,6 +698,7 @@ ath5k_pci_remove(struct pci_dev *pdev)
         ath5k_debug_finish_device(sc);
         ath5k_detach(pdev, hw);
         ath5k_hw_detach(sc->ah);
+        kfree(sc->ah);
         free_irq(pdev->irq, sc);
         pci_iounmap(pdev, sc->iobase);
         pci_release_region(pdev, 0);
@@ -669,33 +707,20 @@ ath5k_pci_remove(struct pci_dev *pdev)
 }
 
 #ifdef CONFIG_PM
-static int
-ath5k_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+static int ath5k_pci_suspend(struct device *dev)
 {
-        struct ieee80211_hw *hw = pci_get_drvdata(pdev);
+        struct ieee80211_hw *hw = pci_get_drvdata(to_pci_dev(dev));
         struct ath5k_softc *sc = hw->priv;
 
         ath5k_led_off(sc);
-
-        pci_save_state(pdev);
-        pci_disable_device(pdev);
-        pci_set_power_state(pdev, PCI_D3hot);
-
         return 0;
 }
 
-static int
-ath5k_pci_resume(struct pci_dev *pdev)
+static int ath5k_pci_resume(struct device *dev)
 {
+        struct pci_dev *pdev = to_pci_dev(dev);
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct ath5k_softc *sc = hw->priv;
-        int err;
-
-        pci_restore_state(pdev);
-
-        err = pci_enable_device(pdev);
-        if (err)
-                return err;
 
         /*
          * Suspend/Resume resets the PCI configuration space, so we have to
@@ -718,7 +743,7 @@ static int ath5k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *re
 {
         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
         struct ath5k_softc *sc = hw->priv;
-        struct ath_regulatory *regulatory = &sc->common.regulatory;
+        struct ath_regulatory *regulatory = ath5k_hw_regulatory(sc->ah);
 
         return ath_reg_notifier_apply(wiphy, request, regulatory);
 }
@@ -728,7 +753,7 @@ ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
 {
         struct ath5k_softc *sc = hw->priv;
         struct ath5k_hw *ah = sc->ah;
-        struct ath_regulatory *regulatory = &sc->common.regulatory;
+        struct ath_regulatory *regulatory = ath5k_hw_regulatory(ah);
         u8 mac[ETH_ALEN] = {};
         int ret;
 
@@ -815,7 +840,7 @@ ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
 
         SET_IEEE80211_PERM_ADDR(hw, mac);
         /* All MAC address bits matter for ACKs */
-        memset(sc->bssidmask, 0xff, ETH_ALEN);
+        memcpy(sc->bssidmask, ath_bcast_mac, ETH_ALEN);
         ath5k_hw_set_bssid_mask(sc->ah, sc->bssidmask);
 
         regulatory->current_rd = ah->ah_capabilities.cap_eeprom.ee_regdomain;
@@ -1152,24 +1177,26 @@ ath5k_hw_to_driver_rix(struct ath5k_softc *sc, int hw_rix)
 static
 struct sk_buff *ath5k_rx_skb_alloc(struct ath5k_softc *sc, dma_addr_t *skb_addr)
 {
+        struct ath_common *common = ath5k_hw_common(sc->ah);
         struct sk_buff *skb;
 
         /*
          * Allocate buffer with headroom_needed space for the
          * fake physical layer header at the start.
          */
-        skb = ath_rxbuf_alloc(&sc->common,
-                              sc->rxbufsize + sc->common.cachelsz - 1,
+        skb = ath_rxbuf_alloc(common,
+                              common->rx_bufsize,
                               GFP_ATOMIC);
 
         if (!skb) {
                 ATH5K_ERR(sc, "can't alloc skbuff of size %u\n",
-                                sc->rxbufsize + sc->common.cachelsz - 1);
+                                common->rx_bufsize);
                 return NULL;
         }
 
         *skb_addr = pci_map_single(sc->pdev,
-                skb->data, sc->rxbufsize, PCI_DMA_FROMDEVICE);
+                                   skb->data, common->rx_bufsize,
+                                   PCI_DMA_FROMDEVICE);
         if (unlikely(pci_dma_mapping_error(sc->pdev, *skb_addr))) {
                 ATH5K_ERR(sc, "%s: DMA mapping failed\n", __func__);
                 dev_kfree_skb(skb);
@@ -1220,6 +1247,29 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
         return 0;
 }
 
+static enum ath5k_pkt_type get_hw_packet_type(struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr;
+        enum ath5k_pkt_type htype;
+        __le16 fc;
+
+        hdr = (struct ieee80211_hdr *)skb->data;
+        fc = hdr->frame_control;
+
+        if (ieee80211_is_beacon(fc))
+                htype = AR5K_PKT_TYPE_BEACON;
+        else if (ieee80211_is_probe_resp(fc))
+                htype = AR5K_PKT_TYPE_PROBE_RESP;
+        else if (ieee80211_is_atim(fc))
+                htype = AR5K_PKT_TYPE_ATIM;
+        else if (ieee80211_is_pspoll(fc))
+                htype = AR5K_PKT_TYPE_PSPOLL;
+        else
+                htype = AR5K_PKT_TYPE_NORMAL;
+
+        return htype;
+}
+
 static int
 ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
                   struct ath5k_txq *txq)
@@ -1274,7 +1324,8 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
                         sc->vif, pktlen, info));
         }
         ret = ah->ah_setup_tx_desc(ah, ds, pktlen,
-                ieee80211_get_hdrlen_from_skb(skb), AR5K_PKT_TYPE_NORMAL,
+                ieee80211_get_hdrlen_from_skb(skb),
+                get_hw_packet_type(skb),
                 (sc->power_level * 2),
                 hw_rate,
                 info->control.rates[0].count, keyidx, ah->ah_tx_ant, flags,
@@ -1303,7 +1354,6 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
 
         spin_lock_bh(&txq->lock);
         list_add_tail(&bf->list, &txq->q);
-        sc->tx_stats[txq->qnum].len++;
         if (txq->link == NULL) /* is this first packet? */
                 ath5k_hw_set_txdp(ah, txq->qnum, bf->daddr);
         else /* no, so only link it */
@@ -1487,7 +1537,8 @@ ath5k_beaconq_config(struct ath5k_softc *sc)
 
         ret = ath5k_hw_get_tx_queueprops(ah, sc->bhalq, &qi);
         if (ret)
-                return ret;
+                goto err;
+
         if (sc->opmode == NL80211_IFTYPE_AP ||
                 sc->opmode == NL80211_IFTYPE_MESH_POINT) {
                 /*
@@ -1514,10 +1565,25 @@ ath5k_beaconq_config(struct ath5k_softc *sc)
         if (ret) {
                 ATH5K_ERR(sc, "%s: unable to update parameters for beacon "
                         "hardware queue!\n", __func__);
-                return ret;
+                goto err;
         }
+        ret = ath5k_hw_reset_tx_queue(ah, sc->bhalq); /* push to h/w */
+        if (ret)
+                goto err;
+
+        /* reconfigure cabq with ready time to 80% of beacon_interval */
+        ret = ath5k_hw_get_tx_queueprops(ah, AR5K_TX_QUEUE_ID_CAB, &qi);
+        if (ret)
+                goto err;
+
+        qi.tqi_ready_time = (sc->bintval * 80) / 100;
+        ret = ath5k_hw_set_tx_queueprops(ah, AR5K_TX_QUEUE_ID_CAB, &qi);
+        if (ret)
+                goto err;
 
-        return ath5k_hw_reset_tx_queue(ah, sc->bhalq); /* push to h/w */;
+        ret = ath5k_hw_reset_tx_queue(ah, AR5K_TX_QUEUE_ID_CAB);
+err:
+        return ret;
 }
 
 static void
@@ -1536,7 +1602,6 @@ ath5k_txq_drainq(struct ath5k_softc *sc, struct ath5k_txq *txq)
                 ath5k_txbuf_free(sc, bf);
 
                 spin_lock_bh(&sc->txbuflock);
-                sc->tx_stats[txq->qnum].len--;
                 list_move_tail(&bf->list, &sc->txbuf);
                 sc->txbuf_len++;
                 spin_unlock_bh(&sc->txbuflock);
@@ -1605,13 +1670,14 @@ static int
 ath5k_rx_start(struct ath5k_softc *sc)
 {
         struct ath5k_hw *ah = sc->ah;
+        struct ath_common *common = ath5k_hw_common(ah);
         struct ath5k_buf *bf;
         int ret;
 
-        sc->rxbufsize = roundup(IEEE80211_MAX_LEN, sc->common.cachelsz);
+        common->rx_bufsize = roundup(IEEE80211_MAX_LEN, common->cachelsz);
 
-        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "cachelsz %u rxbufsize %u\n",
-                sc->common.cachelsz, sc->rxbufsize);
+        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "cachelsz %u rx_bufsize %u\n",
+                  common->cachelsz, common->rx_bufsize);
 
         spin_lock_bh(&sc->rxbuflock);
         sc->rxlink = NULL;
@@ -1656,6 +1722,8 @@ static unsigned int
 ath5k_rx_decrypted(struct ath5k_softc *sc, struct ath5k_desc *ds,
                 struct sk_buff *skb, struct ath5k_rx_status *rs)
 {
+        struct ath5k_hw *ah = sc->ah;
+        struct ath_common *common = ath5k_hw_common(ah);
         struct ieee80211_hdr *hdr = (void *)skb->data;
         unsigned int keyix, hlen;
 
@@ -1672,7 +1740,7 @@ ath5k_rx_decrypted(struct ath5k_softc *sc, struct ath5k_desc *ds,
             skb->len >= hlen + 4) {
                 keyix = skb->data[hlen + 3] >> 6;
 
-                if (test_bit(keyix, sc->keymap))
+                if (test_bit(keyix, common->keymap))
                         return RX_FLAG_DECRYPTED;
         }
 
@@ -1684,13 +1752,14 @@ static void
 ath5k_check_ibss_tsf(struct ath5k_softc *sc, struct sk_buff *skb,
                      struct ieee80211_rx_status *rxs)
 {
+        struct ath_common *common = ath5k_hw_common(sc->ah);
         u64 tsf, bc_tstamp;
         u32 hw_tu;
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
 
         if (ieee80211_is_beacon(mgmt->frame_control) &&
             le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS &&
-            memcmp(mgmt->bssid, sc->ah->ah_bssid, ETH_ALEN) == 0) {
+            memcmp(mgmt->bssid, common->curbssid, ETH_ALEN) == 0) {
                 /*
                  * Received an IBSS beacon with the same BSSID. Hardware *must*
                  * have updated the local TSF. We have to work around various
@@ -1745,6 +1814,8 @@ ath5k_tasklet_rx(unsigned long data)
         struct sk_buff *skb, *next_skb;
         dma_addr_t next_skb_addr;
         struct ath5k_softc *sc = (void *)data;
+        struct ath5k_hw *ah = sc->ah;
+        struct ath_common *common = ath5k_hw_common(ah);
         struct ath5k_buf *bf;
         struct ath5k_desc *ds;
         int ret;
@@ -1822,7 +1893,7 @@ accept:
                 if (!next_skb)
                         goto next;
 
-                pci_unmap_single(sc->pdev, bf->skbaddr, sc->rxbufsize,
+                pci_unmap_single(sc->pdev, bf->skbaddr, common->rx_bufsize,
                                 PCI_DMA_FROMDEVICE);
                 skb_put(skb, rs.rs_datalen);
 
@@ -1871,17 +1942,6 @@ accept:
                 rxs->noise = sc->ah->ah_noise_floor;
                 rxs->signal = rxs->noise + rs.rs_rssi;
 
-                /* An rssi of 35 indicates you should be able use
-                 * 54 Mbps reliably. A more elaborate scheme can be used
-                 * here but it requires a map of SNR/throughput for each
-                 * possible mode used */
-                rxs->qual = rs.rs_rssi * 100 / 35;
-
-                /* rssi can be more than 35 though, anything above that
-                 * should be considered at 100% */
-                if (rxs->qual > 100)
-                        rxs->qual = 100;
-
                 rxs->antenna = rs.rs_antenna;
                 rxs->rate_idx = ath5k_hw_to_driver_rix(sc, rs.rs_rate);
                 rxs->flag |= ath5k_rx_decrypted(sc, ds, skb, &rs);
@@ -1971,10 +2031,8 @@ ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
                 }
 
                 ieee80211_tx_status(sc->hw, skb);
-                sc->tx_stats[txq->qnum].count++;
 
                 spin_lock(&sc->txbuflock);
-                sc->tx_stats[txq->qnum].len--;
                 list_move_tail(&bf->list, &sc->txbuf);
                 sc->txbuf_len++;
                 spin_unlock(&sc->txbuflock);
@@ -2349,6 +2407,9 @@ ath5k_init(struct ath5k_softc *sc)
          */
         ath5k_stop_locked(sc);
 
+        /* Set PHY calibration interval */
+        ah->ah_cal_intval = ath5k_calinterval;
+
         /*
          * The basic interface to setting the hardware in a good
          * state is ``reset''.  On return the hardware is known to
@@ -2376,10 +2437,6 @@ ath5k_init(struct ath5k_softc *sc)
 
         /* Set ack to be sent at low bit-rates */
         ath5k_hw_set_ack_bitrate_high(ah, false);
-
-        /* Set PHY calibration inteval */
-        ah->ah_cal_intval = ath5k_calinterval;
-
         ret = 0;
 done:
         mmiowb();
@@ -2753,7 +2810,7 @@ static void ath5k_stop(struct ieee80211_hw *hw)
 }
 
 static int ath5k_add_interface(struct ieee80211_hw *hw,
-                struct ieee80211_if_init_conf *conf)
+                struct ieee80211_vif *vif)
 {
         struct ath5k_softc *sc = hw->priv;
         int ret;
@@ -2764,22 +2821,22 @@ static int ath5k_add_interface(struct ieee80211_hw *hw,
                 goto end;
         }
 
-        sc->vif = conf->vif;
+        sc->vif = vif;
 
-        switch (conf->type) {
+        switch (vif->type) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
         case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_MONITOR:
-                sc->opmode = conf->type;
+                sc->opmode = vif->type;
                 break;
         default:
                 ret = -EOPNOTSUPP;
                 goto end;
         }
 
-        ath5k_hw_set_lladdr(sc->ah, conf->mac_addr);
+        ath5k_hw_set_lladdr(sc->ah, vif->addr);
         ath5k_mode_setup(sc);
 
         ret = 0;
@@ -2790,13 +2847,13 @@ end:
 
 static void
 ath5k_remove_interface(struct ieee80211_hw *hw,
-                        struct ieee80211_if_init_conf *conf)
+                        struct ieee80211_vif *vif)
 {
         struct ath5k_softc *sc = hw->priv;
         u8 mac[ETH_ALEN] = {};
 
         mutex_lock(&sc->lock);
-        if (sc->vif != conf->vif)
+        if (sc->vif != vif)
                 goto end;
 
         ath5k_hw_set_lladdr(sc->ah, mac);
@@ -3008,6 +3065,8 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
               struct ieee80211_key_conf *key)
 {
         struct ath5k_softc *sc = hw->priv;
+        struct ath5k_hw *ah = sc->ah;
+        struct ath_common *common = ath5k_hw_common(ah);
         int ret = 0;
 
         if (modparam_nohwcrypt)
@@ -3040,14 +3099,14 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                         ATH5K_ERR(sc, "can't set the key\n");
                         goto unlock;
                 }
-                __set_bit(key->keyidx, sc->keymap);
+                __set_bit(key->keyidx, common->keymap);
                 key->hw_key_idx = key->keyidx;
                 key->flags |= (IEEE80211_KEY_FLAG_GENERATE_IV |
                                IEEE80211_KEY_FLAG_GENERATE_MMIC);
                 break;
         case DISABLE_KEY:
                 ath5k_hw_reset_key(sc->ah, key->keyidx);
-                __clear_bit(key->keyidx, sc->keymap);
+                __clear_bit(key->keyidx, common->keymap);
                 break;
         default:
                 ret = -EINVAL;
@@ -3075,17 +3134,6 @@ ath5k_get_stats(struct ieee80211_hw *hw,
         return 0;
 }
 
-static int
-ath5k_get_tx_stats(struct ieee80211_hw *hw,
-                struct ieee80211_tx_queue_stats *stats)
-{
-        struct ath5k_softc *sc = hw->priv;
-
-        memcpy(stats, &sc->tx_stats, sizeof(sc->tx_stats));
-
-        return 0;
-}
-
 static u64
 ath5k_get_tsf(struct ieee80211_hw *hw)
 {
@@ -3176,6 +3224,7 @@ static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
 {
         struct ath5k_softc *sc = hw->priv;
         struct ath5k_hw *ah = sc->ah;
+        struct ath_common *common = ath5k_hw_common(ah);
         unsigned long flags;
 
         mutex_lock(&sc->lock);
@@ -3184,10 +3233,9 @@ static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changes & BSS_CHANGED_BSSID) {
                 /* Cache for later use during resets */
-                memcpy(ah->ah_bssid, bss_conf->bssid, ETH_ALEN);
-                /* XXX: assoc id is set to 0 for now, mac80211 doesn't have
-                 * a clean way of letting us retrieve this yet. */
-                ath5k_hw_set_associd(ah, ah->ah_bssid, 0);
+                memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
+                common->curaid = 0;
+                ath5k_hw_set_associd(ah);
                 mmiowb();
         }
 
@@ -3200,6 +3248,14 @@ static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
                         set_beacon_filter(hw, sc->assoc);
                 ath5k_hw_set_ledstate(sc->ah, sc->assoc ?
                         AR5K_LED_ASSOC : AR5K_LED_INIT);
+                if (bss_conf->assoc) {
+                        ATH5K_DBG(sc, ATH5K_DEBUG_ANY,
+                                  "Bss Info ASSOC %d, bssid: %pM\n",
+                                  bss_conf->aid, common->curbssid);
+                        common->curaid = bss_conf->aid;
+                        ath5k_hw_set_associd(ah);
+                        /* Once ANI is available you would start it here */
+                }
         }
 
         if (changes & BSS_CHANGED_BEACON) {
@@ -3232,3 +3288,22 @@ static void ath5k_sw_scan_complete(struct ieee80211_hw *hw)
         ath5k_hw_set_ledstate(sc->ah, sc->assoc ?
                 AR5K_LED_ASSOC : AR5K_LED_INIT);
 }
+
+/**
+ * ath5k_set_coverage_class - Set IEEE 802.11 coverage class
+ *
+ * @hw: struct ieee80211_hw pointer
+ * @coverage_class: IEEE 802.11 coverage class number
+ *
+ * Mac80211 callback. Sets slot time, ACK timeout and CTS timeout for given
+ * coverage class. The values are persistent, they are restored after device
+ * reset.
+ */
+static void ath5k_set_coverage_class(struct ieee80211_hw *hw, u8 coverage_class)
+{
+        struct ath5k_softc *sc = hw->priv;
+
+        mutex_lock(&sc->lock);
+        ath5k_hw_set_coverage_class(sc->ah, coverage_class);
+        mutex_unlock(&sc->lock);
+}
diff --git a/drivers/net/wireless/ath/ath5k/base.h b/drivers/net/wireless/ath/ath5k/base.h
index a28c42f32c9d..7e1a88a5abdb 100644
--- a/drivers/net/wireless/ath/ath5k/base.h
+++ b/drivers/net/wireless/ath/ath5k/base.h
@@ -36,7 +36,7 @@
  */
 
 /*
- * Defintions for the Atheros Wireless LAN controller driver.
+ * Definitions for the Atheros Wireless LAN controller driver.
  */
 #ifndef _DEV_ATH_ATHVAR_H
 #define _DEV_ATH_ATHVAR_H
@@ -115,10 +115,8 @@ struct ath5k_rfkill {
  * associated with an instance of a device */
 struct ath5k_softc {
         struct pci_dev          *pdev;          /* for dma mapping */
-        struct ath_common       common;
         void __iomem            *iobase;        /* address of the device */
         struct mutex            lock;           /* dev-level lock */
-        struct ieee80211_tx_queue_stats tx_stats[AR5K_NUM_TX_QUEUES];
         struct ieee80211_low_level_stats ll_stats;
         struct ieee80211_hw     *hw;            /* IEEE 802.11 common */
         struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
@@ -154,8 +152,6 @@ struct ath5k_softc {
 
         enum ath5k_int          imask;          /* interrupt mask copy */
 
-        DECLARE_BITMAP(keymap, AR5K_KEYCACHE_SIZE); /* key use bit map */
-
         u8                      bssidmask[ETH_ALEN];
 
         unsigned int            led_pin,        /* GPIO pin for driving LED */
@@ -193,7 +189,7 @@ struct ath5k_softc {
         struct ath5k_txq        *cabq;          /* content after beacon */
 
         int                     power_level;    /* Requested tx power in dbm */
-        bool                    assoc;          /* assocate state */
+        bool                    assoc;          /* associate state */
         bool                    enable_beacon;  /* true if beacons are on */
 };
 
@@ -202,15 +198,4 @@ struct ath5k_softc {
 #define ath5k_hw_hasveol(_ah) \
         (ath5k_hw_get_capability(_ah, AR5K_CAP_VEOL, 0, NULL) == 0)
 
-static inline struct ath_common *ath5k_hw_common(struct ath5k_hw *ah)
-{
-        return &ah->ah_sc->common;
-}
-
-static inline struct ath_regulatory *ath5k_hw_regulatory(struct ath5k_hw *ah)
-{
-        return &(ath5k_hw_common(ah)->regulatory);
-
-}
-
 #endif
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index 644962adda97..67665cdc7afe 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -21,6 +21,8 @@
 * EEPROM access functions and helpers *
 \*************************************/
 
+#include <linux/slab.h>
+
 #include "ath5k.h"
 #include "reg.h"
 #include "debug.h"
@@ -97,6 +99,7 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
         int ret;
         u16 val;
+        u32 cksum, offset, eep_max = AR5K_EEPROM_INFO_MAX;
 
         /*
          * Read values from EEPROM and store them in the capability structure
@@ -111,20 +114,44 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
         if (ah->ah_ee_version < AR5K_EEPROM_VERSION_3_0)
                 return 0;
 
-#ifdef notyet
         /*
          * Validate the checksum of the EEPROM date. There are some
          * devices with invalid EEPROMs.
          */
-        for (cksum = 0, offset = 0; offset < AR5K_EEPROM_INFO_MAX; offset++) {
+        AR5K_EEPROM_READ(AR5K_EEPROM_SIZE_UPPER, val);
+        if (val) {
+                eep_max = (val & AR5K_EEPROM_SIZE_UPPER_MASK) <<
+                           AR5K_EEPROM_SIZE_ENDLOC_SHIFT;
+                AR5K_EEPROM_READ(AR5K_EEPROM_SIZE_LOWER, val);
+                eep_max = (eep_max | val) - AR5K_EEPROM_INFO_BASE;
+
+                /*
+                 * Fail safe check to prevent stupid loops due
+                 * to busted EEPROMs. XXX: This value is likely too
+                 * big still, waiting on a better value.
+                 */
+                if (eep_max > (3 * AR5K_EEPROM_INFO_MAX)) {
+                        ATH5K_ERR(ah->ah_sc, "Invalid max custom EEPROM size: "
+                                  "%d (0x%04x) max expected: %d (0x%04x)\n",
+                                  eep_max, eep_max,
+                                  3 * AR5K_EEPROM_INFO_MAX,
+                                  3 * AR5K_EEPROM_INFO_MAX);
+                        return -EIO;
+                }
+        }
+
+        for (cksum = 0, offset = 0; offset < eep_max; offset++) {
                 AR5K_EEPROM_READ(AR5K_EEPROM_INFO(offset), val);
                 cksum ^= val;
         }
         if (cksum != AR5K_EEPROM_INFO_CKSUM) {
-                ATH5K_ERR(ah->ah_sc, "Invalid EEPROM checksum 0x%04x\n", cksum);
+                ATH5K_ERR(ah->ah_sc, "Invalid EEPROM "
+                          "checksum: 0x%04x eep_max: 0x%04x (%s)\n",
+                          cksum, eep_max,
+                          eep_max == AR5K_EEPROM_INFO_MAX ?
+                                "default size" : "custom size");
                 return -EIO;
         }
-#endif
 
         AR5K_EEPROM_READ_HDR(AR5K_EEPROM_ANT_GAIN(ah->ah_ee_version),
             ee_ant_gain);
@@ -404,8 +431,8 @@ static int ath5k_eeprom_read_modes(struct ath5k_hw *ah, u32 *offset,
                         ee->ee_margin_tx_rx[mode] = (val >> 8) & 0x3f;
 
                 AR5K_EEPROM_READ(o++, val);
-                ee->ee_i_cal[mode] = (val >> 8) & 0x3f;
-                ee->ee_q_cal[mode] = (val >> 3) & 0x1f;
+                ee->ee_i_cal[mode] = (val >> 5) & 0x3f;
+                ee->ee_q_cal[mode] = val & 0x1f;
 
                 if (ah->ah_ee_version >= AR5K_EEPROM_VERSION_4_2) {
                         AR5K_EEPROM_READ(o++, val);
@@ -1492,7 +1519,7 @@ ath5k_eeprom_read_target_rate_pwr_info(struct ath5k_hw *ah, unsigned int mode)
  * This info is used to calibrate the baseband power table. Imagine
  * that for each channel there is a power curve that's hw specific
  * (depends on amplifier etc) and we try to "correct" this curve using
- * offests we pass on to phy chip (baseband -> before amplifier) so that
+ * offsets we pass on to phy chip (baseband -> before amplifier) so that
  * it can use accurate power values when setting tx power (takes amplifier's
  * performance on each channel into account).
  *
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.h b/drivers/net/wireless/ath/ath5k/eeprom.h
index 0123f3521a0b..473a483bb9c3 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.h
+++ b/drivers/net/wireless/ath/ath5k/eeprom.h
@@ -37,6 +37,14 @@
 #define AR5K_EEPROM_RFKILL_POLARITY_S   1
 
 #define AR5K_EEPROM_REG_DOMAIN          0x00bf  /* EEPROM regdom */
+
+/* FLASH(EEPROM) Defines for AR531X chips */
+#define AR5K_EEPROM_SIZE_LOWER          0x1b /* size info -- lower */
+#define AR5K_EEPROM_SIZE_UPPER          0x1c /* size info -- upper */
+#define AR5K_EEPROM_SIZE_UPPER_MASK     0xfff0
+#define AR5K_EEPROM_SIZE_UPPER_SHIFT    4
+#define AR5K_EEPROM_SIZE_ENDLOC_SHIFT   12
+
 #define AR5K_EEPROM_CHECKSUM            0x00c0  /* EEPROM checksum */
 #define AR5K_EEPROM_INFO_BASE           0x00c0  /* EEPROM header */
 #define AR5K_EEPROM_INFO_MAX            (0x400 - AR5K_EEPROM_INFO_BASE)
diff --git a/drivers/net/wireless/ath/ath5k/initvals.c b/drivers/net/wireless/ath/ath5k/initvals.c
index 18eb5190ce4b..8fa439308828 100644
--- a/drivers/net/wireless/ath/ath5k/initvals.c
+++ b/drivers/net/wireless/ath/ath5k/initvals.c
@@ -560,8 +560,8 @@ static const struct ath5k_ini ar5212_ini_common_start[] = {
         { AR5K_SLEEP0,          0x0002aaaa },
         { AR5K_SLEEP1,          0x02005555 },
         { AR5K_SLEEP2,          0x00000000 },
-        { AR5K_BSS_IDM0,        0xffffffff },
-        { AR5K_BSS_IDM1,        0x0000ffff },
+        { AR_BSSMSKL,           0xffffffff },
+        { AR_BSSMSKU,           0x0000ffff },
         { AR5K_TXPC,            0x00000000 },
         { AR5K_PROFCNT_TX,      0x00000000 },
         { AR5K_PROFCNT_RX,      0x00000000 },
diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c
index b548c8eaaae1..67aa52e9bf94 100644
--- a/drivers/net/wireless/ath/ath5k/led.c
+++ b/drivers/net/wireless/ath/ath5k/led.c
@@ -59,6 +59,8 @@ static const struct pci_device_id ath5k_led_devices[] = {
         { ATH_SDEVICE(PCI_VENDOR_ID_COMPAQ, PCI_ANY_ID), ATH_LED(1, 1) },
         /* Acer Aspire One A150 (maximlevitsky@gmail.com) */
         { ATH_SDEVICE(PCI_VENDOR_ID_FOXCONN, 0xe008), ATH_LED(3, 0) },
+        /* Acer Aspire One AO531h AO751h (keng-yu.lin@canonical.com) */
+        { ATH_SDEVICE(PCI_VENDOR_ID_FOXCONN, 0xe00d), ATH_LED(3, 0) },
         /* Acer Ferrari 5000 (russ.dill@gmail.com) */
         { ATH_SDEVICE(PCI_VENDOR_ID_AMBIT, 0x0422), ATH_LED(1, 1) },
         /* E-machines E510 (tuliom@gmail.com) */
@@ -75,8 +77,12 @@ static const struct pci_device_id ath5k_led_devices[] = {
         { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137a), ATH_LED(3, 1) },
         /* HP Compaq C700 (nitrousnrg@gmail.com) */
         { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137b), ATH_LED(3, 1) },
+        /* LiteOn AR5BXB63 (magooz@salug.it) */
+        { ATH_SDEVICE(PCI_VENDOR_ID_ATHEROS, 0x3067), ATH_LED(3, 0) },
         /* IBM-specific AR5212 (all others) */
         { PCI_VDEVICE(ATHEROS, PCI_DEVICE_ID_ATHEROS_AR5212_IBM), ATH_LED(0, 0) },
+        /* Dell Vostro A860 (shahar@shahar-or.co.il) */
+        { ATH_SDEVICE(PCI_VENDOR_ID_QMI, 0x0112), ATH_LED(3, 0) },
         { }
 };
 
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index 2942f13c9c4a..aefe84f9c04b 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -24,6 +24,8 @@
 * Protocol Control Unit Functions *
 \*********************************/
 
+#include <asm/unaligned.h>
+
 #include "ath5k.h"
 #include "reg.h"
 #include "debug.h"
@@ -44,6 +46,7 @@
  */
 int ath5k_hw_set_opmode(struct ath5k_hw *ah)
 {
+        struct ath_common *common = ath5k_hw_common(ah);
         u32 pcu_reg, beacon_reg, low_id, high_id;
 
 
@@ -95,8 +98,8 @@ int ath5k_hw_set_opmode(struct ath5k_hw *ah)
         /*
          * Set PCU registers
          */
-        low_id = AR5K_LOW_ID(ah->ah_sta_id);
-        high_id = AR5K_HIGH_ID(ah->ah_sta_id);
+        low_id = get_unaligned_le32(common->macaddr);
+        high_id = get_unaligned_le16(common->macaddr + 4);
         ath5k_hw_reg_write(ah, low_id, AR5K_STA_ID0);
         ath5k_hw_reg_write(ah, pcu_reg | high_id, AR5K_STA_ID1);
 
@@ -184,8 +187,8 @@ unsigned int ath5k_hw_get_ack_timeout(struct ath5k_hw *ah)
 {
         ATH5K_TRACE(ah->ah_sc);
 
-        return ath5k_hw_clocktoh(AR5K_REG_MS(ath5k_hw_reg_read(ah,
-                        AR5K_TIME_OUT), AR5K_TIME_OUT_ACK), ah->ah_turbo);
+        return ath5k_hw_clocktoh(ah, AR5K_REG_MS(ath5k_hw_reg_read(ah,
+                        AR5K_TIME_OUT), AR5K_TIME_OUT_ACK));
 }
 
 /**
@@ -197,12 +200,12 @@ unsigned int ath5k_hw_get_ack_timeout(struct ath5k_hw *ah)
 int ath5k_hw_set_ack_timeout(struct ath5k_hw *ah, unsigned int timeout)
 {
         ATH5K_TRACE(ah->ah_sc);
-        if (ath5k_hw_clocktoh(AR5K_REG_MS(0xffffffff, AR5K_TIME_OUT_ACK),
-                        ah->ah_turbo) <= timeout)
+        if (ath5k_hw_clocktoh(ah, AR5K_REG_MS(0xffffffff, AR5K_TIME_OUT_ACK))
+                        <= timeout)
                 return -EINVAL;
 
         AR5K_REG_WRITE_BITS(ah, AR5K_TIME_OUT, AR5K_TIME_OUT_ACK,
-                ath5k_hw_htoclock(timeout, ah->ah_turbo));
+                ath5k_hw_htoclock(ah, timeout));
 
         return 0;
 }
@@ -215,8 +218,8 @@ int ath5k_hw_set_ack_timeout(struct ath5k_hw *ah, unsigned int timeout)
 unsigned int ath5k_hw_get_cts_timeout(struct ath5k_hw *ah)
 {
         ATH5K_TRACE(ah->ah_sc);
-        return ath5k_hw_clocktoh(AR5K_REG_MS(ath5k_hw_reg_read(ah,
-                        AR5K_TIME_OUT), AR5K_TIME_OUT_CTS), ah->ah_turbo);
+        return ath5k_hw_clocktoh(ah, AR5K_REG_MS(ath5k_hw_reg_read(ah,
+                        AR5K_TIME_OUT), AR5K_TIME_OUT_CTS));
 }
 
 /**
@@ -228,36 +231,94 @@ unsigned int ath5k_hw_get_cts_timeout(struct ath5k_hw *ah)
 int ath5k_hw_set_cts_timeout(struct ath5k_hw *ah, unsigned int timeout)
 {
         ATH5K_TRACE(ah->ah_sc);
-        if (ath5k_hw_clocktoh(AR5K_REG_MS(0xffffffff, AR5K_TIME_OUT_CTS),
-                        ah->ah_turbo) <= timeout)
+        if (ath5k_hw_clocktoh(ah, AR5K_REG_MS(0xffffffff, AR5K_TIME_OUT_CTS))
+                        <= timeout)
                 return -EINVAL;
 
         AR5K_REG_WRITE_BITS(ah, AR5K_TIME_OUT, AR5K_TIME_OUT_CTS,
-                        ath5k_hw_htoclock(timeout, ah->ah_turbo));
+                        ath5k_hw_htoclock(ah, timeout));
 
         return 0;
 }
 
+/**
+ * ath5k_hw_htoclock - Translate usec to hw clock units
+ *
+ * @ah: The &struct ath5k_hw
+ * @usec: value in microseconds
+ */
+unsigned int ath5k_hw_htoclock(struct ath5k_hw *ah, unsigned int usec)
+{
+        return usec * ath5k_hw_get_clockrate(ah);
+}
 
-/****************\
-* BSSID handling *
-\****************/
+/**
+ * ath5k_hw_clocktoh - Translate hw clock units to usec
+ * @clock: value in hw clock units
+ */
+unsigned int ath5k_hw_clocktoh(struct ath5k_hw *ah, unsigned int clock)
+{
+        return clock / ath5k_hw_get_clockrate(ah);
+}
 
 /**
- * ath5k_hw_get_lladdr - Get station id
+ * ath5k_hw_get_clockrate - Get the clock rate for current mode
  *
  * @ah: The &struct ath5k_hw
- * @mac: The card's mac address
+ */
+unsigned int ath5k_hw_get_clockrate(struct ath5k_hw *ah)
+{
+        struct ieee80211_channel *channel = ah->ah_current_channel;
+        int clock;
+
+        if (channel->hw_value & CHANNEL_5GHZ)
+                clock = 40; /* 802.11a */
+        else if (channel->hw_value & CHANNEL_CCK)
+                clock = 22; /* 802.11b */
+        else
+                clock = 44; /* 802.11g */
+
+        /* Clock rate in turbo modes is twice the normal rate */
+        if (channel->hw_value & CHANNEL_TURBO)
+                clock *= 2;
+
+        return clock;
+}
+
+/**
+ * ath5k_hw_get_default_slottime - Get the default slot time for current mode
  *
- * Initialize ah->ah_sta_id using the mac address provided
- * (just a memcpy).
+ * @ah: The &struct ath5k_hw
+ */
+unsigned int ath5k_hw_get_default_slottime(struct ath5k_hw *ah)
+{
+        struct ieee80211_channel *channel = ah->ah_current_channel;
+
+        if (channel->hw_value & CHANNEL_TURBO)
+                return 6; /* both turbo modes */
+
+        if (channel->hw_value & CHANNEL_CCK)
+                return 20; /* 802.11b */
+
+        return 9; /* 802.11 a/g */
+}
+
+/**
+ * ath5k_hw_get_default_sifs - Get the default SIFS for current mode
  *
- * TODO: Remove it once we merge ath5k_softc and ath5k_hw
+ * @ah: The &struct ath5k_hw
  */
-void ath5k_hw_get_lladdr(struct ath5k_hw *ah, u8 *mac)
+unsigned int ath5k_hw_get_default_sifs(struct ath5k_hw *ah)
 {
-        ATH5K_TRACE(ah->ah_sc);
-        memcpy(mac, ah->ah_sta_id, ETH_ALEN);
+        struct ieee80211_channel *channel = ah->ah_current_channel;
+
+        if (channel->hw_value & CHANNEL_TURBO)
+                return 8; /* both turbo modes */
+
+        if (channel->hw_value & CHANNEL_5GHZ)
+                return 16; /* 802.11a */
+
+        return 10; /* 802.11 b/g */
 }
 
 /**
@@ -270,17 +331,18 @@ void ath5k_hw_get_lladdr(struct ath5k_hw *ah, u8 *mac)
  */
 int ath5k_hw_set_lladdr(struct ath5k_hw *ah, const u8 *mac)
 {
+        struct ath_common *common = ath5k_hw_common(ah);
         u32 low_id, high_id;
         u32 pcu_reg;
 
         ATH5K_TRACE(ah->ah_sc);
         /* Set new station ID */
-        memcpy(ah->ah_sta_id, mac, ETH_ALEN);
+        memcpy(common->macaddr, mac, ETH_ALEN);
 
         pcu_reg = ath5k_hw_reg_read(ah, AR5K_STA_ID1) & 0xffff0000;
 
-        low_id = AR5K_LOW_ID(mac);
-        high_id = AR5K_HIGH_ID(mac);
+        low_id = get_unaligned_le32(mac);
+        high_id = get_unaligned_le16(mac + 4);
 
         ath5k_hw_reg_write(ah, low_id, AR5K_STA_ID0);
         ath5k_hw_reg_write(ah, pcu_reg | high_id, AR5K_STA_ID1);
@@ -297,159 +359,51 @@ int ath5k_hw_set_lladdr(struct ath5k_hw *ah, const u8 *mac)
  *
  * Sets the BSSID which trigers the "SME Join" operation
  */
-void ath5k_hw_set_associd(struct ath5k_hw *ah, const u8 *bssid, u16 assoc_id)
+void ath5k_hw_set_associd(struct ath5k_hw *ah)
 {
-        u32 low_id, high_id;
+        struct ath_common *common = ath5k_hw_common(ah);
         u16 tim_offset = 0;
 
         /*
          * Set simple BSSID mask on 5212
          */
-        if (ah->ah_version == AR5K_AR5212) {
-                ath5k_hw_reg_write(ah, AR5K_LOW_ID(ah->ah_bssid_mask),
-                                                        AR5K_BSS_IDM0);
-                ath5k_hw_reg_write(ah, AR5K_HIGH_ID(ah->ah_bssid_mask),
-                                                        AR5K_BSS_IDM1);
-        }
+        if (ah->ah_version == AR5K_AR5212)
+                ath_hw_setbssidmask(common);
 
         /*
          * Set BSSID which triggers the "SME Join" operation
          */
-        low_id = AR5K_LOW_ID(bssid);
-        high_id = AR5K_HIGH_ID(bssid);
-        ath5k_hw_reg_write(ah, low_id, AR5K_BSS_ID0);
-        ath5k_hw_reg_write(ah, high_id | ((assoc_id & 0x3fff) <<
-                                AR5K_BSS_ID1_AID_S), AR5K_BSS_ID1);
-
-        if (assoc_id == 0) {
+        ath5k_hw_reg_write(ah,
+                           get_unaligned_le32(common->curbssid),
+                           AR5K_BSS_ID0);
+        ath5k_hw_reg_write(ah,
+                           get_unaligned_le16(common->curbssid + 4) |
+                           ((common->curaid & 0x3fff) << AR5K_BSS_ID1_AID_S),
+                           AR5K_BSS_ID1);
+
+        if (common->curaid == 0) {
                 ath5k_hw_disable_pspoll(ah);
                 return;
         }
 
         AR5K_REG_WRITE_BITS(ah, AR5K_BEACON, AR5K_BEACON_TIM,
-                        tim_offset ? tim_offset + 4 : 0);
+                            tim_offset ? tim_offset + 4 : 0);
 
         ath5k_hw_enable_pspoll(ah, NULL, 0);
 }
 
-/**
- * ath5k_hw_set_bssid_mask - filter out bssids we listen
- *
- * @ah: the &struct ath5k_hw
- * @mask: the bssid_mask, a u8 array of size ETH_ALEN
- *
- * BSSID masking is a method used by AR5212 and newer hardware to inform PCU
- * which bits of the interface's MAC address should be looked at when trying
- * to decide which packets to ACK. In station mode and AP mode with a single
- * BSS every bit matters since we lock to only one BSS. In AP mode with
- * multiple BSSes (virtual interfaces) not every bit matters because hw must
- * accept frames for all BSSes and so we tweak some bits of our mac address
- * in order to have multiple BSSes.
- *
- * NOTE: This is a simple filter and does *not* filter out all
- * relevant frames. Some frames that are not for us might get ACKed from us
- * by PCU because they just match the mask.
- *
- * When handling multiple BSSes you can get the BSSID mask by computing the
- * set of  ~ ( MAC XOR BSSID ) for all bssids we handle.
- *
- * When you do this you are essentially computing the common bits of all your
- * BSSes. Later it is assumed the harware will "and" (&) the BSSID mask with
- * the MAC address to obtain the relevant bits and compare the result with
- * (frame's BSSID & mask) to see if they match.
- */
-/*
- * Simple example: on your card you have have two BSSes you have created with
- * BSSID-01 and BSSID-02. Lets assume BSSID-01 will not use the MAC address.
- * There is another BSSID-03 but you are not part of it. For simplicity's sake,
- * assuming only 4 bits for a mac address and for BSSIDs you can then have:
- *
- *                  \
- * MAC:                0001 |
- * BSSID-01:   0100 | --> Belongs to us
- * BSSID-02:   1001 |
- *                  /
- * -------------------
- * BSSID-03:   0110  | --> External
- * -------------------
- *
- * Our bssid_mask would then be:
- *
- *             On loop iteration for BSSID-01:
- *             ~(0001 ^ 0100)  -> ~(0101)
- *                             ->   1010
- *             bssid_mask      =    1010
- *
- *             On loop iteration for BSSID-02:
- *             bssid_mask &= ~(0001   ^   1001)
- *             bssid_mask =   (1010)  & ~(0001 ^ 1001)
- *             bssid_mask =   (1010)  & ~(1001)
- *             bssid_mask =   (1010)  &  (0110)
- *             bssid_mask =   0010
- *
- * A bssid_mask of 0010 means "only pay attention to the second least
- * significant bit". This is because its the only bit common
- * amongst the MAC and all BSSIDs we support. To findout what the real
- * common bit is we can simply "&" the bssid_mask now with any BSSID we have
- * or our MAC address (we assume the hardware uses the MAC address).
- *
- * Now, suppose there's an incoming frame for BSSID-03:
- *
- * IFRAME-01:  0110
- *
- * An easy eye-inspeciton of this already should tell you that this frame
- * will not pass our check. This is beacuse the bssid_mask tells the
- * hardware to only look at the second least significant bit and the
- * common bit amongst the MAC and BSSIDs is 0, this frame has the 2nd LSB
- * as 1, which does not match 0.
- *
- * So with IFRAME-01 we *assume* the hardware will do:
- *
- *     allow = (IFRAME-01 & bssid_mask) == (bssid_mask & MAC) ? 1 : 0;
- *  --> allow = (0110 & 0010) == (0010 & 0001) ? 1 : 0;
- *  --> allow = (0010) == 0000 ? 1 : 0;
- *  --> allow = 0
- *
- *  Lets now test a frame that should work:
- *
- * IFRAME-02:  0001 (we should allow)
- *
- *     allow = (0001 & 1010) == 1010
- *
- *     allow = (IFRAME-02 & bssid_mask) == (bssid_mask & MAC) ? 1 : 0;
- *  --> allow = (0001 & 0010) ==  (0010 & 0001) ? 1 :0;
- *  --> allow = (0010) == (0010)
- *  --> allow = 1
- *
- * Other examples:
- *
- * IFRAME-03:  0100 --> allowed
- * IFRAME-04:  1001 --> allowed
- * IFRAME-05:  1101 --> allowed but its not for us!!!
- *
- */
-int ath5k_hw_set_bssid_mask(struct ath5k_hw *ah, const u8 *mask)
+void ath5k_hw_set_bssid_mask(struct ath5k_hw *ah, const u8 *mask)
 {
-        u32 low_id, high_id;
+        struct ath_common *common = ath5k_hw_common(ah);
         ATH5K_TRACE(ah->ah_sc);
 
         /* Cache bssid mask so that we can restore it
          * on reset */
-        memcpy(ah->ah_bssid_mask, mask, ETH_ALEN);
-        if (ah->ah_version == AR5K_AR5212) {
-                low_id = AR5K_LOW_ID(mask);
-                high_id = AR5K_HIGH_ID(mask);
-
-                ath5k_hw_reg_write(ah, low_id, AR5K_BSS_IDM0);
-                ath5k_hw_reg_write(ah, high_id, AR5K_BSS_IDM1);
-
-                return 0;
-        }
-
-        return -EIO;
+        memcpy(common->bssidmask, mask, ETH_ALEN);
+        if (ah->ah_version == AR5K_AR5212)
+                ath_hw_setbssidmask(common);
 }
 
-
 /************\
 * RX Control *
 \************/
@@ -1157,14 +1111,17 @@ int ath5k_hw_set_key_lladdr(struct ath5k_hw *ah, u16 entry, const u8 *mac)
          /* Invalid entry (key table overflow) */
         AR5K_ASSERT_ENTRY(entry, AR5K_KEYTABLE_SIZE);
 
-        /* MAC may be NULL if it's a broadcast key. In this case no need to
-         * to compute AR5K_LOW_ID and AR5K_HIGH_ID as we already know it. */
+        /*
+         * MAC may be NULL if it's a broadcast key. In this case no need to
+         * to compute get_unaligned_le32 and get_unaligned_le16 as we
+         * already know it.
+         */
         if (!mac) {
                 low_id = 0xffffffff;
                 high_id = 0xffff | AR5K_KEYTABLE_VALID;
         } else {
-                low_id = AR5K_LOW_ID(mac);
-                high_id = AR5K_HIGH_ID(mac) | AR5K_KEYTABLE_VALID;
+                low_id = get_unaligned_le32(mac);
+                high_id = get_unaligned_le16(mac + 4) | AR5K_KEYTABLE_VALID;
         }
 
         ath5k_hw_reg_write(ah, low_id, AR5K_KEYTABLE_MAC0(entry));
@@ -1173,3 +1130,24 @@ int ath5k_hw_set_key_lladdr(struct ath5k_hw *ah, u16 entry, const u8 *mac)
         return 0;
 }
 
+/**
+ * ath5k_hw_set_coverage_class - Set IEEE 802.11 coverage class
+ *
+ * @ah: The &struct ath5k_hw
+ * @coverage_class: IEEE 802.11 coverage class number
+ *
+ * Sets slot time, ACK timeout and CTS timeout for given coverage class.
+ */
+void ath5k_hw_set_coverage_class(struct ath5k_hw *ah, u8 coverage_class)
+{
+        /* As defined by IEEE 802.11-2007 17.3.8.6 */
+        int slot_time = ath5k_hw_get_default_slottime(ah) + 3 * coverage_class;
+        int ack_timeout = ath5k_hw_get_default_sifs(ah) + slot_time;
+        int cts_timeout = ack_timeout;
+
+        ath5k_hw_set_slot_time(ah, slot_time);
+        ath5k_hw_set_ack_timeout(ah, ack_timeout);
+        ath5k_hw_set_cts_timeout(ah, cts_timeout);
+
+        ah->ah_coverage_class = coverage_class;
+}
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 1a039f2bd732..68e2bccd90d3 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -23,6 +23,7 @@
 #define _ATH5K_PHY
 
 #include <linux/delay.h>
+#include <linux/slab.h>
 
 #include "ath5k.h"
 #include "reg.h"
@@ -117,7 +118,7 @@ static unsigned int ath5k_hw_rfb_op(struct ath5k_hw *ah,
 
 /*
  * This code is used to optimize rf gain on different environments
- * (temprature mostly) based on feedback from a power detector.
+ * (temperature mostly) based on feedback from a power detector.
  *
  * It's only used on RF5111 and RF5112, later RF chips seem to have
  * auto adjustment on hw -notice they have a much smaller BANK 7 and
@@ -1124,77 +1125,148 @@ ath5k_hw_calibration_poll(struct ath5k_hw *ah)
                 ah->ah_swi_mask = AR5K_SWI_FULL_CALIBRATION;
                 AR5K_REG_ENABLE_BITS(ah, AR5K_CR, AR5K_CR_SWI);
         }
+}
 
+static int sign_extend(int val, const int nbits)
+{
+        int order = BIT(nbits-1);
+        return (val ^ order) - order;
 }
 
-/**
- * ath5k_hw_noise_floor_calibration - perform PHY noise floor calibration
- *
- * @ah: struct ath5k_hw pointer we are operating on
- * @freq: the channel frequency, just used for error logging
- *
- * This function performs a noise floor calibration of the PHY and waits for
- * it to complete. Then the noise floor value is compared to some maximum
- * noise floor we consider valid.
- *
- * Note that this is different from what the madwifi HAL does: it reads the
- * noise floor and afterwards initiates the calibration. Since the noise floor
- * calibration can take some time to finish, depending on the current channel
- * use, that avoids the occasional timeout warnings we are seeing now.
- *
- * See the following link for an Atheros patent on noise floor calibration:
- * http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL \
- * &p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.htm&r=1&f=G&l=50&s1=7245893.PN.&OS=PN/7
+static s32 ath5k_hw_read_measured_noise_floor(struct ath5k_hw *ah)
+{
+        s32 val;
+
+        val = ath5k_hw_reg_read(ah, AR5K_PHY_NF);
+        return sign_extend(AR5K_REG_MS(val, AR5K_PHY_NF_MINCCA_PWR), 9);
+}
+
+void ath5k_hw_init_nfcal_hist(struct ath5k_hw *ah)
+{
+        int i;
+
+        ah->ah_nfcal_hist.index = 0;
+        for (i = 0; i < ATH5K_NF_CAL_HIST_MAX; i++)
+                ah->ah_nfcal_hist.nfval[i] = AR5K_TUNE_CCA_MAX_GOOD_VALUE;
+}
+
+static void ath5k_hw_update_nfcal_hist(struct ath5k_hw *ah, s16 noise_floor)
+{
+        struct ath5k_nfcal_hist *hist = &ah->ah_nfcal_hist;
+        hist->index = (hist->index + 1) & (ATH5K_NF_CAL_HIST_MAX-1);
+        hist->nfval[hist->index] = noise_floor;
+}
+
+static s16 ath5k_hw_get_median_noise_floor(struct ath5k_hw *ah)
+{
+        s16 sort[ATH5K_NF_CAL_HIST_MAX];
+        s16 tmp;
+        int i, j;
+
+        memcpy(sort, ah->ah_nfcal_hist.nfval, sizeof(sort));
+        for (i = 0; i < ATH5K_NF_CAL_HIST_MAX - 1; i++) {
+                for (j = 1; j < ATH5K_NF_CAL_HIST_MAX - i; j++) {
+                        if (sort[j] > sort[j-1]) {
+                                tmp = sort[j];
+                                sort[j] = sort[j-1];
+                                sort[j-1] = tmp;
+                        }
+                }
+        }
+        for (i = 0; i < ATH5K_NF_CAL_HIST_MAX; i++) {
+                ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
+                        "cal %d:%d\n", i, sort[i]);
+        }
+        return sort[(ATH5K_NF_CAL_HIST_MAX-1) / 2];
+}
+
+/*
+ * When we tell the hardware to perform a noise floor calibration
+ * by setting the AR5K_PHY_AGCCTL_NF bit, it will periodically
+ * sample-and-hold the minimum noise level seen at the antennas.
+ * This value is then stored in a ring buffer of recently measured
+ * noise floor values so we have a moving window of the last few
+ * samples.
  *
- * XXX: Since during noise floor calibration antennas are detached according to
- * the patent, we should stop tx queues here.
+ * The median of the values in the history is then loaded into the
+ * hardware for its own use for RSSI and CCA measurements.
  */
-int
-ath5k_hw_noise_floor_calibration(struct ath5k_hw *ah, short freq)
+void ath5k_hw_update_noise_floor(struct ath5k_hw *ah)
 {
-        int ret;
-        unsigned int i;
-        s32 noise_floor;
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        u32 val;
+        s16 nf, threshold;
+        u8 ee_mode;
 
-        /*
-         * Enable noise floor calibration
-         */
-        AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_AGCCTL,
-                                AR5K_PHY_AGCCTL_NF);
+        /* keep last value if calibration hasn't completed */
+        if (ath5k_hw_reg_read(ah, AR5K_PHY_AGCCTL) & AR5K_PHY_AGCCTL_NF) {
+                ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
+                        "NF did not complete in calibration window\n");
 
-        ret = ath5k_hw_register_timeout(ah, AR5K_PHY_AGCCTL,
-                        AR5K_PHY_AGCCTL_NF, 0, false);
-        if (ret) {
-                ATH5K_ERR(ah->ah_sc,
-                        "noise floor calibration timeout (%uMHz)\n", freq);
-                return -EAGAIN;
+                return;
         }
 
-        /* Wait until the noise floor is calibrated and read the value */
-        for (i = 20; i > 0; i--) {
-                mdelay(1);
-                noise_floor = ath5k_hw_reg_read(ah, AR5K_PHY_NF);
-                noise_floor = AR5K_PHY_NF_RVAL(noise_floor);
-                if (noise_floor & AR5K_PHY_NF_ACTIVE) {
-                        noise_floor = AR5K_PHY_NF_AVAL(noise_floor);
-
-                        if (noise_floor <= AR5K_TUNE_NOISE_FLOOR)
-                                break;
-                }
+        switch (ah->ah_current_channel->hw_value & CHANNEL_MODES) {
+        case CHANNEL_A:
+        case CHANNEL_T:
+        case CHANNEL_XR:
+                ee_mode = AR5K_EEPROM_MODE_11A;
+                break;
+        case CHANNEL_G:
+        case CHANNEL_TG:
+                ee_mode = AR5K_EEPROM_MODE_11G;
+                break;
+        default:
+        case CHANNEL_B:
+                ee_mode = AR5K_EEPROM_MODE_11B;
+                break;
         }
 
-        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
-                "noise floor %d\n", noise_floor);
 
-        if (noise_floor > AR5K_TUNE_NOISE_FLOOR) {
-                ATH5K_ERR(ah->ah_sc,
-                        "noise floor calibration failed (%uMHz)\n", freq);
-                return -EAGAIN;
+        /* completed NF calibration, test threshold */
+        nf = ath5k_hw_read_measured_noise_floor(ah);
+        threshold = ee->ee_noise_floor_thr[ee_mode];
+
+        if (nf > threshold) {
+                ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
+                        "noise floor failure detected; "
+                        "read %d, threshold %d\n",
+                        nf, threshold);
+
+                nf = AR5K_TUNE_CCA_MAX_GOOD_VALUE;
         }
 
-        ah->ah_noise_floor = noise_floor;
+        ath5k_hw_update_nfcal_hist(ah, nf);
+        nf = ath5k_hw_get_median_noise_floor(ah);
 
-        return 0;
+        /* load noise floor (in .5 dBm) so the hardware will use it */
+        val = ath5k_hw_reg_read(ah, AR5K_PHY_NF) & ~AR5K_PHY_NF_M;
+        val |= (nf * 2) & AR5K_PHY_NF_M;
+        ath5k_hw_reg_write(ah, val, AR5K_PHY_NF);
+
+        AR5K_REG_MASKED_BITS(ah, AR5K_PHY_AGCCTL, AR5K_PHY_AGCCTL_NF,
+                ~(AR5K_PHY_AGCCTL_NF_EN | AR5K_PHY_AGCCTL_NF_NOUPDATE));
+
+        ath5k_hw_register_timeout(ah, AR5K_PHY_AGCCTL, AR5K_PHY_AGCCTL_NF,
+                0, false);
+
+        /*
+         * Load a high max CCA Power value (-50 dBm in .5 dBm units)
+         * so that we're not capped by the median we just loaded.
+         * This will be used as the initial value for the next noise
+         * floor calibration.
+         */
+        val = (val & ~AR5K_PHY_NF_M) | ((-50 * 2) & AR5K_PHY_NF_M);
+        ath5k_hw_reg_write(ah, val, AR5K_PHY_NF);
+        AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_AGCCTL,
+                AR5K_PHY_AGCCTL_NF_EN |
+                AR5K_PHY_AGCCTL_NF_NOUPDATE |
+                AR5K_PHY_AGCCTL_NF);
+
+        ah->ah_noise_floor = nf;
+
+        ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
+                "noise floor calibrated: %d\n", nf);
 }
 
 /*
@@ -1287,7 +1359,7 @@ static int ath5k_hw_rf5110_calibrate(struct ath5k_hw *ah,
                 return ret;
         }
 
-        ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
+        ath5k_hw_update_noise_floor(ah);
 
         /*
          * Re-enable RX/TX and beacons
@@ -1315,38 +1387,39 @@ static int ath5k_hw_rf511x_calibrate(struct ath5k_hw *ah,
                 goto done;
 
         /* Calibration has finished, get the results and re-run */
+
+        /* work around empty results which can apparently happen on 5212 */
         for (i = 0; i <= 10; i++) {
                 iq_corr = ath5k_hw_reg_read(ah, AR5K_PHY_IQRES_CAL_CORR);
                 i_pwr = ath5k_hw_reg_read(ah, AR5K_PHY_IQRES_CAL_PWR_I);
                 q_pwr = ath5k_hw_reg_read(ah, AR5K_PHY_IQRES_CAL_PWR_Q);
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
+                        "iq_corr:%x i_pwr:%x q_pwr:%x", iq_corr, i_pwr, q_pwr);
+                if (i_pwr && q_pwr)
+                        break;
         }
 
         i_coffd = ((i_pwr >> 1) + (q_pwr >> 1)) >> 7;
         q_coffd = q_pwr >> 7;
 
-        /* No correction */
-        if (i_coffd == 0 || q_coffd == 0)
+        /* protect against divide by 0 and loss of sign bits */
+        if (i_coffd == 0 || q_coffd < 2)
                 goto done;
 
-        i_coff = ((-iq_corr) / i_coffd) & 0x3f;
+        i_coff = (-iq_corr) / i_coffd;
+        i_coff = clamp(i_coff, -32, 31); /* signed 6 bit */
 
-        /* Boundary check */
-        if (i_coff > 31)
-                i_coff = 31;
-        if (i_coff < -32)
-                i_coff = -32;
+        q_coff = (i_pwr / q_coffd) - 128;
+        q_coff = clamp(q_coff, -16, 15); /* signed 5 bit */
 
-        q_coff = (((s32)i_pwr / q_coffd) - 128) & 0x1f;
-
-        /* Boundary check */
-        if (q_coff > 15)
-                q_coff = 15;
-        if (q_coff < -16)
-                q_coff = -16;
+        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
+                        "new I:%d Q:%d (i_coffd:%x q_coffd:%x)",
+                        i_coff, q_coff, i_coffd, q_coffd);
 
-        /* Commit new I/Q value */
-        AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_ENABLE |
-                ((u32)q_coff) | ((u32)i_coff << AR5K_PHY_IQ_CORR_Q_I_COFF_S));
+        /* Commit new I/Q values (set enable bit last to match HAL sources) */
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_Q_I_COFF, i_coff);
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_Q_Q_COFF, q_coff);
+        AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_ENABLE);
 
         /* Re-enable calibration -if we don't we'll commit
          * the same values again and again */
@@ -1360,7 +1433,7 @@ done:
          * since noise floor calibration interrupts rx path while I/Q
          * calibration doesn't. We don't need to run noise floor calibration
          * as often as I/Q calibration.*/
-        ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
+        ath5k_hw_update_noise_floor(ah);
 
         /* Initiate a gain_F calibration */
         ath5k_hw_request_rfgain_probe(ah);
@@ -1802,7 +1875,7 @@ ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
                 break;
         case AR5K_ANTMODE_FIXED_A:
                 def_ant = 1;
-                tx_ant = 0;
+                tx_ant = 1;
                 use_def_for_tx = true;
                 update_def_on_tx = false;
                 use_def_for_rts = true;
@@ -1811,7 +1884,7 @@ ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
                 break;
         case AR5K_ANTMODE_FIXED_B:
                 def_ant = 2;
-                tx_ant = 0;
+                tx_ant = 2;
                 use_def_for_tx = true;
                 update_def_on_tx = false;
                 use_def_for_rts = true;
@@ -2675,7 +2748,7 @@ ath5k_setup_channel_powertable(struct ath5k_hw *ah,
                 /* Fill curves in reverse order
                  * from lower power (max gain)
                  * to higher power. Use curve -> idx
-                 * backmaping we did on eeprom init */
+                 * backmapping we did on eeprom init */
                 u8 idx = pdg_curve_to_idx[pdg];
 
                 /* Grab the needed curves by index */
@@ -2777,7 +2850,7 @@ ath5k_setup_channel_powertable(struct ath5k_hw *ah,
         /* Now we have a set of curves for this
          * channel on tmpL (x range is table_max - table_min
          * and y values are tmpL[pdg][]) sorted in the same
-         * order as EEPROM (because we've used the backmaping).
+         * order as EEPROM (because we've used the backmapping).
          * So for RF5112 it's from higher power to lower power
          * and for RF2413 it's from lower power to higher power.
          * For RF5111 we only have one curve. */
@@ -2954,8 +3027,6 @@ ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                 ATH5K_ERR(ah->ah_sc, "invalid tx power: %u\n", txpower);
                 return -EINVAL;
         }
-        if (txpower == 0)
-                txpower = AR5K_TUNE_DEFAULT_TXPOWER;
 
         /* Reset TX power values */
         memset(&ah->ah_txpower, 0, sizeof(ah->ah_txpower));
diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
index eeebb9aef206..9122a8556f45 100644
--- a/drivers/net/wireless/ath/ath5k/qcu.c
+++ b/drivers/net/wireless/ath/ath5k/qcu.c
@@ -408,12 +408,13 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
                         break;
 
                 case AR5K_TX_QUEUE_CAB:
+                        /* XXX: use BCN_SENT_GT, if we can figure out how */
                         AR5K_REG_ENABLE_BITS(ah, AR5K_QUEUE_MISC(queue),
-                                AR5K_QCU_MISC_FRSHED_BCN_SENT_GT |
+                                AR5K_QCU_MISC_FRSHED_DBA_GT |
                                 AR5K_QCU_MISC_CBREXP_DIS |
                                 AR5K_QCU_MISC_CBREXP_BCN_DIS);
 
-                        ath5k_hw_reg_write(ah, ((AR5K_TUNE_BEACON_INTERVAL -
+                        ath5k_hw_reg_write(ah, ((tq->tqi_ready_time -
                                 (AR5K_TUNE_SW_BEACON_RESP -
                                 AR5K_TUNE_DMA_BEACON_RESP) -
                                 AR5K_TUNE_ADDITIONAL_SWBA_BACKOFF) * 1024) |
@@ -520,12 +521,16 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
  */
 unsigned int ath5k_hw_get_slot_time(struct ath5k_hw *ah)
 {
+        unsigned int slot_time_clock;
+
         ATH5K_TRACE(ah->ah_sc);
+
         if (ah->ah_version == AR5K_AR5210)
-                return ath5k_hw_clocktoh(ath5k_hw_reg_read(ah,
-                                AR5K_SLOT_TIME) & 0xffff, ah->ah_turbo);
+                slot_time_clock = ath5k_hw_reg_read(ah, AR5K_SLOT_TIME);
         else
-                return ath5k_hw_reg_read(ah, AR5K_DCU_GBL_IFS_SLOT) & 0xffff;
+                slot_time_clock = ath5k_hw_reg_read(ah, AR5K_DCU_GBL_IFS_SLOT);
+
+        return ath5k_hw_clocktoh(ah, slot_time_clock & 0xffff);
 }
 
 /*
@@ -533,15 +538,17 @@ unsigned int ath5k_hw_get_slot_time(struct ath5k_hw *ah)
  */
 int ath5k_hw_set_slot_time(struct ath5k_hw *ah, unsigned int slot_time)
 {
+        u32 slot_time_clock = ath5k_hw_htoclock(ah, slot_time);
+
         ATH5K_TRACE(ah->ah_sc);
-        if (slot_time < AR5K_SLOT_TIME_9 || slot_time > AR5K_SLOT_TIME_MAX)
+
+        if (slot_time < 6 || slot_time_clock > AR5K_SLOT_TIME_MAX)
                 return -EINVAL;
 
         if (ah->ah_version == AR5K_AR5210)
-                ath5k_hw_reg_write(ah, ath5k_hw_htoclock(slot_time,
-                                ah->ah_turbo), AR5K_SLOT_TIME);
+                ath5k_hw_reg_write(ah, slot_time_clock, AR5K_SLOT_TIME);
         else
-                ath5k_hw_reg_write(ah, slot_time, AR5K_DCU_GBL_IFS_SLOT);
+                ath5k_hw_reg_write(ah, slot_time_clock, AR5K_DCU_GBL_IFS_SLOT);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath5k/reg.h b/drivers/net/wireless/ath/ath5k/reg.h
index c63ea6afd96f..1464f89b249c 100644
--- a/drivers/net/wireless/ath/ath5k/reg.h
+++ b/drivers/net/wireless/ath/ath5k/reg.h
@@ -35,7 +35,7 @@
  * released by Atheros and on various debug messages found on the net.
  */
 
-
+#include "../reg.h"
 
 /*====MAC DMA REGISTERS====*/
 
@@ -1650,12 +1650,6 @@
 #define AR5K_SLEEP2_DTIM_PER_S          16
 
 /*
- * BSSID mask registers
- */
-#define AR5K_BSS_IDM0                   0x80e0  /* Upper bits */
-#define AR5K_BSS_IDM1                   0x80e4  /* Lower bits */
-
-/*
  * TX power control (TPC) register
  *
  * XXX: PCDAC steps (0.5dbm) or DBM ?
@@ -2039,17 +2033,14 @@
 #define AR5K_PHY_AGCCTL_NF_NOUPDATE     0x00020000      /* Don't update nf automaticaly */
 
 /*
- * PHY noise floor status register
+ * PHY noise floor status register (CCA = Clear Channel Assessment)
  */
 #define AR5K_PHY_NF                     0x9864                  /* Register address */
-#define AR5K_PHY_NF_M                   0x000001ff      /* Noise floor mask */
-#define AR5K_PHY_NF_ACTIVE              0x00000100      /* Noise floor calibration still active */
-#define AR5K_PHY_NF_RVAL(_n)            (((_n) >> 19) & AR5K_PHY_NF_M)
-#define AR5K_PHY_NF_AVAL(_n)            (-((_n) ^ AR5K_PHY_NF_M) + 1)
-#define AR5K_PHY_NF_SVAL(_n)            (((_n) & AR5K_PHY_NF_M) | (1 << 9))
+#define AR5K_PHY_NF_M                   0x000001ff      /* Noise floor, written to hardware in 1/2 dBm units */
+#define AR5K_PHY_NF_SVAL(_n)           (((_n) & AR5K_PHY_NF_M) | (1 << 9))
 #define AR5K_PHY_NF_THRESH62            0x0007f000      /* Thresh62 -check ANI patent- (field) */
 #define AR5K_PHY_NF_THRESH62_S          12
-#define AR5K_PHY_NF_MINCCA_PWR          0x0ff80000      /* ??? */
+#define AR5K_PHY_NF_MINCCA_PWR          0x0ff80000      /* Minimum measured noise level, read from hardware in 1 dBm units */
 #define AR5K_PHY_NF_MINCCA_PWR_S        19
 
 /*
@@ -2196,6 +2187,7 @@
  */
 #define AR5K_PHY_IQ                     0x9920                  /* Register Address */
 #define AR5K_PHY_IQ_CORR_Q_Q_COFF       0x0000001f      /* Mask for q correction info */
+#define AR5K_PHY_IQ_CORR_Q_Q_COFF_S     0
 #define AR5K_PHY_IQ_CORR_Q_I_COFF       0x000007e0      /* Mask for i correction info */
 #define AR5K_PHY_IQ_CORR_Q_I_COFF_S     5
 #define AR5K_PHY_IQ_CORR_ENABLE         0x00000800      /* Enable i/q correction */
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index 34e13c700849..cbf28e379843 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -25,6 +25,8 @@
   Reset functions and helpers
 \*****************************/
 
+#include <asm/unaligned.h>
+
 #include <linux/pci.h>          /* To determine if a card is pci-e */
 #include <linux/log2.h>
 #include "ath5k.h"
@@ -58,12 +60,11 @@ static inline int ath5k_hw_write_ofdm_timings(struct ath5k_hw *ah,
                 !(channel->hw_value & CHANNEL_OFDM));
 
         /* Get coefficient
-         * ALGO: coef = (5 * clock * carrier_freq) / 2)
+         * ALGO: coef = (5 * clock / carrier_freq) / 2
          * we scale coef by shifting clock value by 24 for
          * better precision since we use integers */
         /* TODO: Half/quarter rate */
-        clock =  ath5k_hw_htoclock(1, channel->hw_value & CHANNEL_TURBO);
-
+        clock =  (channel->hw_value & CHANNEL_TURBO) ? 80 : 40;
         coef_scaled = ((5 * (clock << 24)) / 2) / channel->center_freq;
 
         /* Get exponent
@@ -850,12 +851,15 @@ static void ath5k_hw_commit_eeprom_settings(struct ath5k_hw *ah,
                                 AR5K_PHY_OFDM_SELFCORR_CYPWR_THR1,
                                 AR5K_INIT_CYCRSSI_THR1);
 
-        /* I/Q correction
-         * TODO: Per channel i/q infos ? */
-        AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_IQ,
-                AR5K_PHY_IQ_CORR_ENABLE |
-                (ee->ee_i_cal[ee_mode] << AR5K_PHY_IQ_CORR_Q_I_COFF_S) |
-                ee->ee_q_cal[ee_mode]);
+        /* I/Q correction (set enable bit last to match HAL sources) */
+        /* TODO: Per channel i/q infos ? */
+        if (ah->ah_ee_version >= AR5K_EEPROM_VERSION_4_0) {
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_Q_I_COFF,
+                            ee->ee_i_cal[ee_mode]);
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_Q_Q_COFF,
+                            ee->ee_q_cal[ee_mode]);
+                AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_ENABLE);
+        }
 
         /* Heavy clipping -disable for now */
         if (ah->ah_ee_version >= AR5K_EEPROM_VERSION_5_1)
@@ -870,6 +874,7 @@ static void ath5k_hw_commit_eeprom_settings(struct ath5k_hw *ah,
 int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
         struct ieee80211_channel *channel, bool change_channel)
 {
+        struct ath_common *common = ath5k_hw_common(ah);
         u32 s_seq[10], s_ant, s_led[3], staid1_flags, tsf_up, tsf_lo;
         u32 phy_tst1;
         u8 mode, freq, ee_mode, ant[2];
@@ -1171,10 +1176,12 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
         ath5k_hw_reg_write(ah, s_led[2], AR5K_GPIODO);
 
         /* Restore sta_id flags and preserve our mac address*/
-        ath5k_hw_reg_write(ah, AR5K_LOW_ID(ah->ah_sta_id),
-                                                AR5K_STA_ID0);
-        ath5k_hw_reg_write(ah, staid1_flags | AR5K_HIGH_ID(ah->ah_sta_id),
-                                                AR5K_STA_ID1);
+        ath5k_hw_reg_write(ah,
+                           get_unaligned_le32(common->macaddr),
+                           AR5K_STA_ID0);
+        ath5k_hw_reg_write(ah,
+                           staid1_flags | get_unaligned_le16(common->macaddr + 4),
+                           AR5K_STA_ID1);
 
 
         /*
@@ -1182,8 +1189,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
          */
 
         /* Restore bssid and bssid mask */
-        /* XXX: add ah->aid once mac80211 gives this to us */
-        ath5k_hw_set_associd(ah, ah->ah_bssid, 0);
+        ath5k_hw_set_associd(ah);
 
         /* Set PCU config */
         ath5k_hw_set_opmode(ah);
@@ -1289,7 +1295,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
          * out and/or noise floor calibration might timeout.
          */
         AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_AGCCTL,
-                                AR5K_PHY_AGCCTL_CAL);
+                                AR5K_PHY_AGCCTL_CAL | AR5K_PHY_AGCCTL_NF);
 
         /* At the same time start I/Q calibration for QAM constellation
          * -no need for CCK- */
@@ -1310,24 +1316,13 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                         channel->center_freq);
         }
 
-        /*
-         * If we run NF calibration before AGC, it always times out.
-         * Binary HAL starts NF and AGC calibration at the same time
-         * and only waits for AGC to finish. Also if AGC or NF cal.
-         * times out, reset doesn't fail on binary HAL. I believe
-         * that's wrong because since rx path is routed to a detector,
-         * if cal. doesn't finish we won't have RX. Sam's HAL for AR5210/5211
-         * enables noise floor calibration after offset calibration and if noise
-         * floor calibration fails, reset fails. I believe that's
-         * a better approach, we just need to find a polling interval
-         * that suits best, even if reset continues we need to make
-         * sure that rx path is ready.
-         */
-        ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
-
         /* Restore antenna mode */
         ath5k_hw_set_antenna_mode(ah, ah->ah_ant_mode);
 
+        /* Restore slot time and ACK timeouts */
+        if (ah->ah_coverage_class > 0)
+                ath5k_hw_set_coverage_class(ah, ah->ah_coverage_class);
+
         /*
          * Configure QCUs/DCUs
          */
@@ -1382,15 +1377,15 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
          * Set clocks to 32KHz operation and use an
          * external 32KHz crystal when sleeping if one
          * exists */
-        if (ah->ah_version == AR5K_AR5212)
-                        ath5k_hw_set_sleep_clock(ah, true);
+        if (ah->ah_version == AR5K_AR5212 &&
+            ah->ah_op_mode != NL80211_IFTYPE_AP)
+                ath5k_hw_set_sleep_clock(ah, true);
 
         /*
-         * Disable beacons and reset the register
+         * Disable beacons and reset the TSF
          */
-        AR5K_REG_DISABLE_BITS(ah, AR5K_BEACON, AR5K_BEACON_ENABLE |
-                        AR5K_BEACON_RESET_TSF);
-
+        AR5K_REG_DISABLE_BITS(ah, AR5K_BEACON, AR5K_BEACON_ENABLE);
+        ath5k_hw_reset_tsf(ah);
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index ef5f59c4dd80..5774cea23a3b 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -1,9 +1,16 @@
+config ATH9K_HW
+        tristate
+config ATH9K_COMMON
+        tristate
+
 config ATH9K
         tristate "Atheros 802.11n wireless cards support"
-        depends on PCI && MAC80211 && WLAN_80211
+        depends on PCI && MAC80211
+        select ATH9K_HW
         select MAC80211_LEDS
         select LEDS_CLASS
         select NEW_LEDS
+        select ATH9K_COMMON
         ---help---
           This module adds support for wireless adapters based on
           Atheros IEEE 802.11n AR5008, AR9001 and AR9002 family
@@ -16,13 +23,12 @@ config ATH9K
 
           If you choose to build a module, it'll be called ath9k.
 
-config ATH9K_DEBUG
+config ATH9K_DEBUGFS
         bool "Atheros ath9k debugging"
-        depends on ATH9K
+        depends on ATH9K && DEBUG_FS
         ---help---
-          Say Y, if you need ath9k to display debug messages.
-          Pass the debug mask as a module parameter:
+          Say Y, if you need access to ath9k's statistics for
+          interrupts, rate control, etc.
 
-          modprobe ath9k debug=0x00000200
+          Also required for changing debug message flags at run time.
 
-          Look in ath9k/debug.h for possible debug masks
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index ff2c9a26c10c..6b50d5eb9ec3 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -1,22 +1,30 @@
-ath9k-y +=      hw.o \
-                eeprom.o \
-                eeprom_def.o \
-                eeprom_4k.o \
-                eeprom_9287.o \
-                mac.o \
-                calib.o \
-                ani.o \
-                phy.o \
-                beacon.o \
+ath9k-y +=      beacon.o \
+                gpio.o \
+                init.o \
                 main.o \
                 recv.o \
                 xmit.o \
                 virtual.o \
-                rc.o \
-                btcoex.o
+                rc.o
 
 ath9k-$(CONFIG_PCI) += pci.o
 ath9k-$(CONFIG_ATHEROS_AR71XX) += ahb.o
-ath9k-$(CONFIG_ATH9K_DEBUG) += debug.o
+ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o
 
 obj-$(CONFIG_ATH9K) += ath9k.o
+
+ath9k_hw-y:=    hw.o \
+                eeprom.o \
+                eeprom_def.o \
+                eeprom_4k.o \
+                eeprom_9287.o \
+                calib.o \
+                ani.o \
+                phy.o \
+                btcoex.o \
+                mac.o \
+
+obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o
+
+obj-$(CONFIG_ATH9K_COMMON) += ath9k_common.o
+ath9k_common-y:=        common.o
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index 2ad7d0280f7a..ca4994f13151 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -22,27 +22,23 @@
 #include "ath9k.h"
 
 /* return bus cachesize in 4B word units */
-static void ath_ahb_read_cachesize(struct ath_softc *sc, int *csz)
+static void ath_ahb_read_cachesize(struct ath_common *common, int *csz)
 {
         *csz = L1_CACHE_BYTES >> 2;
 }
 
-static void ath_ahb_cleanup(struct ath_softc *sc)
+static bool ath_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data)
 {
-        iounmap(sc->mem);
-}
-
-static bool ath_ahb_eeprom_read(struct ath_hw *ah, u32 off, u16 *data)
-{
-        struct ath_softc *sc = ah->ah_sc;
+        struct ath_softc *sc = (struct ath_softc *)common->priv;
         struct platform_device *pdev = to_platform_device(sc->dev);
         struct ath9k_platform_data *pdata;
 
         pdata = (struct ath9k_platform_data *) pdev->dev.platform_data;
         if (off >= (ARRAY_SIZE(pdata->eeprom_data))) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "%s: flash read failed, offset %08x is out of range\n",
-                                __func__, off);
+                ath_print(common, ATH_DBG_FATAL,
+                          "%s: flash read failed, offset %08x "
+                          "is out of range\n",
+                          __func__, off);
                 return false;
         }
 
@@ -52,8 +48,6 @@ static bool ath_ahb_eeprom_read(struct ath_hw *ah, u32 off, u16 *data)
 
 static struct ath_bus_ops ath_ahb_bus_ops  = {
         .read_cachesize = ath_ahb_read_cachesize,
-        .cleanup = ath_ahb_cleanup,
-
         .eeprom_read = ath_ahb_eeprom_read,
 };
 
@@ -67,6 +61,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
         int irq;
         int ret = 0;
         struct ath_hw *ah;
+        char hw_name[64];
 
         if (!pdev->dev.platform_data) {
                 dev_err(&pdev->dev, "no platform data specified\n");
@@ -116,36 +111,35 @@ static int ath_ahb_probe(struct platform_device *pdev)
         sc->hw = hw;
         sc->dev = &pdev->dev;
         sc->mem = mem;
-        sc->bus_ops = &ath_ahb_bus_ops;
         sc->irq = irq;
 
-        ret = ath_init_device(AR5416_AR9100_DEVID, sc, 0x0);
+        /* Will be cleared in ath9k_start() */
+        sc->sc_flags |= SC_OP_INVALID;
+
+        ret = request_irq(irq, ath_isr, IRQF_SHARED, "ath9k", sc);
         if (ret) {
-                dev_err(&pdev->dev, "failed to initialize device\n");
+                dev_err(&pdev->dev, "request_irq failed\n");
                 goto err_free_hw;
         }
 
-        ret = request_irq(irq, ath_isr, IRQF_SHARED, "ath9k", sc);
+        ret = ath9k_init_device(AR5416_AR9100_DEVID, sc, 0x0, &ath_ahb_bus_ops);
         if (ret) {
-                dev_err(&pdev->dev, "request_irq failed\n");
-                goto err_detach;
+                dev_err(&pdev->dev, "failed to initialize device\n");
+                goto err_irq;
         }
 
         ah = sc->sc_ah;
+        ath9k_hw_name(ah, hw_name, sizeof(hw_name));
         printk(KERN_INFO
-               "%s: Atheros AR%s MAC/BB Rev:%x, "
-               "AR%s RF Rev:%x, mem=0x%lx, irq=%d\n",
+               "%s: %s mem=0x%lx, irq=%d\n",
                wiphy_name(hw->wiphy),
-               ath_mac_bb_name(ah->hw_version.macVersion),
-               ah->hw_version.macRev,
-               ath_rf_name((ah->hw_version.analog5GhzRev & AR_RADIO_SREV_MAJOR)),
-               ah->hw_version.phyRev,
+               hw_name,
                (unsigned long)mem, irq);
 
         return 0;
 
- err_detach:
-        ath_detach(sc);
+ err_irq:
+        free_irq(irq, sc);
  err_free_hw:
         ieee80211_free_hw(hw);
         platform_set_drvdata(pdev, NULL);
@@ -162,8 +156,12 @@ static int ath_ahb_remove(struct platform_device *pdev)
         if (hw) {
                 struct ath_wiphy *aphy = hw->priv;
                 struct ath_softc *sc = aphy->sc;
+                void __iomem *mem = sc->mem;
 
-                ath_cleanup(sc);
+                ath9k_deinit_device(sc);
+                free_irq(sc->irq, sc);
+                ieee80211_free_hw(sc->hw);
+                iounmap(mem);
                 platform_set_drvdata(pdev, NULL);
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 2b493742ef10..2a0cd64c2bfb 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include "ath9k.h"
+#include "hw.h"
 
 static int ath9k_hw_get_ani_channel_idx(struct ath_hw *ah,
                                         struct ath9k_channel *chan)
@@ -31,8 +31,8 @@ static int ath9k_hw_get_ani_channel_idx(struct ath_hw *ah,
                 }
         }
 
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                "No more channel states left. Using channel 0\n");
+        ath_print(ath9k_hw_common(ah), ATH_DBG_ANI,
+                  "No more channel states left. Using channel 0\n");
 
         return 0;
 }
@@ -41,16 +41,17 @@ static bool ath9k_hw_ani_control(struct ath_hw *ah,
                                  enum ath9k_ani_cmd cmd, int param)
 {
         struct ar5416AniState *aniState = ah->curani;
+        struct ath_common *common = ath9k_hw_common(ah);
 
         switch (cmd & ah->ani_function) {
         case ATH9K_ANI_NOISE_IMMUNITY_LEVEL:{
                 u32 level = param;
 
                 if (level >= ARRAY_SIZE(ah->totalSizeDesired)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                                "level out of range (%u > %u)\n",
-                                level,
-                                (unsigned)ARRAY_SIZE(ah->totalSizeDesired));
+                        ath_print(common, ATH_DBG_ANI,
+                                  "level out of range (%u > %u)\n",
+                                  level,
+                                  (unsigned)ARRAY_SIZE(ah->totalSizeDesired));
                         return false;
                 }
 
@@ -152,10 +153,10 @@ static bool ath9k_hw_ani_control(struct ath_hw *ah,
                 u32 level = param;
 
                 if (level >= ARRAY_SIZE(firstep)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                                "level out of range (%u > %u)\n",
-                                level,
-                                (unsigned) ARRAY_SIZE(firstep));
+                        ath_print(common, ATH_DBG_ANI,
+                                  "level out of range (%u > %u)\n",
+                                  level,
+                                  (unsigned) ARRAY_SIZE(firstep));
                         return false;
                 }
                 REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
@@ -174,11 +175,10 @@ static bool ath9k_hw_ani_control(struct ath_hw *ah,
                 u32 level = param;
 
                 if (level >= ARRAY_SIZE(cycpwrThr1)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                                "level out of range (%u > %u)\n",
-                                level,
-                                (unsigned)
-                                ARRAY_SIZE(cycpwrThr1));
+                        ath_print(common, ATH_DBG_ANI,
+                                  "level out of range (%u > %u)\n",
+                                  level,
+                                  (unsigned) ARRAY_SIZE(cycpwrThr1));
                         return false;
                 }
                 REG_RMW_FIELD(ah, AR_PHY_TIMING5,
@@ -194,25 +194,28 @@ static bool ath9k_hw_ani_control(struct ath_hw *ah,
         case ATH9K_ANI_PRESENT:
                 break;
         default:
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                        "invalid cmd %u\n", cmd);
+                ath_print(common, ATH_DBG_ANI,
+                          "invalid cmd %u\n", cmd);
                 return false;
         }
 
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI, "ANI parameters:\n");
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                "noiseImmunityLevel=%d, spurImmunityLevel=%d, "
-                "ofdmWeakSigDetectOff=%d\n",
-                aniState->noiseImmunityLevel, aniState->spurImmunityLevel,
-                !aniState->ofdmWeakSigDetectOff);
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                "cckWeakSigThreshold=%d, "
-                "firstepLevel=%d, listenTime=%d\n",
-                aniState->cckWeakSigThreshold, aniState->firstepLevel,
-                aniState->listenTime);
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
+        ath_print(common, ATH_DBG_ANI, "ANI parameters:\n");
+        ath_print(common, ATH_DBG_ANI,
+                  "noiseImmunityLevel=%d, spurImmunityLevel=%d, "
+                  "ofdmWeakSigDetectOff=%d\n",
+                  aniState->noiseImmunityLevel,
+                  aniState->spurImmunityLevel,
+                  !aniState->ofdmWeakSigDetectOff);
+        ath_print(common, ATH_DBG_ANI,
+                  "cckWeakSigThreshold=%d, "
+                  "firstepLevel=%d, listenTime=%d\n",
+                  aniState->cckWeakSigThreshold,
+                  aniState->firstepLevel,
+                  aniState->listenTime);
+        ath_print(common, ATH_DBG_ANI,
                 "cycleCount=%d, ofdmPhyErrCount=%d, cckPhyErrCount=%d\n\n",
-                aniState->cycleCount, aniState->ofdmPhyErrCount,
+                aniState->cycleCount,
+                aniState->ofdmPhyErrCount,
                 aniState->cckPhyErrCount);
 
         return true;
@@ -231,6 +234,7 @@ static void ath9k_hw_update_mibstats(struct ath_hw *ah,
 static void ath9k_ani_restart(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
+        struct ath_common *common = ath9k_hw_common(ah);
 
         if (!DO_ANI(ah))
                 return;
@@ -240,24 +244,24 @@ static void ath9k_ani_restart(struct ath_hw *ah)
 
         if (aniState->ofdmTrigHigh > AR_PHY_COUNTMAX) {
                 aniState->ofdmPhyErrBase = 0;
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                        "OFDM Trigger is too high for hw counters\n");
+                ath_print(common, ATH_DBG_ANI,
+                          "OFDM Trigger is too high for hw counters\n");
         } else {
                 aniState->ofdmPhyErrBase =
                         AR_PHY_COUNTMAX - aniState->ofdmTrigHigh;
         }
         if (aniState->cckTrigHigh > AR_PHY_COUNTMAX) {
                 aniState->cckPhyErrBase = 0;
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                        "CCK Trigger is too high for hw counters\n");
+                ath_print(common, ATH_DBG_ANI,
+                          "CCK Trigger is too high for hw counters\n");
         } else {
                 aniState->cckPhyErrBase =
                         AR_PHY_COUNTMAX - aniState->cckTrigHigh;
         }
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                "Writing ofdmbase=%u   cckbase=%u\n",
-                aniState->ofdmPhyErrBase,
-                aniState->cckPhyErrBase);
+        ath_print(common, ATH_DBG_ANI,
+                  "Writing ofdmbase=%u   cckbase=%u\n",
+                  aniState->ofdmPhyErrBase,
+                  aniState->cckPhyErrBase);
         REG_WRITE(ah, AR_PHY_ERR_1, aniState->ofdmPhyErrBase);
         REG_WRITE(ah, AR_PHY_ERR_2, aniState->cckPhyErrBase);
         REG_WRITE(ah, AR_PHY_ERR_MASK_1, AR_PHY_ERR_OFDM_TIMING);
@@ -271,7 +275,7 @@ static void ath9k_ani_restart(struct ath_hw *ah)
 
 static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)
 {
-        struct ieee80211_conf *conf = &ah->ah_sc->hw->conf;
+        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
         struct ar5416AniState *aniState;
         int32_t rssi;
 
@@ -343,7 +347,7 @@ static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)
 
 static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)
 {
-        struct ieee80211_conf *conf = &ah->ah_sc->hw->conf;
+        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
         struct ar5416AniState *aniState;
         int32_t rssi;
 
@@ -464,6 +468,7 @@ void ath9k_ani_reset(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
         struct ath9k_channel *chan = ah->curchan;
+        struct ath_common *common = ath9k_hw_common(ah);
         int index;
 
         if (!DO_ANI(ah))
@@ -475,8 +480,8 @@ void ath9k_ani_reset(struct ath_hw *ah)
 
         if (DO_ANI(ah) && ah->opmode != NL80211_IFTYPE_STATION
             && ah->opmode != NL80211_IFTYPE_ADHOC) {
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                        "Reset ANI state opmode %u\n", ah->opmode);
+                ath_print(common, ATH_DBG_ANI,
+                          "Reset ANI state opmode %u\n", ah->opmode);
                 ah->stats.ast_ani_reset++;
 
                 if (ah->opmode == NL80211_IFTYPE_AP) {
@@ -543,6 +548,7 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah,
                           struct ath9k_channel *chan)
 {
         struct ar5416AniState *aniState;
+        struct ath_common *common = ath9k_hw_common(ah);
         int32_t listenTime;
         u32 phyCnt1, phyCnt2;
         u32 ofdmPhyErrCnt, cckPhyErrCnt;
@@ -569,20 +575,22 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah,
         if (phyCnt1 < aniState->ofdmPhyErrBase ||
             phyCnt2 < aniState->cckPhyErrBase) {
                 if (phyCnt1 < aniState->ofdmPhyErrBase) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                                "phyCnt1 0x%x, resetting "
-                                "counter value to 0x%x\n",
-                                phyCnt1, aniState->ofdmPhyErrBase);
+                        ath_print(common, ATH_DBG_ANI,
+                                  "phyCnt1 0x%x, resetting "
+                                  "counter value to 0x%x\n",
+                                  phyCnt1,
+                                  aniState->ofdmPhyErrBase);
                         REG_WRITE(ah, AR_PHY_ERR_1,
                                   aniState->ofdmPhyErrBase);
                         REG_WRITE(ah, AR_PHY_ERR_MASK_1,
                                   AR_PHY_ERR_OFDM_TIMING);
                 }
                 if (phyCnt2 < aniState->cckPhyErrBase) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                                "phyCnt2 0x%x, resetting "
-                                "counter value to 0x%x\n",
-                                phyCnt2, aniState->cckPhyErrBase);
+                        ath_print(common, ATH_DBG_ANI,
+                                  "phyCnt2 0x%x, resetting "
+                                  "counter value to 0x%x\n",
+                                  phyCnt2,
+                                  aniState->cckPhyErrBase);
                         REG_WRITE(ah, AR_PHY_ERR_2,
                                   aniState->cckPhyErrBase);
                         REG_WRITE(ah, AR_PHY_ERR_MASK_2,
@@ -621,10 +629,13 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah,
                 }
         }
 }
+EXPORT_SYMBOL(ath9k_hw_ani_monitor);
 
 void ath9k_enable_mib_counters(struct ath_hw *ah)
 {
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI, "Enable MIB counters\n");
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        ath_print(common, ATH_DBG_ANI, "Enable MIB counters\n");
 
         ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
 
@@ -640,7 +651,10 @@ void ath9k_enable_mib_counters(struct ath_hw *ah)
 /* Freeze the MIB counters, get the stats and then clear them */
 void ath9k_hw_disable_mib_counters(struct ath_hw *ah)
 {
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI, "Disable MIB counters\n");
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        ath_print(common, ATH_DBG_ANI, "Disable MIB counters\n");
+
         REG_WRITE(ah, AR_MIBC, AR_MIBC_FMC);
         ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
         REG_WRITE(ah, AR_MIBC, AR_MIBC_CMC);
@@ -653,6 +667,7 @@ u32 ath9k_hw_GetMibCycleCountsPct(struct ath_hw *ah,
                                   u32 *rxf_pcnt,
                                   u32 *txf_pcnt)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         static u32 cycles, rx_clear, rx_frame, tx_frame;
         u32 good = 1;
 
@@ -662,8 +677,8 @@ u32 ath9k_hw_GetMibCycleCountsPct(struct ath_hw *ah,
         u32 cc = REG_READ(ah, AR_CCCNT);
 
         if (cycles == 0 || cycles > cc) {
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                        "cycle counter wrap. ExtBusy = 0\n");
+                ath_print(common, ATH_DBG_ANI,
+                          "cycle counter wrap. ExtBusy = 0\n");
                 good = 0;
         } else {
                 u32 cc_d = cc - cycles;
@@ -742,6 +757,7 @@ void ath9k_hw_procmibevent(struct ath_hw *ah)
                 ath9k_ani_restart(ah);
         }
 }
+EXPORT_SYMBOL(ath9k_hw_procmibevent);
 
 void ath9k_hw_ani_setup(struct ath_hw *ah)
 {
@@ -762,9 +778,10 @@ void ath9k_hw_ani_setup(struct ath_hw *ah)
 
 void ath9k_hw_ani_init(struct ath_hw *ah)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         int i;
 
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI, "Initialize ANI\n");
+        ath_print(common, ATH_DBG_ANI, "Initialize ANI\n");
 
         memset(ah->ani, 0, sizeof(ah->ani));
         for (i = 0; i < ARRAY_SIZE(ah->ani); i++) {
@@ -786,11 +803,11 @@ void ath9k_hw_ani_init(struct ath_hw *ah)
                         AR_PHY_COUNTMAX - ATH9K_ANI_CCK_TRIG_HIGH;
         }
 
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                "Setting OfdmErrBase = 0x%08x\n",
-                ah->ani[0].ofdmPhyErrBase);
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI, "Setting cckErrBase = 0x%08x\n",
-                ah->ani[0].cckPhyErrBase);
+        ath_print(common, ATH_DBG_ANI,
+                  "Setting OfdmErrBase = 0x%08x\n",
+                  ah->ani[0].ofdmPhyErrBase);
+        ath_print(common, ATH_DBG_ANI, "Setting cckErrBase = 0x%08x\n",
+                  ah->ani[0].cckPhyErrBase);
 
         REG_WRITE(ah, AR_PHY_ERR_1, ah->ani[0].ofdmPhyErrBase);
         REG_WRITE(ah, AR_PHY_ERR_2, ah->ani[0].cckPhyErrBase);
@@ -803,7 +820,7 @@ void ath9k_hw_ani_init(struct ath_hw *ah)
 
 void ath9k_hw_ani_disable(struct ath_hw *ah)
 {
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI, "Disabling ANI\n");
+        ath_print(ath9k_hw_common(ah), ATH_DBG_ANI, "Disabling ANI\n");
 
         ath9k_hw_disable_mib_counters(ah);
         REG_WRITE(ah, AR_PHY_ERR_1, 0);
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 1d59f10f68da..83c7ea4c007f 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -19,24 +19,25 @@
 
 #include <linux/etherdevice.h>
 #include <linux/device.h>
-#include <net/mac80211.h>
 #include <linux/leds.h>
 
-#include "hw.h"
-#include "rc.h"
 #include "debug.h"
-#include "../ath.h"
-#include "btcoex.h"
+#include "common.h"
+
+/*
+ * Header for the ath9k.ko driver core *only* -- hw code nor any other driver
+ * should rely on this file or its contents.
+ */
 
 struct ath_node;
 
 /* Macro to expand scalars to 64-bit objects */
 
-#define ito64(x) (sizeof(x) == 8) ?                     \
+#define ito64(x) (sizeof(x) == 1) ?                     \
         (((unsigned long long int)(x)) & (0xff)) :      \
-        (sizeof(x) == 16) ?                             \
+        (sizeof(x) == 2) ?                              \
         (((unsigned long long int)(x)) & 0xffff) :      \
-        ((sizeof(x) == 32) ?                            \
+        ((sizeof(x) == 4) ?                             \
          (((unsigned long long int)(x)) & 0xffffffff) : \
          (unsigned long long int)(x))
 
@@ -54,15 +55,11 @@ struct ath_node;
 
 #define A_MAX(a, b) ((a) > (b) ? (a) : (b))
 
-#define ASSERT(exp) BUG_ON(!(exp))
-
 #define TSF_TO_TU(_h,_l) \
         ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
 
 #define ATH_TXQ_SETUP(sc, i)        ((sc)->tx.txqsetup & (1<<i))
 
-static const u8 ath_bcast_mac[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-
 struct ath_config {
         u32 ath_aggr_prot;
         u16 txpowlimit;
@@ -103,18 +100,6 @@ enum buffer_type {
         BUF_XRETRY              = BIT(5),
 };
 
-struct ath_buf_state {
-        int bfs_nframes;
-        u16 bfs_al;
-        u16 bfs_frmlen;
-        int bfs_seqno;
-        int bfs_tidno;
-        int bfs_retries;
-        u8 bf_type;
-        u32 bfs_keyix;
-        enum ath9k_key_type bfs_keytype;
-};
-
 #define bf_nframes              bf_state.bfs_nframes
 #define bf_al                   bf_state.bfs_al
 #define bf_frmlen               bf_state.bfs_frmlen
@@ -129,21 +114,6 @@ struct ath_buf_state {
 #define bf_isretried(bf)        (bf->bf_state.bf_type & BUF_RETRY)
 #define bf_isxretried(bf)       (bf->bf_state.bf_type & BUF_XRETRY)
 
-struct ath_buf {
-        struct list_head list;
-        struct ath_buf *bf_lastbf;      /* last buf of this unit (a frame or
-                                           an aggregate) */
-        struct ath_buf *bf_next;        /* next subframe in the aggregate */
-        struct sk_buff *bf_mpdu;        /* enclosing frame structure */
-        struct ath_desc *bf_desc;       /* virtual addr of desc */
-        dma_addr_t bf_daddr;            /* physical addr of desc */
-        dma_addr_t bf_buf_addr;         /* physical addr of data buffer */
-        bool bf_stale;
-        u16 bf_flags;
-        struct ath_buf_state bf_state;
-        dma_addr_t bf_dmacontext;
-};
-
 struct ath_descdma {
         struct ath_desc *dd_desc;
         dma_addr_t dd_desc_paddr;
@@ -163,13 +133,9 @@ void ath_descdma_cleanup(struct ath_softc *sc, struct ath_descdma *dd,
 
 #define ATH_MAX_ANTENNA         3
 #define ATH_RXBUF               512
-#define WME_NUM_TID             16
 #define ATH_TXBUF               512
 #define ATH_TXMAXTRY            13
 #define ATH_MGT_TXMAXTRY        4
-#define WME_BA_BMP_SIZE         64
-#define WME_MAX_BA              WME_BA_BMP_SIZE
-#define ATH_TID_MAX_BUFS        (2 * WME_MAX_BA)
 
 #define TID_TO_WME_AC(_tid)                             \
         ((((_tid) == 0) || ((_tid) == 3)) ? WME_AC_BE : \
@@ -177,12 +143,6 @@ void ath_descdma_cleanup(struct ath_softc *sc, struct ath_descdma *dd,
          (((_tid) == 4) || ((_tid) == 5)) ? WME_AC_VI : \
          WME_AC_VO)
 
-#define WME_AC_BE   0
-#define WME_AC_BK   1
-#define WME_AC_VI   2
-#define WME_AC_VO   3
-#define WME_NUM_AC  4
-
 #define ADDBA_EXCHANGE_ATTEMPTS    10
 #define ATH_AGGR_DELIM_SZ          4
 #define ATH_AGGR_MINPLEN           256 /* in bytes, minimum packet length */
@@ -191,7 +151,6 @@ void ath_descdma_cleanup(struct ath_softc *sc, struct ath_descdma *dd,
 /* minimum h/w qdepth to be sustained to maximize aggregation */
 #define ATH_AGGR_MIN_QDEPTH        2
 #define ATH_AMPDU_SUBFRAME_DEFAULT 32
-#define ATH_AMPDU_LIMIT_MAX        (64 * 1024 - 1)
 
 #define IEEE80211_SEQ_SEQ_SHIFT    4
 #define IEEE80211_SEQ_MAX          4096
@@ -238,18 +197,8 @@ struct ath_txq {
         struct list_head axq_q;
         spinlock_t axq_lock;
         u32 axq_depth;
-        u8 axq_aggr_depth;
         bool stopped;
         bool axq_tx_inprogress;
-        struct ath_buf *axq_linkbuf;
-
-        /* first desc of the last descriptor that contains CTS */
-        struct ath_desc *axq_lastdsWithCTS;
-
-        /* final desc of the gating desc that determines whether
-           lastdsWithCTS has been DMA'ed or not */
-        struct ath_desc *axq_gatingds;
-
         struct list_head axq_acq;
 };
 
@@ -257,30 +206,6 @@ struct ath_txq {
 #define AGGR_ADDBA_COMPLETE  BIT(2)
 #define AGGR_ADDBA_PROGRESS  BIT(3)
 
-struct ath_atx_tid {
-        struct list_head list;
-        struct list_head buf_q;
-        struct ath_node *an;
-        struct ath_atx_ac *ac;
-        struct ath_buf *tx_buf[ATH_TID_MAX_BUFS];
-        u16 seq_start;
-        u16 seq_next;
-        u16 baw_size;
-        int tidno;
-        int baw_head;   /* first un-acked tx buffer */
-        int baw_tail;   /* next unused tx buffer slot */
-        int sched;
-        int paused;
-        u8 state;
-};
-
-struct ath_atx_ac {
-        int sched;
-        int qnum;
-        struct list_head list;
-        struct list_head tid_q;
-};
-
 struct ath_tx_control {
         struct ath_txq *txq;
         int if_id;
@@ -291,30 +216,6 @@ struct ath_tx_control {
 #define ATH_TX_XRETRY       0x02
 #define ATH_TX_BAR          0x04
 
-#define ATH_RSSI_LPF_LEN                10
-#define RSSI_LPF_THRESHOLD              -20
-#define ATH9K_RSSI_BAD                  0x80
-#define ATH_RSSI_EP_MULTIPLIER     (1<<7)
-#define ATH_EP_MUL(x, mul)         ((x) * (mul))
-#define ATH_RSSI_IN(x)             (ATH_EP_MUL((x), ATH_RSSI_EP_MULTIPLIER))
-#define ATH_LPF_RSSI(x, y, len) \
-    ((x != ATH_RSSI_DUMMY_MARKER) ? (((x) * ((len) - 1) + (y)) / (len)) : (y))
-#define ATH_RSSI_LPF(x, y) do {                                         \
-    if ((y) >= RSSI_LPF_THRESHOLD)                                      \
-        x = ATH_LPF_RSSI((x), ATH_RSSI_IN((y)), ATH_RSSI_LPF_LEN);      \
-} while (0)
-#define ATH_EP_RND(x, mul)                                              \
-        ((((x)%(mul)) >= ((mul)/2)) ? ((x) + ((mul) - 1)) / (mul) : (x)/(mul))
-
-struct ath_node {
-        struct ath_softc *an_sc;
-        struct ath_atx_tid tid[WME_NUM_TID];
-        struct ath_atx_ac ac[WME_NUM_AC];
-        u16 maxampdu;
-        u8 mpdudensity;
-        int last_rssi;
-};
-
 struct ath_tx {
         u16 seq_no;
         u32 txqsetup;
@@ -329,7 +230,6 @@ struct ath_rx {
         u8 defant;
         u8 rxotherant;
         u32 *rxlink;
-        int bufsize;
         unsigned int rxfilter;
         spinlock_t rxflushlock;
         spinlock_t rxbuflock;
@@ -367,6 +267,7 @@ void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
                        u16 tid, u16 *ssn);
 void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
 void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
+void ath9k_enable_ps(struct ath_softc *sc);
 
 /********/
 /* VIFs */
@@ -427,9 +328,9 @@ struct ath_beacon {
 
 void ath_beacon_tasklet(unsigned long data);
 void ath_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif);
-int ath_beaconq_setup(struct ath_hw *ah);
 int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif);
 void ath_beacon_return(struct ath_softc *sc, struct ath_vif *avp);
+int ath_beaconq_config(struct ath_softc *sc);
 
 /*******/
 /* ANI */
@@ -441,16 +342,37 @@ void ath_beacon_return(struct ath_softc *sc, struct ath_vif *avp);
 #define ATH_LONG_CALINTERVAL      30000   /* 30 seconds */
 #define ATH_RESTART_CALINTERVAL   1200000 /* 20 minutes */
 
-struct ath_ani {
-        bool caldone;
-        int16_t noise_floor;
-        unsigned int longcal_timer;
-        unsigned int shortcal_timer;
-        unsigned int resetcal_timer;
-        unsigned int checkani_timer;
-        struct timer_list timer;
+void ath_ani_calibrate(unsigned long data);
+
+/**********/
+/* BTCOEX */
+/**********/
+
+/* Defines the BT AR_BT_COEX_WGHT used */
+enum ath_stomp_type {
+        ATH_BTCOEX_NO_STOMP,
+        ATH_BTCOEX_STOMP_ALL,
+        ATH_BTCOEX_STOMP_LOW,
+        ATH_BTCOEX_STOMP_NONE
 };
 
+struct ath_btcoex {
+        bool hw_timer_enabled;
+        spinlock_t btcoex_lock;
+        struct timer_list period_timer; /* Timer for BT period */
+        u32 bt_priority_cnt;
+        unsigned long bt_priority_time;
+        int bt_stomp_type; /* Types of BT stomping */
+        u32 btcoex_no_stomp; /* in usec */
+        u32 btcoex_period; /* in usec */
+        u32 btscan_no_stomp; /* in usec */
+        struct ath_gen_timer *no_stomp_timer; /* Timer for no BT stomping */
+};
+
+int ath_init_btcoex_timer(struct ath_softc *sc);
+void ath9k_btcoex_timer_resume(struct ath_softc *sc);
+void ath9k_btcoex_timer_pause(struct ath_softc *sc);
+
 /********************/
 /*   LED Control    */
 /********************/
@@ -475,6 +397,9 @@ struct ath_led {
         bool registered;
 };
 
+void ath_init_leds(struct ath_softc *sc);
+void ath_deinit_leds(struct ath_softc *sc);
+
 /********************/
 /* Main driver core */
 /********************/
@@ -484,61 +409,46 @@ struct ath_led {
  * Used when PCI device not fully initialized by bootrom/BIOS
 */
 #define DEFAULT_CACHELINE       32
-#define ATH_DEFAULT_NOISE_FLOOR -95
 #define ATH_REGCLASSIDS_MAX     10
 #define ATH_CABQ_READY_TIME     80      /* % of beacon interval */
 #define ATH_MAX_SW_RETRIES      10
 #define ATH_CHAN_MAX            255
 #define IEEE80211_WEP_NKID      4       /* number of key ids */
 
-/*
- * The key cache is used for h/w cipher state and also for
- * tracking station state such as the current tx antenna.
- * We also setup a mapping table between key cache slot indices
- * and station state to short-circuit node lookups on rx.
- * Different parts have different size key caches.  We handle
- * up to ATH_KEYMAX entries (could dynamically allocate state).
- */
-#define ATH_KEYMAX              128     /* max key cache size we handle */
-
 #define ATH_TXPOWER_MAX         100     /* .5 dBm units */
-#define ATH_RSSI_DUMMY_MARKER   0x127
 #define ATH_RATE_DUMMY_MARKER   0
 
-#define SC_OP_INVALID           BIT(0)
-#define SC_OP_BEACONS           BIT(1)
-#define SC_OP_RXAGGR            BIT(2)
-#define SC_OP_TXAGGR            BIT(3)
-#define SC_OP_FULL_RESET        BIT(4)
-#define SC_OP_PREAMBLE_SHORT    BIT(5)
-#define SC_OP_PROTECT_ENABLE    BIT(6)
-#define SC_OP_RXFLUSH           BIT(7)
-#define SC_OP_LED_ASSOCIATED    BIT(8)
-#define SC_OP_WAIT_FOR_BEACON   BIT(12)
-#define SC_OP_LED_ON            BIT(13)
-#define SC_OP_SCANNING          BIT(14)
-#define SC_OP_TSF_RESET         BIT(15)
-#define SC_OP_WAIT_FOR_CAB      BIT(16)
-#define SC_OP_WAIT_FOR_PSPOLL_DATA BIT(17)
-#define SC_OP_WAIT_FOR_TX_ACK   BIT(18)
-#define SC_OP_BEACON_SYNC       BIT(19)
-#define SC_OP_BTCOEX_ENABLED    BIT(20)
-#define SC_OP_BT_PRIORITY_DETECTED BIT(21)
-
-struct ath_bus_ops {
-        void            (*read_cachesize)(struct ath_softc *sc, int *csz);
-        void            (*cleanup)(struct ath_softc *sc);
-        bool            (*eeprom_read)(struct ath_hw *ah, u32 off, u16 *data);
-};
+#define SC_OP_INVALID                BIT(0)
+#define SC_OP_BEACONS                BIT(1)
+#define SC_OP_RXAGGR                 BIT(2)
+#define SC_OP_TXAGGR                 BIT(3)
+#define SC_OP_FULL_RESET             BIT(4)
+#define SC_OP_PREAMBLE_SHORT         BIT(5)
+#define SC_OP_PROTECT_ENABLE         BIT(6)
+#define SC_OP_RXFLUSH                BIT(7)
+#define SC_OP_LED_ASSOCIATED         BIT(8)
+#define SC_OP_LED_ON                 BIT(9)
+#define SC_OP_SCANNING               BIT(10)
+#define SC_OP_TSF_RESET              BIT(11)
+#define SC_OP_BT_PRIORITY_DETECTED   BIT(12)
+#define SC_OP_BT_SCAN                BIT(13)
+
+/* Powersave flags */
+#define PS_WAIT_FOR_BEACON        BIT(0)
+#define PS_WAIT_FOR_CAB           BIT(1)
+#define PS_WAIT_FOR_PSPOLL_DATA   BIT(2)
+#define PS_WAIT_FOR_TX_ACK        BIT(3)
+#define PS_BEACON_SYNC            BIT(4)
+#define PS_NULLFUNC_COMPLETED     BIT(5)
+#define PS_ENABLED                BIT(6)
 
 struct ath_wiphy;
+struct ath_rate_table;
 
 struct ath_softc {
         struct ieee80211_hw *hw;
         struct device *dev;
 
-        struct ath_common common;
-
         spinlock_t wiphy_lock; /* spinlock to protect ath_wiphy data */
         struct ath_wiphy *pri_wiphy;
         struct ath_wiphy **sec_wiphy; /* secondary wiphys (virtual radios); may
@@ -561,36 +471,26 @@ struct ath_softc {
         int irq;
         spinlock_t sc_resetlock;
         spinlock_t sc_serial_rw;
-        spinlock_t ani_lock;
         spinlock_t sc_pm_lock;
         struct mutex mutex;
 
-        u8 curbssid[ETH_ALEN];
-        u8 bssidmask[ETH_ALEN];
         u32 intrstatus;
         u32 sc_flags; /* SC_OP_* */
+        u16 ps_flags; /* PS_* */
         u16 curtxpow;
-        u16 curaid;
         u8 nbcnvifs;
         u16 nvifs;
-        u8 tx_chainmask;
-        u8 rx_chainmask;
-        u32 keymax;
-        DECLARE_BITMAP(keymap, ATH_KEYMAX);
-        u8 splitmic;
         bool ps_enabled;
+        bool ps_idle;
         unsigned long ps_usecount;
         enum ath9k_int imask;
-        enum ath9k_ht_extprotspacing ht_extprotspacing;
-        enum ath9k_ht_macmode tx_chan_width;
 
         struct ath_config config;
         struct ath_rx rx;
         struct ath_tx tx;
         struct ath_beacon beacon;
-        struct ieee80211_rate rates[IEEE80211_NUM_BANDS][ATH_RATE_MAX];
-        const struct ath_rate_table *hw_rate_table[ATH9K_MODE_MAX];
         const struct ath_rate_table *cur_rate_table;
+        enum wireless_mode cur_rate_mode;
         struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
 
         struct ath_led radio_led;
@@ -605,14 +505,12 @@ struct ath_softc {
 
         int beacon_interval;
 
-        struct ath_ani ani;
-#ifdef CONFIG_ATH9K_DEBUG
+#ifdef CONFIG_ATH9K_DEBUGFS
         struct ath9k_debug debug;
 #endif
-        struct ath_bus_ops *bus_ops;
         struct ath_beacon_config cur_beacon_conf;
         struct delayed_work tx_complete_work;
-        struct ath_btcoex_info btcoex_info;
+        struct ath_btcoex btcoex;
 };
 
 struct ath_wiphy {
@@ -625,51 +523,41 @@ struct ath_wiphy {
                 ATH_WIPHY_PAUSED,
                 ATH_WIPHY_SCAN,
         } state;
+        bool idle;
         int chan_idx;
         int chan_is_ht;
 };
 
+void ath9k_tasklet(unsigned long data);
 int ath_reset(struct ath_softc *sc, bool retry_tx);
 int ath_get_hal_qnum(u16 queue, struct ath_softc *sc);
 int ath_get_mac80211_qnum(u32 queue, struct ath_softc *sc);
 int ath_cabq_update(struct ath_softc *);
 
-static inline struct ath_common *ath9k_hw_common(struct ath_hw *ah)
+static inline void ath_read_cachesize(struct ath_common *common, int *csz)
 {
-        return &ah->ah_sc->common;
-}
-
-static inline struct ath_regulatory *ath9k_hw_regulatory(struct ath_hw *ah)
-{
-        return &(ath9k_hw_common(ah)->regulatory);
-}
-
-static inline void ath_read_cachesize(struct ath_softc *sc, int *csz)
-{
-        sc->bus_ops->read_cachesize(sc, csz);
-}
-
-static inline void ath_bus_cleanup(struct ath_softc *sc)
-{
-        sc->bus_ops->cleanup(sc);
+        common->bus_ops->read_cachesize(common, csz);
 }
 
 extern struct ieee80211_ops ath9k_ops;
+extern int modparam_nohwcrypt;
 
 irqreturn_t ath_isr(int irq, void *dev);
-void ath_cleanup(struct ath_softc *sc);
-int ath_init_device(u16 devid, struct ath_softc *sc, u16 subsysid);
-void ath_detach(struct ath_softc *sc);
+int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
+                    const struct ath_bus_ops *bus_ops);
+void ath9k_deinit_device(struct ath_softc *sc);
 const char *ath_mac_bb_name(u32 mac_bb_version);
 const char *ath_rf_name(u16 rf_version);
-void ath_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw);
+void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw);
 void ath9k_update_ichannel(struct ath_softc *sc, struct ieee80211_hw *hw,
                            struct ath9k_channel *ichan);
 void ath_update_chainmask(struct ath_softc *sc, int is_ht);
 int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
                     struct ath9k_channel *hchan);
-void ath_radio_enable(struct ath_softc *sc);
-void ath_radio_disable(struct ath_softc *sc);
+
+void ath_radio_enable(struct ath_softc *sc, struct ieee80211_hw *hw);
+void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw);
+bool ath9k_setpower(struct ath_softc *sc, enum ath9k_power_mode mode);
 
 #ifdef CONFIG_PCI
 int ath_pci_init(void);
@@ -705,9 +593,14 @@ void ath9k_wiphy_pause_all_forced(struct ath_softc *sc,
 bool ath9k_wiphy_scanning(struct ath_softc *sc);
 void ath9k_wiphy_work(struct work_struct *work);
 bool ath9k_all_wiphys_idle(struct ath_softc *sc);
+void ath9k_set_wiphy_idle(struct ath_wiphy *aphy, bool idle);
 
-void ath9k_iowrite32(struct ath_hw *ah, u32 reg_offset, u32 val);
-unsigned int ath9k_ioread32(struct ath_hw *ah, u32 reg_offset);
+void ath_mac80211_stop_queue(struct ath_softc *sc, u16 skb_queue);
+void ath_mac80211_start_queue(struct ath_softc *sc, u16 skb_queue);
 
 int ath_tx_get_qnum(struct ath_softc *sc, int qtype, int haltype);
+
+void ath_start_rfkill_poll(struct ath_softc *sc);
+extern void ath9k_rfkill_poll_state(struct ieee80211_hw *hw);
+
 #endif /* ATH9K_H */
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 45c4ea57616b..b4a31a43a62c 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -23,10 +23,12 @@
  *  the operating mode of the station (AP or AdHoc).  Parameters are AIFS
  *  settings and channel width min/max
 */
-static int ath_beaconq_config(struct ath_softc *sc)
+int ath_beaconq_config(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
-        struct ath9k_tx_queue_info qi;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_tx_queue_info qi, qi_be;
+        int qnum;
 
         ath9k_hw_get_txq_props(ah, sc->beacon.beaconq, &qi);
         if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
@@ -36,14 +38,17 @@ static int ath_beaconq_config(struct ath_softc *sc)
                 qi.tqi_cwmax = 0;
         } else {
                 /* Adhoc mode; important thing is to use 2x cwmin. */
-                qi.tqi_aifs = sc->beacon.beacon_qi.tqi_aifs;
-                qi.tqi_cwmin = 2*sc->beacon.beacon_qi.tqi_cwmin;
-                qi.tqi_cwmax = sc->beacon.beacon_qi.tqi_cwmax;
+                qnum = ath_tx_get_qnum(sc, ATH9K_TX_QUEUE_DATA,
+                                       ATH9K_WME_AC_BE);
+                ath9k_hw_get_txq_props(ah, qnum, &qi_be);
+                qi.tqi_aifs = qi_be.tqi_aifs;
+                qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
+                qi.tqi_cwmax = qi_be.tqi_cwmax;
         }
 
         if (!ath9k_hw_set_txq_props(ah, sc->beacon.beaconq, &qi)) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to update h/w beacon queue parameters\n");
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to update h/w beacon queue parameters\n");
                 return 0;
         } else {
                 ath9k_hw_resettxqueue(ah, sc->beacon.beaconq);
@@ -57,15 +62,16 @@ static int ath_beaconq_config(struct ath_softc *sc)
  *  Beacons are always sent out at the lowest rate, and are not retried.
 */
 static void ath_beacon_setup(struct ath_softc *sc, struct ath_vif *avp,
-                             struct ath_buf *bf)
+                             struct ath_buf *bf, int rateidx)
 {
         struct sk_buff *skb = bf->bf_mpdu;
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_desc *ds;
         struct ath9k_11n_rate_series series[4];
-        const struct ath_rate_table *rt;
         int flags, antenna, ctsrate = 0, ctsduration = 0;
-        u8 rate;
+        struct ieee80211_supported_band *sband;
+        u8 rate = 0;
 
         ds = bf->bf_desc;
         flags = ATH9K_TXDESC_NOACK;
@@ -89,10 +95,10 @@ static void ath_beacon_setup(struct ath_softc *sc, struct ath_vif *avp,
 
         ds->ds_data = bf->bf_buf_addr;
 
-        rt = sc->cur_rate_table;
-        rate = rt->info[0].ratecode;
+        sband = &sc->sbands[common->hw->conf.channel->band];
+        rate = sband->bitrates[rateidx].hw_value;
         if (sc->sc_flags & SC_OP_PREAMBLE_SHORT)
-                rate |= rt->info[0].short_preamble;
+                rate |= sband->bitrates[rateidx].hw_value_short;
 
         ath9k_hw_set11n_txdesc(ah, ds, skb->len + FCS_LEN,
                                ATH9K_PKT_TYPE_BEACON,
@@ -108,7 +114,7 @@ static void ath_beacon_setup(struct ath_softc *sc, struct ath_vif *avp,
         memset(series, 0, sizeof(struct ath9k_11n_rate_series) * 4);
         series[0].Tries = 1;
         series[0].Rate = rate;
-        series[0].ChSel = sc->tx_chainmask;
+        series[0].ChSel = common->tx_chainmask;
         series[0].RateFlags = (ctsrate) ? ATH9K_RATESERIES_RTS_CTS : 0;
         ath9k_hw_set11n_ratescenario(ah, ds, ds, 0, ctsrate, ctsduration,
                                      series, 4, 0);
@@ -119,6 +125,7 @@ static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw,
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_buf *bf;
         struct ath_vif *avp;
         struct sk_buff *skb;
@@ -172,7 +179,8 @@ static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw,
         if (unlikely(dma_mapping_error(sc->dev, bf->bf_buf_addr))) {
                 dev_kfree_skb_any(skb);
                 bf->bf_mpdu = NULL;
-                DPRINTF(sc, ATH_DBG_FATAL, "dma_mapping_error on beaconing\n");
+                ath_print(common, ATH_DBG_FATAL,
+                          "dma_mapping_error on beaconing\n");
                 return NULL;
         }
 
@@ -192,13 +200,13 @@ static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw,
 
         if (skb && cabq_depth) {
                 if (sc->nvifs > 1) {
-                        DPRINTF(sc, ATH_DBG_BEACON,
-                                "Flushing previous cabq traffic\n");
+                        ath_print(common, ATH_DBG_BEACON,
+                                  "Flushing previous cabq traffic\n");
                         ath_draintxq(sc, cabq, false);
                 }
         }
 
-        ath_beacon_setup(sc, avp, bf);
+        ath_beacon_setup(sc, avp, bf, info->control.rates[0].idx);
 
         while (skb) {
                 ath_tx_cabq(hw, skb);
@@ -216,6 +224,7 @@ static void ath_beacon_start_adhoc(struct ath_softc *sc,
                                    struct ieee80211_vif *vif)
 {
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_buf *bf;
         struct ath_vif *avp;
         struct sk_buff *skb;
@@ -228,30 +237,19 @@ static void ath_beacon_start_adhoc(struct ath_softc *sc,
         bf = avp->av_bcbuf;
         skb = bf->bf_mpdu;
 
-        ath_beacon_setup(sc, avp, bf);
+        ath_beacon_setup(sc, avp, bf, 0);
 
         /* NB: caller is known to have already stopped tx dma */
         ath9k_hw_puttxbuf(ah, sc->beacon.beaconq, bf->bf_daddr);
         ath9k_hw_txstart(ah, sc->beacon.beaconq);
-        DPRINTF(sc, ATH_DBG_BEACON, "TXDP%u = %llx (%p)\n",
-                sc->beacon.beaconq, ito64(bf->bf_daddr), bf->bf_desc);
-}
-
-int ath_beaconq_setup(struct ath_hw *ah)
-{
-        struct ath9k_tx_queue_info qi;
-
-        memset(&qi, 0, sizeof(qi));
-        qi.tqi_aifs = 1;
-        qi.tqi_cwmin = 0;
-        qi.tqi_cwmax = 0;
-        /* NB: don't enable any interrupts */
-        return ath9k_hw_setuptxqueue(ah, ATH9K_TX_QUEUE_BEACON, &qi);
+        ath_print(common, ATH_DBG_BEACON, "TXDP%u = %llx (%p)\n",
+                  sc->beacon.beaconq, ito64(bf->bf_daddr), bf->bf_desc);
 }
 
 int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
 {
         struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_vif *avp;
         struct ath_buf *bf;
         struct sk_buff *skb;
@@ -309,7 +307,7 @@ int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
         /* NB: the beacon data buffer must be 32-bit aligned. */
         skb = ieee80211_beacon_get(sc->hw, vif);
         if (skb == NULL) {
-                DPRINTF(sc, ATH_DBG_BEACON, "cannot get skb\n");
+                ath_print(common, ATH_DBG_BEACON, "cannot get skb\n");
                 return -ENOMEM;
         }
 
@@ -333,9 +331,10 @@ int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
                 tsfadjust = intval * avp->av_bslot / ATH_BCBUF;
                 avp->tsf_adjust = cpu_to_le64(TU_TO_USEC(tsfadjust));
 
-                DPRINTF(sc, ATH_DBG_BEACON,
-                        "stagger beacons, bslot %d intval %u tsfadjust %llu\n",
-                        avp->av_bslot, intval, (unsigned long long)tsfadjust);
+                ath_print(common, ATH_DBG_BEACON,
+                          "stagger beacons, bslot %d intval "
+                          "%u tsfadjust %llu\n",
+                          avp->av_bslot, intval, (unsigned long long)tsfadjust);
 
                 ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp =
                         avp->tsf_adjust;
@@ -349,8 +348,8 @@ int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
         if (unlikely(dma_mapping_error(sc->dev, bf->bf_buf_addr))) {
                 dev_kfree_skb_any(skb);
                 bf->bf_mpdu = NULL;
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "dma_mapping_error on beacon alloc\n");
+                ath_print(common, ATH_DBG_FATAL,
+                          "dma_mapping_error on beacon alloc\n");
                 return -ENOMEM;
         }
 
@@ -386,6 +385,7 @@ void ath_beacon_tasklet(unsigned long data)
 {
         struct ath_softc *sc = (struct ath_softc *)data;
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_buf *bf = NULL;
         struct ieee80211_vif *vif;
         struct ath_wiphy *aphy;
@@ -405,12 +405,12 @@ void ath_beacon_tasklet(unsigned long data)
                 sc->beacon.bmisscnt++;
 
                 if (sc->beacon.bmisscnt < BSTUCK_THRESH) {
-                        DPRINTF(sc, ATH_DBG_BEACON,
-                                "missed %u consecutive beacons\n",
-                                sc->beacon.bmisscnt);
+                        ath_print(common, ATH_DBG_BEACON,
+                                  "missed %u consecutive beacons\n",
+                                  sc->beacon.bmisscnt);
                 } else if (sc->beacon.bmisscnt >= BSTUCK_THRESH) {
-                        DPRINTF(sc, ATH_DBG_BEACON,
-                                "beacon is officially stuck\n");
+                        ath_print(common, ATH_DBG_BEACON,
+                                  "beacon is officially stuck\n");
                         sc->sc_flags |= SC_OP_TSF_RESET;
                         ath_reset(sc, false);
                 }
@@ -419,9 +419,9 @@ void ath_beacon_tasklet(unsigned long data)
         }
 
         if (sc->beacon.bmisscnt != 0) {
-                DPRINTF(sc, ATH_DBG_BEACON,
-                        "resume beacon xmit after %u misses\n",
-                        sc->beacon.bmisscnt);
+                ath_print(common, ATH_DBG_BEACON,
+                          "resume beacon xmit after %u misses\n",
+                          sc->beacon.bmisscnt);
                 sc->beacon.bmisscnt = 0;
         }
 
@@ -447,9 +447,9 @@ void ath_beacon_tasklet(unsigned long data)
         vif = sc->beacon.bslot[slot];
         aphy = sc->beacon.bslot_aphy[slot];
 
-        DPRINTF(sc, ATH_DBG_BEACON,
-                "slot %d [tsf %llu tsftu %u intval %u] vif %p\n",
-                slot, tsf, tsftu, intval, vif);
+        ath_print(common, ATH_DBG_BEACON,
+                  "slot %d [tsf %llu tsftu %u intval %u] vif %p\n",
+                  slot, tsf, tsftu, intval, vif);
 
         bfaddr = 0;
         if (vif) {
@@ -480,7 +480,8 @@ void ath_beacon_tasklet(unsigned long data)
                 sc->beacon.updateslot = COMMIT; /* commit next beacon */
                 sc->beacon.slotupdate = slot;
         } else if (sc->beacon.updateslot == COMMIT && sc->beacon.slotupdate == slot) {
-                ath9k_hw_setslottime(sc->sc_ah, sc->beacon.slottime);
+                ah->slottime = sc->beacon.slottime;
+                ath9k_hw_init_global_settings(ah);
                 sc->beacon.updateslot = OK;
         }
         if (bfaddr != 0) {
@@ -490,7 +491,7 @@ void ath_beacon_tasklet(unsigned long data)
                  * are still pending on the queue.
                  */
                 if (!ath9k_hw_stoptxdma(ah, sc->beacon.beaconq)) {
-                        DPRINTF(sc, ATH_DBG_FATAL,
+                        ath_print(common, ATH_DBG_FATAL,
                                 "beacon queue %u did not stop?\n", sc->beacon.beaconq);
                 }
 
@@ -502,6 +503,19 @@ void ath_beacon_tasklet(unsigned long data)
         }
 }
 
+static void ath9k_beacon_init(struct ath_softc *sc,
+                              u32 next_beacon,
+                              u32 beacon_period)
+{
+        if (beacon_period & ATH9K_BEACON_RESET_TSF)
+                ath9k_ps_wakeup(sc);
+
+        ath9k_hw_beaconinit(sc->sc_ah, next_beacon, beacon_period);
+
+        if (beacon_period & ATH9K_BEACON_RESET_TSF)
+                ath9k_ps_restore(sc);
+}
+
 /*
  * For multi-bss ap support beacons are either staggered evenly over N slots or
  * burst together.  For the former arrange for the SWBA to be delivered for each
@@ -512,16 +526,13 @@ static void ath_beacon_config_ap(struct ath_softc *sc,
 {
         u32 nexttbtt, intval;
 
-        /* Configure the timers only when the TSF has to be reset */
-
-        if (!(sc->sc_flags & SC_OP_TSF_RESET))
-                return;
-
         /* NB: the beacon interval is kept internally in TU's */
         intval = conf->beacon_interval & ATH9K_BEACON_PERIOD;
         intval /= ATH_BCBUF;    /* for staggered beacons */
         nexttbtt = intval;
-        intval |= ATH9K_BEACON_RESET_TSF;
+
+        if (sc->sc_flags & SC_OP_TSF_RESET)
+                intval |= ATH9K_BEACON_RESET_TSF;
 
         /*
          * In AP mode we enable the beacon timers and SWBA interrupts to
@@ -534,7 +545,7 @@ static void ath_beacon_config_ap(struct ath_softc *sc,
         /* Set the computed AP beacon timers */
 
         ath9k_hw_set_interrupts(sc->sc_ah, 0);
-        ath9k_hw_beaconinit(sc->sc_ah, nexttbtt, intval);
+        ath9k_beacon_init(sc, nexttbtt, intval);
         sc->beacon.bmisscnt = 0;
         ath9k_hw_set_interrupts(sc->sc_ah, sc->imask);
 
@@ -555,6 +566,7 @@ static void ath_beacon_config_ap(struct ath_softc *sc,
 static void ath_beacon_config_sta(struct ath_softc *sc,
                                   struct ath_beacon_config *conf)
 {
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath9k_beacon_state bs;
         int dtimperiod, dtimcount, sleepduration;
         int cfpperiod, cfpcount;
@@ -562,6 +574,13 @@ static void ath_beacon_config_sta(struct ath_softc *sc,
         u64 tsf;
         int num_beacons, offset, dtim_dec_count, cfp_dec_count;
 
+        /* No need to configure beacon if we are not associated */
+        if (!common->curaid) {
+                ath_print(common, ATH_DBG_BEACON,
+                         "STA is not yet associated..skipping beacon config\n");
+                return;
+        }
+
         memset(&bs, 0, sizeof(bs));
         intval = conf->beacon_interval & ATH9K_BEACON_PERIOD;
 
@@ -651,11 +670,11 @@ static void ath_beacon_config_sta(struct ath_softc *sc,
         /* TSF out of range threshold fixed at 1 second */
         bs.bs_tsfoor_threshold = ATH9K_TSFOOR_THRESHOLD;
 
-        DPRINTF(sc, ATH_DBG_BEACON, "tsf: %llu tsftu: %u\n", tsf, tsftu);
-        DPRINTF(sc, ATH_DBG_BEACON,
-                "bmiss: %u sleep: %u cfp-period: %u maxdur: %u next: %u\n",
-                bs.bs_bmissthreshold, bs.bs_sleepduration,
-                bs.bs_cfpperiod, bs.bs_cfpmaxduration, bs.bs_cfpnext);
+        ath_print(common, ATH_DBG_BEACON, "tsf: %llu tsftu: %u\n", tsf, tsftu);
+        ath_print(common, ATH_DBG_BEACON,
+                  "bmiss: %u sleep: %u cfp-period: %u maxdur: %u next: %u\n",
+                  bs.bs_bmissthreshold, bs.bs_sleepduration,
+                  bs.bs_cfpperiod, bs.bs_cfpmaxduration, bs.bs_cfpnext);
 
         /* Set the computed STA beacon timers */
 
@@ -669,6 +688,7 @@ static void ath_beacon_config_adhoc(struct ath_softc *sc,
                                     struct ath_beacon_config *conf,
                                     struct ieee80211_vif *vif)
 {
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         u64 tsf;
         u32 tsftu, intval, nexttbtt;
 
@@ -689,9 +709,9 @@ static void ath_beacon_config_adhoc(struct ath_softc *sc,
                 nexttbtt += intval;
         } while (nexttbtt < tsftu);
 
-        DPRINTF(sc, ATH_DBG_BEACON,
-                "IBSS nexttbtt %u intval %u (%u)\n",
-                nexttbtt, intval, conf->beacon_interval);
+        ath_print(common, ATH_DBG_BEACON,
+                  "IBSS nexttbtt %u intval %u (%u)\n",
+                  nexttbtt, intval, conf->beacon_interval);
 
         /*
          * In IBSS mode enable the beacon timers but only enable SWBA interrupts
@@ -707,7 +727,7 @@ static void ath_beacon_config_adhoc(struct ath_softc *sc,
         /* Set the computed ADHOC beacon timers */
 
         ath9k_hw_set_interrupts(sc->sc_ah, 0);
-        ath9k_hw_beaconinit(sc->sc_ah, nexttbtt, intval);
+        ath9k_beacon_init(sc, nexttbtt, intval);
         sc->beacon.bmisscnt = 0;
         ath9k_hw_set_interrupts(sc->sc_ah, sc->imask);
 
@@ -719,10 +739,10 @@ static void ath_beacon_config_adhoc(struct ath_softc *sc,
 void ath_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif)
 {
         struct ath_beacon_config *cur_conf = &sc->cur_beacon_conf;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         enum nl80211_iftype iftype;
 
         /* Setup the beacon configuration parameters */
-
         if (vif) {
                 struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
 
@@ -759,8 +779,8 @@ void ath_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif)
                 ath_beacon_config_sta(sc, cur_conf);
                 break;
         default:
-                DPRINTF(sc, ATH_DBG_CONFIG,
-                        "Unsupported beaconing mode\n");
+                ath_print(common, ATH_DBG_CONFIG,
+                          "Unsupported beaconing mode\n");
                 return;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/btcoex.c b/drivers/net/wireless/ath/ath9k/btcoex.c
index 55f607b7699e..fb4ac15f3b93 100644
--- a/drivers/net/wireless/ath/ath9k/btcoex.c
+++ b/drivers/net/wireless/ath/ath9k/btcoex.c
@@ -14,10 +14,26 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include "ath9k.h"
+#include "hw.h"
 
-static const struct ath_btcoex_config ath_bt_config = { 0, true, true,
-                        ATH_BT_COEX_MODE_SLOTTED, true, true, 2, 5, true };
+enum ath_bt_mode {
+        ATH_BT_COEX_MODE_LEGACY,        /* legacy rx_clear mode */
+        ATH_BT_COEX_MODE_UNSLOTTED,     /* untimed/unslotted mode */
+        ATH_BT_COEX_MODE_SLOTTED,       /* slotted mode */
+        ATH_BT_COEX_MODE_DISALBED,      /* coexistence disabled */
+};
+
+struct ath_btcoex_config {
+        u8 bt_time_extend;
+        bool bt_txstate_extend;
+        bool bt_txframe_extend;
+        enum ath_bt_mode bt_mode; /* coexistence mode */
+        bool bt_quiet_collision;
+        bool bt_rxclear_polarity; /* invert rx_clear as WLAN_ACTIVE*/
+        u8 bt_priority_time;
+        u8 bt_first_slot_time;
+        bool bt_hold_rx_clear;
+};
 
 static const u16 ath_subsysid_tbl[] = {
         AR9280_COEX2WIRE_SUBSYSID,
@@ -29,141 +45,38 @@ static const u16 ath_subsysid_tbl[] = {
  * Checks the subsystem id of the device to see if it
  * supports btcoex
  */
-bool ath_btcoex_supported(u16 subsysid)
+bool ath9k_hw_btcoex_supported(struct ath_hw *ah)
 {
         int i;
 
-        if (!subsysid)
+        if (!ah->hw_version.subsysid)
                 return false;
 
         for (i = 0; i < ARRAY_SIZE(ath_subsysid_tbl); i++)
-                if (subsysid == ath_subsysid_tbl[i])
+                if (ah->hw_version.subsysid == ath_subsysid_tbl[i])
                         return true;
 
         return false;
 }
 
-/*
- * Detects if there is any priority bt traffic
- */
-static void ath_detect_bt_priority(struct ath_softc *sc)
-{
-        struct ath_btcoex_info *btinfo = &sc->btcoex_info;
-
-        if (ath9k_hw_gpio_get(sc->sc_ah, btinfo->btpriority_gpio))
-                btinfo->bt_priority_cnt++;
-
-        if (time_after(jiffies, btinfo->bt_priority_time +
-                        msecs_to_jiffies(ATH_BT_PRIORITY_TIME_THRESHOLD))) {
-                if (btinfo->bt_priority_cnt >= ATH_BT_CNT_THRESHOLD) {
-                        DPRINTF(sc, ATH_DBG_BTCOEX,
-                                "BT priority traffic detected");
-                        sc->sc_flags |= SC_OP_BT_PRIORITY_DETECTED;
-                } else {
-                        sc->sc_flags &= ~SC_OP_BT_PRIORITY_DETECTED;
-                }
-
-                btinfo->bt_priority_cnt = 0;
-                btinfo->bt_priority_time = jiffies;
-        }
-}
-
-/*
- * Configures appropriate weight based on stomp type.
- */
-static void ath_btcoex_bt_stomp(struct ath_softc *sc,
-                                struct ath_btcoex_info *btinfo,
-                                int stomp_type)
-{
-
-        switch (stomp_type) {
-        case ATH_BTCOEX_STOMP_ALL:
-                ath_btcoex_set_weight(btinfo, AR_BT_COEX_WGHT,
-                                      AR_STOMP_ALL_WLAN_WGHT);
-                break;
-        case ATH_BTCOEX_STOMP_LOW:
-                ath_btcoex_set_weight(btinfo, AR_BT_COEX_WGHT,
-                                      AR_STOMP_LOW_WLAN_WGHT);
-                break;
-        case ATH_BTCOEX_STOMP_NONE:
-                ath_btcoex_set_weight(btinfo, AR_BT_COEX_WGHT,
-                                      AR_STOMP_NONE_WLAN_WGHT);
-                break;
-        default:
-                DPRINTF(sc, ATH_DBG_BTCOEX, "Invalid Stomptype\n");
-                break;
-        }
-
-        ath9k_hw_btcoex_enable(sc->sc_ah);
-}
-
-/*
- * This is the master bt coex timer which runs for every
- * 45ms, bt traffic will be given priority during 55% of this
- * period while wlan gets remaining 45%
- */
-
-static void ath_btcoex_period_timer(unsigned long data)
-{
-        struct ath_softc *sc = (struct ath_softc *) data;
-        struct ath_btcoex_info *btinfo = &sc->btcoex_info;
-
-        ath_detect_bt_priority(sc);
-
-        spin_lock_bh(&btinfo->btcoex_lock);
-
-        ath_btcoex_bt_stomp(sc, btinfo, btinfo->bt_stomp_type);
-
-        spin_unlock_bh(&btinfo->btcoex_lock);
-
-        if (btinfo->btcoex_period != btinfo->btcoex_no_stomp) {
-                if (btinfo->hw_timer_enabled)
-                        ath_gen_timer_stop(sc->sc_ah, btinfo->no_stomp_timer);
-
-                ath_gen_timer_start(sc->sc_ah,
-                        btinfo->no_stomp_timer,
-                        (ath9k_hw_gettsf32(sc->sc_ah) +
-                                btinfo->btcoex_no_stomp),
-                                btinfo->btcoex_no_stomp * 10);
-                btinfo->hw_timer_enabled = true;
-        }
-
-        mod_timer(&btinfo->period_timer, jiffies +
-                                  msecs_to_jiffies(ATH_BTCOEX_DEF_BT_PERIOD));
-}
-
-/*
- * Generic tsf based hw timer which configures weight
- * registers to time slice between wlan and bt traffic
- */
-
-static void ath_btcoex_no_stomp_timer(void *arg)
-{
-        struct ath_softc *sc = (struct ath_softc *)arg;
-        struct ath_btcoex_info *btinfo = &sc->btcoex_info;
-
-        DPRINTF(sc, ATH_DBG_BTCOEX, "no stomp timer running \n");
-
-        spin_lock_bh(&btinfo->btcoex_lock);
-
-        if (btinfo->bt_stomp_type == ATH_BTCOEX_STOMP_LOW)
-                ath_btcoex_bt_stomp(sc, btinfo, ATH_BTCOEX_STOMP_NONE);
-         else if (btinfo->bt_stomp_type == ATH_BTCOEX_STOMP_ALL)
-                ath_btcoex_bt_stomp(sc, btinfo, ATH_BTCOEX_STOMP_LOW);
-
-        spin_unlock_bh(&btinfo->btcoex_lock);
-}
-
-static int ath_init_btcoex_info(struct ath_hw *hw,
-                                struct ath_btcoex_info *btcoex_info)
+void ath9k_hw_init_btcoex_hw(struct ath_hw *ah, int qnum)
 {
+        struct ath_btcoex_hw *btcoex_hw = &ah->btcoex_hw;
+        const struct ath_btcoex_config ath_bt_config = {
+                .bt_time_extend = 0,
+                .bt_txstate_extend = true,
+                .bt_txframe_extend = true,
+                .bt_mode = ATH_BT_COEX_MODE_SLOTTED,
+                .bt_quiet_collision = true,
+                .bt_rxclear_polarity = true,
+                .bt_priority_time = 2,
+                .bt_first_slot_time = 5,
+                .bt_hold_rx_clear = true,
+        };
         u32 i;
-        int qnum;
 
-        qnum = ath_tx_get_qnum(hw->ah_sc, ATH9K_TX_QUEUE_DATA, ATH9K_WME_AC_BE);
-
-        btcoex_info->bt_coex_mode =
-                (btcoex_info->bt_coex_mode & AR_BT_QCU_THRESH) |
+        btcoex_hw->bt_coex_mode =
+                (btcoex_hw->bt_coex_mode & AR_BT_QCU_THRESH) |
                 SM(ath_bt_config.bt_time_extend, AR_BT_TIME_EXTEND) |
                 SM(ath_bt_config.bt_txstate_extend, AR_BT_TXSTATE_EXTEND) |
                 SM(ath_bt_config.bt_txframe_extend, AR_BT_TX_FRAME_EXTEND) |
@@ -174,167 +87,141 @@ static int ath_init_btcoex_info(struct ath_hw *hw,
                 SM(ath_bt_config.bt_first_slot_time, AR_BT_FIRST_SLOT_TIME) |
                 SM(qnum, AR_BT_QCU_THRESH);
 
-        btcoex_info->bt_coex_mode2 =
+        btcoex_hw->bt_coex_mode2 =
                 SM(ath_bt_config.bt_hold_rx_clear, AR_BT_HOLD_RX_CLEAR) |
                 SM(ATH_BTCOEX_BMISS_THRESH, AR_BT_BCN_MISS_THRESH) |
                 AR_BT_DISABLE_BT_ANT;
 
-        btcoex_info->bt_stomp_type = ATH_BTCOEX_STOMP_LOW;
+        for (i = 0; i < 32; i++)
+                ah->hw_gen_timers.gen_timer_index[(debruijn32 << i) >> 27] = i;
+}
+EXPORT_SYMBOL(ath9k_hw_init_btcoex_hw);
 
-        btcoex_info->btcoex_period = ATH_BTCOEX_DEF_BT_PERIOD * 1000;
+void ath9k_hw_btcoex_init_2wire(struct ath_hw *ah)
+{
+        struct ath_btcoex_hw *btcoex_hw = &ah->btcoex_hw;
 
-        btcoex_info->btcoex_no_stomp = (100 - ATH_BTCOEX_DEF_DUTY_CYCLE) *
-                btcoex_info->btcoex_period / 100;
+        /* connect bt_active to baseband */
+        REG_CLR_BIT(ah, AR_GPIO_INPUT_EN_VAL,
+                    (AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_DEF |
+                     AR_GPIO_INPUT_EN_VAL_BT_FREQUENCY_DEF));
 
-        for (i = 0; i < 32; i++)
-                hw->hw_gen_timers.gen_timer_index[(debruijn32 << i) >> 27] = i;
+        REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL,
+                    AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_BB);
 
-        setup_timer(&btcoex_info->period_timer, ath_btcoex_period_timer,
-                        (unsigned long) hw->ah_sc);
+        /* Set input mux for bt_active to gpio pin */
+        REG_RMW_FIELD(ah, AR_GPIO_INPUT_MUX1,
+                      AR_GPIO_INPUT_MUX1_BT_ACTIVE,
+                      btcoex_hw->btactive_gpio);
 
-        btcoex_info->no_stomp_timer = ath_gen_timer_alloc(hw,
-                        ath_btcoex_no_stomp_timer,
-                        ath_btcoex_no_stomp_timer,
-                        (void *)hw->ah_sc, AR_FIRST_NDP_TIMER);
+        /* Configure the desired gpio port for input */
+        ath9k_hw_cfg_gpio_input(ah, btcoex_hw->btactive_gpio);
+}
+EXPORT_SYMBOL(ath9k_hw_btcoex_init_2wire);
+
+void ath9k_hw_btcoex_init_3wire(struct ath_hw *ah)
+{
+        struct ath_btcoex_hw *btcoex_hw = &ah->btcoex_hw;
 
-        if (btcoex_info->no_stomp_timer == NULL)
-                return -ENOMEM;
+        /* btcoex 3-wire */
+        REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL,
+                        (AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB |
+                         AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_BB));
 
-        spin_lock_init(&btcoex_info->btcoex_lock);
+        /* Set input mux for bt_prority_async and
+         *                  bt_active_async to GPIO pins */
+        REG_RMW_FIELD(ah, AR_GPIO_INPUT_MUX1,
+                        AR_GPIO_INPUT_MUX1_BT_ACTIVE,
+                        btcoex_hw->btactive_gpio);
 
-        return 0;
+        REG_RMW_FIELD(ah, AR_GPIO_INPUT_MUX1,
+                        AR_GPIO_INPUT_MUX1_BT_PRIORITY,
+                        btcoex_hw->btpriority_gpio);
+
+        /* Configure the desired GPIO ports for input */
+
+        ath9k_hw_cfg_gpio_input(ah, btcoex_hw->btactive_gpio);
+        ath9k_hw_cfg_gpio_input(ah, btcoex_hw->btpriority_gpio);
 }
+EXPORT_SYMBOL(ath9k_hw_btcoex_init_3wire);
 
-int ath9k_hw_btcoex_init(struct ath_hw *ah)
+static void ath9k_hw_btcoex_enable_2wire(struct ath_hw *ah)
 {
-        struct ath_btcoex_info *btcoex_info = &ah->ah_sc->btcoex_info;
-        int ret = 0;
-
-        if (btcoex_info->btcoex_scheme == ATH_BTCOEX_CFG_2WIRE) {
-                /* connect bt_active to baseband */
-                REG_CLR_BIT(ah, AR_GPIO_INPUT_EN_VAL,
-                                (AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_DEF |
-                                 AR_GPIO_INPUT_EN_VAL_BT_FREQUENCY_DEF));
-
-                REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL,
-                                AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_BB);
-
-                /* Set input mux for bt_active to gpio pin */
-                REG_RMW_FIELD(ah, AR_GPIO_INPUT_MUX1,
-                                AR_GPIO_INPUT_MUX1_BT_ACTIVE,
-                                btcoex_info->btactive_gpio);
-
-                /* Configure the desired gpio port for input */
-                ath9k_hw_cfg_gpio_input(ah, btcoex_info->btactive_gpio);
-        } else {
-                /* btcoex 3-wire */
-                REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL,
-                                (AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB |
-                                 AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_BB));
-
-                /* Set input mux for bt_prority_async and
-                 *                  bt_active_async to GPIO pins */
-                REG_RMW_FIELD(ah, AR_GPIO_INPUT_MUX1,
-                                AR_GPIO_INPUT_MUX1_BT_ACTIVE,
-                                btcoex_info->btactive_gpio);
-
-                REG_RMW_FIELD(ah, AR_GPIO_INPUT_MUX1,
-                                AR_GPIO_INPUT_MUX1_BT_PRIORITY,
-                                btcoex_info->btpriority_gpio);
-
-                /* Configure the desired GPIO ports for input */
-
-                ath9k_hw_cfg_gpio_input(ah, btcoex_info->btactive_gpio);
-                ath9k_hw_cfg_gpio_input(ah, btcoex_info->btpriority_gpio);
-
-                ret = ath_init_btcoex_info(ah, btcoex_info);
-        }
+        struct ath_btcoex_hw *btcoex_hw = &ah->btcoex_hw;
 
-        return ret;
+        /* Configure the desired GPIO port for TX_FRAME output */
+        ath9k_hw_cfg_output(ah, btcoex_hw->wlanactive_gpio,
+                            AR_GPIO_OUTPUT_MUX_AS_TX_FRAME);
 }
 
-void ath9k_hw_btcoex_enable(struct ath_hw *ah)
+void ath9k_hw_btcoex_set_weight(struct ath_hw *ah,
+                                u32 bt_weight,
+                                u32 wlan_weight)
 {
-        struct ath_btcoex_info *btcoex_info = &ah->ah_sc->btcoex_info;
-
-        if (btcoex_info->btcoex_scheme == ATH_BTCOEX_CFG_2WIRE) {
-                /* Configure the desired GPIO port for TX_FRAME output */
-                ath9k_hw_cfg_output(ah, btcoex_info->wlanactive_gpio,
-                                AR_GPIO_OUTPUT_MUX_AS_TX_FRAME);
-        } else {
-                /*
-                 * Program coex mode and weight registers to
-                 * enable coex 3-wire
-                 */
-                REG_WRITE(ah, AR_BT_COEX_MODE, btcoex_info->bt_coex_mode);
-                REG_WRITE(ah, AR_BT_COEX_WEIGHT, btcoex_info->bt_coex_weights);
-                REG_WRITE(ah, AR_BT_COEX_MODE2, btcoex_info->bt_coex_mode2);
-
-                REG_RMW_FIELD(ah, AR_QUIET1,
-                                AR_QUIET1_QUIET_ACK_CTS_ENABLE, 1);
-                REG_RMW_FIELD(ah, AR_PCU_MISC,
-                                AR_PCU_BT_ANT_PREVENT_RX, 0);
-
-                ath9k_hw_cfg_output(ah, btcoex_info->wlanactive_gpio,
-                                AR_GPIO_OUTPUT_MUX_AS_RX_CLEAR_EXTERNAL);
-        }
+        struct ath_btcoex_hw *btcoex_hw = &ah->btcoex_hw;
 
-        REG_RMW(ah, AR_GPIO_PDPU,
-                (0x2 << (btcoex_info->btactive_gpio * 2)),
-                (0x3 << (btcoex_info->btactive_gpio * 2)));
-
-        ah->ah_sc->sc_flags |= SC_OP_BTCOEX_ENABLED;
+        btcoex_hw->bt_coex_weights = SM(bt_weight, AR_BTCOEX_BT_WGHT) |
+                                     SM(wlan_weight, AR_BTCOEX_WL_WGHT);
 }
+EXPORT_SYMBOL(ath9k_hw_btcoex_set_weight);
 
-void ath9k_hw_btcoex_disable(struct ath_hw *ah)
+static void ath9k_hw_btcoex_enable_3wire(struct ath_hw *ah)
 {
-        struct ath_btcoex_info *btcoex_info = &ah->ah_sc->btcoex_info;
+        struct ath_btcoex_hw *btcoex_hw = &ah->btcoex_hw;
 
-        ath9k_hw_set_gpio(ah, btcoex_info->wlanactive_gpio, 0);
+        /*
+         * Program coex mode and weight registers to
+         * enable coex 3-wire
+         */
+        REG_WRITE(ah, AR_BT_COEX_MODE, btcoex_hw->bt_coex_mode);
+        REG_WRITE(ah, AR_BT_COEX_WEIGHT, btcoex_hw->bt_coex_weights);
+        REG_WRITE(ah, AR_BT_COEX_MODE2, btcoex_hw->bt_coex_mode2);
 
-        ath9k_hw_cfg_output(ah, btcoex_info->wlanactive_gpio,
-                        AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+        REG_RMW_FIELD(ah, AR_QUIET1, AR_QUIET1_QUIET_ACK_CTS_ENABLE, 1);
+        REG_RMW_FIELD(ah, AR_PCU_MISC, AR_PCU_BT_ANT_PREVENT_RX, 0);
 
-        if (btcoex_info->btcoex_scheme == ATH_BTCOEX_CFG_3WIRE) {
-                REG_WRITE(ah, AR_BT_COEX_MODE, AR_BT_QUIET | AR_BT_MODE);
-                REG_WRITE(ah, AR_BT_COEX_WEIGHT, 0);
-                REG_WRITE(ah, AR_BT_COEX_MODE2, 0);
-        }
-
-        ah->ah_sc->sc_flags &= ~SC_OP_BTCOEX_ENABLED;
+        ath9k_hw_cfg_output(ah, btcoex_hw->wlanactive_gpio,
+                            AR_GPIO_OUTPUT_MUX_AS_RX_CLEAR_EXTERNAL);
 }
 
-/*
- * Pause btcoex timer and bt duty cycle timer
- */
-void ath_btcoex_timer_pause(struct ath_softc *sc,
-                            struct ath_btcoex_info *btinfo)
+void ath9k_hw_btcoex_enable(struct ath_hw *ah)
 {
+        struct ath_btcoex_hw *btcoex_hw = &ah->btcoex_hw;
 
-        del_timer_sync(&btinfo->period_timer);
+        switch (btcoex_hw->scheme) {
+        case ATH_BTCOEX_CFG_NONE:
+                break;
+        case ATH_BTCOEX_CFG_2WIRE:
+                ath9k_hw_btcoex_enable_2wire(ah);
+                break;
+        case ATH_BTCOEX_CFG_3WIRE:
+                ath9k_hw_btcoex_enable_3wire(ah);
+                break;
+        }
 
-        if (btinfo->hw_timer_enabled)
-                ath_gen_timer_stop(sc->sc_ah, btinfo->no_stomp_timer);
+        REG_RMW(ah, AR_GPIO_PDPU,
+                (0x2 << (btcoex_hw->btactive_gpio * 2)),
+                (0x3 << (btcoex_hw->btactive_gpio * 2)));
 
-        btinfo->hw_timer_enabled = false;
+        ah->btcoex_hw.enabled = true;
 }
+EXPORT_SYMBOL(ath9k_hw_btcoex_enable);
 
-/*
- * (Re)start btcoex timers
- */
-void ath_btcoex_timer_resume(struct ath_softc *sc,
-                             struct ath_btcoex_info *btinfo)
+void ath9k_hw_btcoex_disable(struct ath_hw *ah)
 {
+        struct ath_btcoex_hw *btcoex_hw = &ah->btcoex_hw;
 
-        DPRINTF(sc, ATH_DBG_BTCOEX, "Starting btcoex timers");
+        ath9k_hw_set_gpio(ah, btcoex_hw->wlanactive_gpio, 0);
 
-        /* make sure duty cycle timer is also stopped when resuming */
-        if (btinfo->hw_timer_enabled)
-                ath_gen_timer_stop(sc->sc_ah, btinfo->no_stomp_timer);
+        ath9k_hw_cfg_output(ah, btcoex_hw->wlanactive_gpio,
+                        AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
 
-        btinfo->bt_priority_cnt = 0;
-        btinfo->bt_priority_time = jiffies;
-        sc->sc_flags &= ~SC_OP_BT_PRIORITY_DETECTED;
+        if (btcoex_hw->scheme == ATH_BTCOEX_CFG_3WIRE) {
+                REG_WRITE(ah, AR_BT_COEX_MODE, AR_BT_QUIET | AR_BT_MODE);
+                REG_WRITE(ah, AR_BT_COEX_WEIGHT, 0);
+                REG_WRITE(ah, AR_BT_COEX_MODE2, 0);
+        }
 
-        mod_timer(&btinfo->period_timer, jiffies);
+        ah->btcoex_hw.enabled = false;
 }
+EXPORT_SYMBOL(ath9k_hw_btcoex_disable);
diff --git a/drivers/net/wireless/ath/ath9k/btcoex.h b/drivers/net/wireless/ath/ath9k/btcoex.h
index 297b027fd3c3..1ee5a15ccbb1 100644
--- a/drivers/net/wireless/ath/ath9k/btcoex.h
+++ b/drivers/net/wireless/ath/ath9k/btcoex.h
@@ -17,16 +17,20 @@
 #ifndef BTCOEX_H
 #define BTCOEX_H
 
+#include "hw.h"
+
 #define ATH_WLANACTIVE_GPIO     5
 #define ATH_BTACTIVE_GPIO       6
 #define ATH_BTPRIORITY_GPIO     7
 
 #define ATH_BTCOEX_DEF_BT_PERIOD  45
 #define ATH_BTCOEX_DEF_DUTY_CYCLE 55
+#define ATH_BTCOEX_BTSCAN_DUTY_CYCLE 90
 #define ATH_BTCOEX_BMISS_THRESH   50
 
 #define ATH_BT_PRIORITY_TIME_THRESHOLD 1000 /* ms */
 #define ATH_BT_CNT_THRESHOLD           3
+#define ATH_BT_CNT_SCAN_THRESHOLD      15
 
 enum ath_btcoex_scheme {
         ATH_BTCOEX_CFG_NONE,
@@ -34,67 +38,25 @@ enum ath_btcoex_scheme {
         ATH_BTCOEX_CFG_3WIRE,
 };
 
-enum ath_stomp_type {
-        ATH_BTCOEX_NO_STOMP,
-        ATH_BTCOEX_STOMP_ALL,
-        ATH_BTCOEX_STOMP_LOW,
-        ATH_BTCOEX_STOMP_NONE
-};
-
-enum ath_bt_mode {
-        ATH_BT_COEX_MODE_LEGACY,        /* legacy rx_clear mode */
-        ATH_BT_COEX_MODE_UNSLOTTED,     /* untimed/unslotted mode */
-        ATH_BT_COEX_MODE_SLOTTED,       /* slotted mode */
-        ATH_BT_COEX_MODE_DISALBED,      /* coexistence disabled */
-};
-
-struct ath_btcoex_config {
-        u8 bt_time_extend;
-        bool bt_txstate_extend;
-        bool bt_txframe_extend;
-        enum ath_bt_mode bt_mode; /* coexistence mode */
-        bool bt_quiet_collision;
-        bool bt_rxclear_polarity; /* invert rx_clear as WLAN_ACTIVE*/
-        u8 bt_priority_time;
-        u8 bt_first_slot_time;
-        bool bt_hold_rx_clear;
-};
-
-struct ath_btcoex_info {
-        enum ath_btcoex_scheme btcoex_scheme;
+struct ath_btcoex_hw {
+        enum ath_btcoex_scheme scheme;
+        bool enabled;
         u8 wlanactive_gpio;
         u8 btactive_gpio;
         u8 btpriority_gpio;
-        u8 bt_duty_cycle;       /* BT duty cycle in percentage */
-        int bt_stomp_type;      /* Types of BT stomping */
         u32 bt_coex_mode;       /* Register setting for AR_BT_COEX_MODE */
         u32 bt_coex_weights;    /* Register setting for AR_BT_COEX_WEIGHT */
         u32 bt_coex_mode2;      /* Register setting for AR_BT_COEX_MODE2 */
-        u32 btcoex_no_stomp;   /* in usec */
-        u32 btcoex_period;      /* in usec */
-        u32 bt_priority_cnt;
-        unsigned long bt_priority_time;
-        bool hw_timer_enabled;
-        spinlock_t btcoex_lock;
-        struct timer_list period_timer;      /* Timer for BT period */
-        struct ath_gen_timer *no_stomp_timer; /*Timer for no BT stomping*/
 };
 
-bool ath_btcoex_supported(u16 subsysid);
-int ath9k_hw_btcoex_init(struct ath_hw *ah);
+bool ath9k_hw_btcoex_supported(struct ath_hw *ah);
+void ath9k_hw_btcoex_init_2wire(struct ath_hw *ah);
+void ath9k_hw_btcoex_init_3wire(struct ath_hw *ah);
+void ath9k_hw_init_btcoex_hw(struct ath_hw *ah, int qnum);
+void ath9k_hw_btcoex_set_weight(struct ath_hw *ah,
+                                u32 bt_weight,
+                                u32 wlan_weight);
 void ath9k_hw_btcoex_enable(struct ath_hw *ah);
 void ath9k_hw_btcoex_disable(struct ath_hw *ah);
-void ath_btcoex_timer_resume(struct ath_softc *sc,
-                             struct ath_btcoex_info *btinfo);
-void ath_btcoex_timer_pause(struct ath_softc *sc,
-                            struct ath_btcoex_info *btinfo);
-
-static inline void ath_btcoex_set_weight(struct ath_btcoex_info *btcoex_info,
-                                         u32 bt_weight,
-                                         u32 wlan_weight)
-{
-        btcoex_info->bt_coex_weights = SM(bt_weight, AR_BTCOEX_BT_WGHT) |
-                                       SM(wlan_weight, AR_BTCOEX_WL_WGHT);
-}
 
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 0ad6d0b76e9e..238a5744d8e9 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include "ath9k.h"
+#include "hw.h"
 
 /* We can tune this as we go by monitoring really low values */
 #define ATH9K_NF_TOO_LOW        -60
@@ -26,11 +26,11 @@
 static bool ath9k_hw_nf_in_range(struct ath_hw *ah, s16 nf)
 {
         if (nf > ATH9K_NF_TOO_LOW) {
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "noise floor value detected (%d) is "
-                        "lower than what we think is a "
-                        "reasonable value (%d)\n",
-                        nf, ATH9K_NF_TOO_LOW);
+                ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
+                          "noise floor value detected (%d) is "
+                          "lower than what we think is a "
+                          "reasonable value (%d)\n",
+                          nf, ATH9K_NF_TOO_LOW);
                 return false;
         }
         return true;
@@ -89,6 +89,7 @@ static void ath9k_hw_update_nfcal_hist_buffer(struct ath9k_nfcal_hist *h,
 static void ath9k_hw_do_getnf(struct ath_hw *ah,
                               int16_t nfarray[NUM_NF_READINGS])
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         int16_t nf;
 
         if (AR_SREV_9280_10_OR_LATER(ah))
@@ -98,8 +99,8 @@ static void ath9k_hw_do_getnf(struct ath_hw *ah,
 
         if (nf & 0x100)
                 nf = 0 - ((nf ^ 0x1ff) + 1);
-        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                "NF calibrated [ctl] [chain 0] is %d\n", nf);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ctl] [chain 0] is %d\n", nf);
         nfarray[0] = nf;
 
         if (!AR_SREV_9285(ah)) {
@@ -112,8 +113,8 @@ static void ath9k_hw_do_getnf(struct ath_hw *ah,
 
                 if (nf & 0x100)
                         nf = 0 - ((nf ^ 0x1ff) + 1);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "NF calibrated [ctl] [chain 1] is %d\n", nf);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "NF calibrated [ctl] [chain 1] is %d\n", nf);
                 nfarray[1] = nf;
 
                 if (!AR_SREV_9280(ah) && !AR_SREV_9287(ah)) {
@@ -121,8 +122,8 @@ static void ath9k_hw_do_getnf(struct ath_hw *ah,
                                         AR_PHY_CH2_MINCCA_PWR);
                         if (nf & 0x100)
                                 nf = 0 - ((nf ^ 0x1ff) + 1);
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "NF calibrated [ctl] [chain 2] is %d\n", nf);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "NF calibrated [ctl] [chain 2] is %d\n", nf);
                         nfarray[2] = nf;
                 }
         }
@@ -136,8 +137,8 @@ static void ath9k_hw_do_getnf(struct ath_hw *ah,
 
         if (nf & 0x100)
                 nf = 0 - ((nf ^ 0x1ff) + 1);
-        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                "NF calibrated [ext] [chain 0] is %d\n", nf);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ext] [chain 0] is %d\n", nf);
         nfarray[3] = nf;
 
         if (!AR_SREV_9285(ah)) {
@@ -150,8 +151,8 @@ static void ath9k_hw_do_getnf(struct ath_hw *ah,
 
                 if (nf & 0x100)
                         nf = 0 - ((nf ^ 0x1ff) + 1);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "NF calibrated [ext] [chain 1] is %d\n", nf);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "NF calibrated [ext] [chain 1] is %d\n", nf);
                 nfarray[4] = nf;
 
                 if (!AR_SREV_9280(ah) && !AR_SREV_9287(ah)) {
@@ -159,8 +160,8 @@ static void ath9k_hw_do_getnf(struct ath_hw *ah,
                                         AR_PHY_CH2_EXT_MINCCA_PWR);
                         if (nf & 0x100)
                                 nf = 0 - ((nf ^ 0x1ff) + 1);
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "NF calibrated [ext] [chain 2] is %d\n", nf);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "NF calibrated [ext] [chain 2] is %d\n", nf);
                         nfarray[5] = nf;
                 }
         }
@@ -188,6 +189,8 @@ static bool getNoiseFloorThresh(struct ath_hw *ah,
 static void ath9k_hw_setup_calibration(struct ath_hw *ah,
                                        struct ath9k_cal_list *currCal)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
+
         REG_RMW_FIELD(ah, AR_PHY_TIMING_CTRL4(0),
                       AR_PHY_TIMING_CTRL4_IQCAL_LOG_COUNT_MAX,
                       currCal->calData->calCountMax);
@@ -195,23 +198,23 @@ static void ath9k_hw_setup_calibration(struct ath_hw *ah,
         switch (currCal->calData->calType) {
         case IQ_MISMATCH_CAL:
                 REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_IQ);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "starting IQ Mismatch Calibration\n");
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "starting IQ Mismatch Calibration\n");
                 break;
         case ADC_GAIN_CAL:
                 REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_ADC_GAIN);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "starting ADC Gain Calibration\n");
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "starting ADC Gain Calibration\n");
                 break;
         case ADC_DC_CAL:
                 REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_ADC_DC_PER);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "starting ADC DC Calibration\n");
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "starting ADC DC Calibration\n");
                 break;
         case ADC_DC_INIT_CAL:
                 REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_ADC_DC_INIT);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "starting Init ADC DC Calibration\n");
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "starting Init ADC DC Calibration\n");
                 break;
         }
 
@@ -278,7 +281,7 @@ static bool ath9k_hw_per_calibration(struct ath_hw *ah,
 static bool ath9k_hw_iscal_supported(struct ath_hw *ah,
                                      enum ath9k_cal_types calType)
 {
-        struct ieee80211_conf *conf = &ah->ah_sc->hw->conf;
+        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
 
         switch (calType & ah->supp_cals) {
         case IQ_MISMATCH_CAL: /* Both 2 GHz and 5 GHz support OFDM */
@@ -304,11 +307,11 @@ static void ath9k_hw_iqcal_collect(struct ath_hw *ah)
                         REG_READ(ah, AR_PHY_CAL_MEAS_1(i));
                 ah->totalIqCorrMeas[i] +=
                         (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_2(i));
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "%d: Chn %d pmi=0x%08x;pmq=0x%08x;iqcm=0x%08x;\n",
-                        ah->cal_samples, i, ah->totalPowerMeasI[i],
-                        ah->totalPowerMeasQ[i],
-                        ah->totalIqCorrMeas[i]);
+                ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
+                          "%d: Chn %d pmi=0x%08x;pmq=0x%08x;iqcm=0x%08x;\n",
+                          ah->cal_samples, i, ah->totalPowerMeasI[i],
+                          ah->totalPowerMeasQ[i],
+                          ah->totalIqCorrMeas[i]);
         }
 }
 
@@ -326,14 +329,14 @@ static void ath9k_hw_adc_gaincal_collect(struct ath_hw *ah)
                 ah->totalAdcQEvenPhase[i] +=
                         REG_READ(ah, AR_PHY_CAL_MEAS_3(i));
 
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "%d: Chn %d oddi=0x%08x; eveni=0x%08x; "
-                        "oddq=0x%08x; evenq=0x%08x;\n",
-                        ah->cal_samples, i,
-                        ah->totalAdcIOddPhase[i],
-                        ah->totalAdcIEvenPhase[i],
-                        ah->totalAdcQOddPhase[i],
-                        ah->totalAdcQEvenPhase[i]);
+                ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
+                          "%d: Chn %d oddi=0x%08x; eveni=0x%08x; "
+                          "oddq=0x%08x; evenq=0x%08x;\n",
+                          ah->cal_samples, i,
+                          ah->totalAdcIOddPhase[i],
+                          ah->totalAdcIEvenPhase[i],
+                          ah->totalAdcQOddPhase[i],
+                          ah->totalAdcQEvenPhase[i]);
         }
 }
 
@@ -351,19 +354,20 @@ static void ath9k_hw_adc_dccal_collect(struct ath_hw *ah)
                 ah->totalAdcDcOffsetQEvenPhase[i] +=
                         (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_3(i));
 
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "%d: Chn %d oddi=0x%08x; eveni=0x%08x; "
-                        "oddq=0x%08x; evenq=0x%08x;\n",
-                        ah->cal_samples, i,
-                        ah->totalAdcDcOffsetIOddPhase[i],
-                        ah->totalAdcDcOffsetIEvenPhase[i],
-                        ah->totalAdcDcOffsetQOddPhase[i],
-                        ah->totalAdcDcOffsetQEvenPhase[i]);
+                ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
+                          "%d: Chn %d oddi=0x%08x; eveni=0x%08x; "
+                          "oddq=0x%08x; evenq=0x%08x;\n",
+                          ah->cal_samples, i,
+                          ah->totalAdcDcOffsetIOddPhase[i],
+                          ah->totalAdcDcOffsetIEvenPhase[i],
+                          ah->totalAdcDcOffsetQOddPhase[i],
+                          ah->totalAdcDcOffsetQEvenPhase[i]);
         }
 }
 
 static void ath9k_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         u32 powerMeasQ, powerMeasI, iqCorrMeas;
         u32 qCoffDenom, iCoffDenom;
         int32_t qCoff, iCoff;
@@ -374,13 +378,13 @@ static void ath9k_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
                 powerMeasQ = ah->totalPowerMeasQ[i];
                 iqCorrMeas = ah->totalIqCorrMeas[i];
 
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Starting IQ Cal and Correction for Chain %d\n",
-                        i);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Starting IQ Cal and Correction for Chain %d\n",
+                          i);
 
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Orignal: Chn %diq_corr_meas = 0x%08x\n",
-                        i, ah->totalIqCorrMeas[i]);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Orignal: Chn %diq_corr_meas = 0x%08x\n",
+                          i, ah->totalIqCorrMeas[i]);
 
                 iqCorrNeg = 0;
 
@@ -389,27 +393,28 @@ static void ath9k_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
                         iqCorrNeg = 1;
                 }
 
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Chn %d pwr_meas_i = 0x%08x\n", i, powerMeasI);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Chn %d pwr_meas_q = 0x%08x\n", i, powerMeasQ);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE, "iqCorrNeg is 0x%08x\n",
-                        iqCorrNeg);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_i = 0x%08x\n", i, powerMeasI);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_q = 0x%08x\n", i, powerMeasQ);
+                ath_print(common, ATH_DBG_CALIBRATE, "iqCorrNeg is 0x%08x\n",
+                          iqCorrNeg);
 
                 iCoffDenom = (powerMeasI / 2 + powerMeasQ / 2) / 128;
                 qCoffDenom = powerMeasQ / 64;
 
-                if (powerMeasQ != 0) {
+                if ((powerMeasQ != 0) && (iCoffDenom != 0) &&
+                    (qCoffDenom != 0)) {
                         iCoff = iqCorrMeas / iCoffDenom;
                         qCoff = powerMeasI / qCoffDenom - 64;
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "Chn %d iCoff = 0x%08x\n", i, iCoff);
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "Chn %d qCoff = 0x%08x\n", i, qCoff);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d iCoff = 0x%08x\n", i, iCoff);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d qCoff = 0x%08x\n", i, qCoff);
 
                         iCoff = iCoff & 0x3f;
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "New: Chn %d iCoff = 0x%08x\n", i, iCoff);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "New: Chn %d iCoff = 0x%08x\n", i, iCoff);
                         if (iqCorrNeg == 0x0)
                                 iCoff = 0x40 - iCoff;
 
@@ -418,9 +423,9 @@ static void ath9k_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
                         else if (qCoff <= -16)
                                 qCoff = 16;
 
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "Chn %d : iCoff = 0x%x  qCoff = 0x%x\n",
-                                i, iCoff, qCoff);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d : iCoff = 0x%x  qCoff = 0x%x\n",
+                                  i, iCoff, qCoff);
 
                         REG_RMW_FIELD(ah, AR_PHY_TIMING_CTRL4(i),
                                       AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF,
@@ -428,9 +433,9 @@ static void ath9k_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
                         REG_RMW_FIELD(ah, AR_PHY_TIMING_CTRL4(i),
                                       AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF,
                                       qCoff);
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "IQ Cal and Correction done for Chain %d\n",
-                                i);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "IQ Cal and Correction done for Chain %d\n",
+                                  i);
                 }
         }
 
@@ -440,6 +445,7 @@ static void ath9k_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
 
 static void ath9k_hw_adc_gaincal_calibrate(struct ath_hw *ah, u8 numChains)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         u32 iOddMeasOffset, iEvenMeasOffset, qOddMeasOffset, qEvenMeasOffset;
         u32 qGainMismatch, iGainMismatch, val, i;
 
@@ -449,21 +455,21 @@ static void ath9k_hw_adc_gaincal_calibrate(struct ath_hw *ah, u8 numChains)
                 qOddMeasOffset = ah->totalAdcQOddPhase[i];
                 qEvenMeasOffset = ah->totalAdcQEvenPhase[i];
 
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Starting ADC Gain Cal for Chain %d\n", i);
-
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Chn %d pwr_meas_odd_i = 0x%08x\n", i,
-                        iOddMeasOffset);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Chn %d pwr_meas_even_i = 0x%08x\n", i,
-                        iEvenMeasOffset);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Chn %d pwr_meas_odd_q = 0x%08x\n", i,
-                        qOddMeasOffset);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Chn %d pwr_meas_even_q = 0x%08x\n", i,
-                        qEvenMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Starting ADC Gain Cal for Chain %d\n", i);
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_odd_i = 0x%08x\n", i,
+                          iOddMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_even_i = 0x%08x\n", i,
+                          iEvenMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_odd_q = 0x%08x\n", i,
+                          qOddMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_even_q = 0x%08x\n", i,
+                          qEvenMeasOffset);
 
                 if (iOddMeasOffset != 0 && qEvenMeasOffset != 0) {
                         iGainMismatch =
@@ -473,20 +479,20 @@ static void ath9k_hw_adc_gaincal_calibrate(struct ath_hw *ah, u8 numChains)
                                 ((qOddMeasOffset * 32) /
                                  qEvenMeasOffset) & 0x3f;
 
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "Chn %d gain_mismatch_i = 0x%08x\n", i,
-                                iGainMismatch);
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "Chn %d gain_mismatch_q = 0x%08x\n", i,
-                                qGainMismatch);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d gain_mismatch_i = 0x%08x\n", i,
+                                  iGainMismatch);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d gain_mismatch_q = 0x%08x\n", i,
+                                  qGainMismatch);
 
                         val = REG_READ(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(i));
                         val &= 0xfffff000;
                         val |= (qGainMismatch) | (iGainMismatch << 6);
                         REG_WRITE(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(i), val);
 
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "ADC Gain Cal done for Chain %d\n", i);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "ADC Gain Cal done for Chain %d\n", i);
                 }
         }
 
@@ -497,6 +503,7 @@ static void ath9k_hw_adc_gaincal_calibrate(struct ath_hw *ah, u8 numChains)
 
 static void ath9k_hw_adc_dccal_calibrate(struct ath_hw *ah, u8 numChains)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         u32 iOddMeasOffset, iEvenMeasOffset, val, i;
         int32_t qOddMeasOffset, qEvenMeasOffset, qDcMismatch, iDcMismatch;
         const struct ath9k_percal_data *calData =
@@ -510,41 +517,41 @@ static void ath9k_hw_adc_dccal_calibrate(struct ath_hw *ah, u8 numChains)
                 qOddMeasOffset = ah->totalAdcDcOffsetQOddPhase[i];
                 qEvenMeasOffset = ah->totalAdcDcOffsetQEvenPhase[i];
 
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Starting ADC DC Offset Cal for Chain %d\n", i);
-
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Chn %d pwr_meas_odd_i = %d\n", i,
-                        iOddMeasOffset);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Chn %d pwr_meas_even_i = %d\n", i,
-                        iEvenMeasOffset);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Chn %d pwr_meas_odd_q = %d\n", i,
-                        qOddMeasOffset);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Chn %d pwr_meas_even_q = %d\n", i,
-                        qEvenMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                           "Starting ADC DC Offset Cal for Chain %d\n", i);
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_odd_i = %d\n", i,
+                          iOddMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_even_i = %d\n", i,
+                          iEvenMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_odd_q = %d\n", i,
+                          qOddMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_even_q = %d\n", i,
+                          qEvenMeasOffset);
 
                 iDcMismatch = (((iEvenMeasOffset - iOddMeasOffset) * 2) /
                                numSamples) & 0x1ff;
                 qDcMismatch = (((qOddMeasOffset - qEvenMeasOffset) * 2) /
                                numSamples) & 0x1ff;
 
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Chn %d dc_offset_mismatch_i = 0x%08x\n", i,
-                        iDcMismatch);
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Chn %d dc_offset_mismatch_q = 0x%08x\n", i,
-                        qDcMismatch);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d dc_offset_mismatch_i = 0x%08x\n", i,
+                          iDcMismatch);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d dc_offset_mismatch_q = 0x%08x\n", i,
+                          qDcMismatch);
 
                 val = REG_READ(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(i));
                 val &= 0xc0000fff;
                 val |= (qDcMismatch << 12) | (iDcMismatch << 21);
                 REG_WRITE(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(i), val);
 
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "ADC DC Offset Cal done for Chain %d\n", i);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "ADC DC Offset Cal done for Chain %d\n", i);
         }
 
         REG_WRITE(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(0),
@@ -555,7 +562,8 @@ static void ath9k_hw_adc_dccal_calibrate(struct ath_hw *ah, u8 numChains)
 /* This is done for the currently configured channel */
 bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
 {
-        struct ieee80211_conf *conf = &ah->ah_sc->hw->conf;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ieee80211_conf *conf = &common->hw->conf;
         struct ath9k_cal_list *currCal = ah->cal_list_curr;
 
         if (!ah->curchan)
@@ -568,24 +576,25 @@ bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
                 return true;
 
         if (currCal->calState != CAL_DONE) {
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "Calibration state incorrect, %d\n",
-                        currCal->calState);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Calibration state incorrect, %d\n",
+                          currCal->calState);
                 return true;
         }
 
         if (!ath9k_hw_iscal_supported(ah, currCal->calData->calType))
                 return true;
 
-        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                "Resetting Cal %d state for channel %u\n",
-                currCal->calData->calType, conf->channel->center_freq);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "Resetting Cal %d state for channel %u\n",
+                  currCal->calData->calType, conf->channel->center_freq);
 
         ah->curchan->CalValid &= ~currCal->calData->calType;
         currCal->calState = CAL_WAITING;
 
         return false;
 }
+EXPORT_SYMBOL(ath9k_hw_reset_calvalid);
 
 void ath9k_hw_start_nfcal(struct ath_hw *ah)
 {
@@ -645,11 +654,11 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
                     AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
         REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
 
-        for (j = 0; j < 1000; j++) {
+        for (j = 0; j < 5; j++) {
                 if ((REG_READ(ah, AR_PHY_AGC_CONTROL) &
                      AR_PHY_AGC_CONTROL_NF) == 0)
                         break;
-                udelay(10);
+                udelay(50);
         }
 
         for (i = 0; i < NUM_NF_READINGS; i++) {
@@ -665,6 +674,7 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
 int16_t ath9k_hw_getnf(struct ath_hw *ah,
                        struct ath9k_channel *chan)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         int16_t nf, nfThresh;
         int16_t nfarray[NUM_NF_READINGS] = { 0 };
         struct ath9k_nfcal_hist *h;
@@ -672,8 +682,8 @@ int16_t ath9k_hw_getnf(struct ath_hw *ah,
 
         chan->channelFlags &= (~CHANNEL_CW_INT);
         if (REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF) {
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                        "NF did not complete in calibration window\n");
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "NF did not complete in calibration window\n");
                 nf = 0;
                 chan->rawNoiseFloor = nf;
                 return chan->rawNoiseFloor;
@@ -682,10 +692,10 @@ int16_t ath9k_hw_getnf(struct ath_hw *ah,
                 nf = nfarray[0];
                 if (getNoiseFloorThresh(ah, c->band, &nfThresh)
                     && nf > nfThresh) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "noise floor failed detected; "
-                                "detected %d, threshold %d\n",
-                                nf, nfThresh);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "noise floor failed detected; "
+                                  "detected %d, threshold %d\n",
+                                  nf, nfThresh);
                         chan->channelFlags |= CHANNEL_CW_INT;
                 }
         }
@@ -737,51 +747,73 @@ s16 ath9k_hw_getchan_noise(struct ath_hw *ah, struct ath9k_channel *chan)
 
         return nf;
 }
+EXPORT_SYMBOL(ath9k_hw_getchan_noise);
 
-static void ath9k_olc_temp_compensation(struct ath_hw *ah)
+static void ath9k_olc_temp_compensation_9287(struct ath_hw *ah)
 {
-        u32 rddata, i;
-        int delta, currPDADC, regval, slope;
+        u32 rddata;
+        int32_t delta, currPDADC, slope;
 
         rddata = REG_READ(ah, AR_PHY_TX_PWRCTRL4);
         currPDADC = MS(rddata, AR_PHY_TX_PWRCTRL_PD_AVG_OUT);
 
+        if (ah->initPDADC == 0 || currPDADC == 0) {
+                /*
+                 * Zero value indicates that no frames have been transmitted yet,
+                 * can't do temperature compensation until frames are transmitted.
+                 */
+                return;
+        } else {
+                slope = ah->eep_ops->get_eeprom(ah, EEP_TEMPSENSE_SLOPE);
+
+                if (slope == 0) { /* to avoid divide by zero case */
+                        delta = 0;
+                } else {
+                        delta = ((currPDADC - ah->initPDADC)*4) / slope;
+                }
+                REG_RMW_FIELD(ah, AR_PHY_CH0_TX_PWRCTRL11,
+                              AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP, delta);
+                REG_RMW_FIELD(ah, AR_PHY_CH1_TX_PWRCTRL11,
+                              AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP, delta);
+        }
+}
+
+static void ath9k_olc_temp_compensation(struct ath_hw *ah)
+{
+        u32 rddata, i;
+        int delta, currPDADC, regval;
 
         if (OLC_FOR_AR9287_10_LATER) {
+                ath9k_olc_temp_compensation_9287(ah);
+        } else {
+                rddata = REG_READ(ah, AR_PHY_TX_PWRCTRL4);
+                currPDADC = MS(rddata, AR_PHY_TX_PWRCTRL_PD_AVG_OUT);
+
                 if (ah->initPDADC == 0 || currPDADC == 0) {
                         return;
                 } else {
-                        slope = ah->eep_ops->get_eeprom(ah, EEP_TEMPSENSE_SLOPE);
-                        if (slope == 0)
-                                delta = 0;
+                        if (ah->eep_ops->get_eeprom(ah, EEP_DAC_HPWR_5G))
+                                delta = (currPDADC - ah->initPDADC + 4) / 8;
                         else
-                                delta = ((currPDADC - ah->initPDADC)*4) / slope;
-                        REG_RMW_FIELD(ah, AR_PHY_CH0_TX_PWRCTRL11,
-                                        AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP, delta);
-                        REG_RMW_FIELD(ah, AR_PHY_CH1_TX_PWRCTRL11,
-                                        AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP, delta);
-                }
-        } else {
-                if (ah->eep_ops->get_eeprom(ah, EEP_DAC_HPWR_5G))
-                        delta = (currPDADC - ah->initPDADC + 4) / 8;
-                else
-                        delta = (currPDADC - ah->initPDADC + 5) / 10;
-
-                if (delta != ah->PDADCdelta) {
-                        ah->PDADCdelta = delta;
-                        for (i = 1; i < AR9280_TX_GAIN_TABLE_SIZE; i++) {
-                                regval = ah->originalGain[i] - delta;
-                                if (regval < 0)
-                                        regval = 0;
-
-                                REG_RMW_FIELD(ah, AR_PHY_TX_GAIN_TBL1 + i * 4,
-                                                AR_PHY_TX_GAIN, regval);
+                                delta = (currPDADC - ah->initPDADC + 5) / 10;
+
+                        if (delta != ah->PDADCdelta) {
+                                ah->PDADCdelta = delta;
+                                for (i = 1; i < AR9280_TX_GAIN_TABLE_SIZE; i++) {
+                                        regval = ah->originalGain[i] - delta;
+                                        if (regval < 0)
+                                                regval = 0;
+
+                                        REG_RMW_FIELD(ah,
+                                                      AR_PHY_TX_GAIN_TBL1 + i * 4,
+                                                      AR_PHY_TX_GAIN, regval);
+                                }
                         }
                 }
         }
 }
 
-static void ath9k_hw_9271_pa_cal(struct ath_hw *ah)
+static void ath9k_hw_9271_pa_cal(struct ath_hw *ah, bool is_reset)
 {
         u32 regVal;
         unsigned int i;
@@ -845,7 +877,7 @@ static void ath9k_hw_9271_pa_cal(struct ath_hw *ah)
         REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9271_AN_RF2G6_OFFS, 0);
 
         /* find off_6_1; */
-        for (i = 6; i >= 0; i--) {
+        for (i = 6; i > 0; i--) {
                 regVal = REG_READ(ah, 0x7834);
                 regVal |= (1 << (20 + i));
                 REG_WRITE(ah, 0x7834, regVal);
@@ -857,10 +889,19 @@ static void ath9k_hw_9271_pa_cal(struct ath_hw *ah)
                 REG_WRITE(ah, 0x7834, regVal);
         }
 
-        /*  Empirical offset correction  */
-#if 0
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9271_AN_RF2G6_OFFS, 0x20);
-#endif
+        regVal = (regVal >>20) & 0x7f;
+
+        /* Update PA cal info */
+        if ((!is_reset) && (ah->pacal_info.prev_offset == regVal)) {
+                if (ah->pacal_info.max_skipcount < MAX_PACAL_SKIPCOUNT)
+                        ah->pacal_info.max_skipcount =
+                                2 * ah->pacal_info.max_skipcount;
+                ah->pacal_info.skipcount = ah->pacal_info.max_skipcount;
+        } else {
+                ah->pacal_info.max_skipcount = 1;
+                ah->pacal_info.skipcount = 0;
+                ah->pacal_info.prev_offset = regVal;
+        }
 
         regVal = REG_READ(ah, 0x7834);
         regVal |= 0x1;
@@ -875,7 +916,7 @@ static void ath9k_hw_9271_pa_cal(struct ath_hw *ah)
 
 static inline void ath9k_hw_9285_pa_cal(struct ath_hw *ah, bool is_reset)
 {
-
+        struct ath_common *common = ath9k_hw_common(ah);
         u32 regVal;
         int i, offset, offs_6_1, offs_0;
         u32 ccomp_org, reg_field;
@@ -889,7 +930,7 @@ static inline void ath9k_hw_9285_pa_cal(struct ath_hw *ah, bool is_reset)
                 { 0x7838, 0 },
         };
 
-        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE, "Running PA Calibration\n");
+        ath_print(common, ATH_DBG_CALIBRATE, "Running PA Calibration\n");
 
         /* PA CAL is not needed for high power solution */
         if (ah->eep_ops->get_eeprom(ah, EEP_TXGAIN_TYPE) ==
@@ -1011,7 +1052,7 @@ bool ath9k_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
         if (longcal) {
                 /* Do periodic PAOffset Cal */
                 if (AR_SREV_9271(ah))
-                        ath9k_hw_9271_pa_cal(ah);
+                        ath9k_hw_9271_pa_cal(ah, false);
                 else if (AR_SREV_9285_11_OR_LATER(ah)) {
                         if (!ah->pacal_info.skipcount)
                                 ath9k_hw_9285_pa_cal(ah, false);
@@ -1036,9 +1077,13 @@ bool ath9k_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
 
         return iscaldone;
 }
+EXPORT_SYMBOL(ath9k_hw_calibrate);
 
+/* Carrier leakage Calibration fix */
 static bool ar9285_clc(struct ath_hw *ah, struct ath9k_channel *chan)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
+
         REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
         if (IS_CHAN_HT20(chan)) {
                 REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_PARALLEL_CAL_ENABLE);
@@ -1049,9 +1094,9 @@ static bool ar9285_clc(struct ath_hw *ah, struct ath9k_channel *chan)
                 REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL);
                 if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
                                   AR_PHY_AGC_CONTROL_CAL, 0, AH_WAIT_TIMEOUT)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE, "offset "
-                                "calibration failed to complete in "
-                                "1ms; noisy ??\n");
+                        ath_print(common, ATH_DBG_CALIBRATE, "offset "
+                                  "calibration failed to complete in "
+                                  "1ms; noisy ??\n");
                         return false;
                 }
                 REG_CLR_BIT(ah, AR_PHY_TURBO, AR_PHY_FC_DYN2040_EN);
@@ -1064,8 +1109,8 @@ static bool ar9285_clc(struct ath_hw *ah, struct ath9k_channel *chan)
         REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL);
         if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL,
                           0, AH_WAIT_TIMEOUT)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE, "offset calibration "
-                                "failed to complete in 1ms; noisy ??\n");
+                ath_print(common, ATH_DBG_CALIBRATE, "offset calibration "
+                          "failed to complete in 1ms; noisy ??\n");
                 return false;
         }
 
@@ -1078,7 +1123,9 @@ static bool ar9285_clc(struct ath_hw *ah, struct ath9k_channel *chan)
 
 bool ath9k_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
 {
-        if (AR_SREV_9285_12_OR_LATER(ah)) {
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (AR_SREV_9271(ah) || AR_SREV_9285_12_OR_LATER(ah)) {
                 if (!ar9285_clc(ah, chan))
                         return false;
         } else {
@@ -1098,9 +1145,9 @@ bool ath9k_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
                 /* Poll for offset calibration complete */
                 if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL,
                                    0, AH_WAIT_TIMEOUT)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "offset calibration failed to complete in 1ms; "
-                                "noisy environment?\n");
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "offset calibration failed to "
+                                  "complete in 1ms; noisy environment?\n");
                         return false;
                 }
 
@@ -1114,7 +1161,9 @@ bool ath9k_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
         }
 
         /* Do PA Calibration */
-        if (AR_SREV_9285_11_OR_LATER(ah))
+        if (AR_SREV_9271(ah))
+                ath9k_hw_9271_pa_cal(ah, true);
+        else if (AR_SREV_9285_11_OR_LATER(ah))
                 ath9k_hw_9285_pa_cal(ah, true);
 
         /* Do NF Calibration after DC offset and other calibrations */
@@ -1128,20 +1177,20 @@ bool ath9k_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
                 if (ath9k_hw_iscal_supported(ah, ADC_GAIN_CAL)) {
                         INIT_CAL(&ah->adcgain_caldata);
                         INSERT_CAL(ah, &ah->adcgain_caldata);
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "enabling ADC Gain Calibration.\n");
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "enabling ADC Gain Calibration.\n");
                 }
                 if (ath9k_hw_iscal_supported(ah, ADC_DC_CAL)) {
                         INIT_CAL(&ah->adcdc_caldata);
                         INSERT_CAL(ah, &ah->adcdc_caldata);
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "enabling ADC DC Calibration.\n");
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "enabling ADC DC Calibration.\n");
                 }
                 if (ath9k_hw_iscal_supported(ah, IQ_MISMATCH_CAL)) {
                         INIT_CAL(&ah->iq_caldata);
                         INSERT_CAL(ah, &ah->iq_caldata);
-                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
-                                "enabling IQ Calibration.\n");
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "enabling IQ Calibration.\n");
                 }
 
                 ah->cal_list_curr = ah->cal_list;
diff --git a/drivers/net/wireless/ath/ath9k/calib.h b/drivers/net/wireless/ath/ath9k/calib.h
index 9028ab193e42..b2c873e97485 100644
--- a/drivers/net/wireless/ath/ath9k/calib.h
+++ b/drivers/net/wireless/ath/ath9k/calib.h
@@ -17,6 +17,8 @@
 #ifndef CALIB_H
 #define CALIB_H
 
+#include "hw.h"
+
 extern const struct ath9k_percal_data iq_cal_multi_sample;
 extern const struct ath9k_percal_data iq_cal_single_sample;
 extern const struct ath9k_percal_data adc_gain_cal_multi_sample;
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
new file mode 100644
index 000000000000..4d775ae141db
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -0,0 +1,299 @@
+/*
+ * Copyright (c) 2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Module for common driver code between ath9k and ath9k_htc
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include "common.h"
+
+MODULE_AUTHOR("Atheros Communications");
+MODULE_DESCRIPTION("Shared library for Atheros wireless 802.11n LAN cards.");
+MODULE_LICENSE("Dual BSD/GPL");
+
+/* Common RX processing */
+
+/* Assumes you've already done the endian to CPU conversion */
+static bool ath9k_rx_accept(struct ath_common *common,
+                            struct sk_buff *skb,
+                            struct ieee80211_rx_status *rxs,
+                            struct ath_rx_status *rx_stats,
+                            bool *decrypt_error)
+{
+        struct ath_hw *ah = common->ah;
+        struct ieee80211_hdr *hdr;
+        __le16 fc;
+
+        hdr = (struct ieee80211_hdr *) skb->data;
+        fc = hdr->frame_control;
+
+        if (!rx_stats->rs_datalen)
+                return false;
+        /*
+         * rs_status follows rs_datalen so if rs_datalen is too large
+         * we can take a hint that hardware corrupted it, so ignore
+         * those frames.
+         */
+        if (rx_stats->rs_datalen > common->rx_bufsize)
+                return false;
+
+        /*
+         * rs_more indicates chained descriptors which can be used
+         * to link buffers together for a sort of scatter-gather
+         * operation.
+         *
+         * The rx_stats->rs_status will not be set until the end of the
+         * chained descriptors so it can be ignored if rs_more is set. The
+         * rs_more will be false at the last element of the chained
+         * descriptors.
+         */
+        if (!rx_stats->rs_more && rx_stats->rs_status != 0) {
+                if (rx_stats->rs_status & ATH9K_RXERR_CRC)
+                        rxs->flag |= RX_FLAG_FAILED_FCS_CRC;
+                if (rx_stats->rs_status & ATH9K_RXERR_PHY)
+                        return false;
+
+                if (rx_stats->rs_status & ATH9K_RXERR_DECRYPT) {
+                        *decrypt_error = true;
+                } else if (rx_stats->rs_status & ATH9K_RXERR_MIC) {
+                        if (ieee80211_is_ctl(fc))
+                                /*
+                                 * Sometimes, we get invalid
+                                 * MIC failures on valid control frames.
+                                 * Remove these mic errors.
+                                 */
+                                rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
+                        else
+                                rxs->flag |= RX_FLAG_MMIC_ERROR;
+                }
+                /*
+                 * Reject error frames with the exception of
+                 * decryption and MIC failures. For monitor mode,
+                 * we also ignore the CRC error.
+                 */
+                if (ah->opmode == NL80211_IFTYPE_MONITOR) {
+                        if (rx_stats->rs_status &
+                            ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC |
+                              ATH9K_RXERR_CRC))
+                                return false;
+                } else {
+                        if (rx_stats->rs_status &
+                            ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC)) {
+                                return false;
+                        }
+                }
+        }
+        return true;
+}
+
+static u8 ath9k_process_rate(struct ath_common *common,
+                             struct ieee80211_hw *hw,
+                             struct ath_rx_status *rx_stats,
+                             struct ieee80211_rx_status *rxs,
+                             struct sk_buff *skb)
+{
+        struct ieee80211_supported_band *sband;
+        enum ieee80211_band band;
+        unsigned int i = 0;
+
+        band = hw->conf.channel->band;
+        sband = hw->wiphy->bands[band];
+
+        if (rx_stats->rs_rate & 0x80) {
+                /* HT rate */
+                rxs->flag |= RX_FLAG_HT;
+                if (rx_stats->rs_flags & ATH9K_RX_2040)
+                        rxs->flag |= RX_FLAG_40MHZ;
+                if (rx_stats->rs_flags & ATH9K_RX_GI)
+                        rxs->flag |= RX_FLAG_SHORT_GI;
+                return rx_stats->rs_rate & 0x7f;
+        }
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if (sband->bitrates[i].hw_value == rx_stats->rs_rate)
+                        return i;
+                if (sband->bitrates[i].hw_value_short == rx_stats->rs_rate) {
+                        rxs->flag |= RX_FLAG_SHORTPRE;
+                        return i;
+                }
+        }
+
+        /* No valid hardware bitrate found -- we should not get here */
+        ath_print(common, ATH_DBG_XMIT, "unsupported hw bitrate detected "
+                  "0x%02x using 1 Mbit\n", rx_stats->rs_rate);
+        if ((common->debug_mask & ATH_DBG_XMIT))
+                print_hex_dump_bytes("", DUMP_PREFIX_NONE, skb->data, skb->len);
+
+        return 0;
+}
+
+static void ath9k_process_rssi(struct ath_common *common,
+                               struct ieee80211_hw *hw,
+                               struct sk_buff *skb,
+                               struct ath_rx_status *rx_stats)
+{
+        struct ath_hw *ah = common->ah;
+        struct ieee80211_sta *sta;
+        struct ieee80211_hdr *hdr;
+        struct ath_node *an;
+        int last_rssi = ATH_RSSI_DUMMY_MARKER;
+        __le16 fc;
+
+        hdr = (struct ieee80211_hdr *)skb->data;
+        fc = hdr->frame_control;
+
+        rcu_read_lock();
+        /*
+         * XXX: use ieee80211_find_sta! This requires quite a bit of work
+         * under the current ath9k virtual wiphy implementation as we have
+         * no way of tying a vif to wiphy. Typically vifs are attached to
+         * at least one sdata of a wiphy on mac80211 but with ath9k virtual
+         * wiphy you'd have to iterate over every wiphy and each sdata.
+         */
+        sta = ieee80211_find_sta_by_hw(hw, hdr->addr2);
+        if (sta) {
+                an = (struct ath_node *) sta->drv_priv;
+                if (rx_stats->rs_rssi != ATH9K_RSSI_BAD &&
+                   !rx_stats->rs_moreaggr)
+                        ATH_RSSI_LPF(an->last_rssi, rx_stats->rs_rssi);
+                last_rssi = an->last_rssi;
+        }
+        rcu_read_unlock();
+
+        if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
+                rx_stats->rs_rssi = ATH_EP_RND(last_rssi,
+                                              ATH_RSSI_EP_MULTIPLIER);
+        if (rx_stats->rs_rssi < 0)
+                rx_stats->rs_rssi = 0;
+
+        /* Update Beacon RSSI, this is used by ANI. */
+        if (ieee80211_is_beacon(fc))
+                ah->stats.avgbrssi = rx_stats->rs_rssi;
+}
+
+/*
+ * For Decrypt or Demic errors, we only mark packet status here and always push
+ * up the frame up to let mac80211 handle the actual error case, be it no
+ * decryption key or real decryption error. This let us keep statistics there.
+ */
+int ath9k_cmn_rx_skb_preprocess(struct ath_common *common,
+                                struct ieee80211_hw *hw,
+                                struct sk_buff *skb,
+                                struct ath_rx_status *rx_stats,
+                                struct ieee80211_rx_status *rx_status,
+                                bool *decrypt_error)
+{
+        struct ath_hw *ah = common->ah;
+
+        memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
+        if (!ath9k_rx_accept(common, skb, rx_status, rx_stats, decrypt_error))
+                return -EINVAL;
+
+        ath9k_process_rssi(common, hw, skb, rx_stats);
+
+        rx_status->rate_idx = ath9k_process_rate(common, hw,
+                                                 rx_stats, rx_status, skb);
+        rx_status->mactime = ath9k_hw_extend_tsf(ah, rx_stats->rs_tstamp);
+        rx_status->band = hw->conf.channel->band;
+        rx_status->freq = hw->conf.channel->center_freq;
+        rx_status->noise = common->ani.noise_floor;
+        rx_status->signal = ATH_DEFAULT_NOISE_FLOOR + rx_stats->rs_rssi;
+        rx_status->antenna = rx_stats->rs_antenna;
+        rx_status->flag |= RX_FLAG_TSFT;
+
+        return 0;
+}
+EXPORT_SYMBOL(ath9k_cmn_rx_skb_preprocess);
+
+void ath9k_cmn_rx_skb_postprocess(struct ath_common *common,
+                                  struct sk_buff *skb,
+                                  struct ath_rx_status *rx_stats,
+                                  struct ieee80211_rx_status *rxs,
+                                  bool decrypt_error)
+{
+        struct ath_hw *ah = common->ah;
+        struct ieee80211_hdr *hdr;
+        int hdrlen, padpos, padsize;
+        u8 keyix;
+        __le16 fc;
+
+        /* see if any padding is done by the hw and remove it */
+        hdr = (struct ieee80211_hdr *) skb->data;
+        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+        fc = hdr->frame_control;
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+
+        /* The MAC header is padded to have 32-bit boundary if the
+         * packet payload is non-zero. The general calculation for
+         * padsize would take into account odd header lengths:
+         * padsize = (4 - padpos % 4) % 4; However, since only
+         * even-length headers are used, padding can only be 0 or 2
+         * bytes and we can optimize this a bit. In addition, we must
+         * not try to remove padding from short control frames that do
+         * not have payload. */
+        padsize = padpos & 3;
+        if (padsize && skb->len>=padpos+padsize+FCS_LEN) {
+                memmove(skb->data + padsize, skb->data, padpos);
+                skb_pull(skb, padsize);
+        }
+
+        keyix = rx_stats->rs_keyix;
+
+        if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error) {
+                rxs->flag |= RX_FLAG_DECRYPTED;
+        } else if (ieee80211_has_protected(fc)
+                   && !decrypt_error && skb->len >= hdrlen + 4) {
+                keyix = skb->data[hdrlen + 3] >> 6;
+
+                if (test_bit(keyix, common->keymap))
+                        rxs->flag |= RX_FLAG_DECRYPTED;
+        }
+        if (ah->sw_mgmt_crypto &&
+            (rxs->flag & RX_FLAG_DECRYPTED) &&
+            ieee80211_is_mgmt(fc))
+                /* Use software decrypt for management frames. */
+                rxs->flag &= ~RX_FLAG_DECRYPTED;
+}
+EXPORT_SYMBOL(ath9k_cmn_rx_skb_postprocess);
+
+int ath9k_cmn_padpos(__le16 frame_control)
+{
+        int padpos = 24;
+        if (ieee80211_has_a4(frame_control)) {
+                padpos += ETH_ALEN;
+        }
+        if (ieee80211_is_data_qos(frame_control)) {
+                padpos += IEEE80211_QOS_CTL_LEN;
+        }
+
+        return padpos;
+}
+EXPORT_SYMBOL(ath9k_cmn_padpos);
+
+static int __init ath9k_cmn_init(void)
+{
+        return 0;
+}
+module_init(ath9k_cmn_init);
+
+static void __exit ath9k_cmn_exit(void)
+{
+        return;
+}
+module_exit(ath9k_cmn_exit);
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
new file mode 100644
index 000000000000..042999c2fe9c
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <net/mac80211.h>
+
+#include "../ath.h"
+#include "../debug.h"
+
+#include "hw.h"
+
+/* Common header for Atheros 802.11n base driver cores */
+
+#define WME_NUM_TID             16
+#define WME_BA_BMP_SIZE         64
+#define WME_MAX_BA              WME_BA_BMP_SIZE
+#define ATH_TID_MAX_BUFS        (2 * WME_MAX_BA)
+
+#define WME_AC_BE   0
+#define WME_AC_BK   1
+#define WME_AC_VI   2
+#define WME_AC_VO   3
+#define WME_NUM_AC  4
+
+#define ATH_RSSI_DUMMY_MARKER   0x127
+#define ATH_RSSI_LPF_LEN                10
+#define RSSI_LPF_THRESHOLD              -20
+#define ATH_RSSI_EP_MULTIPLIER     (1<<7)
+#define ATH_EP_MUL(x, mul)         ((x) * (mul))
+#define ATH_RSSI_IN(x)             (ATH_EP_MUL((x), ATH_RSSI_EP_MULTIPLIER))
+#define ATH_LPF_RSSI(x, y, len) \
+    ((x != ATH_RSSI_DUMMY_MARKER) ? (((x) * ((len) - 1) + (y)) / (len)) : (y))
+#define ATH_RSSI_LPF(x, y) do {                                         \
+    if ((y) >= RSSI_LPF_THRESHOLD)                                      \
+        x = ATH_LPF_RSSI((x), ATH_RSSI_IN((y)), ATH_RSSI_LPF_LEN);      \
+} while (0)
+#define ATH_EP_RND(x, mul)                                              \
+        ((((x)%(mul)) >= ((mul)/2)) ? ((x) + ((mul) - 1)) / (mul) : (x)/(mul))
+
+struct ath_atx_ac {
+        int sched;
+        int qnum;
+        struct list_head list;
+        struct list_head tid_q;
+};
+
+struct ath_buf_state {
+        int bfs_nframes;
+        u16 bfs_al;
+        u16 bfs_frmlen;
+        int bfs_seqno;
+        int bfs_tidno;
+        int bfs_retries;
+        u8 bf_type;
+        u32 bfs_keyix;
+        enum ath9k_key_type bfs_keytype;
+};
+
+struct ath_buf {
+        struct list_head list;
+        struct ath_buf *bf_lastbf;      /* last buf of this unit (a frame or
+                                           an aggregate) */
+        struct ath_buf *bf_next;        /* next subframe in the aggregate */
+        struct sk_buff *bf_mpdu;        /* enclosing frame structure */
+        struct ath_desc *bf_desc;       /* virtual addr of desc */
+        dma_addr_t bf_daddr;            /* physical addr of desc */
+        dma_addr_t bf_buf_addr;         /* physical addr of data buffer */
+        bool bf_stale;
+        bool bf_isnullfunc;
+        u16 bf_flags;
+        struct ath_buf_state bf_state;
+        dma_addr_t bf_dmacontext;
+        struct ath_wiphy *aphy;
+};
+
+struct ath_atx_tid {
+        struct list_head list;
+        struct list_head buf_q;
+        struct ath_node *an;
+        struct ath_atx_ac *ac;
+        struct ath_buf *tx_buf[ATH_TID_MAX_BUFS];
+        u16 seq_start;
+        u16 seq_next;
+        u16 baw_size;
+        int tidno;
+        int baw_head;   /* first un-acked tx buffer */
+        int baw_tail;   /* next unused tx buffer slot */
+        int sched;
+        int paused;
+        u8 state;
+};
+
+struct ath_node {
+        struct ath_common *common;
+        struct ath_atx_tid tid[WME_NUM_TID];
+        struct ath_atx_ac ac[WME_NUM_AC];
+        u16 maxampdu;
+        u8 mpdudensity;
+        int last_rssi;
+};
+
+int ath9k_cmn_rx_skb_preprocess(struct ath_common *common,
+                                struct ieee80211_hw *hw,
+                                struct sk_buff *skb,
+                                struct ath_rx_status *rx_stats,
+                                struct ieee80211_rx_status *rx_status,
+                                bool *decrypt_error);
+
+void ath9k_cmn_rx_skb_postprocess(struct ath_common *common,
+                                  struct sk_buff *skb,
+                                  struct ath_rx_status *rx_stats,
+                                  struct ieee80211_rx_status *rxs,
+                                  bool decrypt_error);
+
+int ath9k_cmn_padpos(__le16 frame_control);
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 2be4c2252047..081e0085ed4c 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -14,44 +14,35 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include <linux/slab.h>
 #include <asm/unaligned.h>
 
 #include "ath9k.h"
 
-static unsigned int ath9k_debug = DBG_DEFAULT;
-module_param_named(debug, ath9k_debug, uint, 0);
+#define REG_WRITE_D(_ah, _reg, _val) \
+        ath9k_hw_common(_ah)->ops->write((_ah), (_val), (_reg))
+#define REG_READ_D(_ah, _reg) \
+        ath9k_hw_common(_ah)->ops->read((_ah), (_reg))
 
 static struct dentry *ath9k_debugfs_root;
 
-void DPRINTF(struct ath_softc *sc, int dbg_mask, const char *fmt, ...)
-{
-        if (!sc)
-                return;
-
-        if (sc->debug.debug_mask & dbg_mask) {
-                va_list args;
-
-                va_start(args, fmt);
-                printk(KERN_DEBUG "ath9k: ");
-                vprintk(fmt, args);
-                va_end(args);
-        }
-}
-
 static int ath9k_debugfs_open(struct inode *inode, struct file *file)
 {
         file->private_data = inode->i_private;
         return 0;
 }
 
+#ifdef CONFIG_ATH_DEBUG
+
 static ssize_t read_file_debug(struct file *file, char __user *user_buf,
                              size_t count, loff_t *ppos)
 {
         struct ath_softc *sc = file->private_data;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         char buf[32];
         unsigned int len;
 
-        len = snprintf(buf, sizeof(buf), "0x%08x\n", sc->debug.debug_mask);
+        len = snprintf(buf, sizeof(buf), "0x%08x\n", common->debug_mask);
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -59,6 +50,7 @@ static ssize_t write_file_debug(struct file *file, const char __user *user_buf,
                              size_t count, loff_t *ppos)
 {
         struct ath_softc *sc = file->private_data;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         unsigned long mask;
         char buf[32];
         ssize_t len;
@@ -71,7 +63,7 @@ static ssize_t write_file_debug(struct file *file, const char __user *user_buf,
         if (strict_strtoul(buf, 0, &mask))
                 return -EINVAL;
 
-        sc->debug.debug_mask = mask;
+        common->debug_mask = mask;
         return count;
 }
 
@@ -82,38 +74,47 @@ static const struct file_operations fops_debug = {
         .owner = THIS_MODULE
 };
 
+#endif
+
+#define DMA_BUF_LEN 1024
+
 static ssize_t read_file_dma(struct file *file, char __user *user_buf,
                              size_t count, loff_t *ppos)
 {
         struct ath_softc *sc = file->private_data;
         struct ath_hw *ah = sc->sc_ah;
-        char buf[1024];
+        char *buf;
+        int retval;
         unsigned int len = 0;
         u32 val[ATH9K_NUM_DMA_DEBUG_REGS];
         int i, qcuOffset = 0, dcuOffset = 0;
         u32 *qcuBase = &val[0], *dcuBase = &val[4];
 
+        buf = kmalloc(DMA_BUF_LEN, GFP_KERNEL);
+        if (!buf)
+                return 0;
+
         ath9k_ps_wakeup(sc);
 
-        REG_WRITE(ah, AR_MACMISC,
+        REG_WRITE_D(ah, AR_MACMISC,
                   ((AR_MACMISC_DMA_OBS_LINE_8 << AR_MACMISC_DMA_OBS_S) |
                    (AR_MACMISC_MISC_OBS_BUS_1 <<
                     AR_MACMISC_MISC_OBS_BUS_MSB_S)));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
+        len += snprintf(buf + len, DMA_BUF_LEN - len,
                         "Raw DMA Debug values:\n");
 
         for (i = 0; i < ATH9K_NUM_DMA_DEBUG_REGS; i++) {
                 if (i % 4 == 0)
-                        len += snprintf(buf + len, sizeof(buf) - len, "\n");
+                        len += snprintf(buf + len, DMA_BUF_LEN - len, "\n");
 
-                val[i] = REG_READ(ah, AR_DMADBG_0 + (i * sizeof(u32)));
-                len += snprintf(buf + len, sizeof(buf) - len, "%d: %08x ",
+                val[i] = REG_READ_D(ah, AR_DMADBG_0 + (i * sizeof(u32)));
+                len += snprintf(buf + len, DMA_BUF_LEN - len, "%d: %08x ",
                                 i, val[i]);
         }
 
-        len += snprintf(buf + len, sizeof(buf) - len, "\n\n");
-        len += snprintf(buf + len, sizeof(buf) - len,
+        len += snprintf(buf + len, DMA_BUF_LEN - len, "\n\n");
+        len += snprintf(buf + len, DMA_BUF_LEN - len,
                         "Num QCU: chain_st fsp_ok fsp_st DCU: chain_st\n");
 
         for (i = 0; i < ATH9K_NUM_QUEUES; i++, qcuOffset += 4, dcuOffset += 5) {
@@ -127,7 +128,7 @@ static ssize_t read_file_dma(struct file *file, char __user *user_buf,
                         dcuBase++;
                 }
 
-                len += snprintf(buf + len, sizeof(buf) - len,
+                len += snprintf(buf + len, DMA_BUF_LEN - len,
                         "%2d          %2x      %1x     %2x           %2x\n",
                         i, (*qcuBase & (0x7 << qcuOffset)) >> qcuOffset,
                         (*qcuBase & (0x8 << qcuOffset)) >> (qcuOffset + 3),
@@ -135,35 +136,37 @@ static ssize_t read_file_dma(struct file *file, char __user *user_buf,
                         (*dcuBase & (0x1f << dcuOffset)) >> dcuOffset);
         }
 
-        len += snprintf(buf + len, sizeof(buf) - len, "\n");
+        len += snprintf(buf + len, DMA_BUF_LEN - len, "\n");
 
-        len += snprintf(buf + len, sizeof(buf) - len,
+        len += snprintf(buf + len, DMA_BUF_LEN - len,
                 "qcu_stitch state:   %2x    qcu_fetch state:        %2x\n",
                 (val[3] & 0x003c0000) >> 18, (val[3] & 0x03c00000) >> 22);
-        len += snprintf(buf + len, sizeof(buf) - len,
+        len += snprintf(buf + len, DMA_BUF_LEN - len,
                 "qcu_complete state: %2x    dcu_complete state:     %2x\n",
                 (val[3] & 0x1c000000) >> 26, (val[6] & 0x3));
-        len += snprintf(buf + len, sizeof(buf) - len,
+        len += snprintf(buf + len, DMA_BUF_LEN - len,
                 "dcu_arb state:      %2x    dcu_fp state:           %2x\n",
                 (val[5] & 0x06000000) >> 25, (val[5] & 0x38000000) >> 27);
-        len += snprintf(buf + len, sizeof(buf) - len,
+        len += snprintf(buf + len, DMA_BUF_LEN - len,
                 "chan_idle_dur:     %3d    chan_idle_dur_valid:     %1d\n",
                 (val[6] & 0x000003fc) >> 2, (val[6] & 0x00000400) >> 10);
-        len += snprintf(buf + len, sizeof(buf) - len,
+        len += snprintf(buf + len, DMA_BUF_LEN - len,
                 "txfifo_valid_0:      %1d    txfifo_valid_1:          %1d\n",
                 (val[6] & 0x00000800) >> 11, (val[6] & 0x00001000) >> 12);
-        len += snprintf(buf + len, sizeof(buf) - len,
+        len += snprintf(buf + len, DMA_BUF_LEN - len,
                 "txfifo_dcu_num_0:   %2d    txfifo_dcu_num_1:       %2d\n",
                 (val[6] & 0x0001e000) >> 13, (val[6] & 0x001e0000) >> 17);
 
-        len += snprintf(buf + len, sizeof(buf) - len, "pcu observe: 0x%x \n",
-                        REG_READ(ah, AR_OBS_BUS_1));
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "AR_CR: 0x%x \n", REG_READ(ah, AR_CR));
+        len += snprintf(buf + len, DMA_BUF_LEN - len, "pcu observe: 0x%x \n",
+                        REG_READ_D(ah, AR_OBS_BUS_1));
+        len += snprintf(buf + len, DMA_BUF_LEN - len,
+                        "AR_CR: 0x%x \n", REG_READ_D(ah, AR_CR));
 
         ath9k_ps_restore(sc);
 
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+        return retval;
 }
 
 static const struct file_operations fops_dma = {
@@ -266,18 +269,11 @@ static const struct file_operations fops_interrupt = {
         .owner = THIS_MODULE
 };
 
-void ath_debug_stat_rc(struct ath_softc *sc, struct sk_buff *skb)
+void ath_debug_stat_rc(struct ath_softc *sc, int final_rate)
 {
-        struct ath_tx_info_priv *tx_info_priv = NULL;
-        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_tx_rate *rates = tx_info->status.rates;
-        int final_ts_idx, idx;
         struct ath_rc_stats *stats;
 
-        tx_info_priv = ATH_TX_INFO_PRIV(tx_info);
-        final_ts_idx = tx_info_priv->tx.ts_rateindex;
-        idx = rates[final_ts_idx].idx;
-        stats = &sc->debug.stats.rcstats[idx];
+        stats = &sc->debug.stats.rcstats[final_rate];
         stats->success++;
 }
 
@@ -303,23 +299,49 @@ static ssize_t read_file_rcstat(struct file *file, char __user *user_buf,
         if (sc->cur_rate_table == NULL)
                 return 0;
 
-        max = 80 + sc->cur_rate_table->rate_cnt * 64;
+        max = 80 + sc->cur_rate_table->rate_cnt * 1024;
         buf = kmalloc(max + 1, GFP_KERNEL);
         if (buf == NULL)
                 return 0;
         buf[max] = 0;
 
-        len += sprintf(buf, "%5s %15s %8s %9s %3s\n\n", "Rate", "Success",
-                       "Retries", "XRetries", "PER");
+        len += sprintf(buf, "%6s %6s %6s "
+                       "%10s %10s %10s %10s\n",
+                       "HT", "MCS", "Rate",
+                       "Success", "Retries", "XRetries", "PER");
 
         for (i = 0; i < sc->cur_rate_table->rate_cnt; i++) {
                 u32 ratekbps = sc->cur_rate_table->info[i].ratekbps;
                 struct ath_rc_stats *stats = &sc->debug.stats.rcstats[i];
+                char mcs[5];
+                char htmode[5];
+                int used_mcs = 0, used_htmode = 0;
+
+                if (WLAN_RC_PHY_HT(sc->cur_rate_table->info[i].phy)) {
+                        used_mcs = snprintf(mcs, 5, "%d",
+                                sc->cur_rate_table->info[i].ratecode);
+
+                        if (WLAN_RC_PHY_40(sc->cur_rate_table->info[i].phy))
+                                used_htmode = snprintf(htmode, 5, "HT40");
+                        else if (WLAN_RC_PHY_20(sc->cur_rate_table->info[i].phy))
+                                used_htmode = snprintf(htmode, 5, "HT20");
+                        else
+                                used_htmode = snprintf(htmode, 5, "????");
+                }
+
+                mcs[used_mcs] = '\0';
+                htmode[used_htmode] = '\0';
 
                 len += snprintf(buf + len, max - len,
-                        "%3u.%d: %8u %8u %8u %8u\n", ratekbps / 1000,
-                        (ratekbps % 1000) / 100, stats->success,
-                        stats->retries, stats->xretries,
+                        "%6s %6s %3u.%d: "
+                        "%10u %10u %10u %10u\n",
+                        htmode,
+                        mcs,
+                        ratekbps / 1000,
+                        (ratekbps % 1000) / 100,
+                        stats->success,
+                        stats->retries,
+                        stats->xretries,
                         stats->per);
         }
 
@@ -376,12 +398,12 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
                                 aphy->chan_idx, aphy->chan_is_ht);
         }
 
-        put_unaligned_le32(REG_READ(sc->sc_ah, AR_STA_ID0), addr);
-        put_unaligned_le16(REG_READ(sc->sc_ah, AR_STA_ID1) & 0xffff, addr + 4);
+        put_unaligned_le32(REG_READ_D(sc->sc_ah, AR_STA_ID0), addr);
+        put_unaligned_le16(REG_READ_D(sc->sc_ah, AR_STA_ID1) & 0xffff, addr + 4);
         len += snprintf(buf + len, sizeof(buf) - len,
                         "addr: %pM\n", addr);
-        put_unaligned_le32(REG_READ(sc->sc_ah, AR_BSSMSKL), addr);
-        put_unaligned_le16(REG_READ(sc->sc_ah, AR_BSSMSKU) & 0xffff, addr + 4);
+        put_unaligned_le32(REG_READ_D(sc->sc_ah, AR_BSSMSKL), addr);
+        put_unaligned_le16(REG_READ_D(sc->sc_ah, AR_BSSMSKU) & 0xffff, addr + 4);
         len += snprintf(buf + len, sizeof(buf) - len,
                         "addrmask: %pM\n", addr);
 
@@ -568,9 +590,120 @@ static const struct file_operations fops_xmit = {
         .owner = THIS_MODULE
 };
 
-int ath9k_init_debug(struct ath_softc *sc)
+static ssize_t read_file_recv(struct file *file, char __user *user_buf,
+                              size_t count, loff_t *ppos)
 {
-        sc->debug.debug_mask = ath9k_debug;
+#define PHY_ERR(s, p) \
+        len += snprintf(buf + len, size - len, "%18s : %10u\n", s, \
+                        sc->debug.stats.rxstats.phy_err_stats[p]);
+
+        struct ath_softc *sc = file->private_data;
+        char *buf;
+        unsigned int len = 0, size = 1152;
+        ssize_t retval = 0;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return 0;
+
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10u\n", "CRC ERR",
+                        sc->debug.stats.rxstats.crc_err);
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10u\n", "DECRYPT CRC ERR",
+                        sc->debug.stats.rxstats.decrypt_crc_err);
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10u\n", "PHY ERR",
+                        sc->debug.stats.rxstats.phy_err);
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10u\n", "MIC ERR",
+                        sc->debug.stats.rxstats.mic_err);
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10u\n", "PRE-DELIM CRC ERR",
+                        sc->debug.stats.rxstats.pre_delim_crc_err);
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10u\n", "POST-DELIM CRC ERR",
+                        sc->debug.stats.rxstats.post_delim_crc_err);
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10u\n", "DECRYPT BUSY ERR",
+                        sc->debug.stats.rxstats.decrypt_busy_err);
+
+        PHY_ERR("UNDERRUN", ATH9K_PHYERR_UNDERRUN);
+        PHY_ERR("TIMING", ATH9K_PHYERR_TIMING);
+        PHY_ERR("PARITY", ATH9K_PHYERR_PARITY);
+        PHY_ERR("RATE", ATH9K_PHYERR_RATE);
+        PHY_ERR("LENGTH", ATH9K_PHYERR_LENGTH);
+        PHY_ERR("RADAR", ATH9K_PHYERR_RADAR);
+        PHY_ERR("SERVICE", ATH9K_PHYERR_SERVICE);
+        PHY_ERR("TOR", ATH9K_PHYERR_TOR);
+        PHY_ERR("OFDM-TIMING", ATH9K_PHYERR_OFDM_TIMING);
+        PHY_ERR("OFDM-SIGNAL-PARITY", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
+        PHY_ERR("OFDM-RATE", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
+        PHY_ERR("OFDM-LENGTH", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
+        PHY_ERR("OFDM-POWER-DROP", ATH9K_PHYERR_OFDM_POWER_DROP);
+        PHY_ERR("OFDM-SERVICE", ATH9K_PHYERR_OFDM_SERVICE);
+        PHY_ERR("OFDM-RESTART", ATH9K_PHYERR_OFDM_RESTART);
+        PHY_ERR("FALSE-RADAR-EXT", ATH9K_PHYERR_FALSE_RADAR_EXT);
+        PHY_ERR("CCK-TIMING", ATH9K_PHYERR_CCK_TIMING);
+        PHY_ERR("CCK-HEADER-CRC", ATH9K_PHYERR_CCK_HEADER_CRC);
+        PHY_ERR("CCK-RATE", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
+        PHY_ERR("CCK-SERVICE", ATH9K_PHYERR_CCK_SERVICE);
+        PHY_ERR("CCK-RESTART", ATH9K_PHYERR_CCK_RESTART);
+        PHY_ERR("CCK-LENGTH", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
+        PHY_ERR("CCK-POWER-DROP", ATH9K_PHYERR_CCK_POWER_DROP);
+        PHY_ERR("HT-CRC", ATH9K_PHYERR_HT_CRC_ERROR);
+        PHY_ERR("HT-LENGTH", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
+        PHY_ERR("HT-RATE", ATH9K_PHYERR_HT_RATE_ILLEGAL);
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+
+#undef PHY_ERR
+}
+
+void ath_debug_stat_rx(struct ath_softc *sc, struct ath_buf *bf)
+{
+#define RX_STAT_INC(c) sc->debug.stats.rxstats.c++
+#define RX_PHY_ERR_INC(c) sc->debug.stats.rxstats.phy_err_stats[c]++
+
+        struct ath_desc *ds = bf->bf_desc;
+        u32 phyerr;
+
+        if (ds->ds_rxstat.rs_status & ATH9K_RXERR_CRC)
+                RX_STAT_INC(crc_err);
+        if (ds->ds_rxstat.rs_status & ATH9K_RXERR_DECRYPT)
+                RX_STAT_INC(decrypt_crc_err);
+        if (ds->ds_rxstat.rs_status & ATH9K_RXERR_MIC)
+                RX_STAT_INC(mic_err);
+        if (ds->ds_rxstat.rs_status & ATH9K_RX_DELIM_CRC_PRE)
+                RX_STAT_INC(pre_delim_crc_err);
+        if (ds->ds_rxstat.rs_status & ATH9K_RX_DELIM_CRC_POST)
+                RX_STAT_INC(post_delim_crc_err);
+        if (ds->ds_rxstat.rs_status & ATH9K_RX_DECRYPT_BUSY)
+                RX_STAT_INC(decrypt_busy_err);
+
+        if (ds->ds_rxstat.rs_status & ATH9K_RXERR_PHY) {
+                RX_STAT_INC(phy_err);
+                phyerr = ds->ds_rxstat.rs_phyerr & 0x24;
+                RX_PHY_ERR_INC(phyerr);
+        }
+
+#undef RX_STAT_INC
+#undef RX_PHY_ERR_INC
+}
+
+static const struct file_operations fops_recv = {
+        .read = read_file_recv,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE
+};
+
+int ath9k_init_debug(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
 
         if (!ath9k_debugfs_root)
                 return -ENOENT;
@@ -580,10 +713,12 @@ int ath9k_init_debug(struct ath_softc *sc)
         if (!sc->debug.debugfs_phy)
                 goto err;
 
+#ifdef CONFIG_ATH_DEBUG
         sc->debug.debugfs_debug = debugfs_create_file("debug",
                 S_IRUSR | S_IWUSR, sc->debug.debugfs_phy, sc, &fops_debug);
         if (!sc->debug.debugfs_debug)
                 goto err;
+#endif
 
         sc->debug.debugfs_dma = debugfs_create_file("dma", S_IRUSR,
                                        sc->debug.debugfs_phy, sc, &fops_dma);
@@ -617,14 +752,25 @@ int ath9k_init_debug(struct ath_softc *sc)
         if (!sc->debug.debugfs_xmit)
                 goto err;
 
+        sc->debug.debugfs_recv = debugfs_create_file("recv",
+                                                     S_IRUSR,
+                                                     sc->debug.debugfs_phy,
+                                                     sc, &fops_recv);
+        if (!sc->debug.debugfs_recv)
+                goto err;
+
         return 0;
 err:
-        ath9k_exit_debug(sc);
+        ath9k_exit_debug(ah);
         return -ENOMEM;
 }
 
-void ath9k_exit_debug(struct ath_softc *sc)
+void ath9k_exit_debug(struct ath_hw *ah)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
+
+        debugfs_remove(sc->debug.debugfs_recv);
         debugfs_remove(sc->debug.debugfs_xmit);
         debugfs_remove(sc->debug.debugfs_wiphy);
         debugfs_remove(sc->debug.debugfs_rcstat);
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 7241f4748338..86780e68b31e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -17,36 +17,19 @@
 #ifndef DEBUG_H
 #define DEBUG_H
 
-enum ATH_DEBUG {
-        ATH_DBG_RESET           = 0x00000001,
-        ATH_DBG_QUEUE           = 0x00000002,
-        ATH_DBG_EEPROM          = 0x00000004,
-        ATH_DBG_CALIBRATE       = 0x00000008,
-        ATH_DBG_INTERRUPT       = 0x00000010,
-        ATH_DBG_REGULATORY      = 0x00000020,
-        ATH_DBG_ANI             = 0x00000040,
-        ATH_DBG_XMIT            = 0x00000080,
-        ATH_DBG_BEACON          = 0x00000100,
-        ATH_DBG_CONFIG          = 0x00000200,
-        ATH_DBG_FATAL           = 0x00000400,
-        ATH_DBG_PS              = 0x00000800,
-        ATH_DBG_HWTIMER         = 0x00001000,
-        ATH_DBG_BTCOEX          = 0x00002000,
-        ATH_DBG_ANY             = 0xffffffff
-};
-
-#define DBG_DEFAULT (ATH_DBG_FATAL)
+#include "hw.h"
+#include "rc.h"
 
 struct ath_txq;
 struct ath_buf;
 
-#ifdef CONFIG_ATH9K_DEBUG
+#ifdef CONFIG_ATH9K_DEBUGFS
 #define TX_STAT_INC(q, c) sc->debug.stats.txstats[q].c++
 #else
 #define TX_STAT_INC(q, c) do { } while (0)
 #endif
 
-#ifdef CONFIG_ATH9K_DEBUG
+#ifdef CONFIG_ATH9K_DEBUGFS
 
 /**
  * struct ath_interrupt_stats - Contains statistics about interrupts
@@ -133,14 +116,38 @@ struct ath_tx_stats {
         u32 delim_underrun;
 };
 
+/**
+ * struct ath_rx_stats - RX Statistics
+ * @crc_err: No. of frames with incorrect CRC value
+ * @decrypt_crc_err: No. of frames whose CRC check failed after
+        decryption process completed
+ * @phy_err: No. of frames whose reception failed because the PHY
+        encountered an error
+ * @mic_err: No. of frames with incorrect TKIP MIC verification failure
+ * @pre_delim_crc_err: Pre-Frame delimiter CRC error detections
+ * @post_delim_crc_err: Post-Frame delimiter CRC error detections
+ * @decrypt_busy_err: Decryption interruptions counter
+ * @phy_err_stats: Individual PHY error statistics
+ */
+struct ath_rx_stats {
+        u32 crc_err;
+        u32 decrypt_crc_err;
+        u32 phy_err;
+        u32 mic_err;
+        u32 pre_delim_crc_err;
+        u32 post_delim_crc_err;
+        u32 decrypt_busy_err;
+        u32 phy_err_stats[ATH9K_PHYERR_MAX];
+};
+
 struct ath_stats {
         struct ath_interrupt_stats istats;
         struct ath_rc_stats rcstats[RATE_TABLE_SIZE];
         struct ath_tx_stats txstats[ATH9K_NUM_TX_QUEUES];
+        struct ath_rx_stats rxstats;
 };
 
 struct ath9k_debug {
-        int debug_mask;
         struct dentry *debugfs_phy;
         struct dentry *debugfs_debug;
         struct dentry *debugfs_dma;
@@ -148,34 +155,31 @@ struct ath9k_debug {
         struct dentry *debugfs_rcstat;
         struct dentry *debugfs_wiphy;
         struct dentry *debugfs_xmit;
+        struct dentry *debugfs_recv;
         struct ath_stats stats;
 };
 
-void DPRINTF(struct ath_softc *sc, int dbg_mask, const char *fmt, ...);
-int ath9k_init_debug(struct ath_softc *sc);
-void ath9k_exit_debug(struct ath_softc *sc);
+int ath9k_init_debug(struct ath_hw *ah);
+void ath9k_exit_debug(struct ath_hw *ah);
+
 int ath9k_debug_create_root(void);
 void ath9k_debug_remove_root(void);
 void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status);
-void ath_debug_stat_rc(struct ath_softc *sc, struct sk_buff *skb);
+void ath_debug_stat_rc(struct ath_softc *sc, int final_rate);
 void ath_debug_stat_tx(struct ath_softc *sc, struct ath_txq *txq,
                        struct ath_buf *bf);
+void ath_debug_stat_rx(struct ath_softc *sc, struct ath_buf *bf);
 void ath_debug_stat_retries(struct ath_softc *sc, int rix,
                             int xretries, int retries, u8 per);
 
 #else
 
-static inline void DPRINTF(struct ath_softc *sc, int dbg_mask,
-                           const char *fmt, ...)
-{
-}
-
-static inline int ath9k_init_debug(struct ath_softc *sc)
+static inline int ath9k_init_debug(struct ath_hw *ah)
 {
         return 0;
 }
 
-static inline void ath9k_exit_debug(struct ath_softc *sc)
+static inline void ath9k_exit_debug(struct ath_hw *ah)
 {
 }
 
@@ -194,7 +198,7 @@ static inline void ath_debug_stat_interrupt(struct ath_softc *sc,
 }
 
 static inline void ath_debug_stat_rc(struct ath_softc *sc,
-                                     struct sk_buff *skb)
+                                     int final_rate)
 {
 }
 
@@ -204,11 +208,16 @@ static inline void ath_debug_stat_tx(struct ath_softc *sc,
 {
 }
 
+static inline void ath_debug_stat_rx(struct ath_softc *sc,
+                                     struct ath_buf *bf)
+{
+}
+
 static inline void ath_debug_stat_retries(struct ath_softc *sc, int rix,
                                           int xretries, int retries, u8 per)
 {
 }
 
-#endif /* CONFIG_ATH9K_DEBUG */
+#endif /* CONFIG_ATH9K_DEBUGFS */
 
 #endif /* DEBUG_H */
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index b6e52d0f8c48..dacaae934148 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include "ath9k.h"
+#include "hw.h"
 
 static inline u16 ath9k_hw_fbin2freq(u8 fbin, bool is2GHz)
 {
@@ -83,11 +83,9 @@ bool ath9k_hw_get_lower_upper_index(u8 target, u8 *pList, u16 listSize,
         return false;
 }
 
-bool ath9k_hw_nvram_read(struct ath_hw *ah, u32 off, u16 *data)
+bool ath9k_hw_nvram_read(struct ath_common *common, u32 off, u16 *data)
 {
-        struct ath_softc *sc = ah->ah_sc;
-
-        return sc->bus_ops->eeprom_read(ah, off, data);
+        return common->bus_ops->eeprom_read(common, off, data);
 }
 
 void ath9k_hw_fill_vpd_table(u8 pwrMin, u8 pwrMax, u8 *pPwrList,
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index 4fe33f7eee9d..2f2993b50e2f 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -17,6 +17,7 @@
 #ifndef EEPROM_H
 #define EEPROM_H
 
+#include "../ath.h"
 #include <net/cfg80211.h>
 
 #define AH_USE_EEPROM   0x1
@@ -133,6 +134,7 @@
 #define AR5416_EEP_MINOR_VER_17      0x11
 #define AR5416_EEP_MINOR_VER_19      0x13
 #define AR5416_EEP_MINOR_VER_20      0x14
+#define AR5416_EEP_MINOR_VER_21      0x15
 #define AR5416_EEP_MINOR_VER_22      0x16
 
 #define AR5416_NUM_5G_CAL_PIERS         8
@@ -153,7 +155,7 @@
 #define AR5416_BCHAN_UNUSED             0xFF
 #define AR5416_MAX_PWR_RANGE_IN_HALF_DB 64
 #define AR5416_MAX_CHAINS               3
-#define AR5416_PWR_TABLE_OFFSET         -5
+#define AR5416_PWR_TABLE_OFFSET_DB     -5
 
 /* Rx gain type values */
 #define AR5416_EEP_RXGAIN_23DB_BACKOFF     0
@@ -301,7 +303,7 @@ struct base_eep_header {
         u8 txGainType;
         u8 rcChainMask;
         u8 desiredScaleCCK;
-        u8 power_table_offset;
+        u8 pwr_table_offset;
         u8 frac_n_5g;
         u8 futureBase_3[21];
 } __packed;
@@ -638,6 +640,7 @@ struct ar9287_eeprom {
 } __packed;
 
 enum reg_ext_bitmap {
+        REG_EXT_FCC_MIDBAND = 0,
         REG_EXT_JAPAN_MIDBAND = 1,
         REG_EXT_FCC_DFS_HT40 = 2,
         REG_EXT_JAPAN_NONDFS_HT40 = 3,
@@ -684,7 +687,7 @@ int16_t ath9k_hw_interpolate(u16 target, u16 srcLeft, u16 srcRight,
                              int16_t targetRight);
 bool ath9k_hw_get_lower_upper_index(u8 target, u8 *pList, u16 listSize,
                                     u16 *indexL, u16 *indexR);
-bool ath9k_hw_nvram_read(struct ath_hw *ah, u32 off, u16 *data);
+bool ath9k_hw_nvram_read(struct ath_common *common, u32 off, u16 *data);
 void ath9k_hw_fill_vpd_table(u8 pwrMin, u8 pwrMax, u8 *pPwrList,
                              u8 *pVpdList, u16 numIntercepts,
                              u8 *pRetVpdList);
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index b8eca7be5f3a..68db16690abf 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include "ath9k.h"
+#include "hw.h"
 
 static int ath9k_hw_4k_get_eeprom_ver(struct ath_hw *ah)
 {
@@ -29,20 +29,21 @@ static int ath9k_hw_4k_get_eeprom_rev(struct ath_hw *ah)
 static bool ath9k_hw_4k_fill_eeprom(struct ath_hw *ah)
 {
 #define SIZE_EEPROM_4K (sizeof(struct ar5416_eeprom_4k) / sizeof(u16))
+        struct ath_common *common = ath9k_hw_common(ah);
         u16 *eep_data = (u16 *)&ah->eeprom.map4k;
         int addr, eep_start_loc = 0;
 
         eep_start_loc = 64;
 
         if (!ath9k_hw_use_flash(ah)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "Reading from EEPROM, not flash\n");
+                ath_print(common, ATH_DBG_EEPROM,
+                          "Reading from EEPROM, not flash\n");
         }
 
         for (addr = 0; addr < SIZE_EEPROM_4K; addr++) {
-                if (!ath9k_hw_nvram_read(ah, addr + eep_start_loc, eep_data)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                               "Unable to read eeprom region \n");
+                if (!ath9k_hw_nvram_read(common, addr + eep_start_loc, eep_data)) {
+                        ath_print(common, ATH_DBG_EEPROM,
+                                  "Unable to read eeprom region \n");
                         return false;
                 }
                 eep_data++;
@@ -55,6 +56,7 @@ static bool ath9k_hw_4k_fill_eeprom(struct ath_hw *ah)
 static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
 {
 #define EEPROM_4K_SIZE (sizeof(struct ar5416_eeprom_4k) / sizeof(u16))
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ar5416_eeprom_4k *eep =
                 (struct ar5416_eeprom_4k *) &ah->eeprom.map4k;
         u16 *eepdata, temp, magic, magic2;
@@ -64,15 +66,15 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
 
 
         if (!ath9k_hw_use_flash(ah)) {
-                if (!ath9k_hw_nvram_read(ah, AR5416_EEPROM_MAGIC_OFFSET,
+                if (!ath9k_hw_nvram_read(common, AR5416_EEPROM_MAGIC_OFFSET,
                                          &magic)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "Reading Magic # failed\n");
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "Reading Magic # failed\n");
                         return false;
                 }
 
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "Read Magic = 0x%04X\n", magic);
+                ath_print(common, ATH_DBG_EEPROM,
+                          "Read Magic = 0x%04X\n", magic);
 
                 if (magic != AR5416_EEPROM_MAGIC) {
                         magic2 = swab16(magic);
@@ -87,16 +89,16 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
                                         eepdata++;
                                 }
                         } else {
-                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                        "Invalid EEPROM Magic. "
-                                        "endianness mismatch.\n");
+                                ath_print(common, ATH_DBG_FATAL,
+                                          "Invalid EEPROM Magic. "
+                                          "endianness mismatch.\n");
                                 return -EINVAL;
                         }
                 }
         }
 
-        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM, "need_swap = %s.\n",
-                need_swap ? "True" : "False");
+        ath_print(common, ATH_DBG_EEPROM, "need_swap = %s.\n",
+                  need_swap ? "True" : "False");
 
         if (need_swap)
                 el = swab16(ah->eeprom.map4k.baseEepHeader.length);
@@ -117,8 +119,8 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
                 u32 integer;
                 u16 word;
 
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "EEPROM Endianness is not native.. Changing\n");
+                ath_print(common, ATH_DBG_EEPROM,
+                          "EEPROM Endianness is not native.. Changing\n");
 
                 word = swab16(eep->baseEepHeader.length);
                 eep->baseEepHeader.length = word;
@@ -160,9 +162,9 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
 
         if (sum != 0xffff || ah->eep_ops->get_eeprom_ver(ah) != AR5416_EEP_VER ||
             ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_NO_BACK_VER) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
-                        sum, ah->eep_ops->get_eeprom_ver(ah));
+                ath_print(common, ATH_DBG_FATAL,
+                          "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
+                          sum, ah->eep_ops->get_eeprom_ver(ah));
                 return -EINVAL;
         }
 
@@ -208,6 +210,8 @@ static u32 ath9k_hw_4k_get_eeprom(struct ath_hw *ah,
                 return pBase->rxMask;
         case EEP_FRAC_N_5G:
                 return 0;
+        case EEP_PWR_TABLE_OFFSET:
+                return AR5416_PWR_TABLE_OFFSET_DB;
         default:
                 return 0;
         }
@@ -385,6 +389,7 @@ static void ath9k_hw_set_4k_power_cal_table(struct ath_hw *ah,
                                   struct ath9k_channel *chan,
                                   int16_t *pTxPowerIndexOffset)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ar5416_eeprom_4k *pEepData = &ah->eeprom.map4k;
         struct cal_data_per_freq_4k *pRawDataset;
         u8 *pCalBChans = NULL;
@@ -470,21 +475,21 @@ static void ath9k_hw_set_4k_power_cal_table(struct ath_hw *ah,
                                         ((pdadcValues[4 * j + 3] & 0xFF) << 24);
                                 REG_WRITE(ah, regOffset, reg32);
 
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "PDADC (%d,%4x): %4.4x %8.8x\n",
-                                        i, regChainOffset, regOffset,
-                                        reg32);
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "PDADC: Chain %d | "
-                                        "PDADC %3d Value %3d | "
-                                        "PDADC %3d Value %3d | "
-                                        "PDADC %3d Value %3d | "
-                                        "PDADC %3d Value %3d |\n",
-                                        i, 4 * j, pdadcValues[4 * j],
-                                        4 * j + 1, pdadcValues[4 * j + 1],
-                                        4 * j + 2, pdadcValues[4 * j + 2],
-                                        4 * j + 3,
-                                        pdadcValues[4 * j + 3]);
+                                ath_print(common, ATH_DBG_EEPROM,
+                                          "PDADC (%d,%4x): %4.4x %8.8x\n",
+                                          i, regChainOffset, regOffset,
+                                          reg32);
+                                ath_print(common, ATH_DBG_EEPROM,
+                                          "PDADC: Chain %d | "
+                                          "PDADC %3d Value %3d | "
+                                          "PDADC %3d Value %3d | "
+                                          "PDADC %3d Value %3d | "
+                                          "PDADC %3d Value %3d |\n",
+                                          i, 4 * j, pdadcValues[4 * j],
+                                          4 * j + 1, pdadcValues[4 * j + 1],
+                                          4 * j + 2, pdadcValues[4 * j + 2],
+                                          4 * j + 3,
+                                          pdadcValues[4 * j + 3]);
 
                                 regOffset += 4;
                         }
@@ -750,7 +755,7 @@ static void ath9k_hw_4k_set_txpower(struct ath_hw *ah,
 
         if (AR_SREV_9280_10_OR_LATER(ah)) {
                 for (i = 0; i < Ar5416RateSize; i++)
-                        ratesArray[i] -= AR5416_PWR_TABLE_OFFSET * 2;
+                        ratesArray[i] -= AR5416_PWR_TABLE_OFFSET_DB * 2;
         }
 
         /* OFDM power per rate */
@@ -1107,6 +1112,10 @@ static void ath9k_hw_4k_set_board_values(struct ath_hw *ah,
 
         REG_RMW_FIELD(ah, AR_PHY_RF_CTL3, AR_PHY_TX_END_TO_A2_RX_ON,
                       pModal->txEndToRxOn);
+
+        if (AR_SREV_9271_10(ah))
+                REG_RMW_FIELD(ah, AR_PHY_RF_CTL3, AR_PHY_TX_END_TO_A2_RX_ON,
+                              pModal->txEndToRxOn);
         REG_RMW_FIELD(ah, AR_PHY_CCA, AR9280_PHY_CCA_THRESH62,
                       pModal->thresh62);
         REG_RMW_FIELD(ah, AR_PHY_EXT_CCA0, AR_PHY_EXT_CCA0_THRESH62,
@@ -1148,20 +1157,21 @@ static u16 ath9k_hw_4k_get_spur_channel(struct ath_hw *ah, u16 i, bool is2GHz)
 {
 #define EEP_MAP4K_SPURCHAN \
         (ah->eeprom.map4k.modalHeader.spurChans[i].spurChan)
+        struct ath_common *common = ath9k_hw_common(ah);
 
         u16 spur_val = AR_NO_SPUR;
 
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                "Getting spur idx %d is2Ghz. %d val %x\n",
-                i, is2GHz, ah->config.spurchans[i][is2GHz]);
+        ath_print(common, ATH_DBG_ANI,
+                  "Getting spur idx %d is2Ghz. %d val %x\n",
+                  i, is2GHz, ah->config.spurchans[i][is2GHz]);
 
         switch (ah->config.spurmode) {
         case SPUR_DISABLE:
                 break;
         case SPUR_ENABLE_IOCTL:
                 spur_val = ah->config.spurchans[i][is2GHz];
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                        "Getting spur val from new loc. %d\n", spur_val);
+                ath_print(common, ATH_DBG_ANI,
+                          "Getting spur val from new loc. %d\n", spur_val);
                 break;
         case SPUR_ENABLE_EEPROM:
                 spur_val = EEP_MAP4K_SPURCHAN;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index c20c21a79b21..839d05a1df29 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include "ath9k.h"
+#include "hw.h"
 
 static int ath9k_hw_AR9287_get_eeprom_ver(struct ath_hw *ah)
 {
@@ -29,20 +29,22 @@ static int ath9k_hw_AR9287_get_eeprom_rev(struct ath_hw *ah)
 static bool ath9k_hw_AR9287_fill_eeprom(struct ath_hw *ah)
 {
         struct ar9287_eeprom *eep = &ah->eeprom.map9287;
+        struct ath_common *common = ath9k_hw_common(ah);
         u16 *eep_data;
         int addr, eep_start_loc = AR9287_EEP_START_LOC;
         eep_data = (u16 *)eep;
 
         if (!ath9k_hw_use_flash(ah)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "Reading from EEPROM, not flash\n");
+                ath_print(common, ATH_DBG_EEPROM,
+                          "Reading from EEPROM, not flash\n");
         }
 
         for (addr = 0; addr < sizeof(struct ar9287_eeprom) / sizeof(u16);
                         addr++) {
-                if (!ath9k_hw_nvram_read(ah, addr + eep_start_loc, eep_data)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                "Unable to read eeprom region \n");
+                if (!ath9k_hw_nvram_read(common,
+                                         addr + eep_start_loc, eep_data)) {
+                        ath_print(common, ATH_DBG_EEPROM,
+                                  "Unable to read eeprom region \n");
                         return false;
                 }
                 eep_data++;
@@ -57,17 +59,18 @@ static int ath9k_hw_AR9287_check_eeprom(struct ath_hw *ah)
         int i, addr;
         bool need_swap = false;
         struct ar9287_eeprom *eep = &ah->eeprom.map9287;
+        struct ath_common *common = ath9k_hw_common(ah);
 
         if (!ath9k_hw_use_flash(ah)) {
-                if (!ath9k_hw_nvram_read
-                    (ah, AR5416_EEPROM_MAGIC_OFFSET, &magic)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "Reading Magic # failed\n");
+                if (!ath9k_hw_nvram_read(common,
+                                         AR5416_EEPROM_MAGIC_OFFSET, &magic)) {
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "Reading Magic # failed\n");
                         return false;
                 }
 
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                "Read Magic = 0x%04X\n", magic);
+                ath_print(common, ATH_DBG_EEPROM,
+                          "Read Magic = 0x%04X\n", magic);
                 if (magic != AR5416_EEPROM_MAGIC) {
                         magic2 = swab16(magic);
 
@@ -83,15 +86,15 @@ static int ath9k_hw_AR9287_check_eeprom(struct ath_hw *ah)
                                         eepdata++;
                                 }
                         } else {
-                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                        "Invalid EEPROM Magic. "
-                                        "endianness mismatch.\n");
+                                ath_print(common, ATH_DBG_FATAL,
+                                          "Invalid EEPROM Magic. "
+                                          "endianness mismatch.\n");
                                 return -EINVAL;
                         }
                 }
         }
-        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM, "need_swap = %s.\n", need_swap ?
-                "True" : "False");
+        ath_print(common, ATH_DBG_EEPROM, "need_swap = %s.\n", need_swap ?
+                  "True" : "False");
 
         if (need_swap)
                 el = swab16(ah->eeprom.map9287.baseEepHeader.length);
@@ -148,9 +151,9 @@ static int ath9k_hw_AR9287_check_eeprom(struct ath_hw *ah)
 
         if (sum != 0xffff || ah->eep_ops->get_eeprom_ver(ah) != AR9287_EEP_VER
             || ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_NO_BACK_VER) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
-                         sum, ah->eep_ops->get_eeprom_ver(ah));
+                ath_print(common, ATH_DBG_FATAL,
+                          "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
+                           sum, ah->eep_ops->get_eeprom_ver(ah));
                 return -EINVAL;
         }
 
@@ -436,6 +439,7 @@ static void ath9k_hw_set_AR9287_power_cal_table(struct ath_hw *ah,
                                                 struct ath9k_channel *chan,
                                                 int16_t *pTxPowerIndexOffset)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         struct cal_data_per_freq_ar9287 *pRawDataset;
         struct cal_data_op_loop_ar9287 *pRawDatasetOpenLoop;
         u8  *pCalBChans = NULL;
@@ -564,24 +568,25 @@ static void ath9k_hw_set_AR9287_power_cal_table(struct ath_hw *ah,
                                                   & 0xFF) << 24) ;
                                         REG_WRITE(ah, regOffset, reg32);
 
-                                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                                "PDADC (%d,%4x): %4.4x %8.8x\n",
-                                                i, regChainOffset, regOffset,
-                                                reg32);
-
-                                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                                "PDADC: Chain %d | "
-                                                "PDADC %3d Value %3d | "
-                                                "PDADC %3d Value %3d | "
-                                                "PDADC %3d Value %3d | "
-                                                "PDADC %3d Value %3d |\n",
-                                                i, 4 * j, pdadcValues[4 * j],
-                                                4 * j + 1,
-                                                pdadcValues[4 * j + 1],
-                                                4 * j + 2,
-                                                pdadcValues[4 * j + 2],
-                                                4 * j + 3,
-                                                pdadcValues[4 * j + 3]);
+                                        ath_print(common, ATH_DBG_EEPROM,
+                                                  "PDADC (%d,%4x): %4.4x "
+                                                  "%8.8x\n",
+                                                  i, regChainOffset, regOffset,
+                                                  reg32);
+
+                                        ath_print(common, ATH_DBG_EEPROM,
+                                                  "PDADC: Chain %d | "
+                                                  "PDADC %3d Value %3d | "
+                                                  "PDADC %3d Value %3d | "
+                                                  "PDADC %3d Value %3d | "
+                                                  "PDADC %3d Value %3d |\n",
+                                                  i, 4 * j, pdadcValues[4 * j],
+                                                  4 * j + 1,
+                                                  pdadcValues[4 * j + 1],
+                                                  4 * j + 2,
+                                                  pdadcValues[4 * j + 2],
+                                                  4 * j + 3,
+                                                  pdadcValues[4 * j + 3]);
 
                                         regOffset += 4;
                                 }
@@ -831,6 +836,7 @@ static void ath9k_hw_AR9287_set_txpower(struct ath_hw *ah,
 {
 #define INCREASE_MAXPOW_BY_TWO_CHAIN     6
 #define INCREASE_MAXPOW_BY_THREE_CHAIN   10
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
         struct ar9287_eeprom *pEepData = &ah->eeprom.map9287;
         struct modal_eep_ar9287_header *pModal = &pEepData->modalHeader;
@@ -966,8 +972,8 @@ static void ath9k_hw_AR9287_set_txpower(struct ath_hw *ah,
                         INCREASE_MAXPOW_BY_THREE_CHAIN;
                 break;
         default:
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "Invalid chainmask configuration\n");
+                ath_print(common, ATH_DBG_EEPROM,
+                          "Invalid chainmask configuration\n");
                 break;
         }
 }
@@ -1138,19 +1144,20 @@ static u16 ath9k_hw_AR9287_get_spur_channel(struct ath_hw *ah,
 {
 #define EEP_MAP9287_SPURCHAN \
         (ah->eeprom.map9287.modalHeader.spurChans[i].spurChan)
+        struct ath_common *common = ath9k_hw_common(ah);
         u16 spur_val = AR_NO_SPUR;
 
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                "Getting spur idx %d is2Ghz. %d val %x\n",
-                i, is2GHz, ah->config.spurchans[i][is2GHz]);
+        ath_print(common, ATH_DBG_ANI,
+                  "Getting spur idx %d is2Ghz. %d val %x\n",
+                  i, is2GHz, ah->config.spurchans[i][is2GHz]);
 
         switch (ah->config.spurmode) {
         case SPUR_DISABLE:
                 break;
         case SPUR_ENABLE_IOCTL:
                 spur_val = ah->config.spurchans[i][is2GHz];
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                       "Getting spur val from new loc. %d\n", spur_val);
+                ath_print(common, ATH_DBG_ANI,
+                          "Getting spur val from new loc. %d\n", spur_val);
                 break;
         case SPUR_ENABLE_EEPROM:
                 spur_val = EEP_MAP9287_SPURCHAN;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 4071fc91da0a..404a0341242c 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include "ath9k.h"
+#include "hw.h"
 
 static void ath9k_get_txgain_index(struct ath_hw *ah,
                 struct ath9k_channel *chan,
@@ -89,14 +89,15 @@ static int ath9k_hw_def_get_eeprom_rev(struct ath_hw *ah)
 static bool ath9k_hw_def_fill_eeprom(struct ath_hw *ah)
 {
 #define SIZE_EEPROM_DEF (sizeof(struct ar5416_eeprom_def) / sizeof(u16))
+        struct ath_common *common = ath9k_hw_common(ah);
         u16 *eep_data = (u16 *)&ah->eeprom.def;
         int addr, ar5416_eep_start_loc = 0x100;
 
         for (addr = 0; addr < SIZE_EEPROM_DEF; addr++) {
-                if (!ath9k_hw_nvram_read(ah, addr + ar5416_eep_start_loc,
+                if (!ath9k_hw_nvram_read(common, addr + ar5416_eep_start_loc,
                                          eep_data)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "Unable to read eeprom region\n");
+                        ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                                  "Unable to read eeprom region\n");
                         return false;
                 }
                 eep_data++;
@@ -109,19 +110,20 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
 {
         struct ar5416_eeprom_def *eep =
                 (struct ar5416_eeprom_def *) &ah->eeprom.def;
+        struct ath_common *common = ath9k_hw_common(ah);
         u16 *eepdata, temp, magic, magic2;
         u32 sum = 0, el;
         bool need_swap = false;
         int i, addr, size;
 
-        if (!ath9k_hw_nvram_read(ah, AR5416_EEPROM_MAGIC_OFFSET, &magic)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL, "Reading Magic # failed\n");
+        if (!ath9k_hw_nvram_read(common, AR5416_EEPROM_MAGIC_OFFSET, &magic)) {
+                ath_print(common, ATH_DBG_FATAL, "Reading Magic # failed\n");
                 return false;
         }
 
         if (!ath9k_hw_use_flash(ah)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "Read Magic = 0x%04X\n", magic);
+                ath_print(common, ATH_DBG_EEPROM,
+                          "Read Magic = 0x%04X\n", magic);
 
                 if (magic != AR5416_EEPROM_MAGIC) {
                         magic2 = swab16(magic);
@@ -137,16 +139,16 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
                                         eepdata++;
                                 }
                         } else {
-                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                        "Invalid EEPROM Magic. "
-                                        "Endianness mismatch.\n");
+                                ath_print(common, ATH_DBG_FATAL,
+                                          "Invalid EEPROM Magic. "
+                                          "Endianness mismatch.\n");
                                 return -EINVAL;
                         }
                 }
         }
 
-        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM, "need_swap = %s.\n",
-                need_swap ? "True" : "False");
+        ath_print(common, ATH_DBG_EEPROM, "need_swap = %s.\n",
+                  need_swap ? "True" : "False");
 
         if (need_swap)
                 el = swab16(ah->eeprom.def.baseEepHeader.length);
@@ -167,8 +169,8 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
                 u32 integer, j;
                 u16 word;
 
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "EEPROM Endianness is not native.. Changing.\n");
+                ath_print(common, ATH_DBG_EEPROM,
+                          "EEPROM Endianness is not native.. Changing.\n");
 
                 word = swab16(eep->baseEepHeader.length);
                 eep->baseEepHeader.length = word;
@@ -214,8 +216,8 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
 
         if (sum != 0xffff || ah->eep_ops->get_eeprom_ver(ah) != AR5416_EEP_VER ||
             ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_NO_BACK_VER) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
+                ath_print(common, ATH_DBG_FATAL,
+                          "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
                         sum, ah->eep_ops->get_eeprom_ver(ah));
                 return -EINVAL;
         }
@@ -289,6 +291,11 @@ static u32 ath9k_hw_def_get_eeprom(struct ath_hw *ah,
                         return pBase->frac_n_5g;
                 else
                         return 0;
+        case EEP_PWR_TABLE_OFFSET:
+                if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_21)
+                        return pBase->pwr_table_offset;
+                else
+                        return AR5416_PWR_TABLE_OFFSET_DB;
         default:
                 return 0;
         }
@@ -739,6 +746,76 @@ static void ath9k_hw_get_def_gain_boundaries_pdadcs(struct ath_hw *ah,
         return;
 }
 
+static int16_t ath9k_change_gain_boundary_setting(struct ath_hw *ah,
+                                u16 *gb,
+                                u16 numXpdGain,
+                                u16 pdGainOverlap_t2,
+                                int8_t pwr_table_offset,
+                                int16_t *diff)
+
+{
+        u16 k;
+
+        /* Prior to writing the boundaries or the pdadc vs. power table
+         * into the chip registers the default starting point on the pdadc
+         * vs. power table needs to be checked and the curve boundaries
+         * adjusted accordingly
+         */
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
+                u16 gb_limit;
+
+                if (AR5416_PWR_TABLE_OFFSET_DB != pwr_table_offset) {
+                        /* get the difference in dB */
+                        *diff = (u16)(pwr_table_offset - AR5416_PWR_TABLE_OFFSET_DB);
+                        /* get the number of half dB steps */
+                        *diff *= 2;
+                        /* change the original gain boundary settings
+                         * by the number of half dB steps
+                         */
+                        for (k = 0; k < numXpdGain; k++)
+                                gb[k] = (u16)(gb[k] - *diff);
+                }
+                /* Because of a hardware limitation, ensure the gain boundary
+                 * is not larger than (63 - overlap)
+                 */
+                gb_limit = (u16)(AR5416_MAX_RATE_POWER - pdGainOverlap_t2);
+
+                for (k = 0; k < numXpdGain; k++)
+                        gb[k] = (u16)min(gb_limit, gb[k]);
+        }
+
+        return *diff;
+}
+
+static void ath9k_adjust_pdadc_values(struct ath_hw *ah,
+                                      int8_t pwr_table_offset,
+                                      int16_t diff,
+                                      u8 *pdadcValues)
+{
+#define NUM_PDADC(diff) (AR5416_NUM_PDADC_VALUES - diff)
+        u16 k;
+
+        /* If this is a board that has a pwrTableOffset that differs from
+         * the default AR5416_PWR_TABLE_OFFSET_DB then the start of the
+         * pdadc vs pwr table needs to be adjusted prior to writing to the
+         * chip.
+         */
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
+                if (AR5416_PWR_TABLE_OFFSET_DB != pwr_table_offset) {
+                        /* shift the table to start at the new offset */
+                        for (k = 0; k < (u16)NUM_PDADC(diff); k++ ) {
+                                pdadcValues[k] = pdadcValues[k + diff];
+                        }
+
+                        /* fill the back of the table */
+                        for (k = (u16)NUM_PDADC(diff); k < NUM_PDADC(0); k++) {
+                                pdadcValues[k] = pdadcValues[NUM_PDADC(diff)];
+                        }
+                }
+        }
+#undef NUM_PDADC
+}
+
 static void ath9k_hw_set_def_power_cal_table(struct ath_hw *ah,
                                   struct ath9k_channel *chan,
                                   int16_t *pTxPowerIndexOffset)
@@ -746,7 +823,7 @@ static void ath9k_hw_set_def_power_cal_table(struct ath_hw *ah,
 #define SM_PD_GAIN(x) SM(0x38, AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_##x)
 #define SM_PDGAIN_B(x, y) \
                 SM((gainBoundaries[x]), AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_##y)
-
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ar5416_eeprom_def *pEepData = &ah->eeprom.def;
         struct cal_data_per_freq *pRawDataset;
         u8 *pCalBChans = NULL;
@@ -754,15 +831,18 @@ static void ath9k_hw_set_def_power_cal_table(struct ath_hw *ah,
         static u8 pdadcValues[AR5416_NUM_PDADC_VALUES];
         u16 gainBoundaries[AR5416_PD_GAINS_IN_MASK];
         u16 numPiers, i, j;
-        int16_t tMinCalPower;
+        int16_t tMinCalPower, diff = 0;
         u16 numXpdGain, xpdMask;
         u16 xpdGainValues[AR5416_NUM_PD_GAINS] = { 0, 0, 0, 0 };
         u32 reg32, regOffset, regChainOffset;
         int16_t modalIdx;
+        int8_t pwr_table_offset;
 
         modalIdx = IS_CHAN_2GHZ(chan) ? 1 : 0;
         xpdMask = pEepData->modalHeader[modalIdx].xpdGain;
 
+        pwr_table_offset = ah->eep_ops->get_eeprom(ah, EEP_PWR_TABLE_OFFSET);
+
         if ((pEepData->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
             AR5416_EEP_MINOR_VER_2) {
                 pdGainOverlap_t2 =
@@ -842,6 +922,13 @@ static void ath9k_hw_set_def_power_cal_table(struct ath_hw *ah,
                                                         numXpdGain);
                         }
 
+                        diff = ath9k_change_gain_boundary_setting(ah,
+                                                           gainBoundaries,
+                                                           numXpdGain,
+                                                           pdGainOverlap_t2,
+                                                           pwr_table_offset,
+                                                           &diff);
+
                         if ((i == 0) || AR_SREV_5416_20_OR_LATER(ah)) {
                                 if (OLC_FOR_AR9280_20_LATER) {
                                         REG_WRITE(ah,
@@ -862,6 +949,10 @@ static void ath9k_hw_set_def_power_cal_table(struct ath_hw *ah,
                                 }
                         }
 
+
+                        ath9k_adjust_pdadc_values(ah, pwr_table_offset,
+                                                  diff, pdadcValues);
+
                         regOffset = AR_PHY_BASE + (672 << 2) + regChainOffset;
                         for (j = 0; j < 32; j++) {
                                 reg32 = ((pdadcValues[4 * j + 0] & 0xFF) << 0) |
@@ -870,20 +961,20 @@ static void ath9k_hw_set_def_power_cal_table(struct ath_hw *ah,
                                         ((pdadcValues[4 * j + 3] & 0xFF) << 24);
                                 REG_WRITE(ah, regOffset, reg32);
 
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "PDADC (%d,%4x): %4.4x %8.8x\n",
-                                        i, regChainOffset, regOffset,
-                                        reg32);
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "PDADC: Chain %d | PDADC %3d "
-                                        "Value %3d | PDADC %3d Value %3d | "
-                                        "PDADC %3d Value %3d | PDADC %3d "
-                                        "Value %3d |\n",
-                                        i, 4 * j, pdadcValues[4 * j],
-                                        4 * j + 1, pdadcValues[4 * j + 1],
-                                        4 * j + 2, pdadcValues[4 * j + 2],
-                                        4 * j + 3,
-                                        pdadcValues[4 * j + 3]);
+                                ath_print(common, ATH_DBG_EEPROM,
+                                          "PDADC (%d,%4x): %4.4x %8.8x\n",
+                                          i, regChainOffset, regOffset,
+                                          reg32);
+                                ath_print(common, ATH_DBG_EEPROM,
+                                          "PDADC: Chain %d | PDADC %3d "
+                                          "Value %3d | PDADC %3d Value %3d | "
+                                          "PDADC %3d Value %3d | PDADC %3d "
+                                          "Value %3d |\n",
+                                          i, 4 * j, pdadcValues[4 * j],
+                                          4 * j + 1, pdadcValues[4 * j + 1],
+                                          4 * j + 2, pdadcValues[4 * j + 2],
+                                          4 * j + 3,
+                                          pdadcValues[4 * j + 3]);
 
                                 regOffset += 4;
                         }
@@ -1197,8 +1288,13 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
         }
 
         if (AR_SREV_9280_10_OR_LATER(ah)) {
-                for (i = 0; i < Ar5416RateSize; i++)
-                        ratesArray[i] -= AR5416_PWR_TABLE_OFFSET * 2;
+                for (i = 0; i < Ar5416RateSize; i++) {
+                        int8_t pwr_table_offset;
+
+                        pwr_table_offset = ah->eep_ops->get_eeprom(ah,
+                                                        EEP_PWR_TABLE_OFFSET);
+                        ratesArray[i] -= pwr_table_offset * 2;
+                }
         }
 
         REG_WRITE(ah, AR_PHY_POWER_TX_RATE1,
@@ -1297,7 +1393,7 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
 
         if (AR_SREV_9280_10_OR_LATER(ah))
                 regulatory->max_power_level =
-                        ratesArray[i] + AR5416_PWR_TABLE_OFFSET * 2;
+                        ratesArray[i] + AR5416_PWR_TABLE_OFFSET_DB * 2;
         else
                 regulatory->max_power_level = ratesArray[i];
 
@@ -1311,8 +1407,8 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
                 regulatory->max_power_level += INCREASE_MAXPOW_BY_THREE_CHAIN;
                 break;
         default:
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "Invalid chainmask configuration\n");
+                ath_print(ath9k_hw_common(ah), ATH_DBG_EEPROM,
+                          "Invalid chainmask configuration\n");
                 break;
         }
 }
@@ -1349,20 +1445,21 @@ static u16 ath9k_hw_def_get_spur_channel(struct ath_hw *ah, u16 i, bool is2GHz)
 {
 #define EEP_DEF_SPURCHAN \
         (ah->eeprom.def.modalHeader[is2GHz].spurChans[i].spurChan)
+        struct ath_common *common = ath9k_hw_common(ah);
 
         u16 spur_val = AR_NO_SPUR;
 
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                "Getting spur idx %d is2Ghz. %d val %x\n",
-                i, is2GHz, ah->config.spurchans[i][is2GHz]);
+        ath_print(common, ATH_DBG_ANI,
+                  "Getting spur idx %d is2Ghz. %d val %x\n",
+                  i, is2GHz, ah->config.spurchans[i][is2GHz]);
 
         switch (ah->config.spurmode) {
         case SPUR_DISABLE:
                 break;
         case SPUR_ENABLE_IOCTL:
                 spur_val = ah->config.spurchans[i][is2GHz];
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                        "Getting spur val from new loc. %d\n", spur_val);
+                ath_print(common, ATH_DBG_ANI,
+                          "Getting spur val from new loc. %d\n", spur_val);
                 break;
         case SPUR_ENABLE_EEPROM:
                 spur_val = EEP_DEF_SPURCHAN;
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
new file mode 100644
index 000000000000..deab8beb0680
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -0,0 +1,442 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ath9k.h"
+
+/********************************/
+/*       LED functions          */
+/********************************/
+
+static void ath_led_blink_work(struct work_struct *work)
+{
+        struct ath_softc *sc = container_of(work, struct ath_softc,
+                                            ath_led_blink_work.work);
+
+        if (!(sc->sc_flags & SC_OP_LED_ASSOCIATED))
+                return;
+
+        if ((sc->led_on_duration == ATH_LED_ON_DURATION_IDLE) ||
+            (sc->led_off_duration == ATH_LED_OFF_DURATION_IDLE))
+                ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 0);
+        else
+                ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin,
+                                  (sc->sc_flags & SC_OP_LED_ON) ? 1 : 0);
+
+        ieee80211_queue_delayed_work(sc->hw,
+                                     &sc->ath_led_blink_work,
+                                     (sc->sc_flags & SC_OP_LED_ON) ?
+                                        msecs_to_jiffies(sc->led_off_duration) :
+                                        msecs_to_jiffies(sc->led_on_duration));
+
+        sc->led_on_duration = sc->led_on_cnt ?
+                        max((ATH_LED_ON_DURATION_IDLE - sc->led_on_cnt), 25) :
+                        ATH_LED_ON_DURATION_IDLE;
+        sc->led_off_duration = sc->led_off_cnt ?
+                        max((ATH_LED_OFF_DURATION_IDLE - sc->led_off_cnt), 10) :
+                        ATH_LED_OFF_DURATION_IDLE;
+        sc->led_on_cnt = sc->led_off_cnt = 0;
+        if (sc->sc_flags & SC_OP_LED_ON)
+                sc->sc_flags &= ~SC_OP_LED_ON;
+        else
+                sc->sc_flags |= SC_OP_LED_ON;
+}
+
+static void ath_led_brightness(struct led_classdev *led_cdev,
+                               enum led_brightness brightness)
+{
+        struct ath_led *led = container_of(led_cdev, struct ath_led, led_cdev);
+        struct ath_softc *sc = led->sc;
+
+        switch (brightness) {
+        case LED_OFF:
+                if (led->led_type == ATH_LED_ASSOC ||
+                    led->led_type == ATH_LED_RADIO) {
+                        ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin,
+                                (led->led_type == ATH_LED_RADIO));
+                        sc->sc_flags &= ~SC_OP_LED_ASSOCIATED;
+                        if (led->led_type == ATH_LED_RADIO)
+                                sc->sc_flags &= ~SC_OP_LED_ON;
+                } else {
+                        sc->led_off_cnt++;
+                }
+                break;
+        case LED_FULL:
+                if (led->led_type == ATH_LED_ASSOC) {
+                        sc->sc_flags |= SC_OP_LED_ASSOCIATED;
+                        ieee80211_queue_delayed_work(sc->hw,
+                                                     &sc->ath_led_blink_work, 0);
+                } else if (led->led_type == ATH_LED_RADIO) {
+                        ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 0);
+                        sc->sc_flags |= SC_OP_LED_ON;
+                } else {
+                        sc->led_on_cnt++;
+                }
+                break;
+        default:
+                break;
+        }
+}
+
+static int ath_register_led(struct ath_softc *sc, struct ath_led *led,
+                            char *trigger)
+{
+        int ret;
+
+        led->sc = sc;
+        led->led_cdev.name = led->name;
+        led->led_cdev.default_trigger = trigger;
+        led->led_cdev.brightness_set = ath_led_brightness;
+
+        ret = led_classdev_register(wiphy_dev(sc->hw->wiphy), &led->led_cdev);
+        if (ret)
+                ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
+                          "Failed to register led:%s", led->name);
+        else
+                led->registered = 1;
+        return ret;
+}
+
+static void ath_unregister_led(struct ath_led *led)
+{
+        if (led->registered) {
+                led_classdev_unregister(&led->led_cdev);
+                led->registered = 0;
+        }
+}
+
+void ath_deinit_leds(struct ath_softc *sc)
+{
+        ath_unregister_led(&sc->assoc_led);
+        sc->sc_flags &= ~SC_OP_LED_ASSOCIATED;
+        ath_unregister_led(&sc->tx_led);
+        ath_unregister_led(&sc->rx_led);
+        ath_unregister_led(&sc->radio_led);
+        ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
+}
+
+void ath_init_leds(struct ath_softc *sc)
+{
+        char *trigger;
+        int ret;
+
+        if (AR_SREV_9287(sc->sc_ah))
+                sc->sc_ah->led_pin = ATH_LED_PIN_9287;
+        else
+                sc->sc_ah->led_pin = ATH_LED_PIN_DEF;
+
+        /* Configure gpio 1 for output */
+        ath9k_hw_cfg_output(sc->sc_ah, sc->sc_ah->led_pin,
+                            AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+        /* LED off, active low */
+        ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
+
+        INIT_DELAYED_WORK(&sc->ath_led_blink_work, ath_led_blink_work);
+
+        trigger = ieee80211_get_radio_led_name(sc->hw);
+        snprintf(sc->radio_led.name, sizeof(sc->radio_led.name),
+                "ath9k-%s::radio", wiphy_name(sc->hw->wiphy));
+        ret = ath_register_led(sc, &sc->radio_led, trigger);
+        sc->radio_led.led_type = ATH_LED_RADIO;
+        if (ret)
+                goto fail;
+
+        trigger = ieee80211_get_assoc_led_name(sc->hw);
+        snprintf(sc->assoc_led.name, sizeof(sc->assoc_led.name),
+                "ath9k-%s::assoc", wiphy_name(sc->hw->wiphy));
+        ret = ath_register_led(sc, &sc->assoc_led, trigger);
+        sc->assoc_led.led_type = ATH_LED_ASSOC;
+        if (ret)
+                goto fail;
+
+        trigger = ieee80211_get_tx_led_name(sc->hw);
+        snprintf(sc->tx_led.name, sizeof(sc->tx_led.name),
+                "ath9k-%s::tx", wiphy_name(sc->hw->wiphy));
+        ret = ath_register_led(sc, &sc->tx_led, trigger);
+        sc->tx_led.led_type = ATH_LED_TX;
+        if (ret)
+                goto fail;
+
+        trigger = ieee80211_get_rx_led_name(sc->hw);
+        snprintf(sc->rx_led.name, sizeof(sc->rx_led.name),
+                "ath9k-%s::rx", wiphy_name(sc->hw->wiphy));
+        ret = ath_register_led(sc, &sc->rx_led, trigger);
+        sc->rx_led.led_type = ATH_LED_RX;
+        if (ret)
+                goto fail;
+
+        return;
+
+fail:
+        cancel_delayed_work_sync(&sc->ath_led_blink_work);
+        ath_deinit_leds(sc);
+}
+
+/*******************/
+/*      Rfkill     */
+/*******************/
+
+static bool ath_is_rfkill_set(struct ath_softc *sc)
+{
+        struct ath_hw *ah = sc->sc_ah;
+
+        return ath9k_hw_gpio_get(ah, ah->rfkill_gpio) ==
+                                  ah->rfkill_polarity;
+}
+
+void ath9k_rfkill_poll_state(struct ieee80211_hw *hw)
+{
+        struct ath_wiphy *aphy = hw->priv;
+        struct ath_softc *sc = aphy->sc;
+        bool blocked = !!ath_is_rfkill_set(sc);
+
+        wiphy_rfkill_set_hw_state(hw->wiphy, blocked);
+}
+
+void ath_start_rfkill_poll(struct ath_softc *sc)
+{
+        struct ath_hw *ah = sc->sc_ah;
+
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_RFSILENT)
+                wiphy_rfkill_start_polling(sc->hw->wiphy);
+}
+
+/******************/
+/*     BTCOEX     */
+/******************/
+
+/*
+ * Detects if there is any priority bt traffic
+ */
+static void ath_detect_bt_priority(struct ath_softc *sc)
+{
+        struct ath_btcoex *btcoex = &sc->btcoex;
+        struct ath_hw *ah = sc->sc_ah;
+
+        if (ath9k_hw_gpio_get(sc->sc_ah, ah->btcoex_hw.btpriority_gpio))
+                btcoex->bt_priority_cnt++;
+
+        if (time_after(jiffies, btcoex->bt_priority_time +
+                        msecs_to_jiffies(ATH_BT_PRIORITY_TIME_THRESHOLD))) {
+                sc->sc_flags &= ~(SC_OP_BT_PRIORITY_DETECTED | SC_OP_BT_SCAN);
+                /* Detect if colocated bt started scanning */
+                if (btcoex->bt_priority_cnt >= ATH_BT_CNT_SCAN_THRESHOLD) {
+                        ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_BTCOEX,
+                                  "BT scan detected");
+                        sc->sc_flags |= (SC_OP_BT_SCAN |
+                                         SC_OP_BT_PRIORITY_DETECTED);
+                } else if (btcoex->bt_priority_cnt >= ATH_BT_CNT_THRESHOLD) {
+                        ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_BTCOEX,
+                                  "BT priority traffic detected");
+                        sc->sc_flags |= SC_OP_BT_PRIORITY_DETECTED;
+                }
+
+                btcoex->bt_priority_cnt = 0;
+                btcoex->bt_priority_time = jiffies;
+        }
+}
+
+/*
+ * Configures appropriate weight based on stomp type.
+ */
+static void ath9k_btcoex_bt_stomp(struct ath_softc *sc,
+                                  enum ath_stomp_type stomp_type)
+{
+        struct ath_hw *ah = sc->sc_ah;
+
+        switch (stomp_type) {
+        case ATH_BTCOEX_STOMP_ALL:
+                ath9k_hw_btcoex_set_weight(ah, AR_BT_COEX_WGHT,
+                                           AR_STOMP_ALL_WLAN_WGHT);
+                break;
+        case ATH_BTCOEX_STOMP_LOW:
+                ath9k_hw_btcoex_set_weight(ah, AR_BT_COEX_WGHT,
+                                           AR_STOMP_LOW_WLAN_WGHT);
+                break;
+        case ATH_BTCOEX_STOMP_NONE:
+                ath9k_hw_btcoex_set_weight(ah, AR_BT_COEX_WGHT,
+                                           AR_STOMP_NONE_WLAN_WGHT);
+                break;
+        default:
+                ath_print(ath9k_hw_common(ah), ATH_DBG_BTCOEX,
+                          "Invalid Stomptype\n");
+                break;
+        }
+
+        ath9k_hw_btcoex_enable(ah);
+}
+
+static void ath9k_gen_timer_start(struct ath_hw *ah,
+                                  struct ath_gen_timer *timer,
+                                  u32 timer_next,
+                                  u32 timer_period)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
+
+        ath9k_hw_gen_timer_start(ah, timer, timer_next, timer_period);
+
+        if ((sc->imask & ATH9K_INT_GENTIMER) == 0) {
+                ath9k_hw_set_interrupts(ah, 0);
+                sc->imask |= ATH9K_INT_GENTIMER;
+                ath9k_hw_set_interrupts(ah, sc->imask);
+        }
+}
+
+static void ath9k_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
+        struct ath_gen_timer_table *timer_table = &ah->hw_gen_timers;
+
+        ath9k_hw_gen_timer_stop(ah, timer);
+
+        /* if no timer is enabled, turn off interrupt mask */
+        if (timer_table->timer_mask.val == 0) {
+                ath9k_hw_set_interrupts(ah, 0);
+                sc->imask &= ~ATH9K_INT_GENTIMER;
+                ath9k_hw_set_interrupts(ah, sc->imask);
+        }
+}
+
+/*
+ * This is the master bt coex timer which runs for every
+ * 45ms, bt traffic will be given priority during 55% of this
+ * period while wlan gets remaining 45%
+ */
+static void ath_btcoex_period_timer(unsigned long data)
+{
+        struct ath_softc *sc = (struct ath_softc *) data;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_btcoex *btcoex = &sc->btcoex;
+        u32 timer_period;
+        bool is_btscan;
+
+        ath_detect_bt_priority(sc);
+
+        is_btscan = sc->sc_flags & SC_OP_BT_SCAN;
+
+        spin_lock_bh(&btcoex->btcoex_lock);
+
+        ath9k_btcoex_bt_stomp(sc, is_btscan ? ATH_BTCOEX_STOMP_ALL :
+                              btcoex->bt_stomp_type);
+
+        spin_unlock_bh(&btcoex->btcoex_lock);
+
+        if (btcoex->btcoex_period != btcoex->btcoex_no_stomp) {
+                if (btcoex->hw_timer_enabled)
+                        ath9k_gen_timer_stop(ah, btcoex->no_stomp_timer);
+
+                timer_period = is_btscan ? btcoex->btscan_no_stomp :
+                                           btcoex->btcoex_no_stomp;
+                ath9k_gen_timer_start(ah,
+                                      btcoex->no_stomp_timer,
+                                      (ath9k_hw_gettsf32(ah) +
+                                       timer_period), timer_period * 10);
+                btcoex->hw_timer_enabled = true;
+        }
+
+        mod_timer(&btcoex->period_timer, jiffies +
+                                  msecs_to_jiffies(ATH_BTCOEX_DEF_BT_PERIOD));
+}
+
+/*
+ * Generic tsf based hw timer which configures weight
+ * registers to time slice between wlan and bt traffic
+ */
+static void ath_btcoex_no_stomp_timer(void *arg)
+{
+        struct ath_softc *sc = (struct ath_softc *)arg;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_btcoex *btcoex = &sc->btcoex;
+        bool is_btscan = sc->sc_flags & SC_OP_BT_SCAN;
+
+        ath_print(ath9k_hw_common(ah), ATH_DBG_BTCOEX,
+                  "no stomp timer running \n");
+
+        spin_lock_bh(&btcoex->btcoex_lock);
+
+        if (btcoex->bt_stomp_type == ATH_BTCOEX_STOMP_LOW || is_btscan)
+                ath9k_btcoex_bt_stomp(sc, ATH_BTCOEX_STOMP_NONE);
+         else if (btcoex->bt_stomp_type == ATH_BTCOEX_STOMP_ALL)
+                ath9k_btcoex_bt_stomp(sc, ATH_BTCOEX_STOMP_LOW);
+
+        spin_unlock_bh(&btcoex->btcoex_lock);
+}
+
+int ath_init_btcoex_timer(struct ath_softc *sc)
+{
+        struct ath_btcoex *btcoex = &sc->btcoex;
+
+        btcoex->btcoex_period = ATH_BTCOEX_DEF_BT_PERIOD * 1000;
+        btcoex->btcoex_no_stomp = (100 - ATH_BTCOEX_DEF_DUTY_CYCLE) *
+                btcoex->btcoex_period / 100;
+        btcoex->btscan_no_stomp = (100 - ATH_BTCOEX_BTSCAN_DUTY_CYCLE) *
+                                   btcoex->btcoex_period / 100;
+
+        setup_timer(&btcoex->period_timer, ath_btcoex_period_timer,
+                        (unsigned long) sc);
+
+        spin_lock_init(&btcoex->btcoex_lock);
+
+        btcoex->no_stomp_timer = ath_gen_timer_alloc(sc->sc_ah,
+                        ath_btcoex_no_stomp_timer,
+                        ath_btcoex_no_stomp_timer,
+                        (void *) sc, AR_FIRST_NDP_TIMER);
+
+        if (!btcoex->no_stomp_timer)
+                return -ENOMEM;
+
+        return 0;
+}
+
+/*
+ * (Re)start btcoex timers
+ */
+void ath9k_btcoex_timer_resume(struct ath_softc *sc)
+{
+        struct ath_btcoex *btcoex = &sc->btcoex;
+        struct ath_hw *ah = sc->sc_ah;
+
+        ath_print(ath9k_hw_common(ah), ATH_DBG_BTCOEX,
+                  "Starting btcoex timers");
+
+        /* make sure duty cycle timer is also stopped when resuming */
+        if (btcoex->hw_timer_enabled)
+                ath9k_gen_timer_stop(sc->sc_ah, btcoex->no_stomp_timer);
+
+        btcoex->bt_priority_cnt = 0;
+        btcoex->bt_priority_time = jiffies;
+        sc->sc_flags &= ~(SC_OP_BT_PRIORITY_DETECTED | SC_OP_BT_SCAN);
+
+        mod_timer(&btcoex->period_timer, jiffies);
+}
+
+
+/*
+ * Pause btcoex timer and bt duty cycle timer
+ */
+void ath9k_btcoex_timer_pause(struct ath_softc *sc)
+{
+        struct ath_btcoex *btcoex = &sc->btcoex;
+        struct ath_hw *ah = sc->sc_ah;
+
+        del_timer_sync(&btcoex->period_timer);
+
+        if (btcoex->hw_timer_enabled)
+                ath9k_gen_timer_stop(ah, btcoex->no_stomp_timer);
+
+        btcoex->hw_timer_enabled = false;
+}
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index ca7694caf364..78b571129c92 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -15,10 +15,11 @@
  */
 
 #include <linux/io.h>
+#include <linux/slab.h>
 #include <asm/unaligned.h>
-#include <linux/pci.h>
 
-#include "ath9k.h"
+#include "hw.h"
+#include "rc.h"
 #include "initvals.h"
 
 #define ATH9K_CLOCK_RATE_CCK            22
@@ -26,43 +27,35 @@
 #define ATH9K_CLOCK_RATE_2GHZ_OFDM      44
 
 static bool ath9k_hw_set_reset_reg(struct ath_hw *ah, u32 type);
-static void ath9k_hw_set_regs(struct ath_hw *ah, struct ath9k_channel *chan,
-                              enum ath9k_ht_macmode macmode);
+static void ath9k_hw_set_regs(struct ath_hw *ah, struct ath9k_channel *chan);
 static u32 ath9k_hw_ini_fixup(struct ath_hw *ah,
                               struct ar5416_eeprom_def *pEepData,
                               u32 reg, u32 value);
-static void ath9k_hw_9280_spur_mitigate(struct ath_hw *ah, struct ath9k_channel *chan);
-static void ath9k_hw_spur_mitigate(struct ath_hw *ah, struct ath9k_channel *chan);
 
-/********************/
-/* Helper Functions */
-/********************/
+MODULE_AUTHOR("Atheros Communications");
+MODULE_DESCRIPTION("Support for Atheros 802.11n wireless LAN cards.");
+MODULE_SUPPORTED_DEVICE("Atheros 802.11n WLAN cards");
+MODULE_LICENSE("Dual BSD/GPL");
 
-static u32 ath9k_hw_mac_usec(struct ath_hw *ah, u32 clks)
+static int __init ath9k_init(void)
 {
-        struct ieee80211_conf *conf = &ah->ah_sc->hw->conf;
-
-        if (!ah->curchan) /* should really check for CCK instead */
-                return clks / ATH9K_CLOCK_RATE_CCK;
-        if (conf->channel->band == IEEE80211_BAND_2GHZ)
-                return clks / ATH9K_CLOCK_RATE_2GHZ_OFDM;
-
-        return clks / ATH9K_CLOCK_RATE_5GHZ_OFDM;
+        return 0;
 }
+module_init(ath9k_init);
 
-static u32 ath9k_hw_mac_to_usec(struct ath_hw *ah, u32 clks)
+static void __exit ath9k_exit(void)
 {
-        struct ieee80211_conf *conf = &ah->ah_sc->hw->conf;
-
-        if (conf_is_ht40(conf))
-                return ath9k_hw_mac_usec(ah, clks) / 2;
-        else
-                return ath9k_hw_mac_usec(ah, clks);
+        return;
 }
+module_exit(ath9k_exit);
+
+/********************/
+/* Helper Functions */
+/********************/
 
 static u32 ath9k_hw_mac_clks(struct ath_hw *ah, u32 usecs)
 {
-        struct ieee80211_conf *conf = &ah->ah_sc->hw->conf;
+        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
 
         if (!ah->curchan) /* should really check for CCK instead */
                 return usecs *ATH9K_CLOCK_RATE_CCK;
@@ -73,7 +66,7 @@ static u32 ath9k_hw_mac_clks(struct ath_hw *ah, u32 usecs)
 
 static u32 ath9k_hw_mac_to_clks(struct ath_hw *ah, u32 usecs)
 {
-        struct ieee80211_conf *conf = &ah->ah_sc->hw->conf;
+        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
 
         if (conf_is_ht40(conf))
                 return ath9k_hw_mac_clks(ah, usecs) * 2;
@@ -81,38 +74,6 @@ static u32 ath9k_hw_mac_to_clks(struct ath_hw *ah, u32 usecs)
                 return ath9k_hw_mac_clks(ah, usecs);
 }
 
-/*
- * Read and write, they both share the same lock. We do this to serialize
- * reads and writes on Atheros 802.11n PCI devices only. This is required
- * as the FIFO on these devices can only accept sanely 2 requests. After
- * that the device goes bananas. Serializing the reads/writes prevents this
- * from happening.
- */
-
-void ath9k_iowrite32(struct ath_hw *ah, u32 reg_offset, u32 val)
-{
-        if (ah->config.serialize_regmode == SER_REG_MODE_ON) {
-                unsigned long flags;
-                spin_lock_irqsave(&ah->ah_sc->sc_serial_rw, flags);
-                iowrite32(val, ah->ah_sc->mem + reg_offset);
-                spin_unlock_irqrestore(&ah->ah_sc->sc_serial_rw, flags);
-        } else
-                iowrite32(val, ah->ah_sc->mem + reg_offset);
-}
-
-unsigned int ath9k_ioread32(struct ath_hw *ah, u32 reg_offset)
-{
-        u32 val;
-        if (ah->config.serialize_regmode == SER_REG_MODE_ON) {
-                unsigned long flags;
-                spin_lock_irqsave(&ah->ah_sc->sc_serial_rw, flags);
-                val = ioread32(ah->ah_sc->mem + reg_offset);
-                spin_unlock_irqrestore(&ah->ah_sc->sc_serial_rw, flags);
-        } else
-                val = ioread32(ah->ah_sc->mem + reg_offset);
-        return val;
-}
-
 bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val, u32 timeout)
 {
         int i;
@@ -126,12 +87,13 @@ bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val, u32 timeout)
                 udelay(AH_TIME_QUANTUM);
         }
 
-        DPRINTF(ah->ah_sc, ATH_DBG_ANY,
-                "timeout (%d us) on reg 0x%x: 0x%08x & 0x%08x != 0x%08x\n",
-                timeout, reg, REG_READ(ah, reg), mask, val);
+        ath_print(ath9k_hw_common(ah), ATH_DBG_ANY,
+                  "timeout (%d us) on reg 0x%x: 0x%08x & 0x%08x != 0x%08x\n",
+                  timeout, reg, REG_READ(ah, reg), mask, val);
 
         return false;
 }
+EXPORT_SYMBOL(ath9k_hw_wait);
 
 u32 ath9k_hw_reverse_bits(u32 val, u32 n)
 {
@@ -165,22 +127,19 @@ bool ath9k_get_channel_edges(struct ath_hw *ah,
 }
 
 u16 ath9k_hw_computetxtime(struct ath_hw *ah,
-                           const struct ath_rate_table *rates,
+                           u8 phy, int kbps,
                            u32 frameLen, u16 rateix,
                            bool shortPreamble)
 {
         u32 bitsPerSymbol, numBits, numSymbols, phyTime, txTime;
-        u32 kbps;
-
-        kbps = rates->info[rateix].ratekbps;
 
         if (kbps == 0)
                 return 0;
 
-        switch (rates->info[rateix].phy) {
+        switch (phy) {
         case WLAN_RC_PHY_CCK:
                 phyTime = CCK_PREAMBLE_BITS + CCK_PLCP_BITS;
-                if (shortPreamble && rates->info[rateix].short_preamble)
+                if (shortPreamble)
                         phyTime >>= 1;
                 numBits = frameLen << 3;
                 txTime = CCK_SIFS_TIME + phyTime + ((numBits * 1000) / kbps);
@@ -210,15 +169,15 @@ u16 ath9k_hw_computetxtime(struct ath_hw *ah,
                 }
                 break;
         default:
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Unknown phy %u (rate ix %u)\n",
-                        rates->info[rateix].phy, rateix);
+                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                          "Unknown phy %u (rate ix %u)\n", phy, rateix);
                 txTime = 0;
                 break;
         }
 
         return txTime;
 }
+EXPORT_SYMBOL(ath9k_hw_computetxtime);
 
 void ath9k_hw_get_channel_centers(struct ath_hw *ah,
                                   struct ath9k_channel *chan,
@@ -245,10 +204,9 @@ void ath9k_hw_get_channel_centers(struct ath_hw *ah,
 
         centers->ctl_center =
                 centers->synth_center - (extoff * HT40_CHANNEL_CENTER_SHIFT);
+        /* 25 MHz spacing is supported by hw but not on upper layers */
         centers->ext_center =
-                centers->synth_center + (extoff *
-                         ((ah->extprotspacing == ATH9K_HT_EXTPROTSPACING_20) ?
-                          HT40_CHANNEL_CENTER_SHIFT : 15));
+                centers->synth_center + (extoff * HT40_CHANNEL_CENTER_SHIFT);
 }
 
 /******************/
@@ -317,6 +275,7 @@ static void ath9k_hw_disablepcie(struct ath_hw *ah)
 
 static bool ath9k_hw_chip_test(struct ath_hw *ah)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         u32 regAddr[2] = { AR_STA_ID0, AR_PHY_BASE + (8 << 2) };
         u32 regHold[2];
         u32 patternData[4] = { 0x55555555,
@@ -335,10 +294,11 @@ static bool ath9k_hw_chip_test(struct ath_hw *ah)
                         REG_WRITE(ah, addr, wrData);
                         rdData = REG_READ(ah, addr);
                         if (rdData != wrData) {
-                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                        "address test failed "
-                                        "addr: 0x%08x - wr:0x%08x != rd:0x%08x\n",
-                                        addr, wrData, rdData);
+                                ath_print(common, ATH_DBG_FATAL,
+                                          "address test failed "
+                                          "addr: 0x%08x - wr:0x%08x != "
+                                          "rd:0x%08x\n",
+                                          addr, wrData, rdData);
                                 return false;
                         }
                 }
@@ -347,10 +307,11 @@ static bool ath9k_hw_chip_test(struct ath_hw *ah)
                         REG_WRITE(ah, addr, wrData);
                         rdData = REG_READ(ah, addr);
                         if (wrData != rdData) {
-                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                        "address test failed "
-                                        "addr: 0x%08x - wr:0x%08x != rd:0x%08x\n",
-                                        addr, wrData, rdData);
+                                ath_print(common, ATH_DBG_FATAL,
+                                          "address test failed "
+                                          "addr: 0x%08x - wr:0x%08x != "
+                                          "rd:0x%08x\n",
+                                          addr, wrData, rdData);
                                 return false;
                         }
                 }
@@ -361,30 +322,6 @@ static bool ath9k_hw_chip_test(struct ath_hw *ah)
         return true;
 }
 
-static const char *ath9k_hw_devname(u16 devid)
-{
-        switch (devid) {
-        case AR5416_DEVID_PCI:
-                return "Atheros 5416";
-        case AR5416_DEVID_PCIE:
-                return "Atheros 5418";
-        case AR9160_DEVID_PCI:
-                return "Atheros 9160";
-        case AR5416_AR9100_DEVID:
-                return "Atheros 9100";
-        case AR9280_DEVID_PCI:
-        case AR9280_DEVID_PCIE:
-                return "Atheros 9280";
-        case AR9285_DEVID_PCIE:
-                return "Atheros 9285";
-        case AR5416_DEVID_AR9287_PCI:
-        case AR5416_DEVID_AR9287_PCIE:
-                return "Atheros 9287";
-        }
-
-        return NULL;
-}
-
 static void ath9k_hw_init_config(struct ath_hw *ah)
 {
         int i;
@@ -398,21 +335,23 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         ah->config.pcie_clock_req = 0;
         ah->config.pcie_waen = 0;
         ah->config.analog_shiftreg = 1;
-        ah->config.ht_enable = 1;
         ah->config.ofdm_trig_low = 200;
         ah->config.ofdm_trig_high = 500;
         ah->config.cck_trig_high = 200;
         ah->config.cck_trig_low = 100;
         ah->config.enable_ani = 1;
-        ah->config.diversity_control = ATH9K_ANT_VARIABLE;
-        ah->config.antenna_switch_swap = 0;
 
         for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
                 ah->config.spurchans[i][0] = AR_NO_SPUR;
                 ah->config.spurchans[i][1] = AR_NO_SPUR;
         }
 
-        ah->config.intr_mitigation = true;
+        if (ah->hw_version.devid != AR2427_DEVID_PCIE)
+                ah->config.ht_enable = 1;
+        else
+                ah->config.ht_enable = 0;
+
+        ah->config.rx_intr_mitigation = true;
 
         /*
          * We need this for PCI devices only (Cardbus, PCI, miniPCI)
@@ -433,6 +372,7 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         if (num_possible_cpus() > 1)
                 ah->config.serialize_regmode = SER_REG_MODE_AUTO;
 }
+EXPORT_SYMBOL(ath9k_hw_init);
 
 static void ath9k_hw_init_defaults(struct ath_hw *ah)
 {
@@ -456,30 +396,10 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
         ah->beacon_interval = 100;
         ah->enable_32kHz_clock = DONT_USE_32KHZ;
         ah->slottime = (u32) -1;
-        ah->acktimeout = (u32) -1;
-        ah->ctstimeout = (u32) -1;
         ah->globaltxtimeout = (u32) -1;
-
-        ah->gbeacon_rate = 0;
-
         ah->power_mode = ATH9K_PM_UNDEFINED;
 }
 
-static int ath9k_hw_rfattach(struct ath_hw *ah)
-{
-        bool rfStatus = false;
-        int ecode = 0;
-
-        rfStatus = ath9k_hw_init_rf(ah, &ecode);
-        if (!rfStatus) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "RF setup failed, status: %u\n", ecode);
-                return ecode;
-        }
-
-        return 0;
-}
-
 static int ath9k_hw_rf_claim(struct ath_hw *ah)
 {
         u32 val;
@@ -497,9 +417,9 @@ static int ath9k_hw_rf_claim(struct ath_hw *ah)
         case AR_RAD2122_SREV_MAJOR:
                 break;
         default:
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Radio Chip Rev 0x%02X not supported\n",
-                        val & AR_RADIO_SREV_MAJOR);
+                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                          "Radio Chip Rev 0x%02X not supported\n",
+                          val & AR_RADIO_SREV_MAJOR);
                 return -EOPNOTSUPP;
         }
 
@@ -510,6 +430,7 @@ static int ath9k_hw_rf_claim(struct ath_hw *ah)
 
 static int ath9k_hw_init_macaddr(struct ath_hw *ah)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         u32 sum;
         int i;
         u16 eeval;
@@ -518,8 +439,8 @@ static int ath9k_hw_init_macaddr(struct ath_hw *ah)
         for (i = 0; i < 3; i++) {
                 eeval = ah->eep_ops->get_eeprom(ah, AR_EEPROM_MAC(i));
                 sum += eeval;
-                ah->macaddr[2 * i] = eeval >> 8;
-                ah->macaddr[2 * i + 1] = eeval & 0xff;
+                common->macaddr[2 * i] = eeval >> 8;
+                common->macaddr[2 * i + 1] = eeval & 0xff;
         }
         if (sum == 0 || sum == 0xffff * 3)
                 return -EADDRNOTAVAIL;
@@ -590,12 +511,20 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
         if (ecode != 0)
                 return ecode;
 
-        DPRINTF(ah->ah_sc, ATH_DBG_CONFIG, "Eeprom VER: %d, REV: %d\n",
-                ah->eep_ops->get_eeprom_ver(ah), ah->eep_ops->get_eeprom_rev(ah));
-
-        ecode = ath9k_hw_rfattach(ah);
-        if (ecode != 0)
-                return ecode;
+        ath_print(ath9k_hw_common(ah), ATH_DBG_CONFIG,
+                  "Eeprom VER: %d, REV: %d\n",
+                  ah->eep_ops->get_eeprom_ver(ah),
+                  ah->eep_ops->get_eeprom_rev(ah));
+
+        if (!AR_SREV_9280_10_OR_LATER(ah)) {
+                ecode = ath9k_hw_rf_alloc_ext_banks(ah);
+                if (ecode) {
+                        ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                                  "Failed allocating banks for "
+                                  "external radio\n");
+                        return ecode;
+                }
+        }
 
         if (!AR_SREV_9100(ah)) {
                 ath9k_hw_ani_setup(ah);
@@ -617,6 +546,8 @@ static bool ath9k_hw_devid_supported(u16 devid)
         case AR9285_DEVID_PCIE:
         case AR5416_DEVID_AR9287_PCI:
         case AR5416_DEVID_AR9287_PCIE:
+        case AR9271_USB:
+        case AR2427_DEVID_PCIE:
                 return true;
         default:
                 break;
@@ -634,9 +565,8 @@ static bool ath9k_hw_macversion_supported(u32 macversion)
         case AR_SREV_VERSION_9280:
         case AR_SREV_VERSION_9285:
         case AR_SREV_VERSION_9287:
-                return true;
-        /* Not yet */
         case AR_SREV_VERSION_9271:
+                return true;
         default:
                 break;
         }
@@ -670,10 +600,13 @@ static void ath9k_hw_init_cal_settings(struct ath_hw *ah)
 static void ath9k_hw_init_mode_regs(struct ath_hw *ah)
 {
         if (AR_SREV_9271(ah)) {
-                INIT_INI_ARRAY(&ah->iniModes, ar9271Modes_9271_1_0,
-                               ARRAY_SIZE(ar9271Modes_9271_1_0), 6);
-                INIT_INI_ARRAY(&ah->iniCommon, ar9271Common_9271_1_0,
-                               ARRAY_SIZE(ar9271Common_9271_1_0), 2);
+                INIT_INI_ARRAY(&ah->iniModes, ar9271Modes_9271,
+                               ARRAY_SIZE(ar9271Modes_9271), 6);
+                INIT_INI_ARRAY(&ah->iniCommon, ar9271Common_9271,
+                               ARRAY_SIZE(ar9271Common_9271), 2);
+                INIT_INI_ARRAY(&ah->iniModes_9271_1_0_only,
+                               ar9271Modes_9271_1_0_only,
+                               ARRAY_SIZE(ar9271Modes_9271_1_0_only), 6);
                 return;
         }
 
@@ -880,12 +813,11 @@ static void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
         }
 }
 
-static void ath9k_hw_init_11a_eeprom_fix(struct ath_hw *ah)
+static void ath9k_hw_init_eeprom_fix(struct ath_hw *ah)
 {
         u32 i, j;
 
-        if ((ah->hw_version.devid == AR9280_DEVID_PCI) &&
-            test_bit(ATH9K_MODE_11A, ah->caps.wireless_modes)) {
+        if (ah->hw_version.devid == AR9280_DEVID_PCI) {
 
                 /* EEPROM Fixup */
                 for (i = 0; i < ah->iniModes.ia_rows; i++) {
@@ -905,21 +837,27 @@ static void ath9k_hw_init_11a_eeprom_fix(struct ath_hw *ah)
 
 int ath9k_hw_init(struct ath_hw *ah)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         int r = 0;
 
-        if (!ath9k_hw_devid_supported(ah->hw_version.devid))
+        if (!ath9k_hw_devid_supported(ah->hw_version.devid)) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unsupported device ID: 0x%0x\n",
+                          ah->hw_version.devid);
                 return -EOPNOTSUPP;
+        }
 
         ath9k_hw_init_defaults(ah);
         ath9k_hw_init_config(ah);
 
         if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_POWER_ON)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL, "Couldn't reset chip\n");
+                ath_print(common, ATH_DBG_FATAL,
+                          "Couldn't reset chip\n");
                 return -EIO;
         }
 
         if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL, "Couldn't wakeup chip\n");
+                ath_print(common, ATH_DBG_FATAL, "Couldn't wakeup chip\n");
                 return -EIO;
         }
 
@@ -934,14 +872,19 @@ int ath9k_hw_init(struct ath_hw *ah)
                 }
         }
 
-        DPRINTF(ah->ah_sc, ATH_DBG_RESET, "serialize_regmode is %d\n",
+        ath_print(common, ATH_DBG_RESET, "serialize_regmode is %d\n",
                 ah->config.serialize_regmode);
 
+        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
+                ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD >> 1;
+        else
+                ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD;
+
         if (!ath9k_hw_macversion_supported(ah->hw_version.macVersion)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Mac Chip Rev 0x%02x.%x is not supported by "
-                        "this driver\n", ah->hw_version.macVersion,
-                        ah->hw_version.macRev);
+                ath_print(common, ATH_DBG_FATAL,
+                          "Mac Chip Rev 0x%02x.%x is not supported by "
+                          "this driver\n", ah->hw_version.macVersion,
+                          ah->hw_version.macRev);
                 return -EOPNOTSUPP;
         }
 
@@ -959,8 +902,14 @@ int ath9k_hw_init(struct ath_hw *ah)
         ath9k_hw_init_cal_settings(ah);
 
         ah->ani_function = ATH9K_ANI_ALL;
-        if (AR_SREV_9280_10_OR_LATER(ah))
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
                 ah->ani_function &= ~ATH9K_ANI_NOISE_IMMUNITY_LEVEL;
+                ah->ath9k_hw_rf_set_freq = &ath9k_hw_ar9280_set_channel;
+                ah->ath9k_hw_spur_mitigate_freq = &ath9k_hw_9280_spur_mitigate;
+        } else {
+                ah->ath9k_hw_rf_set_freq = &ath9k_hw_set_channel;
+                ah->ath9k_hw_spur_mitigate_freq = &ath9k_hw_spur_mitigate;
+        }
 
         ath9k_hw_init_mode_regs(ah);
 
@@ -969,18 +918,31 @@ int ath9k_hw_init(struct ath_hw *ah)
         else
                 ath9k_hw_disablepcie(ah);
 
+        /* Support for Japan ch.14 (2484) spread */
+        if (AR_SREV_9287_11_OR_LATER(ah)) {
+                INIT_INI_ARRAY(&ah->iniCckfirNormal,
+                       ar9287Common_normal_cck_fir_coeff_92871_1,
+                       ARRAY_SIZE(ar9287Common_normal_cck_fir_coeff_92871_1), 2);
+                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
+                       ar9287Common_japan_2484_cck_fir_coeff_92871_1,
+                       ARRAY_SIZE(ar9287Common_japan_2484_cck_fir_coeff_92871_1), 2);
+        }
+
         r = ath9k_hw_post_init(ah);
         if (r)
                 return r;
 
         ath9k_hw_init_mode_gain_regs(ah);
-        ath9k_hw_fill_cap_info(ah);
-        ath9k_hw_init_11a_eeprom_fix(ah);
+        r = ath9k_hw_fill_cap_info(ah);
+        if (r)
+                return r;
+
+        ath9k_hw_init_eeprom_fix(ah);
 
         r = ath9k_hw_init_macaddr(ah);
         if (r) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Failed to initialize MAC address\n");
+                ath_print(common, ATH_DBG_FATAL,
+                          "Failed to initialize MAC address\n");
                 return r;
         }
 
@@ -991,6 +953,8 @@ int ath9k_hw_init(struct ath_hw *ah)
 
         ath9k_init_nfcal_hist_buffer(ah);
 
+        common->state = ATH_HW_INITIALIZED;
+
         return 0;
 }
 
@@ -1027,6 +991,22 @@ static void ath9k_hw_init_qos(struct ath_hw *ah)
         REG_WRITE(ah, AR_TXOP_12_15, 0xFFFFFFFF);
 }
 
+static void ath9k_hw_change_target_baud(struct ath_hw *ah, u32 freq, u32 baud)
+{
+        u32 lcr;
+        u32 baud_divider = freq * 1000 * 1000 / 16 / baud;
+
+        lcr = REG_READ(ah , 0x5100c);
+        lcr |= 0x80;
+
+        REG_WRITE(ah, 0x5100c, lcr);
+        REG_WRITE(ah, 0x51004, (baud_divider >> 8));
+        REG_WRITE(ah, 0x51000, (baud_divider & 0xff));
+
+        lcr &= ~0x80;
+        REG_WRITE(ah, 0x5100c, lcr);
+}
+
 static void ath9k_hw_init_pll(struct ath_hw *ah,
                               struct ath9k_channel *chan)
 {
@@ -1090,6 +1070,26 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
         }
         REG_WRITE(ah, AR_RTC_PLL_CONTROL, pll);
 
+        /* Switch the core clock for ar9271 to 117Mhz */
+        if (AR_SREV_9271(ah)) {
+                if ((pll == 0x142c) || (pll == 0x2850) ) {
+                        udelay(500);
+                        /* set CLKOBS to output AHB clock */
+                        REG_WRITE(ah, 0x7020, 0xe);
+                        /*
+                         * 0x304: 117Mhz, ahb_ratio: 1x1
+                         * 0x306: 40Mhz, ahb_ratio: 1x1
+                         */
+                        REG_WRITE(ah, 0x50040, 0x304);
+                        /*
+                         * makes adjustments for the baud dividor to keep the
+                         * targetted baud rate based on the used core clock.
+                         */
+                        ath9k_hw_change_target_baud(ah, AR9271_CORE_CLOCK,
+                                                    AR9271_TARGET_BAUD_RATE);
+                }
+        }
+
         udelay(RTC_PLL_SETTLE_DELAY);
 
         REG_WRITE(ah, AR_RTC_SLEEP_CLK, AR_RTC_FORCE_DERIVED_CLK);
@@ -1107,7 +1107,7 @@ static void ath9k_hw_init_chain_masks(struct ath_hw *ah)
                 REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
                             AR_PHY_SWAP_ALT_CHAIN);
         case 0x3:
-                if (((ah)->hw_version.macVersion <= AR_SREV_VERSION_9160)) {
+                if (ah->hw_version.macVersion == AR_SREV_REVISION_5416_10) {
                         REG_WRITE(ah, AR_PHY_RX_CHAINMASK, 0x7);
                         REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, 0x7);
                         break;
@@ -1141,7 +1141,7 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
                 AR_IMR_RXORN |
                 AR_IMR_BCNMISC;
 
-        if (ah->config.intr_mitigation)
+        if (ah->config.rx_intr_mitigation)
                 ah->mask_reg |= AR_IMR_RXINTM | AR_IMR_RXMINTR;
         else
                 ah->mask_reg |= AR_IMR_RXOK;
@@ -1161,39 +1161,32 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
         }
 }
 
-static bool ath9k_hw_set_ack_timeout(struct ath_hw *ah, u32 us)
+static void ath9k_hw_setslottime(struct ath_hw *ah, u32 us)
 {
-        if (us > ath9k_hw_mac_to_usec(ah, MS(0xffffffff, AR_TIME_OUT_ACK))) {
-                DPRINTF(ah->ah_sc, ATH_DBG_RESET, "bad ack timeout %u\n", us);
-                ah->acktimeout = (u32) -1;
-                return false;
-        } else {
-                REG_RMW_FIELD(ah, AR_TIME_OUT,
-                              AR_TIME_OUT_ACK, ath9k_hw_mac_to_clks(ah, us));
-                ah->acktimeout = us;
-                return true;
-        }
+        u32 val = ath9k_hw_mac_to_clks(ah, us);
+        val = min(val, (u32) 0xFFFF);
+        REG_WRITE(ah, AR_D_GBL_IFS_SLOT, val);
 }
 
-static bool ath9k_hw_set_cts_timeout(struct ath_hw *ah, u32 us)
+static void ath9k_hw_set_ack_timeout(struct ath_hw *ah, u32 us)
 {
-        if (us > ath9k_hw_mac_to_usec(ah, MS(0xffffffff, AR_TIME_OUT_CTS))) {
-                DPRINTF(ah->ah_sc, ATH_DBG_RESET, "bad cts timeout %u\n", us);
-                ah->ctstimeout = (u32) -1;
-                return false;
-        } else {
-                REG_RMW_FIELD(ah, AR_TIME_OUT,
-                              AR_TIME_OUT_CTS, ath9k_hw_mac_to_clks(ah, us));
-                ah->ctstimeout = us;
-                return true;
-        }
+        u32 val = ath9k_hw_mac_to_clks(ah, us);
+        val = min(val, (u32) MS(0xFFFFFFFF, AR_TIME_OUT_ACK));
+        REG_RMW_FIELD(ah, AR_TIME_OUT, AR_TIME_OUT_ACK, val);
+}
+
+static void ath9k_hw_set_cts_timeout(struct ath_hw *ah, u32 us)
+{
+        u32 val = ath9k_hw_mac_to_clks(ah, us);
+        val = min(val, (u32) MS(0xFFFFFFFF, AR_TIME_OUT_CTS));
+        REG_RMW_FIELD(ah, AR_TIME_OUT, AR_TIME_OUT_CTS, val);
 }
 
 static bool ath9k_hw_set_global_txtimeout(struct ath_hw *ah, u32 tu)
 {
         if (tu > 0xFFFF) {
-                DPRINTF(ah->ah_sc, ATH_DBG_XMIT,
-                        "bad global tx timeout %u\n", tu);
+                ath_print(ath9k_hw_common(ah), ATH_DBG_XMIT,
+                          "bad global tx timeout %u\n", tu);
                 ah->globaltxtimeout = (u32) -1;
                 return false;
         } else {
@@ -1203,40 +1196,66 @@ static bool ath9k_hw_set_global_txtimeout(struct ath_hw *ah, u32 tu)
         }
 }
 
-static void ath9k_hw_init_user_settings(struct ath_hw *ah)
+void ath9k_hw_init_global_settings(struct ath_hw *ah)
 {
-        DPRINTF(ah->ah_sc, ATH_DBG_RESET, "ah->misc_mode 0x%x\n",
-                ah->misc_mode);
+        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
+        int acktimeout;
+        int slottime;
+        int sifstime;
+
+        ath_print(ath9k_hw_common(ah), ATH_DBG_RESET, "ah->misc_mode 0x%x\n",
+                  ah->misc_mode);
 
         if (ah->misc_mode != 0)
                 REG_WRITE(ah, AR_PCU_MISC,
                           REG_READ(ah, AR_PCU_MISC) | ah->misc_mode);
-        if (ah->slottime != (u32) -1)
-                ath9k_hw_setslottime(ah, ah->slottime);
-        if (ah->acktimeout != (u32) -1)
-                ath9k_hw_set_ack_timeout(ah, ah->acktimeout);
-        if (ah->ctstimeout != (u32) -1)
-                ath9k_hw_set_cts_timeout(ah, ah->ctstimeout);
+
+        if (conf->channel && conf->channel->band == IEEE80211_BAND_5GHZ)
+                sifstime = 16;
+        else
+                sifstime = 10;
+
+        /* As defined by IEEE 802.11-2007 17.3.8.6 */
+        slottime = ah->slottime + 3 * ah->coverage_class;
+        acktimeout = slottime + sifstime;
+
+        /*
+         * Workaround for early ACK timeouts, add an offset to match the
+         * initval's 64us ack timeout value.
+         * This was initially only meant to work around an issue with delayed
+         * BA frames in some implementations, but it has been found to fix ACK
+         * timeout issues in other cases as well.
+         */
+        if (conf->channel && conf->channel->band == IEEE80211_BAND_2GHZ)
+                acktimeout += 64 - sifstime - ah->slottime;
+
+        ath9k_hw_setslottime(ah, slottime);
+        ath9k_hw_set_ack_timeout(ah, acktimeout);
+        ath9k_hw_set_cts_timeout(ah, acktimeout);
         if (ah->globaltxtimeout != (u32) -1)
                 ath9k_hw_set_global_txtimeout(ah, ah->globaltxtimeout);
 }
+EXPORT_SYMBOL(ath9k_hw_init_global_settings);
 
-const char *ath9k_hw_probe(u16 vendorid, u16 devid)
+void ath9k_hw_deinit(struct ath_hw *ah)
 {
-        return vendorid == ATHEROS_VENDOR_ID ?
-                ath9k_hw_devname(devid) : NULL;
-}
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (common->state <= ATH_HW_INITIALIZED)
+                goto free_hw;
 
-void ath9k_hw_detach(struct ath_hw *ah)
-{
         if (!AR_SREV_9100(ah))
                 ath9k_hw_ani_disable(ah);
 
-        ath9k_hw_rf_free(ah);
         ath9k_hw_setpower(ah, ATH9K_PM_FULL_SLEEP);
+
+free_hw:
+        if (!AR_SREV_9280_10_OR_LATER(ah))
+                ath9k_hw_rf_free_ext_banks(ah);
         kfree(ah);
         ah = NULL;
 }
+EXPORT_SYMBOL(ath9k_hw_deinit);
 
 /*******/
 /* INI */
@@ -1254,7 +1273,8 @@ static void ath9k_hw_override_ini(struct ath_hw *ah,
                  * AR9271 1.1
                  */
                 if (AR_SREV_9271_10(ah)) {
-                        val = REG_READ(ah, AR_PHY_SPECTRAL_SCAN) | AR_PHY_SPECTRAL_SCAN_ENABLE;
+                        val = REG_READ(ah, AR_PHY_SPECTRAL_SCAN) |
+                              AR_PHY_SPECTRAL_SCAN_ENABLE;
                         REG_WRITE(ah, AR_PHY_SPECTRAL_SCAN, val);
                 }
                 else if (AR_SREV_9271_11(ah))
@@ -1291,6 +1311,16 @@ static void ath9k_hw_override_ini(struct ath_hw *ah,
          * Necessary to avoid issues on AR5416 2.0
          */
         REG_WRITE(ah, 0x9800 + (651 << 2), 0x11);
+
+        /*
+         * Disable RIFS search on some chips to avoid baseband
+         * hang issues.
+         */
+        if (AR_SREV_9100(ah) || AR_SREV_9160(ah)) {
+                val = REG_READ(ah, AR_PHY_HEAVY_CLIP_FACTOR_RIFS);
+                val &= ~AR_PHY_RIFS_INIT_DELAY;
+                REG_WRITE(ah, AR_PHY_HEAVY_CLIP_FACTOR_RIFS, val);
+        }
 }
 
 static u32 ath9k_hw_def_ini_fixup(struct ath_hw *ah,
@@ -1298,28 +1328,29 @@ static u32 ath9k_hw_def_ini_fixup(struct ath_hw *ah,
                               u32 reg, u32 value)
 {
         struct base_eep_header *pBase = &(pEepData->baseEepHeader);
+        struct ath_common *common = ath9k_hw_common(ah);
 
         switch (ah->hw_version.devid) {
         case AR9280_DEVID_PCI:
                 if (reg == 0x7894) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                        ath_print(common, ATH_DBG_EEPROM,
                                 "ini VAL: %x  EEPROM: %x\n", value,
                                 (pBase->version & 0xff));
 
                         if ((pBase->version & 0xff) > 0x0a) {
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "PWDCLKIND: %d\n",
-                                        pBase->pwdclkind);
+                                ath_print(common, ATH_DBG_EEPROM,
+                                          "PWDCLKIND: %d\n",
+                                          pBase->pwdclkind);
                                 value &= ~AR_AN_TOP2_PWDCLKIND;
                                 value |= AR_AN_TOP2_PWDCLKIND &
                                         (pBase->pwdclkind << AR_AN_TOP2_PWDCLKIND_S);
                         } else {
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "PWDCLKIND Earlier Rev\n");
+                                ath_print(common, ATH_DBG_EEPROM,
+                                          "PWDCLKIND Earlier Rev\n");
                         }
 
-                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                "final ini VAL: %x\n", value);
+                        ath_print(common, ATH_DBG_EEPROM,
+                                  "final ini VAL: %x\n", value);
                 }
                 break;
         }
@@ -1374,8 +1405,7 @@ static u32 ath9k_regd_get_ctl(struct ath_regulatory *reg,
 }
 
 static int ath9k_hw_process_ini(struct ath_hw *ah,
-                                struct ath9k_channel *chan,
-                                enum ath9k_ht_macmode macmode)
+                                struct ath9k_channel *chan)
 {
         struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
         int i, regWrites = 0;
@@ -1469,7 +1499,11 @@ static int ath9k_hw_process_ini(struct ath_hw *ah,
                 DO_DELAY(regWrites);
         }
 
-        ath9k_hw_write_regs(ah, modesIndex, freqIndex, regWrites);
+        ath9k_hw_write_regs(ah, freqIndex, regWrites);
+
+        if (AR_SREV_9271_10(ah))
+                REG_WRITE_ARRAY(&ah->iniModes_9271_1_0_only,
+                                modesIndex, regWrites);
 
         if (AR_SREV_9280_20(ah) && IS_CHAN_A_5MHZ_SPACED(chan)) {
                 REG_WRITE_ARRAY(&ah->iniModesAdditional, modesIndex,
@@ -1477,7 +1511,7 @@ static int ath9k_hw_process_ini(struct ath_hw *ah,
         }
 
         ath9k_hw_override_ini(ah, chan);
-        ath9k_hw_set_regs(ah, chan, macmode);
+        ath9k_hw_set_regs(ah, chan);
         ath9k_hw_init_chain_masks(ah);
 
         if (OLC_FOR_AR9280_20_LATER)
@@ -1491,8 +1525,8 @@ static int ath9k_hw_process_ini(struct ath_hw *ah,
                                  (u32) regulatory->power_limit));
 
         if (!ath9k_hw_set_rf_regs(ah, chan, freqIndex)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "ar5416SetRfRegs failed\n");
+                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                          "ar5416SetRfRegs failed\n");
                 return -EIO;
         }
 
@@ -1697,16 +1731,14 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
 
         REG_WRITE(ah, AR_RTC_RC, 0);
         if (!ath9k_hw_wait(ah, AR_RTC_RC, AR_RTC_RC_M, 0, AH_WAIT_TIMEOUT)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_RESET,
-                        "RTC stuck in MAC reset\n");
+                ath_print(ath9k_hw_common(ah), ATH_DBG_RESET,
+                          "RTC stuck in MAC reset\n");
                 return false;
         }
 
         if (!AR_SREV_9100(ah))
                 REG_WRITE(ah, AR_RC, 0);
 
-        ath9k_hw_init_pll(ah, NULL);
-
         if (AR_SREV_9100(ah))
                 udelay(50);
 
@@ -1734,7 +1766,8 @@ static bool ath9k_hw_set_reset_power_on(struct ath_hw *ah)
                            AR_RTC_STATUS_M,
                            AR_RTC_STATUS_ON,
                            AH_WAIT_TIMEOUT)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_RESET, "RTC not waking up\n");
+                ath_print(ath9k_hw_common(ah), ATH_DBG_RESET,
+                          "RTC not waking up\n");
                 return false;
         }
 
@@ -1759,8 +1792,7 @@ static bool ath9k_hw_set_reset_reg(struct ath_hw *ah, u32 type)
         }
 }
 
-static void ath9k_hw_set_regs(struct ath_hw *ah, struct ath9k_channel *chan,
-                              enum ath9k_ht_macmode macmode)
+static void ath9k_hw_set_regs(struct ath_hw *ah, struct ath9k_channel *chan)
 {
         u32 phymode;
         u32 enableDacFifo = 0;
@@ -1779,12 +1811,10 @@ static void ath9k_hw_set_regs(struct ath_hw *ah, struct ath9k_channel *chan,
                     (chan->chanmode == CHANNEL_G_HT40PLUS))
                         phymode |= AR_PHY_FC_DYN2040_PRI_CH;
 
-                if (ah->extprotspacing == ATH9K_HT_EXTPROTSPACING_25)
-                        phymode |= AR_PHY_FC_DYN2040_EXT_CH;
         }
         REG_WRITE(ah, AR_PHY_TURBO, phymode);
 
-        ath9k_hw_set11nmac2040(ah, macmode);
+        ath9k_hw_set11nmac2040(ah);
 
         REG_WRITE(ah, AR_GTXTO, 25 << AR_GTXTO_TIMEOUT_LIMIT_S);
         REG_WRITE(ah, AR_CST, 0xF << AR_CST_TIMEOUT_LIMIT_S);
@@ -1810,17 +1840,19 @@ static bool ath9k_hw_chip_reset(struct ath_hw *ah,
 }
 
 static bool ath9k_hw_channel_change(struct ath_hw *ah,
-                                    struct ath9k_channel *chan,
-                                    enum ath9k_ht_macmode macmode)
+                                    struct ath9k_channel *chan)
 {
         struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_channel *channel = chan->chan;
         u32 synthDelay, qnum;
+        int r;
 
         for (qnum = 0; qnum < AR_NUM_QCU; qnum++) {
                 if (ath9k_hw_numtxpending(ah, qnum)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_QUEUE,
-                                "Transmit frames pending on queue %d\n", qnum);
+                        ath_print(common, ATH_DBG_QUEUE,
+                                  "Transmit frames pending on "
+                                  "queue %d\n", qnum);
                         return false;
                 }
         }
@@ -1828,21 +1860,18 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
         REG_WRITE(ah, AR_PHY_RFBUS_REQ, AR_PHY_RFBUS_REQ_EN);
         if (!ath9k_hw_wait(ah, AR_PHY_RFBUS_GRANT, AR_PHY_RFBUS_GRANT_EN,
                            AR_PHY_RFBUS_GRANT_EN, AH_WAIT_TIMEOUT)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Could not kill baseband RX\n");
+                ath_print(common, ATH_DBG_FATAL,
+                          "Could not kill baseband RX\n");
                 return false;
         }
 
-        ath9k_hw_set_regs(ah, chan, macmode);
+        ath9k_hw_set_regs(ah, chan);
 
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
-                ath9k_hw_ar9280_set_channel(ah, chan);
-        } else {
-                if (!(ath9k_hw_set_channel(ah, chan))) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "Failed to set channel\n");
-                        return false;
-                }
+        r = ah->ath9k_hw_rf_set_freq(ah, chan);
+        if (r) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Failed to set channel\n");
+                return false;
         }
 
         ah->eep_ops->set_txpower(ah, chan,
@@ -1865,10 +1894,7 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
         if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
                 ath9k_hw_set_delta_slope(ah, chan);
 
-        if (AR_SREV_9280_10_OR_LATER(ah))
-                ath9k_hw_9280_spur_mitigate(ah, chan);
-        else
-                ath9k_hw_spur_mitigate(ah, chan);
+        ah->ath9k_hw_spur_mitigate_freq(ah, chan);
 
         if (!chan->oneTimeCalsDone)
                 chan->oneTimeCalsDone = true;
@@ -1876,457 +1902,6 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
         return true;
 }
 
-static void ath9k_hw_9280_spur_mitigate(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        int bb_spur = AR_NO_SPUR;
-        int freq;
-        int bin, cur_bin;
-        int bb_spur_off, spur_subchannel_sd;
-        int spur_freq_sd;
-        int spur_delta_phase;
-        int denominator;
-        int upper, lower, cur_vit_mask;
-        int tmp, newVal;
-        int i;
-        int pilot_mask_reg[4] = { AR_PHY_TIMING7, AR_PHY_TIMING8,
-                          AR_PHY_PILOT_MASK_01_30, AR_PHY_PILOT_MASK_31_60
-        };
-        int chan_mask_reg[4] = { AR_PHY_TIMING9, AR_PHY_TIMING10,
-                         AR_PHY_CHANNEL_MASK_01_30, AR_PHY_CHANNEL_MASK_31_60
-        };
-        int inc[4] = { 0, 100, 0, 0 };
-        struct chan_centers centers;
-
-        int8_t mask_m[123];
-        int8_t mask_p[123];
-        int8_t mask_amt;
-        int tmp_mask;
-        int cur_bb_spur;
-        bool is2GHz = IS_CHAN_2GHZ(chan);
-
-        memset(&mask_m, 0, sizeof(int8_t) * 123);
-        memset(&mask_p, 0, sizeof(int8_t) * 123);
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-        freq = centers.synth_center;
-
-        ah->config.spurmode = SPUR_ENABLE_EEPROM;
-        for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
-                cur_bb_spur = ah->eep_ops->get_spur_channel(ah, i, is2GHz);
-
-                if (is2GHz)
-                        cur_bb_spur = (cur_bb_spur / 10) + AR_BASE_FREQ_2GHZ;
-                else
-                        cur_bb_spur = (cur_bb_spur / 10) + AR_BASE_FREQ_5GHZ;
-
-                if (AR_NO_SPUR == cur_bb_spur)
-                        break;
-                cur_bb_spur = cur_bb_spur - freq;
-
-                if (IS_CHAN_HT40(chan)) {
-                        if ((cur_bb_spur > -AR_SPUR_FEEQ_BOUND_HT40) &&
-                            (cur_bb_spur < AR_SPUR_FEEQ_BOUND_HT40)) {
-                                bb_spur = cur_bb_spur;
-                                break;
-                        }
-                } else if ((cur_bb_spur > -AR_SPUR_FEEQ_BOUND_HT20) &&
-                           (cur_bb_spur < AR_SPUR_FEEQ_BOUND_HT20)) {
-                        bb_spur = cur_bb_spur;
-                        break;
-                }
-        }
-
-        if (AR_NO_SPUR == bb_spur) {
-                REG_CLR_BIT(ah, AR_PHY_FORCE_CLKEN_CCK,
-                            AR_PHY_FORCE_CLKEN_CCK_MRC_MUX);
-                return;
-        } else {
-                REG_CLR_BIT(ah, AR_PHY_FORCE_CLKEN_CCK,
-                            AR_PHY_FORCE_CLKEN_CCK_MRC_MUX);
-        }
-
-        bin = bb_spur * 320;
-
-        tmp = REG_READ(ah, AR_PHY_TIMING_CTRL4(0));
-
-        newVal = tmp | (AR_PHY_TIMING_CTRL4_ENABLE_SPUR_RSSI |
-                        AR_PHY_TIMING_CTRL4_ENABLE_SPUR_FILTER |
-                        AR_PHY_TIMING_CTRL4_ENABLE_CHAN_MASK |
-                        AR_PHY_TIMING_CTRL4_ENABLE_PILOT_MASK);
-        REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0), newVal);
-
-        newVal = (AR_PHY_SPUR_REG_MASK_RATE_CNTL |
-                  AR_PHY_SPUR_REG_ENABLE_MASK_PPM |
-                  AR_PHY_SPUR_REG_MASK_RATE_SELECT |
-                  AR_PHY_SPUR_REG_ENABLE_VIT_SPUR_RSSI |
-                  SM(SPUR_RSSI_THRESH, AR_PHY_SPUR_REG_SPUR_RSSI_THRESH));
-        REG_WRITE(ah, AR_PHY_SPUR_REG, newVal);
-
-        if (IS_CHAN_HT40(chan)) {
-                if (bb_spur < 0) {
-                        spur_subchannel_sd = 1;
-                        bb_spur_off = bb_spur + 10;
-                } else {
-                        spur_subchannel_sd = 0;
-                        bb_spur_off = bb_spur - 10;
-                }
-        } else {
-                spur_subchannel_sd = 0;
-                bb_spur_off = bb_spur;
-        }
-
-        if (IS_CHAN_HT40(chan))
-                spur_delta_phase =
-                        ((bb_spur * 262144) /
-                         10) & AR_PHY_TIMING11_SPUR_DELTA_PHASE;
-        else
-                spur_delta_phase =
-                        ((bb_spur * 524288) /
-                         10) & AR_PHY_TIMING11_SPUR_DELTA_PHASE;
-
-        denominator = IS_CHAN_2GHZ(chan) ? 44 : 40;
-        spur_freq_sd = ((bb_spur_off * 2048) / denominator) & 0x3ff;
-
-        newVal = (AR_PHY_TIMING11_USE_SPUR_IN_AGC |
-                  SM(spur_freq_sd, AR_PHY_TIMING11_SPUR_FREQ_SD) |
-                  SM(spur_delta_phase, AR_PHY_TIMING11_SPUR_DELTA_PHASE));
-        REG_WRITE(ah, AR_PHY_TIMING11, newVal);
-
-        newVal = spur_subchannel_sd << AR_PHY_SFCORR_SPUR_SUBCHNL_SD_S;
-        REG_WRITE(ah, AR_PHY_SFCORR_EXT, newVal);
-
-        cur_bin = -6000;
-        upper = bin + 100;
-        lower = bin - 100;
-
-        for (i = 0; i < 4; i++) {
-                int pilot_mask = 0;
-                int chan_mask = 0;
-                int bp = 0;
-                for (bp = 0; bp < 30; bp++) {
-                        if ((cur_bin > lower) && (cur_bin < upper)) {
-                                pilot_mask = pilot_mask | 0x1 << bp;
-                                chan_mask = chan_mask | 0x1 << bp;
-                        }
-                        cur_bin += 100;
-                }
-                cur_bin += inc[i];
-                REG_WRITE(ah, pilot_mask_reg[i], pilot_mask);
-                REG_WRITE(ah, chan_mask_reg[i], chan_mask);
-        }
-
-        cur_vit_mask = 6100;
-        upper = bin + 120;
-        lower = bin - 120;
-
-        for (i = 0; i < 123; i++) {
-                if ((cur_vit_mask > lower) && (cur_vit_mask < upper)) {
-
-                        /* workaround for gcc bug #37014 */
-                        volatile int tmp_v = abs(cur_vit_mask - bin);
-
-                        if (tmp_v < 75)
-                                mask_amt = 1;
-                        else
-                                mask_amt = 0;
-                        if (cur_vit_mask < 0)
-                                mask_m[abs(cur_vit_mask / 100)] = mask_amt;
-                        else
-                                mask_p[cur_vit_mask / 100] = mask_amt;
-                }
-                cur_vit_mask -= 100;
-        }
-
-        tmp_mask = (mask_m[46] << 30) | (mask_m[47] << 28)
-                | (mask_m[48] << 26) | (mask_m[49] << 24)
-                | (mask_m[50] << 22) | (mask_m[51] << 20)
-                | (mask_m[52] << 18) | (mask_m[53] << 16)
-                | (mask_m[54] << 14) | (mask_m[55] << 12)
-                | (mask_m[56] << 10) | (mask_m[57] << 8)
-                | (mask_m[58] << 6) | (mask_m[59] << 4)
-                | (mask_m[60] << 2) | (mask_m[61] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK_1, tmp_mask);
-        REG_WRITE(ah, AR_PHY_VIT_MASK2_M_46_61, tmp_mask);
-
-        tmp_mask = (mask_m[31] << 28)
-                | (mask_m[32] << 26) | (mask_m[33] << 24)
-                | (mask_m[34] << 22) | (mask_m[35] << 20)
-                | (mask_m[36] << 18) | (mask_m[37] << 16)
-                | (mask_m[48] << 14) | (mask_m[39] << 12)
-                | (mask_m[40] << 10) | (mask_m[41] << 8)
-                | (mask_m[42] << 6) | (mask_m[43] << 4)
-                | (mask_m[44] << 2) | (mask_m[45] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK_2, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_M_31_45, tmp_mask);
-
-        tmp_mask = (mask_m[16] << 30) | (mask_m[16] << 28)
-                | (mask_m[18] << 26) | (mask_m[18] << 24)
-                | (mask_m[20] << 22) | (mask_m[20] << 20)
-                | (mask_m[22] << 18) | (mask_m[22] << 16)
-                | (mask_m[24] << 14) | (mask_m[24] << 12)
-                | (mask_m[25] << 10) | (mask_m[26] << 8)
-                | (mask_m[27] << 6) | (mask_m[28] << 4)
-                | (mask_m[29] << 2) | (mask_m[30] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK_3, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_M_16_30, tmp_mask);
-
-        tmp_mask = (mask_m[0] << 30) | (mask_m[1] << 28)
-                | (mask_m[2] << 26) | (mask_m[3] << 24)
-                | (mask_m[4] << 22) | (mask_m[5] << 20)
-                | (mask_m[6] << 18) | (mask_m[7] << 16)
-                | (mask_m[8] << 14) | (mask_m[9] << 12)
-                | (mask_m[10] << 10) | (mask_m[11] << 8)
-                | (mask_m[12] << 6) | (mask_m[13] << 4)
-                | (mask_m[14] << 2) | (mask_m[15] << 0);
-        REG_WRITE(ah, AR_PHY_MASK_CTL, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_M_00_15, tmp_mask);
-
-        tmp_mask = (mask_p[15] << 28)
-                | (mask_p[14] << 26) | (mask_p[13] << 24)
-                | (mask_p[12] << 22) | (mask_p[11] << 20)
-                | (mask_p[10] << 18) | (mask_p[9] << 16)
-                | (mask_p[8] << 14) | (mask_p[7] << 12)
-                | (mask_p[6] << 10) | (mask_p[5] << 8)
-                | (mask_p[4] << 6) | (mask_p[3] << 4)
-                | (mask_p[2] << 2) | (mask_p[1] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_1, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_15_01, tmp_mask);
-
-        tmp_mask = (mask_p[30] << 28)
-                | (mask_p[29] << 26) | (mask_p[28] << 24)
-                | (mask_p[27] << 22) | (mask_p[26] << 20)
-                | (mask_p[25] << 18) | (mask_p[24] << 16)
-                | (mask_p[23] << 14) | (mask_p[22] << 12)
-                | (mask_p[21] << 10) | (mask_p[20] << 8)
-                | (mask_p[19] << 6) | (mask_p[18] << 4)
-                | (mask_p[17] << 2) | (mask_p[16] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_2, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_30_16, tmp_mask);
-
-        tmp_mask = (mask_p[45] << 28)
-                | (mask_p[44] << 26) | (mask_p[43] << 24)
-                | (mask_p[42] << 22) | (mask_p[41] << 20)
-                | (mask_p[40] << 18) | (mask_p[39] << 16)
-                | (mask_p[38] << 14) | (mask_p[37] << 12)
-                | (mask_p[36] << 10) | (mask_p[35] << 8)
-                | (mask_p[34] << 6) | (mask_p[33] << 4)
-                | (mask_p[32] << 2) | (mask_p[31] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_3, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_45_31, tmp_mask);
-
-        tmp_mask = (mask_p[61] << 30) | (mask_p[60] << 28)
-                | (mask_p[59] << 26) | (mask_p[58] << 24)
-                | (mask_p[57] << 22) | (mask_p[56] << 20)
-                | (mask_p[55] << 18) | (mask_p[54] << 16)
-                | (mask_p[53] << 14) | (mask_p[52] << 12)
-                | (mask_p[51] << 10) | (mask_p[50] << 8)
-                | (mask_p[49] << 6) | (mask_p[48] << 4)
-                | (mask_p[47] << 2) | (mask_p[46] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_4, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_61_45, tmp_mask);
-}
-
-static void ath9k_hw_spur_mitigate(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        int bb_spur = AR_NO_SPUR;
-        int bin, cur_bin;
-        int spur_freq_sd;
-        int spur_delta_phase;
-        int denominator;
-        int upper, lower, cur_vit_mask;
-        int tmp, new;
-        int i;
-        int pilot_mask_reg[4] = { AR_PHY_TIMING7, AR_PHY_TIMING8,
-                          AR_PHY_PILOT_MASK_01_30, AR_PHY_PILOT_MASK_31_60
-        };
-        int chan_mask_reg[4] = { AR_PHY_TIMING9, AR_PHY_TIMING10,
-                         AR_PHY_CHANNEL_MASK_01_30, AR_PHY_CHANNEL_MASK_31_60
-        };
-        int inc[4] = { 0, 100, 0, 0 };
-
-        int8_t mask_m[123];
-        int8_t mask_p[123];
-        int8_t mask_amt;
-        int tmp_mask;
-        int cur_bb_spur;
-        bool is2GHz = IS_CHAN_2GHZ(chan);
-
-        memset(&mask_m, 0, sizeof(int8_t) * 123);
-        memset(&mask_p, 0, sizeof(int8_t) * 123);
-
-        for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
-                cur_bb_spur = ah->eep_ops->get_spur_channel(ah, i, is2GHz);
-                if (AR_NO_SPUR == cur_bb_spur)
-                        break;
-                cur_bb_spur = cur_bb_spur - (chan->channel * 10);
-                if ((cur_bb_spur > -95) && (cur_bb_spur < 95)) {
-                        bb_spur = cur_bb_spur;
-                        break;
-                }
-        }
-
-        if (AR_NO_SPUR == bb_spur)
-                return;
-
-        bin = bb_spur * 32;
-
-        tmp = REG_READ(ah, AR_PHY_TIMING_CTRL4(0));
-        new = tmp | (AR_PHY_TIMING_CTRL4_ENABLE_SPUR_RSSI |
-                     AR_PHY_TIMING_CTRL4_ENABLE_SPUR_FILTER |
-                     AR_PHY_TIMING_CTRL4_ENABLE_CHAN_MASK |
-                     AR_PHY_TIMING_CTRL4_ENABLE_PILOT_MASK);
-
-        REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0), new);
-
-        new = (AR_PHY_SPUR_REG_MASK_RATE_CNTL |
-               AR_PHY_SPUR_REG_ENABLE_MASK_PPM |
-               AR_PHY_SPUR_REG_MASK_RATE_SELECT |
-               AR_PHY_SPUR_REG_ENABLE_VIT_SPUR_RSSI |
-               SM(SPUR_RSSI_THRESH, AR_PHY_SPUR_REG_SPUR_RSSI_THRESH));
-        REG_WRITE(ah, AR_PHY_SPUR_REG, new);
-
-        spur_delta_phase = ((bb_spur * 524288) / 100) &
-                AR_PHY_TIMING11_SPUR_DELTA_PHASE;
-
-        denominator = IS_CHAN_2GHZ(chan) ? 440 : 400;
-        spur_freq_sd = ((bb_spur * 2048) / denominator) & 0x3ff;
-
-        new = (AR_PHY_TIMING11_USE_SPUR_IN_AGC |
-               SM(spur_freq_sd, AR_PHY_TIMING11_SPUR_FREQ_SD) |
-               SM(spur_delta_phase, AR_PHY_TIMING11_SPUR_DELTA_PHASE));
-        REG_WRITE(ah, AR_PHY_TIMING11, new);
-
-        cur_bin = -6000;
-        upper = bin + 100;
-        lower = bin - 100;
-
-        for (i = 0; i < 4; i++) {
-                int pilot_mask = 0;
-                int chan_mask = 0;
-                int bp = 0;
-                for (bp = 0; bp < 30; bp++) {
-                        if ((cur_bin > lower) && (cur_bin < upper)) {
-                                pilot_mask = pilot_mask | 0x1 << bp;
-                                chan_mask = chan_mask | 0x1 << bp;
-                        }
-                        cur_bin += 100;
-                }
-                cur_bin += inc[i];
-                REG_WRITE(ah, pilot_mask_reg[i], pilot_mask);
-                REG_WRITE(ah, chan_mask_reg[i], chan_mask);
-        }
-
-        cur_vit_mask = 6100;
-        upper = bin + 120;
-        lower = bin - 120;
-
-        for (i = 0; i < 123; i++) {
-                if ((cur_vit_mask > lower) && (cur_vit_mask < upper)) {
-
-                        /* workaround for gcc bug #37014 */
-                        volatile int tmp_v = abs(cur_vit_mask - bin);
-
-                        if (tmp_v < 75)
-                                mask_amt = 1;
-                        else
-                                mask_amt = 0;
-                        if (cur_vit_mask < 0)
-                                mask_m[abs(cur_vit_mask / 100)] = mask_amt;
-                        else
-                                mask_p[cur_vit_mask / 100] = mask_amt;
-                }
-                cur_vit_mask -= 100;
-        }
-
-        tmp_mask = (mask_m[46] << 30) | (mask_m[47] << 28)
-                | (mask_m[48] << 26) | (mask_m[49] << 24)
-                | (mask_m[50] << 22) | (mask_m[51] << 20)
-                | (mask_m[52] << 18) | (mask_m[53] << 16)
-                | (mask_m[54] << 14) | (mask_m[55] << 12)
-                | (mask_m[56] << 10) | (mask_m[57] << 8)
-                | (mask_m[58] << 6) | (mask_m[59] << 4)
-                | (mask_m[60] << 2) | (mask_m[61] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK_1, tmp_mask);
-        REG_WRITE(ah, AR_PHY_VIT_MASK2_M_46_61, tmp_mask);
-
-        tmp_mask = (mask_m[31] << 28)
-                | (mask_m[32] << 26) | (mask_m[33] << 24)
-                | (mask_m[34] << 22) | (mask_m[35] << 20)
-                | (mask_m[36] << 18) | (mask_m[37] << 16)
-                | (mask_m[48] << 14) | (mask_m[39] << 12)
-                | (mask_m[40] << 10) | (mask_m[41] << 8)
-                | (mask_m[42] << 6) | (mask_m[43] << 4)
-                | (mask_m[44] << 2) | (mask_m[45] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK_2, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_M_31_45, tmp_mask);
-
-        tmp_mask = (mask_m[16] << 30) | (mask_m[16] << 28)
-                | (mask_m[18] << 26) | (mask_m[18] << 24)
-                | (mask_m[20] << 22) | (mask_m[20] << 20)
-                | (mask_m[22] << 18) | (mask_m[22] << 16)
-                | (mask_m[24] << 14) | (mask_m[24] << 12)
-                | (mask_m[25] << 10) | (mask_m[26] << 8)
-                | (mask_m[27] << 6) | (mask_m[28] << 4)
-                | (mask_m[29] << 2) | (mask_m[30] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK_3, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_M_16_30, tmp_mask);
-
-        tmp_mask = (mask_m[0] << 30) | (mask_m[1] << 28)
-                | (mask_m[2] << 26) | (mask_m[3] << 24)
-                | (mask_m[4] << 22) | (mask_m[5] << 20)
-                | (mask_m[6] << 18) | (mask_m[7] << 16)
-                | (mask_m[8] << 14) | (mask_m[9] << 12)
-                | (mask_m[10] << 10) | (mask_m[11] << 8)
-                | (mask_m[12] << 6) | (mask_m[13] << 4)
-                | (mask_m[14] << 2) | (mask_m[15] << 0);
-        REG_WRITE(ah, AR_PHY_MASK_CTL, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_M_00_15, tmp_mask);
-
-        tmp_mask = (mask_p[15] << 28)
-                | (mask_p[14] << 26) | (mask_p[13] << 24)
-                | (mask_p[12] << 22) | (mask_p[11] << 20)
-                | (mask_p[10] << 18) | (mask_p[9] << 16)
-                | (mask_p[8] << 14) | (mask_p[7] << 12)
-                | (mask_p[6] << 10) | (mask_p[5] << 8)
-                | (mask_p[4] << 6) | (mask_p[3] << 4)
-                | (mask_p[2] << 2) | (mask_p[1] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_1, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_15_01, tmp_mask);
-
-        tmp_mask = (mask_p[30] << 28)
-                | (mask_p[29] << 26) | (mask_p[28] << 24)
-                | (mask_p[27] << 22) | (mask_p[26] << 20)
-                | (mask_p[25] << 18) | (mask_p[24] << 16)
-                | (mask_p[23] << 14) | (mask_p[22] << 12)
-                | (mask_p[21] << 10) | (mask_p[20] << 8)
-                | (mask_p[19] << 6) | (mask_p[18] << 4)
-                | (mask_p[17] << 2) | (mask_p[16] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_2, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_30_16, tmp_mask);
-
-        tmp_mask = (mask_p[45] << 28)
-                | (mask_p[44] << 26) | (mask_p[43] << 24)
-                | (mask_p[42] << 22) | (mask_p[41] << 20)
-                | (mask_p[40] << 18) | (mask_p[39] << 16)
-                | (mask_p[38] << 14) | (mask_p[37] << 12)
-                | (mask_p[36] << 10) | (mask_p[35] << 8)
-                | (mask_p[34] << 6) | (mask_p[33] << 4)
-                | (mask_p[32] << 2) | (mask_p[31] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_3, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_45_31, tmp_mask);
-
-        tmp_mask = (mask_p[61] << 30) | (mask_p[60] << 28)
-                | (mask_p[59] << 26) | (mask_p[58] << 24)
-                | (mask_p[57] << 22) | (mask_p[56] << 20)
-                | (mask_p[55] << 18) | (mask_p[54] << 16)
-                | (mask_p[53] << 14) | (mask_p[52] << 12)
-                | (mask_p[51] << 10) | (mask_p[50] << 8)
-                | (mask_p[49] << 6) | (mask_p[48] << 4)
-                | (mask_p[47] << 2) | (mask_p[46] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_4, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_61_45, tmp_mask);
-}
-
 static void ath9k_enable_rfkill(struct ath_hw *ah)
 {
         REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL,
@@ -2342,17 +1917,16 @@ static void ath9k_enable_rfkill(struct ath_hw *ah)
 int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                     bool bChannelChange)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         u32 saveLedState;
-        struct ath_softc *sc = ah->ah_sc;
         struct ath9k_channel *curchan = ah->curchan;
         u32 saveDefAntenna;
         u32 macStaId1;
         u64 tsf = 0;
         int i, rx_chainmask, r;
 
-        ah->extprotspacing = sc->ht_extprotspacing;
-        ah->txchainmask = sc->tx_chainmask;
-        ah->rxchainmask = sc->rx_chainmask;
+        ah->txchainmask = common->tx_chainmask;
+        ah->rxchainmask = common->rx_chainmask;
 
         if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
                 return -EIO;
@@ -2369,7 +1943,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
              !(AR_SREV_9280(ah) || IS_CHAN_A_5MHZ_SPACED(chan) ||
              IS_CHAN_A_5MHZ_SPACED(ah->curchan))) {
 
-                if (ath9k_hw_channel_change(ah, chan, sc->tx_chan_width)) {
+                if (ath9k_hw_channel_change(ah, chan)) {
                         ath9k_hw_loadnf(ah, ah->curchan);
                         ath9k_hw_start_nfcal(ah);
                         return 0;
@@ -2400,7 +1974,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         }
 
         if (!ath9k_hw_chip_reset(ah, chan)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL, "Chip reset failed\n");
+                ath_print(common, ATH_DBG_FATAL, "Chip reset failed\n");
                 return -EINVAL;
         }
 
@@ -2429,7 +2003,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 REG_SET_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
                                 AR_MAC_PCU_ASYNC_FIFO_REG3_SOFT_RESET);
         }
-        r = ath9k_hw_process_ini(ah, chan, sc->tx_chan_width);
+        r = ath9k_hw_process_ini(ah, chan);
         if (r)
                 return r;
 
@@ -2453,17 +2027,11 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
                 ath9k_hw_set_delta_slope(ah, chan);
 
-        if (AR_SREV_9280_10_OR_LATER(ah))
-                ath9k_hw_9280_spur_mitigate(ah, chan);
-        else
-                ath9k_hw_spur_mitigate(ah, chan);
-
+        ah->ath9k_hw_spur_mitigate_freq(ah, chan);
         ah->eep_ops->set_board_values(ah, chan);
 
-        ath9k_hw_decrease_chain_power(ah, chan);
-
-        REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(ah->macaddr));
-        REG_WRITE(ah, AR_STA_ID1, get_unaligned_le16(ah->macaddr + 4)
+        REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
+        REG_WRITE(ah, AR_STA_ID1, get_unaligned_le16(common->macaddr + 4)
                   | macStaId1
                   | AR_STA_ID1_RTS_USE_DEF
                   | (ah->config.
@@ -2471,24 +2039,19 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                   | ah->sta_id1_defaults);
         ath9k_hw_set_operating_mode(ah, ah->opmode);
 
-        REG_WRITE(ah, AR_BSSMSKL, get_unaligned_le32(sc->bssidmask));
-        REG_WRITE(ah, AR_BSSMSKU, get_unaligned_le16(sc->bssidmask + 4));
+        ath_hw_setbssidmask(common);
 
         REG_WRITE(ah, AR_DEF_ANTENNA, saveDefAntenna);
 
-        REG_WRITE(ah, AR_BSS_ID0, get_unaligned_le32(sc->curbssid));
-        REG_WRITE(ah, AR_BSS_ID1, get_unaligned_le16(sc->curbssid + 4) |
-                  ((sc->curaid & 0x3fff) << AR_BSS_ID1_AID_S));
+        ath9k_hw_write_associd(ah);
 
         REG_WRITE(ah, AR_ISR, ~0);
 
         REG_WRITE(ah, AR_RSSI_THR, INIT_RSSI_THR);
 
-        if (AR_SREV_9280_10_OR_LATER(ah))
-                ath9k_hw_ar9280_set_channel(ah, chan);
-        else
-                if (!(ath9k_hw_set_channel(ah, chan)))
-                        return -EIO;
+        r = ah->ath9k_hw_rf_set_freq(ah, chan);
+        if (r)
+                return r;
 
         for (i = 0; i < AR_NUM_DCU; i++)
                 REG_WRITE(ah, AR_DQCUMASK(i), 1 << i);
@@ -2503,7 +2066,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (ah->caps.hw_caps & ATH9K_HW_CAP_RFSILENT)
                 ath9k_enable_rfkill(ah);
 
-        ath9k_hw_init_user_settings(ah);
+        ath9k_hw_init_global_settings(ah);
 
         if (AR_SREV_9287_12_OR_LATER(ah)) {
                 REG_WRITE(ah, AR_D_GBL_IFS_SIFS,
@@ -2533,7 +2096,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         REG_WRITE(ah, AR_OBS, 8);
 
-        if (ah->config.intr_mitigation) {
+        if (ah->config.rx_intr_mitigation) {
                 REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_LAST, 500);
                 REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_FIRST, 2000);
         }
@@ -2558,13 +2121,13 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 u32 mask;
                 mask = REG_READ(ah, AR_CFG);
                 if (mask & (AR_CFG_SWRB | AR_CFG_SWTB | AR_CFG_SWRG)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_RESET,
+                        ath_print(common, ATH_DBG_RESET,
                                 "CFG Byte Swap Set 0x%x\n", mask);
                 } else {
                         mask =
                                 INIT_CONFIG_STATUS | AR_CFG_SWRB | AR_CFG_SWTB;
                         REG_WRITE(ah, AR_CFG, mask);
-                        DPRINTF(ah->ah_sc, ATH_DBG_RESET,
+                        ath_print(common, ATH_DBG_RESET,
                                 "Setting CFG 0x%x\n", REG_READ(ah, AR_CFG));
                 }
         } else {
@@ -2577,11 +2140,12 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 #endif
         }
 
-        if (ah->ah_sc->sc_flags & SC_OP_BTCOEX_ENABLED)
+        if (ah->btcoex_hw.enabled)
                 ath9k_hw_btcoex_enable(ah);
 
         return 0;
 }
+EXPORT_SYMBOL(ath9k_hw_reset);
 
 /************************/
 /* Key Cache Management */
@@ -2592,8 +2156,8 @@ bool ath9k_hw_keyreset(struct ath_hw *ah, u16 entry)
         u32 keyType;
 
         if (entry >= ah->caps.keycache_size) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "keychache entry %u out of range\n", entry);
+                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                          "keychache entry %u out of range\n", entry);
                 return false;
         }
 
@@ -2620,14 +2184,15 @@ bool ath9k_hw_keyreset(struct ath_hw *ah, u16 entry)
 
         return true;
 }
+EXPORT_SYMBOL(ath9k_hw_keyreset);
 
 bool ath9k_hw_keysetmac(struct ath_hw *ah, u16 entry, const u8 *mac)
 {
         u32 macHi, macLo;
 
         if (entry >= ah->caps.keycache_size) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "keychache entry %u out of range\n", entry);
+                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                          "keychache entry %u out of range\n", entry);
                 return false;
         }
 
@@ -2648,18 +2213,20 @@ bool ath9k_hw_keysetmac(struct ath_hw *ah, u16 entry, const u8 *mac)
 
         return true;
 }
+EXPORT_SYMBOL(ath9k_hw_keysetmac);
 
 bool ath9k_hw_set_keycache_entry(struct ath_hw *ah, u16 entry,
                                  const struct ath9k_keyval *k,
                                  const u8 *mac)
 {
         const struct ath9k_hw_capabilities *pCap = &ah->caps;
+        struct ath_common *common = ath9k_hw_common(ah);
         u32 key0, key1, key2, key3, key4;
         u32 keyType;
 
         if (entry >= pCap->keycache_size) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "keycache entry %u out of range\n", entry);
+                ath_print(common, ATH_DBG_FATAL,
+                          "keycache entry %u out of range\n", entry);
                 return false;
         }
 
@@ -2669,9 +2236,9 @@ bool ath9k_hw_set_keycache_entry(struct ath_hw *ah, u16 entry,
                 break;
         case ATH9K_CIPHER_AES_CCM:
                 if (!(pCap->hw_caps & ATH9K_HW_CAP_CIPHER_AESCCM)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_ANY,
-                                "AES-CCM not supported by mac rev 0x%x\n",
-                                ah->hw_version.macRev);
+                        ath_print(common, ATH_DBG_ANY,
+                                  "AES-CCM not supported by mac rev 0x%x\n",
+                                  ah->hw_version.macRev);
                         return false;
                 }
                 keyType = AR_KEYTABLE_TYPE_CCM;
@@ -2680,15 +2247,15 @@ bool ath9k_hw_set_keycache_entry(struct ath_hw *ah, u16 entry,
                 keyType = AR_KEYTABLE_TYPE_TKIP;
                 if (ATH9K_IS_MIC_ENABLED(ah)
                     && entry + 64 >= pCap->keycache_size) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_ANY,
-                                "entry %u inappropriate for TKIP\n", entry);
+                        ath_print(common, ATH_DBG_ANY,
+                                  "entry %u inappropriate for TKIP\n", entry);
                         return false;
                 }
                 break;
         case ATH9K_CIPHER_WEP:
                 if (k->kv_len < WLAN_KEY_LEN_WEP40) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_ANY,
-                                "WEP key length %u too small\n", k->kv_len);
+                        ath_print(common, ATH_DBG_ANY,
+                                  "WEP key length %u too small\n", k->kv_len);
                         return false;
                 }
                 if (k->kv_len <= WLAN_KEY_LEN_WEP40)
@@ -2702,8 +2269,8 @@ bool ath9k_hw_set_keycache_entry(struct ath_hw *ah, u16 entry,
                 keyType = AR_KEYTABLE_TYPE_CLR;
                 break;
         default:
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "cipher %u not supported\n", k->kv_type);
+                ath_print(common, ATH_DBG_FATAL,
+                          "cipher %u not supported\n", k->kv_type);
                 return false;
         }
 
@@ -2845,6 +2412,7 @@ bool ath9k_hw_set_keycache_entry(struct ath_hw *ah, u16 entry,
 
         return true;
 }
+EXPORT_SYMBOL(ath9k_hw_set_keycache_entry);
 
 bool ath9k_hw_keyisvalid(struct ath_hw *ah, u16 entry)
 {
@@ -2855,6 +2423,7 @@ bool ath9k_hw_keyisvalid(struct ath_hw *ah, u16 entry)
         }
         return false;
 }
+EXPORT_SYMBOL(ath9k_hw_keyisvalid);
 
 /******************************/
 /* Power Management (Chipset) */
@@ -2869,8 +2438,9 @@ static void ath9k_set_power_sleep(struct ath_hw *ah, int setChip)
                 if (!AR_SREV_9100(ah))
                         REG_WRITE(ah, AR_RC, AR_RC_AHB | AR_RC_HOSTIF);
 
-                REG_CLR_BIT(ah, (AR_RTC_RESET),
-                            AR_RTC_RESET_EN);
+                if(!AR_SREV_5416(ah))
+                        REG_CLR_BIT(ah, (AR_RTC_RESET),
+                                    AR_RTC_RESET_EN);
         }
 }
 
@@ -2902,6 +2472,7 @@ static bool ath9k_hw_set_power_awake(struct ath_hw *ah, int setChip)
                                            ATH9K_RESET_POWER_ON) != true) {
                                 return false;
                         }
+                        ath9k_hw_init_pll(ah, NULL);
                 }
                 if (AR_SREV_9100(ah))
                         REG_SET_BIT(ah, AR_RTC_RESET,
@@ -2920,8 +2491,9 @@ static bool ath9k_hw_set_power_awake(struct ath_hw *ah, int setChip)
                                     AR_RTC_FORCE_WAKE_EN);
                 }
                 if (i == 0) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "Failed to wakeup in %uus\n", POWER_UP_TIME / 20);
+                        ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                                  "Failed to wakeup in %uus\n",
+                                  POWER_UP_TIME / 20);
                         return false;
                 }
         }
@@ -2931,9 +2503,9 @@ static bool ath9k_hw_set_power_awake(struct ath_hw *ah, int setChip)
         return true;
 }
 
-static bool ath9k_hw_setpower_nolock(struct ath_hw *ah,
-                                     enum ath9k_power_mode mode)
+bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         int status = true, setChip = true;
         static const char *modes[] = {
                 "AWAKE",
@@ -2945,8 +2517,8 @@ static bool ath9k_hw_setpower_nolock(struct ath_hw *ah,
         if (ah->power_mode == mode)
                 return status;
 
-        DPRINTF(ah->ah_sc, ATH_DBG_RESET, "%s -> %s\n",
-                modes[ah->power_mode], modes[mode]);
+        ath_print(common, ATH_DBG_RESET, "%s -> %s\n",
+                  modes[ah->power_mode], modes[mode]);
 
         switch (mode) {
         case ATH9K_PM_AWAKE:
@@ -2960,59 +2532,15 @@ static bool ath9k_hw_setpower_nolock(struct ath_hw *ah,
                 ath9k_set_power_network_sleep(ah, setChip);
                 break;
         default:
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Unknown power mode %u\n", mode);
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unknown power mode %u\n", mode);
                 return false;
         }
         ah->power_mode = mode;
 
         return status;
 }
-
-bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode)
-{
-        unsigned long flags;
-        bool ret;
-
-        spin_lock_irqsave(&ah->ah_sc->sc_pm_lock, flags);
-        ret = ath9k_hw_setpower_nolock(ah, mode);
-        spin_unlock_irqrestore(&ah->ah_sc->sc_pm_lock, flags);
-
-        return ret;
-}
-
-void ath9k_ps_wakeup(struct ath_softc *sc)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&sc->sc_pm_lock, flags);
-        if (++sc->ps_usecount != 1)
-                goto unlock;
-
-        ath9k_hw_setpower_nolock(sc->sc_ah, ATH9K_PM_AWAKE);
-
- unlock:
-        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
-}
-
-void ath9k_ps_restore(struct ath_softc *sc)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&sc->sc_pm_lock, flags);
-        if (--sc->ps_usecount != 0)
-                goto unlock;
-
-        if (sc->ps_enabled &&
-            !(sc->sc_flags & (SC_OP_WAIT_FOR_BEACON |
-                              SC_OP_WAIT_FOR_CAB |
-                              SC_OP_WAIT_FOR_PSPOLL_DATA |
-                              SC_OP_WAIT_FOR_TX_ACK)))
-                ath9k_hw_setpower_nolock(sc->sc_ah, ATH9K_PM_NETWORK_SLEEP);
-
- unlock:
-        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
-}
+EXPORT_SYMBOL(ath9k_hw_setpower);
 
 /*
  * Helper for ASPM support.
@@ -3145,6 +2673,7 @@ void ath9k_hw_configpcipowersave(struct ath_hw *ah, int restore, int power_off)
                 }
         }
 }
+EXPORT_SYMBOL(ath9k_hw_configpcipowersave);
 
 /**********************/
 /* Interrupt Handling */
@@ -3168,6 +2697,7 @@ bool ath9k_hw_intrpend(struct ath_hw *ah)
 
         return false;
 }
+EXPORT_SYMBOL(ath9k_hw_intrpend);
 
 bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked)
 {
@@ -3176,6 +2706,7 @@ bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked)
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         u32 sync_cause = 0;
         bool fatal_int = false;
+        struct ath_common *common = ath9k_hw_common(ah);
 
         if (!AR_SREV_9100(ah)) {
                 if (REG_READ(ah, AR_INTR_ASYNC_CAUSE) & AR_INTR_MAC_IRQ) {
@@ -3225,7 +2756,7 @@ bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked)
 
                 *masked = isr & ATH9K_INT_COMMON;
 
-                if (ah->config.intr_mitigation) {
+                if (ah->config.rx_intr_mitigation) {
                         if (isr & (AR_ISR_RXMINTR | AR_ISR_RXINTM))
                                 *masked |= ATH9K_INT_RX;
                 }
@@ -3249,8 +2780,8 @@ bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked)
                 }
 
                 if (isr & AR_ISR_RXORN) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_INTERRUPT,
-                                "receive FIFO overrun interrupt\n");
+                        ath_print(common, ATH_DBG_INTERRUPT,
+                                  "receive FIFO overrun interrupt\n");
                 }
 
                 if (!AR_SREV_9100(ah)) {
@@ -3292,25 +2823,25 @@ bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked)
 
                 if (fatal_int) {
                         if (sync_cause & AR_INTR_SYNC_HOST1_FATAL) {
-                                DPRINTF(ah->ah_sc, ATH_DBG_ANY,
-                                        "received PCI FATAL interrupt\n");
+                                ath_print(common, ATH_DBG_ANY,
+                                          "received PCI FATAL interrupt\n");
                         }
                         if (sync_cause & AR_INTR_SYNC_HOST1_PERR) {
-                                DPRINTF(ah->ah_sc, ATH_DBG_ANY,
-                                        "received PCI PERR interrupt\n");
+                                ath_print(common, ATH_DBG_ANY,
+                                          "received PCI PERR interrupt\n");
                         }
                         *masked |= ATH9K_INT_FATAL;
                 }
                 if (sync_cause & AR_INTR_SYNC_RADM_CPL_TIMEOUT) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_INTERRUPT,
-                                "AR_INTR_SYNC_RADM_CPL_TIMEOUT\n");
+                        ath_print(common, ATH_DBG_INTERRUPT,
+                                  "AR_INTR_SYNC_RADM_CPL_TIMEOUT\n");
                         REG_WRITE(ah, AR_RC, AR_RC_HOSTIF);
                         REG_WRITE(ah, AR_RC, 0);
                         *masked |= ATH9K_INT_FATAL;
                 }
                 if (sync_cause & AR_INTR_SYNC_LOCAL_TIMEOUT) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_INTERRUPT,
-                                "AR_INTR_SYNC_LOCAL_TIMEOUT\n");
+                        ath_print(common, ATH_DBG_INTERRUPT,
+                                  "AR_INTR_SYNC_LOCAL_TIMEOUT\n");
                 }
 
                 REG_WRITE(ah, AR_INTR_SYNC_CAUSE_CLR, sync_cause);
@@ -3319,17 +2850,19 @@ bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked)
 
         return true;
 }
+EXPORT_SYMBOL(ath9k_hw_getisr);
 
 enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
 {
         u32 omask = ah->mask_reg;
         u32 mask, mask2;
         struct ath9k_hw_capabilities *pCap = &ah->caps;
+        struct ath_common *common = ath9k_hw_common(ah);
 
-        DPRINTF(ah->ah_sc, ATH_DBG_INTERRUPT, "0x%x => 0x%x\n", omask, ints);
+        ath_print(common, ATH_DBG_INTERRUPT, "0x%x => 0x%x\n", omask, ints);
 
         if (omask & ATH9K_INT_GLOBAL) {
-                DPRINTF(ah->ah_sc, ATH_DBG_INTERRUPT, "disable IER\n");
+                ath_print(common, ATH_DBG_INTERRUPT, "disable IER\n");
                 REG_WRITE(ah, AR_IER, AR_IER_DISABLE);
                 (void) REG_READ(ah, AR_IER);
                 if (!AR_SREV_9100(ah)) {
@@ -3356,7 +2889,7 @@ enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
         }
         if (ints & ATH9K_INT_RX) {
                 mask |= AR_IMR_RXERR;
-                if (ah->config.intr_mitigation)
+                if (ah->config.rx_intr_mitigation)
                         mask |= AR_IMR_RXMINTR | AR_IMR_RXINTM;
                 else
                         mask |= AR_IMR_RXOK | AR_IMR_RXDESC;
@@ -3386,7 +2919,7 @@ enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
                         mask2 |= AR_IMR_S2_CST;
         }
 
-        DPRINTF(ah->ah_sc, ATH_DBG_INTERRUPT, "new IMR 0x%x\n", mask);
+        ath_print(common, ATH_DBG_INTERRUPT, "new IMR 0x%x\n", mask);
         REG_WRITE(ah, AR_IMR, mask);
         mask = REG_READ(ah, AR_IMR_S2) & ~(AR_IMR_S2_TIM |
                                            AR_IMR_S2_DTIM |
@@ -3406,7 +2939,7 @@ enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
         }
 
         if (ints & ATH9K_INT_GLOBAL) {
-                DPRINTF(ah->ah_sc, ATH_DBG_INTERRUPT, "enable IER\n");
+                ath_print(common, ATH_DBG_INTERRUPT, "enable IER\n");
                 REG_WRITE(ah, AR_IER, AR_IER_ENABLE);
                 if (!AR_SREV_9100(ah)) {
                         REG_WRITE(ah, AR_INTR_ASYNC_ENABLE,
@@ -3419,12 +2952,13 @@ enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
                         REG_WRITE(ah, AR_INTR_SYNC_MASK,
                                   AR_INTR_SYNC_DEFAULT);
                 }
-                DPRINTF(ah->ah_sc, ATH_DBG_INTERRUPT, "AR_IMR 0x%x IER 0x%x\n",
-                         REG_READ(ah, AR_IMR), REG_READ(ah, AR_IER));
+                ath_print(common, ATH_DBG_INTERRUPT, "AR_IMR 0x%x IER 0x%x\n",
+                          REG_READ(ah, AR_IMR), REG_READ(ah, AR_IER));
         }
 
         return omask;
 }
+EXPORT_SYMBOL(ath9k_hw_set_interrupts);
 
 /*******************/
 /* Beacon Handling */
@@ -3467,9 +3001,9 @@ void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period)
                         AR_TBTT_TIMER_EN | AR_DBA_TIMER_EN | AR_SWBA_TIMER_EN;
                 break;
         default:
-                DPRINTF(ah->ah_sc, ATH_DBG_BEACON,
-                        "%s: unsupported opmode: %d\n",
-                        __func__, ah->opmode);
+                ath_print(ath9k_hw_common(ah), ATH_DBG_BEACON,
+                          "%s: unsupported opmode: %d\n",
+                          __func__, ah->opmode);
                 return;
                 break;
         }
@@ -3481,18 +3015,19 @@ void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period)
 
         beacon_period &= ~ATH9K_BEACON_ENA;
         if (beacon_period & ATH9K_BEACON_RESET_TSF) {
-                beacon_period &= ~ATH9K_BEACON_RESET_TSF;
                 ath9k_hw_reset_tsf(ah);
         }
 
         REG_SET_BIT(ah, AR_TIMER_MODE, flags);
 }
+EXPORT_SYMBOL(ath9k_hw_beaconinit);
 
 void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
                                     const struct ath9k_beacon_state *bs)
 {
         u32 nextTbtt, beaconintval, dtimperiod, beacontimeout;
         struct ath9k_hw_capabilities *pCap = &ah->caps;
+        struct ath_common *common = ath9k_hw_common(ah);
 
         REG_WRITE(ah, AR_NEXT_TBTT_TIMER, TU_TO_USEC(bs->bs_nexttbtt));
 
@@ -3518,10 +3053,10 @@ void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
         else
                 nextTbtt = bs->bs_nexttbtt;
 
-        DPRINTF(ah->ah_sc, ATH_DBG_BEACON, "next DTIM %d\n", bs->bs_nextdtim);
-        DPRINTF(ah->ah_sc, ATH_DBG_BEACON, "next beacon %d\n", nextTbtt);
-        DPRINTF(ah->ah_sc, ATH_DBG_BEACON, "beacon period %d\n", beaconintval);
-        DPRINTF(ah->ah_sc, ATH_DBG_BEACON, "DTIM period %d\n", dtimperiod);
+        ath_print(common, ATH_DBG_BEACON, "next DTIM %d\n", bs->bs_nextdtim);
+        ath_print(common, ATH_DBG_BEACON, "next beacon %d\n", nextTbtt);
+        ath_print(common, ATH_DBG_BEACON, "beacon period %d\n", beaconintval);
+        ath_print(common, ATH_DBG_BEACON, "DTIM period %d\n", dtimperiod);
 
         REG_WRITE(ah, AR_NEXT_DTIM,
                   TU_TO_USEC(bs->bs_nextdtim - SLEEP_SLOP));
@@ -3549,16 +3084,18 @@ void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
         /* TSF Out of Range Threshold */
         REG_WRITE(ah, AR_TSFOOR_THRESHOLD, bs->bs_tsfoor_threshold);
 }
+EXPORT_SYMBOL(ath9k_hw_set_sta_beacon_timers);
 
 /*******************/
 /* HW Capabilities */
 /*******************/
 
-void ath9k_hw_fill_cap_info(struct ath_hw *ah)
+int ath9k_hw_fill_cap_info(struct ath_hw *ah)
 {
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
-        struct ath_btcoex_info *btcoex_info = &ah->ah_sc->btcoex_info;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_btcoex_hw *btcoex_hw = &ah->btcoex_hw;
 
         u16 capField = 0, eeval;
 
@@ -3579,11 +3116,17 @@ void ath9k_hw_fill_cap_info(struct ath_hw *ah)
                         regulatory->current_rd += 5;
                 else if (regulatory->current_rd == 0x41)
                         regulatory->current_rd = 0x43;
-                DPRINTF(ah->ah_sc, ATH_DBG_REGULATORY,
-                        "regdomain mapped to 0x%x\n", regulatory->current_rd);
+                ath_print(common, ATH_DBG_REGULATORY,
+                          "regdomain mapped to 0x%x\n", regulatory->current_rd);
         }
 
         eeval = ah->eep_ops->get_eeprom(ah, EEP_OP_MODE);
+        if ((eeval & (AR5416_OPFLAGS_11G | AR5416_OPFLAGS_11A)) == 0) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "no band has been marked as supported in EEPROM.\n");
+                return -EINVAL;
+        }
+
         bitmap_zero(pCap->wireless_modes, ATH9K_MODE_MAX);
 
         if (eeval & AR5416_OPFLAGS_11A) {
@@ -3670,7 +3213,11 @@ void ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->keycache_size = AR_KEYTABLE_SIZE;
 
         pCap->hw_caps |= ATH9K_HW_CAP_FASTCC;
-        pCap->tx_triglevel_max = MAX_TX_FIFO_THRESHOLD;
+
+        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
+                pCap->tx_triglevel_max = MAX_TX_FIFO_THRESHOLD >> 1;
+        else
+                pCap->tx_triglevel_max = MAX_TX_FIFO_THRESHOLD;
 
         if (AR_SREV_9285_10_OR_LATER(ah))
                 pCap->num_gpio_pins = AR9285_NUM_GPIO;
@@ -3719,7 +3266,10 @@ void ath9k_hw_fill_cap_info(struct ath_hw *ah)
                         AR_EEPROM_EEREGCAP_EN_KK_U1_EVEN;
         }
 
-        pCap->reg_cap |= AR_EEPROM_EEREGCAP_EN_FCC_MIDBAND;
+        /* Advertise midband for AR5416 with FCC midband set in eeprom */
+        if (regulatory->current_rd_ext & (1 << REG_EXT_FCC_MIDBAND) &&
+            AR_SREV_5416(ah))
+                pCap->reg_cap |= AR_EEPROM_EEREGCAP_EN_FCC_MIDBAND;
 
         pCap->num_antcfg_5ghz =
                 ah->eep_ops->get_num_ant_config(ah, ATH9K_HAL_FREQ_BAND_5GHZ);
@@ -3727,19 +3277,21 @@ void ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 ah->eep_ops->get_num_ant_config(ah, ATH9K_HAL_FREQ_BAND_2GHZ);
 
         if (AR_SREV_9280_10_OR_LATER(ah) &&
-            ath_btcoex_supported(ah->hw_version.subsysid)) {
-                btcoex_info->btactive_gpio = ATH_BTACTIVE_GPIO;
-                btcoex_info->wlanactive_gpio = ATH_WLANACTIVE_GPIO;
+            ath9k_hw_btcoex_supported(ah)) {
+                btcoex_hw->btactive_gpio = ATH_BTACTIVE_GPIO;
+                btcoex_hw->wlanactive_gpio = ATH_WLANACTIVE_GPIO;
 
                 if (AR_SREV_9285(ah)) {
-                        btcoex_info->btcoex_scheme = ATH_BTCOEX_CFG_3WIRE;
-                        btcoex_info->btpriority_gpio = ATH_BTPRIORITY_GPIO;
+                        btcoex_hw->scheme = ATH_BTCOEX_CFG_3WIRE;
+                        btcoex_hw->btpriority_gpio = ATH_BTPRIORITY_GPIO;
                 } else {
-                        btcoex_info->btcoex_scheme = ATH_BTCOEX_CFG_2WIRE;
+                        btcoex_hw->scheme = ATH_BTCOEX_CFG_2WIRE;
                 }
         } else {
-                btcoex_info->btcoex_scheme = ATH_BTCOEX_CFG_NONE;
+                btcoex_hw->scheme = ATH_BTCOEX_CFG_NONE;
         }
+
+        return 0;
 }
 
 bool ath9k_hw_getcapability(struct ath_hw *ah, enum ath9k_capability_type type,
@@ -3812,6 +3364,7 @@ bool ath9k_hw_getcapability(struct ath_hw *ah, enum ath9k_capability_type type,
                 return false;
         }
 }
+EXPORT_SYMBOL(ath9k_hw_getcapability);
 
 bool ath9k_hw_setcapability(struct ath_hw *ah, enum ath9k_capability_type type,
                             u32 capability, u32 setting, int *status)
@@ -3845,6 +3398,7 @@ bool ath9k_hw_setcapability(struct ath_hw *ah, enum ath9k_capability_type type,
                 return false;
         }
 }
+EXPORT_SYMBOL(ath9k_hw_setcapability);
 
 /****************************/
 /* GPIO / RFKILL / Antennae */
@@ -3882,7 +3436,7 @@ void ath9k_hw_cfg_gpio_input(struct ath_hw *ah, u32 gpio)
 {
         u32 gpio_shift;
 
-        ASSERT(gpio < ah->caps.num_gpio_pins);
+        BUG_ON(gpio >= ah->caps.num_gpio_pins);
 
         gpio_shift = gpio << 1;
 
@@ -3891,6 +3445,7 @@ void ath9k_hw_cfg_gpio_input(struct ath_hw *ah, u32 gpio)
                 (AR_GPIO_OE_OUT_DRV_NO << gpio_shift),
                 (AR_GPIO_OE_OUT_DRV << gpio_shift));
 }
+EXPORT_SYMBOL(ath9k_hw_cfg_gpio_input);
 
 u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio)
 {
@@ -3909,6 +3464,7 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio)
         else
                 return MS_REG_READ(AR, gpio) != 0;
 }
+EXPORT_SYMBOL(ath9k_hw_gpio_get);
 
 void ath9k_hw_cfg_output(struct ath_hw *ah, u32 gpio,
                          u32 ah_signal_type)
@@ -3924,67 +3480,26 @@ void ath9k_hw_cfg_output(struct ath_hw *ah, u32 gpio,
                 (AR_GPIO_OE_OUT_DRV_ALL << gpio_shift),
                 (AR_GPIO_OE_OUT_DRV << gpio_shift));
 }
+EXPORT_SYMBOL(ath9k_hw_cfg_output);
 
 void ath9k_hw_set_gpio(struct ath_hw *ah, u32 gpio, u32 val)
 {
         REG_RMW(ah, AR_GPIO_IN_OUT, ((val & 1) << gpio),
                 AR_GPIO_BIT(gpio));
 }
+EXPORT_SYMBOL(ath9k_hw_set_gpio);
 
 u32 ath9k_hw_getdefantenna(struct ath_hw *ah)
 {
         return REG_READ(ah, AR_DEF_ANTENNA) & 0x7;
 }
+EXPORT_SYMBOL(ath9k_hw_getdefantenna);
 
 void ath9k_hw_setantenna(struct ath_hw *ah, u32 antenna)
 {
         REG_WRITE(ah, AR_DEF_ANTENNA, (antenna & 0x7));
 }
-
-bool ath9k_hw_setantennaswitch(struct ath_hw *ah,
-                               enum ath9k_ant_setting settings,
-                               struct ath9k_channel *chan,
-                               u8 *tx_chainmask,
-                               u8 *rx_chainmask,
-                               u8 *antenna_cfgd)
-{
-        static u8 tx_chainmask_cfg, rx_chainmask_cfg;
-
-        if (AR_SREV_9280(ah)) {
-                if (!tx_chainmask_cfg) {
-
-                        tx_chainmask_cfg = *tx_chainmask;
-                        rx_chainmask_cfg = *rx_chainmask;
-                }
-
-                switch (settings) {
-                case ATH9K_ANT_FIXED_A:
-                        *tx_chainmask = ATH9K_ANTENNA0_CHAINMASK;
-                        *rx_chainmask = ATH9K_ANTENNA0_CHAINMASK;
-                        *antenna_cfgd = true;
-                        break;
-                case ATH9K_ANT_FIXED_B:
-                        if (ah->caps.tx_chainmask >
-                            ATH9K_ANTENNA1_CHAINMASK) {
-                                *tx_chainmask = ATH9K_ANTENNA1_CHAINMASK;
-                        }
-                        *rx_chainmask = ATH9K_ANTENNA1_CHAINMASK;
-                        *antenna_cfgd = true;
-                        break;
-                case ATH9K_ANT_VARIABLE:
-                        *tx_chainmask = tx_chainmask_cfg;
-                        *rx_chainmask = rx_chainmask_cfg;
-                        *antenna_cfgd = true;
-                        break;
-                default:
-                        break;
-                }
-        } else {
-                ah->config.diversity_control = settings;
-        }
-
-        return true;
-}
+EXPORT_SYMBOL(ath9k_hw_setantenna);
 
 /*********************/
 /* General Operation */
@@ -4002,6 +3517,7 @@ u32 ath9k_hw_getrxfilter(struct ath_hw *ah)
 
         return bits;
 }
+EXPORT_SYMBOL(ath9k_hw_getrxfilter);
 
 void ath9k_hw_setrxfilter(struct ath_hw *ah, u32 bits)
 {
@@ -4023,19 +3539,30 @@ void ath9k_hw_setrxfilter(struct ath_hw *ah, u32 bits)
                 REG_WRITE(ah, AR_RXCFG,
                           REG_READ(ah, AR_RXCFG) & ~AR_RXCFG_ZLFDMA);
 }
+EXPORT_SYMBOL(ath9k_hw_setrxfilter);
 
 bool ath9k_hw_phy_disable(struct ath_hw *ah)
 {
-        return ath9k_hw_set_reset_reg(ah, ATH9K_RESET_WARM);
+        if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_WARM))
+                return false;
+
+        ath9k_hw_init_pll(ah, NULL);
+        return true;
 }
+EXPORT_SYMBOL(ath9k_hw_phy_disable);
 
 bool ath9k_hw_disable(struct ath_hw *ah)
 {
         if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
                 return false;
 
-        return ath9k_hw_set_reset_reg(ah, ATH9K_RESET_COLD);
+        if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_COLD))
+                return false;
+
+        ath9k_hw_init_pll(ah, NULL);
+        return true;
 }
+EXPORT_SYMBOL(ath9k_hw_disable);
 
 void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit)
 {
@@ -4052,35 +3579,36 @@ void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit)
                                  min((u32) MAX_RATE_POWER,
                                  (u32) regulatory->power_limit));
 }
+EXPORT_SYMBOL(ath9k_hw_set_txpowerlimit);
 
 void ath9k_hw_setmac(struct ath_hw *ah, const u8 *mac)
 {
-        memcpy(ah->macaddr, mac, ETH_ALEN);
+        memcpy(ath9k_hw_common(ah)->macaddr, mac, ETH_ALEN);
 }
+EXPORT_SYMBOL(ath9k_hw_setmac);
 
 void ath9k_hw_setopmode(struct ath_hw *ah)
 {
         ath9k_hw_set_operating_mode(ah, ah->opmode);
 }
+EXPORT_SYMBOL(ath9k_hw_setopmode);
 
 void ath9k_hw_setmcastfilter(struct ath_hw *ah, u32 filter0, u32 filter1)
 {
         REG_WRITE(ah, AR_MCAST_FIL0, filter0);
         REG_WRITE(ah, AR_MCAST_FIL1, filter1);
 }
+EXPORT_SYMBOL(ath9k_hw_setmcastfilter);
 
-void ath9k_hw_setbssidmask(struct ath_softc *sc)
+void ath9k_hw_write_associd(struct ath_hw *ah)
 {
-        REG_WRITE(sc->sc_ah, AR_BSSMSKL, get_unaligned_le32(sc->bssidmask));
-        REG_WRITE(sc->sc_ah, AR_BSSMSKU, get_unaligned_le16(sc->bssidmask + 4));
-}
+        struct ath_common *common = ath9k_hw_common(ah);
 
-void ath9k_hw_write_associd(struct ath_softc *sc)
-{
-        REG_WRITE(sc->sc_ah, AR_BSS_ID0, get_unaligned_le32(sc->curbssid));
-        REG_WRITE(sc->sc_ah, AR_BSS_ID1, get_unaligned_le16(sc->curbssid + 4) |
-                  ((sc->curaid & 0x3fff) << AR_BSS_ID1_AID_S));
+        REG_WRITE(ah, AR_BSS_ID0, get_unaligned_le32(common->curbssid));
+        REG_WRITE(ah, AR_BSS_ID1, get_unaligned_le16(common->curbssid + 4) |
+                  ((common->curaid & 0x3fff) << AR_BSS_ID1_AID_S));
 }
+EXPORT_SYMBOL(ath9k_hw_write_associd);
 
 u64 ath9k_hw_gettsf64(struct ath_hw *ah)
 {
@@ -4091,24 +3619,25 @@ u64 ath9k_hw_gettsf64(struct ath_hw *ah)
 
         return tsf;
 }
+EXPORT_SYMBOL(ath9k_hw_gettsf64);
 
 void ath9k_hw_settsf64(struct ath_hw *ah, u64 tsf64)
 {
         REG_WRITE(ah, AR_TSF_L32, tsf64 & 0xffffffff);
         REG_WRITE(ah, AR_TSF_U32, (tsf64 >> 32) & 0xffffffff);
 }
+EXPORT_SYMBOL(ath9k_hw_settsf64);
 
 void ath9k_hw_reset_tsf(struct ath_hw *ah)
 {
-        ath9k_ps_wakeup(ah->ah_sc);
         if (!ath9k_hw_wait(ah, AR_SLP32_MODE, AR_SLP32_TSF_WRITE_STATUS, 0,
                            AH_TSF_WRITE_TIMEOUT))
-                DPRINTF(ah->ah_sc, ATH_DBG_RESET,
-                        "AR_SLP32_TSF_WRITE_STATUS limit exceeded\n");
+                ath_print(ath9k_hw_common(ah), ATH_DBG_RESET,
+                          "AR_SLP32_TSF_WRITE_STATUS limit exceeded\n");
 
         REG_WRITE(ah, AR_RESET_TSF, AR_RESET_TSF_ONCE);
-        ath9k_ps_restore(ah->ah_sc);
 }
+EXPORT_SYMBOL(ath9k_hw_reset_tsf);
 
 void ath9k_hw_set_tsfadjust(struct ath_hw *ah, u32 setting)
 {
@@ -4117,26 +3646,29 @@ void ath9k_hw_set_tsfadjust(struct ath_hw *ah, u32 setting)
         else
                 ah->misc_mode &= ~AR_PCU_TX_ADD_TSF;
 }
+EXPORT_SYMBOL(ath9k_hw_set_tsfadjust);
 
-bool ath9k_hw_setslottime(struct ath_hw *ah, u32 us)
+/*
+ *  Extend 15-bit time stamp from rx descriptor to
+ *  a full 64-bit TSF using the current h/w TSF.
+*/
+u64 ath9k_hw_extend_tsf(struct ath_hw *ah, u32 rstamp)
 {
-        if (us < ATH9K_SLOT_TIME_9 || us > ath9k_hw_mac_to_usec(ah, 0xffff)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_RESET, "bad slot time %u\n", us);
-                ah->slottime = (u32) -1;
-                return false;
-        } else {
-                REG_WRITE(ah, AR_D_GBL_IFS_SLOT, ath9k_hw_mac_to_clks(ah, us));
-                ah->slottime = us;
-                return true;
-        }
+        u64 tsf;
+
+        tsf = ath9k_hw_gettsf64(ah);
+        if ((tsf & 0x7fff) < rstamp)
+                tsf -= 0x8000;
+        return (tsf & ~0x7fff) | rstamp;
 }
+EXPORT_SYMBOL(ath9k_hw_extend_tsf);
 
-void ath9k_hw_set11nmac2040(struct ath_hw *ah, enum ath9k_ht_macmode mode)
+void ath9k_hw_set11nmac2040(struct ath_hw *ah)
 {
+        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
         u32 macmode;
 
-        if (mode == ATH9K_HT_MACMODE_2040 &&
-            !ah->config.cwm_ignore_extcca)
+        if (conf_is_ht40(conf) && !ah->config.cwm_ignore_extcca)
                 macmode = AR_2040_JOINED_RX_CLEAR;
         else
                 macmode = 0;
@@ -4193,6 +3725,7 @@ u32 ath9k_hw_gettsf32(struct ath_hw *ah)
 {
         return REG_READ(ah, AR_TSF_L32);
 }
+EXPORT_SYMBOL(ath9k_hw_gettsf32);
 
 struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
                                           void (*trigger)(void *),
@@ -4206,8 +3739,9 @@ struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
         timer = kzalloc(sizeof(struct ath_gen_timer), GFP_KERNEL);
 
         if (timer == NULL) {
-                printk(KERN_DEBUG "Failed to allocate memory"
-                       "for hw timer[%d]\n", timer_index);
+                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                          "Failed to allocate memory"
+                          "for hw timer[%d]\n", timer_index);
                 return NULL;
         }
 
@@ -4220,10 +3754,12 @@ struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
 
         return timer;
 }
+EXPORT_SYMBOL(ath_gen_timer_alloc);
 
-void ath_gen_timer_start(struct ath_hw *ah,
-                         struct ath_gen_timer *timer,
-                         u32 timer_next, u32 timer_period)
+void ath9k_hw_gen_timer_start(struct ath_hw *ah,
+                              struct ath_gen_timer *timer,
+                              u32 timer_next,
+                              u32 timer_period)
 {
         struct ath_gen_timer_table *timer_table = &ah->hw_gen_timers;
         u32 tsf;
@@ -4234,8 +3770,9 @@ void ath_gen_timer_start(struct ath_hw *ah,
 
         tsf = ath9k_hw_gettsf32(ah);
 
-        DPRINTF(ah->ah_sc, ATH_DBG_HWTIMER, "curent tsf %x period %x"
-                "timer_next %x\n", tsf, timer_period, timer_next);
+        ath_print(ath9k_hw_common(ah), ATH_DBG_HWTIMER,
+                  "curent tsf %x period %x"
+                  "timer_next %x\n", tsf, timer_period, timer_next);
 
         /*
          * Pull timer_next forward if the current TSF already passed it
@@ -4258,15 +3795,10 @@ void ath_gen_timer_start(struct ath_hw *ah,
         REG_SET_BIT(ah, AR_IMR_S5,
                 (SM(AR_GENTMR_BIT(timer->index), AR_IMR_S5_GENTIMER_THRESH) |
                 SM(AR_GENTMR_BIT(timer->index), AR_IMR_S5_GENTIMER_TRIG)));
-
-        if ((ah->ah_sc->imask & ATH9K_INT_GENTIMER) == 0) {
-                ath9k_hw_set_interrupts(ah, 0);
-                ah->ah_sc->imask |= ATH9K_INT_GENTIMER;
-                ath9k_hw_set_interrupts(ah, ah->ah_sc->imask);
-        }
 }
+EXPORT_SYMBOL(ath9k_hw_gen_timer_start);
 
-void ath_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer)
+void ath9k_hw_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer)
 {
         struct ath_gen_timer_table *timer_table = &ah->hw_gen_timers;
 
@@ -4285,14 +3817,8 @@ void ath_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer)
                 SM(AR_GENTMR_BIT(timer->index), AR_IMR_S5_GENTIMER_TRIG)));
 
         clear_bit(timer->index, &timer_table->timer_mask.timer_bits);
-
-        /* if no timer is enabled, turn off interrupt mask */
-        if (timer_table->timer_mask.val == 0) {
-                ath9k_hw_set_interrupts(ah, 0);
-                ah->ah_sc->imask &= ~ATH9K_INT_GENTIMER;
-                ath9k_hw_set_interrupts(ah, ah->ah_sc->imask);
-        }
 }
+EXPORT_SYMBOL(ath9k_hw_gen_timer_stop);
 
 void ath_gen_timer_free(struct ath_hw *ah, struct ath_gen_timer *timer)
 {
@@ -4302,6 +3828,7 @@ void ath_gen_timer_free(struct ath_hw *ah, struct ath_gen_timer *timer)
         timer_table->timers[timer->index] = NULL;
         kfree(timer);
 }
+EXPORT_SYMBOL(ath_gen_timer_free);
 
 /*
  * Generic Timer Interrupts handling
@@ -4310,6 +3837,7 @@ void ath_gen_timer_isr(struct ath_hw *ah)
 {
         struct ath_gen_timer_table *timer_table = &ah->hw_gen_timers;
         struct ath_gen_timer *timer;
+        struct ath_common *common = ath9k_hw_common(ah);
         u32 trigger_mask, thresh_mask, index;
 
         /* get hardware generic timer interrupt status */
@@ -4324,8 +3852,8 @@ void ath_gen_timer_isr(struct ath_hw *ah)
                 index = rightmost_index(timer_table, &thresh_mask);
                 timer = timer_table->timers[index];
                 BUG_ON(!timer);
-                DPRINTF(ah->ah_sc, ATH_DBG_HWTIMER,
-                        "TSF overflow for Gen timer %d\n", index);
+                ath_print(common, ATH_DBG_HWTIMER,
+                          "TSF overflow for Gen timer %d\n", index);
                 timer->overflow(timer->arg);
         }
 
@@ -4333,21 +3861,95 @@ void ath_gen_timer_isr(struct ath_hw *ah)
                 index = rightmost_index(timer_table, &trigger_mask);
                 timer = timer_table->timers[index];
                 BUG_ON(!timer);
-                DPRINTF(ah->ah_sc, ATH_DBG_HWTIMER,
-                        "Gen timer[%d] trigger\n", index);
+                ath_print(common, ATH_DBG_HWTIMER,
+                          "Gen timer[%d] trigger\n", index);
                 timer->trigger(timer->arg);
         }
 }
+EXPORT_SYMBOL(ath_gen_timer_isr);
+
+static struct {
+        u32 version;
+        const char * name;
+} ath_mac_bb_names[] = {
+        /* Devices with external radios */
+        { AR_SREV_VERSION_5416_PCI,     "5416" },
+        { AR_SREV_VERSION_5416_PCIE,    "5418" },
+        { AR_SREV_VERSION_9100,         "9100" },
+        { AR_SREV_VERSION_9160,         "9160" },
+        /* Single-chip solutions */
+        { AR_SREV_VERSION_9280,         "9280" },
+        { AR_SREV_VERSION_9285,         "9285" },
+        { AR_SREV_VERSION_9287,         "9287" },
+        { AR_SREV_VERSION_9271,         "9271" },
+};
+
+/* For devices with external radios */
+static struct {
+        u16 version;
+        const char * name;
+} ath_rf_names[] = {
+        { 0,                            "5133" },
+        { AR_RAD5133_SREV_MAJOR,        "5133" },
+        { AR_RAD5122_SREV_MAJOR,        "5122" },
+        { AR_RAD2133_SREV_MAJOR,        "2133" },
+        { AR_RAD2122_SREV_MAJOR,        "2122" }
+};
+
+/*
+ * Return the MAC/BB name. "????" is returned if the MAC/BB is unknown.
+ */
+static const char *ath9k_hw_mac_bb_name(u32 mac_bb_version)
+{
+        int i;
+
+        for (i=0; i<ARRAY_SIZE(ath_mac_bb_names); i++) {
+                if (ath_mac_bb_names[i].version == mac_bb_version) {
+                        return ath_mac_bb_names[i].name;
+                }
+        }
+
+        return "????";
+}
 
 /*
- * Primitive to disable ASPM
+ * Return the RF name. "????" is returned if the RF is unknown.
+ * Used for devices with external radios.
  */
-void ath_pcie_aspm_disable(struct ath_softc *sc)
+static const char *ath9k_hw_rf_name(u16 rf_version)
 {
-        struct pci_dev *pdev = to_pci_dev(sc->dev);
-        u8 aspm;
+        int i;
+
+        for (i=0; i<ARRAY_SIZE(ath_rf_names); i++) {
+                if (ath_rf_names[i].version == rf_version) {
+                        return ath_rf_names[i].name;
+                }
+        }
+
+        return "????";
+}
+
+void ath9k_hw_name(struct ath_hw *ah, char *hw_name, size_t len)
+{
+        int used;
+
+        /* chipsets >= AR9280 are single-chip */
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
+                used = snprintf(hw_name, len,
+                               "Atheros AR%s Rev:%x",
+                               ath9k_hw_mac_bb_name(ah->hw_version.macVersion),
+                               ah->hw_version.macRev);
+        }
+        else {
+                used = snprintf(hw_name, len,
+                               "Atheros AR%s MAC/BB Rev:%x AR%s RF Rev:%x",
+                               ath9k_hw_mac_bb_name(ah->hw_version.macVersion),
+                               ah->hw_version.macRev,
+                               ath9k_hw_rf_name((ah->hw_version.analog5GhzRev &
+                                                AR_RADIO_SREV_MAJOR)),
+                               ah->hw_version.phyRev);
+        }
 
-        pci_read_config_byte(pdev, ATH_PCIE_CAP_LINK_CTRL, &aspm);
-        aspm &= ~(ATH_PCIE_CAP_LINK_L0S | ATH_PCIE_CAP_LINK_L1);
-        pci_write_config_byte(pdev, ATH_PCIE_CAP_LINK_CTRL, aspm);
+        hw_name[used] = '\0';
 }
+EXPORT_SYMBOL(ath9k_hw_name);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index b89234571829..dbbf7ca5f97d 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -27,17 +27,25 @@
 #include "calib.h"
 #include "reg.h"
 #include "phy.h"
+#include "btcoex.h"
 
 #include "../regd.h"
+#include "../debug.h"
 
 #define ATHEROS_VENDOR_ID       0x168c
+
 #define AR5416_DEVID_PCI        0x0023
 #define AR5416_DEVID_PCIE       0x0024
 #define AR9160_DEVID_PCI        0x0027
 #define AR9280_DEVID_PCI        0x0029
 #define AR9280_DEVID_PCIE       0x002a
 #define AR9285_DEVID_PCIE       0x002b
+#define AR2427_DEVID_PCIE       0x002c
+
 #define AR5416_AR9100_DEVID     0x000b
+
+#define AR9271_USB             0x9271
+
 #define AR_SUBVENDOR_ID_NOG     0x0e11
 #define AR_SUBVENDOR_ID_NEW_A   0x7065
 #define AR5416_MAGIC            0x19641014
@@ -49,9 +57,18 @@
 #define AT9285_COEX3WIRE_SA_SUBSYSID    0x30aa
 #define AT9285_COEX3WIRE_DA_SUBSYSID    0x30ab
 
+#define ATH_AMPDU_LIMIT_MAX        (64 * 1024 - 1)
+
+#define ATH_DEFAULT_NOISE_FLOOR -95
+
+#define ATH9K_RSSI_BAD                  -128
+
 /* Register read/write primitives */
-#define REG_WRITE(_ah, _reg, _val) ath9k_iowrite32((_ah), (_reg), (_val))
-#define REG_READ(_ah, _reg) ath9k_ioread32((_ah), (_reg))
+#define REG_WRITE(_ah, _reg, _val) \
+        ath9k_hw_common(_ah)->ops->write((_ah), (_val), (_reg))
+
+#define REG_READ(_ah, _reg) \
+        ath9k_hw_common(_ah)->ops->read((_ah), (_reg))
 
 #define SM(_v, _f)  (((_v) << _f##_S) & _f)
 #define MS(_v, _f)  (((_v) & _f) >> _f##_S)
@@ -91,7 +108,7 @@
 #define AR_GPIO_BIT(_gpio)          (1 << (_gpio))
 
 #define BASE_ACTIVATE_DELAY         100
-#define RTC_PLL_SETTLE_DELAY        1000
+#define RTC_PLL_SETTLE_DELAY        100
 #define COEF_SCALE_S                24
 #define HT40_CHANNEL_CENTER_SHIFT   10
 
@@ -132,12 +149,6 @@ enum wireless_mode {
         ATH9K_MODE_MAX,
 };
 
-enum ath9k_ant_setting {
-        ATH9K_ANT_VARIABLE = 0,
-        ATH9K_ANT_FIXED_A,
-        ATH9K_ANT_FIXED_B
-};
-
 enum ath9k_hw_caps {
         ATH9K_HW_CAP_MIC_AESCCM                 = BIT(0),
         ATH9K_HW_CAP_MIC_CKIP                   = BIT(1),
@@ -201,10 +212,8 @@ struct ath9k_ops_config {
         u32 cck_trig_high;
         u32 cck_trig_low;
         u32 enable_ani;
-        enum ath9k_ant_setting diversity_control;
-        u16 antenna_switch_swap;
         int serialize_regmode;
-        bool intr_mitigation;
+        bool rx_intr_mitigation;
 #define SPUR_DISABLE            0
 #define SPUR_ENABLE_IOCTL       1
 #define SPUR_ENABLE_EEPROM      2
@@ -218,6 +227,7 @@ struct ath9k_ops_config {
 #define AR_SPUR_FEEQ_BOUND_HT20 10
         int spurmode;
         u16 spurchans[AR_EEPROM_MODAL_SPURS][2];
+        u8 max_txtrig_level;
 };
 
 enum ath9k_int {
@@ -407,7 +417,7 @@ struct ath9k_hw_version {
  * Using de Bruijin sequence to to look up 1's index in a 32 bit number
  * debruijn32 = 0000 0111 0111 1100 1011 0101 0011 0001
  */
-#define debruijn32 0x077CB531UL
+#define debruijn32 0x077CB531U
 
 struct ath_gen_timer_configuration {
         u32 next_addr;
@@ -433,7 +443,8 @@ struct ath_gen_timer_table {
 };
 
 struct ath_hw {
-        struct ath_softc *ah_sc;
+        struct ieee80211_hw *hw;
+        struct ath_common common;
         struct ath9k_hw_version hw_version;
         struct ath9k_ops_config config;
         struct ath9k_hw_capabilities caps;
@@ -450,7 +461,6 @@ struct ath_hw {
 
         bool sw_mgmt_crypto;
         bool is_pciexpress;
-        u8 macaddr[ETH_ALEN];
         u16 tx_trig_level;
         u16 rfsilent;
         u32 rfkill_gpio;
@@ -523,7 +533,14 @@ struct ath_hw {
                 DONT_USE_32KHZ,
         } enable_32kHz_clock;
 
-        /* RF */
+        /* Callback for radio frequency change */
+        int (*ath9k_hw_rf_set_freq)(struct ath_hw *ah, struct ath9k_channel *chan);
+
+        /* Callback for baseband spur frequency */
+        void (*ath9k_hw_spur_mitigate_freq)(struct ath_hw *ah,
+                                            struct ath9k_channel *chan);
+
+        /* Used to program the radio on non single-chip devices */
         u32 *analogBank0Data;
         u32 *analogBank1Data;
         u32 *analogBank2Data;
@@ -535,12 +552,10 @@ struct ath_hw {
         u32 *bank6Temp;
 
         int16_t txpower_indexoffset;
+        int coverage_class;
         u32 beacon_interval;
         u32 slottime;
-        u32 acktimeout;
-        u32 ctstimeout;
         u32 globaltxtimeout;
-        u8 gbeacon_rate;
 
         /* ANI */
         u32 proc_phyerr;
@@ -553,8 +568,10 @@ struct ath_hw {
         int firpwr[5];
         enum ath9k_ani_cmd ani_function;
 
+        /* Bluetooth coexistance */
+        struct ath_btcoex_hw btcoex_hw;
+
         u32 intr_txqs;
-        enum ath9k_ht_extprotspacing extprotspacing;
         u8 txchainmask;
         u8 rxchainmask;
 
@@ -578,20 +595,32 @@ struct ath_hw {
         struct ar5416IniArray iniModesAdditional;
         struct ar5416IniArray iniModesRxGain;
         struct ar5416IniArray iniModesTxGain;
+        struct ar5416IniArray iniModes_9271_1_0_only;
+        struct ar5416IniArray iniCckfirNormal;
+        struct ar5416IniArray iniCckfirJapan2484;
 
         u32 intr_gen_timer_trigger;
         u32 intr_gen_timer_thresh;
         struct ath_gen_timer_table hw_gen_timers;
 };
 
+static inline struct ath_common *ath9k_hw_common(struct ath_hw *ah)
+{
+        return &ah->common;
+}
+
+static inline struct ath_regulatory *ath9k_hw_regulatory(struct ath_hw *ah)
+{
+        return &(ath9k_hw_common(ah)->regulatory);
+}
+
 /* Initialization, Detach, Reset */
 const char *ath9k_hw_probe(u16 vendorid, u16 devid);
-void ath9k_hw_detach(struct ath_hw *ah);
+void ath9k_hw_deinit(struct ath_hw *ah);
 int ath9k_hw_init(struct ath_hw *ah);
-void ath9k_hw_rf_free(struct ath_hw *ah);
 int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                    bool bChannelChange);
-void ath9k_hw_fill_cap_info(struct ath_hw *ah);
+int ath9k_hw_fill_cap_info(struct ath_hw *ah);
 bool ath9k_hw_getcapability(struct ath_hw *ah, enum ath9k_capability_type type,
                             u32 capability, u32 *result);
 bool ath9k_hw_setcapability(struct ath_hw *ah, enum ath9k_capability_type type,
@@ -613,18 +642,13 @@ void ath9k_hw_cfg_output(struct ath_hw *ah, u32 gpio,
 void ath9k_hw_set_gpio(struct ath_hw *ah, u32 gpio, u32 val);
 u32 ath9k_hw_getdefantenna(struct ath_hw *ah);
 void ath9k_hw_setantenna(struct ath_hw *ah, u32 antenna);
-bool ath9k_hw_setantennaswitch(struct ath_hw *ah,
-                               enum ath9k_ant_setting settings,
-                               struct ath9k_channel *chan,
-                               u8 *tx_chainmask, u8 *rx_chainmask,
-                               u8 *antenna_cfgd);
 
 /* General Operation */
 bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val, u32 timeout);
 u32 ath9k_hw_reverse_bits(u32 val, u32 n);
 bool ath9k_get_channel_edges(struct ath_hw *ah, u16 flags, u16 *low, u16 *high);
 u16 ath9k_hw_computetxtime(struct ath_hw *ah,
-                           const struct ath_rate_table *rates,
+                           u8 phy, int kbps,
                            u32 frameLen, u16 rateix, bool shortPreamble);
 void ath9k_hw_get_channel_centers(struct ath_hw *ah,
                                   struct ath9k_channel *chan,
@@ -637,19 +661,21 @@ void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit);
 void ath9k_hw_setmac(struct ath_hw *ah, const u8 *mac);
 void ath9k_hw_setopmode(struct ath_hw *ah);
 void ath9k_hw_setmcastfilter(struct ath_hw *ah, u32 filter0, u32 filter1);
-void ath9k_hw_setbssidmask(struct ath_softc *sc);
-void ath9k_hw_write_associd(struct ath_softc *sc);
+void ath9k_hw_setbssidmask(struct ath_hw *ah);
+void ath9k_hw_write_associd(struct ath_hw *ah);
 u64 ath9k_hw_gettsf64(struct ath_hw *ah);
 void ath9k_hw_settsf64(struct ath_hw *ah, u64 tsf64);
 void ath9k_hw_reset_tsf(struct ath_hw *ah);
 void ath9k_hw_set_tsfadjust(struct ath_hw *ah, u32 setting);
-bool ath9k_hw_setslottime(struct ath_hw *ah, u32 us);
-void ath9k_hw_set11nmac2040(struct ath_hw *ah, enum ath9k_ht_macmode mode);
+u64 ath9k_hw_extend_tsf(struct ath_hw *ah, u32 rstamp);
+void ath9k_hw_init_global_settings(struct ath_hw *ah);
+void ath9k_hw_set11nmac2040(struct ath_hw *ah);
 void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period);
 void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
                                     const struct ath9k_beacon_state *bs);
-bool ath9k_hw_setpower(struct ath_hw *ah,
-                       enum ath9k_power_mode mode);
+
+bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
+
 void ath9k_hw_configpcipowersave(struct ath_hw *ah, int restore, int power_off);
 
 /* Interrupt Handling */
@@ -663,16 +689,20 @@ struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
                                           void (*overflow)(void *),
                                           void *arg,
                                           u8 timer_index);
-void ath_gen_timer_start(struct ath_hw *ah, struct ath_gen_timer *timer,
-                         u32 timer_next, u32 timer_period);
-void ath_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer);
+void ath9k_hw_gen_timer_start(struct ath_hw *ah,
+                              struct ath_gen_timer *timer,
+                              u32 timer_next,
+                              u32 timer_period);
+void ath9k_hw_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer);
+
 void ath_gen_timer_free(struct ath_hw *ah, struct ath_gen_timer *timer);
 void ath_gen_timer_isr(struct ath_hw *hw);
 u32 ath9k_hw_gettsf32(struct ath_hw *ah);
 
+void ath9k_hw_name(struct ath_hw *ah, char *hw_name, size_t len);
+
 #define ATH_PCIE_CAP_LINK_CTRL  0x70
 #define ATH_PCIE_CAP_LINK_L0S   1
 #define ATH_PCIE_CAP_LINK_L1    2
 
-void ath_pcie_aspm_disable(struct ath_softc *sc);
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
new file mode 100644
index 000000000000..3d4d897add6d
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -0,0 +1,865 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/slab.h>
+
+#include "ath9k.h"
+
+static char *dev_info = "ath9k";
+
+MODULE_AUTHOR("Atheros Communications");
+MODULE_DESCRIPTION("Support for Atheros 802.11n wireless LAN cards.");
+MODULE_SUPPORTED_DEVICE("Atheros 802.11n WLAN cards");
+MODULE_LICENSE("Dual BSD/GPL");
+
+static unsigned int ath9k_debug = ATH_DBG_DEFAULT;
+module_param_named(debug, ath9k_debug, uint, 0);
+MODULE_PARM_DESC(debug, "Debugging mask");
+
+int modparam_nohwcrypt;
+module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
+MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
+
+/* We use the hw_value as an index into our private channel structure */
+
+#define CHAN2G(_freq, _idx)  { \
+        .center_freq = (_freq), \
+        .hw_value = (_idx), \
+        .max_power = 20, \
+}
+
+#define CHAN5G(_freq, _idx) { \
+        .band = IEEE80211_BAND_5GHZ, \
+        .center_freq = (_freq), \
+        .hw_value = (_idx), \
+        .max_power = 20, \
+}
+
+/* Some 2 GHz radios are actually tunable on 2312-2732
+ * on 5 MHz steps, we support the channels which we know
+ * we have calibration data for all cards though to make
+ * this static */
+static struct ieee80211_channel ath9k_2ghz_chantable[] = {
+        CHAN2G(2412, 0), /* Channel 1 */
+        CHAN2G(2417, 1), /* Channel 2 */
+        CHAN2G(2422, 2), /* Channel 3 */
+        CHAN2G(2427, 3), /* Channel 4 */
+        CHAN2G(2432, 4), /* Channel 5 */
+        CHAN2G(2437, 5), /* Channel 6 */
+        CHAN2G(2442, 6), /* Channel 7 */
+        CHAN2G(2447, 7), /* Channel 8 */
+        CHAN2G(2452, 8), /* Channel 9 */
+        CHAN2G(2457, 9), /* Channel 10 */
+        CHAN2G(2462, 10), /* Channel 11 */
+        CHAN2G(2467, 11), /* Channel 12 */
+        CHAN2G(2472, 12), /* Channel 13 */
+        CHAN2G(2484, 13), /* Channel 14 */
+};
+
+/* Some 5 GHz radios are actually tunable on XXXX-YYYY
+ * on 5 MHz steps, we support the channels which we know
+ * we have calibration data for all cards though to make
+ * this static */
+static struct ieee80211_channel ath9k_5ghz_chantable[] = {
+        /* _We_ call this UNII 1 */
+        CHAN5G(5180, 14), /* Channel 36 */
+        CHAN5G(5200, 15), /* Channel 40 */
+        CHAN5G(5220, 16), /* Channel 44 */
+        CHAN5G(5240, 17), /* Channel 48 */
+        /* _We_ call this UNII 2 */
+        CHAN5G(5260, 18), /* Channel 52 */
+        CHAN5G(5280, 19), /* Channel 56 */
+        CHAN5G(5300, 20), /* Channel 60 */
+        CHAN5G(5320, 21), /* Channel 64 */
+        /* _We_ call this "Middle band" */
+        CHAN5G(5500, 22), /* Channel 100 */
+        CHAN5G(5520, 23), /* Channel 104 */
+        CHAN5G(5540, 24), /* Channel 108 */
+        CHAN5G(5560, 25), /* Channel 112 */
+        CHAN5G(5580, 26), /* Channel 116 */
+        CHAN5G(5600, 27), /* Channel 120 */
+        CHAN5G(5620, 28), /* Channel 124 */
+        CHAN5G(5640, 29), /* Channel 128 */
+        CHAN5G(5660, 30), /* Channel 132 */
+        CHAN5G(5680, 31), /* Channel 136 */
+        CHAN5G(5700, 32), /* Channel 140 */
+        /* _We_ call this UNII 3 */
+        CHAN5G(5745, 33), /* Channel 149 */
+        CHAN5G(5765, 34), /* Channel 153 */
+        CHAN5G(5785, 35), /* Channel 157 */
+        CHAN5G(5805, 36), /* Channel 161 */
+        CHAN5G(5825, 37), /* Channel 165 */
+};
+
+/* Atheros hardware rate code addition for short premble */
+#define SHPCHECK(__hw_rate, __flags) \
+        ((__flags & IEEE80211_RATE_SHORT_PREAMBLE) ? (__hw_rate | 0x04 ) : 0)
+
+#define RATE(_bitrate, _hw_rate, _flags) {              \
+        .bitrate        = (_bitrate),                   \
+        .flags          = (_flags),                     \
+        .hw_value       = (_hw_rate),                   \
+        .hw_value_short = (SHPCHECK(_hw_rate, _flags))  \
+}
+
+static struct ieee80211_rate ath9k_legacy_rates[] = {
+        RATE(10, 0x1b, 0),
+        RATE(20, 0x1a, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(55, 0x19, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(110, 0x18, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(60, 0x0b, 0),
+        RATE(90, 0x0f, 0),
+        RATE(120, 0x0a, 0),
+        RATE(180, 0x0e, 0),
+        RATE(240, 0x09, 0),
+        RATE(360, 0x0d, 0),
+        RATE(480, 0x08, 0),
+        RATE(540, 0x0c, 0),
+};
+
+static void ath9k_deinit_softc(struct ath_softc *sc);
+
+/*
+ * Read and write, they both share the same lock. We do this to serialize
+ * reads and writes on Atheros 802.11n PCI devices only. This is required
+ * as the FIFO on these devices can only accept sanely 2 requests.
+ */
+
+static void ath9k_iowrite32(void *hw_priv, u32 val, u32 reg_offset)
+{
+        struct ath_hw *ah = (struct ath_hw *) hw_priv;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
+
+        if (ah->config.serialize_regmode == SER_REG_MODE_ON) {
+                unsigned long flags;
+                spin_lock_irqsave(&sc->sc_serial_rw, flags);
+                iowrite32(val, sc->mem + reg_offset);
+                spin_unlock_irqrestore(&sc->sc_serial_rw, flags);
+        } else
+                iowrite32(val, sc->mem + reg_offset);
+}
+
+static unsigned int ath9k_ioread32(void *hw_priv, u32 reg_offset)
+{
+        struct ath_hw *ah = (struct ath_hw *) hw_priv;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
+        u32 val;
+
+        if (ah->config.serialize_regmode == SER_REG_MODE_ON) {
+                unsigned long flags;
+                spin_lock_irqsave(&sc->sc_serial_rw, flags);
+                val = ioread32(sc->mem + reg_offset);
+                spin_unlock_irqrestore(&sc->sc_serial_rw, flags);
+        } else
+                val = ioread32(sc->mem + reg_offset);
+        return val;
+}
+
+static const struct ath_ops ath9k_common_ops = {
+        .read = ath9k_ioread32,
+        .write = ath9k_iowrite32,
+};
+
+/**************************/
+/*     Initialization     */
+/**************************/
+
+static void setup_ht_cap(struct ath_softc *sc,
+                         struct ieee80211_sta_ht_cap *ht_info)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        u8 tx_streams, rx_streams;
+
+        ht_info->ht_supported = true;
+        ht_info->cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+                       IEEE80211_HT_CAP_SM_PS |
+                       IEEE80211_HT_CAP_SGI_40 |
+                       IEEE80211_HT_CAP_DSSSCCK40;
+
+        ht_info->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+        ht_info->ampdu_density = IEEE80211_HT_MPDU_DENSITY_8;
+
+        /* set up supported mcs set */
+        memset(&ht_info->mcs, 0, sizeof(ht_info->mcs));
+        tx_streams = !(common->tx_chainmask & (common->tx_chainmask - 1)) ?
+                     1 : 2;
+        rx_streams = !(common->rx_chainmask & (common->rx_chainmask - 1)) ?
+                     1 : 2;
+
+        if (tx_streams != rx_streams) {
+                ath_print(common, ATH_DBG_CONFIG,
+                          "TX streams %d, RX streams: %d\n",
+                          tx_streams, rx_streams);
+                ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_RX_DIFF;
+                ht_info->mcs.tx_params |= ((tx_streams - 1) <<
+                                IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT);
+        }
+
+        ht_info->mcs.rx_mask[0] = 0xff;
+        if (rx_streams >= 2)
+                ht_info->mcs.rx_mask[1] = 0xff;
+
+        ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_DEFINED;
+}
+
+static int ath9k_reg_notifier(struct wiphy *wiphy,
+                              struct regulatory_request *request)
+{
+        struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
+        struct ath_wiphy *aphy = hw->priv;
+        struct ath_softc *sc = aphy->sc;
+        struct ath_regulatory *reg = ath9k_hw_regulatory(sc->sc_ah);
+
+        return ath_reg_notifier_apply(wiphy, request, reg);
+}
+
+/*
+ *  This function will allocate both the DMA descriptor structure, and the
+ *  buffers it contains.  These are used to contain the descriptors used
+ *  by the system.
+*/
+int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
+                      struct list_head *head, const char *name,
+                      int nbuf, int ndesc)
+{
+#define DS2PHYS(_dd, _ds)                                               \
+        ((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
+#define ATH_DESC_4KB_BOUND_CHECK(_daddr) ((((_daddr) & 0xFFF) > 0xF7F) ? 1 : 0)
+#define ATH_DESC_4KB_BOUND_NUM_SKIPPED(_len) ((_len) / 4096)
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_desc *ds;
+        struct ath_buf *bf;
+        int i, bsize, error;
+
+        ath_print(common, ATH_DBG_CONFIG, "%s DMA: %u buffers %u desc/buf\n",
+                  name, nbuf, ndesc);
+
+        INIT_LIST_HEAD(head);
+        /* ath_desc must be a multiple of DWORDs */
+        if ((sizeof(struct ath_desc) % 4) != 0) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "ath_desc not DWORD aligned\n");
+                BUG_ON((sizeof(struct ath_desc) % 4) != 0);
+                error = -ENOMEM;
+                goto fail;
+        }
+
+        dd->dd_desc_len = sizeof(struct ath_desc) * nbuf * ndesc;
+
+        /*
+         * Need additional DMA memory because we can't use
+         * descriptors that cross the 4K page boundary. Assume
+         * one skipped descriptor per 4K page.
+         */
+        if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_4KB_SPLITTRANS)) {
+                u32 ndesc_skipped =
+                        ATH_DESC_4KB_BOUND_NUM_SKIPPED(dd->dd_desc_len);
+                u32 dma_len;
+
+                while (ndesc_skipped) {
+                        dma_len = ndesc_skipped * sizeof(struct ath_desc);
+                        dd->dd_desc_len += dma_len;
+
+                        ndesc_skipped = ATH_DESC_4KB_BOUND_NUM_SKIPPED(dma_len);
+                };
+        }
+
+        /* allocate descriptors */
+        dd->dd_desc = dma_alloc_coherent(sc->dev, dd->dd_desc_len,
+                                         &dd->dd_desc_paddr, GFP_KERNEL);
+        if (dd->dd_desc == NULL) {
+                error = -ENOMEM;
+                goto fail;
+        }
+        ds = dd->dd_desc;
+        ath_print(common, ATH_DBG_CONFIG, "%s DMA map: %p (%u) -> %llx (%u)\n",
+                  name, ds, (u32) dd->dd_desc_len,
+                  ito64(dd->dd_desc_paddr), /*XXX*/(u32) dd->dd_desc_len);
+
+        /* allocate buffers */
+        bsize = sizeof(struct ath_buf) * nbuf;
+        bf = kzalloc(bsize, GFP_KERNEL);
+        if (bf == NULL) {
+                error = -ENOMEM;
+                goto fail2;
+        }
+        dd->dd_bufptr = bf;
+
+        for (i = 0; i < nbuf; i++, bf++, ds += ndesc) {
+                bf->bf_desc = ds;
+                bf->bf_daddr = DS2PHYS(dd, ds);
+
+                if (!(sc->sc_ah->caps.hw_caps &
+                      ATH9K_HW_CAP_4KB_SPLITTRANS)) {
+                        /*
+                         * Skip descriptor addresses which can cause 4KB
+                         * boundary crossing (addr + length) with a 32 dword
+                         * descriptor fetch.
+                         */
+                        while (ATH_DESC_4KB_BOUND_CHECK(bf->bf_daddr)) {
+                                BUG_ON((caddr_t) bf->bf_desc >=
+                                       ((caddr_t) dd->dd_desc +
+                                        dd->dd_desc_len));
+
+                                ds += ndesc;
+                                bf->bf_desc = ds;
+                                bf->bf_daddr = DS2PHYS(dd, ds);
+                        }
+                }
+                list_add_tail(&bf->list, head);
+        }
+        return 0;
+fail2:
+        dma_free_coherent(sc->dev, dd->dd_desc_len, dd->dd_desc,
+                          dd->dd_desc_paddr);
+fail:
+        memset(dd, 0, sizeof(*dd));
+        return error;
+#undef ATH_DESC_4KB_BOUND_CHECK
+#undef ATH_DESC_4KB_BOUND_NUM_SKIPPED
+#undef DS2PHYS
+}
+
+static void ath9k_init_crypto(struct ath_softc *sc)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        int i = 0;
+
+        /* Get the hardware key cache size. */
+        common->keymax = sc->sc_ah->caps.keycache_size;
+        if (common->keymax > ATH_KEYMAX) {
+                ath_print(common, ATH_DBG_ANY,
+                          "Warning, using only %u entries in %u key cache\n",
+                          ATH_KEYMAX, common->keymax);
+                common->keymax = ATH_KEYMAX;
+        }
+
+        /*
+         * Reset the key cache since some parts do not
+         * reset the contents on initial power up.
+         */
+        for (i = 0; i < common->keymax; i++)
+                ath9k_hw_keyreset(sc->sc_ah, (u16) i);
+
+        if (ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_CIPHER,
+                                   ATH9K_CIPHER_TKIP, NULL)) {
+                /*
+                 * Whether we should enable h/w TKIP MIC.
+                 * XXX: if we don't support WME TKIP MIC, then we wouldn't
+                 * report WMM capable, so it's always safe to turn on
+                 * TKIP MIC in this case.
+                 */
+                ath9k_hw_setcapability(sc->sc_ah, ATH9K_CAP_TKIP_MIC, 0, 1, NULL);
+        }
+
+        /*
+         * Check whether the separate key cache entries
+         * are required to handle both tx+rx MIC keys.
+         * With split mic keys the number of stations is limited
+         * to 27 otherwise 59.
+         */
+        if (ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_CIPHER,
+                                   ATH9K_CIPHER_TKIP, NULL)
+            && ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_CIPHER,
+                                      ATH9K_CIPHER_MIC, NULL)
+            && ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_TKIP_SPLIT,
+                                      0, NULL))
+                common->splitmic = 1;
+
+        /* turn on mcast key search if possible */
+        if (!ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_MCAST_KEYSRCH, 0, NULL))
+                (void)ath9k_hw_setcapability(sc->sc_ah, ATH9K_CAP_MCAST_KEYSRCH,
+                                             1, 1, NULL);
+
+}
+
+static int ath9k_init_btcoex(struct ath_softc *sc)
+{
+        int r, qnum;
+
+        switch (sc->sc_ah->btcoex_hw.scheme) {
+        case ATH_BTCOEX_CFG_NONE:
+                break;
+        case ATH_BTCOEX_CFG_2WIRE:
+                ath9k_hw_btcoex_init_2wire(sc->sc_ah);
+                break;
+        case ATH_BTCOEX_CFG_3WIRE:
+                ath9k_hw_btcoex_init_3wire(sc->sc_ah);
+                r = ath_init_btcoex_timer(sc);
+                if (r)
+                        return -1;
+                qnum = ath_tx_get_qnum(sc, ATH9K_TX_QUEUE_DATA, ATH9K_WME_AC_BE);
+                ath9k_hw_init_btcoex_hw(sc->sc_ah, qnum);
+                sc->btcoex.bt_stomp_type = ATH_BTCOEX_STOMP_LOW;
+                break;
+        default:
+                WARN_ON(1);
+                break;
+        }
+
+        return 0;
+}
+
+static int ath9k_init_queues(struct ath_softc *sc)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        int i = 0;
+
+        for (i = 0; i < ARRAY_SIZE(sc->tx.hwq_map); i++)
+                sc->tx.hwq_map[i] = -1;
+
+        sc->beacon.beaconq = ath9k_hw_beaconq_setup(sc->sc_ah);
+        if (sc->beacon.beaconq == -1) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to setup a beacon xmit queue\n");
+                goto err;
+        }
+
+        sc->beacon.cabq = ath_txq_setup(sc, ATH9K_TX_QUEUE_CAB, 0);
+        if (sc->beacon.cabq == NULL) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to setup CAB xmit queue\n");
+                goto err;
+        }
+
+        sc->config.cabqReadytime = ATH_CABQ_READY_TIME;
+        ath_cabq_update(sc);
+
+        if (!ath_tx_setup(sc, ATH9K_WME_AC_BK)) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to setup xmit queue for BK traffic\n");
+                goto err;
+        }
+
+        if (!ath_tx_setup(sc, ATH9K_WME_AC_BE)) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to setup xmit queue for BE traffic\n");
+                goto err;
+        }
+        if (!ath_tx_setup(sc, ATH9K_WME_AC_VI)) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to setup xmit queue for VI traffic\n");
+                goto err;
+        }
+        if (!ath_tx_setup(sc, ATH9K_WME_AC_VO)) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to setup xmit queue for VO traffic\n");
+                goto err;
+        }
+
+        return 0;
+
+err:
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
+                if (ATH_TXQ_SETUP(sc, i))
+                        ath_tx_cleanupq(sc, &sc->tx.txq[i]);
+
+        return -EIO;
+}
+
+static void ath9k_init_channels_rates(struct ath_softc *sc)
+{
+        if (test_bit(ATH9K_MODE_11G, sc->sc_ah->caps.wireless_modes)) {
+                sc->sbands[IEEE80211_BAND_2GHZ].channels = ath9k_2ghz_chantable;
+                sc->sbands[IEEE80211_BAND_2GHZ].band = IEEE80211_BAND_2GHZ;
+                sc->sbands[IEEE80211_BAND_2GHZ].n_channels =
+                        ARRAY_SIZE(ath9k_2ghz_chantable);
+                sc->sbands[IEEE80211_BAND_2GHZ].bitrates = ath9k_legacy_rates;
+                sc->sbands[IEEE80211_BAND_2GHZ].n_bitrates =
+                        ARRAY_SIZE(ath9k_legacy_rates);
+        }
+
+        if (test_bit(ATH9K_MODE_11A, sc->sc_ah->caps.wireless_modes)) {
+                sc->sbands[IEEE80211_BAND_5GHZ].channels = ath9k_5ghz_chantable;
+                sc->sbands[IEEE80211_BAND_5GHZ].band = IEEE80211_BAND_5GHZ;
+                sc->sbands[IEEE80211_BAND_5GHZ].n_channels =
+                        ARRAY_SIZE(ath9k_5ghz_chantable);
+                sc->sbands[IEEE80211_BAND_5GHZ].bitrates =
+                        ath9k_legacy_rates + 4;
+                sc->sbands[IEEE80211_BAND_5GHZ].n_bitrates =
+                        ARRAY_SIZE(ath9k_legacy_rates) - 4;
+        }
+}
+
+static void ath9k_init_misc(struct ath_softc *sc)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        int i = 0;
+
+        common->ani.noise_floor = ATH_DEFAULT_NOISE_FLOOR;
+        setup_timer(&common->ani.timer, ath_ani_calibrate, (unsigned long)sc);
+
+        sc->config.txpowlimit = ATH_TXPOWER_MAX;
+
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
+                sc->sc_flags |= SC_OP_TXAGGR;
+                sc->sc_flags |= SC_OP_RXAGGR;
+        }
+
+        common->tx_chainmask = sc->sc_ah->caps.tx_chainmask;
+        common->rx_chainmask = sc->sc_ah->caps.rx_chainmask;
+
+        ath9k_hw_setcapability(sc->sc_ah, ATH9K_CAP_DIVERSITY, 1, true, NULL);
+        sc->rx.defant = ath9k_hw_getdefantenna(sc->sc_ah);
+
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
+                memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
+
+        sc->beacon.slottime = ATH9K_SLOT_TIME_9;
+
+        for (i = 0; i < ARRAY_SIZE(sc->beacon.bslot); i++) {
+                sc->beacon.bslot[i] = NULL;
+                sc->beacon.bslot_aphy[i] = NULL;
+        }
+}
+
+static int ath9k_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
+                            const struct ath_bus_ops *bus_ops)
+{
+        struct ath_hw *ah = NULL;
+        struct ath_common *common;
+        int ret = 0, i;
+        int csz = 0;
+
+        ah = kzalloc(sizeof(struct ath_hw), GFP_KERNEL);
+        if (!ah)
+                return -ENOMEM;
+
+        ah->hw_version.devid = devid;
+        ah->hw_version.subsysid = subsysid;
+        sc->sc_ah = ah;
+
+        common = ath9k_hw_common(ah);
+        common->ops = &ath9k_common_ops;
+        common->bus_ops = bus_ops;
+        common->ah = ah;
+        common->hw = sc->hw;
+        common->priv = sc;
+        common->debug_mask = ath9k_debug;
+
+        spin_lock_init(&sc->wiphy_lock);
+        spin_lock_init(&sc->sc_resetlock);
+        spin_lock_init(&sc->sc_serial_rw);
+        spin_lock_init(&sc->sc_pm_lock);
+        mutex_init(&sc->mutex);
+        tasklet_init(&sc->intr_tq, ath9k_tasklet, (unsigned long)sc);
+        tasklet_init(&sc->bcon_tasklet, ath_beacon_tasklet,
+                     (unsigned long)sc);
+
+        /*
+         * Cache line size is used to size and align various
+         * structures used to communicate with the hardware.
+         */
+        ath_read_cachesize(common, &csz);
+        common->cachelsz = csz << 2; /* convert to bytes */
+
+        ret = ath9k_hw_init(ah);
+        if (ret) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to initialize hardware; "
+                          "initialization status: %d\n", ret);
+                goto err_hw;
+        }
+
+        ret = ath9k_init_debug(ah);
+        if (ret) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to create debugfs files\n");
+                goto err_debug;
+        }
+
+        ret = ath9k_init_queues(sc);
+        if (ret)
+                goto err_queues;
+
+        ret =  ath9k_init_btcoex(sc);
+        if (ret)
+                goto err_btcoex;
+
+        ath9k_init_crypto(sc);
+        ath9k_init_channels_rates(sc);
+        ath9k_init_misc(sc);
+
+        return 0;
+
+err_btcoex:
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
+                if (ATH_TXQ_SETUP(sc, i))
+                        ath_tx_cleanupq(sc, &sc->tx.txq[i]);
+err_queues:
+        ath9k_exit_debug(ah);
+err_debug:
+        ath9k_hw_deinit(ah);
+err_hw:
+        tasklet_kill(&sc->intr_tq);
+        tasklet_kill(&sc->bcon_tasklet);
+
+        kfree(ah);
+        sc->sc_ah = NULL;
+
+        return ret;
+}
+
+void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
+                IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
+                IEEE80211_HW_SIGNAL_DBM |
+                IEEE80211_HW_SUPPORTS_PS |
+                IEEE80211_HW_PS_NULLFUNC_STACK |
+                IEEE80211_HW_SPECTRUM_MGMT |
+                IEEE80211_HW_REPORTS_TX_ACK_STATUS;
+
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
+                 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+
+        if (AR_SREV_9160_10_OR_LATER(sc->sc_ah) || modparam_nohwcrypt)
+                hw->flags |= IEEE80211_HW_MFP_CAPABLE;
+
+        hw->wiphy->interface_modes =
+                BIT(NL80211_IFTYPE_AP) |
+                BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_ADHOC) |
+                BIT(NL80211_IFTYPE_MESH_POINT);
+
+        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+        hw->queues = 4;
+        hw->max_rates = 4;
+        hw->channel_change_time = 5000;
+        hw->max_listen_interval = 10;
+        hw->max_rate_tries = 10;
+        hw->sta_data_size = sizeof(struct ath_node);
+        hw->vif_data_size = sizeof(struct ath_vif);
+
+        hw->rate_control_algorithm = "ath9k_rate_control";
+
+        if (test_bit(ATH9K_MODE_11G, sc->sc_ah->caps.wireless_modes))
+                hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
+                        &sc->sbands[IEEE80211_BAND_2GHZ];
+        if (test_bit(ATH9K_MODE_11A, sc->sc_ah->caps.wireless_modes))
+                hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
+                        &sc->sbands[IEEE80211_BAND_5GHZ];
+
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
+                if (test_bit(ATH9K_MODE_11G, sc->sc_ah->caps.wireless_modes))
+                        setup_ht_cap(sc, &sc->sbands[IEEE80211_BAND_2GHZ].ht_cap);
+                if (test_bit(ATH9K_MODE_11A, sc->sc_ah->caps.wireless_modes))
+                        setup_ht_cap(sc, &sc->sbands[IEEE80211_BAND_5GHZ].ht_cap);
+        }
+
+        SET_IEEE80211_PERM_ADDR(hw, common->macaddr);
+}
+
+int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
+                    const struct ath_bus_ops *bus_ops)
+{
+        struct ieee80211_hw *hw = sc->hw;
+        struct ath_common *common;
+        struct ath_hw *ah;
+        int error = 0;
+        struct ath_regulatory *reg;
+
+        /* Bring up device */
+        error = ath9k_init_softc(devid, sc, subsysid, bus_ops);
+        if (error != 0)
+                goto error_init;
+
+        ah = sc->sc_ah;
+        common = ath9k_hw_common(ah);
+        ath9k_set_hw_capab(sc, hw);
+
+        /* Initialize regulatory */
+        error = ath_regd_init(&common->regulatory, sc->hw->wiphy,
+                              ath9k_reg_notifier);
+        if (error)
+                goto error_regd;
+
+        reg = &common->regulatory;
+
+        /* Setup TX DMA */
+        error = ath_tx_init(sc, ATH_TXBUF);
+        if (error != 0)
+                goto error_tx;
+
+        /* Setup RX DMA */
+        error = ath_rx_init(sc, ATH_RXBUF);
+        if (error != 0)
+                goto error_rx;
+
+        /* Register with mac80211 */
+        error = ieee80211_register_hw(hw);
+        if (error)
+                goto error_register;
+
+        /* Handle world regulatory */
+        if (!ath_is_world_regd(reg)) {
+                error = regulatory_hint(hw->wiphy, reg->alpha2);
+                if (error)
+                        goto error_world;
+        }
+
+        INIT_WORK(&sc->chan_work, ath9k_wiphy_chan_work);
+        INIT_DELAYED_WORK(&sc->wiphy_work, ath9k_wiphy_work);
+        sc->wiphy_scheduler_int = msecs_to_jiffies(500);
+
+        ath_init_leds(sc);
+        ath_start_rfkill_poll(sc);
+
+        return 0;
+
+error_world:
+        ieee80211_unregister_hw(hw);
+error_register:
+        ath_rx_cleanup(sc);
+error_rx:
+        ath_tx_cleanup(sc);
+error_tx:
+        /* Nothing */
+error_regd:
+        ath9k_deinit_softc(sc);
+error_init:
+        return error;
+}
+
+/*****************************/
+/*     De-Initialization     */
+/*****************************/
+
+static void ath9k_deinit_softc(struct ath_softc *sc)
+{
+        int i = 0;
+
+        if ((sc->btcoex.no_stomp_timer) &&
+            sc->sc_ah->btcoex_hw.scheme == ATH_BTCOEX_CFG_3WIRE)
+                ath_gen_timer_free(sc->sc_ah, sc->btcoex.no_stomp_timer);
+
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
+                if (ATH_TXQ_SETUP(sc, i))
+                        ath_tx_cleanupq(sc, &sc->tx.txq[i]);
+
+        ath9k_exit_debug(sc->sc_ah);
+        ath9k_hw_deinit(sc->sc_ah);
+
+        tasklet_kill(&sc->intr_tq);
+        tasklet_kill(&sc->bcon_tasklet);
+}
+
+void ath9k_deinit_device(struct ath_softc *sc)
+{
+        struct ieee80211_hw *hw = sc->hw;
+        int i = 0;
+
+        ath9k_ps_wakeup(sc);
+
+        wiphy_rfkill_stop_polling(sc->hw->wiphy);
+        ath_deinit_leds(sc);
+
+        for (i = 0; i < sc->num_sec_wiphy; i++) {
+                struct ath_wiphy *aphy = sc->sec_wiphy[i];
+                if (aphy == NULL)
+                        continue;
+                sc->sec_wiphy[i] = NULL;
+                ieee80211_unregister_hw(aphy->hw);
+                ieee80211_free_hw(aphy->hw);
+        }
+        kfree(sc->sec_wiphy);
+
+        ieee80211_unregister_hw(hw);
+        ath_rx_cleanup(sc);
+        ath_tx_cleanup(sc);
+        ath9k_deinit_softc(sc);
+}
+
+void ath_descdma_cleanup(struct ath_softc *sc,
+                         struct ath_descdma *dd,
+                         struct list_head *head)
+{
+        dma_free_coherent(sc->dev, dd->dd_desc_len, dd->dd_desc,
+                          dd->dd_desc_paddr);
+
+        INIT_LIST_HEAD(head);
+        kfree(dd->dd_bufptr);
+        memset(dd, 0, sizeof(*dd));
+}
+
+/************************/
+/*     Module Hooks     */
+/************************/
+
+static int __init ath9k_init(void)
+{
+        int error;
+
+        /* Register rate control algorithm */
+        error = ath_rate_control_register();
+        if (error != 0) {
+                printk(KERN_ERR
+                        "ath9k: Unable to register rate control "
+                        "algorithm: %d\n",
+                        error);
+                goto err_out;
+        }
+
+        error = ath9k_debug_create_root();
+        if (error) {
+                printk(KERN_ERR
+                        "ath9k: Unable to create debugfs root: %d\n",
+                        error);
+                goto err_rate_unregister;
+        }
+
+        error = ath_pci_init();
+        if (error < 0) {
+                printk(KERN_ERR
+                        "ath9k: No PCI devices found, driver not installed.\n");
+                error = -ENODEV;
+                goto err_remove_root;
+        }
+
+        error = ath_ahb_init();
+        if (error < 0) {
+                error = -ENODEV;
+                goto err_pci_exit;
+        }
+
+        return 0;
+
+ err_pci_exit:
+        ath_pci_exit();
+
+ err_remove_root:
+        ath9k_debug_remove_root();
+ err_rate_unregister:
+        ath_rate_control_unregister();
+ err_out:
+        return error;
+}
+module_init(ath9k_init);
+
+static void __exit ath9k_exit(void)
+{
+        ath_ahb_exit();
+        ath_pci_exit();
+        ath9k_debug_remove_root();
+        ath_rate_control_unregister();
+        printk(KERN_INFO "%s: Driver unloaded\n", dev_info);
+}
+module_exit(ath9k_exit);
diff --git a/drivers/net/wireless/ath/ath9k/initvals.h b/drivers/net/wireless/ath/ath9k/initvals.h
index 8622265a030a..8a3bf3ab998d 100644
--- a/drivers/net/wireless/ath/ath9k/initvals.h
+++ b/drivers/net/wireless/ath/ath9k/initvals.h
@@ -21,6 +21,8 @@ static const u32 ar5416Modes[][6] = {
     { 0x000010f0, 0x0000a000, 0x00014000, 0x00016000, 0x0000b000, 0x00014008 },
     { 0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00, 0x06e006e0 },
     { 0x0000801c, 0x128d93a7, 0x128d93cf, 0x12e013d7, 0x12e013ab, 0x098813cf },
+    { 0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810, 0x08f04810 },
+    { 0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a, 0x0000320a },
     { 0x00009804, 0x00000300, 0x000003c4, 0x000003c4, 0x00000300, 0x00000303 },
     { 0x00009820, 0x02020200, 0x02020200, 0x02020200, 0x02020200, 0x02020200 },
     { 0x00009824, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
@@ -31,11 +33,11 @@ static const u32 ar5416Modes[][6] = {
     { 0x00009848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
     { 0x0000a848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
     { 0x0000b848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
-    { 0x00009850, 0x6c48b4e0, 0x6c48b4e0, 0x6c48b0de, 0x6c48b0de, 0x6c48b0de },
+    { 0x00009850, 0x6c48b4e0, 0x6d48b4e0, 0x6d48b0de, 0x6c48b0de, 0x6c48b0de },
     { 0x00009858, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e },
-    { 0x0000985c, 0x31395d5e, 0x31395d5e, 0x31395d5e, 0x31395d5e, 0x31395d5e },
+    { 0x0000985c, 0x31395d5e, 0x3139605e, 0x3139605e, 0x31395d5e, 0x31395d5e },
     { 0x00009860, 0x00049d18, 0x00049d18, 0x00049d18, 0x00049d18, 0x00049d18 },
-    { 0x0000c864, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00 },
+    { 0x00009864, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00 },
     { 0x00009868, 0x409a4190, 0x409a4190, 0x409a4190, 0x409a4190, 0x409a4190 },
     { 0x0000986c, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081 },
     { 0x00009914, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898, 0x000007d0 },
@@ -46,10 +48,10 @@ static const u32 ar5416Modes[][6] = {
     { 0x0000a960, 0x00000900, 0x00000900, 0x00012d80, 0x00012d80, 0x00012d80 },
     { 0x0000b960, 0x00000900, 0x00000900, 0x00012d80, 0x00012d80, 0x00012d80 },
     { 0x00009964, 0x00000000, 0x00000000, 0x00001120, 0x00001120, 0x00001120 },
-    { 0x0000c9bc, 0x001a0a00, 0x001a0a00, 0x001a0a00, 0x001a0a00, 0x001a0a00 },
+    { 0x000099bc, 0x001a0a00, 0x001a0a00, 0x001a0a00, 0x001a0a00, 0x001a0a00 },
     { 0x000099c0, 0x038919be, 0x038919be, 0x038919be, 0x038919be, 0x038919be },
     { 0x000099c4, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77 },
-    { 0x000099c8, 0x60f6532c, 0x60f6532c, 0x60f6532c, 0x60f6532c, 0x60f6532c },
+    { 0x000099c8, 0x6af6532c, 0x6af6532c, 0x6af6532c, 0x6af6532c, 0x6af6532c },
     { 0x000099cc, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8 },
     { 0x000099d0, 0x00046384, 0x00046384, 0x00046384, 0x00046384, 0x00046384 },
     { 0x000099d4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
@@ -199,7 +201,6 @@ static const u32 ar5416Common[][2] = {
     { 0x00008110, 0x00000168 },
     { 0x00008118, 0x000100aa },
     { 0x0000811c, 0x00003210 },
-    { 0x00008120, 0x08f04800 },
     { 0x00008124, 0x00000000 },
     { 0x00008128, 0x00000000 },
     { 0x0000812c, 0x00000000 },
@@ -215,7 +216,6 @@ static const u32 ar5416Common[][2] = {
     { 0x00008178, 0x00000100 },
     { 0x0000817c, 0x00000000 },
     { 0x000081c4, 0x00000000 },
-    { 0x000081d0, 0x00003210 },
     { 0x000081ec, 0x00000000 },
     { 0x000081f0, 0x00000000 },
     { 0x000081f4, 0x00000000 },
@@ -246,6 +246,7 @@ static const u32 ar5416Common[][2] = {
     { 0x00008258, 0x00000000 },
     { 0x0000825c, 0x400000ff },
     { 0x00008260, 0x00080922 },
+    { 0x00008264, 0xa8000010 },
     { 0x00008270, 0x00000000 },
     { 0x00008274, 0x40000000 },
     { 0x00008278, 0x003e4180 },
@@ -406,9 +407,9 @@ static const u32 ar5416Common[][2] = {
     { 0x0000a25c, 0x0f0f0f01 },
     { 0x0000a260, 0xdfa91f01 },
     { 0x0000a268, 0x00000000 },
-    { 0x0000a26c, 0x0ebae9c6 },
-    { 0x0000b26c, 0x0ebae9c6 },
-    { 0x0000c26c, 0x0ebae9c6 },
+    { 0x0000a26c, 0x0e79e5c6 },
+    { 0x0000b26c, 0x0e79e5c6 },
+    { 0x0000c26c, 0x0e79e5c6 },
     { 0x0000d270, 0x00820820 },
     { 0x0000a278, 0x1ce739ce },
     { 0x0000a27c, 0x051701ce },
@@ -2551,26 +2552,27 @@ static const u32 ar9280Modes_9280_2[][6] = {
     { 0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440, 0x00006880 },
     { 0x00009804, 0x00000300, 0x000003c4, 0x000003c4, 0x00000300, 0x00000303 },
     { 0x00009820, 0x02020200, 0x02020200, 0x02020200, 0x02020200, 0x02020200 },
-    { 0x00009824, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
+    { 0x00009824, 0x01000e0e, 0x01000e0e, 0x01000e0e, 0x01000e0e, 0x01000e0e },
     { 0x00009828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001 },
     { 0x00009834, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
     { 0x00009838, 0x00000007, 0x00000007, 0x00000007, 0x00000007, 0x00000007 },
     { 0x00009840, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a012e, 0x206a012e },
     { 0x00009844, 0x0372161e, 0x0372161e, 0x037216a0, 0x037216a0, 0x037216a0 },
-    { 0x00009850, 0x6c4000e2, 0x6c4000e2, 0x6d4000e2, 0x6c4000e2, 0x6c4000e2 },
+    { 0x00009850, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2, 0x6c4000e2 },
     { 0x00009858, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec84d2e, 0x7ec84d2e },
-    { 0x0000985c, 0x31395d5e, 0x31395d5e, 0x3139605e, 0x31395d5e, 0x31395d5e },
+    { 0x0000985c, 0x31395d5e, 0x3139605e, 0x3139605e, 0x31395d5e, 0x31395d5e },
     { 0x00009860, 0x00048d18, 0x00048d18, 0x00048d20, 0x00048d20, 0x00048d18 },
     { 0x00009864, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00 },
     { 0x00009868, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0 },
     { 0x0000986c, 0x06903081, 0x06903081, 0x06903881, 0x06903881, 0x06903881 },
     { 0x00009914, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898, 0x000007d0 },
-    { 0x00009918, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b, 0x00000016 },
+    { 0x00009918, 0x0000000a, 0x00000014, 0x00000268, 0x0000000b, 0x00000016 },
     { 0x00009924, 0xd00a8a0b, 0xd00a8a0b, 0xd00a8a0d, 0xd00a8a0d, 0xd00a8a0d },
     { 0x00009944, 0xffbc1010, 0xffbc1010, 0xffbc1010, 0xffbc1010, 0xffbc1010 },
     { 0x00009960, 0x00000010, 0x00000010, 0x00000010, 0x00000010, 0x00000010 },
     { 0x0000a960, 0x00000010, 0x00000010, 0x00000010, 0x00000010, 0x00000010 },
     { 0x00009964, 0x00000210, 0x00000210, 0x00000210, 0x00000210, 0x00000210 },
+    { 0x0000c968, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce, 0x000003ce },
     { 0x000099b8, 0x0000001c, 0x0000001c, 0x0000001c, 0x0000001c, 0x0000001c },
     { 0x000099bc, 0x00000a00, 0x00000a00, 0x00000c00, 0x00000c00, 0x00000c00 },
     { 0x000099c0, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4 },
@@ -2585,8 +2587,10 @@ static const u32 ar9280Modes_9280_2[][6] = {
     { 0x0000b20c, 0x00000014, 0x00000014, 0x0001f019, 0x0001f019, 0x0001f019 },
     { 0x0000a21c, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a },
     { 0x0000a230, 0x00000000, 0x00000000, 0x00000210, 0x00000108, 0x00000000 },
+    { 0x0000a23c, 0x13c88000, 0x13c88000, 0x13c88001, 0x13c88000, 0x13c88000 },
     { 0x0000a250, 0x001ff000, 0x001ff000, 0x0004a000, 0x0004a000, 0x0004a000 },
     { 0x0000a358, 0x7999aa02, 0x7999aa02, 0x7999aa0e, 0x7999aa0e, 0x7999aa0e },
+    { 0x0000a388, 0x0c000000, 0x0c000000, 0x08000000, 0x0c000000, 0x0c000000 },
     { 0x0000a3d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
     { 0x00007894, 0x5a508000, 0x5a508000, 0x5a508000, 0x5a508000, 0x5a508000 },
 };
@@ -2813,7 +2817,6 @@ static const u32 ar9280Common_9280_2[][2] = {
     { 0x00009958, 0x2108ecff },
     { 0x00009940, 0x14750604 },
     { 0x0000c95c, 0x004b6a8e },
-    { 0x0000c968, 0x000003ce },
     { 0x00009970, 0x190fb515 },
     { 0x00009974, 0x00000000 },
     { 0x00009978, 0x00000001 },
@@ -2849,7 +2852,6 @@ static const u32 ar9280Common_9280_2[][2] = {
     { 0x0000a22c, 0x233f7180 },
     { 0x0000a234, 0x20202020 },
     { 0x0000a238, 0x20202020 },
-    { 0x0000a23c, 0x13c88000 },
     { 0x0000a240, 0x38490a20 },
     { 0x0000a244, 0x00007bb6 },
     { 0x0000a248, 0x0fff3ffc },
@@ -2859,8 +2861,8 @@ static const u32 ar9280Common_9280_2[][2] = {
     { 0x0000a25c, 0x0f0f0f01 },
     { 0x0000a260, 0xdfa91f01 },
     { 0x0000a268, 0x00000000 },
-    { 0x0000a26c, 0x0ebae9c6 },
-    { 0x0000b26c, 0x0ebae9c6 },
+    { 0x0000a26c, 0x0e79e5c6 },
+    { 0x0000b26c, 0x0e79e5c6 },
     { 0x0000d270, 0x00820820 },
     { 0x0000a278, 0x1ce739ce },
     { 0x0000d35c, 0x07ffffef },
@@ -2874,7 +2876,6 @@ static const u32 ar9280Common_9280_2[][2] = {
     { 0x0000d37c, 0x7fffffe2 },
     { 0x0000d380, 0x7f3c7bba },
     { 0x0000d384, 0xf3307ff0 },
-    { 0x0000a388, 0x0c000000 },
     { 0x0000a38c, 0x20202020 },
     { 0x0000a390, 0x20202020 },
     { 0x0000a394, 0x1ce739ce },
@@ -2940,7 +2941,7 @@ static const u32 ar9280Modes_fast_clock_9280_2[][3] = {
     { 0x0000801c, 0x148ec02b, 0x148ec057 },
     { 0x00008318, 0x000044c0, 0x00008980 },
     { 0x00009820, 0x02020200, 0x02020200 },
-    { 0x00009824, 0x00000f0f, 0x00000f0f },
+    { 0x00009824, 0x01000f0f, 0x01000f0f },
     { 0x00009828, 0x0b020001, 0x0b020001 },
     { 0x00009834, 0x00000f0f, 0x00000f0f },
     { 0x00009844, 0x03721821, 0x03721821 },
@@ -3348,6 +3349,8 @@ static const u32 ar9280Modes_backoff_13db_rxgain_9280_2[][6] = {
 };
 
 static const u32 ar9280Modes_high_power_tx_gain_9280_2[][6] = {
+    { 0x0000a274, 0x0a19e652, 0x0a19e652, 0x0a1aa652, 0x0a1aa652, 0x0a1aa652 },
+    { 0x0000a27c, 0x050739ce, 0x050739ce, 0x050739ce, 0x050739ce, 0x050739ce },
     { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
     { 0x0000a304, 0x00003002, 0x00003002, 0x00004002, 0x00004002, 0x00004002 },
     { 0x0000a308, 0x00006004, 0x00006004, 0x00007008, 0x00007008, 0x00007008 },
@@ -3376,11 +3379,11 @@ static const u32 ar9280Modes_high_power_tx_gain_9280_2[][6] = {
     { 0x00007840, 0x00172000, 0x00172000, 0x00172000, 0x00172000, 0x00172000 },
     { 0x00007820, 0xf258a480, 0xf258a480, 0xf258a480, 0xf258a480, 0xf258a480 },
     { 0x00007844, 0xf258a480, 0xf258a480, 0xf258a480, 0xf258a480, 0xf258a480 },
-    { 0x0000a274, 0x0a19e652, 0x0a19e652, 0x0a1aa652, 0x0a1aa652, 0x0a1aa652 },
-    { 0x0000a27c, 0x050739ce, 0x050739ce, 0x050739ce, 0x050739ce, 0x050739ce },
 };
 
 static const u32 ar9280Modes_original_tx_gain_9280_2[][6] = {
+    { 0x0000a274, 0x0a19c652, 0x0a19c652, 0x0a1aa652, 0x0a1aa652, 0x0a1aa652 },
+    { 0x0000a27c, 0x050701ce, 0x050701ce, 0x050701ce, 0x050701ce, 0x050701ce },
     { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
     { 0x0000a304, 0x00003002, 0x00003002, 0x00003002, 0x00003002, 0x00003002 },
     { 0x0000a308, 0x00006004, 0x00006004, 0x00008009, 0x00008009, 0x00008009 },
@@ -3409,8 +3412,6 @@ static const u32 ar9280Modes_original_tx_gain_9280_2[][6] = {
     { 0x00007840, 0x00392000, 0x00392000, 0x00392000, 0x00392000, 0x00392000 },
     { 0x00007820, 0x92592480, 0x92592480, 0x92592480, 0x92592480, 0x92592480 },
     { 0x00007844, 0x92592480, 0x92592480, 0x92592480, 0x92592480, 0x92592480 },
-    { 0x0000a274, 0x0a19c652, 0x0a19c652, 0x0a1aa652, 0x0a1aa652, 0x0a1aa652 },
-    { 0x0000a27c, 0x050701ce, 0x050701ce, 0x050701ce, 0x050701ce, 0x050701ce },
 };
 
 static const u32 ar9280PciePhy_clkreq_off_L1_9280[][2] = {
@@ -5918,9 +5919,6 @@ static const u_int32_t ar9287Common_9287_1_1[][2] = {
     { 0x000099ec, 0x0cc80caa },
     { 0x000099f0, 0x00000000 },
     { 0x000099fc, 0x00001042 },
-    { 0x0000a1f4, 0x00fffeff },
-    { 0x0000a1f8, 0x00f5f9ff },
-    { 0x0000a1fc, 0xb79f6427 },
     { 0x0000a208, 0x803e4788 },
     { 0x0000a210, 0x4080a333 },
     { 0x0000a214, 0x40206c10 },
@@ -5980,7 +5978,7 @@ static const u_int32_t ar9287Common_9287_1_1[][2] = {
     { 0x0000b3f4, 0x00000000 },
     { 0x0000a7d8, 0x000003f1 },
     { 0x00007800, 0x00000800 },
-    { 0x00007804, 0x6c35ffc2 },
+    { 0x00007804, 0x6c35ffd2 },
     { 0x00007808, 0x6db6c000 },
     { 0x0000780c, 0x6db6cb30 },
     { 0x00007810, 0x6db6cb6c },
@@ -6000,7 +5998,7 @@ static const u_int32_t ar9287Common_9287_1_1[][2] = {
     { 0x00007848, 0x934934a8 },
     { 0x00007850, 0x00000000 },
     { 0x00007854, 0x00000800 },
-    { 0x00007858, 0x6c35ffc2 },
+    { 0x00007858, 0x6c35ffd2 },
     { 0x0000785c, 0x6db6c000 },
     { 0x00007860, 0x6db6cb30 },
     { 0x00007864, 0x6db6cb6c },
@@ -6027,6 +6025,22 @@ static const u_int32_t ar9287Common_9287_1_1[][2] = {
     { 0x000078b8, 0x2a850160 },
 };
 
+/*
+ * For Japanese regulatory requirements, 2484 MHz requires the following three
+ * registers be programmed differently from the channel between 2412 and 2472 MHz.
+ */
+static const u_int32_t ar9287Common_normal_cck_fir_coeff_92871_1[][2] = {
+    { 0x0000a1f4, 0x00fffeff },
+    { 0x0000a1f8, 0x00f5f9ff },
+    { 0x0000a1fc, 0xb79f6427 },
+};
+
+static const u_int32_t ar9287Common_japan_2484_cck_fir_coeff_92871_1[][2] = {
+    { 0x0000a1f4, 0x00000000 },
+    { 0x0000a1f8, 0xefff0301 },
+    { 0x0000a1fc, 0xca9228ee },
+};
+
 static const u_int32_t ar9287Modes_tx_gain_9287_1_1[][6] = {
     /* Address      5G-HT20     5G-HT40     2G-HT40     2G-HT20     Turbo   */
     { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
@@ -6365,8 +6379,8 @@ static const u_int32_t ar9287PciePhy_clkreq_off_L1_9287_1_1[][2] = {
 };
 
 
-/* AR9271 initialization values automaticaly created: 03/23/09 */
-static const u_int32_t ar9271Modes_9271_1_0[][6] = {
+/* AR9271 initialization values automaticaly created: 06/04/09 */
+static const u_int32_t ar9271Modes_9271[][6] = {
     { 0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0 },
     { 0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c, 0x000001e0 },
     { 0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38, 0x00001180 },
@@ -6376,8 +6390,8 @@ static const u_int32_t ar9271Modes_9271_1_0[][6] = {
     { 0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440, 0x00006880 },
     { 0x00009804, 0x00000300, 0x000003c4, 0x000003c4, 0x00000300, 0x00000303 },
     { 0x00009820, 0x02020200, 0x02020200, 0x02020200, 0x02020200, 0x02020200 },
-    { 0x00009824, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
-    { 0x00009828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001 },
+    { 0x00009824, 0x01000e0e, 0x01000e0e, 0x01000e0e, 0x01000e0e, 0x01000e0e },
+    { 0x00009828, 0x3a020001, 0x3a020001, 0x3a020001, 0x3a020001, 0x3a020001 },
     { 0x00009834, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
     { 0x00009838, 0x00000007, 0x00000007, 0x00000007, 0x00000007, 0x00000007 },
     { 0x00009840, 0x206a012e, 0x206a012e, 0x206a012e, 0x206a012e, 0x206a012e },
@@ -6391,6 +6405,7 @@ static const u_int32_t ar9271Modes_9271_1_0[][6] = {
     { 0x00009864, 0x0000fe00, 0x0000fe00, 0x0001ce00, 0x0001ce00, 0x0001ce00 },
     { 0x00009868, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0 },
     { 0x0000986c, 0x06903081, 0x06903081, 0x06903881, 0x06903881, 0x06903881 },
+    { 0x00009910, 0x30002310, 0x30002310, 0x30002310, 0x30002310, 0x30002310 },
     { 0x00009914, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898, 0x000007d0 },
     { 0x00009918, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b, 0x00000016 },
     { 0x00009924, 0xd00a8007, 0xd00a8007, 0xd00a800d, 0xd00a800d, 0xd00a800d },
@@ -6401,7 +6416,7 @@ static const u_int32_t ar9271Modes_9271_1_0[][6] = {
     { 0x000099bc, 0x00000600, 0x00000600, 0x00000c00, 0x00000c00, 0x00000c00 },
     { 0x000099c0, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4 },
     { 0x000099c4, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77 },
-    { 0x000099c8, 0x6af65329, 0x6af65329, 0x6af65329, 0x6af65329, 0x6af65329 },
+    { 0x000099c8, 0x6af6532f, 0x6af6532f, 0x6af6532f, 0x6af6532f, 0x6af6532f },
     { 0x000099cc, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8 },
     { 0x000099d0, 0x00046384, 0x00046384, 0x00046384, 0x00046384, 0x00046384 },
     { 0x000099d4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
@@ -6690,7 +6705,7 @@ static const u_int32_t ar9271Modes_9271_1_0[][6] = {
     { 0x0000a358, 0x7999aa02, 0x7999aa02, 0x7999aa0e, 0x7999aa0e, 0x7999aa0e },
 };
 
-static const u_int32_t ar9271Common_9271_1_0[][2] = {
+static const u_int32_t ar9271Common_9271[][2] = {
     { 0x0000000c, 0x00000000 },
     { 0x00000030, 0x00020045 },
     { 0x00000034, 0x00000005 },
@@ -6786,7 +6801,7 @@ static const u_int32_t ar9271Common_9271_1_0[][2] = {
     { 0x0000803c, 0x00000000 },
     { 0x00008048, 0x00000000 },
     { 0x00008054, 0x00000000 },
-    { 0x00008058, 0x02000000 },
+    { 0x00008058, 0x00000000 },
     { 0x0000805c, 0x000fc78f },
     { 0x00008060, 0x0000000f },
     { 0x00008064, 0x00000000 },
@@ -6817,7 +6832,7 @@ static const u_int32_t ar9271Common_9271_1_0[][2] = {
     { 0x00008110, 0x00000168 },
     { 0x00008118, 0x000100aa },
     { 0x0000811c, 0x00003210 },
-    { 0x00008120, 0x08f04814 },
+    { 0x00008120, 0x08f04810 },
     { 0x00008124, 0x00000000 },
     { 0x00008128, 0x00000000 },
     { 0x0000812c, 0x00000000 },
@@ -6864,7 +6879,7 @@ static const u_int32_t ar9271Common_9271_1_0[][2] = {
     { 0x00008258, 0x00000000 },
     { 0x0000825c, 0x400000ff },
     { 0x00008260, 0x00080922 },
-    { 0x00008264, 0xa8a00010 },
+    { 0x00008264, 0x88a00010 },
     { 0x00008270, 0x00000000 },
     { 0x00008274, 0x40000000 },
     { 0x00008278, 0x003e4180 },
@@ -6896,7 +6911,7 @@ static const u_int32_t ar9271Common_9271_1_0[][2] = {
     { 0x00007814, 0x924934a8 },
     { 0x0000781c, 0x00000000 },
     { 0x00007820, 0x00000c04 },
-    { 0x00007824, 0x00d86bff },
+    { 0x00007824, 0x00d8abff },
     { 0x00007828, 0x66964300 },
     { 0x0000782c, 0x8db6d961 },
     { 0x00007830, 0x8db6d96c },
@@ -6930,7 +6945,6 @@ static const u_int32_t ar9271Common_9271_1_0[][2] = {
     { 0x00009904, 0x00000000 },
     { 0x00009908, 0x00000000 },
     { 0x0000990c, 0x00000000 },
-    { 0x00009910, 0x30002310 },
     { 0x0000991c, 0x10000fff },
     { 0x00009920, 0x04900000 },
     { 0x00009928, 0x00000001 },
@@ -6944,7 +6958,7 @@ static const u_int32_t ar9271Common_9271_1_0[][2] = {
     { 0x00009954, 0x5f3ca3de },
     { 0x00009958, 0x0108ecff },
     { 0x00009968, 0x000003ce },
-    { 0x00009970, 0x192bb515 },
+    { 0x00009970, 0x192bb514 },
     { 0x00009974, 0x00000000 },
     { 0x00009978, 0x00000001 },
     { 0x0000997c, 0x00000000 },
@@ -7031,3 +7045,8 @@ static const u_int32_t ar9271Common_9271_1_0[][2] = {
     { 0x0000d380, 0x7f3c7bba },
     { 0x0000d384, 0xf3307ff0 },
 };
+
+static const u_int32_t ar9271Modes_9271_1_0_only[][6] = {
+    { 0x00009910, 0x30002311, 0x30002311, 0x30002311, 0x30002311, 0x30002311 },
+    { 0x00009828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001 },
+};
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 800bfab94635..efc420cd42bf 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -14,16 +14,16 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include "ath9k.h"
+#include "hw.h"
 
 static void ath9k_hw_set_txq_interrupts(struct ath_hw *ah,
                                         struct ath9k_tx_queue_info *qi)
 {
-        DPRINTF(ah->ah_sc, ATH_DBG_INTERRUPT,
-                "tx ok 0x%x err 0x%x desc 0x%x eol 0x%x urn 0x%x\n",
-                ah->txok_interrupt_mask, ah->txerr_interrupt_mask,
-                ah->txdesc_interrupt_mask, ah->txeol_interrupt_mask,
-                ah->txurn_interrupt_mask);
+        ath_print(ath9k_hw_common(ah), ATH_DBG_INTERRUPT,
+                  "tx ok 0x%x err 0x%x desc 0x%x eol 0x%x urn 0x%x\n",
+                  ah->txok_interrupt_mask, ah->txerr_interrupt_mask,
+                  ah->txdesc_interrupt_mask, ah->txeol_interrupt_mask,
+                  ah->txurn_interrupt_mask);
 
         REG_WRITE(ah, AR_IMR_S0,
                   SM(ah->txok_interrupt_mask, AR_IMR_S0_QCU_TXOK)
@@ -39,17 +39,21 @@ u32 ath9k_hw_gettxbuf(struct ath_hw *ah, u32 q)
 {
         return REG_READ(ah, AR_QTXDP(q));
 }
+EXPORT_SYMBOL(ath9k_hw_gettxbuf);
 
 void ath9k_hw_puttxbuf(struct ath_hw *ah, u32 q, u32 txdp)
 {
         REG_WRITE(ah, AR_QTXDP(q), txdp);
 }
+EXPORT_SYMBOL(ath9k_hw_puttxbuf);
 
 void ath9k_hw_txstart(struct ath_hw *ah, u32 q)
 {
-        DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Enable TXE on queue: %u\n", q);
+        ath_print(ath9k_hw_common(ah), ATH_DBG_QUEUE,
+                  "Enable TXE on queue: %u\n", q);
         REG_WRITE(ah, AR_Q_TXE, 1 << q);
 }
+EXPORT_SYMBOL(ath9k_hw_txstart);
 
 u32 ath9k_hw_numtxpending(struct ath_hw *ah, u32 q)
 {
@@ -64,13 +68,39 @@ u32 ath9k_hw_numtxpending(struct ath_hw *ah, u32 q)
 
         return npend;
 }
+EXPORT_SYMBOL(ath9k_hw_numtxpending);
 
+/**
+ * ath9k_hw_updatetxtriglevel - adjusts the frame trigger level
+ *
+ * @ah: atheros hardware struct
+ * @bIncTrigLevel: whether or not the frame trigger level should be updated
+ *
+ * The frame trigger level specifies the minimum number of bytes,
+ * in units of 64 bytes, that must be DMA'ed into the PCU TX FIFO
+ * before the PCU will initiate sending the frame on the air. This can
+ * mean we initiate transmit before a full frame is on the PCU TX FIFO.
+ * Resets to 0x1 (meaning 64 bytes or a full frame, whichever occurs
+ * first)
+ *
+ * Caution must be taken to ensure to set the frame trigger level based
+ * on the DMA request size. For example if the DMA request size is set to
+ * 128 bytes the trigger level cannot exceed 6 * 64 = 384. This is because
+ * there need to be enough space in the tx FIFO for the requested transfer
+ * size. Hence the tx FIFO will stop with 512 - 128 = 384 bytes. If we set
+ * the threshold to a value beyond 6, then the transmit will hang.
+ *
+ * Current dual   stream devices have a PCU TX FIFO size of 8 KB.
+ * Current single stream devices have a PCU TX FIFO size of 4 KB, however,
+ * there is a hardware issue which forces us to use 2 KB instead so the
+ * frame trigger level must not exceed 2 KB for these chipsets.
+ */
 bool ath9k_hw_updatetxtriglevel(struct ath_hw *ah, bool bIncTrigLevel)
 {
         u32 txcfg, curLevel, newLevel;
         enum ath9k_int omask;
 
-        if (ah->tx_trig_level >= MAX_TX_FIFO_THRESHOLD)
+        if (ah->tx_trig_level >= ah->config.max_txtrig_level)
                 return false;
 
         omask = ath9k_hw_set_interrupts(ah, ah->mask_reg & ~ATH9K_INT_GLOBAL);
@@ -79,7 +109,7 @@ bool ath9k_hw_updatetxtriglevel(struct ath_hw *ah, bool bIncTrigLevel)
         curLevel = MS(txcfg, AR_FTRIG);
         newLevel = curLevel;
         if (bIncTrigLevel) {
-                if (curLevel < MAX_TX_FIFO_THRESHOLD)
+                if (curLevel < ah->config.max_txtrig_level)
                         newLevel++;
         } else if (curLevel > MIN_TX_FIFO_THRESHOLD)
                 newLevel--;
@@ -93,27 +123,28 @@ bool ath9k_hw_updatetxtriglevel(struct ath_hw *ah, bool bIncTrigLevel)
 
         return newLevel != curLevel;
 }
+EXPORT_SYMBOL(ath9k_hw_updatetxtriglevel);
 
 bool ath9k_hw_stoptxdma(struct ath_hw *ah, u32 q)
 {
 #define ATH9K_TX_STOP_DMA_TIMEOUT       4000    /* usec */
 #define ATH9K_TIME_QUANTUM              100     /* usec */
-
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         struct ath9k_tx_queue_info *qi;
         u32 tsfLow, j, wait;
         u32 wait_time = ATH9K_TX_STOP_DMA_TIMEOUT / ATH9K_TIME_QUANTUM;
 
         if (q >= pCap->total_queues) {
-                DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Stopping TX DMA, "
-                        "invalid queue: %u\n", q);
+                ath_print(common, ATH_DBG_QUEUE, "Stopping TX DMA, "
+                          "invalid queue: %u\n", q);
                 return false;
         }
 
         qi = &ah->txq[q];
         if (qi->tqi_type == ATH9K_TX_QUEUE_INACTIVE) {
-                DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Stopping TX DMA, "
-                        "inactive queue: %u\n", q);
+                ath_print(common, ATH_DBG_QUEUE, "Stopping TX DMA, "
+                          "inactive queue: %u\n", q);
                 return false;
         }
 
@@ -126,9 +157,9 @@ bool ath9k_hw_stoptxdma(struct ath_hw *ah, u32 q)
         }
 
         if (ath9k_hw_numtxpending(ah, q)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_QUEUE,
-                        "%s: Num of pending TX Frames %d on Q %d\n",
-                        __func__, ath9k_hw_numtxpending(ah, q), q);
+                ath_print(common, ATH_DBG_QUEUE,
+                          "%s: Num of pending TX Frames %d on Q %d\n",
+                          __func__, ath9k_hw_numtxpending(ah, q), q);
 
                 for (j = 0; j < 2; j++) {
                         tsfLow = REG_READ(ah, AR_TSF_L32);
@@ -142,9 +173,9 @@ bool ath9k_hw_stoptxdma(struct ath_hw *ah, u32 q)
                         if ((REG_READ(ah, AR_TSF_L32) >> 10) == (tsfLow >> 10))
                                 break;
 
-                        DPRINTF(ah->ah_sc, ATH_DBG_QUEUE,
-                                "TSF has moved while trying to set "
-                                "quiet time TSF: 0x%08x\n", tsfLow);
+                        ath_print(common, ATH_DBG_QUEUE,
+                                  "TSF has moved while trying to set "
+                                  "quiet time TSF: 0x%08x\n", tsfLow);
                 }
 
                 REG_SET_BIT(ah, AR_DIAG_SW, AR_DIAG_FORCE_CH_IDLE_HIGH);
@@ -155,9 +186,9 @@ bool ath9k_hw_stoptxdma(struct ath_hw *ah, u32 q)
                 wait = wait_time;
                 while (ath9k_hw_numtxpending(ah, q)) {
                         if ((--wait) == 0) {
-                                DPRINTF(ah->ah_sc, ATH_DBG_QUEUE,
-                                        "Failed to stop TX DMA in 100 "
-                                        "msec after killing last frame\n");
+                                ath_print(common, ATH_DBG_FATAL,
+                                          "Failed to stop TX DMA in 100 "
+                                          "msec after killing last frame\n");
                                 break;
                         }
                         udelay(ATH9K_TIME_QUANTUM);
@@ -172,6 +203,7 @@ bool ath9k_hw_stoptxdma(struct ath_hw *ah, u32 q)
 #undef ATH9K_TX_STOP_DMA_TIMEOUT
 #undef ATH9K_TIME_QUANTUM
 }
+EXPORT_SYMBOL(ath9k_hw_stoptxdma);
 
 void ath9k_hw_filltxdesc(struct ath_hw *ah, struct ath_desc *ds,
                          u32 segLen, bool firstSeg,
@@ -198,6 +230,7 @@ void ath9k_hw_filltxdesc(struct ath_hw *ah, struct ath_desc *ds,
         ads->ds_txstatus6 = ads->ds_txstatus7 = 0;
         ads->ds_txstatus8 = ads->ds_txstatus9 = 0;
 }
+EXPORT_SYMBOL(ath9k_hw_filltxdesc);
 
 void ath9k_hw_cleartxdesc(struct ath_hw *ah, struct ath_desc *ds)
 {
@@ -209,6 +242,7 @@ void ath9k_hw_cleartxdesc(struct ath_hw *ah, struct ath_desc *ds)
         ads->ds_txstatus6 = ads->ds_txstatus7 = 0;
         ads->ds_txstatus8 = ads->ds_txstatus9 = 0;
 }
+EXPORT_SYMBOL(ath9k_hw_cleartxdesc);
 
 int ath9k_hw_txprocdesc(struct ath_hw *ah, struct ath_desc *ds)
 {
@@ -222,6 +256,8 @@ int ath9k_hw_txprocdesc(struct ath_hw *ah, struct ath_desc *ds)
         ds->ds_txstat.ts_status = 0;
         ds->ds_txstat.ts_flags = 0;
 
+        if (ads->ds_txstatus1 & AR_FrmXmitOK)
+                ds->ds_txstat.ts_status |= ATH9K_TX_ACKED;
         if (ads->ds_txstatus1 & AR_ExcessiveRetries)
                 ds->ds_txstat.ts_status |= ATH9K_TXERR_XRETRY;
         if (ads->ds_txstatus1 & AR_Filtered)
@@ -284,6 +320,7 @@ int ath9k_hw_txprocdesc(struct ath_hw *ah, struct ath_desc *ds)
 
         return 0;
 }
+EXPORT_SYMBOL(ath9k_hw_txprocdesc);
 
 void ath9k_hw_set11n_txdesc(struct ath_hw *ah, struct ath_desc *ds,
                             u32 pktLen, enum ath9k_pkt_type type, u32 txPower,
@@ -319,6 +356,7 @@ void ath9k_hw_set11n_txdesc(struct ath_hw *ah, struct ath_desc *ds,
                 ads->ds_ctl11 = 0;
         }
 }
+EXPORT_SYMBOL(ath9k_hw_set11n_txdesc);
 
 void ath9k_hw_set11n_ratescenario(struct ath_hw *ah, struct ath_desc *ds,
                                   struct ath_desc *lastds,
@@ -374,6 +412,7 @@ void ath9k_hw_set11n_ratescenario(struct ath_hw *ah, struct ath_desc *ds,
         last_ads->ds_ctl2 = ads->ds_ctl2;
         last_ads->ds_ctl3 = ads->ds_ctl3;
 }
+EXPORT_SYMBOL(ath9k_hw_set11n_ratescenario);
 
 void ath9k_hw_set11n_aggr_first(struct ath_hw *ah, struct ath_desc *ds,
                                 u32 aggrLen)
@@ -384,6 +423,7 @@ void ath9k_hw_set11n_aggr_first(struct ath_hw *ah, struct ath_desc *ds,
         ads->ds_ctl6 &= ~AR_AggrLen;
         ads->ds_ctl6 |= SM(aggrLen, AR_AggrLen);
 }
+EXPORT_SYMBOL(ath9k_hw_set11n_aggr_first);
 
 void ath9k_hw_set11n_aggr_middle(struct ath_hw *ah, struct ath_desc *ds,
                                  u32 numDelims)
@@ -398,6 +438,7 @@ void ath9k_hw_set11n_aggr_middle(struct ath_hw *ah, struct ath_desc *ds,
         ctl6 |= SM(numDelims, AR_PadDelim);
         ads->ds_ctl6 = ctl6;
 }
+EXPORT_SYMBOL(ath9k_hw_set11n_aggr_middle);
 
 void ath9k_hw_set11n_aggr_last(struct ath_hw *ah, struct ath_desc *ds)
 {
@@ -407,6 +448,7 @@ void ath9k_hw_set11n_aggr_last(struct ath_hw *ah, struct ath_desc *ds)
         ads->ds_ctl1 &= ~AR_MoreAggr;
         ads->ds_ctl6 &= ~AR_PadDelim;
 }
+EXPORT_SYMBOL(ath9k_hw_set11n_aggr_last);
 
 void ath9k_hw_clr11n_aggr(struct ath_hw *ah, struct ath_desc *ds)
 {
@@ -414,6 +456,7 @@ void ath9k_hw_clr11n_aggr(struct ath_hw *ah, struct ath_desc *ds)
 
         ads->ds_ctl1 &= (~AR_IsAggr & ~AR_MoreAggr);
 }
+EXPORT_SYMBOL(ath9k_hw_clr11n_aggr);
 
 void ath9k_hw_set11n_burstduration(struct ath_hw *ah, struct ath_desc *ds,
                                    u32 burstDuration)
@@ -423,6 +466,7 @@ void ath9k_hw_set11n_burstduration(struct ath_hw *ah, struct ath_desc *ds,
         ads->ds_ctl2 &= ~AR_BurstDur;
         ads->ds_ctl2 |= SM(burstDuration, AR_BurstDur);
 }
+EXPORT_SYMBOL(ath9k_hw_set11n_burstduration);
 
 void ath9k_hw_set11n_virtualmorefrag(struct ath_hw *ah, struct ath_desc *ds,
                                      u32 vmf)
@@ -440,28 +484,30 @@ void ath9k_hw_gettxintrtxqs(struct ath_hw *ah, u32 *txqs)
         *txqs &= ah->intr_txqs;
         ah->intr_txqs &= ~(*txqs);
 }
+EXPORT_SYMBOL(ath9k_hw_gettxintrtxqs);
 
 bool ath9k_hw_set_txq_props(struct ath_hw *ah, int q,
                             const struct ath9k_tx_queue_info *qinfo)
 {
         u32 cw;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         struct ath9k_tx_queue_info *qi;
 
         if (q >= pCap->total_queues) {
-                DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Set TXQ properties, "
-                        "invalid queue: %u\n", q);
+                ath_print(common, ATH_DBG_QUEUE, "Set TXQ properties, "
+                          "invalid queue: %u\n", q);
                 return false;
         }
 
         qi = &ah->txq[q];
         if (qi->tqi_type == ATH9K_TX_QUEUE_INACTIVE) {
-                DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Set TXQ properties, "
-                        "inactive queue: %u\n", q);
+                ath_print(common, ATH_DBG_QUEUE, "Set TXQ properties, "
+                          "inactive queue: %u\n", q);
                 return false;
         }
 
-        DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Set queue properties for: %u\n", q);
+        ath_print(common, ATH_DBG_QUEUE, "Set queue properties for: %u\n", q);
 
         qi->tqi_ver = qinfo->tqi_ver;
         qi->tqi_subtype = qinfo->tqi_subtype;
@@ -510,23 +556,25 @@ bool ath9k_hw_set_txq_props(struct ath_hw *ah, int q,
 
         return true;
 }
+EXPORT_SYMBOL(ath9k_hw_set_txq_props);
 
 bool ath9k_hw_get_txq_props(struct ath_hw *ah, int q,
                             struct ath9k_tx_queue_info *qinfo)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         struct ath9k_tx_queue_info *qi;
 
         if (q >= pCap->total_queues) {
-                DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Get TXQ properties, "
-                        "invalid queue: %u\n", q);
+                ath_print(common, ATH_DBG_QUEUE, "Get TXQ properties, "
+                          "invalid queue: %u\n", q);
                 return false;
         }
 
         qi = &ah->txq[q];
         if (qi->tqi_type == ATH9K_TX_QUEUE_INACTIVE) {
-                DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Get TXQ properties, "
-                        "inactive queue: %u\n", q);
+                ath_print(common, ATH_DBG_QUEUE, "Get TXQ properties, "
+                          "inactive queue: %u\n", q);
                 return false;
         }
 
@@ -547,10 +595,12 @@ bool ath9k_hw_get_txq_props(struct ath_hw *ah, int q,
 
         return true;
 }
+EXPORT_SYMBOL(ath9k_hw_get_txq_props);
 
 int ath9k_hw_setuptxqueue(struct ath_hw *ah, enum ath9k_tx_queue type,
                           const struct ath9k_tx_queue_info *qinfo)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_tx_queue_info *qi;
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         int q;
@@ -574,23 +624,23 @@ int ath9k_hw_setuptxqueue(struct ath_hw *ah, enum ath9k_tx_queue type,
                             ATH9K_TX_QUEUE_INACTIVE)
                                 break;
                 if (q == pCap->total_queues) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "No available TX queue\n");
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "No available TX queue\n");
                         return -1;
                 }
                 break;
         default:
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL, "Invalid TX queue type: %u\n",
-                        type);
+                ath_print(common, ATH_DBG_FATAL,
+                          "Invalid TX queue type: %u\n", type);
                 return -1;
         }
 
-        DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Setup TX queue: %u\n", q);
+        ath_print(common, ATH_DBG_QUEUE, "Setup TX queue: %u\n", q);
 
         qi = &ah->txq[q];
         if (qi->tqi_type != ATH9K_TX_QUEUE_INACTIVE) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "TX queue: %u already active\n", q);
+                ath_print(common, ATH_DBG_FATAL,
+                          "TX queue: %u already active\n", q);
                 return -1;
         }
         memset(qi, 0, sizeof(struct ath9k_tx_queue_info));
@@ -613,25 +663,27 @@ int ath9k_hw_setuptxqueue(struct ath_hw *ah, enum ath9k_tx_queue type,
 
         return q;
 }
+EXPORT_SYMBOL(ath9k_hw_setuptxqueue);
 
 bool ath9k_hw_releasetxqueue(struct ath_hw *ah, u32 q)
 {
         struct ath9k_hw_capabilities *pCap = &ah->caps;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_tx_queue_info *qi;
 
         if (q >= pCap->total_queues) {
-                DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Release TXQ, "
-                        "invalid queue: %u\n", q);
+                ath_print(common, ATH_DBG_QUEUE, "Release TXQ, "
+                          "invalid queue: %u\n", q);
                 return false;
         }
         qi = &ah->txq[q];
         if (qi->tqi_type == ATH9K_TX_QUEUE_INACTIVE) {
-                DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Release TXQ, "
-                        "inactive queue: %u\n", q);
+                ath_print(common, ATH_DBG_QUEUE, "Release TXQ, "
+                          "inactive queue: %u\n", q);
                 return false;
         }
 
-        DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Release TX queue: %u\n", q);
+        ath_print(common, ATH_DBG_QUEUE, "Release TX queue: %u\n", q);
 
         qi->tqi_type = ATH9K_TX_QUEUE_INACTIVE;
         ah->txok_interrupt_mask &= ~(1 << q);
@@ -643,28 +695,30 @@ bool ath9k_hw_releasetxqueue(struct ath_hw *ah, u32 q)
 
         return true;
 }
+EXPORT_SYMBOL(ath9k_hw_releasetxqueue);
 
 bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
 {
         struct ath9k_hw_capabilities *pCap = &ah->caps;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_channel *chan = ah->curchan;
         struct ath9k_tx_queue_info *qi;
         u32 cwMin, chanCwMin, value;
 
         if (q >= pCap->total_queues) {
-                DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Reset TXQ, "
-                        "invalid queue: %u\n", q);
+                ath_print(common, ATH_DBG_QUEUE, "Reset TXQ, "
+                          "invalid queue: %u\n", q);
                 return false;
         }
 
         qi = &ah->txq[q];
         if (qi->tqi_type == ATH9K_TX_QUEUE_INACTIVE) {
-                DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Reset TXQ, "
-                        "inactive queue: %u\n", q);
+                ath_print(common, ATH_DBG_QUEUE, "Reset TXQ, "
+                          "inactive queue: %u\n", q);
                 return true;
         }
 
-        DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Reset TX queue: %u\n", q);
+        ath_print(common, ATH_DBG_QUEUE, "Reset TX queue: %u\n", q);
 
         if (qi->tqi_cwmin == ATH9K_TXQ_USEDEFAULT) {
                 if (chan && IS_CHAN_B(chan))
@@ -799,6 +853,7 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
 
         return true;
 }
+EXPORT_SYMBOL(ath9k_hw_resettxqueue);
 
 int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
                         u32 pa, struct ath_desc *nds, u64 tsf)
@@ -880,6 +935,7 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
 
         return 0;
 }
+EXPORT_SYMBOL(ath9k_hw_rxprocdesc);
 
 void ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
                           u32 size, u32 flags)
@@ -895,7 +951,15 @@ void ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
         if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
                 memset(&(ads->u), 0, sizeof(ads->u));
 }
+EXPORT_SYMBOL(ath9k_hw_setuprxdesc);
 
+/*
+ * This can stop or re-enables RX.
+ *
+ * If bool is set this will kill any frame which is currently being
+ * transferred between the MAC and baseband and also prevent any new
+ * frames from getting started.
+ */
 bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set)
 {
         u32 reg;
@@ -911,8 +975,9 @@ bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set)
                                      AR_DIAG_RX_ABORT));
 
                         reg = REG_READ(ah, AR_OBS_BUS_1);
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "RX failed to go idle in 10 ms RXSM=0x%x\n", reg);
+                        ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                                  "RX failed to go idle in 10 ms RXSM=0x%x\n",
+                                  reg);
 
                         return false;
                 }
@@ -923,16 +988,19 @@ bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set)
 
         return true;
 }
+EXPORT_SYMBOL(ath9k_hw_setrxabort);
 
 void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp)
 {
         REG_WRITE(ah, AR_RXDP, rxdp);
 }
+EXPORT_SYMBOL(ath9k_hw_putrxbuf);
 
 void ath9k_hw_rxena(struct ath_hw *ah)
 {
         REG_WRITE(ah, AR_CR, AR_CR_RXE);
 }
+EXPORT_SYMBOL(ath9k_hw_rxena);
 
 void ath9k_hw_startpcureceive(struct ath_hw *ah)
 {
@@ -942,6 +1010,7 @@ void ath9k_hw_startpcureceive(struct ath_hw *ah)
 
         REG_CLR_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
 }
+EXPORT_SYMBOL(ath9k_hw_startpcureceive);
 
 void ath9k_hw_stoppcurecv(struct ath_hw *ah)
 {
@@ -949,12 +1018,13 @@ void ath9k_hw_stoppcurecv(struct ath_hw *ah)
 
         ath9k_hw_disable_mib_counters(ah);
 }
+EXPORT_SYMBOL(ath9k_hw_stoppcurecv);
 
 bool ath9k_hw_stopdmarecv(struct ath_hw *ah)
 {
 #define AH_RX_STOP_DMA_TIMEOUT 10000   /* usec */
 #define AH_RX_TIME_QUANTUM     100     /* usec */
-
+        struct ath_common *common = ath9k_hw_common(ah);
         int i;
 
         REG_WRITE(ah, AR_CR, AR_CR_RXD);
@@ -967,12 +1037,12 @@ bool ath9k_hw_stopdmarecv(struct ath_hw *ah)
         }
 
         if (i == 0) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "DMA failed to stop in %d ms "
-                        "AR_CR=0x%08x AR_DIAG_SW=0x%08x\n",
-                        AH_RX_STOP_DMA_TIMEOUT / 1000,
-                        REG_READ(ah, AR_CR),
-                        REG_READ(ah, AR_DIAG_SW));
+                ath_print(common, ATH_DBG_FATAL,
+                          "DMA failed to stop in %d ms "
+                          "AR_CR=0x%08x AR_DIAG_SW=0x%08x\n",
+                          AH_RX_STOP_DMA_TIMEOUT / 1000,
+                          REG_READ(ah, AR_CR),
+                          REG_READ(ah, AR_DIAG_SW));
                 return false;
         } else {
                 return true;
@@ -981,3 +1051,17 @@ bool ath9k_hw_stopdmarecv(struct ath_hw *ah)
 #undef AH_RX_TIME_QUANTUM
 #undef AH_RX_STOP_DMA_TIMEOUT
 }
+EXPORT_SYMBOL(ath9k_hw_stopdmarecv);
+
+int ath9k_hw_beaconq_setup(struct ath_hw *ah)
+{
+        struct ath9k_tx_queue_info qi;
+
+        memset(&qi, 0, sizeof(qi));
+        qi.tqi_aifs = 1;
+        qi.tqi_cwmin = 0;
+        qi.tqi_cwmax = 0;
+        /* NB: don't enable any interrupts */
+        return ath9k_hw_setuptxqueue(ah, ATH9K_TX_QUEUE_BEACON, &qi);
+}
+EXPORT_SYMBOL(ath9k_hw_beaconq_setup);
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index f56e77da6c3e..29851e6376a9 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -76,6 +76,10 @@
 #define ATH9K_TXERR_FIFO           0x04
 #define ATH9K_TXERR_XTXOP          0x08
 #define ATH9K_TXERR_TIMER_EXPIRED  0x10
+#define ATH9K_TX_ACKED             0x20
+#define ATH9K_TXERR_MASK                                                \
+        (ATH9K_TXERR_XRETRY | ATH9K_TXERR_FILT | ATH9K_TXERR_FIFO |     \
+         ATH9K_TXERR_XTXOP | ATH9K_TXERR_TIMER_EXPIRED)
 
 #define ATH9K_TX_BA                0x01
 #define ATH9K_TX_PWRMGMT           0x02
@@ -85,9 +89,15 @@
 #define ATH9K_TX_SW_ABORTED        0x40
 #define ATH9K_TX_SW_FILTERED       0x80
 
+/* 64 bytes */
 #define MIN_TX_FIFO_THRESHOLD   0x1
+
+/*
+ * Single stream device AR9285 and AR9271 require 2 KB
+ * to work around a hardware issue, all other devices
+ * have can use the max 4 KB limit.
+ */
 #define MAX_TX_FIFO_THRESHOLD   ((4096 / 64) - 1)
-#define INIT_TX_FIFO_THRESHOLD  MIN_TX_FIFO_THRESHOLD
 
 struct ath_tx_status {
         u32 ts_tstamp;
@@ -157,6 +167,40 @@ struct ath_rx_status {
 #define ATH9K_RXKEYIX_INVALID   ((u8)-1)
 #define ATH9K_TXKEYIX_INVALID   ((u32)-1)
 
+enum ath9k_phyerr {
+        ATH9K_PHYERR_UNDERRUN             = 0,  /* Transmit underrun */
+        ATH9K_PHYERR_TIMING               = 1,  /* Timing error */
+        ATH9K_PHYERR_PARITY               = 2,  /* Illegal parity */
+        ATH9K_PHYERR_RATE                 = 3,  /* Illegal rate */
+        ATH9K_PHYERR_LENGTH               = 4,  /* Illegal length */
+        ATH9K_PHYERR_RADAR                = 5,  /* Radar detect */
+        ATH9K_PHYERR_SERVICE              = 6,  /* Illegal service */
+        ATH9K_PHYERR_TOR                  = 7,  /* Transmit override receive */
+
+        ATH9K_PHYERR_OFDM_TIMING          = 17,
+        ATH9K_PHYERR_OFDM_SIGNAL_PARITY   = 18,
+        ATH9K_PHYERR_OFDM_RATE_ILLEGAL    = 19,
+        ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL  = 20,
+        ATH9K_PHYERR_OFDM_POWER_DROP      = 21,
+        ATH9K_PHYERR_OFDM_SERVICE         = 22,
+        ATH9K_PHYERR_OFDM_RESTART         = 23,
+        ATH9K_PHYERR_FALSE_RADAR_EXT      = 24,
+
+        ATH9K_PHYERR_CCK_TIMING           = 25,
+        ATH9K_PHYERR_CCK_HEADER_CRC       = 26,
+        ATH9K_PHYERR_CCK_RATE_ILLEGAL     = 27,
+        ATH9K_PHYERR_CCK_SERVICE          = 30,
+        ATH9K_PHYERR_CCK_RESTART          = 31,
+        ATH9K_PHYERR_CCK_LENGTH_ILLEGAL   = 32,
+        ATH9K_PHYERR_CCK_POWER_DROP       = 33,
+
+        ATH9K_PHYERR_HT_CRC_ERROR         = 34,
+        ATH9K_PHYERR_HT_LENGTH_ILLEGAL    = 35,
+        ATH9K_PHYERR_HT_RATE_ILLEGAL      = 36,
+
+        ATH9K_PHYERR_MAX                  = 37,
+};
+
 struct ath_desc {
         u32 ds_link;
         u32 ds_data;
@@ -380,6 +424,11 @@ struct ar5416_desc {
 #define AR_TxBaStatus       0x40000000
 #define AR_TxStatusRsvd01   0x80000000
 
+/*
+ * AR_FrmXmitOK - Frame transmission success flag. If set, the frame was
+ * transmitted successfully. If clear, no ACK or BA was received to indicate
+ * successful transmission when we were expecting an ACK or BA.
+ */
 #define AR_FrmXmitOK            0x00000001
 #define AR_ExcessiveRetries     0x00000002
 #define AR_FIFOUnderrun         0x00000004
@@ -614,19 +663,8 @@ enum ath9k_cipher {
         ATH9K_CIPHER_MIC = 127
 };
 
-enum ath9k_ht_macmode {
-        ATH9K_HT_MACMODE_20 = 0,
-        ATH9K_HT_MACMODE_2040 = 1,
-};
-
-enum ath9k_ht_extprotspacing {
-        ATH9K_HT_EXTPROTSPACING_20 = 0,
-        ATH9K_HT_EXTPROTSPACING_25 = 1,
-};
-
 struct ath_hw;
 struct ath9k_channel;
-struct ath_rate_table;
 
 u32 ath9k_hw_gettxbuf(struct ath_hw *ah, u32 q);
 void ath9k_hw_puttxbuf(struct ath_hw *ah, u32 q, u32 txdp);
@@ -677,5 +715,6 @@ void ath9k_hw_rxena(struct ath_hw *ah);
 void ath9k_hw_startpcureceive(struct ath_hw *ah);
 void ath9k_hw_stoppcurecv(struct ath_hw *ah);
 bool ath9k_hw_stopdmarecv(struct ath_hw *ah);
+int ath9k_hw_beaconq_setup(struct ath_hw *ah);
 
 #endif /* MAC_H */
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 43d2be9867fc..115e1aeedb59 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -16,88 +16,7 @@
 
 #include <linux/nl80211.h>
 #include "ath9k.h"
-
-static char *dev_info = "ath9k";
-
-MODULE_AUTHOR("Atheros Communications");
-MODULE_DESCRIPTION("Support for Atheros 802.11n wireless LAN cards.");
-MODULE_SUPPORTED_DEVICE("Atheros 802.11n WLAN cards");
-MODULE_LICENSE("Dual BSD/GPL");
-
-static int modparam_nohwcrypt;
-module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
-MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
-
-/* We use the hw_value as an index into our private channel structure */
-
-#define CHAN2G(_freq, _idx)  { \
-        .center_freq = (_freq), \
-        .hw_value = (_idx), \
-        .max_power = 20, \
-}
-
-#define CHAN5G(_freq, _idx) { \
-        .band = IEEE80211_BAND_5GHZ, \
-        .center_freq = (_freq), \
-        .hw_value = (_idx), \
-        .max_power = 20, \
-}
-
-/* Some 2 GHz radios are actually tunable on 2312-2732
- * on 5 MHz steps, we support the channels which we know
- * we have calibration data for all cards though to make
- * this static */
-static struct ieee80211_channel ath9k_2ghz_chantable[] = {
-        CHAN2G(2412, 0), /* Channel 1 */
-        CHAN2G(2417, 1), /* Channel 2 */
-        CHAN2G(2422, 2), /* Channel 3 */
-        CHAN2G(2427, 3), /* Channel 4 */
-        CHAN2G(2432, 4), /* Channel 5 */
-        CHAN2G(2437, 5), /* Channel 6 */
-        CHAN2G(2442, 6), /* Channel 7 */
-        CHAN2G(2447, 7), /* Channel 8 */
-        CHAN2G(2452, 8), /* Channel 9 */
-        CHAN2G(2457, 9), /* Channel 10 */
-        CHAN2G(2462, 10), /* Channel 11 */
-        CHAN2G(2467, 11), /* Channel 12 */
-        CHAN2G(2472, 12), /* Channel 13 */
-        CHAN2G(2484, 13), /* Channel 14 */
-};
-
-/* Some 5 GHz radios are actually tunable on XXXX-YYYY
- * on 5 MHz steps, we support the channels which we know
- * we have calibration data for all cards though to make
- * this static */
-static struct ieee80211_channel ath9k_5ghz_chantable[] = {
-        /* _We_ call this UNII 1 */
-        CHAN5G(5180, 14), /* Channel 36 */
-        CHAN5G(5200, 15), /* Channel 40 */
-        CHAN5G(5220, 16), /* Channel 44 */
-        CHAN5G(5240, 17), /* Channel 48 */
-        /* _We_ call this UNII 2 */
-        CHAN5G(5260, 18), /* Channel 52 */
-        CHAN5G(5280, 19), /* Channel 56 */
-        CHAN5G(5300, 20), /* Channel 60 */
-        CHAN5G(5320, 21), /* Channel 64 */
-        /* _We_ call this "Middle band" */
-        CHAN5G(5500, 22), /* Channel 100 */
-        CHAN5G(5520, 23), /* Channel 104 */
-        CHAN5G(5540, 24), /* Channel 108 */
-        CHAN5G(5560, 25), /* Channel 112 */
-        CHAN5G(5580, 26), /* Channel 116 */
-        CHAN5G(5600, 27), /* Channel 120 */
-        CHAN5G(5620, 28), /* Channel 124 */
-        CHAN5G(5640, 29), /* Channel 128 */
-        CHAN5G(5660, 30), /* Channel 132 */
-        CHAN5G(5680, 31), /* Channel 136 */
-        CHAN5G(5700, 32), /* Channel 140 */
-        /* _We_ call this UNII 3 */
-        CHAN5G(5745, 33), /* Channel 149 */
-        CHAN5G(5765, 34), /* Channel 153 */
-        CHAN5G(5785, 35), /* Channel 157 */
-        CHAN5G(5805, 36), /* Channel 161 */
-        CHAN5G(5825, 37), /* Channel 165 */
-};
+#include "btcoex.h"
 
 static void ath_cache_conf_rate(struct ath_softc *sc,
                                 struct ieee80211_conf *conf)
@@ -105,31 +24,23 @@ static void ath_cache_conf_rate(struct ath_softc *sc,
         switch (conf->channel->band) {
         case IEEE80211_BAND_2GHZ:
                 if (conf_is_ht20(conf))
-                        sc->cur_rate_table =
-                          sc->hw_rate_table[ATH9K_MODE_11NG_HT20];
+                        sc->cur_rate_mode = ATH9K_MODE_11NG_HT20;
                 else if (conf_is_ht40_minus(conf))
-                        sc->cur_rate_table =
-                          sc->hw_rate_table[ATH9K_MODE_11NG_HT40MINUS];
+                        sc->cur_rate_mode = ATH9K_MODE_11NG_HT40MINUS;
                 else if (conf_is_ht40_plus(conf))
-                        sc->cur_rate_table =
-                          sc->hw_rate_table[ATH9K_MODE_11NG_HT40PLUS];
+                        sc->cur_rate_mode = ATH9K_MODE_11NG_HT40PLUS;
                 else
-                        sc->cur_rate_table =
-                          sc->hw_rate_table[ATH9K_MODE_11G];
+                        sc->cur_rate_mode = ATH9K_MODE_11G;
                 break;
         case IEEE80211_BAND_5GHZ:
                 if (conf_is_ht20(conf))
-                        sc->cur_rate_table =
-                          sc->hw_rate_table[ATH9K_MODE_11NA_HT20];
+                        sc->cur_rate_mode = ATH9K_MODE_11NA_HT20;
                 else if (conf_is_ht40_minus(conf))
-                        sc->cur_rate_table =
-                          sc->hw_rate_table[ATH9K_MODE_11NA_HT40MINUS];
+                        sc->cur_rate_mode = ATH9K_MODE_11NA_HT40MINUS;
                 else if (conf_is_ht40_plus(conf))
-                        sc->cur_rate_table =
-                          sc->hw_rate_table[ATH9K_MODE_11NA_HT40PLUS];
+                        sc->cur_rate_mode = ATH9K_MODE_11NA_HT40PLUS;
                 else
-                        sc->cur_rate_table =
-                          sc->hw_rate_table[ATH9K_MODE_11A];
+                        sc->cur_rate_mode = ATH9K_MODE_11A;
                 break;
         default:
                 BUG_ON(1);
@@ -185,50 +96,6 @@ static u8 parse_mpdudensity(u8 mpdudensity)
         }
 }
 
-static void ath_setup_rates(struct ath_softc *sc, enum ieee80211_band band)
-{
-        const struct ath_rate_table *rate_table = NULL;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_rate *rate;
-        int i, maxrates;
-
-        switch (band) {
-        case IEEE80211_BAND_2GHZ:
-                rate_table = sc->hw_rate_table[ATH9K_MODE_11G];
-                break;
-        case IEEE80211_BAND_5GHZ:
-                rate_table = sc->hw_rate_table[ATH9K_MODE_11A];
-                break;
-        default:
-                break;
-        }
-
-        if (rate_table == NULL)
-                return;
-
-        sband = &sc->sbands[band];
-        rate = sc->rates[band];
-
-        if (rate_table->rate_cnt > ATH_RATE_MAX)
-                maxrates = ATH_RATE_MAX;
-        else
-                maxrates = rate_table->rate_cnt;
-
-        for (i = 0; i < maxrates; i++) {
-                rate[i].bitrate = rate_table->info[i].ratekbps / 100;
-                rate[i].hw_value = rate_table->info[i].ratecode;
-                if (rate_table->info[i].short_preamble) {
-                        rate[i].hw_value_short = rate_table->info[i].ratecode |
-                                rate_table->info[i].short_preamble;
-                        rate[i].flags = IEEE80211_RATE_SHORT_PREAMBLE;
-                }
-                sband->n_bitrates++;
-
-                DPRINTF(sc, ATH_DBG_CONFIG, "Rate: %2dMbps, ratecode: %2d\n",
-                        rate[i].bitrate / 10, rate[i].hw_value);
-        }
-}
-
 static struct ath9k_channel *ath_get_curchannel(struct ath_softc *sc,
                                                 struct ieee80211_hw *hw)
 {
@@ -242,6 +109,53 @@ static struct ath9k_channel *ath_get_curchannel(struct ath_softc *sc,
         return channel;
 }
 
+bool ath9k_setpower(struct ath_softc *sc, enum ath9k_power_mode mode)
+{
+        unsigned long flags;
+        bool ret;
+
+        spin_lock_irqsave(&sc->sc_pm_lock, flags);
+        ret = ath9k_hw_setpower(sc->sc_ah, mode);
+        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
+
+        return ret;
+}
+
+void ath9k_ps_wakeup(struct ath_softc *sc)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&sc->sc_pm_lock, flags);
+        if (++sc->ps_usecount != 1)
+                goto unlock;
+
+        ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
+
+ unlock:
+        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
+}
+
+void ath9k_ps_restore(struct ath_softc *sc)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&sc->sc_pm_lock, flags);
+        if (--sc->ps_usecount != 0)
+                goto unlock;
+
+        if (sc->ps_idle)
+                ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
+        else if (sc->ps_enabled &&
+                 !(sc->ps_flags & (PS_WAIT_FOR_BEACON |
+                              PS_WAIT_FOR_CAB |
+                              PS_WAIT_FOR_PSPOLL_DATA |
+                              PS_WAIT_FOR_TX_ACK)))
+                ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_NETWORK_SLEEP);
+
+ unlock:
+        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
+}
+
 /*
  * Set/change channels.  If the channel is really being changed, it's done
  * by reseting the chip.  To accomplish this we must first cleanup any pending
@@ -251,6 +165,8 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
                     struct ath9k_channel *hchan)
 {
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ieee80211_conf *conf = &common->hw->conf;
         bool fastcc = true, stopped;
         struct ieee80211_channel *channel = hw->conf.channel;
         int r;
@@ -280,19 +196,19 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
         if (!stopped || (sc->sc_flags & SC_OP_FULL_RESET))
                 fastcc = false;
 
-        DPRINTF(sc, ATH_DBG_CONFIG,
-                "(%u MHz) -> (%u MHz), chanwidth: %d\n",
-                sc->sc_ah->curchan->channel,
-                channel->center_freq, sc->tx_chan_width);
+        ath_print(common, ATH_DBG_CONFIG,
+                  "(%u MHz) -> (%u MHz), conf_is_ht40: %d\n",
+                  sc->sc_ah->curchan->channel,
+                  channel->center_freq, conf_is_ht40(conf));
 
         spin_lock_bh(&sc->sc_resetlock);
 
         r = ath9k_hw_reset(ah, hchan, fastcc);
         if (r) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to reset channel (%u Mhz) "
-                        "reset status %d\n",
-                        channel->center_freq, r);
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to reset channel (%u MHz), "
+                          "reset status %d\n",
+                          channel->center_freq, r);
                 spin_unlock_bh(&sc->sc_resetlock);
                 goto ps_restore;
         }
@@ -301,8 +217,8 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
         sc->sc_flags &= ~SC_OP_FULL_RESET;
 
         if (ath_startrecv(sc) != 0) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to restart recv logic\n");
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to restart recv logic\n");
                 r = -EIO;
                 goto ps_restore;
         }
@@ -323,10 +239,11 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
  *  When the task is complete, it reschedules itself depending on the
  *  appropriate interval that was calculated.
  */
-static void ath_ani_calibrate(unsigned long data)
+void ath_ani_calibrate(unsigned long data)
 {
         struct ath_softc *sc = (struct ath_softc *)data;
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         bool longcal = false;
         bool shortcal = false;
         bool aniflag = false;
@@ -336,14 +253,6 @@ static void ath_ani_calibrate(unsigned long data)
         short_cal_interval = (ah->opmode == NL80211_IFTYPE_AP) ?
                 ATH_AP_SHORT_CALINTERVAL : ATH_STA_SHORT_CALINTERVAL;
 
-        /*
-        * don't calibrate when we're scanning.
-        * we are most likely not on our home channel.
-        */
-        spin_lock(&sc->ani_lock);
-        if (sc->sc_flags & SC_OP_SCANNING)
-                goto set_timer;
-
         /* Only calibrate if awake */
         if (sc->sc_ah->power_mode != ATH9K_PM_AWAKE)
                 goto set_timer;
@@ -351,33 +260,34 @@ static void ath_ani_calibrate(unsigned long data)
         ath9k_ps_wakeup(sc);
 
         /* Long calibration runs independently of short calibration. */
-        if ((timestamp - sc->ani.longcal_timer) >= ATH_LONG_CALINTERVAL) {
+        if ((timestamp - common->ani.longcal_timer) >= ATH_LONG_CALINTERVAL) {
                 longcal = true;
-                DPRINTF(sc, ATH_DBG_ANI, "longcal @%lu\n", jiffies);
-                sc->ani.longcal_timer = timestamp;
+                ath_print(common, ATH_DBG_ANI, "longcal @%lu\n", jiffies);
+                common->ani.longcal_timer = timestamp;
         }
 
         /* Short calibration applies only while caldone is false */
-        if (!sc->ani.caldone) {
-                if ((timestamp - sc->ani.shortcal_timer) >= short_cal_interval) {
+        if (!common->ani.caldone) {
+                if ((timestamp - common->ani.shortcal_timer) >= short_cal_interval) {
                         shortcal = true;
-                        DPRINTF(sc, ATH_DBG_ANI, "shortcal @%lu\n", jiffies);
-                        sc->ani.shortcal_timer = timestamp;
-                        sc->ani.resetcal_timer = timestamp;
+                        ath_print(common, ATH_DBG_ANI,
+                                  "shortcal @%lu\n", jiffies);
+                        common->ani.shortcal_timer = timestamp;
+                        common->ani.resetcal_timer = timestamp;
                 }
         } else {
-                if ((timestamp - sc->ani.resetcal_timer) >=
+                if ((timestamp - common->ani.resetcal_timer) >=
                     ATH_RESTART_CALINTERVAL) {
-                        sc->ani.caldone = ath9k_hw_reset_calvalid(ah);
-                        if (sc->ani.caldone)
-                                sc->ani.resetcal_timer = timestamp;
+                        common->ani.caldone = ath9k_hw_reset_calvalid(ah);
+                        if (common->ani.caldone)
+                                common->ani.resetcal_timer = timestamp;
                 }
         }
 
         /* Verify whether we must check ANI */
-        if ((timestamp - sc->ani.checkani_timer) >= ATH_ANI_POLLINTERVAL) {
+        if ((timestamp - common->ani.checkani_timer) >= ATH_ANI_POLLINTERVAL) {
                 aniflag = true;
-                sc->ani.checkani_timer = timestamp;
+                common->ani.checkani_timer = timestamp;
         }
 
         /* Skip all processing if there's nothing to do. */
@@ -388,23 +298,27 @@ static void ath_ani_calibrate(unsigned long data)
 
                 /* Perform calibration if necessary */
                 if (longcal || shortcal) {
-                        sc->ani.caldone = ath9k_hw_calibrate(ah, ah->curchan,
-                                                     sc->rx_chainmask, longcal);
+                        common->ani.caldone =
+                                ath9k_hw_calibrate(ah,
+                                                   ah->curchan,
+                                                   common->rx_chainmask,
+                                                   longcal);
 
                         if (longcal)
-                                sc->ani.noise_floor = ath9k_hw_getchan_noise(ah,
+                                common->ani.noise_floor = ath9k_hw_getchan_noise(ah,
                                                                      ah->curchan);
 
-                        DPRINTF(sc, ATH_DBG_ANI," calibrate chan %u/%x nf: %d\n",
-                                ah->curchan->channel, ah->curchan->channelFlags,
-                                sc->ani.noise_floor);
+                        ath_print(common, ATH_DBG_ANI,
+                                  " calibrate chan %u/%x nf: %d\n",
+                                  ah->curchan->channel,
+                                  ah->curchan->channelFlags,
+                                  common->ani.noise_floor);
                 }
         }
 
         ath9k_ps_restore(sc);
 
 set_timer:
-        spin_unlock(&sc->ani_lock);
         /*
         * Set timer interval based on previous results.
         * The interval must be the shortest necessary to satisfy ANI,
@@ -413,21 +327,21 @@ set_timer:
         cal_interval = ATH_LONG_CALINTERVAL;
         if (sc->sc_ah->config.enable_ani)
                 cal_interval = min(cal_interval, (u32)ATH_ANI_POLLINTERVAL);
-        if (!sc->ani.caldone)
+        if (!common->ani.caldone)
                 cal_interval = min(cal_interval, (u32)short_cal_interval);
 
-        mod_timer(&sc->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
+        mod_timer(&common->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
 }
 
-static void ath_start_ani(struct ath_softc *sc)
+static void ath_start_ani(struct ath_common *common)
 {
         unsigned long timestamp = jiffies_to_msecs(jiffies);
 
-        sc->ani.longcal_timer = timestamp;
-        sc->ani.shortcal_timer = timestamp;
-        sc->ani.checkani_timer = timestamp;
+        common->ani.longcal_timer = timestamp;
+        common->ani.shortcal_timer = timestamp;
+        common->ani.checkani_timer = timestamp;
 
-        mod_timer(&sc->ani.timer,
+        mod_timer(&common->ani.timer,
                   jiffies + msecs_to_jiffies(ATH_ANI_POLLINTERVAL));
 }
 
@@ -439,17 +353,22 @@ static void ath_start_ani(struct ath_softc *sc)
  */
 void ath_update_chainmask(struct ath_softc *sc, int is_ht)
 {
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+
         if ((sc->sc_flags & SC_OP_SCANNING) || is_ht ||
-            (sc->btcoex_info.btcoex_scheme != ATH_BTCOEX_CFG_NONE)) {
-                sc->tx_chainmask = sc->sc_ah->caps.tx_chainmask;
-                sc->rx_chainmask = sc->sc_ah->caps.rx_chainmask;
+            (ah->btcoex_hw.scheme != ATH_BTCOEX_CFG_NONE)) {
+                common->tx_chainmask = ah->caps.tx_chainmask;
+                common->rx_chainmask = ah->caps.rx_chainmask;
         } else {
-                sc->tx_chainmask = 1;
-                sc->rx_chainmask = 1;
+                common->tx_chainmask = 1;
+                common->rx_chainmask = 1;
         }
 
-        DPRINTF(sc, ATH_DBG_CONFIG, "tx chmask: %d, rx chmask: %d\n",
-                sc->tx_chainmask, sc->rx_chainmask);
+        ath_print(common, ATH_DBG_CONFIG,
+                  "tx chmask: %d, rx chmask: %d\n",
+                  common->tx_chainmask,
+                  common->rx_chainmask);
 }
 
 static void ath_node_attach(struct ath_softc *sc, struct ieee80211_sta *sta)
@@ -475,9 +394,12 @@ static void ath_node_detach(struct ath_softc *sc, struct ieee80211_sta *sta)
                 ath_tx_node_cleanup(sc, an);
 }
 
-static void ath9k_tasklet(unsigned long data)
+void ath9k_tasklet(unsigned long data)
 {
         struct ath_softc *sc = (struct ath_softc *)data;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+
         u32 status = sc->intrstatus;
 
         ath9k_ps_wakeup(sc);
@@ -502,16 +424,17 @@ static void ath9k_tasklet(unsigned long data)
                  * TSF sync does not look correct; remain awake to sync with
                  * the next Beacon.
                  */
-                DPRINTF(sc, ATH_DBG_PS, "TSFOOR - Sync with next Beacon\n");
-                sc->sc_flags |= SC_OP_WAIT_FOR_BEACON | SC_OP_BEACON_SYNC;
+                ath_print(common, ATH_DBG_PS,
+                          "TSFOOR - Sync with next Beacon\n");
+                sc->ps_flags |= PS_WAIT_FOR_BEACON | PS_BEACON_SYNC;
         }
 
-        if (sc->btcoex_info.btcoex_scheme == ATH_BTCOEX_CFG_3WIRE)
+        if (ah->btcoex_hw.scheme == ATH_BTCOEX_CFG_3WIRE)
                 if (status & ATH9K_INT_GENTIMER)
                         ath_gen_timer_isr(sc->sc_ah);
 
         /* re-enable hardware interrupt */
-        ath9k_hw_set_interrupts(sc->sc_ah, sc->imask);
+        ath9k_hw_set_interrupts(ah, sc->imask);
         ath9k_ps_restore(sc);
 }
 
@@ -602,9 +525,9 @@ irqreturn_t ath_isr(int irq, void *dev)
                 if (status & ATH9K_INT_TIM_TIMER) {
                         /* Clear RxAbort bit so that we can
                          * receive frames */
-                        ath9k_hw_setpower(ah, ATH9K_PM_AWAKE);
+                        ath9k_setpower(sc, ATH9K_PM_AWAKE);
                         ath9k_hw_setrxabort(sc->sc_ah, 0);
-                        sc->sc_flags |= SC_OP_WAIT_FOR_BEACON;
+                        sc->ps_flags |= PS_WAIT_FOR_BEACON;
                 }
 
 chip_reset:
@@ -664,10 +587,11 @@ static u32 ath_get_extchanmode(struct ath_softc *sc,
         return chanmode;
 }
 
-static int ath_setkey_tkip(struct ath_softc *sc, u16 keyix, const u8 *key,
+static int ath_setkey_tkip(struct ath_common *common, u16 keyix, const u8 *key,
                            struct ath9k_keyval *hk, const u8 *addr,
                            bool authenticator)
 {
+        struct ath_hw *ah = common->ah;
         const u8 *key_rxmic;
         const u8 *key_txmic;
 
@@ -687,42 +611,42 @@ static int ath_setkey_tkip(struct ath_softc *sc, u16 keyix, const u8 *key,
                         memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
                         memcpy(hk->kv_txmic, key_rxmic, sizeof(hk->kv_mic));
                 }
-                return ath9k_hw_set_keycache_entry(sc->sc_ah, keyix, hk, addr);
+                return ath9k_hw_set_keycache_entry(ah, keyix, hk, addr);
         }
-        if (!sc->splitmic) {
+        if (!common->splitmic) {
                 /* TX and RX keys share the same key cache entry. */
                 memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
                 memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_txmic));
-                return ath9k_hw_set_keycache_entry(sc->sc_ah, keyix, hk, addr);
+                return ath9k_hw_set_keycache_entry(ah, keyix, hk, addr);
         }
 
         /* Separate key cache entries for TX and RX */
 
         /* TX key goes at first index, RX key at +32. */
         memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
-        if (!ath9k_hw_set_keycache_entry(sc->sc_ah, keyix, hk, NULL)) {
+        if (!ath9k_hw_set_keycache_entry(ah, keyix, hk, NULL)) {
                 /* TX MIC entry failed. No need to proceed further */
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Setting TX MIC Key Failed\n");
+                ath_print(common, ATH_DBG_FATAL,
+                          "Setting TX MIC Key Failed\n");
                 return 0;
         }
 
         memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
         /* XXX delete tx key on failure? */
-        return ath9k_hw_set_keycache_entry(sc->sc_ah, keyix + 32, hk, addr);
+        return ath9k_hw_set_keycache_entry(ah, keyix + 32, hk, addr);
 }
 
-static int ath_reserve_key_cache_slot_tkip(struct ath_softc *sc)
+static int ath_reserve_key_cache_slot_tkip(struct ath_common *common)
 {
         int i;
 
-        for (i = IEEE80211_WEP_NKID; i < sc->keymax / 2; i++) {
-                if (test_bit(i, sc->keymap) ||
-                    test_bit(i + 64, sc->keymap))
+        for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
+                if (test_bit(i, common->keymap) ||
+                    test_bit(i + 64, common->keymap))
                         continue; /* At least one part of TKIP key allocated */
-                if (sc->splitmic &&
-                    (test_bit(i + 32, sc->keymap) ||
-                     test_bit(i + 64 + 32, sc->keymap)))
+                if (common->splitmic &&
+                    (test_bit(i + 32, common->keymap) ||
+                     test_bit(i + 64 + 32, common->keymap)))
                         continue; /* At least one part of TKIP key allocated */
 
                 /* Found a free slot for a TKIP key */
@@ -731,60 +655,60 @@ static int ath_reserve_key_cache_slot_tkip(struct ath_softc *sc)
         return -1;
 }
 
-static int ath_reserve_key_cache_slot(struct ath_softc *sc)
+static int ath_reserve_key_cache_slot(struct ath_common *common)
 {
         int i;
 
         /* First, try to find slots that would not be available for TKIP. */
-        if (sc->splitmic) {
-                for (i = IEEE80211_WEP_NKID; i < sc->keymax / 4; i++) {
-                        if (!test_bit(i, sc->keymap) &&
-                            (test_bit(i + 32, sc->keymap) ||
-                             test_bit(i + 64, sc->keymap) ||
-                             test_bit(i + 64 + 32, sc->keymap)))
+        if (common->splitmic) {
+                for (i = IEEE80211_WEP_NKID; i < common->keymax / 4; i++) {
+                        if (!test_bit(i, common->keymap) &&
+                            (test_bit(i + 32, common->keymap) ||
+                             test_bit(i + 64, common->keymap) ||
+                             test_bit(i + 64 + 32, common->keymap)))
                                 return i;
-                        if (!test_bit(i + 32, sc->keymap) &&
-                            (test_bit(i, sc->keymap) ||
-                             test_bit(i + 64, sc->keymap) ||
-                             test_bit(i + 64 + 32, sc->keymap)))
+                        if (!test_bit(i + 32, common->keymap) &&
+                            (test_bit(i, common->keymap) ||
+                             test_bit(i + 64, common->keymap) ||
+                             test_bit(i + 64 + 32, common->keymap)))
                                 return i + 32;
-                        if (!test_bit(i + 64, sc->keymap) &&
-                            (test_bit(i , sc->keymap) ||
-                             test_bit(i + 32, sc->keymap) ||
-                             test_bit(i + 64 + 32, sc->keymap)))
+                        if (!test_bit(i + 64, common->keymap) &&
+                            (test_bit(i , common->keymap) ||
+                             test_bit(i + 32, common->keymap) ||
+                             test_bit(i + 64 + 32, common->keymap)))
                                 return i + 64;
-                        if (!test_bit(i + 64 + 32, sc->keymap) &&
-                            (test_bit(i, sc->keymap) ||
-                             test_bit(i + 32, sc->keymap) ||
-                             test_bit(i + 64, sc->keymap)))
+                        if (!test_bit(i + 64 + 32, common->keymap) &&
+                            (test_bit(i, common->keymap) ||
+                             test_bit(i + 32, common->keymap) ||
+                             test_bit(i + 64, common->keymap)))
                                 return i + 64 + 32;
                 }
         } else {
-                for (i = IEEE80211_WEP_NKID; i < sc->keymax / 2; i++) {
-                        if (!test_bit(i, sc->keymap) &&
-                            test_bit(i + 64, sc->keymap))
+                for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
+                        if (!test_bit(i, common->keymap) &&
+                            test_bit(i + 64, common->keymap))
                                 return i;
-                        if (test_bit(i, sc->keymap) &&
-                            !test_bit(i + 64, sc->keymap))
+                        if (test_bit(i, common->keymap) &&
+                            !test_bit(i + 64, common->keymap))
                                 return i + 64;
                 }
         }
 
         /* No partially used TKIP slots, pick any available slot */
-        for (i = IEEE80211_WEP_NKID; i < sc->keymax; i++) {
+        for (i = IEEE80211_WEP_NKID; i < common->keymax; i++) {
                 /* Do not allow slots that could be needed for TKIP group keys
                  * to be used. This limitation could be removed if we know that
                  * TKIP will not be used. */
                 if (i >= 64 && i < 64 + IEEE80211_WEP_NKID)
                         continue;
-                if (sc->splitmic) {
+                if (common->splitmic) {
                         if (i >= 32 && i < 32 + IEEE80211_WEP_NKID)
                                 continue;
                         if (i >= 64 + 32 && i < 64 + 32 + IEEE80211_WEP_NKID)
                                 continue;
                 }
 
-                if (!test_bit(i, sc->keymap))
+                if (!test_bit(i, common->keymap))
                         return i; /* Found a free slot for a key */
         }
 
@@ -792,11 +716,12 @@ static int ath_reserve_key_cache_slot(struct ath_softc *sc)
         return -1;
 }
 
-static int ath_key_config(struct ath_softc *sc,
+static int ath_key_config(struct ath_common *common,
                           struct ieee80211_vif *vif,
                           struct ieee80211_sta *sta,
                           struct ieee80211_key_conf *key)
 {
+        struct ath_hw *ah = common->ah;
         struct ath9k_keyval hk;
         const u8 *mac = NULL;
         int ret = 0;
@@ -842,104 +767,76 @@ static int ath_key_config(struct ath_softc *sc,
                 mac = sta->addr;
 
                 if (key->alg == ALG_TKIP)
-                        idx = ath_reserve_key_cache_slot_tkip(sc);
+                        idx = ath_reserve_key_cache_slot_tkip(common);
                 else
-                        idx = ath_reserve_key_cache_slot(sc);
+                        idx = ath_reserve_key_cache_slot(common);
                 if (idx < 0)
                         return -ENOSPC; /* no free key cache entries */
         }
 
         if (key->alg == ALG_TKIP)
-                ret = ath_setkey_tkip(sc, idx, key->key, &hk, mac,
+                ret = ath_setkey_tkip(common, idx, key->key, &hk, mac,
                                       vif->type == NL80211_IFTYPE_AP);
         else
-                ret = ath9k_hw_set_keycache_entry(sc->sc_ah, idx, &hk, mac);
+                ret = ath9k_hw_set_keycache_entry(ah, idx, &hk, mac);
 
         if (!ret)
                 return -EIO;
 
-        set_bit(idx, sc->keymap);
+        set_bit(idx, common->keymap);
         if (key->alg == ALG_TKIP) {
-                set_bit(idx + 64, sc->keymap);
-                if (sc->splitmic) {
-                        set_bit(idx + 32, sc->keymap);
-                        set_bit(idx + 64 + 32, sc->keymap);
+                set_bit(idx + 64, common->keymap);
+                if (common->splitmic) {
+                        set_bit(idx + 32, common->keymap);
+                        set_bit(idx + 64 + 32, common->keymap);
                 }
         }
 
         return idx;
 }
 
-static void ath_key_delete(struct ath_softc *sc, struct ieee80211_key_conf *key)
+static void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key)
 {
-        ath9k_hw_keyreset(sc->sc_ah, key->hw_key_idx);
+        struct ath_hw *ah = common->ah;
+
+        ath9k_hw_keyreset(ah, key->hw_key_idx);
         if (key->hw_key_idx < IEEE80211_WEP_NKID)
                 return;
 
-        clear_bit(key->hw_key_idx, sc->keymap);
+        clear_bit(key->hw_key_idx, common->keymap);
         if (key->alg != ALG_TKIP)
                 return;
 
-        clear_bit(key->hw_key_idx + 64, sc->keymap);
-        if (sc->splitmic) {
-                clear_bit(key->hw_key_idx + 32, sc->keymap);
-                clear_bit(key->hw_key_idx + 64 + 32, sc->keymap);
+        clear_bit(key->hw_key_idx + 64, common->keymap);
+        if (common->splitmic) {
+                ath9k_hw_keyreset(ah, key->hw_key_idx + 32);
+                clear_bit(key->hw_key_idx + 32, common->keymap);
+                clear_bit(key->hw_key_idx + 64 + 32, common->keymap);
         }
 }
 
-static void setup_ht_cap(struct ath_softc *sc,
-                         struct ieee80211_sta_ht_cap *ht_info)
-{
-        u8 tx_streams, rx_streams;
-
-        ht_info->ht_supported = true;
-        ht_info->cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
-                       IEEE80211_HT_CAP_SM_PS |
-                       IEEE80211_HT_CAP_SGI_40 |
-                       IEEE80211_HT_CAP_DSSSCCK40;
-
-        ht_info->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
-        ht_info->ampdu_density = IEEE80211_HT_MPDU_DENSITY_8;
-
-        /* set up supported mcs set */
-        memset(&ht_info->mcs, 0, sizeof(ht_info->mcs));
-        tx_streams = !(sc->tx_chainmask & (sc->tx_chainmask - 1)) ? 1 : 2;
-        rx_streams = !(sc->rx_chainmask & (sc->rx_chainmask - 1)) ? 1 : 2;
-
-        if (tx_streams != rx_streams) {
-                DPRINTF(sc, ATH_DBG_CONFIG, "TX streams %d, RX streams: %d\n",
-                        tx_streams, rx_streams);
-                ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_RX_DIFF;
-                ht_info->mcs.tx_params |= ((tx_streams - 1) <<
-                                IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT);
-        }
-
-        ht_info->mcs.rx_mask[0] = 0xff;
-        if (rx_streams >= 2)
-                ht_info->mcs.rx_mask[1] = 0xff;
-
-        ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_DEFINED;
-}
-
 static void ath9k_bss_assoc_info(struct ath_softc *sc,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_bss_conf *bss_conf)
 {
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
 
         if (bss_conf->assoc) {
-                DPRINTF(sc, ATH_DBG_CONFIG, "Bss Info ASSOC %d, bssid: %pM\n",
-                        bss_conf->aid, sc->curbssid);
+                ath_print(common, ATH_DBG_CONFIG,
+                          "Bss Info ASSOC %d, bssid: %pM\n",
+                           bss_conf->aid, common->curbssid);
 
                 /* New association, store aid */
-                sc->curaid = bss_conf->aid;
-                ath9k_hw_write_associd(sc);
+                common->curaid = bss_conf->aid;
+                ath9k_hw_write_associd(ah);
 
                 /*
                  * Request a re-configuration of Beacon related timers
                  * on the receipt of the first Beacon frame (i.e.,
                  * after time sync with the AP).
                  */
-                sc->sc_flags |= SC_OP_BEACON_SYNC;
+                sc->ps_flags |= PS_BEACON_SYNC;
 
                 /* Configure the beacon */
                 ath_beacon_config(sc, vif);
@@ -947,187 +844,20 @@ static void ath9k_bss_assoc_info(struct ath_softc *sc,
                 /* Reset rssi stats */
                 sc->sc_ah->stats.avgbrssi = ATH_RSSI_DUMMY_MARKER;
 
-                ath_start_ani(sc);
+                ath_start_ani(common);
         } else {
-                DPRINTF(sc, ATH_DBG_CONFIG, "Bss Info DISASSOC\n");
-                sc->curaid = 0;
+                ath_print(common, ATH_DBG_CONFIG, "Bss Info DISASSOC\n");
+                common->curaid = 0;
                 /* Stop ANI */
-                del_timer_sync(&sc->ani.timer);
+                del_timer_sync(&common->ani.timer);
         }
 }
 
-/********************************/
-/*       LED functions          */
-/********************************/
-
-static void ath_led_blink_work(struct work_struct *work)
-{
-        struct ath_softc *sc = container_of(work, struct ath_softc,
-                                            ath_led_blink_work.work);
-
-        if (!(sc->sc_flags & SC_OP_LED_ASSOCIATED))
-                return;
-
-        if ((sc->led_on_duration == ATH_LED_ON_DURATION_IDLE) ||
-            (sc->led_off_duration == ATH_LED_OFF_DURATION_IDLE))
-                ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 0);
-        else
-                ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin,
-                                  (sc->sc_flags & SC_OP_LED_ON) ? 1 : 0);
-
-        ieee80211_queue_delayed_work(sc->hw,
-                                     &sc->ath_led_blink_work,
-                                     (sc->sc_flags & SC_OP_LED_ON) ?
-                                        msecs_to_jiffies(sc->led_off_duration) :
-                                        msecs_to_jiffies(sc->led_on_duration));
-
-        sc->led_on_duration = sc->led_on_cnt ?
-                        max((ATH_LED_ON_DURATION_IDLE - sc->led_on_cnt), 25) :
-                        ATH_LED_ON_DURATION_IDLE;
-        sc->led_off_duration = sc->led_off_cnt ?
-                        max((ATH_LED_OFF_DURATION_IDLE - sc->led_off_cnt), 10) :
-                        ATH_LED_OFF_DURATION_IDLE;
-        sc->led_on_cnt = sc->led_off_cnt = 0;
-        if (sc->sc_flags & SC_OP_LED_ON)
-                sc->sc_flags &= ~SC_OP_LED_ON;
-        else
-                sc->sc_flags |= SC_OP_LED_ON;
-}
-
-static void ath_led_brightness(struct led_classdev *led_cdev,
-                               enum led_brightness brightness)
-{
-        struct ath_led *led = container_of(led_cdev, struct ath_led, led_cdev);
-        struct ath_softc *sc = led->sc;
-
-        switch (brightness) {
-        case LED_OFF:
-                if (led->led_type == ATH_LED_ASSOC ||
-                    led->led_type == ATH_LED_RADIO) {
-                        ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin,
-                                (led->led_type == ATH_LED_RADIO));
-                        sc->sc_flags &= ~SC_OP_LED_ASSOCIATED;
-                        if (led->led_type == ATH_LED_RADIO)
-                                sc->sc_flags &= ~SC_OP_LED_ON;
-                } else {
-                        sc->led_off_cnt++;
-                }
-                break;
-        case LED_FULL:
-                if (led->led_type == ATH_LED_ASSOC) {
-                        sc->sc_flags |= SC_OP_LED_ASSOCIATED;
-                        ieee80211_queue_delayed_work(sc->hw,
-                                                     &sc->ath_led_blink_work, 0);
-                } else if (led->led_type == ATH_LED_RADIO) {
-                        ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 0);
-                        sc->sc_flags |= SC_OP_LED_ON;
-                } else {
-                        sc->led_on_cnt++;
-                }
-                break;
-        default:
-                break;
-        }
-}
-
-static int ath_register_led(struct ath_softc *sc, struct ath_led *led,
-                            char *trigger)
-{
-        int ret;
-
-        led->sc = sc;
-        led->led_cdev.name = led->name;
-        led->led_cdev.default_trigger = trigger;
-        led->led_cdev.brightness_set = ath_led_brightness;
-
-        ret = led_classdev_register(wiphy_dev(sc->hw->wiphy), &led->led_cdev);
-        if (ret)
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Failed to register led:%s", led->name);
-        else
-                led->registered = 1;
-        return ret;
-}
-
-static void ath_unregister_led(struct ath_led *led)
-{
-        if (led->registered) {
-                led_classdev_unregister(&led->led_cdev);
-                led->registered = 0;
-        }
-}
-
-static void ath_deinit_leds(struct ath_softc *sc)
-{
-        ath_unregister_led(&sc->assoc_led);
-        sc->sc_flags &= ~SC_OP_LED_ASSOCIATED;
-        ath_unregister_led(&sc->tx_led);
-        ath_unregister_led(&sc->rx_led);
-        ath_unregister_led(&sc->radio_led);
-        ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
-}
-
-static void ath_init_leds(struct ath_softc *sc)
-{
-        char *trigger;
-        int ret;
-
-        if (AR_SREV_9287(sc->sc_ah))
-                sc->sc_ah->led_pin = ATH_LED_PIN_9287;
-        else
-                sc->sc_ah->led_pin = ATH_LED_PIN_DEF;
-
-        /* Configure gpio 1 for output */
-        ath9k_hw_cfg_output(sc->sc_ah, sc->sc_ah->led_pin,
-                            AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
-        /* LED off, active low */
-        ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
-
-        INIT_DELAYED_WORK(&sc->ath_led_blink_work, ath_led_blink_work);
-
-        trigger = ieee80211_get_radio_led_name(sc->hw);
-        snprintf(sc->radio_led.name, sizeof(sc->radio_led.name),
-                "ath9k-%s::radio", wiphy_name(sc->hw->wiphy));
-        ret = ath_register_led(sc, &sc->radio_led, trigger);
-        sc->radio_led.led_type = ATH_LED_RADIO;
-        if (ret)
-                goto fail;
-
-        trigger = ieee80211_get_assoc_led_name(sc->hw);
-        snprintf(sc->assoc_led.name, sizeof(sc->assoc_led.name),
-                "ath9k-%s::assoc", wiphy_name(sc->hw->wiphy));
-        ret = ath_register_led(sc, &sc->assoc_led, trigger);
-        sc->assoc_led.led_type = ATH_LED_ASSOC;
-        if (ret)
-                goto fail;
-
-        trigger = ieee80211_get_tx_led_name(sc->hw);
-        snprintf(sc->tx_led.name, sizeof(sc->tx_led.name),
-                "ath9k-%s::tx", wiphy_name(sc->hw->wiphy));
-        ret = ath_register_led(sc, &sc->tx_led, trigger);
-        sc->tx_led.led_type = ATH_LED_TX;
-        if (ret)
-                goto fail;
-
-        trigger = ieee80211_get_rx_led_name(sc->hw);
-        snprintf(sc->rx_led.name, sizeof(sc->rx_led.name),
-                "ath9k-%s::rx", wiphy_name(sc->hw->wiphy));
-        ret = ath_register_led(sc, &sc->rx_led, trigger);
-        sc->rx_led.led_type = ATH_LED_RX;
-        if (ret)
-                goto fail;
-
-        return;
-
-fail:
-        cancel_delayed_work_sync(&sc->ath_led_blink_work);
-        ath_deinit_leds(sc);
-}
-
-void ath_radio_enable(struct ath_softc *sc)
+void ath_radio_enable(struct ath_softc *sc, struct ieee80211_hw *hw)
 {
         struct ath_hw *ah = sc->sc_ah;
-        struct ieee80211_channel *channel = sc->hw->conf.channel;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ieee80211_channel *channel = hw->conf.channel;
         int r;
 
         ath9k_ps_wakeup(sc);
@@ -1139,17 +869,17 @@ void ath_radio_enable(struct ath_softc *sc)
         spin_lock_bh(&sc->sc_resetlock);
         r = ath9k_hw_reset(ah, ah->curchan, false);
         if (r) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to reset channel %u (%uMhz) ",
-                        "reset status %d\n",
-                        channel->center_freq, r);
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to reset channel (%u MHz), "
+                          "reset status %d\n",
+                          channel->center_freq, r);
         }
         spin_unlock_bh(&sc->sc_resetlock);
 
         ath_update_txpow(sc);
         if (ath_startrecv(sc) != 0) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to restart recv logic\n");
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to restart recv logic\n");
                 return;
         }
 
@@ -1164,18 +894,18 @@ void ath_radio_enable(struct ath_softc *sc)
                             AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
         ath9k_hw_set_gpio(ah, ah->led_pin, 0);
 
-        ieee80211_wake_queues(sc->hw);
+        ieee80211_wake_queues(hw);
         ath9k_ps_restore(sc);
 }
 
-void ath_radio_disable(struct ath_softc *sc)
+void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
 {
         struct ath_hw *ah = sc->sc_ah;
-        struct ieee80211_channel *channel = sc->hw->conf.channel;
+        struct ieee80211_channel *channel = hw->conf.channel;
         int r;
 
         ath9k_ps_wakeup(sc);
-        ieee80211_stop_queues(sc->hw);
+        ieee80211_stop_queues(hw);
 
         /* Disable LED */
         ath9k_hw_set_gpio(ah, ah->led_pin, 1);
@@ -1189,471 +919,36 @@ void ath_radio_disable(struct ath_softc *sc)
         ath_flushrecv(sc);              /* flush recv queue */
 
         if (!ah->curchan)
-                ah->curchan = ath_get_curchannel(sc, sc->hw);
+                ah->curchan = ath_get_curchannel(sc, hw);
 
         spin_lock_bh(&sc->sc_resetlock);
         r = ath9k_hw_reset(ah, ah->curchan, false);
         if (r) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to reset channel %u (%uMhz) "
-                        "reset status %d\n",
-                        channel->center_freq, r);
+                ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
+                          "Unable to reset channel (%u MHz), "
+                          "reset status %d\n",
+                          channel->center_freq, r);
         }
         spin_unlock_bh(&sc->sc_resetlock);
 
         ath9k_hw_phy_disable(ah);
         ath9k_hw_configpcipowersave(ah, 1, 1);
         ath9k_ps_restore(sc);
-        ath9k_hw_setpower(ah, ATH9K_PM_FULL_SLEEP);
-}
-
-/*******************/
-/*      Rfkill     */
-/*******************/
-
-static bool ath_is_rfkill_set(struct ath_softc *sc)
-{
-        struct ath_hw *ah = sc->sc_ah;
-
-        return ath9k_hw_gpio_get(ah, ah->rfkill_gpio) ==
-                                  ah->rfkill_polarity;
-}
-
-static void ath9k_rfkill_poll_state(struct ieee80211_hw *hw)
-{
-        struct ath_wiphy *aphy = hw->priv;
-        struct ath_softc *sc = aphy->sc;
-        bool blocked = !!ath_is_rfkill_set(sc);
-
-        wiphy_rfkill_set_hw_state(hw->wiphy, blocked);
-}
-
-static void ath_start_rfkill_poll(struct ath_softc *sc)
-{
-        struct ath_hw *ah = sc->sc_ah;
-
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_RFSILENT)
-                wiphy_rfkill_start_polling(sc->hw->wiphy);
-}
-
-void ath_cleanup(struct ath_softc *sc)
-{
-        ath_detach(sc);
-        free_irq(sc->irq, sc);
-        ath_bus_cleanup(sc);
-        kfree(sc->sec_wiphy);
-        ieee80211_free_hw(sc->hw);
-}
-
-void ath_detach(struct ath_softc *sc)
-{
-        struct ieee80211_hw *hw = sc->hw;
-        int i = 0;
-
-        ath9k_ps_wakeup(sc);
-
-        DPRINTF(sc, ATH_DBG_CONFIG, "Detach ATH hw\n");
-
-        ath_deinit_leds(sc);
-        wiphy_rfkill_stop_polling(sc->hw->wiphy);
-
-        for (i = 0; i < sc->num_sec_wiphy; i++) {
-                struct ath_wiphy *aphy = sc->sec_wiphy[i];
-                if (aphy == NULL)
-                        continue;
-                sc->sec_wiphy[i] = NULL;
-                ieee80211_unregister_hw(aphy->hw);
-                ieee80211_free_hw(aphy->hw);
-        }
-        ieee80211_unregister_hw(hw);
-        ath_rx_cleanup(sc);
-        ath_tx_cleanup(sc);
-
-        tasklet_kill(&sc->intr_tq);
-        tasklet_kill(&sc->bcon_tasklet);
-
-        if (!(sc->sc_flags & SC_OP_INVALID))
-                ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
-
-        /* cleanup tx queues */
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
-                if (ATH_TXQ_SETUP(sc, i))
-                        ath_tx_cleanupq(sc, &sc->tx.txq[i]);
-
-        if ((sc->btcoex_info.no_stomp_timer) &&
-            sc->btcoex_info.btcoex_scheme == ATH_BTCOEX_CFG_3WIRE)
-                ath_gen_timer_free(sc->sc_ah, sc->btcoex_info.no_stomp_timer);
-
-        ath9k_hw_detach(sc->sc_ah);
-        sc->sc_ah = NULL;
-        ath9k_exit_debug(sc);
-}
-
-static int ath9k_reg_notifier(struct wiphy *wiphy,
-                              struct regulatory_request *request)
-{
-        struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-        struct ath_wiphy *aphy = hw->priv;
-        struct ath_softc *sc = aphy->sc;
-        struct ath_regulatory *reg = &sc->common.regulatory;
-
-        return ath_reg_notifier_apply(wiphy, request, reg);
-}
-
-/*
- * Initialize and fill ath_softc, ath_sofct is the
- * "Software Carrier" struct. Historically it has existed
- * to allow the separation between hardware specific
- * variables (now in ath_hw) and driver specific variables.
- */
-static int ath_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid)
-{
-        struct ath_hw *ah = NULL;
-        int r = 0, i;
-        int csz = 0;
-
-        /* XXX: hardware will not be ready until ath_open() being called */
-        sc->sc_flags |= SC_OP_INVALID;
-
-        if (ath9k_init_debug(sc) < 0)
-                printk(KERN_ERR "Unable to create debugfs files\n");
-
-        spin_lock_init(&sc->wiphy_lock);
-        spin_lock_init(&sc->sc_resetlock);
-        spin_lock_init(&sc->sc_serial_rw);
-        spin_lock_init(&sc->ani_lock);
-        spin_lock_init(&sc->sc_pm_lock);
-        mutex_init(&sc->mutex);
-        tasklet_init(&sc->intr_tq, ath9k_tasklet, (unsigned long)sc);
-        tasklet_init(&sc->bcon_tasklet, ath_beacon_tasklet,
-                     (unsigned long)sc);
-
-        /*
-         * Cache line size is used to size and align various
-         * structures used to communicate with the hardware.
-         */
-        ath_read_cachesize(sc, &csz);
-        /* XXX assert csz is non-zero */
-        sc->common.cachelsz = csz << 2; /* convert to bytes */
-
-        ah = kzalloc(sizeof(struct ath_hw), GFP_KERNEL);
-        if (!ah) {
-                r = -ENOMEM;
-                goto bad_no_ah;
-        }
-
-        ah->ah_sc = sc;
-        ah->hw_version.devid = devid;
-        ah->hw_version.subsysid = subsysid;
-        sc->sc_ah = ah;
-
-        r = ath9k_hw_init(ah);
-        if (r) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to initialize hardware; "
-                        "initialization status: %d\n", r);
-                goto bad;
-        }
-
-        /* Get the hardware key cache size. */
-        sc->keymax = ah->caps.keycache_size;
-        if (sc->keymax > ATH_KEYMAX) {
-                DPRINTF(sc, ATH_DBG_ANY,
-                        "Warning, using only %u entries in %u key cache\n",
-                        ATH_KEYMAX, sc->keymax);
-                sc->keymax = ATH_KEYMAX;
-        }
-
-        /*
-         * Reset the key cache since some parts do not
-         * reset the contents on initial power up.
-         */
-        for (i = 0; i < sc->keymax; i++)
-                ath9k_hw_keyreset(ah, (u16) i);
-
-        /* default to MONITOR mode */
-        sc->sc_ah->opmode = NL80211_IFTYPE_MONITOR;
-
-        /* Setup rate tables */
-
-        ath_rate_attach(sc);
-        ath_setup_rates(sc, IEEE80211_BAND_2GHZ);
-        ath_setup_rates(sc, IEEE80211_BAND_5GHZ);
-
-        /*
-         * Allocate hardware transmit queues: one queue for
-         * beacon frames and one data queue for each QoS
-         * priority.  Note that the hal handles reseting
-         * these queues at the needed time.
-         */
-        sc->beacon.beaconq = ath_beaconq_setup(ah);
-        if (sc->beacon.beaconq == -1) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to setup a beacon xmit queue\n");
-                r = -EIO;
-                goto bad2;
-        }
-        sc->beacon.cabq = ath_txq_setup(sc, ATH9K_TX_QUEUE_CAB, 0);
-        if (sc->beacon.cabq == NULL) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to setup CAB xmit queue\n");
-                r = -EIO;
-                goto bad2;
-        }
-
-        sc->config.cabqReadytime = ATH_CABQ_READY_TIME;
-        ath_cabq_update(sc);
-
-        for (i = 0; i < ARRAY_SIZE(sc->tx.hwq_map); i++)
-                sc->tx.hwq_map[i] = -1;
-
-        /* Setup data queues */
-        /* NB: ensure BK queue is the lowest priority h/w queue */
-        if (!ath_tx_setup(sc, ATH9K_WME_AC_BK)) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to setup xmit queue for BK traffic\n");
-                r = -EIO;
-                goto bad2;
-        }
-
-        if (!ath_tx_setup(sc, ATH9K_WME_AC_BE)) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to setup xmit queue for BE traffic\n");
-                r = -EIO;
-                goto bad2;
-        }
-        if (!ath_tx_setup(sc, ATH9K_WME_AC_VI)) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to setup xmit queue for VI traffic\n");
-                r = -EIO;
-                goto bad2;
-        }
-        if (!ath_tx_setup(sc, ATH9K_WME_AC_VO)) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to setup xmit queue for VO traffic\n");
-                r = -EIO;
-                goto bad2;
-        }
-
-        /* Initializes the noise floor to a reasonable default value.
-         * Later on this will be updated during ANI processing. */
-
-        sc->ani.noise_floor = ATH_DEFAULT_NOISE_FLOOR;
-        setup_timer(&sc->ani.timer, ath_ani_calibrate, (unsigned long)sc);
-
-        if (ath9k_hw_getcapability(ah, ATH9K_CAP_CIPHER,
-                                   ATH9K_CIPHER_TKIP, NULL)) {
-                /*
-                 * Whether we should enable h/w TKIP MIC.
-                 * XXX: if we don't support WME TKIP MIC, then we wouldn't
-                 * report WMM capable, so it's always safe to turn on
-                 * TKIP MIC in this case.
-                 */
-                ath9k_hw_setcapability(sc->sc_ah, ATH9K_CAP_TKIP_MIC,
-                                       0, 1, NULL);
-        }
-
-        /*
-         * Check whether the separate key cache entries
-         * are required to handle both tx+rx MIC keys.
-         * With split mic keys the number of stations is limited
-         * to 27 otherwise 59.
-         */
-        if (ath9k_hw_getcapability(ah, ATH9K_CAP_CIPHER,
-                                   ATH9K_CIPHER_TKIP, NULL)
-            && ath9k_hw_getcapability(ah, ATH9K_CAP_CIPHER,
-                                      ATH9K_CIPHER_MIC, NULL)
-            && ath9k_hw_getcapability(ah, ATH9K_CAP_TKIP_SPLIT,
-                                      0, NULL))
-                sc->splitmic = 1;
-
-        /* turn on mcast key search if possible */
-        if (!ath9k_hw_getcapability(ah, ATH9K_CAP_MCAST_KEYSRCH, 0, NULL))
-                (void)ath9k_hw_setcapability(ah, ATH9K_CAP_MCAST_KEYSRCH, 1,
-                                             1, NULL);
-
-        sc->config.txpowlimit = ATH_TXPOWER_MAX;
-
-        /* 11n Capabilities */
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
-                sc->sc_flags |= SC_OP_TXAGGR;
-                sc->sc_flags |= SC_OP_RXAGGR;
-        }
-
-        sc->tx_chainmask = ah->caps.tx_chainmask;
-        sc->rx_chainmask = ah->caps.rx_chainmask;
-
-        ath9k_hw_setcapability(ah, ATH9K_CAP_DIVERSITY, 1, true, NULL);
-        sc->rx.defant = ath9k_hw_getdefantenna(ah);
-
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
-                memcpy(sc->bssidmask, ath_bcast_mac, ETH_ALEN);
-
-        sc->beacon.slottime = ATH9K_SLOT_TIME_9;        /* default to short slot time */
-
-        /* initialize beacon slots */
-        for (i = 0; i < ARRAY_SIZE(sc->beacon.bslot); i++) {
-                sc->beacon.bslot[i] = NULL;
-                sc->beacon.bslot_aphy[i] = NULL;
-        }
-
-        /* setup channels and rates */
-
-        sc->sbands[IEEE80211_BAND_2GHZ].channels = ath9k_2ghz_chantable;
-        sc->sbands[IEEE80211_BAND_2GHZ].bitrates =
-                sc->rates[IEEE80211_BAND_2GHZ];
-        sc->sbands[IEEE80211_BAND_2GHZ].band = IEEE80211_BAND_2GHZ;
-        sc->sbands[IEEE80211_BAND_2GHZ].n_channels =
-                ARRAY_SIZE(ath9k_2ghz_chantable);
-
-        if (test_bit(ATH9K_MODE_11A, sc->sc_ah->caps.wireless_modes)) {
-                sc->sbands[IEEE80211_BAND_5GHZ].channels = ath9k_5ghz_chantable;
-                sc->sbands[IEEE80211_BAND_5GHZ].bitrates =
-                        sc->rates[IEEE80211_BAND_5GHZ];
-                sc->sbands[IEEE80211_BAND_5GHZ].band = IEEE80211_BAND_5GHZ;
-                sc->sbands[IEEE80211_BAND_5GHZ].n_channels =
-                        ARRAY_SIZE(ath9k_5ghz_chantable);
-        }
-
-        if (sc->btcoex_info.btcoex_scheme != ATH_BTCOEX_CFG_NONE) {
-                r = ath9k_hw_btcoex_init(ah);
-                if (r)
-                        goto bad2;
-        }
-
-        return 0;
-bad2:
-        /* cleanup tx queues */
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
-                if (ATH_TXQ_SETUP(sc, i))
-                        ath_tx_cleanupq(sc, &sc->tx.txq[i]);
-bad:
-        ath9k_hw_detach(ah);
-        sc->sc_ah = NULL;
-bad_no_ah:
-        ath9k_exit_debug(sc);
-
-        return r;
-}
-
-void ath_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
-{
-        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
-                IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
-                IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_AMPDU_AGGREGATION |
-                IEEE80211_HW_SUPPORTS_PS |
-                IEEE80211_HW_PS_NULLFUNC_STACK |
-                IEEE80211_HW_SPECTRUM_MGMT;
-
-        if (AR_SREV_9160_10_OR_LATER(sc->sc_ah) || modparam_nohwcrypt)
-                hw->flags |= IEEE80211_HW_MFP_CAPABLE;
-
-        hw->wiphy->interface_modes =
-                BIT(NL80211_IFTYPE_AP) |
-                BIT(NL80211_IFTYPE_STATION) |
-                BIT(NL80211_IFTYPE_ADHOC) |
-                BIT(NL80211_IFTYPE_MESH_POINT);
-
-        hw->wiphy->ps_default = false;
-
-        hw->queues = 4;
-        hw->max_rates = 4;
-        hw->channel_change_time = 5000;
-        hw->max_listen_interval = 10;
-        /* Hardware supports 10 but we use 4 */
-        hw->max_rate_tries = 4;
-        hw->sta_data_size = sizeof(struct ath_node);
-        hw->vif_data_size = sizeof(struct ath_vif);
-
-        hw->rate_control_algorithm = "ath9k_rate_control";
-
-        hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
-                &sc->sbands[IEEE80211_BAND_2GHZ];
-        if (test_bit(ATH9K_MODE_11A, sc->sc_ah->caps.wireless_modes))
-                hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
-                        &sc->sbands[IEEE80211_BAND_5GHZ];
-}
-
-/* Device driver core initialization */
-int ath_init_device(u16 devid, struct ath_softc *sc, u16 subsysid)
-{
-        struct ieee80211_hw *hw = sc->hw;
-        int error = 0, i;
-        struct ath_regulatory *reg;
-
-        DPRINTF(sc, ATH_DBG_CONFIG, "Attach ATH hw\n");
-
-        error = ath_init_softc(devid, sc, subsysid);
-        if (error != 0)
-                return error;
-
-        /* get mac address from hardware and set in mac80211 */
-
-        SET_IEEE80211_PERM_ADDR(hw, sc->sc_ah->macaddr);
-
-        ath_set_hw_capab(sc, hw);
-
-        error = ath_regd_init(&sc->common.regulatory, sc->hw->wiphy,
-                              ath9k_reg_notifier);
-        if (error)
-                return error;
-
-        reg = &sc->common.regulatory;
-
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
-                setup_ht_cap(sc, &sc->sbands[IEEE80211_BAND_2GHZ].ht_cap);
-                if (test_bit(ATH9K_MODE_11A, sc->sc_ah->caps.wireless_modes))
-                        setup_ht_cap(sc, &sc->sbands[IEEE80211_BAND_5GHZ].ht_cap);
-        }
-
-        /* initialize tx/rx engine */
-        error = ath_tx_init(sc, ATH_TXBUF);
-        if (error != 0)
-                goto error_attach;
-
-        error = ath_rx_init(sc, ATH_RXBUF);
-        if (error != 0)
-                goto error_attach;
-
-        INIT_WORK(&sc->chan_work, ath9k_wiphy_chan_work);
-        INIT_DELAYED_WORK(&sc->wiphy_work, ath9k_wiphy_work);
-        sc->wiphy_scheduler_int = msecs_to_jiffies(500);
-
-        error = ieee80211_register_hw(hw);
-
-        if (!ath_is_world_regd(reg)) {
-                error = regulatory_hint(hw->wiphy, reg->alpha2);
-                if (error)
-                        goto error_attach;
-        }
-
-        /* Initialize LED control */
-        ath_init_leds(sc);
-
-        ath_start_rfkill_poll(sc);
-
-        return 0;
-
-error_attach:
-        /* cleanup tx queues */
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
-                if (ATH_TXQ_SETUP(sc, i))
-                        ath_tx_cleanupq(sc, &sc->tx.txq[i]);
-
-        ath9k_hw_detach(sc->sc_ah);
-        sc->sc_ah = NULL;
-        ath9k_exit_debug(sc);
-
-        return error;
+        ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
 }
 
 int ath_reset(struct ath_softc *sc, bool retry_tx)
 {
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_hw *hw = sc->hw;
         int r;
 
+        /* Stop ANI */
+        del_timer_sync(&common->ani.timer);
+
+        ieee80211_stop_queues(hw);
+
         ath9k_hw_set_interrupts(ah, 0);
         ath_drain_all_txq(sc, retry_tx);
         ath_stoprecv(sc);
@@ -1662,12 +957,13 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
         spin_lock_bh(&sc->sc_resetlock);
         r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false);
         if (r)
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to reset hardware; reset status %d\n", r);
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to reset hardware; reset status %d\n", r);
         spin_unlock_bh(&sc->sc_resetlock);
 
         if (ath_startrecv(sc) != 0)
-                DPRINTF(sc, ATH_DBG_FATAL, "Unable to start recv logic\n");
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to start recv logic\n");
 
         /*
          * We may be doing a reset in response to a request
@@ -1694,125 +990,12 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
                 }
         }
 
-        return r;
-}
-
-/*
- *  This function will allocate both the DMA descriptor structure, and the
- *  buffers it contains.  These are used to contain the descriptors used
- *  by the system.
-*/
-int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
-                      struct list_head *head, const char *name,
-                      int nbuf, int ndesc)
-{
-#define DS2PHYS(_dd, _ds)                                               \
-        ((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
-#define ATH_DESC_4KB_BOUND_CHECK(_daddr) ((((_daddr) & 0xFFF) > 0xF7F) ? 1 : 0)
-#define ATH_DESC_4KB_BOUND_NUM_SKIPPED(_len) ((_len) / 4096)
-
-        struct ath_desc *ds;
-        struct ath_buf *bf;
-        int i, bsize, error;
-
-        DPRINTF(sc, ATH_DBG_CONFIG, "%s DMA: %u buffers %u desc/buf\n",
-                name, nbuf, ndesc);
-
-        INIT_LIST_HEAD(head);
-        /* ath_desc must be a multiple of DWORDs */
-        if ((sizeof(struct ath_desc) % 4) != 0) {
-                DPRINTF(sc, ATH_DBG_FATAL, "ath_desc not DWORD aligned\n");
-                ASSERT((sizeof(struct ath_desc) % 4) == 0);
-                error = -ENOMEM;
-                goto fail;
-        }
-
-        dd->dd_desc_len = sizeof(struct ath_desc) * nbuf * ndesc;
-
-        /*
-         * Need additional DMA memory because we can't use
-         * descriptors that cross the 4K page boundary. Assume
-         * one skipped descriptor per 4K page.
-         */
-        if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_4KB_SPLITTRANS)) {
-                u32 ndesc_skipped =
-                        ATH_DESC_4KB_BOUND_NUM_SKIPPED(dd->dd_desc_len);
-                u32 dma_len;
-
-                while (ndesc_skipped) {
-                        dma_len = ndesc_skipped * sizeof(struct ath_desc);
-                        dd->dd_desc_len += dma_len;
-
-                        ndesc_skipped = ATH_DESC_4KB_BOUND_NUM_SKIPPED(dma_len);
-                };
-        }
-
-        /* allocate descriptors */
-        dd->dd_desc = dma_alloc_coherent(sc->dev, dd->dd_desc_len,
-                                         &dd->dd_desc_paddr, GFP_KERNEL);
-        if (dd->dd_desc == NULL) {
-                error = -ENOMEM;
-                goto fail;
-        }
-        ds = dd->dd_desc;
-        DPRINTF(sc, ATH_DBG_CONFIG, "%s DMA map: %p (%u) -> %llx (%u)\n",
-                name, ds, (u32) dd->dd_desc_len,
-                ito64(dd->dd_desc_paddr), /*XXX*/(u32) dd->dd_desc_len);
-
-        /* allocate buffers */
-        bsize = sizeof(struct ath_buf) * nbuf;
-        bf = kzalloc(bsize, GFP_KERNEL);
-        if (bf == NULL) {
-                error = -ENOMEM;
-                goto fail2;
-        }
-        dd->dd_bufptr = bf;
-
-        for (i = 0; i < nbuf; i++, bf++, ds += ndesc) {
-                bf->bf_desc = ds;
-                bf->bf_daddr = DS2PHYS(dd, ds);
-
-                if (!(sc->sc_ah->caps.hw_caps &
-                      ATH9K_HW_CAP_4KB_SPLITTRANS)) {
-                        /*
-                         * Skip descriptor addresses which can cause 4KB
-                         * boundary crossing (addr + length) with a 32 dword
-                         * descriptor fetch.
-                         */
-                        while (ATH_DESC_4KB_BOUND_CHECK(bf->bf_daddr)) {
-                                ASSERT((caddr_t) bf->bf_desc <
-                                       ((caddr_t) dd->dd_desc +
-                                        dd->dd_desc_len));
-
-                                ds += ndesc;
-                                bf->bf_desc = ds;
-                                bf->bf_daddr = DS2PHYS(dd, ds);
-                        }
-                }
-                list_add_tail(&bf->list, head);
-        }
-        return 0;
-fail2:
-        dma_free_coherent(sc->dev, dd->dd_desc_len, dd->dd_desc,
-                          dd->dd_desc_paddr);
-fail:
-        memset(dd, 0, sizeof(*dd));
-        return error;
-#undef ATH_DESC_4KB_BOUND_CHECK
-#undef ATH_DESC_4KB_BOUND_NUM_SKIPPED
-#undef DS2PHYS
-}
+        ieee80211_wake_queues(hw);
 
-void ath_descdma_cleanup(struct ath_softc *sc,
-                         struct ath_descdma *dd,
-                         struct list_head *head)
-{
-        dma_free_coherent(sc->dev, dd->dd_desc_len, dd->dd_desc,
-                          dd->dd_desc_paddr);
+        /* Start ANI */
+        ath_start_ani(common);
 
-        INIT_LIST_HEAD(head);
-        kfree(dd->dd_bufptr);
-        memset(dd, 0, sizeof(*dd));
+        return r;
 }
 
 int ath_get_hal_qnum(u16 queue, struct ath_softc *sc)
@@ -1884,15 +1067,9 @@ void ath9k_update_ichannel(struct ath_softc *sc, struct ieee80211_hw *hw,
                 ichan->channelFlags = CHANNEL_5GHZ | CHANNEL_OFDM;
         }
 
-        sc->tx_chan_width = ATH9K_HT_MACMODE_20;
-
-        if (conf_is_ht(conf)) {
-                if (conf_is_ht40(conf))
-                        sc->tx_chan_width = ATH9K_HT_MACMODE_2040;
-
+        if (conf_is_ht(conf))
                 ichan->chanmode = ath_get_extchanmode(sc, chan,
                                             conf->channel_type);
-        }
 }
 
 /**********************/
@@ -1903,12 +1080,15 @@ static int ath9k_start(struct ieee80211_hw *hw)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_channel *curchan = hw->conf.channel;
         struct ath9k_channel *init_channel;
         int r;
 
-        DPRINTF(sc, ATH_DBG_CONFIG, "Starting driver with "
-                "initial channel: %d MHz\n", curchan->center_freq);
+        ath_print(common, ATH_DBG_CONFIG,
+                  "Starting driver with initial channel: %d MHz\n",
+                  curchan->center_freq);
 
         mutex_lock(&sc->mutex);
 
@@ -1940,7 +1120,7 @@ static int ath9k_start(struct ieee80211_hw *hw)
         init_channel = ath_get_curchannel(sc, hw);
 
         /* Reset SERDES registers */
-        ath9k_hw_configpcipowersave(sc->sc_ah, 0, 0);
+        ath9k_hw_configpcipowersave(ah, 0, 0);
 
         /*
          * The basic interface to setting the hardware in a good
@@ -1950,12 +1130,12 @@ static int ath9k_start(struct ieee80211_hw *hw)
          * and then setup of the interrupt mask.
          */
         spin_lock_bh(&sc->sc_resetlock);
-        r = ath9k_hw_reset(sc->sc_ah, init_channel, false);
+        r = ath9k_hw_reset(ah, init_channel, false);
         if (r) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to reset hardware; reset status %d "
-                        "(freq %u MHz)\n", r,
-                        curchan->center_freq);
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to reset hardware; reset status %d "
+                          "(freq %u MHz)\n", r,
+                          curchan->center_freq);
                 spin_unlock_bh(&sc->sc_resetlock);
                 goto mutex_unlock;
         }
@@ -1975,7 +1155,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
          * here except setup the interrupt mask.
          */
         if (ath_startrecv(sc) != 0) {
-                DPRINTF(sc, ATH_DBG_FATAL, "Unable to start recv logic\n");
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to start recv logic\n");
                 r = -EIO;
                 goto mutex_unlock;
         }
@@ -1985,10 +1166,10 @@ static int ath9k_start(struct ieee80211_hw *hw)
                 | ATH9K_INT_RXEOL | ATH9K_INT_RXORN
                 | ATH9K_INT_FATAL | ATH9K_INT_GLOBAL;
 
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_GTT)
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_GTT)
                 sc->imask |= ATH9K_INT_GTT;
 
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_HT)
                 sc->imask |= ATH9K_INT_CST;
 
         ath_cache_conf_rate(sc, &hw->conf);
@@ -1997,21 +1178,22 @@ static int ath9k_start(struct ieee80211_hw *hw)
 
         /* Disable BMISS interrupt when we're not associated */
         sc->imask &= ~(ATH9K_INT_SWBA | ATH9K_INT_BMISS);
-        ath9k_hw_set_interrupts(sc->sc_ah, sc->imask);
+        ath9k_hw_set_interrupts(ah, sc->imask);
 
         ieee80211_wake_queues(hw);
 
         ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
 
-        if ((sc->btcoex_info.btcoex_scheme != ATH_BTCOEX_CFG_NONE) &&
-            !(sc->sc_flags & SC_OP_BTCOEX_ENABLED)) {
-                ath_btcoex_set_weight(&sc->btcoex_info, AR_BT_COEX_WGHT,
-                                      AR_STOMP_LOW_WLAN_WGHT);
-                ath9k_hw_btcoex_enable(sc->sc_ah);
+        if ((ah->btcoex_hw.scheme != ATH_BTCOEX_CFG_NONE) &&
+            !ah->btcoex_hw.enabled) {
+                ath9k_hw_btcoex_set_weight(ah, AR_BT_COEX_WGHT,
+                                           AR_STOMP_LOW_WLAN_WGHT);
+                ath9k_hw_btcoex_enable(ah);
 
-                ath_pcie_aspm_disable(sc);
-                if (sc->btcoex_info.btcoex_scheme == ATH_BTCOEX_CFG_3WIRE)
-                        ath_btcoex_timer_resume(sc, &sc->btcoex_info);
+                if (common->bus_ops->bt_coex_prep)
+                        common->bus_ops->bt_coex_prep(common);
+                if (ah->btcoex_hw.scheme == ATH_BTCOEX_CFG_3WIRE)
+                        ath9k_btcoex_timer_resume(sc);
         }
 
 mutex_unlock:
@@ -2026,17 +1208,19 @@ static int ath9k_tx(struct ieee80211_hw *hw,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_tx_control txctl;
-        int hdrlen, padsize;
+        int padpos, padsize;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 
         if (aphy->state != ATH_WIPHY_ACTIVE && aphy->state != ATH_WIPHY_SCAN) {
-                printk(KERN_DEBUG "ath9k: %s: TX in unexpected wiphy state "
-                       "%d\n", wiphy_name(hw->wiphy), aphy->state);
+                ath_print(common, ATH_DBG_XMIT,
+                          "ath9k: %s: TX in unexpected wiphy state "
+                          "%d\n", wiphy_name(hw->wiphy), aphy->state);
                 goto exit;
         }
 
         if (sc->ps_enabled) {
-                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
                 /*
                  * mac80211 does not set PM field for normal data frames, so we
                  * need to update that based on the current PS mode.
@@ -2044,8 +1228,8 @@ static int ath9k_tx(struct ieee80211_hw *hw,
                 if (ieee80211_is_data(hdr->frame_control) &&
                     !ieee80211_is_nullfunc(hdr->frame_control) &&
                     !ieee80211_has_pm(hdr->frame_control)) {
-                        DPRINTF(sc, ATH_DBG_PS, "Add PM=1 for a TX frame "
-                                "while in PS mode\n");
+                        ath_print(common, ATH_DBG_PS, "Add PM=1 for a TX frame "
+                                  "while in PS mode\n");
                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
                 }
         }
@@ -2056,16 +1240,16 @@ static int ath9k_tx(struct ieee80211_hw *hw,
                  * power save mode. Need to wake up hardware for the TX to be
                  * completed and if needed, also for RX of buffered frames.
                  */
-                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
                 ath9k_ps_wakeup(sc);
                 ath9k_hw_setrxabort(sc->sc_ah, 0);
                 if (ieee80211_is_pspoll(hdr->frame_control)) {
-                        DPRINTF(sc, ATH_DBG_PS, "Sending PS-Poll to pick a "
-                                "buffered frame\n");
-                        sc->sc_flags |= SC_OP_WAIT_FOR_PSPOLL_DATA;
+                        ath_print(common, ATH_DBG_PS,
+                                  "Sending PS-Poll to pick a buffered frame\n");
+                        sc->ps_flags |= PS_WAIT_FOR_PSPOLL_DATA;
                 } else {
-                        DPRINTF(sc, ATH_DBG_PS, "Wake up to complete TX\n");
-                        sc->sc_flags |= SC_OP_WAIT_FOR_TX_ACK;
+                        ath_print(common, ATH_DBG_PS,
+                                  "Wake up to complete TX\n");
+                        sc->ps_flags |= PS_WAIT_FOR_TX_ACK;
                 }
                 /*
                  * The actual restore operation will happen only after
@@ -2083,7 +1267,6 @@ static int ath9k_tx(struct ieee80211_hw *hw,
          * BSSes.
          */
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
-                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
                 if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
                         sc->tx.seq_no += 0x10;
                 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
@@ -2091,13 +1274,13 @@ static int ath9k_tx(struct ieee80211_hw *hw,
         }
 
         /* Add the padding after the header if this is not already done */
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        if (hdrlen & 3) {
-                padsize = hdrlen % 4;
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padsize = padpos & 3;
+        if (padsize && skb->len>padpos) {
                 if (skb_headroom(skb) < padsize)
                         return -1;
                 skb_push(skb, padsize);
-                memmove(skb->data, skb->data + padsize, hdrlen);
+                memmove(skb->data, skb->data + padsize, padpos);
         }
 
         /* Check if a tx queue is available */
@@ -2106,10 +1289,10 @@ static int ath9k_tx(struct ieee80211_hw *hw,
         if (!txctl.txq)
                 goto exit;
 
-        DPRINTF(sc, ATH_DBG_XMIT, "transmitting packet, skb: %p\n", skb);
+        ath_print(common, ATH_DBG_XMIT, "transmitting packet, skb: %p\n", skb);
 
         if (ath_tx_start(hw, skb, &txctl) != 0) {
-                DPRINTF(sc, ATH_DBG_XMIT, "TX failed\n");
+                ath_print(common, ATH_DBG_XMIT, "TX failed\n");
                 goto exit;
         }
 
@@ -2123,6 +1306,8 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
 
         mutex_lock(&sc->mutex);
 
@@ -2137,7 +1322,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         }
 
         if (sc->sc_flags & SC_OP_INVALID) {
-                DPRINTF(sc, ATH_DBG_ANY, "Device not present\n");
+                ath_print(common, ATH_DBG_ANY, "Device not present\n");
                 mutex_unlock(&sc->mutex);
                 return;
         }
@@ -2147,41 +1332,48 @@ static void ath9k_stop(struct ieee80211_hw *hw)
                 return; /* another wiphy still in use */
         }
 
-        if (sc->sc_flags & SC_OP_BTCOEX_ENABLED) {
-                ath9k_hw_btcoex_disable(sc->sc_ah);
-                if (sc->btcoex_info.btcoex_scheme == ATH_BTCOEX_CFG_3WIRE)
-                        ath_btcoex_timer_pause(sc, &sc->btcoex_info);
+        /* Ensure HW is awake when we try to shut it down. */
+        ath9k_ps_wakeup(sc);
+
+        if (ah->btcoex_hw.enabled) {
+                ath9k_hw_btcoex_disable(ah);
+                if (ah->btcoex_hw.scheme == ATH_BTCOEX_CFG_3WIRE)
+                        ath9k_btcoex_timer_pause(sc);
         }
 
         /* make sure h/w will not generate any interrupt
          * before setting the invalid flag. */
-        ath9k_hw_set_interrupts(sc->sc_ah, 0);
+        ath9k_hw_set_interrupts(ah, 0);
 
         if (!(sc->sc_flags & SC_OP_INVALID)) {
                 ath_drain_all_txq(sc, false);
                 ath_stoprecv(sc);
-                ath9k_hw_phy_disable(sc->sc_ah);
+                ath9k_hw_phy_disable(ah);
         } else
                 sc->rx.rxlink = NULL;
 
         /* disable HAL and put h/w to sleep */
-        ath9k_hw_disable(sc->sc_ah);
-        ath9k_hw_configpcipowersave(sc->sc_ah, 1, 1);
-        ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
+        ath9k_hw_disable(ah);
+        ath9k_hw_configpcipowersave(ah, 1, 1);
+        ath9k_ps_restore(sc);
+
+        /* Finally, put the chip in FULL SLEEP mode */
+        ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
 
         sc->sc_flags |= SC_OP_INVALID;
 
         mutex_unlock(&sc->mutex);
 
-        DPRINTF(sc, ATH_DBG_CONFIG, "Driver halt\n");
+        ath_print(common, ATH_DBG_CONFIG, "Driver halt\n");
 }
 
 static int ath9k_add_interface(struct ieee80211_hw *hw,
-                               struct ieee80211_if_init_conf *conf)
+                               struct ieee80211_vif *vif)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
-        struct ath_vif *avp = (void *)conf->vif->drv_priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_vif *avp = (void *)vif->drv_priv;
         enum nl80211_iftype ic_opmode = NL80211_IFTYPE_UNSPECIFIED;
         int ret = 0;
 
@@ -2193,7 +1385,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                 goto out;
         }
 
-        switch (conf->type) {
+        switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 ic_opmode = NL80211_IFTYPE_STATION;
                 break;
@@ -2204,16 +1396,17 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                         ret = -ENOBUFS;
                         goto out;
                 }
-                ic_opmode = conf->type;
+                ic_opmode = vif->type;
                 break;
         default:
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Interface type %d not yet supported\n", conf->type);
+                ath_print(common, ATH_DBG_FATAL,
+                        "Interface type %d not yet supported\n", vif->type);
                 ret = -EOPNOTSUPP;
                 goto out;
         }
 
-        DPRINTF(sc, ATH_DBG_CONFIG, "Attach a VIF of type: %d\n", ic_opmode);
+        ath_print(common, ATH_DBG_CONFIG,
+                  "Attach a VIF of type: %d\n", ic_opmode);
 
         /* Set the VIF opmode */
         avp->av_opmode = ic_opmode;
@@ -2239,19 +1432,19 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
          * Enable MIB interrupts when there are hardware phy counters.
          * Note we only do this (at the moment) for station mode.
          */
-        if ((conf->type == NL80211_IFTYPE_STATION) ||
-            (conf->type == NL80211_IFTYPE_ADHOC) ||
-            (conf->type == NL80211_IFTYPE_MESH_POINT)) {
+        if ((vif->type == NL80211_IFTYPE_STATION) ||
+            (vif->type == NL80211_IFTYPE_ADHOC) ||
+            (vif->type == NL80211_IFTYPE_MESH_POINT)) {
                 sc->imask |= ATH9K_INT_MIB;
                 sc->imask |= ATH9K_INT_TSFOOR;
         }
 
         ath9k_hw_set_interrupts(sc->sc_ah, sc->imask);
 
-        if (conf->type == NL80211_IFTYPE_AP    ||
-            conf->type == NL80211_IFTYPE_ADHOC ||
-            conf->type == NL80211_IFTYPE_MONITOR)
-                ath_start_ani(sc);
+        if (vif->type == NL80211_IFTYPE_AP    ||
+            vif->type == NL80211_IFTYPE_ADHOC ||
+            vif->type == NL80211_IFTYPE_MONITOR)
+                ath_start_ani(common);
 
 out:
         mutex_unlock(&sc->mutex);
@@ -2259,32 +1452,35 @@ out:
 }
 
 static void ath9k_remove_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_if_init_conf *conf)
+                                   struct ieee80211_vif *vif)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
-        struct ath_vif *avp = (void *)conf->vif->drv_priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_vif *avp = (void *)vif->drv_priv;
         int i;
 
-        DPRINTF(sc, ATH_DBG_CONFIG, "Detach Interface\n");
+        ath_print(common, ATH_DBG_CONFIG, "Detach Interface\n");
 
         mutex_lock(&sc->mutex);
 
         /* Stop ANI */
-        del_timer_sync(&sc->ani.timer);
+        del_timer_sync(&common->ani.timer);
 
         /* Reclaim beacon resources */
         if ((sc->sc_ah->opmode == NL80211_IFTYPE_AP) ||
             (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC) ||
             (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT)) {
+                ath9k_ps_wakeup(sc);
                 ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
-                ath_beacon_return(sc, avp);
+                ath9k_ps_restore(sc);
         }
 
+        ath_beacon_return(sc, avp);
         sc->sc_flags &= ~SC_OP_BEACONS;
 
         for (i = 0; i < ARRAY_SIZE(sc->beacon.bslot); i++) {
-                if (sc->beacon.bslot[i] == conf->vif) {
+                if (sc->beacon.bslot[i] == vif) {
                         printk(KERN_DEBUG "%s: vif had allocated beacon "
                                "slot\n", __func__);
                         sc->beacon.bslot[i] = NULL;
@@ -2297,56 +1493,92 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
         mutex_unlock(&sc->mutex);
 }
 
+void ath9k_enable_ps(struct ath_softc *sc)
+{
+        sc->ps_enabled = true;
+        if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
+                if ((sc->imask & ATH9K_INT_TIM_TIMER) == 0) {
+                        sc->imask |= ATH9K_INT_TIM_TIMER;
+                        ath9k_hw_set_interrupts(sc->sc_ah,
+                                        sc->imask);
+                }
+        }
+        ath9k_hw_setrxabort(sc->sc_ah, 1);
+}
+
 static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ieee80211_conf *conf = &hw->conf;
         struct ath_hw *ah = sc->sc_ah;
-        bool all_wiphys_idle = false, disable_radio = false;
+        bool disable_radio;
 
         mutex_lock(&sc->mutex);
 
-        /* Leave this as the first check */
+        /*
+         * Leave this as the first check because we need to turn on the
+         * radio if it was disabled before prior to processing the rest
+         * of the changes. Likewise we must only disable the radio towards
+         * the end.
+         */
         if (changed & IEEE80211_CONF_CHANGE_IDLE) {
+                bool enable_radio;
+                bool all_wiphys_idle;
+                bool idle = !!(conf->flags & IEEE80211_CONF_IDLE);
 
                 spin_lock_bh(&sc->wiphy_lock);
                 all_wiphys_idle =  ath9k_all_wiphys_idle(sc);
+                ath9k_set_wiphy_idle(aphy, idle);
+
+                enable_radio = (!idle && all_wiphys_idle);
+
+                /*
+                 * After we unlock here its possible another wiphy
+                 * can be re-renabled so to account for that we will
+                 * only disable the radio toward the end of this routine
+                 * if by then all wiphys are still idle.
+                 */
                 spin_unlock_bh(&sc->wiphy_lock);
 
-                if (conf->flags & IEEE80211_CONF_IDLE){
-                        if (all_wiphys_idle)
-                                disable_radio = true;
-                }
-                else if (all_wiphys_idle) {
-                        ath_radio_enable(sc);
-                        DPRINTF(sc, ATH_DBG_CONFIG,
-                                "not-idle: enabling radio\n");
+                if (enable_radio) {
+                        sc->ps_idle = false;
+                        ath_radio_enable(sc, hw);
+                        ath_print(common, ATH_DBG_CONFIG,
+                                  "not-idle: enabling radio\n");
                 }
         }
 
+        /*
+         * We just prepare to enable PS. We have to wait until our AP has
+         * ACK'd our null data frame to disable RX otherwise we'll ignore
+         * those ACKs and end up retransmitting the same null data frames.
+         * IEEE80211_CONF_CHANGE_PS is only passed by mac80211 for STA mode.
+         */
         if (changed & IEEE80211_CONF_CHANGE_PS) {
                 if (conf->flags & IEEE80211_CONF_PS) {
-                        if (!(ah->caps.hw_caps &
-                              ATH9K_HW_CAP_AUTOSLEEP)) {
-                                if ((sc->imask & ATH9K_INT_TIM_TIMER) == 0) {
-                                        sc->imask |= ATH9K_INT_TIM_TIMER;
-                                        ath9k_hw_set_interrupts(sc->sc_ah,
-                                                        sc->imask);
-                                }
-                                ath9k_hw_setrxabort(sc->sc_ah, 1);
-                        }
-                        sc->ps_enabled = true;
+                        sc->ps_flags |= PS_ENABLED;
+                        /*
+                         * At this point we know hardware has received an ACK
+                         * of a previously sent null data frame.
+                         */
+                        if ((sc->ps_flags & PS_NULLFUNC_COMPLETED)) {
+                                sc->ps_flags &= ~PS_NULLFUNC_COMPLETED;
+                                ath9k_enable_ps(sc);
+                        }
                 } else {
                         sc->ps_enabled = false;
-                        ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
+                        sc->ps_flags &= ~(PS_ENABLED |
+                                          PS_NULLFUNC_COMPLETED);
+                        ath9k_setpower(sc, ATH9K_PM_AWAKE);
                         if (!(ah->caps.hw_caps &
                               ATH9K_HW_CAP_AUTOSLEEP)) {
                                 ath9k_hw_setrxabort(sc->sc_ah, 0);
-                                sc->sc_flags &= ~(SC_OP_WAIT_FOR_BEACON |
-                                                  SC_OP_WAIT_FOR_CAB |
-                                                  SC_OP_WAIT_FOR_PSPOLL_DATA |
-                                                  SC_OP_WAIT_FOR_TX_ACK);
+                                sc->ps_flags &= ~(PS_WAIT_FOR_BEACON |
+                                                  PS_WAIT_FOR_CAB |
+                                                  PS_WAIT_FOR_PSPOLL_DATA |
+                                                  PS_WAIT_FOR_TX_ACK);
                                 if (sc->imask & ATH9K_INT_TIM_TIMER) {
                                         sc->imask &= ~ATH9K_INT_TIM_TIMER;
                                         ath9k_hw_set_interrupts(sc->sc_ah,
@@ -2356,6 +1588,14 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                 }
         }
 
+        if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
+                if (conf->flags & IEEE80211_CONF_MONITOR) {
+                        ath_print(common, ATH_DBG_CONFIG,
+                                  "HW opmode set to Monitor mode\n");
+                        sc->sc_ah->opmode = NL80211_IFTYPE_MONITOR;
+                }
+        }
+
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
                 struct ieee80211_channel *curchan = hw->conf.channel;
                 int pos = curchan->hw_value;
@@ -2374,8 +1614,8 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                         goto skip_chan_change;
                 }
 
-                DPRINTF(sc, ATH_DBG_CONFIG, "Set channel: %d MHz\n",
-                        curchan->center_freq);
+                ath_print(common, ATH_DBG_CONFIG, "Set channel: %d MHz\n",
+                          curchan->center_freq);
 
                 /* XXX: remove me eventualy */
                 ath9k_update_ichannel(sc, hw, &sc->sc_ah->channels[pos]);
@@ -2383,19 +1623,27 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                 ath_update_chainmask(sc, conf_is_ht(conf));
 
                 if (ath_set_channel(sc, hw, &sc->sc_ah->channels[pos]) < 0) {
-                        DPRINTF(sc, ATH_DBG_FATAL, "Unable to set channel\n");
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "Unable to set channel\n");
                         mutex_unlock(&sc->mutex);
                         return -EINVAL;
                 }
         }
 
 skip_chan_change:
-        if (changed & IEEE80211_CONF_CHANGE_POWER)
+        if (changed & IEEE80211_CONF_CHANGE_POWER) {
                 sc->config.txpowlimit = 2 * conf->power_level;
+                ath_update_txpow(sc);
+        }
+
+        spin_lock_bh(&sc->wiphy_lock);
+        disable_radio = ath9k_all_wiphys_idle(sc);
+        spin_unlock_bh(&sc->wiphy_lock);
 
         if (disable_radio) {
-                DPRINTF(sc, ATH_DBG_CONFIG, "idle: disabling radio\n");
-                ath_radio_disable(sc);
+                ath_print(common, ATH_DBG_CONFIG, "idle: disabling radio\n");
+                sc->ps_idle = true;
+                ath_radio_disable(sc, hw);
         }
 
         mutex_unlock(&sc->mutex);
@@ -2431,27 +1679,32 @@ static void ath9k_configure_filter(struct ieee80211_hw *hw,
         ath9k_hw_setrxfilter(sc->sc_ah, rfilt);
         ath9k_ps_restore(sc);
 
-        DPRINTF(sc, ATH_DBG_CONFIG, "Set HW RX filter: 0x%x\n", rfilt);
+        ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_CONFIG,
+                  "Set HW RX filter: 0x%x\n", rfilt);
 }
 
-static void ath9k_sta_notify(struct ieee80211_hw *hw,
-                             struct ieee80211_vif *vif,
-                             enum sta_notify_cmd cmd,
-                             struct ieee80211_sta *sta)
+static int ath9k_sta_add(struct ieee80211_hw *hw,
+                         struct ieee80211_vif *vif,
+                         struct ieee80211_sta *sta)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
 
-        switch (cmd) {
-        case STA_NOTIFY_ADD:
-                ath_node_attach(sc, sta);
-                break;
-        case STA_NOTIFY_REMOVE:
-                ath_node_detach(sc, sta);
-                break;
-        default:
-                break;
-        }
+        ath_node_attach(sc, sta);
+
+        return 0;
+}
+
+static int ath9k_sta_remove(struct ieee80211_hw *hw,
+                            struct ieee80211_vif *vif,
+                            struct ieee80211_sta *sta)
+{
+        struct ath_wiphy *aphy = hw->priv;
+        struct ath_softc *sc = aphy->sc;
+
+        ath_node_detach(sc, sta);
+
+        return 0;
 }
 
 static int ath9k_conf_tx(struct ieee80211_hw *hw, u16 queue,
@@ -2459,6 +1712,7 @@ static int ath9k_conf_tx(struct ieee80211_hw *hw, u16 queue,
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath9k_tx_queue_info qi;
         int ret = 0, qnum;
 
@@ -2475,15 +1729,19 @@ static int ath9k_conf_tx(struct ieee80211_hw *hw, u16 queue,
         qi.tqi_burstTime = params->txop;
         qnum = ath_get_hal_qnum(queue, sc);
 
-        DPRINTF(sc, ATH_DBG_CONFIG,
-                "Configure tx [queue/halq] [%d/%d],  "
-                "aifs: %d, cw_min: %d, cw_max: %d, txop: %d\n",
-                queue, qnum, params->aifs, params->cw_min,
-                params->cw_max, params->txop);
+        ath_print(common, ATH_DBG_CONFIG,
+                  "Configure tx [queue/halq] [%d/%d],  "
+                  "aifs: %d, cw_min: %d, cw_max: %d, txop: %d\n",
+                  queue, qnum, params->aifs, params->cw_min,
+                  params->cw_max, params->txop);
 
         ret = ath_txq_update(sc, qnum, &qi);
         if (ret)
-                DPRINTF(sc, ATH_DBG_FATAL, "TXQ Update failed\n");
+                ath_print(common, ATH_DBG_FATAL, "TXQ Update failed\n");
+
+        if (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC)
+                if ((qnum == sc->tx.hwq_map[ATH9K_WME_AC_BE]) && !ret)
+                        ath_beaconq_config(sc);
 
         mutex_unlock(&sc->mutex);
 
@@ -2498,6 +1756,7 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         int ret = 0;
 
         if (modparam_nohwcrypt)
@@ -2505,11 +1764,11 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
 
         mutex_lock(&sc->mutex);
         ath9k_ps_wakeup(sc);
-        DPRINTF(sc, ATH_DBG_CONFIG, "Set HW Key\n");
+        ath_print(common, ATH_DBG_CONFIG, "Set HW Key\n");
 
         switch (cmd) {
         case SET_KEY:
-                ret = ath_key_config(sc, vif, sta, key);
+                ret = ath_key_config(common, vif, sta, key);
                 if (ret >= 0) {
                         key->hw_key_idx = ret;
                         /* push IV and Michael MIC generation to stack */
@@ -2522,7 +1781,7 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
                 }
                 break;
         case DISABLE_KEY:
-                ath_key_delete(sc, key);
+                ath_key_delete(common, key);
                 break;
         default:
                 ret = -EINVAL;
@@ -2542,94 +1801,87 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_vif *avp = (void *)vif->drv_priv;
-        u32 rfilt = 0;
-        int error, i;
+        int slottime;
+        int error;
 
         mutex_lock(&sc->mutex);
 
-        /*
-         * TODO: Need to decide which hw opmode to use for
-         *       multi-interface cases
-         * XXX: This belongs into add_interface!
-         */
-        if (vif->type == NL80211_IFTYPE_AP &&
-            ah->opmode != NL80211_IFTYPE_AP) {
-                ah->opmode = NL80211_IFTYPE_STATION;
-                ath9k_hw_setopmode(ah);
-                memcpy(sc->curbssid, sc->sc_ah->macaddr, ETH_ALEN);
-                sc->curaid = 0;
-                ath9k_hw_write_associd(sc);
-                /* Request full reset to get hw opmode changed properly */
-                sc->sc_flags |= SC_OP_FULL_RESET;
-        }
-
-        if ((changed & BSS_CHANGED_BSSID) &&
-            !is_zero_ether_addr(bss_conf->bssid)) {
-                switch (vif->type) {
-                case NL80211_IFTYPE_STATION:
-                case NL80211_IFTYPE_ADHOC:
-                case NL80211_IFTYPE_MESH_POINT:
-                        /* Set BSSID */
-                        memcpy(sc->curbssid, bss_conf->bssid, ETH_ALEN);
-                        memcpy(avp->bssid, bss_conf->bssid, ETH_ALEN);
-                        sc->curaid = 0;
-                        ath9k_hw_write_associd(sc);
-
-                        /* Set aggregation protection mode parameters */
-                        sc->config.ath_aggr_prot = 0;
-
-                        DPRINTF(sc, ATH_DBG_CONFIG,
-                                "RX filter 0x%x bssid %pM aid 0x%x\n",
-                                rfilt, sc->curbssid, sc->curaid);
-
-                        /* need to reconfigure the beacon */
-                        sc->sc_flags &= ~SC_OP_BEACONS ;
+        if (changed & BSS_CHANGED_BSSID) {
+                /* Set BSSID */
+                memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
+                memcpy(avp->bssid, bss_conf->bssid, ETH_ALEN);
+                common->curaid = 0;
+                ath9k_hw_write_associd(ah);
 
-                        break;
-                default:
-                        break;
-                }
+                /* Set aggregation protection mode parameters */
+                sc->config.ath_aggr_prot = 0;
+
+                /* Only legacy IBSS for now */
+                if (vif->type == NL80211_IFTYPE_ADHOC)
+                        ath_update_chainmask(sc, 0);
+
+                ath_print(common, ATH_DBG_CONFIG,
+                          "BSSID: %pM aid: 0x%x\n",
+                          common->curbssid, common->curaid);
+
+                /* need to reconfigure the beacon */
+                sc->sc_flags &= ~SC_OP_BEACONS ;
         }
 
-        if ((vif->type == NL80211_IFTYPE_ADHOC) ||
-            (vif->type == NL80211_IFTYPE_AP) ||
-            (vif->type == NL80211_IFTYPE_MESH_POINT)) {
-                if ((changed & BSS_CHANGED_BEACON) ||
-                    (changed & BSS_CHANGED_BEACON_ENABLED &&
-                     bss_conf->enable_beacon)) {
+        /* Enable transmission of beacons (AP, IBSS, MESH) */
+        if ((changed & BSS_CHANGED_BEACON) ||
+            ((changed & BSS_CHANGED_BEACON_ENABLED) && bss_conf->enable_beacon)) {
+                ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
+                error = ath_beacon_alloc(aphy, vif);
+                if (!error)
+                        ath_beacon_config(sc, vif);
+        }
+
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                if (bss_conf->use_short_slot)
+                        slottime = 9;
+                else
+                        slottime = 20;
+                if (vif->type == NL80211_IFTYPE_AP) {
                         /*
-                         * Allocate and setup the beacon frame.
-                         *
-                         * Stop any previous beacon DMA.  This may be
-                         * necessary, for example, when an ibss merge
-                         * causes reconfiguration; we may be called
-                         * with beacon transmission active.
+                         * Defer update, so that connected stations can adjust
+                         * their settings at the same time.
+                         * See beacon.c for more details
                          */
-                        ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
+                        sc->beacon.slottime = slottime;
+                        sc->beacon.updateslot = UPDATE;
+                } else {
+                        ah->slottime = slottime;
+                        ath9k_hw_init_global_settings(ah);
+                }
+        }
+
+        /* Disable transmission of beacons */
+        if ((changed & BSS_CHANGED_BEACON_ENABLED) && !bss_conf->enable_beacon)
+                ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
 
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                sc->beacon_interval = bss_conf->beacon_int;
+                /*
+                 * In case of AP mode, the HW TSF has to be reset
+                 * when the beacon interval changes.
+                 */
+                if (vif->type == NL80211_IFTYPE_AP) {
+                        sc->sc_flags |= SC_OP_TSF_RESET;
+                        ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
                         error = ath_beacon_alloc(aphy, vif);
                         if (!error)
                                 ath_beacon_config(sc, vif);
+                } else {
+                        ath_beacon_config(sc, vif);
                 }
         }
 
-        /* Check for WLAN_CAPABILITY_PRIVACY ? */
-        if ((avp->av_opmode != NL80211_IFTYPE_STATION)) {
-                for (i = 0; i < IEEE80211_WEP_NKID; i++)
-                        if (ath9k_hw_keyisvalid(sc->sc_ah, (u16)i))
-                                ath9k_hw_keysetmac(sc->sc_ah,
-                                                   (u16)i,
-                                                   sc->curbssid);
-        }
-
-        /* Only legacy IBSS for now */
-        if (vif->type == NL80211_IFTYPE_ADHOC)
-                ath_update_chainmask(sc, 0);
-
         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
-                DPRINTF(sc, ATH_DBG_CONFIG, "BSS Changed PREAMBLE %d\n",
-                        bss_conf->use_short_preamble);
+                ath_print(common, ATH_DBG_CONFIG, "BSS Changed PREAMBLE %d\n",
+                          bss_conf->use_short_preamble);
                 if (bss_conf->use_short_preamble)
                         sc->sc_flags |= SC_OP_PREAMBLE_SHORT;
                 else
@@ -2637,8 +1889,8 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (changed & BSS_CHANGED_ERP_CTS_PROT) {
-                DPRINTF(sc, ATH_DBG_CONFIG, "BSS Changed CTS PROT %d\n",
-                        bss_conf->use_cts_prot);
+                ath_print(common, ATH_DBG_CONFIG, "BSS Changed CTS PROT %d\n",
+                          bss_conf->use_cts_prot);
                 if (bss_conf->use_cts_prot &&
                     hw->conf.channel->band != IEEE80211_BAND_5GHZ)
                         sc->sc_flags |= SC_OP_PROTECT_ENABLE;
@@ -2647,23 +1899,11 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (changed & BSS_CHANGED_ASSOC) {
-                DPRINTF(sc, ATH_DBG_CONFIG, "BSS Changed ASSOC %d\n",
+                ath_print(common, ATH_DBG_CONFIG, "BSS Changed ASSOC %d\n",
                         bss_conf->assoc);
                 ath9k_bss_assoc_info(sc, vif, bss_conf);
         }
 
-        /*
-         * The HW TSF has to be reset when the beacon interval changes.
-         * We set the flag here, and ath_beacon_config_ap() would take this
-         * into account when it gets called through the subsequent
-         * config_interface() call - with IFCC_BEACON in the changed field.
-         */
-
-        if (changed & BSS_CHANGED_BEACON_INT) {
-                sc->sc_flags |= SC_OP_TSF_RESET;
-                sc->beacon_interval = bss_conf->beacon_int;
-        }
-
         mutex_unlock(&sc->mutex);
 }
 
@@ -2696,11 +1936,16 @@ static void ath9k_reset_tsf(struct ieee80211_hw *hw)
         struct ath_softc *sc = aphy->sc;
 
         mutex_lock(&sc->mutex);
+
+        ath9k_ps_wakeup(sc);
         ath9k_hw_reset_tsf(sc->sc_ah);
+        ath9k_ps_restore(sc);
+
         mutex_unlock(&sc->mutex);
 }
 
 static int ath9k_ampdu_action(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
                               enum ieee80211_ampdu_mlme_action action,
                               struct ieee80211_sta *sta,
                               u16 tid, u16 *ssn)
@@ -2717,18 +1962,25 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_RX_STOP:
                 break;
         case IEEE80211_AMPDU_TX_START:
+                ath9k_ps_wakeup(sc);
                 ath_tx_aggr_start(sc, sta, tid, ssn);
-                ieee80211_start_tx_ba_cb_irqsafe(hw, sta->addr, tid);
+                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                ath9k_ps_restore(sc);
                 break;
         case IEEE80211_AMPDU_TX_STOP:
+                ath9k_ps_wakeup(sc);
                 ath_tx_aggr_stop(sc, sta, tid);
-                ieee80211_stop_tx_ba_cb_irqsafe(hw, sta->addr, tid);
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                ath9k_ps_restore(sc);
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
+                ath9k_ps_wakeup(sc);
                 ath_tx_aggr_resume(sc, sta, tid);
+                ath9k_ps_restore(sc);
                 break;
         default:
-                DPRINTF(sc, ATH_DBG_FATAL, "Unknown AMPDU action\n");
+                ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
+                          "Unknown AMPDU action\n");
         }
 
         return ret;
@@ -2738,6 +1990,7 @@ static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
         mutex_lock(&sc->mutex);
         if (ath9k_wiphy_scanning(sc)) {
@@ -2753,10 +2006,9 @@ static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
 
         aphy->state = ATH_WIPHY_SCAN;
         ath9k_wiphy_pause_all_forced(sc, aphy);
-
-        spin_lock_bh(&sc->ani_lock);
         sc->sc_flags |= SC_OP_SCANNING;
-        spin_unlock_bh(&sc->ani_lock);
+        del_timer_sync(&common->ani.timer);
+        cancel_delayed_work_sync(&sc->tx_complete_work);
         mutex_unlock(&sc->mutex);
 }
 
@@ -2764,17 +2016,30 @@ static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
         mutex_lock(&sc->mutex);
-        spin_lock_bh(&sc->ani_lock);
         aphy->state = ATH_WIPHY_ACTIVE;
         sc->sc_flags &= ~SC_OP_SCANNING;
         sc->sc_flags |= SC_OP_FULL_RESET;
-        spin_unlock_bh(&sc->ani_lock);
+        ath_start_ani(common);
+        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
         ath_beacon_config(sc, NULL);
         mutex_unlock(&sc->mutex);
 }
 
+static void ath9k_set_coverage_class(struct ieee80211_hw *hw, u8 coverage_class)
+{
+        struct ath_wiphy *aphy = hw->priv;
+        struct ath_softc *sc = aphy->sc;
+        struct ath_hw *ah = sc->sc_ah;
+
+        mutex_lock(&sc->mutex);
+        ah->coverage_class = coverage_class;
+        ath9k_hw_init_global_settings(ah);
+        mutex_unlock(&sc->mutex);
+}
+
 struct ieee80211_ops ath9k_ops = {
         .tx                 = ath9k_tx,
         .start              = ath9k_start,
@@ -2783,7 +2048,8 @@ struct ieee80211_ops ath9k_ops = {
         .remove_interface   = ath9k_remove_interface,
         .config             = ath9k_config,
         .configure_filter   = ath9k_configure_filter,
-        .sta_notify         = ath9k_sta_notify,
+        .sta_add            = ath9k_sta_add,
+        .sta_remove         = ath9k_sta_remove,
         .conf_tx            = ath9k_conf_tx,
         .bss_info_changed   = ath9k_bss_info_changed,
         .set_key            = ath9k_set_key,
@@ -2794,122 +2060,5 @@ struct ieee80211_ops ath9k_ops = {
         .sw_scan_start      = ath9k_sw_scan_start,
         .sw_scan_complete   = ath9k_sw_scan_complete,
         .rfkill_poll        = ath9k_rfkill_poll_state,
+        .set_coverage_class = ath9k_set_coverage_class,
 };
-
-static struct {
-        u32 version;
-        const char * name;
-} ath_mac_bb_names[] = {
-        { AR_SREV_VERSION_5416_PCI,     "5416" },
-        { AR_SREV_VERSION_5416_PCIE,    "5418" },
-        { AR_SREV_VERSION_9100,         "9100" },
-        { AR_SREV_VERSION_9160,         "9160" },
-        { AR_SREV_VERSION_9280,         "9280" },
-        { AR_SREV_VERSION_9285,         "9285" },
-        { AR_SREV_VERSION_9287,         "9287" }
-};
-
-static struct {
-        u16 version;
-        const char * name;
-} ath_rf_names[] = {
-        { 0,                            "5133" },
-        { AR_RAD5133_SREV_MAJOR,        "5133" },
-        { AR_RAD5122_SREV_MAJOR,        "5122" },
-        { AR_RAD2133_SREV_MAJOR,        "2133" },
-        { AR_RAD2122_SREV_MAJOR,        "2122" }
-};
-
-/*
- * Return the MAC/BB name. "????" is returned if the MAC/BB is unknown.
- */
-const char *
-ath_mac_bb_name(u32 mac_bb_version)
-{
-        int i;
-
-        for (i=0; i<ARRAY_SIZE(ath_mac_bb_names); i++) {
-                if (ath_mac_bb_names[i].version == mac_bb_version) {
-                        return ath_mac_bb_names[i].name;
-                }
-        }
-
-        return "????";
-}
-
-/*
- * Return the RF name. "????" is returned if the RF is unknown.
- */
-const char *
-ath_rf_name(u16 rf_version)
-{
-        int i;
-
-        for (i=0; i<ARRAY_SIZE(ath_rf_names); i++) {
-                if (ath_rf_names[i].version == rf_version) {
-                        return ath_rf_names[i].name;
-                }
-        }
-
-        return "????";
-}
-
-static int __init ath9k_init(void)
-{
-        int error;
-
-        /* Register rate control algorithm */
-        error = ath_rate_control_register();
-        if (error != 0) {
-                printk(KERN_ERR
-                        "ath9k: Unable to register rate control "
-                        "algorithm: %d\n",
-                        error);
-                goto err_out;
-        }
-
-        error = ath9k_debug_create_root();
-        if (error) {
-                printk(KERN_ERR
-                        "ath9k: Unable to create debugfs root: %d\n",
-                        error);
-                goto err_rate_unregister;
-        }
-
-        error = ath_pci_init();
-        if (error < 0) {
-                printk(KERN_ERR
-                        "ath9k: No PCI devices found, driver not installed.\n");
-                error = -ENODEV;
-                goto err_remove_root;
-        }
-
-        error = ath_ahb_init();
-        if (error < 0) {
-                error = -ENODEV;
-                goto err_pci_exit;
-        }
-
-        return 0;
-
- err_pci_exit:
-        ath_pci_exit();
-
- err_remove_root:
-        ath9k_debug_remove_root();
- err_rate_unregister:
-        ath_rate_control_unregister();
- err_out:
-        return error;
-}
-module_init(ath9k_init);
-
-static void __exit ath9k_exit(void)
-{
-        ath_ahb_exit();
-        ath_pci_exit();
-        ath9k_debug_remove_root();
-        ath_rate_control_unregister();
-        printk(KERN_INFO "%s: Driver unloaded\n", dev_info);
-}
-module_exit(ath9k_exit);
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 903dd8ad9d43..9441c6718a30 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -18,21 +18,23 @@
 #include <linux/pci.h>
 #include "ath9k.h"
 
-static struct pci_device_id ath_pci_id_table[] __devinitdata = {
+static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
         { PCI_VDEVICE(ATHEROS, 0x0023) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */
         { PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
         { PCI_VDEVICE(ATHEROS, 0x002B) }, /* PCI-E */
+        { PCI_VDEVICE(ATHEROS, 0x002C) }, /* PCI-E 802.11n bonded out */
         { PCI_VDEVICE(ATHEROS, 0x002D) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x002E) }, /* PCI-E */
         { 0 }
 };
 
 /* return bus cachesize in 4B word units */
-static void ath_pci_read_cachesize(struct ath_softc *sc, int *csz)
+static void ath_pci_read_cachesize(struct ath_common *common, int *csz)
 {
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
         u8 u8tmp;
 
         pci_read_config_byte(to_pci_dev(sc->dev), PCI_CACHE_LINE_SIZE, &u8tmp);
@@ -48,18 +50,11 @@ static void ath_pci_read_cachesize(struct ath_softc *sc, int *csz)
                 *csz = DEFAULT_CACHELINE >> 2;   /* Use the default size */
 }
 
-static void ath_pci_cleanup(struct ath_softc *sc)
+static bool ath_pci_eeprom_read(struct ath_common *common, u32 off, u16 *data)
 {
-        struct pci_dev *pdev = to_pci_dev(sc->dev);
-
-        pci_iounmap(pdev, sc->mem);
-        pci_disable_device(pdev);
-        pci_release_region(pdev, 0);
-}
+        struct ath_hw *ah = (struct ath_hw *) common->ah;
 
-static bool ath_pci_eeprom_read(struct ath_hw *ah, u32 off, u16 *data)
-{
-        (void)REG_READ(ah, AR5416_EEPROM_OFFSET + (off << AR5416_EEPROM_S));
+        common->ops->read(ah, AR5416_EEPROM_OFFSET + (off << AR5416_EEPROM_S));
 
         if (!ath9k_hw_wait(ah,
                            AR_EEPROM_STATUS_DATA,
@@ -69,16 +64,33 @@ static bool ath_pci_eeprom_read(struct ath_hw *ah, u32 off, u16 *data)
                 return false;
         }
 
-        *data = MS(REG_READ(ah, AR_EEPROM_STATUS_DATA),
+        *data = MS(common->ops->read(ah, AR_EEPROM_STATUS_DATA),
                    AR_EEPROM_STATUS_DATA_VAL);
 
         return true;
 }
 
-static struct ath_bus_ops ath_pci_bus_ops = {
+/*
+ * Bluetooth coexistance requires disabling ASPM.
+ */
+static void ath_pci_bt_coex_prep(struct ath_common *common)
+{
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
+        struct pci_dev *pdev = to_pci_dev(sc->dev);
+        u8 aspm;
+
+        if (!pdev->is_pcie)
+                return;
+
+        pci_read_config_byte(pdev, ATH_PCIE_CAP_LINK_CTRL, &aspm);
+        aspm &= ~(ATH_PCIE_CAP_LINK_L0S | ATH_PCIE_CAP_LINK_L1);
+        pci_write_config_byte(pdev, ATH_PCIE_CAP_LINK_CTRL, aspm);
+}
+
+static const struct ath_bus_ops ath_pci_bus_ops = {
         .read_cachesize = ath_pci_read_cachesize,
-        .cleanup = ath_pci_cleanup,
         .eeprom_read = ath_pci_eeprom_read,
+        .bt_coex_prep = ath_pci_bt_coex_prep,
 };
 
 static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
@@ -91,24 +103,22 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         u16 subsysid;
         u32 val;
         int ret = 0;
-        struct ath_hw *ah;
+        char hw_name[64];
 
         if (pci_enable_device(pdev))
                 return -EIO;
 
         ret =  pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
-
         if (ret) {
                 printk(KERN_ERR "ath9k: 32-bit DMA not available\n");
-                goto bad;
+                goto err_dma;
         }
 
         ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
-
         if (ret) {
                 printk(KERN_ERR "ath9k: 32-bit DMA consistent "
                         "DMA enable failed\n");
-                goto bad;
+                goto err_dma;
         }
 
         /*
@@ -148,22 +158,22 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (ret) {
                 dev_err(&pdev->dev, "PCI memory region reserve error\n");
                 ret = -ENODEV;
-                goto bad;
+                goto err_region;
         }
 
         mem = pci_iomap(pdev, 0, 0);
         if (!mem) {
                 printk(KERN_ERR "PCI memory map error\n") ;
                 ret = -EIO;
-                goto bad1;
+                goto err_iomap;
         }
 
         hw = ieee80211_alloc_hw(sizeof(struct ath_wiphy) +
                                 sizeof(struct ath_softc), &ath9k_ops);
         if (!hw) {
-                dev_err(&pdev->dev, "no memory for ieee80211_hw\n");
+                dev_err(&pdev->dev, "No memory for ieee80211_hw\n");
                 ret = -ENOMEM;
-                goto bad2;
+                goto err_alloc_hw;
         }
 
         SET_IEEE80211_DEV(hw, &pdev->dev);
@@ -177,46 +187,45 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         sc->hw = hw;
         sc->dev = &pdev->dev;
         sc->mem = mem;
-        sc->bus_ops = &ath_pci_bus_ops;
 
-        pci_read_config_word(pdev, PCI_SUBSYSTEM_ID, &subsysid);
-        ret = ath_init_device(id->device, sc, subsysid);
-        if (ret) {
-                dev_err(&pdev->dev, "failed to initialize device\n");
-                goto bad3;
-        }
-
-        /* setup interrupt service routine */
+        /* Will be cleared in ath9k_start() */
+        sc->sc_flags |= SC_OP_INVALID;
 
         ret = request_irq(pdev->irq, ath_isr, IRQF_SHARED, "ath9k", sc);
         if (ret) {
                 dev_err(&pdev->dev, "request_irq failed\n");
-                goto bad4;
+                goto err_irq;
         }
 
         sc->irq = pdev->irq;
 
-        ah = sc->sc_ah;
+        pci_read_config_word(pdev, PCI_SUBSYSTEM_ID, &subsysid);
+        ret = ath9k_init_device(id->device, sc, subsysid, &ath_pci_bus_ops);
+        if (ret) {
+                dev_err(&pdev->dev, "Failed to initialize device\n");
+                goto err_init;
+        }
+
+        ath9k_hw_name(sc->sc_ah, hw_name, sizeof(hw_name));
         printk(KERN_INFO
-               "%s: Atheros AR%s MAC/BB Rev:%x "
-               "AR%s RF Rev:%x: mem=0x%lx, irq=%d\n",
+               "%s: %s mem=0x%lx, irq=%d\n",
                wiphy_name(hw->wiphy),
-               ath_mac_bb_name(ah->hw_version.macVersion),
-               ah->hw_version.macRev,
-               ath_rf_name((ah->hw_version.analog5GhzRev & AR_RADIO_SREV_MAJOR)),
-               ah->hw_version.phyRev,
+               hw_name,
                (unsigned long)mem, pdev->irq);
 
         return 0;
-bad4:
-        ath_detach(sc);
-bad3:
+
+err_init:
+        free_irq(sc->irq, sc);
+err_irq:
         ieee80211_free_hw(hw);
-bad2:
+err_alloc_hw:
         pci_iounmap(pdev, mem);
-bad1:
+err_iomap:
         pci_release_region(pdev, 0);
-bad:
+err_region:
+        /* Nothing */
+err_dma:
         pci_disable_device(pdev);
         return ret;
 }
@@ -226,8 +235,15 @@ static void ath_pci_remove(struct pci_dev *pdev)
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        void __iomem *mem = sc->mem;
+
+        ath9k_deinit_device(sc);
+        free_irq(sc->irq, sc);
+        ieee80211_free_hw(sc->hw);
 
-        ath_cleanup(sc);
+        pci_iounmap(pdev, mem);
+        pci_disable_device(pdev);
+        pci_release_region(pdev, 0);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/net/wireless/ath/ath9k/phy.c b/drivers/net/wireless/ath/ath9k/phy.c
index 63bf9a307c6a..2547b3c4a26c 100644
--- a/drivers/net/wireless/ath/ath9k/phy.c
+++ b/drivers/net/wireless/ath/ath9k/phy.c
@@ -14,90 +14,72 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include "ath9k.h"
-
-void
-ath9k_hw_write_regs(struct ath_hw *ah, u32 modesIndex, u32 freqIndex,
-                    int regWrites)
-{
-        REG_WRITE_ARRAY(&ah->iniBB_RfGain, freqIndex, regWrites);
-}
-
-bool
-ath9k_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        u32 channelSel = 0;
-        u32 bModeSynth = 0;
-        u32 aModeRefSel = 0;
-        u32 reg32 = 0;
-        u16 freq;
-        struct chan_centers centers;
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-        freq = centers.synth_center;
-
-        if (freq < 4800) {
-                u32 txctl;
-
-                if (((freq - 2192) % 5) == 0) {
-                        channelSel = ((freq - 672) * 2 - 3040) / 10;
-                        bModeSynth = 0;
-                } else if (((freq - 2224) % 5) == 0) {
-                        channelSel = ((freq - 704) * 2 - 3040) / 10;
-                        bModeSynth = 1;
-                } else {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "Invalid channel %u MHz\n", freq);
-                        return false;
-                }
-
-                channelSel = (channelSel << 2) & 0xff;
-                channelSel = ath9k_hw_reverse_bits(channelSel, 8);
-
-                txctl = REG_READ(ah, AR_PHY_CCK_TX_CTRL);
-                if (freq == 2484) {
-
-                        REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
-                                  txctl | AR_PHY_CCK_TX_CTRL_JAPAN);
-                } else {
-                        REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
-                                  txctl & ~AR_PHY_CCK_TX_CTRL_JAPAN);
-                }
-
-        } else if ((freq % 20) == 0 && freq >= 5120) {
-                channelSel =
-                    ath9k_hw_reverse_bits(((freq - 4800) / 20 << 2), 8);
-                aModeRefSel = ath9k_hw_reverse_bits(1, 2);
-        } else if ((freq % 10) == 0) {
-                channelSel =
-                    ath9k_hw_reverse_bits(((freq - 4800) / 10 << 1), 8);
-                if (AR_SREV_9100(ah) || AR_SREV_9160_10_OR_LATER(ah))
-                        aModeRefSel = ath9k_hw_reverse_bits(2, 2);
-                else
-                        aModeRefSel = ath9k_hw_reverse_bits(1, 2);
-        } else if ((freq % 5) == 0) {
-                channelSel = ath9k_hw_reverse_bits((freq - 4800) / 5, 8);
-                aModeRefSel = ath9k_hw_reverse_bits(1, 2);
-        } else {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Invalid channel %u MHz\n", freq);
-                return false;
-        }
-
-        reg32 =
-            (channelSel << 8) | (aModeRefSel << 2) | (bModeSynth << 1) |
-            (1 << 5) | 0x1;
+/**
+ * DOC: Programming Atheros 802.11n analog front end radios
+ *
+ * AR5416 MAC based PCI devices and AR518 MAC based PCI-Express
+ * devices have either an external AR2133 analog front end radio for single
+ * band 2.4 GHz communication or an AR5133 analog front end radio for dual
+ * band 2.4 GHz / 5 GHz communication.
+ *
+ * All devices after the AR5416 and AR5418 family starting with the AR9280
+ * have their analog front radios, MAC/BB and host PCIe/USB interface embedded
+ * into a single-chip and require less programming.
+ *
+ * The following single-chips exist with a respective embedded radio:
+ *
+ * AR9280 - 11n dual-band 2x2 MIMO for PCIe
+ * AR9281 - 11n single-band 1x2 MIMO for PCIe
+ * AR9285 - 11n single-band 1x1 for PCIe
+ * AR9287 - 11n single-band 2x2 MIMO for PCIe
+ *
+ * AR9220 - 11n dual-band 2x2 MIMO for PCI
+ * AR9223 - 11n single-band 2x2 MIMO for PCI
+ *
+ * AR9287 - 11n single-band 1x1 MIMO for USB
+ */
 
-        REG_WRITE(ah, AR_PHY(0x37), reg32);
+#include <linux/slab.h>
 
-        ah->curchan = chan;
-        ah->curchan_rad_index = -1;
+#include "hw.h"
 
-        return true;
+/**
+ * ath9k_hw_write_regs - ??
+ *
+ * @ah: atheros hardware structure
+ * @freqIndex:
+ * @regWrites:
+ *
+ * Used for both the chipsets with an external AR2133/AR5133 radios and
+ * single-chip devices.
+ */
+void ath9k_hw_write_regs(struct ath_hw *ah, u32 freqIndex, int regWrites)
+{
+        REG_WRITE_ARRAY(&ah->iniBB_RfGain, freqIndex, regWrites);
 }
 
-void ath9k_hw_ar9280_set_channel(struct ath_hw *ah,
-                                 struct ath9k_channel *chan)
+/**
+ * ath9k_hw_ar9280_set_channel - set channel on single-chip device
+ * @ah: atheros hardware structure
+ * @chan:
+ *
+ * This is the function to change channel on single-chip devices, that is
+ * all devices after ar9280.
+ *
+ * This function takes the channel value in MHz and sets
+ * hardware channel value. Assumes writes have been enabled to analog bus.
+ *
+ * Actual Expression,
+ *
+ * For 2GHz channel,
+ * Channel Frequency = (3/4) * freq_ref * (chansel[8:0] + chanfrac[16:0]/2^17)
+ * (freq_ref = 40MHz)
+ *
+ * For 5GHz channel,
+ * Channel Frequency = (3/2) * freq_ref * (chansel[8:0] + chanfrac[16:0]/2^10)
+ * (freq_ref = 40MHz/(24>>amodeRefSel))
+ */
+int ath9k_hw_ar9280_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
 {
         u16 bMode, fracMode, aModeRefSel = 0;
         u32 freq, ndiv, channelSel = 0, channelFrac = 0, reg32 = 0;
@@ -110,22 +92,34 @@ void ath9k_hw_ar9280_set_channel(struct ath_hw *ah,
         reg32 = REG_READ(ah, AR_PHY_SYNTH_CONTROL);
         reg32 &= 0xc0000000;
 
-        if (freq < 4800) {
+        if (freq < 4800) { /* 2 GHz, fractional mode */
                 u32 txctl;
+                int regWrites = 0;
 
                 bMode = 1;
                 fracMode = 1;
                 aModeRefSel = 0;
                 channelSel = (freq * 0x10000) / 15;
 
-                txctl = REG_READ(ah, AR_PHY_CCK_TX_CTRL);
-                if (freq == 2484) {
-
-                        REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
-                                  txctl | AR_PHY_CCK_TX_CTRL_JAPAN);
+                if (AR_SREV_9287_11_OR_LATER(ah)) {
+                        if (freq == 2484) {
+                                /* Enable channel spreading for channel 14 */
+                                REG_WRITE_ARRAY(&ah->iniCckfirJapan2484,
+                                                1, regWrites);
+                        } else {
+                                REG_WRITE_ARRAY(&ah->iniCckfirNormal,
+                                                1, regWrites);
+                        }
                 } else {
-                        REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
-                                  txctl & ~AR_PHY_CCK_TX_CTRL_JAPAN);
+                        txctl = REG_READ(ah, AR_PHY_CCK_TX_CTRL);
+                        if (freq == 2484) {
+                                /* Enable channel spreading for channel 14 */
+                                REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
+                                          txctl | AR_PHY_CCK_TX_CTRL_JAPAN);
+                        } else {
+                                REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
+                                          txctl &~ AR_PHY_CCK_TX_CTRL_JAPAN);
+                        }
                 }
         } else {
                 bMode = 0;
@@ -143,10 +137,15 @@ void ath9k_hw_ar9280_set_channel(struct ath_hw *ah,
                 case 1:
                 default:
                         aModeRefSel = 0;
+                        /*
+                         * Enable 2G (fractional) mode for channels
+                         * which are 5MHz spaced.
+                         */
                         fracMode = 1;
                         refDivA = 1;
                         channelSel = (freq * 0x8000) / 15;
 
+                        /* RefDivA setting */
                         REG_RMW_FIELD(ah, AR_AN_SYNTH9,
                                       AR_AN_SYNTH9_REFDIVA, refDivA);
 
@@ -168,12 +167,284 @@ void ath9k_hw_ar9280_set_channel(struct ath_hw *ah,
 
         ah->curchan = chan;
         ah->curchan_rad_index = -1;
+
+        return 0;
+}
+
+/**
+ * ath9k_hw_9280_spur_mitigate - convert baseband spur frequency
+ * @ah: atheros hardware structure
+ * @chan:
+ *
+ * For single-chip solutions. Converts to baseband spur frequency given the
+ * input channel frequency and compute register settings below.
+ */
+void ath9k_hw_9280_spur_mitigate(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        int bb_spur = AR_NO_SPUR;
+        int freq;
+        int bin, cur_bin;
+        int bb_spur_off, spur_subchannel_sd;
+        int spur_freq_sd;
+        int spur_delta_phase;
+        int denominator;
+        int upper, lower, cur_vit_mask;
+        int tmp, newVal;
+        int i;
+        int pilot_mask_reg[4] = { AR_PHY_TIMING7, AR_PHY_TIMING8,
+                          AR_PHY_PILOT_MASK_01_30, AR_PHY_PILOT_MASK_31_60
+        };
+        int chan_mask_reg[4] = { AR_PHY_TIMING9, AR_PHY_TIMING10,
+                         AR_PHY_CHANNEL_MASK_01_30, AR_PHY_CHANNEL_MASK_31_60
+        };
+        int inc[4] = { 0, 100, 0, 0 };
+        struct chan_centers centers;
+
+        int8_t mask_m[123];
+        int8_t mask_p[123];
+        int8_t mask_amt;
+        int tmp_mask;
+        int cur_bb_spur;
+        bool is2GHz = IS_CHAN_2GHZ(chan);
+
+        memset(&mask_m, 0, sizeof(int8_t) * 123);
+        memset(&mask_p, 0, sizeof(int8_t) * 123);
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+        freq = centers.synth_center;
+
+        ah->config.spurmode = SPUR_ENABLE_EEPROM;
+        for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
+                cur_bb_spur = ah->eep_ops->get_spur_channel(ah, i, is2GHz);
+
+                if (is2GHz)
+                        cur_bb_spur = (cur_bb_spur / 10) + AR_BASE_FREQ_2GHZ;
+                else
+                        cur_bb_spur = (cur_bb_spur / 10) + AR_BASE_FREQ_5GHZ;
+
+                if (AR_NO_SPUR == cur_bb_spur)
+                        break;
+                cur_bb_spur = cur_bb_spur - freq;
+
+                if (IS_CHAN_HT40(chan)) {
+                        if ((cur_bb_spur > -AR_SPUR_FEEQ_BOUND_HT40) &&
+                            (cur_bb_spur < AR_SPUR_FEEQ_BOUND_HT40)) {
+                                bb_spur = cur_bb_spur;
+                                break;
+                        }
+                } else if ((cur_bb_spur > -AR_SPUR_FEEQ_BOUND_HT20) &&
+                           (cur_bb_spur < AR_SPUR_FEEQ_BOUND_HT20)) {
+                        bb_spur = cur_bb_spur;
+                        break;
+                }
+        }
+
+        if (AR_NO_SPUR == bb_spur) {
+                REG_CLR_BIT(ah, AR_PHY_FORCE_CLKEN_CCK,
+                            AR_PHY_FORCE_CLKEN_CCK_MRC_MUX);
+                return;
+        } else {
+                REG_CLR_BIT(ah, AR_PHY_FORCE_CLKEN_CCK,
+                            AR_PHY_FORCE_CLKEN_CCK_MRC_MUX);
+        }
+
+        bin = bb_spur * 320;
+
+        tmp = REG_READ(ah, AR_PHY_TIMING_CTRL4(0));
+
+        newVal = tmp | (AR_PHY_TIMING_CTRL4_ENABLE_SPUR_RSSI |
+                        AR_PHY_TIMING_CTRL4_ENABLE_SPUR_FILTER |
+                        AR_PHY_TIMING_CTRL4_ENABLE_CHAN_MASK |
+                        AR_PHY_TIMING_CTRL4_ENABLE_PILOT_MASK);
+        REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0), newVal);
+
+        newVal = (AR_PHY_SPUR_REG_MASK_RATE_CNTL |
+                  AR_PHY_SPUR_REG_ENABLE_MASK_PPM |
+                  AR_PHY_SPUR_REG_MASK_RATE_SELECT |
+                  AR_PHY_SPUR_REG_ENABLE_VIT_SPUR_RSSI |
+                  SM(SPUR_RSSI_THRESH, AR_PHY_SPUR_REG_SPUR_RSSI_THRESH));
+        REG_WRITE(ah, AR_PHY_SPUR_REG, newVal);
+
+        if (IS_CHAN_HT40(chan)) {
+                if (bb_spur < 0) {
+                        spur_subchannel_sd = 1;
+                        bb_spur_off = bb_spur + 10;
+                } else {
+                        spur_subchannel_sd = 0;
+                        bb_spur_off = bb_spur - 10;
+                }
+        } else {
+                spur_subchannel_sd = 0;
+                bb_spur_off = bb_spur;
+        }
+
+        if (IS_CHAN_HT40(chan))
+                spur_delta_phase =
+                        ((bb_spur * 262144) /
+                         10) & AR_PHY_TIMING11_SPUR_DELTA_PHASE;
+        else
+                spur_delta_phase =
+                        ((bb_spur * 524288) /
+                         10) & AR_PHY_TIMING11_SPUR_DELTA_PHASE;
+
+        denominator = IS_CHAN_2GHZ(chan) ? 44 : 40;
+        spur_freq_sd = ((bb_spur_off * 2048) / denominator) & 0x3ff;
+
+        newVal = (AR_PHY_TIMING11_USE_SPUR_IN_AGC |
+                  SM(spur_freq_sd, AR_PHY_TIMING11_SPUR_FREQ_SD) |
+                  SM(spur_delta_phase, AR_PHY_TIMING11_SPUR_DELTA_PHASE));
+        REG_WRITE(ah, AR_PHY_TIMING11, newVal);
+
+        newVal = spur_subchannel_sd << AR_PHY_SFCORR_SPUR_SUBCHNL_SD_S;
+        REG_WRITE(ah, AR_PHY_SFCORR_EXT, newVal);
+
+        cur_bin = -6000;
+        upper = bin + 100;
+        lower = bin - 100;
+
+        for (i = 0; i < 4; i++) {
+                int pilot_mask = 0;
+                int chan_mask = 0;
+                int bp = 0;
+                for (bp = 0; bp < 30; bp++) {
+                        if ((cur_bin > lower) && (cur_bin < upper)) {
+                                pilot_mask = pilot_mask | 0x1 << bp;
+                                chan_mask = chan_mask | 0x1 << bp;
+                        }
+                        cur_bin += 100;
+                }
+                cur_bin += inc[i];
+                REG_WRITE(ah, pilot_mask_reg[i], pilot_mask);
+                REG_WRITE(ah, chan_mask_reg[i], chan_mask);
+        }
+
+        cur_vit_mask = 6100;
+        upper = bin + 120;
+        lower = bin - 120;
+
+        for (i = 0; i < 123; i++) {
+                if ((cur_vit_mask > lower) && (cur_vit_mask < upper)) {
+
+                        /* workaround for gcc bug #37014 */
+                        volatile int tmp_v = abs(cur_vit_mask - bin);
+
+                        if (tmp_v < 75)
+                                mask_amt = 1;
+                        else
+                                mask_amt = 0;
+                        if (cur_vit_mask < 0)
+                                mask_m[abs(cur_vit_mask / 100)] = mask_amt;
+                        else
+                                mask_p[cur_vit_mask / 100] = mask_amt;
+                }
+                cur_vit_mask -= 100;
+        }
+
+        tmp_mask = (mask_m[46] << 30) | (mask_m[47] << 28)
+                | (mask_m[48] << 26) | (mask_m[49] << 24)
+                | (mask_m[50] << 22) | (mask_m[51] << 20)
+                | (mask_m[52] << 18) | (mask_m[53] << 16)
+                | (mask_m[54] << 14) | (mask_m[55] << 12)
+                | (mask_m[56] << 10) | (mask_m[57] << 8)
+                | (mask_m[58] << 6) | (mask_m[59] << 4)
+                | (mask_m[60] << 2) | (mask_m[61] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK_1, tmp_mask);
+        REG_WRITE(ah, AR_PHY_VIT_MASK2_M_46_61, tmp_mask);
+
+        tmp_mask = (mask_m[31] << 28)
+                | (mask_m[32] << 26) | (mask_m[33] << 24)
+                | (mask_m[34] << 22) | (mask_m[35] << 20)
+                | (mask_m[36] << 18) | (mask_m[37] << 16)
+                | (mask_m[48] << 14) | (mask_m[39] << 12)
+                | (mask_m[40] << 10) | (mask_m[41] << 8)
+                | (mask_m[42] << 6) | (mask_m[43] << 4)
+                | (mask_m[44] << 2) | (mask_m[45] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK_2, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_M_31_45, tmp_mask);
+
+        tmp_mask = (mask_m[16] << 30) | (mask_m[16] << 28)
+                | (mask_m[18] << 26) | (mask_m[18] << 24)
+                | (mask_m[20] << 22) | (mask_m[20] << 20)
+                | (mask_m[22] << 18) | (mask_m[22] << 16)
+                | (mask_m[24] << 14) | (mask_m[24] << 12)
+                | (mask_m[25] << 10) | (mask_m[26] << 8)
+                | (mask_m[27] << 6) | (mask_m[28] << 4)
+                | (mask_m[29] << 2) | (mask_m[30] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK_3, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_M_16_30, tmp_mask);
+
+        tmp_mask = (mask_m[0] << 30) | (mask_m[1] << 28)
+                | (mask_m[2] << 26) | (mask_m[3] << 24)
+                | (mask_m[4] << 22) | (mask_m[5] << 20)
+                | (mask_m[6] << 18) | (mask_m[7] << 16)
+                | (mask_m[8] << 14) | (mask_m[9] << 12)
+                | (mask_m[10] << 10) | (mask_m[11] << 8)
+                | (mask_m[12] << 6) | (mask_m[13] << 4)
+                | (mask_m[14] << 2) | (mask_m[15] << 0);
+        REG_WRITE(ah, AR_PHY_MASK_CTL, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_M_00_15, tmp_mask);
+
+        tmp_mask = (mask_p[15] << 28)
+                | (mask_p[14] << 26) | (mask_p[13] << 24)
+                | (mask_p[12] << 22) | (mask_p[11] << 20)
+                | (mask_p[10] << 18) | (mask_p[9] << 16)
+                | (mask_p[8] << 14) | (mask_p[7] << 12)
+                | (mask_p[6] << 10) | (mask_p[5] << 8)
+                | (mask_p[4] << 6) | (mask_p[3] << 4)
+                | (mask_p[2] << 2) | (mask_p[1] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_1, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_15_01, tmp_mask);
+
+        tmp_mask = (mask_p[30] << 28)
+                | (mask_p[29] << 26) | (mask_p[28] << 24)
+                | (mask_p[27] << 22) | (mask_p[26] << 20)
+                | (mask_p[25] << 18) | (mask_p[24] << 16)
+                | (mask_p[23] << 14) | (mask_p[22] << 12)
+                | (mask_p[21] << 10) | (mask_p[20] << 8)
+                | (mask_p[19] << 6) | (mask_p[18] << 4)
+                | (mask_p[17] << 2) | (mask_p[16] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_2, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_30_16, tmp_mask);
+
+        tmp_mask = (mask_p[45] << 28)
+                | (mask_p[44] << 26) | (mask_p[43] << 24)
+                | (mask_p[42] << 22) | (mask_p[41] << 20)
+                | (mask_p[40] << 18) | (mask_p[39] << 16)
+                | (mask_p[38] << 14) | (mask_p[37] << 12)
+                | (mask_p[36] << 10) | (mask_p[35] << 8)
+                | (mask_p[34] << 6) | (mask_p[33] << 4)
+                | (mask_p[32] << 2) | (mask_p[31] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_3, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_45_31, tmp_mask);
+
+        tmp_mask = (mask_p[61] << 30) | (mask_p[60] << 28)
+                | (mask_p[59] << 26) | (mask_p[58] << 24)
+                | (mask_p[57] << 22) | (mask_p[56] << 20)
+                | (mask_p[55] << 18) | (mask_p[54] << 16)
+                | (mask_p[53] << 14) | (mask_p[52] << 12)
+                | (mask_p[51] << 10) | (mask_p[50] << 8)
+                | (mask_p[49] << 6) | (mask_p[48] << 4)
+                | (mask_p[47] << 2) | (mask_p[46] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_4, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_61_45, tmp_mask);
 }
 
-static void
-ath9k_phy_modify_rx_buffer(u32 *rfBuf, u32 reg32,
-                           u32 numBits, u32 firstBit,
-                           u32 column)
+/* All code below is for non single-chip solutions */
+
+/**
+ * ath9k_phy_modify_rx_buffer() - perform analog swizzling of parameters
+ * @rfbuf:
+ * @reg32:
+ * @numBits:
+ * @firstBit:
+ * @column:
+ *
+ * Performs analog "swizzling" of parameters into their location.
+ * Used on external AR2133/AR5133 radios.
+ */
+static void ath9k_phy_modify_rx_buffer(u32 *rfBuf, u32 reg32,
+                                       u32 numBits, u32 firstBit,
+                                       u32 column)
 {
         u32 tmp32, mask, arrayEntry, lastBit;
         int32_t bitPosition, bitsLeft;
@@ -197,26 +468,466 @@ ath9k_phy_modify_rx_buffer(u32 *rfBuf, u32 reg32,
         }
 }
 
-bool
-ath9k_hw_set_rf_regs(struct ath_hw *ah, struct ath9k_channel *chan,
-                     u16 modesIndex)
+/*
+ * Fix on 2.4 GHz band for orientation sensitivity issue by increasing
+ * rf_pwd_icsyndiv.
+ *
+ * Theoretical Rules:
+ *   if 2 GHz band
+ *      if forceBiasAuto
+ *         if synth_freq < 2412
+ *            bias = 0
+ *         else if 2412 <= synth_freq <= 2422
+ *            bias = 1
+ *         else // synth_freq > 2422
+ *            bias = 2
+ *      else if forceBias > 0
+ *         bias = forceBias & 7
+ *      else
+ *         no change, use value from ini file
+ *   else
+ *      no change, invalid band
+ *
+ *  1st Mod:
+ *    2422 also uses value of 2
+ *    <approved>
+ *
+ *  2nd Mod:
+ *    Less than 2412 uses value of 0, 2412 and above uses value of 2
+ */
+static void ath9k_hw_force_bias(struct ath_hw *ah, u16 synth_freq)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 tmp_reg;
+        int reg_writes = 0;
+        u32 new_bias = 0;
+
+        if (!AR_SREV_5416(ah) || synth_freq >= 3000) {
+                return;
+        }
+
+        BUG_ON(AR_SREV_9280_10_OR_LATER(ah));
+
+        if (synth_freq < 2412)
+                new_bias = 0;
+        else if (synth_freq < 2422)
+                new_bias = 1;
+        else
+                new_bias = 2;
+
+        /* pre-reverse this field */
+        tmp_reg = ath9k_hw_reverse_bits(new_bias, 3);
+
+        ath_print(common, ATH_DBG_CONFIG,
+                  "Force rf_pwd_icsyndiv to %1d on %4d\n",
+                  new_bias, synth_freq);
+
+        /* swizzle rf_pwd_icsyndiv */
+        ath9k_phy_modify_rx_buffer(ah->analogBank6Data, tmp_reg, 3, 181, 3);
+
+        /* write Bank 6 with new params */
+        REG_WRITE_RF_ARRAY(&ah->iniBank6, ah->analogBank6Data, reg_writes);
+}
+
+/**
+ * ath9k_hw_set_channel - tune to a channel on the external AR2133/AR5133 radios
+ * @ah: atheros hardware stucture
+ * @chan:
+ *
+ * For the external AR2133/AR5133 radios, takes the MHz channel value and set
+ * the channel value. Assumes writes enabled to analog bus and bank6 register
+ * cache in ah->analogBank6Data.
+ */
+int ath9k_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 channelSel = 0;
+        u32 bModeSynth = 0;
+        u32 aModeRefSel = 0;
+        u32 reg32 = 0;
+        u16 freq;
+        struct chan_centers centers;
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+        freq = centers.synth_center;
+
+        if (freq < 4800) {
+                u32 txctl;
+
+                if (((freq - 2192) % 5) == 0) {
+                        channelSel = ((freq - 672) * 2 - 3040) / 10;
+                        bModeSynth = 0;
+                } else if (((freq - 2224) % 5) == 0) {
+                        channelSel = ((freq - 704) * 2 - 3040) / 10;
+                        bModeSynth = 1;
+                } else {
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "Invalid channel %u MHz\n", freq);
+                        return -EINVAL;
+                }
+
+                channelSel = (channelSel << 2) & 0xff;
+                channelSel = ath9k_hw_reverse_bits(channelSel, 8);
+
+                txctl = REG_READ(ah, AR_PHY_CCK_TX_CTRL);
+                if (freq == 2484) {
+
+                        REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
+                                  txctl | AR_PHY_CCK_TX_CTRL_JAPAN);
+                } else {
+                        REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
+                                  txctl & ~AR_PHY_CCK_TX_CTRL_JAPAN);
+                }
+
+        } else if ((freq % 20) == 0 && freq >= 5120) {
+                channelSel =
+                    ath9k_hw_reverse_bits(((freq - 4800) / 20 << 2), 8);
+                aModeRefSel = ath9k_hw_reverse_bits(1, 2);
+        } else if ((freq % 10) == 0) {
+                channelSel =
+                    ath9k_hw_reverse_bits(((freq - 4800) / 10 << 1), 8);
+                if (AR_SREV_9100(ah) || AR_SREV_9160_10_OR_LATER(ah))
+                        aModeRefSel = ath9k_hw_reverse_bits(2, 2);
+                else
+                        aModeRefSel = ath9k_hw_reverse_bits(1, 2);
+        } else if ((freq % 5) == 0) {
+                channelSel = ath9k_hw_reverse_bits((freq - 4800) / 5, 8);
+                aModeRefSel = ath9k_hw_reverse_bits(1, 2);
+        } else {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Invalid channel %u MHz\n", freq);
+                return -EINVAL;
+        }
+
+        ath9k_hw_force_bias(ah, freq);
+
+        reg32 =
+            (channelSel << 8) | (aModeRefSel << 2) | (bModeSynth << 1) |
+            (1 << 5) | 0x1;
+
+        REG_WRITE(ah, AR_PHY(0x37), reg32);
+
+        ah->curchan = chan;
+        ah->curchan_rad_index = -1;
+
+        return 0;
+}
+
+/**
+ * ath9k_hw_spur_mitigate - convert baseband spur frequency for external radios
+ * @ah: atheros hardware structure
+ * @chan:
+ *
+ * For non single-chip solutions. Converts to baseband spur frequency given the
+ * input channel frequency and compute register settings below.
+ */
+void ath9k_hw_spur_mitigate(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        int bb_spur = AR_NO_SPUR;
+        int bin, cur_bin;
+        int spur_freq_sd;
+        int spur_delta_phase;
+        int denominator;
+        int upper, lower, cur_vit_mask;
+        int tmp, new;
+        int i;
+        int pilot_mask_reg[4] = { AR_PHY_TIMING7, AR_PHY_TIMING8,
+                          AR_PHY_PILOT_MASK_01_30, AR_PHY_PILOT_MASK_31_60
+        };
+        int chan_mask_reg[4] = { AR_PHY_TIMING9, AR_PHY_TIMING10,
+                         AR_PHY_CHANNEL_MASK_01_30, AR_PHY_CHANNEL_MASK_31_60
+        };
+        int inc[4] = { 0, 100, 0, 0 };
+
+        int8_t mask_m[123];
+        int8_t mask_p[123];
+        int8_t mask_amt;
+        int tmp_mask;
+        int cur_bb_spur;
+        bool is2GHz = IS_CHAN_2GHZ(chan);
+
+        memset(&mask_m, 0, sizeof(int8_t) * 123);
+        memset(&mask_p, 0, sizeof(int8_t) * 123);
+
+        for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
+                cur_bb_spur = ah->eep_ops->get_spur_channel(ah, i, is2GHz);
+                if (AR_NO_SPUR == cur_bb_spur)
+                        break;
+                cur_bb_spur = cur_bb_spur - (chan->channel * 10);
+                if ((cur_bb_spur > -95) && (cur_bb_spur < 95)) {
+                        bb_spur = cur_bb_spur;
+                        break;
+                }
+        }
+
+        if (AR_NO_SPUR == bb_spur)
+                return;
+
+        bin = bb_spur * 32;
+
+        tmp = REG_READ(ah, AR_PHY_TIMING_CTRL4(0));
+        new = tmp | (AR_PHY_TIMING_CTRL4_ENABLE_SPUR_RSSI |
+                     AR_PHY_TIMING_CTRL4_ENABLE_SPUR_FILTER |
+                     AR_PHY_TIMING_CTRL4_ENABLE_CHAN_MASK |
+                     AR_PHY_TIMING_CTRL4_ENABLE_PILOT_MASK);
+
+        REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0), new);
+
+        new = (AR_PHY_SPUR_REG_MASK_RATE_CNTL |
+               AR_PHY_SPUR_REG_ENABLE_MASK_PPM |
+               AR_PHY_SPUR_REG_MASK_RATE_SELECT |
+               AR_PHY_SPUR_REG_ENABLE_VIT_SPUR_RSSI |
+               SM(SPUR_RSSI_THRESH, AR_PHY_SPUR_REG_SPUR_RSSI_THRESH));
+        REG_WRITE(ah, AR_PHY_SPUR_REG, new);
+
+        spur_delta_phase = ((bb_spur * 524288) / 100) &
+                AR_PHY_TIMING11_SPUR_DELTA_PHASE;
+
+        denominator = IS_CHAN_2GHZ(chan) ? 440 : 400;
+        spur_freq_sd = ((bb_spur * 2048) / denominator) & 0x3ff;
+
+        new = (AR_PHY_TIMING11_USE_SPUR_IN_AGC |
+               SM(spur_freq_sd, AR_PHY_TIMING11_SPUR_FREQ_SD) |
+               SM(spur_delta_phase, AR_PHY_TIMING11_SPUR_DELTA_PHASE));
+        REG_WRITE(ah, AR_PHY_TIMING11, new);
+
+        cur_bin = -6000;
+        upper = bin + 100;
+        lower = bin - 100;
+
+        for (i = 0; i < 4; i++) {
+                int pilot_mask = 0;
+                int chan_mask = 0;
+                int bp = 0;
+                for (bp = 0; bp < 30; bp++) {
+                        if ((cur_bin > lower) && (cur_bin < upper)) {
+                                pilot_mask = pilot_mask | 0x1 << bp;
+                                chan_mask = chan_mask | 0x1 << bp;
+                        }
+                        cur_bin += 100;
+                }
+                cur_bin += inc[i];
+                REG_WRITE(ah, pilot_mask_reg[i], pilot_mask);
+                REG_WRITE(ah, chan_mask_reg[i], chan_mask);
+        }
+
+        cur_vit_mask = 6100;
+        upper = bin + 120;
+        lower = bin - 120;
+
+        for (i = 0; i < 123; i++) {
+                if ((cur_vit_mask > lower) && (cur_vit_mask < upper)) {
+
+                        /* workaround for gcc bug #37014 */
+                        volatile int tmp_v = abs(cur_vit_mask - bin);
+
+                        if (tmp_v < 75)
+                                mask_amt = 1;
+                        else
+                                mask_amt = 0;
+                        if (cur_vit_mask < 0)
+                                mask_m[abs(cur_vit_mask / 100)] = mask_amt;
+                        else
+                                mask_p[cur_vit_mask / 100] = mask_amt;
+                }
+                cur_vit_mask -= 100;
+        }
+
+        tmp_mask = (mask_m[46] << 30) | (mask_m[47] << 28)
+                | (mask_m[48] << 26) | (mask_m[49] << 24)
+                | (mask_m[50] << 22) | (mask_m[51] << 20)
+                | (mask_m[52] << 18) | (mask_m[53] << 16)
+                | (mask_m[54] << 14) | (mask_m[55] << 12)
+                | (mask_m[56] << 10) | (mask_m[57] << 8)
+                | (mask_m[58] << 6) | (mask_m[59] << 4)
+                | (mask_m[60] << 2) | (mask_m[61] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK_1, tmp_mask);
+        REG_WRITE(ah, AR_PHY_VIT_MASK2_M_46_61, tmp_mask);
+
+        tmp_mask = (mask_m[31] << 28)
+                | (mask_m[32] << 26) | (mask_m[33] << 24)
+                | (mask_m[34] << 22) | (mask_m[35] << 20)
+                | (mask_m[36] << 18) | (mask_m[37] << 16)
+                | (mask_m[48] << 14) | (mask_m[39] << 12)
+                | (mask_m[40] << 10) | (mask_m[41] << 8)
+                | (mask_m[42] << 6) | (mask_m[43] << 4)
+                | (mask_m[44] << 2) | (mask_m[45] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK_2, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_M_31_45, tmp_mask);
+
+        tmp_mask = (mask_m[16] << 30) | (mask_m[16] << 28)
+                | (mask_m[18] << 26) | (mask_m[18] << 24)
+                | (mask_m[20] << 22) | (mask_m[20] << 20)
+                | (mask_m[22] << 18) | (mask_m[22] << 16)
+                | (mask_m[24] << 14) | (mask_m[24] << 12)
+                | (mask_m[25] << 10) | (mask_m[26] << 8)
+                | (mask_m[27] << 6) | (mask_m[28] << 4)
+                | (mask_m[29] << 2) | (mask_m[30] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK_3, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_M_16_30, tmp_mask);
+
+        tmp_mask = (mask_m[0] << 30) | (mask_m[1] << 28)
+                | (mask_m[2] << 26) | (mask_m[3] << 24)
+                | (mask_m[4] << 22) | (mask_m[5] << 20)
+                | (mask_m[6] << 18) | (mask_m[7] << 16)
+                | (mask_m[8] << 14) | (mask_m[9] << 12)
+                | (mask_m[10] << 10) | (mask_m[11] << 8)
+                | (mask_m[12] << 6) | (mask_m[13] << 4)
+                | (mask_m[14] << 2) | (mask_m[15] << 0);
+        REG_WRITE(ah, AR_PHY_MASK_CTL, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_M_00_15, tmp_mask);
+
+        tmp_mask = (mask_p[15] << 28)
+                | (mask_p[14] << 26) | (mask_p[13] << 24)
+                | (mask_p[12] << 22) | (mask_p[11] << 20)
+                | (mask_p[10] << 18) | (mask_p[9] << 16)
+                | (mask_p[8] << 14) | (mask_p[7] << 12)
+                | (mask_p[6] << 10) | (mask_p[5] << 8)
+                | (mask_p[4] << 6) | (mask_p[3] << 4)
+                | (mask_p[2] << 2) | (mask_p[1] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_1, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_15_01, tmp_mask);
+
+        tmp_mask = (mask_p[30] << 28)
+                | (mask_p[29] << 26) | (mask_p[28] << 24)
+                | (mask_p[27] << 22) | (mask_p[26] << 20)
+                | (mask_p[25] << 18) | (mask_p[24] << 16)
+                | (mask_p[23] << 14) | (mask_p[22] << 12)
+                | (mask_p[21] << 10) | (mask_p[20] << 8)
+                | (mask_p[19] << 6) | (mask_p[18] << 4)
+                | (mask_p[17] << 2) | (mask_p[16] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_2, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_30_16, tmp_mask);
+
+        tmp_mask = (mask_p[45] << 28)
+                | (mask_p[44] << 26) | (mask_p[43] << 24)
+                | (mask_p[42] << 22) | (mask_p[41] << 20)
+                | (mask_p[40] << 18) | (mask_p[39] << 16)
+                | (mask_p[38] << 14) | (mask_p[37] << 12)
+                | (mask_p[36] << 10) | (mask_p[35] << 8)
+                | (mask_p[34] << 6) | (mask_p[33] << 4)
+                | (mask_p[32] << 2) | (mask_p[31] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_3, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_45_31, tmp_mask);
+
+        tmp_mask = (mask_p[61] << 30) | (mask_p[60] << 28)
+                | (mask_p[59] << 26) | (mask_p[58] << 24)
+                | (mask_p[57] << 22) | (mask_p[56] << 20)
+                | (mask_p[55] << 18) | (mask_p[54] << 16)
+                | (mask_p[53] << 14) | (mask_p[52] << 12)
+                | (mask_p[51] << 10) | (mask_p[50] << 8)
+                | (mask_p[49] << 6) | (mask_p[48] << 4)
+                | (mask_p[47] << 2) | (mask_p[46] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_4, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_61_45, tmp_mask);
+}
+
+/**
+ * ath9k_hw_rf_alloc_ext_banks - allocates banks for external radio programming
+ * @ah: atheros hardware structure
+ *
+ * Only required for older devices with external AR2133/AR5133 radios.
+ */
+int ath9k_hw_rf_alloc_ext_banks(struct ath_hw *ah)
+{
+#define ATH_ALLOC_BANK(bank, size) do { \
+                bank = kzalloc((sizeof(u32) * size), GFP_KERNEL); \
+                if (!bank) { \
+                        ath_print(common, ATH_DBG_FATAL, \
+                                  "Cannot allocate RF banks\n"); \
+                        return -ENOMEM; \
+                } \
+        } while (0);
+
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        BUG_ON(AR_SREV_9280_10_OR_LATER(ah));
+
+        ATH_ALLOC_BANK(ah->analogBank0Data, ah->iniBank0.ia_rows);
+        ATH_ALLOC_BANK(ah->analogBank1Data, ah->iniBank1.ia_rows);
+        ATH_ALLOC_BANK(ah->analogBank2Data, ah->iniBank2.ia_rows);
+        ATH_ALLOC_BANK(ah->analogBank3Data, ah->iniBank3.ia_rows);
+        ATH_ALLOC_BANK(ah->analogBank6Data, ah->iniBank6.ia_rows);
+        ATH_ALLOC_BANK(ah->analogBank6TPCData, ah->iniBank6TPC.ia_rows);
+        ATH_ALLOC_BANK(ah->analogBank7Data, ah->iniBank7.ia_rows);
+        ATH_ALLOC_BANK(ah->addac5416_21,
+                       ah->iniAddac.ia_rows * ah->iniAddac.ia_columns);
+        ATH_ALLOC_BANK(ah->bank6Temp, ah->iniBank6.ia_rows);
+
+        return 0;
+#undef ATH_ALLOC_BANK
+}
+
+
+/**
+ * ath9k_hw_rf_free_ext_banks - Free memory for analog bank scratch buffers
+ * @ah: atheros hardware struture
+ * For the external AR2133/AR5133 radios banks.
+ */
+void
+ath9k_hw_rf_free_ext_banks(struct ath_hw *ah)
+{
+#define ATH_FREE_BANK(bank) do { \
+                kfree(bank); \
+                bank = NULL; \
+        } while (0);
+
+        BUG_ON(AR_SREV_9280_10_OR_LATER(ah));
+
+        ATH_FREE_BANK(ah->analogBank0Data);
+        ATH_FREE_BANK(ah->analogBank1Data);
+        ATH_FREE_BANK(ah->analogBank2Data);
+        ATH_FREE_BANK(ah->analogBank3Data);
+        ATH_FREE_BANK(ah->analogBank6Data);
+        ATH_FREE_BANK(ah->analogBank6TPCData);
+        ATH_FREE_BANK(ah->analogBank7Data);
+        ATH_FREE_BANK(ah->addac5416_21);
+        ATH_FREE_BANK(ah->bank6Temp);
+
+#undef ATH_FREE_BANK
+}
+
+/* *
+ * ath9k_hw_set_rf_regs - programs rf registers based on EEPROM
+ * @ah: atheros hardware structure
+ * @chan:
+ * @modesIndex:
+ *
+ * Used for the external AR2133/AR5133 radios.
+ *
+ * Reads the EEPROM header info from the device structure and programs
+ * all rf registers. This routine requires access to the analog
+ * rf device. This is not required for single-chip devices.
+ */
+bool ath9k_hw_set_rf_regs(struct ath_hw *ah, struct ath9k_channel *chan,
+                          u16 modesIndex)
 {
         u32 eepMinorRev;
         u32 ob5GHz = 0, db5GHz = 0;
         u32 ob2GHz = 0, db2GHz = 0;
         int regWrites = 0;
 
+        /*
+         * Software does not need to program bank data
+         * for single chip devices, that is AR9280 or anything
+         * after that.
+         */
         if (AR_SREV_9280_10_OR_LATER(ah))
                 return true;
 
+        /* Setup rf parameters */
         eepMinorRev = ah->eep_ops->get_eeprom(ah, EEP_MINOR_REV);
 
+        /* Setup Bank 0 Write */
         RF_BANK_SETUP(ah->analogBank0Data, &ah->iniBank0, 1);
 
+        /* Setup Bank 1 Write */
         RF_BANK_SETUP(ah->analogBank1Data, &ah->iniBank1, 1);
 
+        /* Setup Bank 2 Write */
         RF_BANK_SETUP(ah->analogBank2Data, &ah->iniBank2, 1);
 
+        /* Setup Bank 6 Write */
         RF_BANK_SETUP(ah->analogBank3Data, &ah->iniBank3,
                       modesIndex);
         {
@@ -227,6 +938,7 @@ ath9k_hw_set_rf_regs(struct ath_hw *ah, struct ath9k_channel *chan,
                 }
         }
 
+        /* Only the 5 or 2 GHz OB/DB need to be set for a mode */
         if (eepMinorRev >= 2) {
                 if (IS_CHAN_2GHZ(chan)) {
                         ob2GHz = ah->eep_ops->get_eeprom(ah, EEP_OB_2);
@@ -245,8 +957,10 @@ ath9k_hw_set_rf_regs(struct ath_hw *ah, struct ath9k_channel *chan,
                 }
         }
 
+        /* Setup Bank 7 Setup */
         RF_BANK_SETUP(ah->analogBank7Data, &ah->iniBank7, 1);
 
+        /* Write Analog registers */
         REG_WRITE_RF_ARRAY(&ah->iniBank0, ah->analogBank0Data,
                            regWrites);
         REG_WRITE_RF_ARRAY(&ah->iniBank1, ah->analogBank1Data,
@@ -262,137 +976,3 @@ ath9k_hw_set_rf_regs(struct ath_hw *ah, struct ath9k_channel *chan,
 
         return true;
 }
-
-void
-ath9k_hw_rf_free(struct ath_hw *ah)
-{
-#define ATH_FREE_BANK(bank) do { \
-                kfree(bank); \
-                bank = NULL; \
-        } while (0);
-
-        ATH_FREE_BANK(ah->analogBank0Data);
-        ATH_FREE_BANK(ah->analogBank1Data);
-        ATH_FREE_BANK(ah->analogBank2Data);
-        ATH_FREE_BANK(ah->analogBank3Data);
-        ATH_FREE_BANK(ah->analogBank6Data);
-        ATH_FREE_BANK(ah->analogBank6TPCData);
-        ATH_FREE_BANK(ah->analogBank7Data);
-        ATH_FREE_BANK(ah->addac5416_21);
-        ATH_FREE_BANK(ah->bank6Temp);
-#undef ATH_FREE_BANK
-}
-
-bool ath9k_hw_init_rf(struct ath_hw *ah, int *status)
-{
-        if (!AR_SREV_9280_10_OR_LATER(ah)) {
-                ah->analogBank0Data =
-                    kzalloc((sizeof(u32) *
-                             ah->iniBank0.ia_rows), GFP_KERNEL);
-                ah->analogBank1Data =
-                    kzalloc((sizeof(u32) *
-                             ah->iniBank1.ia_rows), GFP_KERNEL);
-                ah->analogBank2Data =
-                    kzalloc((sizeof(u32) *
-                             ah->iniBank2.ia_rows), GFP_KERNEL);
-                ah->analogBank3Data =
-                    kzalloc((sizeof(u32) *
-                             ah->iniBank3.ia_rows), GFP_KERNEL);
-                ah->analogBank6Data =
-                    kzalloc((sizeof(u32) *
-                             ah->iniBank6.ia_rows), GFP_KERNEL);
-                ah->analogBank6TPCData =
-                    kzalloc((sizeof(u32) *
-                             ah->iniBank6TPC.ia_rows), GFP_KERNEL);
-                ah->analogBank7Data =
-                    kzalloc((sizeof(u32) *
-                             ah->iniBank7.ia_rows), GFP_KERNEL);
-
-                if (ah->analogBank0Data == NULL
-                    || ah->analogBank1Data == NULL
-                    || ah->analogBank2Data == NULL
-                    || ah->analogBank3Data == NULL
-                    || ah->analogBank6Data == NULL
-                    || ah->analogBank6TPCData == NULL
-                    || ah->analogBank7Data == NULL) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "Cannot allocate RF banks\n");
-                        *status = -ENOMEM;
-                        return false;
-                }
-
-                ah->addac5416_21 =
-                    kzalloc((sizeof(u32) *
-                             ah->iniAddac.ia_rows *
-                             ah->iniAddac.ia_columns), GFP_KERNEL);
-                if (ah->addac5416_21 == NULL) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "Cannot allocate addac5416_21\n");
-                        *status = -ENOMEM;
-                        return false;
-                }
-
-                ah->bank6Temp =
-                    kzalloc((sizeof(u32) *
-                             ah->iniBank6.ia_rows), GFP_KERNEL);
-                if (ah->bank6Temp == NULL) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "Cannot allocate bank6Temp\n");
-                        *status = -ENOMEM;
-                        return false;
-                }
-        }
-
-        return true;
-}
-
-void
-ath9k_hw_decrease_chain_power(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        int i, regWrites = 0;
-        u32 bank6SelMask;
-        u32 *bank6Temp = ah->bank6Temp;
-
-        switch (ah->config.diversity_control) {
-        case ATH9K_ANT_FIXED_A:
-                bank6SelMask =
-                    (ah->config.antenna_switch_swap & ANTSWAP_AB) ?
-                        REDUCE_CHAIN_0 : REDUCE_CHAIN_1;
-                break;
-        case ATH9K_ANT_FIXED_B:
-                bank6SelMask =
-                    (ah->config.antenna_switch_swap & ANTSWAP_AB) ?
-                        REDUCE_CHAIN_1 : REDUCE_CHAIN_0;
-                break;
-        case ATH9K_ANT_VARIABLE:
-                return;
-                break;
-        default:
-                return;
-                break;
-        }
-
-        for (i = 0; i < ah->iniBank6.ia_rows; i++)
-                bank6Temp[i] = ah->analogBank6Data[i];
-
-        REG_WRITE(ah, AR_PHY_BASE + 0xD8, bank6SelMask);
-
-        ath9k_phy_modify_rx_buffer(bank6Temp, 1, 1, 189, 0);
-        ath9k_phy_modify_rx_buffer(bank6Temp, 1, 1, 190, 0);
-        ath9k_phy_modify_rx_buffer(bank6Temp, 1, 1, 191, 0);
-        ath9k_phy_modify_rx_buffer(bank6Temp, 1, 1, 192, 0);
-        ath9k_phy_modify_rx_buffer(bank6Temp, 1, 1, 193, 0);
-        ath9k_phy_modify_rx_buffer(bank6Temp, 1, 1, 222, 0);
-        ath9k_phy_modify_rx_buffer(bank6Temp, 1, 1, 245, 0);
-        ath9k_phy_modify_rx_buffer(bank6Temp, 1, 1, 246, 0);
-        ath9k_phy_modify_rx_buffer(bank6Temp, 1, 1, 247, 0);
-
-        REG_WRITE_RF_ARRAY(&ah->iniBank6, bank6Temp, regWrites);
-
-        REG_WRITE(ah, AR_PHY_BASE + 0xD8, 0x00000053);
-#ifdef ALTER_SWITCH
-        REG_WRITE(ah, PHY_SWITCH_CHAIN_0,
-                  (REG_READ(ah, PHY_SWITCH_CHAIN_0) & ~0x38)
-                  | ((REG_READ(ah, PHY_SWITCH_CHAIN_0) >> 3) & 0x38));
-#endif
-}
diff --git a/drivers/net/wireless/ath/ath9k/phy.h b/drivers/net/wireless/ath/ath9k/phy.h
index dfda6f444648..0999a495fd46 100644
--- a/drivers/net/wireless/ath/ath9k/phy.h
+++ b/drivers/net/wireless/ath/ath9k/phy.h
@@ -17,20 +17,23 @@
 #ifndef PHY_H
 #define PHY_H
 
-void ath9k_hw_ar9280_set_channel(struct ath_hw *ah,
-                                 struct ath9k_channel
-                                 *chan);
-bool ath9k_hw_set_channel(struct ath_hw *ah,
-                          struct ath9k_channel *chan);
-void ath9k_hw_write_regs(struct ath_hw *ah, u32 modesIndex,
-                         u32 freqIndex, int regWrites);
+/* Common between single chip and non single-chip solutions */
+void ath9k_hw_write_regs(struct ath_hw *ah, u32 freqIndex, int regWrites);
+
+/* Single chip radio settings */
+int ath9k_hw_ar9280_set_channel(struct ath_hw *ah, struct ath9k_channel *chan);
+void ath9k_hw_9280_spur_mitigate(struct ath_hw *ah, struct ath9k_channel *chan);
+
+/* Routines below are for non single-chip solutions */
+int ath9k_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan);
+void ath9k_hw_spur_mitigate(struct ath_hw *ah, struct ath9k_channel *chan);
+
+int ath9k_hw_rf_alloc_ext_banks(struct ath_hw *ah);
+void ath9k_hw_rf_free_ext_banks(struct ath_hw *ah);
+
 bool ath9k_hw_set_rf_regs(struct ath_hw *ah,
                           struct ath9k_channel *chan,
                           u16 modesIndex);
-void ath9k_hw_decrease_chain_power(struct ath_hw *ah,
-                                   struct ath9k_channel *chan);
-bool ath9k_hw_init_rf(struct ath_hw *ah,
-                      int *status);
 
 #define AR_PHY_BASE     0x9800
 #define AR_PHY(_n)      (AR_PHY_BASE + ((_n)<<2))
@@ -45,6 +48,7 @@ bool ath9k_hw_init_rf(struct ath_hw *ah,
 #define AR_PHY_FC_DYN2040_EN        0x00000004
 #define AR_PHY_FC_DYN2040_PRI_ONLY  0x00000008
 #define AR_PHY_FC_DYN2040_PRI_CH    0x00000010
+/* For 25 MHz channel spacing -- not used but supported by hw */
 #define AR_PHY_FC_DYN2040_EXT_CH    0x00000020
 #define AR_PHY_FC_HT_EN             0x00000040
 #define AR_PHY_FC_SHORT_GI_40       0x00000080
@@ -185,8 +189,20 @@ bool ath9k_hw_init_rf(struct ath_hw *ah,
 #define AR_PHY_PLL_CTL_44_2133  0xeb
 #define AR_PHY_PLL_CTL_40_2133  0xea
 
-#define AR_PHY_SPECTRAL_SCAN            0x9912
-#define AR_PHY_SPECTRAL_SCAN_ENABLE     0x1
+#define AR_PHY_SPECTRAL_SCAN                    0x9910  /* AR9280 spectral scan configuration register */
+#define AR_PHY_SPECTRAL_SCAN_ENABLE             0x1
+#define AR_PHY_SPECTRAL_SCAN_ENA                0x00000001  /* Enable spectral scan, reg 68, bit 0 */
+#define AR_PHY_SPECTRAL_SCAN_ENA_S              0  /* Enable spectral scan, reg 68, bit 0 */
+#define AR_PHY_SPECTRAL_SCAN_ACTIVE             0x00000002  /* Activate spectral scan reg 68, bit 1*/
+#define AR_PHY_SPECTRAL_SCAN_ACTIVE_S           1  /* Activate spectral scan reg 68, bit 1*/
+#define AR_PHY_SPECTRAL_SCAN_FFT_PERIOD         0x000000F0  /* Interval for FFT reports, reg 68, bits 4-7*/
+#define AR_PHY_SPECTRAL_SCAN_FFT_PERIOD_S       4
+#define AR_PHY_SPECTRAL_SCAN_PERIOD             0x0000FF00  /* Interval for FFT reports, reg 68, bits 8-15*/
+#define AR_PHY_SPECTRAL_SCAN_PERIOD_S           8
+#define AR_PHY_SPECTRAL_SCAN_COUNT              0x00FF0000  /* Number of reports, reg 68, bits 16-23*/
+#define AR_PHY_SPECTRAL_SCAN_COUNT_S            16
+#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT       0x01000000  /* Short repeat, reg 68, bit 24*/
+#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT_S     24  /* Short repeat, reg 68, bit 24*/
 
 #define AR_PHY_RX_DELAY           0x9914
 #define AR_PHY_SEARCH_START_DELAY 0x9918
@@ -368,6 +384,9 @@ bool ath9k_hw_init_rf(struct ath_hw *ah,
 
 #define AR_PHY_HEAVY_CLIP_ENABLE         0x99E0
 
+#define AR_PHY_HEAVY_CLIP_FACTOR_RIFS    0x99EC
+#define AR_PHY_RIFS_INIT_DELAY         0x03ff0000
+
 #define AR_PHY_M_SLEEP      0x99f0
 #define AR_PHY_REFCLKDLY    0x99f4
 #define AR_PHY_REFCLKPD     0x99f8
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 1895d63aad0a..244e1c629177 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -15,137 +15,98 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include <linux/slab.h>
+
 #include "ath9k.h"
 
 static const struct ath_rate_table ar5416_11na_ratetable = {
         42,
+        8, /* MCS start */
         {
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 6000, /* 6 Mb */
-                        5400, 0x0b, 0x00, 12,
-                        0, 0, 0, 0, 0, 0 },
+                        5400, 0, 12, 0, 0, 0, 0, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 9000, /* 9 Mb */
-                        7800,  0x0f, 0x00, 18,
-                        0, 1, 1, 1, 1, 0 },
+                        7800,  1, 18, 0, 1, 1, 1, 1 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 12000, /* 12 Mb */
-                        10000, 0x0a, 0x00, 24,
-                        2, 2, 2, 2, 2, 0 },
+                        10000, 2, 24, 2, 2, 2, 2, 2 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 18000, /* 18 Mb */
-                        13900, 0x0e, 0x00, 36,
-                        2,  3, 3, 3, 3, 0 },
+                        13900, 3, 36, 2, 3, 3, 3, 3 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 24000, /* 24 Mb */
-                        17300, 0x09, 0x00, 48,
-                        4,  4, 4, 4, 4, 0 },
+                        17300, 4, 48, 4, 4, 4, 4, 4 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 36000, /* 36 Mb */
-                        23000, 0x0d, 0x00, 72,
-                        4,  5, 5, 5, 5, 0 },
+                        23000, 5, 72, 4, 5, 5, 5, 5 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 48000, /* 48 Mb */
-                        27400, 0x08, 0x00, 96,
-                        4,  6, 6, 6, 6, 0 },
+                        27400, 6, 96, 4, 6, 6, 6, 6 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 54000, /* 54 Mb */
-                        29300, 0x0c, 0x00, 108,
-                        4,  7, 7, 7, 7, 0 },
+                        29300, 7, 108, 4, 7, 7, 7, 7 },
                 { VALID_2040, VALID_2040, WLAN_RC_PHY_HT_20_SS, 6500, /* 6.5 Mb */
-                        6400, 0x80, 0x00, 0,
-                        0, 8, 24, 8, 24, 3216 },
+                        6400, 0, 0, 0, 8, 24, 8, 24 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 13000, /* 13 Mb */
-                        12700, 0x81, 0x00, 1,
-                        2, 9, 25, 9, 25, 6434 },
+                        12700, 1, 1, 2, 9, 25, 9, 25 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 19500, /* 19.5 Mb */
-                        18800, 0x82, 0x00, 2,
-                        2, 10, 26, 10, 26, 9650 },
+                        18800, 2, 2, 2, 10, 26, 10, 26 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 26000, /* 26 Mb */
-                        25000, 0x83, 0x00, 3,
-                        4,  11, 27, 11, 27, 12868 },
+                        25000, 3, 3, 4, 11, 27, 11, 27 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 39000, /* 39 Mb */
-                        36700, 0x84, 0x00, 4,
-                        4,  12, 28, 12, 28, 19304 },
+                        36700, 4, 4, 4, 12, 28, 12, 28 },
                 { INVALID, VALID_20, WLAN_RC_PHY_HT_20_SS, 52000, /* 52 Mb */
-                        48100, 0x85, 0x00, 5,
-                        4,  13, 29, 13, 29, 25740 },
+                        48100, 5, 5, 4, 13, 29, 13, 29 },
                 { INVALID, VALID_20, WLAN_RC_PHY_HT_20_SS, 58500, /* 58.5 Mb */
-                        53500, 0x86, 0x00, 6,
-                        4,  14, 30, 14, 30,  28956 },
+                        53500, 6, 6, 4, 14, 30, 14, 30 },
                 { INVALID, VALID_20, WLAN_RC_PHY_HT_20_SS, 65000, /* 65 Mb */
-                        59000, 0x87, 0x00, 7,
-                        4,  15, 31, 15, 32, 32180 },
+                        59000, 7, 7, 4, 15, 31, 15, 32 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_DS, 13000, /* 13 Mb */
-                        12700, 0x88, 0x00,
-                        8, 3, 16, 33, 16, 33, 6430 },
+                        12700, 8, 8, 3, 16, 33, 16, 33 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_DS, 26000, /* 26 Mb */
-                        24800, 0x89, 0x00, 9,
-                        2, 17, 34, 17, 34, 12860 },
+                        24800, 9, 9, 2, 17, 34, 17, 34 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_DS, 39000, /* 39 Mb */
-                        36600, 0x8a, 0x00, 10,
-                        2, 18, 35, 18, 35, 19300 },
+                        36600, 10, 10, 2, 18, 35, 18, 35 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 52000, /* 52 Mb */
-                        48100, 0x8b, 0x00, 11,
-                        4,  19, 36, 19, 36, 25736 },
+                        48100, 11, 11, 4, 19, 36, 19, 36 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 78000, /* 78 Mb */
-                        69500, 0x8c, 0x00, 12,
-                        4,  20, 37, 20, 37, 38600 },
+                        69500, 12, 12, 4, 20, 37, 20, 37 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 104000, /* 104 Mb */
-                        89500, 0x8d, 0x00, 13,
-                        4,  21, 38, 21, 38, 51472 },
+                        89500, 13, 13, 4, 21, 38, 21, 38 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 117000, /* 117 Mb */
-                        98900, 0x8e, 0x00, 14,
-                        4,  22, 39, 22, 39, 57890 },
+                        98900, 14, 14, 4, 22, 39, 22, 39 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 130000, /* 130 Mb */
-                        108300, 0x8f, 0x00, 15,
-                        4,  23, 40, 23, 41, 64320 },
+                        108300, 15, 15, 4, 23, 40, 23, 41 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 13500, /* 13.5 Mb */
-                        13200, 0x80, 0x00, 0,
-                        0, 8, 24, 24, 24, 6684 },
+                        13200, 0, 0, 0, 8, 24, 24, 24 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 27500, /* 27.0 Mb */
-                        25900, 0x81, 0x00, 1,
-                        2, 9, 25, 25, 25, 13368 },
+                        25900, 1, 1, 2, 9, 25, 25, 25 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 40500, /* 40.5 Mb */
-                        38600, 0x82, 0x00, 2,
-                        2, 10, 26, 26, 26, 20052 },
+                        38600, 2, 2, 2, 10, 26, 26, 26 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 54000, /* 54 Mb */
-                        49800, 0x83, 0x00, 3,
-                        4,  11, 27, 27, 27, 26738 },
+                        49800, 3, 3, 4, 11, 27, 27, 27 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 81500, /* 81 Mb */
-                        72200, 0x84, 0x00, 4,
-                        4,  12, 28, 28, 28, 40104 },
+                        72200, 4, 4, 4, 12, 28, 28, 28 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS, 108000, /* 108 Mb */
-                        92900, 0x85, 0x00, 5,
-                        4,  13, 29, 29, 29, 53476 },
+                        92900, 5, 5, 4, 13, 29, 29, 29 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS, 121500, /* 121.5 Mb */
-                        102700, 0x86, 0x00, 6,
-                        4,  14, 30, 30, 30, 60156 },
+                        102700, 6, 6, 4, 14, 30, 30, 30 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS, 135000, /* 135 Mb */
-                        112000, 0x87, 0x00, 7,
-                        4,  15, 31, 32, 32, 66840 },
+                        112000, 7, 7, 4, 15, 31, 32, 32 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS_HGI, 150000, /* 150 Mb */
-                        122000, 0x87, 0x00, 7,
-                        4,  15, 31, 32, 32, 74200 },
+                        122000, 7, 7, 4, 15, 31, 32, 32 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_40_DS, 27000, /* 27 Mb */
-                        25800, 0x88, 0x00, 8,
-                        0, 16, 33, 33, 33, 13360 },
+                        25800, 8, 8, 0, 16, 33, 33, 33 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_40_DS, 54000, /* 54 Mb */
-                        49800, 0x89, 0x00, 9,
-                        2, 17, 34, 34, 34, 26720 },
+                        49800, 9, 9, 2, 17, 34, 34, 34 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_40_DS, 81000, /* 81 Mb */
-                        71900, 0x8a, 0x00, 10,
-                        2, 18, 35, 35, 35, 40080 },
+                        71900, 10, 10, 2, 18, 35, 35, 35 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 108000, /* 108 Mb */
-                        92500, 0x8b, 0x00, 11,
-                        4,  19, 36, 36, 36, 53440 },
+                        92500, 11, 11, 4, 19, 36, 36, 36 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 162000, /* 162 Mb */
-                        130300, 0x8c, 0x00, 12,
-                        4,  20, 37, 37, 37, 80160 },
+                        130300, 12, 12, 4, 20, 37, 37, 37 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 216000, /* 216 Mb */
-                        162800, 0x8d, 0x00, 13,
-                        4,  21, 38, 38, 38, 106880 },
+                        162800, 13, 13, 4, 21, 38, 38, 38 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 243000, /* 243 Mb */
-                        178200, 0x8e, 0x00, 14,
-                        4,  22, 39, 39, 39, 120240 },
+                        178200, 14, 14, 4, 22, 39, 39, 39 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 270000, /* 270 Mb */
-                        192100, 0x8f, 0x00, 15,
-                        4,  23, 40, 41, 41, 133600 },
+                        192100, 15, 15, 4, 23, 40, 41, 41 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS_HGI, 300000, /* 300 Mb */
-                        207000, 0x8f, 0x00, 15,
-                        4,  23, 40, 41, 41, 148400 },
+                        207000, 15, 15, 4, 23, 40, 41, 41 },
         },
         50,  /* probe interval */
         WLAN_RC_HT_FLAG,  /* Phy rates allowed initially */
@@ -156,177 +117,125 @@ static const struct ath_rate_table ar5416_11na_ratetable = {
 
 static const struct ath_rate_table ar5416_11ng_ratetable = {
         46,
+        12, /* MCS start */
         {
                 { VALID_ALL, VALID_ALL, WLAN_RC_PHY_CCK, 1000, /* 1 Mb */
-                        900, 0x1b, 0x00, 2,
-                        0, 0, 0, 0, 0, 0 },
+                        900, 0, 2, 0, 0, 0, 0, 0 },
                 { VALID_ALL, VALID_ALL, WLAN_RC_PHY_CCK, 2000, /* 2 Mb */
-                        1900, 0x1a, 0x04, 4,
-                        1, 1, 1, 1, 1, 0 },
+                        1900, 1, 4, 1, 1, 1, 1, 1 },
                 { VALID_ALL, VALID_ALL, WLAN_RC_PHY_CCK, 5500, /* 5.5 Mb */
-                        4900, 0x19, 0x04, 11,
-                        2, 2, 2, 2, 2, 0 },
+                        4900, 2, 11, 2, 2, 2, 2, 2 },
                 { VALID_ALL, VALID_ALL, WLAN_RC_PHY_CCK, 11000, /* 11 Mb */
-                        8100, 0x18, 0x04, 22,
-                        3, 3, 3, 3, 3, 0 },
+                        8100, 3, 22, 3, 3, 3, 3, 3 },
                 { INVALID, INVALID, WLAN_RC_PHY_OFDM, 6000, /* 6 Mb */
-                        5400, 0x0b, 0x00, 12,
-                        4, 4, 4, 4, 4, 0 },
+                        5400, 4, 12, 4, 4, 4, 4, 4 },
                 { INVALID, INVALID, WLAN_RC_PHY_OFDM, 9000, /* 9 Mb */
-                        7800, 0x0f, 0x00, 18,
-                        4, 5, 5, 5, 5, 0 },
+                        7800, 5, 18, 4, 5, 5, 5, 5 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 12000, /* 12 Mb */
-                        10100, 0x0a, 0x00, 24,
-                        6, 6, 6, 6, 6, 0 },
+                        10100, 6, 24, 6, 6, 6, 6, 6 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 18000, /* 18 Mb */
-                        14100,  0x0e, 0x00, 36,
-                        6, 7, 7, 7, 7, 0 },
+                        14100, 7, 36, 6, 7, 7, 7, 7 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 24000, /* 24 Mb */
-                        17700, 0x09, 0x00, 48,
-                        8,  8, 8, 8, 8, 0 },
+                        17700, 8, 48, 8, 8, 8, 8, 8 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 36000, /* 36 Mb */
-                        23700, 0x0d, 0x00, 72,
-                        8,  9, 9, 9, 9, 0 },
+                        23700, 9, 72, 8, 9, 9, 9, 9 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 48000, /* 48 Mb */
-                        27400, 0x08, 0x00, 96,
-                        8,  10, 10, 10, 10, 0 },
+                        27400, 10, 96, 8, 10, 10, 10, 10 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 54000, /* 54 Mb */
-                        30900, 0x0c, 0x00, 108,
-                        8,  11, 11, 11, 11, 0 },
+                        30900, 11, 108, 8, 11, 11, 11, 11 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_SS, 6500, /* 6.5 Mb */
-                        6400, 0x80, 0x00, 0,
-                        4, 12, 28, 12, 28, 3216 },
+                        6400, 0, 0, 4, 12, 28, 12, 28 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 13000, /* 13 Mb */
-                        12700, 0x81, 0x00, 1,
-                        6, 13, 29, 13, 29, 6434 },
+                        12700, 1, 1, 6, 13, 29, 13, 29 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 19500, /* 19.5 Mb */
-                        18800, 0x82, 0x00, 2,
-                        6, 14, 30, 14, 30, 9650 },
+                        18800, 2, 2, 6, 14, 30, 14, 30 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 26000, /* 26 Mb */
-                        25000, 0x83, 0x00, 3,
-                        8,  15, 31, 15, 31, 12868 },
+                        25000, 3, 3, 8, 15, 31, 15, 31 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 39000, /* 39 Mb */
-                        36700, 0x84, 0x00, 4,
-                        8,  16, 32, 16, 32, 19304 },
+                        36700, 4, 4, 8, 16, 32, 16, 32 },
                 { INVALID, VALID_20, WLAN_RC_PHY_HT_20_SS, 52000, /* 52 Mb */
-                        48100, 0x85, 0x00, 5,
-                        8,  17, 33, 17, 33, 25740 },
+                        48100, 5, 5, 8, 17, 33, 17, 33 },
                 { INVALID,  VALID_20, WLAN_RC_PHY_HT_20_SS, 58500, /* 58.5 Mb */
-                        53500, 0x86, 0x00, 6,
-                        8,  18, 34, 18, 34, 28956 },
+                        53500, 6, 6, 8, 18, 34, 18, 34 },
                 { INVALID, VALID_20, WLAN_RC_PHY_HT_20_SS, 65000, /* 65 Mb */
-                        59000, 0x87, 0x00, 7,
-                        8,  19, 35, 19, 36, 32180 },
+                        59000, 7, 7, 8, 19, 35, 19, 36 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_DS, 13000, /* 13 Mb */
-                        12700, 0x88, 0x00, 8,
-                        4, 20, 37, 20, 37, 6430 },
+                        12700, 8, 8, 4, 20, 37, 20, 37 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_DS, 26000, /* 26 Mb */
-                        24800, 0x89, 0x00, 9,
-                        6, 21, 38, 21, 38, 12860 },
+                        24800, 9, 9, 6, 21, 38, 21, 38 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_DS, 39000, /* 39 Mb */
-                        36600, 0x8a, 0x00, 10,
-                        6, 22, 39, 22, 39, 19300 },
+                        36600, 10, 10, 6, 22, 39, 22, 39 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 52000, /* 52 Mb */
-                        48100, 0x8b, 0x00, 11,
-                        8,  23, 40, 23, 40, 25736 },
+                        48100, 11, 11, 8, 23, 40, 23, 40 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 78000, /* 78 Mb */
-                        69500, 0x8c, 0x00, 12,
-                        8,  24, 41, 24, 41, 38600 },
+                        69500, 12, 12, 8, 24, 41, 24, 41 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 104000, /* 104 Mb */
-                        89500, 0x8d, 0x00, 13,
-                        8,  25, 42, 25, 42, 51472 },
+                        89500, 13, 13, 8, 25, 42, 25, 42 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 117000, /* 117 Mb */
-                        98900, 0x8e, 0x00, 14,
-                        8,  26, 43, 26, 44, 57890 },
+                        98900, 14, 14, 8, 26, 43, 26, 44 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 130000, /* 130 Mb */
-                        108300, 0x8f, 0x00, 15,
-                        8,  27, 44, 27, 45, 64320 },
+                        108300, 15, 15, 8, 27, 44, 27, 45 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 13500, /* 13.5 Mb */
-                        13200, 0x80, 0x00, 0,
-                        8, 12, 28, 28, 28, 6684 },
+                        13200, 0, 0, 8, 12, 28, 28, 28 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 27500, /* 27.0 Mb */
-                        25900, 0x81, 0x00, 1,
-                        8, 13, 29, 29, 29, 13368 },
+                        25900, 1, 1, 8, 13, 29, 29, 29 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 40500, /* 40.5 Mb */
-                        38600, 0x82, 0x00, 2,
-                        8, 14, 30, 30, 30, 20052 },
+                        38600, 2, 2, 8, 14, 30, 30, 30 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 54000, /* 54 Mb */
-                        49800, 0x83, 0x00, 3,
-                        8,  15, 31, 31, 31, 26738 },
+                        49800, 3, 3, 8,  15, 31, 31, 31 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 81500, /* 81 Mb */
-                        72200, 0x84, 0x00, 4,
-                        8,  16, 32, 32, 32, 40104 },
+                        72200, 4, 4, 8, 16, 32, 32, 32 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS, 108000, /* 108 Mb */
-                        92900, 0x85, 0x00, 5,
-                        8,  17, 33, 33, 33, 53476 },
+                        92900, 5, 5, 8, 17, 33, 33, 33 },
                 { INVALID,  VALID_40, WLAN_RC_PHY_HT_40_SS, 121500, /* 121.5 Mb */
-                        102700, 0x86, 0x00, 6,
-                        8,  18, 34, 34, 34, 60156 },
+                        102700, 6, 6, 8, 18, 34, 34, 34 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS, 135000, /* 135 Mb */
-                        112000, 0x87, 0x00, 7,
-                        8,  19, 35, 36, 36, 66840 },
+                        112000, 7, 7, 8, 19, 35, 36, 36 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS_HGI, 150000, /* 150 Mb */
-                        122000, 0x87, 0x00, 7,
-                        8,  19, 35, 36, 36, 74200 },
+                        122000, 7, 7, 8, 19, 35, 36, 36 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_40_DS, 27000, /* 27 Mb */
-                        25800, 0x88, 0x00, 8,
-                        8, 20, 37, 37, 37, 13360 },
+                        25800, 8, 8, 8, 20, 37, 37, 37 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_40_DS, 54000, /* 54 Mb */
-                        49800, 0x89, 0x00, 9,
-                        8, 21, 38, 38, 38, 26720 },
+                        49800, 9, 9, 8, 21, 38, 38, 38 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_40_DS, 81000, /* 81 Mb */
-                        71900, 0x8a, 0x00, 10,
-                        8, 22, 39, 39, 39, 40080 },
+                        71900, 10, 10, 8, 22, 39, 39, 39 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 108000, /* 108 Mb */
-                        92500, 0x8b, 0x00, 11,
-                        8,  23, 40, 40, 40, 53440 },
+                        92500, 11, 11, 8, 23, 40, 40, 40 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 162000, /* 162 Mb */
-                        130300, 0x8c, 0x00, 12,
-                        8,  24, 41, 41, 41, 80160 },
+                        130300, 12, 12, 8, 24, 41, 41, 41 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 216000, /* 216 Mb */
-                        162800, 0x8d, 0x00, 13,
-                        8,  25, 42, 42, 42, 106880 },
+                        162800, 13, 13, 8, 25, 42, 42, 42 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 243000, /* 243 Mb */
-                        178200, 0x8e, 0x00, 14,
-                        8,  26, 43, 43, 43, 120240 },
+                        178200, 14, 14, 8, 26, 43, 43, 43 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 270000, /* 270 Mb */
-                        192100, 0x8f, 0x00, 15,
-                        8,  27, 44, 45, 45, 133600 },
+                        192100, 15, 15, 8, 27, 44, 45, 45 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS_HGI, 300000, /* 300 Mb */
-                        207000, 0x8f, 0x00, 15,
-                        8,  27, 44, 45, 45, 148400 },
-                },
+                        207000, 15, 15, 8, 27, 44, 45, 45 },
+        },
         50,  /* probe interval */
         WLAN_RC_HT_FLAG,  /* Phy rates allowed initially */
 };
 
 static const struct ath_rate_table ar5416_11a_ratetable = {
         8,
+        0,
         {
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 6000, /* 6 Mb */
-                        5400, 0x0b, 0x00, (0x80|12),
-                        0, 0, 0 },
+                        5400, 0, 12, 0, 0, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 9000, /* 9 Mb */
-                        7800, 0x0f, 0x00, 18,
-                        0, 1, 0 },
+                        7800,  1, 18, 0, 1, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 12000, /* 12 Mb */
-                        10000, 0x0a, 0x00, (0x80|24),
-                        2, 2, 0 },
+                        10000, 2, 24, 2, 2, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 18000, /* 18 Mb */
-                        13900, 0x0e, 0x00, 36,
-                        2, 3, 0 },
+                        13900, 3, 36, 2, 3, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 24000, /* 24 Mb */
-                        17300, 0x09, 0x00, (0x80|48),
-                        4,  4, 0 },
+                        17300, 4, 48, 4, 4, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 36000, /* 36 Mb */
-                        23000, 0x0d, 0x00, 72,
-                        4,  5, 0 },
+                        23000, 5, 72, 4, 5, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 48000, /* 48 Mb */
-                        27400, 0x08, 0x00, 96,
-                        4,  6, 0 },
+                        27400, 6, 96, 4, 6, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 54000, /* 54 Mb */
-                        29300, 0x0c, 0x00, 108,
-                        4,  7, 0 },
+                        29300, 7, 108, 4, 7, 0 },
         },
         50,  /* probe interval */
         0,   /* Phy rates allowed initially */
@@ -334,48 +243,51 @@ static const struct ath_rate_table ar5416_11a_ratetable = {
 
 static const struct ath_rate_table ar5416_11g_ratetable = {
         12,
+        0,
         {
                 { VALID, VALID, WLAN_RC_PHY_CCK, 1000, /* 1 Mb */
-                        900, 0x1b, 0x00, 2,
-                        0, 0, 0 },
+                        900, 0, 2, 0, 0, 0 },
                 { VALID, VALID, WLAN_RC_PHY_CCK, 2000, /* 2 Mb */
-                        1900, 0x1a, 0x04, 4,
-                        1, 1, 0 },
+                        1900, 1, 4, 1, 1, 0 },
                 { VALID, VALID, WLAN_RC_PHY_CCK, 5500, /* 5.5 Mb */
-                        4900, 0x19, 0x04, 11,
-                        2, 2, 0 },
+                        4900, 2, 11, 2, 2, 0 },
                 { VALID, VALID, WLAN_RC_PHY_CCK, 11000, /* 11 Mb */
-                        8100, 0x18, 0x04, 22,
-                        3, 3, 0 },
+                        8100, 3, 22, 3, 3, 0 },
                 { INVALID, INVALID, WLAN_RC_PHY_OFDM, 6000, /* 6 Mb */
-                        5400, 0x0b, 0x00, 12,
-                        4, 4, 0 },
+                        5400, 4, 12, 4, 4, 0 },
                 { INVALID, INVALID, WLAN_RC_PHY_OFDM, 9000, /* 9 Mb */
-                        7800, 0x0f, 0x00, 18,
-                        4, 5, 0 },
+                        7800, 5, 18, 4, 5, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 12000, /* 12 Mb */
-                        10000, 0x0a, 0x00, 24,
-                        6, 6, 0 },
+                        10000, 6, 24, 6, 6, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 18000, /* 18 Mb */
-                        13900, 0x0e, 0x00, 36,
-                        6, 7, 0 },
+                        13900, 7, 36, 6, 7, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 24000, /* 24 Mb */
-                        17300, 0x09, 0x00, 48,
-                        8,  8, 0 },
+                        17300, 8, 48, 8, 8, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 36000, /* 36 Mb */
-                        23000, 0x0d, 0x00, 72,
-                        8,  9, 0 },
+                        23000, 9, 72, 8, 9, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 48000, /* 48 Mb */
-                        27400, 0x08, 0x00, 96,
-                        8,  10, 0 },
+                        27400, 10, 96, 8, 10, 0 },
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 54000, /* 54 Mb */
-                        29300, 0x0c, 0x00, 108,
-                        8,  11, 0 },
+                        29300, 11, 108, 8, 11, 0 },
         },
         50,  /* probe interval */
         0,   /* Phy rates allowed initially */
 };
 
+static const struct ath_rate_table *hw_rate_table[ATH9K_MODE_MAX] = {
+        [ATH9K_MODE_11A] = &ar5416_11a_ratetable,
+        [ATH9K_MODE_11G] = &ar5416_11g_ratetable,
+        [ATH9K_MODE_11NA_HT20] = &ar5416_11na_ratetable,
+        [ATH9K_MODE_11NG_HT20] = &ar5416_11ng_ratetable,
+        [ATH9K_MODE_11NA_HT40PLUS] = &ar5416_11na_ratetable,
+        [ATH9K_MODE_11NA_HT40MINUS] = &ar5416_11na_ratetable,
+        [ATH9K_MODE_11NG_HT40PLUS] = &ar5416_11ng_ratetable,
+        [ATH9K_MODE_11NG_HT40MINUS] = &ar5416_11ng_ratetable,
+};
+
+static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table,
+                                struct ieee80211_tx_rate *rate);
+
 static inline int8_t median(int8_t a, int8_t b, int8_t c)
 {
         if (a >= b) {
@@ -425,7 +337,7 @@ static void ath_rc_init_valid_txmask(struct ath_rate_priv *ath_rc_priv)
 static inline void ath_rc_set_valid_txmask(struct ath_rate_priv *ath_rc_priv,
                                            u8 index, int valid_tx_rate)
 {
-        ASSERT(index <= ath_rc_priv->rate_table_size);
+        BUG_ON(index > ath_rc_priv->rate_table_size);
         ath_rc_priv->valid_rate_index[index] = valid_tx_rate ? 1 : 0;
 }
 
@@ -534,7 +446,7 @@ static u8 ath_rc_setvalid_rates(struct ath_rate_priv *ath_rc_priv,
                          * capflag matches one of the validity
                          * (VALID/VALID_20/VALID_40) flags */
 
-                        if (((rate & 0x7F) == (dot11rate & 0x7F)) &&
+                        if ((rate == dot11rate) &&
                             ((valid & WLAN_RC_CAP_MODE(capflag)) ==
                              WLAN_RC_CAP_MODE(capflag)) &&
                             !WLAN_RC_PHY_HT(phy)) {
@@ -576,8 +488,7 @@ static u8 ath_rc_setvalid_htrates(struct ath_rate_priv *ath_rc_priv,
                         u8 rate = rateset->rs_rates[i];
                         u8 dot11rate = rate_table->info[j].dot11rate;
 
-                        if (((rate & 0x7F) != (dot11rate & 0x7F)) ||
-                            !WLAN_RC_PHY_HT(phy) ||
+                        if ((rate != dot11rate) || !WLAN_RC_PHY_HT(phy) ||
                             !WLAN_RC_PHY_HT_VALID(valid, capflag))
                                 continue;
 
@@ -696,18 +607,20 @@ static void ath_rc_rate_set_series(const struct ath_rate_table *rate_table,
                                    u8 tries, u8 rix, int rtsctsenable)
 {
         rate->count = tries;
-        rate->idx = rix;
+        rate->idx = rate_table->info[rix].ratecode;
 
         if (txrc->short_preamble)
                 rate->flags |= IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
         if (txrc->rts || rtsctsenable)
                 rate->flags |= IEEE80211_TX_RC_USE_RTS_CTS;
-        if (WLAN_RC_PHY_40(rate_table->info[rix].phy))
-                rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
-        if (WLAN_RC_PHY_SGI(rate_table->info[rix].phy))
-                rate->flags |= IEEE80211_TX_RC_SHORT_GI;
-        if (WLAN_RC_PHY_HT(rate_table->info[rix].phy))
+
+        if (WLAN_RC_PHY_HT(rate_table->info[rix].phy)) {
                 rate->flags |= IEEE80211_TX_RC_MCS;
+                if (WLAN_RC_PHY_40(rate_table->info[rix].phy))
+                        rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+                if (WLAN_RC_PHY_SGI(rate_table->info[rix].phy))
+                        rate->flags |= IEEE80211_TX_RC_SHORT_GI;
+        }
 }
 
 static void ath_rc_rate_set_rtscts(struct ath_softc *sc,
@@ -720,7 +633,7 @@ static void ath_rc_rate_set_rtscts(struct ath_softc *sc,
         /* get the cix for the lowest valid rix */
         for (i = 3; i >= 0; i--) {
                 if (rates[i].count && (rates[i].idx >= 0)) {
-                        rix = rates[i].idx;
+                        rix = ath_rc_get_rateindex(rate_table, &rates[i]);
                         break;
                 }
         }
@@ -757,7 +670,7 @@ static void ath_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         struct ieee80211_tx_rate *rates = tx_info->control.rates;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         __le16 fc = hdr->frame_control;
-        u8 try_per_rate, i = 0, rix, nrix;
+        u8 try_per_rate, i = 0, rix;
         int is_probe = 0;
 
         if (rate_control_send_low(sta, priv_sta, txrc))
@@ -767,48 +680,47 @@ static void ath_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
          * For Multi Rate Retry we use a different number of
          * retry attempt counts. This ends up looking like this:
          *
-         * MRR[0] = 2
-         * MRR[1] = 2
-         * MRR[2] = 2
-         * MRR[3] = 4
+         * MRR[0] = 4
+         * MRR[1] = 4
+         * MRR[2] = 4
+         * MRR[3] = 8
          *
          */
-        try_per_rate = sc->hw->max_rate_tries;
+        try_per_rate = 4;
 
         rate_table = sc->cur_rate_table;
         rix = ath_rc_get_highest_rix(sc, ath_rc_priv, rate_table, &is_probe);
-        nrix = rix;
 
         if (is_probe) {
                 /* set one try for probe rates. For the
                  * probes don't enable rts */
                 ath_rc_rate_set_series(rate_table, &rates[i++], txrc,
-                                       1, nrix, 0);
+                                       1, rix, 0);
 
                 /* Get the next tried/allowed rate. No RTS for the next series
                  * after the probe rate
                  */
-                ath_rc_get_lower_rix(rate_table, ath_rc_priv, rix, &nrix);
+                ath_rc_get_lower_rix(rate_table, ath_rc_priv, rix, &rix);
                 ath_rc_rate_set_series(rate_table, &rates[i++], txrc,
-                                       try_per_rate, nrix, 0);
+                                       try_per_rate, rix, 0);
 
                 tx_info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
         } else {
                 /* Set the choosen rate. No RTS for first series entry. */
                 ath_rc_rate_set_series(rate_table, &rates[i++], txrc,
-                                       try_per_rate, nrix, 0);
+                                       try_per_rate, rix, 0);
         }
 
         /* Fill in the other rates for multirate retry */
         for ( ; i < 4; i++) {
                 /* Use twice the number of tries for the last MRR segment. */
                 if (i + 1 == 4)
-                        try_per_rate = 4;
+                        try_per_rate = 8;
 
-                ath_rc_get_lower_rix(rate_table, ath_rc_priv, rix, &nrix);
+                ath_rc_get_lower_rix(rate_table, ath_rc_priv, rix, &rix);
                 /* All other rates in the series have RTS enabled */
                 ath_rc_rate_set_series(rate_table, &rates[i], txrc,
-                                       try_per_rate, nrix, 1);
+                                       try_per_rate, rix, 1);
         }
 
         /*
@@ -859,12 +771,12 @@ static void ath_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 static bool ath_rc_update_per(struct ath_softc *sc,
                               const struct ath_rate_table *rate_table,
                               struct ath_rate_priv *ath_rc_priv,
-                              struct ath_tx_info_priv *tx_info_priv,
+                                  struct ieee80211_tx_info *tx_info,
                               int tx_rate, int xretries, int retries,
                               u32 now_msec)
 {
         bool state_change = false;
-        int count;
+        int count, n_bad_frames;
         u8 last_per;
         static u32 nretry_to_per_lookup[10] = {
                 100 * 0 / 1,
@@ -880,6 +792,7 @@ static bool ath_rc_update_per(struct ath_softc *sc,
         };
 
         last_per = ath_rc_priv->per[tx_rate];
+        n_bad_frames = tx_info->status.ampdu_len - tx_info->status.ampdu_ack_len;
 
         if (xretries) {
                 if (xretries == 1) {
@@ -907,7 +820,7 @@ static bool ath_rc_update_per(struct ath_softc *sc,
                 if (retries >= count)
                         retries = count - 1;
 
-                if (tx_info_priv->n_bad_frames) {
+                if (n_bad_frames) {
                         /* new_PER = 7/8*old_PER + 1/8*(currentPER)
                          * Assuming that n_frames is not 0.  The current PER
                          * from the retries is 100 * retries / (retries+1),
@@ -920,14 +833,14 @@ static bool ath_rc_update_per(struct ath_softc *sc,
                          * the above PER.  The expression below is a
                          * simplified version of the sum of these two terms.
                          */
-                        if (tx_info_priv->n_frames > 0) {
-                                int n_frames, n_bad_frames;
+                        if (tx_info->status.ampdu_len > 0) {
+                                int n_frames, n_bad_tries;
                                 u8 cur_per, new_per;
 
-                                n_bad_frames = retries * tx_info_priv->n_frames +
-                                        tx_info_priv->n_bad_frames;
-                                n_frames = tx_info_priv->n_frames * (retries + 1);
-                                cur_per = (100 * n_bad_frames / n_frames) >> 3;
+                                n_bad_tries = retries * tx_info->status.ampdu_len +
+                                        n_bad_frames;
+                                n_frames = tx_info->status.ampdu_len * (retries + 1);
+                                cur_per = (100 * n_bad_tries / n_frames) >> 3;
                                 new_per = (u8)(last_per - (last_per >> 3) + cur_per);
                                 ath_rc_priv->per[tx_rate] = new_per;
                         }
@@ -943,8 +856,7 @@ static bool ath_rc_update_per(struct ath_softc *sc,
                  * this was a probe.  Otherwise, ignore the probe.
                  */
                 if (ath_rc_priv->probe_rate && ath_rc_priv->probe_rate == tx_rate) {
-                        if (retries > 0 || 2 * tx_info_priv->n_bad_frames >
-                                tx_info_priv->n_frames) {
+                        if (retries > 0 || 2 * n_bad_frames > tx_info->status.ampdu_len) {
                                 /*
                                  * Since we probed with just a single attempt,
                                  * any retries means the probe failed.  Also,
@@ -969,7 +881,7 @@ static bool ath_rc_update_per(struct ath_softc *sc,
                                  * Since this probe succeeded, we allow the next
                                  * probe twice as soon.  This allows the maxRate
                                  * to move up faster if the probes are
-                                 * succesful.
+                                 * successful.
                                  */
                                 ath_rc_priv->probe_time =
                                         now_msec - rate_table->probe_interval / 2;
@@ -1003,7 +915,7 @@ static bool ath_rc_update_per(struct ath_softc *sc,
 
 static void ath_rc_update_ht(struct ath_softc *sc,
                              struct ath_rate_priv *ath_rc_priv,
-                             struct ath_tx_info_priv *tx_info_priv,
+                             struct ieee80211_tx_info *tx_info,
                              int tx_rate, int xretries, int retries)
 {
         u32 now_msec = jiffies_to_msecs(jiffies);
@@ -1020,7 +932,7 @@ static void ath_rc_update_ht(struct ath_softc *sc,
 
         /* Update PER first */
         state_change = ath_rc_update_per(sc, rate_table, ath_rc_priv,
-                                         tx_info_priv, tx_rate, xretries,
+                                         tx_info, tx_rate, xretries,
                                          retries, now_msec);
 
         /*
@@ -1080,15 +992,19 @@ static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table,
 {
         int rix;
 
+        if (!(rate->flags & IEEE80211_TX_RC_MCS))
+                return rate->idx;
+
+        rix = rate->idx + rate_table->mcs_start;
         if ((rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) &&
             (rate->flags & IEEE80211_TX_RC_SHORT_GI))
-                rix = rate_table->info[rate->idx].ht_index;
+                rix = rate_table->info[rix].ht_index;
         else if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
-                rix = rate_table->info[rate->idx].sgi_index;
+                rix = rate_table->info[rix].sgi_index;
         else if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
-                rix = rate_table->info[rate->idx].cw40index;
+                rix = rate_table->info[rix].cw40index;
         else
-                rix = rate_table->info[rate->idx].base_index;
+                rix = rate_table->info[rix].base_index;
 
         return rix;
 }
@@ -1098,7 +1014,6 @@ static void ath_rc_tx_status(struct ath_softc *sc,
                              struct ieee80211_tx_info *tx_info,
                              int final_ts_idx, int xretries, int long_retry)
 {
-        struct ath_tx_info_priv *tx_info_priv = ATH_TX_INFO_PRIV(tx_info);
         const struct ath_rate_table *rate_table;
         struct ieee80211_tx_rate *rates = tx_info->status.rates;
         u8 flags;
@@ -1124,9 +1039,8 @@ static void ath_rc_tx_status(struct ath_softc *sc,
                                         return;
 
                                 rix = ath_rc_get_rateindex(rate_table, &rates[i]);
-                                ath_rc_update_ht(sc, ath_rc_priv,
-                                                tx_info_priv, rix,
-                                                xretries ? 1 : 2,
+                                ath_rc_update_ht(sc, ath_rc_priv, tx_info,
+                                                rix, xretries ? 1 : 2,
                                                 rates[i].count);
                         }
                 }
@@ -1149,8 +1063,7 @@ static void ath_rc_tx_status(struct ath_softc *sc,
                 return;
 
         rix = ath_rc_get_rateindex(rate_table, &rates[i]);
-        ath_rc_update_ht(sc, ath_rc_priv, tx_info_priv, rix,
-                         xretries, long_retry);
+        ath_rc_update_ht(sc, ath_rc_priv, tx_info, rix, xretries, long_retry);
 }
 
 static const
@@ -1160,6 +1073,7 @@ struct ath_rate_table *ath_choose_rate_table(struct ath_softc *sc,
                                              bool is_cw_40)
 {
         int mode = 0;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
         switch(band) {
         case IEEE80211_BAND_2GHZ:
@@ -1177,14 +1091,17 @@ struct ath_rate_table *ath_choose_rate_table(struct ath_softc *sc,
                         mode = ATH9K_MODE_11NA_HT40PLUS;
                 break;
         default:
-                DPRINTF(sc, ATH_DBG_CONFIG, "Invalid band\n");
+                ath_print(common, ATH_DBG_CONFIG, "Invalid band\n");
                 return NULL;
         }
 
         BUG_ON(mode >= ATH9K_MODE_MAX);
 
-        DPRINTF(sc, ATH_DBG_CONFIG, "Choosing rate table for mode: %d\n", mode);
-        return sc->hw_rate_table[mode];
+        ath_print(common, ATH_DBG_CONFIG,
+                  "Choosing rate table for mode: %d\n", mode);
+
+        sc->cur_rate_mode = mode;
+        return hw_rate_table[mode];
 }
 
 static void ath_rc_init(struct ath_softc *sc,
@@ -1194,14 +1111,10 @@ static void ath_rc_init(struct ath_softc *sc,
                         const struct ath_rate_table *rate_table)
 {
         struct ath_rateset *rateset = &ath_rc_priv->neg_rates;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         u8 *ht_mcs = (u8 *)&ath_rc_priv->neg_ht_rates;
         u8 i, j, k, hi = 0, hthi = 0;
 
-        if (!rate_table) {
-                DPRINTF(sc, ATH_DBG_FATAL, "Rate table not initialized\n");
-                return;
-        }
-
         /* Initial rate table size. Will change depending
          * on the working rate set */
         ath_rc_priv->rate_table_size = RATE_TABLE_SIZE;
@@ -1239,7 +1152,7 @@ static void ath_rc_init(struct ath_softc *sc,
 
         ath_rc_priv->rate_table_size = hi + 1;
         ath_rc_priv->rate_max_phy = 0;
-        ASSERT(ath_rc_priv->rate_table_size <= RATE_TABLE_SIZE);
+        BUG_ON(ath_rc_priv->rate_table_size > RATE_TABLE_SIZE);
 
         for (i = 0, k = 0; i < WLAN_RC_PHY_MAX; i++) {
                 for (j = 0; j < ath_rc_priv->valid_phy_ratecnt[i]; j++) {
@@ -1253,16 +1166,17 @@ static void ath_rc_init(struct ath_softc *sc,
 
                 ath_rc_priv->rate_max_phy = ath_rc_priv->valid_phy_rateidx[i][j-1];
         }
-        ASSERT(ath_rc_priv->rate_table_size <= RATE_TABLE_SIZE);
-        ASSERT(k <= RATE_TABLE_SIZE);
+        BUG_ON(ath_rc_priv->rate_table_size > RATE_TABLE_SIZE);
+        BUG_ON(k > RATE_TABLE_SIZE);
 
         ath_rc_priv->max_valid_rate = k;
         ath_rc_sort_validrates(rate_table, ath_rc_priv);
         ath_rc_priv->rate_max_phy = ath_rc_priv->valid_rate_index[k-4];
         sc->cur_rate_table = rate_table;
 
-        DPRINTF(sc, ATH_DBG_CONFIG, "RC Initialized with capabilities: 0x%x\n",
-                ath_rc_priv->ht_cap);
+        ath_print(common, ATH_DBG_CONFIG,
+                  "RC Initialized with capabilities: 0x%x\n",
+                  ath_rc_priv->ht_cap);
 }
 
 static u8 ath_rc_build_ht_caps(struct ath_softc *sc, struct ieee80211_sta *sta,
@@ -1296,44 +1210,52 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
 {
         struct ath_softc *sc = priv;
         struct ath_rate_priv *ath_rc_priv = priv_sta;
-        struct ath_tx_info_priv *tx_info_priv = NULL;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr;
-        int final_ts_idx, tx_status = 0, is_underrun = 0;
+        int final_ts_idx = 0, tx_status = 0, is_underrun = 0;
+        int long_retry = 0;
         __le16 fc;
+        int i;
 
         hdr = (struct ieee80211_hdr *)skb->data;
         fc = hdr->frame_control;
-        tx_info_priv = ATH_TX_INFO_PRIV(tx_info);
-        final_ts_idx = tx_info_priv->tx.ts_rateindex;
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                struct ieee80211_tx_rate *rate = &tx_info->status.rates[i];
+                if (!rate->count)
+                        break;
+
+                final_ts_idx = i;
+                long_retry = rate->count - 1;
+        }
 
         if (!priv_sta || !ieee80211_is_data(fc) ||
-            !tx_info_priv->update_rc)
-                goto exit;
+            !(tx_info->pad[0] & ATH_TX_INFO_UPDATE_RC))
+                return;
 
-        if (tx_info_priv->tx.ts_status & ATH9K_TXERR_FILT)
-                goto exit;
+        if (tx_info->flags & IEEE80211_TX_STAT_TX_FILTERED)
+                return;
 
         /*
-         * If underrun error is seen assume it as an excessive retry only
-         * if prefetch trigger level have reached the max (0x3f for 5416)
-         * Adjust the long retry as if the frame was tried hw->max_rate_tries
-         * times. This affects how ratectrl updates PER for the failed rate.
+         * If an underrun error is seen assume it as an excessive retry only
+         * if max frame trigger level has been reached (2 KB for singel stream,
+         * and 4 KB for dual stream). Adjust the long retry as if the frame was
+         * tried hw->max_rate_tries times to affect how ratectrl updates PER for
+         * the failed rate. In case of congestion on the bus penalizing these
+         * type of underruns should help hardware actually transmit new frames
+         * successfully by eventually preferring slower rates. This itself
+         * should also alleviate congestion on the bus.
          */
-        if (tx_info_priv->tx.ts_flags &
-            (ATH9K_TX_DATA_UNDERRUN | ATH9K_TX_DELIM_UNDERRUN) &&
-            ((sc->sc_ah->tx_trig_level) >= ath_rc_priv->tx_triglevel_max)) {
+        if ((tx_info->pad[0] & ATH_TX_INFO_UNDERRUN) &&
+            (sc->sc_ah->tx_trig_level >= ath_rc_priv->tx_triglevel_max)) {
                 tx_status = 1;
                 is_underrun = 1;
         }
 
-        if ((tx_info_priv->tx.ts_status & ATH9K_TXERR_XRETRY) ||
-            (tx_info_priv->tx.ts_status & ATH9K_TXERR_FIFO))
+        if (tx_info->pad[0] & ATH_TX_INFO_XRETRY)
                 tx_status = 1;
 
         ath_rc_tx_status(sc, ath_rc_priv, tx_info, final_ts_idx, tx_status,
-                         (is_underrun) ? sc->hw->max_rate_tries :
-                         tx_info_priv->tx.ts_longretry);
+                         (is_underrun) ? sc->hw->max_rate_tries : long_retry);
 
         /* Check if aggregation has to be enabled for this tid */
         if (conf_is_ht(&sc->hw->conf) &&
@@ -1347,13 +1269,12 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
                         an = (struct ath_node *)sta->drv_priv;
 
                         if(ath_tx_aggr_check(sc, an, tid))
-                                ieee80211_start_tx_ba_session(sc->hw, hdr->addr1, tid);
+                                ieee80211_start_tx_ba_session(sta, tid);
                 }
         }
 
-        ath_debug_stat_rc(sc, skb);
-exit:
-        kfree(tx_info_priv);
+        ath_debug_stat_rc(sc, ath_rc_get_rateindex(sc->cur_rate_table,
+                &tx_info->status.rates[final_ts_idx]));
 }
 
 static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
@@ -1361,7 +1282,7 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
 {
         struct ath_softc *sc = priv;
         struct ath_rate_priv *ath_rc_priv = priv_sta;
-        const struct ath_rate_table *rate_table = NULL;
+        const struct ath_rate_table *rate_table;
         bool is_cw40, is_sgi40;
         int i, j = 0;
 
@@ -1393,11 +1314,9 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
             (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT) ||
             (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC)) {
                 rate_table = ath_choose_rate_table(sc, sband->band,
-                                                   sta->ht_cap.ht_supported,
-                                                   is_cw40);
-        } else if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
-                /* cur_rate_table would be set on init through config() */
-                rate_table = sc->cur_rate_table;
+                                      sta->ht_cap.ht_supported, is_cw40);
+        } else {
+                rate_table = hw_rate_table[sc->cur_rate_mode];
         }
 
         ath_rc_priv->ht_cap = ath_rc_build_ht_caps(sc, sta, is_cw40, is_sgi40);
@@ -1406,7 +1325,7 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
 
 static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
                             struct ieee80211_sta *sta, void *priv_sta,
-                            u32 changed)
+                            u32 changed, enum nl80211_channel_type oper_chan_type)
 {
         struct ath_softc *sc = priv;
         struct ath_rate_priv *ath_rc_priv = priv_sta;
@@ -1423,8 +1342,8 @@ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
                 if (sc->sc_ah->opmode != NL80211_IFTYPE_STATION)
                         return;
 
-                if (sc->hw->conf.channel_type == NL80211_CHAN_HT40MINUS ||
-                    sc->hw->conf.channel_type == NL80211_CHAN_HT40PLUS)
+                if (oper_chan_type == NL80211_CHAN_HT40MINUS ||
+                    oper_chan_type == NL80211_CHAN_HT40PLUS)
                         oper_cw40 = true;
 
                 oper_sgi40 = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
@@ -1438,9 +1357,10 @@ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
                                                    oper_cw40, oper_sgi40);
                         ath_rc_init(sc, priv_sta, sband, sta, rate_table);
 
-                        DPRINTF(sc, ATH_DBG_CONFIG,
-                                "Operating HT Bandwidth changed to: %d\n",
-                                sc->hw->conf.channel_type);
+                        ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_CONFIG,
+                                  "Operating HT Bandwidth changed to: %d\n",
+                                  sc->hw->conf.channel_type);
+                        sc->cur_rate_table = hw_rate_table[sc->cur_rate_mode];
                 }
         }
 }
@@ -1463,8 +1383,8 @@ static void *ath_rate_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp
 
         rate_priv = kzalloc(sizeof(struct ath_rate_priv), gfp);
         if (!rate_priv) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to allocate private rc structure\n");
+                ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
+                          "Unable to allocate private rc structure\n");
                 return NULL;
         }
 
@@ -1493,26 +1413,6 @@ static struct rate_control_ops ath_rate_ops = {
         .free_sta = ath_rate_free_sta,
 };
 
-void ath_rate_attach(struct ath_softc *sc)
-{
-        sc->hw_rate_table[ATH9K_MODE_11A] =
-                &ar5416_11a_ratetable;
-        sc->hw_rate_table[ATH9K_MODE_11G] =
-                &ar5416_11g_ratetable;
-        sc->hw_rate_table[ATH9K_MODE_11NA_HT20] =
-                &ar5416_11na_ratetable;
-        sc->hw_rate_table[ATH9K_MODE_11NG_HT20] =
-                &ar5416_11ng_ratetable;
-        sc->hw_rate_table[ATH9K_MODE_11NA_HT40PLUS] =
-                &ar5416_11na_ratetable;
-        sc->hw_rate_table[ATH9K_MODE_11NA_HT40MINUS] =
-                &ar5416_11na_ratetable;
-        sc->hw_rate_table[ATH9K_MODE_11NG_HT40PLUS] =
-                &ar5416_11ng_ratetable;
-        sc->hw_rate_table[ATH9K_MODE_11NG_HT40MINUS] =
-                &ar5416_11ng_ratetable;
-}
-
 int ath_rate_control_register(void)
 {
         return ieee80211_rate_control_register(&ath_rate_ops);
diff --git a/drivers/net/wireless/ath/ath9k/rc.h b/drivers/net/wireless/ath/ath9k/rc.h
index fa21a628ddd0..4f6d6fd442f4 100644
--- a/drivers/net/wireless/ath/ath9k/rc.h
+++ b/drivers/net/wireless/ath/ath9k/rc.h
@@ -19,6 +19,8 @@
 #ifndef RC_H
 #define RC_H
 
+#include "hw.h"
+
 struct ath_softc;
 
 #define ATH_RATE_MAX     30
@@ -55,6 +57,10 @@ enum {
                                 || (_phy == WLAN_RC_PHY_HT_40_DS)       \
                                 || (_phy == WLAN_RC_PHY_HT_20_DS_HGI)   \
                                 || (_phy == WLAN_RC_PHY_HT_40_DS_HGI))
+#define WLAN_RC_PHY_20(_phy)   ((_phy == WLAN_RC_PHY_HT_20_SS)          \
+                                || (_phy == WLAN_RC_PHY_HT_20_DS)       \
+                                || (_phy == WLAN_RC_PHY_HT_20_SS_HGI)   \
+                                || (_phy == WLAN_RC_PHY_HT_20_DS_HGI))
 #define WLAN_RC_PHY_40(_phy)   ((_phy == WLAN_RC_PHY_HT_40_SS)          \
                                 || (_phy == WLAN_RC_PHY_HT_40_DS)       \
                                 || (_phy == WLAN_RC_PHY_HT_40_SS_HGI)   \
@@ -102,6 +108,7 @@ enum {
  */
 struct ath_rate_table {
         int rate_cnt;
+        int mcs_start;
         struct {
                 int valid;
                 int valid_single_stream;
@@ -109,14 +116,12 @@ struct ath_rate_table {
                 u32 ratekbps;
                 u32 user_ratekbps;
                 u8 ratecode;
-                u8 short_preamble;
                 u8 dot11rate;
                 u8 ctrl_rate;
                 u8 base_index;
                 u8 cw40index;
                 u8 sgi_index;
                 u8 ht_index;
-                u32 max_4ms_framelen;
         } info[RATE_TABLE_SIZE];
         u32 probe_interval;
         u8 initial_ratemax;
@@ -165,26 +170,18 @@ struct ath_rate_priv {
         struct ath_rate_softc *asc;
 };
 
+#define ATH_TX_INFO_FRAME_TYPE_INTERNAL (1 << 0)
+#define ATH_TX_INFO_FRAME_TYPE_PAUSE    (1 << 1)
+#define ATH_TX_INFO_UPDATE_RC           (1 << 2)
+#define ATH_TX_INFO_XRETRY              (1 << 3)
+#define ATH_TX_INFO_UNDERRUN            (1 << 4)
+
 enum ath9k_internal_frame_type {
         ATH9K_NOT_INTERNAL,
         ATH9K_INT_PAUSE,
         ATH9K_INT_UNPAUSE
 };
 
-struct ath_tx_info_priv {
-        struct ath_wiphy *aphy;
-        struct ath_tx_status tx;
-        int n_frames;
-        int n_bad_frames;
-        bool update_rc;
-        enum ath9k_internal_frame_type frame_type;
-};
-
-#define ATH_TX_INFO_PRIV(tx_info) \
-        ((struct ath_tx_info_priv *)((tx_info)->rate_driver_data[0]))
-
-void ath_rate_attach(struct ath_softc *sc);
-u8 ath_rate_findrateix(struct ath_softc *sc, u8 dot11_rate);
 int ath_rate_control_register(void);
 void ath_rate_control_unregister(void);
 
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index ec0abf823995..1ca42e5148c8 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -48,6 +48,7 @@ static struct ieee80211_hw * ath_get_virt_hw(struct ath_softc *sc,
 static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
 {
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_desc *ds;
         struct sk_buff *skb;
 
@@ -59,14 +60,16 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
 
         /* virtual addr of the beginning of the buffer. */
         skb = bf->bf_mpdu;
-        ASSERT(skb != NULL);
+        BUG_ON(skb == NULL);
         ds->ds_vdata = skb->data;
 
-        /* setup rx descriptors. The rx.bufsize here tells the harware
+        /*
+         * setup rx descriptors. The rx_bufsize here tells the hardware
          * how much data it can DMA to us and that we are prepared
-         * to process */
+         * to process
+         */
         ath9k_hw_setuprxdesc(ah, ds,
-                             sc->rx.bufsize,
+                             common->rx_bufsize,
                              0);
 
         if (sc->rx.rxlink == NULL)
@@ -86,192 +89,11 @@ static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
         sc->rx.rxotherant = 0;
 }
 
-/*
- *  Extend 15-bit time stamp from rx descriptor to
- *  a full 64-bit TSF using the current h/w TSF.
-*/
-static u64 ath_extend_tsf(struct ath_softc *sc, u32 rstamp)
-{
-        u64 tsf;
-
-        tsf = ath9k_hw_gettsf64(sc->sc_ah);
-        if ((tsf & 0x7fff) < rstamp)
-                tsf -= 0x8000;
-        return (tsf & ~0x7fff) | rstamp;
-}
-
-/*
- * For Decrypt or Demic errors, we only mark packet status here and always push
- * up the frame up to let mac80211 handle the actual error case, be it no
- * decryption key or real decryption error. This let us keep statistics there.
- */
-static int ath_rx_prepare(struct sk_buff *skb, struct ath_desc *ds,
-                          struct ieee80211_rx_status *rx_status, bool *decrypt_error,
-                          struct ath_softc *sc)
-{
-        struct ieee80211_hdr *hdr;
-        u8 ratecode;
-        __le16 fc;
-        struct ieee80211_hw *hw;
-        struct ieee80211_sta *sta;
-        struct ath_node *an;
-        int last_rssi = ATH_RSSI_DUMMY_MARKER;
-
-
-        hdr = (struct ieee80211_hdr *)skb->data;
-        fc = hdr->frame_control;
-        memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
-        hw = ath_get_virt_hw(sc, hdr);
-
-        if (ds->ds_rxstat.rs_more) {
-                /*
-                 * Frame spans multiple descriptors; this cannot happen yet
-                 * as we don't support jumbograms. If not in monitor mode,
-                 * discard the frame. Enable this if you want to see
-                 * error frames in Monitor mode.
-                 */
-                if (sc->sc_ah->opmode != NL80211_IFTYPE_MONITOR)
-                        goto rx_next;
-        } else if (ds->ds_rxstat.rs_status != 0) {
-                if (ds->ds_rxstat.rs_status & ATH9K_RXERR_CRC)
-                        rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
-                if (ds->ds_rxstat.rs_status & ATH9K_RXERR_PHY)
-                        goto rx_next;
-
-                if (ds->ds_rxstat.rs_status & ATH9K_RXERR_DECRYPT) {
-                        *decrypt_error = true;
-                } else if (ds->ds_rxstat.rs_status & ATH9K_RXERR_MIC) {
-                        if (ieee80211_is_ctl(fc))
-                                /*
-                                 * Sometimes, we get invalid
-                                 * MIC failures on valid control frames.
-                                 * Remove these mic errors.
-                                 */
-                                ds->ds_rxstat.rs_status &= ~ATH9K_RXERR_MIC;
-                        else
-                                rx_status->flag |= RX_FLAG_MMIC_ERROR;
-                }
-                /*
-                 * Reject error frames with the exception of
-                 * decryption and MIC failures. For monitor mode,
-                 * we also ignore the CRC error.
-                 */
-                if (sc->sc_ah->opmode == NL80211_IFTYPE_MONITOR) {
-                        if (ds->ds_rxstat.rs_status &
-                            ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC |
-                              ATH9K_RXERR_CRC))
-                                goto rx_next;
-                } else {
-                        if (ds->ds_rxstat.rs_status &
-                            ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC)) {
-                                goto rx_next;
-                        }
-                }
-        }
-
-        ratecode = ds->ds_rxstat.rs_rate;
-
-        if (ratecode & 0x80) {
-                /* HT rate */
-                rx_status->flag |= RX_FLAG_HT;
-                if (ds->ds_rxstat.rs_flags & ATH9K_RX_2040)
-                        rx_status->flag |= RX_FLAG_40MHZ;
-                if (ds->ds_rxstat.rs_flags & ATH9K_RX_GI)
-                        rx_status->flag |= RX_FLAG_SHORT_GI;
-                rx_status->rate_idx = ratecode & 0x7f;
-        } else {
-                int i = 0, cur_band, n_rates;
-
-                cur_band = hw->conf.channel->band;
-                n_rates = sc->sbands[cur_band].n_bitrates;
-
-                for (i = 0; i < n_rates; i++) {
-                        if (sc->sbands[cur_band].bitrates[i].hw_value ==
-                            ratecode) {
-                                rx_status->rate_idx = i;
-                                break;
-                        }
-
-                        if (sc->sbands[cur_band].bitrates[i].hw_value_short ==
-                            ratecode) {
-                                rx_status->rate_idx = i;
-                                rx_status->flag |= RX_FLAG_SHORTPRE;
-                                break;
-                        }
-                }
-        }
-
-        rcu_read_lock();
-        sta = ieee80211_find_sta(sc->hw, hdr->addr2);
-        if (sta) {
-                an = (struct ath_node *) sta->drv_priv;
-                if (ds->ds_rxstat.rs_rssi != ATH9K_RSSI_BAD &&
-                   !ds->ds_rxstat.rs_moreaggr)
-                        ATH_RSSI_LPF(an->last_rssi, ds->ds_rxstat.rs_rssi);
-                last_rssi = an->last_rssi;
-        }
-        rcu_read_unlock();
-
-        if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
-                ds->ds_rxstat.rs_rssi = ATH_EP_RND(last_rssi,
-                                        ATH_RSSI_EP_MULTIPLIER);
-        if (ds->ds_rxstat.rs_rssi < 0)
-                ds->ds_rxstat.rs_rssi = 0;
-        else if (ds->ds_rxstat.rs_rssi > 127)
-                ds->ds_rxstat.rs_rssi = 127;
-
-        /* Update Beacon RSSI, this is used by ANI. */
-        if (ieee80211_is_beacon(fc))
-                sc->sc_ah->stats.avgbrssi = ds->ds_rxstat.rs_rssi;
-
-        rx_status->mactime = ath_extend_tsf(sc, ds->ds_rxstat.rs_tstamp);
-        rx_status->band = hw->conf.channel->band;
-        rx_status->freq = hw->conf.channel->center_freq;
-        rx_status->noise = sc->ani.noise_floor;
-        rx_status->signal = ATH_DEFAULT_NOISE_FLOOR + ds->ds_rxstat.rs_rssi;
-        rx_status->antenna = ds->ds_rxstat.rs_antenna;
-
-        /*
-         * Theory for reporting quality:
-         *
-         * At a hardware RSSI of 45 you will be able to use MCS 7  reliably.
-         * At a hardware RSSI of 45 you will be able to use MCS 15 reliably.
-         * At a hardware RSSI of 35 you should be able use 54 Mbps reliably.
-         *
-         * MCS 7  is the highets MCS index usable by a 1-stream device.
-         * MCS 15 is the highest MCS index usable by a 2-stream device.
-         *
-         * All ath9k devices are either 1-stream or 2-stream.
-         *
-         * How many bars you see is derived from the qual reporting.
-         *
-         * A more elaborate scheme can be used here but it requires tables
-         * of SNR/throughput for each possible mode used. For the MCS table
-         * you can refer to the wireless wiki:
-         *
-         * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
-         *
-         */
-        if (conf_is_ht(&hw->conf))
-                rx_status->qual =  ds->ds_rxstat.rs_rssi * 100 / 45;
-        else
-                rx_status->qual =  ds->ds_rxstat.rs_rssi * 100 / 35;
-
-        /* rssi can be more than 45 though, anything above that
-         * should be considered at 100% */
-        if (rx_status->qual > 100)
-                rx_status->qual = 100;
-
-        rx_status->flag |= RX_FLAG_TSFT;
-
-        return 1;
-rx_next:
-        return 0;
-}
-
 static void ath_opmode_init(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+
         u32 rfilt, mfilt[2];
 
         /* configure rx filter */
@@ -280,13 +102,13 @@ static void ath_opmode_init(struct ath_softc *sc)
 
         /* configure bssid mask */
         if (ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
-                ath9k_hw_setbssidmask(sc);
+                ath_hw_setbssidmask(common);
 
         /* configure operational mode */
         ath9k_hw_setopmode(ah);
 
         /* Handle any link-level address change. */
-        ath9k_hw_setmac(ah, sc->sc_ah->macaddr);
+        ath9k_hw_setmac(ah, common->macaddr);
 
         /* calculate and install multicast filter */
         mfilt[0] = mfilt[1] = ~0;
@@ -295,6 +117,7 @@ static void ath_opmode_init(struct ath_softc *sc)
 
 int ath_rx_init(struct ath_softc *sc, int nbufs)
 {
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct sk_buff *skb;
         struct ath_buf *bf;
         int error = 0;
@@ -303,24 +126,24 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
         sc->sc_flags &= ~SC_OP_RXFLUSH;
         spin_lock_init(&sc->rx.rxbuflock);
 
-        sc->rx.bufsize = roundup(IEEE80211_MAX_MPDU_LEN,
-                                 min(sc->common.cachelsz, (u16)64));
+        common->rx_bufsize = roundup(IEEE80211_MAX_MPDU_LEN,
+                                     min(common->cachelsz, (u16)64));
 
-        DPRINTF(sc, ATH_DBG_CONFIG, "cachelsz %u rxbufsize %u\n",
-                sc->common.cachelsz, sc->rx.bufsize);
+        ath_print(common, ATH_DBG_CONFIG, "cachelsz %u rxbufsize %u\n",
+                  common->cachelsz, common->rx_bufsize);
 
         /* Initialize rx descriptors */
 
         error = ath_descdma_setup(sc, &sc->rx.rxdma, &sc->rx.rxbuf,
                                   "rx", nbufs, 1);
         if (error != 0) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "failed to allocate rx descriptors: %d\n", error);
+                ath_print(common, ATH_DBG_FATAL,
+                          "failed to allocate rx descriptors: %d\n", error);
                 goto err;
         }
 
         list_for_each_entry(bf, &sc->rx.rxbuf, list) {
-                skb = ath_rxbuf_alloc(&sc->common, sc->rx.bufsize, GFP_KERNEL);
+                skb = ath_rxbuf_alloc(common, common->rx_bufsize, GFP_KERNEL);
                 if (skb == NULL) {
                         error = -ENOMEM;
                         goto err;
@@ -328,14 +151,14 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
 
                 bf->bf_mpdu = skb;
                 bf->bf_buf_addr = dma_map_single(sc->dev, skb->data,
-                                                 sc->rx.bufsize,
+                                                 common->rx_bufsize,
                                                  DMA_FROM_DEVICE);
                 if (unlikely(dma_mapping_error(sc->dev,
                                                bf->bf_buf_addr))) {
                         dev_kfree_skb_any(skb);
                         bf->bf_mpdu = NULL;
-                        DPRINTF(sc, ATH_DBG_FATAL,
-                                "dma_mapping_error() on RX init\n");
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "dma_mapping_error() on RX init\n");
                         error = -ENOMEM;
                         goto err;
                 }
@@ -352,6 +175,8 @@ err:
 
 void ath_rx_cleanup(struct ath_softc *sc)
 {
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct sk_buff *skb;
         struct ath_buf *bf;
 
@@ -359,7 +184,7 @@ void ath_rx_cleanup(struct ath_softc *sc)
                 skb = bf->bf_mpdu;
                 if (skb) {
                         dma_unmap_single(sc->dev, bf->bf_buf_addr,
-                                         sc->rx.bufsize, DMA_FROM_DEVICE);
+                                         common->rx_bufsize, DMA_FROM_DEVICE);
                         dev_kfree_skb(skb);
                 }
         }
@@ -420,7 +245,10 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
         else
                 rfilt |= ATH9K_RX_FILTER_BEACON;
 
-        if (sc->rx.rxfilter & FIF_PSPOLL)
+        if ((AR_SREV_9280_10_OR_LATER(sc->sc_ah) ||
+            AR_SREV_9285_10_OR_LATER(sc->sc_ah)) &&
+            (sc->sc_ah->opmode == NL80211_IFTYPE_AP) &&
+            (sc->rx.rxfilter & FIF_PSPOLL))
                 rfilt |= ATH9K_RX_FILTER_PSPOLL;
 
         if (conf_is_ht(&sc->hw->conf))
@@ -527,20 +355,22 @@ static bool ath_beacon_dtim_pending_cab(struct sk_buff *skb)
 static void ath_rx_ps_beacon(struct ath_softc *sc, struct sk_buff *skb)
 {
         struct ieee80211_mgmt *mgmt;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
         if (skb->len < 24 + 8 + 2 + 2)
                 return;
 
         mgmt = (struct ieee80211_mgmt *)skb->data;
-        if (memcmp(sc->curbssid, mgmt->bssid, ETH_ALEN) != 0)
+        if (memcmp(common->curbssid, mgmt->bssid, ETH_ALEN) != 0)
                 return; /* not from our current AP */
 
-        sc->sc_flags &= ~SC_OP_WAIT_FOR_BEACON;
+        sc->ps_flags &= ~PS_WAIT_FOR_BEACON;
 
-        if (sc->sc_flags & SC_OP_BEACON_SYNC) {
-                sc->sc_flags &= ~SC_OP_BEACON_SYNC;
-                DPRINTF(sc, ATH_DBG_PS, "Reconfigure Beacon timers based on "
-                        "timestamp from the AP\n");
+        if (sc->ps_flags & PS_BEACON_SYNC) {
+                sc->ps_flags &= ~PS_BEACON_SYNC;
+                ath_print(common, ATH_DBG_PS,
+                          "Reconfigure Beacon timers based on "
+                          "timestamp from the AP\n");
                 ath_beacon_config(sc, NULL);
         }
 
@@ -552,34 +382,36 @@ static void ath_rx_ps_beacon(struct ath_softc *sc, struct sk_buff *skb)
                  * a backup trigger for returning into NETWORK SLEEP state,
                  * so we are waiting for it as well.
                  */
-                DPRINTF(sc, ATH_DBG_PS, "Received DTIM beacon indicating "
-                        "buffered broadcast/multicast frame(s)\n");
-                sc->sc_flags |= SC_OP_WAIT_FOR_CAB | SC_OP_WAIT_FOR_BEACON;
+                ath_print(common, ATH_DBG_PS, "Received DTIM beacon indicating "
+                          "buffered broadcast/multicast frame(s)\n");
+                sc->ps_flags |= PS_WAIT_FOR_CAB | PS_WAIT_FOR_BEACON;
                 return;
         }
 
-        if (sc->sc_flags & SC_OP_WAIT_FOR_CAB) {
+        if (sc->ps_flags & PS_WAIT_FOR_CAB) {
                 /*
                  * This can happen if a broadcast frame is dropped or the AP
                  * fails to send a frame indicating that all CAB frames have
                  * been delivered.
                  */
-                sc->sc_flags &= ~SC_OP_WAIT_FOR_CAB;
-                DPRINTF(sc, ATH_DBG_PS, "PS wait for CAB frames timed out\n");
+                sc->ps_flags &= ~PS_WAIT_FOR_CAB;
+                ath_print(common, ATH_DBG_PS,
+                          "PS wait for CAB frames timed out\n");
         }
 }
 
 static void ath_rx_ps(struct ath_softc *sc, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
         hdr = (struct ieee80211_hdr *)skb->data;
 
         /* Process Beacon and CAB receive in PS state */
-        if ((sc->sc_flags & SC_OP_WAIT_FOR_BEACON) &&
+        if ((sc->ps_flags & PS_WAIT_FOR_BEACON) &&
             ieee80211_is_beacon(hdr->frame_control))
                 ath_rx_ps_beacon(sc, skb);
-        else if ((sc->sc_flags & SC_OP_WAIT_FOR_CAB) &&
+        else if ((sc->ps_flags & PS_WAIT_FOR_CAB) &&
                  (ieee80211_is_data(hdr->frame_control) ||
                   ieee80211_is_action(hdr->frame_control)) &&
                  is_multicast_ether_addr(hdr->addr1) &&
@@ -588,24 +420,26 @@ static void ath_rx_ps(struct ath_softc *sc, struct sk_buff *skb)
                  * No more broadcast/multicast frames to be received at this
                  * point.
                  */
-                sc->sc_flags &= ~SC_OP_WAIT_FOR_CAB;
-                DPRINTF(sc, ATH_DBG_PS, "All PS CAB frames received, back to "
-                        "sleep\n");
-        } else if ((sc->sc_flags & SC_OP_WAIT_FOR_PSPOLL_DATA) &&
+                sc->ps_flags &= ~PS_WAIT_FOR_CAB;
+                ath_print(common, ATH_DBG_PS,
+                          "All PS CAB frames received, back to sleep\n");
+        } else if ((sc->ps_flags & PS_WAIT_FOR_PSPOLL_DATA) &&
                    !is_multicast_ether_addr(hdr->addr1) &&
                    !ieee80211_has_morefrags(hdr->frame_control)) {
-                sc->sc_flags &= ~SC_OP_WAIT_FOR_PSPOLL_DATA;
-                DPRINTF(sc, ATH_DBG_PS, "Going back to sleep after having "
-                        "received PS-Poll data (0x%x)\n",
-                        sc->sc_flags & (SC_OP_WAIT_FOR_BEACON |
-                                        SC_OP_WAIT_FOR_CAB |
-                                        SC_OP_WAIT_FOR_PSPOLL_DATA |
-                                        SC_OP_WAIT_FOR_TX_ACK));
+                sc->ps_flags &= ~PS_WAIT_FOR_PSPOLL_DATA;
+                ath_print(common, ATH_DBG_PS,
+                          "Going back to sleep after having received "
+                          "PS-Poll data (0x%lx)\n",
+                        sc->ps_flags & (PS_WAIT_FOR_BEACON |
+                                        PS_WAIT_FOR_CAB |
+                                        PS_WAIT_FOR_PSPOLL_DATA |
+                                        PS_WAIT_FOR_TX_ACK));
         }
 }
 
-static void ath_rx_send_to_mac80211(struct ath_softc *sc, struct sk_buff *skb,
-                                    struct ieee80211_rx_status *rx_status)
+static void ath_rx_send_to_mac80211(struct ieee80211_hw *hw,
+                                    struct ath_softc *sc, struct sk_buff *skb,
+                                    struct ieee80211_rx_status *rxs)
 {
         struct ieee80211_hdr *hdr;
 
@@ -625,19 +459,14 @@ static void ath_rx_send_to_mac80211(struct ath_softc *sc, struct sk_buff *skb,
                         if (aphy == NULL)
                                 continue;
                         nskb = skb_copy(skb, GFP_ATOMIC);
-                        if (nskb) {
-                                memcpy(IEEE80211_SKB_RXCB(nskb), rx_status,
-                                        sizeof(*rx_status));
-                                ieee80211_rx(aphy->hw, nskb);
-                        }
+                        if (!nskb)
+                                continue;
+                        ieee80211_rx(aphy->hw, nskb);
                 }
-                memcpy(IEEE80211_SKB_RXCB(skb), rx_status, sizeof(*rx_status));
                 ieee80211_rx(sc->hw, skb);
-        } else {
+        } else
                 /* Deliver unicast frames based on receiver address */
-                memcpy(IEEE80211_SKB_RXCB(skb), rx_status, sizeof(*rx_status));
-                ieee80211_rx(ath_get_virt_hw(sc, hdr), skb);
-        }
+                ieee80211_rx(hw, skb);
 }
 
 int ath_rx_tasklet(struct ath_softc *sc, int flush)
@@ -648,14 +477,20 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
 
         struct ath_buf *bf;
         struct ath_desc *ds;
+        struct ath_rx_status *rx_stats;
         struct sk_buff *skb = NULL, *requeue_skb;
-        struct ieee80211_rx_status rx_status;
+        struct ieee80211_rx_status *rxs;
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        /*
+         * The hw can techncically differ from common->hw when using ath9k
+         * virtual wiphy so to account for that we iterate over the active
+         * wiphys and find the appropriate wiphy and therefore hw.
+         */
+        struct ieee80211_hw *hw = NULL;
         struct ieee80211_hdr *hdr;
-        int hdrlen, padsize, retval;
+        int retval;
         bool decrypt_error = false;
-        u8 keyix;
-        __le16 fc;
 
         spin_lock_bh(&sc->rx.rxbuflock);
 
@@ -727,9 +562,17 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                  * 2. requeueing the same buffer to h/w
                  */
                 dma_sync_single_for_cpu(sc->dev, bf->bf_buf_addr,
-                                sc->rx.bufsize,
+                                common->rx_bufsize,
                                 DMA_FROM_DEVICE);
 
+                hdr = (struct ieee80211_hdr *) skb->data;
+                rxs =  IEEE80211_SKB_RXCB(skb);
+
+                hw = ath_get_virt_hw(sc, hdr);
+                rx_stats = &ds->ds_rxstat;
+
+                ath_debug_stat_rx(sc, bf);
+
                 /*
                  * If we're asked to flush receive queue, directly
                  * chain it back at the queue without processing it.
@@ -737,19 +580,14 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                 if (flush)
                         goto requeue;
 
-                if (!ds->ds_rxstat.rs_datalen)
-                        goto requeue;
-
-                /* The status portion of the descriptor could get corrupted. */
-                if (sc->rx.bufsize < ds->ds_rxstat.rs_datalen)
-                        goto requeue;
-
-                if (!ath_rx_prepare(skb, ds, &rx_status, &decrypt_error, sc))
+                retval = ath9k_cmn_rx_skb_preprocess(common, hw, skb, rx_stats,
+                                                     rxs, &decrypt_error);
+                if (retval)
                         goto requeue;
 
                 /* Ensure we always have an skb to requeue once we are done
                  * processing the current buffer's skb */
-                requeue_skb = ath_rxbuf_alloc(&sc->common, sc->rx.bufsize, GFP_ATOMIC);
+                requeue_skb = ath_rxbuf_alloc(common, common->rx_bufsize, GFP_ATOMIC);
 
                 /* If there is no memory we ignore the current RX'd frame,
                  * tell hardware it can give us a new frame using the old
@@ -760,60 +598,26 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
 
                 /* Unmap the frame */
                 dma_unmap_single(sc->dev, bf->bf_buf_addr,
-                                 sc->rx.bufsize,
+                                 common->rx_bufsize,
                                  DMA_FROM_DEVICE);
 
-                skb_put(skb, ds->ds_rxstat.rs_datalen);
-
-                /* see if any padding is done by the hw and remove it */
-                hdr = (struct ieee80211_hdr *)skb->data;
-                hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-                fc = hdr->frame_control;
-
-                /* The MAC header is padded to have 32-bit boundary if the
-                 * packet payload is non-zero. The general calculation for
-                 * padsize would take into account odd header lengths:
-                 * padsize = (4 - hdrlen % 4) % 4; However, since only
-                 * even-length headers are used, padding can only be 0 or 2
-                 * bytes and we can optimize this a bit. In addition, we must
-                 * not try to remove padding from short control frames that do
-                 * not have payload. */
-                padsize = hdrlen & 3;
-                if (padsize && hdrlen >= 24) {
-                        memmove(skb->data + padsize, skb->data, hdrlen);
-                        skb_pull(skb, padsize);
-                }
-
-                keyix = ds->ds_rxstat.rs_keyix;
+                skb_put(skb, rx_stats->rs_datalen);
 
-                if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error) {
-                        rx_status.flag |= RX_FLAG_DECRYPTED;
-                } else if (ieee80211_has_protected(fc)
-                           && !decrypt_error && skb->len >= hdrlen + 4) {
-                        keyix = skb->data[hdrlen + 3] >> 6;
-
-                        if (test_bit(keyix, sc->keymap))
-                                rx_status.flag |= RX_FLAG_DECRYPTED;
-                }
-                if (ah->sw_mgmt_crypto &&
-                    (rx_status.flag & RX_FLAG_DECRYPTED) &&
-                    ieee80211_is_mgmt(fc)) {
-                        /* Use software decrypt for management frames. */
-                        rx_status.flag &= ~RX_FLAG_DECRYPTED;
-                }
+                ath9k_cmn_rx_skb_postprocess(common, skb, rx_stats,
+                                             rxs, decrypt_error);
 
                 /* We will now give hardware our shiny new allocated skb */
                 bf->bf_mpdu = requeue_skb;
                 bf->bf_buf_addr = dma_map_single(sc->dev, requeue_skb->data,
-                                         sc->rx.bufsize,
-                                         DMA_FROM_DEVICE);
+                                                 common->rx_bufsize,
+                                                 DMA_FROM_DEVICE);
                 if (unlikely(dma_mapping_error(sc->dev,
                           bf->bf_buf_addr))) {
                         dev_kfree_skb_any(requeue_skb);
                         bf->bf_mpdu = NULL;
-                        DPRINTF(sc, ATH_DBG_FATAL,
-                                "dma_mapping_error() on RX\n");
-                        ath_rx_send_to_mac80211(sc, skb, &rx_status);
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "dma_mapping_error() on RX\n");
+                        ath_rx_send_to_mac80211(hw, sc, skb, rxs);
                         break;
                 }
                 bf->bf_dmacontext = bf->bf_buf_addr;
@@ -824,17 +628,17 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                  */
                 if (sc->rx.defant != ds->ds_rxstat.rs_antenna) {
                         if (++sc->rx.rxotherant >= 3)
-                                ath_setdefantenna(sc, ds->ds_rxstat.rs_antenna);
+                                ath_setdefantenna(sc, rx_stats->rs_antenna);
                 } else {
                         sc->rx.rxotherant = 0;
                 }
 
-                if (unlikely(sc->sc_flags & (SC_OP_WAIT_FOR_BEACON |
-                                             SC_OP_WAIT_FOR_CAB |
-                                             SC_OP_WAIT_FOR_PSPOLL_DATA)))
+                if (unlikely(sc->ps_flags & (PS_WAIT_FOR_BEACON |
+                                             PS_WAIT_FOR_CAB |
+                                             PS_WAIT_FOR_PSPOLL_DATA)))
                         ath_rx_ps(sc, skb);
 
-                ath_rx_send_to_mac80211(sc, skb, &rx_status);
+                ath_rx_send_to_mac80211(hw, sc, skb, rxs);
 
 requeue:
                 list_move_tail(&bf->list, &sc->rx.rxbuf);
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index d83b77f821e9..72cfa8ebd9ae 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -17,6 +17,8 @@
 #ifndef REG_H
 #define REG_H
 
+#include "../reg.h"
+
 #define AR_CR                0x0008
 #define AR_CR_RXE            0x00000004
 #define AR_CR_RXD            0x00000020
@@ -969,10 +971,10 @@ enum {
 #define AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_S         4
 #define AR_GPIO_INPUT_EN_VAL_RFSILENT_DEF        0x00000080
 #define AR_GPIO_INPUT_EN_VAL_RFSILENT_DEF_S      7
+#define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB      0x00000400
+#define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB_S    10
 #define AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_BB        0x00001000
 #define AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_BB_S      12
-#define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB      0x00001000
-#define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB_S    1
 #define AR_GPIO_INPUT_EN_VAL_RFSILENT_BB         0x00008000
 #define AR_GPIO_INPUT_EN_VAL_RFSILENT_BB_S       15
 #define AR_GPIO_RTC_RESET_OVERRIDE_ENABLE        0x00010000
@@ -1330,13 +1332,22 @@ enum {
 #define AR_MCAST_FIL0       0x8040
 #define AR_MCAST_FIL1       0x8044
 
+/*
+ * AR_DIAG_SW - Register which can be used for diagnostics and testing purposes.
+ *
+ * The force RX abort (AR_DIAG_RX_ABORT, bit 25) can be used in conjunction with
+ * RX block (AR_DIAG_RX_DIS, bit 5) to help fast channel change to shut down
+ * receive. The force RX abort bit will kill any frame which is currently being
+ * transferred between the MAC and baseband. The RX block bit (AR_DIAG_RX_DIS)
+ * will prevent any new frames from getting started.
+ */
 #define AR_DIAG_SW                  0x8048
 #define AR_DIAG_CACHE_ACK           0x00000001
 #define AR_DIAG_ACK_DIS             0x00000002
 #define AR_DIAG_CTS_DIS             0x00000004
 #define AR_DIAG_ENCRYPT_DIS         0x00000008
 #define AR_DIAG_DECRYPT_DIS         0x00000010
-#define AR_DIAG_RX_DIS              0x00000020
+#define AR_DIAG_RX_DIS              0x00000020 /* RX block */
 #define AR_DIAG_LOOP_BACK           0x00000040
 #define AR_DIAG_CORR_FCS            0x00000080
 #define AR_DIAG_CHAN_INFO           0x00000100
@@ -1345,12 +1356,12 @@ enum {
 #define AR_DIAG_FRAME_NV0           0x00020000
 #define AR_DIAG_OBS_PT_SEL1         0x000C0000
 #define AR_DIAG_OBS_PT_SEL1_S       18
-#define AR_DIAG_FORCE_RX_CLEAR      0x00100000
+#define AR_DIAG_FORCE_RX_CLEAR      0x00100000 /* force rx_clear high */
 #define AR_DIAG_IGNORE_VIRT_CS      0x00200000
 #define AR_DIAG_FORCE_CH_IDLE_HIGH  0x00400000
 #define AR_DIAG_EIFS_CTRL_ENA       0x00800000
 #define AR_DIAG_DUAL_CHAIN_INFO     0x01000000
-#define AR_DIAG_RX_ABORT            0x02000000
+#define AR_DIAG_RX_ABORT            0x02000000 /* Force RX abort */
 #define AR_DIAG_SATURATE_CYCLE_CNT  0x04000000
 #define AR_DIAG_OBS_PT_SEL2         0x08000000
 #define AR_DIAG_RX_CLEAR_CTL_LOW    0x10000000
@@ -1421,9 +1432,6 @@ enum {
 #define AR_SLEEP2_BEACON_TIMEOUT    0xFFE00000
 #define AR_SLEEP2_BEACON_TIMEOUT_S  21
 
-#define AR_BSSMSKL            0x80e0
-#define AR_BSSMSKU            0x80e4
-
 #define AR_TPC                 0x80e8
 #define AR_TPC_ACK             0x0000003f
 #define AR_TPC_ACK_S           0x00
@@ -1539,9 +1547,9 @@ enum {
 
 #define AR_BT_COEX_WEIGHT          0x8174
 #define AR_BT_COEX_WGHT            0xff55
-#define AR_STOMP_ALL_WLAN_WGHT     0xffcc
-#define AR_STOMP_LOW_WLAN_WGHT     0xaaa8
-#define AR_STOMP_NONE_WLAN_WGHT    0xaa00
+#define AR_STOMP_ALL_WLAN_WGHT     0xfcfc
+#define AR_STOMP_LOW_WLAN_WGHT     0xa8a8
+#define AR_STOMP_NONE_WLAN_WGHT    0x0000
 #define AR_BTCOEX_BT_WGHT          0x0000ffff
 #define AR_BTCOEX_BT_WGHT_S        0
 #define AR_BTCOEX_WL_WGHT          0xffff0000
@@ -1705,4 +1713,7 @@ enum {
 #define AR_KEYTABLE_MAC0(_n)    (AR_KEYTABLE(_n) + 24)
 #define AR_KEYTABLE_MAC1(_n)    (AR_KEYTABLE(_n) + 28)
 
+#define AR9271_CORE_CLOCK       117   /* clock to 117Mhz */
+#define AR9271_TARGET_BAUD_RATE 19200 /* 115200 */
+
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/virtual.c b/drivers/net/wireless/ath/ath9k/virtual.c
index 19b88f8177fd..00c0e21a4af7 100644
--- a/drivers/net/wireless/ath/ath9k/virtual.c
+++ b/drivers/net/wireless/ath/ath9k/virtual.c
@@ -14,6 +14,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include <linux/slab.h>
+
 #include "ath9k.h"
 
 struct ath9k_vif_iter_data {
@@ -40,6 +42,7 @@ void ath9k_set_bssid_mask(struct ieee80211_hw *hw)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath9k_vif_iter_data iter_data;
         int i, j;
         u8 mask[ETH_ALEN];
@@ -51,7 +54,7 @@ void ath9k_set_bssid_mask(struct ieee80211_hw *hw)
          */
         iter_data.addr = kmalloc(ETH_ALEN, GFP_ATOMIC);
         if (iter_data.addr) {
-                memcpy(iter_data.addr, sc->sc_ah->macaddr, ETH_ALEN);
+                memcpy(iter_data.addr, common->macaddr, ETH_ALEN);
                 iter_data.count = 1;
         } else
                 iter_data.count = 0;
@@ -86,20 +89,21 @@ void ath9k_set_bssid_mask(struct ieee80211_hw *hw)
         kfree(iter_data.addr);
 
         /* Invert the mask and configure hardware */
-        sc->bssidmask[0] = ~mask[0];
-        sc->bssidmask[1] = ~mask[1];
-        sc->bssidmask[2] = ~mask[2];
-        sc->bssidmask[3] = ~mask[3];
-        sc->bssidmask[4] = ~mask[4];
-        sc->bssidmask[5] = ~mask[5];
-
-        ath9k_hw_setbssidmask(sc);
+        common->bssidmask[0] = ~mask[0];
+        common->bssidmask[1] = ~mask[1];
+        common->bssidmask[2] = ~mask[2];
+        common->bssidmask[3] = ~mask[3];
+        common->bssidmask[4] = ~mask[4];
+        common->bssidmask[5] = ~mask[5];
+
+        ath_hw_setbssidmask(common);
 }
 
 int ath9k_wiphy_add(struct ath_softc *sc)
 {
         int i, error;
         struct ath_wiphy *aphy;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ieee80211_hw *hw;
         u8 addr[ETH_ALEN];
 
@@ -138,7 +142,7 @@ int ath9k_wiphy_add(struct ath_softc *sc)
         sc->sec_wiphy[i] = aphy;
         spin_unlock_bh(&sc->wiphy_lock);
 
-        memcpy(addr, sc->sc_ah->macaddr, ETH_ALEN);
+        memcpy(addr, common->macaddr, ETH_ALEN);
         addr[0] |= 0x02; /* Locally managed address */
         /*
          * XOR virtual wiphy index into the least significant bits to generate
@@ -150,7 +154,7 @@ int ath9k_wiphy_add(struct ath_softc *sc)
 
         SET_IEEE80211_PERM_ADDR(hw, addr);
 
-        ath_set_hw_capab(sc, hw);
+        ath9k_set_hw_capab(sc, hw);
 
         error = ieee80211_register_hw(hw);
 
@@ -296,6 +300,7 @@ static void ath9k_wiphy_unpause_channel(struct ath_softc *sc)
 void ath9k_wiphy_chan_work(struct work_struct *work)
 {
         struct ath_softc *sc = container_of(work, struct ath_softc, chan_work);
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_wiphy *aphy = sc->next_wiphy;
 
         if (aphy == NULL)
@@ -311,6 +316,10 @@ void ath9k_wiphy_chan_work(struct work_struct *work)
         /* XXX: remove me eventually */
         ath9k_update_ichannel(sc, aphy->hw,
                               &sc->sc_ah->channels[sc->chan_idx]);
+
+        /* sync hw configuration for hw code */
+        common->hw = aphy->hw;
+
         ath_update_chainmask(sc, sc->chan_is_ht);
         if (ath_set_channel(sc, aphy->hw,
                             &sc->sc_ah->channels[sc->chan_idx]) < 0) {
@@ -331,13 +340,11 @@ void ath9k_wiphy_chan_work(struct work_struct *work)
 void ath9k_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct ath_wiphy *aphy = hw->priv;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-        struct ath_tx_info_priv *tx_info_priv = ATH_TX_INFO_PRIV(tx_info);
 
-        if (tx_info_priv && tx_info_priv->frame_type == ATH9K_INT_PAUSE &&
+        if ((tx_info->pad[0] & ATH_TX_INFO_FRAME_TYPE_PAUSE) &&
             aphy->state == ATH_WIPHY_PAUSING) {
-                if (!(info->flags & IEEE80211_TX_STAT_ACK)) {
+                if (!(tx_info->flags & IEEE80211_TX_STAT_ACK)) {
                         printk(KERN_DEBUG "ath9k: %s: no ACK for pause "
                                "frame\n", wiphy_name(hw->wiphy));
                         /*
@@ -356,9 +363,6 @@ void ath9k_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 }
         }
 
-        kfree(tx_info_priv);
-        tx_info->rate_driver_data[0] = NULL;
-
         dev_kfree_skb(skb);
 }
 
@@ -519,8 +523,9 @@ int ath9k_wiphy_select(struct ath_wiphy *aphy)
                          * frame being completed)
                          */
                         spin_unlock_bh(&sc->wiphy_lock);
-                        ath_radio_disable(sc);
-                        ath_radio_enable(sc);
+                        ath_radio_disable(sc, aphy->hw);
+                        ath_radio_enable(sc, aphy->hw);
+                        /* Only the primary wiphy hw is used for queuing work */
                         ieee80211_queue_work(aphy->sc->hw,
                                    &aphy->sc->chan_work);
                         return -EBUSY; /* previous select still in progress */
@@ -666,15 +671,78 @@ void ath9k_wiphy_set_scheduler(struct ath_softc *sc, unsigned int msec_int)
 bool ath9k_all_wiphys_idle(struct ath_softc *sc)
 {
         unsigned int i;
-        if (sc->pri_wiphy->state != ATH_WIPHY_INACTIVE) {
+        if (!sc->pri_wiphy->idle)
                 return false;
-        }
         for (i = 0; i < sc->num_sec_wiphy; i++) {
                 struct ath_wiphy *aphy = sc->sec_wiphy[i];
                 if (!aphy)
                         continue;
-                if (aphy->state != ATH_WIPHY_INACTIVE)
+                if (!aphy->idle)
                         return false;
         }
         return true;
 }
+
+/* caller must hold wiphy_lock */
+void ath9k_set_wiphy_idle(struct ath_wiphy *aphy, bool idle)
+{
+        struct ath_softc *sc = aphy->sc;
+
+        aphy->idle = idle;
+        ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_CONFIG,
+                  "Marking %s as %s\n",
+                  wiphy_name(aphy->hw->wiphy),
+                  idle ? "idle" : "not-idle");
+}
+/* Only bother starting a queue on an active virtual wiphy */
+void ath_mac80211_start_queue(struct ath_softc *sc, u16 skb_queue)
+{
+        struct ieee80211_hw *hw = sc->pri_wiphy->hw;
+        unsigned int i;
+
+        spin_lock_bh(&sc->wiphy_lock);
+
+        /* Start the primary wiphy */
+        if (sc->pri_wiphy->state == ATH_WIPHY_ACTIVE) {
+                ieee80211_wake_queue(hw, skb_queue);
+                goto unlock;
+        }
+
+        /* Now start the secondary wiphy queues */
+        for (i = 0; i < sc->num_sec_wiphy; i++) {
+                struct ath_wiphy *aphy = sc->sec_wiphy[i];
+                if (!aphy)
+                        continue;
+                if (aphy->state != ATH_WIPHY_ACTIVE)
+                        continue;
+
+                hw = aphy->hw;
+                ieee80211_wake_queue(hw, skb_queue);
+                break;
+        }
+
+unlock:
+        spin_unlock_bh(&sc->wiphy_lock);
+}
+
+/* Go ahead and propagate information to all virtual wiphys, it won't hurt */
+void ath_mac80211_stop_queue(struct ath_softc *sc, u16 skb_queue)
+{
+        struct ieee80211_hw *hw = sc->pri_wiphy->hw;
+        unsigned int i;
+
+        spin_lock_bh(&sc->wiphy_lock);
+
+        /* Stop the primary wiphy */
+        ieee80211_stop_queue(hw, skb_queue);
+
+        /* Now stop the secondary wiphy queues */
+        for (i = 0; i < sc->num_sec_wiphy; i++) {
+                struct ath_wiphy *aphy = sc->sec_wiphy[i];
+                if (!aphy)
+                        continue;
+                hw = aphy->hw;
+                ieee80211_stop_queue(hw, skb_queue);
+        }
+        spin_unlock_bh(&sc->wiphy_lock);
+}
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 42551a48c8ac..294b486bc3ed 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -70,6 +70,29 @@ static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
 static void ath_tx_rc_status(struct ath_buf *bf, struct ath_desc *ds,
                              int nbad, int txok, bool update_rc);
 
+enum {
+        MCS_DEFAULT,
+        MCS_HT40,
+        MCS_HT40_SGI,
+};
+
+static int ath_max_4ms_framelen[3][16] = {
+        [MCS_DEFAULT] = {
+                3216,  6434,  9650,  12868, 19304, 25740,  28956,  32180,
+                6430,  12860, 19300, 25736, 38600, 51472,  57890,  64320,
+        },
+        [MCS_HT40] = {
+                6684,  13368, 20052, 26738, 40104, 53476,  60156,  66840,
+                13360, 26720, 40080, 53440, 80160, 106880, 120240, 133600,
+        },
+        [MCS_HT40_SGI] = {
+                /* TODO: Only MCS 7 and 15 updated, recalculate the rest */
+                6684,  13368, 20052, 26738, 40104, 53476,  60156,  74200,
+                13360, 26720, 40080, 53440, 80160, 106880, 120240, 148400,
+        }
+};
+
+
 /*********************/
 /* Aggregation logic */
 /*********************/
@@ -107,7 +130,7 @@ static void ath_tx_resume_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 {
         struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
 
-        ASSERT(tid->paused > 0);
+        BUG_ON(tid->paused <= 0);
         spin_lock_bh(&txq->axq_lock);
 
         tid->paused--;
@@ -131,7 +154,7 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
         struct list_head bf_head;
         INIT_LIST_HEAD(&bf_head);
 
-        ASSERT(tid->paused > 0);
+        BUG_ON(tid->paused <= 0);
         spin_lock_bh(&txq->axq_lock);
 
         tid->paused--;
@@ -143,7 +166,7 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 
         while (!list_empty(&tid->buf_q)) {
                 bf = list_first_entry(&tid->buf_q, struct ath_buf, list);
-                ASSERT(!bf_isretried(bf));
+                BUG_ON(bf_isretried(bf));
                 list_move_tail(&bf->list, &bf_head);
                 ath_tx_send_ht_normal(sc, txq, tid, &bf_head);
         }
@@ -178,7 +201,7 @@ static void ath_tx_addto_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
         index  = ATH_BA_INDEX(tid->seq_start, bf->bf_seqno);
         cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
 
-        ASSERT(tid->tx_buf[cindex] == NULL);
+        BUG_ON(tid->tx_buf[cindex] != NULL);
         tid->tx_buf[cindex] = bf;
 
         if (index >= ((tid->baw_tail - tid->baw_head) &
@@ -251,6 +274,7 @@ static struct ath_buf* ath_clone_txbuf(struct ath_softc *sc, struct ath_buf *bf)
 
         ATH_TXBUF_RESET(tbf);
 
+        tbf->aphy = bf->aphy;
         tbf->bf_mpdu = bf->bf_mpdu;
         tbf->bf_buf_addr = bf->bf_buf_addr;
         *(tbf->bf_desc) = *(bf->bf_desc);
@@ -267,7 +291,9 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         struct ath_node *an = NULL;
         struct sk_buff *skb;
         struct ieee80211_sta *sta;
+        struct ieee80211_hw *hw;
         struct ieee80211_hdr *hdr;
+        struct ieee80211_tx_info *tx_info;
         struct ath_atx_tid *tid = NULL;
         struct ath_buf *bf_next, *bf_last = bf->bf_lastbf;
         struct ath_desc *ds = bf_last->bf_desc;
@@ -280,9 +306,13 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         skb = bf->bf_mpdu;
         hdr = (struct ieee80211_hdr *)skb->data;
 
+        tx_info = IEEE80211_SKB_CB(skb);
+        hw = bf->aphy->hw;
+
         rcu_read_lock();
 
-        sta = ieee80211_find_sta(sc->hw, hdr->addr1);
+        /* XXX: use ieee80211_find_sta! */
+        sta = ieee80211_find_sta_by_hw(hw, hdr->addr1);
         if (!sta) {
                 rcu_read_unlock();
                 return;
@@ -358,7 +388,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                         else
                                 INIT_LIST_HEAD(&bf_head);
                 } else {
-                        ASSERT(!list_empty(bf_q));
+                        BUG_ON(list_empty(bf_q));
                         list_move_tail(&bf->list, &bf_head);
                 }
 
@@ -452,11 +482,9 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
 static u32 ath_lookup_rate(struct ath_softc *sc, struct ath_buf *bf,
                            struct ath_atx_tid *tid)
 {
-        const struct ath_rate_table *rate_table = sc->cur_rate_table;
         struct sk_buff *skb;
         struct ieee80211_tx_info *tx_info;
         struct ieee80211_tx_rate *rates;
-        struct ath_tx_info_priv *tx_info_priv;
         u32 max_4ms_framelen, frmlen;
         u16 aggr_limit, legacy = 0;
         int i;
@@ -464,7 +492,6 @@ static u32 ath_lookup_rate(struct ath_softc *sc, struct ath_buf *bf,
         skb = bf->bf_mpdu;
         tx_info = IEEE80211_SKB_CB(skb);
         rates = tx_info->control.rates;
-        tx_info_priv = (struct ath_tx_info_priv *)tx_info->rate_driver_data[0];
 
         /*
          * Find the lowest frame length among the rate series that will have a
@@ -475,12 +502,20 @@ static u32 ath_lookup_rate(struct ath_softc *sc, struct ath_buf *bf,
 
         for (i = 0; i < 4; i++) {
                 if (rates[i].count) {
-                        if (!WLAN_RC_PHY_HT(rate_table->info[rates[i].idx].phy)) {
+                        int modeidx;
+                        if (!(rates[i].flags & IEEE80211_TX_RC_MCS)) {
                                 legacy = 1;
                                 break;
                         }
 
-                        frmlen = rate_table->info[rates[i].idx].max_4ms_framelen;
+                        if (rates[i].flags & IEEE80211_TX_RC_SHORT_GI)
+                                modeidx = MCS_HT40_SGI;
+                        else if (rates[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                                modeidx = MCS_HT40;
+                        else
+                                modeidx = MCS_DEFAULT;
+
+                        frmlen = ath_max_4ms_framelen[modeidx][rates[i].idx];
                         max_4ms_framelen = min(max_4ms_framelen, frmlen);
                 }
         }
@@ -518,12 +553,11 @@ static u32 ath_lookup_rate(struct ath_softc *sc, struct ath_buf *bf,
 static int ath_compute_num_delims(struct ath_softc *sc, struct ath_atx_tid *tid,
                                   struct ath_buf *bf, u16 frmlen)
 {
-        const struct ath_rate_table *rt = sc->cur_rate_table;
         struct sk_buff *skb = bf->bf_mpdu;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         u32 nsymbits, nsymbols;
         u16 minlen;
-        u8 rc, flags, rix;
+        u8 flags, rix;
         int width, half_gi, ndelim, mindelim;
 
         /* Select standard number of delimiters based on frame length alone */
@@ -553,7 +587,6 @@ static int ath_compute_num_delims(struct ath_softc *sc, struct ath_atx_tid *tid,
 
         rix = tx_info->control.rates[0].idx;
         flags = tx_info->control.rates[0].flags;
-        rc = rt->info[rix].ratecode;
         width = (flags & IEEE80211_TX_RC_40_MHZ_WIDTH) ? 1 : 0;
         half_gi = (flags & IEEE80211_TX_RC_SHORT_GI) ? 1 : 0;
 
@@ -565,7 +598,7 @@ static int ath_compute_num_delims(struct ath_softc *sc, struct ath_atx_tid *tid,
         if (nsymbols == 0)
                 nsymbols = 1;
 
-        nsymbits = bits_per_symbol[HT_RC_2_MCS(rc)][width];
+        nsymbits = bits_per_symbol[rix][width];
         minlen = (nsymbols * nsymbits) / BITS_PER_BYTE;
 
         if (frmlen < minlen) {
@@ -694,7 +727,6 @@ static void ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
                 /* anchor last desc of aggregate */
                 ath9k_hw_set11n_aggr_last(sc->sc_ah, bf->bf_lastbf->bf_desc);
 
-                txq->axq_aggr_depth++;
                 ath_tx_txqaddbuf(sc, txq, &bf_q);
                 TX_STAT_INC(txq->axq_qnum, a_aggr);
 
@@ -815,6 +847,7 @@ static void ath_txq_drain_pending_buffers(struct ath_softc *sc,
 struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
 {
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_tx_queue_info qi;
         int qnum;
 
@@ -854,9 +887,9 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
                 return NULL;
         }
         if (qnum >= ARRAY_SIZE(sc->tx.txq)) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "qnum %u out of range, max %u!\n",
-                        qnum, (unsigned int)ARRAY_SIZE(sc->tx.txq));
+                ath_print(common, ATH_DBG_FATAL,
+                          "qnum %u out of range, max %u!\n",
+                          qnum, (unsigned int)ARRAY_SIZE(sc->tx.txq));
                 ath9k_hw_releasetxqueue(ah, qnum);
                 return NULL;
         }
@@ -869,8 +902,6 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
                 INIT_LIST_HEAD(&txq->axq_acq);
                 spin_lock_init(&txq->axq_lock);
                 txq->axq_depth = 0;
-                txq->axq_aggr_depth = 0;
-                txq->axq_linkbuf = NULL;
                 txq->axq_tx_inprogress = false;
                 sc->tx.txqsetup |= 1<<qnum;
         }
@@ -884,9 +915,9 @@ int ath_tx_get_qnum(struct ath_softc *sc, int qtype, int haltype)
         switch (qtype) {
         case ATH9K_TX_QUEUE_DATA:
                 if (haltype >= ARRAY_SIZE(sc->tx.hwq_map)) {
-                        DPRINTF(sc, ATH_DBG_FATAL,
-                                "HAL AC %u out of range, max %zu!\n",
-                                haltype, ARRAY_SIZE(sc->tx.hwq_map));
+                        ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
+                                  "HAL AC %u out of range, max %zu!\n",
+                                  haltype, ARRAY_SIZE(sc->tx.hwq_map));
                         return -1;
                 }
                 qnum = sc->tx.hwq_map[haltype];
@@ -906,18 +937,19 @@ int ath_tx_get_qnum(struct ath_softc *sc, int qtype, int haltype)
 struct ath_txq *ath_test_get_txq(struct ath_softc *sc, struct sk_buff *skb)
 {
         struct ath_txq *txq = NULL;
+        u16 skb_queue = skb_get_queue_mapping(skb);
         int qnum;
 
-        qnum = ath_get_hal_qnum(skb_get_queue_mapping(skb), sc);
+        qnum = ath_get_hal_qnum(skb_queue, sc);
         txq = &sc->tx.txq[qnum];
 
         spin_lock_bh(&txq->axq_lock);
 
         if (txq->axq_depth >= (ATH_TXBUF - 20)) {
-                DPRINTF(sc, ATH_DBG_XMIT,
-                        "TX queue: %d is full, depth: %d\n",
-                        qnum, txq->axq_depth);
-                ieee80211_stop_queue(sc->hw, skb_get_queue_mapping(skb));
+                ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_XMIT,
+                          "TX queue: %d is full, depth: %d\n",
+                          qnum, txq->axq_depth);
+                ath_mac80211_stop_queue(sc, skb_queue);
                 txq->stopped = 1;
                 spin_unlock_bh(&txq->axq_lock);
                 return NULL;
@@ -945,7 +977,7 @@ int ath_txq_update(struct ath_softc *sc, int qnum,
                 return 0;
         }
 
-        ASSERT(sc->tx.txq[qnum].axq_qnum == qnum);
+        BUG_ON(sc->tx.txq[qnum].axq_qnum != qnum);
 
         ath9k_hw_get_txq_props(ah, qnum, &qi);
         qi.tqi_aifs = qinfo->tqi_aifs;
@@ -955,8 +987,8 @@ int ath_txq_update(struct ath_softc *sc, int qnum,
         qi.tqi_readyTime = qinfo->tqi_readyTime;
 
         if (!ath9k_hw_set_txq_props(ah, qnum, &qi)) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Unable to update hardware queue %u!\n", qnum);
+                ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
+                          "Unable to update hardware queue %u!\n", qnum);
                 error = -EIO;
         } else {
                 ath9k_hw_resettxqueue(ah, qnum);
@@ -1004,7 +1036,6 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
 
                 if (list_empty(&txq->axq_q)) {
                         txq->axq_link = NULL;
-                        txq->axq_linkbuf = NULL;
                         spin_unlock_bh(&txq->axq_lock);
                         break;
                 }
@@ -1055,6 +1086,7 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
 void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
 {
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_txq *txq;
         int i, npend = 0;
 
@@ -1076,14 +1108,15 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
         if (npend) {
                 int r;
 
-                DPRINTF(sc, ATH_DBG_XMIT, "Unable to stop TxDMA. Reset HAL!\n");
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to stop TxDMA. Reset HAL!\n");
 
                 spin_lock_bh(&sc->sc_resetlock);
-                r = ath9k_hw_reset(ah, sc->sc_ah->curchan, true);
+                r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false);
                 if (r)
-                        DPRINTF(sc, ATH_DBG_FATAL,
-                                "Unable to reset hardware; reset status %d\n",
-                                r);
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "Unable to reset hardware; reset status %d\n",
+                                  r);
                 spin_unlock_bh(&sc->sc_resetlock);
         }
 
@@ -1147,8 +1180,8 @@ int ath_tx_setup(struct ath_softc *sc, int haltype)
         struct ath_txq *txq;
 
         if (haltype >= ARRAY_SIZE(sc->tx.hwq_map)) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "HAL AC %u out of range, max %zu!\n",
+                ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
+                          "HAL AC %u out of range, max %zu!\n",
                          haltype, ARRAY_SIZE(sc->tx.hwq_map));
                 return 0;
         }
@@ -1172,6 +1205,7 @@ static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
                              struct list_head *head)
 {
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_buf *bf;
 
         /*
@@ -1186,21 +1220,20 @@ static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
 
         list_splice_tail_init(head, &txq->axq_q);
         txq->axq_depth++;
-        txq->axq_linkbuf = list_entry(txq->axq_q.prev, struct ath_buf, list);
 
-        DPRINTF(sc, ATH_DBG_QUEUE,
-                "qnum: %d, txq depth: %d\n", txq->axq_qnum, txq->axq_depth);
+        ath_print(common, ATH_DBG_QUEUE,
+                  "qnum: %d, txq depth: %d\n", txq->axq_qnum, txq->axq_depth);
 
         if (txq->axq_link == NULL) {
                 ath9k_hw_puttxbuf(ah, txq->axq_qnum, bf->bf_daddr);
-                DPRINTF(sc, ATH_DBG_XMIT,
-                        "TXDP[%u] = %llx (%p)\n",
-                        txq->axq_qnum, ito64(bf->bf_daddr), bf->bf_desc);
+                ath_print(common, ATH_DBG_XMIT,
+                          "TXDP[%u] = %llx (%p)\n",
+                          txq->axq_qnum, ito64(bf->bf_daddr), bf->bf_desc);
         } else {
                 *txq->axq_link = bf->bf_daddr;
-                DPRINTF(sc, ATH_DBG_XMIT, "link[%u] (%p)=%llx (%p)\n",
-                        txq->axq_qnum, txq->axq_link,
-                        ito64(bf->bf_daddr), bf->bf_desc);
+                ath_print(common, ATH_DBG_XMIT, "link[%u] (%p)=%llx (%p)\n",
+                          txq->axq_qnum, txq->axq_link,
+                          ito64(bf->bf_daddr), bf->bf_desc);
         }
         txq->axq_link = &(bf->bf_lastbf->bf_desc->ds_link);
         ath9k_hw_txstart(ah, txq->axq_qnum);
@@ -1320,25 +1353,6 @@ static enum ath9k_pkt_type get_hw_packet_type(struct sk_buff *skb)
         return htype;
 }
 
-static bool is_pae(struct sk_buff *skb)
-{
-        struct ieee80211_hdr *hdr;
-        __le16 fc;
-
-        hdr = (struct ieee80211_hdr *)skb->data;
-        fc = hdr->frame_control;
-
-        if (ieee80211_is_data(fc)) {
-                if (ieee80211_is_nullfunc(fc) ||
-                    /* Port Access Entity (IEEE 802.1X) */
-                    (skb->protocol == cpu_to_be16(ETH_P_PAE))) {
-                        return true;
-                }
-        }
-
-        return false;
-}
-
 static int get_hw_crypto_keytype(struct sk_buff *skb)
 {
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
@@ -1381,17 +1395,9 @@ static void assign_aggr_tid_seqno(struct sk_buff *skb,
          * For HT capable stations, we save tidno for later use.
          * We also override seqno set by upper layer with the one
          * in tx aggregation state.
-         *
-         * If fragmentation is on, the sequence number is
-         * not overridden, since it has been
-         * incremented by the fragmentation routine.
-         *
-         * FIXME: check if the fragmentation threshold exceeds
-         * IEEE80211 max.
          */
         tid = ATH_AN_2_TID(an, bf->bf_tidno);
-        hdr->seq_ctrl = cpu_to_le16(tid->seq_next <<
-                        IEEE80211_SEQ_SEQ_SHIFT);
+        hdr->seq_ctrl = cpu_to_le16(tid->seq_next << IEEE80211_SEQ_SEQ_SHIFT);
         bf->bf_seqno = tid->seq_next;
         INCR(tid->seq_next, IEEE80211_SEQ_MAX);
 }
@@ -1420,22 +1426,14 @@ static int setup_tx_flags(struct ath_softc *sc, struct sk_buff *skb,
 static u32 ath_pkt_duration(struct ath_softc *sc, u8 rix, struct ath_buf *bf,
                             int width, int half_gi, bool shortPreamble)
 {
-        const struct ath_rate_table *rate_table = sc->cur_rate_table;
         u32 nbits, nsymbits, duration, nsymbols;
-        u8 rc;
         int streams, pktlen;
 
         pktlen = bf_isaggr(bf) ? bf->bf_al : bf->bf_frmlen;
-        rc = rate_table->info[rix].ratecode;
-
-        /* for legacy rates, use old function to compute packet duration */
-        if (!IS_HT_RATE(rc))
-                return ath9k_hw_computetxtime(sc->sc_ah, rate_table, pktlen,
-                                              rix, shortPreamble);
 
         /* find number of symbols: PLCP + data */
         nbits = (pktlen << 3) + OFDM_PLCP_BITS;
-        nsymbits = bits_per_symbol[HT_RC_2_MCS(rc)][width];
+        nsymbits = bits_per_symbol[rix][width];
         nsymbols = (nbits + nsymbits - 1) / nsymbits;
 
         if (!half_gi)
@@ -1444,7 +1442,7 @@ static u32 ath_pkt_duration(struct ath_softc *sc, u8 rix, struct ath_buf *bf,
                 duration = SYMBOL_TIME_HALFGI(nsymbols);
 
         /* addup duration for legacy/ht training and signal fields */
-        streams = HT_RC_2_STREAMS(rc);
+        streams = HT_RC_2_STREAMS(rix);
         duration += L_STF + L_LTF + L_SIG + HT_SIG + HT_STF + HT_LTF(streams);
 
         return duration;
@@ -1452,11 +1450,12 @@ static u32 ath_pkt_duration(struct ath_softc *sc, u8 rix, struct ath_buf *bf,
 
 static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf)
 {
-        const struct ath_rate_table *rt = sc->cur_rate_table;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath9k_11n_rate_series series[4];
         struct sk_buff *skb;
         struct ieee80211_tx_info *tx_info;
         struct ieee80211_tx_rate *rates;
+        const struct ieee80211_rate *rate;
         struct ieee80211_hdr *hdr;
         int i, flags = 0;
         u8 rix = 0, ctsrate = 0;
@@ -1475,59 +1474,76 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf)
          * checking the BSS's global flag.
          * But for the rate series, IEEE80211_TX_RC_USE_SHORT_PREAMBLE is used.
          */
+        rate = ieee80211_get_rts_cts_rate(sc->hw, tx_info);
+        ctsrate = rate->hw_value;
         if (sc->sc_flags & SC_OP_PREAMBLE_SHORT)
-                ctsrate = rt->info[tx_info->control.rts_cts_rate_idx].ratecode |
-                        rt->info[tx_info->control.rts_cts_rate_idx].short_preamble;
-        else
-                ctsrate = rt->info[tx_info->control.rts_cts_rate_idx].ratecode;
-
-        /*
-         * ATH9K_TXDESC_RTSENA and ATH9K_TXDESC_CTSENA are mutually exclusive.
-         * Check the first rate in the series to decide whether RTS/CTS
-         * or CTS-to-self has to be used.
-         */
-        if (rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
-                flags = ATH9K_TXDESC_CTSENA;
-        else if (rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
-                flags = ATH9K_TXDESC_RTSENA;
-
-        /* FIXME: Handle aggregation protection */
-        if (sc->config.ath_aggr_prot &&
-            (!bf_isaggr(bf) || (bf_isaggr(bf) && bf->bf_al < 8192))) {
-                flags = ATH9K_TXDESC_RTSENA;
-        }
-
-        /* For AR5416 - RTS cannot be followed by a frame larger than 8K */
-        if (bf_isaggr(bf) && (bf->bf_al > sc->sc_ah->caps.rts_aggr_limit))
-                flags &= ~(ATH9K_TXDESC_RTSENA);
+                ctsrate |= rate->hw_value_short;
 
         for (i = 0; i < 4; i++) {
+                bool is_40, is_sgi, is_sp;
+                int phy;
+
                 if (!rates[i].count || (rates[i].idx < 0))
                         continue;
 
                 rix = rates[i].idx;
                 series[i].Tries = rates[i].count;
-                series[i].ChSel = sc->tx_chainmask;
+                series[i].ChSel = common->tx_chainmask;
 
-                if (rates[i].flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
-                        series[i].Rate = rt->info[rix].ratecode |
-                                rt->info[rix].short_preamble;
-                else
-                        series[i].Rate = rt->info[rix].ratecode;
-
-                if (rates[i].flags & IEEE80211_TX_RC_USE_RTS_CTS)
+                if ((sc->config.ath_aggr_prot && bf_isaggr(bf)) ||
+                    (rates[i].flags & IEEE80211_TX_RC_USE_RTS_CTS)) {
+                        series[i].RateFlags |= ATH9K_RATESERIES_RTS_CTS;
+                        flags |= ATH9K_TXDESC_RTSENA;
+                } else if (rates[i].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
                         series[i].RateFlags |= ATH9K_RATESERIES_RTS_CTS;
+                        flags |= ATH9K_TXDESC_CTSENA;
+                }
+
                 if (rates[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
                         series[i].RateFlags |= ATH9K_RATESERIES_2040;
                 if (rates[i].flags & IEEE80211_TX_RC_SHORT_GI)
                         series[i].RateFlags |= ATH9K_RATESERIES_HALFGI;
 
-                series[i].PktDuration = ath_pkt_duration(sc, rix, bf,
-                         (rates[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH) != 0,
-                         (rates[i].flags & IEEE80211_TX_RC_SHORT_GI),
-                         (rates[i].flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE));
+                is_sgi = !!(rates[i].flags & IEEE80211_TX_RC_SHORT_GI);
+                is_40 = !!(rates[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH);
+                is_sp = !!(rates[i].flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE);
+
+                if (rates[i].flags & IEEE80211_TX_RC_MCS) {
+                        /* MCS rates */
+                        series[i].Rate = rix | 0x80;
+                        series[i].PktDuration = ath_pkt_duration(sc, rix, bf,
+                                 is_40, is_sgi, is_sp);
+                        continue;
+                }
+
+                /* legcay rates */
+                if ((tx_info->band == IEEE80211_BAND_2GHZ) &&
+                    !(rate->flags & IEEE80211_RATE_ERP_G))
+                        phy = WLAN_RC_PHY_CCK;
+                else
+                        phy = WLAN_RC_PHY_OFDM;
+
+                rate = &sc->sbands[tx_info->band].bitrates[rates[i].idx];
+                series[i].Rate = rate->hw_value;
+                if (rate->hw_value_short) {
+                        if (rates[i].flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
+                                series[i].Rate |= rate->hw_value_short;
+                } else {
+                        is_sp = false;
+                }
+
+                series[i].PktDuration = ath9k_hw_computetxtime(sc->sc_ah,
+                        phy, rate->bitrate * 100, bf->bf_frmlen, rix, is_sp);
         }
 
+        /* For AR5416 - RTS cannot be followed by a frame larger than 8K */
+        if (bf_isaggr(bf) && (bf->bf_al > sc->sc_ah->caps.rts_aggr_limit))
+                flags &= ~ATH9K_TXDESC_RTSENA;
+
+        /* ATH9K_TXDESC_RTSENA and ATH9K_TXDESC_CTSENA are mutually exclusive. */
+        if (flags & ATH9K_TXDESC_RTSENA)
+                flags &= ~ATH9K_TXDESC_CTSENA;
+
         /* set dur_update_en for l-sig computation except for PS-Poll frames */
         ath9k_hw_set11n_ratescenario(sc->sc_ah, bf->bf_desc,
                                      bf->bf_lastbf->bf_desc,
@@ -1546,24 +1562,36 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
         struct ath_softc *sc = aphy->sc;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        struct ath_tx_info_priv *tx_info_priv;
         int hdrlen;
         __le16 fc;
+        int padpos, padsize;
 
-        tx_info_priv = kzalloc(sizeof(*tx_info_priv), GFP_ATOMIC);
-        if (unlikely(!tx_info_priv))
-                return -ENOMEM;
-        tx_info->rate_driver_data[0] = tx_info_priv;
-        tx_info_priv->aphy = aphy;
-        tx_info_priv->frame_type = txctl->frame_type;
+        tx_info->pad[0] = 0;
+        switch (txctl->frame_type) {
+        case ATH9K_NOT_INTERNAL:
+                break;
+        case ATH9K_INT_PAUSE:
+                tx_info->pad[0] |= ATH_TX_INFO_FRAME_TYPE_PAUSE;
+                /* fall through */
+        case ATH9K_INT_UNPAUSE:
+                tx_info->pad[0] |= ATH_TX_INFO_FRAME_TYPE_INTERNAL;
+                break;
+        }
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
         fc = hdr->frame_control;
 
         ATH_TXBUF_RESET(bf);
 
-        bf->bf_frmlen = skb->len + FCS_LEN - (hdrlen & 3);
+        bf->aphy = aphy;
+        bf->bf_frmlen = skb->len + FCS_LEN;
+        /* Remove the padding size from bf_frmlen, if any */
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padsize = padpos & 3;
+        if (padsize && skb->len>padpos+padsize) {
+                bf->bf_frmlen -= padsize;
+        }
 
-        if (conf_is_ht(&sc->hw->conf) && !is_pae(skb))
+        if (conf_is_ht(&hw->conf))
                 bf->bf_state.bf_type |= BUF_HT;
 
         bf->bf_flags = setup_tx_flags(sc, skb, txctl->txq);
@@ -1576,7 +1604,8 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
                 bf->bf_keyix = ATH9K_TXKEYIX_INVALID;
         }
 
-        if (ieee80211_is_data_qos(fc) && (sc->sc_flags & SC_OP_TXAGGR))
+        if (ieee80211_is_data_qos(fc) && bf_isht(bf) &&
+            (sc->sc_flags & SC_OP_TXAGGR))
                 assign_aggr_tid_seqno(skb, bf);
 
         bf->bf_mpdu = skb;
@@ -1585,13 +1614,20 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
                                            skb->len, DMA_TO_DEVICE);
         if (unlikely(dma_mapping_error(sc->dev, bf->bf_dmacontext))) {
                 bf->bf_mpdu = NULL;
-                kfree(tx_info_priv);
-                tx_info->rate_driver_data[0] = NULL;
-                DPRINTF(sc, ATH_DBG_FATAL, "dma_mapping_error() on TX\n");
+                ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
+                          "dma_mapping_error() on TX\n");
                 return -ENOMEM;
         }
 
         bf->bf_buf_addr = bf->bf_dmacontext;
+
+        /* tag if this is a nullfunc frame to enable PS when AP acks it */
+        if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc)) {
+                bf->bf_isnullfunc = true;
+                sc->ps_flags &= ~PS_NULLFUNC_COMPLETED;
+        } else
+                bf->bf_isnullfunc = false;
+
         return 0;
 }
 
@@ -1669,12 +1705,13 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_buf *bf;
         int r;
 
         bf = ath_tx_get_buffer(sc);
         if (!bf) {
-                DPRINTF(sc, ATH_DBG_XMIT, "TX buffers are full\n");
+                ath_print(common, ATH_DBG_XMIT, "TX buffers are full\n");
                 return -1;
         }
 
@@ -1682,7 +1719,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         if (unlikely(r)) {
                 struct ath_txq *txq = txctl->txq;
 
-                DPRINTF(sc, ATH_DBG_FATAL, "TX mem alloc failure\n");
+                ath_print(common, ATH_DBG_FATAL, "TX mem alloc failure\n");
 
                 /* upon ath_tx_processq() this TX queue will be resumed, we
                  * guarantee this will happen by knowing beforehand that
@@ -1690,8 +1727,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                  * on the queue */
                 spin_lock_bh(&txq->axq_lock);
                 if (sc->tx.txq[txq->axq_qnum].axq_depth > 1) {
-                        ieee80211_stop_queue(sc->hw,
-                                skb_get_queue_mapping(skb));
+                        ath_mac80211_stop_queue(sc, skb_get_queue_mapping(skb));
                         txq->stopped = 1;
                 }
                 spin_unlock_bh(&txq->axq_lock);
@@ -1712,7 +1748,9 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
-        int hdrlen, padsize;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        int padpos, padsize;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ath_tx_control txctl;
 
@@ -1724,7 +1762,6 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
          * BSSes.
          */
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
-                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
                 if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
                         sc->tx.seq_no += 0x10;
                 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
@@ -1732,24 +1769,26 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
         }
 
         /* Add the padding after the header if this is not already done */
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        if (hdrlen & 3) {
-                padsize = hdrlen % 4;
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padsize = padpos & 3;
+        if (padsize && skb->len>padpos) {
                 if (skb_headroom(skb) < padsize) {
-                        DPRINTF(sc, ATH_DBG_XMIT, "TX CABQ padding failed\n");
+                        ath_print(common, ATH_DBG_XMIT,
+                                  "TX CABQ padding failed\n");
                         dev_kfree_skb_any(skb);
                         return;
                 }
                 skb_push(skb, padsize);
-                memmove(skb->data, skb->data + padsize, hdrlen);
+                memmove(skb->data, skb->data + padsize, padpos);
         }
 
         txctl.txq = sc->beacon.cabq;
 
-        DPRINTF(sc, ATH_DBG_XMIT, "transmitting CABQ packet, skb: %p\n", skb);
+        ath_print(common, ATH_DBG_XMIT,
+                  "transmitting CABQ packet, skb: %p\n", skb);
 
         if (ath_tx_start(hw, skb, &txctl) != 0) {
-                DPRINTF(sc, ATH_DBG_XMIT, "CABQ TX failed\n");
+                ath_print(common, ATH_DBG_XMIT, "CABQ TX failed\n");
                 goto exit;
         }
 
@@ -1763,26 +1802,18 @@ exit:
 /*****************/
 
 static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
-                            int tx_flags)
+                            struct ath_wiphy *aphy, int tx_flags)
 {
         struct ieee80211_hw *hw = sc->hw;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-        struct ath_tx_info_priv *tx_info_priv = ATH_TX_INFO_PRIV(tx_info);
-        int hdrlen, padsize;
-        int frame_type = ATH9K_NOT_INTERNAL;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
+        int padpos, padsize;
 
-        DPRINTF(sc, ATH_DBG_XMIT, "TX complete: skb: %p\n", skb);
-
-        if (tx_info_priv) {
-                hw = tx_info_priv->aphy->hw;
-                frame_type = tx_info_priv->frame_type;
-        }
+        ath_print(common, ATH_DBG_XMIT, "TX complete: skb: %p\n", skb);
 
-        if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK ||
-            tx_info->flags & IEEE80211_TX_STAT_TX_FILTERED) {
-                kfree(tx_info_priv);
-                tx_info->rate_driver_data[0] = NULL;
-        }
+        if (aphy)
+                hw = aphy->hw;
 
         if (tx_flags & ATH_TX_BAR)
                 tx_info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
@@ -1792,31 +1823,32 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                 tx_info->flags |= IEEE80211_TX_STAT_ACK;
         }
 
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        padsize = hdrlen & 3;
-        if (padsize && hdrlen >= 24) {
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padsize = padpos & 3;
+        if (padsize && skb->len>padpos+padsize) {
                 /*
                  * Remove MAC header padding before giving the frame back to
                  * mac80211.
                  */
-                memmove(skb->data + padsize, skb->data, hdrlen);
+                memmove(skb->data + padsize, skb->data, padpos);
                 skb_pull(skb, padsize);
         }
 
-        if (sc->sc_flags & SC_OP_WAIT_FOR_TX_ACK) {
-                sc->sc_flags &= ~SC_OP_WAIT_FOR_TX_ACK;
-                DPRINTF(sc, ATH_DBG_PS, "Going back to sleep after having "
-                        "received TX status (0x%x)\n",
-                        sc->sc_flags & (SC_OP_WAIT_FOR_BEACON |
-                                        SC_OP_WAIT_FOR_CAB |
-                                        SC_OP_WAIT_FOR_PSPOLL_DATA |
-                                        SC_OP_WAIT_FOR_TX_ACK));
+        if (sc->ps_flags & PS_WAIT_FOR_TX_ACK) {
+                sc->ps_flags &= ~PS_WAIT_FOR_TX_ACK;
+                ath_print(common, ATH_DBG_PS,
+                          "Going back to sleep after having "
+                          "received TX status (0x%lx)\n",
+                        sc->ps_flags & (PS_WAIT_FOR_BEACON |
+                                        PS_WAIT_FOR_CAB |
+                                        PS_WAIT_FOR_PSPOLL_DATA |
+                                        PS_WAIT_FOR_TX_ACK));
         }
 
-        if (frame_type == ATH9K_NOT_INTERNAL)
-                ieee80211_tx_status(hw, skb);
-        else
+        if (unlikely(tx_info->pad[0] & ATH_TX_INFO_FRAME_TYPE_INTERNAL))
                 ath9k_tx_status(hw, skb);
+        else
+                ieee80211_tx_status(hw, skb);
 }
 
 static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
@@ -1839,7 +1871,7 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
         }
 
         dma_unmap_single(sc->dev, bf->bf_dmacontext, skb->len, DMA_TO_DEVICE);
-        ath_tx_complete(sc, skb, tx_flags);
+        ath_tx_complete(sc, skb, bf->aphy, tx_flags);
         ath_debug_stat_tx(sc, txq, bf);
 
         /*
@@ -1887,8 +1919,7 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_desc *ds,
         struct sk_buff *skb = bf->bf_mpdu;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-        struct ath_tx_info_priv *tx_info_priv = ATH_TX_INFO_PRIV(tx_info);
-        struct ieee80211_hw *hw = tx_info_priv->aphy->hw;
+        struct ieee80211_hw *hw = bf->aphy->hw;
         u8 i, tx_rateindex;
 
         if (txok)
@@ -1897,22 +1928,29 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_desc *ds,
         tx_rateindex = ds->ds_txstat.ts_rateindex;
         WARN_ON(tx_rateindex >= hw->max_rates);
 
-        tx_info_priv->update_rc = update_rc;
+        if (update_rc)
+                tx_info->pad[0] |= ATH_TX_INFO_UPDATE_RC;
         if (ds->ds_txstat.ts_status & ATH9K_TXERR_FILT)
                 tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
 
         if ((ds->ds_txstat.ts_status & ATH9K_TXERR_FILT) == 0 &&
             (bf->bf_flags & ATH9K_TXDESC_NOACK) == 0 && update_rc) {
                 if (ieee80211_is_data(hdr->frame_control)) {
-                        memcpy(&tx_info_priv->tx, &ds->ds_txstat,
-                               sizeof(tx_info_priv->tx));
-                        tx_info_priv->n_frames = bf->bf_nframes;
-                        tx_info_priv->n_bad_frames = nbad;
+                        if (ds->ds_txstat.ts_flags &
+                            (ATH9K_TX_DATA_UNDERRUN | ATH9K_TX_DELIM_UNDERRUN))
+                                tx_info->pad[0] |= ATH_TX_INFO_UNDERRUN;
+                        if ((ds->ds_txstat.ts_status & ATH9K_TXERR_XRETRY) ||
+                            (ds->ds_txstat.ts_status & ATH9K_TXERR_FIFO))
+                                tx_info->pad[0] |= ATH_TX_INFO_XRETRY;
+                        tx_info->status.ampdu_len = bf->bf_nframes;
+                        tx_info->status.ampdu_ack_len = bf->bf_nframes - nbad;
                 }
         }
 
-        for (i = tx_rateindex + 1; i < hw->max_rates; i++)
+        for (i = tx_rateindex + 1; i < hw->max_rates; i++) {
                 tx_info->status.rates[i].count = 0;
+                tx_info->status.rates[i].idx = -1;
+        }
 
         tx_info->status.rates[tx_rateindex].count = bf->bf_retries + 1;
 }
@@ -1926,7 +1964,7 @@ static void ath_wake_mac80211_queue(struct ath_softc *sc, struct ath_txq *txq)
             sc->tx.txq[txq->axq_qnum].axq_depth <= (ATH_TXBUF - 20)) {
                 qnum = ath_get_mac80211_qnum(txq->axq_qnum, sc);
                 if (qnum != -1) {
-                        ieee80211_wake_queue(sc->hw, qnum);
+                        ath_mac80211_start_queue(sc, qnum);
                         txq->stopped = 0;
                 }
         }
@@ -1936,21 +1974,21 @@ static void ath_wake_mac80211_queue(struct ath_softc *sc, struct ath_txq *txq)
 static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
 {
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_buf *bf, *lastbf, *bf_held = NULL;
         struct list_head bf_head;
         struct ath_desc *ds;
         int txok;
         int status;
 
-        DPRINTF(sc, ATH_DBG_QUEUE, "tx queue %d (%x), link %p\n",
-                txq->axq_qnum, ath9k_hw_gettxbuf(sc->sc_ah, txq->axq_qnum),
-                txq->axq_link);
+        ath_print(common, ATH_DBG_QUEUE, "tx queue %d (%x), link %p\n",
+                  txq->axq_qnum, ath9k_hw_gettxbuf(sc->sc_ah, txq->axq_qnum),
+                  txq->axq_link);
 
         for (;;) {
                 spin_lock_bh(&txq->axq_lock);
                 if (list_empty(&txq->axq_q)) {
                         txq->axq_link = NULL;
-                        txq->axq_linkbuf = NULL;
                         spin_unlock_bh(&txq->axq_lock);
                         break;
                 }
@@ -1984,10 +2022,18 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                         spin_unlock_bh(&txq->axq_lock);
                         break;
                 }
-                if (bf->bf_desc == txq->axq_lastdsWithCTS)
-                        txq->axq_lastdsWithCTS = NULL;
-                if (ds == txq->axq_gatingds)
-                        txq->axq_gatingds = NULL;
+
+                /*
+                 * We now know the nullfunc frame has been ACKed so we
+                 * can disable RX.
+                 */
+                if (bf->bf_isnullfunc &&
+                    (ds->ds_txstat.ts_status & ATH9K_TX_ACKED)) {
+                        if ((sc->ps_flags & PS_ENABLED))
+                                ath9k_enable_ps(sc);
+                        else
+                                sc->ps_flags |= PS_NULLFUNC_COMPLETED;
+                }
 
                 /*
                  * Remove ath_buf's of the same transmit unit from txq,
@@ -2001,10 +2047,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                                 &txq->axq_q, lastbf->list.prev);
 
                 txq->axq_depth--;
-                if (bf_isaggr(bf))
-                        txq->axq_aggr_depth--;
-
-                txok = (ds->ds_txstat.ts_status == 0);
+                txok = !(ds->ds_txstat.ts_status & ATH9K_TXERR_MASK);
                 txq->axq_tx_inprogress = false;
                 spin_unlock_bh(&txq->axq_lock);
 
@@ -2064,8 +2107,11 @@ static void ath_tx_complete_poll_work(struct work_struct *work)
                 }
 
         if (needreset) {
-                DPRINTF(sc, ATH_DBG_RESET, "tx hung, resetting the chip\n");
+                ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_RESET,
+                          "tx hung, resetting the chip\n");
+                ath9k_ps_wakeup(sc);
                 ath_reset(sc, false);
+                ath9k_ps_restore(sc);
         }
 
         ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
@@ -2093,6 +2139,7 @@ void ath_tx_tasklet(struct ath_softc *sc)
 
 int ath_tx_init(struct ath_softc *sc, int nbufs)
 {
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         int error = 0;
 
         spin_lock_init(&sc->tx.txbuflock);
@@ -2100,16 +2147,16 @@ int ath_tx_init(struct ath_softc *sc, int nbufs)
         error = ath_descdma_setup(sc, &sc->tx.txdma, &sc->tx.txbuf,
                                   "tx", nbufs, 1);
         if (error != 0) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Failed to allocate tx descriptors: %d\n", error);
+                ath_print(common, ATH_DBG_FATAL,
+                          "Failed to allocate tx descriptors: %d\n", error);
                 goto err;
         }
 
         error = ath_descdma_setup(sc, &sc->beacon.bdma, &sc->beacon.bbuf,
                                   "beacon", ATH_BCBUF, 1);
         if (error != 0) {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "Failed to allocate beacon descriptors: %d\n", error);
+                ath_print(common, ATH_DBG_FATAL,
+                          "Failed to allocate beacon descriptors: %d\n", error);
                 goto err;
         }
 
@@ -2192,7 +2239,7 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
                 if (ATH_TXQ_SETUP(sc, i)) {
                         txq = &sc->tx.txq[i];
 
-                        spin_lock(&txq->axq_lock);
+                        spin_lock_bh(&txq->axq_lock);
 
                         list_for_each_entry_safe(ac,
                                         ac_tmp, &txq->axq_acq, list) {
@@ -2213,7 +2260,7 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
                                 }
                         }
 
-                        spin_unlock(&txq->axq_lock);
+                        spin_unlock_bh(&txq->axq_lock);
                 }
         }
 }
diff --git a/drivers/net/wireless/ath/debug.c b/drivers/net/wireless/ath/debug.c
new file mode 100644
index 000000000000..53e77bd131b9
--- /dev/null
+++ b/drivers/net/wireless/ath/debug.c
@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ath.h"
+#include "debug.h"
+
+void ath_print(struct ath_common *common, int dbg_mask, const char *fmt, ...)
+{
+        va_list args;
+
+        if (likely(!(common->debug_mask & dbg_mask)))
+                return;
+
+        va_start(args, fmt);
+        printk(KERN_DEBUG "ath: ");
+        vprintk(fmt, args);
+        va_end(args);
+}
+EXPORT_SYMBOL(ath_print);
diff --git a/drivers/net/wireless/ath/debug.h b/drivers/net/wireless/ath/debug.h
new file mode 100644
index 000000000000..8263633c003c
--- /dev/null
+++ b/drivers/net/wireless/ath/debug.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef ATH_DEBUG_H
+#define ATH_DEBUG_H
+
+#include "ath.h"
+
+/**
+ * enum ath_debug_level - atheros wireless debug level
+ *
+ * @ATH_DBG_RESET: reset processing
+ * @ATH_DBG_QUEUE: hardware queue management
+ * @ATH_DBG_EEPROM: eeprom processing
+ * @ATH_DBG_CALIBRATE: periodic calibration
+ * @ATH_DBG_INTERRUPT: interrupt processing
+ * @ATH_DBG_REGULATORY: regulatory processing
+ * @ATH_DBG_ANI: adaptive noise immunitive processing
+ * @ATH_DBG_XMIT: basic xmit operation
+ * @ATH_DBG_BEACON: beacon handling
+ * @ATH_DBG_CONFIG: configuration of the hardware
+ * @ATH_DBG_FATAL: fatal errors, this is the default, DBG_DEFAULT
+ * @ATH_DBG_PS: power save processing
+ * @ATH_DBG_HWTIMER: hardware timer handling
+ * @ATH_DBG_BTCOEX: bluetooth coexistance
+ * @ATH_DBG_ANY: enable all debugging
+ *
+ * The debug level is used to control the amount and type of debugging output
+ * we want to see. Each driver has its own method for enabling debugging and
+ * modifying debug level states -- but this is typically done through a
+ * module parameter 'debug' along with a respective 'debug' debugfs file
+ * entry.
+ */
+enum ATH_DEBUG {
+        ATH_DBG_RESET           = 0x00000001,
+        ATH_DBG_QUEUE           = 0x00000002,
+        ATH_DBG_EEPROM          = 0x00000004,
+        ATH_DBG_CALIBRATE       = 0x00000008,
+        ATH_DBG_INTERRUPT       = 0x00000010,
+        ATH_DBG_REGULATORY      = 0x00000020,
+        ATH_DBG_ANI             = 0x00000040,
+        ATH_DBG_XMIT            = 0x00000080,
+        ATH_DBG_BEACON          = 0x00000100,
+        ATH_DBG_CONFIG          = 0x00000200,
+        ATH_DBG_FATAL           = 0x00000400,
+        ATH_DBG_PS              = 0x00000800,
+        ATH_DBG_HWTIMER         = 0x00001000,
+        ATH_DBG_BTCOEX          = 0x00002000,
+        ATH_DBG_ANY             = 0xffffffff
+};
+
+#define ATH_DBG_DEFAULT (ATH_DBG_FATAL)
+
+#ifdef CONFIG_ATH_DEBUG
+void ath_print(struct ath_common *common, int dbg_mask, const char *fmt, ...)
+        __attribute__ ((format (printf, 3, 4)));
+#else
+static inline void __attribute__ ((format (printf, 3, 4)))
+ath_print(struct ath_common *common, int dbg_mask, const char *fmt, ...)
+{
+}
+#endif /* CONFIG_ATH_DEBUG */
+
+#endif /* ATH_DEBUG_H */
diff --git a/drivers/net/wireless/ath/hw.c b/drivers/net/wireless/ath/hw.c
new file mode 100644
index 000000000000..ecc9eb01f4fa
--- /dev/null
+++ b/drivers/net/wireless/ath/hw.c
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <asm/unaligned.h>
+
+#include "ath.h"
+#include "reg.h"
+
+#define REG_READ        common->ops->read
+#define REG_WRITE       common->ops->write
+
+/**
+ * ath_hw_set_bssid_mask - filter out bssids we listen
+ *
+ * @common: the ath_common struct for the device.
+ *
+ * BSSID masking is a method used by AR5212 and newer hardware to inform PCU
+ * which bits of the interface's MAC address should be looked at when trying
+ * to decide which packets to ACK. In station mode and AP mode with a single
+ * BSS every bit matters since we lock to only one BSS. In AP mode with
+ * multiple BSSes (virtual interfaces) not every bit matters because hw must
+ * accept frames for all BSSes and so we tweak some bits of our mac address
+ * in order to have multiple BSSes.
+ *
+ * NOTE: This is a simple filter and does *not* filter out all
+ * relevant frames. Some frames that are not for us might get ACKed from us
+ * by PCU because they just match the mask.
+ *
+ * When handling multiple BSSes you can get the BSSID mask by computing the
+ * set of  ~ ( MAC XOR BSSID ) for all bssids we handle.
+ *
+ * When you do this you are essentially computing the common bits of all your
+ * BSSes. Later it is assumed the harware will "and" (&) the BSSID mask with
+ * the MAC address to obtain the relevant bits and compare the result with
+ * (frame's BSSID & mask) to see if they match.
+ *
+ * Simple example: on your card you have have two BSSes you have created with
+ * BSSID-01 and BSSID-02. Lets assume BSSID-01 will not use the MAC address.
+ * There is another BSSID-03 but you are not part of it. For simplicity's sake,
+ * assuming only 4 bits for a mac address and for BSSIDs you can then have:
+ *
+ *                  \
+ * MAC:        0001 |
+ * BSSID-01:   0100 | --> Belongs to us
+ * BSSID-02:   1001 |
+ *                  /
+ * -------------------
+ * BSSID-03:   0110  | --> External
+ * -------------------
+ *
+ * Our bssid_mask would then be:
+ *
+ *             On loop iteration for BSSID-01:
+ *             ~(0001 ^ 0100)  -> ~(0101)
+ *                             ->   1010
+ *             bssid_mask      =    1010
+ *
+ *             On loop iteration for BSSID-02:
+ *             bssid_mask &= ~(0001   ^   1001)
+ *             bssid_mask =   (1010)  & ~(0001 ^ 1001)
+ *             bssid_mask =   (1010)  & ~(1001)
+ *             bssid_mask =   (1010)  &  (0110)
+ *             bssid_mask =   0010
+ *
+ * A bssid_mask of 0010 means "only pay attention to the second least
+ * significant bit". This is because its the only bit common
+ * amongst the MAC and all BSSIDs we support. To findout what the real
+ * common bit is we can simply "&" the bssid_mask now with any BSSID we have
+ * or our MAC address (we assume the hardware uses the MAC address).
+ *
+ * Now, suppose there's an incoming frame for BSSID-03:
+ *
+ * IFRAME-01:  0110
+ *
+ * An easy eye-inspeciton of this already should tell you that this frame
+ * will not pass our check. This is beacuse the bssid_mask tells the
+ * hardware to only look at the second least significant bit and the
+ * common bit amongst the MAC and BSSIDs is 0, this frame has the 2nd LSB
+ * as 1, which does not match 0.
+ *
+ * So with IFRAME-01 we *assume* the hardware will do:
+ *
+ *     allow = (IFRAME-01 & bssid_mask) == (bssid_mask & MAC) ? 1 : 0;
+ *  --> allow = (0110 & 0010) == (0010 & 0001) ? 1 : 0;
+ *  --> allow = (0010) == 0000 ? 1 : 0;
+ *  --> allow = 0
+ *
+ *  Lets now test a frame that should work:
+ *
+ * IFRAME-02:  0001 (we should allow)
+ *
+ *     allow = (0001 & 1010) == 1010
+ *
+ *     allow = (IFRAME-02 & bssid_mask) == (bssid_mask & MAC) ? 1 : 0;
+ *  --> allow = (0001 & 0010) ==  (0010 & 0001) ? 1 :0;
+ *  --> allow = (0010) == (0010)
+ *  --> allow = 1
+ *
+ * Other examples:
+ *
+ * IFRAME-03:  0100 --> allowed
+ * IFRAME-04:  1001 --> allowed
+ * IFRAME-05:  1101 --> allowed but its not for us!!!
+ *
+ */
+void ath_hw_setbssidmask(struct ath_common *common)
+{
+        void *ah = common->ah;
+
+        REG_WRITE(ah, get_unaligned_le32(common->bssidmask), AR_BSSMSKL);
+        REG_WRITE(ah, get_unaligned_le16(common->bssidmask + 4), AR_BSSMSKU);
+}
+EXPORT_SYMBOL(ath_hw_setbssidmask);
diff --git a/drivers/net/wireless/ath/reg.h b/drivers/net/wireless/ath/reg.h
new file mode 100644
index 000000000000..dfe1fbec24f5
--- /dev/null
+++ b/drivers/net/wireless/ath/reg.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef ATH_REGISTERS_H
+#define ATH_REGISTERS_H
+
+/*
+ * BSSID mask registers. See ath_hw_set_bssid_mask()
+ * for detailed documentation about these registers.
+ */
+#define AR_BSSMSKL              0x80e0
+#define AR_BSSMSKU              0x80e4
+
+#endif /* ATH_REGISTERS_H */
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index 077bcc142cde..00489c40be0c 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -15,7 +15,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <net/cfg80211.h>
 #include <net/mac80211.h>
 #include "regd.h"
@@ -110,8 +109,9 @@ static const struct ieee80211_regdomain ath_world_regdom_67_68_6A = {
 
 static inline bool is_wwr_sku(u16 regd)
 {
-        return ((regd & WORLD_SKU_MASK) == WORLD_SKU_PREFIX) ||
-                (regd == WORLD);
+        return ((regd & COUNTRY_ERD_FLAG) != COUNTRY_ERD_FLAG) &&
+                (((regd & WORLD_SKU_MASK) == WORLD_SKU_PREFIX) ||
+                (regd == WORLD));
 }
 
 static u16 ath_regd_get_eepromRD(struct ath_regulatory *reg)
@@ -450,7 +450,7 @@ ath_regd_init_wiphy(struct ath_regulatory *reg,
         const struct ieee80211_regdomain *regd;
 
         wiphy->reg_notifier = reg_notifier;
-        wiphy->strict_regulatory = true;
+        wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
 
         if (ath_is_world_regd(reg)) {
                 /*
@@ -458,8 +458,7 @@ ath_regd_init_wiphy(struct ath_regulatory *reg,
                  * saved on the wiphy orig_* parameters
                  */
                 regd = ath_world_regdomain(reg);
-                wiphy->custom_regulatory = true;
-                wiphy->strict_regulatory = false;
+                wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
         } else {
                 /*
                  * This gets applied in the case of the absense of CRDA,
diff --git a/drivers/net/wireless/ath/regd.h b/drivers/net/wireless/ath/regd.h
index c1dd857697a7..a1c39526161a 100644
--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -65,10 +65,13 @@ enum CountryCode {
         CTRY_ALGERIA = 12,
         CTRY_ARGENTINA = 32,
         CTRY_ARMENIA = 51,
+        CTRY_ARUBA = 533,
         CTRY_AUSTRALIA = 36,
         CTRY_AUSTRIA = 40,
         CTRY_AZERBAIJAN = 31,
         CTRY_BAHRAIN = 48,
+        CTRY_BANGLADESH = 50,
+        CTRY_BARBADOS = 52,
         CTRY_BELARUS = 112,
         CTRY_BELGIUM = 56,
         CTRY_BELIZE = 84,
@@ -77,6 +80,7 @@ enum CountryCode {
         CTRY_BRAZIL = 76,
         CTRY_BRUNEI_DARUSSALAM = 96,
         CTRY_BULGARIA = 100,
+        CTRY_CAMBODIA = 116,
         CTRY_CANADA = 124,
         CTRY_CHILE = 152,
         CTRY_CHINA = 156,
@@ -97,7 +101,11 @@ enum CountryCode {
         CTRY_GEORGIA = 268,
         CTRY_GERMANY = 276,
         CTRY_GREECE = 300,
+        CTRY_GREENLAND = 304,
+        CTRY_GRENEDA = 308,
+        CTRY_GUAM = 316,
         CTRY_GUATEMALA = 320,
+        CTRY_HAITI = 332,
         CTRY_HONDURAS = 340,
         CTRY_HONG_KONG = 344,
         CTRY_HUNGARY = 348,
diff --git a/drivers/net/wireless/ath/regd_common.h b/drivers/net/wireless/ath/regd_common.h
index 9847af72208c..248c670fdfbe 100644
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -288,13 +288,16 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_DEFAULT, FCC1_FCCA, "CO"},
         {CTRY_ALBANIA, NULL1_WORLD, "AL"},
         {CTRY_ALGERIA, NULL1_WORLD, "DZ"},
-        {CTRY_ARGENTINA, APL3_WORLD, "AR"},
+        {CTRY_ARGENTINA, FCC3_WORLD, "AR"},
         {CTRY_ARMENIA, ETSI4_WORLD, "AM"},
+        {CTRY_ARUBA, ETSI1_WORLD, "AW"},
         {CTRY_AUSTRALIA, FCC2_WORLD, "AU"},
         {CTRY_AUSTRALIA2, FCC6_WORLD, "AU"},
         {CTRY_AUSTRIA, ETSI1_WORLD, "AT"},
         {CTRY_AZERBAIJAN, ETSI4_WORLD, "AZ"},
         {CTRY_BAHRAIN, APL6_WORLD, "BH"},
+        {CTRY_BANGLADESH, NULL1_WORLD, "BD"},
+        {CTRY_BARBADOS, FCC2_WORLD, "BB"},
         {CTRY_BELARUS, ETSI1_WORLD, "BY"},
         {CTRY_BELGIUM, ETSI1_WORLD, "BE"},
         {CTRY_BELGIUM2, ETSI4_WORLD, "BL"},
@@ -304,13 +307,14 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_BRAZIL, FCC3_WORLD, "BR"},
         {CTRY_BRUNEI_DARUSSALAM, APL1_WORLD, "BN"},
         {CTRY_BULGARIA, ETSI6_WORLD, "BG"},
-        {CTRY_CANADA, FCC2_FCCA, "CA"},
+        {CTRY_CAMBODIA, ETSI1_WORLD, "KH"},
+        {CTRY_CANADA, FCC3_FCCA, "CA"},
         {CTRY_CANADA2, FCC6_FCCA, "CA"},
         {CTRY_CHILE, APL6_WORLD, "CL"},
         {CTRY_CHINA, APL1_WORLD, "CN"},
         {CTRY_COLOMBIA, FCC1_FCCA, "CO"},
         {CTRY_COSTA_RICA, FCC1_WORLD, "CR"},
-        {CTRY_CROATIA, ETSI3_WORLD, "HR"},
+        {CTRY_CROATIA, ETSI1_WORLD, "HR"},
         {CTRY_CYPRUS, ETSI1_WORLD, "CY"},
         {CTRY_CZECH, ETSI3_WORLD, "CZ"},
         {CTRY_DENMARK, ETSI1_WORLD, "DK"},
@@ -324,18 +328,22 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_GEORGIA, ETSI4_WORLD, "GE"},
         {CTRY_GERMANY, ETSI1_WORLD, "DE"},
         {CTRY_GREECE, ETSI1_WORLD, "GR"},
+        {CTRY_GREENLAND, ETSI1_WORLD, "GL"},
+        {CTRY_GRENEDA, FCC3_FCCA, "GD"},
+        {CTRY_GUAM, FCC1_FCCA, "GU"},
         {CTRY_GUATEMALA, FCC1_FCCA, "GT"},
+        {CTRY_HAITI, ETSI1_WORLD, "HT"},
         {CTRY_HONDURAS, NULL1_WORLD, "HN"},
-        {CTRY_HONG_KONG, FCC2_WORLD, "HK"},
+        {CTRY_HONG_KONG, FCC3_WORLD, "HK"},
         {CTRY_HUNGARY, ETSI1_WORLD, "HU"},
         {CTRY_ICELAND, ETSI1_WORLD, "IS"},
         {CTRY_INDIA, APL6_WORLD, "IN"},
-        {CTRY_INDONESIA, APL1_WORLD, "ID"},
+        {CTRY_INDONESIA, NULL1_WORLD, "ID"},
         {CTRY_IRAN, APL1_WORLD, "IR"},
         {CTRY_IRELAND, ETSI1_WORLD, "IE"},
         {CTRY_ISRAEL, NULL1_WORLD, "IL"},
         {CTRY_ITALY, ETSI1_WORLD, "IT"},
-        {CTRY_JAMAICA, ETSI1_WORLD, "JM"},
+        {CTRY_JAMAICA, FCC3_WORLD, "JM"},
 
         {CTRY_JAPAN, MKK1_MKKA, "JP"},
         {CTRY_JAPAN1, MKK1_MKKB, "JP"},
@@ -402,7 +410,7 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_KOREA_ROC, APL9_WORLD, "KR"},
         {CTRY_KOREA_ROC2, APL2_WORLD, "K2"},
         {CTRY_KOREA_ROC3, APL9_WORLD, "K3"},
-        {CTRY_KUWAIT, NULL1_WORLD, "KW"},
+        {CTRY_KUWAIT, ETSI3_WORLD, "KW"},
         {CTRY_LATVIA, ETSI1_WORLD, "LV"},
         {CTRY_LEBANON, NULL1_WORLD, "LB"},
         {CTRY_LIECHTENSTEIN, ETSI1_WORLD, "LI"},
@@ -414,13 +422,13 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_MALTA, ETSI1_WORLD, "MT"},
         {CTRY_MEXICO, FCC1_FCCA, "MX"},
         {CTRY_MONACO, ETSI4_WORLD, "MC"},
-        {CTRY_MOROCCO, NULL1_WORLD, "MA"},
+        {CTRY_MOROCCO, APL4_WORLD, "MA"},
         {CTRY_NEPAL, APL1_WORLD, "NP"},
         {CTRY_NETHERLANDS, ETSI1_WORLD, "NL"},
         {CTRY_NETHERLANDS_ANTILLES, ETSI1_WORLD, "AN"},
         {CTRY_NEW_ZEALAND, FCC2_ETSIC, "NZ"},
         {CTRY_NORWAY, ETSI1_WORLD, "NO"},
-        {CTRY_OMAN, APL6_WORLD, "OM"},
+        {CTRY_OMAN, FCC3_WORLD, "OM"},
         {CTRY_PAKISTAN, NULL1_WORLD, "PK"},
         {CTRY_PANAMA, FCC1_FCCA, "PA"},
         {CTRY_PAPUA_NEW_GUINEA, FCC1_WORLD, "PG"},
@@ -429,7 +437,7 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_POLAND, ETSI1_WORLD, "PL"},
         {CTRY_PORTUGAL, ETSI1_WORLD, "PT"},
         {CTRY_PUERTO_RICO, FCC1_FCCA, "PR"},
-        {CTRY_QATAR, NULL1_WORLD, "QA"},
+        {CTRY_QATAR, APL1_WORLD, "QA"},
         {CTRY_ROMANIA, NULL1_WORLD, "RO"},
         {CTRY_RUSSIA, NULL1_WORLD, "RU"},
         {CTRY_SAUDI_ARABIA, NULL1_WORLD, "SA"},
@@ -445,7 +453,7 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_SYRIA, NULL1_WORLD, "SY"},
         {CTRY_TAIWAN, APL3_FCCA, "TW"},
         {CTRY_THAILAND, FCC3_WORLD, "TH"},
-        {CTRY_TRINIDAD_Y_TOBAGO, ETSI4_WORLD, "TT"},
+        {CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"},
         {CTRY_TUNISIA, ETSI3_WORLD, "TN"},
         {CTRY_TURKEY, ETSI3_WORLD, "TR"},
         {CTRY_UKRAINE, NULL1_WORLD, "UA"},
@@ -456,7 +464,7 @@ static struct country_code_to_enum_rd allCountries[] = {
          * would need to assign new special alpha2 to CRDA db as with the world
          * regdomain and use another alpha2 */
         {CTRY_UNITED_STATES_FCC49, FCC4_FCCA, "PS"},
-        {CTRY_URUGUAY, APL2_WORLD, "UY"},
+        {CTRY_URUGUAY, FCC3_WORLD, "UY"},
         {CTRY_UZBEKISTAN, FCC3_FCCA, "UZ"},
         {CTRY_VENEZUELA, APL2_ETSIC, "VE"},
         {CTRY_VIET_NAM, NULL1_WORLD, "VN"},
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index cce188837d10..3edbbcf0f548 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -99,6 +99,22 @@ static struct {
         { ATMEL_FW_TYPE_506,            "atmel_at76c506",       "bin" },
         { ATMEL_FW_TYPE_NONE,           NULL,                   NULL }
 };
+MODULE_FIRMWARE("atmel_at76c502-wpa.bin");
+MODULE_FIRMWARE("atmel_at76c502.bin");
+MODULE_FIRMWARE("atmel_at76c502d-wpa.bin");
+MODULE_FIRMWARE("atmel_at76c502d.bin");
+MODULE_FIRMWARE("atmel_at76c502e-wpa.bin");
+MODULE_FIRMWARE("atmel_at76c502e.bin");
+MODULE_FIRMWARE("atmel_at76c502_3com-wpa.bin");
+MODULE_FIRMWARE("atmel_at76c502_3com.bin");
+MODULE_FIRMWARE("atmel_at76c504-wpa.bin");
+MODULE_FIRMWARE("atmel_at76c504.bin");
+MODULE_FIRMWARE("atmel_at76c504_2958-wpa.bin");
+MODULE_FIRMWARE("atmel_at76c504_2958.bin");
+MODULE_FIRMWARE("atmel_at76c504a_2958-wpa.bin");
+MODULE_FIRMWARE("atmel_at76c504a_2958.bin");
+MODULE_FIRMWARE("atmel_at76c506-wpa.bin");
+MODULE_FIRMWARE("atmel_at76c506.bin");
 
 #define MAX_SSID_LENGTH 32
 #define MGMT_JIFFIES (256 * HZ / 100)
diff --git a/drivers/net/wireless/atmel_cs.c b/drivers/net/wireless/atmel_cs.c
index ddaa859c3491..32407911842f 100644
--- a/drivers/net/wireless/atmel_cs.c
+++ b/drivers/net/wireless/atmel_cs.c
@@ -55,22 +55,6 @@
 
 #include "atmel.h"
 
-/*
-   All the PCMCIA modules use PCMCIA_DEBUG to control debugging.  If
-   you do not define PCMCIA_DEBUG at all, all the debug code will be
-   left out.  If you compile with PCMCIA_DEBUG=0, the debug code will
-   be present but disabled -- but it can then be enabled for specific
-   modules at load time with a 'pc_debug=#' option to insmod.
-*/
-
-#ifdef PCMCIA_DEBUG
-static int pc_debug = PCMCIA_DEBUG;
-module_param(pc_debug, int, 0);
-static char *version = "$Revision: 1.2 $";
-#define DEBUG(n, args...) if (pc_debug>(n)) printk(KERN_DEBUG args);
-#else
-#define DEBUG(n, args...)
-#endif
 
 /*====================================================================*/
 
@@ -155,11 +139,10 @@ static int atmel_probe(struct pcmcia_device *p_dev)
 {
         local_info_t *local;
 
-        DEBUG(0, "atmel_attach()\n");
+        dev_dbg(&p_dev->dev, "atmel_attach()\n");
 
         /* Interrupt setup */
         p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        p_dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
         p_dev->irq.Handler = NULL;
 
         /*
@@ -194,7 +177,7 @@ static int atmel_probe(struct pcmcia_device *p_dev)
 
 static void atmel_detach(struct pcmcia_device *link)
 {
-        DEBUG(0, "atmel_detach(0x%p)\n", link);
+        dev_dbg(&link->dev, "atmel_detach\n");
 
         atmel_release(link);
 
@@ -209,9 +192,6 @@ static void atmel_detach(struct pcmcia_device *link)
 
   ======================================================================*/
 
-#define CS_CHECK(fn, ret) \
-do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
-
 /* Call-back function to interrogate PCMCIA-specific information
    about the current existance of the card */
 static int card_present(void *arg)
@@ -275,13 +255,13 @@ static int atmel_config_check(struct pcmcia_device *p_dev,
 static int atmel_config(struct pcmcia_device *link)
 {
         local_info_t *dev;
-        int last_fn, last_ret;
+        int ret;
         struct pcmcia_device_id *did;
 
         dev = link->priv;
-        did = dev_get_drvdata(&handle_to_dev(link));
+        did = dev_get_drvdata(&link->dev);
 
-        DEBUG(0, "atmel_config(0x%p)\n", link);
+        dev_dbg(&link->dev, "atmel_config\n");
 
         /*
           In this loop, we scan the CIS for configuration table entries,
@@ -303,31 +283,36 @@ static int atmel_config(struct pcmcia_device *link)
           handler to the interrupt, unless the 'Handler' member of the
           irq structure is initialized.
         */
-        if (link->conf.Attributes & CONF_ENABLE_IRQ)
-                CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
+                ret = pcmcia_request_irq(link, &link->irq);
+                if (ret)
+                        goto failed;
+        }
 
         /*
           This actually configures the PCMCIA socket -- setting up
           the I/O windows and the interrupt mapping, and putting the
           card and host interface into "Memory and IO" mode.
         */
-        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
+        ret = pcmcia_request_configuration(link, &link->conf);
+        if (ret)
+                goto failed;
 
         if (link->irq.AssignedIRQ == 0) {
                 printk(KERN_ALERT
                        "atmel: cannot assign IRQ: check that CONFIG_ISA is set in kernel config.");
-                goto cs_failed;
+                goto failed;
         }
 
         ((local_info_t*)link->priv)->eth_dev =
                 init_atmel_card(link->irq.AssignedIRQ,
                                 link->io.BasePort1,
                                 did ? did->driver_info : ATMEL_FW_TYPE_NONE,
-                                &handle_to_dev(link),
+                                &link->dev,
                                 card_present,
                                 link);
         if (!((local_info_t*)link->priv)->eth_dev)
-                        goto cs_failed;
+                        goto failed;
 
 
         /*
@@ -340,8 +325,6 @@ static int atmel_config(struct pcmcia_device *link)
 
         return 0;
 
- cs_failed:
-        cs_error(link, last_fn, last_ret);
  failed:
         atmel_release(link);
         return -ENODEV;
@@ -359,7 +342,7 @@ static void atmel_release(struct pcmcia_device *link)
 {
         struct net_device *dev = ((local_info_t*)link->priv)->eth_dev;
 
-        DEBUG(0, "atmel_release(0x%p)\n", link);
+        dev_dbg(&link->dev, "atmel_release\n");
 
         if (dev)
                 stop_atmel_card(dev);
diff --git a/drivers/net/wireless/atmel_pci.c b/drivers/net/wireless/atmel_pci.c
index 92f87fbe750f..9ab1192004c0 100644
--- a/drivers/net/wireless/atmel_pci.c
+++ b/drivers/net/wireless/atmel_pci.c
@@ -31,7 +31,7 @@ MODULE_DESCRIPTION("Support for Atmel at76c50x 802.11 wireless ethernet cards.")
 MODULE_LICENSE("GPL");
 MODULE_SUPPORTED_DEVICE("Atmel at76c506 PCI wireless cards");
 
-static struct pci_device_id card_ids[] = {
+static DEFINE_PCI_DEVICE_TABLE(card_ids) = {
         { 0x1114, 0x0506, PCI_ANY_ID, PCI_ANY_ID },
         { 0, }
 };
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 54ea61c15d8b..0a00d42642cd 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -1,6 +1,6 @@
 config B43
         tristate "Broadcom 43xx wireless support (mac80211 stack)"
-        depends on SSB_POSSIBLE && MAC80211 && WLAN_80211 && HAS_DMA
+        depends on SSB_POSSIBLE && MAC80211 && HAS_DMA
         select SSB
         select FW_LOADER
         ---help---
@@ -78,11 +78,11 @@ config B43_SDIO
 
           If unsure, say N.
 
-# Data transfers to the device via PIO
-# This is only needed on PCMCIA and SDIO devices. All others can do DMA properly.
+#Data transfers to the device via PIO. We want it as a fallback even
+# if we can do DMA.
 config B43_PIO
         bool
-        depends on B43 && (B43_SDIO || B43_PCMCIA || B43_FORCE_PIO)
+        depends on B43
         select SSB_BLOCKIO
         default y
 
diff --git a/drivers/net/wireless/b43/Makefile b/drivers/net/wireless/b43/Makefile
index 84772a2542dc..5e83b6f0a3a0 100644
--- a/drivers/net/wireless/b43/Makefile
+++ b/drivers/net/wireless/b43/Makefile
@@ -12,7 +12,7 @@ b43-y				+= xmit.o
 b43-y                           += lo.o
 b43-y                           += wa.o
 b43-y                           += dma.o
-b43-$(CONFIG_B43_PIO)           += pio.o
+b43-y                           += pio.o
 b43-y                           += rfkill.o
 b43-$(CONFIG_B43_LEDS)          += leds.o
 b43-$(CONFIG_B43_PCMCIA)        += pcmcia.o
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 660716214d49..b8807fb12c92 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -26,8 +26,6 @@
 # define B43_DEBUG      0
 #endif
 
-#define B43_RX_MAX_SSI                  60
-
 /* MMIO offsets */
 #define B43_MMIO_DMA0_REASON            0x20
 #define B43_MMIO_DMA0_IRQ_MASK          0x24
@@ -117,6 +115,7 @@
 #define B43_MMIO_TSF_2                  0x636   /* core rev < 3 only */
 #define B43_MMIO_TSF_3                  0x638   /* core rev < 3 only */
 #define B43_MMIO_RNG                    0x65A
+#define B43_MMIO_IFSSLOT                0x684   /* Interframe slot time */
 #define B43_MMIO_IFSCTL                 0x688 /* Interframe space control */
 #define  B43_MMIO_IFSCTL_USE_EDCF       0x0004
 #define B43_MMIO_POWERUP_DELAY          0x6A8
@@ -255,6 +254,14 @@ enum {
 #define B43_SHM_SH_MAXBFRAMES           0x0080  /* Maximum number of frames in a burst */
 #define B43_SHM_SH_SPUWKUP              0x0094  /* pre-wakeup for synth PU in us */
 #define B43_SHM_SH_PRETBTT              0x0096  /* pre-TBTT in us */
+/* SHM_SHARED tx iq workarounds */
+#define B43_SHM_SH_NPHY_TXIQW0          0x0700
+#define B43_SHM_SH_NPHY_TXIQW1          0x0702
+#define B43_SHM_SH_NPHY_TXIQW2          0x0704
+#define B43_SHM_SH_NPHY_TXIQW3          0x0706
+/* SHM_SHARED tx pwr ctrl */
+#define B43_SHM_SH_NPHY_TXPWR_INDX0     0x0708
+#define B43_SHM_SH_NPHY_TXPWR_INDX1     0x070E
 
 /* SHM_SCRATCH offsets */
 #define B43_SHM_SC_MINCONT              0x0003  /* Minimum contention window */
@@ -695,6 +702,7 @@ struct b43_wldev {
         bool radio_hw_enable;   /* saved state of radio hardware enabled state */
         bool qos_enabled;               /* TRUE, if QoS is used. */
         bool hwcrypto_enabled;          /* TRUE, if HW crypto acceleration is enabled. */
+        bool use_pio;                   /* TRUE if next init should use PIO */
 
         /* PHY/Radio device. */
         struct b43_phy phy;
@@ -749,12 +757,6 @@ struct b43_wldev {
 #endif
 };
 
-/*
- * Include goes here to avoid a dependency problem.
- * A better fix would be to integrate xmit.h into b43.h.
- */
-#include "xmit.h"
-
 /* Data structure for the WLAN parts (802.11 cores) of the b43 chip. */
 struct b43_wl {
         /* Pointer to the active wireless device on this chip */
@@ -829,15 +831,9 @@ struct b43_wl {
         /* The device LEDs. */
         struct b43_leds leds;
 
-#ifdef CONFIG_B43_PIO
-        /*
-         * RX/TX header/tail buffers used by the frame transmit functions.
-         */
-        struct b43_rxhdr_fw4 rxhdr;
-        struct b43_txhdr txhdr;
-        u8 rx_tail[4];
-        u8 tx_tail[4];
-#endif /* CONFIG_B43_PIO */
+        /* Kmalloc'ed scratch space for PIO TX/RX. Protected by wl->mutex. */
+        u8 pio_scratchspace[110] __attribute__((__aligned__(8)));
+        u8 pio_tailspace[4] __attribute__((__aligned__(8)));
 };
 
 static inline struct b43_wl *hw_to_b43_wl(struct ieee80211_hw *hw)
@@ -888,20 +884,15 @@ static inline void b43_write32(struct b43_wldev *dev, u16 offset, u32 value)
 
 static inline bool b43_using_pio_transfers(struct b43_wldev *dev)
 {
-#ifdef CONFIG_B43_PIO
         return dev->__using_pio_transfers;
-#else
-        return 0;
-#endif
 }
 
 #ifdef CONFIG_B43_FORCE_PIO
-# define B43_FORCE_PIO  1
+# define B43_PIO_DEFAULT 1
 #else
-# define B43_FORCE_PIO  0
+# define B43_PIO_DEFAULT 0
 #endif
 
-
 /* Message printing */
 void b43info(struct b43_wl *wl, const char *fmt, ...)
     __attribute__ ((format(printf, 2, 3)));
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index de4e804bedf0..fa40fdfea719 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -38,6 +38,7 @@
 #include <linux/delay.h>
 #include <linux/skbuff.h>
 #include <linux/etherdevice.h>
+#include <linux/slab.h>
 #include <asm/div64.h>
 
 
@@ -770,7 +771,7 @@ static void free_all_descbuffers(struct b43_dmaring *ring)
         for (i = 0; i < ring->nr_slots; i++) {
                 desc = ring->ops->idx2desc(ring, i, &meta);
 
-                if (!meta->skb) {
+                if (!meta->skb || b43_dma_ptr_is_poisoned(meta->skb)) {
                         B43_WARN_ON(!ring->tx);
                         continue;
                 }
@@ -822,7 +823,7 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                                       enum b43_dmatype type)
 {
         struct b43_dmaring *ring;
-        int err;
+        int i, err;
         dma_addr_t dma_test;
 
         ring = kzalloc(sizeof(*ring), GFP_KERNEL);
@@ -837,6 +838,8 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                              GFP_KERNEL);
         if (!ring->meta)
                 goto err_kfree_ring;
+        for (i = 0; i < ring->nr_slots; i++)
+                ring->meta->skb = B43_DMA_PTR_POISON;
 
         ring->type = type;
         ring->dev = dev;
@@ -1147,28 +1150,29 @@ struct b43_dmaring *parse_cookie(struct b43_wldev *dev, u16 cookie, int *slot)
         case 0x5000:
                 ring = dma->tx_ring_mcast;
                 break;
-        default:
-                B43_WARN_ON(1);
         }
         *slot = (cookie & 0x0FFF);
-        B43_WARN_ON(!(ring && *slot >= 0 && *slot < ring->nr_slots));
+        if (unlikely(!ring || *slot < 0 || *slot >= ring->nr_slots)) {
+                b43dbg(dev->wl, "TX-status contains "
+                       "invalid cookie: 0x%04X\n", cookie);
+                return NULL;
+        }
 
         return ring;
 }
 
 static int dma_tx_fragment(struct b43_dmaring *ring,
-                           struct sk_buff **in_skb)
+                           struct sk_buff *skb)
 {
-        struct sk_buff *skb = *in_skb;
         const struct b43_dma_ops *ops = ring->ops;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct b43_private_tx_info *priv_info = b43_get_priv_tx_info(info);
         u8 *header;
         int slot, old_top_slot, old_used_slots;
         int err;
         struct b43_dmadesc_generic *desc;
         struct b43_dmadesc_meta *meta;
         struct b43_dmadesc_meta *meta_hdr;
-        struct sk_buff *bounce_skb;
         u16 cookie;
         size_t hdrsize = b43_txhdr_size(ring->dev);
 
@@ -1212,34 +1216,28 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
 
         meta->skb = skb;
         meta->is_last_fragment = 1;
+        priv_info->bouncebuffer = NULL;
 
         meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
         /* create a bounce buffer in zone_dma on mapping failure. */
         if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
-                bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
-                if (!bounce_skb) {
+                priv_info->bouncebuffer = kmalloc(skb->len, GFP_ATOMIC | GFP_DMA);
+                if (!priv_info->bouncebuffer) {
                         ring->current_slot = old_top_slot;
                         ring->used_slots = old_used_slots;
                         err = -ENOMEM;
                         goto out_unmap_hdr;
                 }
+                memcpy(priv_info->bouncebuffer, skb->data, skb->len);
 
-                memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len);
-                memcpy(bounce_skb->cb, skb->cb, sizeof(skb->cb));
-                bounce_skb->dev = skb->dev;
-                skb_set_queue_mapping(bounce_skb, skb_get_queue_mapping(skb));
-                info = IEEE80211_SKB_CB(bounce_skb);
-
-                dev_kfree_skb_any(skb);
-                skb = bounce_skb;
-                *in_skb = bounce_skb;
-                meta->skb = skb;
-                meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
+                meta->dmaaddr = map_descbuffer(ring, priv_info->bouncebuffer, skb->len, 1);
                 if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
+                        kfree(priv_info->bouncebuffer);
+                        priv_info->bouncebuffer = NULL;
                         ring->current_slot = old_top_slot;
                         ring->used_slots = old_used_slots;
                         err = -EIO;
-                        goto out_free_bounce;
+                        goto out_unmap_hdr;
                 }
         }
 
@@ -1256,8 +1254,6 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
         ops->poke_tx(ring, next_slot(ring, slot));
         return 0;
 
-out_free_bounce:
-        dev_kfree_skb_any(skb);
 out_unmap_hdr:
         unmap_descbuffer(ring, meta_hdr->dmaaddr,
                          hdrsize, 1);
@@ -1362,11 +1358,7 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb)
          * static, so we don't need to store it per frame. */
         ring->queue_prio = skb_get_queue_mapping(skb);
 
-        /* dma_tx_fragment might reallocate the skb, so invalidate pointers pointing
-         * into the skb data or cb now. */
-        hdr = NULL;
-        info = NULL;
-        err = dma_tx_fragment(ring, &skb);
+        err = dma_tx_fragment(ring, skb);
         if (unlikely(err == -ENOKEY)) {
                 /* Drop this packet, as we don't have the encryption key
                  * anymore and must not transmit it unencrypted. */
@@ -1378,7 +1370,6 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb)
                 b43err(dev->wl, "DMA tx mapping failure\n");
                 goto out;
         }
-        ring->nr_tx_packets++;
         if ((free_slots(ring) < TX_SLOTS_PER_FRAME) ||
             should_inject_overflow(ring)) {
                 /* This TX ring is full. */
@@ -1400,30 +1391,63 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
         struct b43_dmaring *ring;
         struct b43_dmadesc_generic *desc;
         struct b43_dmadesc_meta *meta;
-        int slot;
+        int slot, firstused;
         bool frame_succeed;
 
         ring = parse_cookie(dev, status->cookie, &slot);
         if (unlikely(!ring))
                 return;
-
         B43_WARN_ON(!ring->tx);
+
+        /* Sanity check: TX packets are processed in-order on one ring.
+         * Check if the slot deduced from the cookie really is the first
+         * used slot. */
+        firstused = ring->current_slot - ring->used_slots + 1;
+        if (firstused < 0)
+                firstused = ring->nr_slots + firstused;
+        if (unlikely(slot != firstused)) {
+                /* This possibly is a firmware bug and will result in
+                 * malfunction, memory leaks and/or stall of DMA functionality. */
+                b43dbg(dev->wl, "Out of order TX status report on DMA ring %d. "
+                       "Expected %d, but got %d\n",
+                       ring->index, firstused, slot);
+                return;
+        }
+
         ops = ring->ops;
         while (1) {
-                B43_WARN_ON(!(slot >= 0 && slot < ring->nr_slots));
+                B43_WARN_ON(slot < 0 || slot >= ring->nr_slots);
                 desc = ops->idx2desc(ring, slot, &meta);
 
-                if (meta->skb)
-                        unmap_descbuffer(ring, meta->dmaaddr, meta->skb->len,
-                                         1);
-                else
+                if (b43_dma_ptr_is_poisoned(meta->skb)) {
+                        b43dbg(dev->wl, "Poisoned TX slot %d (first=%d) "
+                               "on ring %d\n",
+                               slot, firstused, ring->index);
+                        break;
+                }
+                if (meta->skb) {
+                        struct b43_private_tx_info *priv_info =
+                                b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
+
+                        unmap_descbuffer(ring, meta->dmaaddr, meta->skb->len, 1);
+                        kfree(priv_info->bouncebuffer);
+                        priv_info->bouncebuffer = NULL;
+                } else {
                         unmap_descbuffer(ring, meta->dmaaddr,
                                          b43_txhdr_size(dev), 1);
+                }
 
                 if (meta->is_last_fragment) {
                         struct ieee80211_tx_info *info;
 
-                        BUG_ON(!meta->skb);
+                        if (unlikely(!meta->skb)) {
+                                /* This is a scatter-gather fragment of a frame, so
+                                 * the skb pointer must not be NULL. */
+                                b43dbg(dev->wl, "TX status unexpected NULL skb "
+                                       "at slot %d (first=%d) on ring %d\n",
+                                       slot, firstused, ring->index);
+                                break;
+                        }
 
                         info = IEEE80211_SKB_CB(meta->skb);
 
@@ -1441,20 +1465,29 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
 #endif /* DEBUG */
                         ieee80211_tx_status(dev->wl->hw, meta->skb);
 
-                        /* skb is freed by ieee80211_tx_status() */
-                        meta->skb = NULL;
+                        /* skb will be freed by ieee80211_tx_status().
+                         * Poison our pointer. */
+                        meta->skb = B43_DMA_PTR_POISON;
                 } else {
                         /* No need to call free_descriptor_buffer here, as
                          * this is only the txhdr, which is not allocated.
                          */
-                        B43_WARN_ON(meta->skb);
+                        if (unlikely(meta->skb)) {
+                                b43dbg(dev->wl, "TX status unexpected non-NULL skb "
+                                       "at slot %d (first=%d) on ring %d\n",
+                                       slot, firstused, ring->index);
+                                break;
+                        }
                 }
 
                 /* Everything unmapped and free'd. So it's not used anymore. */
                 ring->used_slots--;
 
-                if (meta->is_last_fragment)
+                if (meta->is_last_fragment) {
+                        /* This is the last scatter-gather
+                         * fragment of the frame. We are done. */
                         break;
+                }
                 slot = next_slot(ring, slot);
         }
         if (ring->stopped) {
@@ -1467,22 +1500,6 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
         }
 }
 
-void b43_dma_get_tx_stats(struct b43_wldev *dev,
-                          struct ieee80211_tx_queue_stats *stats)
-{
-        const int nr_queues = dev->wl->hw->queues;
-        struct b43_dmaring *ring;
-        int i;
-
-        for (i = 0; i < nr_queues; i++) {
-                ring = select_ring_by_priority(dev, i);
-
-                stats[i].len = ring->used_slots / TX_SLOTS_PER_FRAME;
-                stats[i].limit = ring->nr_slots / TX_SLOTS_PER_FRAME;
-                stats[i].count = ring->nr_tx_packets;
-        }
-}
-
 static void dma_rx(struct b43_dmaring *ring, int *slot)
 {
         const struct b43_dma_ops *ops = ring->ops;
@@ -1620,7 +1637,6 @@ void b43_dma_tx_resume(struct b43_wldev *dev)
         b43_power_saving_ctl_bits(dev, 0);
 }
 
-#ifdef CONFIG_B43_PIO
 static void direct_fifo_rx(struct b43_wldev *dev, enum b43_dmatype type,
                            u16 mmio_base, bool enable)
 {
@@ -1654,4 +1670,3 @@ void b43_dma_direct_fifo_rx(struct b43_wldev *dev,
         mmio_base = b43_dmacontroller_base(type, engine_index);
         direct_fifo_rx(dev, type, mmio_base, enable);
 }
-#endif /* CONFIG_B43_PIO */
diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
index f0b0838fb5ba..dc91944d6022 100644
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -1,7 +1,7 @@
 #ifndef B43_DMA_H_
 #define B43_DMA_H_
 
-#include <linux/ieee80211.h>
+#include <linux/err.h>
 
 #include "b43.h"
 
@@ -165,6 +165,10 @@ struct b43_dmadesc_generic {
 #define B43_RXRING_SLOTS                64
 #define B43_DMA0_RX_BUFFERSIZE          IEEE80211_MAX_FRAME_LEN
 
+/* Pointer poison */
+#define B43_DMA_PTR_POISON              ((void *)ERR_PTR(-ENOMEM))
+#define b43_dma_ptr_is_poisoned(ptr)    (unlikely((ptr) == B43_DMA_PTR_POISON))
+
 
 struct sk_buff;
 struct b43_private;
@@ -224,8 +228,6 @@ struct b43_dmaring {
         int used_slots;
         /* Currently used slot in the ring. */
         int current_slot;
-        /* Total number of packets sent. Statistics only. */
-        unsigned int nr_tx_packets;
         /* Frameoffset in octets. */
         u32 frameoffset;
         /* Descriptor buffer size. */
@@ -274,9 +276,6 @@ void b43_dma_free(struct b43_wldev *dev);
 void b43_dma_tx_suspend(struct b43_wldev *dev);
 void b43_dma_tx_resume(struct b43_wldev *dev);
 
-void b43_dma_get_tx_stats(struct b43_wldev *dev,
-                          struct ieee80211_tx_queue_stats *stats);
-
 int b43_dma_tx(struct b43_wldev *dev,
                struct sk_buff *skb);
 void b43_dma_handle_txstatus(struct b43_wldev *dev,
diff --git a/drivers/net/wireless/b43/leds.c b/drivers/net/wireless/b43/leds.c
index 1e8dba488004..c587115dd2b9 100644
--- a/drivers/net/wireless/b43/leds.c
+++ b/drivers/net/wireless/b43/leds.c
@@ -246,6 +246,7 @@ static void b43_led_get_sprominfo(struct b43_wldev *dev,
                         *behaviour = B43_LED_OFF;
                         break;
                 default:
+                        *behaviour = B43_LED_OFF;
                         B43_WARN_ON(1);
                         return;
                 }
diff --git a/drivers/net/wireless/b43/lo.c b/drivers/net/wireless/b43/lo.c
index 976104f634a1..94e4f1378fc3 100644
--- a/drivers/net/wireless/b43/lo.c
+++ b/drivers/net/wireless/b43/lo.c
@@ -34,6 +34,7 @@
 
 #include <linux/delay.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 
 
 static struct b43_lo_calib *b43_find_lo_calib(struct b43_txpower_lo_control *lo,
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 098dda1a67c1..9a374ef83a22 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -42,6 +42,7 @@
 #include <linux/skbuff.h>
 #include <linux/io.h>
 #include <linux/dma-mapping.h>
+#include <linux/slab.h>
 #include <asm/unaligned.h>
 
 #include "b43.h"
@@ -67,7 +68,12 @@ MODULE_AUTHOR("Gábor Stefanik");
 MODULE_LICENSE("GPL");
 
 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
-
+MODULE_FIRMWARE("b43/ucode11.fw");
+MODULE_FIRMWARE("b43/ucode13.fw");
+MODULE_FIRMWARE("b43/ucode14.fw");
+MODULE_FIRMWARE("b43/ucode15.fw");
+MODULE_FIRMWARE("b43/ucode5.fw");
+MODULE_FIRMWARE("b43/ucode9.fw");
 
 static int modparam_bad_frames_preempt;
 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
@@ -102,6 +108,9 @@ int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 
+int b43_modparam_pio = B43_PIO_DEFAULT;
+module_param_named(pio, b43_modparam_pio, int, 0644);
+MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 
 static const struct ssb_device_id b43_ssb_tbl[] = {
         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
@@ -110,6 +119,7 @@ static const struct ssb_device_id b43_ssb_tbl[] = {
         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
+        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
@@ -628,10 +638,17 @@ static void b43_upload_card_macaddress(struct b43_wldev *dev)
 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 {
         /* slot_time is in usec. */
-        if (dev->phy.type != B43_PHYTYPE_G)
+        /* This test used to exit for all but a G PHY. */
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
                 return;
-        b43_write16(dev, 0x684, 510 + slot_time);
-        b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
+        b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
+        /* Shared memory location 0x0010 is the slot time and should be
+         * set to slot_time; however, this register is initially 0 and changing
+         * the value adversely affects the transmit rate for BCM4311
+         * devices. Until this behavior is unterstood, delete this step
+         *
+         * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
+         */
 }
 
 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
@@ -835,8 +852,10 @@ static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 }
 
 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
-                        struct ieee80211_key_conf *keyconf, const u8 *addr,
-                        u32 iv32, u16 *phase1key)
+                                   struct ieee80211_vif *vif,
+                                   struct ieee80211_key_conf *keyconf,
+                                   struct ieee80211_sta *sta,
+                                   u32 iv32, u16 *phase1key)
 {
         struct b43_wl *wl = hw_to_b43_wl(hw);
         struct b43_wldev *dev;
@@ -845,19 +864,19 @@ static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
         if (B43_WARN_ON(!modparam_hwtkip))
                 return;
 
-        mutex_lock(&wl->mutex);
-
+        /* This is only called from the RX path through mac80211, where
+         * our mutex is already locked. */
+        B43_WARN_ON(!mutex_is_locked(&wl->mutex));
         dev = wl->current_dev;
-        if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
-                goto out_unlock;
+        B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 
         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 
         rx_tkip_phase1_write(dev, index, iv32, phase1key);
-        keymac_write(dev, index, addr);
-
-out_unlock:
-        mutex_unlock(&wl->mutex);
+        /* only pairwise TKIP keys are supported right now */
+        if (WARN_ON(!sta))
+                return;
+        keymac_write(dev, index, sta->addr);
 }
 
 static void do_key_write(struct b43_wldev *dev,
@@ -1784,6 +1803,10 @@ static void b43_do_interrupt_thread(struct b43_wldev *dev)
                                dma_reason[0], dma_reason[1],
                                dma_reason[2], dma_reason[3],
                                dma_reason[4], dma_reason[5]);
+                        b43err(dev->wl, "This device does not support DMA "
+                               "on your system. Please use PIO instead.\n");
+                        /* Fall back to PIO transfers if we get fatal DMA errors! */
+                        dev->use_pio = 1;
                         b43_controller_restart(dev, "DMA error");
                         return;
                 }
@@ -2955,7 +2978,7 @@ static void do_periodic_work(struct b43_wldev *dev)
 /* Periodic work locking policy:
  *      The whole periodic work handler is protected by
  *      wl->mutex. If another lock is needed somewhere in the
- *      pwork callchain, it's aquired in-place, where it's needed.
+ *      pwork callchain, it's acquired in-place, where it's needed.
  */
 static void b43_periodic_work_handler(struct work_struct *work)
 {
@@ -3335,27 +3358,6 @@ out_unlock:
         return err;
 }
 
-static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
-                               struct ieee80211_tx_queue_stats *stats)
-{
-        struct b43_wl *wl = hw_to_b43_wl(hw);
-        struct b43_wldev *dev;
-        int err = -ENODEV;
-
-        mutex_lock(&wl->mutex);
-        dev = wl->current_dev;
-        if (dev && b43_status(dev) >= B43_STAT_STARTED) {
-                if (b43_using_pio_transfers(dev))
-                        b43_pio_get_tx_stats(dev, stats);
-                else
-                        b43_dma_get_tx_stats(dev, stats);
-                err = 0;
-        }
-        mutex_unlock(&wl->mutex);
-
-        return err;
-}
-
 static int b43_op_get_stats(struct ieee80211_hw *hw,
                             struct ieee80211_low_level_stats *stats)
 {
@@ -3559,6 +3561,12 @@ static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
         dev = wl->current_dev;
         phy = &dev->phy;
 
+        if (conf_is_ht(conf))
+                phy->is_40mhz =
+                        (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
+        else
+                phy->is_40mhz = false;
+
         b43_mac_suspend(dev);
 
         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
@@ -3573,7 +3581,7 @@ static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
         if (conf->channel->hw_value != phy->channel)
                 b43_switch_channel(dev, conf->channel->hw_value);
 
-        dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
+        dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
 
         /* Adjust the desired TX power level. */
         if (conf->power_level != 0) {
@@ -3960,6 +3968,7 @@ static int b43_wireless_core_start(struct b43_wldev *dev)
         }
 
         /* We are ready to run. */
+        ieee80211_wake_queues(dev->wl->hw);
         b43_set_status(dev, B43_STAT_STARTED);
 
         /* Start data flow (TX/RX). */
@@ -4350,7 +4359,7 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
 
         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) ||
             (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) ||
-            B43_FORCE_PIO) {
+            dev->use_pio) {
                 dev->__using_pio_transfers = 1;
                 err = b43_pio_init(dev);
         } else {
@@ -4369,8 +4378,6 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
 
         ieee80211_wake_queues(dev->wl->hw);
 
-        ieee80211_wake_queues(dev->wl->hw);
-
         b43_set_status(dev, B43_STAT_INITIALIZED);
 
 out:
@@ -4385,7 +4392,7 @@ err_busdown:
 }
 
 static int b43_op_add_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_if_init_conf *conf)
+                                struct ieee80211_vif *vif)
 {
         struct b43_wl *wl = hw_to_b43_wl(hw);
         struct b43_wldev *dev;
@@ -4393,24 +4400,24 @@ static int b43_op_add_interface(struct ieee80211_hw *hw,
 
         /* TODO: allow WDS/AP devices to coexist */
 
-        if (conf->type != NL80211_IFTYPE_AP &&
-            conf->type != NL80211_IFTYPE_MESH_POINT &&
-            conf->type != NL80211_IFTYPE_STATION &&
-            conf->type != NL80211_IFTYPE_WDS &&
-            conf->type != NL80211_IFTYPE_ADHOC)
+        if (vif->type != NL80211_IFTYPE_AP &&
+            vif->type != NL80211_IFTYPE_MESH_POINT &&
+            vif->type != NL80211_IFTYPE_STATION &&
+            vif->type != NL80211_IFTYPE_WDS &&
+            vif->type != NL80211_IFTYPE_ADHOC)
                 return -EOPNOTSUPP;
 
         mutex_lock(&wl->mutex);
         if (wl->operating)
                 goto out_mutex_unlock;
 
-        b43dbg(wl, "Adding Interface type %d\n", conf->type);
+        b43dbg(wl, "Adding Interface type %d\n", vif->type);
 
         dev = wl->current_dev;
         wl->operating = 1;
-        wl->vif = conf->vif;
-        wl->if_type = conf->type;
-        memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
+        wl->vif = vif;
+        wl->if_type = vif->type;
+        memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
 
         b43_adjust_opmode(dev);
         b43_set_pretbtt(dev);
@@ -4425,17 +4432,17 @@ static int b43_op_add_interface(struct ieee80211_hw *hw,
 }
 
 static void b43_op_remove_interface(struct ieee80211_hw *hw,
-                                    struct ieee80211_if_init_conf *conf)
+                                    struct ieee80211_vif *vif)
 {
         struct b43_wl *wl = hw_to_b43_wl(hw);
         struct b43_wldev *dev = wl->current_dev;
 
-        b43dbg(wl, "Removing Interface type %d\n", conf->type);
+        b43dbg(wl, "Removing Interface type %d\n", vif->type);
 
         mutex_lock(&wl->mutex);
 
         B43_WARN_ON(!wl->operating);
-        B43_WARN_ON(wl->vif != conf->vif);
+        B43_WARN_ON(wl->vif != vif);
         wl->vif = NULL;
 
         wl->operating = 0;
@@ -4576,7 +4583,6 @@ static const struct ieee80211_ops b43_hw_ops = {
         .set_key                = b43_op_set_key,
         .update_tkip_key        = b43_op_update_tkip_key,
         .get_stats              = b43_op_get_stats,
-        .get_tx_stats           = b43_op_get_tx_stats,
         .get_tsf                = b43_op_get_tsf,
         .set_tsf                = b43_op_set_tsf,
         .start                  = b43_op_start,
@@ -4669,7 +4675,7 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
 {
         struct b43_wl *wl = dev->wl;
         struct ssb_bus *bus = dev->dev->bus;
-        struct pci_dev *pdev = bus->host_pci;
+        struct pci_dev *pdev = (bus->bustype == SSB_BUSTYPE_PCI) ? bus->host_pci : NULL;
         int err;
         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
         u32 tmp;
@@ -4802,7 +4808,7 @@ static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
 
         if (!list_empty(&wl->devlist)) {
                 /* We are not the first core on this chip. */
-                pdev = dev->bus->host_pci;
+                pdev = (dev->bus->bustype == SSB_BUSTYPE_PCI) ? dev->bus->host_pci : NULL;
                 /* Only special chips support more than one wireless
                  * core, although some of the other chips have more than
                  * one wireless core as well. Check for this and
@@ -4820,6 +4826,7 @@ static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
         if (!wldev)
                 goto out;
 
+        wldev->use_pio = b43_modparam_pio;
         wldev->dev = dev;
         wldev->wl = wl;
         b43_set_status(wldev, B43_STAT_UNINIT);
diff --git a/drivers/net/wireless/b43/pcmcia.c b/drivers/net/wireless/b43/pcmcia.c
index 6c3a74964ab8..609e7051e018 100644
--- a/drivers/net/wireless/b43/pcmcia.c
+++ b/drivers/net/wireless/b43/pcmcia.c
@@ -24,6 +24,7 @@
 #include "pcmcia.h"
 
 #include <linux/ssb/ssb.h>
+#include <linux/slab.h>
 
 #include <pcmcia/cs_types.h>
 #include <pcmcia/cs.h>
@@ -65,35 +66,15 @@ static int __devinit b43_pcmcia_probe(struct pcmcia_device *dev)
         struct ssb_bus *ssb;
         win_req_t win;
         memreq_t mem;
-        tuple_t tuple;
-        cisparse_t parse;
         int err = -ENOMEM;
         int res = 0;
-        unsigned char buf[64];
 
         ssb = kzalloc(sizeof(*ssb), GFP_KERNEL);
         if (!ssb)
                 goto out_error;
 
         err = -ENODEV;
-        tuple.DesiredTuple = CISTPL_CONFIG;
-        tuple.Attributes = 0;
-        tuple.TupleData = buf;
-        tuple.TupleDataMax = sizeof(buf);
-        tuple.TupleOffset = 0;
 
-        res = pcmcia_get_first_tuple(dev, &tuple);
-        if (res != 0)
-                goto err_kfree_ssb;
-        res = pcmcia_get_tuple_data(dev, &tuple);
-        if (res != 0)
-                goto err_kfree_ssb;
-        res = pcmcia_parse_tuple(&tuple, &parse);
-        if (res != 0)
-                goto err_kfree_ssb;
-
-        dev->conf.ConfigBase = parse.config.base;
-        dev->conf.Present = parse.config.rmask[0];
         dev->conf.Attributes = CONF_ENABLE_IRQ;
         dev->conf.IntType = INT_MEMORY_AND_IO;
 
@@ -107,20 +88,18 @@ static int __devinit b43_pcmcia_probe(struct pcmcia_device *dev)
         win.Base = 0;
         win.Size = SSB_CORE_SIZE;
         win.AccessSpeed = 250;
-        res = pcmcia_request_window(&dev, &win, &dev->win);
+        res = pcmcia_request_window(dev, &win, &dev->win);
         if (res != 0)
                 goto err_kfree_ssb;
 
         mem.CardOffset = 0;
         mem.Page = 0;
-        res = pcmcia_map_mem_page(dev->win, &mem);
+        res = pcmcia_map_mem_page(dev, dev->win, &mem);
         if (res != 0)
                 goto err_disable;
 
         dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
         dev->irq.Handler = NULL; /* The handler is registered later. */
-        dev->irq.Instance = NULL;
         res = pcmcia_request_irq(dev, &dev->irq);
         if (res != 0)
                 goto err_disable;
diff --git a/drivers/net/wireless/b43/phy_a.c b/drivers/net/wireless/b43/phy_a.c
index d90217c3a706..b6428ec16dd6 100644
--- a/drivers/net/wireless/b43/phy_a.c
+++ b/drivers/net/wireless/b43/phy_a.c
@@ -26,6 +26,8 @@
 
 */
 
+#include <linux/slab.h>
+
 #include "b43.h"
 #include "phy_a.h"
 #include "phy_common.h"
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 75b26e175e8f..8f7d7eff2d80 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -421,3 +421,48 @@ void b43_phyop_switch_analog_generic(struct b43_wldev *dev, bool on)
 {
         b43_write16(dev, B43_MMIO_PHY0, on ? 0 : 0xF4);
 }
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/Cordic */
+struct b43_c32 b43_cordic(int theta)
+{
+        u32 arctg[] = { 2949120, 1740967, 919879, 466945, 234379, 117304,
+                      58666, 29335, 14668, 7334, 3667, 1833, 917, 458,
+                      229, 115, 57, 29, };
+        u8 i;
+        s32 tmp;
+        s8 signx = 1;
+        u32 angle = 0;
+        struct b43_c32 ret = { .i = 39797, .q = 0, };
+
+        while (theta > (180 << 16))
+                theta -= (360 << 16);
+        while (theta < -(180 << 16))
+                theta += (360 << 16);
+
+        if (theta > (90 << 16)) {
+                theta -= (180 << 16);
+                signx = -1;
+        } else if (theta < -(90 << 16)) {
+                theta += (180 << 16);
+                signx = -1;
+        }
+
+        for (i = 0; i <= 17; i++) {
+                if (theta > angle) {
+                        tmp = ret.i - (ret.q >> i);
+                        ret.q += ret.i >> i;
+                        ret.i = tmp;
+                        angle += arctg[i];
+                } else {
+                        tmp = ret.i + (ret.q >> i);
+                        ret.q -= ret.i >> i;
+                        ret.i = tmp;
+                        angle -= arctg[i];
+                }
+        }
+
+        ret.i *= signx;
+        ret.q *= signx;
+
+        return ret;
+}
diff --git a/drivers/net/wireless/b43/phy_common.h b/drivers/net/wireless/b43/phy_common.h
index 9edd4e8e0c85..bd480b481bfc 100644
--- a/drivers/net/wireless/b43/phy_common.h
+++ b/drivers/net/wireless/b43/phy_common.h
@@ -5,6 +5,12 @@
 
 struct b43_wldev;
 
+/* Complex number using 2 32-bit signed integers */
+struct b43_c32 { s32 i, q; };
+
+#define CORDIC_CONVERT(value)   (((value) >= 0) ? \
+                                 ((((value) >> 15) + 1) >> 1) : \
+                                 -((((-(value)) >> 15) + 1) >> 1))
 
 /* PHY register routing bits */
 #define B43_PHYROUTE                    0x0C00 /* PHY register routing bits mask */
@@ -212,6 +218,9 @@ struct b43_phy {
         bool supports_2ghz;
         bool supports_5ghz;
 
+        /* HT info */
+        bool is_40mhz;
+
         /* GMODE bit enabled? */
         bool gmode;
 
@@ -418,5 +427,6 @@ int b43_phy_shm_tssi_read(struct b43_wldev *dev, u16 shm_offset);
  */
 void b43_phyop_switch_analog_generic(struct b43_wldev *dev, bool on);
 
+struct b43_c32 b43_cordic(int theta);
 
 #endif /* LINUX_B43_PHY_COMMON_H_ */
diff --git a/drivers/net/wireless/b43/phy_g.c b/drivers/net/wireless/b43/phy_g.c
index 382826a8da82..29bf34ced865 100644
--- a/drivers/net/wireless/b43/phy_g.c
+++ b/drivers/net/wireless/b43/phy_g.c
@@ -33,6 +33,7 @@
 #include "main.h"
 
 #include <linux/bitrev.h>
+#include <linux/slab.h>
 
 
 static const s8 b43_tssi2dbm_g_table[] = {
diff --git a/drivers/net/wireless/b43/phy_lp.c b/drivers/net/wireless/b43/phy_lp.c
index 1e318d815a5b..c6afe9d94590 100644
--- a/drivers/net/wireless/b43/phy_lp.c
+++ b/drivers/net/wireless/b43/phy_lp.c
@@ -23,6 +23,8 @@
 
 */
 
+#include <linux/slab.h>
+
 #include "b43.h"
 #include "main.h"
 #include "phy_lp.h"
@@ -67,6 +69,7 @@ static void b43_lpphy_op_prepare_structs(struct b43_wldev *dev)
         struct b43_phy_lp *lpphy = phy->lp;
 
         memset(lpphy, 0, sizeof(*lpphy));
+        lpphy->antenna = B43_ANTENNA_DEFAULT;
 
         //TODO
 }
@@ -79,6 +82,7 @@ static void b43_lpphy_op_free(struct b43_wldev *dev)
         dev->phy.lp = NULL;
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/LP/ReadBandSrom */
 static void lpphy_read_band_sprom(struct b43_wldev *dev)
 {
         struct b43_phy_lp *lpphy = dev->phy.lp;
@@ -100,6 +104,12 @@ static void lpphy_read_band_sprom(struct b43_wldev *dev)
                 maxpwr = bus->sprom.maxpwr_bg;
                 lpphy->max_tx_pwr_med_band = maxpwr;
                 cckpo = bus->sprom.cck2gpo;
+                /*
+                 * We don't read SPROM's opo as specs say. On rev8 SPROMs
+                 * opo == ofdm2gpo and we don't know any SSB with LP-PHY
+                 * and SPROM rev below 8.
+                 */
+                B43_WARN_ON(bus->sprom.revision < 8);
                 ofdmpo = bus->sprom.ofdm2gpo;
                 if (cckpo) {
                         for (i = 0; i < 4; i++) {
@@ -751,11 +761,17 @@ static void lpphy_clear_deaf(struct b43_wldev *dev, bool user)
         }
 }
 
+static void lpphy_set_trsw_over(struct b43_wldev *dev, bool tx, bool rx)
+{
+        u16 trsw = (tx << 1) | rx;
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFFC, trsw);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x3);
+}
+
 static void lpphy_disable_crs(struct b43_wldev *dev, bool user)
 {
         lpphy_set_deaf(dev, user);
-        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFFC, 0x1);
-        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x3);
+        lpphy_set_trsw_over(dev, false, true);
         b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFFB);
         b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x4);
         b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFF7);
@@ -790,6 +806,60 @@ static void lpphy_restore_crs(struct b43_wldev *dev, bool user)
 
 struct lpphy_tx_gains { u16 gm, pga, pad, dac; };
 
+static void lpphy_disable_rx_gain_override(struct b43_wldev *dev)
+{
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFFE);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFEF);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFBF);
+        if (dev->phy.rev >= 2) {
+                b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFEFF);
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFBFF);
+                        b43_phy_mask(dev, B43_PHY_OFDM(0xE5), 0xFFF7);
+                }
+        } else {
+                b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFDFF);
+        }
+}
+
+static void lpphy_enable_rx_gain_override(struct b43_wldev *dev)
+{
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x1);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x10);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x40);
+        if (dev->phy.rev >= 2) {
+                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x100);
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x400);
+                        b43_phy_set(dev, B43_PHY_OFDM(0xE5), 0x8);
+                }
+        } else {
+                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x200);
+        }
+}
+
+static void lpphy_disable_tx_gain_override(struct b43_wldev *dev)
+{
+        if (dev->phy.rev < 2)
+                b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFEFF);
+        else {
+                b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFF7F);
+                b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xBFFF);
+        }
+        b43_phy_mask(dev, B43_LPPHY_AFE_CTL_OVR, 0xFFBF);
+}
+
+static void lpphy_enable_tx_gain_override(struct b43_wldev *dev)
+{
+        if (dev->phy.rev < 2)
+                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x100);
+        else {
+                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x80);
+                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x4000);
+        }
+        b43_phy_set(dev, B43_LPPHY_AFE_CTL_OVR, 0x40);
+}
+
 static struct lpphy_tx_gains lpphy_get_tx_gains(struct b43_wldev *dev)
 {
         struct lpphy_tx_gains gains;
@@ -819,6 +889,17 @@ static void lpphy_set_dac_gain(struct b43_wldev *dev, u16 dac)
         b43_phy_maskset(dev, B43_LPPHY_AFE_DAC_CTL, 0xF000, ctl);
 }
 
+static u16 lpphy_get_pa_gain(struct b43_wldev *dev)
+{
+        return b43_phy_read(dev, B43_PHY_OFDM(0xFB)) & 0x7F;
+}
+
+static void lpphy_set_pa_gain(struct b43_wldev *dev, u16 gain)
+{
+        b43_phy_maskset(dev, B43_PHY_OFDM(0xFB), 0xE03F, gain << 6);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0xFD), 0x80FF, gain << 8);
+}
+
 static void lpphy_set_tx_gains(struct b43_wldev *dev,
                                struct lpphy_tx_gains gains)
 {
@@ -829,25 +910,22 @@ static void lpphy_set_tx_gains(struct b43_wldev *dev,
                 b43_phy_maskset(dev, B43_LPPHY_TX_GAIN_CTL_OVERRIDE_VAL,
                                 0xF800, rf_gain);
         } else {
-                pa_gain = b43_phy_read(dev, B43_PHY_OFDM(0xFB)) & 0x1FC0;
-                pa_gain <<= 2;
+                pa_gain = lpphy_get_pa_gain(dev);
                 b43_phy_write(dev, B43_LPPHY_TX_GAIN_CTL_OVERRIDE_VAL,
                               (gains.pga << 8) | gains.gm);
+                /*
+                 * SPEC FIXME The spec calls for (pa_gain << 8) here, but that
+                 * conflicts with the spec for set_pa_gain! Vendor driver bug?
+                 */
                 b43_phy_maskset(dev, B43_PHY_OFDM(0xFB),
-                                0x8000, gains.pad | pa_gain);
+                                0x8000, gains.pad | (pa_gain << 6));
                 b43_phy_write(dev, B43_PHY_OFDM(0xFC),
                               (gains.pga << 8) | gains.gm);
                 b43_phy_maskset(dev, B43_PHY_OFDM(0xFD),
-                                0x8000, gains.pad | pa_gain);
+                                0x8000, gains.pad | (pa_gain << 8));
         }
         lpphy_set_dac_gain(dev, gains.dac);
-        if (dev->phy.rev < 2) {
-                b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFEFF, 1 << 8);
-        } else {
-                b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFF7F, 1 << 7);
-                b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2, 0xBFFF, 1 << 14);
-        }
-        b43_phy_maskset(dev, B43_LPPHY_AFE_CTL_OVR, 0xFFBF, 1 << 6);
+        lpphy_enable_tx_gain_override(dev);
 }
 
 static void lpphy_rev0_1_set_rx_gain(struct b43_wldev *dev, u32 gain)
@@ -887,38 +965,6 @@ static void lpphy_rev2plus_set_rx_gain(struct b43_wldev *dev, u32 gain)
         }
 }
 
-static void lpphy_disable_rx_gain_override(struct b43_wldev *dev)
-{
-        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFFE);
-        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFEF);
-        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFBF);
-        if (dev->phy.rev >= 2) {
-                b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFEFF);
-                if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
-                        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFBFF);
-                        b43_phy_mask(dev, B43_PHY_OFDM(0xE5), 0xFFF7);
-                }
-        } else {
-                b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFDFF);
-        }
-}
-
-static void lpphy_enable_rx_gain_override(struct b43_wldev *dev)
-{
-        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x1);
-        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x10);
-        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x40);
-        if (dev->phy.rev >= 2) {
-                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x100);
-                if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
-                        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x400);
-                        b43_phy_set(dev, B43_PHY_OFDM(0xE5), 0x8);
-                }
-        } else {
-                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x200);
-        }
-}
-
 static void lpphy_set_rx_gain(struct b43_wldev *dev, u32 gain)
 {
         if (dev->phy.rev < 2)
@@ -1003,8 +1049,7 @@ static int lpphy_loopback(struct b43_wldev *dev)
 
         memset(&iq_est, 0, sizeof(iq_est));
 
-        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFFC, 0x3);
-        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x3);
+        lpphy_set_trsw_over(dev, true, true);
         b43_phy_set(dev, B43_LPPHY_AFE_CTL_OVR, 1);
         b43_phy_mask(dev, B43_LPPHY_AFE_CTL_OVRVAL, 0xFFFE);
         b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x800);
@@ -1126,7 +1171,7 @@ static void lpphy_set_tx_power_control(struct b43_wldev *dev,
                         b43_phy_maskset(dev, B43_LPPHY_TX_PWR_CTL_NNUM,
                                         0x8FFF, ((u16)lpphy->tssi_npt << 16));
                         //TODO Set "TSSI Transmit Count" variable to total transmitted frame count
-                        //TODO Disable TX gain override
+                        lpphy_disable_tx_gain_override(dev);
                         lpphy->tx_pwr_idx_over = -1;
                 }
         }
@@ -1312,15 +1357,73 @@ static void lpphy_calibrate_rc(struct b43_wldev *dev)
         }
 }
 
+static void b43_lpphy_op_set_rx_antenna(struct b43_wldev *dev, int antenna)
+{
+        if (dev->phy.rev >= 2)
+                return; // rev2+ doesn't support antenna diversity
+
+        if (B43_WARN_ON(antenna > B43_ANTENNA_AUTO1))
+                return;
+
+        b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_ANTDIVHELP);
+
+        b43_phy_maskset(dev, B43_LPPHY_CRSGAIN_CTL, 0xFFFD, antenna & 0x2);
+        b43_phy_maskset(dev, B43_LPPHY_CRSGAIN_CTL, 0xFFFE, antenna & 0x1);
+
+        b43_hf_write(dev, b43_hf_read(dev) | B43_HF_ANTDIVHELP);
+
+        dev->phy.lp->antenna = antenna;
+}
+
+static void lpphy_set_tx_iqcc(struct b43_wldev *dev, u16 a, u16 b)
+{
+        u16 tmp[2];
+
+        tmp[0] = a;
+        tmp[1] = b;
+        b43_lptab_write_bulk(dev, B43_LPTAB16(0, 80), 2, tmp);
+}
+
 static void lpphy_set_tx_power_by_index(struct b43_wldev *dev, u8 index)
 {
         struct b43_phy_lp *lpphy = dev->phy.lp;
+        struct lpphy_tx_gains gains;
+        u32 iq_comp, tx_gain, coeff, rf_power;
 
         lpphy->tx_pwr_idx_over = index;
+        lpphy_read_tx_pctl_mode_from_hardware(dev);
         if (lpphy->txpctl_mode != B43_LPPHY_TXPCTL_OFF)
                 lpphy_set_tx_power_control(dev, B43_LPPHY_TXPCTL_SW);
-
-        //TODO
+        if (dev->phy.rev >= 2) {
+                iq_comp = b43_lptab_read(dev, B43_LPTAB32(7, index + 320));
+                tx_gain = b43_lptab_read(dev, B43_LPTAB32(7, index + 192));
+                gains.pad = (tx_gain >> 16) & 0xFF;
+                gains.gm = tx_gain & 0xFF;
+                gains.pga = (tx_gain >> 8) & 0xFF;
+                gains.dac = (iq_comp >> 28) & 0xFF;
+                lpphy_set_tx_gains(dev, gains);
+        } else {
+                iq_comp = b43_lptab_read(dev, B43_LPTAB32(10, index + 320));
+                tx_gain = b43_lptab_read(dev, B43_LPTAB32(10, index + 192));
+                b43_phy_maskset(dev, B43_LPPHY_TX_GAIN_CTL_OVERRIDE_VAL,
+                                0xF800, (tx_gain >> 4) & 0x7FFF);
+                lpphy_set_dac_gain(dev, tx_gain & 0x7);
+                lpphy_set_pa_gain(dev, (tx_gain >> 24) & 0x7F);
+        }
+        lpphy_set_bb_mult(dev, (iq_comp >> 20) & 0xFF);
+        lpphy_set_tx_iqcc(dev, (iq_comp >> 10) & 0x3FF, iq_comp & 0x3FF);
+        if (dev->phy.rev >= 2) {
+                coeff = b43_lptab_read(dev, B43_LPTAB32(7, index + 448));
+        } else {
+                coeff = b43_lptab_read(dev, B43_LPTAB32(10, index + 448));
+        }
+        b43_lptab_write(dev, B43_LPTAB16(0, 85), coeff & 0xFFFF);
+        if (dev->phy.rev >= 2) {
+                rf_power = b43_lptab_read(dev, B43_LPTAB32(7, index + 576));
+                b43_phy_maskset(dev, B43_LPPHY_RF_PWR_OVERRIDE, 0xFF00,
+                                rf_power & 0xFFFF);//SPEC FIXME mask & set != 0
+        }
+        lpphy_enable_tx_gain_override(dev);
 }
 
 static void lpphy_btcoex_override(struct b43_wldev *dev)
@@ -1329,58 +1432,45 @@ static void lpphy_btcoex_override(struct b43_wldev *dev)
         b43_write16(dev, B43_MMIO_BTCOEX_TXCTL, 0xFF);
 }
 
-static void lpphy_pr41573_workaround(struct b43_wldev *dev)
+static void b43_lpphy_op_software_rfkill(struct b43_wldev *dev,
+                                         bool blocked)
 {
-        struct b43_phy_lp *lpphy = dev->phy.lp;
-        u32 *saved_tab;
-        const unsigned int saved_tab_size = 256;
-        enum b43_lpphy_txpctl_mode txpctl_mode;
-        s8 tx_pwr_idx_over;
-        u16 tssi_npt, tssi_idx;
-
-        saved_tab = kcalloc(saved_tab_size, sizeof(saved_tab[0]), GFP_KERNEL);
-        if (!saved_tab) {
-                b43err(dev->wl, "PR41573 failed. Out of memory!\n");
-                return;
-        }
-
-        lpphy_read_tx_pctl_mode_from_hardware(dev);
-        txpctl_mode = lpphy->txpctl_mode;
-        tx_pwr_idx_over = lpphy->tx_pwr_idx_over;
-        tssi_npt = lpphy->tssi_npt;
-        tssi_idx = lpphy->tssi_idx;
-
-        if (dev->phy.rev < 2) {
-                b43_lptab_read_bulk(dev, B43_LPTAB32(10, 0x140),
-                                    saved_tab_size, saved_tab);
+        //TODO check MAC control register
+        if (blocked) {
+                if (dev->phy.rev >= 2) {
+                        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0x83FF);
+                        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x1F00);
+                        b43_phy_mask(dev, B43_LPPHY_AFE_DDFS, 0x80FF);
+                        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, 0xDFFF);
+                        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x0808);
+                } else {
+                        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xE0FF);
+                        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x1F00);
+                        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, 0xFCFF);
+                        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x0018);
+                }
         } else {
-                b43_lptab_read_bulk(dev, B43_LPTAB32(7, 0x140),
-                                    saved_tab_size, saved_tab);
+                b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xE0FF);
+                if (dev->phy.rev >= 2)
+                        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xF7F7);
+                else
+                        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFFE7);
         }
-        //TODO
-
-        kfree(saved_tab);
 }
 
-static void lpphy_calibration(struct b43_wldev *dev)
+/* This was previously called lpphy_japan_filter */
+static void lpphy_set_analog_filter(struct b43_wldev *dev, int channel)
 {
         struct b43_phy_lp *lpphy = dev->phy.lp;
-        enum b43_lpphy_txpctl_mode saved_pctl_mode;
-
-        b43_mac_suspend(dev);
-
-        lpphy_btcoex_override(dev);
-        lpphy_read_tx_pctl_mode_from_hardware(dev);
-        saved_pctl_mode = lpphy->txpctl_mode;
-        lpphy_set_tx_power_control(dev, B43_LPPHY_TXPCTL_OFF);
-        //TODO Perform transmit power table I/Q LO calibration
-        if ((dev->phy.rev == 0) && (saved_pctl_mode != B43_LPPHY_TXPCTL_OFF))
-                lpphy_pr41573_workaround(dev);
-        //TODO If a full calibration has not been performed on this channel yet, perform PAPD TX-power calibration
-        lpphy_set_tx_power_control(dev, saved_pctl_mode);
-        //TODO Perform I/Q calibration with a single control value set
+        u16 tmp = (channel == 14); //SPEC FIXME check japanwidefilter!
 
-        b43_mac_enable(dev);
+        if (dev->phy.rev < 2) { //SPEC FIXME Isn't this rev0/1-specific?
+                b43_phy_maskset(dev, B43_LPPHY_LP_PHY_CTL, 0xFCFF, tmp << 9);
+                if ((dev->phy.rev == 1) && (lpphy->rc_cap))
+                        lpphy_set_rc_cap(dev);
+        } else {
+                b43_radio_write(dev, B2063_TX_BB_SP3, 0x3F);
+        }
 }
 
 static void lpphy_set_tssi_mux(struct b43_wldev *dev, enum tssi_mux_mode mode)
@@ -1489,6 +1579,420 @@ static void lpphy_tx_pctl_init(struct b43_wldev *dev)
         }
 }
 
+static void lpphy_pr41573_workaround(struct b43_wldev *dev)
+{
+        struct b43_phy_lp *lpphy = dev->phy.lp;
+        u32 *saved_tab;
+        const unsigned int saved_tab_size = 256;
+        enum b43_lpphy_txpctl_mode txpctl_mode;
+        s8 tx_pwr_idx_over;
+        u16 tssi_npt, tssi_idx;
+
+        saved_tab = kcalloc(saved_tab_size, sizeof(saved_tab[0]), GFP_KERNEL);
+        if (!saved_tab) {
+                b43err(dev->wl, "PR41573 failed. Out of memory!\n");
+                return;
+        }
+
+        lpphy_read_tx_pctl_mode_from_hardware(dev);
+        txpctl_mode = lpphy->txpctl_mode;
+        tx_pwr_idx_over = lpphy->tx_pwr_idx_over;
+        tssi_npt = lpphy->tssi_npt;
+        tssi_idx = lpphy->tssi_idx;
+
+        if (dev->phy.rev < 2) {
+                b43_lptab_read_bulk(dev, B43_LPTAB32(10, 0x140),
+                                    saved_tab_size, saved_tab);
+        } else {
+                b43_lptab_read_bulk(dev, B43_LPTAB32(7, 0x140),
+                                    saved_tab_size, saved_tab);
+        }
+        //FIXME PHY reset
+        lpphy_table_init(dev); //FIXME is table init needed?
+        lpphy_baseband_init(dev);
+        lpphy_tx_pctl_init(dev);
+        b43_lpphy_op_software_rfkill(dev, false);
+        lpphy_set_tx_power_control(dev, B43_LPPHY_TXPCTL_OFF);
+        if (dev->phy.rev < 2) {
+                b43_lptab_write_bulk(dev, B43_LPTAB32(10, 0x140),
+                                     saved_tab_size, saved_tab);
+        } else {
+                b43_lptab_write_bulk(dev, B43_LPTAB32(7, 0x140),
+                                     saved_tab_size, saved_tab);
+        }
+        b43_write16(dev, B43_MMIO_CHANNEL, lpphy->channel);
+        lpphy->tssi_npt = tssi_npt;
+        lpphy->tssi_idx = tssi_idx;
+        lpphy_set_analog_filter(dev, lpphy->channel);
+        if (tx_pwr_idx_over != -1)
+                lpphy_set_tx_power_by_index(dev, tx_pwr_idx_over);
+        if (lpphy->rc_cap)
+                lpphy_set_rc_cap(dev);
+        b43_lpphy_op_set_rx_antenna(dev, lpphy->antenna);
+        lpphy_set_tx_power_control(dev, txpctl_mode);
+        kfree(saved_tab);
+}
+
+struct lpphy_rx_iq_comp { u8 chan; s8 c1, c0; };
+
+static const struct lpphy_rx_iq_comp lpphy_5354_iq_table[] = {
+        { .chan = 1, .c1 = -66, .c0 = 15, },
+        { .chan = 2, .c1 = -66, .c0 = 15, },
+        { .chan = 3, .c1 = -66, .c0 = 15, },
+        { .chan = 4, .c1 = -66, .c0 = 15, },
+        { .chan = 5, .c1 = -66, .c0 = 15, },
+        { .chan = 6, .c1 = -66, .c0 = 15, },
+        { .chan = 7, .c1 = -66, .c0 = 14, },
+        { .chan = 8, .c1 = -66, .c0 = 14, },
+        { .chan = 9, .c1 = -66, .c0 = 14, },
+        { .chan = 10, .c1 = -66, .c0 = 14, },
+        { .chan = 11, .c1 = -66, .c0 = 14, },
+        { .chan = 12, .c1 = -66, .c0 = 13, },
+        { .chan = 13, .c1 = -66, .c0 = 13, },
+        { .chan = 14, .c1 = -66, .c0 = 13, },
+};
+
+static const struct lpphy_rx_iq_comp lpphy_rev0_1_iq_table[] = {
+        { .chan = 1, .c1 = -64, .c0 = 13, },
+        { .chan = 2, .c1 = -64, .c0 = 13, },
+        { .chan = 3, .c1 = -64, .c0 = 13, },
+        { .chan = 4, .c1 = -64, .c0 = 13, },
+        { .chan = 5, .c1 = -64, .c0 = 12, },
+        { .chan = 6, .c1 = -64, .c0 = 12, },
+        { .chan = 7, .c1 = -64, .c0 = 12, },
+        { .chan = 8, .c1 = -64, .c0 = 12, },
+        { .chan = 9, .c1 = -64, .c0 = 12, },
+        { .chan = 10, .c1 = -64, .c0 = 11, },
+        { .chan = 11, .c1 = -64, .c0 = 11, },
+        { .chan = 12, .c1 = -64, .c0 = 11, },
+        { .chan = 13, .c1 = -64, .c0 = 11, },
+        { .chan = 14, .c1 = -64, .c0 = 10, },
+        { .chan = 34, .c1 = -62, .c0 = 24, },
+        { .chan = 38, .c1 = -62, .c0 = 24, },
+        { .chan = 42, .c1 = -62, .c0 = 24, },
+        { .chan = 46, .c1 = -62, .c0 = 23, },
+        { .chan = 36, .c1 = -62, .c0 = 24, },
+        { .chan = 40, .c1 = -62, .c0 = 24, },
+        { .chan = 44, .c1 = -62, .c0 = 23, },
+        { .chan = 48, .c1 = -62, .c0 = 23, },
+        { .chan = 52, .c1 = -62, .c0 = 23, },
+        { .chan = 56, .c1 = -62, .c0 = 22, },
+        { .chan = 60, .c1 = -62, .c0 = 22, },
+        { .chan = 64, .c1 = -62, .c0 = 22, },
+        { .chan = 100, .c1 = -62, .c0 = 16, },
+        { .chan = 104, .c1 = -62, .c0 = 16, },
+        { .chan = 108, .c1 = -62, .c0 = 15, },
+        { .chan = 112, .c1 = -62, .c0 = 14, },
+        { .chan = 116, .c1 = -62, .c0 = 14, },
+        { .chan = 120, .c1 = -62, .c0 = 13, },
+        { .chan = 124, .c1 = -62, .c0 = 12, },
+        { .chan = 128, .c1 = -62, .c0 = 12, },
+        { .chan = 132, .c1 = -62, .c0 = 12, },
+        { .chan = 136, .c1 = -62, .c0 = 11, },
+        { .chan = 140, .c1 = -62, .c0 = 10, },
+        { .chan = 149, .c1 = -61, .c0 = 9, },
+        { .chan = 153, .c1 = -61, .c0 = 9, },
+        { .chan = 157, .c1 = -61, .c0 = 9, },
+        { .chan = 161, .c1 = -61, .c0 = 8, },
+        { .chan = 165, .c1 = -61, .c0 = 8, },
+        { .chan = 184, .c1 = -62, .c0 = 25, },
+        { .chan = 188, .c1 = -62, .c0 = 25, },
+        { .chan = 192, .c1 = -62, .c0 = 25, },
+        { .chan = 196, .c1 = -62, .c0 = 25, },
+        { .chan = 200, .c1 = -62, .c0 = 25, },
+        { .chan = 204, .c1 = -62, .c0 = 25, },
+        { .chan = 208, .c1 = -62, .c0 = 25, },
+        { .chan = 212, .c1 = -62, .c0 = 25, },
+        { .chan = 216, .c1 = -62, .c0 = 26, },
+};
+
+static const struct lpphy_rx_iq_comp lpphy_rev2plus_iq_comp = {
+        .chan = 0,
+        .c1 = -64,
+        .c0 = 0,
+};
+
+static int lpphy_calc_rx_iq_comp(struct b43_wldev *dev, u16 samples)
+{
+        struct lpphy_iq_est iq_est;
+        u16 c0, c1;
+        int prod, ipwr, qpwr, prod_msb, q_msb, tmp1, tmp2, tmp3, tmp4, ret;
+
+        c1 = b43_phy_read(dev, B43_LPPHY_RX_COMP_COEFF_S);
+        c0 = c1 >> 8;
+        c1 |= 0xFF;
+
+        b43_phy_maskset(dev, B43_LPPHY_RX_COMP_COEFF_S, 0xFF00, 0x00C0);
+        b43_phy_mask(dev, B43_LPPHY_RX_COMP_COEFF_S, 0x00FF);
+
+        ret = lpphy_rx_iq_est(dev, samples, 32, &iq_est);
+        if (!ret)
+                goto out;
+
+        prod = iq_est.iq_prod;
+        ipwr = iq_est.i_pwr;
+        qpwr = iq_est.q_pwr;
+
+        if (ipwr + qpwr < 2) {
+                ret = 0;
+                goto out;
+        }
+
+        prod_msb = fls(abs(prod));
+        q_msb = fls(abs(qpwr));
+        tmp1 = prod_msb - 20;
+
+        if (tmp1 >= 0) {
+                tmp3 = ((prod << (30 - prod_msb)) + (ipwr >> (1 + tmp1))) /
+                        (ipwr >> tmp1);
+        } else {
+                tmp3 = ((prod << (30 - prod_msb)) + (ipwr << (-1 - tmp1))) /
+                        (ipwr << -tmp1);
+        }
+
+        tmp2 = q_msb - 11;
+
+        if (tmp2 >= 0)
+                tmp4 = (qpwr << (31 - q_msb)) / (ipwr >> tmp2);
+        else
+                tmp4 = (qpwr << (31 - q_msb)) / (ipwr << -tmp2);
+
+        tmp4 -= tmp3 * tmp3;
+        tmp4 = -int_sqrt(tmp4);
+
+        c0 = tmp3 >> 3;
+        c1 = tmp4 >> 4;
+
+out:
+        b43_phy_maskset(dev, B43_LPPHY_RX_COMP_COEFF_S, 0xFF00, c1);
+        b43_phy_maskset(dev, B43_LPPHY_RX_COMP_COEFF_S, 0x00FF, c0 << 8);
+        return ret;
+}
+
+static void lpphy_run_samples(struct b43_wldev *dev, u16 samples, u16 loops,
+                              u16 wait)
+{
+        b43_phy_maskset(dev, B43_LPPHY_SMPL_PLAY_BUFFER_CTL,
+                        0xFFC0, samples - 1);
+        if (loops != 0xFFFF)
+                loops--;
+        b43_phy_maskset(dev, B43_LPPHY_SMPL_PLAY_COUNT, 0xF000, loops);
+        b43_phy_maskset(dev, B43_LPPHY_SMPL_PLAY_BUFFER_CTL, 0x3F, wait << 6);
+        b43_phy_set(dev, B43_LPPHY_A_PHY_CTL_ADDR, 0x1);
+}
+
+//SPEC FIXME what does a negative freq mean?
+static void lpphy_start_tx_tone(struct b43_wldev *dev, s32 freq, u16 max)
+{
+        struct b43_phy_lp *lpphy = dev->phy.lp;
+        u16 buf[64];
+        int i, samples = 0, angle = 0;
+        int rotation = (((36 * freq) / 20) << 16) / 100;
+        struct b43_c32 sample;
+
+        lpphy->tx_tone_freq = freq;
+
+        if (freq) {
+                /* Find i for which abs(freq) integrally divides 20000 * i */
+                for (i = 1; samples * abs(freq) != 20000 * i; i++) {
+                        samples = (20000 * i) / abs(freq);
+                        if(B43_WARN_ON(samples > 63))
+                                return;
+                }
+        } else {
+                samples = 2;
+        }
+
+        for (i = 0; i < samples; i++) {
+                sample = b43_cordic(angle);
+                angle += rotation;
+                buf[i] = CORDIC_CONVERT((sample.i * max) & 0xFF) << 8;
+                buf[i] |= CORDIC_CONVERT((sample.q * max) & 0xFF);
+        }
+
+        b43_lptab_write_bulk(dev, B43_LPTAB16(5, 0), samples, buf);
+
+        lpphy_run_samples(dev, samples, 0xFFFF, 0);
+}
+
+static void lpphy_stop_tx_tone(struct b43_wldev *dev)
+{
+        struct b43_phy_lp *lpphy = dev->phy.lp;
+        int i;
+
+        lpphy->tx_tone_freq = 0;
+
+        b43_phy_mask(dev, B43_LPPHY_SMPL_PLAY_COUNT, 0xF000);
+        for (i = 0; i < 31; i++) {
+                if (!(b43_phy_read(dev, B43_LPPHY_A_PHY_CTL_ADDR) & 0x1))
+                        break;
+                udelay(100);
+        }
+}
+
+
+static void lpphy_papd_cal(struct b43_wldev *dev, struct lpphy_tx_gains gains,
+                           int mode, bool useindex, u8 index)
+{
+        //TODO
+}
+
+static void lpphy_papd_cal_txpwr(struct b43_wldev *dev)
+{
+        struct b43_phy_lp *lpphy = dev->phy.lp;
+        struct ssb_bus *bus = dev->dev->bus;
+        struct lpphy_tx_gains gains, oldgains;
+        int old_txpctl, old_afe_ovr, old_rf, old_bbmult;
+
+        lpphy_read_tx_pctl_mode_from_hardware(dev);
+        old_txpctl = lpphy->txpctl_mode;
+        old_afe_ovr = b43_phy_read(dev, B43_LPPHY_AFE_CTL_OVR) & 0x40;
+        if (old_afe_ovr)
+                oldgains = lpphy_get_tx_gains(dev);
+        old_rf = b43_phy_read(dev, B43_LPPHY_RF_PWR_OVERRIDE) & 0xFF;
+        old_bbmult = lpphy_get_bb_mult(dev);
+
+        lpphy_set_tx_power_control(dev, B43_LPPHY_TXPCTL_OFF);
+
+        if (bus->chip_id == 0x4325 && bus->chip_rev == 0)
+                lpphy_papd_cal(dev, gains, 0, 1, 30);
+        else
+                lpphy_papd_cal(dev, gains, 0, 1, 65);
+
+        if (old_afe_ovr)
+                lpphy_set_tx_gains(dev, oldgains);
+        lpphy_set_bb_mult(dev, old_bbmult);
+        lpphy_set_tx_power_control(dev, old_txpctl);
+        b43_phy_maskset(dev, B43_LPPHY_RF_PWR_OVERRIDE, 0xFF00, old_rf);
+}
+
+static int lpphy_rx_iq_cal(struct b43_wldev *dev, bool noise, bool tx,
+                            bool rx, bool pa, struct lpphy_tx_gains *gains)
+{
+        struct b43_phy_lp *lpphy = dev->phy.lp;
+        struct ssb_bus *bus = dev->dev->bus;
+        const struct lpphy_rx_iq_comp *iqcomp = NULL;
+        struct lpphy_tx_gains nogains, oldgains;
+        u16 tmp;
+        int i, ret;
+
+        memset(&nogains, 0, sizeof(nogains));
+        memset(&oldgains, 0, sizeof(oldgains));
+
+        if (bus->chip_id == 0x5354) {
+                for (i = 0; i < ARRAY_SIZE(lpphy_5354_iq_table); i++) {
+                        if (lpphy_5354_iq_table[i].chan == lpphy->channel) {
+                                iqcomp = &lpphy_5354_iq_table[i];
+                        }
+                }
+        } else if (dev->phy.rev >= 2) {
+                iqcomp = &lpphy_rev2plus_iq_comp;
+        } else {
+                for (i = 0; i < ARRAY_SIZE(lpphy_rev0_1_iq_table); i++) {
+                        if (lpphy_rev0_1_iq_table[i].chan == lpphy->channel) {
+                                iqcomp = &lpphy_rev0_1_iq_table[i];
+                        }
+                }
+        }
+
+        if (B43_WARN_ON(!iqcomp))
+                return 0;
+
+        b43_phy_maskset(dev, B43_LPPHY_RX_COMP_COEFF_S, 0xFF00, iqcomp->c1);
+        b43_phy_maskset(dev, B43_LPPHY_RX_COMP_COEFF_S,
+                        0x00FF, iqcomp->c0 << 8);
+
+        if (noise) {
+                tx = true;
+                rx = false;
+                pa = false;
+        }
+
+        lpphy_set_trsw_over(dev, tx, rx);
+
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x8);
+                b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_VAL_0,
+                                0xFFF7, pa << 3);
+        } else {
+                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x20);
+                b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_VAL_0,
+                                0xFFDF, pa << 5);
+        }
+
+        tmp = b43_phy_read(dev, B43_LPPHY_AFE_CTL_OVR) & 0x40;
+
+        if (noise)
+                lpphy_set_rx_gain(dev, 0x2D5D);
+        else {
+                if (tmp)
+                        oldgains = lpphy_get_tx_gains(dev);
+                if (!gains)
+                        gains = &nogains;
+                lpphy_set_tx_gains(dev, *gains);
+        }
+
+        b43_phy_mask(dev, B43_LPPHY_AFE_CTL_OVR, 0xFFFE);
+        b43_phy_mask(dev, B43_LPPHY_AFE_CTL_OVRVAL, 0xFFFE);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x800);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0x800);
+        lpphy_set_deaf(dev, false);
+        if (noise)
+                ret = lpphy_calc_rx_iq_comp(dev, 0xFFF0);
+        else {
+                lpphy_start_tx_tone(dev, 4000, 100);
+                ret = lpphy_calc_rx_iq_comp(dev, 0x4000);
+                lpphy_stop_tx_tone(dev);
+        }
+        lpphy_clear_deaf(dev, false);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFFC);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFF7);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFDF);
+        if (!noise) {
+                if (tmp)
+                        lpphy_set_tx_gains(dev, oldgains);
+                else
+                        lpphy_disable_tx_gain_override(dev);
+        }
+        lpphy_disable_rx_gain_override(dev);
+        b43_phy_mask(dev, B43_LPPHY_AFE_CTL_OVR, 0xFFFE);
+        b43_phy_mask(dev, B43_LPPHY_AFE_CTL_OVRVAL, 0xF7FF);
+        return ret;
+}
+
+static void lpphy_calibration(struct b43_wldev *dev)
+{
+        struct b43_phy_lp *lpphy = dev->phy.lp;
+        enum b43_lpphy_txpctl_mode saved_pctl_mode;
+        bool full_cal = false;
+
+        if (lpphy->full_calib_chan != lpphy->channel) {
+                full_cal = true;
+                lpphy->full_calib_chan = lpphy->channel;
+        }
+
+        b43_mac_suspend(dev);
+
+        lpphy_btcoex_override(dev);
+        if (dev->phy.rev >= 2)
+                lpphy_save_dig_flt_state(dev);
+        lpphy_read_tx_pctl_mode_from_hardware(dev);
+        saved_pctl_mode = lpphy->txpctl_mode;
+        lpphy_set_tx_power_control(dev, B43_LPPHY_TXPCTL_OFF);
+        //TODO Perform transmit power table I/Q LO calibration
+        if ((dev->phy.rev == 0) && (saved_pctl_mode != B43_LPPHY_TXPCTL_OFF))
+                lpphy_pr41573_workaround(dev);
+        if ((dev->phy.rev >= 2) && full_cal) {
+                lpphy_papd_cal_txpwr(dev);
+        }
+        lpphy_set_tx_power_control(dev, saved_pctl_mode);
+        if (dev->phy.rev >= 2)
+                lpphy_restore_dig_flt_state(dev);
+        lpphy_rx_iq_cal(dev, true, true, false, false, NULL);
+
+        b43_mac_enable(dev);
+}
+
 static u16 b43_lpphy_op_read(struct b43_wldev *dev, u16 reg)
 {
         b43_write16(dev, B43_MMIO_PHY_CONTROL, reg);
@@ -1533,12 +2037,6 @@ static void b43_lpphy_op_radio_write(struct b43_wldev *dev, u16 reg, u16 value)
         b43_write16(dev, B43_MMIO_RADIO_DATA_LOW, value);
 }
 
-static void b43_lpphy_op_software_rfkill(struct b43_wldev *dev,
-                                         bool blocked)
-{
-        //TODO
-}
-
 struct b206x_channel {
         u8 channel;
         u16 freq;
@@ -2004,22 +2502,6 @@ static int lpphy_b2062_tune(struct b43_wldev *dev,
         return err;
 }
 
-
-/* This was previously called lpphy_japan_filter */
-static void lpphy_set_analog_filter(struct b43_wldev *dev, int channel)
-{
-        struct b43_phy_lp *lpphy = dev->phy.lp;
-        u16 tmp = (channel == 14); //SPEC FIXME check japanwidefilter!
-
-        if (dev->phy.rev < 2) { //SPEC FIXME Isn't this rev0/1-specific?
-                b43_phy_maskset(dev, B43_LPPHY_LP_PHY_CTL, 0xFCFF, tmp << 9);
-                if ((dev->phy.rev == 1) && (lpphy->rc_cap))
-                        lpphy_set_rc_cap(dev);
-        } else {
-                b43_radio_write(dev, B2063_TX_BB_SP3, 0x3F);
-        }
-}
-
 static void lpphy_b2063_vco_calib(struct b43_wldev *dev)
 {
         u16 tmp;
@@ -2204,18 +2686,6 @@ static int b43_lpphy_op_init(struct b43_wldev *dev)
         return 0;
 }
 
-static void b43_lpphy_op_set_rx_antenna(struct b43_wldev *dev, int antenna)
-{
-        if (dev->phy.rev >= 2)
-                return; // rev2+ doesn't support antenna diversity
-
-        if (B43_WARN_ON(antenna > B43_ANTENNA_AUTO1))
-                return;
-
-        b43_phy_maskset(dev, B43_LPPHY_CRSGAIN_CTL, 0xFFFD, antenna & 0x2);
-        b43_phy_maskset(dev, B43_LPPHY_CRSGAIN_CTL, 0xFFFE, antenna & 0x1);
-}
-
 static void b43_lpphy_op_adjust_txpower(struct b43_wldev *dev)
 {
         //TODO
@@ -2238,6 +2708,11 @@ void b43_lpphy_op_switch_analog(struct b43_wldev *dev, bool on)
        }
 }
 
+static void b43_lpphy_op_pwork_15sec(struct b43_wldev *dev)
+{
+        //TODO
+}
+
 const struct b43_phy_operations b43_phyops_lp = {
         .allocate               = b43_lpphy_op_allocate,
         .free                   = b43_lpphy_op_free,
@@ -2255,4 +2730,6 @@ const struct b43_phy_operations b43_phyops_lp = {
         .set_rx_antenna         = b43_lpphy_op_set_rx_antenna,
         .recalc_txpower         = b43_lpphy_op_recalc_txpower,
         .adjust_txpower         = b43_lpphy_op_adjust_txpower,
+        .pwork_15sec            = b43_lpphy_op_pwork_15sec,
+        .pwork_60sec            = lpphy_calibration,
 };
diff --git a/drivers/net/wireless/b43/phy_lp.h b/drivers/net/wireless/b43/phy_lp.h
index c3232c17b60a..62737f700cbc 100644
--- a/drivers/net/wireless/b43/phy_lp.h
+++ b/drivers/net/wireless/b43/phy_lp.h
@@ -286,6 +286,7 @@
 #define B43_LPPHY_TR_LOOKUP_6                   B43_PHY_OFDM(0xC8) /* TR Lookup 6 */
 #define B43_LPPHY_TR_LOOKUP_7                   B43_PHY_OFDM(0xC9) /* TR Lookup 7 */
 #define B43_LPPHY_TR_LOOKUP_8                   B43_PHY_OFDM(0xCA) /* TR Lookup 8 */
+#define B43_LPPHY_RF_PWR_OVERRIDE               B43_PHY_OFDM(0xD3) /* RF power override */
 
 
 
@@ -871,12 +872,12 @@ struct b43_phy_lp {
         u8 rssi_gs;
 
         /* RC cap */
-        u8 rc_cap; /* FIXME initial value? */
+        u8 rc_cap;
         /* BX arch */
         u8 bx_arch;
 
         /* Full calibration channel */
-        u8 full_calib_chan; /* FIXME initial value? */
+        u8 full_calib_chan;
 
         /* Transmit iqlocal best coeffs */
         bool tx_iqloc_best_coeffs_valid;
@@ -891,6 +892,12 @@ struct b43_phy_lp {
 
         /* The channel we are tuned to */
         u8 channel;
+
+        /* The active antenna diversity mode */
+        int antenna;
+
+        /* Frequency of the active TX tone */
+        int tx_tone_freq;
 };
 
 enum tssi_mux_mode {
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 992318a78077..9c7cd282e46c 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -23,12 +23,56 @@
 */
 
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 
 #include "b43.h"
 #include "phy_n.h"
 #include "tables_nphy.h"
+#include "main.h"
 
+struct nphy_txgains {
+        u16 txgm[2];
+        u16 pga[2];
+        u16 pad[2];
+        u16 ipa[2];
+};
+
+struct nphy_iqcal_params {
+        u16 txgm;
+        u16 pga;
+        u16 pad;
+        u16 ipa;
+        u16 cal_gain;
+        u16 ncorr[5];
+};
+
+struct nphy_iq_est {
+        s32 iq0_prod;
+        u32 i0_pwr;
+        u32 q0_pwr;
+        s32 iq1_prod;
+        u32 i1_pwr;
+        u32 q1_pwr;
+};
+
+enum b43_nphy_rf_sequence {
+        B43_RFSEQ_RX2TX,
+        B43_RFSEQ_TX2RX,
+        B43_RFSEQ_RESET2RX,
+        B43_RFSEQ_UPDATE_GAINH,
+        B43_RFSEQ_UPDATE_GAINL,
+        B43_RFSEQ_UPDATE_GAINU,
+};
+
+static void b43_nphy_set_rf_sequence(struct b43_wldev *dev, u8 cmd,
+                                        u8 *events, u8 *delays, u8 length);
+static void b43_nphy_force_rf_sequence(struct b43_wldev *dev,
+                                       enum b43_nphy_rf_sequence seq);
+static void b43_nphy_rf_control_override(struct b43_wldev *dev, u16 field,
+                                                u16 value, u8 core, bool off);
+static void b43_nphy_rf_control_intc_override(struct b43_wldev *dev, u8 field,
+                                                u16 value, u8 core);
 
 void b43_nphy_set_rxantenna(struct b43_wldev *dev, int antenna)
 {//TODO
@@ -197,173 +241,1020 @@ void b43_nphy_radio_turn_off(struct b43_wldev *dev)
                      ~B43_NPHY_RFCTL_CMD_EN);
 }
 
-#define ntab_upload(dev, offset, data) do { \
-                unsigned int i;                                         \
-                for (i = 0; i < (offset##_SIZE); i++)                   \
-                        b43_ntab_write(dev, (offset) + i, (data)[i]);   \
-        } while (0)
-
-/* Upload the N-PHY tables. */
+/*
+ * Upload the N-PHY tables.
+ * http://bcm-v4.sipsolutions.net/802.11/PHY/N/InitTables
+ */
 static void b43_nphy_tables_init(struct b43_wldev *dev)
 {
-        /* Static tables */
-        ntab_upload(dev, B43_NTAB_FRAMESTRUCT, b43_ntab_framestruct);
-        ntab_upload(dev, B43_NTAB_FRAMELT, b43_ntab_framelookup);
-        ntab_upload(dev, B43_NTAB_TMAP, b43_ntab_tmap);
-        ntab_upload(dev, B43_NTAB_TDTRN, b43_ntab_tdtrn);
-        ntab_upload(dev, B43_NTAB_INTLEVEL, b43_ntab_intlevel);
-        ntab_upload(dev, B43_NTAB_PILOT, b43_ntab_pilot);
-        ntab_upload(dev, B43_NTAB_PILOTLT, b43_ntab_pilotlt);
-        ntab_upload(dev, B43_NTAB_TDI20A0, b43_ntab_tdi20a0);
-        ntab_upload(dev, B43_NTAB_TDI20A1, b43_ntab_tdi20a1);
-        ntab_upload(dev, B43_NTAB_TDI40A0, b43_ntab_tdi40a0);
-        ntab_upload(dev, B43_NTAB_TDI40A1, b43_ntab_tdi40a1);
-        ntab_upload(dev, B43_NTAB_BDI, b43_ntab_bdi);
-        ntab_upload(dev, B43_NTAB_CHANEST, b43_ntab_channelest);
-        ntab_upload(dev, B43_NTAB_MCS, b43_ntab_mcs);
-
-        /* Volatile tables */
-        ntab_upload(dev, B43_NTAB_NOISEVAR10, b43_ntab_noisevar10);
-        ntab_upload(dev, B43_NTAB_NOISEVAR11, b43_ntab_noisevar11);
-        ntab_upload(dev, B43_NTAB_C0_ESTPLT, b43_ntab_estimatepowerlt0);
-        ntab_upload(dev, B43_NTAB_C1_ESTPLT, b43_ntab_estimatepowerlt1);
-        ntab_upload(dev, B43_NTAB_C0_ADJPLT, b43_ntab_adjustpower0);
-        ntab_upload(dev, B43_NTAB_C1_ADJPLT, b43_ntab_adjustpower1);
-        ntab_upload(dev, B43_NTAB_C0_GAINCTL, b43_ntab_gainctl0);
-        ntab_upload(dev, B43_NTAB_C1_GAINCTL, b43_ntab_gainctl1);
-        ntab_upload(dev, B43_NTAB_C0_IQLT, b43_ntab_iqlt0);
-        ntab_upload(dev, B43_NTAB_C1_IQLT, b43_ntab_iqlt1);
-        ntab_upload(dev, B43_NTAB_C0_LOFEEDTH, b43_ntab_loftlt0);
-        ntab_upload(dev, B43_NTAB_C1_LOFEEDTH, b43_ntab_loftlt1);
+        if (dev->phy.rev < 3)
+                b43_nphy_rev0_1_2_tables_init(dev);
+        else
+                b43_nphy_rev3plus_tables_init(dev);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/PA%20override */
+static void b43_nphy_pa_override(struct b43_wldev *dev, bool enable)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        enum ieee80211_band band;
+        u16 tmp;
+
+        if (!enable) {
+                nphy->rfctrl_intc1_save = b43_phy_read(dev,
+                                                       B43_NPHY_RFCTL_INTC1);
+                nphy->rfctrl_intc2_save = b43_phy_read(dev,
+                                                       B43_NPHY_RFCTL_INTC2);
+                band = b43_current_band(dev->wl);
+                if (dev->phy.rev >= 3) {
+                        if (band == IEEE80211_BAND_5GHZ)
+                                tmp = 0x600;
+                        else
+                                tmp = 0x480;
+                } else {
+                        if (band == IEEE80211_BAND_5GHZ)
+                                tmp = 0x180;
+                        else
+                                tmp = 0x120;
+                }
+                b43_phy_write(dev, B43_NPHY_RFCTL_INTC1, tmp);
+                b43_phy_write(dev, B43_NPHY_RFCTL_INTC2, tmp);
+        } else {
+                b43_phy_write(dev, B43_NPHY_RFCTL_INTC1,
+                                nphy->rfctrl_intc1_save);
+                b43_phy_write(dev, B43_NPHY_RFCTL_INTC2,
+                                nphy->rfctrl_intc2_save);
+        }
 }
 
-static void b43_nphy_workarounds(struct b43_wldev *dev)
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/TxLpFbw */
+static void b43_nphy_tx_lp_fbw(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        u16 tmp;
+        enum ieee80211_band band = b43_current_band(dev->wl);
+        bool ipa = (nphy->ipa2g_on && band == IEEE80211_BAND_2GHZ) ||
+                        (nphy->ipa5g_on && band == IEEE80211_BAND_5GHZ);
+
+        if (dev->phy.rev >= 3) {
+                if (ipa) {
+                        tmp = 4;
+                        b43_phy_write(dev, B43_NPHY_TXF_40CO_B32S2,
+                              (((((tmp << 3) | tmp) << 3) | tmp) << 3) | tmp);
+                }
+
+                tmp = 1;
+                b43_phy_write(dev, B43_NPHY_TXF_40CO_B1S2,
+                              (((((tmp << 3) | tmp) << 3) | tmp) << 3) | tmp);
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/BmacPhyClkFgc */
+static void b43_nphy_bmac_clock_fgc(struct b43_wldev *dev, bool force)
+{
+        u32 tmslow;
+
+        if (dev->phy.type != B43_PHYTYPE_N)
+                return;
+
+        tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
+        if (force)
+                tmslow |= SSB_TMSLOW_FGC;
+        else
+                tmslow &= ~SSB_TMSLOW_FGC;
+        ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/CCA */
+static void b43_nphy_reset_cca(struct b43_wldev *dev)
+{
+        u16 bbcfg;
+
+        b43_nphy_bmac_clock_fgc(dev, 1);
+        bbcfg = b43_phy_read(dev, B43_NPHY_BBCFG);
+        b43_phy_write(dev, B43_NPHY_BBCFG, bbcfg | B43_NPHY_BBCFG_RSTCCA);
+        udelay(1);
+        b43_phy_write(dev, B43_NPHY_BBCFG, bbcfg & ~B43_NPHY_BBCFG_RSTCCA);
+        b43_nphy_bmac_clock_fgc(dev, 0);
+        b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RESET2RX);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MIMOConfig */
+static void b43_nphy_update_mimo_config(struct b43_wldev *dev, s32 preamble)
+{
+        u16 mimocfg = b43_phy_read(dev, B43_NPHY_MIMOCFG);
+
+        mimocfg |= B43_NPHY_MIMOCFG_AUTO;
+        if (preamble == 1)
+                mimocfg |= B43_NPHY_MIMOCFG_GFMIX;
+        else
+                mimocfg &= ~B43_NPHY_MIMOCFG_GFMIX;
+
+        b43_phy_write(dev, B43_NPHY_MIMOCFG, mimocfg);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/Chains */
+static void b43_nphy_update_txrx_chain(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        bool override = false;
+        u16 chain = 0x33;
+
+        if (nphy->txrx_chain == 0) {
+                chain = 0x11;
+                override = true;
+        } else if (nphy->txrx_chain == 1) {
+                chain = 0x22;
+                override = true;
+        }
+
+        b43_phy_maskset(dev, B43_NPHY_RFSEQCA,
+                        ~(B43_NPHY_RFSEQCA_TXEN | B43_NPHY_RFSEQCA_RXEN),
+                        chain);
+
+        if (override)
+                b43_phy_set(dev, B43_NPHY_RFSEQMODE,
+                                B43_NPHY_RFSEQMODE_CAOVER);
+        else
+                b43_phy_mask(dev, B43_NPHY_RFSEQMODE,
+                                ~B43_NPHY_RFSEQMODE_CAOVER);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RxIqEst */
+static void b43_nphy_rx_iq_est(struct b43_wldev *dev, struct nphy_iq_est *est,
+                                u16 samps, u8 time, bool wait)
+{
+        int i;
+        u16 tmp;
+
+        b43_phy_write(dev, B43_NPHY_IQEST_SAMCNT, samps);
+        b43_phy_maskset(dev, B43_NPHY_IQEST_WT, ~B43_NPHY_IQEST_WT_VAL, time);
+        if (wait)
+                b43_phy_set(dev, B43_NPHY_IQEST_CMD, B43_NPHY_IQEST_CMD_MODE);
+        else
+                b43_phy_mask(dev, B43_NPHY_IQEST_CMD, ~B43_NPHY_IQEST_CMD_MODE);
+
+        b43_phy_set(dev, B43_NPHY_IQEST_CMD, B43_NPHY_IQEST_CMD_START);
+
+        for (i = 1000; i; i--) {
+                tmp = b43_phy_read(dev, B43_NPHY_IQEST_CMD);
+                if (!(tmp & B43_NPHY_IQEST_CMD_START)) {
+                        est->i0_pwr = (b43_phy_read(dev, B43_NPHY_IQEST_IPACC_HI0) << 16) |
+                                        b43_phy_read(dev, B43_NPHY_IQEST_IPACC_LO0);
+                        est->q0_pwr = (b43_phy_read(dev, B43_NPHY_IQEST_QPACC_HI0) << 16) |
+                                        b43_phy_read(dev, B43_NPHY_IQEST_QPACC_LO0);
+                        est->iq0_prod = (b43_phy_read(dev, B43_NPHY_IQEST_IQACC_HI0) << 16) |
+                                        b43_phy_read(dev, B43_NPHY_IQEST_IQACC_LO0);
+
+                        est->i1_pwr = (b43_phy_read(dev, B43_NPHY_IQEST_IPACC_HI1) << 16) |
+                                        b43_phy_read(dev, B43_NPHY_IQEST_IPACC_LO1);
+                        est->q1_pwr = (b43_phy_read(dev, B43_NPHY_IQEST_QPACC_HI1) << 16) |
+                                        b43_phy_read(dev, B43_NPHY_IQEST_QPACC_LO1);
+                        est->iq1_prod = (b43_phy_read(dev, B43_NPHY_IQEST_IQACC_HI1) << 16) |
+                                        b43_phy_read(dev, B43_NPHY_IQEST_IQACC_LO1);
+                        return;
+                }
+                udelay(10);
+        }
+        memset(est, 0, sizeof(*est));
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RxIqCoeffs */
+static void b43_nphy_rx_iq_coeffs(struct b43_wldev *dev, bool write,
+                                        struct b43_phy_n_iq_comp *pcomp)
+{
+        if (write) {
+                b43_phy_write(dev, B43_NPHY_C1_RXIQ_COMPA0, pcomp->a0);
+                b43_phy_write(dev, B43_NPHY_C1_RXIQ_COMPB0, pcomp->b0);
+                b43_phy_write(dev, B43_NPHY_C2_RXIQ_COMPA1, pcomp->a1);
+                b43_phy_write(dev, B43_NPHY_C2_RXIQ_COMPB1, pcomp->b1);
+        } else {
+                pcomp->a0 = b43_phy_read(dev, B43_NPHY_C1_RXIQ_COMPA0);
+                pcomp->b0 = b43_phy_read(dev, B43_NPHY_C1_RXIQ_COMPB0);
+                pcomp->a1 = b43_phy_read(dev, B43_NPHY_C2_RXIQ_COMPA1);
+                pcomp->b1 = b43_phy_read(dev, B43_NPHY_C2_RXIQ_COMPB1);
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RxCalPhyCleanup */
+static void b43_nphy_rx_cal_phy_cleanup(struct b43_wldev *dev, u8 core)
+{
+        u16 *regs = dev->phy.n->tx_rx_cal_phy_saveregs;
+
+        b43_phy_write(dev, B43_NPHY_RFSEQCA, regs[0]);
+        if (core == 0) {
+                b43_phy_write(dev, B43_NPHY_AFECTL_C1, regs[1]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER1, regs[2]);
+        } else {
+                b43_phy_write(dev, B43_NPHY_AFECTL_C2, regs[1]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER, regs[2]);
+        }
+        b43_phy_write(dev, B43_NPHY_RFCTL_INTC1, regs[3]);
+        b43_phy_write(dev, B43_NPHY_RFCTL_INTC2, regs[4]);
+        b43_phy_write(dev, B43_NPHY_RFCTL_RSSIO1, regs[5]);
+        b43_phy_write(dev, B43_NPHY_RFCTL_RSSIO2, regs[6]);
+        b43_phy_write(dev, B43_NPHY_TXF_40CO_B1S1, regs[7]);
+        b43_phy_write(dev, B43_NPHY_RFCTL_OVER, regs[8]);
+        b43_phy_write(dev, B43_NPHY_PAPD_EN0, regs[9]);
+        b43_phy_write(dev, B43_NPHY_PAPD_EN1, regs[10]);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RxCalPhySetup */
+static void b43_nphy_rx_cal_phy_setup(struct b43_wldev *dev, u8 core)
+{
+        u8 rxval, txval;
+        u16 *regs = dev->phy.n->tx_rx_cal_phy_saveregs;
+
+        regs[0] = b43_phy_read(dev, B43_NPHY_RFSEQCA);
+        if (core == 0) {
+                regs[1] = b43_phy_read(dev, B43_NPHY_AFECTL_C1);
+                regs[2] = b43_phy_read(dev, B43_NPHY_AFECTL_OVER1);
+        } else {
+                regs[1] = b43_phy_read(dev, B43_NPHY_AFECTL_C2);
+                regs[2] = b43_phy_read(dev, B43_NPHY_AFECTL_OVER);
+        }
+        regs[3] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC1);
+        regs[4] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC2);
+        regs[5] = b43_phy_read(dev, B43_NPHY_RFCTL_RSSIO1);
+        regs[6] = b43_phy_read(dev, B43_NPHY_RFCTL_RSSIO2);
+        regs[7] = b43_phy_read(dev, B43_NPHY_TXF_40CO_B1S1);
+        regs[8] = b43_phy_read(dev, B43_NPHY_RFCTL_OVER);
+        regs[9] = b43_phy_read(dev, B43_NPHY_PAPD_EN0);
+        regs[10] = b43_phy_read(dev, B43_NPHY_PAPD_EN1);
+
+        b43_phy_mask(dev, B43_NPHY_PAPD_EN0, ~0x0001);
+        b43_phy_mask(dev, B43_NPHY_PAPD_EN1, ~0x0001);
+
+        b43_phy_maskset(dev, B43_NPHY_RFSEQCA, (u16)~B43_NPHY_RFSEQCA_RXDIS,
+                        ((1 - core) << B43_NPHY_RFSEQCA_RXDIS_SHIFT));
+        b43_phy_maskset(dev, B43_NPHY_RFSEQCA, ~B43_NPHY_RFSEQCA_TXEN,
+                        ((1 - core) << B43_NPHY_RFSEQCA_TXEN_SHIFT));
+        b43_phy_maskset(dev, B43_NPHY_RFSEQCA, ~B43_NPHY_RFSEQCA_RXEN,
+                        (core << B43_NPHY_RFSEQCA_RXEN_SHIFT));
+        b43_phy_maskset(dev, B43_NPHY_RFSEQCA, ~B43_NPHY_RFSEQCA_TXDIS,
+                        (core << B43_NPHY_RFSEQCA_TXDIS_SHIFT));
+
+        if (core == 0) {
+                b43_phy_mask(dev, B43_NPHY_AFECTL_C1, ~0x0007);
+                b43_phy_set(dev, B43_NPHY_AFECTL_OVER1, 0x0007);
+        } else {
+                b43_phy_mask(dev, B43_NPHY_AFECTL_C2, ~0x0007);
+                b43_phy_set(dev, B43_NPHY_AFECTL_OVER, 0x0007);
+        }
+
+        b43_nphy_rf_control_intc_override(dev, 2, 0, 3);
+        b43_nphy_rf_control_override(dev, 8, 0, 3, false);
+        b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RX2TX);
+
+        if (core == 0) {
+                rxval = 1;
+                txval = 8;
+        } else {
+                rxval = 4;
+                txval = 2;
+        }
+        b43_nphy_rf_control_intc_override(dev, 1, rxval, (core + 1));
+        b43_nphy_rf_control_intc_override(dev, 1, txval, (2 - core));
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/CalcRxIqComp */
+static void b43_nphy_calc_rx_iq_comp(struct b43_wldev *dev, u8 mask)
+{
+        int i;
+        s32 iq;
+        u32 ii;
+        u32 qq;
+        int iq_nbits, qq_nbits;
+        int arsh, brsh;
+        u16 tmp, a, b;
+
+        struct nphy_iq_est est;
+        struct b43_phy_n_iq_comp old;
+        struct b43_phy_n_iq_comp new = { };
+        bool error = false;
+
+        if (mask == 0)
+                return;
+
+        b43_nphy_rx_iq_coeffs(dev, false, &old);
+        b43_nphy_rx_iq_coeffs(dev, true, &new);
+        b43_nphy_rx_iq_est(dev, &est, 0x4000, 32, false);
+        new = old;
+
+        for (i = 0; i < 2; i++) {
+                if (i == 0 && (mask & 1)) {
+                        iq = est.iq0_prod;
+                        ii = est.i0_pwr;
+                        qq = est.q0_pwr;
+                } else if (i == 1 && (mask & 2)) {
+                        iq = est.iq1_prod;
+                        ii = est.i1_pwr;
+                        qq = est.q1_pwr;
+                } else {
+                        B43_WARN_ON(1);
+                        continue;
+                }
+
+                if (ii + qq < 2) {
+                        error = true;
+                        break;
+                }
+
+                iq_nbits = fls(abs(iq));
+                qq_nbits = fls(qq);
+
+                arsh = iq_nbits - 20;
+                if (arsh >= 0) {
+                        a = -((iq << (30 - iq_nbits)) + (ii >> (1 + arsh)));
+                        tmp = ii >> arsh;
+                } else {
+                        a = -((iq << (30 - iq_nbits)) + (ii << (-1 - arsh)));
+                        tmp = ii << -arsh;
+                }
+                if (tmp == 0) {
+                        error = true;
+                        break;
+                }
+                a /= tmp;
+
+                brsh = qq_nbits - 11;
+                if (brsh >= 0) {
+                        b = (qq << (31 - qq_nbits));
+                        tmp = ii >> brsh;
+                } else {
+                        b = (qq << (31 - qq_nbits));
+                        tmp = ii << -brsh;
+                }
+                if (tmp == 0) {
+                        error = true;
+                        break;
+                }
+                b = int_sqrt(b / tmp - a * a) - (1 << 10);
+
+                if (i == 0 && (mask & 0x1)) {
+                        if (dev->phy.rev >= 3) {
+                                new.a0 = a & 0x3FF;
+                                new.b0 = b & 0x3FF;
+                        } else {
+                                new.a0 = b & 0x3FF;
+                                new.b0 = a & 0x3FF;
+                        }
+                } else if (i == 1 && (mask & 0x2)) {
+                        if (dev->phy.rev >= 3) {
+                                new.a1 = a & 0x3FF;
+                                new.b1 = b & 0x3FF;
+                        } else {
+                                new.a1 = b & 0x3FF;
+                                new.b1 = a & 0x3FF;
+                        }
+                }
+        }
+
+        if (error)
+                new = old;
+
+        b43_nphy_rx_iq_coeffs(dev, true, &new);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/TxIqWar */
+static void b43_nphy_tx_iq_workaround(struct b43_wldev *dev)
+{
+        u16 array[4];
+        int i;
+
+        b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x3C50);
+        for (i = 0; i < 4; i++)
+                array[i] = b43_phy_read(dev, B43_NPHY_TABLE_DATALO);
+
+        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_NPHY_TXIQW0, array[0]);
+        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_NPHY_TXIQW1, array[1]);
+        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_NPHY_TXIQW2, array[2]);
+        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_NPHY_TXIQW3, array[3]);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/clip-detection */
+static void b43_nphy_write_clip_detection(struct b43_wldev *dev, u16 *clip_st)
+{
+        b43_phy_write(dev, B43_NPHY_C1_CLIP1THRES, clip_st[0]);
+        b43_phy_write(dev, B43_NPHY_C2_CLIP1THRES, clip_st[1]);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/clip-detection */
+static void b43_nphy_read_clip_detection(struct b43_wldev *dev, u16 *clip_st)
+{
+        clip_st[0] = b43_phy_read(dev, B43_NPHY_C1_CLIP1THRES);
+        clip_st[1] = b43_phy_read(dev, B43_NPHY_C2_CLIP1THRES);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/classifier */
+static u16 b43_nphy_classifier(struct b43_wldev *dev, u16 mask, u16 val)
+{
+        u16 tmp;
+
+        if (dev->dev->id.revision == 16)
+                b43_mac_suspend(dev);
+
+        tmp = b43_phy_read(dev, B43_NPHY_CLASSCTL);
+        tmp &= (B43_NPHY_CLASSCTL_CCKEN | B43_NPHY_CLASSCTL_OFDMEN |
+                B43_NPHY_CLASSCTL_WAITEDEN);
+        tmp &= ~mask;
+        tmp |= (val & mask);
+        b43_phy_maskset(dev, B43_NPHY_CLASSCTL, 0xFFF8, tmp);
+
+        if (dev->dev->id.revision == 16)
+                b43_mac_enable(dev);
+
+        return tmp;
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/carriersearch */
+static void b43_nphy_stay_in_carrier_search(struct b43_wldev *dev, bool enable)
 {
         struct b43_phy *phy = &dev->phy;
-        unsigned int i;
+        struct b43_phy_n *nphy = phy->n;
 
-        b43_phy_set(dev, B43_NPHY_IQFLIP,
-                    B43_NPHY_IQFLIP_ADC1 | B43_NPHY_IQFLIP_ADC2);
-        if (1 /* FIXME band is 2.4GHz */) {
-                b43_phy_set(dev, B43_NPHY_CLASSCTL,
-                            B43_NPHY_CLASSCTL_CCKEN);
-        } else {
-                b43_phy_mask(dev, B43_NPHY_CLASSCTL,
-                             ~B43_NPHY_CLASSCTL_CCKEN);
-        }
-        b43_radio_set(dev, B2055_C1_TX_RF_SPARE, 0x8);
-        b43_phy_write(dev, B43_NPHY_TXFRAMEDELAY, 8);
-
-        /* Fixup some tables */
-        b43_ntab_write(dev, B43_NTAB16(8, 0x00), 0xA);
-        b43_ntab_write(dev, B43_NTAB16(8, 0x10), 0xA);
-        b43_ntab_write(dev, B43_NTAB16(8, 0x02), 0xCDAA);
-        b43_ntab_write(dev, B43_NTAB16(8, 0x12), 0xCDAA);
-        b43_ntab_write(dev, B43_NTAB16(8, 0x08), 0);
-        b43_ntab_write(dev, B43_NTAB16(8, 0x18), 0);
-        b43_ntab_write(dev, B43_NTAB16(8, 0x07), 0x7AAB);
-        b43_ntab_write(dev, B43_NTAB16(8, 0x17), 0x7AAB);
-        b43_ntab_write(dev, B43_NTAB16(8, 0x06), 0x800);
-        b43_ntab_write(dev, B43_NTAB16(8, 0x16), 0x800);
-
-        b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_LO1, 0x2D8);
-        b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_UP1, 0x301);
-        b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_LO2, 0x2D8);
-        b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_UP2, 0x301);
-
-        //TODO set RF sequence
-
-        /* Set narrowband clip threshold */
-        b43_phy_write(dev, B43_NPHY_C1_NBCLIPTHRES, 66);
-        b43_phy_write(dev, B43_NPHY_C2_NBCLIPTHRES, 66);
-
-        /* Set wideband clip 2 threshold */
-        b43_phy_maskset(dev, B43_NPHY_C1_CLIPWBTHRES,
-                        ~B43_NPHY_C1_CLIPWBTHRES_CLIP2,
-                        21 << B43_NPHY_C1_CLIPWBTHRES_CLIP2_SHIFT);
-        b43_phy_maskset(dev, B43_NPHY_C2_CLIPWBTHRES,
-                        ~B43_NPHY_C2_CLIPWBTHRES_CLIP2,
-                        21 << B43_NPHY_C2_CLIPWBTHRES_CLIP2_SHIFT);
-
-        /* Set Clip 2 detect */
-        b43_phy_set(dev, B43_NPHY_C1_CGAINI,
-                    B43_NPHY_C1_CGAINI_CL2DETECT);
-        b43_phy_set(dev, B43_NPHY_C2_CGAINI,
-                    B43_NPHY_C2_CGAINI_CL2DETECT);
-
-        if (0 /*FIXME*/) {
-                /* Set dwell lengths */
-                b43_phy_write(dev, B43_NPHY_CLIP1_NBDWELL_LEN, 43);
-                b43_phy_write(dev, B43_NPHY_CLIP2_NBDWELL_LEN, 43);
-                b43_phy_write(dev, B43_NPHY_W1CLIP1_DWELL_LEN, 9);
-                b43_phy_write(dev, B43_NPHY_W1CLIP2_DWELL_LEN, 9);
-
-                /* Set gain backoff */
-                b43_phy_maskset(dev, B43_NPHY_C1_CGAINI,
-                                ~B43_NPHY_C1_CGAINI_GAINBKOFF,
-                                1 << B43_NPHY_C1_CGAINI_GAINBKOFF_SHIFT);
-                b43_phy_maskset(dev, B43_NPHY_C2_CGAINI,
-                                ~B43_NPHY_C2_CGAINI_GAINBKOFF,
-                                1 << B43_NPHY_C2_CGAINI_GAINBKOFF_SHIFT);
+        if (enable) {
+                u16 clip[] = { 0xFFFF, 0xFFFF };
+                if (nphy->deaf_count++ == 0) {
+                        nphy->classifier_state = b43_nphy_classifier(dev, 0, 0);
+                        b43_nphy_classifier(dev, 0x7, 0);
+                        b43_nphy_read_clip_detection(dev, nphy->clip_state);
+                        b43_nphy_write_clip_detection(dev, clip);
+                }
+                b43_nphy_reset_cca(dev);
+        } else {
+                if (--nphy->deaf_count == 0) {
+                        b43_nphy_classifier(dev, 0x7, nphy->classifier_state);
+                        b43_nphy_write_clip_detection(dev, nphy->clip_state);
+                }
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/stop-playback */
+static void b43_nphy_stop_playback(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        u16 tmp;
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 1);
+
+        tmp = b43_phy_read(dev, B43_NPHY_SAMP_STAT);
+        if (tmp & 0x1)
+                b43_phy_set(dev, B43_NPHY_SAMP_CMD, B43_NPHY_SAMP_CMD_STOP);
+        else if (tmp & 0x2)
+                b43_phy_mask(dev, B43_NPHY_IQLOCAL_CMDGCTL, (u16)~0x8000);
+
+        b43_phy_mask(dev, B43_NPHY_SAMP_CMD, ~0x0004);
+
+        if (nphy->bb_mult_save & 0x80000000) {
+                tmp = nphy->bb_mult_save & 0xFFFF;
+                b43_ntab_write(dev, B43_NTAB16(15, 87), tmp);
+                nphy->bb_mult_save = 0;
+        }
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 0);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/SpurWar */
+static void b43_nphy_spur_workaround(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        unsigned int channel;
+        int tone[2] = { 57, 58 };
+        u32 noise[2] = { 0x3FF, 0x3FF };
+
+        B43_WARN_ON(dev->phy.rev < 3);
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 1);
+
+        /* FIXME: channel = radio_chanspec */
+
+        if (nphy->gband_spurwar_en) {
+                /* TODO: N PHY Adjust Analog Pfbw (7) */
+                if (channel == 11 && dev->phy.is_40mhz)
+                        ; /* TODO: N PHY Adjust Min Noise Var(2, tone, noise)*/
+                else
+                        ; /* TODO: N PHY Adjust Min Noise Var(0, NULL, NULL)*/
+                /* TODO: N PHY Adjust CRS Min Power (0x1E) */
+        }
+
+        if (nphy->aband_spurwar_en) {
+                if (channel == 54) {
+                        tone[0] = 0x20;
+                        noise[0] = 0x25F;
+                } else if (channel == 38 || channel == 102 || channel == 118) {
+                        if (0 /* FIXME */) {
+                                tone[0] = 0x20;
+                                noise[0] = 0x21F;
+                        } else {
+                                tone[0] = 0;
+                                noise[0] = 0;
+                        }
+                } else if (channel == 134) {
+                        tone[0] = 0x20;
+                        noise[0] = 0x21F;
+                } else if (channel == 151) {
+                        tone[0] = 0x10;
+                        noise[0] = 0x23F;
+                } else if (channel == 153 || channel == 161) {
+                        tone[0] = 0x30;
+                        noise[0] = 0x23F;
+                } else {
+                        tone[0] = 0;
+                        noise[0] = 0;
+                }
+
+                if (!tone[0] && !noise[0])
+                        ; /* TODO: N PHY Adjust Min Noise Var(1, tone, noise)*/
+                else
+                        ; /* TODO: N PHY Adjust Min Noise Var(0, NULL, NULL)*/
+        }
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 0);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/WorkaroundsGainCtrl */
+static void b43_nphy_gain_crtl_workarounds(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        u8 i, j;
+        u8 code;
+
+        /* TODO: for PHY >= 3
+        s8 *lna1_gain, *lna2_gain;
+        u8 *gain_db, *gain_bits;
+        u16 *rfseq_init;
+        u8 lpf_gain[6] = { 0x00, 0x06, 0x0C, 0x12, 0x12, 0x12 };
+        u8 lpf_bits[6] = { 0, 1, 2, 3, 3, 3 };
+        */
+
+        u8 rfseq_events[3] = { 6, 8, 7 };
+        u8 rfseq_delays[3] = { 10, 30, 1 };
+
+        if (dev->phy.rev >= 3) {
+                /* TODO */
+        } else {
+                /* Set Clip 2 detect */
+                b43_phy_set(dev, B43_NPHY_C1_CGAINI,
+                                B43_NPHY_C1_CGAINI_CL2DETECT);
+                b43_phy_set(dev, B43_NPHY_C2_CGAINI,
+                                B43_NPHY_C2_CGAINI_CL2DETECT);
+
+                /* Set narrowband clip threshold */
+                b43_phy_set(dev, B43_NPHY_C1_NBCLIPTHRES, 0x84);
+                b43_phy_set(dev, B43_NPHY_C2_NBCLIPTHRES, 0x84);
+
+                if (!dev->phy.is_40mhz) {
+                        /* Set dwell lengths */
+                        b43_phy_set(dev, B43_NPHY_CLIP1_NBDWELL_LEN, 0x002B);
+                        b43_phy_set(dev, B43_NPHY_CLIP2_NBDWELL_LEN, 0x002B);
+                        b43_phy_set(dev, B43_NPHY_W1CLIP1_DWELL_LEN, 0x0009);
+                        b43_phy_set(dev, B43_NPHY_W1CLIP2_DWELL_LEN, 0x0009);
+                }
+
+                /* Set wideband clip 2 threshold */
+                b43_phy_maskset(dev, B43_NPHY_C1_CLIPWBTHRES,
+                                ~B43_NPHY_C1_CLIPWBTHRES_CLIP2,
+                                21);
+                b43_phy_maskset(dev, B43_NPHY_C2_CLIPWBTHRES,
+                                ~B43_NPHY_C2_CLIPWBTHRES_CLIP2,
+                                21);
+
+                if (!dev->phy.is_40mhz) {
+                        b43_phy_maskset(dev, B43_NPHY_C1_CGAINI,
+                                ~B43_NPHY_C1_CGAINI_GAINBKOFF, 0x1);
+                        b43_phy_maskset(dev, B43_NPHY_C2_CGAINI,
+                                ~B43_NPHY_C2_CGAINI_GAINBKOFF, 0x1);
+                        b43_phy_maskset(dev, B43_NPHY_C1_CCK_CGAINI,
+                                ~B43_NPHY_C1_CCK_CGAINI_GAINBKOFF, 0x1);
+                        b43_phy_maskset(dev, B43_NPHY_C2_CCK_CGAINI,
+                                ~B43_NPHY_C2_CCK_CGAINI_GAINBKOFF, 0x1);
+                }
+
+                b43_phy_set(dev, B43_NPHY_CCK_SHIFTB_REF, 0x809C);
+
+                if (nphy->gain_boost) {
+                        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ &&
+                            dev->phy.is_40mhz)
+                                code = 4;
+                        else
+                                code = 5;
+                } else {
+                        code = dev->phy.is_40mhz ? 6 : 7;
+                }
 
                 /* Set HPVGA2 index */
                 b43_phy_maskset(dev, B43_NPHY_C1_INITGAIN,
                                 ~B43_NPHY_C1_INITGAIN_HPVGA2,
-                                6 << B43_NPHY_C1_INITGAIN_HPVGA2_SHIFT);
+                                code << B43_NPHY_C1_INITGAIN_HPVGA2_SHIFT);
                 b43_phy_maskset(dev, B43_NPHY_C2_INITGAIN,
                                 ~B43_NPHY_C2_INITGAIN_HPVGA2,
-                                6 << B43_NPHY_C2_INITGAIN_HPVGA2_SHIFT);
+                                code << B43_NPHY_C2_INITGAIN_HPVGA2_SHIFT);
+
+                b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x1D06);
+                b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
+                                        (code << 8 | 0x7C));
+                b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
+                                        (code << 8 | 0x7C));
+
+                /* TODO: b43_nphy_adjust_lna_gain_table(dev); */
+
+                if (nphy->elna_gain_config) {
+                        b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x0808);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x0);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x1);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x1);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x1);
+
+                        b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x0C08);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x0);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x1);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x1);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x1);
+
+                        b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x1D06);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
+                                        (code << 8 | 0x74));
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
+                                        (code << 8 | 0x74));
+                }
 
-                //FIXME verify that the specs really mean to use autoinc here.
-                for (i = 0; i < 3; i++)
-                        b43_ntab_write(dev, B43_NTAB16(7, 0x106) + i, 0x673);
+                if (dev->phy.rev == 2) {
+                        for (i = 0; i < 4; i++) {
+                                b43_phy_write(dev, B43_NPHY_TABLE_ADDR,
+                                                (0x0400 * i) + 0x0020);
+                                for (j = 0; j < 21; j++)
+                                        b43_phy_write(dev,
+                                                B43_NPHY_TABLE_DATALO, 3 * j);
+                        }
+
+                        b43_nphy_set_rf_sequence(dev, 5,
+                                        rfseq_events, rfseq_delays, 3);
+                        b43_phy_maskset(dev, B43_NPHY_OVER_DGAIN1,
+                                (u16)~B43_NPHY_OVER_DGAIN_CCKDGECV,
+                                0x5A << B43_NPHY_OVER_DGAIN_CCKDGECV_SHIFT);
+
+                        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                                b43_phy_maskset(dev, B43_PHY_N(0xC5D),
+                                                0xFF80, 4);
+                }
         }
+}
 
-        /* Set minimum gain value */
-        b43_phy_maskset(dev, B43_NPHY_C1_MINMAX_GAIN,
-                        ~B43_NPHY_C1_MINGAIN,
-                        23 << B43_NPHY_C1_MINGAIN_SHIFT);
-        b43_phy_maskset(dev, B43_NPHY_C2_MINMAX_GAIN,
-                        ~B43_NPHY_C2_MINGAIN,
-                        23 << B43_NPHY_C2_MINGAIN_SHIFT);
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/Workarounds */
+static void b43_nphy_workarounds(struct b43_wldev *dev)
+{
+        struct ssb_bus *bus = dev->dev->bus;
+        struct b43_phy *phy = &dev->phy;
+        struct b43_phy_n *nphy = phy->n;
 
-        if (phy->rev < 2) {
-                b43_phy_mask(dev, B43_NPHY_SCRAM_SIGCTL,
-                             ~B43_NPHY_SCRAM_SIGCTL_SCM);
+        u8 events1[7] = { 0x0, 0x1, 0x2, 0x8, 0x4, 0x5, 0x3 };
+        u8 delays1[7] = { 0x8, 0x6, 0x6, 0x2, 0x4, 0x3C, 0x1 };
+
+        u8 events2[7] = { 0x0, 0x3, 0x5, 0x4, 0x2, 0x1, 0x8 };
+        u8 delays2[7] = { 0x8, 0x6, 0x2, 0x4, 0x4, 0x6, 0x1 };
+
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                b43_nphy_classifier(dev, 1, 0);
+        else
+                b43_nphy_classifier(dev, 1, 1);
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 1);
+
+        b43_phy_set(dev, B43_NPHY_IQFLIP,
+                    B43_NPHY_IQFLIP_ADC1 | B43_NPHY_IQFLIP_ADC2);
+
+        if (dev->phy.rev >= 3) {
+                /* TODO */
+        } else {
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ &&
+                    nphy->band5g_pwrgain) {
+                        b43_radio_mask(dev, B2055_C1_TX_RF_SPARE, ~0x8);
+                        b43_radio_mask(dev, B2055_C2_TX_RF_SPARE, ~0x8);
+                } else {
+                        b43_radio_set(dev, B2055_C1_TX_RF_SPARE, 0x8);
+                        b43_radio_set(dev, B2055_C2_TX_RF_SPARE, 0x8);
+                }
+
+                /* TODO: convert to b43_ntab_write? */
+                b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x2000);
+                b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x000A);
+                b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x2010);
+                b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x000A);
+                b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x2002);
+                b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0xCDAA);
+                b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x2012);
+                b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0xCDAA);
+
+                if (dev->phy.rev < 2) {
+                        b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x2008);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x0000);
+                        b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x2018);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x0000);
+                        b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x2007);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x7AAB);
+                        b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x2017);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x7AAB);
+                        b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x2006);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x0800);
+                        b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x2016);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x0800);
+                }
+
+                b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_LO1, 0x2D8);
+                b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_UP1, 0x301);
+                b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_LO2, 0x2D8);
+                b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_UP2, 0x301);
+
+                if (bus->sprom.boardflags2_lo & 0x100 &&
+                    bus->boardinfo.type == 0x8B) {
+                        delays1[0] = 0x1;
+                        delays1[5] = 0x14;
+                }
+                b43_nphy_set_rf_sequence(dev, 0, events1, delays1, 7);
+                b43_nphy_set_rf_sequence(dev, 1, events2, delays2, 7);
+
+                b43_nphy_gain_crtl_workarounds(dev);
+
+                if (dev->phy.rev < 2) {
+                        if (b43_phy_read(dev, B43_NPHY_RXCTL) & 0x2)
+                                ; /*TODO: b43_mhf(dev, 2, 0x0010, 0x0010, 3);*/
+                } else if (dev->phy.rev == 2) {
+                        b43_phy_write(dev, B43_NPHY_CRSCHECK2, 0);
+                        b43_phy_write(dev, B43_NPHY_CRSCHECK3, 0);
+                }
+
+                if (dev->phy.rev < 2)
+                        b43_phy_mask(dev, B43_NPHY_SCRAM_SIGCTL,
+                                        ~B43_NPHY_SCRAM_SIGCTL_SCM);
+
+                /* Set phase track alpha and beta */
+                b43_phy_write(dev, B43_NPHY_PHASETR_A0, 0x125);
+                b43_phy_write(dev, B43_NPHY_PHASETR_A1, 0x1B3);
+                b43_phy_write(dev, B43_NPHY_PHASETR_A2, 0x105);
+                b43_phy_write(dev, B43_NPHY_PHASETR_B0, 0x16E);
+                b43_phy_write(dev, B43_NPHY_PHASETR_B1, 0xCD);
+                b43_phy_write(dev, B43_NPHY_PHASETR_B2, 0x20);
+
+                b43_phy_mask(dev, B43_NPHY_PIL_DW1,
+                                (u16)~B43_NPHY_PIL_DW_64QAM);
+                b43_phy_write(dev, B43_NPHY_TXF_20CO_S2B1, 0xB5);
+                b43_phy_write(dev, B43_NPHY_TXF_20CO_S2B2, 0xA4);
+                b43_phy_write(dev, B43_NPHY_TXF_20CO_S2B3, 0x00);
+
+                if (dev->phy.rev == 2)
+                        b43_phy_set(dev, B43_NPHY_FINERX2_CGC,
+                                        B43_NPHY_FINERX2_CGC_DECGC);
         }
 
-        /* Set phase track alpha and beta */
-        b43_phy_write(dev, B43_NPHY_PHASETR_A0, 0x125);
-        b43_phy_write(dev, B43_NPHY_PHASETR_A1, 0x1B3);
-        b43_phy_write(dev, B43_NPHY_PHASETR_A2, 0x105);
-        b43_phy_write(dev, B43_NPHY_PHASETR_B0, 0x16E);
-        b43_phy_write(dev, B43_NPHY_PHASETR_B1, 0xCD);
-        b43_phy_write(dev, B43_NPHY_PHASETR_B2, 0x20);
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 0);
 }
 
-static void b43_nphy_reset_cca(struct b43_wldev *dev)
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/LoadSampleTable */
+static int b43_nphy_load_samples(struct b43_wldev *dev,
+                                        struct b43_c32 *samples, u16 len) {
+        struct b43_phy_n *nphy = dev->phy.n;
+        u16 i;
+        u32 *data;
+
+        data = kzalloc(len * sizeof(u32), GFP_KERNEL);
+        if (!data) {
+                b43err(dev->wl, "allocation for samples loading failed\n");
+                return -ENOMEM;
+        }
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 1);
+
+        for (i = 0; i < len; i++) {
+                data[i] = (samples[i].i & 0x3FF << 10);
+                data[i] |= samples[i].q & 0x3FF;
+        }
+        b43_ntab_write_bulk(dev, B43_NTAB32(17, 0), len, data);
+
+        kfree(data);
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 0);
+        return 0;
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/GenLoadSamples */
+static u16 b43_nphy_gen_load_samples(struct b43_wldev *dev, u32 freq, u16 max,
+                                        bool test)
 {
-        u16 bbcfg;
+        int i;
+        u16 bw, len, rot, angle;
+        struct b43_c32 *samples;
 
-        ssb_write32(dev->dev, SSB_TMSLOW,
-                    ssb_read32(dev->dev, SSB_TMSLOW) | SSB_TMSLOW_FGC);
-        bbcfg = b43_phy_read(dev, B43_NPHY_BBCFG);
-        b43_phy_set(dev, B43_NPHY_BBCFG, B43_NPHY_BBCFG_RSTCCA);
-        b43_phy_write(dev, B43_NPHY_BBCFG,
-                      bbcfg & ~B43_NPHY_BBCFG_RSTCCA);
-        ssb_write32(dev->dev, SSB_TMSLOW,
-                    ssb_read32(dev->dev, SSB_TMSLOW) & ~SSB_TMSLOW_FGC);
+
+        bw = (dev->phy.is_40mhz) ? 40 : 20;
+        len = bw << 3;
+
+        if (test) {
+                if (b43_phy_read(dev, B43_NPHY_BBCFG) & B43_NPHY_BBCFG_RSTRX)
+                        bw = 82;
+                else
+                        bw = 80;
+
+                if (dev->phy.is_40mhz)
+                        bw <<= 1;
+
+                len = bw << 1;
+        }
+
+        samples = kzalloc(len * sizeof(struct b43_c32), GFP_KERNEL);
+        if (!samples) {
+                b43err(dev->wl, "allocation for samples generation failed\n");
+                return 0;
+        }
+        rot = (((freq * 36) / bw) << 16) / 100;
+        angle = 0;
+
+        for (i = 0; i < len; i++) {
+                samples[i] = b43_cordic(angle);
+                angle += rot;
+                samples[i].q = CORDIC_CONVERT(samples[i].q * max);
+                samples[i].i = CORDIC_CONVERT(samples[i].i * max);
+        }
+
+        i = b43_nphy_load_samples(dev, samples, len);
+        kfree(samples);
+        return (i < 0) ? 0 : len;
 }
 
-enum b43_nphy_rf_sequence {
-        B43_RFSEQ_RX2TX,
-        B43_RFSEQ_TX2RX,
-        B43_RFSEQ_RESET2RX,
-        B43_RFSEQ_UPDATE_GAINH,
-        B43_RFSEQ_UPDATE_GAINL,
-        B43_RFSEQ_UPDATE_GAINU,
-};
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RunSamples */
+static void b43_nphy_run_samples(struct b43_wldev *dev, u16 samps, u16 loops,
+                                        u16 wait, bool iqmode, bool dac_test)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        int i;
+        u16 seq_mode;
+        u32 tmp;
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, true);
+
+        if ((nphy->bb_mult_save & 0x80000000) == 0) {
+                tmp = b43_ntab_read(dev, B43_NTAB16(15, 87));
+                nphy->bb_mult_save = (tmp & 0xFFFF) | 0x80000000;
+        }
+
+        if (!dev->phy.is_40mhz)
+                tmp = 0x6464;
+        else
+                tmp = 0x4747;
+        b43_ntab_write(dev, B43_NTAB16(15, 87), tmp);
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, false);
+
+        b43_phy_write(dev, B43_NPHY_SAMP_DEPCNT, (samps - 1));
+
+        if (loops != 0xFFFF)
+                b43_phy_write(dev, B43_NPHY_SAMP_LOOPCNT, (loops - 1));
+        else
+                b43_phy_write(dev, B43_NPHY_SAMP_LOOPCNT, loops);
+
+        b43_phy_write(dev, B43_NPHY_SAMP_WAITCNT, wait);
+
+        seq_mode = b43_phy_read(dev, B43_NPHY_RFSEQMODE);
+
+        b43_phy_set(dev, B43_NPHY_RFSEQMODE, B43_NPHY_RFSEQMODE_CAOVER);
+        if (iqmode) {
+                b43_phy_mask(dev, B43_NPHY_IQLOCAL_CMDGCTL, 0x7FFF);
+                b43_phy_set(dev, B43_NPHY_IQLOCAL_CMDGCTL, 0x8000);
+        } else {
+                if (dac_test)
+                        b43_phy_write(dev, B43_NPHY_SAMP_CMD, 5);
+                else
+                        b43_phy_write(dev, B43_NPHY_SAMP_CMD, 1);
+        }
+        for (i = 0; i < 100; i++) {
+                if (b43_phy_read(dev, B43_NPHY_RFSEQST) & 1) {
+                        i = 0;
+                        break;
+                }
+                udelay(10);
+        }
+        if (i)
+                b43err(dev->wl, "run samples timeout\n");
+
+        b43_phy_write(dev, B43_NPHY_RFSEQMODE, seq_mode);
+}
+
+/*
+ * Transmits a known value for LO calibration
+ * http://bcm-v4.sipsolutions.net/802.11/PHY/N/TXTone
+ */
+static int b43_nphy_tx_tone(struct b43_wldev *dev, u32 freq, u16 max_val,
+                                bool iqmode, bool dac_test)
+{
+        u16 samp = b43_nphy_gen_load_samples(dev, freq, max_val, dac_test);
+        if (samp == 0)
+                return -1;
+        b43_nphy_run_samples(dev, samp, 0xFFFF, 0, iqmode, dac_test);
+        return 0;
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/TxPwrCtrlCoefSetup */
+static void b43_nphy_tx_pwr_ctrl_coef_setup(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        int i, j;
+        u32 tmp;
+        u32 cur_real, cur_imag, real_part, imag_part;
+
+        u16 buffer[7];
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, true);
+
+        b43_ntab_read_bulk(dev, B43_NTAB16(15, 80), 7, buffer);
+
+        for (i = 0; i < 2; i++) {
+                tmp = ((buffer[i * 2] & 0x3FF) << 10) |
+                        (buffer[i * 2 + 1] & 0x3FF);
+                b43_phy_write(dev, B43_NPHY_TABLE_ADDR,
+                                (((i + 26) << 10) | 320));
+                for (j = 0; j < 128; j++) {
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATAHI,
+                                        ((tmp >> 16) & 0xFFFF));
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
+                                        (tmp & 0xFFFF));
+                }
+        }
+
+        for (i = 0; i < 2; i++) {
+                tmp = buffer[5 + i];
+                real_part = (tmp >> 8) & 0xFF;
+                imag_part = (tmp & 0xFF);
+                b43_phy_write(dev, B43_NPHY_TABLE_ADDR,
+                                (((i + 26) << 10) | 448));
+
+                if (dev->phy.rev >= 3) {
+                        cur_real = real_part;
+                        cur_imag = imag_part;
+                        tmp = ((cur_real & 0xFF) << 8) | (cur_imag & 0xFF);
+                }
+
+                for (j = 0; j < 128; j++) {
+                        if (dev->phy.rev < 3) {
+                                cur_real = (real_part * loscale[j] + 128) >> 8;
+                                cur_imag = (imag_part * loscale[j] + 128) >> 8;
+                                tmp = ((cur_real & 0xFF) << 8) |
+                                        (cur_imag & 0xFF);
+                        }
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATAHI,
+                                        ((tmp >> 16) & 0xFFFF));
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
+                                        (tmp & 0xFFFF));
+                }
+        }
+
+        if (dev->phy.rev >= 3) {
+                b43_shm_write16(dev, B43_SHM_SHARED,
+                                B43_SHM_SH_NPHY_TXPWR_INDX0, 0xFFFF);
+                b43_shm_write16(dev, B43_SHM_SHARED,
+                                B43_SHM_SH_NPHY_TXPWR_INDX1, 0xFFFF);
+        }
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, false);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/SetRfSeq */
+static void b43_nphy_set_rf_sequence(struct b43_wldev *dev, u8 cmd,
+                                        u8 *events, u8 *delays, u8 length)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        u8 i;
+        u8 end = (dev->phy.rev >= 3) ? 0x1F : 0x0F;
+        u16 offset1 = cmd << 4;
+        u16 offset2 = offset1 + 0x80;
 
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, true);
+
+        b43_ntab_write_bulk(dev, B43_NTAB8(7, offset1), length, events);
+        b43_ntab_write_bulk(dev, B43_NTAB8(7, offset2), length, delays);
+
+        for (i = length; i < 16; i++) {
+                b43_ntab_write(dev, B43_NTAB8(7, offset1 + i), end);
+                b43_ntab_write(dev, B43_NTAB8(7, offset2 + i), 1);
+        }
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, false);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/ForceRFSeq */
 static void b43_nphy_force_rf_sequence(struct b43_wldev *dev,
                                        enum b43_nphy_rf_sequence seq)
 {
@@ -376,6 +1267,7 @@ static void b43_nphy_force_rf_sequence(struct b43_wldev *dev,
                 [B43_RFSEQ_UPDATE_GAINU]        = B43_NPHY_RFSEQTR_UPGU,
         };
         int i;
+        u16 seq_mode = b43_phy_read(dev, B43_NPHY_RFSEQMODE);
 
         B43_WARN_ON(seq >= ARRAY_SIZE(trigger));
 
@@ -389,8 +1281,181 @@ static void b43_nphy_force_rf_sequence(struct b43_wldev *dev,
         }
         b43err(dev->wl, "RF sequence status timeout\n");
 ok:
-        b43_phy_mask(dev, B43_NPHY_RFSEQMODE,
-                     ~(B43_NPHY_RFSEQMODE_CAOVER | B43_NPHY_RFSEQMODE_TROVER));
+        b43_phy_write(dev, B43_NPHY_RFSEQMODE, seq_mode);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RFCtrlOverride */
+static void b43_nphy_rf_control_override(struct b43_wldev *dev, u16 field,
+                                                u16 value, u8 core, bool off)
+{
+        int i;
+        u8 index = fls(field);
+        u8 addr, en_addr, val_addr;
+        /* we expect only one bit set */
+        B43_WARN_ON(field & (~(1 << (index - 1))));
+
+        if (dev->phy.rev >= 3) {
+                const struct nphy_rf_control_override_rev3 *rf_ctrl;
+                for (i = 0; i < 2; i++) {
+                        if (index == 0 || index == 16) {
+                                b43err(dev->wl,
+                                        "Unsupported RF Ctrl Override call\n");
+                                return;
+                        }
+
+                        rf_ctrl = &tbl_rf_control_override_rev3[index - 1];
+                        en_addr = B43_PHY_N((i == 0) ?
+                                rf_ctrl->en_addr0 : rf_ctrl->en_addr1);
+                        val_addr = B43_PHY_N((i == 0) ?
+                                rf_ctrl->val_addr0 : rf_ctrl->val_addr1);
+
+                        if (off) {
+                                b43_phy_mask(dev, en_addr, ~(field));
+                                b43_phy_mask(dev, val_addr,
+                                                ~(rf_ctrl->val_mask));
+                        } else {
+                                if (core == 0 || ((1 << core) & i) != 0) {
+                                        b43_phy_set(dev, en_addr, field);
+                                        b43_phy_maskset(dev, val_addr,
+                                                ~(rf_ctrl->val_mask),
+                                                (value << rf_ctrl->val_shift));
+                                }
+                        }
+                }
+        } else {
+                const struct nphy_rf_control_override_rev2 *rf_ctrl;
+                if (off) {
+                        b43_phy_mask(dev, B43_NPHY_RFCTL_OVER, ~(field));
+                        value = 0;
+                } else {
+                        b43_phy_set(dev, B43_NPHY_RFCTL_OVER, field);
+                }
+
+                for (i = 0; i < 2; i++) {
+                        if (index <= 1 || index == 16) {
+                                b43err(dev->wl,
+                                        "Unsupported RF Ctrl Override call\n");
+                                return;
+                        }
+
+                        if (index == 2 || index == 10 ||
+                            (index >= 13 && index <= 15)) {
+                                core = 1;
+                        }
+
+                        rf_ctrl = &tbl_rf_control_override_rev2[index - 2];
+                        addr = B43_PHY_N((i == 0) ?
+                                rf_ctrl->addr0 : rf_ctrl->addr1);
+
+                        if ((core & (1 << i)) != 0)
+                                b43_phy_maskset(dev, addr, ~(rf_ctrl->bmask),
+                                                (value << rf_ctrl->shift));
+
+                        b43_phy_set(dev, B43_NPHY_RFCTL_OVER, 0x1);
+                        b43_phy_set(dev, B43_NPHY_RFCTL_CMD,
+                                        B43_NPHY_RFCTL_CMD_START);
+                        udelay(1);
+                        b43_phy_mask(dev, B43_NPHY_RFCTL_OVER, 0xFFFE);
+                }
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RFCtrlIntcOverride */
+static void b43_nphy_rf_control_intc_override(struct b43_wldev *dev, u8 field,
+                                                u16 value, u8 core)
+{
+        u8 i, j;
+        u16 reg, tmp, val;
+
+        B43_WARN_ON(dev->phy.rev < 3);
+        B43_WARN_ON(field > 4);
+
+        for (i = 0; i < 2; i++) {
+                if ((core == 1 && i == 1) || (core == 2 && !i))
+                        continue;
+
+                reg = (i == 0) ?
+                        B43_NPHY_RFCTL_INTC1 : B43_NPHY_RFCTL_INTC2;
+                b43_phy_mask(dev, reg, 0xFBFF);
+
+                switch (field) {
+                case 0:
+                        b43_phy_write(dev, reg, 0);
+                        b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RESET2RX);
+                        break;
+                case 1:
+                        if (!i) {
+                                b43_phy_maskset(dev, B43_NPHY_RFCTL_INTC1,
+                                                0xFC3F, (value << 6));
+                                b43_phy_maskset(dev, B43_NPHY_TXF_40CO_B1S1,
+                                                0xFFFE, 1);
+                                b43_phy_set(dev, B43_NPHY_RFCTL_CMD,
+                                                B43_NPHY_RFCTL_CMD_START);
+                                for (j = 0; j < 100; j++) {
+                                        if (b43_phy_read(dev, B43_NPHY_RFCTL_CMD) & B43_NPHY_RFCTL_CMD_START) {
+                                                j = 0;
+                                                break;
+                                        }
+                                        udelay(10);
+                                }
+                                if (j)
+                                        b43err(dev->wl,
+                                                "intc override timeout\n");
+                                b43_phy_mask(dev, B43_NPHY_TXF_40CO_B1S1,
+                                                0xFFFE);
+                        } else {
+                                b43_phy_maskset(dev, B43_NPHY_RFCTL_INTC2,
+                                                0xFC3F, (value << 6));
+                                b43_phy_maskset(dev, B43_NPHY_RFCTL_OVER,
+                                                0xFFFE, 1);
+                                b43_phy_set(dev, B43_NPHY_RFCTL_CMD,
+                                                B43_NPHY_RFCTL_CMD_RXTX);
+                                for (j = 0; j < 100; j++) {
+                                        if (b43_phy_read(dev, B43_NPHY_RFCTL_CMD) & B43_NPHY_RFCTL_CMD_RXTX) {
+                                                j = 0;
+                                                break;
+                                        }
+                                        udelay(10);
+                                }
+                                if (j)
+                                        b43err(dev->wl,
+                                                "intc override timeout\n");
+                                b43_phy_mask(dev, B43_NPHY_RFCTL_OVER,
+                                                0xFFFE);
+                        }
+                        break;
+                case 2:
+                        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                                tmp = 0x0020;
+                                val = value << 5;
+                        } else {
+                                tmp = 0x0010;
+                                val = value << 4;
+                        }
+                        b43_phy_maskset(dev, reg, ~tmp, val);
+                        break;
+                case 3:
+                        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                                tmp = 0x0001;
+                                val = value;
+                        } else {
+                                tmp = 0x0004;
+                                val = value << 2;
+                        }
+                        b43_phy_maskset(dev, reg, ~tmp, val);
+                        break;
+                case 4:
+                        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                                tmp = 0x0002;
+                                val = value << 1;
+                        } else {
+                                tmp = 0x0008;
+                                val = value << 3;
+                        }
+                        b43_phy_maskset(dev, reg, ~tmp, val);
+                        break;
+                }
+        }
 }
 
 static void b43_nphy_bphy_init(struct b43_wldev *dev)
@@ -411,81 +1476,1680 @@ static void b43_nphy_bphy_init(struct b43_wldev *dev)
         b43_phy_write(dev, B43_PHY_N_BMODE(0x38), 0x668);
 }
 
-/* RSSI Calibration */
-static void b43_nphy_rssi_cal(struct b43_wldev *dev, u8 type)
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/ScaleOffsetRssi */
+static void b43_nphy_scale_offset_rssi(struct b43_wldev *dev, u16 scale,
+                                       s8 offset, u8 core, u8 rail, u8 type)
 {
-        //TODO
+        u16 tmp;
+        bool core1or5 = (core == 1) || (core == 5);
+        bool core2or5 = (core == 2) || (core == 5);
+
+        offset = clamp_val(offset, -32, 31);
+        tmp = ((scale & 0x3F) << 8) | (offset & 0x3F);
+
+        if (core1or5 && (rail == 0) && (type == 2))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_0I_RSSI_Z, tmp);
+        if (core1or5 && (rail == 1) && (type == 2))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_0Q_RSSI_Z, tmp);
+        if (core2or5 && (rail == 0) && (type == 2))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_1I_RSSI_Z, tmp);
+        if (core2or5 && (rail == 1) && (type == 2))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_1Q_RSSI_Z, tmp);
+        if (core1or5 && (rail == 0) && (type == 0))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_0I_RSSI_X, tmp);
+        if (core1or5 && (rail == 1) && (type == 0))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_0Q_RSSI_X, tmp);
+        if (core2or5 && (rail == 0) && (type == 0))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_1I_RSSI_X, tmp);
+        if (core2or5 && (rail == 1) && (type == 0))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_1Q_RSSI_X, tmp);
+        if (core1or5 && (rail == 0) && (type == 1))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_0I_RSSI_Y, tmp);
+        if (core1or5 && (rail == 1) && (type == 1))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_0Q_RSSI_Y, tmp);
+        if (core2or5 && (rail == 0) && (type == 1))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_1I_RSSI_Y, tmp);
+        if (core2or5 && (rail == 1) && (type == 1))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_1Q_RSSI_Y, tmp);
+        if (core1or5 && (rail == 0) && (type == 6))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_0I_TBD, tmp);
+        if (core1or5 && (rail == 1) && (type == 6))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_0Q_TBD, tmp);
+        if (core2or5 && (rail == 0) && (type == 6))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_1I_TBD, tmp);
+        if (core2or5 && (rail == 1) && (type == 6))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_1Q_TBD, tmp);
+        if (core1or5 && (rail == 0) && (type == 3))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_0I_PWRDET, tmp);
+        if (core1or5 && (rail == 1) && (type == 3))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_0Q_PWRDET, tmp);
+        if (core2or5 && (rail == 0) && (type == 3))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_1I_PWRDET, tmp);
+        if (core2or5 && (rail == 1) && (type == 3))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_1Q_PWRDET, tmp);
+        if (core1or5 && (type == 4))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_0I_TSSI, tmp);
+        if (core2or5 && (type == 4))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_1I_TSSI, tmp);
+        if (core1or5 && (type == 5))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_0Q_TSSI, tmp);
+        if (core2or5 && (type == 5))
+                b43_phy_write(dev, B43_NPHY_RSSIMC_1Q_TSSI, tmp);
+}
+
+static void b43_nphy_rev2_rssi_select(struct b43_wldev *dev, u8 code, u8 type)
+{
+        u16 val;
+
+        if (type < 3)
+                val = 0;
+        else if (type == 6)
+                val = 1;
+        else if (type == 3)
+                val = 2;
+        else
+                val = 3;
+
+        val = (val << 12) | (val << 14);
+        b43_phy_maskset(dev, B43_NPHY_AFECTL_C1, 0x0FFF, val);
+        b43_phy_maskset(dev, B43_NPHY_AFECTL_C2, 0x0FFF, val);
+
+        if (type < 3) {
+                b43_phy_maskset(dev, B43_NPHY_RFCTL_RSSIO1, 0xFFCF,
+                                (type + 1) << 4);
+                b43_phy_maskset(dev, B43_NPHY_RFCTL_RSSIO2, 0xFFCF,
+                                (type + 1) << 4);
+        }
+
+        /* TODO use some definitions */
+        if (code == 0) {
+                b43_phy_maskset(dev, B43_NPHY_AFECTL_OVER, 0xCFFF, 0);
+                if (type < 3) {
+                        b43_phy_maskset(dev, B43_NPHY_RFCTL_CMD, 0xFEC7, 0);
+                        b43_phy_maskset(dev, B43_NPHY_RFCTL_OVER, 0xEFDC, 0);
+                        b43_phy_maskset(dev, B43_NPHY_RFCTL_CMD, 0xFFFE, 0);
+                        udelay(20);
+                        b43_phy_maskset(dev, B43_NPHY_RFCTL_OVER, 0xFFFE, 0);
+                }
+        } else {
+                b43_phy_maskset(dev, B43_NPHY_AFECTL_OVER, 0xCFFF,
+                                0x3000);
+                if (type < 3) {
+                        b43_phy_maskset(dev, B43_NPHY_RFCTL_CMD,
+                                        0xFEC7, 0x0180);
+                        b43_phy_maskset(dev, B43_NPHY_RFCTL_OVER,
+                                        0xEFDC, (code << 1 | 0x1021));
+                        b43_phy_maskset(dev, B43_NPHY_RFCTL_CMD, 0xFFFE, 0x1);
+                        udelay(20);
+                        b43_phy_maskset(dev, B43_NPHY_RFCTL_OVER, 0xFFFE, 0);
+                }
+        }
+}
+
+static void b43_nphy_rev3_rssi_select(struct b43_wldev *dev, u8 code, u8 type)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        u8 i;
+        u16 reg, val;
+
+        if (code == 0) {
+                b43_phy_mask(dev, B43_NPHY_AFECTL_OVER1, 0xFDFF);
+                b43_phy_mask(dev, B43_NPHY_AFECTL_OVER, 0xFDFF);
+                b43_phy_mask(dev, B43_NPHY_AFECTL_C1, 0xFCFF);
+                b43_phy_mask(dev, B43_NPHY_AFECTL_C2, 0xFCFF);
+                b43_phy_mask(dev, B43_NPHY_TXF_40CO_B1S0, 0xFFDF);
+                b43_phy_mask(dev, B43_NPHY_TXF_40CO_B32S1, 0xFFDF);
+                b43_phy_mask(dev, B43_NPHY_RFCTL_LUT_TRSW_UP1, 0xFFC3);
+                b43_phy_mask(dev, B43_NPHY_RFCTL_LUT_TRSW_UP2, 0xFFC3);
+        } else {
+                for (i = 0; i < 2; i++) {
+                        if ((code == 1 && i == 1) || (code == 2 && !i))
+                                continue;
+
+                        reg = (i == 0) ?
+                                B43_NPHY_AFECTL_OVER1 : B43_NPHY_AFECTL_OVER;
+                        b43_phy_maskset(dev, reg, 0xFDFF, 0x0200);
+
+                        if (type < 3) {
+                                reg = (i == 0) ?
+                                        B43_NPHY_AFECTL_C1 :
+                                        B43_NPHY_AFECTL_C2;
+                                b43_phy_maskset(dev, reg, 0xFCFF, 0);
+
+                                reg = (i == 0) ?
+                                        B43_NPHY_RFCTL_LUT_TRSW_UP1 :
+                                        B43_NPHY_RFCTL_LUT_TRSW_UP2;
+                                b43_phy_maskset(dev, reg, 0xFFC3, 0);
+
+                                if (type == 0)
+                                        val = (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) ? 4 : 8;
+                                else if (type == 1)
+                                        val = 16;
+                                else
+                                        val = 32;
+                                b43_phy_set(dev, reg, val);
+
+                                reg = (i == 0) ?
+                                        B43_NPHY_TXF_40CO_B1S0 :
+                                        B43_NPHY_TXF_40CO_B32S1;
+                                b43_phy_set(dev, reg, 0x0020);
+                        } else {
+                                if (type == 6)
+                                        val = 0x0100;
+                                else if (type == 3)
+                                        val = 0x0200;
+                                else
+                                        val = 0x0300;
+
+                                reg = (i == 0) ?
+                                        B43_NPHY_AFECTL_C1 :
+                                        B43_NPHY_AFECTL_C2;
+
+                                b43_phy_maskset(dev, reg, 0xFCFF, val);
+                                b43_phy_maskset(dev, reg, 0xF3FF, val << 2);
+
+                                if (type != 3 && type != 6) {
+                                        enum ieee80211_band band =
+                                                b43_current_band(dev->wl);
+
+                                        if ((nphy->ipa2g_on &&
+                                                band == IEEE80211_BAND_2GHZ) ||
+                                                (nphy->ipa5g_on &&
+                                                band == IEEE80211_BAND_5GHZ))
+                                                val = (band == IEEE80211_BAND_5GHZ) ? 0xC : 0xE;
+                                        else
+                                                val = 0x11;
+                                        reg = (i == 0) ? 0x2000 : 0x3000;
+                                        reg |= B2055_PADDRV;
+                                        b43_radio_write16(dev, reg, val);
+
+                                        reg = (i == 0) ?
+                                                B43_NPHY_AFECTL_OVER1 :
+                                                B43_NPHY_AFECTL_OVER;
+                                        b43_phy_set(dev, reg, 0x0200);
+                                }
+                        }
+                }
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RSSISel */
+static void b43_nphy_rssi_select(struct b43_wldev *dev, u8 code, u8 type)
+{
+        if (dev->phy.rev >= 3)
+                b43_nphy_rev3_rssi_select(dev, code, type);
+        else
+                b43_nphy_rev2_rssi_select(dev, code, type);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/SetRssi2055Vcm */
+static void b43_nphy_set_rssi_2055_vcm(struct b43_wldev *dev, u8 type, u8 *buf)
+{
+        int i;
+        for (i = 0; i < 2; i++) {
+                if (type == 2) {
+                        if (i == 0) {
+                                b43_radio_maskset(dev, B2055_C1_B0NB_RSSIVCM,
+                                                  0xFC, buf[0]);
+                                b43_radio_maskset(dev, B2055_C1_RX_BB_RSSICTL5,
+                                                  0xFC, buf[1]);
+                        } else {
+                                b43_radio_maskset(dev, B2055_C2_B0NB_RSSIVCM,
+                                                  0xFC, buf[2 * i]);
+                                b43_radio_maskset(dev, B2055_C2_RX_BB_RSSICTL5,
+                                                  0xFC, buf[2 * i + 1]);
+                        }
+                } else {
+                        if (i == 0)
+                                b43_radio_maskset(dev, B2055_C1_RX_BB_RSSICTL5,
+                                                  0xF3, buf[0] << 2);
+                        else
+                                b43_radio_maskset(dev, B2055_C2_RX_BB_RSSICTL5,
+                                                  0xF3, buf[2 * i + 1] << 2);
+                }
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/PollRssi */
+static int b43_nphy_poll_rssi(struct b43_wldev *dev, u8 type, s32 *buf,
+                                u8 nsamp)
+{
+        int i;
+        int out;
+        u16 save_regs_phy[9];
+        u16 s[2];
+
+        if (dev->phy.rev >= 3) {
+                save_regs_phy[0] = b43_phy_read(dev,
+                                                B43_NPHY_RFCTL_LUT_TRSW_UP1);
+                save_regs_phy[1] = b43_phy_read(dev,
+                                                B43_NPHY_RFCTL_LUT_TRSW_UP2);
+                save_regs_phy[2] = b43_phy_read(dev, B43_NPHY_AFECTL_C1);
+                save_regs_phy[3] = b43_phy_read(dev, B43_NPHY_AFECTL_C2);
+                save_regs_phy[4] = b43_phy_read(dev, B43_NPHY_AFECTL_OVER1);
+                save_regs_phy[5] = b43_phy_read(dev, B43_NPHY_AFECTL_OVER);
+                save_regs_phy[6] = b43_phy_read(dev, B43_NPHY_TXF_40CO_B1S0);
+                save_regs_phy[7] = b43_phy_read(dev, B43_NPHY_TXF_40CO_B32S1);
+        }
+
+        b43_nphy_rssi_select(dev, 5, type);
+
+        if (dev->phy.rev < 2) {
+                save_regs_phy[8] = b43_phy_read(dev, B43_NPHY_GPIO_SEL);
+                b43_phy_write(dev, B43_NPHY_GPIO_SEL, 5);
+        }
+
+        for (i = 0; i < 4; i++)
+                buf[i] = 0;
+
+        for (i = 0; i < nsamp; i++) {
+                if (dev->phy.rev < 2) {
+                        s[0] = b43_phy_read(dev, B43_NPHY_GPIO_LOOUT);
+                        s[1] = b43_phy_read(dev, B43_NPHY_GPIO_HIOUT);
+                } else {
+                        s[0] = b43_phy_read(dev, B43_NPHY_RSSI1);
+                        s[1] = b43_phy_read(dev, B43_NPHY_RSSI2);
+                }
+
+                buf[0] += ((s8)((s[0] & 0x3F) << 2)) >> 2;
+                buf[1] += ((s8)(((s[0] >> 8) & 0x3F) << 2)) >> 2;
+                buf[2] += ((s8)((s[1] & 0x3F) << 2)) >> 2;
+                buf[3] += ((s8)(((s[1] >> 8) & 0x3F) << 2)) >> 2;
+        }
+        out = (buf[0] & 0xFF) << 24 | (buf[1] & 0xFF) << 16 |
+                (buf[2] & 0xFF) << 8 | (buf[3] & 0xFF);
+
+        if (dev->phy.rev < 2)
+                b43_phy_write(dev, B43_NPHY_GPIO_SEL, save_regs_phy[8]);
+
+        if (dev->phy.rev >= 3) {
+                b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_UP1,
+                                save_regs_phy[0]);
+                b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_UP2,
+                                save_regs_phy[1]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_C1, save_regs_phy[2]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_C2, save_regs_phy[3]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER1, save_regs_phy[4]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER, save_regs_phy[5]);
+                b43_phy_write(dev, B43_NPHY_TXF_40CO_B1S0, save_regs_phy[6]);
+                b43_phy_write(dev, B43_NPHY_TXF_40CO_B32S1, save_regs_phy[7]);
+        }
+
+        return out;
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RSSICal */
+static void b43_nphy_rev2_rssi_cal(struct b43_wldev *dev, u8 type)
+{
+        int i, j;
+        u8 state[4];
+        u8 code, val;
+        u16 class, override;
+        u8 regs_save_radio[2];
+        u16 regs_save_phy[2];
+        s8 offset[4];
+
+        u16 clip_state[2];
+        u16 clip_off[2] = { 0xFFFF, 0xFFFF };
+        s32 results_min[4] = { };
+        u8 vcm_final[4] = { };
+        s32 results[4][4] = { };
+        s32 miniq[4][2] = { };
+
+        if (type == 2) {
+                code = 0;
+                val = 6;
+        } else if (type < 2) {
+                code = 25;
+                val = 4;
+        } else {
+                B43_WARN_ON(1);
+                return;
+        }
+
+        class = b43_nphy_classifier(dev, 0, 0);
+        b43_nphy_classifier(dev, 7, 4);
+        b43_nphy_read_clip_detection(dev, clip_state);
+        b43_nphy_write_clip_detection(dev, clip_off);
+
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
+                override = 0x140;
+        else
+                override = 0x110;
+
+        regs_save_phy[0] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC1);
+        regs_save_radio[0] = b43_radio_read16(dev, B2055_C1_PD_RXTX);
+        b43_phy_write(dev, B43_NPHY_RFCTL_INTC1, override);
+        b43_radio_write16(dev, B2055_C1_PD_RXTX, val);
+
+        regs_save_phy[1] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC2);
+        regs_save_radio[1] = b43_radio_read16(dev, B2055_C2_PD_RXTX);
+        b43_phy_write(dev, B43_NPHY_RFCTL_INTC2, override);
+        b43_radio_write16(dev, B2055_C2_PD_RXTX, val);
+
+        state[0] = b43_radio_read16(dev, B2055_C1_PD_RSSIMISC) & 0x07;
+        state[1] = b43_radio_read16(dev, B2055_C2_PD_RSSIMISC) & 0x07;
+        b43_radio_mask(dev, B2055_C1_PD_RSSIMISC, 0xF8);
+        b43_radio_mask(dev, B2055_C2_PD_RSSIMISC, 0xF8);
+        state[2] = b43_radio_read16(dev, B2055_C1_SP_RSSI) & 0x07;
+        state[3] = b43_radio_read16(dev, B2055_C2_SP_RSSI) & 0x07;
+
+        b43_nphy_rssi_select(dev, 5, type);
+        b43_nphy_scale_offset_rssi(dev, 0, 0, 5, 0, type);
+        b43_nphy_scale_offset_rssi(dev, 0, 0, 5, 1, type);
+
+        for (i = 0; i < 4; i++) {
+                u8 tmp[4];
+                for (j = 0; j < 4; j++)
+                        tmp[j] = i;
+                if (type != 1)
+                        b43_nphy_set_rssi_2055_vcm(dev, type, tmp);
+                b43_nphy_poll_rssi(dev, type, results[i], 8);
+                if (type < 2)
+                        for (j = 0; j < 2; j++)
+                                miniq[i][j] = min(results[i][2 * j],
+                                                results[i][2 * j + 1]);
+        }
+
+        for (i = 0; i < 4; i++) {
+                s32 mind = 40;
+                u8 minvcm = 0;
+                s32 minpoll = 249;
+                s32 curr;
+                for (j = 0; j < 4; j++) {
+                        if (type == 2)
+                                curr = abs(results[j][i]);
+                        else
+                                curr = abs(miniq[j][i / 2] - code * 8);
+
+                        if (curr < mind) {
+                                mind = curr;
+                                minvcm = j;
+                        }
+
+                        if (results[j][i] < minpoll)
+                                minpoll = results[j][i];
+                }
+                results_min[i] = minpoll;
+                vcm_final[i] = minvcm;
+        }
+
+        if (type != 1)
+                b43_nphy_set_rssi_2055_vcm(dev, type, vcm_final);
+
+        for (i = 0; i < 4; i++) {
+                offset[i] = (code * 8) - results[vcm_final[i]][i];
+
+                if (offset[i] < 0)
+                        offset[i] = -((abs(offset[i]) + 4) / 8);
+                else
+                        offset[i] = (offset[i] + 4) / 8;
+
+                if (results_min[i] == 248)
+                        offset[i] = code - 32;
+
+                if (i % 2 == 0)
+                        b43_nphy_scale_offset_rssi(dev, 0, offset[i], 1, 0,
+                                                        type);
+                else
+                        b43_nphy_scale_offset_rssi(dev, 0, offset[i], 2, 1,
+                                                        type);
+        }
+
+        b43_radio_maskset(dev, B2055_C1_PD_RSSIMISC, 0xF8, state[0]);
+        b43_radio_maskset(dev, B2055_C1_PD_RSSIMISC, 0xF8, state[1]);
+
+        switch (state[2]) {
+        case 1:
+                b43_nphy_rssi_select(dev, 1, 2);
+                break;
+        case 4:
+                b43_nphy_rssi_select(dev, 1, 0);
+                break;
+        case 2:
+                b43_nphy_rssi_select(dev, 1, 1);
+                break;
+        default:
+                b43_nphy_rssi_select(dev, 1, 1);
+                break;
+        }
+
+        switch (state[3]) {
+        case 1:
+                b43_nphy_rssi_select(dev, 2, 2);
+                break;
+        case 4:
+                b43_nphy_rssi_select(dev, 2, 0);
+                break;
+        default:
+                b43_nphy_rssi_select(dev, 2, 1);
+                break;
+        }
+
+        b43_nphy_rssi_select(dev, 0, type);
+
+        b43_phy_write(dev, B43_NPHY_RFCTL_INTC1, regs_save_phy[0]);
+        b43_radio_write16(dev, B2055_C1_PD_RXTX, regs_save_radio[0]);
+        b43_phy_write(dev, B43_NPHY_RFCTL_INTC2, regs_save_phy[1]);
+        b43_radio_write16(dev, B2055_C2_PD_RXTX, regs_save_radio[1]);
+
+        b43_nphy_classifier(dev, 7, class);
+        b43_nphy_write_clip_detection(dev, clip_state);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RSSICalRev3 */
+static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
+{
+        /* TODO */
+}
+
+/*
+ * RSSI Calibration
+ * http://bcm-v4.sipsolutions.net/802.11/PHY/N/RSSICal
+ */
+static void b43_nphy_rssi_cal(struct b43_wldev *dev)
+{
+        if (dev->phy.rev >= 3) {
+                b43_nphy_rev3_rssi_cal(dev);
+        } else {
+                b43_nphy_rev2_rssi_cal(dev, 2);
+                b43_nphy_rev2_rssi_cal(dev, 0);
+                b43_nphy_rev2_rssi_cal(dev, 1);
+        }
 }
 
+/*
+ * Restore RSSI Calibration
+ * http://bcm-v4.sipsolutions.net/802.11/PHY/N/RestoreRssiCal
+ */
+static void b43_nphy_restore_rssi_cal(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        u16 *rssical_radio_regs = NULL;
+        u16 *rssical_phy_regs = NULL;
+
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                if (!nphy->rssical_chanspec_2G)
+                        return;
+                rssical_radio_regs = nphy->rssical_cache.rssical_radio_regs_2G;
+                rssical_phy_regs = nphy->rssical_cache.rssical_phy_regs_2G;
+        } else {
+                if (!nphy->rssical_chanspec_5G)
+                        return;
+                rssical_radio_regs = nphy->rssical_cache.rssical_radio_regs_5G;
+                rssical_phy_regs = nphy->rssical_cache.rssical_phy_regs_5G;
+        }
+
+        /* TODO use some definitions */
+        b43_radio_maskset(dev, 0x602B, 0xE3, rssical_radio_regs[0]);
+        b43_radio_maskset(dev, 0x702B, 0xE3, rssical_radio_regs[1]);
+
+        b43_phy_write(dev, B43_NPHY_RSSIMC_0I_RSSI_Z, rssical_phy_regs[0]);
+        b43_phy_write(dev, B43_NPHY_RSSIMC_0Q_RSSI_Z, rssical_phy_regs[1]);
+        b43_phy_write(dev, B43_NPHY_RSSIMC_1I_RSSI_Z, rssical_phy_regs[2]);
+        b43_phy_write(dev, B43_NPHY_RSSIMC_1Q_RSSI_Z, rssical_phy_regs[3]);
+
+        b43_phy_write(dev, B43_NPHY_RSSIMC_0I_RSSI_X, rssical_phy_regs[4]);
+        b43_phy_write(dev, B43_NPHY_RSSIMC_0Q_RSSI_X, rssical_phy_regs[5]);
+        b43_phy_write(dev, B43_NPHY_RSSIMC_1I_RSSI_X, rssical_phy_regs[6]);
+        b43_phy_write(dev, B43_NPHY_RSSIMC_1Q_RSSI_X, rssical_phy_regs[7]);
+
+        b43_phy_write(dev, B43_NPHY_RSSIMC_0I_RSSI_Y, rssical_phy_regs[8]);
+        b43_phy_write(dev, B43_NPHY_RSSIMC_0Q_RSSI_Y, rssical_phy_regs[9]);
+        b43_phy_write(dev, B43_NPHY_RSSIMC_1I_RSSI_Y, rssical_phy_regs[10]);
+        b43_phy_write(dev, B43_NPHY_RSSIMC_1Q_RSSI_Y, rssical_phy_regs[11]);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/GetIpaGainTbl */
+static const u32 *b43_nphy_get_ipa_gain_table(struct b43_wldev *dev)
+{
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                if (dev->phy.rev >= 6) {
+                        /* TODO If the chip is 47162
+                                return txpwrctrl_tx_gain_ipa_rev5 */
+                        return txpwrctrl_tx_gain_ipa_rev6;
+                } else if (dev->phy.rev >= 5) {
+                        return txpwrctrl_tx_gain_ipa_rev5;
+                } else {
+                        return txpwrctrl_tx_gain_ipa;
+                }
+        } else {
+                return txpwrctrl_tx_gain_ipa_5g;
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/TxCalRadioSetup */
+static void b43_nphy_tx_cal_radio_setup(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        u16 *save = nphy->tx_rx_cal_radio_saveregs;
+        u16 tmp;
+        u8 offset, i;
+
+        if (dev->phy.rev >= 3) {
+            for (i = 0; i < 2; i++) {
+                tmp = (i == 0) ? 0x2000 : 0x3000;
+                offset = i * 11;
+
+                save[offset + 0] = b43_radio_read16(dev, B2055_CAL_RVARCTL);
+                save[offset + 1] = b43_radio_read16(dev, B2055_CAL_LPOCTL);
+                save[offset + 2] = b43_radio_read16(dev, B2055_CAL_TS);
+                save[offset + 3] = b43_radio_read16(dev, B2055_CAL_RCCALRTS);
+                save[offset + 4] = b43_radio_read16(dev, B2055_CAL_RCALRTS);
+                save[offset + 5] = b43_radio_read16(dev, B2055_PADDRV);
+                save[offset + 6] = b43_radio_read16(dev, B2055_XOCTL1);
+                save[offset + 7] = b43_radio_read16(dev, B2055_XOCTL2);
+                save[offset + 8] = b43_radio_read16(dev, B2055_XOREGUL);
+                save[offset + 9] = b43_radio_read16(dev, B2055_XOMISC);
+                save[offset + 10] = b43_radio_read16(dev, B2055_PLL_LFC1);
+
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                        b43_radio_write16(dev, tmp | B2055_CAL_RVARCTL, 0x0A);
+                        b43_radio_write16(dev, tmp | B2055_CAL_LPOCTL, 0x40);
+                        b43_radio_write16(dev, tmp | B2055_CAL_TS, 0x55);
+                        b43_radio_write16(dev, tmp | B2055_CAL_RCCALRTS, 0);
+                        b43_radio_write16(dev, tmp | B2055_CAL_RCALRTS, 0);
+                        if (nphy->ipa5g_on) {
+                                b43_radio_write16(dev, tmp | B2055_PADDRV, 4);
+                                b43_radio_write16(dev, tmp | B2055_XOCTL1, 1);
+                        } else {
+                                b43_radio_write16(dev, tmp | B2055_PADDRV, 0);
+                                b43_radio_write16(dev, tmp | B2055_XOCTL1, 0x2F);
+                        }
+                        b43_radio_write16(dev, tmp | B2055_XOCTL2, 0);
+                } else {
+                        b43_radio_write16(dev, tmp | B2055_CAL_RVARCTL, 0x06);
+                        b43_radio_write16(dev, tmp | B2055_CAL_LPOCTL, 0x40);
+                        b43_radio_write16(dev, tmp | B2055_CAL_TS, 0x55);
+                        b43_radio_write16(dev, tmp | B2055_CAL_RCCALRTS, 0);
+                        b43_radio_write16(dev, tmp | B2055_CAL_RCALRTS, 0);
+                        b43_radio_write16(dev, tmp | B2055_XOCTL1, 0);
+                        if (nphy->ipa2g_on) {
+                                b43_radio_write16(dev, tmp | B2055_PADDRV, 6);
+                                b43_radio_write16(dev, tmp | B2055_XOCTL2,
+                                        (dev->phy.rev < 5) ? 0x11 : 0x01);
+                        } else {
+                                b43_radio_write16(dev, tmp | B2055_PADDRV, 0);
+                                b43_radio_write16(dev, tmp | B2055_XOCTL2, 0);
+                        }
+                }
+                b43_radio_write16(dev, tmp | B2055_XOREGUL, 0);
+                b43_radio_write16(dev, tmp | B2055_XOMISC, 0);
+                b43_radio_write16(dev, tmp | B2055_PLL_LFC1, 0);
+            }
+        } else {
+                save[0] = b43_radio_read16(dev, B2055_C1_TX_RF_IQCAL1);
+                b43_radio_write16(dev, B2055_C1_TX_RF_IQCAL1, 0x29);
+
+                save[1] = b43_radio_read16(dev, B2055_C1_TX_RF_IQCAL2);
+                b43_radio_write16(dev, B2055_C1_TX_RF_IQCAL2, 0x54);
+
+                save[2] = b43_radio_read16(dev, B2055_C2_TX_RF_IQCAL1);
+                b43_radio_write16(dev, B2055_C2_TX_RF_IQCAL1, 0x29);
+
+                save[3] = b43_radio_read16(dev, B2055_C2_TX_RF_IQCAL2);
+                b43_radio_write16(dev, B2055_C2_TX_RF_IQCAL2, 0x54);
+
+                save[3] = b43_radio_read16(dev, B2055_C1_PWRDET_RXTX);
+                save[4] = b43_radio_read16(dev, B2055_C2_PWRDET_RXTX);
+
+                if (!(b43_phy_read(dev, B43_NPHY_BANDCTL) &
+                    B43_NPHY_BANDCTL_5GHZ)) {
+                        b43_radio_write16(dev, B2055_C1_PWRDET_RXTX, 0x04);
+                        b43_radio_write16(dev, B2055_C2_PWRDET_RXTX, 0x04);
+                } else {
+                        b43_radio_write16(dev, B2055_C1_PWRDET_RXTX, 0x20);
+                        b43_radio_write16(dev, B2055_C2_PWRDET_RXTX, 0x20);
+                }
+
+                if (dev->phy.rev < 2) {
+                        b43_radio_set(dev, B2055_C1_TX_BB_MXGM, 0x20);
+                        b43_radio_set(dev, B2055_C2_TX_BB_MXGM, 0x20);
+                } else {
+                        b43_radio_mask(dev, B2055_C1_TX_BB_MXGM, ~0x20);
+                        b43_radio_mask(dev, B2055_C2_TX_BB_MXGM, ~0x20);
+                }
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/IqCalGainParams */
+static void b43_nphy_iq_cal_gain_params(struct b43_wldev *dev, u16 core,
+                                        struct nphy_txgains target,
+                                        struct nphy_iqcal_params *params)
+{
+        int i, j, indx;
+        u16 gain;
+
+        if (dev->phy.rev >= 3) {
+                params->txgm = target.txgm[core];
+                params->pga = target.pga[core];
+                params->pad = target.pad[core];
+                params->ipa = target.ipa[core];
+                params->cal_gain = (params->txgm << 12) | (params->pga << 8) |
+                                        (params->pad << 4) | (params->ipa);
+                for (j = 0; j < 5; j++)
+                        params->ncorr[j] = 0x79;
+        } else {
+                gain = (target.pad[core]) | (target.pga[core] << 4) |
+                        (target.txgm[core] << 8);
+
+                indx = (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) ?
+                        1 : 0;
+                for (i = 0; i < 9; i++)
+                        if (tbl_iqcal_gainparams[indx][i][0] == gain)
+                                break;
+                i = min(i, 8);
+
+                params->txgm = tbl_iqcal_gainparams[indx][i][1];
+                params->pga = tbl_iqcal_gainparams[indx][i][2];
+                params->pad = tbl_iqcal_gainparams[indx][i][3];
+                params->cal_gain = (params->txgm << 7) | (params->pga << 4) |
+                                        (params->pad << 2);
+                for (j = 0; j < 4; j++)
+                        params->ncorr[j] = tbl_iqcal_gainparams[indx][i][4 + j];
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/UpdateTxCalLadder */
+static void b43_nphy_update_tx_cal_ladder(struct b43_wldev *dev, u16 core)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        int i;
+        u16 scale, entry;
+
+        u16 tmp = nphy->txcal_bbmult;
+        if (core == 0)
+                tmp >>= 8;
+        tmp &= 0xff;
+
+        for (i = 0; i < 18; i++) {
+                scale = (ladder_lo[i].percent * tmp) / 100;
+                entry = ((scale & 0xFF) << 8) | ladder_lo[i].g_env;
+                b43_ntab_write(dev, B43_NTAB16(15, i), entry);
+
+                scale = (ladder_iq[i].percent * tmp) / 100;
+                entry = ((scale & 0xFF) << 8) | ladder_iq[i].g_env;
+                b43_ntab_write(dev, B43_NTAB16(15, i + 32), entry);
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/ExtPaSetTxDigiFilts */
+static void b43_nphy_ext_pa_set_tx_dig_filters(struct b43_wldev *dev)
+{
+        int i;
+        for (i = 0; i < 15; i++)
+                b43_phy_write(dev, B43_PHY_N(0x2C5 + i),
+                                tbl_tx_filter_coef_rev4[2][i]);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/IpaSetTxDigiFilts */
+static void b43_nphy_int_pa_set_tx_dig_filters(struct b43_wldev *dev)
+{
+        int i, j;
+        /* B43_NPHY_TXF_20CO_S0A1, B43_NPHY_TXF_40CO_S0A1, unknown */
+        u16 offset[] = { 0x186, 0x195, 0x2C5 };
+
+        for (i = 0; i < 3; i++)
+                for (j = 0; j < 15; j++)
+                        b43_phy_write(dev, B43_PHY_N(offset[i] + j),
+                                        tbl_tx_filter_coef_rev4[i][j]);
+
+        if (dev->phy.is_40mhz) {
+                for (j = 0; j < 15; j++)
+                        b43_phy_write(dev, B43_PHY_N(offset[0] + j),
+                                        tbl_tx_filter_coef_rev4[3][j]);
+        } else if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                for (j = 0; j < 15; j++)
+                        b43_phy_write(dev, B43_PHY_N(offset[0] + j),
+                                        tbl_tx_filter_coef_rev4[5][j]);
+        }
+
+        if (dev->phy.channel == 14)
+                for (j = 0; j < 15; j++)
+                        b43_phy_write(dev, B43_PHY_N(offset[0] + j),
+                                        tbl_tx_filter_coef_rev4[6][j]);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/GetTxGain */
+static struct nphy_txgains b43_nphy_get_tx_gains(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        u16 curr_gain[2];
+        struct nphy_txgains target;
+        const u32 *table = NULL;
+
+        if (nphy->txpwrctrl == 0) {
+                int i;
+
+                if (nphy->hang_avoid)
+                        b43_nphy_stay_in_carrier_search(dev, true);
+                b43_ntab_read_bulk(dev, B43_NTAB16(7, 0x110), 2, curr_gain);
+                if (nphy->hang_avoid)
+                        b43_nphy_stay_in_carrier_search(dev, false);
+
+                for (i = 0; i < 2; ++i) {
+                        if (dev->phy.rev >= 3) {
+                                target.ipa[i] = curr_gain[i] & 0x000F;
+                                target.pad[i] = (curr_gain[i] & 0x00F0) >> 4;
+                                target.pga[i] = (curr_gain[i] & 0x0F00) >> 8;
+                                target.txgm[i] = (curr_gain[i] & 0x7000) >> 12;
+                        } else {
+                                target.ipa[i] = curr_gain[i] & 0x0003;
+                                target.pad[i] = (curr_gain[i] & 0x000C) >> 2;
+                                target.pga[i] = (curr_gain[i] & 0x0070) >> 4;
+                                target.txgm[i] = (curr_gain[i] & 0x0380) >> 7;
+                        }
+                }
+        } else {
+                int i;
+                u16 index[2];
+                index[0] = (b43_phy_read(dev, B43_NPHY_C1_TXPCTL_STAT) &
+                        B43_NPHY_TXPCTL_STAT_BIDX) >>
+                        B43_NPHY_TXPCTL_STAT_BIDX_SHIFT;
+                index[1] = (b43_phy_read(dev, B43_NPHY_C2_TXPCTL_STAT) &
+                        B43_NPHY_TXPCTL_STAT_BIDX) >>
+                        B43_NPHY_TXPCTL_STAT_BIDX_SHIFT;
+
+                for (i = 0; i < 2; ++i) {
+                        if (dev->phy.rev >= 3) {
+                                enum ieee80211_band band =
+                                        b43_current_band(dev->wl);
+
+                                if ((nphy->ipa2g_on &&
+                                     band == IEEE80211_BAND_2GHZ) ||
+                                    (nphy->ipa5g_on &&
+                                     band == IEEE80211_BAND_5GHZ)) {
+                                        table = b43_nphy_get_ipa_gain_table(dev);
+                                } else {
+                                        if (band == IEEE80211_BAND_5GHZ) {
+                                                if (dev->phy.rev == 3)
+                                                        table = b43_ntab_tx_gain_rev3_5ghz;
+                                                else if (dev->phy.rev == 4)
+                                                        table = b43_ntab_tx_gain_rev4_5ghz;
+                                                else
+                                                        table = b43_ntab_tx_gain_rev5plus_5ghz;
+                                        } else {
+                                                table = b43_ntab_tx_gain_rev3plus_2ghz;
+                                        }
+                                }
+
+                                target.ipa[i] = (table[index[i]] >> 16) & 0xF;
+                                target.pad[i] = (table[index[i]] >> 20) & 0xF;
+                                target.pga[i] = (table[index[i]] >> 24) & 0xF;
+                                target.txgm[i] = (table[index[i]] >> 28) & 0xF;
+                        } else {
+                                table = b43_ntab_tx_gain_rev0_1_2;
+
+                                target.ipa[i] = (table[index[i]] >> 16) & 0x3;
+                                target.pad[i] = (table[index[i]] >> 18) & 0x3;
+                                target.pga[i] = (table[index[i]] >> 20) & 0x7;
+                                target.txgm[i] = (table[index[i]] >> 23) & 0x7;
+                        }
+                }
+        }
+
+        return target;
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/TxCalPhyCleanup */
+static void b43_nphy_tx_cal_phy_cleanup(struct b43_wldev *dev)
+{
+        u16 *regs = dev->phy.n->tx_rx_cal_phy_saveregs;
+
+        if (dev->phy.rev >= 3) {
+                b43_phy_write(dev, B43_NPHY_AFECTL_C1, regs[0]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_C2, regs[1]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER1, regs[2]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER, regs[3]);
+                b43_phy_write(dev, B43_NPHY_BBCFG, regs[4]);
+                b43_ntab_write(dev, B43_NTAB16(8, 3), regs[5]);
+                b43_ntab_write(dev, B43_NTAB16(8, 19), regs[6]);
+                b43_phy_write(dev, B43_NPHY_RFCTL_INTC1, regs[7]);
+                b43_phy_write(dev, B43_NPHY_RFCTL_INTC2, regs[8]);
+                b43_phy_write(dev, B43_NPHY_PAPD_EN0, regs[9]);
+                b43_phy_write(dev, B43_NPHY_PAPD_EN1, regs[10]);
+                b43_nphy_reset_cca(dev);
+        } else {
+                b43_phy_maskset(dev, B43_NPHY_AFECTL_C1, 0x0FFF, regs[0]);
+                b43_phy_maskset(dev, B43_NPHY_AFECTL_C2, 0x0FFF, regs[1]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER, regs[2]);
+                b43_ntab_write(dev, B43_NTAB16(8, 2), regs[3]);
+                b43_ntab_write(dev, B43_NTAB16(8, 18), regs[4]);
+                b43_phy_write(dev, B43_NPHY_RFCTL_INTC1, regs[5]);
+                b43_phy_write(dev, B43_NPHY_RFCTL_INTC2, regs[6]);
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/TxCalPhySetup */
+static void b43_nphy_tx_cal_phy_setup(struct b43_wldev *dev)
+{
+        u16 *regs = dev->phy.n->tx_rx_cal_phy_saveregs;
+        u16 tmp;
+
+        regs[0] = b43_phy_read(dev, B43_NPHY_AFECTL_C1);
+        regs[1] = b43_phy_read(dev, B43_NPHY_AFECTL_C2);
+        if (dev->phy.rev >= 3) {
+                b43_phy_maskset(dev, B43_NPHY_AFECTL_C1, 0xF0FF, 0x0A00);
+                b43_phy_maskset(dev, B43_NPHY_AFECTL_C2, 0xF0FF, 0x0A00);
+
+                tmp = b43_phy_read(dev, B43_NPHY_AFECTL_OVER1);
+                regs[2] = tmp;
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER1, tmp | 0x0600);
+
+                tmp = b43_phy_read(dev, B43_NPHY_AFECTL_OVER);
+                regs[3] = tmp;
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER, tmp | 0x0600);
+
+                regs[4] = b43_phy_read(dev, B43_NPHY_BBCFG);
+                b43_phy_mask(dev, B43_NPHY_BBCFG, (u16)~B43_NPHY_BBCFG_RSTRX);
+
+                tmp = b43_ntab_read(dev, B43_NTAB16(8, 3));
+                regs[5] = tmp;
+                b43_ntab_write(dev, B43_NTAB16(8, 3), 0);
+
+                tmp = b43_ntab_read(dev, B43_NTAB16(8, 19));
+                regs[6] = tmp;
+                b43_ntab_write(dev, B43_NTAB16(8, 19), 0);
+                regs[7] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC1);
+                regs[8] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC2);
+
+                b43_nphy_rf_control_intc_override(dev, 2, 1, 3);
+                b43_nphy_rf_control_intc_override(dev, 1, 2, 1);
+                b43_nphy_rf_control_intc_override(dev, 1, 8, 2);
+
+                regs[9] = b43_phy_read(dev, B43_NPHY_PAPD_EN0);
+                regs[10] = b43_phy_read(dev, B43_NPHY_PAPD_EN1);
+                b43_phy_mask(dev, B43_NPHY_PAPD_EN0, ~0x0001);
+                b43_phy_mask(dev, B43_NPHY_PAPD_EN1, ~0x0001);
+        } else {
+                b43_phy_maskset(dev, B43_NPHY_AFECTL_C1, 0x0FFF, 0xA000);
+                b43_phy_maskset(dev, B43_NPHY_AFECTL_C2, 0x0FFF, 0xA000);
+                tmp = b43_phy_read(dev, B43_NPHY_AFECTL_OVER);
+                regs[2] = tmp;
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER, tmp | 0x3000);
+                tmp = b43_ntab_read(dev, B43_NTAB16(8, 2));
+                regs[3] = tmp;
+                tmp |= 0x2000;
+                b43_ntab_write(dev, B43_NTAB16(8, 2), tmp);
+                tmp = b43_ntab_read(dev, B43_NTAB16(8, 18));
+                regs[4] = tmp;
+                tmp |= 0x2000;
+                b43_ntab_write(dev, B43_NTAB16(8, 18), tmp);
+                regs[5] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC1);
+                regs[6] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC2);
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
+                        tmp = 0x0180;
+                else
+                        tmp = 0x0120;
+                b43_phy_write(dev, B43_NPHY_RFCTL_INTC1, tmp);
+                b43_phy_write(dev, B43_NPHY_RFCTL_INTC2, tmp);
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/SaveCal */
+static void b43_nphy_save_cal(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        struct b43_phy_n_iq_comp *rxcal_coeffs = NULL;
+        u16 *txcal_radio_regs = NULL;
+        u8 *iqcal_chanspec;
+        u16 *table = NULL;
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 1);
+
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                rxcal_coeffs = &nphy->cal_cache.rxcal_coeffs_2G;
+                txcal_radio_regs = nphy->cal_cache.txcal_radio_regs_2G;
+                iqcal_chanspec = &nphy->iqcal_chanspec_2G;
+                table = nphy->cal_cache.txcal_coeffs_2G;
+        } else {
+                rxcal_coeffs = &nphy->cal_cache.rxcal_coeffs_5G;
+                txcal_radio_regs = nphy->cal_cache.txcal_radio_regs_5G;
+                iqcal_chanspec = &nphy->iqcal_chanspec_5G;
+                table = nphy->cal_cache.txcal_coeffs_5G;
+        }
+
+        b43_nphy_rx_iq_coeffs(dev, false, rxcal_coeffs);
+        /* TODO use some definitions */
+        if (dev->phy.rev >= 3) {
+                txcal_radio_regs[0] = b43_radio_read(dev, 0x2021);
+                txcal_radio_regs[1] = b43_radio_read(dev, 0x2022);
+                txcal_radio_regs[2] = b43_radio_read(dev, 0x3021);
+                txcal_radio_regs[3] = b43_radio_read(dev, 0x3022);
+                txcal_radio_regs[4] = b43_radio_read(dev, 0x2023);
+                txcal_radio_regs[5] = b43_radio_read(dev, 0x2024);
+                txcal_radio_regs[6] = b43_radio_read(dev, 0x3023);
+                txcal_radio_regs[7] = b43_radio_read(dev, 0x3024);
+        } else {
+                txcal_radio_regs[0] = b43_radio_read(dev, 0x8B);
+                txcal_radio_regs[1] = b43_radio_read(dev, 0xBA);
+                txcal_radio_regs[2] = b43_radio_read(dev, 0x8D);
+                txcal_radio_regs[3] = b43_radio_read(dev, 0xBC);
+        }
+        *iqcal_chanspec = nphy->radio_chanspec;
+        b43_ntab_write_bulk(dev, B43_NTAB16(15, 80), 8, table);
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 0);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RestoreCal */
+static void b43_nphy_restore_cal(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        u16 coef[4];
+        u16 *loft = NULL;
+        u16 *table = NULL;
+
+        int i;
+        u16 *txcal_radio_regs = NULL;
+        struct b43_phy_n_iq_comp *rxcal_coeffs = NULL;
+
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                if (nphy->iqcal_chanspec_2G == 0)
+                        return;
+                table = nphy->cal_cache.txcal_coeffs_2G;
+                loft = &nphy->cal_cache.txcal_coeffs_2G[5];
+        } else {
+                if (nphy->iqcal_chanspec_5G == 0)
+                        return;
+                table = nphy->cal_cache.txcal_coeffs_5G;
+                loft = &nphy->cal_cache.txcal_coeffs_5G[5];
+        }
+
+        b43_ntab_write_bulk(dev, B43_NTAB16(15, 80), 4, table);
+
+        for (i = 0; i < 4; i++) {
+                if (dev->phy.rev >= 3)
+                        table[i] = coef[i];
+                else
+                        coef[i] = 0;
+        }
+
+        b43_ntab_write_bulk(dev, B43_NTAB16(15, 88), 4, coef);
+        b43_ntab_write_bulk(dev, B43_NTAB16(15, 85), 2, loft);
+        b43_ntab_write_bulk(dev, B43_NTAB16(15, 93), 2, loft);
+
+        if (dev->phy.rev < 2)
+                b43_nphy_tx_iq_workaround(dev);
+
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                txcal_radio_regs = nphy->cal_cache.txcal_radio_regs_2G;
+                rxcal_coeffs = &nphy->cal_cache.rxcal_coeffs_2G;
+        } else {
+                txcal_radio_regs = nphy->cal_cache.txcal_radio_regs_5G;
+                rxcal_coeffs = &nphy->cal_cache.rxcal_coeffs_5G;
+        }
+
+        /* TODO use some definitions */
+        if (dev->phy.rev >= 3) {
+                b43_radio_write(dev, 0x2021, txcal_radio_regs[0]);
+                b43_radio_write(dev, 0x2022, txcal_radio_regs[1]);
+                b43_radio_write(dev, 0x3021, txcal_radio_regs[2]);
+                b43_radio_write(dev, 0x3022, txcal_radio_regs[3]);
+                b43_radio_write(dev, 0x2023, txcal_radio_regs[4]);
+                b43_radio_write(dev, 0x2024, txcal_radio_regs[5]);
+                b43_radio_write(dev, 0x3023, txcal_radio_regs[6]);
+                b43_radio_write(dev, 0x3024, txcal_radio_regs[7]);
+        } else {
+                b43_radio_write(dev, 0x8B, txcal_radio_regs[0]);
+                b43_radio_write(dev, 0xBA, txcal_radio_regs[1]);
+                b43_radio_write(dev, 0x8D, txcal_radio_regs[2]);
+                b43_radio_write(dev, 0xBC, txcal_radio_regs[3]);
+        }
+        b43_nphy_rx_iq_coeffs(dev, true, rxcal_coeffs);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/CalTxIqlo */
+static int b43_nphy_cal_tx_iq_lo(struct b43_wldev *dev,
+                                struct nphy_txgains target,
+                                bool full, bool mphase)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        int i;
+        int error = 0;
+        int freq;
+        bool avoid = false;
+        u8 length;
+        u16 tmp, core, type, count, max, numb, last, cmd;
+        const u16 *table;
+        bool phy6or5x;
+
+        u16 buffer[11];
+        u16 diq_start = 0;
+        u16 save[2];
+        u16 gain[2];
+        struct nphy_iqcal_params params[2];
+        bool updated[2] = { };
+
+        b43_nphy_stay_in_carrier_search(dev, true);
+
+        if (dev->phy.rev >= 4) {
+                avoid = nphy->hang_avoid;
+                nphy->hang_avoid = 0;
+        }
+
+        b43_ntab_read_bulk(dev, B43_NTAB16(7, 0x110), 2, save);
+
+        for (i = 0; i < 2; i++) {
+                b43_nphy_iq_cal_gain_params(dev, i, target, &params[i]);
+                gain[i] = params[i].cal_gain;
+        }
+
+        b43_ntab_write_bulk(dev, B43_NTAB16(7, 0x110), 2, gain);
+
+        b43_nphy_tx_cal_radio_setup(dev);
+        b43_nphy_tx_cal_phy_setup(dev);
+
+        phy6or5x = dev->phy.rev >= 6 ||
+                (dev->phy.rev == 5 && nphy->ipa2g_on &&
+                b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ);
+        if (phy6or5x) {
+                if (dev->phy.is_40mhz) {
+                        b43_ntab_write_bulk(dev, B43_NTAB16(15, 0), 18,
+                                        tbl_tx_iqlo_cal_loft_ladder_40);
+                        b43_ntab_write_bulk(dev, B43_NTAB16(15, 32), 18,
+                                        tbl_tx_iqlo_cal_iqimb_ladder_40);
+                } else {
+                        b43_ntab_write_bulk(dev, B43_NTAB16(15, 0), 18,
+                                        tbl_tx_iqlo_cal_loft_ladder_20);
+                        b43_ntab_write_bulk(dev, B43_NTAB16(15, 32), 18,
+                                        tbl_tx_iqlo_cal_iqimb_ladder_20);
+                }
+        }
+
+        b43_phy_write(dev, B43_NPHY_IQLOCAL_CMDGCTL, 0x8AA9);
+
+        if (!dev->phy.is_40mhz)
+                freq = 2500;
+        else
+                freq = 5000;
+
+        if (nphy->mphase_cal_phase_id > 2)
+                b43_nphy_run_samples(dev, (dev->phy.is_40mhz ? 40 : 20) * 8,
+                                        0xFFFF, 0, true, false);
+        else
+                error = b43_nphy_tx_tone(dev, freq, 250, true, false);
+
+        if (error == 0) {
+                if (nphy->mphase_cal_phase_id > 2) {
+                        table = nphy->mphase_txcal_bestcoeffs;
+                        length = 11;
+                        if (dev->phy.rev < 3)
+                                length -= 2;
+                } else {
+                        if (!full && nphy->txiqlocal_coeffsvalid) {
+                                table = nphy->txiqlocal_bestc;
+                                length = 11;
+                                if (dev->phy.rev < 3)
+                                        length -= 2;
+                        } else {
+                                full = true;
+                                if (dev->phy.rev >= 3) {
+                                        table = tbl_tx_iqlo_cal_startcoefs_nphyrev3;
+                                        length = B43_NTAB_TX_IQLO_CAL_STARTCOEFS_REV3;
+                                } else {
+                                        table = tbl_tx_iqlo_cal_startcoefs;
+                                        length = B43_NTAB_TX_IQLO_CAL_STARTCOEFS;
+                                }
+                        }
+                }
+
+                b43_ntab_write_bulk(dev, B43_NTAB16(15, 64), length, table);
+
+                if (full) {
+                        if (dev->phy.rev >= 3)
+                                max = B43_NTAB_TX_IQLO_CAL_CMDS_FULLCAL_REV3;
+                        else
+                                max = B43_NTAB_TX_IQLO_CAL_CMDS_FULLCAL;
+                } else {
+                        if (dev->phy.rev >= 3)
+                                max = B43_NTAB_TX_IQLO_CAL_CMDS_RECAL_REV3;
+                        else
+                                max = B43_NTAB_TX_IQLO_CAL_CMDS_RECAL;
+                }
+
+                if (mphase) {
+                        count = nphy->mphase_txcal_cmdidx;
+                        numb = min(max,
+                                (u16)(count + nphy->mphase_txcal_numcmds));
+                } else {
+                        count = 0;
+                        numb = max;
+                }
+
+                for (; count < numb; count++) {
+                        if (full) {
+                                if (dev->phy.rev >= 3)
+                                        cmd = tbl_tx_iqlo_cal_cmds_fullcal_nphyrev3[count];
+                                else
+                                        cmd = tbl_tx_iqlo_cal_cmds_fullcal[count];
+                        } else {
+                                if (dev->phy.rev >= 3)
+                                        cmd = tbl_tx_iqlo_cal_cmds_recal_nphyrev3[count];
+                                else
+                                        cmd = tbl_tx_iqlo_cal_cmds_recal[count];
+                        }
+
+                        core = (cmd & 0x3000) >> 12;
+                        type = (cmd & 0x0F00) >> 8;
+
+                        if (phy6or5x && updated[core] == 0) {
+                                b43_nphy_update_tx_cal_ladder(dev, core);
+                                updated[core] = 1;
+                        }
+
+                        tmp = (params[core].ncorr[type] << 8) | 0x66;
+                        b43_phy_write(dev, B43_NPHY_IQLOCAL_CMDNNUM, tmp);
+
+                        if (type == 1 || type == 3 || type == 4) {
+                                buffer[0] = b43_ntab_read(dev,
+                                                B43_NTAB16(15, 69 + core));
+                                diq_start = buffer[0];
+                                buffer[0] = 0;
+                                b43_ntab_write(dev, B43_NTAB16(15, 69 + core),
+                                                0);
+                        }
+
+                        b43_phy_write(dev, B43_NPHY_IQLOCAL_CMD, cmd);
+                        for (i = 0; i < 2000; i++) {
+                                tmp = b43_phy_read(dev, B43_NPHY_IQLOCAL_CMD);
+                                if (tmp & 0xC000)
+                                        break;
+                                udelay(10);
+                        }
+
+                        b43_ntab_read_bulk(dev, B43_NTAB16(15, 96), length,
+                                                buffer);
+                        b43_ntab_write_bulk(dev, B43_NTAB16(15, 64), length,
+                                                buffer);
+
+                        if (type == 1 || type == 3 || type == 4)
+                                buffer[0] = diq_start;
+                }
+
+                if (mphase)
+                        nphy->mphase_txcal_cmdidx = (numb >= max) ? 0 : numb;
+
+                last = (dev->phy.rev < 3) ? 6 : 7;
+
+                if (!mphase || nphy->mphase_cal_phase_id == last) {
+                        b43_ntab_write_bulk(dev, B43_NTAB16(15, 96), 4, buffer);
+                        b43_ntab_read_bulk(dev, B43_NTAB16(15, 80), 4, buffer);
+                        if (dev->phy.rev < 3) {
+                                buffer[0] = 0;
+                                buffer[1] = 0;
+                                buffer[2] = 0;
+                                buffer[3] = 0;
+                        }
+                        b43_ntab_write_bulk(dev, B43_NTAB16(15, 88), 4,
+                                                buffer);
+                        b43_ntab_write_bulk(dev, B43_NTAB16(15, 101), 2,
+                                                buffer);
+                        b43_ntab_write_bulk(dev, B43_NTAB16(15, 85), 2,
+                                                buffer);
+                        b43_ntab_write_bulk(dev, B43_NTAB16(15, 93), 2,
+                                                buffer);
+                        length = 11;
+                        if (dev->phy.rev < 3)
+                                length -= 2;
+                        b43_ntab_read_bulk(dev, B43_NTAB16(15, 96), length,
+                                                nphy->txiqlocal_bestc);
+                        nphy->txiqlocal_coeffsvalid = true;
+                        /* TODO: Set nphy->txiqlocal_chanspec to
+                                the current channel */
+                } else {
+                        length = 11;
+                        if (dev->phy.rev < 3)
+                                length -= 2;
+                        b43_ntab_read_bulk(dev, B43_NTAB16(15, 96), length,
+                                                nphy->mphase_txcal_bestcoeffs);
+                }
+
+                b43_nphy_stop_playback(dev);
+                b43_phy_write(dev, B43_NPHY_IQLOCAL_CMDGCTL, 0);
+        }
+
+        b43_nphy_tx_cal_phy_cleanup(dev);
+        b43_ntab_write_bulk(dev, B43_NTAB16(7, 0x110), 2, save);
+
+        if (dev->phy.rev < 2 && (!mphase || nphy->mphase_cal_phase_id == last))
+                b43_nphy_tx_iq_workaround(dev);
+
+        if (dev->phy.rev >= 4)
+                nphy->hang_avoid = avoid;
+
+        b43_nphy_stay_in_carrier_search(dev, false);
+
+        return error;
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/ReapplyTxCalCoeffs */
+static void b43_nphy_reapply_tx_cal_coeffs(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        u8 i;
+        u16 buffer[7];
+        bool equal = true;
+
+        if (!nphy->txiqlocal_coeffsvalid || 1 /* FIXME */)
+                return;
+
+        b43_ntab_read_bulk(dev, B43_NTAB16(15, 80), 7, buffer);
+        for (i = 0; i < 4; i++) {
+                if (buffer[i] != nphy->txiqlocal_bestc[i]) {
+                        equal = false;
+                        break;
+                }
+        }
+
+        if (!equal) {
+                b43_ntab_write_bulk(dev, B43_NTAB16(15, 80), 4,
+                                        nphy->txiqlocal_bestc);
+                for (i = 0; i < 4; i++)
+                        buffer[i] = 0;
+                b43_ntab_write_bulk(dev, B43_NTAB16(15, 88), 4,
+                                        buffer);
+                b43_ntab_write_bulk(dev, B43_NTAB16(15, 85), 2,
+                                        &nphy->txiqlocal_bestc[5]);
+                b43_ntab_write_bulk(dev, B43_NTAB16(15, 93), 2,
+                                        &nphy->txiqlocal_bestc[5]);
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/CalRxIqRev2 */
+static int b43_nphy_rev2_cal_rx_iq(struct b43_wldev *dev,
+                        struct nphy_txgains target, u8 type, bool debug)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        int i, j, index;
+        u8 rfctl[2];
+        u8 afectl_core;
+        u16 tmp[6];
+        u16 cur_hpf1, cur_hpf2, cur_lna;
+        u32 real, imag;
+        enum ieee80211_band band;
+
+        u8 use;
+        u16 cur_hpf;
+        u16 lna[3] = { 3, 3, 1 };
+        u16 hpf1[3] = { 7, 2, 0 };
+        u16 hpf2[3] = { 2, 0, 0 };
+        u32 power[3] = { };
+        u16 gain_save[2];
+        u16 cal_gain[2];
+        struct nphy_iqcal_params cal_params[2];
+        struct nphy_iq_est est;
+        int ret = 0;
+        bool playtone = true;
+        int desired = 13;
+
+        b43_nphy_stay_in_carrier_search(dev, 1);
+
+        if (dev->phy.rev < 2)
+                b43_nphy_reapply_tx_cal_coeffs(dev);
+        b43_ntab_read_bulk(dev, B43_NTAB16(7, 0x110), 2, gain_save);
+        for (i = 0; i < 2; i++) {
+                b43_nphy_iq_cal_gain_params(dev, i, target, &cal_params[i]);
+                cal_gain[i] = cal_params[i].cal_gain;
+        }
+        b43_ntab_write_bulk(dev, B43_NTAB16(7, 0x110), 2, cal_gain);
+
+        for (i = 0; i < 2; i++) {
+                if (i == 0) {
+                        rfctl[0] = B43_NPHY_RFCTL_INTC1;
+                        rfctl[1] = B43_NPHY_RFCTL_INTC2;
+                        afectl_core = B43_NPHY_AFECTL_C1;
+                } else {
+                        rfctl[0] = B43_NPHY_RFCTL_INTC2;
+                        rfctl[1] = B43_NPHY_RFCTL_INTC1;
+                        afectl_core = B43_NPHY_AFECTL_C2;
+                }
+
+                tmp[1] = b43_phy_read(dev, B43_NPHY_RFSEQCA);
+                tmp[2] = b43_phy_read(dev, afectl_core);
+                tmp[3] = b43_phy_read(dev, B43_NPHY_AFECTL_OVER);
+                tmp[4] = b43_phy_read(dev, rfctl[0]);
+                tmp[5] = b43_phy_read(dev, rfctl[1]);
+
+                b43_phy_maskset(dev, B43_NPHY_RFSEQCA,
+                                (u16)~B43_NPHY_RFSEQCA_RXDIS,
+                                ((1 - i) << B43_NPHY_RFSEQCA_RXDIS_SHIFT));
+                b43_phy_maskset(dev, B43_NPHY_RFSEQCA, ~B43_NPHY_RFSEQCA_TXEN,
+                                (1 - i));
+                b43_phy_set(dev, afectl_core, 0x0006);
+                b43_phy_set(dev, B43_NPHY_AFECTL_OVER, 0x0006);
+
+                band = b43_current_band(dev->wl);
+
+                if (nphy->rxcalparams & 0xFF000000) {
+                        if (band == IEEE80211_BAND_5GHZ)
+                                b43_phy_write(dev, rfctl[0], 0x140);
+                        else
+                                b43_phy_write(dev, rfctl[0], 0x110);
+                } else {
+                        if (band == IEEE80211_BAND_5GHZ)
+                                b43_phy_write(dev, rfctl[0], 0x180);
+                        else
+                                b43_phy_write(dev, rfctl[0], 0x120);
+                }
+
+                if (band == IEEE80211_BAND_5GHZ)
+                        b43_phy_write(dev, rfctl[1], 0x148);
+                else
+                        b43_phy_write(dev, rfctl[1], 0x114);
+
+                if (nphy->rxcalparams & 0x10000) {
+                        b43_radio_maskset(dev, B2055_C1_GENSPARE2, 0xFC,
+                                        (i + 1));
+                        b43_radio_maskset(dev, B2055_C2_GENSPARE2, 0xFC,
+                                        (2 - i));
+                }
+
+                for (j = 0; i < 4; j++) {
+                        if (j < 3) {
+                                cur_lna = lna[j];
+                                cur_hpf1 = hpf1[j];
+                                cur_hpf2 = hpf2[j];
+                        } else {
+                                if (power[1] > 10000) {
+                                        use = 1;
+                                        cur_hpf = cur_hpf1;
+                                        index = 2;
+                                } else {
+                                        if (power[0] > 10000) {
+                                                use = 1;
+                                                cur_hpf = cur_hpf1;
+                                                index = 1;
+                                        } else {
+                                                index = 0;
+                                                use = 2;
+                                                cur_hpf = cur_hpf2;
+                                        }
+                                }
+                                cur_lna = lna[index];
+                                cur_hpf1 = hpf1[index];
+                                cur_hpf2 = hpf2[index];
+                                cur_hpf += desired - hweight32(power[index]);
+                                cur_hpf = clamp_val(cur_hpf, 0, 10);
+                                if (use == 1)
+                                        cur_hpf1 = cur_hpf;
+                                else
+                                        cur_hpf2 = cur_hpf;
+                        }
+
+                        tmp[0] = ((cur_hpf2 << 8) | (cur_hpf1 << 4) |
+                                        (cur_lna << 2));
+                        b43_nphy_rf_control_override(dev, 0x400, tmp[0], 3,
+                                                                        false);
+                        b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RESET2RX);
+                        b43_nphy_stop_playback(dev);
+
+                        if (playtone) {
+                                ret = b43_nphy_tx_tone(dev, 4000,
+                                                (nphy->rxcalparams & 0xFFFF),
+                                                false, false);
+                                playtone = false;
+                        } else {
+                                b43_nphy_run_samples(dev, 160, 0xFFFF, 0,
+                                                        false, false);
+                        }
+
+                        if (ret == 0) {
+                                if (j < 3) {
+                                        b43_nphy_rx_iq_est(dev, &est, 1024, 32,
+                                                                        false);
+                                        if (i == 0) {
+                                                real = est.i0_pwr;
+                                                imag = est.q0_pwr;
+                                        } else {
+                                                real = est.i1_pwr;
+                                                imag = est.q1_pwr;
+                                        }
+                                        power[i] = ((real + imag) / 1024) + 1;
+                                } else {
+                                        b43_nphy_calc_rx_iq_comp(dev, 1 << i);
+                                }
+                                b43_nphy_stop_playback(dev);
+                        }
+
+                        if (ret != 0)
+                                break;
+                }
+
+                b43_radio_mask(dev, B2055_C1_GENSPARE2, 0xFC);
+                b43_radio_mask(dev, B2055_C2_GENSPARE2, 0xFC);
+                b43_phy_write(dev, rfctl[1], tmp[5]);
+                b43_phy_write(dev, rfctl[0], tmp[4]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER, tmp[3]);
+                b43_phy_write(dev, afectl_core, tmp[2]);
+                b43_phy_write(dev, B43_NPHY_RFSEQCA, tmp[1]);
+
+                if (ret != 0)
+                        break;
+        }
+
+        b43_nphy_rf_control_override(dev, 0x400, 0, 3, true);
+        b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RESET2RX);
+        b43_ntab_write_bulk(dev, B43_NTAB16(7, 0x110), 2, gain_save);
+
+        b43_nphy_stay_in_carrier_search(dev, 0);
+
+        return ret;
+}
+
+static int b43_nphy_rev3_cal_rx_iq(struct b43_wldev *dev,
+                        struct nphy_txgains target, u8 type, bool debug)
+{
+        return -1;
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/CalRxIq */
+static int b43_nphy_cal_rx_iq(struct b43_wldev *dev,
+                        struct nphy_txgains target, u8 type, bool debug)
+{
+        if (dev->phy.rev >= 3)
+                return b43_nphy_rev3_cal_rx_iq(dev, target, type, debug);
+        else
+                return b43_nphy_rev2_cal_rx_iq(dev, target, type, debug);
+}
+
+/*
+ * Init N-PHY
+ * http://bcm-v4.sipsolutions.net/802.11/PHY/Init/N
+ */
 int b43_phy_initn(struct b43_wldev *dev)
 {
+        struct ssb_bus *bus = dev->dev->bus;
         struct b43_phy *phy = &dev->phy;
+        struct b43_phy_n *nphy = phy->n;
+        u8 tx_pwr_state;
+        struct nphy_txgains target;
         u16 tmp;
+        enum ieee80211_band tmp2;
+        bool do_rssi_cal;
 
-        //TODO: Spectral management
+        u16 clip[2];
+        bool do_cal = false;
+
+        if ((dev->phy.rev >= 3) &&
+           (bus->sprom.boardflags_lo & B43_BFL_EXTLNA) &&
+           (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)) {
+                chipco_set32(&dev->dev->bus->chipco, SSB_CHIPCO_CHIPCTL, 0x40);
+        }
+        nphy->deaf_count = 0;
         b43_nphy_tables_init(dev);
+        nphy->crsminpwr_adjusted = false;
+        nphy->noisevars_adjusted = false;
 
         /* Clear all overrides */
-        b43_phy_write(dev, B43_NPHY_RFCTL_OVER, 0);
+        if (dev->phy.rev >= 3) {
+                b43_phy_write(dev, B43_NPHY_TXF_40CO_B1S1, 0);
+                b43_phy_write(dev, B43_NPHY_RFCTL_OVER, 0);
+                b43_phy_write(dev, B43_NPHY_TXF_40CO_B1S0, 0);
+                b43_phy_write(dev, B43_NPHY_TXF_40CO_B32S1, 0);
+        } else {
+                b43_phy_write(dev, B43_NPHY_RFCTL_OVER, 0);
+        }
         b43_phy_write(dev, B43_NPHY_RFCTL_INTC1, 0);
         b43_phy_write(dev, B43_NPHY_RFCTL_INTC2, 0);
-        b43_phy_write(dev, B43_NPHY_RFCTL_INTC3, 0);
-        b43_phy_write(dev, B43_NPHY_RFCTL_INTC4, 0);
+        if (dev->phy.rev < 6) {
+                b43_phy_write(dev, B43_NPHY_RFCTL_INTC3, 0);
+                b43_phy_write(dev, B43_NPHY_RFCTL_INTC4, 0);
+        }
         b43_phy_mask(dev, B43_NPHY_RFSEQMODE,
                      ~(B43_NPHY_RFSEQMODE_CAOVER |
                        B43_NPHY_RFSEQMODE_TROVER));
+        if (dev->phy.rev >= 3)
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER1, 0);
         b43_phy_write(dev, B43_NPHY_AFECTL_OVER, 0);
 
-        tmp = (phy->rev < 2) ? 64 : 59;
-        b43_phy_maskset(dev, B43_NPHY_BPHY_CTL3,
-                        ~B43_NPHY_BPHY_CTL3_SCALE,
-                        tmp << B43_NPHY_BPHY_CTL3_SCALE_SHIFT);
-
+        if (dev->phy.rev <= 2) {
+                tmp = (dev->phy.rev == 2) ? 0x3B : 0x40;
+                b43_phy_maskset(dev, B43_NPHY_BPHY_CTL3,
+                                ~B43_NPHY_BPHY_CTL3_SCALE,
+                                tmp << B43_NPHY_BPHY_CTL3_SCALE_SHIFT);
+        }
         b43_phy_write(dev, B43_NPHY_AFESEQ_TX2RX_PUD_20M, 0x20);
         b43_phy_write(dev, B43_NPHY_AFESEQ_TX2RX_PUD_40M, 0x20);
 
-        b43_phy_write(dev, B43_NPHY_TXREALFD, 184);
-        b43_phy_write(dev, B43_NPHY_MIMO_CRSTXEXT, 200);
-        b43_phy_write(dev, B43_NPHY_PLOAD_CSENSE_EXTLEN, 80);
-        b43_phy_write(dev, B43_NPHY_C2_BCLIPBKOFF, 511);
+        if (bus->sprom.boardflags2_lo & 0x100 ||
+            (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
+             bus->boardinfo.type == 0x8B))
+                b43_phy_write(dev, B43_NPHY_TXREALFD, 0xA0);
+        else
+                b43_phy_write(dev, B43_NPHY_TXREALFD, 0xB8);
+        b43_phy_write(dev, B43_NPHY_MIMO_CRSTXEXT, 0xC8);
+        b43_phy_write(dev, B43_NPHY_PLOAD_CSENSE_EXTLEN, 0x50);
+        b43_phy_write(dev, B43_NPHY_TXRIFS_FRDEL, 0x30);
 
-        //TODO MIMO-Config
-        //TODO Update TX/RX chain
+        b43_nphy_update_mimo_config(dev, nphy->preamble_override);
+        b43_nphy_update_txrx_chain(dev);
 
         if (phy->rev < 2) {
                 b43_phy_write(dev, B43_NPHY_DUP40_GFBL, 0xAA8);
                 b43_phy_write(dev, B43_NPHY_DUP40_BL, 0x9A4);
         }
+
+        tmp2 = b43_current_band(dev->wl);
+        if ((nphy->ipa2g_on && tmp2 == IEEE80211_BAND_2GHZ) ||
+            (nphy->ipa5g_on && tmp2 == IEEE80211_BAND_5GHZ)) {
+                b43_phy_set(dev, B43_NPHY_PAPD_EN0, 0x1);
+                b43_phy_maskset(dev, B43_NPHY_EPS_TABLE_ADJ0, 0x007F,
+                                nphy->papd_epsilon_offset[0] << 7);
+                b43_phy_set(dev, B43_NPHY_PAPD_EN1, 0x1);
+                b43_phy_maskset(dev, B43_NPHY_EPS_TABLE_ADJ1, 0x007F,
+                                nphy->papd_epsilon_offset[1] << 7);
+                b43_nphy_int_pa_set_tx_dig_filters(dev);
+        } else if (phy->rev >= 5) {
+                b43_nphy_ext_pa_set_tx_dig_filters(dev);
+        }
+
         b43_nphy_workarounds(dev);
-        b43_nphy_reset_cca(dev);
 
-        ssb_write32(dev->dev, SSB_TMSLOW,
-                    ssb_read32(dev->dev, SSB_TMSLOW) | B43_TMSLOW_MACPHYCLKEN);
+        /* Reset CCA, in init code it differs a little from standard way */
+        b43_nphy_bmac_clock_fgc(dev, 1);
+        tmp = b43_phy_read(dev, B43_NPHY_BBCFG);
+        b43_phy_write(dev, B43_NPHY_BBCFG, tmp | B43_NPHY_BBCFG_RSTCCA);
+        b43_phy_write(dev, B43_NPHY_BBCFG, tmp & ~B43_NPHY_BBCFG_RSTCCA);
+        b43_nphy_bmac_clock_fgc(dev, 0);
+
+        /* TODO N PHY MAC PHY Clock Set with argument 1 */
+
+        b43_nphy_pa_override(dev, false);
         b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RX2TX);
         b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RESET2RX);
+        b43_nphy_pa_override(dev, true);
+
+        b43_nphy_classifier(dev, 0, 0);
+        b43_nphy_read_clip_detection(dev, clip);
+        tx_pwr_state = nphy->txpwrctrl;
+        /* TODO N PHY TX power control with argument 0
+                (turning off power control) */
+        /* TODO Fix the TX Power Settings */
+        /* TODO N PHY TX Power Control Idle TSSI */
+        /* TODO N PHY TX Power Control Setup */
+
+        if (phy->rev >= 3) {
+                /* TODO */
+        } else {
+                b43_ntab_write_bulk(dev, B43_NTAB32(26, 192), 128,
+                                        b43_ntab_tx_gain_rev0_1_2);
+                b43_ntab_write_bulk(dev, B43_NTAB32(27, 192), 128,
+                                        b43_ntab_tx_gain_rev0_1_2);
+        }
+
+        if (nphy->phyrxchain != 3)
+                ;/* TODO N PHY RX Core Set State with phyrxchain as argument */
+        if (nphy->mphase_cal_phase_id > 0)
+                ;/* TODO PHY Periodic Calibration Multi-Phase Restart */
+
+        do_rssi_cal = false;
+        if (phy->rev >= 3) {
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                        do_rssi_cal = (nphy->rssical_chanspec_2G == 0);
+                else
+                        do_rssi_cal = (nphy->rssical_chanspec_5G == 0);
+
+                if (do_rssi_cal)
+                        b43_nphy_rssi_cal(dev);
+                else
+                        b43_nphy_restore_rssi_cal(dev);
+        } else {
+                b43_nphy_rssi_cal(dev);
+        }
+
+        if (!((nphy->measure_hold & 0x6) != 0)) {
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                        do_cal = (nphy->iqcal_chanspec_2G == 0);
+                else
+                        do_cal = (nphy->iqcal_chanspec_5G == 0);
+
+                if (nphy->mute)
+                        do_cal = false;
+
+                if (do_cal) {
+                        target = b43_nphy_get_tx_gains(dev);
+
+                        if (nphy->antsel_type == 2)
+                                ;/*TODO NPHY Superswitch Init with argument 1*/
+                        if (nphy->perical != 2) {
+                                b43_nphy_rssi_cal(dev);
+                                if (phy->rev >= 3) {
+                                        nphy->cal_orig_pwr_idx[0] =
+                                            nphy->txpwrindex[0].index_internal;
+                                        nphy->cal_orig_pwr_idx[1] =
+                                            nphy->txpwrindex[1].index_internal;
+                                        /* TODO N PHY Pre Calibrate TX Gain */
+                                        target = b43_nphy_get_tx_gains(dev);
+                                }
+                        }
+                }
+        }
+
+        if (!b43_nphy_cal_tx_iq_lo(dev, target, true, false)) {
+                if (b43_nphy_cal_rx_iq(dev, target, 2, 0) == 0)
+                        b43_nphy_save_cal(dev);
+                else if (nphy->mphase_cal_phase_id == 0)
+                        ;/* N PHY Periodic Calibration with argument 3 */
+        } else {
+                b43_nphy_restore_cal(dev);
+        }
 
-        b43_phy_read(dev, B43_NPHY_CLASSCTL); /* dummy read */
-        //TODO read core1/2 clip1 thres regs
-
-        if (1 /* FIXME Band is 2.4GHz */)
-                b43_nphy_bphy_init(dev);
-        //TODO disable TX power control
-        //TODO Fix the TX power settings
-        //TODO Init periodic calibration with reason 3
-        b43_nphy_rssi_cal(dev, 2);
-        b43_nphy_rssi_cal(dev, 0);
-        b43_nphy_rssi_cal(dev, 1);
-        //TODO get TX gain
-        //TODO init superswitch
-        //TODO calibrate LO
-        //TODO idle TSSI TX pctl
-        //TODO TX power control power setup
-        //TODO table writes
-        //TODO TX power control coefficients
-        //TODO enable TX power control
-        //TODO control antenna selection
-        //TODO init radar detection
-        //TODO reset channel if changed
+        b43_nphy_tx_pwr_ctrl_coef_setup(dev);
+        /* TODO N PHY TX Power Control Enable with argument tx_pwr_state */
+        b43_phy_write(dev, B43_NPHY_TXMACIF_HOLDOFF, 0x0015);
+        b43_phy_write(dev, B43_NPHY_TXMACDELAY, 0x0320);
+        if (phy->rev >= 3 && phy->rev <= 6)
+                b43_phy_write(dev, B43_NPHY_PLOAD_CSENSE_EXTLEN, 0x0014);
+        b43_nphy_tx_lp_fbw(dev);
+        if (phy->rev >= 3)
+                b43_nphy_spur_workaround(dev);
 
         b43err(dev->wl, "IEEE 802.11n devices are not supported, yet.\n");
         return 0;
diff --git a/drivers/net/wireless/b43/phy_n.h b/drivers/net/wireless/b43/phy_n.h
index 1749aef4147d..403aad3f894f 100644
--- a/drivers/net/wireless/b43/phy_n.h
+++ b/drivers/net/wireless/b43/phy_n.h
@@ -231,6 +231,7 @@
 #define B43_NPHY_C2_TXIQ_COMP_OFF               B43_PHY_N(0x088) /* Core 2 TX I/Q comp offset */
 #define B43_NPHY_C1_TXCTL                       B43_PHY_N(0x08B) /* Core 1 TX control */
 #define B43_NPHY_C2_TXCTL                       B43_PHY_N(0x08C) /* Core 2 TX control */
+#define B43_NPHY_AFECTL_OVER1                   B43_PHY_N(0x08F) /* AFE control override 1 */
 #define B43_NPHY_SCRAM_SIGCTL                   B43_PHY_N(0x090) /* Scram signal control */
 #define  B43_NPHY_SCRAM_SIGCTL_INITST           0x007F /* Initial state value */
 #define  B43_NPHY_SCRAM_SIGCTL_INITST_SHIFT     0
@@ -705,6 +706,10 @@
 #define B43_NPHY_TXPCTL_INIT                    B43_PHY_N(0x222) /* TX power controll init */
 #define  B43_NPHY_TXPCTL_INIT_PIDXI1            0x00FF /* Power index init 1 */
 #define  B43_NPHY_TXPCTL_INIT_PIDXI1_SHIFT      0
+#define B43_NPHY_PAPD_EN0                       B43_PHY_N(0x297) /* PAPD Enable0 TBD */
+#define B43_NPHY_EPS_TABLE_ADJ0                 B43_PHY_N(0x298) /* EPS Table Adj0 TBD */
+#define B43_NPHY_PAPD_EN1                       B43_PHY_N(0x29B) /* PAPD Enable1 TBD */
+#define B43_NPHY_EPS_TABLE_ADJ1                 B43_PHY_N(0x29C) /* EPS Table Adj1 TBD */
 
 
 
@@ -919,8 +924,99 @@
 
 struct b43_wldev;
 
+struct b43_phy_n_iq_comp {
+        s16 a0;
+        s16 b0;
+        s16 a1;
+        s16 b1;
+};
+
+struct b43_phy_n_rssical_cache {
+        u16 rssical_radio_regs_2G[2];
+        u16 rssical_phy_regs_2G[12];
+
+        u16 rssical_radio_regs_5G[2];
+        u16 rssical_phy_regs_5G[12];
+};
+
+struct b43_phy_n_cal_cache {
+        u16 txcal_radio_regs_2G[8];
+        u16 txcal_coeffs_2G[8];
+        struct b43_phy_n_iq_comp rxcal_coeffs_2G;
+
+        u16 txcal_radio_regs_5G[8];
+        u16 txcal_coeffs_5G[8];
+        struct b43_phy_n_iq_comp rxcal_coeffs_5G;
+};
+
+struct b43_phy_n_txpwrindex {
+        s8 index;
+        s8 index_internal;
+        s8 index_internal_save;
+        u16 AfectrlOverride;
+        u16 AfeCtrlDacGain;
+        u16 rad_gain;
+        u8 bbmult;
+        u16 iqcomp_a;
+        u16 iqcomp_b;
+        u16 locomp;
+};
+
 struct b43_phy_n {
-        //TODO lots of missing stuff
+        u8 antsel_type;
+        u8 cal_orig_pwr_idx[2];
+        u8 measure_hold;
+        u8 phyrxchain;
+        u8 perical;
+        u32 deaf_count;
+        u32 rxcalparams;
+        bool hang_avoid;
+        bool mute;
+        u16 papd_epsilon_offset[2];
+        s32 preamble_override;
+        u32 bb_mult_save;
+        u16 radio_chanspec;
+
+        bool gain_boost;
+        bool elna_gain_config;
+        bool band5g_pwrgain;
+
+        u8 mphase_cal_phase_id;
+        u16 mphase_txcal_cmdidx;
+        u16 mphase_txcal_numcmds;
+        u16 mphase_txcal_bestcoeffs[11];
+
+        u8 txpwrctrl;
+        u16 txcal_bbmult;
+        u16 txiqlocal_bestc[11];
+        bool txiqlocal_coeffsvalid;
+        struct b43_phy_n_txpwrindex txpwrindex[2];
+
+        u8 txrx_chain;
+        u16 tx_rx_cal_phy_saveregs[11];
+        u16 tx_rx_cal_radio_saveregs[22];
+
+        u16 rfctrl_intc1_save;
+        u16 rfctrl_intc2_save;
+
+        u16 classifier_state;
+        u16 clip_state[2];
+
+        bool aband_spurwar_en;
+        bool gband_spurwar_en;
+
+        bool ipa2g_on;
+        u8 iqcal_chanspec_2G;
+        u8 rssical_chanspec_2G;
+
+        bool ipa5g_on;
+        u8 iqcal_chanspec_5G;
+        u8 rssical_chanspec_5G;
+
+        struct b43_phy_n_rssical_cache rssical_cache;
+        struct b43_phy_n_cal_cache cal_cache;
+        bool crsminpwr_adjusted;
+        bool noisevars_adjusted;
 };
 
 
diff --git a/drivers/net/wireless/b43/pio.c b/drivers/net/wireless/b43/pio.c
index 9b9044400218..aa12273ae716 100644
--- a/drivers/net/wireless/b43/pio.c
+++ b/drivers/net/wireless/b43/pio.c
@@ -31,6 +31,7 @@
 
 #include <linux/delay.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 
 
 static u16 generate_cookie(struct b43_pio_txqueue *q,
@@ -342,12 +343,15 @@ static u16 tx_write_2byte_queue(struct b43_pio_txqueue *q,
                         q->mmio_base + B43_PIO_TXDATA,
                         sizeof(u16));
         if (data_len & 1) {
+                u8 *tail = wl->pio_tailspace;
+                BUILD_BUG_ON(sizeof(wl->pio_tailspace) < 2);
+
                 /* Write the last byte. */
                 ctl &= ~B43_PIO_TXCTL_WRITEHI;
                 b43_piotx_write16(q, B43_PIO_TXCTL, ctl);
-                wl->tx_tail[0] = data[data_len - 1];
-                wl->tx_tail[1] = 0;
-                ssb_block_write(dev->dev, wl->tx_tail, 2,
+                tail[0] = data[data_len - 1];
+                tail[1] = 0;
+                ssb_block_write(dev->dev, tail, 2,
                                 q->mmio_base + B43_PIO_TXDATA,
                                 sizeof(u16));
         }
@@ -393,31 +397,31 @@ static u32 tx_write_4byte_queue(struct b43_pio_txqueue *q,
                         q->mmio_base + B43_PIO8_TXDATA,
                         sizeof(u32));
         if (data_len & 3) {
-                wl->tx_tail[3] = 0;
+                u8 *tail = wl->pio_tailspace;
+                BUILD_BUG_ON(sizeof(wl->pio_tailspace) < 4);
+
+                memset(tail, 0, 4);
                 /* Write the last few bytes. */
                 ctl &= ~(B43_PIO8_TXCTL_8_15 | B43_PIO8_TXCTL_16_23 |
                          B43_PIO8_TXCTL_24_31);
                 switch (data_len & 3) {
                 case 3:
                         ctl |= B43_PIO8_TXCTL_16_23 | B43_PIO8_TXCTL_8_15;
-                        wl->tx_tail[0] = data[data_len - 3];
-                        wl->tx_tail[1] = data[data_len - 2];
-                        wl->tx_tail[2] = data[data_len - 1];
+                        tail[0] = data[data_len - 3];
+                        tail[1] = data[data_len - 2];
+                        tail[2] = data[data_len - 1];
                         break;
                 case 2:
                         ctl |= B43_PIO8_TXCTL_8_15;
-                        wl->tx_tail[0] = data[data_len - 2];
-                        wl->tx_tail[1] = data[data_len - 1];
-                        wl->tx_tail[2] = 0;
+                        tail[0] = data[data_len - 2];
+                        tail[1] = data[data_len - 1];
                         break;
                 case 1:
-                        wl->tx_tail[0] = data[data_len - 1];
-                        wl->tx_tail[1] = 0;
-                        wl->tx_tail[2] = 0;
+                        tail[0] = data[data_len - 1];
                         break;
                 }
                 b43_piotx_write32(q, B43_PIO8_TXCTL, ctl);
-                ssb_block_write(dev->dev, wl->tx_tail, 4,
+                ssb_block_write(dev->dev, tail, 4,
                                 q->mmio_base + B43_PIO8_TXDATA,
                                 sizeof(u32));
         }
@@ -456,6 +460,7 @@ static int pio_tx_frame(struct b43_pio_txqueue *q,
         int err;
         unsigned int hdrlen;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct b43_txhdr *txhdr = (struct b43_txhdr *)wl->pio_scratchspace;
 
         B43_WARN_ON(list_empty(&q->packets_list));
         pack = list_entry(q->packets_list.next,
@@ -463,7 +468,9 @@ static int pio_tx_frame(struct b43_pio_txqueue *q,
 
         cookie = generate_cookie(q, pack);
         hdrlen = b43_txhdr_size(dev);
-        err = b43_generate_txhdr(dev, (u8 *)&wl->txhdr, skb,
+        BUILD_BUG_ON(sizeof(wl->pio_scratchspace) < sizeof(struct b43_txhdr));
+        B43_WARN_ON(sizeof(wl->pio_scratchspace) < hdrlen);
+        err = b43_generate_txhdr(dev, (u8 *)txhdr, skb,
                                  info, cookie);
         if (err)
                 return err;
@@ -477,9 +484,9 @@ static int pio_tx_frame(struct b43_pio_txqueue *q,
 
         pack->skb = skb;
         if (q->rev >= 8)
-                pio_tx_frame_4byte_queue(pack, (const u8 *)&wl->txhdr, hdrlen);
+                pio_tx_frame_4byte_queue(pack, (const u8 *)txhdr, hdrlen);
         else
-                pio_tx_frame_2byte_queue(pack, (const u8 *)&wl->txhdr, hdrlen);
+                pio_tx_frame_2byte_queue(pack, (const u8 *)txhdr, hdrlen);
 
         /* Remove it from the list of available packet slots.
          * It will be put back when we receive the status report. */
@@ -553,7 +560,6 @@ int b43_pio_tx(struct b43_wldev *dev, struct sk_buff *skb)
                 b43err(dev->wl, "PIO transmission failure\n");
                 goto out;
         }
-        q->nr_tx_packets++;
 
         B43_WARN_ON(q->buffer_used > q->buffer_size);
         if (((q->buffer_size - q->buffer_used) < roundup(2 + 2 + 6, 4)) ||
@@ -599,22 +605,6 @@ void b43_pio_handle_txstatus(struct b43_wldev *dev,
         }
 }
 
-void b43_pio_get_tx_stats(struct b43_wldev *dev,
-                          struct ieee80211_tx_queue_stats *stats)
-{
-        const int nr_queues = dev->wl->hw->queues;
-        struct b43_pio_txqueue *q;
-        int i;
-
-        for (i = 0; i < nr_queues; i++) {
-                q = select_queue_by_priority(dev, i);
-
-                stats[i].len = B43_PIO_MAX_NR_TXPACKETS - q->free_packet_slots;
-                stats[i].limit = B43_PIO_MAX_NR_TXPACKETS;
-                stats[i].count = q->nr_tx_packets;
-        }
-}
-
 /* Returns whether we should fetch another frame. */
 static bool pio_rx_frame(struct b43_pio_rxqueue *q)
 {
@@ -625,8 +615,11 @@ static bool pio_rx_frame(struct b43_pio_rxqueue *q)
         unsigned int i, padding;
         struct sk_buff *skb;
         const char *err_msg = NULL;
+        struct b43_rxhdr_fw4 *rxhdr =
+                (struct b43_rxhdr_fw4 *)wl->pio_scratchspace;
 
-        memset(&wl->rxhdr, 0, sizeof(wl->rxhdr));
+        BUILD_BUG_ON(sizeof(wl->pio_scratchspace) < sizeof(*rxhdr));
+        memset(rxhdr, 0, sizeof(*rxhdr));
 
         /* Check if we have data and wait for it to get ready. */
         if (q->rev >= 8) {
@@ -664,16 +657,16 @@ data_ready:
 
         /* Get the preamble (RX header) */
         if (q->rev >= 8) {
-                ssb_block_read(dev->dev, &wl->rxhdr, sizeof(wl->rxhdr),
+                ssb_block_read(dev->dev, rxhdr, sizeof(*rxhdr),
                                q->mmio_base + B43_PIO8_RXDATA,
                                sizeof(u32));
         } else {
-                ssb_block_read(dev->dev, &wl->rxhdr, sizeof(wl->rxhdr),
+                ssb_block_read(dev->dev, rxhdr, sizeof(*rxhdr),
                                q->mmio_base + B43_PIO_RXDATA,
                                sizeof(u16));
         }
         /* Sanity checks. */
-        len = le16_to_cpu(wl->rxhdr.frame_len);
+        len = le16_to_cpu(rxhdr->frame_len);
         if (unlikely(len > 0x700)) {
                 err_msg = "len > 0x700";
                 goto rx_error;
@@ -683,7 +676,7 @@ data_ready:
                 goto rx_error;
         }
 
-        macstat = le32_to_cpu(wl->rxhdr.mac_status);
+        macstat = le32_to_cpu(rxhdr->mac_status);
         if (macstat & B43_RX_MAC_FCSERR) {
                 if (!(q->dev->wl->filter_flags & FIF_FCSFAIL)) {
                         /* Drop frames with failed FCS. */
@@ -708,22 +701,25 @@ data_ready:
                                q->mmio_base + B43_PIO8_RXDATA,
                                sizeof(u32));
                 if (len & 3) {
+                        u8 *tail = wl->pio_tailspace;
+                        BUILD_BUG_ON(sizeof(wl->pio_tailspace) < 4);
+
                         /* Read the last few bytes. */
-                        ssb_block_read(dev->dev, wl->rx_tail, 4,
+                        ssb_block_read(dev->dev, tail, 4,
                                        q->mmio_base + B43_PIO8_RXDATA,
                                        sizeof(u32));
                         switch (len & 3) {
                         case 3:
-                                skb->data[len + padding - 3] = wl->rx_tail[0];
-                                skb->data[len + padding - 2] = wl->rx_tail[1];
-                                skb->data[len + padding - 1] = wl->rx_tail[2];
+                                skb->data[len + padding - 3] = tail[0];
+                                skb->data[len + padding - 2] = tail[1];
+                                skb->data[len + padding - 1] = tail[2];
                                 break;
                         case 2:
-                                skb->data[len + padding - 2] = wl->rx_tail[0];
-                                skb->data[len + padding - 1] = wl->rx_tail[1];
+                                skb->data[len + padding - 2] = tail[0];
+                                skb->data[len + padding - 1] = tail[1];
                                 break;
                         case 1:
-                                skb->data[len + padding - 1] = wl->rx_tail[0];
+                                skb->data[len + padding - 1] = tail[0];
                                 break;
                         }
                 }
@@ -732,22 +728,29 @@ data_ready:
                                q->mmio_base + B43_PIO_RXDATA,
                                sizeof(u16));
                 if (len & 1) {
+                        u8 *tail = wl->pio_tailspace;
+                        BUILD_BUG_ON(sizeof(wl->pio_tailspace) < 2);
+
                         /* Read the last byte. */
-                        ssb_block_read(dev->dev, wl->rx_tail, 2,
+                        ssb_block_read(dev->dev, tail, 2,
                                        q->mmio_base + B43_PIO_RXDATA,
                                        sizeof(u16));
-                        skb->data[len + padding - 1] = wl->rx_tail[0];
+                        skb->data[len + padding - 1] = tail[0];
                 }
         }
 
-        b43_rx(q->dev, skb, &wl->rxhdr);
+        b43_rx(q->dev, skb, rxhdr);
 
         return 1;
 
 rx_error:
         if (err_msg)
                 b43dbg(q->dev->wl, "PIO RX error: %s\n", err_msg);
-        b43_piorx_write16(q, B43_PIO_RXCTL, B43_PIO_RXCTL_DATARDY);
+        if (q->rev >= 8)
+                b43_piorx_write32(q, B43_PIO8_RXCTL, B43_PIO8_RXCTL_DATARDY);
+        else
+                b43_piorx_write16(q, B43_PIO_RXCTL, B43_PIO_RXCTL_DATARDY);
+
         return 1;
 }
 
diff --git a/drivers/net/wireless/b43/pio.h b/drivers/net/wireless/b43/pio.h
index 7dd649c9ddad..1e516147424f 100644
--- a/drivers/net/wireless/b43/pio.h
+++ b/drivers/net/wireless/b43/pio.h
@@ -55,8 +55,6 @@
 #define B43_PIO_MAX_NR_TXPACKETS        32
 
 
-#ifdef CONFIG_B43_PIO
-
 struct b43_pio_txpacket {
         /* Pointer to the TX queue we belong to. */
         struct b43_pio_txqueue *queue;
@@ -92,9 +90,6 @@ struct b43_pio_txqueue {
         struct b43_pio_txpacket packets[B43_PIO_MAX_NR_TXPACKETS];
         struct list_head packets_list;
 
-        /* Total number of transmitted packets. */
-        unsigned int nr_tx_packets;
-
         /* Shortcut to the 802.11 core revision. This is to
          * avoid horrible pointer dereferencing in the fastpaths. */
         u8 rev;
@@ -162,49 +157,9 @@ void b43_pio_free(struct b43_wldev *dev);
 int b43_pio_tx(struct b43_wldev *dev, struct sk_buff *skb);
 void b43_pio_handle_txstatus(struct b43_wldev *dev,
                              const struct b43_txstatus *status);
-void b43_pio_get_tx_stats(struct b43_wldev *dev,
-                          struct ieee80211_tx_queue_stats *stats);
 void b43_pio_rx(struct b43_pio_rxqueue *q);
 
 void b43_pio_tx_suspend(struct b43_wldev *dev);
 void b43_pio_tx_resume(struct b43_wldev *dev);
 
-
-#else /* CONFIG_B43_PIO */
-
-
-static inline int b43_pio_init(struct b43_wldev *dev)
-{
-        return 0;
-}
-static inline void b43_pio_free(struct b43_wldev *dev)
-{
-}
-static inline void b43_pio_stop(struct b43_wldev *dev)
-{
-}
-static inline int b43_pio_tx(struct b43_wldev *dev,
-                             struct sk_buff *skb)
-{
-        return 0;
-}
-static inline void b43_pio_handle_txstatus(struct b43_wldev *dev,
-                                           const struct b43_txstatus *status)
-{
-}
-static inline void b43_pio_get_tx_stats(struct b43_wldev *dev,
-                                        struct ieee80211_tx_queue_stats *stats)
-{
-}
-static inline void b43_pio_rx(struct b43_pio_rxqueue *q)
-{
-}
-static inline void b43_pio_tx_suspend(struct b43_wldev *dev)
-{
-}
-static inline void b43_pio_tx_resume(struct b43_wldev *dev)
-{
-}
-
-#endif /* CONFIG_B43_PIO */
 #endif /* B43_PIO_H_ */
diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c
index ffdce6f3c909..78016ae21c50 100644
--- a/drivers/net/wireless/b43/rfkill.c
+++ b/drivers/net/wireless/b43/rfkill.c
@@ -33,8 +33,14 @@ bool b43_is_hw_radio_enabled(struct b43_wldev *dev)
                       & B43_MMIO_RADIO_HWENABLED_HI_MASK))
                         return 1;
         } else {
-                if (b43_status(dev) >= B43_STAT_STARTED &&
-                    b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
+                /* To prevent CPU fault on PPC, do not read a register
+                 * unless the interface is started; however, on resume
+                 * for hibernation, this routine is entered early. When
+                 * that happens, unconditionally return TRUE.
+                 */
+                if (b43_status(dev) < B43_STAT_STARTED)
+                        return 1;
+                if (b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
                     & B43_MMIO_RADIO_HWENABLED_LO_MASK)
                         return 1;
         }
diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c
index 0d3ac64147a5..4e56b7bbcebd 100644
--- a/drivers/net/wireless/b43/sdio.c
+++ b/drivers/net/wireless/b43/sdio.c
@@ -16,6 +16,7 @@
 #include <linux/mmc/card.h>
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/sdio_ids.h>
+#include <linux/slab.h>
 #include <linux/ssb/ssb.h>
 
 #include "sdio.h"
diff --git a/drivers/net/wireless/b43/tables_nphy.c b/drivers/net/wireless/b43/tables_nphy.c
index 4e2336315545..a00d509150f7 100644
--- a/drivers/net/wireless/b43/tables_nphy.c
+++ b/drivers/net/wireless/b43/tables_nphy.c
@@ -1336,7 +1336,7 @@ b43_nphy_get_chantabent(struct b43_wldev *dev, u8 channel)
 }
 
 
-const u8 b43_ntab_adjustpower0[] = {
+static const u8 b43_ntab_adjustpower0[] = {
         0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01,
         0x02, 0x02, 0x02, 0x02, 0x03, 0x03, 0x03, 0x03,
         0x04, 0x04, 0x04, 0x04, 0x05, 0x05, 0x05, 0x05,
@@ -1355,7 +1355,7 @@ const u8 b43_ntab_adjustpower0[] = {
         0x1E, 0x1E, 0x1E, 0x1E, 0x1F, 0x1F, 0x1F, 0x1F,
 };
 
-const u8 b43_ntab_adjustpower1[] = {
+static const u8 b43_ntab_adjustpower1[] = {
         0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01,
         0x02, 0x02, 0x02, 0x02, 0x03, 0x03, 0x03, 0x03,
         0x04, 0x04, 0x04, 0x04, 0x05, 0x05, 0x05, 0x05,
@@ -1374,11 +1374,11 @@ const u8 b43_ntab_adjustpower1[] = {
         0x1E, 0x1E, 0x1E, 0x1E, 0x1F, 0x1F, 0x1F, 0x1F,
 };
 
-const u16 b43_ntab_bdi[] = {
+static const u16 b43_ntab_bdi[] = {
         0x0070, 0x0126, 0x012C, 0x0246, 0x048D, 0x04D2,
 };
 
-const u32 b43_ntab_channelest[] = {
+static const u32 b43_ntab_channelest[] = {
         0x44444444, 0x44444444, 0x44444444, 0x44444444,
         0x44444444, 0x44444444, 0x44444444, 0x44444444,
         0x10101010, 0x10101010, 0x10101010, 0x10101010,
@@ -1405,7 +1405,7 @@ const u32 b43_ntab_channelest[] = {
         0x10101010, 0x10101010, 0x10101010, 0x10101010,
 };
 
-const u8 b43_ntab_estimatepowerlt0[] = {
+static const u8 b43_ntab_estimatepowerlt0[] = {
         0x50, 0x4F, 0x4E, 0x4D, 0x4C, 0x4B, 0x4A, 0x49,
         0x48, 0x47, 0x46, 0x45, 0x44, 0x43, 0x42, 0x41,
         0x40, 0x3F, 0x3E, 0x3D, 0x3C, 0x3B, 0x3A, 0x39,
@@ -1416,7 +1416,7 @@ const u8 b43_ntab_estimatepowerlt0[] = {
         0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11,
 };
 
-const u8 b43_ntab_estimatepowerlt1[] = {
+static const u8 b43_ntab_estimatepowerlt1[] = {
         0x50, 0x4F, 0x4E, 0x4D, 0x4C, 0x4B, 0x4A, 0x49,
         0x48, 0x47, 0x46, 0x45, 0x44, 0x43, 0x42, 0x41,
         0x40, 0x3F, 0x3E, 0x3D, 0x3C, 0x3B, 0x3A, 0x39,
@@ -1427,14 +1427,14 @@ const u8 b43_ntab_estimatepowerlt1[] = {
         0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11,
 };
 
-const u8 b43_ntab_framelookup[] = {
+static const u8 b43_ntab_framelookup[] = {
         0x02, 0x04, 0x14, 0x14, 0x03, 0x05, 0x16, 0x16,
         0x0A, 0x0C, 0x1C, 0x1C, 0x0B, 0x0D, 0x1E, 0x1E,
         0x06, 0x08, 0x18, 0x18, 0x07, 0x09, 0x1A, 0x1A,
         0x0E, 0x10, 0x20, 0x28, 0x0F, 0x11, 0x22, 0x2A,
 };
 
-const u32 b43_ntab_framestruct[] = {
+static const u32 b43_ntab_framestruct[] = {
         0x08004A04, 0x00100000, 0x01000A05, 0x00100020,
         0x09804506, 0x00100030, 0x09804507, 0x00100030,
         0x00000000, 0x00000000, 0x00000000, 0x00000000,
@@ -1645,7 +1645,7 @@ const u32 b43_ntab_framestruct[] = {
         0x00000000, 0x00000000, 0x00000000, 0x00000000,
 };
 
-const u32 b43_ntab_gainctl0[] = {
+static const u32 b43_ntab_gainctl0[] = {
         0x007F003F, 0x007E013F, 0x007D023E, 0x007C033E,
         0x007B043D, 0x007A053D, 0x0079063C, 0x0078073C,
         0x0077083B, 0x0076093B, 0x00750A3A, 0x00740B3A,
@@ -1680,7 +1680,7 @@ const u32 b43_ntab_gainctl0[] = {
         0x00030C01, 0x00020D01, 0x00010E00, 0x00000F00,
 };
 
-const u32 b43_ntab_gainctl1[] = {
+static const u32 b43_ntab_gainctl1[] = {
         0x007F003F, 0x007E013F, 0x007D023E, 0x007C033E,
         0x007B043D, 0x007A053D, 0x0079063C, 0x0078073C,
         0x0077083B, 0x0076093B, 0x00750A3A, 0x00740B3A,
@@ -1715,12 +1715,12 @@ const u32 b43_ntab_gainctl1[] = {
         0x00030C01, 0x00020D01, 0x00010E00, 0x00000F00,
 };
 
-const u32 b43_ntab_intlevel[] = {
+static const u32 b43_ntab_intlevel[] = {
         0x00802070, 0x0671188D, 0x0A60192C, 0x0A300E46,
         0x00C1188D, 0x080024D2, 0x00000070,
 };
 
-const u32 b43_ntab_iqlt0[] = {
+static const u32 b43_ntab_iqlt0[] = {
         0x0000007F, 0x0000007F, 0x0000007F, 0x0000007F,
         0x0000007F, 0x0000007F, 0x0000007F, 0x0000007F,
         0x0000007F, 0x0000007F, 0x0000007F, 0x0000007F,
@@ -1755,7 +1755,7 @@ const u32 b43_ntab_iqlt0[] = {
         0x0000007F, 0x0000007F, 0x0000007F, 0x0000007F,
 };
 
-const u32 b43_ntab_iqlt1[] = {
+static const u32 b43_ntab_iqlt1[] = {
         0x0000007F, 0x0000007F, 0x0000007F, 0x0000007F,
         0x0000007F, 0x0000007F, 0x0000007F, 0x0000007F,
         0x0000007F, 0x0000007F, 0x0000007F, 0x0000007F,
@@ -1790,7 +1790,7 @@ const u32 b43_ntab_iqlt1[] = {
         0x0000007F, 0x0000007F, 0x0000007F, 0x0000007F,
 };
 
-const u16 b43_ntab_loftlt0[] = {
+static const u16 b43_ntab_loftlt0[] = {
         0x0000, 0x0101, 0x0002, 0x0103, 0x0000, 0x0101,
         0x0002, 0x0103, 0x0000, 0x0101, 0x0002, 0x0103,
         0x0000, 0x0101, 0x0002, 0x0103, 0x0000, 0x0101,
@@ -1815,7 +1815,7 @@ const u16 b43_ntab_loftlt0[] = {
         0x0002, 0x0103,
 };
 
-const u16 b43_ntab_loftlt1[] = {
+static const u16 b43_ntab_loftlt1[] = {
         0x0000, 0x0101, 0x0002, 0x0103, 0x0000, 0x0101,
         0x0002, 0x0103, 0x0000, 0x0101, 0x0002, 0x0103,
         0x0000, 0x0101, 0x0002, 0x0103, 0x0000, 0x0101,
@@ -1840,7 +1840,7 @@ const u16 b43_ntab_loftlt1[] = {
         0x0002, 0x0103,
 };
 
-const u8 b43_ntab_mcs[] = {
+static const u8 b43_ntab_mcs[] = {
         0x00, 0x08, 0x0A, 0x10, 0x12, 0x19, 0x1A, 0x1C,
         0x40, 0x48, 0x4A, 0x50, 0x52, 0x59, 0x5A, 0x5C,
         0x80, 0x88, 0x8A, 0x90, 0x92, 0x99, 0x9A, 0x9C,
@@ -1859,7 +1859,7 @@ const u8 b43_ntab_mcs[] = {
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 };
 
-const u32 b43_ntab_noisevar10[] = {
+static const u32 b43_ntab_noisevar10[] = {
         0x020C020C, 0x0000014D, 0x020C020C, 0x0000014D,
         0x020C020C, 0x0000014D, 0x020C020C, 0x0000014D,
         0x020C020C, 0x0000014D, 0x020C020C, 0x0000014D,
@@ -1926,7 +1926,7 @@ const u32 b43_ntab_noisevar10[] = {
         0x020C020C, 0x0000014D, 0x020C020C, 0x0000014D,
 };
 
-const u32 b43_ntab_noisevar11[] = {
+static const u32 b43_ntab_noisevar11[] = {
         0x020C020C, 0x0000014D, 0x020C020C, 0x0000014D,
         0x020C020C, 0x0000014D, 0x020C020C, 0x0000014D,
         0x020C020C, 0x0000014D, 0x020C020C, 0x0000014D,
@@ -1993,7 +1993,7 @@ const u32 b43_ntab_noisevar11[] = {
         0x020C020C, 0x0000014D, 0x020C020C, 0x0000014D,
 };
 
-const u16 b43_ntab_pilot[] = {
+static const u16 b43_ntab_pilot[] = {
         0xFF08, 0xFF08, 0xFF08, 0xFF08, 0xFF08, 0xFF08,
         0xFF08, 0xFF08, 0x80D5, 0x80D5, 0x80D5, 0x80D5,
         0x80D5, 0x80D5, 0x80D5, 0x80D5, 0xFF0A, 0xFF82,
@@ -2011,12 +2011,12 @@ const u16 b43_ntab_pilot[] = {
         0xF0A0, 0xF028, 0xFFFF, 0xFFFF,
 };
 
-const u32 b43_ntab_pilotlt[] = {
+static const u32 b43_ntab_pilotlt[] = {
         0x76540123, 0x62407351, 0x76543201, 0x76540213,
         0x76540123, 0x76430521,
 };
 
-const u32 b43_ntab_tdi20a0[] = {
+static const u32 b43_ntab_tdi20a0[] = {
         0x00091226, 0x000A1429, 0x000B56AD, 0x000C58B0,
         0x000D5AB3, 0x000E9CB6, 0x000F9EBA, 0x0000C13D,
         0x00020301, 0x00030504, 0x00040708, 0x0005090B,
@@ -2033,7 +2033,7 @@ const u32 b43_ntab_tdi20a0[] = {
         0x00000000, 0x00000000, 0x00000000,
 };
 
-const u32 b43_ntab_tdi20a1[] = {
+static const u32 b43_ntab_tdi20a1[] = {
         0x00014B26, 0x00028D29, 0x000393AD, 0x00049630,
         0x0005D833, 0x0006DA36, 0x00099C3A, 0x000A9E3D,
         0x000BC081, 0x000CC284, 0x000DC488, 0x000F068B,
@@ -2050,7 +2050,7 @@ const u32 b43_ntab_tdi20a1[] = {
         0x00000000, 0x00000000, 0x00000000,
 };
 
-const u32 b43_ntab_tdi40a0[] = {
+static const u32 b43_ntab_tdi40a0[] = {
         0x0011A346, 0x00136CCF, 0x0014F5D9, 0x001641E2,
         0x0017CB6B, 0x00195475, 0x001B2383, 0x001CAD0C,
         0x001E7616, 0x0000821F, 0x00020BA8, 0x0003D4B2,
@@ -2081,7 +2081,7 @@ const u32 b43_ntab_tdi40a0[] = {
         0x00000000, 0x00000000,
 };
 
-const u32 b43_ntab_tdi40a1[] = {
+static const u32 b43_ntab_tdi40a1[] = {
         0x001EDB36, 0x000129CA, 0x0002B353, 0x00047CDD,
         0x0005C8E6, 0x000791EF, 0x00091BF9, 0x000AAA07,
         0x000C3391, 0x000DFD1A, 0x00120923, 0x0013D22D,
@@ -2112,7 +2112,7 @@ const u32 b43_ntab_tdi40a1[] = {
         0x00000000, 0x00000000,
 };
 
-const u32 b43_ntab_tdtrn[] = {
+static const u32 b43_ntab_tdtrn[] = {
         0x061C061C, 0x0050EE68, 0xF592FE36, 0xFE5212F6,
         0x00000C38, 0xFE5212F6, 0xF592FE36, 0x0050EE68,
         0x061C061C, 0xEE680050, 0xFE36F592, 0x12F6FE52,
@@ -2291,7 +2291,7 @@ const u32 b43_ntab_tdtrn[] = {
         0xFA58FC00, 0x0B64FC7E, 0x0800F7B6, 0x00F006BE,
 };
 
-const u32 b43_ntab_tmap[] = {
+static const u32 b43_ntab_tmap[] = {
         0x8A88AA80, 0x8AAAAA8A, 0x8A8A8AA8, 0x00000888,
         0x88000000, 0x8A8A88AA, 0x8AA88888, 0x8888A8A8,
         0xF1111110, 0x11111111, 0x11F11111, 0x00000111,
@@ -2406,6 +2406,544 @@ const u32 b43_ntab_tmap[] = {
         0x00000000, 0x00000000, 0x00000000, 0x00000000,
 };
 
+const u32 b43_ntab_tx_gain_rev0_1_2[] = {
+        0x03cc2b44, 0x03cc2b42, 0x03cc2a44, 0x03cc2a42,
+        0x03cc2944, 0x03c82b44, 0x03c82b42, 0x03c82a44,
+        0x03c82a42, 0x03c82944, 0x03c82942, 0x03c82844,
+        0x03c82842, 0x03c42b44, 0x03c42b42, 0x03c42a44,
+        0x03c42a42, 0x03c42944, 0x03c42942, 0x03c42844,
+        0x03c42842, 0x03c42744, 0x03c42742, 0x03c42644,
+        0x03c42642, 0x03c42544, 0x03c42542, 0x03c42444,
+        0x03c42442, 0x03c02b44, 0x03c02b42, 0x03c02a44,
+        0x03c02a42, 0x03c02944, 0x03c02942, 0x03c02844,
+        0x03c02842, 0x03c02744, 0x03c02742, 0x03b02b44,
+        0x03b02b42, 0x03b02a44, 0x03b02a42, 0x03b02944,
+        0x03b02942, 0x03b02844, 0x03b02842, 0x03b02744,
+        0x03b02742, 0x03b02644, 0x03b02642, 0x03b02544,
+        0x03b02542, 0x03a02b44, 0x03a02b42, 0x03a02a44,
+        0x03a02a42, 0x03a02944, 0x03a02942, 0x03a02844,
+        0x03a02842, 0x03a02744, 0x03a02742, 0x03902b44,
+        0x03902b42, 0x03902a44, 0x03902a42, 0x03902944,
+        0x03902942, 0x03902844, 0x03902842, 0x03902744,
+        0x03902742, 0x03902644, 0x03902642, 0x03902544,
+        0x03902542, 0x03802b44, 0x03802b42, 0x03802a44,
+        0x03802a42, 0x03802944, 0x03802942, 0x03802844,
+        0x03802842, 0x03802744, 0x03802742, 0x03802644,
+        0x03802642, 0x03802544, 0x03802542, 0x03802444,
+        0x03802442, 0x03802344, 0x03802342, 0x03802244,
+        0x03802242, 0x03802144, 0x03802142, 0x03802044,
+        0x03802042, 0x03801f44, 0x03801f42, 0x03801e44,
+        0x03801e42, 0x03801d44, 0x03801d42, 0x03801c44,
+        0x03801c42, 0x03801b44, 0x03801b42, 0x03801a44,
+        0x03801a42, 0x03801944, 0x03801942, 0x03801844,
+        0x03801842, 0x03801744, 0x03801742, 0x03801644,
+        0x03801642, 0x03801544, 0x03801542, 0x03801444,
+        0x03801442, 0x03801344, 0x03801342, 0x00002b00,
+};
+
+const u32 b43_ntab_tx_gain_rev3plus_2ghz[] = {
+        0x1f410044, 0x1f410042, 0x1f410040, 0x1f41003e,
+        0x1f41003c, 0x1f41003b, 0x1f410039, 0x1f410037,
+        0x1e410044, 0x1e410042, 0x1e410040, 0x1e41003e,
+        0x1e41003c, 0x1e41003b, 0x1e410039, 0x1e410037,
+        0x1d410044, 0x1d410042, 0x1d410040, 0x1d41003e,
+        0x1d41003c, 0x1d41003b, 0x1d410039, 0x1d410037,
+        0x1c410044, 0x1c410042, 0x1c410040, 0x1c41003e,
+        0x1c41003c, 0x1c41003b, 0x1c410039, 0x1c410037,
+        0x1b410044, 0x1b410042, 0x1b410040, 0x1b41003e,
+        0x1b41003c, 0x1b41003b, 0x1b410039, 0x1b410037,
+        0x1a410044, 0x1a410042, 0x1a410040, 0x1a41003e,
+        0x1a41003c, 0x1a41003b, 0x1a410039, 0x1a410037,
+        0x19410044, 0x19410042, 0x19410040, 0x1941003e,
+        0x1941003c, 0x1941003b, 0x19410039, 0x19410037,
+        0x18410044, 0x18410042, 0x18410040, 0x1841003e,
+        0x1841003c, 0x1841003b, 0x18410039, 0x18410037,
+        0x17410044, 0x17410042, 0x17410040, 0x1741003e,
+        0x1741003c, 0x1741003b, 0x17410039, 0x17410037,
+        0x16410044, 0x16410042, 0x16410040, 0x1641003e,
+        0x1641003c, 0x1641003b, 0x16410039, 0x16410037,
+        0x15410044, 0x15410042, 0x15410040, 0x1541003e,
+        0x1541003c, 0x1541003b, 0x15410039, 0x15410037,
+        0x14410044, 0x14410042, 0x14410040, 0x1441003e,
+        0x1441003c, 0x1441003b, 0x14410039, 0x14410037,
+        0x13410044, 0x13410042, 0x13410040, 0x1341003e,
+        0x1341003c, 0x1341003b, 0x13410039, 0x13410037,
+        0x12410044, 0x12410042, 0x12410040, 0x1241003e,
+        0x1241003c, 0x1241003b, 0x12410039, 0x12410037,
+        0x11410044, 0x11410042, 0x11410040, 0x1141003e,
+        0x1141003c, 0x1141003b, 0x11410039, 0x11410037,
+        0x10410044, 0x10410042, 0x10410040, 0x1041003e,
+        0x1041003c, 0x1041003b, 0x10410039, 0x10410037,
+};
+
+const u32 b43_ntab_tx_gain_rev3_5ghz[] = {
+        0xcff70044, 0xcff70042, 0xcff70040, 0xcff7003e,
+        0xcff7003c, 0xcff7003b, 0xcff70039, 0xcff70037,
+        0xcef70044, 0xcef70042, 0xcef70040, 0xcef7003e,
+        0xcef7003c, 0xcef7003b, 0xcef70039, 0xcef70037,
+        0xcdf70044, 0xcdf70042, 0xcdf70040, 0xcdf7003e,
+        0xcdf7003c, 0xcdf7003b, 0xcdf70039, 0xcdf70037,
+        0xccf70044, 0xccf70042, 0xccf70040, 0xccf7003e,
+        0xccf7003c, 0xccf7003b, 0xccf70039, 0xccf70037,
+        0xcbf70044, 0xcbf70042, 0xcbf70040, 0xcbf7003e,
+        0xcbf7003c, 0xcbf7003b, 0xcbf70039, 0xcbf70037,
+        0xcaf70044, 0xcaf70042, 0xcaf70040, 0xcaf7003e,
+        0xcaf7003c, 0xcaf7003b, 0xcaf70039, 0xcaf70037,
+        0xc9f70044, 0xc9f70042, 0xc9f70040, 0xc9f7003e,
+        0xc9f7003c, 0xc9f7003b, 0xc9f70039, 0xc9f70037,
+        0xc8f70044, 0xc8f70042, 0xc8f70040, 0xc8f7003e,
+        0xc8f7003c, 0xc8f7003b, 0xc8f70039, 0xc8f70037,
+        0xc7f70044, 0xc7f70042, 0xc7f70040, 0xc7f7003e,
+        0xc7f7003c, 0xc7f7003b, 0xc7f70039, 0xc7f70037,
+        0xc6f70044, 0xc6f70042, 0xc6f70040, 0xc6f7003e,
+        0xc6f7003c, 0xc6f7003b, 0xc6f70039, 0xc6f70037,
+        0xc5f70044, 0xc5f70042, 0xc5f70040, 0xc5f7003e,
+        0xc5f7003c, 0xc5f7003b, 0xc5f70039, 0xc5f70037,
+        0xc4f70044, 0xc4f70042, 0xc4f70040, 0xc4f7003e,
+        0xc4f7003c, 0xc4f7003b, 0xc4f70039, 0xc4f70037,
+        0xc3f70044, 0xc3f70042, 0xc3f70040, 0xc3f7003e,
+        0xc3f7003c, 0xc3f7003b, 0xc3f70039, 0xc3f70037,
+        0xc2f70044, 0xc2f70042, 0xc2f70040, 0xc2f7003e,
+        0xc2f7003c, 0xc2f7003b, 0xc2f70039, 0xc2f70037,
+        0xc1f70044, 0xc1f70042, 0xc1f70040, 0xc1f7003e,
+        0xc1f7003c, 0xc1f7003b, 0xc1f70039, 0xc1f70037,
+        0xc0f70044, 0xc0f70042, 0xc0f70040, 0xc0f7003e,
+        0xc0f7003c, 0xc0f7003b, 0xc0f70039, 0xc0f70037,
+};
+
+const u32 b43_ntab_tx_gain_rev4_5ghz[] = {
+        0x2ff20044, 0x2ff20042, 0x2ff20040, 0x2ff2003e,
+        0x2ff2003c, 0x2ff2003b, 0x2ff20039, 0x2ff20037,
+        0x2ef20044, 0x2ef20042, 0x2ef20040, 0x2ef2003e,
+        0x2ef2003c, 0x2ef2003b, 0x2ef20039, 0x2ef20037,
+        0x2df20044, 0x2df20042, 0x2df20040, 0x2df2003e,
+        0x2df2003c, 0x2df2003b, 0x2df20039, 0x2df20037,
+        0x2cf20044, 0x2cf20042, 0x2cf20040, 0x2cf2003e,
+        0x2cf2003c, 0x2cf2003b, 0x2cf20039, 0x2cf20037,
+        0x2bf20044, 0x2bf20042, 0x2bf20040, 0x2bf2003e,
+        0x2bf2003c, 0x2bf2003b, 0x2bf20039, 0x2bf20037,
+        0x2af20044, 0x2af20042, 0x2af20040, 0x2af2003e,
+        0x2af2003c, 0x2af2003b, 0x2af20039, 0x2af20037,
+        0x29f20044, 0x29f20042, 0x29f20040, 0x29f2003e,
+        0x29f2003c, 0x29f2003b, 0x29f20039, 0x29f20037,
+        0x28f20044, 0x28f20042, 0x28f20040, 0x28f2003e,
+        0x28f2003c, 0x28f2003b, 0x28f20039, 0x28f20037,
+        0x27f20044, 0x27f20042, 0x27f20040, 0x27f2003e,
+        0x27f2003c, 0x27f2003b, 0x27f20039, 0x27f20037,
+        0x26f20044, 0x26f20042, 0x26f20040, 0x26f2003e,
+        0x26f2003c, 0x26f2003b, 0x26f20039, 0x26f20037,
+        0x25f20044, 0x25f20042, 0x25f20040, 0x25f2003e,
+        0x25f2003c, 0x25f2003b, 0x25f20039, 0x25f20037,
+        0x24f20044, 0x24f20042, 0x24f20040, 0x24f2003e,
+        0x24f2003c, 0x24f2003b, 0x24f20039, 0x24f20038,
+        0x23f20041, 0x23f20040, 0x23f2003f, 0x23f2003e,
+        0x23f2003c, 0x23f2003b, 0x23f20039, 0x23f20037,
+        0x22f20044, 0x22f20042, 0x22f20040, 0x22f2003e,
+        0x22f2003c, 0x22f2003b, 0x22f20039, 0x22f20037,
+        0x21f20044, 0x21f20042, 0x21f20040, 0x21f2003e,
+        0x21f2003c, 0x21f2003b, 0x21f20039, 0x21f20037,
+        0x20d20043, 0x20d20041, 0x20d2003e, 0x20d2003c,
+        0x20d2003a, 0x20d20038, 0x20d20036, 0x20d20034,
+};
+
+const u32 b43_ntab_tx_gain_rev5plus_5ghz[] = {
+        0x0f62004a, 0x0f620048, 0x0f620046, 0x0f620044,
+        0x0f620042, 0x0f620040, 0x0f62003e, 0x0f62003c,
+        0x0e620044, 0x0e620042, 0x0e620040, 0x0e62003e,
+        0x0e62003c, 0x0e62003d, 0x0e62003b, 0x0e62003a,
+        0x0d620043, 0x0d620041, 0x0d620040, 0x0d62003e,
+        0x0d62003d, 0x0d62003c, 0x0d62003b, 0x0d62003a,
+        0x0c620041, 0x0c620040, 0x0c62003f, 0x0c62003e,
+        0x0c62003c, 0x0c62003b, 0x0c620039, 0x0c620037,
+        0x0b620046, 0x0b620044, 0x0b620042, 0x0b620040,
+        0x0b62003e, 0x0b62003c, 0x0b62003b, 0x0b62003a,
+        0x0a620041, 0x0a620040, 0x0a62003e, 0x0a62003c,
+        0x0a62003b, 0x0a62003a, 0x0a620039, 0x0a620038,
+        0x0962003e, 0x0962003d, 0x0962003c, 0x0962003b,
+        0x09620039, 0x09620037, 0x09620035, 0x09620033,
+        0x08620044, 0x08620042, 0x08620040, 0x0862003e,
+        0x0862003c, 0x0862003b, 0x0862003a, 0x08620039,
+        0x07620043, 0x07620042, 0x07620040, 0x0762003f,
+        0x0762003d, 0x0762003b, 0x0762003a, 0x07620039,
+        0x0662003e, 0x0662003d, 0x0662003c, 0x0662003b,
+        0x06620039, 0x06620037, 0x06620035, 0x06620033,
+        0x05620046, 0x05620044, 0x05620042, 0x05620040,
+        0x0562003e, 0x0562003c, 0x0562003b, 0x05620039,
+        0x04620044, 0x04620042, 0x04620040, 0x0462003e,
+        0x0462003c, 0x0462003b, 0x04620039, 0x04620038,
+        0x0362003c, 0x0362003b, 0x0362003a, 0x03620039,
+        0x03620038, 0x03620037, 0x03620035, 0x03620033,
+        0x0262004c, 0x0262004a, 0x02620048, 0x02620047,
+        0x02620046, 0x02620044, 0x02620043, 0x02620042,
+        0x0162004a, 0x01620048, 0x01620046, 0x01620044,
+        0x01620043, 0x01620042, 0x01620041, 0x01620040,
+        0x00620042, 0x00620040, 0x0062003e, 0x0062003c,
+        0x0062003b, 0x00620039, 0x00620037, 0x00620035,
+};
+
+const u32 txpwrctrl_tx_gain_ipa[] = {
+        0x5ff7002d, 0x5ff7002b, 0x5ff7002a, 0x5ff70029,
+        0x5ff70028, 0x5ff70027, 0x5ff70026, 0x5ff70025,
+        0x5ef7002d, 0x5ef7002b, 0x5ef7002a, 0x5ef70029,
+        0x5ef70028, 0x5ef70027, 0x5ef70026, 0x5ef70025,
+        0x5df7002d, 0x5df7002b, 0x5df7002a, 0x5df70029,
+        0x5df70028, 0x5df70027, 0x5df70026, 0x5df70025,
+        0x5cf7002d, 0x5cf7002b, 0x5cf7002a, 0x5cf70029,
+        0x5cf70028, 0x5cf70027, 0x5cf70026, 0x5cf70025,
+        0x5bf7002d, 0x5bf7002b, 0x5bf7002a, 0x5bf70029,
+        0x5bf70028, 0x5bf70027, 0x5bf70026, 0x5bf70025,
+        0x5af7002d, 0x5af7002b, 0x5af7002a, 0x5af70029,
+        0x5af70028, 0x5af70027, 0x5af70026, 0x5af70025,
+        0x59f7002d, 0x59f7002b, 0x59f7002a, 0x59f70029,
+        0x59f70028, 0x59f70027, 0x59f70026, 0x59f70025,
+        0x58f7002d, 0x58f7002b, 0x58f7002a, 0x58f70029,
+        0x58f70028, 0x58f70027, 0x58f70026, 0x58f70025,
+        0x57f7002d, 0x57f7002b, 0x57f7002a, 0x57f70029,
+        0x57f70028, 0x57f70027, 0x57f70026, 0x57f70025,
+        0x56f7002d, 0x56f7002b, 0x56f7002a, 0x56f70029,
+        0x56f70028, 0x56f70027, 0x56f70026, 0x56f70025,
+        0x55f7002d, 0x55f7002b, 0x55f7002a, 0x55f70029,
+        0x55f70028, 0x55f70027, 0x55f70026, 0x55f70025,
+        0x54f7002d, 0x54f7002b, 0x54f7002a, 0x54f70029,
+        0x54f70028, 0x54f70027, 0x54f70026, 0x54f70025,
+        0x53f7002d, 0x53f7002b, 0x53f7002a, 0x53f70029,
+        0x53f70028, 0x53f70027, 0x53f70026, 0x53f70025,
+        0x52f7002d, 0x52f7002b, 0x52f7002a, 0x52f70029,
+        0x52f70028, 0x52f70027, 0x52f70026, 0x52f70025,
+        0x51f7002d, 0x51f7002b, 0x51f7002a, 0x51f70029,
+        0x51f70028, 0x51f70027, 0x51f70026, 0x51f70025,
+        0x50f7002d, 0x50f7002b, 0x50f7002a, 0x50f70029,
+        0x50f70028, 0x50f70027, 0x50f70026, 0x50f70025,
+};
+
+const u32 txpwrctrl_tx_gain_ipa_rev5[] = {
+        0x1ff7002d, 0x1ff7002b, 0x1ff7002a, 0x1ff70029,
+        0x1ff70028, 0x1ff70027, 0x1ff70026, 0x1ff70025,
+        0x1ef7002d, 0x1ef7002b, 0x1ef7002a, 0x1ef70029,
+        0x1ef70028, 0x1ef70027, 0x1ef70026, 0x1ef70025,
+        0x1df7002d, 0x1df7002b, 0x1df7002a, 0x1df70029,
+        0x1df70028, 0x1df70027, 0x1df70026, 0x1df70025,
+        0x1cf7002d, 0x1cf7002b, 0x1cf7002a, 0x1cf70029,
+        0x1cf70028, 0x1cf70027, 0x1cf70026, 0x1cf70025,
+        0x1bf7002d, 0x1bf7002b, 0x1bf7002a, 0x1bf70029,
+        0x1bf70028, 0x1bf70027, 0x1bf70026, 0x1bf70025,
+        0x1af7002d, 0x1af7002b, 0x1af7002a, 0x1af70029,
+        0x1af70028, 0x1af70027, 0x1af70026, 0x1af70025,
+        0x19f7002d, 0x19f7002b, 0x19f7002a, 0x19f70029,
+        0x19f70028, 0x19f70027, 0x19f70026, 0x19f70025,
+        0x18f7002d, 0x18f7002b, 0x18f7002a, 0x18f70029,
+        0x18f70028, 0x18f70027, 0x18f70026, 0x18f70025,
+        0x17f7002d, 0x17f7002b, 0x17f7002a, 0x17f70029,
+        0x17f70028, 0x17f70027, 0x17f70026, 0x17f70025,
+        0x16f7002d, 0x16f7002b, 0x16f7002a, 0x16f70029,
+        0x16f70028, 0x16f70027, 0x16f70026, 0x16f70025,
+        0x15f7002d, 0x15f7002b, 0x15f7002a, 0x15f70029,
+        0x15f70028, 0x15f70027, 0x15f70026, 0x15f70025,
+        0x14f7002d, 0x14f7002b, 0x14f7002a, 0x14f70029,
+        0x14f70028, 0x14f70027, 0x14f70026, 0x14f70025,
+        0x13f7002d, 0x13f7002b, 0x13f7002a, 0x13f70029,
+        0x13f70028, 0x13f70027, 0x13f70026, 0x13f70025,
+        0x12f7002d, 0x12f7002b, 0x12f7002a, 0x12f70029,
+        0x12f70028, 0x12f70027, 0x12f70026, 0x12f70025,
+        0x11f7002d, 0x11f7002b, 0x11f7002a, 0x11f70029,
+        0x11f70028, 0x11f70027, 0x11f70026, 0x11f70025,
+        0x10f7002d, 0x10f7002b, 0x10f7002a, 0x10f70029,
+        0x10f70028, 0x10f70027, 0x10f70026, 0x10f70025,
+};
+
+const u32 txpwrctrl_tx_gain_ipa_rev6[] = {
+        0x0ff7002d, 0x0ff7002b, 0x0ff7002a, 0x0ff70029,
+        0x0ff70028, 0x0ff70027, 0x0ff70026, 0x0ff70025,
+        0x0ef7002d, 0x0ef7002b, 0x0ef7002a, 0x0ef70029,
+        0x0ef70028, 0x0ef70027, 0x0ef70026, 0x0ef70025,
+        0x0df7002d, 0x0df7002b, 0x0df7002a, 0x0df70029,
+        0x0df70028, 0x0df70027, 0x0df70026, 0x0df70025,
+        0x0cf7002d, 0x0cf7002b, 0x0cf7002a, 0x0cf70029,
+        0x0cf70028, 0x0cf70027, 0x0cf70026, 0x0cf70025,
+        0x0bf7002d, 0x0bf7002b, 0x0bf7002a, 0x0bf70029,
+        0x0bf70028, 0x0bf70027, 0x0bf70026, 0x0bf70025,
+        0x0af7002d, 0x0af7002b, 0x0af7002a, 0x0af70029,
+        0x0af70028, 0x0af70027, 0x0af70026, 0x0af70025,
+        0x09f7002d, 0x09f7002b, 0x09f7002a, 0x09f70029,
+        0x09f70028, 0x09f70027, 0x09f70026, 0x09f70025,
+        0x08f7002d, 0x08f7002b, 0x08f7002a, 0x08f70029,
+        0x08f70028, 0x08f70027, 0x08f70026, 0x08f70025,
+        0x07f7002d, 0x07f7002b, 0x07f7002a, 0x07f70029,
+        0x07f70028, 0x07f70027, 0x07f70026, 0x07f70025,
+        0x06f7002d, 0x06f7002b, 0x06f7002a, 0x06f70029,
+        0x06f70028, 0x06f70027, 0x06f70026, 0x06f70025,
+        0x05f7002d, 0x05f7002b, 0x05f7002a, 0x05f70029,
+        0x05f70028, 0x05f70027, 0x05f70026, 0x05f70025,
+        0x04f7002d, 0x04f7002b, 0x04f7002a, 0x04f70029,
+        0x04f70028, 0x04f70027, 0x04f70026, 0x04f70025,
+        0x03f7002d, 0x03f7002b, 0x03f7002a, 0x03f70029,
+        0x03f70028, 0x03f70027, 0x03f70026, 0x03f70025,
+        0x02f7002d, 0x02f7002b, 0x02f7002a, 0x02f70029,
+        0x02f70028, 0x02f70027, 0x02f70026, 0x02f70025,
+        0x01f7002d, 0x01f7002b, 0x01f7002a, 0x01f70029,
+        0x01f70028, 0x01f70027, 0x01f70026, 0x01f70025,
+        0x00f7002d, 0x00f7002b, 0x00f7002a, 0x00f70029,
+        0x00f70028, 0x00f70027, 0x00f70026, 0x00f70025,
+};
+
+const u32 txpwrctrl_tx_gain_ipa_5g[] = {
+        0x7ff70035, 0x7ff70033, 0x7ff70032, 0x7ff70031,
+        0x7ff7002f, 0x7ff7002e, 0x7ff7002d, 0x7ff7002b,
+        0x7ff7002a, 0x7ff70029, 0x7ff70028, 0x7ff70027,
+        0x7ff70026, 0x7ff70024, 0x7ff70023, 0x7ff70022,
+        0x7ef70028, 0x7ef70027, 0x7ef70026, 0x7ef70025,
+        0x7ef70024, 0x7ef70023, 0x7df70028, 0x7df70027,
+        0x7df70026, 0x7df70025, 0x7df70024, 0x7df70023,
+        0x7df70022, 0x7cf70029, 0x7cf70028, 0x7cf70027,
+        0x7cf70026, 0x7cf70025, 0x7cf70023, 0x7cf70022,
+        0x7bf70029, 0x7bf70028, 0x7bf70026, 0x7bf70025,
+        0x7bf70024, 0x7bf70023, 0x7bf70022, 0x7bf70021,
+        0x7af70029, 0x7af70028, 0x7af70027, 0x7af70026,
+        0x7af70025, 0x7af70024, 0x7af70023, 0x7af70022,
+        0x79f70029, 0x79f70028, 0x79f70027, 0x79f70026,
+        0x79f70025, 0x79f70024, 0x79f70023, 0x79f70022,
+        0x78f70029, 0x78f70028, 0x78f70027, 0x78f70026,
+        0x78f70025, 0x78f70024, 0x78f70023, 0x78f70022,
+        0x77f70029, 0x77f70028, 0x77f70027, 0x77f70026,
+        0x77f70025, 0x77f70024, 0x77f70023, 0x77f70022,
+        0x76f70029, 0x76f70028, 0x76f70027, 0x76f70026,
+        0x76f70024, 0x76f70023, 0x76f70022, 0x76f70021,
+        0x75f70029, 0x75f70028, 0x75f70027, 0x75f70026,
+        0x75f70025, 0x75f70024, 0x75f70023, 0x74f70029,
+        0x74f70028, 0x74f70026, 0x74f70025, 0x74f70024,
+        0x74f70023, 0x74f70022, 0x73f70029, 0x73f70027,
+        0x73f70026, 0x73f70025, 0x73f70024, 0x73f70023,
+        0x73f70022, 0x72f70028, 0x72f70027, 0x72f70026,
+        0x72f70025, 0x72f70024, 0x72f70023, 0x72f70022,
+        0x71f70028, 0x71f70027, 0x71f70026, 0x71f70025,
+        0x71f70024, 0x71f70023, 0x70f70028, 0x70f70027,
+        0x70f70026, 0x70f70024, 0x70f70023, 0x70f70022,
+        0x70f70021, 0x70f70020, 0x70f70020, 0x70f7001f,
+};
+
+const u16 tbl_iqcal_gainparams[2][9][8] = {
+        {
+                { 0x000, 0, 0, 2, 0x69, 0x69, 0x69, 0x69 },
+                { 0x700, 7, 0, 0, 0x69, 0x69, 0x69, 0x69 },
+                { 0x710, 7, 1, 0, 0x68, 0x68, 0x68, 0x68 },
+                { 0x720, 7, 2, 0, 0x67, 0x67, 0x67, 0x67 },
+                { 0x730, 7, 3, 0, 0x66, 0x66, 0x66, 0x66 },
+                { 0x740, 7, 4, 0, 0x65, 0x65, 0x65, 0x65 },
+                { 0x741, 7, 4, 1, 0x65, 0x65, 0x65, 0x65 },
+                { 0x742, 7, 4, 2, 0x65, 0x65, 0x65, 0x65 },
+                { 0x743, 7, 4, 3, 0x65, 0x65, 0x65, 0x65 }
+        },
+        {
+                { 0x000, 7, 0, 0, 0x79, 0x79, 0x79, 0x79 },
+                { 0x700, 7, 0, 0, 0x79, 0x79, 0x79, 0x79 },
+                { 0x710, 7, 1, 0, 0x79, 0x79, 0x79, 0x79 },
+                { 0x720, 7, 2, 0, 0x78, 0x78, 0x78, 0x78 },
+                { 0x730, 7, 3, 0, 0x78, 0x78, 0x78, 0x78 },
+                { 0x740, 7, 4, 0, 0x78, 0x78, 0x78, 0x78 },
+                { 0x741, 7, 4, 1, 0x78, 0x78, 0x78, 0x78 },
+                { 0x742, 7, 4, 2, 0x78, 0x78, 0x78, 0x78 },
+                { 0x743, 7, 4, 3, 0x78, 0x78, 0x78, 0x78 }
+        }
+};
+
+const struct nphy_txiqcal_ladder ladder_lo[] = {
+        { 3, 0 },
+        { 4, 0 },
+        { 6, 0 },
+        { 9, 0 },
+        { 13, 0 },
+        { 18, 0 },
+        { 25, 0 },
+        { 25, 1 },
+        { 25, 2 },
+        { 25, 3 },
+        { 25, 4 },
+        { 25, 5 },
+        { 25, 6 },
+        { 25, 7 },
+        { 35, 7 },
+        { 50, 7 },
+        { 71, 7 },
+        { 100, 7 }
+};
+
+const struct nphy_txiqcal_ladder ladder_iq[] = {
+        { 3, 0 },
+        { 4, 0 },
+        { 6, 0 },
+        { 9, 0 },
+        { 13, 0 },
+        { 18, 0 },
+        { 25, 0 },
+        { 35, 0 },
+        { 50, 0 },
+        { 71, 0 },
+        { 100, 0 },
+        { 100, 1 },
+        { 100, 2 },
+        { 100, 3 },
+        { 100, 4 },
+        { 100, 5 },
+        { 100, 6 },
+        { 100, 7 }
+};
+
+const u16 loscale[] = {
+        256, 256, 271, 271,
+        287, 256, 256, 271,
+        271, 287, 287, 304,
+        304, 256, 256, 271,
+        271, 287, 287, 304,
+        304, 322, 322, 341,
+        341, 362, 362, 383,
+        383, 256, 256, 271,
+        271, 287, 287, 304,
+        304, 322, 322, 256,
+        256, 271, 271, 287,
+        287, 304, 304, 322,
+        322, 341, 341, 362,
+        362, 256, 256, 271,
+        271, 287, 287, 304,
+        304, 322, 322, 256,
+        256, 271, 271, 287,
+        287, 304, 304, 322,
+        322, 341, 341, 362,
+        362, 256, 256, 271,
+        271, 287, 287, 304,
+        304, 322, 322, 341,
+        341, 362, 362, 383,
+        383, 406, 406, 430,
+        430, 455, 455, 482,
+        482, 511, 511, 541,
+        541, 573, 573, 607,
+        607, 643, 643, 681,
+        681, 722, 722, 764,
+        764, 810, 810, 858,
+        858, 908, 908, 962,
+        962, 1019, 1019, 256
+};
+
+const u16 tbl_tx_iqlo_cal_loft_ladder_40[] = {
+        0x0200, 0x0300, 0x0400, 0x0700,
+        0x0900, 0x0c00, 0x1200, 0x1201,
+        0x1202, 0x1203, 0x1204, 0x1205,
+        0x1206, 0x1207, 0x1907, 0x2307,
+        0x3207, 0x4707
+};
+
+const u16 tbl_tx_iqlo_cal_loft_ladder_20[] = {
+        0x0300, 0x0500, 0x0700, 0x0900,
+        0x0d00, 0x1100, 0x1900, 0x1901,
+        0x1902, 0x1903, 0x1904, 0x1905,
+        0x1906, 0x1907, 0x2407, 0x3207,
+        0x4607, 0x6407
+};
+
+const u16 tbl_tx_iqlo_cal_iqimb_ladder_40[] = {
+        0x0100, 0x0200, 0x0400, 0x0700,
+        0x0900, 0x0c00, 0x1200, 0x1900,
+        0x2300, 0x3200, 0x4700, 0x4701,
+        0x4702, 0x4703, 0x4704, 0x4705,
+        0x4706, 0x4707
+};
+
+const u16 tbl_tx_iqlo_cal_iqimb_ladder_20[] = {
+        0x0200, 0x0300, 0x0600, 0x0900,
+        0x0d00, 0x1100, 0x1900, 0x2400,
+        0x3200, 0x4600, 0x6400, 0x6401,
+        0x6402, 0x6403, 0x6404, 0x6405,
+        0x6406, 0x6407
+};
+
+const u16 tbl_tx_iqlo_cal_startcoefs_nphyrev3[B43_NTAB_TX_IQLO_CAL_STARTCOEFS_REV3] = { };
+
+const u16 tbl_tx_iqlo_cal_startcoefs[B43_NTAB_TX_IQLO_CAL_STARTCOEFS] = { };
+
+const u16 tbl_tx_iqlo_cal_cmds_recal_nphyrev3[] = {
+        0x8423, 0x8323, 0x8073, 0x8256,
+        0x8045, 0x8223, 0x9423, 0x9323,
+        0x9073, 0x9256, 0x9045, 0x9223
+};
+
+const u16 tbl_tx_iqlo_cal_cmds_recal[] = {
+        0x8101, 0x8253, 0x8053, 0x8234,
+        0x8034, 0x9101, 0x9253, 0x9053,
+        0x9234, 0x9034
+};
+
+const u16 tbl_tx_iqlo_cal_cmds_fullcal[] = {
+        0x8123, 0x8264, 0x8086, 0x8245,
+        0x8056, 0x9123, 0x9264, 0x9086,
+        0x9245, 0x9056
+};
+
+const u16 tbl_tx_iqlo_cal_cmds_fullcal_nphyrev3[] = {
+        0x8434, 0x8334, 0x8084, 0x8267,
+        0x8056, 0x8234, 0x9434, 0x9334,
+        0x9084, 0x9267, 0x9056, 0x9234
+};
+
+const s16 tbl_tx_filter_coef_rev4[7][15] = {
+        {  -377,   137,  -407,   208, -1527,
+            956,    93,   186,    93,   230,
+            -44,   230,    20,  -191,   201 },
+        {   -77,    20,   -98,    49,   -93,
+             60,    56,   111,    56,    26,
+             -5,    26,    34,   -32,    34 },
+        {  -360,   164,  -376,   164, -1533,
+            576,   308,  -314,   308,   121,
+            -73,   121,    91,   124,    91 },
+        {  -295,   200,  -363,   142, -1391,
+            826,   151,   301,   151,   151,
+            301,   151,   602,  -752,   602 },
+        {   -92,    58,   -96,    49,  -104,
+             44,    17,    35,    17,    12,
+             25,    12,    13,    27,    13 },
+        {  -375,   136,  -399,   209, -1479,
+            949,   130,   260,   130,   230,
+            -44,   230,   201,  -191,   201 },
+        { 0xed9,  0xc8, 0xe95,  0x8e, 0xa91,
+          0x33a,  0x97, 0x12d,  0x97,  0x97,
+          0x12d,  0x97, 0x25a, 0xd10, 0x25a }
+};
+
+/* addr0,  addr1,  bmask,  shift */
+const struct nphy_rf_control_override_rev2 tbl_rf_control_override_rev2[] = {
+        { 0x78, 0x78, 0x0038,  3 }, /* for field == 0x0002 (fls == 2) */
+        { 0x7A, 0x7D, 0x0001,  0 }, /* for field == 0x0004 (fls == 3) */
+        { 0x7A, 0x7D, 0x0002,  1 }, /* for field == 0x0008 (fls == 4) */
+        { 0x7A, 0x7D, 0x0004,  2 }, /* for field == 0x0010 (fls == 5) */
+        { 0x7A, 0x7D, 0x0030,  4 }, /* for field == 0x0020 (fls == 6) */
+        { 0x7A, 0x7D, 0x00C0,  6 }, /* for field == 0x0040 (fls == 7) */
+        { 0x7A, 0x7D, 0x0100,  8 }, /* for field == 0x0080 (fls == 8) */
+        { 0x7A, 0x7D, 0x0200,  9 }, /* for field == 0x0100 (fls == 9) */
+        { 0x78, 0x78, 0x0004,  2 }, /* for field == 0x0200 (fls == 10) */
+        { 0x7B, 0x7E, 0x01FF,  0 }, /* for field == 0x0400 (fls == 11) */
+        { 0x7C, 0x7F, 0x01FF,  0 }, /* for field == 0x0800 (fls == 12) */
+        { 0x78, 0x78, 0x0100,  8 }, /* for field == 0x1000 (fls == 13) */
+        { 0x78, 0x78, 0x0200,  9 }, /* for field == 0x2000 (fls == 14) */
+        { 0x78, 0x78, 0xF000, 12 }  /* for field == 0x4000 (fls == 15) */
+};
+
+/* val_mask, val_shift, en_addr0, val_addr0, en_addr1, val_addr1 */
+const struct nphy_rf_control_override_rev3 tbl_rf_control_override_rev3[] = {
+        { 0x8000, 15, 0xE5, 0xF9, 0xE6, 0xFB }, /* field == 0x0001 (fls 1) */
+        { 0x0001,  0, 0xE7, 0x7A, 0xEC, 0x7D }, /* field == 0x0002 (fls 2) */
+        { 0x0002,  1, 0xE7, 0x7A, 0xEC, 0x7D }, /* field == 0x0004 (fls 3) */
+        { 0x0004,  2, 0xE7, 0x7A, 0xEC, 0x7D }, /* field == 0x0008 (fls 4) */
+        { 0x0016,  4, 0xE7, 0x7A, 0xEC, 0x7D }, /* field == 0x0010 (fls 5) */
+        { 0x0020,  5, 0xE7, 0x7A, 0xEC, 0x7D }, /* field == 0x0020 (fls 6) */
+        { 0x0040,  6, 0xE7, 0x7A, 0xEC, 0x7D }, /* field == 0x0040 (fls 7) */
+        { 0x0080,  6, 0xE7, 0x7A, 0xEC, 0x7D }, /* field == 0x0080 (fls 8) */
+        { 0x0100,  7, 0xE7, 0x7A, 0xEC, 0x7D }, /* field == 0x0100 (fls 9) */
+        { 0x0007,  0, 0xE7, 0xF8, 0xEC, 0xFA }, /* field == 0x0200 (fls 10) */
+        { 0x0070,  4, 0xE7, 0xF8, 0xEC, 0xFA }, /* field == 0x0400 (fls 11) */
+        { 0xE000, 13, 0xE7, 0x7A, 0xEC, 0x7D }, /* field == 0x0800 (fls 12) */
+        { 0xFFFF,  0, 0xE7, 0x7B, 0xEC, 0x7E }, /* field == 0x1000 (fls 13) */
+        { 0xFFFF,  0, 0xE7, 0x7C, 0xEC, 0x7F }, /* field == 0x2000 (fls 14) */
+        { 0x00C0,  6, 0xE7, 0xF9, 0xEC, 0xFB }  /* field == 0x4000 (fls 15) */
+};
+
 static inline void assert_ntab_array_sizes(void)
 {
 #undef check
@@ -2442,6 +2980,72 @@ static inline void assert_ntab_array_sizes(void)
 #undef check
 }
 
+u32 b43_ntab_read(struct b43_wldev *dev, u32 offset)
+{
+        u32 type, value;
+
+        type = offset & B43_NTAB_TYPEMASK;
+        offset &= ~B43_NTAB_TYPEMASK;
+        B43_WARN_ON(offset > 0xFFFF);
+
+        switch (type) {
+        case B43_NTAB_8BIT:
+                b43_phy_write(dev, B43_NPHY_TABLE_ADDR, offset);
+                value = b43_phy_read(dev, B43_NPHY_TABLE_DATALO) & 0xFF;
+                break;
+        case B43_NTAB_16BIT:
+                b43_phy_write(dev, B43_NPHY_TABLE_ADDR, offset);
+                value = b43_phy_read(dev, B43_NPHY_TABLE_DATALO);
+                break;
+        case B43_NTAB_32BIT:
+                b43_phy_write(dev, B43_NPHY_TABLE_ADDR, offset);
+                value = b43_phy_read(dev, B43_NPHY_TABLE_DATAHI);
+                value <<= 16;
+                value |= b43_phy_read(dev, B43_NPHY_TABLE_DATALO);
+                break;
+        default:
+                B43_WARN_ON(1);
+                value = 0;
+        }
+
+        return value;
+}
+
+void b43_ntab_read_bulk(struct b43_wldev *dev, u32 offset,
+                         unsigned int nr_elements, void *_data)
+{
+        u32 type;
+        u8 *data = _data;
+        unsigned int i;
+
+        type = offset & B43_NTAB_TYPEMASK;
+        offset &= ~B43_NTAB_TYPEMASK;
+        B43_WARN_ON(offset > 0xFFFF);
+
+        b43_phy_write(dev, B43_NPHY_TABLE_ADDR, offset);
+
+        for (i = 0; i < nr_elements; i++) {
+                switch (type) {
+                case B43_NTAB_8BIT:
+                        *data = b43_phy_read(dev, B43_NPHY_TABLE_DATALO) & 0xFF;
+                        data++;
+                        break;
+                case B43_NTAB_16BIT:
+                        *((u16 *)data) = b43_phy_read(dev, B43_NPHY_TABLE_DATALO);
+                        data += 2;
+                        break;
+                case B43_NTAB_32BIT:
+                        *((u32 *)data) = b43_phy_read(dev, B43_NPHY_TABLE_DATAHI);
+                        *((u32 *)data) <<= 16;
+                        *((u32 *)data) |= b43_phy_read(dev, B43_NPHY_TABLE_DATALO);
+                        data += 4;
+                        break;
+                default:
+                        B43_WARN_ON(1);
+                }
+        }
+}
+
 void b43_ntab_write(struct b43_wldev *dev, u32 offset, u32 value)
 {
         u32 type;
@@ -2474,3 +3078,91 @@ void b43_ntab_write(struct b43_wldev *dev, u32 offset, u32 value)
         /* Some compiletime assertions... */
         assert_ntab_array_sizes();
 }
+
+void b43_ntab_write_bulk(struct b43_wldev *dev, u32 offset,
+                          unsigned int nr_elements, const void *_data)
+{
+        u32 type, value;
+        const u8 *data = _data;
+        unsigned int i;
+
+        type = offset & B43_NTAB_TYPEMASK;
+        offset &= ~B43_NTAB_TYPEMASK;
+        B43_WARN_ON(offset > 0xFFFF);
+
+        b43_phy_write(dev, B43_NPHY_TABLE_ADDR, offset);
+
+        for (i = 0; i < nr_elements; i++) {
+                switch (type) {
+                case B43_NTAB_8BIT:
+                        value = *data;
+                        data++;
+                        B43_WARN_ON(value & ~0xFF);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, value);
+                        break;
+                case B43_NTAB_16BIT:
+                        value = *((u16 *)data);
+                        data += 2;
+                        B43_WARN_ON(value & ~0xFFFF);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO, value);
+                        break;
+                case B43_NTAB_32BIT:
+                        value = *((u32 *)data);
+                        data += 4;
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATAHI, value >> 16);
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
+                                        value & 0xFFFF);
+                        break;
+                default:
+                        B43_WARN_ON(1);
+                }
+        }
+}
+
+#define ntab_upload(dev, offset, data) do { \
+                unsigned int i;                                         \
+                for (i = 0; i < (offset##_SIZE); i++)                   \
+                        b43_ntab_write(dev, (offset) + i, (data)[i]);   \
+        } while (0)
+
+void b43_nphy_rev0_1_2_tables_init(struct b43_wldev *dev)
+{
+        /* Static tables */
+        ntab_upload(dev, B43_NTAB_FRAMESTRUCT, b43_ntab_framestruct);
+        ntab_upload(dev, B43_NTAB_FRAMELT, b43_ntab_framelookup);
+        ntab_upload(dev, B43_NTAB_TMAP, b43_ntab_tmap);
+        ntab_upload(dev, B43_NTAB_TDTRN, b43_ntab_tdtrn);
+        ntab_upload(dev, B43_NTAB_INTLEVEL, b43_ntab_intlevel);
+        ntab_upload(dev, B43_NTAB_PILOT, b43_ntab_pilot);
+        ntab_upload(dev, B43_NTAB_PILOTLT, b43_ntab_pilotlt);
+        ntab_upload(dev, B43_NTAB_TDI20A0, b43_ntab_tdi20a0);
+        ntab_upload(dev, B43_NTAB_TDI20A1, b43_ntab_tdi20a1);
+        ntab_upload(dev, B43_NTAB_TDI40A0, b43_ntab_tdi40a0);
+        ntab_upload(dev, B43_NTAB_TDI40A1, b43_ntab_tdi40a1);
+        ntab_upload(dev, B43_NTAB_BDI, b43_ntab_bdi);
+        ntab_upload(dev, B43_NTAB_CHANEST, b43_ntab_channelest);
+        ntab_upload(dev, B43_NTAB_MCS, b43_ntab_mcs);
+
+        /* Volatile tables */
+        ntab_upload(dev, B43_NTAB_NOISEVAR10, b43_ntab_noisevar10);
+        ntab_upload(dev, B43_NTAB_NOISEVAR11, b43_ntab_noisevar11);
+        ntab_upload(dev, B43_NTAB_C0_ESTPLT, b43_ntab_estimatepowerlt0);
+        ntab_upload(dev, B43_NTAB_C1_ESTPLT, b43_ntab_estimatepowerlt1);
+        ntab_upload(dev, B43_NTAB_C0_ADJPLT, b43_ntab_adjustpower0);
+        ntab_upload(dev, B43_NTAB_C1_ADJPLT, b43_ntab_adjustpower1);
+        ntab_upload(dev, B43_NTAB_C0_GAINCTL, b43_ntab_gainctl0);
+        ntab_upload(dev, B43_NTAB_C1_GAINCTL, b43_ntab_gainctl1);
+        ntab_upload(dev, B43_NTAB_C0_IQLT, b43_ntab_iqlt0);
+        ntab_upload(dev, B43_NTAB_C1_IQLT, b43_ntab_iqlt1);
+        ntab_upload(dev, B43_NTAB_C0_LOFEEDTH, b43_ntab_loftlt0);
+        ntab_upload(dev, B43_NTAB_C1_LOFEEDTH, b43_ntab_loftlt1);
+}
+
+void b43_nphy_rev3plus_tables_init(struct b43_wldev *dev)
+{
+        /* Static tables */
+        /* TODO */
+
+        /* Volatile tables */
+        /* TODO */
+}
diff --git a/drivers/net/wireless/b43/tables_nphy.h b/drivers/net/wireless/b43/tables_nphy.h
index 4d498b053ec7..9c1c6ecd3672 100644
--- a/drivers/net/wireless/b43/tables_nphy.h
+++ b/drivers/net/wireless/b43/tables_nphy.h
@@ -46,6 +46,27 @@ struct b43_nphy_channeltab_entry {
 
 struct b43_wldev;
 
+struct nphy_txiqcal_ladder {
+        u8 percent;
+        u8 g_env;
+};
+
+struct nphy_rf_control_override_rev2 {
+        u8 addr0;
+        u8 addr1;
+        u16 bmask;
+        u8 shift;
+};
+
+struct nphy_rf_control_override_rev3 {
+        u16 val_mask;
+        u8 val_shift;
+        u8 en_addr0;
+        u8 val_addr0;
+        u8 en_addr1;
+        u8 val_addr1;
+};
+
 /* Upload the default register value table.
  * If "ghz5" is true, we upload the 5Ghz table. Otherwise the 2.4Ghz
  * table is uploaded. If "ignore_uploadflag" is true, we upload any value
@@ -126,34 +147,57 @@ b43_nphy_get_chantabent(struct b43_wldev *dev, u8 channel);
 #define B43_NTAB_C1_LOFEEDTH            B43_NTAB16(0x1B, 0x1C0) /* Local Oscillator Feed Through Lookup Table Core 1 */
 #define B43_NTAB_C1_LOFEEDTH_SIZE       128
 
+#define B43_NTAB_TX_IQLO_CAL_LOFT_LADDER_40_SIZE        18
+#define B43_NTAB_TX_IQLO_CAL_LOFT_LADDER_20_SIZE        18
+#define B43_NTAB_TX_IQLO_CAL_IQIMB_LADDER_40_SIZE       18
+#define B43_NTAB_TX_IQLO_CAL_IQIMB_LADDER_20_SIZE       18
+#define B43_NTAB_TX_IQLO_CAL_STARTCOEFS_REV3            11
+#define B43_NTAB_TX_IQLO_CAL_STARTCOEFS                 9
+#define B43_NTAB_TX_IQLO_CAL_CMDS_RECAL_REV3            12
+#define B43_NTAB_TX_IQLO_CAL_CMDS_RECAL                 10
+#define B43_NTAB_TX_IQLO_CAL_CMDS_FULLCAL               10
+#define B43_NTAB_TX_IQLO_CAL_CMDS_FULLCAL_REV3          12
+
+u32 b43_ntab_read(struct b43_wldev *dev, u32 offset);
+void b43_ntab_read_bulk(struct b43_wldev *dev, u32 offset,
+                         unsigned int nr_elements, void *_data);
 void b43_ntab_write(struct b43_wldev *dev, u32 offset, u32 value);
-
-extern const u8 b43_ntab_adjustpower0[];
-extern const u8 b43_ntab_adjustpower1[];
-extern const u16 b43_ntab_bdi[];
-extern const u32 b43_ntab_channelest[];
-extern const u8 b43_ntab_estimatepowerlt0[];
-extern const u8 b43_ntab_estimatepowerlt1[];
-extern const u8 b43_ntab_framelookup[];
-extern const u32 b43_ntab_framestruct[];
-extern const u32 b43_ntab_gainctl0[];
-extern const u32 b43_ntab_gainctl1[];
-extern const u32 b43_ntab_intlevel[];
-extern const u32 b43_ntab_iqlt0[];
-extern const u32 b43_ntab_iqlt1[];
-extern const u16 b43_ntab_loftlt0[];
-extern const u16 b43_ntab_loftlt1[];
-extern const u8 b43_ntab_mcs[];
-extern const u32 b43_ntab_noisevar10[];
-extern const u32 b43_ntab_noisevar11[];
-extern const u16 b43_ntab_pilot[];
-extern const u32 b43_ntab_pilotlt[];
-extern const u32 b43_ntab_tdi20a0[];
-extern const u32 b43_ntab_tdi20a1[];
-extern const u32 b43_ntab_tdi40a0[];
-extern const u32 b43_ntab_tdi40a1[];
-extern const u32 b43_ntab_tdtrn[];
-extern const u32 b43_ntab_tmap[];
-
+void b43_ntab_write_bulk(struct b43_wldev *dev, u32 offset,
+                          unsigned int nr_elements, const void *_data);
+
+void b43_nphy_rev0_1_2_tables_init(struct b43_wldev *dev);
+void b43_nphy_rev3plus_tables_init(struct b43_wldev *dev);
+
+extern const u32 b43_ntab_tx_gain_rev0_1_2[];
+extern const u32 b43_ntab_tx_gain_rev3plus_2ghz[];
+extern const u32 b43_ntab_tx_gain_rev3_5ghz[];
+extern const u32 b43_ntab_tx_gain_rev4_5ghz[];
+extern const u32 b43_ntab_tx_gain_rev5plus_5ghz[];
+
+extern const u32 txpwrctrl_tx_gain_ipa[];
+extern const u32 txpwrctrl_tx_gain_ipa_rev5[];
+extern const u32 txpwrctrl_tx_gain_ipa_rev6[];
+extern const u32 txpwrctrl_tx_gain_ipa_5g[];
+extern const u16 tbl_iqcal_gainparams[2][9][8];
+extern const struct nphy_txiqcal_ladder ladder_lo[];
+extern const struct nphy_txiqcal_ladder ladder_iq[];
+extern const u16 loscale[];
+
+extern const u16 tbl_tx_iqlo_cal_loft_ladder_40[];
+extern const u16 tbl_tx_iqlo_cal_loft_ladder_20[];
+extern const u16 tbl_tx_iqlo_cal_iqimb_ladder_40[];
+extern const u16 tbl_tx_iqlo_cal_iqimb_ladder_20[];
+extern const u16 tbl_tx_iqlo_cal_startcoefs_nphyrev3[];
+extern const u16 tbl_tx_iqlo_cal_startcoefs[];
+extern const u16 tbl_tx_iqlo_cal_cmds_recal_nphyrev3[];
+extern const u16 tbl_tx_iqlo_cal_cmds_recal[];
+extern const u16 tbl_tx_iqlo_cal_cmds_fullcal[];
+extern const u16 tbl_tx_iqlo_cal_cmds_fullcal_nphyrev3[];
+extern const s16 tbl_tx_filter_coef_rev4[7][15];
+
+extern const struct nphy_rf_control_override_rev2
+        tbl_rf_control_override_rev2[];
+extern const struct nphy_rf_control_override_rev3
+        tbl_rf_control_override_rev3[];
 
 #endif /* B43_TABLES_NPHY_H_ */
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index f4e9695ec186..eda06529ef5f 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -27,7 +27,7 @@
 
 */
 
-#include "b43.h"
+#include "xmit.h"
 #include "phy_common.h"
 #include "dma.h"
 #include "pio.h"
@@ -621,7 +621,6 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
                                                   (phystat0 & B43_RX_PHYST0_OFDM),
                                                   (phystat0 & B43_RX_PHYST0_GAINCTL),
                                                   (phystat3 & B43_RX_PHYST3_TRSTATE));
-                status.qual = (rxhdr->jssi * 100) / B43_RX_MAX_SSI;
         }
 
         if (phystat0 & B43_RX_PHYST0_OFDM)
@@ -690,10 +689,7 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
         }
 
         memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
-
-        local_bh_disable();
-        ieee80211_rx(dev->wl->hw, skb);
-        local_bh_enable();
+        ieee80211_rx_ni(dev->wl->hw, skb);
 
 #if B43_DEBUG
         dev->rx_count++;
diff --git a/drivers/net/wireless/b43/xmit.h b/drivers/net/wireless/b43/xmit.h
index 3530de871873..d23ff9fe0c9e 100644
--- a/drivers/net/wireless/b43/xmit.h
+++ b/drivers/net/wireless/b43/xmit.h
@@ -2,6 +2,8 @@
 #define B43_XMIT_H_
 
 #include "main.h"
+#include <net/mac80211.h>
+
 
 #define _b43_declare_plcp_hdr(size) \
         struct b43_plcp_hdr##size {             \
@@ -332,4 +334,21 @@ static inline u8 b43_kidx_to_raw(struct b43_wldev *dev, u8 firmware_kidx)
         return raw_kidx;
 }
 
+/* struct b43_private_tx_info - TX info private to b43.
+ * The structure is placed in (struct ieee80211_tx_info *)->rate_driver_data
+ *
+ * @bouncebuffer: DMA Bouncebuffer (if used)
+ */
+struct b43_private_tx_info {
+        void *bouncebuffer;
+};
+
+static inline struct b43_private_tx_info *
+b43_get_priv_tx_info(struct ieee80211_tx_info *info)
+{
+        BUILD_BUG_ON(sizeof(struct b43_private_tx_info) >
+                     sizeof(info->rate_driver_data));
+        return (struct b43_private_tx_info *)info->rate_driver_data;
+}
+
 #endif /* B43_XMIT_H_ */
diff --git a/drivers/net/wireless/b43legacy/Kconfig b/drivers/net/wireless/b43legacy/Kconfig
index 94a463478053..1ffa28835c58 100644
--- a/drivers/net/wireless/b43legacy/Kconfig
+++ b/drivers/net/wireless/b43legacy/Kconfig
@@ -1,6 +1,6 @@
 config B43LEGACY
         tristate "Broadcom 43xx-legacy wireless support (mac80211 stack)"
-        depends on SSB_POSSIBLE && MAC80211 && WLAN_80211 && HAS_DMA
+        depends on SSB_POSSIBLE && MAC80211 && HAS_DMA
         select SSB
         select FW_LOADER
         ---help---
diff --git a/drivers/net/wireless/b43legacy/b43legacy.h b/drivers/net/wireless/b43legacy/b43legacy.h
index 038baa8869e2..89fe2f972c72 100644
--- a/drivers/net/wireless/b43legacy/b43legacy.h
+++ b/drivers/net/wireless/b43legacy/b43legacy.h
@@ -29,8 +29,6 @@
 
 #define B43legacy_IRQWAIT_MAX_RETRIES   20
 
-#define B43legacy_RX_MAX_SSI            60 /* best guess at max ssi */
-
 /* MMIO offsets */
 #define B43legacy_MMIO_DMA0_REASON      0x20
 #define B43legacy_MMIO_DMA0_IRQ_MASK    0x24
diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index 866403415811..e91520d0312e 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -37,6 +37,7 @@
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/dst.h>
 
 /* 32bit DMA ops. */
@@ -1240,8 +1241,9 @@ struct b43legacy_dmaring *parse_cookie(struct b43legacy_wldev *dev,
 }
 
 static int dma_tx_fragment(struct b43legacy_dmaring *ring,
-                            struct sk_buff *skb)
+                            struct sk_buff **in_skb)
 {
+        struct sk_buff *skb = *in_skb;
         const struct b43legacy_dma_ops *ops = ring->ops;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         u8 *header;
@@ -1305,8 +1307,14 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
                 }
 
                 memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len);
+                memcpy(bounce_skb->cb, skb->cb, sizeof(skb->cb));
+                bounce_skb->dev = skb->dev;
+                skb_set_queue_mapping(bounce_skb, skb_get_queue_mapping(skb));
+                info = IEEE80211_SKB_CB(bounce_skb);
+
                 dev_kfree_skb_any(skb);
                 skb = bounce_skb;
+                *in_skb = bounce_skb;
                 meta->skb = skb;
                 meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
                 if (b43legacy_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
@@ -1360,8 +1368,10 @@ int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                      struct sk_buff *skb)
 {
         struct b43legacy_dmaring *ring;
+        struct ieee80211_hdr *hdr;
         int err = 0;
         unsigned long flags;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         ring = priority_to_txring(dev, skb_get_queue_mapping(skb));
         spin_lock_irqsave(&ring->lock, flags);
@@ -1386,7 +1396,11 @@ int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                 goto out_unlock;
         }
 
-        err = dma_tx_fragment(ring, skb);
+        /* dma_tx_fragment might reallocate the skb, so invalidate pointers pointing
+         * into the skb data or cb now. */
+        hdr = NULL;
+        info = NULL;
+        err = dma_tx_fragment(ring, &skb);
         if (unlikely(err == -ENOKEY)) {
                 /* Drop this packet, as we don't have the encryption key
                  * anymore and must not transmit it unencrypted. */
@@ -1398,7 +1412,6 @@ int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                 b43legacyerr(dev->wl, "DMA tx mapping failure\n");
                 goto out_unlock;
         }
-        ring->nr_tx_packets++;
         if ((free_slots(ring) < SLOTS_PER_PACKET) ||
             should_inject_overflow(ring)) {
                 /* This TX ring is full. */
@@ -1514,25 +1527,6 @@ void b43legacy_dma_handle_txstatus(struct b43legacy_wldev *dev,
         spin_unlock(&ring->lock);
 }
 
-void b43legacy_dma_get_tx_stats(struct b43legacy_wldev *dev,
-                              struct ieee80211_tx_queue_stats *stats)
-{
-        const int nr_queues = dev->wl->hw->queues;
-        struct b43legacy_dmaring *ring;
-        unsigned long flags;
-        int i;
-
-        for (i = 0; i < nr_queues; i++) {
-                ring = priority_to_txring(dev, i);
-
-                spin_lock_irqsave(&ring->lock, flags);
-                stats[i].len = ring->used_slots / SLOTS_PER_PACKET;
-                stats[i].limit = ring->nr_slots / SLOTS_PER_PACKET;
-                stats[i].count = ring->nr_tx_packets;
-                spin_unlock_irqrestore(&ring->lock, flags);
-        }
-}
-
 static void dma_rx(struct b43legacy_dmaring *ring,
                    int *slot)
 {
diff --git a/drivers/net/wireless/b43legacy/dma.h b/drivers/net/wireless/b43legacy/dma.h
index 2f186003c31e..f9681041c2d8 100644
--- a/drivers/net/wireless/b43legacy/dma.h
+++ b/drivers/net/wireless/b43legacy/dma.h
@@ -243,8 +243,6 @@ struct b43legacy_dmaring {
         int used_slots;
         /* Currently used slot in the ring. */
         int current_slot;
-        /* Total number of packets sent. Statistics only. */
-        unsigned int nr_tx_packets;
         /* Frameoffset in octets. */
         u32 frameoffset;
         /* Descriptor buffer size. */
@@ -292,9 +290,6 @@ void b43legacy_dma_free(struct b43legacy_wldev *dev);
 void b43legacy_dma_tx_suspend(struct b43legacy_wldev *dev);
 void b43legacy_dma_tx_resume(struct b43legacy_wldev *dev);
 
-void b43legacy_dma_get_tx_stats(struct b43legacy_wldev *dev,
-                                struct ieee80211_tx_queue_stats *stats);
-
 int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                      struct sk_buff *skb);
 void b43legacy_dma_handle_txstatus(struct b43legacy_wldev *dev,
@@ -315,11 +310,6 @@ void b43legacy_dma_free(struct b43legacy_wldev *dev)
 {
 }
 static inline
-void b43legacy_dma_get_tx_stats(struct b43legacy_wldev *dev,
-                                struct ieee80211_tx_queue_stats *stats)
-{
-}
-static inline
 int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                      struct sk_buff *skb)
 {
diff --git a/drivers/net/wireless/b43legacy/leds.h b/drivers/net/wireless/b43legacy/leds.h
index 82167a90088f..9ff6750dc57f 100644
--- a/drivers/net/wireless/b43legacy/leds.h
+++ b/drivers/net/wireless/b43legacy/leds.h
@@ -45,7 +45,7 @@ enum b43legacy_led_behaviour {
 void b43legacy_leds_init(struct b43legacy_wldev *dev);
 void b43legacy_leds_exit(struct b43legacy_wldev *dev);
 
-#else /* CONFIG_B43EGACY_LEDS */
+#else /* CONFIG_B43LEGACY_LEDS */
 /* LED support disabled */
 
 struct b43legacy_led {
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 4b60148a5e61..bb2dd9329aa0 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -40,6 +40,7 @@
 #include <linux/sched.h>
 #include <linux/skbuff.h>
 #include <linux/dma-mapping.h>
+#include <linux/slab.h>
 #include <net/dst.h>
 #include <asm/unaligned.h>
 
@@ -61,6 +62,8 @@ MODULE_AUTHOR("Michael Buesch");
 MODULE_LICENSE("GPL");
 
 MODULE_FIRMWARE(B43legacy_SUPPORTED_FIRMWARE_ID);
+MODULE_FIRMWARE("b43legacy/ucode2.fw");
+MODULE_FIRMWARE("b43legacy/ucode4.fw");
 
 #if defined(CONFIG_B43LEGACY_DMA) && defined(CONFIG_B43LEGACY_PIO)
 static int modparam_pio;
@@ -2277,7 +2280,7 @@ static void do_periodic_work(struct b43legacy_wldev *dev)
 /* Periodic work locking policy:
  *      The whole periodic work handler is protected by
  *      wl->mutex. If another lock is needed somewhere in the
- *      pwork callchain, it's aquired in-place, where it's needed.
+ *      pwork callchain, it's acquired in-place, where it's needed.
  */
 static void b43legacy_periodic_work_handler(struct work_struct *work)
 {
@@ -2444,29 +2447,6 @@ static int b43legacy_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
         return 0;
 }
 
-static int b43legacy_op_get_tx_stats(struct ieee80211_hw *hw,
-                                     struct ieee80211_tx_queue_stats *stats)
-{
-        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
-        struct b43legacy_wldev *dev = wl->current_dev;
-        unsigned long flags;
-        int err = -ENODEV;
-
-        if (!dev)
-                goto out;
-        spin_lock_irqsave(&wl->irq_lock, flags);
-        if (likely(b43legacy_status(dev) >= B43legacy_STAT_STARTED)) {
-                if (b43legacy_using_pio(dev))
-                        b43legacy_pio_get_tx_stats(dev, stats);
-                else
-                        b43legacy_dma_get_tx_stats(dev, stats);
-                err = 0;
-        }
-        spin_unlock_irqrestore(&wl->irq_lock, flags);
-out:
-        return err;
-}
-
 static int b43legacy_op_get_stats(struct ieee80211_hw *hw,
                                   struct ieee80211_low_level_stats *stats)
 {
@@ -2677,7 +2657,7 @@ static int b43legacy_op_dev_config(struct ieee80211_hw *hw,
         if (conf->channel->hw_value != phy->channel)
                 b43legacy_radio_selectchannel(dev, conf->channel->hw_value, 0);
 
-        dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
+        dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
 
         /* Adjust the desired TX power level. */
         if (conf->power_level != 0) {
@@ -2921,6 +2901,7 @@ static int b43legacy_wireless_core_start(struct b43legacy_wldev *dev)
                 goto out;
         }
         /* We are ready to run. */
+        ieee80211_wake_queues(dev->wl->hw);
         b43legacy_set_status(dev, B43legacy_STAT_STARTED);
 
         /* Start data flow (TX/RX) */
@@ -3341,6 +3322,7 @@ static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev)
         b43legacy_security_init(dev);
         b43legacy_rng_init(wl);
 
+        ieee80211_wake_queues(dev->wl->hw);
         b43legacy_set_status(dev, B43legacy_STAT_INITIALIZED);
 
         b43legacy_leds_init(dev);
@@ -3361,7 +3343,7 @@ err_kfree_lo_control:
 }
 
 static int b43legacy_op_add_interface(struct ieee80211_hw *hw,
-                                      struct ieee80211_if_init_conf *conf)
+                                      struct ieee80211_vif *vif)
 {
         struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
         struct b43legacy_wldev *dev;
@@ -3370,23 +3352,23 @@ static int b43legacy_op_add_interface(struct ieee80211_hw *hw,
 
         /* TODO: allow WDS/AP devices to coexist */
 
-        if (conf->type != NL80211_IFTYPE_AP &&
-            conf->type != NL80211_IFTYPE_STATION &&
-            conf->type != NL80211_IFTYPE_WDS &&
-            conf->type != NL80211_IFTYPE_ADHOC)
+        if (vif->type != NL80211_IFTYPE_AP &&
+            vif->type != NL80211_IFTYPE_STATION &&
+            vif->type != NL80211_IFTYPE_WDS &&
+            vif->type != NL80211_IFTYPE_ADHOC)
                 return -EOPNOTSUPP;
 
         mutex_lock(&wl->mutex);
         if (wl->operating)
                 goto out_mutex_unlock;
 
-        b43legacydbg(wl, "Adding Interface type %d\n", conf->type);
+        b43legacydbg(wl, "Adding Interface type %d\n", vif->type);
 
         dev = wl->current_dev;
         wl->operating = 1;
-        wl->vif = conf->vif;
-        wl->if_type = conf->type;
-        memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
+        wl->vif = vif;
+        wl->if_type = vif->type;
+        memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
 
         spin_lock_irqsave(&wl->irq_lock, flags);
         b43legacy_adjust_opmode(dev);
@@ -3403,18 +3385,18 @@ static int b43legacy_op_add_interface(struct ieee80211_hw *hw,
 }
 
 static void b43legacy_op_remove_interface(struct ieee80211_hw *hw,
-                                          struct ieee80211_if_init_conf *conf)
+                                          struct ieee80211_vif *vif)
 {
         struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
         struct b43legacy_wldev *dev = wl->current_dev;
         unsigned long flags;
 
-        b43legacydbg(wl, "Removing Interface type %d\n", conf->type);
+        b43legacydbg(wl, "Removing Interface type %d\n", vif->type);
 
         mutex_lock(&wl->mutex);
 
         B43legacy_WARN_ON(!wl->operating);
-        B43legacy_WARN_ON(wl->vif != conf->vif);
+        B43legacy_WARN_ON(wl->vif != vif);
         wl->vif = NULL;
 
         wl->operating = 0;
@@ -3509,7 +3491,6 @@ static const struct ieee80211_ops b43legacy_hw_ops = {
         .bss_info_changed       = b43legacy_op_bss_info_changed,
         .configure_filter       = b43legacy_op_configure_filter,
         .get_stats              = b43legacy_op_get_stats,
-        .get_tx_stats           = b43legacy_op_get_tx_stats,
         .start                  = b43legacy_op_start,
         .stop                   = b43legacy_op_stop,
         .set_tim                = b43legacy_op_beacon_set_tim,
@@ -3593,7 +3574,7 @@ static int b43legacy_wireless_core_attach(struct b43legacy_wldev *dev)
 {
         struct b43legacy_wl *wl = dev->wl;
         struct ssb_bus *bus = dev->dev->bus;
-        struct pci_dev *pdev = bus->host_pci;
+        struct pci_dev *pdev = (bus->bustype == SSB_BUSTYPE_PCI) ? bus->host_pci : NULL;
         int err;
         int have_bphy = 0;
         int have_gphy = 0;
@@ -3707,7 +3688,7 @@ static int b43legacy_one_core_attach(struct ssb_device *dev,
 
         if (!list_empty(&wl->devlist)) {
                 /* We are not the first core on this chip. */
-                pdev = dev->bus->host_pci;
+                pdev = (dev->bus->bustype == SSB_BUSTYPE_PCI) ? dev->bus->host_pci : NULL;
                 /* Only special chips support more than one wireless
                  * core, although some of the other chips have more than
                  * one wireless core as well. Check for this and
@@ -3960,7 +3941,7 @@ static struct ssb_driver b43legacy_ssb_driver = {
 
 static void b43legacy_print_driverinfo(void)
 {
-        const char *feat_pci = "", *feat_leds = "", *feat_rfkill = "",
+        const char *feat_pci = "", *feat_leds = "",
                    *feat_pio = "", *feat_dma = "";
 
 #ifdef CONFIG_B43LEGACY_PCI_AUTOSELECT
@@ -3969,9 +3950,6 @@ static void b43legacy_print_driverinfo(void)
 #ifdef CONFIG_B43LEGACY_LEDS
         feat_leds = "L";
 #endif
-#ifdef CONFIG_B43LEGACY_RFKILL
-        feat_rfkill = "R";
-#endif
 #ifdef CONFIG_B43LEGACY_PIO
         feat_pio = "I";
 #endif
@@ -3979,9 +3957,9 @@ static void b43legacy_print_driverinfo(void)
         feat_dma = "D";
 #endif
         printk(KERN_INFO "Broadcom 43xx-legacy driver loaded "
-               "[ Features: %s%s%s%s%s, Firmware-ID: "
+               "[ Features: %s%s%s%s, Firmware-ID: "
                B43legacy_SUPPORTED_FIRMWARE_ID " ]\n",
-               feat_pci, feat_leds, feat_rfkill, feat_pio, feat_dma);
+               feat_pci, feat_leds, feat_pio, feat_dma);
 }
 
 static int __init b43legacy_init(void)
diff --git a/drivers/net/wireless/b43legacy/phy.c b/drivers/net/wireless/b43legacy/phy.c
index aaf227203a98..35033dd342ce 100644
--- a/drivers/net/wireless/b43legacy/phy.c
+++ b/drivers/net/wireless/b43legacy/phy.c
@@ -32,6 +32,7 @@
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 
 #include "b43legacy.h"
diff --git a/drivers/net/wireless/b43legacy/pio.c b/drivers/net/wireless/b43legacy/pio.c
index 51866c9a2769..b033b0ed4ca0 100644
--- a/drivers/net/wireless/b43legacy/pio.c
+++ b/drivers/net/wireless/b43legacy/pio.c
@@ -29,6 +29,7 @@
 #include "xmit.h"
 
 #include <linux/delay.h>
+#include <linux/slab.h>
 
 
 static void tx_start(struct b43legacy_pioqueue *queue)
@@ -477,7 +478,6 @@ int b43legacy_pio_tx(struct b43legacy_wldev *dev,
 
         list_move_tail(&packet->list, &queue->txqueue);
         queue->nr_txfree--;
-        queue->nr_tx_packets++;
         B43legacy_WARN_ON(queue->nr_txfree >= B43legacy_PIO_MAXTXPACKETS);
 
         tasklet_schedule(&queue->txtask);
@@ -546,18 +546,6 @@ void b43legacy_pio_handle_txstatus(struct b43legacy_wldev *dev,
                 tasklet_schedule(&queue->txtask);
 }
 
-void b43legacy_pio_get_tx_stats(struct b43legacy_wldev *dev,
-                                struct ieee80211_tx_queue_stats *stats)
-{
-        struct b43legacy_pio *pio = &dev->pio;
-        struct b43legacy_pioqueue *queue;
-
-        queue = pio->queue1;
-        stats[0].len = B43legacy_PIO_MAXTXPACKETS - queue->nr_txfree;
-        stats[0].limit = B43legacy_PIO_MAXTXPACKETS;
-        stats[0].count = queue->nr_tx_packets;
-}
-
 static void pio_rx_error(struct b43legacy_pioqueue *queue,
                          int clear_buffers,
                          const char *error)
diff --git a/drivers/net/wireless/b43legacy/pio.h b/drivers/net/wireless/b43legacy/pio.h
index 464fec05a06d..8e6773ea6e75 100644
--- a/drivers/net/wireless/b43legacy/pio.h
+++ b/drivers/net/wireless/b43legacy/pio.h
@@ -74,10 +74,6 @@ struct b43legacy_pioqueue {
          * posted to the device. We are waiting for the txstatus.
          */
         struct list_head txrunning;
-        /* Total number or packets sent.
-         * (This counter can obviously wrap).
-         */
-        unsigned int nr_tx_packets;
         struct tasklet_struct txtask;
         struct b43legacy_pio_txpacket
                          tx_packets_cache[B43legacy_PIO_MAXTXPACKETS];
@@ -106,8 +102,6 @@ int b43legacy_pio_tx(struct b43legacy_wldev *dev,
                    struct sk_buff *skb);
 void b43legacy_pio_handle_txstatus(struct b43legacy_wldev *dev,
                                  const struct b43legacy_txstatus *status);
-void b43legacy_pio_get_tx_stats(struct b43legacy_wldev *dev,
-                              struct ieee80211_tx_queue_stats *stats);
 void b43legacy_pio_rx(struct b43legacy_pioqueue *queue);
 
 /* Suspend TX queue in hardware. */
@@ -140,11 +134,6 @@ void b43legacy_pio_handle_txstatus(struct b43legacy_wldev *dev,
 {
 }
 static inline
-void b43legacy_pio_get_tx_stats(struct b43legacy_wldev *dev,
-                              struct ieee80211_tx_queue_stats *stats)
-{
-}
-static inline
 void b43legacy_pio_rx(struct b43legacy_pioqueue *queue)
 {
 }
diff --git a/drivers/net/wireless/b43legacy/rfkill.c b/drivers/net/wireless/b43legacy/rfkill.c
index 8783022db11e..d579df72b783 100644
--- a/drivers/net/wireless/b43legacy/rfkill.c
+++ b/drivers/net/wireless/b43legacy/rfkill.c
@@ -34,6 +34,13 @@ bool b43legacy_is_hw_radio_enabled(struct b43legacy_wldev *dev)
                       & B43legacy_MMIO_RADIO_HWENABLED_HI_MASK))
                         return 1;
         } else {
+                /* To prevent CPU fault on PPC, do not read a register
+                 * unless the interface is started; however, on resume
+                 * for hibernation, this routine is entered early. When
+                 * that happens, unconditionally return TRUE.
+                 */
+                if (b43legacy_status(dev) < B43legacy_STAT_STARTED)
+                        return 1;
                 if (b43legacy_read16(dev, B43legacy_MMIO_RADIO_HWENABLED_LO)
                     & B43legacy_MMIO_RADIO_HWENABLED_LO_MASK)
                         return 1;
diff --git a/drivers/net/wireless/b43legacy/xmit.c b/drivers/net/wireless/b43legacy/xmit.c
index 103f3c9e7f58..9c8882d9275e 100644
--- a/drivers/net/wireless/b43legacy/xmit.c
+++ b/drivers/net/wireless/b43legacy/xmit.c
@@ -549,7 +549,6 @@ void b43legacy_rx(struct b43legacy_wldev *dev,
                                       (phystat0 & B43legacy_RX_PHYST0_GAINCTL),
                                       (phystat3 & B43legacy_RX_PHYST3_TRSTATE));
         status.noise = dev->stats.link_noise;
-        status.qual = (jssi * 100) / B43legacy_RX_MAX_SSI;
         /* change to support A PHY */
         if (phystat0 & B43legacy_RX_PHYST0_OFDM)
                 status.rate_idx = b43legacy_plcp_get_bitrate_idx_ofdm(plcp, false);
diff --git a/drivers/net/wireless/hostap/Kconfig b/drivers/net/wireless/hostap/Kconfig
index c15db2293515..287d82728bc3 100644
--- a/drivers/net/wireless/hostap/Kconfig
+++ b/drivers/net/wireless/hostap/Kconfig
@@ -1,7 +1,8 @@
 config HOSTAP
         tristate "IEEE 802.11 for Host AP (Prism2/2.5/3 and WEP/TKIP/CCMP)"
-        depends on WLAN_80211
         select WIRELESS_EXT
+        select WEXT_SPY
+        select WEXT_PRIV
         select CRYPTO
         select CRYPTO_ARC4
         select CRYPTO_ECB
diff --git a/drivers/net/wireless/hostap/hostap_80211_rx.c b/drivers/net/wireless/hostap/hostap_80211_rx.c
index 3816df96a663..f4c56121d387 100644
--- a/drivers/net/wireless/hostap/hostap_80211_rx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_rx.c
@@ -1,4 +1,5 @@
 #include <linux/etherdevice.h>
+#include <linux/slab.h>
 #include <net/lib80211.h>
 #include <linux/if_arp.h>
 
diff --git a/drivers/net/wireless/hostap/hostap_80211_tx.c b/drivers/net/wireless/hostap/hostap_80211_tx.c
index 90108b698f11..c34a3b7f1292 100644
--- a/drivers/net/wireless/hostap/hostap_80211_tx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_tx.c
@@ -1,3 +1,5 @@
+#include <linux/slab.h>
+
 #include "hostap_80211.h"
 #include "hostap_common.h"
 #include "hostap_wlan.h"
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index a2a203c90ba3..7e72ac1de49b 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -20,6 +20,7 @@
 #include <linux/delay.h>
 #include <linux/random.h>
 #include <linux/if_arp.h>
+#include <linux/slab.h>
 
 #include "hostap_wlan.h"
 #include "hostap.h"
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index ad8eab4a639b..a36501dbbe02 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -3,6 +3,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/if.h>
+#include <linux/slab.h>
 #include <linux/wait.h>
 #include <linux/timer.h>
 #include <linux/skbuff.h>
@@ -274,9 +275,6 @@ static int sandisk_enable_wireless(struct net_device *dev)
         conf_reg_t reg;
         struct hostap_interface *iface = netdev_priv(dev);
         local_info_t *local = iface->local;
-        tuple_t tuple;
-        cisparse_t *parse = NULL;
-        u_char buf[64];
         struct hostap_cs_priv *hw_priv = local->hw_priv;
 
         if (hw_priv->link->io.NumPorts1 < 0x42) {
@@ -285,28 +283,13 @@ static int sandisk_enable_wireless(struct net_device *dev)
                 goto done;
         }
 
-        parse = kmalloc(sizeof(cisparse_t), GFP_KERNEL);
-        if (parse == NULL) {
-                ret = -ENOMEM;
-                goto done;
-        }
-
-        tuple.Attributes = TUPLE_RETURN_COMMON;
-        tuple.TupleData = buf;
-        tuple.TupleDataMax = sizeof(buf);
-        tuple.TupleOffset = 0;
-
         if (hw_priv->link->manf_id != 0xd601 || hw_priv->link->card_id != 0x0101) {
                 /* No SanDisk manfid found */
                 ret = -ENODEV;
                 goto done;
         }
 
-        tuple.DesiredTuple = CISTPL_LONGLINK_MFC;
-        if (pcmcia_get_first_tuple(hw_priv->link, &tuple) ||
-            pcmcia_get_tuple_data(hw_priv->link, &tuple) ||
-            pcmcia_parse_tuple(&tuple, parse) ||
-                parse->longlink_mfc.nfn < 2) {
+        if (hw_priv->link->socket->functions < 2) {
                 /* No multi-function links found */
                 ret = -ENODEV;
                 goto done;
@@ -354,7 +337,6 @@ static int sandisk_enable_wireless(struct net_device *dev)
         udelay(10);
 
 done:
-        kfree(parse);
         return ret;
 }
 
@@ -529,10 +511,6 @@ static void prism2_detach(struct pcmcia_device *link)
 }
 
 
-#define CS_CHECK(fn, ret) \
-do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
-
-
 /* run after a CARD_INSERTION event is received to configure the PCMCIA
  * socket and make the device available to the system */
 
@@ -624,7 +602,6 @@ static int prism2_config(struct pcmcia_device *link)
         struct hostap_interface *iface;
         local_info_t *local;
         int ret = 1;
-        int last_fn, last_ret;
         struct hostap_cs_priv *hw_priv;
 
         PDEBUG(DEBUG_FLOW, "prism2_config()\n");
@@ -636,19 +613,18 @@ static int prism2_config(struct pcmcia_device *link)
         }
 
         /* Look for an appropriate configuration table entry in the CIS */
-        last_ret = pcmcia_loop_config(link, prism2_config_check, NULL);
-        if (last_ret) {
+        ret = pcmcia_loop_config(link, prism2_config_check, NULL);
+        if (ret) {
                 if (!ignore_cis_vcc)
                         printk(KERN_ERR "GetNextTuple(): No matching "
                                "CIS configuration.  Maybe you need the "
                                "ignore_cis_vcc=1 parameter.\n");
-                cs_error(link, RequestIO, last_ret);
                 goto failed;
         }
 
         /* Need to allocate net_device before requesting IRQ handler */
         dev = prism2_init_local_data(&prism2_pccard_funcs, 0,
-                                     &handle_to_dev(link));
+                                     &link->dev);
         if (dev == NULL)
                 goto failed;
         link->priv = dev;
@@ -666,13 +642,11 @@ static int prism2_config(struct pcmcia_device *link)
          * irq structure is initialized.
          */
         if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING |
-                                       IRQ_HANDLE_PRESENT;
-                link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+                link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
                 link->irq.Handler = prism2_interrupt;
-                link->irq.Instance = dev;
-                CS_CHECK(RequestIRQ,
-                         pcmcia_request_irq(link, &link->irq));
+                ret = pcmcia_request_irq(link, &link->irq);
+                if (ret)
+                        goto failed;
         }
 
         /*
@@ -680,8 +654,9 @@ static int prism2_config(struct pcmcia_device *link)
          * the I/O windows and the interrupt mapping, and putting the
          * card and host interface into "Memory and IO" mode.
          */
-        CS_CHECK(RequestConfiguration,
-                 pcmcia_request_configuration(link, &link->conf));
+        ret = pcmcia_request_configuration(link, &link->conf);
+        if (ret)
+                goto failed;
 
         dev->irq = link->irq.AssignedIRQ;
         dev->base_addr = link->io.BasePort1;
@@ -714,9 +689,6 @@ static int prism2_config(struct pcmcia_device *link)
         }
         return ret;
 
- cs_failed:
-        cs_error(link, last_fn, last_ret);
-
  failed:
         kfree(hw_priv);
         prism2_release((u_long)link);
@@ -823,13 +795,6 @@ static struct pcmcia_device_id hostap_cs_ids[] = {
         PCMCIA_MFC_DEVICE_PROD_ID12(0, "SanDisk", "ConnectPlus",
                                     0x7a954bd9, 0x74be00c6),
         PCMCIA_DEVICE_PROD_ID123(
-                "Intersil", "PRISM 2_5 PCMCIA ADAPTER", "ISL37300P",
-                0x4b801a17, 0x6345a0bf, 0xc9049a39),
-        /* D-Link DWL-650 Rev. P1; manfid 0x000b, 0x7110 */
-        PCMCIA_DEVICE_PROD_ID123(
-                "D-Link", "DWL-650 Wireless PC Card RevP", "ISL37101P-10",
-                0x1a424a1c, 0x6ea57632, 0xdd97a26b),
-        PCMCIA_DEVICE_PROD_ID123(
                 "Addtron", "AWP-100 Wireless PCMCIA", "Version 01.02",
                 0xe6ec52ce, 0x08649af2, 0x4b74baa0),
         PCMCIA_DEVICE_PROD_ID123(
@@ -863,14 +828,12 @@ static struct pcmcia_device_id hostap_cs_ids[] = {
                 "Ver. 1.00",
                 0x5cd01705, 0x4271660f, 0x9d08ee12),
         PCMCIA_DEVICE_PROD_ID123(
-                "corega", "WL PCCL-11", "ISL37300P",
-                0xa21501a, 0x59868926, 0xc9049a39),
-        PCMCIA_DEVICE_PROD_ID123(
-                "The Linksys Group, Inc.", "Wireless Network CF Card", "ISL37300P",
-                0xa5f472c2, 0x9c05598d, 0xc9049a39),
-        PCMCIA_DEVICE_PROD_ID123(
                 "Wireless LAN" , "11Mbps PC Card", "Version 01.02",
                 0x4b8870ff, 0x70e946d1, 0x4b74baa0),
+        PCMCIA_DEVICE_PROD_ID3("HFA3863", 0x355cb092),
+        PCMCIA_DEVICE_PROD_ID3("ISL37100P", 0x630d52b2),
+        PCMCIA_DEVICE_PROD_ID3("ISL37101P-10", 0xdd97a26b),
+        PCMCIA_DEVICE_PROD_ID3("ISL37300P", 0xc9049a39),
         PCMCIA_DEVICE_NULL
 };
 MODULE_DEVICE_TABLE(pcmcia, hostap_cs_ids);
diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
index ff9b5c882184..d70732819423 100644
--- a/drivers/net/wireless/hostap/hostap_hw.c
+++ b/drivers/net/wireless/hostap/hostap_hw.c
@@ -2618,6 +2618,15 @@ static irqreturn_t prism2_interrupt(int irq, void *dev_id)
         int events = 0;
         u16 ev;
 
+        /* Detect early interrupt before driver is fully configued */
+        if (!dev->base_addr) {
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "%s: Interrupt, but dev not configured\n",
+                               dev->name);
+                }
+                return IRQ_HANDLED;
+        }
+
         iface = netdev_priv(dev);
         local = iface->local;
 
diff --git a/drivers/net/wireless/hostap/hostap_info.c b/drivers/net/wireless/hostap/hostap_info.c
index 4dfb40a84c96..d737091cf6ac 100644
--- a/drivers/net/wireless/hostap/hostap_info.c
+++ b/drivers/net/wireless/hostap/hostap_info.c
@@ -2,6 +2,7 @@
 
 #include <linux/if_arp.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include "hostap_wlan.h"
 #include "hostap.h"
 #include "hostap_ap.h"
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index 9419cebca8a5..9a082308a9d4 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -1,5 +1,6 @@
 /* ioctl() (mostly Linux Wireless Extensions) routines for Host AP driver */
 
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/sched.h>
 #include <linux/ethtool.h>
diff --git a/drivers/net/wireless/hostap/hostap_pci.c b/drivers/net/wireless/hostap/hostap_pci.c
index 8fdd41f4b4f2..d24dc7dc0723 100644
--- a/drivers/net/wireless/hostap/hostap_pci.c
+++ b/drivers/net/wireless/hostap/hostap_pci.c
@@ -9,6 +9,7 @@
 #include <linux/if.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <linux/workqueue.h>
 #include <linux/wireless.h>
 #include <net/iw_handler.h>
@@ -39,7 +40,7 @@ struct hostap_pci_priv {
 /* FIX: do we need mb/wmb/rmb with memory operations? */
 
 
-static struct pci_device_id prism2_pci_id_table[] __devinitdata = {
+static DEFINE_PCI_DEVICE_TABLE(prism2_pci_id_table) = {
         /* Intersil Prism3 ISL3872 11Mb/s WLAN Controller */
         { 0x1260, 0x3872, PCI_ANY_ID, PCI_ANY_ID },
         /* Intersil Prism2.5 ISL3874 11Mb/s WLAN Controller */
diff --git a/drivers/net/wireless/hostap/hostap_plx.c b/drivers/net/wireless/hostap/hostap_plx.c
index 0e5d51086a44..33e79037770b 100644
--- a/drivers/net/wireless/hostap/hostap_plx.c
+++ b/drivers/net/wireless/hostap/hostap_plx.c
@@ -12,6 +12,7 @@
 #include <linux/if.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <linux/workqueue.h>
 #include <linux/wireless.h>
 #include <net/iw_handler.h>
@@ -60,7 +61,7 @@ struct hostap_plx_priv {
 
 #define PLXDEV(vendor,dev,str) { vendor, dev, PCI_ANY_ID, PCI_ANY_ID }
 
-static struct pci_device_id prism2_plx_id_table[] __devinitdata = {
+static DEFINE_PCI_DEVICE_TABLE(prism2_plx_id_table) = {
         PLXDEV(0x10b7, 0x7770, "3Com AirConnect PCI 777A"),
         PLXDEV(0x111a, 0x1023, "Siemens SpeedStream SS1023"),
         PLXDEV(0x126c, 0x8030, "Nortel emobility"),
diff --git a/drivers/net/wireless/i82586.h b/drivers/net/wireless/i82586.h
deleted file mode 100644
index 5f65b250646f..000000000000
--- a/drivers/net/wireless/i82586.h
+++ /dev/null
@@ -1,413 +0,0 @@
-/*
- * Intel 82586 IEEE 802.3 Ethernet LAN Coprocessor.
- *
- * See:
- *      Intel Microcommunications 1991
- *      p1-1 to p1-37
- *      Intel order No. 231658
- *      ISBN 1-55512-119-5
- *
- *     Unfortunately, the above chapter mentions neither
- * the System Configuration Pointer (SCP) nor the
- * Intermediate System Configuration Pointer (ISCP),
- * so we probably need to look elsewhere for the
- * whole story -- some recommend the "Intel LAN
- * Components manual" but I have neither a copy
- * nor a full reference.  But "elsewhere" may be
- * in the same publication...
- *     The description of a later device, the
- * "82596CA High-Performance 32-Bit Local Area Network
- * Coprocessor", (ibid. p1-38 to p1-109) does mention
- * the SCP and ISCP and also has an i82586 compatibility
- * mode.  Even more useful is "AP-235 An 82586 Data Link
- * Driver" (ibid. p1-337 to p1-417).
- */
-
-#define I82586_MEMZ     (64 * 1024)
-
-#define I82586_SCP_ADDR (I82586_MEMZ - sizeof(scp_t))
-
-#define ADDR_LEN        6
-#define I82586NULL      0xFFFF
-
-#define toff(t,p,f)     (unsigned short)((void *)(&((t *)((void *)0 + (p)))->f) - (void *)0)
-
-/*
- * System Configuration Pointer (SCP).
- */
-typedef struct scp_t    scp_t;
-struct scp_t
-{
-        unsigned short  scp_sysbus;     /* 82586 bus width:     */
-#define         SCP_SY_16BBUS   (0x0 << 0)      /* 16 bits */
-#define         SCP_SY_8BBUS    (0x1 << 0)      /*  8 bits. */
-        unsigned short  scp_junk[2];    /* Unused */
-        unsigned short  scp_iscpl;      /* lower 16 bits of ISCP_ADDR */
-        unsigned short  scp_iscph;      /* upper 16 bits of ISCP_ADDR */
-};
-
-/*
- * Intermediate System Configuration Pointer (ISCP).
- */
-typedef struct iscp_t   iscp_t;
-struct iscp_t
-{
-        unsigned short  iscp_busy;      /* set by CPU before first CA,  */
-                                        /* cleared by 82586 after read. */
-        unsigned short  iscp_offset;    /* offset of SCB                */
-        unsigned short  iscp_basel;     /* base of SCB                  */
-        unsigned short  iscp_baseh;     /*  "                           */
-};
-
-/*
- * System Control Block (SCB).
- *      The 82586 writes its status to scb_status and then
- *      raises an interrupt to alert the CPU.
- *      The CPU writes a command to scb_command and
- *      then issues a Channel Attention (CA) to alert the 82586.
- */
-typedef struct scb_t    scb_t;
-struct scb_t
-{
-        unsigned short  scb_status;     /* Status of 82586              */
-#define         SCB_ST_INT      (0xF << 12)     /* Some of:             */
-#define         SCB_ST_CX       (0x1 << 15)     /* Cmd completed        */
-#define         SCB_ST_FR       (0x1 << 14)     /* Frame received       */
-#define         SCB_ST_CNA      (0x1 << 13)     /* Cmd unit not active  */
-#define         SCB_ST_RNR      (0x1 << 12)     /* Rcv unit not ready   */
-#define         SCB_ST_JUNK0    (0x1 << 11)     /* 0                    */
-#define         SCB_ST_CUS      (0x7 <<  8)     /* Cmd unit status      */
-#define                 SCB_ST_CUS_IDLE (0 << 8)        /* Idle         */
-#define                 SCB_ST_CUS_SUSP (1 << 8)        /* Suspended    */
-#define                 SCB_ST_CUS_ACTV (2 << 8)        /* Active       */
-#define         SCB_ST_JUNK1    (0x1 <<  7)     /* 0                    */
-#define         SCB_ST_RUS      (0x7 <<  4)     /* Rcv unit status      */
-#define                 SCB_ST_RUS_IDLE (0 << 4)        /* Idle         */
-#define                 SCB_ST_RUS_SUSP (1 << 4)        /* Suspended    */
-#define                 SCB_ST_RUS_NRES (2 << 4)        /* No resources */
-#define                 SCB_ST_RUS_RDY  (4 << 4)        /* Ready        */
-        unsigned short  scb_command;    /* Next command                 */
-#define         SCB_CMD_ACK_CX  (0x1 << 15)     /* Ack cmd completion   */
-#define         SCB_CMD_ACK_FR  (0x1 << 14)     /* Ack frame received   */
-#define         SCB_CMD_ACK_CNA (0x1 << 13)     /* Ack CU not active    */
-#define         SCB_CMD_ACK_RNR (0x1 << 12)     /* Ack RU not ready     */
-#define         SCB_CMD_JUNKX   (0x1 << 11)     /* Unused               */
-#define         SCB_CMD_CUC     (0x7 <<  8)     /* Command Unit command */
-#define                 SCB_CMD_CUC_NOP (0 << 8)        /* Nop          */
-#define                 SCB_CMD_CUC_GO  (1 << 8)        /* Start cbl_offset */
-#define                 SCB_CMD_CUC_RES (2 << 8)        /* Resume execution */
-#define                 SCB_CMD_CUC_SUS (3 << 8)        /* Suspend   "  */
-#define                 SCB_CMD_CUC_ABT (4 << 8)        /* Abort     "  */
-#define         SCB_CMD_RESET   (0x1 <<  7)     /* Reset chip (hardware) */
-#define         SCB_CMD_RUC     (0x7 <<  4)     /* Receive Unit command */
-#define                 SCB_CMD_RUC_NOP (0 << 4)        /* Nop          */
-#define                 SCB_CMD_RUC_GO  (1 << 4)        /* Start rfa_offset */
-#define                 SCB_CMD_RUC_RES (2 << 4)        /* Resume reception */
-#define                 SCB_CMD_RUC_SUS (3 << 4)        /* Suspend   "  */
-#define                 SCB_CMD_RUC_ABT (4 << 4)        /* Abort     "  */
-        unsigned short  scb_cbl_offset; /* Offset of first command unit */
-                                        /* Action Command               */
-        unsigned short  scb_rfa_offset; /* Offset of first Receive      */
-                                        /* Frame Descriptor in the      */
-                                        /* Receive Frame Area           */
-        unsigned short  scb_crcerrs;    /* Properly aligned frames      */
-                                        /* received with a CRC error    */
-        unsigned short  scb_alnerrs;    /* Misaligned frames received   */
-                                        /* with a CRC error             */
-        unsigned short  scb_rscerrs;    /* Frames lost due to no space  */
-        unsigned short  scb_ovrnerrs;   /* Frames lost due to slow bus  */
-};
-
-#define scboff(p,f)     toff(scb_t, p, f)
-
-/*
- * The eight Action Commands.
- */
-typedef enum acmd_e     acmd_e;
-enum acmd_e
-{
-        acmd_nop        = 0,    /* Do nothing                           */
-        acmd_ia_setup   = 1,    /* Load an (ethernet) address into the  */
-                                /* 82586                                */
-        acmd_configure  = 2,    /* Update the 82586 operating parameters */
-        acmd_mc_setup   = 3,    /* Load a list of (ethernet) multicast  */
-                                /* addresses into the 82586             */
-        acmd_transmit   = 4,    /* Transmit a frame                     */
-        acmd_tdr        = 5,    /* Perform a Time Domain Reflectometer  */
-                                /* test on the serial link              */
-        acmd_dump       = 6,    /* Copy 82586 registers to memory       */
-        acmd_diagnose   = 7,    /* Run an internal self test            */
-};
-
-/*
- * Generic Action Command header.
- */
-typedef struct ach_t    ach_t;
-struct ach_t
-{
-        unsigned short  ac_status;              /* Command status:      */
-#define         AC_SFLD_C       (0x1 << 15)     /* Command completed    */
-#define         AC_SFLD_B       (0x1 << 14)     /* Busy executing       */
-#define         AC_SFLD_OK      (0x1 << 13)     /* Completed error free */
-#define         AC_SFLD_A       (0x1 << 12)     /* Command aborted      */
-#define         AC_SFLD_FAIL    (0x1 << 11)     /* Selftest failed      */
-#define         AC_SFLD_S10     (0x1 << 10)     /* No carrier sense     */
-                                                /* during transmission  */
-#define         AC_SFLD_S9      (0x1 <<  9)     /* Tx unsuccessful:     */
-                                                /* (stopped) lost CTS   */
-#define         AC_SFLD_S8      (0x1 <<  8)     /* Tx unsuccessful:     */
-                                                /* (stopped) slow DMA   */
-#define         AC_SFLD_S7      (0x1 <<  7)     /* Tx deferred:         */
-                                                /* other link traffic   */
-#define         AC_SFLD_S6      (0x1 <<  6)     /* Heart Beat: collision */
-                                                /* detect after last tx */
-#define         AC_SFLD_S5      (0x1 <<  5)     /* Tx stopped:          */
-                                                /* excessive collisions */
-#define         AC_SFLD_MAXCOL  (0xF <<  0)     /* Collision count      */
-        unsigned short  ac_command;             /* Command specifier:   */
-#define         AC_CFLD_EL      (0x1 << 15)     /* End of command list  */
-#define         AC_CFLD_S       (0x1 << 14)     /* Suspend on completion */
-#define         AC_CFLD_I       (0x1 << 13)     /* Interrupt on completion */
-#define         AC_CFLD_CMD     (0x7 <<  0)     /* acmd_e               */
-        unsigned short  ac_link;                /* Next Action Command  */
-};
-
-#define acoff(p,f)      toff(ach_t, p, f)
-
-/*
- * The Nop Action Command.
- */
-typedef struct ac_nop_t ac_nop_t;
-struct ac_nop_t
-{
-        ach_t   nop_h;
-};
-
-/*
- * The IA-Setup Action Command.
- */
-typedef struct ac_ias_t ac_ias_t;
-struct ac_ias_t
-{
-        ach_t           ias_h;
-        unsigned char   ias_addr[ADDR_LEN]; /* The (ethernet) address   */
-};
-
-/*
- * The Configure Action Command.
- */
-typedef struct ac_cfg_t ac_cfg_t;
-struct ac_cfg_t
-{
-        ach_t           cfg_h;
-        unsigned char   cfg_byte_cnt;   /* Size foll data: 4-12 */
-#define AC_CFG_BYTE_CNT(v)      (((v) & 0xF) << 0)
-        unsigned char   cfg_fifolim;    /* FIFO threshold       */
-#define AC_CFG_FIFOLIM(v)       (((v) & 0xF) << 0)
-        unsigned char   cfg_byte8;
-#define AC_CFG_SAV_BF(v)        (((v) & 0x1) << 7)      /* Save rxd bad frames  */
-#define AC_CFG_SRDY(v)          (((v) & 0x1) << 6)      /* SRDY/ARDY pin means  */
-                                                        /* external sync.       */
-        unsigned char   cfg_byte9;
-#define AC_CFG_ELPBCK(v)        (((v) & 0x1) << 7)      /* External loopback    */
-#define AC_CFG_ILPBCK(v)        (((v) & 0x1) << 6)      /* Internal loopback    */
-#define AC_CFG_PRELEN(v)        (((v) & 0x3) << 4)      /* Preamble length      */
-#define         AC_CFG_PLEN_2           0               /*  2 bytes     */
-#define         AC_CFG_PLEN_4           1               /*  4 bytes     */
-#define         AC_CFG_PLEN_8           2               /*  8 bytes     */
-#define         AC_CFG_PLEN_16          3               /* 16 bytes     */
-#define AC_CFG_ALOC(v)          (((v) & 0x1) << 3)      /* Addr/len data is     */
-                                                        /* explicit in buffers  */
-#define AC_CFG_ADDRLEN(v)       (((v) & 0x7) << 0)      /* Bytes per address    */
-        unsigned char   cfg_byte10;
-#define AC_CFG_BOFMET(v)        (((v) & 0x1) << 7)      /* Use alternate expo.  */
-                                                        /* backoff method       */
-#define AC_CFG_ACR(v)           (((v) & 0x7) << 4)      /* Accelerated cont. res. */
-#define AC_CFG_LINPRIO(v)       (((v) & 0x7) << 0)      /* Linear priority      */
-        unsigned char   cfg_ifs;        /* Interframe spacing           */
-        unsigned char   cfg_slotl;      /* Slot time (low byte)         */
-        unsigned char   cfg_byte13;
-#define AC_CFG_RETRYNUM(v)      (((v) & 0xF) << 4)      /* Max. collision retry */
-#define AC_CFG_SLTTMHI(v)       (((v) & 0x7) << 0)      /* Slot time (high bits) */
-        unsigned char   cfg_byte14;
-#define AC_CFG_FLGPAD(v)        (((v) & 0x1) << 7)      /* Pad with HDLC flags  */
-#define AC_CFG_BTSTF(v)         (((v) & 0x1) << 6)      /* Do HDLC bitstuffing  */
-#define AC_CFG_CRC16(v)         (((v) & 0x1) << 5)      /* 16 bit CCITT CRC     */
-#define AC_CFG_NCRC(v)          (((v) & 0x1) << 4)      /* Insert no CRC        */
-#define AC_CFG_TNCRS(v)         (((v) & 0x1) << 3)      /* Tx even if no carrier */
-#define AC_CFG_MANCH(v)         (((v) & 0x1) << 2)      /* Manchester coding    */
-#define AC_CFG_BCDIS(v)         (((v) & 0x1) << 1)      /* Disable broadcast    */
-#define AC_CFG_PRM(v)           (((v) & 0x1) << 0)      /* Promiscuous mode     */
-        unsigned char   cfg_byte15;
-#define AC_CFG_ICDS(v)          (((v) & 0x1) << 7)      /* Internal collision   */
-                                                        /* detect source        */
-#define AC_CFG_CDTF(v)          (((v) & 0x7) << 4)      /* Collision detect     */
-                                                        /* filter in bit times  */
-#define AC_CFG_ICSS(v)          (((v) & 0x1) << 3)      /* Internal carrier     */
-                                                        /* sense source         */
-#define AC_CFG_CSTF(v)          (((v) & 0x7) << 0)      /* Carrier sense        */
-                                                        /* filter in bit times  */
-        unsigned short  cfg_min_frm_len;
-#define AC_CFG_MNFRM(v)         (((v) & 0xFF) << 0)     /* Min. bytes/frame (<= 255) */
-};
-
-/*
- * The MC-Setup Action Command.
- */
-typedef struct ac_mcs_t ac_mcs_t;
-struct ac_mcs_t
-{
-        ach_t           mcs_h;
-        unsigned short  mcs_cnt;        /* No. of bytes of MC addresses */
-#if 0
-        unsigned char   mcs_data[ADDR_LEN]; /* The first MC address ..  */
-        ...
-#endif
-};
-
-#define I82586_MAX_MULTICAST_ADDRESSES  128     /* Hardware hashed filter */
-
-/*
- * The Transmit Action Command.
- */
-typedef struct ac_tx_t  ac_tx_t;
-struct ac_tx_t
-{
-        ach_t           tx_h;
-        unsigned short  tx_tbd_offset;  /* Address of list of buffers.  */
-#if     0
-Linux packets are passed down with the destination MAC address
-and length/type field already prepended to the data,
-so we do not need to insert it.  Consistent with this
-we must also set the AC_CFG_ALOC(..) flag during the
-ac_cfg_t action command.
-        unsigned char   tx_addr[ADDR_LEN]; /* The frame dest. address   */
-        unsigned short  tx_length;      /* The frame length             */
-#endif  /* 0 */
-};
-
-/*
- * The Time Domain Reflectometer Action Command.
- */
-typedef struct ac_tdr_t ac_tdr_t;
-struct ac_tdr_t
-{
-        ach_t           tdr_h;
-        unsigned short  tdr_result;     /* Result.      */
-#define         AC_TDR_LNK_OK   (0x1 << 15)     /* No link problem      */
-#define         AC_TDR_XCVR_PRB (0x1 << 14)     /* Txcvr cable problem  */
-#define         AC_TDR_ET_OPN   (0x1 << 13)     /* Open on the link     */
-#define         AC_TDR_ET_SRT   (0x1 << 12)     /* Short on the link    */
-#define         AC_TDR_TIME     (0x7FF << 0)    /* Distance to problem  */
-                                                /* site in transmit     */
-                                                /* clock cycles         */
-};
-
-/*
- * The Dump Action Command.
- */
-typedef struct ac_dmp_t ac_dmp_t;
-struct ac_dmp_t
-{
-        ach_t           dmp_h;
-        unsigned short  dmp_offset;     /* Result.      */
-};
-
-/*
- * Size of the result of the dump command.
- */
-#define DUMPBYTES       170
-
-/*
- * The Diagnose Action Command.
- */
-typedef struct ac_dgn_t ac_dgn_t;
-struct ac_dgn_t
-{
-        ach_t           dgn_h;
-};
-
-/*
- * Transmit Buffer Descriptor (TBD).
- */
-typedef struct tbd_t    tbd_t;
-struct tbd_t
-{
-        unsigned short  tbd_status;             /* Written by the CPU   */
-#define         TBD_STATUS_EOF  (0x1 << 15)     /* This TBD is the      */
-                                                /* last for this frame  */
-#define         TBD_STATUS_ACNT (0x3FFF << 0)   /* Actual count of data */
-                                                /* bytes in this buffer */
-        unsigned short  tbd_next_bd_offset;     /* Next in list         */
-        unsigned short  tbd_bufl;               /* Buffer address (low) */
-        unsigned short  tbd_bufh;               /*    "      "  (high)  */
-};
-
-/*
- * Receive Buffer Descriptor (RBD).
- */
-typedef struct rbd_t    rbd_t;
-struct rbd_t
-{
-        unsigned short  rbd_status;             /* Written by the 82586 */
-#define         RBD_STATUS_EOF  (0x1 << 15)     /* This RBD is the      */
-                                                /* last for this frame  */
-#define         RBD_STATUS_F    (0x1 << 14)     /* ACNT field is valid  */
-#define         RBD_STATUS_ACNT (0x3FFF << 0)   /* Actual no. of data   */
-                                                /* bytes in this buffer */
-        unsigned short  rbd_next_rbd_offset;    /* Next rbd in list     */
-        unsigned short  rbd_bufl;               /* Data pointer (low)   */
-        unsigned short  rbd_bufh;               /*  "      "    (high)  */
-        unsigned short  rbd_el_size;            /* EL+Data buf. size    */
-#define         RBD_EL  (0x1 << 15)             /* This BD is the       */
-                                                /* last in the list     */
-#define         RBD_SIZE (0x3FFF << 0)          /* No. of bytes the     */
-                                                /* buffer can hold      */
-};
-
-#define rbdoff(p,f)     toff(rbd_t, p, f)
-
-/*
- * Frame Descriptor (FD).
- */
-typedef struct fd_t     fd_t;
-struct fd_t
-{
-        unsigned short  fd_status;              /* Written by the 82586 */
-#define         FD_STATUS_C     (0x1 << 15)     /* Completed storing frame */
-#define         FD_STATUS_B     (0x1 << 14)     /* FD was consumed by RU */
-#define         FD_STATUS_OK    (0x1 << 13)     /* Frame rxd successfully */
-#define         FD_STATUS_S11   (0x1 << 11)     /* CRC error            */
-#define         FD_STATUS_S10   (0x1 << 10)     /* Alignment error      */
-#define         FD_STATUS_S9    (0x1 <<  9)     /* Ran out of resources */
-#define         FD_STATUS_S8    (0x1 <<  8)     /* Rx DMA overrun       */
-#define         FD_STATUS_S7    (0x1 <<  7)     /* Frame too short      */
-#define         FD_STATUS_S6    (0x1 <<  6)     /* No EOF flag          */
-        unsigned short  fd_command;             /* Command              */
-#define         FD_COMMAND_EL   (0x1 << 15)     /* Last FD in list      */
-#define         FD_COMMAND_S    (0x1 << 14)     /* Suspend RU after rx  */
-        unsigned short  fd_link_offset;         /* Next FD              */
-        unsigned short  fd_rbd_offset;          /* First RBD (data)     */
-                                                /* Prepared by CPU,     */
-                                                /* updated by 82586     */
-#if     0
-I think the rest is unused since we
-have set AC_CFG_ALOC(..).  However, just
-in case, we leave the space.
-#endif  /* 0 */
-        unsigned char   fd_dest[ADDR_LEN];      /* Destination address  */
-                                                /* Written by 82586     */
-        unsigned char   fd_src[ADDR_LEN];       /* Source address       */
-                                                /* Written by 82586     */
-        unsigned short  fd_length;              /* Frame length or type */
-                                                /* Written by 82586     */
-};
-
-#define fdoff(p,f)      toff(fd_t, p, f)
-
-/*
- * This software may only be used and distributed
- * according to the terms of the GNU General Public License.
- *
- * For more details, see wavelan.c.
- */
diff --git a/drivers/net/wireless/i82593.h b/drivers/net/wireless/i82593.h
deleted file mode 100644
index afac5c7a323d..000000000000
--- a/drivers/net/wireless/i82593.h
+++ /dev/null
@@ -1,229 +0,0 @@
-/*
- * Definitions for Intel 82593 CSMA/CD Core LAN Controller
- * The definitions are taken from the 1992 users manual with Intel
- * order number 297125-001.
- *
- * /usr/src/pc/RCS/i82593.h,v 1.1 1996/07/17 15:23:12 root Exp
- *
- * Copyright 1994, Anders Klemets <klemets@it.kth.se>
- *
- * HISTORY
- * i82593.h,v
- * Revision 1.4  2005/11/4  09:15:00  baroniunas
- * Modified copyright with permission of author as follows:
- *
- *   "If I82539.H is the only file with my copyright statement
- *    that is included in the Source Forge project, then you have
- *    my approval to change the copyright statement to be a GPL
- *    license, in the way you proposed on October 10."
- *
- * Revision 1.1  1996/07/17 15:23:12  root
- * Initial revision
- *
- * Revision 1.3  1995/04/05  15:13:58  adj
- * Initial alpha release
- *
- * Revision 1.2  1994/06/16  23:57:31  klemets
- * Mirrored all the fields in the configuration block.
- *
- * Revision 1.1  1994/06/02  20:25:34  klemets
- * Initial revision
- *
- *
- */
-#ifndef _I82593_H
-#define _I82593_H
-
-/* Intel 82593 CSMA/CD Core LAN Controller */
-
-/* Port 0 Command Register definitions */
-
-/* Execution operations */
-#define OP0_NOP                 0       /* CHNL = 0 */
-#define OP0_SWIT_TO_PORT_1      0       /* CHNL = 1 */
-#define OP0_IA_SETUP            1
-#define OP0_CONFIGURE           2
-#define OP0_MC_SETUP            3
-#define OP0_TRANSMIT            4
-#define OP0_TDR                 5
-#define OP0_DUMP                6
-#define OP0_DIAGNOSE            7
-#define OP0_TRANSMIT_NO_CRC     9
-#define OP0_RETRANSMIT          12
-#define OP0_ABORT               13
-/* Reception operations */
-#define OP0_RCV_ENABLE          8
-#define OP0_RCV_DISABLE         10
-#define OP0_STOP_RCV            11
-/* Status pointer control operations */
-#define OP0_FIX_PTR             15      /* CHNL = 1 */
-#define OP0_RLS_PTR             15      /* CHNL = 0 */
-#define OP0_RESET               14
-
-#define CR0_CHNL                (1 << 4)        /* 0=Channel 0, 1=Channel 1 */
-#define CR0_STATUS_0            0x00
-#define CR0_STATUS_1            0x20
-#define CR0_STATUS_2            0x40
-#define CR0_STATUS_3            0x60
-#define CR0_INT_ACK             (1 << 7)        /* 0=No ack, 1=acknowledge */
-
-/* Port 0 Status Register definitions */
-
-#define SR0_NO_RESULT           0               /* dummy */
-#define SR0_EVENT_MASK          0x0f
-#define SR0_IA_SETUP_DONE       1
-#define SR0_CONFIGURE_DONE      2
-#define SR0_MC_SETUP_DONE       3
-#define SR0_TRANSMIT_DONE       4
-#define SR0_TDR_DONE            5
-#define SR0_DUMP_DONE           6
-#define SR0_DIAGNOSE_PASSED     7
-#define SR0_TRANSMIT_NO_CRC_DONE 9
-#define SR0_RETRANSMIT_DONE     12
-#define SR0_EXECUTION_ABORTED   13
-#define SR0_END_OF_FRAME        8
-#define SR0_RECEPTION_ABORTED   10
-#define SR0_DIAGNOSE_FAILED     15
-#define SR0_STOP_REG_HIT        11
-
-#define SR0_CHNL                (1 << 4)
-#define SR0_EXECUTION           (1 << 5)
-#define SR0_RECEPTION           (1 << 6)
-#define SR0_INTERRUPT           (1 << 7)
-#define SR0_BOTH_RX_TX          (SR0_EXECUTION | SR0_RECEPTION)
-
-#define SR3_EXEC_STATE_MASK     0x03
-#define SR3_EXEC_IDLE           0
-#define SR3_TX_ABORT_IN_PROGRESS 1
-#define SR3_EXEC_ACTIVE         2
-#define SR3_ABORT_IN_PROGRESS   3
-#define SR3_EXEC_CHNL           (1 << 2)
-#define SR3_STP_ON_NO_RSRC      (1 << 3)
-#define SR3_RCVING_NO_RSRC      (1 << 4)
-#define SR3_RCV_STATE_MASK      0x60
-#define SR3_RCV_IDLE            0x00
-#define SR3_RCV_READY           0x20
-#define SR3_RCV_ACTIVE          0x40
-#define SR3_RCV_STOP_IN_PROG    0x60
-#define SR3_RCV_CHNL            (1 << 7)
-
-/* Port 1 Command Register definitions */
-
-#define OP1_NOP                 0
-#define OP1_SWIT_TO_PORT_0      1
-#define OP1_INT_DISABLE         2
-#define OP1_INT_ENABLE          3
-#define OP1_SET_TS              5
-#define OP1_RST_TS              7
-#define OP1_POWER_DOWN          8
-#define OP1_RESET_RING_MNGMT    11
-#define OP1_RESET               14
-#define OP1_SEL_RST             15
-
-#define CR1_STATUS_4            0x00
-#define CR1_STATUS_5            0x20
-#define CR1_STATUS_6            0x40
-#define CR1_STOP_REG_UPDATE     (1 << 7)
-
-/* Receive frame status bits */
-
-#define RX_RCLD                 (1 << 0)
-#define RX_IA_MATCH             (1 << 1)
-#define RX_NO_AD_MATCH          (1 << 2)
-#define RX_NO_SFD               (1 << 3)
-#define RX_SRT_FRM              (1 << 7)
-#define RX_OVRRUN               (1 << 8)
-#define RX_ALG_ERR              (1 << 10)
-#define RX_CRC_ERR              (1 << 11)
-#define RX_LEN_ERR              (1 << 12)
-#define RX_RCV_OK               (1 << 13)
-#define RX_TYP_LEN              (1 << 15)
-
-/* Transmit status bits */
-
-#define TX_NCOL_MASK            0x0f
-#define TX_FRTL                 (1 << 4)
-#define TX_MAX_COL              (1 << 5)
-#define TX_HRT_BEAT             (1 << 6)
-#define TX_DEFER                (1 << 7)
-#define TX_UND_RUN              (1 << 8)
-#define TX_LOST_CTS             (1 << 9)
-#define TX_LOST_CRS             (1 << 10)
-#define TX_LTCOL                (1 << 11)
-#define TX_OK                   (1 << 13)
-#define TX_COLL                 (1 << 15)
-
-struct i82593_conf_block {
-  u_char fifo_limit : 4,
-         forgnesi   : 1,
-         fifo_32    : 1,
-         d6mod      : 1,
-         throttle_enb : 1;
-  u_char throttle   : 6,
-         cntrxint   : 1,
-         contin     : 1;
-  u_char addr_len   : 3,
-         acloc      : 1,
-         preamb_len : 2,
-         loopback   : 2;
-  u_char lin_prio   : 3,
-         tbofstop   : 1,
-         exp_prio   : 3,
-         bof_met    : 1;
-  u_char            : 4,
-         ifrm_spc   : 4;
-  u_char            : 5,
-         slottim_low : 3;
-  u_char slottim_hi : 3,
-                    : 1,
-         max_retr   : 4;
-  u_char prmisc     : 1,
-         bc_dis     : 1,
-                    : 1,
-         crs_1      : 1,
-         nocrc_ins  : 1,
-         crc_1632   : 1,
-                    : 1,
-         crs_cdt    : 1;
-  u_char cs_filter  : 3,
-         crs_src    : 1,
-         cd_filter  : 3,
-                    : 1;
-  u_char            : 2,
-         min_fr_len : 6;
-  u_char lng_typ    : 1,
-         lng_fld    : 1,
-         rxcrc_xf   : 1,
-         artx       : 1,
-         sarec      : 1,
-         tx_jabber  : 1,        /* why is this called max_len in the manual? */
-         hash_1     : 1,
-         lbpkpol    : 1;
-  u_char            : 6,
-         fdx        : 1,
-                    : 1;
-  u_char dummy_6    : 6,        /* supposed to be ones */
-         mult_ia    : 1,
-         dis_bof    : 1;
-  u_char dummy_1    : 1,        /* supposed to be one */
-         tx_ifs_retrig : 2,
-         mc_all     : 1,
-         rcv_mon    : 2,
-         frag_acpt  : 1,
-         tstrttrs   : 1;
-  u_char fretx      : 1,
-         runt_eop   : 1,
-         hw_sw_pin  : 1,
-         big_endn   : 1,
-         syncrqs    : 1,
-         sttlen     : 1,
-         tx_eop     : 1,
-         rx_eop     : 1;
-  u_char rbuf_size  : 5,
-         rcvstop    : 1,
-                    : 2;
-};
-
-#define I82593_MAX_MULTICAST_ADDRESSES  128     /* Hardware hashed filter */
-
-#endif /* _I82593_H */
diff --git a/drivers/net/wireless/ipw2x00/Kconfig b/drivers/net/wireless/ipw2x00/Kconfig
index a8131384c6b9..2715b101aded 100644
--- a/drivers/net/wireless/ipw2x00/Kconfig
+++ b/drivers/net/wireless/ipw2x00/Kconfig
@@ -4,8 +4,10 @@
 
 config IPW2100
         tristate "Intel PRO/Wireless 2100 Network Connection"
-        depends on PCI && WLAN_80211 && CFG80211
+        depends on PCI && CFG80211
         select WIRELESS_EXT
+        select WEXT_SPY
+        select WEXT_PRIV
         select FW_LOADER
         select LIB80211
         select LIBIPW
@@ -63,8 +65,10 @@ config IPW2100_DEBUG
 
 config IPW2200
         tristate "Intel PRO/Wireless 2200BG and 2915ABG Network Connection"
-        depends on PCI && WLAN_80211 && CFG80211
+        depends on PCI && CFG80211 && CFG80211_WEXT
         select WIRELESS_EXT
+        select WEXT_SPY
+        select WEXT_PRIV
         select FW_LOADER
         select LIB80211
         select LIBIPW
@@ -150,8 +154,9 @@ config IPW2200_DEBUG
 
 config LIBIPW
         tristate
-        depends on PCI && WLAN_80211 && CFG80211
+        depends on PCI && CFG80211
         select WIRELESS_EXT
+        select WEXT_SPY
         select CRYPTO
         select CRYPTO_ARC4
         select CRYPTO_ECB
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 6e2fc0cb6f8a..9b72c45a7748 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -296,6 +296,33 @@ static const char *command_types[] = {
 };
 #endif
 
+#define WEXT_USECHANNELS 1
+
+static const long ipw2100_frequencies[] = {
+        2412, 2417, 2422, 2427,
+        2432, 2437, 2442, 2447,
+        2452, 2457, 2462, 2467,
+        2472, 2484
+};
+
+#define FREQ_COUNT      ARRAY_SIZE(ipw2100_frequencies)
+
+static const long ipw2100_rates_11b[] = {
+        1000000,
+        2000000,
+        5500000,
+        11000000
+};
+
+static struct ieee80211_rate ipw2100_bg_rates[] = {
+        { .bitrate = 10 },
+        { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+};
+
+#define RATE_COUNT ARRAY_SIZE(ipw2100_rates_11b)
+
 /* Pre-decl until we get the code solid and then we can clean it up */
 static void ipw2100_tx_send_commands(struct ipw2100_priv *priv);
 static void ipw2100_tx_send_data(struct ipw2100_priv *priv);
@@ -551,7 +578,7 @@ static int ipw2100_get_ordinal(struct ipw2100_priv *priv, u32 ord,
                 /* get number of entries */
                 field_count = *(((u16 *) & field_info) + 1);
 
-                /* abort if no enought memory */
+                /* abort if no enough memory */
                 total_length = field_len * field_count;
                 if (total_length > *len) {
                         *len = total_length;
@@ -1141,6 +1168,7 @@ static int rf_kill_active(struct ipw2100_priv *priv)
         int i;
 
         if (!(priv->hw_features & HW_FEATURE_RFKILL)) {
+                wiphy_rfkill_set_hw_state(priv->ieee->wdev.wiphy, false);
                 priv->status &= ~STATUS_RF_KILL_HW;
                 return 0;
         }
@@ -1151,10 +1179,13 @@ static int rf_kill_active(struct ipw2100_priv *priv)
                 value = (value << 1) | ((reg & IPW_BIT_GPIO_RF_KILL) ? 0 : 1);
         }
 
-        if (value == 0)
+        if (value == 0) {
+                wiphy_rfkill_set_hw_state(priv->ieee->wdev.wiphy, true);
                 priv->status |= STATUS_RF_KILL_HW;
-        else
+        } else {
+                wiphy_rfkill_set_hw_state(priv->ieee->wdev.wiphy, false);
                 priv->status &= ~STATUS_RF_KILL_HW;
+        }
 
         return (value == 0);
 }
@@ -1814,13 +1845,6 @@ static int ipw2100_up(struct ipw2100_priv *priv, int deferred)
         return rc;
 }
 
-/* Called by register_netdev() */
-static int ipw2100_net_init(struct net_device *dev)
-{
-        struct ipw2100_priv *priv = libipw_priv(dev);
-        return ipw2100_up(priv, 1);
-}
-
 static void ipw2100_down(struct ipw2100_priv *priv)
 {
         unsigned long flags;
@@ -1875,6 +1899,64 @@ static void ipw2100_down(struct ipw2100_priv *priv)
         netif_stop_queue(priv->net_dev);
 }
 
+/* Called by register_netdev() */
+static int ipw2100_net_init(struct net_device *dev)
+{
+        struct ipw2100_priv *priv = libipw_priv(dev);
+        const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
+        struct wireless_dev *wdev = &priv->ieee->wdev;
+        int ret;
+        int i;
+
+        ret = ipw2100_up(priv, 1);
+        if (ret)
+                return ret;
+
+        memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
+
+        /* fill-out priv->ieee->bg_band */
+        if (geo->bg_channels) {
+                struct ieee80211_supported_band *bg_band = &priv->ieee->bg_band;
+
+                bg_band->band = IEEE80211_BAND_2GHZ;
+                bg_band->n_channels = geo->bg_channels;
+                bg_band->channels =
+                        kzalloc(geo->bg_channels *
+                                sizeof(struct ieee80211_channel), GFP_KERNEL);
+                /* translate geo->bg to bg_band.channels */
+                for (i = 0; i < geo->bg_channels; i++) {
+                        bg_band->channels[i].band = IEEE80211_BAND_2GHZ;
+                        bg_band->channels[i].center_freq = geo->bg[i].freq;
+                        bg_band->channels[i].hw_value = geo->bg[i].channel;
+                        bg_band->channels[i].max_power = geo->bg[i].max_power;
+                        if (geo->bg[i].flags & LIBIPW_CH_PASSIVE_ONLY)
+                                bg_band->channels[i].flags |=
+                                        IEEE80211_CHAN_PASSIVE_SCAN;
+                        if (geo->bg[i].flags & LIBIPW_CH_NO_IBSS)
+                                bg_band->channels[i].flags |=
+                                        IEEE80211_CHAN_NO_IBSS;
+                        if (geo->bg[i].flags & LIBIPW_CH_RADAR_DETECT)
+                                bg_band->channels[i].flags |=
+                                        IEEE80211_CHAN_RADAR;
+                        /* No equivalent for LIBIPW_CH_80211H_RULES,
+                           LIBIPW_CH_UNIFORM_SPREADING, or
+                           LIBIPW_CH_B_ONLY... */
+                }
+                /* point at bitrate info */
+                bg_band->bitrates = ipw2100_bg_rates;
+                bg_band->n_bitrates = RATE_COUNT;
+
+                wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = bg_band;
+        }
+
+        set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
+        if (wiphy_register(wdev->wiphy)) {
+                ipw2100_down(priv);
+                return -EIO;
+        }
+        return 0;
+}
+
 static void ipw2100_reset_adapter(struct work_struct *work)
 {
         struct ipw2100_priv *priv =
@@ -2090,6 +2172,7 @@ static void isr_indicate_rf_kill(struct ipw2100_priv *priv, u32 status)
                        priv->net_dev->name);
 
         /* RF_KILL is now enabled (else we wouldn't be here) */
+        wiphy_rfkill_set_hw_state(priv->ieee->wdev.wiphy, true);
         priv->status |= STATUS_RF_KILL_HW;
 
         /* Make sure the RF Kill check timer is running */
@@ -3044,7 +3127,7 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv)
                              IPW_MAX_BDS)) {
                         /* TODO: Support merging buffers if more than
                          * IPW_MAX_BDS are used */
-                        IPW_DEBUG_INFO("%s: Maximum BD theshold exceeded.  "
+                        IPW_DEBUG_INFO("%s: Maximum BD threshold exceeded.  "
                                        "Increase fragmentation level.\n",
                                        priv->net_dev->name);
                 }
@@ -6029,7 +6112,7 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
         struct ipw2100_priv *priv;
         struct net_device *dev;
 
-        dev = alloc_ieee80211(sizeof(struct ipw2100_priv));
+        dev = alloc_ieee80211(sizeof(struct ipw2100_priv), 0);
         if (!dev)
                 return NULL;
         priv = libipw_priv(dev);
@@ -6342,7 +6425,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
                 sysfs_remove_group(&pci_dev->dev.kobj,
                                    &ipw2100_attribute_group);
 
-                free_ieee80211(dev);
+                free_ieee80211(dev, 0);
                 pci_set_drvdata(pci_dev, NULL);
         }
 
@@ -6400,7 +6483,10 @@ static void __devexit ipw2100_pci_remove_one(struct pci_dev *pci_dev)
                 if (dev->base_addr)
                         iounmap((void __iomem *)dev->base_addr);
 
-                free_ieee80211(dev);
+                /* wiphy_unregister needs to be here, before free_ieee80211 */
+                wiphy_unregister(priv->ieee->wdev.wiphy);
+                kfree(priv->ieee->bg_band.channels);
+                free_ieee80211(dev, 0);
         }
 
         pci_release_regions(pci_dev);
@@ -6487,9 +6573,19 @@ static int ipw2100_resume(struct pci_dev *pci_dev)
 }
 #endif
 
+static void ipw2100_shutdown(struct pci_dev *pci_dev)
+{
+        struct ipw2100_priv *priv = pci_get_drvdata(pci_dev);
+
+        /* Take down the device; powers it off, etc. */
+        ipw2100_down(priv);
+
+        pci_disable_device(pci_dev);
+}
+
 #define IPW2100_DEV_ID(x) { PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, x }
 
-static struct pci_device_id ipw2100_pci_id_table[] __devinitdata = {
+static DEFINE_PCI_DEVICE_TABLE(ipw2100_pci_id_table) = {
         IPW2100_DEV_ID(0x2520), /* IN 2100A mPCI 3A */
         IPW2100_DEV_ID(0x2521), /* IN 2100A mPCI 3B */
         IPW2100_DEV_ID(0x2524), /* IN 2100A mPCI 3B */
@@ -6550,6 +6646,7 @@ static struct pci_driver ipw2100_pci_driver = {
         .suspend = ipw2100_suspend,
         .resume = ipw2100_resume,
 #endif
+        .shutdown = ipw2100_shutdown,
 };
 
 /**
@@ -6601,26 +6698,6 @@ static void __exit ipw2100_exit(void)
 module_init(ipw2100_init);
 module_exit(ipw2100_exit);
 
-#define WEXT_USECHANNELS 1
-
-static const long ipw2100_frequencies[] = {
-        2412, 2417, 2422, 2427,
-        2432, 2437, 2442, 2447,
-        2452, 2457, 2462, 2467,
-        2472, 2484
-};
-
-#define FREQ_COUNT      ARRAY_SIZE(ipw2100_frequencies)
-
-static const long ipw2100_rates_11b[] = {
-        1000000,
-        2000000,
-        5500000,
-        11000000
-};
-
-#define RATE_COUNT ARRAY_SIZE(ipw2100_rates_11b)
-
 static int ipw2100_wx_get_name(struct net_device *dev,
                                struct iw_request_info *info,
                                union iwreq_data *wrqu, char *extra)
@@ -6820,7 +6897,7 @@ static int ipw2100_wx_get_range(struct net_device *dev,
         range->max_qual.updated = 7;    /* Updated all three */
 
         range->avg_qual.qual = 70;      /* > 8% missed beacons is 'bad' */
-        /* TODO: Find real 'good' to 'bad' threshol value for RSSI */
+        /* TODO: Find real 'good' to 'bad' threshold value for RSSI */
         range->avg_qual.level = 20 + IPW2100_RSSI_TO_DBM;
         range->avg_qual.noise = 0;
         range->avg_qual.updated = 7;    /* Updated all three */
@@ -8462,6 +8539,12 @@ static int ipw2100_get_firmware(struct ipw2100_priv *priv,
         return 0;
 }
 
+MODULE_FIRMWARE(IPW2100_FW_NAME("-i"));
+#ifdef CONFIG_IPW2100_MONITOR
+MODULE_FIRMWARE(IPW2100_FW_NAME("-p"));
+#endif
+MODULE_FIRMWARE(IPW2100_FW_NAME(""));
+
 static void ipw2100_release_firmware(struct ipw2100_priv *priv,
                                      struct ipw2100_fw *fw)
 {
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index a6ca536e44f8..8d72e3d19586 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -31,6 +31,7 @@
 ******************************************************************************/
 
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include "ipw2200.h"
 
 
@@ -81,6 +82,11 @@ MODULE_DESCRIPTION(DRV_DESCRIPTION);
 MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT);
 MODULE_LICENSE("GPL");
+MODULE_FIRMWARE("ipw2200-ibss.fw");
+#ifdef CONFIG_IPW2200_MONITOR
+MODULE_FIRMWARE("ipw2200-sniffer.fw");
+#endif
+MODULE_FIRMWARE("ipw2200-bss.fw");
 
 static int cmdlog = 0;
 static int debug = 0;
@@ -104,6 +110,25 @@ static int antenna = CFG_SYS_ANTENNA_BOTH;
 static int rtap_iface = 0;     /* def: 0 -- do not create rtap interface */
 #endif
 
+static struct ieee80211_rate ipw2200_rates[] = {
+        { .bitrate = 10 },
+        { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 60 },
+        { .bitrate = 90 },
+        { .bitrate = 120 },
+        { .bitrate = 180 },
+        { .bitrate = 240 },
+        { .bitrate = 360 },
+        { .bitrate = 480 },
+        { .bitrate = 540 }
+};
+
+#define ipw2200_a_rates         (ipw2200_rates + 4)
+#define ipw2200_num_a_rates     8
+#define ipw2200_bg_rates        (ipw2200_rates + 0)
+#define ipw2200_num_bg_rates    12
 
 #ifdef CONFIG_IPW2200_QOS
 static int qos_enable = 0;
@@ -768,7 +793,7 @@ static int ipw_get_ordinal(struct ipw_priv *priv, u32 ord, void *val, u32 * len)
                 /* get number of entries */
                 field_count = *(((u16 *) & field_info) + 1);
 
-                /* abort if not enought memory */
+                /* abort if not enough memory */
                 total_len = field_len * field_count;
                 if (total_len > *len) {
                         *len = total_len;
@@ -1734,10 +1759,13 @@ static DEVICE_ATTR(direct_dword, S_IWUSR | S_IRUGO,
 
 static int rf_kill_active(struct ipw_priv *priv)
 {
-        if (0 == (ipw_read32(priv, 0x30) & 0x10000))
+        if (0 == (ipw_read32(priv, 0x30) & 0x10000)) {
                 priv->status |= STATUS_RF_KILL_HW;
-        else
+                wiphy_rfkill_set_hw_state(priv->ieee->wdev.wiphy, true);
+        } else {
                 priv->status &= ~STATUS_RF_KILL_HW;
+                wiphy_rfkill_set_hw_state(priv->ieee->wdev.wiphy, false);
+        }
 
         return (priv->status & STATUS_RF_KILL_HW) ? 1 : 0;
 }
@@ -2020,6 +2048,7 @@ static void ipw_irq_tasklet(struct ipw_priv *priv)
         if (inta & IPW_INTA_BIT_RF_KILL_DONE) {
                 IPW_DEBUG_RF_KILL("RF_KILL_DONE\n");
                 priv->status |= STATUS_RF_KILL_HW;
+                wiphy_rfkill_set_hw_state(priv->ieee->wdev.wiphy, true);
                 wake_up_interruptible(&priv->wait_command_queue);
                 priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
                 cancel_delayed_work(&priv->request_scan);
@@ -3149,14 +3178,27 @@ static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
         int total_nr = 0;
         int i;
         struct pci_pool *pool;
-        u32 *virts[CB_NUMBER_OF_ELEMENTS_SMALL];
-        dma_addr_t phys[CB_NUMBER_OF_ELEMENTS_SMALL];
+        void **virts;
+        dma_addr_t *phys;
 
         IPW_DEBUG_TRACE("<< : \n");
 
+        virts = kmalloc(sizeof(void *) * CB_NUMBER_OF_ELEMENTS_SMALL,
+                        GFP_KERNEL);
+        if (!virts)
+                return -ENOMEM;
+
+        phys = kmalloc(sizeof(dma_addr_t) * CB_NUMBER_OF_ELEMENTS_SMALL,
+                        GFP_KERNEL);
+        if (!phys) {
+                kfree(virts);
+                return -ENOMEM;
+        }
         pool = pci_pool_create("ipw2200", priv->pci_dev, CB_MAX_LENGTH, 0, 0);
         if (!pool) {
                 IPW_ERROR("pci_pool_create failed\n");
+                kfree(phys);
+                kfree(virts);
                 return -ENOMEM;
         }
 
@@ -3226,6 +3268,8 @@ static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
                 pci_pool_free(pool, virts[i], phys[i]);
 
         pci_pool_destroy(pool);
+        kfree(phys);
+        kfree(virts);
 
         return ret;
 }
@@ -7732,7 +7776,7 @@ static void ipw_rebuild_decrypted_skb(struct ipw_priv *priv,
         case SEC_LEVEL_0:
                 break;
         default:
-                printk(KERN_ERR "Unknow security level %d\n",
+                printk(KERN_ERR "Unknown security level %d\n",
                        priv->ieee->sec.level);
                 break;
         }
@@ -8655,24 +8699,6 @@ static int ipw_sw_reset(struct ipw_priv *priv, int option)
  *
  */
 
-static int ipw_wx_get_name(struct net_device *dev,
-                           struct iw_request_info *info,
-                           union iwreq_data *wrqu, char *extra)
-{
-        struct ipw_priv *priv = libipw_priv(dev);
-        mutex_lock(&priv->mutex);
-        if (priv->status & STATUS_RF_KILL_MASK)
-                strcpy(wrqu->name, "radio off");
-        else if (!(priv->status & STATUS_ASSOCIATED))
-                strcpy(wrqu->name, "unassociated");
-        else
-                snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11%c",
-                         ipw_modes[priv->assoc_request.ieee_mode]);
-        IPW_DEBUG_WX("Name: %s\n", wrqu->name);
-        mutex_unlock(&priv->mutex);
-        return 0;
-}
-
 static int ipw_set_channel(struct ipw_priv *priv, u8 channel)
 {
         if (channel == 0) {
@@ -8916,7 +8942,7 @@ static int ipw_wx_get_range(struct net_device *dev,
         range->max_qual.updated = 7;    /* Updated all three */
 
         range->avg_qual.qual = 70;
-        /* TODO: Find real 'good' to 'bad' threshol value for RSSI */
+        /* TODO: Find real 'good' to 'bad' threshold value for RSSI */
         range->avg_qual.level = 0;      /* FIXME to real average level */
         range->avg_qual.noise = 0;
         range->avg_qual.updated = 7;    /* Updated all three */
@@ -9972,7 +9998,7 @@ static int ipw_wx_sw_reset(struct net_device *dev,
 /* Rebase the WE IOCTLs to zero for the handler array */
 #define IW_IOCTL(x) [(x)-SIOCSIWCOMMIT]
 static iw_handler ipw_wx_handlers[] = {
-        IW_IOCTL(SIOCGIWNAME) = ipw_wx_get_name,
+        IW_IOCTL(SIOCGIWNAME) = (iw_handler) cfg80211_wext_giwname,
         IW_IOCTL(SIOCSIWFREQ) = ipw_wx_set_freq,
         IW_IOCTL(SIOCGIWFREQ) = ipw_wx_get_freq,
         IW_IOCTL(SIOCSIWMODE) = ipw_wx_set_mode,
@@ -10289,7 +10315,7 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct libipw_txb *txb,
                 case SEC_LEVEL_0:
                         break;
                 default:
-                        printk(KERN_ERR "Unknow security level %d\n",
+                        printk(KERN_ERR "Unknown security level %d\n",
                                priv->ieee->sec.level);
                         break;
                 }
@@ -11275,6 +11301,7 @@ static int ipw_up(struct ipw_priv *priv)
                 if (!(priv->config & CFG_CUSTOM_MAC))
                         eeprom_parse_mac(priv, priv->mac_addr);
                 memcpy(priv->net_dev->dev_addr, priv->mac_addr, ETH_ALEN);
+                memcpy(priv->net_dev->perm_addr, priv->mac_addr, ETH_ALEN);
 
                 for (j = 0; j < ARRAY_SIZE(ipw_geos); j++) {
                         if (!memcmp(&priv->eeprom[EEPROM_COUNTRY_CODE],
@@ -11416,20 +11443,104 @@ static void ipw_bg_down(struct work_struct *work)
 /* Called by register_netdev() */
 static int ipw_net_init(struct net_device *dev)
 {
+        int i, rc = 0;
         struct ipw_priv *priv = libipw_priv(dev);
+        const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
+        struct wireless_dev *wdev = &priv->ieee->wdev;
         mutex_lock(&priv->mutex);
 
         if (ipw_up(priv)) {
-                mutex_unlock(&priv->mutex);
-                return -EIO;
+                rc = -EIO;
+                goto out;
+        }
+
+        memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
+
+        /* fill-out priv->ieee->bg_band */
+        if (geo->bg_channels) {
+                struct ieee80211_supported_band *bg_band = &priv->ieee->bg_band;
+
+                bg_band->band = IEEE80211_BAND_2GHZ;
+                bg_band->n_channels = geo->bg_channels;
+                bg_band->channels =
+                        kzalloc(geo->bg_channels *
+                                sizeof(struct ieee80211_channel), GFP_KERNEL);
+                /* translate geo->bg to bg_band.channels */
+                for (i = 0; i < geo->bg_channels; i++) {
+                        bg_band->channels[i].band = IEEE80211_BAND_2GHZ;
+                        bg_band->channels[i].center_freq = geo->bg[i].freq;
+                        bg_band->channels[i].hw_value = geo->bg[i].channel;
+                        bg_band->channels[i].max_power = geo->bg[i].max_power;
+                        if (geo->bg[i].flags & LIBIPW_CH_PASSIVE_ONLY)
+                                bg_band->channels[i].flags |=
+                                        IEEE80211_CHAN_PASSIVE_SCAN;
+                        if (geo->bg[i].flags & LIBIPW_CH_NO_IBSS)
+                                bg_band->channels[i].flags |=
+                                        IEEE80211_CHAN_NO_IBSS;
+                        if (geo->bg[i].flags & LIBIPW_CH_RADAR_DETECT)
+                                bg_band->channels[i].flags |=
+                                        IEEE80211_CHAN_RADAR;
+                        /* No equivalent for LIBIPW_CH_80211H_RULES,
+                           LIBIPW_CH_UNIFORM_SPREADING, or
+                           LIBIPW_CH_B_ONLY... */
+                }
+                /* point at bitrate info */
+                bg_band->bitrates = ipw2200_bg_rates;
+                bg_band->n_bitrates = ipw2200_num_bg_rates;
+
+                wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = bg_band;
+        }
+
+        /* fill-out priv->ieee->a_band */
+        if (geo->a_channels) {
+                struct ieee80211_supported_band *a_band = &priv->ieee->a_band;
+
+                a_band->band = IEEE80211_BAND_5GHZ;
+                a_band->n_channels = geo->a_channels;
+                a_band->channels =
+                        kzalloc(geo->a_channels *
+                                sizeof(struct ieee80211_channel), GFP_KERNEL);
+                /* translate geo->bg to a_band.channels */
+                for (i = 0; i < geo->a_channels; i++) {
+                        a_band->channels[i].band = IEEE80211_BAND_2GHZ;
+                        a_band->channels[i].center_freq = geo->a[i].freq;
+                        a_band->channels[i].hw_value = geo->a[i].channel;
+                        a_band->channels[i].max_power = geo->a[i].max_power;
+                        if (geo->a[i].flags & LIBIPW_CH_PASSIVE_ONLY)
+                                a_band->channels[i].flags |=
+                                        IEEE80211_CHAN_PASSIVE_SCAN;
+                        if (geo->a[i].flags & LIBIPW_CH_NO_IBSS)
+                                a_band->channels[i].flags |=
+                                        IEEE80211_CHAN_NO_IBSS;
+                        if (geo->a[i].flags & LIBIPW_CH_RADAR_DETECT)
+                                a_band->channels[i].flags |=
+                                        IEEE80211_CHAN_RADAR;
+                        /* No equivalent for LIBIPW_CH_80211H_RULES,
+                           LIBIPW_CH_UNIFORM_SPREADING, or
+                           LIBIPW_CH_B_ONLY... */
+                }
+                /* point at bitrate info */
+                a_band->bitrates = ipw2200_a_rates;
+                a_band->n_bitrates = ipw2200_num_a_rates;
+
+                wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = a_band;
         }
 
+        set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
+
+        /* With that information in place, we can now register the wiphy... */
+        if (wiphy_register(wdev->wiphy)) {
+                rc = -EIO;
+                goto out;
+        }
+
+out:
         mutex_unlock(&priv->mutex);
-        return 0;
+        return rc;
 }
 
 /* PCI driver stuff */
-static struct pci_device_id card_ids[] = {
+static DEFINE_PCI_DEVICE_TABLE(card_ids) = {
         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2701, 0, 0, 0},
         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2702, 0, 0, 0},
         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2711, 0, 0, 0},
@@ -11556,7 +11667,7 @@ static int ipw_prom_alloc(struct ipw_priv *priv)
         if (priv->prom_net_dev)
                 return -EPERM;
 
-        priv->prom_net_dev = alloc_ieee80211(sizeof(struct ipw_prom_priv));
+        priv->prom_net_dev = alloc_ieee80211(sizeof(struct ipw_prom_priv), 1);
         if (priv->prom_net_dev == NULL)
                 return -ENOMEM;
 
@@ -11575,7 +11686,7 @@ static int ipw_prom_alloc(struct ipw_priv *priv)
 
         rc = register_netdev(priv->prom_net_dev);
         if (rc) {
-                free_ieee80211(priv->prom_net_dev);
+                free_ieee80211(priv->prom_net_dev, 1);
                 priv->prom_net_dev = NULL;
                 return rc;
         }
@@ -11589,7 +11700,7 @@ static void ipw_prom_free(struct ipw_priv *priv)
                 return;
 
         unregister_netdev(priv->prom_net_dev);
-        free_ieee80211(priv->prom_net_dev);
+        free_ieee80211(priv->prom_net_dev, 1);
 
         priv->prom_net_dev = NULL;
 }
@@ -11617,7 +11728,7 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
         struct ipw_priv *priv;
         int i;
 
-        net_dev = alloc_ieee80211(sizeof(struct ipw_priv));
+        net_dev = alloc_ieee80211(sizeof(struct ipw_priv), 0);
         if (net_dev == NULL) {
                 err = -ENOMEM;
                 goto out;
@@ -11765,7 +11876,7 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
         pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
       out_free_ieee80211:
-        free_ieee80211(priv->net_dev);
+        free_ieee80211(priv->net_dev, 0);
       out:
         return err;
 }
@@ -11832,7 +11943,11 @@ static void __devexit ipw_pci_remove(struct pci_dev *pdev)
         pci_release_regions(pdev);
         pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
-        free_ieee80211(priv->net_dev);
+        /* wiphy_unregister needs to be here, before free_ieee80211 */
+        wiphy_unregister(priv->ieee->wdev.wiphy);
+        kfree(priv->ieee->a_band.channels);
+        kfree(priv->ieee->bg_band.channels);
+        free_ieee80211(priv->net_dev, 0);
         free_firmware();
 }
 
diff --git a/drivers/net/wireless/ipw2x00/libipw.h b/drivers/net/wireless/ipw2x00/libipw.h
index 1e334ff6bd52..a6d5e42647e4 100644
--- a/drivers/net/wireless/ipw2x00/libipw.h
+++ b/drivers/net/wireless/ipw2x00/libipw.h
@@ -31,6 +31,7 @@
 #include <linux/ieee80211.h>
 
 #include <net/lib80211.h>
+#include <net/cfg80211.h>
 
 #define LIBIPW_VERSION "git-1.1.13"
 
@@ -783,17 +784,20 @@ struct libipw_geo {
 
 struct libipw_device {
         struct net_device *dev;
+        struct wireless_dev wdev;
         struct libipw_security sec;
 
         /* Bookkeeping structures */
         struct libipw_stats ieee_stats;
 
         struct libipw_geo geo;
+        struct ieee80211_supported_band bg_band;
+        struct ieee80211_supported_band a_band;
 
         /* Probe / Beacon management */
         struct list_head network_free_list;
         struct list_head network_list;
-        struct libipw_network *networks;
+        struct libipw_network *networks[MAX_NETWORK_COUNT];
         int scans;
         int scan_age;
 
@@ -1014,8 +1018,8 @@ static inline int libipw_is_cck_rate(u8 rate)
 }
 
 /* ieee80211.c */
-extern void free_ieee80211(struct net_device *dev);
-extern struct net_device *alloc_ieee80211(int sizeof_priv);
+extern void free_ieee80211(struct net_device *dev, int monitor);
+extern struct net_device *alloc_ieee80211(int sizeof_priv, int monitor);
 extern int libipw_change_mtu(struct net_device *dev, int new_mtu);
 
 extern void libipw_networks_age(struct libipw_device *ieee,
diff --git a/drivers/net/wireless/ipw2x00/libipw_geo.c b/drivers/net/wireless/ipw2x00/libipw_geo.c
index 65e8c175a4a0..c9fe3c99cb00 100644
--- a/drivers/net/wireless/ipw2x00/libipw_geo.c
+++ b/drivers/net/wireless/ipw2x00/libipw_geo.c
@@ -34,7 +34,6 @@
 #include <linux/netdevice.h>
 #include <linux/proc_fs.h>
 #include <linux/skbuff.h>
-#include <linux/slab.h>
 #include <linux/tcp.h>
 #include <linux/types.h>
 #include <linux/wireless.h>
diff --git a/drivers/net/wireless/ipw2x00/libipw_module.c b/drivers/net/wireless/ipw2x00/libipw_module.c
index eb2b60834c17..2fa55867bd8b 100644
--- a/drivers/net/wireless/ipw2x00/libipw_module.c
+++ b/drivers/net/wireless/ipw2x00/libipw_module.c
@@ -62,18 +62,22 @@ MODULE_DESCRIPTION(DRV_DESCRIPTION);
 MODULE_AUTHOR(DRV_COPYRIGHT);
 MODULE_LICENSE("GPL");
 
+struct cfg80211_ops libipw_config_ops = { };
+void *libipw_wiphy_privid = &libipw_wiphy_privid;
+
 static int libipw_networks_allocate(struct libipw_device *ieee)
 {
-        if (ieee->networks)
-                return 0;
-
-        ieee->networks =
-            kzalloc(MAX_NETWORK_COUNT * sizeof(struct libipw_network),
-                    GFP_KERNEL);
-        if (!ieee->networks) {
-                printk(KERN_WARNING "%s: Out of memory allocating beacons\n",
-                       ieee->dev->name);
-                return -ENOMEM;
+        int i, j;
+
+        for (i = 0; i < MAX_NETWORK_COUNT; i++) {
+                ieee->networks[i] = kzalloc(sizeof(struct libipw_network),
+                                            GFP_KERNEL);
+                if (!ieee->networks[i]) {
+                        LIBIPW_ERROR("Out of memory allocating beacons\n");
+                        for (j = 0; j < i; j++)
+                                kfree(ieee->networks[j]);
+                        return -ENOMEM;
+                }
         }
 
         return 0;
@@ -94,15 +98,11 @@ static inline void libipw_networks_free(struct libipw_device *ieee)
 {
         int i;
 
-        if (!ieee->networks)
-                return;
-
-        for (i = 0; i < MAX_NETWORK_COUNT; i++)
-                if (ieee->networks[i].ibss_dfs)
-                        kfree(ieee->networks[i].ibss_dfs);
-
-        kfree(ieee->networks);
-        ieee->networks = NULL;
+        for (i = 0; i < MAX_NETWORK_COUNT; i++) {
+                if (ieee->networks[i]->ibss_dfs)
+                        kfree(ieee->networks[i]->ibss_dfs);
+                kfree(ieee->networks[i]);
+        }
 }
 
 void libipw_networks_age(struct libipw_device *ieee,
@@ -127,7 +127,7 @@ static void libipw_networks_initialize(struct libipw_device *ieee)
         INIT_LIST_HEAD(&ieee->network_free_list);
         INIT_LIST_HEAD(&ieee->network_list);
         for (i = 0; i < MAX_NETWORK_COUNT; i++)
-                list_add_tail(&ieee->networks[i].list,
+                list_add_tail(&ieee->networks[i]->list,
                               &ieee->network_free_list);
 }
 
@@ -140,7 +140,7 @@ int libipw_change_mtu(struct net_device *dev, int new_mtu)
 }
 EXPORT_SYMBOL(libipw_change_mtu);
 
-struct net_device *alloc_ieee80211(int sizeof_priv)
+struct net_device *alloc_ieee80211(int sizeof_priv, int monitor)
 {
         struct libipw_device *ieee;
         struct net_device *dev;
@@ -157,10 +157,31 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
 
         ieee->dev = dev;
 
+        if (!monitor) {
+                ieee->wdev.wiphy = wiphy_new(&libipw_config_ops, 0);
+                if (!ieee->wdev.wiphy) {
+                        LIBIPW_ERROR("Unable to allocate wiphy.\n");
+                        goto failed_free_netdev;
+                }
+
+                ieee->dev->ieee80211_ptr = &ieee->wdev;
+                ieee->wdev.iftype = NL80211_IFTYPE_STATION;
+
+                /* Fill-out wiphy structure bits we know...  Not enough info
+                   here to call set_wiphy_dev or set MAC address or channel info
+                   -- have to do that in ->ndo_init... */
+                ieee->wdev.wiphy->privid = libipw_wiphy_privid;
+
+                ieee->wdev.wiphy->max_scan_ssids = 1;
+                ieee->wdev.wiphy->max_scan_ie_len = 0;
+                ieee->wdev.wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION)
+                                                | BIT(NL80211_IFTYPE_ADHOC);
+        }
+
         err = libipw_networks_allocate(ieee);
         if (err) {
                 LIBIPW_ERROR("Unable to allocate beacon storage: %d\n", err);
-                goto failed_free_netdev;
+                goto failed_free_wiphy;
         }
         libipw_networks_initialize(ieee);
 
@@ -175,7 +196,7 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
         ieee->host_decrypt = 1;
         ieee->host_mc_decrypt = 1;
 
-        /* Host fragementation in Open mode. Default is enabled.
+        /* Host fragmentation in Open mode. Default is enabled.
          * Note: host fragmentation is always enabled if host encryption
          * is enabled. For cards can do hardware encryption, they must do
          * hardware fragmentation as well. So we don't need a variable
@@ -193,19 +214,27 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
 
         return dev;
 
+failed_free_wiphy:
+        if (!monitor)
+                wiphy_free(ieee->wdev.wiphy);
 failed_free_netdev:
         free_netdev(dev);
 failed:
         return NULL;
 }
 
-void free_ieee80211(struct net_device *dev)
+void free_ieee80211(struct net_device *dev, int monitor)
 {
         struct libipw_device *ieee = netdev_priv(dev);
 
         lib80211_crypt_info_free(&ieee->crypt_info);
 
         libipw_networks_free(ieee);
+
+        /* free cfg80211 resources */
+        if (!monitor)
+                wiphy_free(ieee->wdev.wiphy);
+
         free_netdev(dev);
 }
 
@@ -216,17 +245,22 @@ u32 libipw_debug_level = 0;
 EXPORT_SYMBOL_GPL(libipw_debug_level);
 static struct proc_dir_entry *libipw_proc = NULL;
 
-static int show_debug_level(char *page, char **start, off_t offset,
-                            int count, int *eof, void *data)
+static int debug_level_proc_show(struct seq_file *m, void *v)
 {
-        return snprintf(page, count, "0x%08X\n", libipw_debug_level);
+        seq_printf(m, "0x%08X\n", libipw_debug_level);
+        return 0;
 }
 
-static int store_debug_level(struct file *file, const char __user * buffer,
-                             unsigned long count, void *data)
+static int debug_level_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, debug_level_proc_show, NULL);
+}
+
+static ssize_t debug_level_proc_write(struct file *file,
+                const char __user *buffer, size_t count, loff_t *pos)
 {
         char buf[] = "0x00000000\n";
-        unsigned long len = min((unsigned long)sizeof(buf) - 1, count);
+        size_t len = min(sizeof(buf) - 1, count);
         unsigned long val;
 
         if (copy_from_user(buf, buffer, len))
@@ -240,6 +274,15 @@ static int store_debug_level(struct file *file, const char __user * buffer,
 
         return strnlen(buf, len);
 }
+
+static const struct file_operations debug_level_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = debug_level_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+        .write          = debug_level_proc_write,
+};
 #endif                          /* CONFIG_LIBIPW_DEBUG */
 
 static int __init libipw_init(void)
@@ -254,16 +297,13 @@ static int __init libipw_init(void)
                                 " proc directory\n");
                 return -EIO;
         }
-        e = create_proc_entry("debug_level", S_IFREG | S_IRUGO | S_IWUSR,
-                              libipw_proc);
+        e = proc_create("debug_level", S_IRUGO | S_IWUSR, libipw_proc,
+                        &debug_level_proc_fops);
         if (!e) {
                 remove_proc_entry(DRV_NAME, init_net.proc_net);
                 libipw_proc = NULL;
                 return -EIO;
         }
-        e->read_proc = show_debug_level;
-        e->write_proc = store_debug_level;
-        e->data = NULL;
 #endif                          /* CONFIG_LIBIPW_DEBUG */
 
         printk(KERN_INFO DRV_NAME ": " DRV_DESCRIPTION ", " DRV_VERSION "\n");
diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
index 282b1f7ff1e9..39a34da52d52 100644
--- a/drivers/net/wireless/ipw2x00/libipw_rx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
@@ -17,6 +17,7 @@
 #include <linux/errno.h>
 #include <linux/if_arp.h>
 #include <linux/in6.h>
+#include <linux/gfp.h>
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/kernel.h>
@@ -24,7 +25,6 @@
 #include <linux/netdevice.h>
 #include <linux/proc_fs.h>
 #include <linux/skbuff.h>
-#include <linux/slab.h>
 #include <linux/tcp.h>
 #include <linux/types.h>
 #include <linux/wireless.h>
diff --git a/drivers/net/wireless/ipw2x00/libipw_wx.c b/drivers/net/wireless/ipw2x00/libipw_wx.c
index 4d89f66f53b2..3633c6682e49 100644
--- a/drivers/net/wireless/ipw2x00/libipw_wx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_wx.c
@@ -31,6 +31,7 @@
 ******************************************************************************/
 
 #include <linux/kmod.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/jiffies.h>
 
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 99310c033253..dc8ed1527666 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -1,23 +1,7 @@
 config IWLWIFI
         tristate "Intel Wireless Wifi"
-        depends on PCI && MAC80211 && WLAN_80211 && EXPERIMENTAL
-        select LIB80211
+        depends on PCI && MAC80211
         select FW_LOADER
-        select MAC80211_LEDS if IWLWIFI_LEDS
-        select LEDS_CLASS if IWLWIFI_LEDS
-
-config IWLWIFI_LEDS
-        bool "Enable LED support in iwlagn and iwl3945 drivers"
-        depends on IWLWIFI
-        default y
-        ---help---
-          Select this if you want LED support.
-
-config IWLWIFI_SPECTRUM_MEASUREMENT
-        bool "Enable Spectrum Measurement in iwlagn driver"
-        depends on IWLWIFI
-        ---help---
-          This option will enable spectrum measurement for the iwlagn driver.
 
 config IWLWIFI_DEBUG
         bool "Enable full debugging output in iwlagn and iwl3945 drivers"
@@ -50,6 +34,24 @@ config IWLWIFI_DEBUGFS
         ---help---
           Enable creation of debugfs files for the iwlwifi drivers.
 
+config IWLWIFI_DEVICE_TRACING
+        bool "iwlwifi device access tracing"
+        depends on IWLWIFI
+        depends on EVENT_TRACING
+        help
+          Say Y here to trace all commands, including TX frames and IO
+          accesses, sent to the device. If you say yes, iwlwifi will
+          register with the ftrace framework for event tracing and dump
+          all this information to the ringbuffer, you may need to
+          increase the ringbuffer size. See the ftrace documentation
+          for more information.
+
+          When tracing is not enabled, this option still has some
+          (though rather small) overhead.
+
+          If unsure, say Y so we can help you better when problems
+          occur.
+
 config IWLAGN
         tristate "Intel Wireless WiFi Next Gen AGN (iwlagn)"
         depends on IWLWIFI
@@ -112,9 +114,3 @@ config IWL3945
           inserted in and removed from the running kernel whenever you want),
           say M here and read <file:Documentation/kbuild/modules.txt>.  The
           module will be called iwl3945.
-
-config IWL3945_SPECTRUM_MEASUREMENT
-        bool "Enable Spectrum Measurement in iwl3945 driver"
-        depends on IWL3945
-        ---help---
-          This option will enable spectrum measurement for the iwl3945 driver.
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index 1d4e0a226fd4..4e378faee650 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -1,20 +1,23 @@
 obj-$(CONFIG_IWLWIFI)   += iwlcore.o
 iwlcore-objs            := iwl-core.o iwl-eeprom.o iwl-hcmd.o iwl-power.o
 iwlcore-objs            += iwl-rx.o iwl-tx.o iwl-sta.o iwl-calib.o
-iwlcore-objs            += iwl-scan.o
+iwlcore-objs            += iwl-scan.o iwl-led.o
 iwlcore-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-debugfs.o
-iwlcore-$(CONFIG_IWLWIFI_LEDS) += iwl-led.o
-iwlcore-$(CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT) += iwl-spectrum.o
+iwlcore-$(CONFIG_IWLWIFI_DEVICE_TRACING) += iwl-devtrace.o
 
+CFLAGS_iwl-devtrace.o := -I$(src)
+
+# AGN
 obj-$(CONFIG_IWLAGN)    += iwlagn.o
-iwlagn-objs             := iwl-agn.o iwl-agn-rs.o
+iwlagn-objs             := iwl-agn.o iwl-agn-rs.o iwl-agn-led.o
 
 iwlagn-$(CONFIG_IWL4965) += iwl-4965.o
 iwlagn-$(CONFIG_IWL5000) += iwl-5000.o
 iwlagn-$(CONFIG_IWL5000) += iwl-6000.o
 iwlagn-$(CONFIG_IWL5000) += iwl-1000.o
 
+# 3945
 obj-$(CONFIG_IWL3945)   += iwl3945.o
 iwl3945-objs            := iwl3945-base.o iwl-3945.o iwl-3945-rs.o iwl-3945-led.o
 
-
+ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 950267ab556a..3bf2e6e9b2d9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2008-2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -44,6 +44,7 @@
 #include "iwl-sta.h"
 #include "iwl-helpers.h"
 #include "iwl-5000-hw.h"
+#include "iwl-agn-led.h"
 
 /* Highest firmware API version supported */
 #define IWL1000_UCODE_API_MAX 3
@@ -76,7 +77,10 @@ static void iwl1000_set_ct_threshold(struct iwl_priv *priv)
 /* NIC configuration for 1000 series */
 static void iwl1000_nic_config(struct iwl_priv *priv)
 {
-        iwl5000_nic_config(priv);
+        /* set CSR_HW_CONFIG_REG for uCode use */
+        iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
+                    CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI |
+                    CSR_HW_IF_CONFIG_REG_BIT_MAC_SI);
 
         /* Setting digital SVR for 1000 card to 1.32V */
         /* locking is acquired in iwl_set_bits_mask_prph() function */
@@ -85,8 +89,78 @@ static void iwl1000_nic_config(struct iwl_priv *priv)
                                 ~APMG_SVR_VOLTAGE_CONFIG_BIT_MSK);
 }
 
+static struct iwl_sensitivity_ranges iwl1000_sensitivity = {
+        .min_nrg_cck = 95,
+        .max_nrg_cck = 0, /* not used, set to 0 */
+        .auto_corr_min_ofdm = 90,
+        .auto_corr_min_ofdm_mrc = 170,
+        .auto_corr_min_ofdm_x1 = 120,
+        .auto_corr_min_ofdm_mrc_x1 = 240,
+
+        .auto_corr_max_ofdm = 120,
+        .auto_corr_max_ofdm_mrc = 210,
+        .auto_corr_max_ofdm_x1 = 155,
+        .auto_corr_max_ofdm_mrc_x1 = 290,
+
+        .auto_corr_min_cck = 125,
+        .auto_corr_max_cck = 200,
+        .auto_corr_min_cck_mrc = 170,
+        .auto_corr_max_cck_mrc = 400,
+        .nrg_th_cck = 95,
+        .nrg_th_ofdm = 95,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
+};
+
+static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
+{
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
+
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
+        priv->hw_params.scd_bc_tbls_size =
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwl5000_scd_bc_tbl);
+        priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
+        priv->hw_params.max_stations = IWL5000_STATION_COUNT;
+        priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
+
+        priv->hw_params.max_data_size = IWL50_RTC_DATA_SIZE;
+        priv->hw_params.max_inst_size = IWL50_RTC_INST_SIZE;
+
+        priv->hw_params.max_bsm_size = 0;
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
+                                        BIT(IEEE80211_BAND_5GHZ);
+        priv->hw_params.rx_wrt_ptr_reg = FH_RSCSR_CHNL0_WPTR;
+
+        priv->hw_params.tx_chains_num = num_of_ant(priv->cfg->valid_tx_ant);
+        priv->hw_params.rx_chains_num = num_of_ant(priv->cfg->valid_rx_ant);
+        priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
+        priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
+
+        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
+                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
+
+        /* Set initial sensitivity parameters */
+        /* Set initial calibration set */
+        priv->hw_params.sens = &iwl1000_sensitivity;
+        priv->hw_params.calib_init_cfg =
+                        BIT(IWL_CALIB_XTAL)             |
+                        BIT(IWL_CALIB_LO)               |
+                        BIT(IWL_CALIB_TX_IQ)            |
+                        BIT(IWL_CALIB_TX_IQ_PERD)       |
+                        BIT(IWL_CALIB_BASE_BAND);
+
+        return 0;
+}
+
 static struct iwl_lib_ops iwl1000_lib = {
-        .set_hw_params = iwl5000_hw_set_hw_params,
+        .set_hw_params = iwl1000_hw_set_hw_params,
         .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
         .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
         .txq_set_sched = iwl5000_txq_set_sched,
@@ -101,14 +175,15 @@ static struct iwl_lib_ops iwl1000_lib = {
         .load_ucode = iwl5000_load_ucode,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
+        .dump_fh = iwl_dump_fh,
         .init_alive_start = iwl5000_init_alive_start,
         .alive_notify = iwl5000_alive_notify,
         .send_tx_power = iwl5000_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
         .apm_ops = {
-                .init = iwl5000_apm_init,
-                .reset = iwl5000_apm_reset,
-                .stop = iwl5000_apm_stop,
+                .init = iwl_apm_init,
+                .stop = iwl_apm_stop,
                 .config = iwl1000_nic_config,
                 .set_pwr_src = iwl_set_pwr_src,
         },
@@ -135,13 +210,15 @@ static struct iwl_lib_ops iwl1000_lib = {
                 .temperature = iwl5000_temperature,
                 .set_ct_kill = iwl1000_set_ct_threshold,
          },
+        .add_bcast_station = iwl_add_bcast_station,
 };
 
-static struct iwl_ops iwl1000_ops = {
+static const struct iwl_ops iwl1000_ops = {
         .ucode = &iwl5000_ucode,
         .lib = &iwl1000_lib,
         .hcmd = &iwl5000_hcmd,
         .utils = &iwl5000_hcmd_utils,
+        .led = &iwlagn_led_ops,
 };
 
 struct iwl_cfg iwl1000_bgn_cfg = {
@@ -152,15 +229,53 @@ struct iwl_cfg iwl1000_bgn_cfg = {
         .sku = IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl1000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
+        .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
         .max_ll_items = OTP_MAX_LL_ITEMS_1000,
         .shadow_ram_support = false,
         .ht_greenfield_support = true,
+        .led_compensation = 51,
         .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+};
+
+struct iwl_cfg iwl1000_bg_cfg = {
+        .name = "1000 Series BG",
+        .fw_name_pre = IWL1000_FW_PRE,
+        .ucode_api_max = IWL1000_UCODE_API_MAX,
+        .ucode_api_min = IWL1000_UCODE_API_MIN,
+        .sku = IWL_SKU_G,
+        .ops = &iwl1000_ops,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
+        .mod_params = &iwl50_mod_params,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
+        .max_ll_items = OTP_MAX_LL_ITEMS_1000,
+        .shadow_ram_support = false,
+        .ht_greenfield_support = true,
+        .led_compensation = 51,
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
+MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-fh.h b/drivers/net/wireless/iwlwifi/iwl-3945-fh.h
index 08ce259a0e60..042f6bc0df13 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-fh.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
index 16772780c5b0..3a876a8ece38 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -71,12 +71,6 @@
 
 #include "iwl-eeprom.h"
 
-/*
- * uCode queue management definitions ...
- * Queue #4 is the command queue for 3945 and 4965.
- */
-#define IWL_CMD_QUEUE_NUM       4
-
 /* Time constants */
 #define SHORT_SLOT_TIME 9
 #define LONG_SLOT_TIME 20
@@ -254,12 +248,6 @@ struct iwl3945_eeprom {
 #define TFD_CTL_PAD_SET(n)         (n << 28)
 #define TFD_CTL_PAD_GET(ctl)       (ctl >> 28)
 
-/*
- * RX related structures and functions
- */
-#define RX_FREE_BUFFERS 64
-#define RX_LOW_WATERMARK 8
-
 /* Sizes and addresses for instruction and data memory (SRAM) in
  * 3945's embedded processor.  Driver access is via HBUS_TARG_MEM_* regs. */
 #define IWL39_RTC_INST_LOWER_BOUND              (0x000000)
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-led.c b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
index 8c29ded7d02c..abe2b739c4dc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -24,8 +24,6 @@
  *
  *****************************************************************************/
 
-#ifdef CONFIG_IWLWIFI_LEDS
-
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -43,388 +41,51 @@
 #include "iwl-3945.h"
 #include "iwl-core.h"
 #include "iwl-dev.h"
+#include "iwl-3945-led.h"
 
-#ifdef CONFIG_IWLWIFI_DEBUG
-static const char *led_type_str[] = {
-        __stringify(IWL_LED_TRG_TX),
-        __stringify(IWL_LED_TRG_RX),
-        __stringify(IWL_LED_TRG_ASSOC),
-        __stringify(IWL_LED_TRG_RADIO),
-        NULL
-};
-#endif /* CONFIG_IWLWIFI_DEBUG */
-
-static const struct {
-        u16 brightness;
-        u8 on_time;
-        u8 off_time;
-} blink_tbl[] =
-{
-        {300, 25, 25},
-        {200, 40, 40},
-        {100, 55, 55},
-        {70, 65, 65},
-        {50, 75, 75},
-        {20, 85, 85},
-        {15, 95, 95 },
-        {10, 110, 110},
-        {5, 130, 130},
-        {0, 167, 167},
-        /* SOLID_ON */
-        {-1, IWL_LED_SOLID, 0}
-};
-
-#define IWL_1MB_RATE (128 * 1024)
-#define IWL_LED_THRESHOLD (16)
-#define IWL_MAX_BLINK_TBL (ARRAY_SIZE(blink_tbl) - 1) /*Exclude Solid on*/
-#define IWL_SOLID_BLINK_IDX (ARRAY_SIZE(blink_tbl) - 1)
-
-static void iwl3945_led_cmd_callback(struct iwl_priv *priv,
-                                     struct iwl_device_cmd *cmd,
-                                     struct sk_buff *skb)
-{
-}
-
-static inline int iwl3945_brightness_to_idx(enum led_brightness brightness)
-{
-        return fls(0x000000FF & (u32)brightness);
-}
 
 /* Send led command */
-static int iwl_send_led_cmd(struct iwl_priv *priv,
-                            struct iwl_led_cmd *led_cmd)
+static int iwl3945_send_led_cmd(struct iwl_priv *priv,
+                                struct iwl_led_cmd *led_cmd)
 {
         struct iwl_host_cmd cmd = {
                 .id = REPLY_LEDS_CMD,
                 .len = sizeof(struct iwl_led_cmd),
                 .data = led_cmd,
                 .flags = CMD_ASYNC,
-                .callback = iwl3945_led_cmd_callback,
+                .callback = NULL,
         };
 
         return iwl_send_cmd(priv, &cmd);
 }
 
-
-
-/* Set led on command */
-static int iwl3945_led_pattern(struct iwl_priv *priv, int led_id,
-                               unsigned int idx)
-{
-        struct iwl_led_cmd led_cmd = {
-                .id = led_id,
-                .interval = IWL_DEF_LED_INTRVL
-        };
-
-        BUG_ON(idx > IWL_MAX_BLINK_TBL);
-
-        led_cmd.on = blink_tbl[idx].on_time;
-        led_cmd.off = blink_tbl[idx].off_time;
-
-        return iwl_send_led_cmd(priv, &led_cmd);
-}
-
-
 /* Set led on command */
-static int iwl3945_led_on(struct iwl_priv *priv, int led_id)
+static int iwl3945_led_on(struct iwl_priv *priv)
 {
         struct iwl_led_cmd led_cmd = {
-                .id = led_id,
+                .id = IWL_LED_LINK,
                 .on = IWL_LED_SOLID,
                 .off = 0,
                 .interval = IWL_DEF_LED_INTRVL
         };
-        return iwl_send_led_cmd(priv, &led_cmd);
+        return iwl3945_send_led_cmd(priv, &led_cmd);
 }
 
 /* Set led off command */
-static int iwl3945_led_off(struct iwl_priv *priv, int led_id)
+static int iwl3945_led_off(struct iwl_priv *priv)
 {
         struct iwl_led_cmd led_cmd = {
-                .id = led_id,
+                .id = IWL_LED_LINK,
                 .on = 0,
                 .off = 0,
                 .interval = IWL_DEF_LED_INTRVL
         };
-        IWL_DEBUG_LED(priv, "led off %d\n", led_id);
-        return iwl_send_led_cmd(priv, &led_cmd);
+        IWL_DEBUG_LED(priv, "led off\n");
+        return iwl3945_send_led_cmd(priv, &led_cmd);
 }
 
-/*
- *  Set led on in case of association
- *  */
-static int iwl3945_led_associate(struct iwl_priv *priv, int led_id)
-{
-        IWL_DEBUG_LED(priv, "Associated\n");
-
-        priv->allow_blinking = 1;
-        return iwl3945_led_on(priv, led_id);
-}
-/* Set Led off in case of disassociation */
-static int iwl3945_led_disassociate(struct iwl_priv *priv, int led_id)
-{
-        IWL_DEBUG_LED(priv, "Disassociated\n");
-
-        priv->allow_blinking = 0;
-
-        return 0;
-}
-
-/*
- * brightness call back function for Tx/Rx LED
- */
-static int iwl3945_led_associated(struct iwl_priv *priv, int led_id)
-{
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
-            !test_bit(STATUS_READY, &priv->status))
-                return 0;
-
-
-        /* start counting Tx/Rx bytes */
-        if (!priv->last_blink_time && priv->allow_blinking)
-                priv->last_blink_time = jiffies;
-        return 0;
-}
-
-/*
- * brightness call back for association and radio
- */
-static void iwl3945_led_brightness_set(struct led_classdev *led_cdev,
-                                enum led_brightness brightness)
-{
-        struct iwl_led *led = container_of(led_cdev,
-                                           struct iwl_led, led_dev);
-        struct iwl_priv *priv = led->priv;
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        IWL_DEBUG_LED(priv, "Led type = %s brightness = %d\n",
-                        led_type_str[led->type], brightness);
-
-        switch (brightness) {
-        case LED_FULL:
-                if (led->led_on)
-                        led->led_on(priv, IWL_LED_LINK);
-                break;
-        case LED_OFF:
-                if (led->led_off)
-                        led->led_off(priv, IWL_LED_LINK);
-                break;
-        default:
-                if (led->led_pattern) {
-                        int idx = iwl3945_brightness_to_idx(brightness);
-                        led->led_pattern(priv, IWL_LED_LINK, idx);
-                }
-                break;
-        }
-}
-
-/*
- * Register led class with the system
- */
-static int iwl3945_led_register_led(struct iwl_priv *priv,
-                                   struct iwl_led *led,
-                                   enum led_type type, u8 set_led,
-                                   char *trigger)
-{
-        struct device *device = wiphy_dev(priv->hw->wiphy);
-        int ret;
-
-        led->led_dev.name = led->name;
-        led->led_dev.brightness_set = iwl3945_led_brightness_set;
-        led->led_dev.default_trigger = trigger;
-
-        led->priv = priv;
-        led->type = type;
-
-        ret = led_classdev_register(device, &led->led_dev);
-        if (ret) {
-                IWL_ERR(priv, "Error: failed to register led handler.\n");
-                return ret;
-        }
-
-        led->registered = 1;
-
-        if (set_led && led->led_on)
-                led->led_on(priv, IWL_LED_LINK);
-        return 0;
-}
-
-
-/*
- * calculate blink rate according to last 2 sec Tx/Rx activities
- */
-static inline u8 get_blink_rate(struct iwl_priv *priv)
-{
-        int index;
-        s64 tpt = priv->rxtxpackets;
-
-        if (tpt < 0)
-                tpt = -tpt;
-
-        IWL_DEBUG_LED(priv, "tpt %lld \n", (long long)tpt);
-
-        if (!priv->allow_blinking)
-                index = IWL_MAX_BLINK_TBL;
-        else
-                for (index = 0; index < IWL_MAX_BLINK_TBL; index++)
-                        if (tpt > (blink_tbl[index].brightness * IWL_1MB_RATE))
-                                break;
-
-        IWL_DEBUG_LED(priv, "LED BLINK IDX=%d\n", index);
-        return index;
-}
-
-/*
- * this function called from handler. Since setting Led command can
- * happen very frequent we postpone led command to be called from
- * REPLY handler so we know ucode is up
- */
-void iwl3945_led_background(struct iwl_priv *priv)
-{
-        u8 blink_idx;
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
-                priv->last_blink_time = 0;
-                return;
-        }
-        if (iwl_is_rfkill(priv)) {
-                priv->last_blink_time = 0;
-                return;
-        }
-
-        if (!priv->allow_blinking) {
-                priv->last_blink_time = 0;
-                if (priv->last_blink_rate != IWL_SOLID_BLINK_IDX) {
-                        priv->last_blink_rate = IWL_SOLID_BLINK_IDX;
-                        iwl3945_led_pattern(priv, IWL_LED_LINK,
-                                            IWL_SOLID_BLINK_IDX);
-                }
-                return;
-        }
-        if (!priv->last_blink_time ||
-            !time_after(jiffies, priv->last_blink_time +
-                        msecs_to_jiffies(1000)))
-                return;
-
-        blink_idx = get_blink_rate(priv);
-
-        /* call only if blink rate change */
-        if (blink_idx != priv->last_blink_rate)
-                iwl3945_led_pattern(priv, IWL_LED_LINK, blink_idx);
-
-        priv->last_blink_time = jiffies;
-        priv->last_blink_rate = blink_idx;
-        priv->rxtxpackets = 0;
-}
-
-
-/* Register all led handler */
-int iwl3945_led_register(struct iwl_priv *priv)
-{
-        char *trigger;
-        int ret;
-
-        priv->last_blink_rate = 0;
-        priv->rxtxpackets = 0;
-        priv->led_tpt = 0;
-        priv->last_blink_time = 0;
-        priv->allow_blinking = 0;
-
-        trigger = ieee80211_get_radio_led_name(priv->hw);
-        snprintf(priv->led[IWL_LED_TRG_RADIO].name,
-                 sizeof(priv->led[IWL_LED_TRG_RADIO].name), "iwl-%s::radio",
-                 wiphy_name(priv->hw->wiphy));
-
-        priv->led[IWL_LED_TRG_RADIO].led_on = iwl3945_led_on;
-        priv->led[IWL_LED_TRG_RADIO].led_off = iwl3945_led_off;
-        priv->led[IWL_LED_TRG_RADIO].led_pattern = NULL;
-
-        ret = iwl3945_led_register_led(priv,
-                                   &priv->led[IWL_LED_TRG_RADIO],
-                                   IWL_LED_TRG_RADIO, 1, trigger);
-
-        if (ret)
-                goto exit_fail;
-
-        trigger = ieee80211_get_assoc_led_name(priv->hw);
-        snprintf(priv->led[IWL_LED_TRG_ASSOC].name,
-                 sizeof(priv->led[IWL_LED_TRG_ASSOC].name), "iwl-%s::assoc",
-                 wiphy_name(priv->hw->wiphy));
-
-        ret = iwl3945_led_register_led(priv,
-                                   &priv->led[IWL_LED_TRG_ASSOC],
-                                   IWL_LED_TRG_ASSOC, 0, trigger);
-
-        /* for assoc always turn led on */
-        priv->led[IWL_LED_TRG_ASSOC].led_on = iwl3945_led_associate;
-        priv->led[IWL_LED_TRG_ASSOC].led_off = iwl3945_led_disassociate;
-        priv->led[IWL_LED_TRG_ASSOC].led_pattern = NULL;
-
-        if (ret)
-                goto exit_fail;
-
-        trigger = ieee80211_get_rx_led_name(priv->hw);
-        snprintf(priv->led[IWL_LED_TRG_RX].name,
-                 sizeof(priv->led[IWL_LED_TRG_RX].name), "iwl-%s::RX",
-                 wiphy_name(priv->hw->wiphy));
-
-        ret = iwl3945_led_register_led(priv,
-                                   &priv->led[IWL_LED_TRG_RX],
-                                   IWL_LED_TRG_RX, 0, trigger);
-
-        priv->led[IWL_LED_TRG_RX].led_on = iwl3945_led_associated;
-        priv->led[IWL_LED_TRG_RX].led_off = iwl3945_led_associated;
-        priv->led[IWL_LED_TRG_RX].led_pattern = iwl3945_led_pattern;
-
-        if (ret)
-                goto exit_fail;
-
-        trigger = ieee80211_get_tx_led_name(priv->hw);
-        snprintf(priv->led[IWL_LED_TRG_TX].name,
-                 sizeof(priv->led[IWL_LED_TRG_TX].name), "iwl-%s::TX",
-                 wiphy_name(priv->hw->wiphy));
-
-        ret = iwl3945_led_register_led(priv,
-                                   &priv->led[IWL_LED_TRG_TX],
-                                   IWL_LED_TRG_TX, 0, trigger);
-
-        priv->led[IWL_LED_TRG_TX].led_on = iwl3945_led_associated;
-        priv->led[IWL_LED_TRG_TX].led_off = iwl3945_led_associated;
-        priv->led[IWL_LED_TRG_TX].led_pattern = iwl3945_led_pattern;
-
-        if (ret)
-                goto exit_fail;
-
-        return 0;
-
-exit_fail:
-        iwl3945_led_unregister(priv);
-        return ret;
-}
-
-
-/* unregister led class */
-static void iwl3945_led_unregister_led(struct iwl_led *led, u8 set_led)
-{
-        if (!led->registered)
-                return;
-
-        led_classdev_unregister(&led->led_dev);
-
-        if (set_led)
-                led->led_dev.brightness_set(&led->led_dev, LED_OFF);
-        led->registered = 0;
-}
-
-/* Unregister all led handlers */
-void iwl3945_led_unregister(struct iwl_priv *priv)
-{
-        iwl3945_led_unregister_led(&priv->led[IWL_LED_TRG_ASSOC], 0);
-        iwl3945_led_unregister_led(&priv->led[IWL_LED_TRG_RX], 0);
-        iwl3945_led_unregister_led(&priv->led[IWL_LED_TRG_TX], 0);
-        iwl3945_led_unregister_led(&priv->led[IWL_LED_TRG_RADIO], 1);
-}
-
-#endif
+const struct iwl_led_ops iwl3945_led_ops = {
+        .cmd = iwl3945_send_led_cmd,
+        .on = iwl3945_led_on,
+        .off = iwl3945_led_off,
+};
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-led.h b/drivers/net/wireless/iwlwifi/iwl-3945-led.h
index 3b65642258ca..ce990adc51e7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-led.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-led.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -24,23 +24,9 @@
  *
  *****************************************************************************/
 
-#ifndef IWL3945_LEDS_H
-#define IWL3945_LEDS_H
+#ifndef __iwl_3945_led_h__
+#define __iwl_3945_led_h__
 
-struct iwl_priv;
+extern const struct iwl_led_ops iwl3945_led_ops;
 
-#ifdef CONFIG_IWLWIFI_LEDS
-
-#include "iwl-led.h"
-
-extern int iwl3945_led_register(struct iwl_priv *priv);
-extern void iwl3945_led_unregister(struct iwl_priv *priv);
-extern void iwl3945_led_background(struct iwl_priv *priv);
-
-#else
-static inline int iwl3945_led_register(struct iwl_priv *priv) { return 0; }
-static inline void iwl3945_led_unregister(struct iwl_priv *priv) {}
-static inline void iwl3945_led_background(struct iwl_priv *priv) {}
-
-#endif /* IWLWIFI_LEDS*/
-#endif /* IWL3945_LEDS_H */
+#endif /* __iwl_3945_led_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index cbb0585083a9..902c4d4293e9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -27,6 +27,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/wireless.h>
 #include <net/mac80211.h>
 
@@ -42,38 +43,6 @@
 
 #define RS_NAME "iwl-3945-rs"
 
-struct iwl3945_rate_scale_data {
-        u64 data;
-        s32 success_counter;
-        s32 success_ratio;
-        s32 counter;
-        s32 average_tpt;
-        unsigned long stamp;
-};
-
-struct iwl3945_rs_sta {
-        spinlock_t lock;
-        struct iwl_priv *priv;
-        s32 *expected_tpt;
-        unsigned long last_partial_flush;
-        unsigned long last_flush;
-        u32 flush_time;
-        u32 last_tx_packets;
-        u32 tx_packets;
-        u8 tgg;
-        u8 flush_pending;
-        u8 start_rate;
-        u8 ibss_sta_added;
-        struct timer_list rate_scale_flush;
-        struct iwl3945_rate_scale_data win[IWL_RATE_COUNT_3945];
-#ifdef CONFIG_MAC80211_DEBUGFS
-        struct dentry *rs_sta_dbgfs_stats_table_file;
-#endif
-
-        /* used to be in sta_info */
-        int last_txrate_idx;
-};
-
 static s32 iwl3945_expected_tpt_g[IWL_RATE_COUNT_3945] = {
         7, 13, 35, 58, 0, 0, 76, 104, 130, 168, 191, 202
 };
@@ -370,6 +339,28 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
 
         IWL_DEBUG_RATE(priv, "enter\n");
 
+        spin_lock_init(&rs_sta->lock);
+
+        rs_sta->priv = priv;
+
+        rs_sta->start_rate = IWL_RATE_INVALID;
+
+        /* default to just 802.11b */
+        rs_sta->expected_tpt = iwl3945_expected_tpt_b;
+
+        rs_sta->last_partial_flush = jiffies;
+        rs_sta->last_flush = jiffies;
+        rs_sta->flush_time = IWL_RATE_FLUSH;
+        rs_sta->last_tx_packets = 0;
+        rs_sta->ibss_sta_added = 0;
+
+        init_timer(&rs_sta->rate_scale_flush);
+        rs_sta->rate_scale_flush.data = (unsigned long)rs_sta;
+        rs_sta->rate_scale_flush.function = iwl3945_bg_rate_scale_flush;
+
+        for (i = 0; i < IWL_RATE_COUNT_3945; i++)
+                iwl3945_clear_window(&rs_sta->win[i]);
+
         /* TODO: what is a good starting rate for STA? About middle? Maybe not
          * the lowest or the highest rate.. Could consider using RSSI from
          * previous packets? Need to have IEEE 802.1X auth succeed immediately
@@ -409,45 +400,11 @@ static void *rs_alloc_sta(void *iwl_priv, struct ieee80211_sta *sta, gfp_t gfp)
 {
         struct iwl3945_rs_sta *rs_sta;
         struct iwl3945_sta_priv *psta = (void *) sta->drv_priv;
-        struct iwl_priv *priv = iwl_priv;
-        int i;
-
-        /*
-         * XXX: If it's using sta->drv_priv anyway, it might
-         *      as well just put all the information there.
-         */
+        struct iwl_priv *priv __maybe_unused = iwl_priv;
 
         IWL_DEBUG_RATE(priv, "enter\n");
 
-        rs_sta = kzalloc(sizeof(struct iwl3945_rs_sta), gfp);
-        if (!rs_sta) {
-                IWL_DEBUG_RATE(priv, "leave: ENOMEM\n");
-                return NULL;
-        }
-
-        psta->rs_sta = rs_sta;
-
-        spin_lock_init(&rs_sta->lock);
-
-        rs_sta->priv = priv;
-
-        rs_sta->start_rate = IWL_RATE_INVALID;
-
-        /* default to just 802.11b */
-        rs_sta->expected_tpt = iwl3945_expected_tpt_b;
-
-        rs_sta->last_partial_flush = jiffies;
-        rs_sta->last_flush = jiffies;
-        rs_sta->flush_time = IWL_RATE_FLUSH;
-        rs_sta->last_tx_packets = 0;
-        rs_sta->ibss_sta_added = 0;
-
-        init_timer(&rs_sta->rate_scale_flush);
-        rs_sta->rate_scale_flush.data = (unsigned long)rs_sta;
-        rs_sta->rate_scale_flush.function = &iwl3945_bg_rate_scale_flush;
-
-        for (i = 0; i < IWL_RATE_COUNT_3945; i++)
-                iwl3945_clear_window(&rs_sta->win[i]);
+        rs_sta = &psta->rs_sta;
 
         IWL_DEBUG_RATE(priv, "leave\n");
 
@@ -458,14 +415,11 @@ static void rs_free_sta(void *iwl_priv, struct ieee80211_sta *sta,
                         void *priv_sta)
 {
         struct iwl3945_sta_priv *psta = (void *) sta->drv_priv;
-        struct iwl3945_rs_sta *rs_sta = priv_sta;
+        struct iwl3945_rs_sta *rs_sta = &psta->rs_sta;
         struct iwl_priv *priv __maybe_unused = rs_sta->priv;
 
-        psta->rs_sta = NULL;
-
         IWL_DEBUG_RATE(priv, "enter\n");
         del_timer_sync(&rs_sta->rate_scale_flush);
-        kfree(rs_sta);
         IWL_DEBUG_RATE(priv, "leave\n");
 }
 
@@ -960,14 +914,15 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
 
         rcu_read_lock();
 
-        sta = ieee80211_find_sta(hw, priv->stations[sta_id].sta.sta.addr);
+        sta = ieee80211_find_sta(priv->vif,
+                                 priv->stations[sta_id].sta.sta.addr);
         if (!sta) {
                 rcu_read_unlock();
                 return;
         }
 
         psta = (void *) sta->drv_priv;
-        rs_sta = psta->rs_sta;
+        rs_sta = &psta->rs_sta;
 
         spin_lock_irqsave(&rs_sta->lock, flags);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index f059b49dc691..0728054a22d4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -27,6 +27,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
@@ -45,9 +46,10 @@
 #include "iwl-sta.h"
 #include "iwl-3945.h"
 #include "iwl-eeprom.h"
-#include "iwl-helpers.h"
 #include "iwl-core.h"
-#include "iwl-agn-rs.h"
+#include "iwl-helpers.h"
+#include "iwl-led.h"
+#include "iwl-3945-led.h"
 
 #define IWL_DECLARE_RATE_INFO(r, ip, in, rp, rn, pp, np)    \
         [IWL_RATE_##r##M_INDEX] = { IWL_RATE_##r##M_PLCP,   \
@@ -183,7 +185,7 @@ static int iwl3945_hwrate_to_plcp_idx(u8 plcp)
 {
         int idx;
 
-        for (idx = 0; idx < IWL_RATE_COUNT; idx++)
+        for (idx = 0; idx < IWL_RATE_COUNT_3945; idx++)
                 if (iwl3945_rates[idx].plcp == plcp)
                         return idx;
         return -1;
@@ -293,7 +295,7 @@ static void iwl3945_tx_queue_reclaim(struct iwl_priv *priv,
 static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
                             struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
         int txq_id = SEQ_TO_QUEUE(sequence);
         int index = SEQ_TO_INDEX(sequence);
@@ -353,16 +355,12 @@ static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
 void iwl3945_hw_rx_statistics(struct iwl_priv *priv,
                 struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
                      (int)sizeof(struct iwl3945_notif_statistics),
                      le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
 
         memcpy(&priv->statistics_39, pkt->u.raw, sizeof(priv->statistics_39));
-
-        iwl3945_led_background(priv);
-
-        priv->last_statistics_time = jiffies;
 }
 
 /******************************************************************************
@@ -545,14 +543,18 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
                                    struct iwl_rx_mem_buffer *rxb,
                                    struct ieee80211_rx_status *stats)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)IWL_RX_DATA(pkt);
         struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
         struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
-        short len = le16_to_cpu(rx_hdr->len);
+        u16 len = le16_to_cpu(rx_hdr->len);
+        struct sk_buff *skb;
+        int ret;
+        __le16 fc = hdr->frame_control;
 
         /* We received data from the HW, so stop the watchdog */
-        if (unlikely((len + IWL39_RX_FRAME_SIZE) > skb_tailroom(rxb->skb))) {
+        if (unlikely(len + IWL39_RX_FRAME_SIZE >
+                     PAGE_SIZE << priv->hw_params.rx_page_order)) {
                 IWL_DEBUG_DROP(priv, "Corruption detected!\n");
                 return;
         }
@@ -564,24 +566,50 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
                 return;
         }
 
-        skb_reserve(rxb->skb, (void *)rx_hdr->payload - (void *)pkt);
-        /* Set the size of the skb to the size of the frame */
-        skb_put(rxb->skb, le16_to_cpu(rx_hdr->len));
+        skb = alloc_skb(IWL_LINK_HDR_MAX * 2, GFP_ATOMIC);
+        if (!skb) {
+                IWL_ERR(priv, "alloc_skb failed\n");
+                return;
+        }
 
         if (!iwl3945_mod_params.sw_crypto)
                 iwl_set_decrypted_flag(priv,
-                                       (struct ieee80211_hdr *)rxb->skb->data,
+                                       (struct ieee80211_hdr *)rxb_addr(rxb),
                                        le32_to_cpu(rx_end->status), stats);
 
-#ifdef CONFIG_IWLWIFI_LEDS
-        if (ieee80211_is_data(hdr->frame_control))
-                priv->rxtxpackets += len;
-#endif
-        iwl_update_stats(priv, false, hdr->frame_control, len);
+        skb_reserve(skb, IWL_LINK_HDR_MAX);
+        skb_add_rx_frag(skb, 0, rxb->page,
+                        (void *)rx_hdr->payload - (void *)pkt, len);
+
+        /* mac80211 currently doesn't support paged SKB. Convert it to
+         * linear SKB for management frame and data frame requires
+         * software decryption or software defragementation. */
+        if (ieee80211_is_mgmt(fc) ||
+            ieee80211_has_protected(fc) ||
+            ieee80211_has_morefrags(fc) ||
+            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG)
+                ret = skb_linearize(skb);
+        else
+                ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
+                        0 : -ENOMEM;
+
+        if (ret) {
+                kfree_skb(skb);
+                goto out;
+        }
+
+        /*
+         * XXX: We cannot touch the page and its virtual memory (pkt) after
+         * here. It might have already been freed by the above skb change.
+         */
+
+        iwl_update_stats(priv, false, fc, len);
+        memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
 
-        memcpy(IEEE80211_SKB_RXCB(rxb->skb), stats, sizeof(*stats));
-        ieee80211_rx_irqsafe(priv->hw, rxb->skb);
-        rxb->skb = NULL;
+        ieee80211_rx(priv->hw, skb);
+ out:
+        priv->alloc_rxb_page--;
+        rxb->page = NULL;
 }
 
 #define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
@@ -591,7 +619,7 @@ static void iwl3945_rx_reply_rx(struct iwl_priv *priv,
 {
         struct ieee80211_hdr *header;
         struct ieee80211_rx_status rx_status;
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl3945_rx_frame_stats *rx_stats = IWL_RX_STATS(pkt);
         struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
         struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
@@ -654,19 +682,13 @@ static void iwl3945_rx_reply_rx(struct iwl_priv *priv,
                 snr = rx_stats_sig_avg / rx_stats_noise_diff;
                 rx_status.noise = rx_status.signal -
                                         iwl3945_calc_db_from_ratio(snr);
-                rx_status.qual = iwl3945_calc_sig_qual(rx_status.signal,
-                                                         rx_status.noise);
-
-        /* If noise info not available, calculate signal quality indicator (%)
-         *   using just the dBm signal level. */
         } else {
                 rx_status.noise = priv->last_rx_noise;
-                rx_status.qual = iwl3945_calc_sig_qual(rx_status.signal, 0);
         }
 
 
-        IWL_DEBUG_STATS(priv, "Rssi %d noise %d qual %d sig_avg %d noise_diff %d\n",
-                        rx_status.signal, rx_status.noise, rx_status.qual,
+        IWL_DEBUG_STATS(priv, "Rssi %d noise %d sig_avg %d noise_diff %d\n",
+                        rx_status.signal, rx_status.noise,
                         rx_stats_sig_avg, rx_stats_noise_diff);
 
         header = (struct ieee80211_hdr *)IWL_RX_DATA(pkt);
@@ -784,36 +806,38 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv,
                                   int sta_id, int tx_id)
 {
         u16 hw_value = ieee80211_get_tx_rate(priv->hw, info)->hw_value;
-        u16 rate_index = min(hw_value & 0xffff, IWL_RATE_COUNT - 1);
+        u16 rate_index = min(hw_value & 0xffff, IWL_RATE_COUNT_3945);
         u16 rate_mask;
         int rate;
         u8 rts_retry_limit;
         u8 data_retry_limit;
         __le32 tx_flags;
         __le16 fc = hdr->frame_control;
-        struct iwl3945_tx_cmd *tx = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
+        struct iwl3945_tx_cmd *tx_cmd = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
 
         rate = iwl3945_rates[rate_index].plcp;
-        tx_flags = tx->tx_flags;
+        tx_flags = tx_cmd->tx_flags;
 
         /* We need to figure out how to get the sta->supp_rates while
          * in this running context */
         rate_mask = IWL_RATES_MASK;
 
+
+        /* Set retry limit on DATA packets and Probe Responses*/
+        if (ieee80211_is_probe_resp(fc))
+                data_retry_limit = 3;
+        else
+                data_retry_limit = IWL_DEFAULT_TX_RETRY;
+        tx_cmd->data_retry_limit = data_retry_limit;
+
         if (tx_id >= IWL_CMD_QUEUE_NUM)
                 rts_retry_limit = 3;
         else
                 rts_retry_limit = 7;
 
-        if (ieee80211_is_probe_resp(fc)) {
-                data_retry_limit = 3;
-                if (data_retry_limit < rts_retry_limit)
-                        rts_retry_limit = data_retry_limit;
-        } else
-                data_retry_limit = IWL_DEFAULT_TX_RETRY;
-
-        if (priv->data_retry_limit != -1)
-                data_retry_limit = priv->data_retry_limit;
+        if (data_retry_limit < rts_retry_limit)
+                rts_retry_limit = data_retry_limit;
+        tx_cmd->rts_retry_limit = rts_retry_limit;
 
         if (ieee80211_is_mgmt(fc)) {
                 switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
@@ -831,22 +855,20 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv,
                 }
         }
 
-        tx->rts_retry_limit = rts_retry_limit;
-        tx->data_retry_limit = data_retry_limit;
-        tx->rate = rate;
-        tx->tx_flags = tx_flags;
+        tx_cmd->rate = rate;
+        tx_cmd->tx_flags = tx_flags;
 
         /* OFDM */
-        tx->supp_rates[0] =
+        tx_cmd->supp_rates[0] =
            ((rate_mask & IWL_OFDM_RATES_MASK) >> IWL_FIRST_OFDM_RATE) & 0xFF;
 
         /* CCK */
-        tx->supp_rates[1] = (rate_mask & 0xF);
+        tx_cmd->supp_rates[1] = (rate_mask & 0xF);
 
         IWL_DEBUG_RATE(priv, "Tx sta id: %d, rate: %d (plcp), flags: 0x%4X "
                        "cck/ofdm mask: 0x%x/0x%x\n", sta_id,
-                       tx->rate, le32_to_cpu(tx->tx_flags),
-                       tx->supp_rates[1], tx->supp_rates[0]);
+                       tx_cmd->rate, le32_to_cpu(tx_cmd->tx_flags),
+                       tx_cmd->supp_rates[1], tx_cmd->supp_rates[0]);
 }
 
 u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id, u16 tx_rate, u8 flags)
@@ -962,6 +984,11 @@ static int iwl3945_txq_ctx_reset(struct iwl_priv *priv)
 
         iwl3945_hw_txq_ctx_free(priv);
 
+        /* allocate tx queue structure */
+        rc = iwl_alloc_txq_mem(priv);
+        if (rc)
+                return rc;
+
         /* Tx CMD queue */
         rc = iwl3945_tx_reset(priv);
         if (rc)
@@ -986,41 +1013,25 @@ static int iwl3945_txq_ctx_reset(struct iwl_priv *priv)
         return rc;
 }
 
+
+/*
+ * Start up 3945's basic functionality after it has been reset
+ * (e.g. after platform boot, or shutdown via iwl_apm_stop())
+ * NOTE:  This does not load uCode nor start the embedded processor
+ */
 static int iwl3945_apm_init(struct iwl_priv *priv)
 {
-        int ret;
-
-        iwl_power_initialize(priv);
-
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
+        int ret = iwl_apm_init(priv);
 
-        /* disable L0s without affecting L1 :don't wait for ICH L0s bug W/A) */
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
-
-        /* set "initialization complete" bit to move adapter
-        * D0U* --> D0A* state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        ret = iwl_poll_direct_bit(priv, CSR_GP_CNTRL,
-                            CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                goto out;
-        }
-
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_CTRL_REG, APMG_CLK_VAL_DMA_CLK_RQT |
-                                                APMG_CLK_VAL_BSM_CLK_RQT);
-
-        udelay(20);
+        /* Clear APMG (NIC's internal power management) interrupts */
+        iwl_write_prph(priv, APMG_RTC_INT_MSK_REG, 0x0);
+        iwl_write_prph(priv, APMG_RTC_INT_STT_REG, 0xFFFFFFFF);
 
-        /* disable L1-Active */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
+        /* Reset radio chip */
+        iwl_set_bits_prph(priv, APMG_PS_CTRL_REG, APMG_PS_CTRL_VAL_RESET_REQ);
+        udelay(5);
+        iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG, APMG_PS_CTRL_VAL_RESET_REQ);
 
-out:
         return ret;
 }
 
@@ -1145,12 +1156,16 @@ void iwl3945_hw_txq_ctx_free(struct iwl_priv *priv)
         int txq_id;
 
         /* Tx queues */
-        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
-                if (txq_id == IWL_CMD_QUEUE_NUM)
-                        iwl_cmd_queue_free(priv);
-                else
-                        iwl_tx_queue_free(priv, txq_id);
+        if (priv->txq)
+                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num;
+                     txq_id++)
+                        if (txq_id == IWL_CMD_QUEUE_NUM)
+                                iwl_cmd_queue_free(priv);
+                        else
+                                iwl_tx_queue_free(priv, txq_id);
 
+        /* free tx queue structure */
+        iwl_free_txq_mem(priv);
 }
 
 void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
@@ -1159,6 +1174,7 @@ void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
 
         /* stop SCD */
         iwl_write_prph(priv, ALM_SCD_MODE_REG, 0);
+        iwl_write_prph(priv, ALM_SCD_TXFACT_REG, 0);
 
         /* reset TFD queues */
         for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
@@ -1171,85 +1187,6 @@ void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
         iwl3945_hw_txq_ctx_free(priv);
 }
 
-static int iwl3945_apm_stop_master(struct iwl_priv *priv)
-{
-        int ret = 0;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* set stop master bit */
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_STOP_MASTER);
-
-        iwl_poll_direct_bit(priv, CSR_RESET,
-                            CSR_RESET_REG_FLAG_MASTER_DISABLED, 100);
-
-        if (ret < 0)
-                goto out;
-
-out:
-        spin_unlock_irqrestore(&priv->lock, flags);
-        IWL_DEBUG_INFO(priv, "stop master\n");
-
-        return ret;
-}
-
-static void iwl3945_apm_stop(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        iwl3945_apm_stop_master(priv);
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-
-        udelay(10);
-        /* clear "init complete"  move adapter D0A* --> D0U state */
-        iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-        spin_unlock_irqrestore(&priv->lock, flags);
-}
-
-static int iwl3945_apm_reset(struct iwl_priv *priv)
-{
-        iwl3945_apm_stop_master(priv);
-
-
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-        udelay(10);
-
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        iwl_poll_direct_bit(priv, CSR_GP_CNTRL,
-                         CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-
-        iwl_write_prph(priv, APMG_CLK_CTRL_REG,
-                                APMG_CLK_VAL_BSM_CLK_RQT);
-
-        iwl_write_prph(priv, APMG_RTC_INT_MSK_REG, 0x0);
-        iwl_write_prph(priv, APMG_RTC_INT_STT_REG,
-                                        0xFFFFFFFF);
-
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_EN_REG,
-                                APMG_CLK_VAL_DMA_CLK_RQT |
-                                APMG_CLK_VAL_BSM_CLK_RQT);
-        udelay(10);
-
-        iwl_set_bits_prph(priv, APMG_PS_CTRL_REG,
-                                APMG_PS_CTRL_VAL_RESET_REQ);
-        udelay(5);
-        iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG,
-                                APMG_PS_CTRL_VAL_RESET_REQ);
-
-        /* Clear the 'host command active' bit... */
-        clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
-
-        wake_up_interruptible(&priv->wait_command_queue);
-
-        return 0;
-}
-
 /**
  * iwl3945_hw_reg_adjust_power_by_temp
  * return index delta into power gain settings table
@@ -1858,7 +1795,7 @@ int iwl3945_hw_reg_set_txpower(struct iwl_priv *priv, s8 power)
 static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
 {
         int rc = 0;
-        struct iwl_rx_packet *res = NULL;
+        struct iwl_rx_packet *pkt;
         struct iwl3945_rxon_assoc_cmd rxon_assoc;
         struct iwl_host_cmd cmd = {
                 .id = REPLY_RXON_ASSOC,
@@ -1887,14 +1824,13 @@ static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
         if (rc)
                 return rc;
 
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_RXON_ASSOC command\n");
                 rc = -EIO;
         }
 
-        priv->alloc_rxb_skb--;
-        dev_kfree_skb_any(cmd.reply_skb);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return rc;
 }
@@ -2016,11 +1952,7 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
         }
 
         /* Add the broadcast address so we can send broadcast frames */
-        if (iwl_add_station(priv, iwl_bcast_addr, false, CMD_SYNC, NULL) ==
-            IWL_INVALID_STATION) {
-                IWL_ERR(priv, "Error adding BROADCAST address for transmit.\n");
-                return -EIO;
-        }
+        priv->cfg->ops->lib->add_bcast_station(priv);
 
         /* If we have set the ASSOC_MSK and we are in BSS mode then
          * add the IWL_AP_ID to the station rate table */
@@ -2042,12 +1974,6 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
         return 0;
 }
 
-/* will add 3945 channel switch cmd handling later */
-int iwl3945_hw_channel_switch(struct iwl_priv *priv, u16 channel)
-{
-        return 0;
-}
-
 /**
  * iwl3945_reg_txpower_periodic -  called when time to check our temperature.
  *
@@ -2221,7 +2147,7 @@ static void iwl3945_hw_reg_init_channel_groups(struct iwl_priv *priv)
 
                 /* fill in channel group's nominal powers for each rate */
                 for (rate_index = 0;
-                     rate_index < IWL_RATE_COUNT; rate_index++, clip_pwrs++) {
+                     rate_index < IWL_RATE_COUNT_3945; rate_index++, clip_pwrs++) {
                         switch (rate_index) {
                         case IWL_RATE_36M_INDEX_TABLE:
                                 if (i == 0)     /* B/G */
@@ -2545,11 +2471,9 @@ int iwl3945_hw_set_hw_params(struct iwl_priv *priv)
         memset((void *)&priv->hw_params, 0,
                sizeof(struct iwl_hw_params));
 
-        priv->shared_virt =
-            pci_alloc_consistent(priv->pci_dev,
-                                 sizeof(struct iwl3945_shared),
-                                 &priv->shared_phys);
-
+        priv->shared_virt = dma_alloc_coherent(&priv->pci_dev->dev,
+                                               sizeof(struct iwl3945_shared),
+                                               &priv->shared_phys, GFP_KERNEL);
         if (!priv->shared_virt) {
                 IWL_ERR(priv, "failed to allocate pci memory\n");
                 mutex_unlock(&priv->mutex);
@@ -2557,11 +2481,10 @@ int iwl3945_hw_set_hw_params(struct iwl_priv *priv)
         }
 
         /* Assign number of Usable TX queues */
-        priv->hw_params.max_txq_num = IWL39_NUM_QUEUES;
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
 
         priv->hw_params.tfd_size = sizeof(struct iwl3945_tfd);
-        priv->hw_params.rx_buf_size = IWL_RX_BUF_SIZE_3K;
-        priv->hw_params.max_pkt_size = 2342;
+        priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_3K);
         priv->hw_params.max_rxq_size = RX_QUEUE_SIZE;
         priv->hw_params.max_rxq_log = RX_QUEUE_SIZE_LOG;
         priv->hw_params.max_stations = IWL3945_STATION_COUNT;
@@ -2844,8 +2767,7 @@ static struct iwl_lib_ops iwl3945_lib = {
         .dump_nic_error_log = iwl3945_dump_nic_error_log,
         .apm_ops = {
                 .init = iwl3945_apm_init,
-                .reset = iwl3945_apm_reset,
-                .stop = iwl3945_apm_stop,
+                .stop = iwl_apm_stop,
                 .config = iwl3945_nic_config,
                 .set_pwr_src = iwl3945_set_pwr_src,
         },
@@ -2869,18 +2791,21 @@ static struct iwl_lib_ops iwl3945_lib = {
         .post_associate = iwl3945_post_associate,
         .isr = iwl_isr_legacy,
         .config_ap = iwl3945_config_ap,
+        .add_bcast_station = iwl3945_add_bcast_station,
 };
 
 static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
         .get_hcmd_size = iwl3945_get_hcmd_size,
         .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
+        .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
 };
 
-static struct iwl_ops iwl3945_ops = {
+static const struct iwl_ops iwl3945_ops = {
         .ucode = &iwl3945_ucode,
         .lib = &iwl3945_lib,
         .hcmd = &iwl3945_hcmd,
         .utils = &iwl3945_hcmd_utils,
+        .led = &iwl3945_led_ops,
 };
 
 static struct iwl_cfg iwl3945_bg_cfg = {
@@ -2892,9 +2817,16 @@ static struct iwl_cfg iwl3945_bg_cfg = {
         .eeprom_size = IWL3945_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_3945_EEPROM_VERSION,
         .ops = &iwl3945_ops,
+        .num_of_queues = IWL39_NUM_QUEUES,
         .mod_params = &iwl3945_mod_params,
+        .pll_cfg_val = CSR39_ANA_PLL_CFG_VAL,
+        .set_l0s = false,
+        .use_bsm = true,
         .use_isr_legacy = true,
         .ht_greenfield_support = false,
+        .led_compensation = 64,
+        .broken_powersave = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
 };
 
 static struct iwl_cfg iwl3945_abg_cfg = {
@@ -2906,12 +2838,16 @@ static struct iwl_cfg iwl3945_abg_cfg = {
         .eeprom_size = IWL3945_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_3945_EEPROM_VERSION,
         .ops = &iwl3945_ops,
+        .num_of_queues = IWL39_NUM_QUEUES,
         .mod_params = &iwl3945_mod_params,
         .use_isr_legacy = true,
         .ht_greenfield_support = false,
+        .led_compensation = 64,
+        .broken_powersave = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
 };
 
-struct pci_device_id iwl3945_hw_card_ids[] = {
+DEFINE_PCI_DEVICE_TABLE(iwl3945_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x4222, 0x1005, iwl3945_bg_cfg)},
         {IWL_PCI_DEVICE(0x4222, 0x1034, iwl3945_bg_cfg)},
         {IWL_PCI_DEVICE(0x4222, 0x1044, iwl3945_bg_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index 21679bf3a1aa..452dfd5456c6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -37,7 +37,7 @@
 #include <net/ieee80211_radiotap.h>
 
 /* Hardware specific file defines the PCI IDs table for that hardware module */
-extern struct pci_device_id iwl3945_hw_card_ids[];
+extern const struct pci_device_id iwl3945_hw_card_ids[];
 
 #include "iwl-csr.h"
 #include "iwl-prph.h"
@@ -46,7 +46,7 @@ extern struct pci_device_id iwl3945_hw_card_ids[];
 #include "iwl-debug.h"
 #include "iwl-power.h"
 #include "iwl-dev.h"
-#include "iwl-3945-led.h"
+#include "iwl-led.h"
 
 /* Highest firmware API version supported */
 #define IWL3945_UCODE_API_MAX 2
@@ -74,8 +74,41 @@ extern struct pci_device_id iwl3945_hw_card_ids[];
 /* Module parameters accessible from iwl-*.c */
 extern struct iwl_mod_params iwl3945_mod_params;
 
+struct iwl3945_rate_scale_data {
+        u64 data;
+        s32 success_counter;
+        s32 success_ratio;
+        s32 counter;
+        s32 average_tpt;
+        unsigned long stamp;
+};
+
+struct iwl3945_rs_sta {
+        spinlock_t lock;
+        struct iwl_priv *priv;
+        s32 *expected_tpt;
+        unsigned long last_partial_flush;
+        unsigned long last_flush;
+        u32 flush_time;
+        u32 last_tx_packets;
+        u32 tx_packets;
+        u8 tgg;
+        u8 flush_pending;
+        u8 start_rate;
+        u8 ibss_sta_added;
+        struct timer_list rate_scale_flush;
+        struct iwl3945_rate_scale_data win[IWL_RATE_COUNT_3945];
+#ifdef CONFIG_MAC80211_DEBUGFS
+        struct dentry *rs_sta_dbgfs_stats_table_file;
+#endif
+
+        /* used to be in sta_info */
+        int last_txrate_idx;
+};
+
+
 struct iwl3945_sta_priv {
-        struct iwl3945_rs_sta *rs_sta;
+        struct iwl3945_rs_sta rs_sta;
 };
 
 enum iwl3945_antenna {
@@ -130,12 +163,6 @@ struct iwl3945_frame {
 #define SN_TO_SEQ(ssn) (((ssn) << 4) & IEEE80211_SCTL_SEQ)
 #define MAX_SN ((IEEE80211_SCTL_SEQ) >> 4)
 
-/*
- * RX related structures and functions
- */
-#define RX_FREE_BUFFERS 64
-#define RX_LOW_WATERMARK 8
-
 #define SUP_RATE_11A_MAX_NUM_CHANNELS  8
 #define SUP_RATE_11B_MAX_NUM_CHANNELS  4
 #define SUP_RATE_11G_MAX_NUM_CHANNELS  12
@@ -144,24 +171,6 @@ struct iwl3945_frame {
 
 #define SCAN_INTERVAL 100
 
-#define STATUS_HCMD_ACTIVE      0       /* host command in progress */
-#define STATUS_HCMD_SYNC_ACTIVE 1       /* sync host command in progress */
-#define STATUS_INT_ENABLED      2
-#define STATUS_RF_KILL_HW       3
-#define STATUS_INIT             5
-#define STATUS_ALIVE            6
-#define STATUS_READY            7
-#define STATUS_TEMPERATURE      8
-#define STATUS_GEO_CONFIGURED   9
-#define STATUS_EXIT_PENDING     10
-#define STATUS_STATISTICS       12
-#define STATUS_SCANNING         13
-#define STATUS_SCAN_ABORTING    14
-#define STATUS_SCAN_HW          15
-#define STATUS_POWER_PMI        16
-#define STATUS_FW_ERROR         17
-#define STATUS_CONF_PENDING     18
-
 #define MAX_TID_COUNT        9
 
 #define IWL_INVALID_RATE     0xFF
@@ -194,22 +203,13 @@ struct iwl3945_ibss_seq {
  * for use by iwl-*.c
  *
  *****************************************************************************/
-extern int iwl3945_power_init_handle(struct iwl_priv *priv);
-extern int iwl3945_eeprom_init(struct iwl_priv *priv);
 extern int iwl3945_calc_db_from_ratio(int sig_ratio);
-extern int iwl3945_calc_sig_qual(int rssi_dbm, int noise_dbm);
-extern int iwl3945_tx_queue_init(struct iwl_priv *priv,
-                             struct iwl_tx_queue *txq, int count, u32 id);
 extern void iwl3945_rx_replenish(void *data);
 extern void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
-extern void iwl3945_tx_queue_free(struct iwl_priv *priv, struct iwl_tx_queue *txq);
-extern int iwl3945_send_cmd_pdu(struct iwl_priv *priv, u8 id, u16 len,
-                            const void *data);
-extern int __must_check iwl3945_send_cmd(struct iwl_priv *priv,
-                                         struct iwl_host_cmd *cmd);
 extern unsigned int iwl3945_fill_beacon_frame(struct iwl_priv *priv,
                                         struct ieee80211_hdr *hdr,int left);
-extern void iwl3945_dump_nic_event_log(struct iwl_priv *priv);
+extern int iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
+                                       char **buf, bool display);
 extern void iwl3945_dump_nic_error_log(struct iwl_priv *priv);
 
 /*
@@ -280,8 +280,6 @@ extern void iwl3945_config_ap(struct iwl_priv *priv);
  */
 extern u8 iwl3945_hw_find_station(struct iwl_priv *priv, const u8 *bssid);
 
-extern int iwl3945_hw_channel_switch(struct iwl_priv *priv, u16 channel);
-
 /*
  * Forward declare iwl-3945.c functions for iwl-base.c
  */
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
index b34322a32458..67ef562e8db1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -76,12 +76,9 @@
 
 /*
  * uCode queue management definitions ...
- * Queue #4 is the command queue for 3945 and 4965; map it to Tx FIFO chnl 4.
  * The first queue used for block-ack aggregation is #7 (4965 only).
  * All block-ack aggregation queues should map to Tx DMA/FIFO channel 7.
  */
-#define IWL_CMD_QUEUE_NUM       4
-#define IWL_CMD_FIFO_NUM        4
 #define IWL49_FIRST_AMPDU_QUEUE 7
 
 /* Time constants */
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 6f703a041847..8972166386cb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -45,6 +45,7 @@
 #include "iwl-helpers.h"
 #include "iwl-calib.h"
 #include "iwl-sta.h"
+#include "iwl-agn-led.h"
 
 static int iwl4965_send_tx_power(struct iwl_priv *priv);
 static int iwl4965_hw_get_temperature(struct iwl_priv *priv);
@@ -62,8 +63,6 @@ static int iwl4965_hw_get_temperature(struct iwl_priv *priv);
 
 /* module parameters */
 static struct iwl_mod_params iwl4965_mod_params = {
-        .num_of_queues = IWL49_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL49_NUM_AMPDU_QUEUES,
         .amsdu_size_8K = 1,
         .restart_fw = 1,
         /* the rest are 0 by default */
@@ -319,63 +318,13 @@ static void iwl4965_txq_set_sched(struct iwl_priv *priv, u32 mask)
         iwl_write_prph(priv, IWL49_SCD_TXFACT, mask);
 }
 
-static int iwl4965_apm_init(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
-
-        /* disable L0s without affecting L1 :don't wait for ICH L0s bug W/A) */
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
-
-        /* set "initialization complete" bit to move adapter
-         * D0U* --> D0A* state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        /* wait for clock stabilization */
-        ret = iwl_poll_direct_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                goto out;
-        }
-
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_CTRL_REG, APMG_CLK_VAL_DMA_CLK_RQT |
-                                                APMG_CLK_VAL_BSM_CLK_RQT);
-
-        udelay(20);
-
-        /* disable L1-Active */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-
-out:
-        return ret;
-}
-
-
 static void iwl4965_nic_config(struct iwl_priv *priv)
 {
         unsigned long flags;
         u16 radio_cfg;
-        u16 lctl;
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        lctl = iwl_pcie_link_ctl(priv);
-
-        /* HW bug W/A - negligible power consumption */
-        /* L1-ASPM is enabled by BIOS */
-        if ((lctl & PCI_CFG_LINK_CTRL_VAL_L1_EN) == PCI_CFG_LINK_CTRL_VAL_L1_EN)
-                /* L1-ASPM enabled: disable L0S  */
-                iwl_set_bit(priv, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-        else
-                /* L1-ASPM disabled: enable L0S */
-                iwl_clear_bit(priv, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-
         radio_cfg = iwl_eeprom_query16(priv, EEPROM_RADIO_CONFIG);
 
         /* write radio config values to register */
@@ -396,79 +345,6 @@ static void iwl4965_nic_config(struct iwl_priv *priv)
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
-static int iwl4965_apm_stop_master(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* set stop master bit */
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_STOP_MASTER);
-
-        iwl_poll_direct_bit(priv, CSR_RESET,
-                        CSR_RESET_REG_FLAG_MASTER_DISABLED, 100);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-        IWL_DEBUG_INFO(priv, "stop master\n");
-
-        return 0;
-}
-
-static void iwl4965_apm_stop(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        iwl4965_apm_stop_master(priv);
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-
-        udelay(10);
-        /* clear "init complete"  move adapter D0A* --> D0U state */
-        iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-        spin_unlock_irqrestore(&priv->lock, flags);
-}
-
-static int iwl4965_apm_reset(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        iwl4965_apm_stop_master(priv);
-
-
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-
-        udelay(10);
-
-        /* FIXME: put here L1A -L0S w/a */
-
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        ret = iwl_poll_direct_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0)
-                goto out;
-
-        udelay(10);
-
-        /* Enable DMA and BSM Clock */
-        iwl_write_prph(priv, APMG_CLK_EN_REG, APMG_CLK_VAL_DMA_CLK_RQT |
-                                              APMG_CLK_VAL_BSM_CLK_RQT);
-
-        udelay(10);
-
-        /* disable L1A */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-
-        clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
-        wake_up_interruptible(&priv->wait_command_queue);
-
-out:
-        return ret;
-}
-
 /* Reset differential Rx gains in NIC to prepare for chain noise calibration.
  * Called after every association, but this runs only once!
  *  ... once chain noise is calibrated the first time, it's good forever.  */
@@ -496,14 +372,15 @@ static void iwl4965_chain_noise_reset(struct iwl_priv *priv)
 static void iwl4965_gain_computation(struct iwl_priv *priv,
                 u32 *average_noise,
                 u16 min_average_noise_antenna_i,
-                u32 min_average_noise)
+                u32 min_average_noise,
+                u8 default_chain)
 {
         int i, ret;
         struct iwl_chain_noise_data *data = &priv->chain_noise_data;
 
         data->delta_gain_code[min_average_noise_antenna_i] = 0;
 
-        for (i = 0; i < NUM_RX_CHAINS; i++) {
+        for (i = default_chain; i < NUM_RX_CHAINS; i++) {
                 s32 delta_g = 0;
 
                 if (!(data->disconn_array[i]) &&
@@ -557,18 +434,6 @@ static void iwl4965_gain_computation(struct iwl_priv *priv,
         data->beacon_count = 0;
 }
 
-static void iwl4965_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
-                        __le32 *tx_flags)
-{
-        if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
-                *tx_flags |= TX_CMD_FLG_RTS_MSK;
-                *tx_flags &= ~TX_CMD_FLG_CTS_MSK;
-        } else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                *tx_flags &= ~TX_CMD_FLG_RTS_MSK;
-                *tx_flags |= TX_CMD_FLG_CTS_MSK;
-        }
-}
-
 static void iwl4965_bg_txpower_work(struct work_struct *work)
 {
         struct iwl_priv *priv = container_of(work, struct iwl_priv,
@@ -663,7 +528,8 @@ static int iwl4965_alive_notify(struct iwl_priv *priv)
                 iwl_write_targ_mem(priv, a, 0);
         for (; a < priv->scd_base_addr + IWL49_SCD_TRANSLATE_TBL_OFFSET; a += 4)
                 iwl_write_targ_mem(priv, a, 0);
-        for (; a < sizeof(u16) * priv->hw_params.max_txq_num; a += 4)
+        for (; a < priv->scd_base_addr +
+               IWL49_SCD_TRANSLATE_TBL_OFFSET_QUEUE(priv->hw_params.max_txq_num); a += 4)
                 iwl_write_targ_mem(priv, a, 0);
 
         /* Tel 4965 where to find Tx byte count tables */
@@ -715,6 +581,13 @@ static int iwl4965_alive_notify(struct iwl_priv *priv)
 
         iwl4965_set_wr_ptrs(priv, IWL_CMD_QUEUE_NUM, 0);
 
+        /* make sure all queue are not stopped */
+        memset(&priv->queue_stopped[0], 0, sizeof(priv->queue_stopped));
+        for (i = 0; i < 4; i++)
+                atomic_set(&priv->queue_stop_count[i], 0);
+
+        /* reset to 0 to enable all the queue first */
+        priv->txq_ctx_active_msk = 0;
         /* Map each Tx/cmd queue to its corresponding fifo */
         for (i = 0; i < ARRAY_SIZE(default_queue_to_tx_fifo); i++) {
                 int ac = default_queue_to_tx_fifo[i];
@@ -748,6 +621,10 @@ static struct iwl_sensitivity_ranges iwl4965_sensitivity = {
 
         .nrg_th_cck = 100,
         .nrg_th_ofdm = 100,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
 };
 
 static void iwl4965_set_ct_threshold(struct iwl_priv *priv)
@@ -764,19 +641,16 @@ static void iwl4965_set_ct_threshold(struct iwl_priv *priv)
  */
 static int iwl4965_hw_set_hw_params(struct iwl_priv *priv)
 {
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWL49_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
 
-        if ((priv->cfg->mod_params->num_of_queues > IWL49_NUM_QUEUES) ||
-            (priv->cfg->mod_params->num_of_queues < IWL_MIN_NUM_QUEUES)) {
-                IWL_ERR(priv,
-                        "invalid queues_num, should be between %d and %d\n",
-                        IWL_MIN_NUM_QUEUES, IWL49_NUM_QUEUES);
-                return -EINVAL;
-        }
-
-        priv->hw_params.max_txq_num = priv->cfg->mod_params->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
         priv->hw_params.dma_chnl_num = FH49_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
-                        IWL49_NUM_QUEUES * sizeof(struct iwl4965_scd_bc_tbl);
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwl4965_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL4965_STATION_COUNT;
         priv->hw_params.bcast_sta_id = IWL4965_BROADCAST_ID;
@@ -787,10 +661,10 @@ static int iwl4965_hw_set_hw_params(struct iwl_priv *priv)
 
         priv->hw_params.rx_wrt_ptr_reg = FH_RSCSR_CHNL0_WPTR;
 
-        priv->hw_params.tx_chains_num = 2;
-        priv->hw_params.rx_chains_num = 2;
-        priv->hw_params.valid_tx_ant = ANT_A | ANT_B;
-        priv->hw_params.valid_rx_ant = ANT_A | ANT_B;
+        priv->hw_params.tx_chains_num = num_of_ant(priv->cfg->valid_tx_ant);
+        priv->hw_params.rx_chains_num = num_of_ant(priv->cfg->valid_rx_ant);
+        priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
+        priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
         if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
                 priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
 
@@ -1337,7 +1211,7 @@ static int iwl4965_fill_txpower_tbl(struct iwl_priv *priv, u8 band, u16 channel,
         iwl4965_interpolate_chan(priv, channel, &ch_eeprom_info);
 
         /* calculate tx gain adjustment based on power supply voltage */
-        voltage = priv->calib_info->voltage;
+        voltage = le16_to_cpu(priv->calib_info->voltage);
         init_voltage = (s32)le32_to_cpu(priv->card_alive_init.voltage);
         voltage_compensation =
             iwl4965_get_voltage_compensation(voltage, init_voltage);
@@ -1567,14 +1441,13 @@ static int iwl4965_send_rxon_assoc(struct iwl_priv *priv)
         return ret;
 }
 
-#ifdef IEEE80211_CONF_CHANNEL_SWITCH
 static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
 {
         int rc;
         u8 band = 0;
         bool is_ht40 = false;
         u8 ctrl_chan_high = 0;
-        struct iwl4965_channel_switch_cmd cmd = { 0 };
+        struct iwl4965_channel_switch_cmd cmd;
         const struct iwl_channel_info *ch_info;
 
         band = priv->band == IEEE80211_BAND_2GHZ;
@@ -1584,19 +1457,22 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
         is_ht40 = is_ht40_channel(priv->staging_rxon.flags);
 
         if (is_ht40 &&
-            (priv->active_rxon.flags & RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK))
+            (priv->staging_rxon.flags & RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK))
                 ctrl_chan_high = 1;
 
         cmd.band = band;
         cmd.expect_beacon = 0;
         cmd.channel = cpu_to_le16(channel);
-        cmd.rxon_flags = priv->active_rxon.flags;
-        cmd.rxon_filter_flags = priv->active_rxon.filter_flags;
+        cmd.rxon_flags = priv->staging_rxon.flags;
+        cmd.rxon_filter_flags = priv->staging_rxon.filter_flags;
         cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
         if (ch_info)
                 cmd.expect_beacon = is_channel_radar(ch_info);
-        else
-                cmd.expect_beacon = 1;
+        else {
+                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+                        priv->active_rxon.channel, channel);
+                return -EFAULT;
+        }
 
         rc = iwl4965_fill_txpower_tbl(priv, band, channel, is_ht40,
                                       ctrl_chan_high, &cmd.tx_power);
@@ -1605,10 +1481,11 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
                 return rc;
         }
 
-        rc = iwl_send_cmd_pdu(priv, REPLY_CHANNEL_SWITCH, sizeof(cmd), &cmd);
-        return rc;
+        priv->switch_rxon.channel = cpu_to_le16(channel);
+        priv->switch_rxon.switch_in_progress = true;
+
+        return iwl_send_cmd_pdu(priv, REPLY_CHANNEL_SWITCH, sizeof(cmd), &cmd);
 }
-#endif
 
 /**
  * iwl4965_txq_update_byte_cnt_tbl - Set up entry in Tx byte-count array
@@ -1805,11 +1682,13 @@ static int iwl4965_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                                    u16 ssn_idx, u8 tx_fifo)
 {
         if ((IWL49_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES <= txq_id)) {
+            (IWL49_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
                 IWL_WARN(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWL49_FIRST_AMPDU_QUEUE,
-                        IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES - 1);
+                        IWL49_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
                 return -EINVAL;
         }
 
@@ -1870,11 +1749,13 @@ static int iwl4965_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         u16 ra_tid;
 
         if ((IWL49_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES <= txq_id)) {
+            (IWL49_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
                 IWL_WARN(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWL49_FIRST_AMPDU_QUEUE,
-                        IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES - 1);
+                        IWL49_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
                 return -EINVAL;
         }
 
@@ -1944,8 +1825,9 @@ static u16 iwl4965_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd, u8 *data)
         addsta->add_immediate_ba_tid = cmd->add_immediate_ba_tid;
         addsta->remove_immediate_ba_tid = cmd->remove_immediate_ba_tid;
         addsta->add_immediate_ba_ssn = cmd->add_immediate_ba_ssn;
+        addsta->sleep_tx_count = cmd->sleep_tx_count;
         addsta->reserved1 = cpu_to_le16(0);
-        addsta->reserved2 = cpu_to_le32(0);
+        addsta->reserved2 = cpu_to_le16(0);
 
         return (u16)sizeof(struct iwl4965_addsta_cmd);
 }
@@ -1991,8 +1873,7 @@ static int iwl4965_tx_status_reply_tx(struct iwl_priv *priv,
                 info = IEEE80211_SKB_CB(priv->txq[txq_id].txb[idx].skb[0]);
                 info->status.rates[0].count = tx_resp->failure_frame + 1;
                 info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-                info->flags |= iwl_is_tx_success(status) ?
-                        IEEE80211_TX_STAT_ACK : 0;
+                info->flags |= iwl_tx_status_to_mac80211(status);
                 iwl_hwrate_to_tx_control(priv, rate_n_flags, info);
                 /* FIXME: code repetition end */
 
@@ -2078,7 +1959,7 @@ static int iwl4965_tx_status_reply_tx(struct iwl_priv *priv,
 static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
         int txq_id = SEQ_TO_QUEUE(sequence);
         int index = SEQ_TO_INDEX(sequence);
@@ -2087,7 +1968,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
         struct ieee80211_tx_info *info;
         struct iwl4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
         u32  status = le32_to_cpu(tx_resp->u.status);
-        int tid = MAX_TID_COUNT;
+        int uninitialized_var(tid);
         int sta_id;
         int freed;
         u8 *qc = NULL;
@@ -2134,7 +2015,9 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                         IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn "
                                            "%d index %d\n", scd_ssn , index);
                         freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                        if (qc)
+                                iwl_free_tfds_in_queue(priv, sta_id,
+                                                       tid, freed);
 
                         if (priv->mac80211_registered &&
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
@@ -2147,8 +2030,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                 }
         } else {
                 info->status.rates[0].count = tx_resp->failure_frame + 1;
-                info->flags |= iwl_is_tx_success(status) ?
-                                        IEEE80211_TX_STAT_ACK : 0;
+                info->flags |= iwl_tx_status_to_mac80211(status);
                 iwl_hwrate_to_tx_control(priv,
                                         le32_to_cpu(tx_resp->rate_n_flags),
                                         info);
@@ -2162,13 +2044,14 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
 
                 freed = iwl_tx_queue_reclaim(priv, txq_id, index);
                 if (qc && likely(sta_id != IWL_INVALID_STATION))
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+                else if (sta_id == IWL_INVALID_STATION)
+                        IWL_DEBUG_TX_REPLY(priv, "Station not known\n");
 
                 if (priv->mac80211_registered &&
                     (iwl_queue_space(&txq->q) > txq->q.low_mark))
                         iwl_wake_queue(priv, txq_id);
         }
-
         if (qc && likely(sta_id != IWL_INVALID_STATION))
                 iwl_txq_check_empty(priv, sta_id, tid, txq_id);
 
@@ -2279,7 +2162,7 @@ static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
         .build_addsta_hcmd = iwl4965_build_addsta_hcmd,
         .chain_noise_reset = iwl4965_chain_noise_reset,
         .gain_computation = iwl4965_gain_computation,
-        .rts_tx_cmd_flag = iwl4965_rts_tx_cmd_flag,
+        .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
         .calc_rssi = iwl4965_calc_rssi,
 };
 
@@ -2301,10 +2184,10 @@ static struct iwl_lib_ops iwl4965_lib = {
         .load_ucode = iwl4965_load_bsm,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
+        .set_channel_switch = iwl4965_hw_channel_switch,
         .apm_ops = {
-                .init = iwl4965_apm_init,
-                .reset = iwl4965_apm_reset,
-                .stop = iwl4965_apm_stop,
+                .init = iwl_apm_init,
+                .stop = iwl_apm_stop,
                 .config = iwl4965_nic_config,
                 .set_pwr_src = iwl_set_pwr_src,
         },
@@ -2333,13 +2216,15 @@ static struct iwl_lib_ops iwl4965_lib = {
                 .temperature = iwl4965_temperature_calib,
                 .set_ct_kill = iwl4965_set_ct_threshold,
         },
+        .add_bcast_station = iwl_add_bcast_station,
 };
 
-static struct iwl_ops iwl4965_ops = {
+static const struct iwl_ops iwl4965_ops = {
         .ucode = &iwl4965_ucode,
         .lib = &iwl4965_lib,
         .hcmd = &iwl4965_hcmd,
         .utils = &iwl4965_hcmd_utils,
+        .led = &iwlagn_led_ops,
 };
 
 struct iwl_cfg iwl4965_agn_cfg = {
@@ -2352,30 +2237,41 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .eeprom_ver = EEPROM_4965_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_4965_TX_POWER_VERSION,
         .ops = &iwl4965_ops,
+        .num_of_queues = IWL49_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL49_NUM_AMPDU_QUEUES,
         .mod_params = &iwl4965_mod_params,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_ABC,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = true,
         .use_isr_legacy = true,
         .ht_greenfield_support = false,
         .broken_powersave = true,
+        .led_compensation = 61,
+        .chain_noise_num_beacons = IWL4965_CAL_NUM_BEACONS,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
 };
 
 /* Module firmware */
 MODULE_FIRMWARE(IWL4965_MODULE_FIRMWARE(IWL4965_UCODE_API_MAX));
 
-module_param_named(antenna, iwl4965_mod_params.antenna, int, 0444);
+module_param_named(antenna, iwl4965_mod_params.antenna, int, S_IRUGO);
 MODULE_PARM_DESC(antenna, "select antenna (1=Main, 2=Aux, default 0 [both])");
-module_param_named(swcrypto, iwl4965_mod_params.sw_crypto, int, 0444);
+module_param_named(swcrypto, iwl4965_mod_params.sw_crypto, int, S_IRUGO);
 MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])");
 module_param_named(
-        disable_hw_scan, iwl4965_mod_params.disable_hw_scan, int, 0444);
+        disable_hw_scan, iwl4965_mod_params.disable_hw_scan, int, S_IRUGO);
 MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 0)");
 
-module_param_named(queues_num, iwl4965_mod_params.num_of_queues, int, 0444);
+module_param_named(queues_num, iwl4965_mod_params.num_of_queues, int, S_IRUGO);
 MODULE_PARM_DESC(queues_num, "number of hw queues.");
 /* 11n */
-module_param_named(11n_disable, iwl4965_mod_params.disable_11n, int, 0444);
+module_param_named(11n_disable, iwl4965_mod_params.disable_11n, int, S_IRUGO);
 MODULE_PARM_DESC(11n_disable, "disable 11n functionality");
-module_param_named(amsdu_size_8K, iwl4965_mod_params.amsdu_size_8K, int, 0444);
+module_param_named(amsdu_size_8K, iwl4965_mod_params.amsdu_size_8K,
+                   int, S_IRUGO);
 MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size");
 
-module_param_named(fw_restart4965, iwl4965_mod_params.restart_fw, int, 0444);
+module_param_named(fw_restart4965, iwl4965_mod_params.restart_fw, int, S_IRUGO);
 MODULE_PARM_DESC(fw_restart4965, "restart firmware in case of error");
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
index 4ef6804a455a..714e032f6217 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -92,11 +92,15 @@
 
 static inline s32 iwl_temp_calib_to_offset(struct iwl_priv *priv)
 {
-        u16 *temp_calib = (u16 *)iwl_eeprom_query_addr(priv,
-                                                       EEPROM_5000_TEMPERATURE);
-        /* offset =  temperature -  voltage / coef */
-        s32 offset = (s32)(temp_calib[0] - temp_calib[1] / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
-        return offset;
+        u16 temperature, voltage;
+        __le16 *temp_calib =
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_TEMPERATURE);
+
+        temperature = le16_to_cpu(temp_calib[0]);
+        voltage = le16_to_cpu(temp_calib[1]);
+
+        /* offset = temp - volt / coeff */
+        return (s32)(temperature - voltage / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
 }
 
 /* Fixed (non-configurable) rx data from phy */
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 6e6f516ba404..e476acb53aa7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -43,6 +43,7 @@
 #include "iwl-io.h"
 #include "iwl-sta.h"
 #include "iwl-helpers.h"
+#include "iwl-agn-led.h"
 #include "iwl-5000-hw.h"
 #include "iwl-6000-hw.h"
 
@@ -72,157 +73,18 @@ static const u16 iwl5000_default_queue_to_tx_fifo[] = {
         IWL_TX_FIFO_HCCA_2
 };
 
-/* FIXME: same implementation as 4965 */
-static int iwl5000_apm_stop_master(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* set stop master bit */
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_STOP_MASTER);
-
-        iwl_poll_direct_bit(priv, CSR_RESET,
-                                  CSR_RESET_REG_FLAG_MASTER_DISABLED, 100);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-        IWL_DEBUG_INFO(priv, "stop master\n");
-
-        return 0;
-}
-
-
-int iwl5000_apm_init(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                    CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
-
-        /* disable L0s without affecting L1 :don't wait for ICH L0s bug W/A) */
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                    CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
-
-        /* Set FH wait threshold to maximum (HW error during stress W/A) */
-        iwl_set_bit(priv, CSR_DBG_HPET_MEM_REG, CSR_DBG_HPET_MEM_REG_VAL);
-
-        /* enable HAP INTA to move device L1a -> L0s */
-        iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
-                    CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A);
-
-        if (priv->cfg->need_pll_cfg)
-                iwl_set_bit(priv, CSR_ANA_PLL_CFG, CSR50_ANA_PLL_CFG_VAL);
-
-        /* set "initialization complete" bit to move adapter
-         * D0U* --> D0A* state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        /* wait for clock stabilization */
-        ret = iwl_poll_direct_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                return ret;
-        }
-
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_EN_REG, APMG_CLK_VAL_DMA_CLK_RQT);
-
-        udelay(20);
-
-        /* disable L1-Active */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-
-        return ret;
-}
-
-/* FIXME: this is identical to 4965 */
-void iwl5000_apm_stop(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        iwl5000_apm_stop_master(priv);
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-
-        udelay(10);
-
-        /* clear "init complete"  move adapter D0A* --> D0U state */
-        iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-}
-
-
-int iwl5000_apm_reset(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        iwl5000_apm_stop_master(priv);
-
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-
-        udelay(10);
-
-
-        /* FIXME: put here L1A -L0S w/a */
-
-        if (priv->cfg->need_pll_cfg)
-                iwl_set_bit(priv, CSR_ANA_PLL_CFG, CSR50_ANA_PLL_CFG_VAL);
-
-        /* set "initialization complete" bit to move adapter
-         * D0U* --> D0A* state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        /* wait for clock stabilization */
-        ret = iwl_poll_direct_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                goto out;
-        }
-
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_EN_REG, APMG_CLK_VAL_DMA_CLK_RQT);
-
-        udelay(20);
-
-        /* disable L1-Active */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-out:
-
-        return ret;
-}
-
-
-/* NIC configuration for 5000 series and up */
+/* NIC configuration for 5000 series */
 void iwl5000_nic_config(struct iwl_priv *priv)
 {
         unsigned long flags;
         u16 radio_cfg;
-        u16 lctl;
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        lctl = iwl_pcie_link_ctl(priv);
-
-        /* HW bug W/A */
-        /* L1-ASPM is enabled by BIOS */
-        if ((lctl & PCI_CFG_LINK_CTRL_VAL_L1_EN) == PCI_CFG_LINK_CTRL_VAL_L1_EN)
-                /* L1-APSM enabled: disable L0S  */
-                iwl_set_bit(priv, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-        else
-                /* L1-ASPM disabled: enable L0S */
-                iwl_clear_bit(priv, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-
         radio_cfg = iwl_eeprom_query16(priv, EEPROM_RADIO_CONFIG);
 
         /* write radio config values to register */
-        if (EEPROM_RF_CFG_TYPE_MSK(radio_cfg) < EEPROM_5000_RF_CFG_TYPE_MAX)
+        if (EEPROM_RF_CFG_TYPE_MSK(radio_cfg) < EEPROM_RF_CONFIG_TYPE_MAX)
                 iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
                             EEPROM_RF_CFG_TYPE_MSK(radio_cfg) |
                             EEPROM_RF_CFG_STEP_MSK(radio_cfg) |
@@ -302,26 +164,39 @@ u16 iwl5000_eeprom_calib_version(struct iwl_priv *priv)
 static void iwl5000_gain_computation(struct iwl_priv *priv,
                 u32 average_noise[NUM_RX_CHAINS],
                 u16 min_average_noise_antenna_i,
-                u32 min_average_noise)
+                u32 min_average_noise,
+                u8 default_chain)
 {
         int i;
         s32 delta_g;
         struct iwl_chain_noise_data *data = &priv->chain_noise_data;
 
-        /* Find Gain Code for the antennas B and C */
-        for (i = 1; i < NUM_RX_CHAINS; i++) {
+        /*
+         * Find Gain Code for the chains based on "default chain"
+         */
+        for (i = default_chain + 1; i < NUM_RX_CHAINS; i++) {
                 if ((data->disconn_array[i])) {
                         data->delta_gain_code[i] = 0;
                         continue;
                 }
-                delta_g = (1000 * ((s32)average_noise[0] -
+
+                delta_g = (priv->cfg->chain_noise_scale *
+                        ((s32)average_noise[default_chain] -
                         (s32)average_noise[i])) / 1500;
+
                 /* bound gain by 2 bits value max, 3rd bit is sign */
                 data->delta_gain_code[i] =
                         min(abs(delta_g), (long) CHAIN_NOISE_MAX_DELTA_GAIN_CODE);
 
                 if (delta_g < 0)
-                        /* set negative sign */
+                        /*
+                         * set negative sign ...
+                         * note to Intel developers:  This is uCode API format,
+                         *   not the format of any internal device registers.
+                         *   Do not change this format for e.g. 6050 or similar
+                         *   devices.  Change format only if more resolution
+                         *   (i.e. more than 2 bits magnitude) is needed.
+                         */
                         data->delta_gain_code[i] |= (1 << 2);
         }
 
@@ -398,8 +273,8 @@ static struct iwl_sensitivity_ranges iwl5000_sensitivity = {
 
         .auto_corr_max_ofdm = 120,
         .auto_corr_max_ofdm_mrc = 210,
-        .auto_corr_max_ofdm_x1 = 155,
-        .auto_corr_max_ofdm_mrc_x1 = 290,
+        .auto_corr_max_ofdm_x1 = 120,
+        .auto_corr_max_ofdm_mrc_x1 = 240,
 
         .auto_corr_min_cck = 125,
         .auto_corr_max_cck = 200,
@@ -407,6 +282,10 @@ static struct iwl_sensitivity_ranges iwl5000_sensitivity = {
         .auto_corr_max_cck_mrc = 400,
         .nrg_th_cck = 95,
         .nrg_th_ofdm = 95,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
 };
 
 static struct iwl_sensitivity_ranges iwl5150_sensitivity = {
@@ -429,6 +308,10 @@ static struct iwl_sensitivity_ranges iwl5150_sensitivity = {
         .auto_corr_max_cck_mrc = 400,
         .nrg_th_cck = 95,
         .nrg_th_ofdm = 95,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
 };
 
 const u8 *iwl5000_eeprom_query_addr(const struct iwl_priv *priv,
@@ -460,14 +343,15 @@ static void iwl5000_set_ct_threshold(struct iwl_priv *priv)
 static int iwl5000_set_Xtal_calib(struct iwl_priv *priv)
 {
         struct iwl_calib_xtal_freq_cmd cmd;
-        u16 *xtal_calib = (u16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL);
+        __le16 *xtal_calib =
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL);
 
         cmd.hdr.op_code = IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD;
         cmd.hdr.first_group = 0;
         cmd.hdr.groups_num = 1;
         cmd.hdr.data_valid = 1;
-        cmd.cap_pin1 = (u8)xtal_calib[0];
-        cmd.cap_pin2 = (u8)xtal_calib[1];
+        cmd.cap_pin1 = le16_to_cpu(xtal_calib[0]);
+        cmd.cap_pin2 = le16_to_cpu(xtal_calib[1]);
         return iwl_calib_set(&priv->calib_results[IWL_CALIB_XTAL],
                              (u8 *)&cmd, sizeof(cmd));
 }
@@ -493,7 +377,7 @@ static int iwl5000_send_calib_cfg(struct iwl_priv *priv)
 static void iwl5000_rx_calib_result(struct iwl_priv *priv,
                              struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_calib_hdr *hdr = (struct iwl_calib_hdr *)pkt->u.raw;
         int len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
         int index;
@@ -538,12 +422,14 @@ static void iwl5000_rx_calib_complete(struct iwl_priv *priv,
 /*
  * ucode
  */
-static int iwl5000_load_section(struct iwl_priv *priv,
-                                struct fw_desc *image,
-                                u32 dst_addr)
+static int iwl5000_load_section(struct iwl_priv *priv, const char *name,
+                                struct fw_desc *image, u32 dst_addr)
 {
         dma_addr_t phy_addr = image->p_addr;
         u32 byte_cnt = image->len;
+        int ret;
+
+        priv->ucode_write_complete = 0;
 
         iwl_write_direct32(priv,
                 FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
@@ -573,57 +459,36 @@ static int iwl5000_load_section(struct iwl_priv *priv,
                 FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE    |
                 FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
 
-        return 0;
-}
-
-static int iwl5000_load_given_ucode(struct iwl_priv *priv,
-                struct fw_desc *inst_image,
-                struct fw_desc *data_image)
-{
-        int ret = 0;
-
-        ret = iwl5000_load_section(priv, inst_image,
-                                   IWL50_RTC_INST_LOWER_BOUND);
-        if (ret)
-                return ret;
-
-        IWL_DEBUG_INFO(priv, "INST uCode section being loaded...\n");
+        IWL_DEBUG_INFO(priv, "%s uCode section being loaded...\n", name);
         ret = wait_event_interruptible_timeout(priv->wait_command_queue,
                                         priv->ucode_write_complete, 5 * HZ);
         if (ret == -ERESTARTSYS) {
-                IWL_ERR(priv, "Could not load the INST uCode section due "
-                        "to interrupt\n");
+                IWL_ERR(priv, "Could not load the %s uCode section due "
+                        "to interrupt\n", name);
                 return ret;
         }
         if (!ret) {
-                IWL_ERR(priv, "Could not load the INST uCode section\n");
+                IWL_ERR(priv, "Could not load the %s uCode section\n",
+                        name);
                 return -ETIMEDOUT;
         }
 
-        priv->ucode_write_complete = 0;
-
-        ret = iwl5000_load_section(
-                priv, data_image, IWL50_RTC_DATA_LOWER_BOUND);
-        if (ret)
-                return ret;
+        return 0;
+}
 
-        IWL_DEBUG_INFO(priv, "DATA uCode section being loaded...\n");
+static int iwl5000_load_given_ucode(struct iwl_priv *priv,
+                struct fw_desc *inst_image,
+                struct fw_desc *data_image)
+{
+        int ret = 0;
 
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
-                                priv->ucode_write_complete, 5 * HZ);
-        if (ret == -ERESTARTSYS) {
-                IWL_ERR(priv, "Could not load the INST uCode section due "
-                        "to interrupt\n");
+        ret = iwl5000_load_section(priv, "INST", inst_image,
+                                   IWL50_RTC_INST_LOWER_BOUND);
+        if (ret)
                 return ret;
-        } else if (!ret) {
-                IWL_ERR(priv, "Could not load the DATA uCode section\n");
-                return -ETIMEDOUT;
-        } else
-                ret = 0;
-
-        priv->ucode_write_complete = 0;
 
-        return ret;
+        return iwl5000_load_section(priv, "DATA", data_image,
+                                    IWL50_RTC_DATA_LOWER_BOUND);
 }
 
 int iwl5000_load_ucode(struct iwl_priv *priv)
@@ -719,16 +584,6 @@ static void iwl5000_tx_queue_set_status(struct iwl_priv *priv,
                        scd_retry ? "BA" : "AC", txq_id, tx_fifo_id);
 }
 
-static int iwl5000_send_wimax_coex(struct iwl_priv *priv)
-{
-        struct iwl_wimax_coex_cmd coex_cmd;
-
-        memset(&coex_cmd, 0, sizeof(coex_cmd));
-
-        return iwl_send_cmd_pdu(priv, COEX_PRIORITY_TABLE_CMD,
-                                sizeof(coex_cmd), &coex_cmd);
-}
-
 int iwl5000_alive_notify(struct iwl_priv *priv)
 {
         u32 a;
@@ -746,7 +601,8 @@ int iwl5000_alive_notify(struct iwl_priv *priv)
         for (; a < priv->scd_base_addr + IWL50_SCD_TRANSLATE_TBL_OFFSET;
                 a += 4)
                 iwl_write_targ_mem(priv, a, 0);
-        for (; a < sizeof(u16) * priv->hw_params.max_txq_num; a += 4)
+        for (; a < priv->scd_base_addr +
+               IWL50_SCD_TRANSLATE_TBL_OFFSET_QUEUE(priv->hw_params.max_txq_num); a += 4)
                 iwl_write_targ_mem(priv, a, 0);
 
         iwl_write_prph(priv, IWL50_SCD_DRAM_BASE_ADDR,
@@ -792,15 +648,26 @@ int iwl5000_alive_notify(struct iwl_priv *priv)
 
         iwl5000_set_wr_ptrs(priv, IWL_CMD_QUEUE_NUM, 0);
 
+        /* make sure all queue are not stopped */
+        memset(&priv->queue_stopped[0], 0, sizeof(priv->queue_stopped));
+        for (i = 0; i < 4; i++)
+                atomic_set(&priv->queue_stop_count[i], 0);
+
+        /* reset to 0 to enable all the queue first */
+        priv->txq_ctx_active_msk = 0;
         /* map qos queues to fifos one-to-one */
         for (i = 0; i < ARRAY_SIZE(iwl5000_default_queue_to_tx_fifo); i++) {
                 int ac = iwl5000_default_queue_to_tx_fifo[i];
                 iwl_txq_ctx_activate(priv, i);
                 iwl5000_tx_queue_set_status(priv, &priv->txq[i], ac, 0);
         }
-        /* TODO - need to initialize those FIFOs inside the loop above,
-         * not only mark them as active */
-        iwl_txq_ctx_activate(priv, 4);
+
+        /*
+         * TODO - need to initialize these queues and map them to FIFOs
+         * in the loop above, not only mark them as active. We do this
+         * because we want the first aggregation queue to be queue #10,
+         * but do not use 8 or 9 otherwise yet.
+         */
         iwl_txq_ctx_activate(priv, 7);
         iwl_txq_ctx_activate(priv, 8);
         iwl_txq_ctx_activate(priv, 9);
@@ -808,7 +675,7 @@ int iwl5000_alive_notify(struct iwl_priv *priv)
         spin_unlock_irqrestore(&priv->lock, flags);
 
 
-        iwl5000_send_wimax_coex(priv);
+        iwl_send_wimax_coex(priv);
 
         iwl5000_set_Xtal_calib(priv);
         iwl_send_calib_results(priv);
@@ -818,32 +685,22 @@ int iwl5000_alive_notify(struct iwl_priv *priv)
 
 int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
 {
-        if ((priv->cfg->mod_params->num_of_queues > IWL50_NUM_QUEUES) ||
-            (priv->cfg->mod_params->num_of_queues < IWL_MIN_NUM_QUEUES)) {
-                IWL_ERR(priv,
-                        "invalid queues_num, should be between %d and %d\n",
-                        IWL_MIN_NUM_QUEUES, IWL50_NUM_QUEUES);
-                return -EINVAL;
-        }
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
 
-        priv->hw_params.max_txq_num = priv->cfg->mod_params->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
-                        IWL50_NUM_QUEUES * sizeof(struct iwl5000_scd_bc_tbl);
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwl5000_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL5000_STATION_COUNT;
         priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
 
-        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
-        case CSR_HW_REV_TYPE_6x00:
-        case CSR_HW_REV_TYPE_6x50:
-                priv->hw_params.max_data_size = IWL60_RTC_DATA_SIZE;
-                priv->hw_params.max_inst_size = IWL60_RTC_INST_SIZE;
-                break;
-        default:
-                priv->hw_params.max_data_size = IWL50_RTC_DATA_SIZE;
-                priv->hw_params.max_inst_size = IWL50_RTC_INST_SIZE;
-        }
+        priv->hw_params.max_data_size = IWL50_RTC_DATA_SIZE;
+        priv->hw_params.max_inst_size = IWL50_RTC_INST_SIZE;
 
         priv->hw_params.max_bsm_size = 0;
         priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
@@ -922,7 +779,7 @@ void iwl5000_txq_update_byte_cnt_tbl(struct iwl_priv *priv,
 
         scd_bc_tbl[txq_id].tfd_offset[write_ptr] = bc_ent;
 
-        if (txq->q.write_ptr < TFD_QUEUE_SIZE_BC_DUP)
+        if (write_ptr < TFD_QUEUE_SIZE_BC_DUP)
                 scd_bc_tbl[txq_id].
                         tfd_offset[TFD_QUEUE_SIZE_MAX + write_ptr] = bc_ent;
 }
@@ -941,12 +798,12 @@ void iwl5000_txq_inval_byte_cnt_tbl(struct iwl_priv *priv,
         if (txq_id != IWL_CMD_QUEUE_NUM)
                 sta_id = txq->cmd[read_ptr]->cmd.tx.sta_id;
 
-        bc_ent =  cpu_to_le16(1 | (sta_id << 12));
+        bc_ent = cpu_to_le16(1 | (sta_id << 12));
         scd_bc_tbl[txq_id].tfd_offset[read_ptr] = bc_ent;
 
-        if (txq->q.write_ptr < TFD_QUEUE_SIZE_BC_DUP)
+        if (read_ptr < TFD_QUEUE_SIZE_BC_DUP)
                 scd_bc_tbl[txq_id].
-                        tfd_offset[TFD_QUEUE_SIZE_MAX + read_ptr] =  bc_ent;
+                        tfd_offset[TFD_QUEUE_SIZE_MAX + read_ptr] = bc_ent;
 }
 
 static int iwl5000_tx_queue_set_q2ratid(struct iwl_priv *priv, u16 ra_tid,
@@ -989,11 +846,13 @@ int iwl5000_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         u16 ra_tid;
 
         if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES <= txq_id)) {
+            (IWL50_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
                 IWL_WARN(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWL50_FIRST_AMPDU_QUEUE,
-                        IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES - 1);
+                        IWL50_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
                 return -EINVAL;
         }
 
@@ -1047,11 +906,13 @@ int iwl5000_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                                    u16 ssn_idx, u8 tx_fifo)
 {
         if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES <= txq_id)) {
+            (IWL50_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
                 IWL_ERR(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWL50_FIRST_AMPDU_QUEUE,
-                        IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES - 1);
+                        IWL50_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
                 return -EINVAL;
         }
 
@@ -1132,8 +993,7 @@ static int iwl5000_tx_status_reply_tx(struct iwl_priv *priv,
                 info = IEEE80211_SKB_CB(priv->txq[txq_id].txb[idx].skb[0]);
                 info->status.rates[0].count = tx_resp->failure_frame + 1;
                 info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-                info->flags |= iwl_is_tx_success(status) ?
-                                        IEEE80211_TX_STAT_ACK : 0;
+                info->flags |= iwl_tx_status_to_mac80211(status);
                 iwl_hwrate_to_tx_control(priv, rate_n_flags, info);
 
                 /* FIXME: code repetition end */
@@ -1218,7 +1078,7 @@ static int iwl5000_tx_status_reply_tx(struct iwl_priv *priv,
 static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
         int txq_id = SEQ_TO_QUEUE(sequence);
         int index = SEQ_TO_INDEX(sequence);
@@ -1263,7 +1123,7 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                                         scd_ssn , index, txq_id, txq->swq_id);
 
                         freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                         if (priv->mac80211_registered &&
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
@@ -1278,8 +1138,7 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                 BUG_ON(txq_id != txq->swq_id);
 
                 info->status.rates[0].count = tx_resp->failure_frame + 1;
-                info->flags |= iwl_is_tx_success(status) ?
-                                        IEEE80211_TX_STAT_ACK : 0;
+                info->flags |= iwl_tx_status_to_mac80211(status);
                 iwl_hwrate_to_tx_control(priv,
                                         le32_to_cpu(tx_resp->rate_n_flags),
                                         info);
@@ -1292,16 +1151,14 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                                    tx_resp->failure_frame);
 
                 freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                if (ieee80211_is_data_qos(tx_resp->frame_ctrl))
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                 if (priv->mac80211_registered &&
                     (iwl_queue_space(&txq->q) > txq->q.low_mark))
                         iwl_wake_queue(priv, txq_id);
         }
 
-        if (ieee80211_is_data_qos(tx_resp->frame_ctrl))
-                iwl_txq_check_empty(priv, sta_id, tid, txq_id);
+        iwl_txq_check_empty(priv, sta_id, tid, txq_id);
 
         if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
                 IWL_ERR(priv, "TODO:  Implement Tx ABORT REQUIRED!!!\n");
@@ -1389,6 +1246,22 @@ int  iwl5000_send_tx_power(struct iwl_priv *priv)
 
         /* half dBm need to multiply */
         tx_power_cmd.global_lmt = (s8)(2 * priv->tx_power_user_lmt);
+
+        if (priv->tx_power_lmt_in_half_dbm &&
+            priv->tx_power_lmt_in_half_dbm < tx_power_cmd.global_lmt) {
+                /*
+                 * For the newer devices which using enhanced/extend tx power
+                 * table in EEPROM, the format is in half dBm. driver need to
+                 * convert to dBm format before report to mac80211.
+                 * By doing so, there is a possibility of 1/2 dBm resolution
+                 * lost. driver will perform "round-up" operation before
+                 * reporting, but it will cause 1/2 dBm tx power over the
+                 * regulatory limit. Perform the checking here, if the
+                 * "tx_power_user_lmt" is higher than EEPROM value (in
+                 * half-dBm format), lower the tx power based on EEPROM
+                 */
+                tx_power_cmd.global_lmt = priv->tx_power_lmt_in_half_dbm;
+        }
         tx_power_cmd.flags = IWL50_TX_POWER_NO_CLOSED;
         tx_power_cmd.srv_chan_lmt = IWL50_TX_POWER_AUTO;
 
@@ -1459,6 +1332,24 @@ int iwl5000_calc_rssi(struct iwl_priv *priv,
         return max_rssi - agc - IWL49_RSSI_OFFSET;
 }
 
+static int iwl5000_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant)
+{
+        struct iwl_tx_ant_config_cmd tx_ant_cmd = {
+          .valid = cpu_to_le32(valid_tx_ant),
+        };
+
+        if (IWL_UCODE_API(priv->ucode_ver) > 1) {
+                IWL_DEBUG_HC(priv, "select valid tx ant: %u\n", valid_tx_ant);
+                return iwl_send_cmd_pdu(priv, TX_ANT_CONFIGURATION_CMD,
+                                        sizeof(struct iwl_tx_ant_config_cmd),
+                                        &tx_ant_cmd);
+        } else {
+                IWL_DEBUG_HC(priv, "TX_ANT_CONFIGURATION_CMD not supported\n");
+                return -EOPNOTSUPP;
+        }
+}
+
+
 #define IWL5000_UCODE_GET(item)                                         \
 static u32 iwl5000_ucode_get_##item(const struct iwl_ucode_header *ucode,\
                                     u32 api_ver)                        \
@@ -1497,10 +1388,43 @@ IWL5000_UCODE_GET(init_size);
 IWL5000_UCODE_GET(init_data_size);
 IWL5000_UCODE_GET(boot_size);
 
+static int iwl5000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
+{
+        struct iwl5000_channel_switch_cmd cmd;
+        const struct iwl_channel_info *ch_info;
+        struct iwl_host_cmd hcmd = {
+                .id = REPLY_CHANNEL_SWITCH,
+                .len = sizeof(cmd),
+                .flags = CMD_SIZE_HUGE,
+                .data = &cmd,
+        };
+
+        IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
+                priv->active_rxon.channel, channel);
+        cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+        cmd.channel = cpu_to_le16(channel);
+        cmd.rxon_flags = priv->staging_rxon.flags;
+        cmd.rxon_filter_flags = priv->staging_rxon.filter_flags;
+        cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+        ch_info = iwl_get_channel_info(priv, priv->band, channel);
+        if (ch_info)
+                cmd.expect_beacon = is_channel_radar(ch_info);
+        else {
+                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+                        priv->active_rxon.channel, channel);
+                return -EFAULT;
+        }
+        priv->switch_rxon.channel = cpu_to_le16(channel);
+        priv->switch_rxon.switch_in_progress = true;
+
+        return iwl_send_cmd_sync(priv, &hcmd);
+}
+
 struct iwl_hcmd_ops iwl5000_hcmd = {
         .rxon_assoc = iwl5000_send_rxon_assoc,
         .commit_rxon = iwl_commit_rxon,
         .set_rxon_chain = iwl_set_rxon_chain,
+        .set_tx_ant = iwl5000_send_tx_ant_config,
 };
 
 struct iwl_hcmd_utils_ops iwl5000_hcmd_utils = {
@@ -1538,15 +1462,17 @@ struct iwl_lib_ops iwl5000_lib = {
         .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
+        .dump_fh = iwl_dump_fh,
         .load_ucode = iwl5000_load_ucode,
         .init_alive_start = iwl5000_init_alive_start,
         .alive_notify = iwl5000_alive_notify,
         .send_tx_power = iwl5000_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
+        .set_channel_switch = iwl5000_hw_channel_switch,
         .apm_ops = {
-                .init = iwl5000_apm_init,
-                .reset = iwl5000_apm_reset,
-                .stop = iwl5000_apm_stop,
+                .init = iwl_apm_init,
+                .stop = iwl_apm_stop,
                 .config = iwl5000_nic_config,
                 .set_pwr_src = iwl_set_pwr_src,
         },
@@ -1573,6 +1499,7 @@ struct iwl_lib_ops iwl5000_lib = {
                 .temperature = iwl5000_temperature,
                 .set_ct_kill = iwl5000_set_ct_threshold,
          },
+        .add_bcast_station = iwl_add_bcast_station,
 };
 
 static struct iwl_lib_ops iwl5150_lib = {
@@ -1590,15 +1517,16 @@ static struct iwl_lib_ops iwl5150_lib = {
         .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
         .load_ucode = iwl5000_load_ucode,
         .init_alive_start = iwl5000_init_alive_start,
         .alive_notify = iwl5000_alive_notify,
         .send_tx_power = iwl5000_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
+        .set_channel_switch = iwl5000_hw_channel_switch,
         .apm_ops = {
-                .init = iwl5000_apm_init,
-                .reset = iwl5000_apm_reset,
-                .stop = iwl5000_apm_stop,
+                .init = iwl_apm_init,
+                .stop = iwl_apm_stop,
                 .config = iwl5000_nic_config,
                 .set_pwr_src = iwl_set_pwr_src,
         },
@@ -1625,25 +1553,26 @@ static struct iwl_lib_ops iwl5150_lib = {
                 .temperature = iwl5150_temperature,
                 .set_ct_kill = iwl5150_set_ct_threshold,
          },
+        .add_bcast_station = iwl_add_bcast_station,
 };
 
-struct iwl_ops iwl5000_ops = {
+static const struct iwl_ops iwl5000_ops = {
         .ucode = &iwl5000_ucode,
         .lib = &iwl5000_lib,
         .hcmd = &iwl5000_hcmd,
         .utils = &iwl5000_hcmd_utils,
+        .led = &iwlagn_led_ops,
 };
 
-static struct iwl_ops iwl5150_ops = {
+static const struct iwl_ops iwl5150_ops = {
         .ucode = &iwl5000_ucode,
         .lib = &iwl5150_lib,
         .hcmd = &iwl5000_hcmd,
         .utils = &iwl5000_hcmd_utils,
+        .led = &iwlagn_led_ops,
 };
 
 struct iwl_mod_params iwl50_mod_params = {
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .amsdu_size_8K = 1,
         .restart_fw = 1,
         /* the rest are 0 by default */
@@ -1660,28 +1589,46 @@ struct iwl_cfg iwl5300_agn_cfg = {
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
         .ht_greenfield_support = true,
+        .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
-struct iwl_cfg iwl5100_bg_cfg = {
-        .name = "5100BG",
+struct iwl_cfg iwl5100_bgn_cfg = {
+        .name = "5100BGN",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
-        .sku = IWL_SKU_G,
+        .sku = IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl5000_ops,
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
         .ht_greenfield_support = true,
+        .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl5100_abg_cfg = {
@@ -1694,11 +1641,18 @@ struct iwl_cfg iwl5100_abg_cfg = {
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
-        .ht_greenfield_support = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
+        .led_compensation = 51,
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl5100_agn_cfg = {
@@ -1711,11 +1665,20 @@ struct iwl_cfg iwl5100_agn_cfg = {
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
         .ht_greenfield_support = true,
+        .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl5350_agn_cfg = {
@@ -1728,11 +1691,20 @@ struct iwl_cfg iwl5350_agn_cfg = {
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
         .ht_greenfield_support = true,
+        .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl5150_agn_cfg = {
@@ -1745,24 +1717,58 @@ struct iwl_cfg iwl5150_agn_cfg = {
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
         .ht_greenfield_support = true,
+        .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+};
+
+struct iwl_cfg iwl5150_abg_cfg = {
+        .name = "5150ABG",
+        .fw_name_pre = IWL5150_FW_PRE,
+        .ucode_api_max = IWL5150_UCODE_API_MAX,
+        .ucode_api_min = IWL5150_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G,
+        .ops = &iwl5150_ops,
+        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
+        .mod_params = &iwl50_mod_params,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
+        .led_compensation = 51,
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_MAX));
 
-module_param_named(swcrypto50, iwl50_mod_params.sw_crypto, bool, 0444);
+module_param_named(swcrypto50, iwl50_mod_params.sw_crypto, bool, S_IRUGO);
 MODULE_PARM_DESC(swcrypto50,
                   "using software crypto engine (default 0 [hardware])\n");
-module_param_named(queues_num50, iwl50_mod_params.num_of_queues, int, 0444);
+module_param_named(queues_num50, iwl50_mod_params.num_of_queues, int, S_IRUGO);
 MODULE_PARM_DESC(queues_num50, "number of hw queues in 50xx series");
-module_param_named(11n_disable50, iwl50_mod_params.disable_11n, int, 0444);
+module_param_named(11n_disable50, iwl50_mod_params.disable_11n, int, S_IRUGO);
 MODULE_PARM_DESC(11n_disable50, "disable 50XX 11n functionality");
-module_param_named(amsdu_size_8K50, iwl50_mod_params.amsdu_size_8K, int, 0444);
+module_param_named(amsdu_size_8K50, iwl50_mod_params.amsdu_size_8K,
+                   int, S_IRUGO);
 MODULE_PARM_DESC(amsdu_size_8K50, "enable 8K amsdu size in 50XX series");
-module_param_named(fw_restart50, iwl50_mod_params.restart_fw, int, 0444);
+module_param_named(fw_restart50, iwl50_mod_params.restart_fw, int, S_IRUGO);
 MODULE_PARM_DESC(fw_restart50, "restart firmware in case of error");
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000-hw.h b/drivers/net/wireless/iwlwifi/iwl-6000-hw.h
index 90185777d98b..ddba39999997 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-6000-hw.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 1473452ba22f..92b3e64fc14d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2008-2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -44,14 +44,16 @@
 #include "iwl-sta.h"
 #include "iwl-helpers.h"
 #include "iwl-5000-hw.h"
+#include "iwl-6000-hw.h"
+#include "iwl-agn-led.h"
 
 /* Highest firmware API version supported */
 #define IWL6000_UCODE_API_MAX 4
 #define IWL6050_UCODE_API_MAX 4
 
 /* Lowest firmware API version supported */
-#define IWL6000_UCODE_API_MIN 1
-#define IWL6050_UCODE_API_MIN 1
+#define IWL6000_UCODE_API_MIN 4
+#define IWL6050_UCODE_API_MIN 4
 
 #define IWL6000_FW_PRE "iwlwifi-6000-"
 #define _IWL6000_MODULE_FIRMWARE(api) IWL6000_FW_PRE #api ".ucode"
@@ -68,26 +70,161 @@ static void iwl6000_set_ct_threshold(struct iwl_priv *priv)
         priv->hw_params.ct_kill_exit_threshold = CT_KILL_EXIT_THRESHOLD;
 }
 
+/* Indicate calibration version to uCode. */
+static void iwl6050_set_calib_version(struct iwl_priv *priv)
+{
+        if (priv->cfg->ops->lib->eeprom_ops.calib_version(priv) >= 6)
+                iwl_set_bit(priv, CSR_GP_DRIVER_REG,
+                                CSR_GP_DRIVER_REG_BIT_CALIB_VERSION6);
+}
+
 /* NIC configuration for 6000 series */
 static void iwl6000_nic_config(struct iwl_priv *priv)
 {
-        iwl5000_nic_config(priv);
+        u16 radio_cfg;
+
+        radio_cfg = iwl_eeprom_query16(priv, EEPROM_RADIO_CONFIG);
+
+        /* write radio config values to register */
+        if (EEPROM_RF_CFG_TYPE_MSK(radio_cfg) <= EEPROM_RF_CONFIG_TYPE_MAX)
+                iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
+                            EEPROM_RF_CFG_TYPE_MSK(radio_cfg) |
+                            EEPROM_RF_CFG_STEP_MSK(radio_cfg) |
+                            EEPROM_RF_CFG_DASH_MSK(radio_cfg));
+
+        /* set CSR_HW_CONFIG_REG for uCode use */
+        iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
+                    CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI |
+                    CSR_HW_IF_CONFIG_REG_BIT_MAC_SI);
 
         /* no locking required for register write */
-        if (priv->cfg->pa_type == IWL_PA_HYBRID) {
-                /* 2x2 hybrid phy type */
-                iwl_write32(priv, CSR_GP_DRIVER_REG,
-                             CSR_GP_DRIVER_REG_BIT_RADIO_SKU_2x2_HYB);
-        } else if (priv->cfg->pa_type == IWL_PA_INTERNAL) {
+        if (priv->cfg->pa_type == IWL_PA_INTERNAL) {
                 /* 2x2 IPA phy type */
                 iwl_write32(priv, CSR_GP_DRIVER_REG,
                              CSR_GP_DRIVER_REG_BIT_RADIO_SKU_2x2_IPA);
         }
         /* else do nothing, uCode configured */
+        if (priv->cfg->ops->lib->temp_ops.set_calib_version)
+                priv->cfg->ops->lib->temp_ops.set_calib_version(priv);
+}
+
+static struct iwl_sensitivity_ranges iwl6000_sensitivity = {
+        .min_nrg_cck = 97,
+        .max_nrg_cck = 0, /* not used, set to 0 */
+        .auto_corr_min_ofdm = 80,
+        .auto_corr_min_ofdm_mrc = 128,
+        .auto_corr_min_ofdm_x1 = 105,
+        .auto_corr_min_ofdm_mrc_x1 = 192,
+
+        .auto_corr_max_ofdm = 145,
+        .auto_corr_max_ofdm_mrc = 232,
+        .auto_corr_max_ofdm_x1 = 110,
+        .auto_corr_max_ofdm_mrc_x1 = 232,
+
+        .auto_corr_min_cck = 125,
+        .auto_corr_max_cck = 175,
+        .auto_corr_min_cck_mrc = 160,
+        .auto_corr_max_cck_mrc = 310,
+        .nrg_th_cck = 97,
+        .nrg_th_ofdm = 100,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
+};
+
+static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
+{
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
+
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
+        priv->hw_params.scd_bc_tbls_size =
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwl5000_scd_bc_tbl);
+        priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
+        priv->hw_params.max_stations = IWL5000_STATION_COUNT;
+        priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
+
+        priv->hw_params.max_data_size = IWL60_RTC_DATA_SIZE;
+        priv->hw_params.max_inst_size = IWL60_RTC_INST_SIZE;
+
+        priv->hw_params.max_bsm_size = 0;
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
+                                        BIT(IEEE80211_BAND_5GHZ);
+        priv->hw_params.rx_wrt_ptr_reg = FH_RSCSR_CHNL0_WPTR;
+
+        priv->hw_params.tx_chains_num = num_of_ant(priv->cfg->valid_tx_ant);
+        priv->hw_params.rx_chains_num = num_of_ant(priv->cfg->valid_rx_ant);
+        priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
+        priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
+
+        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
+                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
+
+        /* Set initial sensitivity parameters */
+        /* Set initial calibration set */
+        priv->hw_params.sens = &iwl6000_sensitivity;
+        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
+        case CSR_HW_REV_TYPE_6x50:
+                priv->hw_params.calib_init_cfg =
+                        BIT(IWL_CALIB_XTAL)             |
+                        BIT(IWL_CALIB_DC)               |
+                        BIT(IWL_CALIB_LO)               |
+                        BIT(IWL_CALIB_TX_IQ)            |
+                        BIT(IWL_CALIB_BASE_BAND);
+
+                break;
+        default:
+                priv->hw_params.calib_init_cfg =
+                        BIT(IWL_CALIB_XTAL)             |
+                        BIT(IWL_CALIB_LO)               |
+                        BIT(IWL_CALIB_TX_IQ)            |
+                        BIT(IWL_CALIB_BASE_BAND);
+                break;
+        }
+
+        return 0;
+}
+
+static int iwl6000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
+{
+        struct iwl6000_channel_switch_cmd cmd;
+        const struct iwl_channel_info *ch_info;
+        struct iwl_host_cmd hcmd = {
+                .id = REPLY_CHANNEL_SWITCH,
+                .len = sizeof(cmd),
+                .flags = CMD_SIZE_HUGE,
+                .data = &cmd,
+        };
+
+        IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
+                priv->active_rxon.channel, channel);
+
+        cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+        cmd.channel = cpu_to_le16(channel);
+        cmd.rxon_flags = priv->staging_rxon.flags;
+        cmd.rxon_filter_flags = priv->staging_rxon.filter_flags;
+        cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+        ch_info = iwl_get_channel_info(priv, priv->band, channel);
+        if (ch_info)
+                cmd.expect_beacon = is_channel_radar(ch_info);
+        else {
+                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+                        priv->active_rxon.channel, channel);
+                return -EFAULT;
+        }
+        priv->switch_rxon.channel = cpu_to_le16(channel);
+        priv->switch_rxon.switch_in_progress = true;
+
+        return iwl_send_cmd_sync(priv, &hcmd);
 }
 
 static struct iwl_lib_ops iwl6000_lib = {
-        .set_hw_params = iwl5000_hw_set_hw_params,
+        .set_hw_params = iwl6000_hw_set_hw_params,
         .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
         .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
         .txq_set_sched = iwl5000_txq_set_sched,
@@ -102,14 +239,16 @@ static struct iwl_lib_ops iwl6000_lib = {
         .load_ucode = iwl5000_load_ucode,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
+        .dump_fh = iwl_dump_fh,
         .init_alive_start = iwl5000_init_alive_start,
         .alive_notify = iwl5000_alive_notify,
         .send_tx_power = iwl5000_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
+        .set_channel_switch = iwl6000_hw_channel_switch,
         .apm_ops = {
-                .init = iwl5000_apm_init,
-                .reset = iwl5000_apm_reset,
-                .stop = iwl5000_apm_stop,
+                .init = iwl_apm_init,
+                .stop = iwl_apm_stop,
                 .config = iwl6000_nic_config,
                 .set_pwr_src = iwl_set_pwr_src,
         },
@@ -120,7 +259,7 @@ static struct iwl_lib_ops iwl6000_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
@@ -137,27 +276,86 @@ static struct iwl_lib_ops iwl6000_lib = {
                 .temperature = iwl5000_temperature,
                 .set_ct_kill = iwl6000_set_ct_threshold,
          },
+        .add_bcast_station = iwl_add_bcast_station,
 };
 
-static struct iwl_hcmd_utils_ops iwl6000_hcmd_utils = {
-        .get_hcmd_size = iwl5000_get_hcmd_size,
-        .build_addsta_hcmd = iwl5000_build_addsta_hcmd,
-        .rts_tx_cmd_flag = iwl5000_rts_tx_cmd_flag,
-        .calc_rssi = iwl5000_calc_rssi,
-};
-
-static struct iwl_ops iwl6000_ops = {
+static const struct iwl_ops iwl6000_ops = {
         .ucode = &iwl5000_ucode,
         .lib = &iwl6000_lib,
         .hcmd = &iwl5000_hcmd,
-        .utils = &iwl6000_hcmd_utils,
+        .utils = &iwl5000_hcmd_utils,
+        .led = &iwlagn_led_ops,
+};
+
+static struct iwl_lib_ops iwl6050_lib = {
+        .set_hw_params = iwl6000_hw_set_hw_params,
+        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwl5000_txq_set_sched,
+        .txq_agg_enable = iwl5000_txq_agg_enable,
+        .txq_agg_disable = iwl5000_txq_agg_disable,
+        .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
+        .txq_free_tfd = iwl_hw_txq_free_tfd,
+        .txq_init = iwl_hw_tx_queue_init,
+        .rx_handler_setup = iwl5000_rx_handler_setup,
+        .setup_deferred_work = iwl5000_setup_deferred_work,
+        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
+        .load_ucode = iwl5000_load_ucode,
+        .dump_nic_event_log = iwl_dump_nic_event_log,
+        .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
+        .dump_fh = iwl_dump_fh,
+        .init_alive_start = iwl5000_init_alive_start,
+        .alive_notify = iwl5000_alive_notify,
+        .send_tx_power = iwl5000_send_tx_power,
+        .update_chain_flags = iwl_update_chain_flags,
+        .set_channel_switch = iwl6000_hw_channel_switch,
+        .apm_ops = {
+                .init = iwl_apm_init,
+                .stop = iwl_apm_stop,
+                .config = iwl6000_nic_config,
+                .set_pwr_src = iwl_set_pwr_src,
+        },
+        .eeprom_ops = {
+                .regulatory_bands = {
+                        EEPROM_5000_REG_BAND_1_CHANNELS,
+                        EEPROM_5000_REG_BAND_2_CHANNELS,
+                        EEPROM_5000_REG_BAND_3_CHANNELS,
+                        EEPROM_5000_REG_BAND_4_CHANNELS,
+                        EEPROM_5000_REG_BAND_5_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
+                },
+                .verify_signature  = iwlcore_eeprom_verify_signature,
+                .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
+                .release_semaphore = iwlcore_eeprom_release_semaphore,
+                .calib_version  = iwl5000_eeprom_calib_version,
+                .query_addr = iwl5000_eeprom_query_addr,
+                .update_enhanced_txpower = iwlcore_eeprom_enhanced_txpower,
+        },
+        .post_associate = iwl_post_associate,
+        .isr = iwl_isr_ict,
+        .config_ap = iwl_config_ap,
+        .temp_ops = {
+                .temperature = iwl5000_temperature,
+                .set_ct_kill = iwl6000_set_ct_threshold,
+                .set_calib_version = iwl6050_set_calib_version,
+         },
+        .add_bcast_station = iwl_add_bcast_station,
 };
 
+static const struct iwl_ops iwl6050_ops = {
+        .ucode = &iwl5000_ucode,
+        .lib = &iwl6050_lib,
+        .hcmd = &iwl5000_hcmd,
+        .utils = &iwl5000_hcmd_utils,
+        .led = &iwlagn_led_ops,
+};
 
 /*
- * "h": Hybrid configuration, use both internal and external Power Amplifier
+ * "i": Internal configuration, use internal Power Amplifier
  */
-struct iwl_cfg iwl6000h_2agn_cfg = {
+struct iwl_cfg iwl6000i_2agn_cfg = {
         .name = "6000 Series 2x2 AGN",
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
@@ -165,41 +363,90 @@ struct iwl_cfg iwl6000h_2agn_cfg = {
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
+        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
-        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = false,
-        .pa_type = IWL_PA_HYBRID,
+        .valid_tx_ant = ANT_BC,
+        .valid_rx_ant = ANT_BC,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
+        .pa_type = IWL_PA_INTERNAL,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
         .ht_greenfield_support = true,
+        .led_compensation = 51,
         .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
-/*
- * "i": Internal configuration, use internal Power Amplifier
- */
-struct iwl_cfg iwl6000i_2agn_cfg = {
-        .name = "6000 Series 2x2 AGN",
+struct iwl_cfg iwl6000i_2abg_cfg = {
+        .name = "6000 Series 2x2 ABG",
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
+        .sku = IWL_SKU_A|IWL_SKU_G,
         .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
+        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
         .pa_type = IWL_PA_INTERNAL,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
         .ht_greenfield_support = true,
-        .use_rts_for_ht = true, /* use rts/cts protection */
+        .led_compensation = 51,
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+};
+
+struct iwl_cfg iwl6000i_2bg_cfg = {
+        .name = "6000 Series 2x2 BG",
+        .fw_name_pre = IWL6000_FW_PRE,
+        .ucode_api_max = IWL6000_UCODE_API_MAX,
+        .ucode_api_min = IWL6000_UCODE_API_MIN,
+        .sku = IWL_SKU_G,
+        .ops = &iwl6000_ops,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
+        .mod_params = &iwl50_mod_params,
+        .valid_tx_ant = ANT_BC,
+        .valid_rx_ant = ANT_BC,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
+        .pa_type = IWL_PA_INTERNAL,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .shadow_ram_support = true,
+        .ht_greenfield_support = true,
+        .led_compensation = 51,
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl6050_2agn_cfg = {
@@ -208,61 +455,93 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000_ops,
+        .ops = &iwl6050_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
+        .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
         .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
         .shadow_ram_support = true,
         .ht_greenfield_support = true,
+        .led_compensation = 51,
         .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1500,
 };
 
-struct iwl_cfg iwl6000_3agn_cfg = {
-        .name = "6000 Series 3x3 AGN",
-        .fw_name_pre = IWL6000_FW_PRE,
-        .ucode_api_max = IWL6000_UCODE_API_MAX,
-        .ucode_api_min = IWL6000_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000_ops,
+struct iwl_cfg iwl6050_2abg_cfg = {
+        .name = "6050 Series 2x2 ABG",
+        .fw_name_pre = IWL6050_FW_PRE,
+        .ucode_api_max = IWL6050_UCODE_API_MAX,
+        .ucode_api_min = IWL6050_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G,
+        .ops = &iwl6050_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
+        .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
-        .valid_tx_ant = ANT_ABC,
-        .valid_rx_ant = ANT_ABC,
-        .need_pll_cfg = false,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
         .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
         .shadow_ram_support = true,
         .ht_greenfield_support = true,
-        .use_rts_for_ht = true, /* use rts/cts protection */
+        .led_compensation = 51,
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1500,
 };
 
-struct iwl_cfg iwl6050_3agn_cfg = {
-        .name = "6050 Series 3x3 AGN",
-        .fw_name_pre = IWL6050_FW_PRE,
-        .ucode_api_max = IWL6050_UCODE_API_MAX,
-        .ucode_api_min = IWL6050_UCODE_API_MIN,
+struct iwl_cfg iwl6000_3agn_cfg = {
+        .name = "6000 Series 3x3 AGN",
+        .fw_name_pre = IWL6000_FW_PRE,
+        .ucode_api_max = IWL6000_UCODE_API_MAX,
+        .ucode_api_min = IWL6000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
+        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
         .pa_type = IWL_PA_SYSTEM,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
         .ht_greenfield_support = true,
+        .led_compensation = 51,
         .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-led.c b/drivers/net/wireless/iwlwifi/iwl-agn-led.c
new file mode 100644
index 000000000000..1a24946bc203
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-led.c
@@ -0,0 +1,85 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/dma-mapping.h>
+#include <linux/delay.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/wireless.h>
+#include <net/mac80211.h>
+#include <linux/etherdevice.h>
+#include <asm/unaligned.h>
+
+#include "iwl-commands.h"
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-io.h"
+#include "iwl-agn-led.h"
+
+/* Send led command */
+static int iwl_send_led_cmd(struct iwl_priv *priv, struct iwl_led_cmd *led_cmd)
+{
+        struct iwl_host_cmd cmd = {
+                .id = REPLY_LEDS_CMD,
+                .len = sizeof(struct iwl_led_cmd),
+                .data = led_cmd,
+                .flags = CMD_ASYNC,
+                .callback = NULL,
+        };
+        u32 reg;
+
+        reg = iwl_read32(priv, CSR_LED_REG);
+        if (reg != (reg & CSR_LED_BSM_CTRL_MSK))
+                iwl_write32(priv, CSR_LED_REG, reg & CSR_LED_BSM_CTRL_MSK);
+
+        return iwl_send_cmd(priv, &cmd);
+}
+
+/* Set led register off */
+static int iwl_led_on_reg(struct iwl_priv *priv)
+{
+        IWL_DEBUG_LED(priv, "led on\n");
+        iwl_write32(priv, CSR_LED_REG, CSR_LED_REG_TRUN_ON);
+        return 0;
+}
+
+/* Set led register off */
+static int iwl_led_off_reg(struct iwl_priv *priv)
+{
+        IWL_DEBUG_LED(priv, "LED Reg off\n");
+        iwl_write32(priv, CSR_LED_REG, CSR_LED_REG_TRUN_OFF);
+        return 0;
+}
+
+const struct iwl_led_ops iwlagn_led_ops = {
+        .cmd = iwl_send_led_cmd,
+        .on = iwl_led_on_reg,
+        .off = iwl_led_off_reg,
+};
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-led.h b/drivers/net/wireless/iwlwifi/iwl-agn-led.h
new file mode 100644
index 000000000000..a594e4fdc6b8
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-led.h
@@ -0,0 +1,32 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#ifndef __iwl_agn_led_h__
+#define __iwl_agn_led_h__
+
+extern const struct iwl_led_ops iwlagn_led_ops;
+
+#endif /* __iwl_agn_led_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 81726ee32858..1460116d329f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -26,6 +26,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/wireless.h>
 #include <net/mac80211.h>
 
@@ -75,104 +76,6 @@ static const u8 ant_toggle_lookup[] = {
         /*ANT_ABC  -> */ ANT_ABC,
 };
 
-/**
- * struct iwl_rate_scale_data -- tx success history for one rate
- */
-struct iwl_rate_scale_data {
-        u64 data;               /* bitmap of successful frames */
-        s32 success_counter;    /* number of frames successful */
-        s32 success_ratio;      /* per-cent * 128  */
-        s32 counter;            /* number of frames attempted */
-        s32 average_tpt;        /* success ratio * expected throughput */
-        unsigned long stamp;
-};
-
-/**
- * struct iwl_scale_tbl_info -- tx params and success history for all rates
- *
- * There are two of these in struct iwl_lq_sta,
- * one for "active", and one for "search".
- */
-struct iwl_scale_tbl_info {
-        enum iwl_table_type lq_type;
-        u8 ant_type;
-        u8 is_SGI;      /* 1 = short guard interval */
-        u8 is_ht40;     /* 1 = 40 MHz channel width */
-        u8 is_dup;      /* 1 = duplicated data streams */
-        u8 action;      /* change modulation; IWL_[LEGACY/SISO/MIMO]_SWITCH_* */
-        u8 max_search;  /* maximun number of tables we can search */
-        s32 *expected_tpt;      /* throughput metrics; expected_tpt_G, etc. */
-        u32 current_rate;  /* rate_n_flags, uCode API format */
-        struct iwl_rate_scale_data win[IWL_RATE_COUNT]; /* rate histories */
-};
-
-struct iwl_traffic_load {
-        unsigned long time_stamp;       /* age of the oldest statistics */
-        u32 packet_count[TID_QUEUE_MAX_SIZE];   /* packet count in this time
-                                                 * slice */
-        u32 total;                      /* total num of packets during the
-                                         * last TID_MAX_TIME_DIFF */
-        u8 queue_count;                 /* number of queues that has
-                                         * been used since the last cleanup */
-        u8 head;                        /* start of the circular buffer */
-};
-
-/**
- * struct iwl_lq_sta -- driver's rate scaling private structure
- *
- * Pointer to this gets passed back and forth between driver and mac80211.
- */
-struct iwl_lq_sta {
-        u8 active_tbl;          /* index of active table, range 0-1 */
-        u8 enable_counter;      /* indicates HT mode */
-        u8 stay_in_tbl;         /* 1: disallow, 0: allow search for new mode */
-        u8 search_better_tbl;   /* 1: currently trying alternate mode */
-        s32 last_tpt;
-
-        /* The following determine when to search for a new mode */
-        u32 table_count_limit;
-        u32 max_failure_limit;  /* # failed frames before new search */
-        u32 max_success_limit;  /* # successful frames before new search */
-        u32 table_count;
-        u32 total_failed;       /* total failed frames, any/all rates */
-        u32 total_success;      /* total successful frames, any/all rates */
-        u64 flush_timer;        /* time staying in mode before new search */
-
-        u8 action_counter;      /* # mode-switch actions tried */
-        u8 is_green;
-        u8 is_dup;
-        enum ieee80211_band band;
-        u8 ibss_sta_added;
-
-        /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
-        u32 supp_rates;
-        u16 active_legacy_rate;
-        u16 active_siso_rate;
-        u16 active_mimo2_rate;
-        u16 active_mimo3_rate;
-        u16 active_rate_basic;
-        s8 max_rate_idx;     /* Max rate set by user */
-        u8 missed_rate_counter;
-
-        struct iwl_link_quality_cmd lq;
-        struct iwl_scale_tbl_info lq_info[LQ_SIZE]; /* "active", "search" */
-        struct iwl_traffic_load load[TID_MAX_LOAD_COUNT];
-        u8 tx_agg_tid_en;
-#ifdef CONFIG_MAC80211_DEBUGFS
-        struct dentry *rs_sta_dbgfs_scale_table_file;
-        struct dentry *rs_sta_dbgfs_stats_table_file;
-        struct dentry *rs_sta_dbgfs_rate_scale_data_file;
-        struct dentry *rs_sta_dbgfs_tx_agg_tid_en_file;
-        u32 dbg_fixed_rate;
-#endif
-        struct iwl_priv *drv;
-
-        /* used to be in sta_info */
-        int last_txrate_idx;
-        /* last tx rate_n_flags */
-        u32 last_rate_n_flags;
-};
-
 static void rs_rate_scale_perform(struct iwl_priv *priv,
                                    struct sk_buff *skb,
                                    struct ieee80211_sta *sta,
@@ -190,84 +93,78 @@ static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
 {}
 #endif
 
-/*
- * Expected throughput metrics for following rates:
- * 1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54, 60 MBits
- * "G" is the only table that supports CCK (the first 4 rates).
+/**
+ * The following tables contain the expected throughput metrics for all rates
+ *
+ *      1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54, 60 MBits
+ *
+ * where invalid entries are zeros.
+ *
+ * CCK rates are only valid in legacy table and will only be used in G
+ * (2.4 GHz) band.
  */
 
-static s32 expected_tpt_A[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 40, 57, 72, 98, 121, 154, 177, 186, 186
-};
-
-static s32 expected_tpt_G[IWL_RATE_COUNT] = {
-        7, 13, 35, 58, 40, 57, 72, 98, 121, 154, 177, 186, 186
-};
-
-static s32 expected_tpt_siso20MHz[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 42, 42, 76, 102, 124, 159, 183, 193, 202
-};
-
-static s32 expected_tpt_siso20MHzSGI[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 46, 46, 82, 110, 132, 168, 192, 202, 211
-};
-
-static s32 expected_tpt_mimo2_20MHz[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 74, 74, 123, 155, 179, 214, 236, 244, 251
-};
-
-static s32 expected_tpt_mimo2_20MHzSGI[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 81, 81, 131, 164, 188, 222, 243, 251, 257
-};
-
-static s32 expected_tpt_siso40MHz[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 77, 77, 127, 160, 184, 220, 242, 250, 257
-};
-
-static s32 expected_tpt_siso40MHzSGI[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 83, 83, 135, 169, 193, 229, 250, 257, 264
+static s32 expected_tpt_legacy[IWL_RATE_COUNT] = {
+        7, 13, 35, 58, 40, 57, 72, 98, 121, 154, 177, 186, 0
 };
 
-static s32 expected_tpt_mimo2_40MHz[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 123, 123, 182, 214, 235, 264, 279, 285, 289
+static s32 expected_tpt_siso20MHz[4][IWL_RATE_COUNT] = {
+        {0, 0, 0, 0, 42, 0,  76, 102, 124, 158, 183, 193, 202}, /* Norm */
+        {0, 0, 0, 0, 46, 0,  82, 110, 132, 167, 192, 202, 210}, /* SGI */
+        {0, 0, 0, 0, 48, 0,  93, 135, 176, 251, 319, 351, 381}, /* AGG */
+        {0, 0, 0, 0, 53, 0, 102, 149, 193, 275, 348, 381, 413}, /* AGG+SGI */
 };
 
-static s32 expected_tpt_mimo2_40MHzSGI[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 131, 131, 191, 222, 242, 270, 284, 289, 293
+static s32 expected_tpt_siso40MHz[4][IWL_RATE_COUNT] = {
+        {0, 0, 0, 0,  77, 0, 127, 160, 184, 220, 242, 250, 257}, /* Norm */
+        {0, 0, 0, 0,  83, 0, 135, 169, 193, 229, 250, 257, 264}, /* SGI */
+        {0, 0, 0, 0,  96, 0, 182, 259, 328, 451, 553, 598, 640}, /* AGG */
+        {0, 0, 0, 0, 106, 0, 199, 282, 357, 487, 593, 640, 683}, /* AGG+SGI */
 };
 
-/* Expected throughput metric MIMO3 */
-static s32 expected_tpt_mimo3_20MHz[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 99, 99, 153, 186, 208, 239, 256, 263, 268
+static s32 expected_tpt_mimo2_20MHz[4][IWL_RATE_COUNT] = {
+        {0, 0, 0, 0,  74, 0, 123, 155, 179, 213, 235, 243, 250}, /* Norm */
+        {0, 0, 0, 0,  81, 0, 131, 164, 187, 221, 242, 250, 256}, /* SGI */
+        {0, 0, 0, 0,  92, 0, 175, 250, 317, 436, 534, 578, 619}, /* AGG */
+        {0, 0, 0, 0, 102, 0, 192, 273, 344, 470, 573, 619, 660}, /* AGG+SGI*/
 };
 
-static s32 expected_tpt_mimo3_20MHzSGI[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 106, 106, 162, 194, 215, 246, 262, 268, 273
+static s32 expected_tpt_mimo2_40MHz[4][IWL_RATE_COUNT] = {
+        {0, 0, 0, 0, 123, 0, 182, 214, 235, 264, 279, 285, 289}, /* Norm */
+        {0, 0, 0, 0, 131, 0, 191, 222, 242, 270, 284, 289, 293}, /* SGI */
+        {0, 0, 0, 0, 180, 0, 327, 446, 545, 708, 828, 878, 922}, /* AGG */
+        {0, 0, 0, 0, 197, 0, 355, 481, 584, 752, 872, 922, 966}, /* AGG+SGI */
 };
 
-static s32 expected_tpt_mimo3_40MHz[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 152, 152, 211, 239, 255, 279, 290, 294, 297
+static s32 expected_tpt_mimo3_20MHz[4][IWL_RATE_COUNT] = {
+        {0, 0, 0, 0,  99, 0, 153, 186, 208, 239, 256, 263, 268}, /* Norm */
+        {0, 0, 0, 0, 106, 0, 162, 194, 215, 246, 262, 268, 273}, /* SGI */
+        {0, 0, 0, 0, 134, 0, 249, 346, 431, 574, 685, 732, 775}, /* AGG */
+        {0, 0, 0, 0, 148, 0, 272, 376, 465, 614, 727, 775, 818}, /* AGG+SGI */
 };
 
-static s32 expected_tpt_mimo3_40MHzSGI[IWL_RATE_COUNT] = {
-        0, 0, 0, 0, 160, 160, 219, 245, 261, 284, 294, 297, 300
+static s32 expected_tpt_mimo3_40MHz[4][IWL_RATE_COUNT] = {
+        {0, 0, 0, 0, 152, 0, 211, 239, 255, 279,  290,  294,  297}, /* Norm */
+        {0, 0, 0, 0, 160, 0, 219, 245, 261, 284,  294,  297,  300}, /* SGI */
+        {0, 0, 0, 0, 254, 0, 443, 584, 695, 868,  984, 1030, 1070}, /* AGG */
+        {0, 0, 0, 0, 277, 0, 478, 624, 737, 911, 1026, 1070, 1109}, /* AGG+SGI */
 };
 
 /* mbps, mcs */
-const static struct iwl_rate_mcs_info iwl_rate_mcs[IWL_RATE_COUNT] = {
-  {"1", ""},
-  {"2", ""},
-  {"5.5", ""},
-  {"11", ""},
-  {"6", "BPSK 1/2"},
-  {"9", "BPSK 1/2"},
-  {"12", "QPSK 1/2"},
-  {"18", "QPSK 3/4"},
-  {"24", "16QAM 1/2"},
-  {"36", "16QAM 3/4"},
-  {"48", "64QAM 2/3"},
-  {"54", "64QAM 3/4"},
-  {"60", "64QAM 5/6"}
+static const struct iwl_rate_mcs_info iwl_rate_mcs[IWL_RATE_COUNT] = {
+        {  "1", "BPSK DSSS"},
+        {  "2", "QPSK DSSS"},
+        {"5.5", "BPSK CCK"},
+        { "11", "QPSK CCK"},
+        {  "6", "BPSK 1/2"},
+        {  "9", "BPSK 1/2"},
+        { "12", "QPSK 1/2"},
+        { "18", "QPSK 3/4"},
+        { "24", "16QAM 1/2"},
+        { "36", "16QAM 3/4"},
+        { "48", "64QAM 2/3"},
+        { "54", "64QAM 3/4"},
+        { "60", "64QAM 5/6"},
 };
 
 #define MCS_INDEX_PER_STREAM    (8)
@@ -402,10 +299,23 @@ static void rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
                                       struct iwl_lq_sta *lq_data, u8 tid,
                                       struct ieee80211_sta *sta)
 {
+        int ret;
+
         if (rs_tl_get_load(lq_data, tid) > IWL_AGG_LOAD_THRESHOLD) {
                 IWL_DEBUG_HT(priv, "Starting Tx agg: STA: %pM tid: %d\n",
                                 sta->addr, tid);
-                ieee80211_start_tx_ba_session(priv->hw, sta->addr, tid);
+                ret = ieee80211_start_tx_ba_session(sta, tid);
+                if (ret == -EAGAIN) {
+                        /*
+                         * driver and mac80211 is out of sync
+                         * this might be cause by reloading firmware
+                         * stop the tx ba session here
+                         */
+                        IWL_DEBUG_HT(priv, "Fail start Tx agg on tid: %d\n",
+                                tid);
+                        ret = ieee80211_stop_tx_ba_session(sta, tid,
+                                                WLAN_BACK_INITIATOR);
+                }
         }
 }
 
@@ -436,6 +346,17 @@ static inline int get_num_of_ant_from_rate(u32 rate_n_flags)
                !!(rate_n_flags & RATE_MCS_ANT_C_MSK);
 }
 
+/*
+ * Static function to get the expected throughput from an iwl_scale_tbl_info
+ * that wraps a NULL pointer check
+ */
+static s32 get_expected_tpt(struct iwl_scale_tbl_info *tbl, int rs_index)
+{
+        if (tbl->expected_tpt)
+                return tbl->expected_tpt[rs_index];
+        return 0;
+}
+
 /**
  * rs_collect_tx_data - Update the success/failure sliding window
  *
@@ -443,19 +364,21 @@ static inline int get_num_of_ant_from_rate(u32 rate_n_flags)
  * at this rate.  window->data contains the bitmask of successful
  * packets.
  */
-static int rs_collect_tx_data(struct iwl_rate_scale_data *windows,
-                              int scale_index, s32 tpt, int retries,
-                              int successes)
+static int rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
+                              int scale_index, int attempts, int successes)
 {
         struct iwl_rate_scale_data *window = NULL;
         static const u64 mask = (((u64)1) << (IWL_RATE_MAX_WINDOW - 1));
-        s32 fail_count;
+        s32 fail_count, tpt;
 
         if (scale_index < 0 || scale_index >= IWL_RATE_COUNT)
                 return -EINVAL;
 
-        /* Select data for current tx bit rate */
-        window = &(windows[scale_index]);
+        /* Select window for current tx bit rate */
+        window = &(tbl->win[scale_index]);
+
+        /* Get expected throughput */
+        tpt = get_expected_tpt(tbl, scale_index);
 
         /*
          * Keep track of only the latest 62 tx frame attempts in this rate's
@@ -465,7 +388,7 @@ static int rs_collect_tx_data(struct iwl_rate_scale_data *windows,
          * subtract "1" from the success counter (this is the main reason
          * we keep these bitmaps!).
          */
-        while (retries > 0) {
+        while (attempts > 0) {
                 if (window->counter >= IWL_RATE_MAX_WINDOW) {
 
                         /* remove earliest */
@@ -480,17 +403,17 @@ static int rs_collect_tx_data(struct iwl_rate_scale_data *windows,
                 /* Increment frames-attempted counter */
                 window->counter++;
 
-                /* Shift bitmap by one frame (throw away oldest history),
-                 * OR in "1", and increment "success" if this
-                 * frame was successful. */
+                /* Shift bitmap by one frame to throw away oldest history */
                 window->data <<= 1;
+
+                /* Mark the most recent #successes attempts as successful */
                 if (successes > 0) {
                         window->success_counter++;
                         window->data |= 0x1;
                         successes--;
                 }
 
-                retries--;
+                attempts--;
         }
 
         /* Calculate current success ratio, avoid divide-by-0! */
@@ -671,7 +594,7 @@ static int rs_toggle_antenna(u32 valid_ant, u32 *rate_n_flags,
  * there are no non-GF stations present in the BSS.
  */
 static inline u8 rs_use_green(struct ieee80211_sta *sta,
-                              struct iwl_ht_info *ht_conf)
+                              struct iwl_ht_config *ht_conf)
 {
         return (sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD) &&
                 !(ht_conf->non_GF_STA_present);
@@ -821,28 +744,34 @@ out:
 }
 
 /*
+ * Simple function to compare two rate scale table types
+ */
+static bool table_type_matches(struct iwl_scale_tbl_info *a,
+                               struct iwl_scale_tbl_info *b)
+{
+        return (a->lq_type == b->lq_type) && (a->ant_type == b->ant_type) &&
+                (a->is_SGI == b->is_SGI);
+}
+
+/*
  * mac80211 sends us Tx status
  */
 static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                          struct ieee80211_sta *sta, void *priv_sta,
                          struct sk_buff *skb)
 {
-        int status;
-        u8 retries;
-        int rs_index, mac_index, index = 0;
+        int legacy_success;
+        int retries;
+        int rs_index, mac_index, i;
         struct iwl_lq_sta *lq_sta = priv_sta;
         struct iwl_link_quality_cmd *table;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct iwl_priv *priv = (struct iwl_priv *)priv_r;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct iwl_rate_scale_data *window = NULL;
-        struct iwl_rate_scale_data *search_win = NULL;
         enum mac80211_rate_control_flags mac_flags;
         u32 tx_rate;
         struct iwl_scale_tbl_info tbl_type;
-        struct iwl_scale_tbl_info *curr_tbl, *search_tbl;
-        u8 active_index = 0;
-        s32 tpt = 0;
+        struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
 
         IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
 
@@ -850,30 +779,14 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
             info->flags & IEEE80211_TX_CTL_NO_ACK)
                 return;
 
-        /* This packet was aggregated but doesn't carry rate scale info */
+        /* This packet was aggregated but doesn't carry status info */
         if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
             !(info->flags & IEEE80211_TX_STAT_AMPDU))
                 return;
 
-        if (info->flags & IEEE80211_TX_STAT_AMPDU)
-                retries = 0;
-        else
-                retries = info->status.rates[0].count - 1;
-
-        if (retries > 15)
-                retries = 15;
-
         if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) &&
             !lq_sta->ibss_sta_added)
-                goto out;
-
-        table = &lq_sta->lq;
-        active_index = lq_sta->active_tbl;
-
-        curr_tbl = &(lq_sta->lq_info[active_index]);
-        search_tbl = &(lq_sta->lq_info[(1 - active_index)]);
-        window = (struct iwl_rate_scale_data *)&(curr_tbl->win[0]);
-        search_win = (struct iwl_rate_scale_data *)&(search_tbl->win[0]);
+                return;
 
         /*
          * Ignore this Tx frame response if its initial rate doesn't match
@@ -883,6 +796,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
          * to check "search" mode, or a prior "search" mode after we've moved
          * to a new "search" mode (which might become the new "active" mode).
          */
+        table = &lq_sta->lq;
         tx_rate = le32_to_cpu(table->rs_table[0].rate_n_flags);
         rs_get_tbl_info_from_mcs(tx_rate, priv->band, &tbl_type, &rs_index);
         if (priv->band == IEEE80211_BAND_5GHZ)
@@ -901,7 +815,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                 if (priv->band == IEEE80211_BAND_2GHZ)
                         mac_index += IWL_FIRST_OFDM_RATE;
         }
-
+        /* Here we actually compare this rate to the latest LQ command */
         if ((mac_index < 0) ||
             (tbl_type.is_SGI != !!(mac_flags & IEEE80211_TX_RC_SHORT_GI)) ||
             (tbl_type.is_ht40 != !!(mac_flags & IEEE80211_TX_RC_40_MHZ_WIDTH)) ||
@@ -911,124 +825,98 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
             (!!(tx_rate & RATE_MCS_GF_MSK) != !!(mac_flags & IEEE80211_TX_RC_GREEN_FIELD)) ||
             (rs_index != mac_index)) {
                 IWL_DEBUG_RATE(priv, "initial rate %d does not match %d (0x%x)\n", mac_index, rs_index, tx_rate);
-                /* the last LQ command could failed so the LQ in ucode not
-                 * the same in driver sync up
+                /*
+                 * Since rates mis-match, the last LQ command may have failed.
+                 * After IWL_MISSED_RATE_MAX mis-matches, resync the uCode with
+                 * ... driver.
                  */
                 lq_sta->missed_rate_counter++;
                 if (lq_sta->missed_rate_counter > IWL_MISSED_RATE_MAX) {
                         lq_sta->missed_rate_counter = 0;
                         iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC);
                 }
-                goto out;
-        }
-
-        lq_sta->missed_rate_counter = 0;
-        /* Update frame history window with "failure" for each Tx retry. */
-        while (retries) {
-                /* Look up the rate and other info used for each tx attempt.
-                 * Each tx attempt steps one entry deeper in the rate table. */
-                tx_rate = le32_to_cpu(table->rs_table[index].rate_n_flags);
-                rs_get_tbl_info_from_mcs(tx_rate, priv->band,
-                                          &tbl_type, &rs_index);
-
-                /* If type matches "search" table,
-                 * add failure to "search" history */
-                if ((tbl_type.lq_type == search_tbl->lq_type) &&
-                    (tbl_type.ant_type == search_tbl->ant_type) &&
-                    (tbl_type.is_SGI == search_tbl->is_SGI)) {
-                        if (search_tbl->expected_tpt)
-                                tpt = search_tbl->expected_tpt[rs_index];
-                        else
-                                tpt = 0;
-                        rs_collect_tx_data(search_win, rs_index, tpt, 1, 0);
-
-                /* Else if type matches "current/active" table,
-                 * add failure to "current/active" history */
-                } else if ((tbl_type.lq_type == curr_tbl->lq_type) &&
-                           (tbl_type.ant_type == curr_tbl->ant_type) &&
-                           (tbl_type.is_SGI == curr_tbl->is_SGI)) {
-                        if (curr_tbl->expected_tpt)
-                                tpt = curr_tbl->expected_tpt[rs_index];
-                        else
-                                tpt = 0;
-                        rs_collect_tx_data(window, rs_index, tpt, 1, 0);
-                }
-
-                /* If not searching for a new mode, increment failed counter
-                 * ... this helps determine when to start searching again */
-                if (lq_sta->stay_in_tbl)
-                        lq_sta->total_failed++;
-                --retries;
-                index++;
-
+                /* Regardless, ignore this status info for outdated rate */
+                return;
+        } else
+                /* Rate did match, so reset the missed_rate_counter */
+                lq_sta->missed_rate_counter = 0;
+
+        /* Figure out if rate scale algorithm is in active or search table */
+        if (table_type_matches(&tbl_type,
+                                &(lq_sta->lq_info[lq_sta->active_tbl]))) {
+                curr_tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
+                other_tbl = &(lq_sta->lq_info[1 - lq_sta->active_tbl]);
+        } else if (table_type_matches(&tbl_type,
+                                &lq_sta->lq_info[1 - lq_sta->active_tbl])) {
+                curr_tbl = &(lq_sta->lq_info[1 - lq_sta->active_tbl]);
+                other_tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
+        } else {
+                IWL_DEBUG_RATE(priv, "Neither active nor search matches tx rate\n");
+                return;
         }
 
         /*
-         * Find (by rate) the history window to update with final Tx attempt;
-         * if Tx was successful first try, use original rate,
-         * else look up the rate that was, finally, successful.
+         * Updating the frame history depends on whether packets were
+         * aggregated.
+         *
+         * For aggregation, all packets were transmitted at the same rate, the
+         * first index into rate scale table.
          */
-        tx_rate = le32_to_cpu(table->rs_table[index].rate_n_flags);
-        lq_sta->last_rate_n_flags = tx_rate;
-        rs_get_tbl_info_from_mcs(tx_rate, priv->band, &tbl_type, &rs_index);
-
-        /* Update frame history window with "success" if Tx got ACKed ... */
-        status = !!(info->flags & IEEE80211_TX_STAT_ACK);
-
-        /* If type matches "search" table,
-         * add final tx status to "search" history */
-        if ((tbl_type.lq_type == search_tbl->lq_type) &&
-            (tbl_type.ant_type == search_tbl->ant_type) &&
-            (tbl_type.is_SGI == search_tbl->is_SGI)) {
-                if (search_tbl->expected_tpt)
-                        tpt = search_tbl->expected_tpt[rs_index];
-                else
-                        tpt = 0;
-                if (info->flags & IEEE80211_TX_STAT_AMPDU)
-                        rs_collect_tx_data(search_win, rs_index, tpt,
-                                           info->status.ampdu_ack_len,
-                                           info->status.ampdu_ack_map);
-                else
-                        rs_collect_tx_data(search_win, rs_index, tpt,
-                                           1, status);
-        /* Else if type matches "current/active" table,
-         * add final tx status to "current/active" history */
-        } else if ((tbl_type.lq_type == curr_tbl->lq_type) &&
-                   (tbl_type.ant_type == curr_tbl->ant_type) &&
-                   (tbl_type.is_SGI == curr_tbl->is_SGI)) {
-                if (curr_tbl->expected_tpt)
-                        tpt = curr_tbl->expected_tpt[rs_index];
-                else
-                        tpt = 0;
-                if (info->flags & IEEE80211_TX_STAT_AMPDU)
-                        rs_collect_tx_data(window, rs_index, tpt,
-                                           info->status.ampdu_ack_len,
-                                           info->status.ampdu_ack_map);
-                else
-                        rs_collect_tx_data(window, rs_index, tpt,
-                                           1, status);
-        }
-
-        /* If not searching for new mode, increment success/failed counter
-         * ... these help determine when to start searching again */
-        if (lq_sta->stay_in_tbl) {
-                if (info->flags & IEEE80211_TX_STAT_AMPDU) {
+        if (info->flags & IEEE80211_TX_STAT_AMPDU) {
+                tx_rate = le32_to_cpu(table->rs_table[0].rate_n_flags);
+                rs_get_tbl_info_from_mcs(tx_rate, priv->band, &tbl_type,
+                                &rs_index);
+                rs_collect_tx_data(curr_tbl, rs_index,
+                                   info->status.ampdu_ack_len,
+                                   info->status.ampdu_ack_map);
+
+                /* Update success/fail counts if not searching for new mode */
+                if (lq_sta->stay_in_tbl) {
                         lq_sta->total_success += info->status.ampdu_ack_map;
-                        lq_sta->total_failed +=
-                             (info->status.ampdu_ack_len - info->status.ampdu_ack_map);
-                } else {
-                        if (status)
-                                lq_sta->total_success++;
+                        lq_sta->total_failed += (info->status.ampdu_ack_len -
+                                        info->status.ampdu_ack_map);
+                }
+        } else {
+        /*
+         * For legacy, update frame history with for each Tx retry.
+         */
+                retries = info->status.rates[0].count - 1;
+                /* HW doesn't send more than 15 retries */
+                retries = min(retries, 15);
+
+                /* The last transmission may have been successful */
+                legacy_success = !!(info->flags & IEEE80211_TX_STAT_ACK);
+                /* Collect data for each rate used during failed TX attempts */
+                for (i = 0; i <= retries; ++i) {
+                        tx_rate = le32_to_cpu(table->rs_table[i].rate_n_flags);
+                        rs_get_tbl_info_from_mcs(tx_rate, priv->band,
+                                        &tbl_type, &rs_index);
+                        /*
+                         * Only collect stats if retried rate is in the same RS
+                         * table as active/search.
+                         */
+                        if (table_type_matches(&tbl_type, curr_tbl))
+                                tmp_tbl = curr_tbl;
+                        else if (table_type_matches(&tbl_type, other_tbl))
+                                tmp_tbl = other_tbl;
                         else
-                                lq_sta->total_failed++;
+                                continue;
+                        rs_collect_tx_data(tmp_tbl, rs_index, 1,
+                                           i < retries ? 0 : legacy_success);
+                }
+
+                /* Update success/fail counts if not searching for new mode */
+                if (lq_sta->stay_in_tbl) {
+                        lq_sta->total_success += legacy_success;
+                        lq_sta->total_failed += retries + (1 - legacy_success);
                 }
         }
+        /* The last TX rate is cached in lq_sta; it's set in if/else above */
+        lq_sta->last_rate_n_flags = tx_rate;
 
         /* See if there's a better rate or modulation mode to try. */
         if (sta && sta->supp_rates[sband->band])
                 rs_rate_scale_perform(priv, skb, sta, lq_sta);
-out:
-        return;
 }
 
 /*
@@ -1066,43 +954,45 @@ static void rs_set_stay_in_table(struct iwl_priv *priv, u8 is_legacy,
 static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
                                       struct iwl_scale_tbl_info *tbl)
 {
+        /* Used to choose among HT tables */
+        s32 (*ht_tbl_pointer)[IWL_RATE_COUNT];
+
+        /* Check for invalid LQ type */
+        if (WARN_ON_ONCE(!is_legacy(tbl->lq_type) && !is_Ht(tbl->lq_type))) {
+                tbl->expected_tpt = expected_tpt_legacy;
+                return;
+        }
+
+        /* Legacy rates have only one table */
         if (is_legacy(tbl->lq_type)) {
-                if (!is_a_band(tbl->lq_type))
-                        tbl->expected_tpt = expected_tpt_G;
-                else
-                        tbl->expected_tpt = expected_tpt_A;
-        } else if (is_siso(tbl->lq_type)) {
-                if (tbl->is_ht40 && !lq_sta->is_dup)
-                        if (tbl->is_SGI)
-                                tbl->expected_tpt = expected_tpt_siso40MHzSGI;
-                        else
-                                tbl->expected_tpt = expected_tpt_siso40MHz;
-                else if (tbl->is_SGI)
-                        tbl->expected_tpt = expected_tpt_siso20MHzSGI;
-                else
-                        tbl->expected_tpt = expected_tpt_siso20MHz;
-        } else if (is_mimo2(tbl->lq_type)) {
-                if (tbl->is_ht40 && !lq_sta->is_dup)
-                        if (tbl->is_SGI)
-                                tbl->expected_tpt = expected_tpt_mimo2_40MHzSGI;
-                        else
-                                tbl->expected_tpt = expected_tpt_mimo2_40MHz;
-                else if (tbl->is_SGI)
-                        tbl->expected_tpt = expected_tpt_mimo2_20MHzSGI;
-                else
-                        tbl->expected_tpt = expected_tpt_mimo2_20MHz;
-        } else if (is_mimo3(tbl->lq_type)) {
-                if (tbl->is_ht40 && !lq_sta->is_dup)
-                        if (tbl->is_SGI)
-                                tbl->expected_tpt = expected_tpt_mimo3_40MHzSGI;
-                        else
-                                tbl->expected_tpt = expected_tpt_mimo3_40MHz;
-                else if (tbl->is_SGI)
-                        tbl->expected_tpt = expected_tpt_mimo3_20MHzSGI;
-                else
-                        tbl->expected_tpt = expected_tpt_mimo3_20MHz;
-        } else
-                tbl->expected_tpt = expected_tpt_G;
+                tbl->expected_tpt = expected_tpt_legacy;
+                return;
+        }
+
+        /* Choose among many HT tables depending on number of streams
+         * (SISO/MIMO2/MIMO3), channel width (20/40), SGI, and aggregation
+         * status */
+        if (is_siso(tbl->lq_type) && (!tbl->is_ht40 || lq_sta->is_dup))
+                ht_tbl_pointer = expected_tpt_siso20MHz;
+        else if (is_siso(tbl->lq_type))
+                ht_tbl_pointer = expected_tpt_siso40MHz;
+        else if (is_mimo2(tbl->lq_type) && (!tbl->is_ht40 || lq_sta->is_dup))
+                ht_tbl_pointer = expected_tpt_mimo2_20MHz;
+        else if (is_mimo2(tbl->lq_type))
+                ht_tbl_pointer = expected_tpt_mimo2_40MHz;
+        else if (is_mimo3(tbl->lq_type) && (!tbl->is_ht40 || lq_sta->is_dup))
+                ht_tbl_pointer = expected_tpt_mimo3_20MHz;
+        else /* if (is_mimo3(tbl->lq_type)) <-- must be true */
+                ht_tbl_pointer = expected_tpt_mimo3_40MHz;
+
+        if (!tbl->is_SGI && !lq_sta->is_agg)            /* Normal */
+                tbl->expected_tpt = ht_tbl_pointer[0];
+        else if (tbl->is_SGI && !lq_sta->is_agg)        /* SGI */
+                tbl->expected_tpt = ht_tbl_pointer[1];
+        else if (!tbl->is_SGI && lq_sta->is_agg)        /* AGG */
+                tbl->expected_tpt = ht_tbl_pointer[2];
+        else                                            /* AGG+SGI */
+                tbl->expected_tpt = ht_tbl_pointer[3];
 }
 
 /*
@@ -2077,6 +1967,14 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
         lq_sta->supp_rates = sta->supp_rates[lq_sta->band];
 
         tid = rs_tl_add_packet(lq_sta, hdr);
+        if ((tid != MAX_TID_COUNT) && (lq_sta->tx_agg_tid_en & (1 << tid))) {
+                tid_data = &priv->stations[lq_sta->lq.sta_id].tid[tid];
+                if (tid_data->agg.state == IWL_AGG_OFF)
+                        lq_sta->is_agg = 0;
+                else
+                        lq_sta->is_agg = 1;
+        } else
+                lq_sta->is_agg = 0;
 
         /*
          * Select rate-scale / modulation-mode table to work with in
@@ -2177,10 +2075,10 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
 
                 goto out;
         }
-
         /* Else we have enough samples; calculate estimate of
          * actual average throughput */
 
+        /* Sanity-check TPT calculations */
         BUG_ON(window->average_tpt != ((window->success_ratio *
                         tbl->expected_tpt[index] + 64) / 128));
 
@@ -2584,22 +2482,13 @@ static void *rs_alloc_sta(void *priv_rate, struct ieee80211_sta *sta,
                           gfp_t gfp)
 {
         struct iwl_lq_sta *lq_sta;
+        struct iwl_station_priv *sta_priv = (struct iwl_station_priv *) sta->drv_priv;
         struct iwl_priv *priv;
-        int i, j;
 
         priv = (struct iwl_priv *)priv_rate;
         IWL_DEBUG_RATE(priv, "create station rate scale window\n");
 
-        lq_sta = kzalloc(sizeof(struct iwl_lq_sta), gfp);
-
-        if (lq_sta == NULL)
-                return NULL;
-        lq_sta->lq.sta_id = 0xff;
-
-
-        for (j = 0; j < LQ_SIZE; j++)
-                for (i = 0; i < IWL_RATE_COUNT; i++)
-                        rs_rate_scale_clear_window(&lq_sta->lq_info[j].win[i]);
+        lq_sta = &sta_priv->lq_sta;
 
         return lq_sta;
 }
@@ -2613,6 +2502,12 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
         struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
         struct iwl_lq_sta *lq_sta = priv_sta;
 
+        lq_sta->lq.sta_id = 0xff;
+
+        for (j = 0; j < LQ_SIZE; j++)
+                for (i = 0; i < IWL_RATE_COUNT; i++)
+                        rs_rate_scale_clear_window(&lq_sta->lq_info[j].win[i]);
+
         lq_sta->flush_timer = 0;
         lq_sta->supp_rates = sta->supp_rates[sband->band];
         for (j = 0; j < LQ_SIZE; j++)
@@ -2690,6 +2585,7 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
         lq_sta->last_txrate_idx = rate_lowest_index(sband, sta);
         if (sband->band == IEEE80211_BAND_5GHZ)
                 lq_sta->last_txrate_idx += IWL_FIRST_OFDM_RATE;
+        lq_sta->is_agg = 0;
 
         rs_initialize_lq(priv, conf, sta, lq_sta);
 }
@@ -2808,7 +2704,7 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
                 repeat_rate--;
         }
 
-        lq_cmd->agg_params.agg_frame_cnt_limit = LINK_QUAL_AGG_FRAME_LIMIT_MAX;
+        lq_cmd->agg_params.agg_frame_cnt_limit = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
         lq_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
         lq_cmd->agg_params.agg_time_limit =
                 cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
@@ -2827,11 +2723,9 @@ static void rs_free(void *priv_rate)
 static void rs_free_sta(void *priv_r, struct ieee80211_sta *sta,
                         void *priv_sta)
 {
-        struct iwl_lq_sta *lq_sta = priv_sta;
         struct iwl_priv *priv __maybe_unused = priv_r;
 
         IWL_DEBUG_RATE(priv, "enter\n");
-        kfree(lq_sta);
         IWL_DEBUG_RATE(priv, "leave\n");
 }
 
@@ -2942,8 +2836,9 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
                    ((is_mimo2(tbl->lq_type)) ? "MIMO2" : "MIMO3"));
                    desc += sprintf(buff+desc, " %s",
                    (tbl->is_ht40) ? "40MHz" : "20MHz");
-                   desc += sprintf(buff+desc, " %s %s\n", (tbl->is_SGI) ? "SGI" : "",
-                   (lq_sta->is_green) ? "GF enabled" : "");
+                   desc += sprintf(buff+desc, " %s %s %s\n", (tbl->is_SGI) ? "SGI" : "",
+                   (lq_sta->is_green) ? "GF enabled" : "",
+                   (lq_sta->is_agg) ? "AGG on" : "");
         }
         desc += sprintf(buff+desc, "last tx rate=0x%X\n",
                 lq_sta->last_rate_n_flags);
@@ -3076,16 +2971,16 @@ static void rs_add_debugfs(void *priv, void *priv_sta,
 {
         struct iwl_lq_sta *lq_sta = priv_sta;
         lq_sta->rs_sta_dbgfs_scale_table_file =
-                debugfs_create_file("rate_scale_table", 0600, dir,
+                debugfs_create_file("rate_scale_table", S_IRUSR | S_IWUSR, dir,
                                 lq_sta, &rs_sta_dbgfs_scale_table_ops);
         lq_sta->rs_sta_dbgfs_stats_table_file =
-                debugfs_create_file("rate_stats_table", 0600, dir,
+                debugfs_create_file("rate_stats_table", S_IRUSR, dir,
                         lq_sta, &rs_sta_dbgfs_stats_table_ops);
         lq_sta->rs_sta_dbgfs_rate_scale_data_file =
-                debugfs_create_file("rate_scale_data", 0600, dir,
+                debugfs_create_file("rate_scale_data", S_IRUSR, dir,
                         lq_sta, &rs_sta_dbgfs_rate_scale_data_ops);
         lq_sta->rs_sta_dbgfs_tx_agg_tid_en_file =
-                debugfs_create_u8("tx_agg_tid_enable", 0600, dir,
+                debugfs_create_u8("tx_agg_tid_enable", S_IRUSR | S_IWUSR, dir,
                 &lq_sta->tx_agg_tid_en);
 
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
index 9fac530cfb7e..e71923961e69 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -54,6 +54,7 @@ struct iwl3945_rate_info {
         u8 prev_table_rs;       /* prev in rate table cmd */
 };
 
+
 /*
  * These serve as indexes into
  * struct iwl_rate_info iwl_rates[IWL_RATE_COUNT];
@@ -190,7 +191,7 @@ enum {
         IWL_RATE_2M_MASK)
 
 #define IWL_CCK_RATES_MASK          \
-       (IWL_BASIC_RATES_MASK      | \
+       (IWL_CCK_BASIC_RATES_MASK  | \
         IWL_RATE_5M_MASK          | \
         IWL_RATE_11M_MASK)
 
@@ -335,6 +336,106 @@ struct iwl_rate_mcs_info {
         char    mcs[IWL_MAX_MCS_DISPLAY_SIZE];
 };
 
+/**
+ * struct iwl_rate_scale_data -- tx success history for one rate
+ */
+struct iwl_rate_scale_data {
+        u64 data;               /* bitmap of successful frames */
+        s32 success_counter;    /* number of frames successful */
+        s32 success_ratio;      /* per-cent * 128  */
+        s32 counter;            /* number of frames attempted */
+        s32 average_tpt;        /* success ratio * expected throughput */
+        unsigned long stamp;
+};
+
+/**
+ * struct iwl_scale_tbl_info -- tx params and success history for all rates
+ *
+ * There are two of these in struct iwl_lq_sta,
+ * one for "active", and one for "search".
+ */
+struct iwl_scale_tbl_info {
+        enum iwl_table_type lq_type;
+        u8 ant_type;
+        u8 is_SGI;      /* 1 = short guard interval */
+        u8 is_ht40;     /* 1 = 40 MHz channel width */
+        u8 is_dup;      /* 1 = duplicated data streams */
+        u8 action;      /* change modulation; IWL_[LEGACY/SISO/MIMO]_SWITCH_* */
+        u8 max_search;  /* maximun number of tables we can search */
+        s32 *expected_tpt;      /* throughput metrics; expected_tpt_G, etc. */
+        u32 current_rate;  /* rate_n_flags, uCode API format */
+        struct iwl_rate_scale_data win[IWL_RATE_COUNT]; /* rate histories */
+};
+
+struct iwl_traffic_load {
+        unsigned long time_stamp;       /* age of the oldest statistics */
+        u32 packet_count[TID_QUEUE_MAX_SIZE];   /* packet count in this time
+                                                 * slice */
+        u32 total;                      /* total num of packets during the
+                                         * last TID_MAX_TIME_DIFF */
+        u8 queue_count;                 /* number of queues that has
+                                         * been used since the last cleanup */
+        u8 head;                        /* start of the circular buffer */
+};
+
+/**
+ * struct iwl_lq_sta -- driver's rate scaling private structure
+ *
+ * Pointer to this gets passed back and forth between driver and mac80211.
+ */
+struct iwl_lq_sta {
+        u8 active_tbl;          /* index of active table, range 0-1 */
+        u8 enable_counter;      /* indicates HT mode */
+        u8 stay_in_tbl;         /* 1: disallow, 0: allow search for new mode */
+        u8 search_better_tbl;   /* 1: currently trying alternate mode */
+        s32 last_tpt;
+
+        /* The following determine when to search for a new mode */
+        u32 table_count_limit;
+        u32 max_failure_limit;  /* # failed frames before new search */
+        u32 max_success_limit;  /* # successful frames before new search */
+        u32 table_count;
+        u32 total_failed;       /* total failed frames, any/all rates */
+        u32 total_success;      /* total successful frames, any/all rates */
+        u64 flush_timer;        /* time staying in mode before new search */
+
+        u8 action_counter;      /* # mode-switch actions tried */
+        u8 is_green;
+        u8 is_dup;
+        enum ieee80211_band band;
+        u8 ibss_sta_added;
+
+        /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
+        u32 supp_rates;
+        u16 active_legacy_rate;
+        u16 active_siso_rate;
+        u16 active_mimo2_rate;
+        u16 active_mimo3_rate;
+        u16 active_rate_basic;
+        s8 max_rate_idx;     /* Max rate set by user */
+        u8 missed_rate_counter;
+
+        struct iwl_link_quality_cmd lq;
+        struct iwl_scale_tbl_info lq_info[LQ_SIZE]; /* "active", "search" */
+        struct iwl_traffic_load load[TID_MAX_LOAD_COUNT];
+        u8 tx_agg_tid_en;
+#ifdef CONFIG_MAC80211_DEBUGFS
+        struct dentry *rs_sta_dbgfs_scale_table_file;
+        struct dentry *rs_sta_dbgfs_stats_table_file;
+        struct dentry *rs_sta_dbgfs_rate_scale_data_file;
+        struct dentry *rs_sta_dbgfs_tx_agg_tid_en_file;
+        u32 dbg_fixed_rate;
+#endif
+        struct iwl_priv *drv;
+
+        /* used to be in sta_info */
+        int last_txrate_idx;
+        /* last tx rate_n_flags */
+        u32 last_rate_n_flags;
+        /* packets destined for this STA are aggregated */
+        u8 is_agg;
+};
+
 static inline u8 num_of_ant(u8 mask)
 {
         return  !!((mask) & ANT_A) +
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 921dc4a26fe2..bdff56583e11 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -31,6 +31,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/pci.h>
+#include <linux/slab.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
 #include <linux/sched.h>
@@ -73,13 +74,7 @@
 #define VD
 #endif
 
-#ifdef CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT
-#define VS "s"
-#else
-#define VS
-#endif
-
-#define DRV_VERSION     IWLWIFI_VERSION VD VS
+#define DRV_VERSION     IWLWIFI_VERSION VD
 
 
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
@@ -123,6 +118,17 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                 return -EINVAL;
         }
 
+        /*
+         * receive commit_rxon request
+         * abort any previous channel switch if still in process
+         */
+        if (priv->switch_rxon.switch_in_progress &&
+            (priv->switch_rxon.channel != priv->staging_rxon.channel)) {
+                IWL_DEBUG_11H(priv, "abort channel switch on %d\n",
+                      le16_to_cpu(priv->switch_rxon.channel));
+                priv->switch_rxon.switch_in_progress = false;
+        }
+
         /* If we don't need to send a full RXON, we can use
          * iwl_rxon_assoc_cmd which is used to reconfigure filter
          * and other flags for the current radio configuration. */
@@ -134,6 +140,7 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                 }
 
                 memcpy(active_rxon, &priv->staging_rxon, sizeof(*active_rxon));
+                iwl_print_rx_config_cmd(priv);
                 return 0;
         }
 
@@ -191,11 +198,8 @@ int iwl_commit_rxon(struct iwl_priv *priv)
         priv->start_calib = 0;
 
         /* Add the broadcast address so we can send broadcast frames */
-        if (iwl_rxon_add_station(priv, iwl_bcast_addr, 0) ==
-                                                IWL_INVALID_STATION) {
-                IWL_ERR(priv, "Error adding BROADCAST address for transmit.\n");
-                return -EIO;
-        }
+        priv->cfg->ops->lib->add_bcast_station(priv);
+
 
         /* If we have set the ASSOC_MSK and we are in BSS mode then
          * add the IWL_AP_ID to the station rate table */
@@ -233,6 +237,7 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                 }
                 memcpy(active_rxon, &priv->staging_rxon, sizeof(*active_rxon));
         }
+        iwl_print_rx_config_cmd(priv);
 
         iwl_init_sensitivity(priv);
 
@@ -302,7 +307,7 @@ static void iwl_free_frame(struct iwl_priv *priv, struct iwl_frame *frame)
         list_add(&frame->list, &priv->free_frames);
 }
 
-static unsigned int iwl_fill_beacon_frame(struct iwl_priv *priv,
+static u32 iwl_fill_beacon_frame(struct iwl_priv *priv,
                                           struct ieee80211_hdr *hdr,
                                           int left)
 {
@@ -319,34 +324,74 @@ static unsigned int iwl_fill_beacon_frame(struct iwl_priv *priv,
         return priv->ibss_beacon->len;
 }
 
+/* Parse the beacon frame to find the TIM element and set tim_idx & tim_size */
+static void iwl_set_beacon_tim(struct iwl_priv *priv,
+                struct iwl_tx_beacon_cmd *tx_beacon_cmd,
+                u8 *beacon, u32 frame_size)
+{
+        u16 tim_idx;
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)beacon;
+
+        /*
+         * The index is relative to frame start but we start looking at the
+         * variable-length part of the beacon.
+         */
+        tim_idx = mgmt->u.beacon.variable - beacon;
+
+        /* Parse variable-length elements of beacon to find WLAN_EID_TIM */
+        while ((tim_idx < (frame_size - 2)) &&
+                        (beacon[tim_idx] != WLAN_EID_TIM))
+                tim_idx += beacon[tim_idx+1] + 2;
+
+        /* If TIM field was found, set variables */
+        if ((tim_idx < (frame_size - 1)) && (beacon[tim_idx] == WLAN_EID_TIM)) {
+                tx_beacon_cmd->tim_idx = cpu_to_le16(tim_idx);
+                tx_beacon_cmd->tim_size = beacon[tim_idx+1];
+        } else
+                IWL_WARN(priv, "Unable to find TIM Element in beacon\n");
+}
+
 static unsigned int iwl_hw_get_beacon_cmd(struct iwl_priv *priv,
-                                       struct iwl_frame *frame, u8 rate)
+                                       struct iwl_frame *frame)
 {
         struct iwl_tx_beacon_cmd *tx_beacon_cmd;
-        unsigned int frame_size;
+        u32 frame_size;
+        u32 rate_flags;
+        u32 rate;
+        /*
+         * We have to set up the TX command, the TX Beacon command, and the
+         * beacon contents.
+         */
 
+        /* Initialize memory */
         tx_beacon_cmd = &frame->u.beacon;
         memset(tx_beacon_cmd, 0, sizeof(*tx_beacon_cmd));
 
-        tx_beacon_cmd->tx.sta_id = priv->hw_params.bcast_sta_id;
-        tx_beacon_cmd->tx.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
-
+        /* Set up TX beacon contents */
         frame_size = iwl_fill_beacon_frame(priv, tx_beacon_cmd->frame,
                                 sizeof(frame->u) - sizeof(*tx_beacon_cmd));
+        if (WARN_ON_ONCE(frame_size > MAX_MPDU_SIZE))
+                return 0;
 
-        BUG_ON(frame_size > MAX_MPDU_SIZE);
+        /* Set up TX command fields */
         tx_beacon_cmd->tx.len = cpu_to_le16((u16)frame_size);
+        tx_beacon_cmd->tx.sta_id = priv->hw_params.bcast_sta_id;
+        tx_beacon_cmd->tx.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
+        tx_beacon_cmd->tx.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK |
+                TX_CMD_FLG_TSF_MSK | TX_CMD_FLG_STA_RATE_MSK;
 
-        if ((rate == IWL_RATE_1M_PLCP) || (rate >= IWL_RATE_2M_PLCP))
-                tx_beacon_cmd->tx.rate_n_flags =
-                        iwl_hw_set_rate_n_flags(rate, RATE_MCS_CCK_MSK);
-        else
-                tx_beacon_cmd->tx.rate_n_flags =
-                        iwl_hw_set_rate_n_flags(rate, 0);
+        /* Set up TX beacon command fields */
+        iwl_set_beacon_tim(priv, tx_beacon_cmd, (u8 *)tx_beacon_cmd->frame,
+                        frame_size);
 
-        tx_beacon_cmd->tx.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK |
-                                     TX_CMD_FLG_TSF_MSK |
-                                     TX_CMD_FLG_STA_RATE_MSK;
+        /* Set up packet rate and flags */
+        rate = iwl_rate_get_lowest_plcp(priv);
+        priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant);
+        rate_flags = iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
+        if ((rate >= IWL_FIRST_CCK_RATE) && (rate <= IWL_LAST_CCK_RATE))
+                rate_flags |= RATE_MCS_CCK_MSK;
+        tx_beacon_cmd->tx.rate_n_flags = iwl_hw_set_rate_n_flags(rate,
+                        rate_flags);
 
         return sizeof(*tx_beacon_cmd) + frame_size;
 }
@@ -355,19 +400,20 @@ static int iwl_send_beacon_cmd(struct iwl_priv *priv)
         struct iwl_frame *frame;
         unsigned int frame_size;
         int rc;
-        u8 rate;
 
         frame = iwl_get_free_frame(priv);
-
         if (!frame) {
                 IWL_ERR(priv, "Could not obtain free frame buffer for beacon "
                           "command.\n");
                 return -ENOMEM;
         }
 
-        rate = iwl_rate_get_lowest_plcp(priv);
-
-        frame_size = iwl_hw_get_beacon_cmd(priv, frame, rate);
+        frame_size = iwl_hw_get_beacon_cmd(priv, frame);
+        if (!frame_size) {
+                IWL_ERR(priv, "Error configuring the beacon command\n");
+                iwl_free_frame(priv, frame);
+                return -EINVAL;
+        }
 
         rc = iwl_send_cmd_pdu(priv, REPLY_TX_BEACON, frame_size,
                               &frame->u.cmd[0]);
@@ -525,7 +571,7 @@ int iwl_hw_tx_queue_init(struct iwl_priv *priv,
 static void iwl_rx_reply_alive(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_alive_resp *palive;
         struct delayed_work *pwork;
 
@@ -604,14 +650,139 @@ static void iwl_bg_statistics_periodic(unsigned long data)
         if (!iwl_is_ready_rf(priv))
                 return;
 
-        iwl_send_statistics_request(priv, CMD_ASYNC);
+        iwl_send_statistics_request(priv, CMD_ASYNC, false);
+}
+
+
+static void iwl_print_cont_event_trace(struct iwl_priv *priv, u32 base,
+                                        u32 start_idx, u32 num_events,
+                                        u32 mode)
+{
+        u32 i;
+        u32 ptr;        /* SRAM byte address of log data */
+        u32 ev, time, data; /* event log data */
+        unsigned long reg_flags;
+
+        if (mode == 0)
+                ptr = base + (4 * sizeof(u32)) + (start_idx * 2 * sizeof(u32));
+        else
+                ptr = base + (4 * sizeof(u32)) + (start_idx * 3 * sizeof(u32));
+
+        /* Make sure device is powered up for SRAM reads */
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        if (iwl_grab_nic_access(priv)) {
+                spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+                return;
+        }
+
+        /* Set starting address; reads will auto-increment */
+        _iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR, ptr);
+        rmb();
+
+        /*
+         * "time" is actually "data" for mode 0 (no timestamp).
+         * place event id # at far right for easier visual parsing.
+         */
+        for (i = 0; i < num_events; i++) {
+                ev = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                time = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                if (mode == 0) {
+                        trace_iwlwifi_dev_ucode_cont_event(priv,
+                                                        0, time, ev);
+                } else {
+                        data = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                        trace_iwlwifi_dev_ucode_cont_event(priv,
+                                                time, data, ev);
+                }
+        }
+        /* Allow device to power down */
+        iwl_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+}
+
+static void iwl_continuous_event_trace(struct iwl_priv *priv)
+{
+        u32 capacity;   /* event log capacity in # entries */
+        u32 base;       /* SRAM byte address of event log header */
+        u32 mode;       /* 0 - no timestamp, 1 - timestamp recorded */
+        u32 num_wraps;  /* # times uCode wrapped to top of log */
+        u32 next_entry; /* index of next entry to be written by uCode */
+
+        if (priv->ucode_type == UCODE_INIT)
+                base = le32_to_cpu(priv->card_alive_init.error_event_table_ptr);
+        else
+                base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
+        if (priv->cfg->ops->lib->is_valid_rtc_data_addr(base)) {
+                capacity = iwl_read_targ_mem(priv, base);
+                num_wraps = iwl_read_targ_mem(priv, base + (2 * sizeof(u32)));
+                mode = iwl_read_targ_mem(priv, base + (1 * sizeof(u32)));
+                next_entry = iwl_read_targ_mem(priv, base + (3 * sizeof(u32)));
+        } else
+                return;
+
+        if (num_wraps == priv->event_log.num_wraps) {
+                iwl_print_cont_event_trace(priv,
+                                       base, priv->event_log.next_entry,
+                                       next_entry - priv->event_log.next_entry,
+                                       mode);
+                priv->event_log.non_wraps_count++;
+        } else {
+                if ((num_wraps - priv->event_log.num_wraps) > 1)
+                        priv->event_log.wraps_more_count++;
+                else
+                        priv->event_log.wraps_once_count++;
+                trace_iwlwifi_dev_ucode_wrap_event(priv,
+                                num_wraps - priv->event_log.num_wraps,
+                                next_entry, priv->event_log.next_entry);
+                if (next_entry < priv->event_log.next_entry) {
+                        iwl_print_cont_event_trace(priv, base,
+                               priv->event_log.next_entry,
+                               capacity - priv->event_log.next_entry,
+                               mode);
+
+                        iwl_print_cont_event_trace(priv, base, 0,
+                                next_entry, mode);
+                } else {
+                        iwl_print_cont_event_trace(priv, base,
+                               next_entry, capacity - next_entry,
+                               mode);
+
+                        iwl_print_cont_event_trace(priv, base, 0,
+                                next_entry, mode);
+                }
+        }
+        priv->event_log.num_wraps = num_wraps;
+        priv->event_log.next_entry = next_entry;
+}
+
+/**
+ * iwl_bg_ucode_trace - Timer callback to log ucode event
+ *
+ * The timer is continually set to execute every
+ * UCODE_TRACE_PERIOD milliseconds after the last timer expired
+ * this function is to perform continuous uCode event logging operation
+ * if enabled
+ */
+static void iwl_bg_ucode_trace(unsigned long data)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)data;
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        if (priv->event_log.ucode_trace) {
+                iwl_continuous_event_trace(priv);
+                /* Reschedule the timer to occur in UCODE_TRACE_PERIOD */
+                mod_timer(&priv->ucode_trace,
+                         jiffies + msecs_to_jiffies(UCODE_TRACE_PERIOD));
+        }
 }
 
 static void iwl_rx_beacon_notif(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl4965_beacon_notif *beacon =
                 (struct iwl4965_beacon_notif *)pkt->u.raw;
         u8 rate = iwl_hw_get_rate(beacon->beacon_notify_hdr.rate_n_flags);
@@ -635,16 +806,18 @@ static void iwl_rx_beacon_notif(struct iwl_priv *priv,
 static void iwl_rx_card_state_notif(struct iwl_priv *priv,
                                     struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u32 flags = le32_to_cpu(pkt->u.card_state_notif.flags);
         unsigned long status = priv->status;
 
-        IWL_DEBUG_RF_KILL(priv, "Card state received: HW:%s SW:%s\n",
+        IWL_DEBUG_RF_KILL(priv, "Card state received: HW:%s SW:%s CT:%s\n",
                           (flags & HW_CARD_DISABLED) ? "Kill" : "On",
-                          (flags & SW_CARD_DISABLED) ? "Kill" : "On");
+                          (flags & SW_CARD_DISABLED) ? "Kill" : "On",
+                          (flags & CT_CARD_DISABLED) ?
+                          "Reached" : "Not reached");
 
         if (flags & (SW_CARD_DISABLED | HW_CARD_DISABLED |
-                     RF_CARD_DISABLED)) {
+                     CT_CARD_DISABLED)) {
 
                 iwl_write32(priv, CSR_UCODE_DRV_GP1_SET,
                             CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
@@ -658,10 +831,10 @@ static void iwl_rx_card_state_notif(struct iwl_priv *priv,
                         iwl_write_direct32(priv, HBUS_TARG_MBX_C,
                                         HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED);
                 }
-                if (flags & RF_CARD_DISABLED)
+                if (flags & CT_CARD_DISABLED)
                         iwl_tt_enter_ct_kill(priv);
         }
-        if (!(flags & RF_CARD_DISABLED))
+        if (!(flags & CT_CARD_DISABLED))
                 iwl_tt_exit_ct_kill(priv);
 
         if (flags & HW_CARD_DISABLED)
@@ -711,6 +884,8 @@ static void iwl_setup_rx_handlers(struct iwl_priv *priv)
         priv->rx_handlers[REPLY_ALIVE] = iwl_rx_reply_alive;
         priv->rx_handlers[REPLY_ERROR] = iwl_rx_reply_error;
         priv->rx_handlers[CHANNEL_SWITCH_NOTIFICATION] = iwl_rx_csa;
+        priv->rx_handlers[SPECTRUM_MEASURE_NOTIFICATION] =
+                        iwl_rx_spectrum_measure_notif;
         priv->rx_handlers[PM_SLEEP_NOTIFICATION] = iwl_rx_pm_sleep_notif;
         priv->rx_handlers[PM_DEBUG_STATISTIC_NOTIFIC] =
             iwl_rx_pm_debug_statistics_notif;
@@ -721,10 +896,9 @@ static void iwl_setup_rx_handlers(struct iwl_priv *priv)
          * statistics request from the host as well as for the periodic
          * statistics notifications (after received beacons) from the uCode.
          */
-        priv->rx_handlers[REPLY_STATISTICS_CMD] = iwl_rx_statistics;
+        priv->rx_handlers[REPLY_STATISTICS_CMD] = iwl_reply_statistics;
         priv->rx_handlers[STATISTICS_NOTIFICATION] = iwl_rx_statistics;
 
-        iwl_setup_spectrum_handlers(priv);
         iwl_setup_rx_scan_handlers(priv);
 
         /* status change handler */
@@ -770,7 +944,7 @@ void iwl_rx_handle(struct iwl_priv *priv)
                 IWL_DEBUG_RX(priv, "r = %d, i = %d\n", r, i);
 
         /* calculate total frames need to be restock after handling RX */
-        total_empty = r - priv->rxq.write_actual;
+        total_empty = r - rxq->write_actual;
         if (total_empty < 0)
                 total_empty += RX_QUEUE_SIZE;
 
@@ -787,10 +961,13 @@ void iwl_rx_handle(struct iwl_priv *priv)
 
                 rxq->queue[i] = NULL;
 
-                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
-                                 priv->hw_params.rx_buf_size + 256,
-                                 PCI_DMA_FROMDEVICE);
-                pkt = (struct iwl_rx_packet *)rxb->skb->data;
+                pci_unmap_page(priv->pci_dev, rxb->page_dma,
+                               PAGE_SIZE << priv->hw_params.rx_page_order,
+                               PCI_DMA_FROMDEVICE);
+                pkt = rxb_addr(rxb);
+
+                trace_iwlwifi_dev_rx(priv, pkt,
+                        le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
 
                 /* Reclaim a command buffer only if this packet is a response
                  *   to a (driver-originated) command.
@@ -812,8 +989,8 @@ void iwl_rx_handle(struct iwl_priv *priv)
                 if (priv->rx_handlers[pkt->hdr.cmd]) {
                         IWL_DEBUG_RX(priv, "r = %d, i = %d, %s, 0x%02x\n", r,
                                 i, get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
-                        priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
                         priv->isr_stats.rx_handlers[pkt->hdr.cmd]++;
+                        priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
                 } else {
                         /* No handling needed */
                         IWL_DEBUG_RX(priv,
@@ -822,35 +999,45 @@ void iwl_rx_handle(struct iwl_priv *priv)
                                 pkt->hdr.cmd);
                 }
 
+                /*
+                 * XXX: After here, we should always check rxb->page
+                 * against NULL before touching it or its virtual
+                 * memory (pkt). Because some rx_handler might have
+                 * already taken or freed the pages.
+                 */
+
                 if (reclaim) {
-                        /* Invoke any callbacks, transfer the skb to caller, and
-                         * fire off the (possibly) blocking iwl_send_cmd()
+                        /* Invoke any callbacks, transfer the buffer to caller,
+                         * and fire off the (possibly) blocking iwl_send_cmd()
                          * as we reclaim the driver command queue */
-                        if (rxb && rxb->skb)
+                        if (rxb->page)
                                 iwl_tx_cmd_complete(priv, rxb);
                         else
                                 IWL_WARN(priv, "Claim null rxb?\n");
                 }
 
-                /* For now we just don't re-use anything.  We can tweak this
-                 * later to try and re-use notification packets and SKBs that
-                 * fail to Rx correctly */
-                if (rxb->skb != NULL) {
-                        priv->alloc_rxb_skb--;
-                        dev_kfree_skb_any(rxb->skb);
-                        rxb->skb = NULL;
-                }
-
+                /* Reuse the page if possible. For notification packets and
+                 * SKBs that fail to Rx correctly, add them back into the
+                 * rx_free list for reuse later. */
                 spin_lock_irqsave(&rxq->lock, flags);
-                list_add_tail(&rxb->list, &priv->rxq.rx_used);
+                if (rxb->page != NULL) {
+                        rxb->page_dma = pci_map_page(priv->pci_dev, rxb->page,
+                                0, PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        list_add_tail(&rxb->list, &rxq->rx_free);
+                        rxq->free_count++;
+                } else
+                        list_add_tail(&rxb->list, &rxq->rx_used);
+
                 spin_unlock_irqrestore(&rxq->lock, flags);
+
                 i = (i + 1) & RX_QUEUE_MASK;
                 /* If there are a lot of unused frames,
                  * restock the Rx queue so ucode wont assert. */
                 if (fill_rx) {
                         count++;
                         if (count >= 8) {
-                                priv->rxq.read = i;
+                                rxq->read = i;
                                 iwl_rx_replenish_now(priv);
                                 count = 0;
                         }
@@ -858,7 +1045,7 @@ void iwl_rx_handle(struct iwl_priv *priv)
         }
 
         /* Backtrack one entry */
-        priv->rxq.read = i;
+        rxq->read = i;
         if (fill_rx)
                 iwl_rx_replenish_now(priv);
         else
@@ -878,6 +1065,7 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
         u32 inta, handled = 0;
         u32 inta_fh;
         unsigned long flags;
+        u32 i;
 #ifdef CONFIG_IWLWIFI_DEBUG
         u32 inta_mask;
 #endif
@@ -905,6 +1093,8 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
         }
 #endif
 
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         /* Since CSR_INT and CSR_FH_INT_STATUS reads and clears are not
          * atomic, make sure that inta covers all the interrupts that
          * we've discovered, even if FH interrupt came in just after
@@ -926,8 +1116,6 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
 
                 handled |= CSR_INT_BIT_HW_ERR;
 
-                spin_unlock_irqrestore(&priv->lock, flags);
-
                 return;
         }
 
@@ -995,19 +1183,17 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
                 handled |= CSR_INT_BIT_SW_ERR;
         }
 
-        /* uCode wakes up after power-down sleep */
+        /*
+         * uCode wakes up after power-down sleep.
+         * Tell device about any new tx or host commands enqueued,
+         * and about any Rx buffers made available while asleep.
+         */
         if (inta & CSR_INT_BIT_WAKEUP) {
                 IWL_DEBUG_ISR(priv, "Wakeup interrupt\n");
                 iwl_rx_queue_update_write_ptr(priv, &priv->rxq);
-                iwl_txq_update_write_ptr(priv, &priv->txq[0]);
-                iwl_txq_update_write_ptr(priv, &priv->txq[1]);
-                iwl_txq_update_write_ptr(priv, &priv->txq[2]);
-                iwl_txq_update_write_ptr(priv, &priv->txq[3]);
-                iwl_txq_update_write_ptr(priv, &priv->txq[4]);
-                iwl_txq_update_write_ptr(priv, &priv->txq[5]);
-
+                for (i = 0; i < priv->hw_params.max_txq_num; i++)
+                        iwl_txq_update_write_ptr(priv, &priv->txq[i]);
                 priv->isr_stats.wakeup++;
-
                 handled |= CSR_INT_BIT_WAKEUP;
         }
 
@@ -1020,11 +1206,12 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
                 handled |= (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX);
         }
 
+        /* This "Tx" DMA channel is used only for loading uCode */
         if (inta & CSR_INT_BIT_FH_TX) {
-                IWL_DEBUG_ISR(priv, "Tx interrupt\n");
+                IWL_DEBUG_ISR(priv, "uCode load interrupt\n");
                 priv->isr_stats.tx++;
                 handled |= CSR_INT_BIT_FH_TX;
-                /* FH finished to write, send event */
+                /* Wake up uCode load routine, now that load is complete */
                 priv->ucode_write_complete = 1;
                 wake_up_interruptible(&priv->wait_command_queue);
         }
@@ -1054,7 +1241,6 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
                         "flags 0x%08lx\n", inta, inta_mask, inta_fh, flags);
         }
 #endif
-        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 /* tasklet for iwlagn interrupt */
@@ -1063,6 +1249,7 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         u32 inta = 0;
         u32 handled = 0;
         unsigned long flags;
+        u32 i;
 #ifdef CONFIG_IWLWIFI_DEBUG
         u32 inta_mask;
 #endif
@@ -1072,7 +1259,15 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         /* Ack/clear/reset pending uCode interrupts.
          * Note:  Some bits in CSR_INT are "OR" of bits in CSR_FH_INT_STATUS,
          */
-        iwl_write32(priv, CSR_INT, priv->inta);
+        /* There is a hardware bug in the interrupt mask function that some
+         * interrupts (i.e. CSR_INT_BIT_SCD) can still be generated even if
+         * they are disabled in the CSR_INT_MASK register. Furthermore the
+         * ICT interrupt handling mechanism has another bug that might cause
+         * these unmasked interrupts fail to be detected. We workaround the
+         * hardware bugs here by ACKing all the possible interrupts so that
+         * interrupt coalescing can still be achieved.
+         */
+        iwl_write32(priv, CSR_INT, priv->inta | ~priv->inta_mask);
 
         inta = priv->inta;
 
@@ -1084,6 +1279,9 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                                 inta, inta_mask);
         }
 #endif
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         /* saved interrupt in inta variable now we can reset priv->inta */
         priv->inta = 0;
 
@@ -1099,8 +1297,6 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
 
                 handled |= CSR_INT_BIT_HW_ERR;
 
-                spin_unlock_irqrestore(&priv->lock, flags);
-
                 return;
         }
 
@@ -1172,12 +1368,8 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         if (inta & CSR_INT_BIT_WAKEUP) {
                 IWL_DEBUG_ISR(priv, "Wakeup interrupt\n");
                 iwl_rx_queue_update_write_ptr(priv, &priv->rxq);
-                iwl_txq_update_write_ptr(priv, &priv->txq[0]);
-                iwl_txq_update_write_ptr(priv, &priv->txq[1]);
-                iwl_txq_update_write_ptr(priv, &priv->txq[2]);
-                iwl_txq_update_write_ptr(priv, &priv->txq[3]);
-                iwl_txq_update_write_ptr(priv, &priv->txq[4]);
-                iwl_txq_update_write_ptr(priv, &priv->txq[5]);
+                for (i = 0; i < priv->hw_params.max_txq_num; i++)
+                        iwl_txq_update_write_ptr(priv, &priv->txq[i]);
 
                 priv->isr_stats.wakeup++;
 
@@ -1206,26 +1398,36 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                  * 3- update RX shared data to indicate last write index.
                  * 4- send interrupt.
                  * This could lead to RX race, driver could receive RX interrupt
-                 * but the shared data changes does not reflect this.
-                 * this could lead to RX race, RX periodic will solve this race
+                 * but the shared data changes does not reflect this;
+                 * periodic interrupt will detect any dangling Rx activity.
                  */
-                iwl_write32(priv, CSR_INT_PERIODIC_REG,
+
+                /* Disable periodic interrupt; we use it as just a one-shot. */
+                iwl_write8(priv, CSR_INT_PERIODIC_REG,
                             CSR_INT_PERIODIC_DIS);
                 iwl_rx_handle(priv);
-                /* Only set RX periodic if real RX is received. */
+
+                /*
+                 * Enable periodic interrupt in 8 msec only if we received
+                 * real RX interrupt (instead of just periodic int), to catch
+                 * any dangling Rx interrupt.  If it was just the periodic
+                 * interrupt, there was no dangling Rx activity, and no need
+                 * to extend the periodic interrupt; one-shot is enough.
+                 */
                 if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX))
-                        iwl_write32(priv, CSR_INT_PERIODIC_REG,
+                        iwl_write8(priv, CSR_INT_PERIODIC_REG,
                                     CSR_INT_PERIODIC_ENA);
 
                 priv->isr_stats.rx++;
         }
 
+        /* This "Tx" DMA channel is used only for loading uCode */
         if (inta & CSR_INT_BIT_FH_TX) {
                 iwl_write32(priv, CSR_FH_INT_STATUS, CSR49_FH_INT_TX_MASK);
-                IWL_DEBUG_ISR(priv, "Tx interrupt\n");
+                IWL_DEBUG_ISR(priv, "uCode load interrupt\n");
                 priv->isr_stats.tx++;
                 handled |= CSR_INT_BIT_FH_TX;
-                /* FH finished to write, send event */
+                /* Wake up uCode load routine, now that load is complete */
                 priv->ucode_write_complete = 1;
                 wake_up_interruptible(&priv->wait_command_queue);
         }
@@ -1240,14 +1442,10 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                          inta & ~priv->inta_mask);
         }
 
-
         /* Re-enable all interrupts */
         /* only Re-enable if diabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_enable_interrupts(priv);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
 }
 
 
@@ -1274,59 +1472,66 @@ static void iwl_nic_start(struct iwl_priv *priv)
 }
 
 
+static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context);
+static int iwl_mac_setup_register(struct iwl_priv *priv);
+
+static int __must_check iwl_request_firmware(struct iwl_priv *priv, bool first)
+{
+        const char *name_pre = priv->cfg->fw_name_pre;
+
+        if (first)
+                priv->fw_index = priv->cfg->ucode_api_max;
+        else
+                priv->fw_index--;
+
+        if (priv->fw_index < priv->cfg->ucode_api_min) {
+                IWL_ERR(priv, "no suitable firmware found!\n");
+                return -ENOENT;
+        }
+
+        sprintf(priv->firmware_name, "%s%d%s",
+                name_pre, priv->fw_index, ".ucode");
+
+        IWL_DEBUG_INFO(priv, "attempting to load firmware '%s'\n",
+                       priv->firmware_name);
+
+        return request_firmware_nowait(THIS_MODULE, 1, priv->firmware_name,
+                                       &priv->pci_dev->dev, GFP_KERNEL, priv,
+                                       iwl_ucode_callback);
+}
+
 /**
- * iwl_read_ucode - Read uCode images from disk file.
+ * iwl_ucode_callback - callback when firmware was loaded
  *
- * Copy into buffers for card to fetch via bus-mastering
+ * If loaded successfully, copies the firmware into buffers
+ * for the card to fetch (via DMA).
  */
-static int iwl_read_ucode(struct iwl_priv *priv)
+static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
 {
+        struct iwl_priv *priv = context;
         struct iwl_ucode_header *ucode;
-        int ret = -EINVAL, index;
-        const struct firmware *ucode_raw;
-        const char *name_pre = priv->cfg->fw_name_pre;
         const unsigned int api_max = priv->cfg->ucode_api_max;
         const unsigned int api_min = priv->cfg->ucode_api_min;
-        char buf[25];
         u8 *src;
         size_t len;
         u32 api_ver, build;
         u32 inst_size, data_size, init_size, init_data_size, boot_size;
+        int err;
         u16 eeprom_ver;
 
-        /* Ask kernel firmware_class module to get the boot firmware off disk.
-         * request_firmware() is synchronous, file is in memory on return. */
-        for (index = api_max; index >= api_min; index--) {
-                sprintf(buf, "%s%d%s", name_pre, index, ".ucode");
-                ret = request_firmware(&ucode_raw, buf, &priv->pci_dev->dev);
-                if (ret < 0) {
-                        IWL_ERR(priv, "%s firmware file req failed: %d\n",
-                                  buf, ret);
-                        if (ret == -ENOENT)
-                                continue;
-                        else
-                                goto error;
-                } else {
-                        if (index < api_max)
-                                IWL_ERR(priv, "Loaded firmware %s, "
-                                        "which is deprecated. "
-                                        "Please use API v%u instead.\n",
-                                          buf, api_max);
-
-                        IWL_DEBUG_INFO(priv, "Got firmware '%s' file (%zd bytes) from disk\n",
-                                       buf, ucode_raw->size);
-                        break;
-                }
+        if (!ucode_raw) {
+                IWL_ERR(priv, "request for firmware file '%s' failed.\n",
+                        priv->firmware_name);
+                goto try_again;
         }
 
-        if (ret < 0)
-                goto error;
+        IWL_DEBUG_INFO(priv, "Loaded firmware file '%s' (%zd bytes).\n",
+                       priv->firmware_name, ucode_raw->size);
 
         /* Make sure that we got at least the v1 header! */
         if (ucode_raw->size < priv->cfg->ops->ucode->get_header_size(1)) {
                 IWL_ERR(priv, "File size way too small!\n");
-                ret = -EINVAL;
-                goto err_release;
+                goto try_again;
         }
 
         /* Data from ucode file:  header followed by uCode images */
@@ -1351,10 +1556,9 @@ static int iwl_read_ucode(struct iwl_priv *priv)
                 IWL_ERR(priv, "Driver unable to support your firmware API. "
                           "Driver supports v%u, firmware is v%u.\n",
                           api_max, api_ver);
-                priv->ucode_ver = 0;
-                ret = -EINVAL;
-                goto err_release;
+                goto try_again;
         }
+
         if (api_ver != api_max)
                 IWL_ERR(priv, "Firmware has old API version. Expected v%u, "
                           "got v%u. New firmware can be obtained "
@@ -1367,6 +1571,14 @@ static int iwl_read_ucode(struct iwl_priv *priv)
                IWL_UCODE_API(priv->ucode_ver),
                IWL_UCODE_SERIAL(priv->ucode_ver));
 
+        snprintf(priv->hw->wiphy->fw_version,
+                 sizeof(priv->hw->wiphy->fw_version),
+                 "%u.%u.%u.%u",
+                 IWL_UCODE_MAJOR(priv->ucode_ver),
+                 IWL_UCODE_MINOR(priv->ucode_ver),
+                 IWL_UCODE_API(priv->ucode_ver),
+                 IWL_UCODE_SERIAL(priv->ucode_ver));
+
         if (build)
                 IWL_DEBUG_INFO(priv, "Build %u\n", build);
 
@@ -1388,6 +1600,12 @@ static int iwl_read_ucode(struct iwl_priv *priv)
         IWL_DEBUG_INFO(priv, "f/w package hdr boot inst size = %u\n",
                        boot_size);
 
+        /*
+         * For any of the failures below (before allocating pci memory)
+         * we will try to load a version with a smaller API -- maybe the
+         * user just got a corrupted version of the latest API.
+         */
+
         /* Verify size of file vs. image size info in file's header */
         if (ucode_raw->size !=
                 priv->cfg->ops->ucode->get_header_size(api_ver) +
@@ -1397,41 +1615,35 @@ static int iwl_read_ucode(struct iwl_priv *priv)
                 IWL_DEBUG_INFO(priv,
                         "uCode file size %d does not match expected size\n",
                         (int)ucode_raw->size);
-                ret = -EINVAL;
-                goto err_release;
+                goto try_again;
         }
 
         /* Verify that uCode images will fit in card's SRAM */
         if (inst_size > priv->hw_params.max_inst_size) {
                 IWL_DEBUG_INFO(priv, "uCode instr len %d too large to fit in\n",
                                inst_size);
-                ret = -EINVAL;
-                goto err_release;
+                goto try_again;
         }
 
         if (data_size > priv->hw_params.max_data_size) {
                 IWL_DEBUG_INFO(priv, "uCode data len %d too large to fit in\n",
                                 data_size);
-                ret = -EINVAL;
-                goto err_release;
+                goto try_again;
         }
         if (init_size > priv->hw_params.max_inst_size) {
                 IWL_INFO(priv, "uCode init instr len %d too large to fit in\n",
                         init_size);
-                ret = -EINVAL;
-                goto err_release;
+                goto try_again;
         }
         if (init_data_size > priv->hw_params.max_data_size) {
                 IWL_INFO(priv, "uCode init data len %d too large to fit in\n",
                       init_data_size);
-                ret = -EINVAL;
-                goto err_release;
+                goto try_again;
         }
         if (boot_size > priv->hw_params.max_bsm_size) {
                 IWL_INFO(priv, "uCode boot instr len %d too large to fit in\n",
                         boot_size);
-                ret = -EINVAL;
-                goto err_release;
+                goto try_again;
         }
 
         /* Allocate ucode buffers for card's bus-master loading ... */
@@ -1515,23 +1727,38 @@ static int iwl_read_ucode(struct iwl_priv *priv)
         IWL_DEBUG_INFO(priv, "Copying (but not loading) boot instr len %Zd\n", len);
         memcpy(priv->ucode_boot.v_addr, src, len);
 
+        /**************************************************
+         * This is still part of probe() in a sense...
+         *
+         * 9. Setup and register with mac80211 and debugfs
+         **************************************************/
+        err = iwl_mac_setup_register(priv);
+        if (err)
+                goto out_unbind;
+
+        err = iwl_dbgfs_register(priv, DRV_NAME);
+        if (err)
+                IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
+
         /* We have our copies now, allow OS release its copies */
         release_firmware(ucode_raw);
-        return 0;
+        return;
+
+ try_again:
+        /* try next, if any */
+        if (iwl_request_firmware(priv, false))
+                goto out_unbind;
+        release_firmware(ucode_raw);
+        return;
 
  err_pci_alloc:
         IWL_ERR(priv, "failed to allocate pci memory\n");
-        ret = -ENOMEM;
         iwl_dealloc_ucode_pci(priv);
-
- err_release:
+ out_unbind:
+        device_release_driver(&priv->pci_dev->dev);
         release_firmware(ucode_raw);
-
- error:
-        return ret;
 }
 
-#ifdef CONFIG_IWLWIFI_DEBUG
 static const char *desc_lookup_text[] = {
         "OK",
         "FAIL",
@@ -1561,7 +1788,7 @@ static const char *desc_lookup_text[] = {
         "DEBUG_1",
         "DEBUG_2",
         "DEBUG_3",
-        "UNKNOWN"
+        "ADVANCED SYSASSERT"
 };
 
 static const char *desc_lookup(int i)
@@ -1589,7 +1816,9 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
                 base = le32_to_cpu(priv->card_alive.error_event_table_ptr);
 
         if (!priv->cfg->ops->lib->is_valid_rtc_data_addr(base)) {
-                IWL_ERR(priv, "Not valid error log pointer 0x%08X\n", base);
+                IWL_ERR(priv,
+                        "Not valid error log pointer 0x%08X for %s uCode\n",
+                        base, (priv->ucode_type == UCODE_INIT) ? "Init" : "RT");
                 return;
         }
 
@@ -1611,6 +1840,9 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
         line = iwl_read_targ_mem(priv, base + 9 * sizeof(u32));
         time = iwl_read_targ_mem(priv, base + 11 * sizeof(u32));
 
+        trace_iwlwifi_dev_ucode_error(priv, desc, time, data1, data2, line,
+                                      blink1, blink2, ilink1, ilink2);
+
         IWL_ERR(priv, "Desc                               Time       "
                 "data1      data2      line\n");
         IWL_ERR(priv, "%-28s (#%02d) %010u 0x%08X 0x%08X %u\n",
@@ -1627,17 +1859,19 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
  * iwl_print_event_log - Dump error event log to syslog
  *
  */
-static void iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
-                                u32 num_events, u32 mode)
+static int iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
+                               u32 num_events, u32 mode,
+                               int pos, char **buf, size_t bufsz)
 {
         u32 i;
         u32 base;       /* SRAM byte address of event log header */
         u32 event_size; /* 2 u32s, or 3 u32s if timestamp recorded */
         u32 ptr;        /* SRAM byte address of log data */
         u32 ev, time, data; /* event log data */
+        unsigned long reg_flags;
 
         if (num_events == 0)
-                return;
+                return pos;
         if (priv->ucode_type == UCODE_INIT)
                 base = le32_to_cpu(priv->card_alive_init.log_event_table_ptr);
         else
@@ -1650,26 +1884,95 @@ static void iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
 
         ptr = base + EVENT_START_OFFSET + (start_idx * event_size);
 
+        /* Make sure device is powered up for SRAM reads */
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        iwl_grab_nic_access(priv);
+
+        /* Set starting address; reads will auto-increment */
+        _iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR, ptr);
+        rmb();
+
         /* "time" is actually "data" for mode 0 (no timestamp).
         * place event id # at far right for easier visual parsing. */
         for (i = 0; i < num_events; i++) {
-                ev = iwl_read_targ_mem(priv, ptr);
-                ptr += sizeof(u32);
-                time = iwl_read_targ_mem(priv, ptr);
-                ptr += sizeof(u32);
+                ev = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                time = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
                 if (mode == 0) {
                         /* data, ev */
-                        IWL_ERR(priv, "EVT_LOG:0x%08x:%04u\n", time, ev);
+                        if (bufsz) {
+                                pos += scnprintf(*buf + pos, bufsz - pos,
+                                                "EVT_LOG:0x%08x:%04u\n",
+                                                time, ev);
+                        } else {
+                                trace_iwlwifi_dev_ucode_event(priv, 0,
+                                        time, ev);
+                                IWL_ERR(priv, "EVT_LOG:0x%08x:%04u\n",
+                                        time, ev);
+                        }
                 } else {
-                        data = iwl_read_targ_mem(priv, ptr);
-                        ptr += sizeof(u32);
-                        IWL_ERR(priv, "EVT_LOGT:%010u:0x%08x:%04u\n",
+                        data = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                        if (bufsz) {
+                                pos += scnprintf(*buf + pos, bufsz - pos,
+                                                "EVT_LOGT:%010u:0x%08x:%04u\n",
+                                                 time, data, ev);
+                        } else {
+                                IWL_ERR(priv, "EVT_LOGT:%010u:0x%08x:%04u\n",
                                         time, data, ev);
+                                trace_iwlwifi_dev_ucode_event(priv, time,
+                                        data, ev);
+                        }
+                }
+        }
+
+        /* Allow device to power down */
+        iwl_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+        return pos;
+}
+
+/**
+ * iwl_print_last_event_logs - Dump the newest # of event log to syslog
+ */
+static int iwl_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
+                                    u32 num_wraps, u32 next_entry,
+                                    u32 size, u32 mode,
+                                    int pos, char **buf, size_t bufsz)
+{
+        /*
+         * display the newest DEFAULT_LOG_ENTRIES entries
+         * i.e the entries just before the next ont that uCode would fill.
+         */
+        if (num_wraps) {
+                if (next_entry < size) {
+                        pos = iwl_print_event_log(priv,
+                                                capacity - (size - next_entry),
+                                                size - next_entry, mode,
+                                                pos, buf, bufsz);
+                        pos = iwl_print_event_log(priv, 0,
+                                                  next_entry, mode,
+                                                  pos, buf, bufsz);
+                } else
+                        pos = iwl_print_event_log(priv, next_entry - size,
+                                                  size, mode, pos, buf, bufsz);
+        } else {
+                if (next_entry < size) {
+                        pos = iwl_print_event_log(priv, 0, next_entry,
+                                                  mode, pos, buf, bufsz);
+                } else {
+                        pos = iwl_print_event_log(priv, next_entry - size,
+                                                  size, mode, pos, buf, bufsz);
                 }
         }
+        return pos;
 }
 
-void iwl_dump_nic_event_log(struct iwl_priv *priv)
+/* For sanity check only.  Actual size is determined by uCode, typ. 512 */
+#define MAX_EVENT_LOG_SIZE (512)
+
+#define DEFAULT_DUMP_EVENT_LOG_ENTRIES (20)
+
+int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
+                            char **buf, bool display)
 {
         u32 base;       /* SRAM byte address of event log header */
         u32 capacity;   /* event log capacity in # entries */
@@ -1677,6 +1980,8 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv)
         u32 num_wraps;  /* # times uCode wrapped to top of log */
         u32 next_entry; /* index of next entry to be written by uCode */
         u32 size;       /* # entries that we'll print */
+        int pos = 0;
+        size_t bufsz = 0;
 
         if (priv->ucode_type == UCODE_INIT)
                 base = le32_to_cpu(priv->card_alive_init.log_event_table_ptr);
@@ -1684,8 +1989,10 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv)
                 base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
 
         if (!priv->cfg->ops->lib->is_valid_rtc_data_addr(base)) {
-                IWL_ERR(priv, "Invalid event log pointer 0x%08X\n", base);
-                return;
+                IWL_ERR(priv,
+                        "Invalid event log pointer 0x%08X for %s uCode\n",
+                        base, (priv->ucode_type == UCODE_INIT) ? "Init" : "RT");
+                return -EINVAL;
         }
 
         /* event log header */
@@ -1694,27 +2001,71 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv)
         num_wraps = iwl_read_targ_mem(priv, base + (2 * sizeof(u32)));
         next_entry = iwl_read_targ_mem(priv, base + (3 * sizeof(u32)));
 
+        if (capacity > MAX_EVENT_LOG_SIZE) {
+                IWL_ERR(priv, "Log capacity %d is bogus, limit to %d entries\n",
+                        capacity, MAX_EVENT_LOG_SIZE);
+                capacity = MAX_EVENT_LOG_SIZE;
+        }
+
+        if (next_entry > MAX_EVENT_LOG_SIZE) {
+                IWL_ERR(priv, "Log write index %d is bogus, limit to %d\n",
+                        next_entry, MAX_EVENT_LOG_SIZE);
+                next_entry = MAX_EVENT_LOG_SIZE;
+        }
+
         size = num_wraps ? capacity : next_entry;
 
         /* bail out if nothing in log */
         if (size == 0) {
                 IWL_ERR(priv, "Start IWL Event Log Dump: nothing in log\n");
-                return;
+                return pos;
         }
 
-        IWL_ERR(priv, "Start IWL Event Log Dump: display count %d, wraps %d\n",
-                        size, num_wraps);
-
-        /* if uCode has wrapped back to top of log, start at the oldest entry,
-         * i.e the next one that uCode would fill. */
-        if (num_wraps)
-                iwl_print_event_log(priv, next_entry,
-                                        capacity - next_entry, mode);
-        /* (then/else) start at top of log */
-        iwl_print_event_log(priv, 0, next_entry, mode);
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (!(iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) && !full_log)
+                size = (size > DEFAULT_DUMP_EVENT_LOG_ENTRIES)
+                        ? DEFAULT_DUMP_EVENT_LOG_ENTRIES : size;
+#else
+        size = (size > DEFAULT_DUMP_EVENT_LOG_ENTRIES)
+                ? DEFAULT_DUMP_EVENT_LOG_ENTRIES : size;
+#endif
+        IWL_ERR(priv, "Start IWL Event Log Dump: display last %u entries\n",
+                size);
 
-}
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (display) {
+                if (full_log)
+                        bufsz = capacity * 48;
+                else
+                        bufsz = size * 48;
+                *buf = kmalloc(bufsz, GFP_KERNEL);
+                if (!*buf)
+                        return -ENOMEM;
+        }
+        if ((iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) || full_log) {
+                /*
+                 * if uCode has wrapped back to top of log,
+                 * start at the oldest entry,
+                 * i.e the next one that uCode would fill.
+                 */
+                if (num_wraps)
+                        pos = iwl_print_event_log(priv, next_entry,
+                                                capacity - next_entry, mode,
+                                                pos, buf, bufsz);
+                /* (then/else) start at top of log */
+                pos = iwl_print_event_log(priv, 0,
+                                          next_entry, mode, pos, buf, bufsz);
+        } else
+                pos = iwl_print_last_event_logs(priv, capacity, num_wraps,
+                                                next_entry, size, mode,
+                                                pos, buf, bufsz);
+#else
+        pos = iwl_print_last_event_logs(priv, capacity, num_wraps,
+                                        next_entry, size, mode,
+                                        pos, buf, bufsz);
 #endif
+        return pos;
+}
 
 /**
  * iwl_alive_start - called after REPLY_ALIVE notification received
@@ -1763,6 +2114,10 @@ static void iwl_alive_start(struct iwl_priv *priv)
         priv->active_rate = priv->rates_mask;
         priv->active_rate_basic = priv->rates_mask & IWL_BASIC_RATES_MASK;
 
+        /* Configure Tx antenna selection based on H/W config */
+        if (priv->cfg->ops->hcmd->set_tx_ant)
+                priv->cfg->ops->hcmd->set_tx_ant(priv, priv->cfg->valid_tx_ant);
+
         if (iwl_is_associated(priv)) {
                 struct iwl_rxon_cmd *active_rxon =
                                 (struct iwl_rxon_cmd *)&priv->active_rxon;
@@ -1790,7 +2145,7 @@ static void iwl_alive_start(struct iwl_priv *priv)
         /* At this point, the NIC is initialized and operational */
         iwl_rf_kill_ct_config(priv);
 
-        iwl_leds_register(priv);
+        iwl_leds_init(priv);
 
         IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
         set_bit(STATUS_READY, &priv->status);
@@ -1828,8 +2183,6 @@ static void __iwl_down(struct iwl_priv *priv)
         if (!exit_pending)
                 set_bit(STATUS_EXIT_PENDING, &priv->status);
 
-        iwl_leds_unregister(priv);
-
         iwl_clear_stations_table(priv);
 
         /* Unblock any waiting calls */
@@ -1877,24 +2230,20 @@ static void __iwl_down(struct iwl_priv *priv)
 
         /* device going down, Stop using ICT table */
         iwl_disable_ict(priv);
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_clear_bit(priv, CSR_GP_CNTRL,
-                         CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-        spin_unlock_irqrestore(&priv->lock, flags);
 
         iwl_txq_ctx_stop(priv);
         iwl_rxq_stop(priv);
 
-        iwl_write_prph(priv, APMG_CLK_DIS_REG,
-                                APMG_CLK_VAL_DMA_CLK_RQT);
-
+        /* Power-down device's busmaster DMA clocks */
+        iwl_write_prph(priv, APMG_CLK_DIS_REG, APMG_CLK_VAL_DMA_CLK_RQT);
         udelay(5);
 
-        /* FIXME: apm_ops.suspend(priv) */
-        if (exit_pending)
-                priv->cfg->ops->lib->apm_ops.stop(priv);
-        else
-                priv->cfg->ops->lib->apm_ops.reset(priv);
+        /* Make sure (redundant) we've released our request to stay awake */
+        iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+
+        /* Stop the device, and put it in low power state */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
+
  exit:
         memset(&priv->card_alive, 0, sizeof(struct iwl_alive_resp));
 
@@ -2121,18 +2470,6 @@ static void iwl_bg_run_time_calib_work(struct work_struct *work)
         return;
 }
 
-static void iwl_bg_up(struct work_struct *data)
-{
-        struct iwl_priv *priv = container_of(data, struct iwl_priv, up);
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        mutex_lock(&priv->mutex);
-        __iwl_up(priv);
-        mutex_unlock(&priv->mutex);
-}
-
 static void iwl_bg_restart(struct work_struct *data)
 {
         struct iwl_priv *priv = container_of(data, struct iwl_priv, restart);
@@ -2149,7 +2486,13 @@ static void iwl_bg_restart(struct work_struct *data)
                 ieee80211_restart_hw(priv->hw);
         } else {
                 iwl_down(priv);
-                queue_work(priv->workqueue, &priv->up);
+
+                if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                        return;
+
+                mutex_lock(&priv->mutex);
+                __iwl_up(priv);
+                mutex_unlock(&priv->mutex);
         }
 }
 
@@ -2281,6 +2624,71 @@ void iwl_post_associate(struct iwl_priv *priv)
 
 #define UCODE_READY_TIMEOUT     (4 * HZ)
 
+/*
+ * Not a mac80211 entry point function, but it fits in with all the
+ * other mac80211 functions grouped here.
+ */
+static int iwl_mac_setup_register(struct iwl_priv *priv)
+{
+        int ret;
+        struct ieee80211_hw *hw = priv->hw;
+        hw->rate_control_algorithm = "iwl-agn-rs";
+
+        /* Tell mac80211 our characteristics */
+        hw->flags = IEEE80211_HW_SIGNAL_DBM |
+                    IEEE80211_HW_NOISE_DBM |
+                    IEEE80211_HW_AMPDU_AGGREGATION |
+                    IEEE80211_HW_SPECTRUM_MGMT;
+
+        if (!priv->cfg->broken_powersave)
+                hw->flags |= IEEE80211_HW_SUPPORTS_PS |
+                             IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
+
+        if (priv->cfg->sku & IWL_SKU_N)
+                hw->flags |= IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
+                             IEEE80211_HW_SUPPORTS_STATIC_SMPS;
+
+        hw->sta_data_size = sizeof(struct iwl_station_priv);
+        hw->wiphy->interface_modes =
+                BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_ADHOC);
+
+        hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY |
+                            WIPHY_FLAG_DISABLE_BEACON_HINTS;
+
+        /*
+         * For now, disable PS by default because it affects
+         * RX performance significantly.
+         */
+        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
+        /* we create the 802.11 header and a zero-length SSID element */
+        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
+
+        /* Default value; 4 EDCA QOS priorities */
+        hw->queues = 4;
+
+        hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
+
+        if (priv->bands[IEEE80211_BAND_2GHZ].n_channels)
+                priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
+                        &priv->bands[IEEE80211_BAND_2GHZ];
+        if (priv->bands[IEEE80211_BAND_5GHZ].n_channels)
+                priv->hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
+                        &priv->bands[IEEE80211_BAND_5GHZ];
+
+        ret = ieee80211_register_hw(priv->hw);
+        if (ret) {
+                IWL_ERR(priv, "Failed to register hw (error %d)\n", ret);
+                return ret;
+        }
+        priv->mac80211_registered = 1;
+
+        return 0;
+}
+
+
 static int iwl_mac_start(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = hw->priv;
@@ -2290,21 +2698,7 @@ static int iwl_mac_start(struct ieee80211_hw *hw)
 
         /* we should be verifying the device is ready to be opened */
         mutex_lock(&priv->mutex);
-
-        /* fetch ucode file from disk, alloc and copy to bus-master buffers ...
-         * ucode filename and max sizes are card-specific. */
-
-        if (!priv->ucode_code.len) {
-                ret = iwl_read_ucode(priv);
-                if (ret) {
-                        IWL_ERR(priv, "Could not read microcode: %d\n", ret);
-                        mutex_unlock(&priv->mutex);
-                        return ret;
-                }
-        }
-
         ret = __iwl_up(priv);
-
         mutex_unlock(&priv->mutex);
 
         if (ret)
@@ -2328,6 +2722,8 @@ static int iwl_mac_start(struct ieee80211_hw *hw)
                 }
         }
 
+        iwl_led_start(priv);
+
 out:
         priv->is_open = 1;
         IWL_DEBUG_MAC80211(priv, "leave\n");
@@ -2404,6 +2800,10 @@ void iwl_config_ap(struct iwl_priv *priv)
                         IWL_WARN(priv, "REPLY_RXON_TIMING failed - "
                                         "Attempting to continue.\n");
 
+                /* AP has all antennas */
+                priv->chain_noise_data.active_chains =
+                        priv->hw_params.valid_rx_ant;
+                iwl_set_rxon_ht(priv, &priv->current_ht_config);
                 if (priv->cfg->ops->hcmd->set_rxon_chain)
                         priv->cfg->ops->hcmd->set_rxon_chain(priv);
 
@@ -2432,10 +2832,11 @@ void iwl_config_ap(struct iwl_priv *priv)
                 /* restore RXON assoc */
                 priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
                 iwlcore_commit_rxon(priv);
+                iwl_reset_qos(priv);
                 spin_lock_irqsave(&priv->lock, flags);
                 iwl_activate_qos(priv, 1);
                 spin_unlock_irqrestore(&priv->lock, flags);
-                iwl_rxon_add_station(priv, iwl_bcast_addr, 0);
+                iwl_add_bcast_station(priv);
         }
         iwl_send_beacon_cmd(priv);
 
@@ -2445,14 +2846,18 @@ void iwl_config_ap(struct iwl_priv *priv)
 }
 
 static void iwl_mac_update_tkip_key(struct ieee80211_hw *hw,
-                        struct ieee80211_key_conf *keyconf, const u8 *addr,
-                        u32 iv32, u16 *phase1key)
+                                    struct ieee80211_vif *vif,
+                                    struct ieee80211_key_conf *keyconf,
+                                    struct ieee80211_sta *sta,
+                                    u32 iv32, u16 *phase1key)
 {
 
         struct iwl_priv *priv = hw->priv;
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
-        iwl_update_tkip_key(priv, keyconf, addr, iv32, phase1key);
+        iwl_update_tkip_key(priv, keyconf,
+                            sta ? sta->addr : iwl_bcast_addr,
+                            iv32, phase1key);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
@@ -2527,6 +2932,7 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 }
 
 static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
                              enum ieee80211_ampdu_mlme_action action,
                              struct ieee80211_sta *sta, u16 tid, u16 *ssn)
 {
@@ -2560,6 +2966,9 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
                         return 0;
                 else
                         return ret;
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
+                /* do nothing */
+                return -EOPNOTSUPP;
         default:
                 IWL_DEBUG_HT(priv, "unknown\n");
                 return -EINVAL;
@@ -2580,6 +2989,47 @@ static int iwl_mac_get_stats(struct ieee80211_hw *hw,
         return 0;
 }
 
+static void iwl_mac_sta_notify(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               enum sta_notify_cmd cmd,
+                               struct ieee80211_sta *sta)
+{
+        struct iwl_priv *priv = hw->priv;
+        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+        int sta_id;
+
+        /*
+         * TODO: We really should use this callback to
+         *       actually maintain the station table in
+         *       the device.
+         */
+
+        switch (cmd) {
+        case STA_NOTIFY_ADD:
+                atomic_set(&sta_priv->pending_frames, 0);
+                if (vif->type == NL80211_IFTYPE_AP)
+                        sta_priv->client = true;
+                break;
+        case STA_NOTIFY_SLEEP:
+                WARN_ON(!sta_priv->client);
+                sta_priv->asleep = true;
+                if (atomic_read(&sta_priv->pending_frames) > 0)
+                        ieee80211_sta_block_awake(hw, sta, true);
+                break;
+        case STA_NOTIFY_AWAKE:
+                WARN_ON(!sta_priv->client);
+                if (!sta_priv->asleep)
+                        break;
+                sta_priv->asleep = false;
+                sta_id = iwl_find_station(priv, sta->addr);
+                if (sta_id != IWL_INVALID_STATION)
+                        iwl_sta_modify_ps_wake(priv, sta_id);
+                break;
+        default:
+                break;
+        }
+}
+
 /*****************************************************************************
  *
  * sysfs attributes
@@ -2774,7 +3224,7 @@ static ssize_t show_statistics(struct device *d,
                 return -EAGAIN;
 
         mutex_lock(&priv->mutex);
-        rc = iwl_send_statistics_request(priv, 0);
+        rc = iwl_send_statistics_request(priv, CMD_SYNC, false);
         mutex_unlock(&priv->mutex);
 
         if (rc) {
@@ -2799,6 +3249,40 @@ static ssize_t show_statistics(struct device *d,
 
 static DEVICE_ATTR(statistics, S_IRUGO, show_statistics, NULL);
 
+static ssize_t show_rts_ht_protection(struct device *d,
+                             struct device_attribute *attr, char *buf)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+
+        return sprintf(buf, "%s\n",
+                priv->cfg->use_rts_for_ht ? "RTS/CTS" : "CTS-to-self");
+}
+
+static ssize_t store_rts_ht_protection(struct device *d,
+                              struct device_attribute *attr,
+                              const char *buf, size_t count)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        unsigned long val;
+        int ret;
+
+        ret = strict_strtoul(buf, 10, &val);
+        if (ret)
+                IWL_INFO(priv, "Input is not in decimal form.\n");
+        else {
+                if (!iwl_is_associated(priv))
+                        priv->cfg->use_rts_for_ht = val ? true : false;
+                else
+                        IWL_ERR(priv, "Sta associated with AP - "
+                                "Change protection mechanism is not allowed\n");
+                ret = count;
+        }
+        return ret;
+}
+
+static DEVICE_ATTR(rts_ht_protection, S_IWUSR | S_IRUGO,
+                        show_rts_ht_protection, store_rts_ht_protection);
+
 
 /*****************************************************************************
  *
@@ -2812,7 +3296,6 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
 
         init_waitqueue_head(&priv->wait_command_queue);
 
-        INIT_WORK(&priv->up, iwl_bg_up);
         INIT_WORK(&priv->restart, iwl_bg_restart);
         INIT_WORK(&priv->rx_replenish, iwl_bg_rx_replenish);
         INIT_WORK(&priv->beacon_update, iwl_bg_beacon_update);
@@ -2829,6 +3312,10 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
         priv->statistics_periodic.data = (unsigned long)priv;
         priv->statistics_periodic.function = iwl_bg_statistics_periodic;
 
+        init_timer(&priv->ucode_trace);
+        priv->ucode_trace.data = (unsigned long)priv;
+        priv->ucode_trace.function = iwl_bg_ucode_trace;
+
         if (!priv->cfg->use_isr_legacy)
                 tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
                         iwl_irq_tasklet, (unsigned long)priv);
@@ -2844,9 +3331,109 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 
         cancel_delayed_work_sync(&priv->init_alive_start);
         cancel_delayed_work(&priv->scan_check);
+        cancel_work_sync(&priv->start_internal_scan);
         cancel_delayed_work(&priv->alive_start);
         cancel_work_sync(&priv->beacon_update);
         del_timer_sync(&priv->statistics_periodic);
+        del_timer_sync(&priv->ucode_trace);
+}
+
+static void iwl_init_hw_rates(struct iwl_priv *priv,
+                              struct ieee80211_rate *rates)
+{
+        int i;
+
+        for (i = 0; i < IWL_RATE_COUNT_LEGACY; i++) {
+                rates[i].bitrate = iwl_rates[i].ieee * 5;
+                rates[i].hw_value = i; /* Rate scaling will work on indexes */
+                rates[i].hw_value_short = i;
+                rates[i].flags = 0;
+                if ((i >= IWL_FIRST_CCK_RATE) && (i <= IWL_LAST_CCK_RATE)) {
+                        /*
+                         * If CCK != 1M then set short preamble rate flag.
+                         */
+                        rates[i].flags |=
+                                (iwl_rates[i].plcp == IWL_RATE_1M_PLCP) ?
+                                        0 : IEEE80211_RATE_SHORT_PREAMBLE;
+                }
+        }
+}
+
+static int iwl_init_drv(struct iwl_priv *priv)
+{
+        int ret;
+
+        priv->ibss_beacon = NULL;
+
+        spin_lock_init(&priv->sta_lock);
+        spin_lock_init(&priv->hcmd_lock);
+
+        INIT_LIST_HEAD(&priv->free_frames);
+
+        mutex_init(&priv->mutex);
+        mutex_init(&priv->sync_cmd_mutex);
+
+        /* Clear the driver's (not device's) station table */
+        iwl_clear_stations_table(priv);
+
+        priv->ieee_channels = NULL;
+        priv->ieee_rates = NULL;
+        priv->band = IEEE80211_BAND_2GHZ;
+
+        priv->iw_mode = NL80211_IFTYPE_STATION;
+        priv->current_ht_config.smps = IEEE80211_SMPS_STATIC;
+        priv->missed_beacon_threshold = IWL_MISSED_BEACON_THRESHOLD_DEF;
+
+        /* initialize force reset */
+        priv->force_reset[IWL_RF_RESET].reset_duration =
+                IWL_DELAY_NEXT_FORCE_RF_RESET;
+        priv->force_reset[IWL_FW_RESET].reset_duration =
+                IWL_DELAY_NEXT_FORCE_FW_RELOAD;
+
+        /* Choose which receivers/antennas to use */
+        if (priv->cfg->ops->hcmd->set_rxon_chain)
+                priv->cfg->ops->hcmd->set_rxon_chain(priv);
+
+        iwl_init_scan_params(priv);
+
+        iwl_reset_qos(priv);
+
+        priv->qos_data.qos_active = 0;
+        priv->qos_data.qos_cap.val = 0;
+
+        priv->rates_mask = IWL_RATES_MASK;
+        /* Set the tx_power_user_lmt to the lowest power level
+         * this value will get overwritten by channel max power avg
+         * from eeprom */
+        priv->tx_power_user_lmt = IWL_TX_POWER_TARGET_POWER_MIN;
+
+        ret = iwl_init_channel_map(priv);
+        if (ret) {
+                IWL_ERR(priv, "initializing regulatory failed: %d\n", ret);
+                goto err;
+        }
+
+        ret = iwlcore_init_geos(priv);
+        if (ret) {
+                IWL_ERR(priv, "initializing geos failed: %d\n", ret);
+                goto err_free_channel_map;
+        }
+        iwl_init_hw_rates(priv, priv->ieee_rates);
+
+        return 0;
+
+err_free_channel_map:
+        iwl_free_channel_map(priv);
+err:
+        return ret;
+}
+
+static void iwl_uninit_drv(struct iwl_priv *priv)
+{
+        iwl_calib_free_results(priv);
+        iwlcore_free_geos(priv);
+        iwl_free_channel_map(priv);
+        kfree(priv->scan);
 }
 
 static struct attribute *iwl_sysfs_entries[] = {
@@ -2855,6 +3442,7 @@ static struct attribute *iwl_sysfs_entries[] = {
         &dev_attr_statistics.attr,
         &dev_attr_temperature.attr,
         &dev_attr_tx_power.attr,
+        &dev_attr_rts_ht_protection.attr,
 #ifdef CONFIG_IWLWIFI_DEBUG
         &dev_attr_debug_level.attr,
 #endif
@@ -2877,12 +3465,12 @@ static struct ieee80211_ops iwl_hw_ops = {
         .set_key = iwl_mac_set_key,
         .update_tkip_key = iwl_mac_update_tkip_key,
         .get_stats = iwl_mac_get_stats,
-        .get_tx_stats = iwl_mac_get_tx_stats,
         .conf_tx = iwl_mac_conf_tx,
         .reset_tsf = iwl_mac_reset_tsf,
         .bss_info_changed = iwl_bss_info_changed,
         .ampdu_action = iwl_mac_ampdu_action,
-        .hw_scan = iwl_mac_hw_scan
+        .hw_scan = iwl_mac_hw_scan,
+        .sta_notify = iwl_mac_sta_notify,
 };
 
 static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
@@ -2972,10 +3560,19 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 (unsigned long long) pci_resource_len(pdev, 0));
         IWL_DEBUG_INFO(priv, "pci_resource_base = %p\n", priv->hw_base);
 
-        /* this spin lock will be used in apm_ops.init and EEPROM access
+        /* these spin locks will be used in apm_ops.init and EEPROM access
          * we should init now
          */
         spin_lock_init(&priv->reg_lock);
+        spin_lock_init(&priv->lock);
+
+        /*
+         * stop and reset the on-board processor just in case it is in a
+         * strange state ... like being left stranded by a primary kernel
+         * and this is now the kdump kernel trying to start up
+         */
+        iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
+
         iwl_hw_detect(priv);
         IWL_INFO(priv, "Detected Intel Wireless WiFi Link %s REV=0x%X\n",
                 priv->cfg->name, priv->hw_rev);
@@ -2990,12 +3587,6 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto out_iounmap;
         }
 
-        /* amp init */
-        err = priv->cfg->ops->lib->apm_ops.init(priv);
-        if (err < 0) {
-                IWL_ERR(priv, "Failed to init APMG\n");
-                goto out_iounmap;
-        }
         /*****************
          * 4. Read EEPROM
          *****************/
@@ -3056,9 +3647,9 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         iwl_setup_deferred_work(priv);
         iwl_setup_rx_handlers(priv);
 
-        /**********************************
-         * 8. Setup and register mac80211
-         **********************************/
+        /*********************************************
+         * 8. Enable interrupts and read RFKILL state
+         *********************************************/
 
         /* enable interrupts if needed: hw bug w/a */
         pci_read_config_word(priv->pci_dev, PCI_COMMAND, &pci_cmd);
@@ -3069,14 +3660,6 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         iwl_enable_interrupts(priv);
 
-        err = iwl_setup_mac(priv);
-        if (err)
-                goto out_remove_sysfs;
-
-        err = iwl_dbgfs_register(priv, DRV_NAME);
-        if (err)
-                IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
-
         /* If platform's RF_KILL switch is NOT set to KILL */
         if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
                 clear_bit(STATUS_RF_KILL_HW, &priv->status);
@@ -3088,6 +3671,11 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         iwl_power_initialize(priv);
         iwl_tt_initialize(priv);
+
+        err = iwl_request_firmware(priv, true);
+        if (err)
+                goto out_remove_sysfs;
+
         return 0;
 
  out_remove_sysfs:
@@ -3141,6 +3729,15 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
                 iwl_down(priv);
         }
 
+        /*
+         * Make sure device is reset to low power before unloading driver.
+         * This may be redundant with iwl_down(), but there are paths to
+         * run iwl_down() without calling apm_ops.stop(), and there are
+         * paths to avoid running iwl_down() at all before leaving driver.
+         * This (inexpensive) call *makes sure* device is reset.
+         */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
+
         iwl_tt_exit(priv);
 
         /* make sure we flush any pending irq or
@@ -3197,43 +3794,103 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
  *****************************************************************************/
 
 /* Hardware specific file defines the PCI IDs table for that hardware module */
-static struct pci_device_id iwl_hw_card_ids[] = {
+static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 #ifdef CONFIG_IWL4965
         {IWL_PCI_DEVICE(0x4229, PCI_ANY_ID, iwl4965_agn_cfg)},
         {IWL_PCI_DEVICE(0x4230, PCI_ANY_ID, iwl4965_agn_cfg)},
 #endif /* CONFIG_IWL4965 */
 #ifdef CONFIG_IWL5000
-        {IWL_PCI_DEVICE(0x4232, 0x1205, iwl5100_bg_cfg)},
-        {IWL_PCI_DEVICE(0x4232, 0x1305, iwl5100_bg_cfg)},
-        {IWL_PCI_DEVICE(0x4232, 0x1206, iwl5100_abg_cfg)},
-        {IWL_PCI_DEVICE(0x4232, 0x1306, iwl5100_abg_cfg)},
-        {IWL_PCI_DEVICE(0x4232, 0x1326, iwl5100_abg_cfg)},
-        {IWL_PCI_DEVICE(0x4237, 0x1216, iwl5100_abg_cfg)},
-        {IWL_PCI_DEVICE(0x4232, PCI_ANY_ID, iwl5100_agn_cfg)},
-        {IWL_PCI_DEVICE(0x4235, PCI_ANY_ID, iwl5300_agn_cfg)},
-        {IWL_PCI_DEVICE(0x4236, PCI_ANY_ID, iwl5300_agn_cfg)},
-        {IWL_PCI_DEVICE(0x4237, PCI_ANY_ID, iwl5100_agn_cfg)},
-/* 5350 WiFi/WiMax */
-        {IWL_PCI_DEVICE(0x423A, 0x1001, iwl5350_agn_cfg)},
-        {IWL_PCI_DEVICE(0x423A, 0x1021, iwl5350_agn_cfg)},
-        {IWL_PCI_DEVICE(0x423B, 0x1011, iwl5350_agn_cfg)},
-/* 5150 Wifi/WiMax */
-        {IWL_PCI_DEVICE(0x423C, PCI_ANY_ID, iwl5150_agn_cfg)},
-        {IWL_PCI_DEVICE(0x423D, PCI_ANY_ID, iwl5150_agn_cfg)},
-/* 6000/6050 Series */
-        {IWL_PCI_DEVICE(0x008D, PCI_ANY_ID, iwl6000h_2agn_cfg)},
-        {IWL_PCI_DEVICE(0x008E, PCI_ANY_ID, iwl6000h_2agn_cfg)},
-        {IWL_PCI_DEVICE(0x422B, PCI_ANY_ID, iwl6000_3agn_cfg)},
-        {IWL_PCI_DEVICE(0x422C, PCI_ANY_ID, iwl6000i_2agn_cfg)},
-        {IWL_PCI_DEVICE(0x4238, PCI_ANY_ID, iwl6000_3agn_cfg)},
-        {IWL_PCI_DEVICE(0x4239, PCI_ANY_ID, iwl6000i_2agn_cfg)},
-        {IWL_PCI_DEVICE(0x0086, PCI_ANY_ID, iwl6050_3agn_cfg)},
-        {IWL_PCI_DEVICE(0x0087, PCI_ANY_ID, iwl6050_2agn_cfg)},
-        {IWL_PCI_DEVICE(0x0088, PCI_ANY_ID, iwl6050_3agn_cfg)},
-        {IWL_PCI_DEVICE(0x0089, PCI_ANY_ID, iwl6050_2agn_cfg)},
+/* 5100 Series WiFi */
+        {IWL_PCI_DEVICE(0x4232, 0x1201, iwl5100_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1301, iwl5100_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1204, iwl5100_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1304, iwl5100_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1205, iwl5100_bgn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1305, iwl5100_bgn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1206, iwl5100_abg_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1306, iwl5100_abg_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1221, iwl5100_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1321, iwl5100_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1224, iwl5100_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1324, iwl5100_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1225, iwl5100_bgn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1325, iwl5100_bgn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1226, iwl5100_abg_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4232, 0x1326, iwl5100_abg_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4237, 0x1211, iwl5100_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4237, 0x1311, iwl5100_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4237, 0x1214, iwl5100_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4237, 0x1314, iwl5100_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4237, 0x1215, iwl5100_bgn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4237, 0x1315, iwl5100_bgn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4237, 0x1216, iwl5100_abg_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4237, 0x1316, iwl5100_abg_cfg)}, /* Half Mini Card */
+
+/* 5300 Series WiFi */
+        {IWL_PCI_DEVICE(0x4235, 0x1021, iwl5300_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4235, 0x1121, iwl5300_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4235, 0x1024, iwl5300_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4235, 0x1124, iwl5300_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4235, 0x1001, iwl5300_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4235, 0x1101, iwl5300_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4235, 0x1004, iwl5300_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4235, 0x1104, iwl5300_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4236, 0x1011, iwl5300_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4236, 0x1111, iwl5300_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x4236, 0x1014, iwl5300_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x4236, 0x1114, iwl5300_agn_cfg)}, /* Half Mini Card */
+
+/* 5350 Series WiFi/WiMax */
+        {IWL_PCI_DEVICE(0x423A, 0x1001, iwl5350_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x423A, 0x1021, iwl5350_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x423B, 0x1011, iwl5350_agn_cfg)}, /* Mini Card */
+
+/* 5150 Series Wifi/WiMax */
+        {IWL_PCI_DEVICE(0x423C, 0x1201, iwl5150_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x423C, 0x1301, iwl5150_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x423C, 0x1206, iwl5150_abg_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x423C, 0x1306, iwl5150_abg_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x423C, 0x1221, iwl5150_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x423C, 0x1321, iwl5150_agn_cfg)}, /* Half Mini Card */
+
+        {IWL_PCI_DEVICE(0x423D, 0x1211, iwl5150_agn_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x423D, 0x1311, iwl5150_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x423D, 0x1216, iwl5150_abg_cfg)}, /* Mini Card */
+        {IWL_PCI_DEVICE(0x423D, 0x1316, iwl5150_abg_cfg)}, /* Half Mini Card */
+
+/* 6x00 Series */
+        {IWL_PCI_DEVICE(0x422B, 0x1101, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422B, 0x1121, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422C, 0x1301, iwl6000i_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x422C, 0x1306, iwl6000i_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x422C, 0x1307, iwl6000i_2bg_cfg)},
+        {IWL_PCI_DEVICE(0x422C, 0x1321, iwl6000i_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x422C, 0x1326, iwl6000i_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x4238, 0x1111, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x4239, 0x1311, iwl6000i_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x4239, 0x1316, iwl6000i_2abg_cfg)},
+
+/* 6x50 WiFi/WiMax Series */
+        {IWL_PCI_DEVICE(0x0087, 0x1301, iwl6050_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0087, 0x1306, iwl6050_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0087, 0x1321, iwl6050_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0087, 0x1326, iwl6050_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0089, 0x1311, iwl6050_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0089, 0x1316, iwl6050_2abg_cfg)},
+
 /* 1000 Series WiFi */
-        {IWL_PCI_DEVICE(0x0083, PCI_ANY_ID, iwl1000_bgn_cfg)},
-        {IWL_PCI_DEVICE(0x0084, PCI_ANY_ID, iwl1000_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0083, 0x1205, iwl1000_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0083, 0x1305, iwl1000_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0083, 0x1225, iwl1000_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0083, 0x1325, iwl1000_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0084, 0x1215, iwl1000_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0084, 0x1315, iwl1000_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0083, 0x1206, iwl1000_bg_cfg)},
+        {IWL_PCI_DEVICE(0x0083, 0x1306, iwl1000_bg_cfg)},
+        {IWL_PCI_DEVICE(0x0083, 0x1226, iwl1000_bg_cfg)},
+        {IWL_PCI_DEVICE(0x0083, 0x1326, iwl1000_bg_cfg)},
+        {IWL_PCI_DEVICE(0x0084, 0x1216, iwl1000_bg_cfg)},
+        {IWL_PCI_DEVICE(0x0084, 0x1316, iwl1000_bg_cfg)},
 #endif /* CONFIG_IWL5000 */
 
         {0}
@@ -3288,9 +3945,9 @@ module_exit(iwl_exit);
 module_init(iwl_init);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-module_param_named(debug50, iwl_debug_level, uint, 0444);
+module_param_named(debug50, iwl_debug_level, uint, S_IRUGO);
 MODULE_PARM_DESC(debug50, "50XX debug output mask (deprecated)");
-module_param_named(debug, iwl_debug_level, uint, 0644);
+module_param_named(debug, iwl_debug_level, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "debug output mask");
 #endif
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index c4b565a2de94..8b516c5ff0bb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -60,6 +60,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *****************************************************************************/
 
+#include <linux/slab.h>
 #include <net/mac80211.h>
 
 #include "iwl-dev.h"
@@ -132,6 +133,7 @@ void iwl_calib_free_results(struct iwl_priv *priv)
                 priv->calib_results[i].buf_len = 0;
         }
 }
+EXPORT_SYMBOL(iwl_calib_free_results);
 
 /*****************************************************************************
  * RUNTIME calibrations framework
@@ -413,7 +415,6 @@ static int iwl_sens_auto_corr_ofdm(struct iwl_priv *priv,
 /* Prepare a SENSITIVITY_CMD, send to uCode if values have changed */
 static int iwl_sensitivity_write(struct iwl_priv *priv)
 {
-        int ret = 0;
         struct iwl_sensitivity_cmd cmd ;
         struct iwl_sensitivity_data *data = NULL;
         struct iwl_host_cmd cmd_out = {
@@ -447,11 +448,11 @@ static int iwl_sensitivity_write(struct iwl_priv *priv)
                                 cpu_to_le16((u16)data->nrg_th_ofdm);
 
         cmd.table[HD_BARKER_CORR_TH_ADD_MIN_INDEX] =
-                                cpu_to_le16(190);
+                                cpu_to_le16(data->barker_corr_th_min);
         cmd.table[HD_BARKER_CORR_TH_ADD_MIN_MRC_INDEX] =
-                                cpu_to_le16(390);
+                                cpu_to_le16(data->barker_corr_th_min_mrc);
         cmd.table[HD_OFDM_ENERGY_TH_IN_INDEX] =
-                                cpu_to_le16(62);
+                                cpu_to_le16(data->nrg_th_cca);
 
         IWL_DEBUG_CALIB(priv, "ofdm: ac %u mrc %u x1 %u mrc_x1 %u thresh %u\n",
                         data->auto_corr_ofdm, data->auto_corr_ofdm_mrc,
@@ -476,11 +477,7 @@ static int iwl_sensitivity_write(struct iwl_priv *priv)
         memcpy(&(priv->sensitivity_tbl[0]), &(cmd.table[0]),
                sizeof(u16)*HD_TABLE_SIZE);
 
-        ret = iwl_send_cmd(priv, &cmd_out);
-        if (ret)
-                IWL_ERR(priv, "SENSITIVITY_CMD failed\n");
-
-        return ret;
+        return iwl_send_cmd(priv, &cmd_out);
 }
 
 void iwl_init_sensitivity(struct iwl_priv *priv)
@@ -516,7 +513,7 @@ void iwl_init_sensitivity(struct iwl_priv *priv)
         for (i = 0; i < NRG_NUM_PREV_STAT_L; i++)
                 data->nrg_silence_rssi[i] = 0;
 
-        data->auto_corr_ofdm = 90;
+        data->auto_corr_ofdm =  ranges->auto_corr_min_ofdm;
         data->auto_corr_ofdm_mrc = ranges->auto_corr_min_ofdm_mrc;
         data->auto_corr_ofdm_x1  = ranges->auto_corr_min_ofdm_x1;
         data->auto_corr_ofdm_mrc_x1 = ranges->auto_corr_min_ofdm_mrc_x1;
@@ -524,6 +521,9 @@ void iwl_init_sensitivity(struct iwl_priv *priv)
         data->auto_corr_cck_mrc = ranges->auto_corr_min_cck_mrc;
         data->nrg_th_cck = ranges->nrg_th_cck;
         data->nrg_th_ofdm = ranges->nrg_th_ofdm;
+        data->barker_corr_th_min = ranges->barker_corr_th_min;
+        data->barker_corr_th_min_mrc = ranges->barker_corr_th_min_mrc;
+        data->nrg_th_cca = ranges->nrg_th_cca;
 
         data->last_bad_plcp_cnt_ofdm = 0;
         data->last_fa_cnt_ofdm = 0;
@@ -643,6 +643,15 @@ void iwl_sensitivity_calibration(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_sensitivity_calibration);
 
+static inline u8 find_first_chain(u8 mask)
+{
+        if (mask & ANT_A)
+                return CHAIN_A;
+        if (mask & ANT_B)
+                return CHAIN_B;
+        return CHAIN_C;
+}
+
 /*
  * Accumulate 20 beacons of signal and noise statistics for each of
  *   3 receivers/antennas/rx-chains, then figure out:
@@ -675,14 +684,17 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
         u8 num_tx_chains;
         unsigned long flags;
         struct statistics_rx_non_phy *rx_info = &(stat_resp->rx.general);
+        u8 first_chain;
 
         if (priv->disable_chain_noise_cal)
                 return;
 
         data = &(priv->chain_noise_data);
 
-        /* Accumulate just the first 20 beacons after the first association,
-         *   then we're done forever. */
+        /*
+         * Accumulate just the first "chain_noise_num_beacons" after
+         * the first association, then we're done forever.
+         */
         if (data->state != IWL_CHAIN_NOISE_ACCUMULATE) {
                 if (data->state == IWL_CHAIN_NOISE_ALIVE)
                         IWL_DEBUG_CALIB(priv, "Wait for noise calib reset\n");
@@ -710,7 +722,10 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
                 return;
         }
 
-        /* Accumulate beacon statistics values across 20 beacons */
+        /*
+         *  Accumulate beacon statistics values across
+         * "chain_noise_num_beacons"
+         */
         chain_noise_a = le32_to_cpu(rx_info->beacon_silence_rssi_a) &
                                 IN_BAND_FILTER;
         chain_noise_b = le32_to_cpu(rx_info->beacon_silence_rssi_b) &
@@ -741,16 +756,19 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
         IWL_DEBUG_CALIB(priv, "chain_noise: a %d b %d c %d\n",
                         chain_noise_a, chain_noise_b, chain_noise_c);
 
-        /* If this is the 20th beacon, determine:
+        /* If this is the "chain_noise_num_beacons", determine:
          * 1)  Disconnected antennas (using signal strengths)
          * 2)  Differential gain (using silence noise) to balance receivers */
-        if (data->beacon_count != CAL_NUM_OF_BEACONS)
+        if (data->beacon_count != priv->cfg->chain_noise_num_beacons)
                 return;
 
         /* Analyze signal for disconnected antenna */
-        average_sig[0] = (data->chain_signal_a) / CAL_NUM_OF_BEACONS;
-        average_sig[1] = (data->chain_signal_b) / CAL_NUM_OF_BEACONS;
-        average_sig[2] = (data->chain_signal_c) / CAL_NUM_OF_BEACONS;
+        average_sig[0] =
+                (data->chain_signal_a) / priv->cfg->chain_noise_num_beacons;
+        average_sig[1] =
+                (data->chain_signal_b) / priv->cfg->chain_noise_num_beacons;
+        average_sig[2] =
+                (data->chain_signal_c) / priv->cfg->chain_noise_num_beacons;
 
         if (average_sig[0] >= average_sig[1]) {
                 max_average_sig = average_sig[0];
@@ -790,6 +808,18 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
                 }
         }
 
+        /*
+         * The above algorithm sometimes fails when the ucode
+         * reports 0 for all chains. It's not clear why that
+         * happens to start with, but it is then causing trouble
+         * because this can make us enable more chains than the
+         * hardware really has.
+         *
+         * To be safe, simply mask out any chains that we know
+         * are not on the device.
+         */
+        active_chains &= priv->hw_params.valid_rx_ant;
+
         num_tx_chains = 0;
         for (i = 0; i < NUM_RX_CHAINS; i++) {
                 /* loops on all the bits of
@@ -803,13 +833,17 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
                         /* there is a Tx antenna connected */
                         break;
                 if (num_tx_chains == priv->hw_params.tx_chains_num &&
-                data->disconn_array[i]) {
-                        /* This is the last TX antenna and is also
-                         * disconnected connect it anyway */
-                        data->disconn_array[i] = 0;
-                        active_chains |= ant_msk;
-                        IWL_DEBUG_CALIB(priv, "All Tx chains are disconnected W/A - "
-                                "declare %d as connected\n", i);
+                    data->disconn_array[i]) {
+                        /*
+                         * If all chains are disconnected
+                         * connect the first valid tx chain
+                         */
+                        first_chain =
+                                find_first_chain(priv->cfg->valid_tx_ant);
+                        data->disconn_array[first_chain] = 0;
+                        active_chains |= BIT(first_chain);
+                        IWL_DEBUG_CALIB(priv, "All Tx chains are disconnected W/A - declare %d as connected\n",
+                                        first_chain);
                         break;
                 }
         }
@@ -820,9 +854,12 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
                         active_chains);
 
         /* Analyze noise for rx balance */
-        average_noise[0] = ((data->chain_noise_a)/CAL_NUM_OF_BEACONS);
-        average_noise[1] = ((data->chain_noise_b)/CAL_NUM_OF_BEACONS);
-        average_noise[2] = ((data->chain_noise_c)/CAL_NUM_OF_BEACONS);
+        average_noise[0] =
+                ((data->chain_noise_a) / priv->cfg->chain_noise_num_beacons);
+        average_noise[1] =
+                ((data->chain_noise_b) / priv->cfg->chain_noise_num_beacons);
+        average_noise[2] =
+                ((data->chain_noise_c) / priv->cfg->chain_noise_num_beacons);
 
         for (i = 0; i < NUM_RX_CHAINS; i++) {
                 if (!(data->disconn_array[i]) &&
@@ -843,7 +880,8 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
 
         if (priv->cfg->ops->utils->gain_computation)
                 priv->cfg->ops->utils->gain_computation(priv, average_noise,
-                        min_average_noise_antenna_i, min_average_noise);
+                                min_average_noise_antenna_i, min_average_noise,
+                                find_first_chain(priv->cfg->valid_rx_ant));
 
         /* Some power changes may have been made during the calibration.
          * Update and commit the RXON
@@ -870,7 +908,7 @@ void iwl_reset_run_time_calib(struct iwl_priv *priv)
 
         /* Ask for statistics now, the uCode will send notification
          * periodically after association */
-        iwl_send_statistics_request(priv, CMD_ASYNC);
+        iwl_send_statistics_request(priv, CMD_ASYNC, true);
 }
 EXPORT_SYMBOL(iwl_reset_run_time_calib);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.h b/drivers/net/wireless/iwlwifi/iwl-calib.h
index b6cef989a796..2b7b1df83ba0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.h
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 4afaf773aeac..f4e59ae07f8e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -109,17 +109,17 @@ enum {
         REPLY_TX_LINK_QUALITY_CMD = 0x4e, /* 4965 only */
 
         /* WiMAX coexistence */
-        COEX_PRIORITY_TABLE_CMD = 0x5a, /*5000 only */
+        COEX_PRIORITY_TABLE_CMD = 0x5a, /* for 5000 series and up */
         COEX_MEDIUM_NOTIFICATION = 0x5b,
         COEX_EVENT_CMD = 0x5c,
 
         /* Calibration */
+        TEMPERATURE_NOTIFICATION = 0x62,
         CALIBRATION_CFG_CMD = 0x65,
         CALIBRATION_RES_NOTIFICATION = 0x66,
         CALIBRATION_COMPLETE_NOTIFICATION = 0x67,
 
         /* 802.11h related */
-        RADAR_NOTIFICATION = 0x70,      /* not used */
         REPLY_QUIET_CMD = 0x71,         /* not used */
         REPLY_CHANNEL_SWITCH = 0x72,
         CHANNEL_SWITCH_NOTIFICATION = 0x73,
@@ -148,7 +148,7 @@ enum {
         QUIET_NOTIFICATION = 0x96,              /* not used */
         REPLY_TX_PWR_TABLE_CMD = 0x97,
         REPLY_TX_POWER_DBM_CMD_V1 = 0x98,       /* old version of API */
-        TX_ANT_CONFIGURATION_CMD = 0x98,        /* not used */
+        TX_ANT_CONFIGURATION_CMD = 0x98,
         MEASURE_ABORT_NOTIFICATION = 0x99,      /* not used */
 
         /* Bluetooth device coexistence config command */
@@ -353,6 +353,9 @@ struct iwl3945_power_per_rate {
 #define POWER_TABLE_NUM_HT_OFDM_ENTRIES         32
 #define POWER_TABLE_CCK_ENTRY                   32
 
+#define IWL_PWR_NUM_HT_OFDM_ENTRIES             24
+#define IWL_PWR_CCK_ENTRIES                     2
+
 /**
  * union iwl4965_tx_power_dual_stream
  *
@@ -411,6 +414,16 @@ struct iwl5000_tx_power_dbm_cmd {
         u8 reserved;
 } __attribute__ ((packed));
 
+/**
+ * Command TX_ANT_CONFIGURATION_CMD = 0x98
+ * This command is used to configure valid Tx antenna.
+ * By default uCode concludes the valid antenna according to the radio flavor.
+ * This command enables the driver to override/modify this conclusion.
+ */
+struct iwl_tx_ant_config_cmd {
+        __le32 valid;
+} __attribute__ ((packed));
+
 /******************************************************************************
  * (0a)
  * Alive and Error Commands & Responses:
@@ -793,7 +806,7 @@ struct iwl3945_channel_switch_cmd {
         struct iwl3945_power_per_rate power[IWL_MAX_RATES];
 } __attribute__ ((packed));
 
-struct iwl_channel_switch_cmd {
+struct iwl4965_channel_switch_cmd {
         u8 band;
         u8 expect_beacon;
         __le16 channel;
@@ -803,6 +816,48 @@ struct iwl_channel_switch_cmd {
         struct iwl4965_tx_power_db tx_power;
 } __attribute__ ((packed));
 
+/**
+ * struct iwl5000_channel_switch_cmd
+ * @band: 0- 5.2GHz, 1- 2.4GHz
+ * @expect_beacon: 0- resume transmits after channel switch
+ *                 1- wait for beacon to resume transmits
+ * @channel: new channel number
+ * @rxon_flags: Rx on flags
+ * @rxon_filter_flags: filtering parameters
+ * @switch_time: switch time in extended beacon format
+ * @reserved: reserved bytes
+ */
+struct iwl5000_channel_switch_cmd {
+        u8 band;
+        u8 expect_beacon;
+        __le16 channel;
+        __le32 rxon_flags;
+        __le32 rxon_filter_flags;
+        __le32 switch_time;
+        __le32 reserved[2][IWL_PWR_NUM_HT_OFDM_ENTRIES + IWL_PWR_CCK_ENTRIES];
+} __attribute__ ((packed));
+
+/**
+ * struct iwl6000_channel_switch_cmd
+ * @band: 0- 5.2GHz, 1- 2.4GHz
+ * @expect_beacon: 0- resume transmits after channel switch
+ *                 1- wait for beacon to resume transmits
+ * @channel: new channel number
+ * @rxon_flags: Rx on flags
+ * @rxon_filter_flags: filtering parameters
+ * @switch_time: switch time in extended beacon format
+ * @reserved: reserved bytes
+ */
+struct iwl6000_channel_switch_cmd {
+        u8 band;
+        u8 expect_beacon;
+        __le16 channel;
+        __le32 rxon_flags;
+        __le32 rxon_filter_flags;
+        __le32 switch_time;
+        __le32 reserved[3][IWL_PWR_NUM_HT_OFDM_ENTRIES + IWL_PWR_CCK_ENTRIES];
+} __attribute__ ((packed));
+
 /*
  * CHANNEL_SWITCH_NOTIFICATION = 0x73 (notification only, not a command)
  */
@@ -921,6 +976,7 @@ struct iwl_qosparam_cmd {
 #define STA_MODIFY_TX_RATE_MSK          0x04
 #define STA_MODIFY_ADDBA_TID_MSK        0x08
 #define STA_MODIFY_DELBA_TID_MSK        0x10
+#define STA_MODIFY_SLEEP_TX_COUNT_MSK   0x20
 
 /* Receiver address (actually, Rx station's index into station table),
  * combined with Traffic ID (QOS priority), in format used by Tx Scheduler */
@@ -1051,7 +1107,14 @@ struct iwl4965_addsta_cmd {
          * Set modify_mask bit STA_MODIFY_ADDBA_TID_MSK to use this field. */
         __le16 add_immediate_ba_ssn;
 
-        __le32 reserved2;
+        /*
+         * Number of packets OK to transmit to station even though
+         * it is asleep -- used to synchronise PS-poll and u-APSD
+         * responses while ucode keeps track of STA sleep state.
+         */
+        __le16 sleep_tx_count;
+
+        __le16 reserved2;
 } __attribute__ ((packed));
 
 /* 5000 */
@@ -1082,7 +1145,14 @@ struct iwl_addsta_cmd {
          * Set modify_mask bit STA_MODIFY_ADDBA_TID_MSK to use this field. */
         __le16 add_immediate_ba_ssn;
 
-        __le32 reserved2;
+        /*
+         * Number of packets OK to transmit to station even though
+         * it is asleep -- used to synchronise PS-poll and u-APSD
+         * responses while ucode keeps track of STA sleep state.
+         */
+        __le16 sleep_tx_count;
+
+        __le16 reserved2;
 } __attribute__ ((packed));
 
 
@@ -1634,6 +1704,21 @@ enum {
         TX_ABORT_REQUIRED_MSK = 0x80000000,     /* bits 31:31 */
 };
 
+static inline u32 iwl_tx_status_to_mac80211(u32 status)
+{
+        status &= TX_STATUS_MSK;
+
+        switch (status) {
+        case TX_STATUS_SUCCESS:
+        case TX_STATUS_DIRECT_DONE:
+                return IEEE80211_TX_STAT_ACK;
+        case TX_STATUS_FAIL_DEST_PS:
+                return IEEE80211_TX_STAT_TX_FILTERED;
+        default:
+                return 0;
+        }
+}
+
 static inline bool iwl_is_tx_success(u32 status)
 {
         status &= TX_STATUS_MSK;
@@ -2163,6 +2248,31 @@ struct iwl_link_quality_cmd {
 } __attribute__ ((packed));
 
 /*
+ * BT configuration enable flags:
+ *   bit 0 - 1: BT channel announcement enabled
+ *           0: disable
+ *   bit 1 - 1: priority of BT device enabled
+ *           0: disable
+ *   bit 2 - 1: BT 2 wire support enabled
+ *           0: disable
+ */
+#define BT_COEX_DISABLE (0x0)
+#define BT_ENABLE_CHANNEL_ANNOUNCE BIT(0)
+#define BT_ENABLE_PRIORITY         BIT(1)
+#define BT_ENABLE_2_WIRE           BIT(2)
+
+#define BT_COEX_DISABLE (0x0)
+#define BT_COEX_ENABLE  (BT_ENABLE_CHANNEL_ANNOUNCE | BT_ENABLE_PRIORITY)
+
+#define BT_LEAD_TIME_MIN (0x0)
+#define BT_LEAD_TIME_DEF (0x1E)
+#define BT_LEAD_TIME_MAX (0xFF)
+
+#define BT_MAX_KILL_MIN (0x1)
+#define BT_MAX_KILL_DEF (0x5)
+#define BT_MAX_KILL_MAX (0xFF)
+
+/*
  * REPLY_BT_CONFIG = 0x9b (command, has simple generic response)
  *
  * 3945 and 4965 support hardware handshake with Bluetooth device on
@@ -2411,7 +2521,7 @@ struct iwl_card_state_notif {
 
 #define HW_CARD_DISABLED   0x01
 #define SW_CARD_DISABLED   0x02
-#define RF_CARD_DISABLED   0x04
+#define CT_CARD_DISABLED   0x04
 #define RXON_CARD_DISABLED 0x10
 
 struct iwl_ct_kill_config {
@@ -2497,9 +2607,10 @@ struct iwl_scan_channel {
 /**
  * struct iwl_ssid_ie - directed scan network information element
  *
- * Up to 4 of these may appear in REPLY_SCAN_CMD, selected by "type" field
- * in struct iwl_scan_channel; each channel may select different ssids from
- * among the 4 entries.  SSID IEs get transmitted in reverse order of entry.
+ * Up to 20 of these may appear in REPLY_SCAN_CMD (Note: Only 4 are in
+ * 3945 SCAN api), selected by "type" bit field in struct iwl_scan_channel;
+ * each channel may select different ssids from among the 20 (4) entries.
+ * SSID IEs get transmitted in reverse order of entry.
  */
 struct iwl_ssid_ie {
         u8 id;
@@ -2510,8 +2621,11 @@ struct iwl_ssid_ie {
 #define PROBE_OPTION_MAX_3945           4
 #define PROBE_OPTION_MAX                20
 #define TX_CMD_LIFE_TIME_INFINITE       cpu_to_le32(0xFFFFFFFF)
-#define IWL_GOOD_CRC_TH                 cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_DISABLED        0
+#define IWL_GOOD_CRC_TH_DEFAULT         cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_NEVER           cpu_to_le16(0xffff)
 #define IWL_MAX_SCAN_SIZE 1024
+#define IWL_MAX_CMD_SIZE 4096
 #define IWL_MAX_PROBE_REQUEST           200
 
 /*
@@ -2884,7 +2998,7 @@ struct statistics_rx_ht_phy {
         __le32 agg_crc32_good;
         __le32 agg_mpdu_cnt;
         __le32 agg_cnt;
-        __le32 reserved2;
+        __le32 unsupport_mcs;
 } __attribute__ ((packed));
 
 #define INTERFERENCE_DATA_AVAILABLE      cpu_to_le32(1)
@@ -2987,8 +3101,8 @@ struct statistics_div {
 } __attribute__ ((packed));
 
 struct statistics_general {
-        __le32 temperature;
-        __le32 temperature_m;
+        __le32 temperature;   /* radio temperature */
+        __le32 temperature_m; /* for 5000 and up, this is radio voltage */
         struct statistics_dbg dbg;
         __le32 sleep_time;
         __le32 slots_out;
@@ -2996,11 +3110,20 @@ struct statistics_general {
         __le32 ttl_timestamp;
         struct statistics_div div;
         __le32 rx_enable_counter;
-        __le32 reserved1;
+        /*
+         * num_of_sos_states:
+         *  count the number of times we have to re-tune
+         *  in order to get out of bad PHY status
+         */
+        __le32 num_of_sos_states;
         __le32 reserved2;
         __le32 reserved3;
 } __attribute__ ((packed));
 
+#define UCODE_STATISTICS_CLEAR_MSK              (0x1 << 0)
+#define UCODE_STATISTICS_FREQUENCY_MSK          (0x1 << 1)
+#define UCODE_STATISTICS_NARROW_BAND_MSK        (0x1 << 2)
+
 /*
  * REPLY_STATISTICS_CMD = 0x9c,
  * 3945 and 4965 identical.
@@ -3057,13 +3180,30 @@ struct iwl_notif_statistics {
 
 /*
  * MISSED_BEACONS_NOTIFICATION = 0xa2 (notification only, not a command)
+ *
+ * uCode send MISSED_BEACONS_NOTIFICATION to driver when detect beacon missed
+ * in regardless of how many missed beacons, which mean when driver receive the
+ * notification, inside the command, it can find all the beacons information
+ * which include number of total missed beacons, number of consecutive missed
+ * beacons, number of beacons received and number of beacons expected to
+ * receive.
+ *
+ * If uCode detected consecutive_missed_beacons > 5, it will reset the radio
+ * in order to bring the radio/PHY back to working state; which has no relation
+ * to when driver will perform sensitivity calibration.
+ *
+ * Driver should set it own missed_beacon_threshold to decide when to perform
+ * sensitivity calibration based on number of consecutive missed beacons in
+ * order to improve overall performance, especially in noisy environment.
+ *
  */
-/* if ucode missed CONSECUTIVE_MISSED_BCONS_TH beacons in a row,
- * then this notification will be sent. */
-#define CONSECUTIVE_MISSED_BCONS_TH 20
+
+#define IWL_MISSED_BEACON_THRESHOLD_MIN (1)
+#define IWL_MISSED_BEACON_THRESHOLD_DEF (5)
+#define IWL_MISSED_BEACON_THRESHOLD_MAX IWL_MISSED_BEACON_THRESHOLD_DEF
 
 struct iwl_missed_beacon_notif {
-        __le32 consequtive_missed_beacons;
+        __le32 consecutive_missed_beacons;
         __le32 total_missed_becons;
         __le32 num_expected_beacons;
         __le32 num_recvd_beacons;
@@ -3237,12 +3377,6 @@ struct iwl_missed_beacon_notif {
  *   Lower values mean higher energy; this means making sure that the value
  *   in HD_MIN_ENERGY_CCK_DET_INDEX is at or *above* "Max cck energy".
  *
- * Driver should set the following entries to fixed values:
- *
- *   HD_MIN_ENERGY_OFDM_DET_INDEX               100
- *   HD_BARKER_CORR_TH_ADD_MIN_INDEX            190
- *   HD_BARKER_CORR_TH_ADD_MIN_MRC_INDEX        390
- *   HD_OFDM_ENERGY_TH_IN_INDEX                  62
  */
 
 /*
@@ -3339,11 +3473,7 @@ enum {
         IWL_PHY_CALIBRATE_DIFF_GAIN_CMD         = 7,
         IWL_PHY_CALIBRATE_DC_CMD                = 8,
         IWL_PHY_CALIBRATE_LO_CMD                = 9,
-        IWL_PHY_CALIBRATE_RX_BB_CMD             = 10,
         IWL_PHY_CALIBRATE_TX_IQ_CMD             = 11,
-        IWL_PHY_CALIBRATE_RX_IQ_CMD             = 12,
-        IWL_PHY_CALIBRATION_NOISE_CMD           = 13,
-        IWL_PHY_CALIBRATE_AGC_TABLE_CMD         = 14,
         IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD       = 15,
         IWL_PHY_CALIBRATE_BASE_BAND_CMD         = 16,
         IWL_PHY_CALIBRATE_TX_IQ_PERD_CMD        = 17,
@@ -3440,30 +3570,134 @@ struct iwl_led_cmd {
 } __attribute__ ((packed));
 
 /*
- * Coexistence WIFI/WIMAX  Command
- * COEX_PRIORITY_TABLE_CMD = 0x5a
- *
+ * station priority table entries
+ * also used as potential "events" value for both
+ * COEX_MEDIUM_NOTIFICATION and COEX_EVENT_CMD
+ */
+
+/*
+ * COEX events entry flag masks
+ * RP - Requested Priority
+ * WP - Win Medium Priority: priority assigned when the contention has been won
+ */
+#define COEX_EVT_FLAG_MEDIUM_FREE_NTFY_FLG        (0x1)
+#define COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_FLG        (0x2)
+#define COEX_EVT_FLAG_DELAY_MEDIUM_FREE_NTFY_FLG  (0x4)
+
+#define COEX_CU_UNASSOC_IDLE_RP               4
+#define COEX_CU_UNASSOC_MANUAL_SCAN_RP        4
+#define COEX_CU_UNASSOC_AUTO_SCAN_RP          4
+#define COEX_CU_CALIBRATION_RP                4
+#define COEX_CU_PERIODIC_CALIBRATION_RP       4
+#define COEX_CU_CONNECTION_ESTAB_RP           4
+#define COEX_CU_ASSOCIATED_IDLE_RP            4
+#define COEX_CU_ASSOC_MANUAL_SCAN_RP          4
+#define COEX_CU_ASSOC_AUTO_SCAN_RP            4
+#define COEX_CU_ASSOC_ACTIVE_LEVEL_RP         4
+#define COEX_CU_RF_ON_RP                      6
+#define COEX_CU_RF_OFF_RP                     4
+#define COEX_CU_STAND_ALONE_DEBUG_RP          6
+#define COEX_CU_IPAN_ASSOC_LEVEL_RP           4
+#define COEX_CU_RSRVD1_RP                     4
+#define COEX_CU_RSRVD2_RP                     4
+
+#define COEX_CU_UNASSOC_IDLE_WP               3
+#define COEX_CU_UNASSOC_MANUAL_SCAN_WP        3
+#define COEX_CU_UNASSOC_AUTO_SCAN_WP          3
+#define COEX_CU_CALIBRATION_WP                3
+#define COEX_CU_PERIODIC_CALIBRATION_WP       3
+#define COEX_CU_CONNECTION_ESTAB_WP           3
+#define COEX_CU_ASSOCIATED_IDLE_WP            3
+#define COEX_CU_ASSOC_MANUAL_SCAN_WP          3
+#define COEX_CU_ASSOC_AUTO_SCAN_WP            3
+#define COEX_CU_ASSOC_ACTIVE_LEVEL_WP         3
+#define COEX_CU_RF_ON_WP                      3
+#define COEX_CU_RF_OFF_WP                     3
+#define COEX_CU_STAND_ALONE_DEBUG_WP          6
+#define COEX_CU_IPAN_ASSOC_LEVEL_WP           3
+#define COEX_CU_RSRVD1_WP                     3
+#define COEX_CU_RSRVD2_WP                     3
+
+#define COEX_UNASSOC_IDLE_FLAGS                     0
+#define COEX_UNASSOC_MANUAL_SCAN_FLAGS          \
+        (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_FLG |   \
+        COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_FLG)
+#define COEX_UNASSOC_AUTO_SCAN_FLAGS            \
+        (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_FLG |   \
+        COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_FLG)
+#define COEX_CALIBRATION_FLAGS                  \
+        (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_FLG |   \
+        COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_FLG)
+#define COEX_PERIODIC_CALIBRATION_FLAGS             0
+/*
+ * COEX_CONNECTION_ESTAB:
+ * we need DELAY_MEDIUM_FREE_NTFY to let WiMAX disconnect from network.
+ */
+#define COEX_CONNECTION_ESTAB_FLAGS             \
+        (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_FLG |   \
+        COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_FLG |    \
+        COEX_EVT_FLAG_DELAY_MEDIUM_FREE_NTFY_FLG)
+#define COEX_ASSOCIATED_IDLE_FLAGS                  0
+#define COEX_ASSOC_MANUAL_SCAN_FLAGS            \
+        (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_FLG |   \
+        COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_FLG)
+#define COEX_ASSOC_AUTO_SCAN_FLAGS              \
+        (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_FLG |   \
+         COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_FLG)
+#define COEX_ASSOC_ACTIVE_LEVEL_FLAGS               0
+#define COEX_RF_ON_FLAGS                            0
+#define COEX_RF_OFF_FLAGS                           0
+#define COEX_STAND_ALONE_DEBUG_FLAGS            \
+        (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_FLG |   \
+         COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_FLG)
+#define COEX_IPAN_ASSOC_LEVEL_FLAGS             \
+        (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_FLG |   \
+         COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_FLG |   \
+         COEX_EVT_FLAG_DELAY_MEDIUM_FREE_NTFY_FLG)
+#define COEX_RSRVD1_FLAGS                           0
+#define COEX_RSRVD2_FLAGS                           0
+/*
+ * COEX_CU_RF_ON is the event wrapping all radio ownership.
+ * We need DELAY_MEDIUM_FREE_NTFY to let WiMAX disconnect from network.
  */
+#define COEX_CU_RF_ON_FLAGS                     \
+        (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_FLG |   \
+         COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_FLG |   \
+         COEX_EVT_FLAG_DELAY_MEDIUM_FREE_NTFY_FLG)
+
+
 enum {
+        /* un-association part */
         COEX_UNASSOC_IDLE               = 0,
         COEX_UNASSOC_MANUAL_SCAN        = 1,
         COEX_UNASSOC_AUTO_SCAN          = 2,
+        /* calibration */
         COEX_CALIBRATION                = 3,
         COEX_PERIODIC_CALIBRATION       = 4,
+        /* connection */
         COEX_CONNECTION_ESTAB           = 5,
+        /* association part */
         COEX_ASSOCIATED_IDLE            = 6,
         COEX_ASSOC_MANUAL_SCAN          = 7,
         COEX_ASSOC_AUTO_SCAN            = 8,
         COEX_ASSOC_ACTIVE_LEVEL         = 9,
+        /* RF ON/OFF */
         COEX_RF_ON                      = 10,
         COEX_RF_OFF                     = 11,
         COEX_STAND_ALONE_DEBUG          = 12,
+        /* IPAN */
         COEX_IPAN_ASSOC_LEVEL           = 13,
+        /* reserved */
         COEX_RSRVD1                     = 14,
         COEX_RSRVD2                     = 15,
         COEX_NUM_OF_EVENTS              = 16
 };
 
+/*
+ * Coexistence WIFI/WIMAX  Command
+ * COEX_PRIORITY_TABLE_CMD = 0x5a
+ *
+ */
 struct iwl_wimax_coex_event_entry {
         u8 request_prio;
         u8 win_medium_prio;
@@ -3488,6 +3722,55 @@ struct iwl_wimax_coex_cmd {
         struct iwl_wimax_coex_event_entry sta_prio[COEX_NUM_OF_EVENTS];
 } __attribute__ ((packed));
 
+/*
+ * Coexistence MEDIUM NOTIFICATION
+ * COEX_MEDIUM_NOTIFICATION = 0x5b
+ *
+ * notification from uCode to host to indicate medium changes
+ *
+ */
+/*
+ * status field
+ * bit 0 - 2: medium status
+ * bit 3: medium change indication
+ * bit 4 - 31: reserved
+ */
+/* status option values, (0 - 2 bits) */
+#define COEX_MEDIUM_BUSY        (0x0) /* radio belongs to WiMAX */
+#define COEX_MEDIUM_ACTIVE      (0x1) /* radio belongs to WiFi */
+#define COEX_MEDIUM_PRE_RELEASE (0x2) /* received radio release */
+#define COEX_MEDIUM_MSK         (0x7)
+
+/* send notification status (1 bit) */
+#define COEX_MEDIUM_CHANGED     (0x8)
+#define COEX_MEDIUM_CHANGED_MSK (0x8)
+#define COEX_MEDIUM_SHIFT       (3)
+
+struct iwl_coex_medium_notification {
+        __le32 status;
+        __le32 events;
+} __attribute__ ((packed));
+
+/*
+ * Coexistence EVENT  Command
+ * COEX_EVENT_CMD = 0x5c
+ *
+ * send from host to uCode for coex event request.
+ */
+/* flags options */
+#define COEX_EVENT_REQUEST_MSK  (0x1)
+
+struct iwl_coex_event_cmd {
+        u8 flags;
+        u8 event;
+        __le16 reserved;
+} __attribute__ ((packed));
+
+struct iwl_coex_event_resp {
+        __le32 status;
+} __attribute__ ((packed));
+
+
 /******************************************************************************
  * (13)
  * Union of all expected notifications/responses:
@@ -3495,6 +3778,16 @@ struct iwl_wimax_coex_cmd {
  *****************************************************************************/
 
 struct iwl_rx_packet {
+        /*
+         * The first 4 bytes of the RX frame header contain both the RX frame
+         * size and some flags.
+         * Bit fields:
+         * 31:    flag flush RB request
+         * 30:    flag ignore TC (terminal counter) request
+         * 29:    flag fast IRQ request
+         * 28-14: Reserved
+         * 13-00: RX frame size
+         */
         __le32 len_n_flags;
         struct iwl_cmd_header hdr;
         union {
@@ -3514,6 +3807,8 @@ struct iwl_rx_packet {
                 struct iwl_notif_statistics stats;
                 struct iwl_compressed_ba_resp compressed_ba;
                 struct iwl_missed_beacon_notif missed_beacon;
+                struct iwl_coex_medium_notification coex_medium_notif;
+                struct iwl_coex_event_resp coex_event;
                 __le32 status;
                 u8 raw[0];
         } u;
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 2dc928755454..049b652bcb5e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/etherdevice.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 
 #include "iwl-eeprom.h"
@@ -47,6 +48,57 @@ MODULE_VERSION(IWLWIFI_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 
+/*
+ * set bt_coex_active to true, uCode will do kill/defer
+ * every time the priority line is asserted (BT is sending signals on the
+ * priority line in the PCIx).
+ * set bt_coex_active to false, uCode will ignore the BT activity and
+ * perform the normal operation
+ *
+ * User might experience transmit issue on some platform due to WiFi/BT
+ * co-exist problem. The possible behaviors are:
+ *   Able to scan and finding all the available AP
+ *   Not able to associate with any AP
+ * On those platforms, WiFi communication can be restored by set
+ * "bt_coex_active" module parameter to "false"
+ *
+ * default: bt_coex_active = true (BT_COEX_ENABLE)
+ */
+static bool bt_coex_active = true;
+module_param(bt_coex_active, bool, S_IRUGO);
+MODULE_PARM_DESC(bt_coex_active, "enable wifi/bluetooth co-exist\n");
+
+static struct iwl_wimax_coex_event_entry cu_priorities[COEX_NUM_OF_EVENTS] = {
+        {COEX_CU_UNASSOC_IDLE_RP, COEX_CU_UNASSOC_IDLE_WP,
+         0, COEX_UNASSOC_IDLE_FLAGS},
+        {COEX_CU_UNASSOC_MANUAL_SCAN_RP, COEX_CU_UNASSOC_MANUAL_SCAN_WP,
+         0, COEX_UNASSOC_MANUAL_SCAN_FLAGS},
+        {COEX_CU_UNASSOC_AUTO_SCAN_RP, COEX_CU_UNASSOC_AUTO_SCAN_WP,
+         0, COEX_UNASSOC_AUTO_SCAN_FLAGS},
+        {COEX_CU_CALIBRATION_RP, COEX_CU_CALIBRATION_WP,
+         0, COEX_CALIBRATION_FLAGS},
+        {COEX_CU_PERIODIC_CALIBRATION_RP, COEX_CU_PERIODIC_CALIBRATION_WP,
+         0, COEX_PERIODIC_CALIBRATION_FLAGS},
+        {COEX_CU_CONNECTION_ESTAB_RP, COEX_CU_CONNECTION_ESTAB_WP,
+         0, COEX_CONNECTION_ESTAB_FLAGS},
+        {COEX_CU_ASSOCIATED_IDLE_RP, COEX_CU_ASSOCIATED_IDLE_WP,
+         0, COEX_ASSOCIATED_IDLE_FLAGS},
+        {COEX_CU_ASSOC_MANUAL_SCAN_RP, COEX_CU_ASSOC_MANUAL_SCAN_WP,
+         0, COEX_ASSOC_MANUAL_SCAN_FLAGS},
+        {COEX_CU_ASSOC_AUTO_SCAN_RP, COEX_CU_ASSOC_AUTO_SCAN_WP,
+         0, COEX_ASSOC_AUTO_SCAN_FLAGS},
+        {COEX_CU_ASSOC_ACTIVE_LEVEL_RP, COEX_CU_ASSOC_ACTIVE_LEVEL_WP,
+         0, COEX_ASSOC_ACTIVE_LEVEL_FLAGS},
+        {COEX_CU_RF_ON_RP, COEX_CU_RF_ON_WP, 0, COEX_CU_RF_ON_FLAGS},
+        {COEX_CU_RF_OFF_RP, COEX_CU_RF_OFF_WP, 0, COEX_RF_OFF_FLAGS},
+        {COEX_CU_STAND_ALONE_DEBUG_RP, COEX_CU_STAND_ALONE_DEBUG_WP,
+         0, COEX_STAND_ALONE_DEBUG_FLAGS},
+        {COEX_CU_IPAN_ASSOC_LEVEL_RP, COEX_CU_IPAN_ASSOC_LEVEL_WP,
+         0, COEX_IPAN_ASSOC_LEVEL_FLAGS},
+        {COEX_CU_RSRVD1_RP, COEX_CU_RSRVD1_WP, 0, COEX_RSRVD1_FLAGS},
+        {COEX_CU_RSRVD2_RP, COEX_CU_RSRVD2_WP, 0, COEX_RSRVD2_FLAGS}
+};
+
 #define IWL_DECLARE_RATE_INFO(r, s, ip, in, rp, rn, pp, np)    \
         [IWL_RATE_##r##M_INDEX] = { IWL_RATE_##r##M_PLCP,      \
                                     IWL_RATE_SISO_##s##M_PLCP, \
@@ -178,6 +230,7 @@ u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant)
         }
         return ant;
 }
+EXPORT_SYMBOL(iwl_toggle_tx_ant);
 
 const u8 iwl_bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 EXPORT_SYMBOL(iwl_bcast_addr);
@@ -224,7 +277,10 @@ int iwl_hw_nic_init(struct iwl_priv *priv)
         /* nic_init */
         spin_lock_irqsave(&priv->lock, flags);
         priv->cfg->ops->lib->apm_ops.init(priv);
-        iwl_write32(priv, CSR_INT_COALESCING, 512 / 32);
+
+        /* Set interrupt coalescing calibration timer to default (512 usecs) */
+        iwl_write8(priv, CSR_INT_COALESCING, IWL_HOST_INT_CALIB_TIMEOUT_DEF);
+
         spin_unlock_irqrestore(&priv->lock, flags);
 
         ret = priv->cfg->ops->lib->apm_ops.set_pwr_src(priv, IWL_PWR_SRC_VMAIN);
@@ -252,10 +308,13 @@ int iwl_hw_nic_init(struct iwl_priv *priv)
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /* Allocate and init all Tx and Command queues */
-        ret = iwl_txq_ctx_reset(priv);
-        if (ret)
-                return ret;
+        /* Allocate or reset and init all Tx and Command queues */
+        if (!priv->txq) {
+                ret = iwl_txq_ctx_alloc(priv);
+                if (ret)
+                        return ret;
+        } else
+                iwl_txq_ctx_reset(priv);
 
         set_bit(STATUS_INIT, &priv->status);
 
@@ -415,9 +474,6 @@ static void iwlcore_init_ht_hw_capab(const struct iwl_priv *priv,
         if (priv->cfg->ht_greenfield_support)
                 ht_info->cap |= IEEE80211_HT_CAP_GRN_FLD;
         ht_info->cap |= IEEE80211_HT_CAP_SGI_20;
-        ht_info->cap |= (IEEE80211_HT_CAP_SM_PS &
-                             (WLAN_HT_CAP_SM_PS_DISABLED << 2));
-
         max_bit_rate = MAX_BIT_RATE_20_MHZ;
         if (priv->hw_params.ht40_channel & BIT(band)) {
                 ht_info->cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
@@ -452,28 +508,6 @@ static void iwlcore_init_ht_hw_capab(const struct iwl_priv *priv,
         }
 }
 
-static void iwlcore_init_hw_rates(struct iwl_priv *priv,
-                              struct ieee80211_rate *rates)
-{
-        int i;
-
-        for (i = 0; i < IWL_RATE_COUNT_LEGACY; i++) {
-                rates[i].bitrate = iwl_rates[i].ieee * 5;
-                rates[i].hw_value = i; /* Rate scaling will work on indexes */
-                rates[i].hw_value_short = i;
-                rates[i].flags = 0;
-                if ((i >= IWL_FIRST_CCK_RATE) && (i <= IWL_LAST_CCK_RATE)) {
-                        /*
-                         * If CCK != 1M then set short preamble rate flag.
-                         */
-                        rates[i].flags |=
-                                (iwl_rates[i].plcp == IWL_RATE_1M_PLCP) ?
-                                        0 : IEEE80211_RATE_SHORT_PREAMBLE;
-                }
-        }
-}
-
-
 /**
  * iwlcore_init_geos - Initialize mac80211's geo/channel info based from eeprom
  */
@@ -605,11 +639,27 @@ void iwlcore_free_geos(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwlcore_free_geos);
 
+/*
+ *  iwlcore_rts_tx_cmd_flag: Set rts/cts. 3945 and 4965 only share this
+ *  function.
+ */
+void iwlcore_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
+                                __le32 *tx_flags)
+{
+        if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
+                *tx_flags |= TX_CMD_FLG_RTS_MSK;
+                *tx_flags &= ~TX_CMD_FLG_CTS_MSK;
+        } else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
+                *tx_flags &= ~TX_CMD_FLG_RTS_MSK;
+                *tx_flags |= TX_CMD_FLG_CTS_MSK;
+        }
+}
+EXPORT_SYMBOL(iwlcore_rts_tx_cmd_flag);
+
 static bool is_single_rx_stream(struct iwl_priv *priv)
 {
-        return !priv->current_ht_config.is_ht ||
-               ((priv->current_ht_config.mcs.rx_mask[1] == 0) &&
-                (priv->current_ht_config.mcs.rx_mask[2] == 0));
+        return priv->current_ht_config.smps == IEEE80211_SMPS_STATIC ||
+               priv->current_ht_config.single_chain_sufficient;
 }
 
 static u8 iwl_is_channel_extension(struct iwl_priv *priv,
@@ -635,10 +685,9 @@ static u8 iwl_is_channel_extension(struct iwl_priv *priv,
 u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                          struct ieee80211_sta_ht_cap *sta_ht_inf)
 {
-        struct iwl_ht_info *iwl_ht_conf = &priv->current_ht_config;
+        struct iwl_ht_config *ht_conf = &priv->current_ht_config;
 
-        if ((!iwl_ht_conf->is_ht) ||
-            (iwl_ht_conf->supported_chan_width != IWL_CHANNEL_WIDTH_40MHZ))
+        if (!ht_conf->is_ht || !ht_conf->is_40mhz)
                 return 0;
 
         /* We do not check for IEEE80211_HT_CAP_SUP_WIDTH_20_40
@@ -654,7 +703,7 @@ u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
 #endif
         return iwl_is_channel_extension(priv, priv->band,
                         le16_to_cpu(priv->staging_rxon.channel),
-                        iwl_ht_conf->extension_chan_offset);
+                        ht_conf->extension_chan_offset);
 }
 EXPORT_SYMBOL(iwl_is_ht40_tx_allowed);
 
@@ -878,11 +927,11 @@ u8 iwl_rate_get_lowest_plcp(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_rate_get_lowest_plcp);
 
-void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_info *ht_info)
+void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf)
 {
         struct iwl_rxon_cmd *rxon = &priv->staging_rxon;
 
-        if (!ht_info->is_ht) {
+        if (!ht_conf->is_ht) {
                 rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
                         RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK |
                         RXON_FLG_HT40_PROT_MSK |
@@ -893,7 +942,7 @@ void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_info *ht_info)
         /* FIXME: if the definition of ht_protection changed, the "translation"
          * will be needed for rxon->flags
          */
-        rxon->flags |= cpu_to_le32(ht_info->ht_protection << RXON_FLG_HT_OPERATING_MODE_POS);
+        rxon->flags |= cpu_to_le32(ht_conf->ht_protection << RXON_FLG_HT_OPERATING_MODE_POS);
 
         /* Set up channel bandwidth:
          * 20 MHz only, 20/40 mixed or pure 40 if ht40 ok */
@@ -902,10 +951,10 @@ void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_info *ht_info)
                          RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK);
         if (iwl_is_ht40_tx_allowed(priv, NULL)) {
                 /* pure ht40 */
-                if (ht_info->ht_protection == IEEE80211_HT_OP_MODE_PROTECTION_20MHZ) {
+                if (ht_conf->ht_protection == IEEE80211_HT_OP_MODE_PROTECTION_20MHZ) {
                         rxon->flags |= RXON_FLG_CHANNEL_MODE_PURE_40;
                         /* Note: control channel is opposite of extension channel */
-                        switch (ht_info->extension_chan_offset) {
+                        switch (ht_conf->extension_chan_offset) {
                         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
                                 rxon->flags &= ~RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK;
                                 break;
@@ -915,7 +964,7 @@ void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_info *ht_info)
                         }
                 } else {
                         /* Note: control channel is opposite of extension channel */
-                        switch (ht_info->extension_chan_offset) {
+                        switch (ht_conf->extension_chan_offset) {
                         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
                                 rxon->flags &= ~(RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK);
                                 rxon->flags |= RXON_FLG_CHANNEL_MODE_MIXED;
@@ -938,14 +987,10 @@ void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_info *ht_info)
         if (priv->cfg->ops->hcmd->set_rxon_chain)
                 priv->cfg->ops->hcmd->set_rxon_chain(priv);
 
-        IWL_DEBUG_ASSOC(priv, "supported HT rate 0x%X 0x%X 0x%X "
-                        "rxon flags 0x%X operation mode :0x%X "
+        IWL_DEBUG_ASSOC(priv, "rxon flags 0x%X operation mode :0x%X "
                         "extension channel offset 0x%x\n",
-                        ht_info->mcs.rx_mask[0],
-                        ht_info->mcs.rx_mask[1],
-                        ht_info->mcs.rx_mask[2],
-                        le32_to_cpu(rxon->flags), ht_info->ht_protection,
-                        ht_info->extension_chan_offset);
+                        le32_to_cpu(rxon->flags), ht_conf->ht_protection,
+                        ht_conf->extension_chan_offset);
         return;
 }
 EXPORT_SYMBOL(iwl_set_rxon_ht);
@@ -955,47 +1000,43 @@ EXPORT_SYMBOL(iwl_set_rxon_ht);
 #define IWL_NUM_IDLE_CHAINS_DUAL        2
 #define IWL_NUM_IDLE_CHAINS_SINGLE      1
 
-/* Determine how many receiver/antenna chains to use.
- * More provides better reception via diversity.  Fewer saves power.
+/*
+ * Determine how many receiver/antenna chains to use.
+ *
+ * More provides better reception via diversity.  Fewer saves power
+ * at the expense of throughput, but only when not in powersave to
+ * start with.
+ *
  * MIMO (dual stream) requires at least 2, but works better with 3.
  * This does not determine *which* chains to use, just how many.
  */
 static int iwl_get_active_rx_chain_count(struct iwl_priv *priv)
 {
-        bool is_single = is_single_rx_stream(priv);
-        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
-
         /* # of Rx chains to use when expecting MIMO. */
-        if (is_single || (!is_cam && (priv->current_ht_config.sm_ps ==
-                                                 WLAN_HT_CAP_SM_PS_STATIC)))
+        if (is_single_rx_stream(priv))
                 return IWL_NUM_RX_CHAINS_SINGLE;
         else
                 return IWL_NUM_RX_CHAINS_MULTIPLE;
 }
 
+/*
+ * When we are in power saving mode, unless device support spatial
+ * multiplexing power save, use the active count for rx chain count.
+ */
 static int iwl_get_idle_rx_chain_count(struct iwl_priv *priv, int active_cnt)
 {
-        int idle_cnt;
-        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
-        /* # Rx chains when idling and maybe trying to save power */
-        switch (priv->current_ht_config.sm_ps) {
-        case WLAN_HT_CAP_SM_PS_STATIC:
-        case WLAN_HT_CAP_SM_PS_DYNAMIC:
-                idle_cnt = (is_cam) ? IWL_NUM_IDLE_CHAINS_DUAL :
-                                        IWL_NUM_IDLE_CHAINS_SINGLE;
-                break;
-        case WLAN_HT_CAP_SM_PS_DISABLED:
-                idle_cnt = (is_cam) ? active_cnt : IWL_NUM_IDLE_CHAINS_SINGLE;
-                break;
-        case WLAN_HT_CAP_SM_PS_INVALID:
+        /* # Rx chains when idling, depending on SMPS mode */
+        switch (priv->current_ht_config.smps) {
+        case IEEE80211_SMPS_STATIC:
+        case IEEE80211_SMPS_DYNAMIC:
+                return IWL_NUM_IDLE_CHAINS_SINGLE;
+        case IEEE80211_SMPS_OFF:
+                return active_cnt;
         default:
-                IWL_ERR(priv, "invalid mimo ps mode %d\n",
-                           priv->current_ht_config.sm_ps);
-                WARN_ON(1);
-                idle_cnt = -1;
-                break;
+                WARN(1, "invalid SMPS mode %d",
+                     priv->current_ht_config.smps);
+                return active_cnt;
         }
-        return idle_cnt;
 }
 
 /* up to 4 chains */
@@ -1005,7 +1046,7 @@ static u8 iwl_count_chain_bitmap(u32 chain_bitmap)
         res = (chain_bitmap & BIT(0)) >> 0;
         res += (chain_bitmap & BIT(1)) >> 1;
         res += (chain_bitmap & BIT(2)) >> 2;
-        res += (chain_bitmap & BIT(4)) >> 4;
+        res += (chain_bitmap & BIT(3)) >> 3;
         return res;
 }
 
@@ -1281,18 +1322,28 @@ static void iwl_set_rate(struct iwl_priv *priv)
 
 void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_rxon_cmd *rxon = (void *)&priv->active_rxon;
         struct iwl_csa_notification *csa = &(pkt->u.csa_notif);
-        IWL_DEBUG_11H(priv, "CSA notif: channel %d, status %d\n",
-                      le16_to_cpu(csa->channel), le32_to_cpu(csa->status));
-        rxon->channel = csa->channel;
-        priv->staging_rxon.channel = csa->channel;
+
+        if (priv->switch_rxon.switch_in_progress) {
+                if (!le32_to_cpu(csa->status) &&
+                    (csa->channel == priv->switch_rxon.channel)) {
+                        rxon->channel = csa->channel;
+                        priv->staging_rxon.channel = csa->channel;
+                        IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
+                              le16_to_cpu(csa->channel));
+                } else
+                        IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
+                              le16_to_cpu(csa->channel));
+
+                priv->switch_rxon.switch_in_progress = false;
+        }
 }
 EXPORT_SYMBOL(iwl_rx_csa);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-static void iwl_print_rx_config_cmd(struct iwl_priv *priv)
+void iwl_print_rx_config_cmd(struct iwl_priv *priv)
 {
         struct iwl_rxon_cmd *rxon = &priv->staging_rxon;
 
@@ -1310,6 +1361,7 @@ static void iwl_print_rx_config_cmd(struct iwl_priv *priv)
         IWL_DEBUG_RADIO(priv, "u8[6] bssid_addr: %pM\n", rxon->bssid_addr);
         IWL_DEBUG_RADIO(priv, "u16 assoc_id: 0x%x\n", le16_to_cpu(rxon->assoc_id));
 }
+EXPORT_SYMBOL(iwl_print_rx_config_cmd);
 #endif
 /**
  * iwl_irq_handle_error - called for HW or SW error interrupt from card
@@ -1322,12 +1374,15 @@ void iwl_irq_handle_error(struct iwl_priv *priv)
         /* Cancel currently queued command. */
         clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
 
+        priv->cfg->ops->lib->dump_nic_error_log(priv);
+        if (priv->cfg->ops->lib->dump_csr)
+                priv->cfg->ops->lib->dump_csr(priv);
+        if (priv->cfg->ops->lib->dump_fh)
+                priv->cfg->ops->lib->dump_fh(priv, NULL, false);
+        priv->cfg->ops->lib->dump_nic_event_log(priv, false, NULL, false);
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) {
-                priv->cfg->ops->lib->dump_nic_error_log(priv);
-                priv->cfg->ops->lib->dump_nic_event_log(priv);
+        if (iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS)
                 iwl_print_rx_config_cmd(priv);
-        }
 #endif
 
         wake_up_interruptible(&priv->wait_command_queue);
@@ -1346,6 +1401,160 @@ void iwl_irq_handle_error(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_irq_handle_error);
 
+int iwl_apm_stop_master(struct iwl_priv *priv)
+{
+        int ret = 0;
+
+        /* stop device's busmaster DMA activity */
+        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_STOP_MASTER);
+
+        ret = iwl_poll_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_MASTER_DISABLED,
+                        CSR_RESET_REG_FLAG_MASTER_DISABLED, 100);
+        if (ret)
+                IWL_WARN(priv, "Master Disable Timed Out, 100 usec\n");
+
+        IWL_DEBUG_INFO(priv, "stop master\n");
+
+        return ret;
+}
+EXPORT_SYMBOL(iwl_apm_stop_master);
+
+void iwl_apm_stop(struct iwl_priv *priv)
+{
+        IWL_DEBUG_INFO(priv, "Stop card, put in low power state\n");
+
+        /* Stop device's DMA activity */
+        iwl_apm_stop_master(priv);
+
+        /* Reset the entire device */
+        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
+
+        udelay(10);
+
+        /*
+         * Clear "initialization complete" bit to move adapter from
+         * D0A* (powered-up Active) --> D0U* (Uninitialized) state.
+         */
+        iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+}
+EXPORT_SYMBOL(iwl_apm_stop);
+
+
+/*
+ * Start up NIC's basic functionality after it has been reset
+ * (e.g. after platform boot, or shutdown via iwl_apm_stop())
+ * NOTE:  This does not load uCode nor start the embedded processor
+ */
+int iwl_apm_init(struct iwl_priv *priv)
+{
+        int ret = 0;
+        u16 lctl;
+
+        IWL_DEBUG_INFO(priv, "Init card's basic functions\n");
+
+        /*
+         * Use "set_bit" below rather than "write", to preserve any hardware
+         * bits already set by default after reset.
+         */
+
+        /* Disable L0S exit timer (platform NMI Work/Around) */
+        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
+                          CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
+
+        /*
+         * Disable L0s without affecting L1;
+         *  don't wait for ICH L0s (ICH bug W/A)
+         */
+        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
+                          CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
+
+        /* Set FH wait threshold to maximum (HW error during stress W/A) */
+        iwl_set_bit(priv, CSR_DBG_HPET_MEM_REG, CSR_DBG_HPET_MEM_REG_VAL);
+
+        /*
+         * Enable HAP INTA (interrupt from management bus) to
+         * wake device's PCI Express link L1a -> L0s
+         * NOTE:  This is no-op for 3945 (non-existant bit)
+         */
+        iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
+                                    CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A);
+
+        /*
+         * HW bug W/A for instability in PCIe bus L0->L0S->L1 transition.
+         * Check if BIOS (or OS) enabled L1-ASPM on this device.
+         * If so (likely), disable L0S, so device moves directly L0->L1;
+         *    costs negligible amount of power savings.
+         * If not (unlikely), enable L0S, so there is at least some
+         *    power savings, even without L1.
+         */
+        if (priv->cfg->set_l0s) {
+                lctl = iwl_pcie_link_ctl(priv);
+                if ((lctl & PCI_CFG_LINK_CTRL_VAL_L1_EN) ==
+                                        PCI_CFG_LINK_CTRL_VAL_L1_EN) {
+                        /* L1-ASPM enabled; disable(!) L0S  */
+                        iwl_set_bit(priv, CSR_GIO_REG,
+                                        CSR_GIO_REG_VAL_L0S_ENABLED);
+                        IWL_DEBUG_POWER(priv, "L1 Enabled; Disabling L0S\n");
+                } else {
+                        /* L1-ASPM disabled; enable(!) L0S */
+                        iwl_clear_bit(priv, CSR_GIO_REG,
+                                        CSR_GIO_REG_VAL_L0S_ENABLED);
+                        IWL_DEBUG_POWER(priv, "L1 Disabled; Enabling L0S\n");
+                }
+        }
+
+        /* Configure analog phase-lock-loop before activating to D0A */
+        if (priv->cfg->pll_cfg_val)
+                iwl_set_bit(priv, CSR_ANA_PLL_CFG, priv->cfg->pll_cfg_val);
+
+        /*
+         * Set "initialization complete" bit to move adapter from
+         * D0U* --> D0A* (powered-up active) state.
+         */
+        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+
+        /*
+         * Wait for clock stabilization; once stabilized, access to
+         * device-internal resources is supported, e.g. iwl_write_prph()
+         * and accesses to uCode SRAM.
+         */
+        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
+                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
+                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
+        if (ret < 0) {
+                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
+                goto out;
+        }
+
+        /*
+         * Enable DMA and BSM (if used) clocks, wait for them to stabilize.
+         * BSM (Boostrap State Machine) is only in 3945 and 4965;
+         * later devices (i.e. 5000 and later) have non-volatile SRAM,
+         * and don't need BSM to restore data after power-saving sleep.
+         *
+         * Write to "CLK_EN_REG"; "1" bits enable clocks, while "0" bits
+         * do not disable clocks.  This preserves any hardware bits already
+         * set by default in "CLK_CTRL_REG" after reset.
+         */
+        if (priv->cfg->use_bsm)
+                iwl_write_prph(priv, APMG_CLK_EN_REG,
+                        APMG_CLK_VAL_DMA_CLK_RQT | APMG_CLK_VAL_BSM_CLK_RQT);
+        else
+                iwl_write_prph(priv, APMG_CLK_EN_REG,
+                        APMG_CLK_VAL_DMA_CLK_RQT);
+        udelay(20);
+
+        /* Disable L1-Active */
+        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
+                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
+
+out:
+        return ret;
+}
+EXPORT_SYMBOL(iwl_apm_init);
+
+
+
 void iwl_configure_filter(struct ieee80211_hw *hw,
                           unsigned int changed_flags,
                           unsigned int *total_flags,
@@ -1393,73 +1602,14 @@ void iwl_configure_filter(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(iwl_configure_filter);
 
-int iwl_setup_mac(struct iwl_priv *priv)
-{
-        int ret;
-        struct ieee80211_hw *hw = priv->hw;
-        hw->rate_control_algorithm = "iwl-agn-rs";
-
-        /* Tell mac80211 our characteristics */
-        hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                    IEEE80211_HW_NOISE_DBM |
-                    IEEE80211_HW_AMPDU_AGGREGATION |
-                    IEEE80211_HW_SPECTRUM_MGMT;
-
-        if (!priv->cfg->broken_powersave)
-                hw->flags |= IEEE80211_HW_SUPPORTS_PS |
-                             IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
-
-        hw->wiphy->interface_modes =
-                BIT(NL80211_IFTYPE_STATION) |
-                BIT(NL80211_IFTYPE_ADHOC);
-
-        hw->wiphy->custom_regulatory = true;
-
-        /* Firmware does not support this */
-        hw->wiphy->disable_beacon_hints = true;
-
-        /*
-         * For now, disable PS by default because it affects
-         * RX performance significantly.
-         */
-        hw->wiphy->ps_default = false;
-
-        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
-        /* we create the 802.11 header and a zero-length SSID element */
-        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
-
-        /* Default value; 4 EDCA QOS priorities */
-        hw->queues = 4;
-
-        hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
-
-        if (priv->bands[IEEE80211_BAND_2GHZ].n_channels)
-                priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
-                        &priv->bands[IEEE80211_BAND_2GHZ];
-        if (priv->bands[IEEE80211_BAND_5GHZ].n_channels)
-                priv->hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
-                        &priv->bands[IEEE80211_BAND_5GHZ];
-
-        ret = ieee80211_register_hw(priv->hw);
-        if (ret) {
-                IWL_ERR(priv, "Failed to register hw (error %d)\n", ret);
-                return ret;
-        }
-        priv->mac80211_registered = 1;
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_setup_mac);
-
 int iwl_set_hw_params(struct iwl_priv *priv)
 {
         priv->hw_params.max_rxq_size = RX_QUEUE_SIZE;
         priv->hw_params.max_rxq_log = RX_QUEUE_SIZE_LOG;
         if (priv->cfg->mod_params->amsdu_size_8K)
-                priv->hw_params.rx_buf_size = IWL_RX_BUF_SIZE_8K;
+                priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_8K);
         else
-                priv->hw_params.rx_buf_size = IWL_RX_BUF_SIZE_4K;
-        priv->hw_params.max_pkt_size = priv->hw_params.rx_buf_size - 256;
+                priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_4K);
 
         priv->hw_params.max_beacon_itrvl = IWL_MAX_UCODE_BEACON_INTERVAL;
 
@@ -1471,71 +1621,6 @@ int iwl_set_hw_params(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_set_hw_params);
 
-int iwl_init_drv(struct iwl_priv *priv)
-{
-        int ret;
-
-        priv->ibss_beacon = NULL;
-
-        spin_lock_init(&priv->lock);
-        spin_lock_init(&priv->sta_lock);
-        spin_lock_init(&priv->hcmd_lock);
-
-        INIT_LIST_HEAD(&priv->free_frames);
-
-        mutex_init(&priv->mutex);
-
-        /* Clear the driver's (not device's) station table */
-        iwl_clear_stations_table(priv);
-
-        priv->data_retry_limit = -1;
-        priv->ieee_channels = NULL;
-        priv->ieee_rates = NULL;
-        priv->band = IEEE80211_BAND_2GHZ;
-
-        priv->iw_mode = NL80211_IFTYPE_STATION;
-
-        priv->current_ht_config.sm_ps = WLAN_HT_CAP_SM_PS_DISABLED;
-
-        /* Choose which receivers/antennas to use */
-        if (priv->cfg->ops->hcmd->set_rxon_chain)
-                priv->cfg->ops->hcmd->set_rxon_chain(priv);
-
-        iwl_init_scan_params(priv);
-
-        iwl_reset_qos(priv);
-
-        priv->qos_data.qos_active = 0;
-        priv->qos_data.qos_cap.val = 0;
-
-        priv->rates_mask = IWL_RATES_MASK;
-        /* Set the tx_power_user_lmt to the lowest power level
-         * this value will get overwritten by channel max power avg
-         * from eeprom */
-        priv->tx_power_user_lmt = IWL_TX_POWER_TARGET_POWER_MIN;
-
-        ret = iwl_init_channel_map(priv);
-        if (ret) {
-                IWL_ERR(priv, "initializing regulatory failed: %d\n", ret);
-                goto err;
-        }
-
-        ret = iwlcore_init_geos(priv);
-        if (ret) {
-                IWL_ERR(priv, "initializing geos failed: %d\n", ret);
-                goto err_free_channel_map;
-        }
-        iwlcore_init_hw_rates(priv, priv->ieee_rates);
-
-        return 0;
-
-err_free_channel_map:
-        iwl_free_channel_map(priv);
-err:
-        return ret;
-}
-EXPORT_SYMBOL(iwl_init_drv);
-
 int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
 {
         int ret = 0;
@@ -1583,24 +1668,15 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
 }
 EXPORT_SYMBOL(iwl_set_tx_power);
 
-void iwl_uninit_drv(struct iwl_priv *priv)
-{
-        iwl_calib_free_results(priv);
-        iwlcore_free_geos(priv);
-        iwl_free_channel_map(priv);
-        kfree(priv->scan);
-}
-EXPORT_SYMBOL(iwl_uninit_drv);
-
 #define ICT_COUNT (PAGE_SIZE/sizeof(u32))
 
 /* Free dram table */
 void iwl_free_isr_ict(struct iwl_priv *priv)
 {
         if (priv->ict_tbl_vir) {
-                pci_free_consistent(priv->pci_dev, (sizeof(u32) * ICT_COUNT) +
-                                        PAGE_SIZE, priv->ict_tbl_vir,
-                                        priv->ict_tbl_dma);
+                dma_free_coherent(&priv->pci_dev->dev,
+                                  (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
+                                  priv->ict_tbl_vir, priv->ict_tbl_dma);
                 priv->ict_tbl_vir = NULL;
         }
 }
@@ -1616,9 +1692,9 @@ int iwl_alloc_isr_ict(struct iwl_priv *priv)
         if (priv->cfg->use_isr_legacy)
                 return 0;
         /* allocate shrared data table */
-        priv->ict_tbl_vir = pci_alloc_consistent(priv->pci_dev, (sizeof(u32) *
-                                                  ICT_COUNT) + PAGE_SIZE,
-                                                  &priv->ict_tbl_dma);
+        priv->ict_tbl_vir = dma_alloc_coherent(&priv->pci_dev->dev,
+                                        (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
+                                        &priv->ict_tbl_dma, GFP_KERNEL);
         if (!priv->ict_tbl_vir)
                 return -ENOMEM;
 
@@ -1753,6 +1829,16 @@ irqreturn_t iwl_isr_ict(int irq, void *data)
         if (val == 0xffffffff)
                 val = 0;
 
+        /*
+         * this is a w/a for a h/w bug. the h/w bug may cause the Rx bit
+         * (bit 15 before shifting it to 31) to clear when using interrupt
+         * coalescing. fortunately, bits 18 and 19 stay set when this happens
+         * so we use them to decide on the real state of the Rx bit.
+         * In order words, bit 15 is set if bit 18 or bit 19 are set.
+         */
+        if (val & 0xC0000)
+                val |= 0x8000;
+
         inta = (0xff & val) | ((0xff00 & val) << 16);
         IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x ict 0x%08x\n",
                         inta, inta_mask, val);
@@ -1915,28 +2001,40 @@ EXPORT_SYMBOL(iwl_isr_legacy);
 int iwl_send_bt_config(struct iwl_priv *priv)
 {
         struct iwl_bt_cmd bt_cmd = {
-                .flags = 3,
-                .lead_time = 0xAA,
-                .max_kill = 1,
+                .lead_time = BT_LEAD_TIME_DEF,
+                .max_kill = BT_MAX_KILL_DEF,
                 .kill_ack_mask = 0,
                 .kill_cts_mask = 0,
         };
 
+        if (!bt_coex_active)
+                bt_cmd.flags = BT_COEX_DISABLE;
+        else
+                bt_cmd.flags = BT_COEX_ENABLE;
+
+        IWL_DEBUG_INFO(priv, "BT coex %s\n",
+                (bt_cmd.flags == BT_COEX_DISABLE) ? "disable" : "active");
+
         return iwl_send_cmd_pdu(priv, REPLY_BT_CONFIG,
                                 sizeof(struct iwl_bt_cmd), &bt_cmd);
 }
 EXPORT_SYMBOL(iwl_send_bt_config);
 
-int iwl_send_statistics_request(struct iwl_priv *priv, u8 flags)
+int iwl_send_statistics_request(struct iwl_priv *priv, u8 flags, bool clear)
 {
-        u32 stat_flags = 0;
-        struct iwl_host_cmd cmd = {
-                .id = REPLY_STATISTICS_CMD,
-                .flags = flags,
-                .len = sizeof(stat_flags),
-                .data = (u8 *) &stat_flags,
+        struct iwl_statistics_cmd statistics_cmd = {
+                .configuration_flags =
+                        clear ? IWL_STATS_CONF_CLEAR_STATS : 0,
         };
-        return iwl_send_cmd(priv, &cmd);
+
+        if (flags & CMD_ASYNC)
+                return iwl_send_cmd_pdu_async(priv, REPLY_STATISTICS_CMD,
+                                               sizeof(struct iwl_statistics_cmd),
+                                               &statistics_cmd, NULL);
+        else
+                return iwl_send_cmd_pdu(priv, REPLY_STATISTICS_CMD,
+                                        sizeof(struct iwl_statistics_cmd),
+                                        &statistics_cmd);
 }
 EXPORT_SYMBOL(iwl_send_statistics_request);
 
@@ -2077,10 +2175,7 @@ void iwl_rf_kill_ct_config(struct iwl_priv *priv)
         spin_unlock_irqrestore(&priv->lock, flags);
         priv->thermal_throttle.ct_kill_toggle = false;
 
-        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
-        case CSR_HW_REV_TYPE_1000:
-        case CSR_HW_REV_TYPE_6x00:
-        case CSR_HW_REV_TYPE_6x50:
+        if (priv->cfg->support_ct_kill_exit) {
                 adv_cmd.critical_temperature_enter =
                         cpu_to_le32(priv->hw_params.ct_kill_threshold);
                 adv_cmd.critical_temperature_exit =
@@ -2097,8 +2192,7 @@ void iwl_rf_kill_ct_config(struct iwl_priv *priv)
                                         "exit is %d\n",
                                        priv->hw_params.ct_kill_threshold,
                                        priv->hw_params.ct_kill_exit_threshold);
-                break;
-        default:
+        } else {
                 cmd.critical_temperature_R =
                         cpu_to_le32(priv->hw_params.ct_kill_threshold);
 
@@ -2111,7 +2205,6 @@ void iwl_rf_kill_ct_config(struct iwl_priv *priv)
                                         "succeeded, "
                                         "critical temperature is %d\n",
                                         priv->hw_params.ct_kill_threshold);
-                break;
         }
 }
 EXPORT_SYMBOL(iwl_rf_kill_ct_config);
@@ -2143,7 +2236,7 @@ void iwl_rx_pm_sleep_notif(struct iwl_priv *priv,
                            struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_sleep_notification *sleep = &(pkt->u.sleep_notif);
         IWL_DEBUG_RX(priv, "sleep mode: %d, src: %d\n",
                      sleep->pm_sleep_mode, sleep->pm_wakeup_src);
@@ -2154,7 +2247,7 @@ EXPORT_SYMBOL(iwl_rx_pm_sleep_notif);
 void iwl_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
                                       struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u32 len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
         IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "
                         "notification for %s:\n", len,
@@ -2166,7 +2259,7 @@ EXPORT_SYMBOL(iwl_rx_pm_debug_statistics_notif);
 void iwl_rx_reply_error(struct iwl_priv *priv,
                         struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
 
         IWL_ERR(priv, "Error Reply type 0x%08X cmd %s (0x%02X) "
                 "seq 0x%04X ser 0x%08X\n",
@@ -2228,46 +2321,77 @@ int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
 EXPORT_SYMBOL(iwl_mac_conf_tx);
 
 static void iwl_ht_conf(struct iwl_priv *priv,
-                            struct ieee80211_bss_conf *bss_conf)
+                        struct ieee80211_bss_conf *bss_conf)
 {
-        struct ieee80211_sta_ht_cap *ht_conf;
-        struct iwl_ht_info *iwl_conf = &priv->current_ht_config;
+        struct iwl_ht_config *ht_conf = &priv->current_ht_config;
         struct ieee80211_sta *sta;
 
         IWL_DEBUG_MAC80211(priv, "enter: \n");
 
-        if (!iwl_conf->is_ht)
+        if (!ht_conf->is_ht)
                 return;
 
+        ht_conf->ht_protection =
+                bss_conf->ht_operation_mode & IEEE80211_HT_OP_MODE_PROTECTION;
+        ht_conf->non_GF_STA_present =
+                !!(bss_conf->ht_operation_mode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
 
-        /*
-         * It is totally wrong to base global information on something
-         * that is valid only when associated, alas, this driver works
-         * that way and I don't know how to fix it.
-         */
+        ht_conf->single_chain_sufficient = false;
 
-        rcu_read_lock();
-        sta = ieee80211_find_sta(priv->hw, priv->bssid);
-        if (!sta) {
+        switch (priv->iw_mode) {
+        case NL80211_IFTYPE_STATION:
+                rcu_read_lock();
+                sta = ieee80211_find_sta(priv->vif, priv->bssid);
+                if (sta) {
+                        struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
+                        int maxstreams;
+
+                        maxstreams = (ht_cap->mcs.tx_params &
+                                      IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
+                                        >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
+                        maxstreams += 1;
+
+                        if ((ht_cap->mcs.rx_mask[1] == 0) &&
+                            (ht_cap->mcs.rx_mask[2] == 0))
+                                ht_conf->single_chain_sufficient = true;
+                        if (maxstreams <= 1)
+                                ht_conf->single_chain_sufficient = true;
+                } else {
+                        /*
+                         * If at all, this can only happen through a race
+                         * when the AP disconnects us while we're still
+                         * setting up the connection, in that case mac80211
+                         * will soon tell us about that.
+                         */
+                        ht_conf->single_chain_sufficient = true;
+                }
                 rcu_read_unlock();
-                return;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                ht_conf->single_chain_sufficient = true;
+                break;
+        default:
+                break;
         }
-        ht_conf = &sta->ht_cap;
-
-        iwl_conf->sm_ps = (u8)((ht_conf->cap & IEEE80211_HT_CAP_SM_PS) >> 2);
-
-        memcpy(&iwl_conf->mcs, &ht_conf->mcs, 16);
-
-        iwl_conf->ht_protection =
-                bss_conf->ht_operation_mode & IEEE80211_HT_OP_MODE_PROTECTION;
-        iwl_conf->non_GF_STA_present =
-                !!(bss_conf->ht_operation_mode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
-
-        rcu_read_unlock();
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
+static inline void iwl_set_no_assoc(struct iwl_priv *priv)
+{
+        priv->assoc_id = 0;
+        iwl_led_disassociate(priv);
+        /*
+         * inform the ucode that there is no longer an
+         * association and that no more packets should be
+         * sent
+         */
+        priv->staging_rxon.filter_flags &=
+                ~RXON_FILTER_ASSOC_MSK;
+        priv->staging_rxon.assoc_id = 0;
+        iwlcore_commit_rxon(priv);
+}
+
 #define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
 void iwl_bss_info_changed(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif,
@@ -2387,6 +2511,8 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                         priv->timestamp = bss_conf->timestamp;
                         priv->assoc_capability = bss_conf->assoc_capability;
 
+                        iwl_led_associate(priv);
+
                         /*
                          * We have just associated, don't start scan too early
                          * leave time for EAPOL exchange to complete.
@@ -2398,8 +2524,7 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                         if (!iwl_is_rfkill(priv))
                                 priv->cfg->ops->lib->post_associate(priv);
                 } else
-                        priv->assoc_id = 0;
-
+                        iwl_set_no_assoc(priv);
         }
 
         if (changes && iwl_is_associated(priv) && priv->assoc_id) {
@@ -2414,6 +2539,16 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
+        if (changes & BSS_CHANGED_BEACON_ENABLED) {
+                if (vif->bss_conf.enable_beacon) {
+                        memcpy(priv->staging_rxon.bssid_addr,
+                               bss_conf->bssid, ETH_ALEN);
+                        memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
+                        iwlcore_config_ap(priv);
+                } else
+                        iwl_set_no_assoc(priv);
+        }
+
         mutex_unlock(&priv->mutex);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
@@ -2497,44 +2632,43 @@ int iwl_set_mode(struct iwl_priv *priv, int mode)
 EXPORT_SYMBOL(iwl_set_mode);
 
 int iwl_mac_add_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_if_init_conf *conf)
+                                 struct ieee80211_vif *vif)
 {
         struct iwl_priv *priv = hw->priv;
-        unsigned long flags;
+        int err = 0;
+
+        IWL_DEBUG_MAC80211(priv, "enter: type %d\n", vif->type);
 
-        IWL_DEBUG_MAC80211(priv, "enter: type %d\n", conf->type);
+        mutex_lock(&priv->mutex);
 
         if (priv->vif) {
                 IWL_DEBUG_MAC80211(priv, "leave - vif != NULL\n");
-                return -EOPNOTSUPP;
+                err = -EOPNOTSUPP;
+                goto out;
         }
 
-        spin_lock_irqsave(&priv->lock, flags);
-        priv->vif = conf->vif;
-        priv->iw_mode = conf->type;
+        priv->vif = vif;
+        priv->iw_mode = vif->type;
 
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        mutex_lock(&priv->mutex);
-
-        if (conf->mac_addr) {
-                IWL_DEBUG_MAC80211(priv, "Set %pM\n", conf->mac_addr);
-                memcpy(priv->mac_addr, conf->mac_addr, ETH_ALEN);
+        if (vif->addr) {
+                IWL_DEBUG_MAC80211(priv, "Set %pM\n", vif->addr);
+                memcpy(priv->mac_addr, vif->addr, ETH_ALEN);
         }
 
-        if (iwl_set_mode(priv, conf->type) == -EAGAIN)
+        if (iwl_set_mode(priv, vif->type) == -EAGAIN)
                 /* we are not ready, will run again when ready */
                 set_bit(STATUS_MODE_PENDING, &priv->status);
 
+ out:
         mutex_unlock(&priv->mutex);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
-        return 0;
+        return err;
 }
 EXPORT_SYMBOL(iwl_mac_add_interface);
 
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
-                                     struct ieee80211_if_init_conf *conf)
+                                     struct ieee80211_vif *vif)
 {
         struct iwl_priv *priv = hw->priv;
 
@@ -2547,7 +2681,7 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
                 priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
                 iwlcore_commit_rxon(priv);
         }
-        if (priv->vif == conf->vif) {
+        if (priv->vif == vif) {
                 priv->vif = NULL;
                 memset(priv->bssid, 0, ETH_ALEN);
         }
@@ -2570,7 +2704,7 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
         struct iwl_priv *priv = hw->priv;
         const struct iwl_channel_info *ch_info;
         struct ieee80211_conf *conf = &hw->conf;
-        struct iwl_ht_info *ht_conf = &priv->current_ht_config;
+        struct iwl_ht_config *ht_conf = &priv->current_ht_config;
         unsigned long flags = 0;
         int ret = 0;
         u16 ch;
@@ -2587,6 +2721,21 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                 IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
         }
 
+        if (changed & (IEEE80211_CONF_CHANGE_SMPS |
+                       IEEE80211_CONF_CHANGE_CHANNEL)) {
+                /* mac80211 uses static for non-HT which is what we want */
+                priv->current_ht_config.smps = conf->smps_mode;
+
+                /*
+                 * Recalculate chain counts.
+                 *
+                 * If monitor mode is enabled then mac80211 will
+                 * set up the SM PS mode to OFF if an HT channel is
+                 * configured.
+                 */
+                if (priv->cfg->ops->hcmd->set_rxon_chain)
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv);
+        }
 
         /* during scanning mac80211 will delay channel setting until
          * scan finish with changed = 0
@@ -2620,21 +2769,18 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                         if (conf_is_ht40_minus(conf)) {
                                 ht_conf->extension_chan_offset =
                                         IEEE80211_HT_PARAM_CHA_SEC_BELOW;
-                                ht_conf->supported_chan_width =
-                                        IWL_CHANNEL_WIDTH_40MHZ;
+                                ht_conf->is_40mhz = true;
                         } else if (conf_is_ht40_plus(conf)) {
                                 ht_conf->extension_chan_offset =
                                         IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
-                                ht_conf->supported_chan_width =
-                                        IWL_CHANNEL_WIDTH_40MHZ;
+                                ht_conf->is_40mhz = true;
                         } else {
                                 ht_conf->extension_chan_offset =
                                         IEEE80211_HT_PARAM_CHA_SEC_NONE;
-                                ht_conf->supported_chan_width =
-                                        IWL_CHANNEL_WIDTH_20MHZ;
+                                ht_conf->is_40mhz = false;
                         }
                 } else
-                        ht_conf->supported_chan_width = IWL_CHANNEL_WIDTH_20MHZ;
+                        ht_conf->is_40mhz = false;
                 /* Default to no protection. Protection mode will later be set
                  * from BSS config in iwl_ht_conf */
                 ht_conf->ht_protection = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
@@ -2646,9 +2792,26 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                         priv->staging_rxon.flags = 0;
 
                 iwl_set_rxon_channel(priv, conf->channel);
+                iwl_set_rxon_ht(priv, ht_conf);
 
                 iwl_set_flags_for_band(priv, conf->channel->band);
                 spin_unlock_irqrestore(&priv->lock, flags);
+                if (iwl_is_associated(priv) &&
+                    (le16_to_cpu(priv->active_rxon.channel) != ch) &&
+                    priv->cfg->ops->lib->set_channel_switch) {
+                        iwl_set_rate(priv);
+                        /*
+                         * at this point, staging_rxon has the
+                         * configuration for channel switch
+                         */
+                        ret = priv->cfg->ops->lib->set_channel_switch(priv,
+                                ch);
+                        if (!ret) {
+                                iwl_print_rx_config_cmd(priv);
+                                goto out;
+                        }
+                        priv->switch_rxon.switch_in_progress = false;
+                }
  set_ch_out:
                 /* The list of supported rates and rate mask can be different
                  * for each band; since the band may have changed, reset
@@ -2656,7 +2819,8 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                 iwl_set_rate(priv);
         }
 
-        if (changed & IEEE80211_CONF_CHANGE_PS) {
+        if (changed & (IEEE80211_CONF_CHANGE_PS |
+                        IEEE80211_CONF_CHANGE_IDLE)) {
                 ret = iwl_power_update_mode(priv, false);
                 if (ret)
                         IWL_DEBUG_MAC80211(priv, "Error setting sleep level\n");
@@ -2669,10 +2833,6 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                 iwl_set_tx_power(priv, conf->power_level, false);
         }
 
-        /* call to ensure that 4965 rx_chain is set properly in monitor mode */
-        if (priv->cfg->ops->hcmd->set_rxon_chain)
-                priv->cfg->ops->hcmd->set_rxon_chain(priv);
-
         if (!iwl_is_ready(priv)) {
                 IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
                 goto out;
@@ -2695,42 +2855,6 @@ out:
 }
 EXPORT_SYMBOL(iwl_mac_config);
 
-int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
-                         struct ieee80211_tx_queue_stats *stats)
-{
-        struct iwl_priv *priv = hw->priv;
-        int i, avail;
-        struct iwl_tx_queue *txq;
-        struct iwl_queue *q;
-        unsigned long flags;
-
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
-                return -EIO;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        for (i = 0; i < AC_NUM; i++) {
-                txq = &priv->txq[i];
-                q = &txq->q;
-                avail = iwl_queue_space(q);
-
-                stats[i].len = q->n_window - avail;
-                stats[i].limit = q->n_window - q->high_mark;
-                stats[i].count = q->n_window;
-
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_mac_get_tx_stats);
-
 void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = hw->priv;
@@ -2740,7 +2864,7 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
         spin_lock_irqsave(&priv->lock, flags);
-        memset(&priv->current_ht_config, 0, sizeof(struct iwl_ht_info));
+        memset(&priv->current_ht_config, 0, sizeof(struct iwl_ht_config));
         spin_unlock_irqrestore(&priv->lock, flags);
 
         iwl_reset_qos(priv);
@@ -2792,6 +2916,55 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(iwl_mac_reset_tsf);
 
+int iwl_alloc_txq_mem(struct iwl_priv *priv)
+{
+        if (!priv->txq)
+                priv->txq = kzalloc(
+                        sizeof(struct iwl_tx_queue) * priv->cfg->num_of_queues,
+                        GFP_KERNEL);
+        if (!priv->txq) {
+                IWL_ERR(priv, "Not enough memory for txq \n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(iwl_alloc_txq_mem);
+
+void iwl_free_txq_mem(struct iwl_priv *priv)
+{
+        kfree(priv->txq);
+        priv->txq = NULL;
+}
+EXPORT_SYMBOL(iwl_free_txq_mem);
+
+int iwl_send_wimax_coex(struct iwl_priv *priv)
+{
+        struct iwl_wimax_coex_cmd uninitialized_var(coex_cmd);
+
+        if (priv->cfg->support_wimax_coexist) {
+                /* UnMask wake up src at associated sleep */
+                coex_cmd.flags |= COEX_FLAGS_ASSOC_WA_UNMASK_MSK;
+
+                /* UnMask wake up src at unassociated sleep */
+                coex_cmd.flags |= COEX_FLAGS_UNASSOC_WA_UNMASK_MSK;
+                memcpy(coex_cmd.sta_prio, cu_priorities,
+                        sizeof(struct iwl_wimax_coex_event_entry) *
+                         COEX_NUM_OF_EVENTS);
+
+                /* enabling the coexistence feature */
+                coex_cmd.flags |= COEX_FLAGS_COEX_ENABLE_MSK;
+
+                /* enabling the priorities tables */
+                coex_cmd.flags |= COEX_FLAGS_STA_TABLE_VALID_MSK;
+        } else {
+                /* coexistence is disabled */
+                memset(&coex_cmd, 0, sizeof(coex_cmd));
+        }
+        return iwl_send_cmd_pdu(priv, COEX_PRIORITY_TABLE_CMD,
+                                sizeof(coex_cmd), &coex_cmd);
+}
+EXPORT_SYMBOL(iwl_send_wimax_coex);
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 
 #define IWL_TRAFFIC_DUMP_SIZE   (IWL_TRAFFIC_ENTRY_SIZE * IWL_TRAFFIC_ENTRIES)
@@ -2929,15 +3102,11 @@ const char *get_ctrl_string(int cmd)
         }
 }
 
-void iwl_clear_tx_stats(struct iwl_priv *priv)
+void iwl_clear_traffic_stats(struct iwl_priv *priv)
 {
         memset(&priv->tx_stats, 0, sizeof(struct traffic_stats));
-
-}
-
-void iwl_clear_rx_stats(struct iwl_priv *priv)
-{
         memset(&priv->rx_stats, 0, sizeof(struct traffic_stats));
+        priv->led_tpt = 0;
 }
 
 /*
@@ -3030,10 +3199,211 @@ void iwl_update_stats(struct iwl_priv *priv, bool is_tx, __le16 fc, u16 len)
                 stats->data_cnt++;
                 stats->data_bytes += len;
         }
+        iwl_leds_background(priv);
 }
 EXPORT_SYMBOL(iwl_update_stats);
 #endif
 
+const static char *get_csr_string(int cmd)
+{
+        switch (cmd) {
+                IWL_CMD(CSR_HW_IF_CONFIG_REG);
+                IWL_CMD(CSR_INT_COALESCING);
+                IWL_CMD(CSR_INT);
+                IWL_CMD(CSR_INT_MASK);
+                IWL_CMD(CSR_FH_INT_STATUS);
+                IWL_CMD(CSR_GPIO_IN);
+                IWL_CMD(CSR_RESET);
+                IWL_CMD(CSR_GP_CNTRL);
+                IWL_CMD(CSR_HW_REV);
+                IWL_CMD(CSR_EEPROM_REG);
+                IWL_CMD(CSR_EEPROM_GP);
+                IWL_CMD(CSR_OTP_GP_REG);
+                IWL_CMD(CSR_GIO_REG);
+                IWL_CMD(CSR_GP_UCODE_REG);
+                IWL_CMD(CSR_GP_DRIVER_REG);
+                IWL_CMD(CSR_UCODE_DRV_GP1);
+                IWL_CMD(CSR_UCODE_DRV_GP2);
+                IWL_CMD(CSR_LED_REG);
+                IWL_CMD(CSR_DRAM_INT_TBL_REG);
+                IWL_CMD(CSR_GIO_CHICKEN_BITS);
+                IWL_CMD(CSR_ANA_PLL_CFG);
+                IWL_CMD(CSR_HW_REV_WA_REG);
+                IWL_CMD(CSR_DBG_HPET_MEM_REG);
+        default:
+                return "UNKNOWN";
+
+        }
+}
+
+void iwl_dump_csr(struct iwl_priv *priv)
+{
+        int i;
+        u32 csr_tbl[] = {
+                CSR_HW_IF_CONFIG_REG,
+                CSR_INT_COALESCING,
+                CSR_INT,
+                CSR_INT_MASK,
+                CSR_FH_INT_STATUS,
+                CSR_GPIO_IN,
+                CSR_RESET,
+                CSR_GP_CNTRL,
+                CSR_HW_REV,
+                CSR_EEPROM_REG,
+                CSR_EEPROM_GP,
+                CSR_OTP_GP_REG,
+                CSR_GIO_REG,
+                CSR_GP_UCODE_REG,
+                CSR_GP_DRIVER_REG,
+                CSR_UCODE_DRV_GP1,
+                CSR_UCODE_DRV_GP2,
+                CSR_LED_REG,
+                CSR_DRAM_INT_TBL_REG,
+                CSR_GIO_CHICKEN_BITS,
+                CSR_ANA_PLL_CFG,
+                CSR_HW_REV_WA_REG,
+                CSR_DBG_HPET_MEM_REG
+        };
+        IWL_ERR(priv, "CSR values:\n");
+        IWL_ERR(priv, "(2nd byte of CSR_INT_COALESCING is "
+                "CSR_INT_PERIODIC_REG)\n");
+        for (i = 0; i <  ARRAY_SIZE(csr_tbl); i++) {
+                IWL_ERR(priv, "  %25s: 0X%08x\n",
+                        get_csr_string(csr_tbl[i]),
+                        iwl_read32(priv, csr_tbl[i]));
+        }
+}
+EXPORT_SYMBOL(iwl_dump_csr);
+
+const static char *get_fh_string(int cmd)
+{
+        switch (cmd) {
+                IWL_CMD(FH_RSCSR_CHNL0_STTS_WPTR_REG);
+                IWL_CMD(FH_RSCSR_CHNL0_RBDCB_BASE_REG);
+                IWL_CMD(FH_RSCSR_CHNL0_WPTR);
+                IWL_CMD(FH_MEM_RCSR_CHNL0_CONFIG_REG);
+                IWL_CMD(FH_MEM_RSSR_SHARED_CTRL_REG);
+                IWL_CMD(FH_MEM_RSSR_RX_STATUS_REG);
+                IWL_CMD(FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV);
+                IWL_CMD(FH_TSSR_TX_STATUS_REG);
+                IWL_CMD(FH_TSSR_TX_ERROR_REG);
+        default:
+                return "UNKNOWN";
+
+        }
+}
+
+int iwl_dump_fh(struct iwl_priv *priv, char **buf, bool display)
+{
+        int i;
+#ifdef CONFIG_IWLWIFI_DEBUG
+        int pos = 0;
+        size_t bufsz = 0;
+#endif
+        u32 fh_tbl[] = {
+                FH_RSCSR_CHNL0_STTS_WPTR_REG,
+                FH_RSCSR_CHNL0_RBDCB_BASE_REG,
+                FH_RSCSR_CHNL0_WPTR,
+                FH_MEM_RCSR_CHNL0_CONFIG_REG,
+                FH_MEM_RSSR_SHARED_CTRL_REG,
+                FH_MEM_RSSR_RX_STATUS_REG,
+                FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV,
+                FH_TSSR_TX_STATUS_REG,
+                FH_TSSR_TX_ERROR_REG
+        };
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (display) {
+                bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
+                *buf = kmalloc(bufsz, GFP_KERNEL);
+                if (!*buf)
+                        return -ENOMEM;
+                pos += scnprintf(*buf + pos, bufsz - pos,
+                                "FH register values:\n");
+                for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
+                        pos += scnprintf(*buf + pos, bufsz - pos,
+                                "  %34s: 0X%08x\n",
+                                get_fh_string(fh_tbl[i]),
+                                iwl_read_direct32(priv, fh_tbl[i]));
+                }
+                return pos;
+        }
+#endif
+        IWL_ERR(priv, "FH register values:\n");
+        for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++) {
+                IWL_ERR(priv, "  %34s: 0X%08x\n",
+                        get_fh_string(fh_tbl[i]),
+                        iwl_read_direct32(priv, fh_tbl[i]));
+        }
+        return 0;
+}
+EXPORT_SYMBOL(iwl_dump_fh);
+
+static void iwl_force_rf_reset(struct iwl_priv *priv)
+{
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        if (!iwl_is_associated(priv)) {
+                IWL_DEBUG_SCAN(priv, "force reset rejected: not associated\n");
+                return;
+        }
+        /*
+         * There is no easy and better way to force reset the radio,
+         * the only known method is switching channel which will force to
+         * reset and tune the radio.
+         * Use internal short scan (single channel) operation to should
+         * achieve this objective.
+         * Driver should reset the radio when number of consecutive missed
+         * beacon, or any other uCode error condition detected.
+         */
+        IWL_DEBUG_INFO(priv, "perform radio reset.\n");
+        iwl_internal_short_hw_scan(priv);
+}
+
+
+int iwl_force_reset(struct iwl_priv *priv, int mode)
+{
+        struct iwl_force_reset *force_reset;
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return -EINVAL;
+
+        if (mode >= IWL_MAX_FORCE_RESET) {
+                IWL_DEBUG_INFO(priv, "invalid reset request.\n");
+                return -EINVAL;
+        }
+        force_reset = &priv->force_reset[mode];
+        force_reset->reset_request_count++;
+        if (force_reset->last_force_reset_jiffies &&
+            time_after(force_reset->last_force_reset_jiffies +
+            force_reset->reset_duration, jiffies)) {
+                IWL_DEBUG_INFO(priv, "force reset rejected\n");
+                force_reset->reset_reject_count++;
+                return -EAGAIN;
+        }
+        force_reset->reset_success_count++;
+        force_reset->last_force_reset_jiffies = jiffies;
+        IWL_DEBUG_INFO(priv, "perform force reset (%d)\n", mode);
+        switch (mode) {
+        case IWL_RF_RESET:
+                iwl_force_rf_reset(priv);
+                break;
+        case IWL_FW_RESET:
+                IWL_ERR(priv, "On demand firmware reload\n");
+                /* Set the FW error flag -- cleared on iwl_down */
+                set_bit(STATUS_FW_ERROR, &priv->status);
+                wake_up_interruptible(&priv->wait_command_queue);
+                /*
+                 * Keep the restart process from trying to send host
+                 * commands by clearing the INIT status bit
+                 */
+                clear_bit(STATUS_READY, &priv->status);
+                queue_work(priv->workqueue, &priv->restart);
+                break;
+        }
+        return 0;
+}
+
 #ifdef CONFIG_PM
 
 int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 7754538c2194..36940a9ec6b9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -70,8 +70,8 @@ struct iwl_host_cmd;
 struct iwl_cmd;
 
 
-#define IWLWIFI_VERSION "1.3.27k"
-#define DRV_COPYRIGHT   "Copyright(c) 2003-2009 Intel Corporation"
+#define IWLWIFI_VERSION "in-tree:"
+#define DRV_COPYRIGHT   "Copyright(c) 2003-2010 Intel Corporation"
 #define DRV_AUTHOR     "<ilw@linux.intel.com>"
 
 #define IWL_PCI_DEVICE(dev, subdev, cfg) \
@@ -89,6 +89,7 @@ struct iwl_hcmd_ops {
         int (*rxon_assoc)(struct iwl_priv *priv);
         int (*commit_rxon)(struct iwl_priv *priv);
         void (*set_rxon_chain)(struct iwl_priv *priv);
+        int (*set_tx_ant)(struct iwl_priv *priv, u8 valid_tx_ant);
 };
 
 struct iwl_hcmd_utils_ops {
@@ -97,7 +98,8 @@ struct iwl_hcmd_utils_ops {
         void (*gain_computation)(struct iwl_priv *priv,
                         u32 *average_noise,
                         u16 min_average_noise_antennat_i,
-                        u32 min_average_noise);
+                        u32 min_average_noise,
+                        u8 default_chain);
         void (*chain_noise_reset)(struct iwl_priv *priv);
         void (*rts_tx_cmd_flag)(struct ieee80211_tx_info *info,
                         __le32 *tx_flags);
@@ -107,7 +109,6 @@ struct iwl_hcmd_utils_ops {
 
 struct iwl_apm_ops {
         int (*init)(struct iwl_priv *priv);
-        int (*reset)(struct iwl_priv *priv);
         void (*stop)(struct iwl_priv *priv);
         void (*config)(struct iwl_priv *priv);
         int (*set_pwr_src)(struct iwl_priv *priv, enum iwl_pwr_src src);
@@ -116,6 +117,7 @@ struct iwl_apm_ops {
 struct iwl_temp_ops {
         void (*temperature)(struct iwl_priv *priv);
         void (*set_ct_kill)(struct iwl_priv *priv);
+        void (*set_calib_version)(struct iwl_priv *priv);
 };
 
 struct iwl_ucode_ops {
@@ -166,8 +168,12 @@ struct iwl_lib_ops {
         int (*is_valid_rtc_data_addr)(u32 addr);
         /* 1st ucode load */
         int (*load_ucode)(struct iwl_priv *priv);
-        void (*dump_nic_event_log)(struct iwl_priv *priv);
+        int (*dump_nic_event_log)(struct iwl_priv *priv,
+                                  bool full_log, char **buf, bool display);
         void (*dump_nic_error_log)(struct iwl_priv *priv);
+        void (*dump_csr)(struct iwl_priv *priv);
+        int (*dump_fh)(struct iwl_priv *priv, char **buf, bool display);
+        int (*set_channel_switch)(struct iwl_priv *priv, u16 channel);
         /* power management */
         struct iwl_apm_ops apm_ops;
 
@@ -183,6 +189,14 @@ struct iwl_lib_ops {
 
         /* temperature */
         struct iwl_temp_ops temp_ops;
+        /* station management */
+        void (*add_bcast_station)(struct iwl_priv *priv);
+};
+
+struct iwl_led_ops {
+        int (*cmd)(struct iwl_priv *priv, struct iwl_led_cmd *led_cmd);
+        int (*on)(struct iwl_priv *priv);
+        int (*off)(struct iwl_priv *priv);
 };
 
 struct iwl_ops {
@@ -190,13 +204,13 @@ struct iwl_ops {
         const struct iwl_lib_ops *lib;
         const struct iwl_hcmd_ops *hcmd;
         const struct iwl_hcmd_utils_ops *utils;
+        const struct iwl_led_ops *led;
 };
 
 struct iwl_mod_params {
         int sw_crypto;          /* def: 0 = using hardware encryption */
         int disable_hw_scan;    /* def: 0 = use h/w scan */
         int num_of_queues;      /* def: HW dependent */
-        int num_of_ampdu_queues;/* def: HW dependent */
         int disable_11n;        /* def: 0 = 11n capabilities enabled */
         int amsdu_size_8K;      /* def: 1 = enable 8K amsdu size */
         int antenna;            /* def: 0 = both antennas (use diversity) */
@@ -213,7 +227,16 @@ struct iwl_mod_params {
  * @pa_type: used by 6000 series only to identify the type of Power Amplifier
  * @max_ll_items: max number of OTP blocks
  * @shadow_ram_support: shadow support for OTP memory
+ * @led_compensation: compensate on the led on/off time per HW according
+ *      to the deviation to achieve the desired led frequency.
+ *      The detail algorithm is described in iwl-led.c
  * @use_rts_for_ht: use rts/cts protection for HT traffic
+ * @chain_noise_num_beacons: number of beacons used to compute chain noise
+ * @adv_thermal_throttle: support advance thermal throttle
+ * @support_ct_kill_exit: support ct kill exit condition
+ * @support_wimax_coexist: support wimax/wifi co-exist
+ * @plcp_delta_threshold: plcp error rate threshold used to trigger
+ *      radio tuning when there is a high receiving plcp error rate
  *
  * We enable the driver to be backward compatible wrt API version. The
  * driver specifies which APIs it supports (with @ucode_api_max being the
@@ -245,18 +268,33 @@ struct iwl_cfg {
         int eeprom_size;
         u16  eeprom_ver;
         u16  eeprom_calib_ver;
+        int num_of_queues;      /* def: HW dependent */
+        int num_of_ampdu_queues;/* def: HW dependent */
         const struct iwl_ops *ops;
         const struct iwl_mod_params *mod_params;
         u8   valid_tx_ant;
         u8   valid_rx_ant;
-        bool need_pll_cfg;
+
+        /* for iwl_apm_init() */
+        u32 pll_cfg_val;
+        bool set_l0s;
+        bool use_bsm;
+
         bool use_isr_legacy;
         enum iwl_pa_type pa_type;
         const u16 max_ll_items;
         const bool shadow_ram_support;
         const bool ht_greenfield_support;
+        u16 led_compensation;
         const bool broken_powersave;
         bool use_rts_for_ht;
+        int chain_noise_num_beacons;
+        const bool supports_idle;
+        bool adv_thermal_throttle;
+        bool support_ct_kill_exit;
+        const bool support_wimax_coexist;
+        u8 plcp_delta_threshold;
+        s32 chain_noise_scale;
 };
 
 /***************************
@@ -275,7 +313,7 @@ int iwl_check_rxon_cmd(struct iwl_priv *priv);
 int iwl_full_rxon_required(struct iwl_priv *priv);
 void iwl_set_rxon_chain(struct iwl_priv *priv);
 int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch);
-void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_info *ht_info);
+void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf);
 u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                          struct ieee80211_sta_ht_cap *sta_ht_inf);
 void iwl_set_flags_for_band(struct iwl_priv *priv, enum ieee80211_band band);
@@ -289,10 +327,7 @@ void iwl_configure_filter(struct ieee80211_hw *hw,
                           unsigned int changed_flags,
                           unsigned int *total_flags, u64 multicast);
 int iwl_hw_nic_init(struct iwl_priv *priv);
-int iwl_setup_mac(struct iwl_priv *priv);
 int iwl_set_hw_params(struct iwl_priv *priv);
-int iwl_init_drv(struct iwl_priv *priv);
-void iwl_uninit_drv(struct iwl_priv *priv);
 bool iwl_is_monitor_mode(struct iwl_priv *priv);
 void iwl_post_associate(struct iwl_priv *priv);
 void iwl_bss_info_changed(struct ieee80211_hw *hw,
@@ -303,14 +338,17 @@ int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb);
 int iwl_commit_rxon(struct iwl_priv *priv);
 int iwl_set_mode(struct iwl_priv *priv, int mode);
 int iwl_mac_add_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_if_init_conf *conf);
+                          struct ieee80211_vif *vif);
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_if_init_conf *conf);
+                              struct ieee80211_vif *vif);
 int iwl_mac_config(struct ieee80211_hw *hw, u32 changed);
 void iwl_config_ap(struct iwl_priv *priv);
-int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
-                         struct ieee80211_tx_queue_stats *stats);
 void iwl_mac_reset_tsf(struct ieee80211_hw *hw);
+int iwl_alloc_txq_mem(struct iwl_priv *priv);
+void iwl_free_txq_mem(struct iwl_priv *priv);
+void iwlcore_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
+                                __le32 *tx_flags);
+int iwl_send_wimax_coex(struct iwl_priv *priv);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_alloc_traffic_mem(struct iwl_priv *priv);
 void iwl_free_traffic_mem(struct iwl_priv *priv);
@@ -321,8 +359,7 @@ void iwl_dbg_log_rx_data_frame(struct iwl_priv *priv,
                                 u16 length, struct ieee80211_hdr *header);
 const char *get_mgmt_string(int cmd);
 const char *get_ctrl_string(int cmd);
-void iwl_clear_tx_stats(struct iwl_priv *priv);
-void iwl_clear_rx_stats(struct iwl_priv *priv);
+void iwl_clear_traffic_stats(struct iwl_priv *priv);
 void iwl_update_stats(struct iwl_priv *priv, bool is_tx, __le16 fc,
                       u16 len);
 #else
@@ -358,6 +395,7 @@ static inline void iwl_update_stats(struct iwl_priv *priv, bool is_tx,
                 /* data */
                 stats->data_bytes += len;
         }
+        iwl_leds_background(priv);
 }
 #endif
 /*****************************************************
@@ -377,13 +415,13 @@ void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
 void iwl_cmd_queue_free(struct iwl_priv *priv);
 int iwl_rx_queue_alloc(struct iwl_priv *priv);
 void iwl_rx_handle(struct iwl_priv *priv);
-int iwl_rx_queue_update_write_ptr(struct iwl_priv *priv,
+void iwl_rx_queue_update_write_ptr(struct iwl_priv *priv,
                                   struct iwl_rx_queue *q);
 void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
 void iwl_rx_replenish(struct iwl_priv *priv);
 void iwl_rx_replenish_now(struct iwl_priv *priv);
 int iwl_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
-int iwl_rx_queue_restock(struct iwl_priv *priv);
+void iwl_rx_queue_restock(struct iwl_priv *priv);
 int iwl_rx_queue_space(const struct iwl_rx_queue *q);
 void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority);
 void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
@@ -391,8 +429,12 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index);
 /* Handlers */
 void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb);
+void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
+                                          struct iwl_rx_mem_buffer *rxb);
 void iwl_rx_statistics(struct iwl_priv *priv,
                               struct iwl_rx_mem_buffer *rxb);
+void iwl_reply_statistics(struct iwl_priv *priv,
+                          struct iwl_rx_mem_buffer *rxb);
 void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
 
 /* TX helpers */
@@ -400,7 +442,8 @@ void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
 /*****************************************************
 * TX
 ******************************************************/
-int iwl_txq_ctx_reset(struct iwl_priv *priv);
+int iwl_txq_ctx_alloc(struct iwl_priv *priv);
+void iwl_txq_ctx_reset(struct iwl_priv *priv);
 void iwl_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq);
 int iwl_hw_txq_attach_buf_to_tfd(struct iwl_priv *priv,
                                  struct iwl_tx_queue *txq,
@@ -409,9 +452,13 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb);
 void iwl_hw_txq_ctx_free(struct iwl_priv *priv);
 int iwl_hw_tx_queue_init(struct iwl_priv *priv,
                          struct iwl_tx_queue *txq);
-int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq);
+void iwl_free_tfds_in_queue(struct iwl_priv *priv,
+                            int sta_id, int tid, int freed);
+void iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq);
 int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
                       int slots_num, u32 txq_id);
+void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
+                        int slots_num, u32 txq_id);
 void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id);
 int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn);
 int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid);
@@ -459,6 +506,8 @@ void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
 int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
+void iwl_internal_short_hw_scan(struct iwl_priv *priv);
+int iwl_force_reset(struct iwl_priv *priv, int mode);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
                        const u8 *ie, int ie_len, int left);
 void iwl_setup_rx_scan_handlers(struct iwl_priv *priv);
@@ -489,14 +538,6 @@ int iwl_send_calib_results(struct iwl_priv *priv);
 int iwl_calib_set(struct iwl_calib_result *res, const u8 *buf, int len);
 void iwl_calib_free_results(struct iwl_priv *priv);
 
-/*******************************************************************************
- * Spectrum Measureemtns in  iwl-spectrum.c
- ******************************************************************************/
-#ifdef CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT
-void iwl_setup_spectrum_handlers(struct iwl_priv *priv);
-#else
-static inline void iwl_setup_spectrum_handlers(struct iwl_priv *priv) {}
-#endif
 /*****************************************************
  *   S e n d i n g     H o s t     C o m m a n d s   *
  *****************************************************/
@@ -511,7 +552,7 @@ int iwl_send_cmd_pdu_async(struct iwl_priv *priv, u8 id, u16 len,
                            const void *data,
                            void (*callback)(struct iwl_priv *priv,
                                             struct iwl_device_cmd *cmd,
-                                            struct sk_buff *skb));
+                                            struct iwl_rx_packet *pkt));
 
 int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd);
 
@@ -544,15 +585,15 @@ int iwl_pci_resume(struct pci_dev *pdev);
 /*****************************************************
 *  Error Handling Debugging
 ******************************************************/
-#ifdef CONFIG_IWLWIFI_DEBUG
-void iwl_dump_nic_event_log(struct iwl_priv *priv);
 void iwl_dump_nic_error_log(struct iwl_priv *priv);
+int iwl_dump_nic_event_log(struct iwl_priv *priv,
+                           bool full_log, char **buf, bool display);
+void iwl_dump_csr(struct iwl_priv *priv);
+int iwl_dump_fh(struct iwl_priv *priv, char **buf, bool display);
+#ifdef CONFIG_IWLWIFI_DEBUG
+void iwl_print_rx_config_cmd(struct iwl_priv *priv);
 #else
-static inline void iwl_dump_nic_event_log(struct iwl_priv *priv)
-{
-}
-
-static inline void iwl_dump_nic_error_log(struct iwl_priv *priv)
+static inline void iwl_print_rx_config_cmd(struct iwl_priv *priv)
 {
 }
 #endif
@@ -568,9 +609,10 @@ void iwlcore_free_geos(struct iwl_priv *priv);
 /*************** DRIVER STATUS FUNCTIONS   *****/
 
 #define STATUS_HCMD_ACTIVE      0       /* host command in progress */
-#define STATUS_HCMD_SYNC_ACTIVE 1       /* sync host command in progress */
+/* 1 is unused (used to be STATUS_HCMD_SYNC_ACTIVE) */
 #define STATUS_INT_ENABLED      2
 #define STATUS_RF_KILL_HW       3
+#define STATUS_CT_KILL          4
 #define STATUS_INIT             5
 #define STATUS_ALIVE            6
 #define STATUS_READY            7
@@ -615,6 +657,11 @@ static inline int iwl_is_rfkill(struct iwl_priv *priv)
         return iwl_is_rfkill_hw(priv);
 }
 
+static inline int iwl_is_ctkill(struct iwl_priv *priv)
+{
+        return test_bit(STATUS_CT_KILL, &priv->status);
+}
+
 static inline int iwl_is_ready_rf(struct iwl_priv *priv)
 {
 
@@ -626,7 +673,8 @@ static inline int iwl_is_ready_rf(struct iwl_priv *priv)
 
 extern void iwl_rf_kill_ct_config(struct iwl_priv *priv);
 extern int iwl_send_bt_config(struct iwl_priv *priv);
-extern int iwl_send_statistics_request(struct iwl_priv *priv, u8 flags);
+extern int iwl_send_statistics_request(struct iwl_priv *priv,
+                                       u8 flags, bool clear);
 extern int iwl_verify_ucode(struct iwl_priv *priv);
 extern int iwl_send_lq_cmd(struct iwl_priv *priv,
                 struct iwl_link_quality_cmd *lq, u8 flags);
@@ -636,6 +684,9 @@ extern void iwl_rx_reply_rx_phy(struct iwl_priv *priv,
                                     struct iwl_rx_mem_buffer *rxb);
 void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
                                            struct iwl_rx_mem_buffer *rxb);
+void iwl_apm_stop(struct iwl_priv *priv);
+int iwl_apm_stop_master(struct iwl_priv *priv);
+int iwl_apm_init(struct iwl_priv *priv);
 
 void iwl_setup_rxon_timing(struct iwl_priv *priv);
 static inline int iwl_send_rxon_assoc(struct iwl_priv *priv)
@@ -655,5 +706,4 @@ static inline const struct ieee80211_supported_band *iwl_get_hw_mode(
 {
         return priv->hw->wiphy->bands[band];
 }
-
 #endif /* __iwl_core_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 06437d13e73e..808b7146bead 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -62,11 +62,28 @@
  *****************************************************************************/
 #ifndef __iwl_csr_h__
 #define __iwl_csr_h__
-/*=== CSR (control and status registers) ===*/
+/*
+ * CSR (control and status registers)
+ *
+ * CSR registers are mapped directly into PCI bus space, and are accessible
+ * whenever platform supplies power to device, even when device is in
+ * low power states due to driver-invoked device resets
+ * (e.g. CSR_RESET_REG_FLAG_SW_RESET) or uCode-driven power-saving modes.
+ *
+ * Use iwl_write32() and iwl_read32() family to access these registers;
+ * these provide simple PCI bus access, without waking up the MAC.
+ * Do not use iwl_write_direct32() family for these registers;
+ * no need to "grab nic access" via CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ.
+ * The MAC (uCode processor, etc.) does not need to be powered up for accessing
+ * the CSR registers.
+ *
+ * NOTE:  Device does need to be awake in order to read this memory
+ *        via CSR_EEPROM and CSR_OTP registers
+ */
 #define CSR_BASE    (0x000)
 
 #define CSR_HW_IF_CONFIG_REG    (CSR_BASE+0x000) /* hardware interface config */
-#define CSR_INT_COALESCING     (CSR_BASE+0x004) /* accum ints, 32-usec units */
+#define CSR_INT_COALESCING      (CSR_BASE+0x004) /* accum ints, 32-usec units */
 #define CSR_INT                 (CSR_BASE+0x008) /* host interrupt status/ack */
 #define CSR_INT_MASK            (CSR_BASE+0x00c) /* host interrupt enable */
 #define CSR_FH_INT_STATUS       (CSR_BASE+0x010) /* busmaster int status/ack*/
@@ -74,43 +91,66 @@
 #define CSR_RESET               (CSR_BASE+0x020) /* busmaster enable, NMI, etc*/
 #define CSR_GP_CNTRL            (CSR_BASE+0x024)
 
+/* 2nd byte of CSR_INT_COALESCING, not accessible via iwl_write32()! */
+#define CSR_INT_PERIODIC_REG    (CSR_BASE+0x005)
+
 /*
  * Hardware revision info
  * Bit fields:
  * 31-8:  Reserved
- *  7-4:  Type of device:  0x0 = 4965, 0xd = 3945
+ *  7-4:  Type of device:  see CSR_HW_REV_TYPE_xxx definitions
  *  3-2:  Revision step:  0 = A, 1 = B, 2 = C, 3 = D
- *  1-0:  "Dash" value, as in A-1, etc.
+ *  1-0:  "Dash" (-) value, as in A-1, etc.
  *
  * NOTE:  Revision step affects calculation of CCK txpower for 4965.
+ * NOTE:  See also CSR_HW_REV_WA_REG (work-around for bug in 4965).
  */
 #define CSR_HW_REV              (CSR_BASE+0x028)
 
-/* EEPROM reads */
+/*
+ * EEPROM and OTP (one-time-programmable) memory reads
+ *
+ * NOTE:  Device must be awake, initialized via apm_ops.init(),
+ *        in order to read.
+ */
 #define CSR_EEPROM_REG          (CSR_BASE+0x02c)
 #define CSR_EEPROM_GP           (CSR_BASE+0x030)
 #define CSR_OTP_GP_REG          (CSR_BASE+0x034)
+
 #define CSR_GIO_REG             (CSR_BASE+0x03C)
 #define CSR_GP_UCODE_REG        (CSR_BASE+0x048)
 #define CSR_GP_DRIVER_REG       (CSR_BASE+0x050)
+
+/*
+ * UCODE-DRIVER GP (general purpose) mailbox registers.
+ * SET/CLR registers set/clear bit(s) if "1" is written.
+ */
 #define CSR_UCODE_DRV_GP1       (CSR_BASE+0x054)
 #define CSR_UCODE_DRV_GP1_SET   (CSR_BASE+0x058)
 #define CSR_UCODE_DRV_GP1_CLR   (CSR_BASE+0x05c)
 #define CSR_UCODE_DRV_GP2       (CSR_BASE+0x060)
+
 #define CSR_LED_REG             (CSR_BASE+0x094)
 #define CSR_DRAM_INT_TBL_REG    (CSR_BASE+0x0A0)
+
+/* GIO Chicken Bits (PCI Express bus link power management) */
 #define CSR_GIO_CHICKEN_BITS    (CSR_BASE+0x100)
 
-#define CSR_INT_PERIODIC_REG    (CSR_BASE+0x005)
 /* Analog phase-lock-loop configuration  */
 #define CSR_ANA_PLL_CFG         (CSR_BASE+0x20c)
+
 /*
- * Indicates hardware rev, to determine CCK backoff for txpower calculation.
+ * CSR Hardware Revision Workaround Register.  Indicates hardware rev;
+ * "step" determines CCK backoff for txpower calculation.  Used for 4965 only.
+ * See also CSR_HW_REV register.
  * Bit fields:
  *  3-2:  0 = A, 1 = B, 2 = C, 3 = D step
+ *  1-0:  "Dash" (-) value, as in C-1, etc.
  */
-#define CSR_HW_REV_WA_REG       (CSR_BASE+0x22C)
-#define CSR_DBG_HPET_MEM_REG    (CSR_BASE+0x240)
+#define CSR_HW_REV_WA_REG               (CSR_BASE+0x22C)
+
+#define CSR_DBG_HPET_MEM_REG            (CSR_BASE+0x240)
+#define CSR_DBG_LINK_PWR_MGMT_REG       (CSR_BASE+0x250)
 
 /* Bits for CSR_HW_IF_CONFIG_REG */
 #define CSR49_HW_IF_CONFIG_REG_BIT_4965_R       (0x00000010)
@@ -125,14 +165,14 @@
 #define CSR39_HW_IF_CONFIG_REG_BITS_SILICON_TYPE_A    (0x00000000)
 #define CSR39_HW_IF_CONFIG_REG_BITS_SILICON_TYPE_B    (0x00001000)
 
-#define CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A           (0x00080000)
-#define CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM         (0x00200000)
-#define CSR_HW_IF_CONFIG_REG_BIT_NIC_READY              (0x00400000)
-#define CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE       (0x02000000)
-#define CSR_HW_IF_CONFIG_REG_PREPARE                    (0x08000000)
+#define CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A   (0x00080000)
+#define CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM (0x00200000)
+#define CSR_HW_IF_CONFIG_REG_BIT_NIC_READY      (0x00400000) /* PCI_OWN_SEM */
+#define CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE (0x02000000) /* ME_OWN */
+#define CSR_HW_IF_CONFIG_REG_PREPARE              (0x08000000) /* WAKE_ME */
 
-#define CSR_INT_PERIODIC_DIS                    (0x00)
-#define CSR_INT_PERIODIC_ENA                    (0xFF)
+#define CSR_INT_PERIODIC_DIS                    (0x00) /* disable periodic int*/
+#define CSR_INT_PERIODIC_ENA                    (0xFF) /* 255*32 usec ~ 8 msec*/
 
 /* interrupt flags in INTA, set by uCode or hardware (e.g. dma),
  * acknowledged (reset) by host writing "1" to flagged bits. */
@@ -195,8 +235,46 @@
 #define CSR_RESET_REG_FLAG_SW_RESET                  (0x00000080)
 #define CSR_RESET_REG_FLAG_MASTER_DISABLED           (0x00000100)
 #define CSR_RESET_REG_FLAG_STOP_MASTER               (0x00000200)
+#define CSR_RESET_LINK_PWR_MGMT_DISABLED             (0x80000000)
 
-/* GP (general purpose) CONTROL */
+/*
+ * GP (general purpose) CONTROL REGISTER
+ * Bit fields:
+ *    27:  HW_RF_KILL_SW
+ *         Indicates state of (platform's) hardware RF-Kill switch
+ * 26-24:  POWER_SAVE_TYPE
+ *         Indicates current power-saving mode:
+ *         000 -- No power saving
+ *         001 -- MAC power-down
+ *         010 -- PHY (radio) power-down
+ *         011 -- Error
+ *   9-6:  SYS_CONFIG
+ *         Indicates current system configuration, reflecting pins on chip
+ *         as forced high/low by device circuit board.
+ *     4:  GOING_TO_SLEEP
+ *         Indicates MAC is entering a power-saving sleep power-down.
+ *         Not a good time to access device-internal resources.
+ *     3:  MAC_ACCESS_REQ
+ *         Host sets this to request and maintain MAC wakeup, to allow host
+ *         access to device-internal resources.  Host must wait for
+ *         MAC_CLOCK_READY (and !GOING_TO_SLEEP) before accessing non-CSR
+ *         device registers.
+ *     2:  INIT_DONE
+ *         Host sets this to put device into fully operational D0 power mode.
+ *         Host resets this after SW_RESET to put device into low power mode.
+ *     0:  MAC_CLOCK_READY
+ *         Indicates MAC (ucode processor, etc.) is powered up and can run.
+ *         Internal resources are accessible.
+ *         NOTE:  This does not indicate that the processor is actually running.
+ *         NOTE:  This does not indicate that 4965 or 3945 has completed
+ *                init or post-power-down restore of internal SRAM memory.
+ *                Use CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP as indication that
+ *                SRAM is restored and uCode is in normal operation mode.
+ *                Later devices (5xxx/6xxx/1xxx) use non-volatile SRAM, and
+ *                do not need to save/restore it.
+ *         NOTE:  After device reset, this bit remains "0" until host sets
+ *                INIT_DONE
+ */
 #define CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY        (0x00000001)
 #define CSR_GP_CNTRL_REG_FLAG_INIT_DONE              (0x00000004)
 #define CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ         (0x00000008)
@@ -229,18 +307,58 @@
 #define CSR_EEPROM_REG_MSK_DATA         (0xFFFF0000)
 
 /* EEPROM GP */
-#define CSR_EEPROM_GP_VALID_MSK         (0x00000007)
-#define CSR_EEPROM_GP_BAD_SIGNATURE     (0x00000000)
+#define CSR_EEPROM_GP_VALID_MSK         (0x00000007) /* signature */
 #define CSR_EEPROM_GP_IF_OWNER_MSK      (0x00000180)
+#define CSR_EEPROM_GP_BAD_SIGNATURE_BOTH_EEP_AND_OTP    (0x00000000)
+#define CSR_EEPROM_GP_BAD_SIG_EEP_GOOD_SIG_OTP          (0x00000001)
+#define CSR_EEPROM_GP_GOOD_SIG_EEP_LESS_THAN_4K         (0x00000002)
+#define CSR_EEPROM_GP_GOOD_SIG_EEP_MORE_THAN_4K         (0x00000004)
+
+/* One-time-programmable memory general purpose reg */
 #define CSR_OTP_GP_REG_DEVICE_SELECT    (0x00010000) /* 0 - EEPROM, 1 - OTP */
 #define CSR_OTP_GP_REG_OTP_ACCESS_MODE  (0x00020000) /* 0 - absolute, 1 - relative */
 #define CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK          (0x00100000) /* bit 20 */
 #define CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK        (0x00200000) /* bit 21 */
 
+/* GP REG */
+#define CSR_GP_REG_POWER_SAVE_STATUS_MSK            (0x03000000) /* bit 24/25 */
+#define CSR_GP_REG_NO_POWER_SAVE            (0x00000000)
+#define CSR_GP_REG_MAC_POWER_SAVE           (0x01000000)
+#define CSR_GP_REG_PHY_POWER_SAVE           (0x02000000)
+#define CSR_GP_REG_POWER_SAVE_ERROR         (0x03000000)
+
+
 /* CSR GIO */
 #define CSR_GIO_REG_VAL_L0S_ENABLED     (0x00000002)
 
-/* UCODE DRV GP */
+/*
+ * UCODE-DRIVER GP (general purpose) mailbox register 1
+ * Host driver and uCode write and/or read this register to communicate with
+ * each other.
+ * Bit fields:
+ *     4:  UCODE_DISABLE
+ *         Host sets this to request permanent halt of uCode, same as
+ *         sending CARD_STATE command with "halt" bit set.
+ *     3:  CT_KILL_EXIT
+ *         Host sets this to request exit from CT_KILL state, i.e. host thinks
+ *         device temperature is low enough to continue normal operation.
+ *     2:  CMD_BLOCKED
+ *         Host sets this during RF KILL power-down sequence (HW, SW, CT KILL)
+ *         to release uCode to clear all Tx and command queues, enter
+ *         unassociated mode, and power down.
+ *         NOTE:  Some devices also use HBUS_TARG_MBX_C register for this bit.
+ *     1:  SW_BIT_RFKILL
+ *         Host sets this when issuing CARD_STATE command to request
+ *         device sleep.
+ *     0:  MAC_SLEEP
+ *         uCode sets this when preparing a power-saving power-down.
+ *         uCode resets this when power-up is complete and SRAM is sane.
+ *         NOTE:  3945/4965 saves internal SRAM data to host when powering down,
+ *                and must restore this data after powering back up.
+ *                MAC_SLEEP is the best indication that restore is complete.
+ *                Later devices (5xxx/6xxx/1xxx) use non-volatile SRAM, and
+ *                do not need to save/restore it.
+ */
 #define CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP             (0x00000001)
 #define CSR_UCODE_SW_BIT_RFKILL                     (0x00000002)
 #define CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED           (0x00000004)
@@ -251,9 +369,9 @@
 #define CSR_GP_DRIVER_REG_BIT_RADIO_SKU_3x3_HYB     (0x00000000)
 #define CSR_GP_DRIVER_REG_BIT_RADIO_SKU_2x2_HYB     (0x00000001)
 #define CSR_GP_DRIVER_REG_BIT_RADIO_SKU_2x2_IPA     (0x00000002)
+#define CSR_GP_DRIVER_REG_BIT_CALIB_VERSION6    (0x00000004)
 
-
-/* GI Chicken Bits */
+/* GIO Chicken Bits (PCI Express bus link power management) */
 #define CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX  (0x00800000)
 #define CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER  (0x20000000)
 
@@ -273,8 +391,23 @@
 #define CSR_DRAM_INT_TBL_ENABLE         (1 << 31)
 #define CSR_DRAM_INIT_TBL_WRAP_CHECK    (1 << 27)
 
-/*=== HBUS (Host-side Bus) ===*/
+/*
+ * HBUS (Host-side Bus)
+ *
+ * HBUS registers are mapped directly into PCI bus space, but are used
+ * to indirectly access device's internal memory or registers that
+ * may be powered-down.
+ *
+ * Use iwl_write_direct32()/iwl_read_direct32() family for these registers;
+ * host must "grab nic access" via CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ
+ * to make sure the MAC (uCode processor, etc.) is powered up for accessing
+ * internal resources.
+ *
+ * Do not use iwl_write32()/iwl_read32() family to access these registers;
+ * these provide only simple PCI bus access, without waking up the MAC.
+ */
 #define HBUS_BASE       (0x400)
+
 /*
  * Registers for accessing device's internal SRAM memory (e.g. SCD SRAM
  * structures, error log, event log, verifying uCode load).
@@ -289,6 +422,10 @@
 #define HBUS_TARG_MEM_WDAT      (HBUS_BASE+0x018)
 #define HBUS_TARG_MEM_RDAT      (HBUS_BASE+0x01c)
 
+/* Mailbox C, used as workaround alternative to CSR_UCODE_DRV_GP1 mailbox */
+#define HBUS_TARG_MBX_C         (HBUS_BASE+0x030)
+#define HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED         (0x00000004)
+
 /*
  * Registers for accessing device's internal peripheral registers
  * (e.g. SCD, BSM, etc.).  First write to address register,
@@ -303,16 +440,12 @@
 #define HBUS_TARG_PRPH_RDAT     (HBUS_BASE+0x050)
 
 /*
- * Per-Tx-queue write pointer (index, really!) (3945 and 4965).
+ * Per-Tx-queue write pointer (index, really!)
  * Indicates index to next TFD that driver will fill (1 past latest filled).
  * Bit usage:
  *  0-7:  queue write index
  * 11-8:  queue selector
  */
 #define HBUS_TARG_WRPTR         (HBUS_BASE+0x060)
-#define HBUS_TARG_MBX_C         (HBUS_BASE+0x030)
-
-#define HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED         (0x00000004)
-
 
 #endif /* !__iwl_csr_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index cbc62904655d..1c7b53d511c7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project.
  *
@@ -67,56 +67,6 @@ do {                                            			\
                                DUMP_PREFIX_OFFSET, 16, 1, p, len, 1);   \
 } while (0)
 
-#ifdef CONFIG_IWLWIFI_DEBUGFS
-struct iwl_debugfs {
-        const char *name;
-        struct dentry *dir_drv;
-        struct dentry *dir_data;
-        struct dentry *dir_debug;
-        struct dentry *dir_rf;
-        struct dir_data_files {
-                struct dentry *file_sram;
-                struct dentry *file_nvm;
-                struct dentry *file_stations;
-                struct dentry *file_log_event;
-                struct dentry *file_channels;
-                struct dentry *file_status;
-                struct dentry *file_interrupt;
-                struct dentry *file_qos;
-                struct dentry *file_thermal_throttling;
-#ifdef CONFIG_IWLWIFI_LEDS
-                struct dentry *file_led;
-#endif
-                struct dentry *file_disable_ht40;
-                struct dentry *file_sleep_level_override;
-                struct dentry *file_current_sleep_command;
-        } dbgfs_data_files;
-        struct dir_rf_files {
-                struct dentry *file_disable_sensitivity;
-                struct dentry *file_disable_chain_noise;
-                struct dentry *file_disable_tx_power;
-        } dbgfs_rf_files;
-        struct dir_debug_files {
-                struct dentry *file_rx_statistics;
-                struct dentry *file_tx_statistics;
-                struct dentry *file_traffic_log;
-                struct dentry *file_rx_queue;
-                struct dentry *file_tx_queue;
-                struct dentry *file_ucode_rx_stats;
-                struct dentry *file_ucode_tx_stats;
-                struct dentry *file_ucode_general_stats;
-                struct dentry *file_sensitivity;
-                struct dentry *file_chain_noise;
-                struct dentry *file_tx_power;
-        } dbgfs_debug_files;
-        u32 sram_offset;
-        u32 sram_len;
-};
-
-int iwl_dbgfs_register(struct iwl_priv *priv, const char *name);
-void iwl_dbgfs_unregister(struct iwl_priv *priv);
-#endif
-
 #else
 #define IWL_DEBUG(__priv, level, fmt, args...)
 #define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
@@ -125,9 +75,10 @@ static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
 {}
 #endif                          /* CONFIG_IWLWIFI_DEBUG */
 
-
-
-#ifndef CONFIG_IWLWIFI_DEBUGFS
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+int iwl_dbgfs_register(struct iwl_priv *priv, const char *name);
+void iwl_dbgfs_unregister(struct iwl_priv *priv);
+#else
 static inline int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
 {
         return 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index a198bcf61022..b6e1b0ebe230 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -26,6 +26,7 @@
  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  *****************************************************************************/
 
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/debugfs.h>
@@ -41,43 +42,28 @@
 #include "iwl-calib.h"
 
 /* create and remove of files */
-#define DEBUGFS_ADD_DIR(name, parent) do {                              \
-        dbgfs->dir_##name = debugfs_create_dir(#name, parent);          \
-        if (!(dbgfs->dir_##name))                                       \
-                goto err;                                               \
+#define DEBUGFS_ADD_FILE(name, parent, mode) do {                       \
+        if (!debugfs_create_file(#name, mode, parent, priv,             \
+                                 &iwl_dbgfs_##name##_ops))              \
+                goto err;                                               \
 } while (0)
 
-#define DEBUGFS_ADD_FILE(name, parent) do {                             \
-        dbgfs->dbgfs_##parent##_files.file_##name =                     \
-        debugfs_create_file(#name, S_IWUSR | S_IRUSR,                   \
-                                dbgfs->dir_##parent, priv,              \
-                                &iwl_dbgfs_##name##_ops);               \
-        if (!(dbgfs->dbgfs_##parent##_files.file_##name))               \
-                goto err;                                               \
+#define DEBUGFS_ADD_BOOL(name, parent, ptr) do {                        \
+        struct dentry *__tmp;                                           \
+        __tmp = debugfs_create_bool(#name, S_IWUSR | S_IRUSR,           \
+                                    parent, ptr);                       \
+        if (IS_ERR(__tmp) || !__tmp)                                    \
+                goto err;                                               \
 } while (0)
 
-#define DEBUGFS_ADD_BOOL(name, parent, ptr) do {                        \
-        dbgfs->dbgfs_##parent##_files.file_##name =                     \
-        debugfs_create_bool(#name, S_IWUSR | S_IRUSR,                   \
-                            dbgfs->dir_##parent, ptr);                  \
-        if (IS_ERR(dbgfs->dbgfs_##parent##_files.file_##name)           \
-                        || !dbgfs->dbgfs_##parent##_files.file_##name)  \
-                goto err;                                               \
+#define DEBUGFS_ADD_X32(name, parent, ptr) do {                         \
+        struct dentry *__tmp;                                           \
+        __tmp = debugfs_create_x32(#name, S_IWUSR | S_IRUSR,            \
+                                   parent, ptr);                        \
+        if (IS_ERR(__tmp) || !__tmp)                                    \
+                goto err;                                               \
 } while (0)
 
-#define DEBUGFS_ADD_X32(name, parent, ptr) do {                        \
-        dbgfs->dbgfs_##parent##_files.file_##name =                     \
-        debugfs_create_x32(#name, S_IRUSR, dbgfs->dir_##parent, ptr);   \
-        if (IS_ERR(dbgfs->dbgfs_##parent##_files.file_##name)           \
-                        || !dbgfs->dbgfs_##parent##_files.file_##name)  \
-                goto err;                                               \
-} while (0)
-
-#define DEBUGFS_REMOVE(name)  do {              \
-        debugfs_remove(name);                   \
-        name = NULL;                            \
-} while (0);
-
 /* file operation */
 #define DEBUGFS_READ_FUNC(name)                                         \
 static ssize_t iwl_dbgfs_##name##_read(struct file *file,               \
@@ -125,27 +111,28 @@ static ssize_t iwl_dbgfs_tx_statistics_read(struct file *file,
                                                 char __user *user_buf,
                                                 size_t count, loff_t *ppos) {
 
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         char *buf;
         int pos = 0;
 
         int cnt;
         ssize_t ret;
-        const size_t bufsz = 100 + sizeof(char) * 24 * (MANAGEMENT_MAX + CONTROL_MAX);
+        const size_t bufsz = 100 +
+                sizeof(char) * 50 * (MANAGEMENT_MAX + CONTROL_MAX);
         buf = kzalloc(bufsz, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
         pos += scnprintf(buf + pos, bufsz - pos, "Management:\n");
         for (cnt = 0; cnt < MANAGEMENT_MAX; cnt++) {
                 pos += scnprintf(buf + pos, bufsz - pos,
-                                 "\t%s\t\t: %u\n",
+                                 "\t%25s\t\t: %u\n",
                                  get_mgmt_string(cnt),
                                  priv->tx_stats.mgmt[cnt]);
         }
         pos += scnprintf(buf + pos, bufsz - pos, "Control\n");
         for (cnt = 0; cnt < CONTROL_MAX; cnt++) {
                 pos += scnprintf(buf + pos, bufsz - pos,
-                                 "\t%s\t\t: %u\n",
+                                 "\t%25s\t\t: %u\n",
                                  get_ctrl_string(cnt),
                                  priv->tx_stats.ctrl[cnt]);
         }
@@ -159,7 +146,7 @@ static ssize_t iwl_dbgfs_tx_statistics_read(struct file *file,
         return ret;
 }
 
-static ssize_t iwl_dbgfs_tx_statistics_write(struct file *file,
+static ssize_t iwl_dbgfs_clear_traffic_statistics_write(struct file *file,
                                         const char __user *user_buf,
                                         size_t count, loff_t *ppos)
 {
@@ -174,8 +161,7 @@ static ssize_t iwl_dbgfs_tx_statistics_write(struct file *file,
                 return -EFAULT;
         if (sscanf(buf, "%x", &clear_flag) != 1)
                 return -EFAULT;
-        if (clear_flag == 1)
-                iwl_clear_tx_stats(priv);
+        iwl_clear_traffic_stats(priv);
 
         return count;
 }
@@ -184,13 +170,13 @@ static ssize_t iwl_dbgfs_rx_statistics_read(struct file *file,
                                                 char __user *user_buf,
                                                 size_t count, loff_t *ppos) {
 
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         char *buf;
         int pos = 0;
         int cnt;
         ssize_t ret;
         const size_t bufsz = 100 +
-                sizeof(char) * 24 * (MANAGEMENT_MAX + CONTROL_MAX);
+                sizeof(char) * 50 * (MANAGEMENT_MAX + CONTROL_MAX);
         buf = kzalloc(bufsz, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
@@ -198,14 +184,14 @@ static ssize_t iwl_dbgfs_rx_statistics_read(struct file *file,
         pos += scnprintf(buf + pos, bufsz - pos, "Management:\n");
         for (cnt = 0; cnt < MANAGEMENT_MAX; cnt++) {
                 pos += scnprintf(buf + pos, bufsz - pos,
-                                 "\t%s\t\t: %u\n",
+                                 "\t%25s\t\t: %u\n",
                                  get_mgmt_string(cnt),
                                  priv->rx_stats.mgmt[cnt]);
         }
         pos += scnprintf(buf + pos, bufsz - pos, "Control:\n");
         for (cnt = 0; cnt < CONTROL_MAX; cnt++) {
                 pos += scnprintf(buf + pos, bufsz - pos,
-                                 "\t%s\t\t: %u\n",
+                                 "\t%25s\t\t: %u\n",
                                  get_ctrl_string(cnt),
                                  priv->rx_stats.ctrl[cnt]);
         }
@@ -220,26 +206,6 @@ static ssize_t iwl_dbgfs_rx_statistics_read(struct file *file,
         return ret;
 }
 
-static ssize_t iwl_dbgfs_rx_statistics_write(struct file *file,
-                                        const char __user *user_buf,
-                                        size_t count, loff_t *ppos)
-{
-        struct iwl_priv *priv = file->private_data;
-        u32 clear_flag;
-        char buf[8];
-        int buf_size;
-
-        memset(buf, 0, sizeof(buf));
-        buf_size = min(count, sizeof(buf) -  1);
-        if (copy_from_user(buf, user_buf, buf_size))
-                return -EFAULT;
-        if (sscanf(buf, "%x", &clear_flag) != 1)
-                return -EFAULT;
-        if (clear_flag == 1)
-                iwl_clear_rx_stats(priv);
-        return count;
-}
-
 #define BYTE1_MASK 0x000000ff;
 #define BYTE2_MASK 0x0000ffff;
 #define BYTE3_MASK 0x00ffffff;
@@ -248,16 +214,32 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file,
                                         size_t count, loff_t *ppos)
 {
         u32 val;
-        char buf[1024];
+        char *buf;
         ssize_t ret;
         int i;
         int pos = 0;
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
-        const size_t bufsz = sizeof(buf);
-
-        for (i = priv->dbgfs->sram_len; i > 0; i -= 4) {
-                val = iwl_read_targ_mem(priv, priv->dbgfs->sram_offset + \
-                                        priv->dbgfs->sram_len - i);
+        struct iwl_priv *priv = file->private_data;
+        size_t bufsz;
+
+        /* default is to dump the entire data segment */
+        if (!priv->dbgfs_sram_offset && !priv->dbgfs_sram_len) {
+                priv->dbgfs_sram_offset = 0x800000;
+                if (priv->ucode_type == UCODE_INIT)
+                        priv->dbgfs_sram_len = priv->ucode_init_data.len;
+                else
+                        priv->dbgfs_sram_len = priv->ucode_data.len;
+        }
+        bufsz =  30 + priv->dbgfs_sram_len * sizeof(char) * 10;
+        buf = kmalloc(bufsz, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        pos += scnprintf(buf + pos, bufsz - pos, "sram_len: 0x%x\n",
+                        priv->dbgfs_sram_len);
+        pos += scnprintf(buf + pos, bufsz - pos, "sram_offset: 0x%x\n",
+                        priv->dbgfs_sram_offset);
+        for (i = priv->dbgfs_sram_len; i > 0; i -= 4) {
+                val = iwl_read_targ_mem(priv, priv->dbgfs_sram_offset + \
+                                        priv->dbgfs_sram_len - i);
                 if (i < 4) {
                         switch (i) {
                         case 1:
@@ -271,11 +253,14 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file,
                                 break;
                         }
                 }
+                if (!(i % 16))
+                        pos += scnprintf(buf + pos, bufsz - pos, "\n");
                 pos += scnprintf(buf + pos, bufsz - pos, "0x%08x ", val);
         }
         pos += scnprintf(buf + pos, bufsz - pos, "\n");
 
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
         return ret;
 }
 
@@ -294,11 +279,11 @@ static ssize_t iwl_dbgfs_sram_write(struct file *file,
                 return -EFAULT;
 
         if (sscanf(buf, "%x,%x", &offset, &len) == 2) {
-                priv->dbgfs->sram_offset = offset;
-                priv->dbgfs->sram_len = len;
+                priv->dbgfs_sram_offset = offset;
+                priv->dbgfs_sram_len = len;
         } else {
-                priv->dbgfs->sram_offset = 0;
-                priv->dbgfs->sram_len = 0;
+                priv->dbgfs_sram_offset = 0;
+                priv->dbgfs_sram_len = 0;
         }
 
         return count;
@@ -307,7 +292,7 @@ static ssize_t iwl_dbgfs_sram_write(struct file *file,
 static ssize_t iwl_dbgfs_stations_read(struct file *file, char __user *user_buf,
                                         size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         struct iwl_station_entry *station;
         int max_sta = priv->hw_params.max_stations;
         char *buf;
@@ -335,8 +320,6 @@ static ssize_t iwl_dbgfs_stations_read(struct file *file, char __user *user_buf,
                         pos += scnprintf(buf + pos, bufsz - pos,
                                         "flags: 0x%x\n",
                                         station->sta.station_flags_msk);
-                        pos += scnprintf(buf + pos, bufsz - pos,
-                                        "ps_status: %u\n", station->ps_status);
                         pos += scnprintf(buf + pos, bufsz - pos, "tid data:\n");
                         pos += scnprintf(buf + pos, bufsz - pos,
                                         "seq_num\t\ttxq_id");
@@ -379,10 +362,11 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
                                        loff_t *ppos)
 {
         ssize_t ret;
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         int pos = 0, ofs = 0, buf_size = 0;
         const u8 *ptr;
         char *buf;
+        u16 eeprom_ver;
         size_t eeprom_len = priv->cfg->eeprom_size;
         buf_size = 4 * eeprom_len + 256;
 
@@ -403,9 +387,11 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
                 IWL_ERR(priv, "Can not allocate Buffer\n");
                 return -ENOMEM;
         }
-        pos += scnprintf(buf + pos, buf_size - pos, "NVM Type: %s\n",
+        eeprom_ver = iwl_eeprom_query16(priv, EEPROM_VERSION);
+        pos += scnprintf(buf + pos, buf_size - pos, "NVM Type: %s, "
+                        "version: 0x%x\n",
                         (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
-                        ? "OTP" : "EEPROM");
+                         ? "OTP" : "EEPROM", eeprom_ver);
         for (ofs = 0 ; ofs < eeprom_len ; ofs += 16) {
                 pos += scnprintf(buf + pos, buf_size - pos, "0x%.4x ", ofs);
                 hex_dump_to_buffer(ptr + ofs, 16 , 16, 2, buf + pos,
@@ -420,6 +406,24 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
         return ret;
 }
 
+static ssize_t iwl_dbgfs_log_event_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char *buf;
+        int pos = 0;
+        ssize_t ret = -ENOMEM;
+
+        ret = pos = priv->cfg->ops->lib->dump_nic_event_log(
+                                        priv, true, &buf, true);
+        if (buf) {
+                ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+                kfree(buf);
+        }
+        return ret;
+}
+
 static ssize_t iwl_dbgfs_log_event_write(struct file *file,
                                         const char __user *user_buf,
                                         size_t count, loff_t *ppos)
@@ -436,7 +440,8 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
         if (sscanf(buf, "%d", &event_log_flag) != 1)
                 return -EFAULT;
         if (event_log_flag == 1)
-                priv->cfg->ops->lib->dump_nic_event_log(priv);
+                priv->cfg->ops->lib->dump_nic_event_log(priv, true,
+                                                        NULL, false);
 
         return count;
 }
@@ -446,7 +451,7 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
 static ssize_t iwl_dbgfs_channels_read(struct file *file, char __user *user_buf,
                                        size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         struct ieee80211_channel *channels = NULL;
         const struct ieee80211_supported_band *supp_band = NULL;
         int pos = 0, i, bufsz = PAGE_SIZE;
@@ -519,19 +524,19 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
                                                 char __user *user_buf,
                                                 size_t count, loff_t *ppos) {
 
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         char buf[512];
         int pos = 0;
         const size_t bufsz = sizeof(buf);
 
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
                 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
-        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_SYNC_ACTIVE: %d\n",
-                test_bit(STATUS_HCMD_SYNC_ACTIVE, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
                 test_bit(STATUS_INT_ENABLED, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_RF_KILL_HW:\t %d\n",
                 test_bit(STATUS_RF_KILL_HW, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_CT_KILL:\t\t %d\n",
+                test_bit(STATUS_CT_KILL, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INIT:\t\t %d\n",
                 test_bit(STATUS_INIT, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_ALIVE:\t\t %d\n",
@@ -565,7 +570,7 @@ static ssize_t iwl_dbgfs_interrupt_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos) {
 
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         int pos = 0;
         int cnt = 0;
         char *buf;
@@ -652,7 +657,7 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file,
 static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
                                        size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         int pos = 0, i;
         char buf[256];
         const size_t bufsz = sizeof(buf);
@@ -672,11 +677,10 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
         return ret;
 }
 
-#ifdef CONFIG_IWLWIFI_LEDS
 static ssize_t iwl_dbgfs_led_read(struct file *file, char __user *user_buf,
                                   size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         int pos = 0;
         char buf[256];
         const size_t bufsz = sizeof(buf);
@@ -697,13 +701,12 @@ static ssize_t iwl_dbgfs_led_read(struct file *file, char __user *user_buf,
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
         return ret;
 }
-#endif
 
 static ssize_t iwl_dbgfs_thermal_throttling_read(struct file *file,
                                 char __user *user_buf,
                                 size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
         struct iwl_tt_restriction *restriction;
         char buf[100];
@@ -763,7 +766,7 @@ static ssize_t iwl_dbgfs_disable_ht40_read(struct file *file,
                                          char __user *user_buf,
                                          size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         char buf[100];
         int pos = 0;
         const size_t bufsz = sizeof(buf);
@@ -798,15 +801,22 @@ static ssize_t iwl_dbgfs_sleep_level_override_write(struct file *file,
          * valid here. However, let's not confuse them and present
          * IWL_POWER_INDEX_1 as "1", not "0".
          */
-        if (value > 0)
+        if (value == 0)
+                return -EINVAL;
+        else if (value > 0)
                 value -= 1;
 
         if (value != -1 && (value < 0 || value >= IWL_POWER_NUM))
                 return -EINVAL;
 
+        if (!iwl_is_ready_rf(priv))
+                return -EAGAIN;
+
         priv->power_data.debug_sleep_level_override = value;
 
-        iwl_power_update_mode(priv, false);
+        mutex_lock(&priv->mutex);
+        iwl_power_update_mode(priv, true);
+        mutex_unlock(&priv->mutex);
 
         return count;
 }
@@ -815,7 +825,7 @@ static ssize_t iwl_dbgfs_sleep_level_override_read(struct file *file,
                                                    char __user *user_buf,
                                                    size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         char buf[10];
         int pos, value;
         const size_t bufsz = sizeof(buf);
@@ -833,7 +843,7 @@ static ssize_t iwl_dbgfs_current_sleep_command_read(struct file *file,
                                                     char __user *user_buf,
                                                     size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         char buf[200];
         int pos = 0, i;
         const size_t bufsz = sizeof(buf);
@@ -854,16 +864,14 @@ static ssize_t iwl_dbgfs_current_sleep_command_read(struct file *file,
 }
 
 DEBUGFS_READ_WRITE_FILE_OPS(sram);
-DEBUGFS_WRITE_FILE_OPS(log_event);
+DEBUGFS_READ_WRITE_FILE_OPS(log_event);
 DEBUGFS_READ_FILE_OPS(nvm);
 DEBUGFS_READ_FILE_OPS(stations);
 DEBUGFS_READ_FILE_OPS(channels);
 DEBUGFS_READ_FILE_OPS(status);
 DEBUGFS_READ_WRITE_FILE_OPS(interrupt);
 DEBUGFS_READ_FILE_OPS(qos);
-#ifdef CONFIG_IWLWIFI_LEDS
 DEBUGFS_READ_FILE_OPS(led);
-#endif
 DEBUGFS_READ_FILE_OPS(thermal_throttling);
 DEBUGFS_READ_WRITE_FILE_OPS(disable_ht40);
 DEBUGFS_READ_WRITE_FILE_OPS(sleep_level_override);
@@ -881,10 +889,14 @@ static ssize_t iwl_dbgfs_traffic_log_read(struct file *file,
         struct iwl_rx_queue *rxq = &priv->rxq;
         char *buf;
         int bufsz = ((IWL_TRAFFIC_ENTRIES * IWL_TRAFFIC_ENTRY_SIZE * 64) * 2) +
-                (IWL_MAX_NUM_QUEUES * 32 * 8) + 400;
+                (priv->cfg->num_of_queues * 32 * 8) + 400;
         const u8 *ptr;
         ssize_t ret;
 
+        if (!priv->txq) {
+                IWL_ERR(priv, "txq not ready\n");
+                return -EAGAIN;
+        }
         buf = kzalloc(bufsz, GFP_KERNEL);
         if (!buf) {
                 IWL_ERR(priv, "Can not allocate buffer\n");
@@ -969,15 +981,19 @@ static ssize_t iwl_dbgfs_tx_queue_read(struct file *file,
                                                 char __user *user_buf,
                                                 size_t count, loff_t *ppos) {
 
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         struct iwl_tx_queue *txq;
         struct iwl_queue *q;
         char *buf;
         int pos = 0;
         int cnt;
         int ret;
-        const size_t bufsz = sizeof(char) * 60 * IWL_MAX_NUM_QUEUES;
+        const size_t bufsz = sizeof(char) * 64 * priv->cfg->num_of_queues;
 
+        if (!priv->txq) {
+                IWL_ERR(priv, "txq not ready\n");
+                return -EAGAIN;
+        }
         buf = kzalloc(bufsz, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
@@ -1011,7 +1027,7 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
                                                 char __user *user_buf,
                                                 size_t count, loff_t *ppos) {
 
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         struct iwl_rx_queue *rxq = &priv->rxq;
         char buf[256];
         int pos = 0;
@@ -1028,10 +1044,6 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
-#define UCODE_STATISTICS_CLEAR_MSK              (0x1 << 0)
-#define UCODE_STATISTICS_FREQUENCY_MSK          (0x1 << 1)
-#define UCODE_STATISTICS_NARROW_BAND_MSK        (0x1 << 2)
-
 static int iwl_dbgfs_statistics_flag(struct iwl_priv *priv, char *buf,
                                      int bufsz)
 {
@@ -1056,36 +1068,33 @@ static int iwl_dbgfs_statistics_flag(struct iwl_priv *priv, char *buf,
         return p;
 }
 
+static const char ucode_stats_header[] =
+        "%-32s     current  acumulative       delta         max\n";
+static const char ucode_stats_short_format[] =
+        "  %-30s %10u\n";
+static const char ucode_stats_format[] =
+        "  %-30s %10u  %10u  %10u  %10u\n";
 
 static ssize_t iwl_dbgfs_ucode_rx_stats_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         int pos = 0;
         char *buf;
-        int bufsz = sizeof(struct statistics_rx_phy) * 20 +
-                sizeof(struct statistics_rx_non_phy) * 20 +
-                sizeof(struct statistics_rx_ht_phy) * 20 + 400;
+        int bufsz = sizeof(struct statistics_rx_phy) * 40 +
+                sizeof(struct statistics_rx_non_phy) * 40 +
+                sizeof(struct statistics_rx_ht_phy) * 40 + 400;
         ssize_t ret;
-        struct statistics_rx_phy *ofdm;
-        struct statistics_rx_phy *cck;
-        struct statistics_rx_non_phy *general;
-        struct statistics_rx_ht_phy *ht;
+        struct statistics_rx_phy *ofdm, *accum_ofdm, *delta_ofdm, *max_ofdm;
+        struct statistics_rx_phy *cck, *accum_cck, *delta_cck, *max_cck;
+        struct statistics_rx_non_phy *general, *accum_general;
+        struct statistics_rx_non_phy *delta_general, *max_general;
+        struct statistics_rx_ht_phy *ht, *accum_ht, *delta_ht, *max_ht;
 
         if (!iwl_is_alive(priv))
                 return -EAGAIN;
 
-        /* make request to uCode to retrieve statistics information */
-        mutex_lock(&priv->mutex);
-        ret = iwl_send_statistics_request(priv, 0);
-        mutex_unlock(&priv->mutex);
-
-        if (ret) {
-                IWL_ERR(priv,
-                        "Error sending statistics request: %zd\n", ret);
-                return -EAGAIN;
-        }
         buf = kzalloc(bufsz, GFP_KERNEL);
         if (!buf) {
                 IWL_ERR(priv, "Can not allocate Buffer\n");
@@ -1100,155 +1109,405 @@ static ssize_t iwl_dbgfs_ucode_rx_stats_read(struct file *file,
         cck = &priv->statistics.rx.cck;
         general = &priv->statistics.rx.general;
         ht = &priv->statistics.rx.ofdm_ht;
+        accum_ofdm = &priv->accum_statistics.rx.ofdm;
+        accum_cck = &priv->accum_statistics.rx.cck;
+        accum_general = &priv->accum_statistics.rx.general;
+        accum_ht = &priv->accum_statistics.rx.ofdm_ht;
+        delta_ofdm = &priv->delta_statistics.rx.ofdm;
+        delta_cck = &priv->delta_statistics.rx.cck;
+        delta_general = &priv->delta_statistics.rx.general;
+        delta_ht = &priv->delta_statistics.rx.ofdm_ht;
+        max_ofdm = &priv->max_delta.rx.ofdm;
+        max_cck = &priv->max_delta.rx.cck;
+        max_general = &priv->max_delta.rx.general;
+        max_ht = &priv->max_delta.rx.ofdm_ht;
+
         pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt: %u\n",
-                         le32_to_cpu(ofdm->ina_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt: %u\n",
-                         le32_to_cpu(ofdm->fina_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err: %u\n",
-                         le32_to_cpu(ofdm->plcp_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err: %u\n",
-                         le32_to_cpu(ofdm->crc32_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "overrun_err: %u\n",
-                         le32_to_cpu(ofdm->overrun_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "early_overrun_err: %u\n",
-                         le32_to_cpu(ofdm->early_overrun_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good: %u\n",
-                         le32_to_cpu(ofdm->crc32_good));
-        pos += scnprintf(buf + pos, bufsz - pos, "false_alarm_cnt: %u\n",
-                         le32_to_cpu(ofdm->false_alarm_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_sync_err_cnt: %u\n",
-                         le32_to_cpu(ofdm->fina_sync_err_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "sfd_timeout: %u\n",
-                         le32_to_cpu(ofdm->sfd_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_timeout: %u\n",
-                         le32_to_cpu(ofdm->fina_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos, "unresponded_rts: %u\n",
-                         le32_to_cpu(ofdm->unresponded_rts));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "rxe_frame_limit_overrun: %u\n",
-                        le32_to_cpu(ofdm->rxe_frame_limit_overrun));
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_ack_cnt: %u\n",
-                         le32_to_cpu(ofdm->sent_ack_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_cts_cnt: %u\n",
-                         le32_to_cpu(ofdm->sent_cts_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_ba_rsp_cnt: %u\n",
-                         le32_to_cpu(ofdm->sent_ba_rsp_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "dsp_self_kill: %u\n",
-                         le32_to_cpu(ofdm->dsp_self_kill));
-        pos += scnprintf(buf + pos, bufsz - pos, "mh_format_err: %u\n",
-                         le32_to_cpu(ofdm->mh_format_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "re_acq_main_rssi_sum: %u\n",
-                         le32_to_cpu(ofdm->re_acq_main_rssi_sum));
-
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - CCK:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt: %u\n",
-                         le32_to_cpu(cck->ina_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt: %u\n",
-                         le32_to_cpu(cck->fina_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err: %u\n",
-                         le32_to_cpu(cck->plcp_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err: %u\n",
-                         le32_to_cpu(cck->crc32_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "overrun_err: %u\n",
-                         le32_to_cpu(cck->overrun_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "early_overrun_err: %u\n",
-                         le32_to_cpu(cck->early_overrun_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good: %u\n",
-                         le32_to_cpu(cck->crc32_good));
-        pos += scnprintf(buf + pos, bufsz - pos, "false_alarm_cnt: %u\n",
-                         le32_to_cpu(cck->false_alarm_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_sync_err_cnt: %u\n",
-                         le32_to_cpu(cck->fina_sync_err_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "sfd_timeout: %u\n",
-                         le32_to_cpu(cck->sfd_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_timeout: %u\n",
-                         le32_to_cpu(cck->fina_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos, "unresponded_rts: %u\n",
-                         le32_to_cpu(cck->unresponded_rts));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "rxe_frame_limit_overrun: %u\n",
-                        le32_to_cpu(cck->rxe_frame_limit_overrun));
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_ack_cnt: %u\n",
-                         le32_to_cpu(cck->sent_ack_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_cts_cnt: %u\n",
-                         le32_to_cpu(cck->sent_cts_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_ba_rsp_cnt: %u\n",
-                         le32_to_cpu(cck->sent_ba_rsp_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "dsp_self_kill: %u\n",
-                         le32_to_cpu(cck->dsp_self_kill));
-        pos += scnprintf(buf + pos, bufsz - pos, "mh_format_err: %u\n",
-                         le32_to_cpu(cck->mh_format_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "re_acq_main_rssi_sum: %u\n",
-                         le32_to_cpu(cck->re_acq_main_rssi_sum));
-
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - GENERAL:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "bogus_cts: %u\n",
-                         le32_to_cpu(general->bogus_cts));
-        pos += scnprintf(buf + pos, bufsz - pos, "bogus_ack: %u\n",
-                         le32_to_cpu(general->bogus_ack));
-        pos += scnprintf(buf + pos, bufsz - pos, "non_bssid_frames: %u\n",
-                         le32_to_cpu(general->non_bssid_frames));
-        pos += scnprintf(buf + pos, bufsz - pos, "filtered_frames: %u\n",
-                         le32_to_cpu(general->filtered_frames));
-        pos += scnprintf(buf + pos, bufsz - pos, "non_channel_beacons: %u\n",
-                         le32_to_cpu(general->non_channel_beacons));
-        pos += scnprintf(buf + pos, bufsz - pos, "channel_beacons: %u\n",
-                         le32_to_cpu(general->channel_beacons));
-        pos += scnprintf(buf + pos, bufsz - pos, "num_missed_bcon: %u\n",
-                         le32_to_cpu(general->num_missed_bcon));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "adc_rx_saturation_time: %u\n",
-                        le32_to_cpu(general->adc_rx_saturation_time));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "ina_detection_search_time: %u\n",
-                        le32_to_cpu(general->ina_detection_search_time));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_silence_rssi_a: %u\n",
-                         le32_to_cpu(general->beacon_silence_rssi_a));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_silence_rssi_b: %u\n",
-                         le32_to_cpu(general->beacon_silence_rssi_b));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_silence_rssi_c: %u\n",
-                         le32_to_cpu(general->beacon_silence_rssi_c));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "interference_data_flag: %u\n",
-                        le32_to_cpu(general->interference_data_flag));
-        pos += scnprintf(buf + pos, bufsz - pos, "channel_load: %u\n",
-                         le32_to_cpu(general->channel_load));
-        pos += scnprintf(buf + pos, bufsz - pos, "dsp_false_alarms: %u\n",
-                         le32_to_cpu(general->dsp_false_alarms));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_rssi_a: %u\n",
-                         le32_to_cpu(general->beacon_rssi_a));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_rssi_b: %u\n",
-                         le32_to_cpu(general->beacon_rssi_b));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_rssi_c: %u\n",
-                         le32_to_cpu(general->beacon_rssi_c));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_energy_a: %u\n",
-                         le32_to_cpu(general->beacon_energy_a));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_energy_b: %u\n",
-                         le32_to_cpu(general->beacon_energy_b));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_energy_c: %u\n",
-                         le32_to_cpu(general->beacon_energy_c));
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
+                         "Statistics_Rx - OFDM:");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "ina_cnt:", le32_to_cpu(ofdm->ina_cnt),
+                         accum_ofdm->ina_cnt,
+                         delta_ofdm->ina_cnt, max_ofdm->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "fina_cnt:",
+                         le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt,
+                         delta_ofdm->fina_cnt, max_ofdm->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "plcp_err:",
+                         le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err,
+                         delta_ofdm->plcp_err, max_ofdm->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "crc32_err:",
+                         le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err,
+                         delta_ofdm->crc32_err, max_ofdm->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "overrun_err:",
+                         le32_to_cpu(ofdm->overrun_err),
+                         accum_ofdm->overrun_err,
+                         delta_ofdm->overrun_err, max_ofdm->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "early_overrun_err:",
+                         le32_to_cpu(ofdm->early_overrun_err),
+                         accum_ofdm->early_overrun_err,
+                         delta_ofdm->early_overrun_err,
+                         max_ofdm->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "crc32_good:",
+                         le32_to_cpu(ofdm->crc32_good),
+                         accum_ofdm->crc32_good,
+                         delta_ofdm->crc32_good, max_ofdm->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "false_alarm_cnt:",
+                         le32_to_cpu(ofdm->false_alarm_cnt),
+                         accum_ofdm->false_alarm_cnt,
+                         delta_ofdm->false_alarm_cnt,
+                         max_ofdm->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "fina_sync_err_cnt:",
+                         le32_to_cpu(ofdm->fina_sync_err_cnt),
+                         accum_ofdm->fina_sync_err_cnt,
+                         delta_ofdm->fina_sync_err_cnt,
+                         max_ofdm->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sfd_timeout:",
+                         le32_to_cpu(ofdm->sfd_timeout),
+                         accum_ofdm->sfd_timeout,
+                         delta_ofdm->sfd_timeout,
+                         max_ofdm->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "fina_timeout:",
+                         le32_to_cpu(ofdm->fina_timeout),
+                         accum_ofdm->fina_timeout,
+                         delta_ofdm->fina_timeout,
+                         max_ofdm->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "unresponded_rts:",
+                         le32_to_cpu(ofdm->unresponded_rts),
+                         accum_ofdm->unresponded_rts,
+                         delta_ofdm->unresponded_rts,
+                         max_ofdm->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "rxe_frame_lmt_ovrun:",
+                         le32_to_cpu(ofdm->rxe_frame_limit_overrun),
+                         accum_ofdm->rxe_frame_limit_overrun,
+                         delta_ofdm->rxe_frame_limit_overrun,
+                         max_ofdm->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sent_ack_cnt:",
+                         le32_to_cpu(ofdm->sent_ack_cnt),
+                         accum_ofdm->sent_ack_cnt,
+                         delta_ofdm->sent_ack_cnt,
+                         max_ofdm->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sent_cts_cnt:",
+                         le32_to_cpu(ofdm->sent_cts_cnt),
+                         accum_ofdm->sent_cts_cnt,
+                         delta_ofdm->sent_cts_cnt, max_ofdm->sent_cts_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sent_ba_rsp_cnt:",
+                         le32_to_cpu(ofdm->sent_ba_rsp_cnt),
+                         accum_ofdm->sent_ba_rsp_cnt,
+                         delta_ofdm->sent_ba_rsp_cnt,
+                         max_ofdm->sent_ba_rsp_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "dsp_self_kill:",
+                         le32_to_cpu(ofdm->dsp_self_kill),
+                         accum_ofdm->dsp_self_kill,
+                         delta_ofdm->dsp_self_kill,
+                         max_ofdm->dsp_self_kill);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "mh_format_err:",
+                         le32_to_cpu(ofdm->mh_format_err),
+                         accum_ofdm->mh_format_err,
+                         delta_ofdm->mh_format_err,
+                         max_ofdm->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "re_acq_main_rssi_sum:",
+                         le32_to_cpu(ofdm->re_acq_main_rssi_sum),
+                         accum_ofdm->re_acq_main_rssi_sum,
+                         delta_ofdm->re_acq_main_rssi_sum,
+                        max_ofdm->re_acq_main_rssi_sum);
+
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
+                         "Statistics_Rx - CCK:");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "ina_cnt:",
+                         le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt,
+                         delta_cck->ina_cnt, max_cck->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "fina_cnt:",
+                         le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt,
+                         delta_cck->fina_cnt, max_cck->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "plcp_err:",
+                         le32_to_cpu(cck->plcp_err), accum_cck->plcp_err,
+                         delta_cck->plcp_err, max_cck->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "crc32_err:",
+                         le32_to_cpu(cck->crc32_err), accum_cck->crc32_err,
+                         delta_cck->crc32_err, max_cck->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "overrun_err:",
+                         le32_to_cpu(cck->overrun_err),
+                         accum_cck->overrun_err,
+                         delta_cck->overrun_err, max_cck->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "early_overrun_err:",
+                         le32_to_cpu(cck->early_overrun_err),
+                         accum_cck->early_overrun_err,
+                         delta_cck->early_overrun_err,
+                         max_cck->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "crc32_good:",
+                         le32_to_cpu(cck->crc32_good), accum_cck->crc32_good,
+                         delta_cck->crc32_good,
+                         max_cck->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "false_alarm_cnt:",
+                         le32_to_cpu(cck->false_alarm_cnt),
+                         accum_cck->false_alarm_cnt,
+                         delta_cck->false_alarm_cnt, max_cck->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "fina_sync_err_cnt:",
+                         le32_to_cpu(cck->fina_sync_err_cnt),
+                         accum_cck->fina_sync_err_cnt,
+                         delta_cck->fina_sync_err_cnt,
+                         max_cck->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sfd_timeout:",
+                         le32_to_cpu(cck->sfd_timeout),
+                         accum_cck->sfd_timeout,
+                         delta_cck->sfd_timeout, max_cck->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "fina_timeout:",
+                         le32_to_cpu(cck->fina_timeout),
+                         accum_cck->fina_timeout,
+                         delta_cck->fina_timeout, max_cck->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "unresponded_rts:",
+                         le32_to_cpu(cck->unresponded_rts),
+                         accum_cck->unresponded_rts,
+                         delta_cck->unresponded_rts,
+                         max_cck->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "rxe_frame_lmt_ovrun:",
+                         le32_to_cpu(cck->rxe_frame_limit_overrun),
+                         accum_cck->rxe_frame_limit_overrun,
+                         delta_cck->rxe_frame_limit_overrun,
+                         max_cck->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sent_ack_cnt:",
+                         le32_to_cpu(cck->sent_ack_cnt),
+                         accum_cck->sent_ack_cnt,
+                         delta_cck->sent_ack_cnt,
+                         max_cck->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sent_cts_cnt:",
+                         le32_to_cpu(cck->sent_cts_cnt),
+                         accum_cck->sent_cts_cnt,
+                         delta_cck->sent_cts_cnt,
+                         max_cck->sent_cts_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sent_ba_rsp_cnt:",
+                         le32_to_cpu(cck->sent_ba_rsp_cnt),
+                         accum_cck->sent_ba_rsp_cnt,
+                         delta_cck->sent_ba_rsp_cnt,
+                         max_cck->sent_ba_rsp_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "dsp_self_kill:",
+                         le32_to_cpu(cck->dsp_self_kill),
+                         accum_cck->dsp_self_kill,
+                         delta_cck->dsp_self_kill,
+                         max_cck->dsp_self_kill);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "mh_format_err:",
+                         le32_to_cpu(cck->mh_format_err),
+                         accum_cck->mh_format_err,
+                         delta_cck->mh_format_err, max_cck->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "re_acq_main_rssi_sum:",
+                         le32_to_cpu(cck->re_acq_main_rssi_sum),
+                         accum_cck->re_acq_main_rssi_sum,
+                         delta_cck->re_acq_main_rssi_sum,
+                         max_cck->re_acq_main_rssi_sum);
+
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
+                        "Statistics_Rx - GENERAL:");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "bogus_cts:",
+                         le32_to_cpu(general->bogus_cts),
+                         accum_general->bogus_cts,
+                         delta_general->bogus_cts, max_general->bogus_cts);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "bogus_ack:",
+                         le32_to_cpu(general->bogus_ack),
+                         accum_general->bogus_ack,
+                         delta_general->bogus_ack, max_general->bogus_ack);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "non_bssid_frames:",
+                         le32_to_cpu(general->non_bssid_frames),
+                         accum_general->non_bssid_frames,
+                         delta_general->non_bssid_frames,
+                         max_general->non_bssid_frames);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "filtered_frames:",
+                         le32_to_cpu(general->filtered_frames),
+                         accum_general->filtered_frames,
+                         delta_general->filtered_frames,
+                         max_general->filtered_frames);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "non_channel_beacons:",
+                         le32_to_cpu(general->non_channel_beacons),
+                         accum_general->non_channel_beacons,
+                         delta_general->non_channel_beacons,
+                         max_general->non_channel_beacons);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "channel_beacons:",
+                         le32_to_cpu(general->channel_beacons),
+                         accum_general->channel_beacons,
+                         delta_general->channel_beacons,
+                         max_general->channel_beacons);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "num_missed_bcon:",
+                         le32_to_cpu(general->num_missed_bcon),
+                         accum_general->num_missed_bcon,
+                         delta_general->num_missed_bcon,
+                         max_general->num_missed_bcon);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "adc_rx_saturation_time:",
+                         le32_to_cpu(general->adc_rx_saturation_time),
+                         accum_general->adc_rx_saturation_time,
+                         delta_general->adc_rx_saturation_time,
+                         max_general->adc_rx_saturation_time);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "ina_detect_search_tm:",
+                         le32_to_cpu(general->ina_detection_search_time),
+                         accum_general->ina_detection_search_time,
+                         delta_general->ina_detection_search_time,
+                         max_general->ina_detection_search_time);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_silence_rssi_a:",
+                         le32_to_cpu(general->beacon_silence_rssi_a),
+                         accum_general->beacon_silence_rssi_a,
+                         delta_general->beacon_silence_rssi_a,
+                         max_general->beacon_silence_rssi_a);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_silence_rssi_b:",
+                         le32_to_cpu(general->beacon_silence_rssi_b),
+                         accum_general->beacon_silence_rssi_b,
+                         delta_general->beacon_silence_rssi_b,
+                         max_general->beacon_silence_rssi_b);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_silence_rssi_c:",
+                         le32_to_cpu(general->beacon_silence_rssi_c),
+                         accum_general->beacon_silence_rssi_c,
+                         delta_general->beacon_silence_rssi_c,
+                         max_general->beacon_silence_rssi_c);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "interference_data_flag:",
+                         le32_to_cpu(general->interference_data_flag),
+                         accum_general->interference_data_flag,
+                         delta_general->interference_data_flag,
+                         max_general->interference_data_flag);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "channel_load:",
+                         le32_to_cpu(general->channel_load),
+                         accum_general->channel_load,
+                         delta_general->channel_load,
+                         max_general->channel_load);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "dsp_false_alarms:",
+                         le32_to_cpu(general->dsp_false_alarms),
+                         accum_general->dsp_false_alarms,
+                         delta_general->dsp_false_alarms,
+                         max_general->dsp_false_alarms);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_rssi_a:",
+                         le32_to_cpu(general->beacon_rssi_a),
+                         accum_general->beacon_rssi_a,
+                         delta_general->beacon_rssi_a,
+                         max_general->beacon_rssi_a);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_rssi_b:",
+                         le32_to_cpu(general->beacon_rssi_b),
+                         accum_general->beacon_rssi_b,
+                         delta_general->beacon_rssi_b,
+                         max_general->beacon_rssi_b);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_rssi_c:",
+                         le32_to_cpu(general->beacon_rssi_c),
+                         accum_general->beacon_rssi_c,
+                         delta_general->beacon_rssi_c,
+                         max_general->beacon_rssi_c);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_energy_a:",
+                         le32_to_cpu(general->beacon_energy_a),
+                         accum_general->beacon_energy_a,
+                         delta_general->beacon_energy_a,
+                         max_general->beacon_energy_a);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_energy_b:",
+                         le32_to_cpu(general->beacon_energy_b),
+                         accum_general->beacon_energy_b,
+                         delta_general->beacon_energy_b,
+                         max_general->beacon_energy_b);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_energy_c:",
+                         le32_to_cpu(general->beacon_energy_c),
+                         accum_general->beacon_energy_c,
+                         delta_general->beacon_energy_c,
+                         max_general->beacon_energy_c);
 
         pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM_HT:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err: %u\n",
-                         le32_to_cpu(ht->plcp_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "overrun_err: %u\n",
-                         le32_to_cpu(ht->overrun_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "early_overrun_err: %u\n",
-                         le32_to_cpu(ht->early_overrun_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good: %u\n",
-                         le32_to_cpu(ht->crc32_good));
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err: %u\n",
-                         le32_to_cpu(ht->crc32_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "mh_format_err: %u\n",
-                         le32_to_cpu(ht->mh_format_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg_crc32_good: %u\n",
-                         le32_to_cpu(ht->agg_crc32_good));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg_mpdu_cnt: %u\n",
-                         le32_to_cpu(ht->agg_mpdu_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg_cnt: %u\n",
-                         le32_to_cpu(ht->agg_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
+                        "Statistics_Rx - OFDM_HT:");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "plcp_err:",
+                         le32_to_cpu(ht->plcp_err), accum_ht->plcp_err,
+                         delta_ht->plcp_err, max_ht->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "overrun_err:",
+                         le32_to_cpu(ht->overrun_err), accum_ht->overrun_err,
+                         delta_ht->overrun_err, max_ht->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "early_overrun_err:",
+                         le32_to_cpu(ht->early_overrun_err),
+                         accum_ht->early_overrun_err,
+                         delta_ht->early_overrun_err,
+                         max_ht->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "crc32_good:",
+                         le32_to_cpu(ht->crc32_good), accum_ht->crc32_good,
+                         delta_ht->crc32_good, max_ht->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "crc32_err:",
+                         le32_to_cpu(ht->crc32_err), accum_ht->crc32_err,
+                         delta_ht->crc32_err, max_ht->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "mh_format_err:",
+                         le32_to_cpu(ht->mh_format_err),
+                         accum_ht->mh_format_err,
+                         delta_ht->mh_format_err, max_ht->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg_crc32_good:",
+                         le32_to_cpu(ht->agg_crc32_good),
+                         accum_ht->agg_crc32_good,
+                         delta_ht->agg_crc32_good, max_ht->agg_crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg_mpdu_cnt:",
+                         le32_to_cpu(ht->agg_mpdu_cnt),
+                         accum_ht->agg_mpdu_cnt,
+                         delta_ht->agg_mpdu_cnt, max_ht->agg_mpdu_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg_cnt:",
+                         le32_to_cpu(ht->agg_cnt), accum_ht->agg_cnt,
+                         delta_ht->agg_cnt, max_ht->agg_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "unsupport_mcs:",
+                         le32_to_cpu(ht->unsupport_mcs),
+                         accum_ht->unsupport_mcs,
+                         delta_ht->unsupport_mcs, max_ht->unsupport_mcs);
 
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
         kfree(buf);
@@ -1259,26 +1518,16 @@ static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         int pos = 0;
         char *buf;
-        int bufsz = (sizeof(struct statistics_tx) * 24) + 250;
+        int bufsz = (sizeof(struct statistics_tx) * 48) + 250;
         ssize_t ret;
-        struct statistics_tx *tx;
+        struct statistics_tx *tx, *accum_tx, *delta_tx, *max_tx;
 
         if (!iwl_is_alive(priv))
                 return -EAGAIN;
 
-        /* make request to uCode to retrieve statistics information */
-        mutex_lock(&priv->mutex);
-        ret = iwl_send_statistics_request(priv, 0);
-        mutex_unlock(&priv->mutex);
-
-        if (ret) {
-                IWL_ERR(priv,
-                        "Error sending statistics request: %zd\n", ret);
-                return -EAGAIN;
-        }
         buf = kzalloc(bufsz, GFP_KERNEL);
         if (!buf) {
                 IWL_ERR(priv, "Can not allocate Buffer\n");
@@ -1290,62 +1539,149 @@ static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
          * might not reflect the current uCode activity
          */
         tx = &priv->statistics.tx;
+        accum_tx = &priv->accum_statistics.tx;
+        delta_tx = &priv->delta_statistics.tx;
+        max_tx = &priv->max_delta.tx;
         pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Tx:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "preamble: %u\n",
-                         le32_to_cpu(tx->preamble_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "rx_detected_cnt: %u\n",
-                         le32_to_cpu(tx->rx_detected_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "bt_prio_defer_cnt: %u\n",
-                         le32_to_cpu(tx->bt_prio_defer_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "bt_prio_kill_cnt: %u\n",
-                         le32_to_cpu(tx->bt_prio_kill_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "few_bytes_cnt: %u\n",
-                         le32_to_cpu(tx->few_bytes_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "cts_timeout: %u\n",
-                         le32_to_cpu(tx->cts_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos, "ack_timeout: %u\n",
-                         le32_to_cpu(tx->ack_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos, "expected_ack_cnt: %u\n",
-                         le32_to_cpu(tx->expected_ack_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "actual_ack_cnt: %u\n",
-                         le32_to_cpu(tx->actual_ack_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "dump_msdu_cnt: %u\n",
-                         le32_to_cpu(tx->dump_msdu_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "burst_abort_next_frame_mismatch_cnt: %u\n",
-                        le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "burst_abort_missing_next_frame_cnt: %u\n",
-                        le32_to_cpu(tx->burst_abort_missing_next_frame_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "cts_timeout_collision: %u\n",
-                         le32_to_cpu(tx->cts_timeout_collision));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "ack_or_ba_timeout_collision: %u\n",
-                        le32_to_cpu(tx->ack_or_ba_timeout_collision));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg ba_timeout: %u\n",
-                         le32_to_cpu(tx->agg.ba_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "agg ba_reschedule_frames: %u\n",
-                        le32_to_cpu(tx->agg.ba_reschedule_frames));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "agg scd_query_agg_frame_cnt: %u\n",
-                        le32_to_cpu(tx->agg.scd_query_agg_frame_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg scd_query_no_agg: %u\n",
-                         le32_to_cpu(tx->agg.scd_query_no_agg));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg scd_query_agg: %u\n",
-                         le32_to_cpu(tx->agg.scd_query_agg));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "agg scd_query_mismatch: %u\n",
-                        le32_to_cpu(tx->agg.scd_query_mismatch));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg frame_not_ready: %u\n",
-                         le32_to_cpu(tx->agg.frame_not_ready));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg underrun: %u\n",
-                         le32_to_cpu(tx->agg.underrun));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg bt_prio_kill: %u\n",
-                         le32_to_cpu(tx->agg.bt_prio_kill));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg rx_ba_rsp_cnt: %u\n",
-                         le32_to_cpu(tx->agg.rx_ba_rsp_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos,  ucode_stats_header,
+                        "Statistics_Tx:");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "preamble:",
+                         le32_to_cpu(tx->preamble_cnt),
+                         accum_tx->preamble_cnt,
+                         delta_tx->preamble_cnt, max_tx->preamble_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "rx_detected_cnt:",
+                         le32_to_cpu(tx->rx_detected_cnt),
+                         accum_tx->rx_detected_cnt,
+                         delta_tx->rx_detected_cnt, max_tx->rx_detected_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "bt_prio_defer_cnt:",
+                         le32_to_cpu(tx->bt_prio_defer_cnt),
+                         accum_tx->bt_prio_defer_cnt,
+                         delta_tx->bt_prio_defer_cnt,
+                         max_tx->bt_prio_defer_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "bt_prio_kill_cnt:",
+                         le32_to_cpu(tx->bt_prio_kill_cnt),
+                         accum_tx->bt_prio_kill_cnt,
+                         delta_tx->bt_prio_kill_cnt,
+                         max_tx->bt_prio_kill_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "few_bytes_cnt:",
+                         le32_to_cpu(tx->few_bytes_cnt),
+                         accum_tx->few_bytes_cnt,
+                         delta_tx->few_bytes_cnt, max_tx->few_bytes_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "cts_timeout:",
+                         le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout,
+                         delta_tx->cts_timeout, max_tx->cts_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "ack_timeout:",
+                         le32_to_cpu(tx->ack_timeout),
+                         accum_tx->ack_timeout,
+                         delta_tx->ack_timeout, max_tx->ack_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "expected_ack_cnt:",
+                         le32_to_cpu(tx->expected_ack_cnt),
+                         accum_tx->expected_ack_cnt,
+                         delta_tx->expected_ack_cnt,
+                         max_tx->expected_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "actual_ack_cnt:",
+                         le32_to_cpu(tx->actual_ack_cnt),
+                         accum_tx->actual_ack_cnt,
+                         delta_tx->actual_ack_cnt,
+                         max_tx->actual_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "dump_msdu_cnt:",
+                         le32_to_cpu(tx->dump_msdu_cnt),
+                         accum_tx->dump_msdu_cnt,
+                         delta_tx->dump_msdu_cnt,
+                         max_tx->dump_msdu_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "abort_nxt_frame_mismatch:",
+                         le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt),
+                         accum_tx->burst_abort_next_frame_mismatch_cnt,
+                         delta_tx->burst_abort_next_frame_mismatch_cnt,
+                         max_tx->burst_abort_next_frame_mismatch_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "abort_missing_nxt_frame:",
+                         le32_to_cpu(tx->burst_abort_missing_next_frame_cnt),
+                         accum_tx->burst_abort_missing_next_frame_cnt,
+                         delta_tx->burst_abort_missing_next_frame_cnt,
+                         max_tx->burst_abort_missing_next_frame_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "cts_timeout_collision:",
+                         le32_to_cpu(tx->cts_timeout_collision),
+                         accum_tx->cts_timeout_collision,
+                         delta_tx->cts_timeout_collision,
+                         max_tx->cts_timeout_collision);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "ack_ba_timeout_collision:",
+                         le32_to_cpu(tx->ack_or_ba_timeout_collision),
+                         accum_tx->ack_or_ba_timeout_collision,
+                         delta_tx->ack_or_ba_timeout_collision,
+                         max_tx->ack_or_ba_timeout_collision);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg ba_timeout:",
+                         le32_to_cpu(tx->agg.ba_timeout),
+                         accum_tx->agg.ba_timeout,
+                         delta_tx->agg.ba_timeout,
+                         max_tx->agg.ba_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "agg ba_resched_frames:",
+                         le32_to_cpu(tx->agg.ba_reschedule_frames),
+                         accum_tx->agg.ba_reschedule_frames,
+                         delta_tx->agg.ba_reschedule_frames,
+                         max_tx->agg.ba_reschedule_frames);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "agg scd_query_agg_frame:",
+                         le32_to_cpu(tx->agg.scd_query_agg_frame_cnt),
+                         accum_tx->agg.scd_query_agg_frame_cnt,
+                         delta_tx->agg.scd_query_agg_frame_cnt,
+                         max_tx->agg.scd_query_agg_frame_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg scd_query_no_agg:",
+                         le32_to_cpu(tx->agg.scd_query_no_agg),
+                         accum_tx->agg.scd_query_no_agg,
+                         delta_tx->agg.scd_query_no_agg,
+                         max_tx->agg.scd_query_no_agg);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg scd_query_agg:",
+                         le32_to_cpu(tx->agg.scd_query_agg),
+                         accum_tx->agg.scd_query_agg,
+                         delta_tx->agg.scd_query_agg,
+                         max_tx->agg.scd_query_agg);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "agg scd_query_mismatch:",
+                         le32_to_cpu(tx->agg.scd_query_mismatch),
+                         accum_tx->agg.scd_query_mismatch,
+                         delta_tx->agg.scd_query_mismatch,
+                         max_tx->agg.scd_query_mismatch);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg frame_not_ready:",
+                         le32_to_cpu(tx->agg.frame_not_ready),
+                         accum_tx->agg.frame_not_ready,
+                         delta_tx->agg.frame_not_ready,
+                         max_tx->agg.frame_not_ready);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg underrun:",
+                         le32_to_cpu(tx->agg.underrun),
+                         accum_tx->agg.underrun,
+                         delta_tx->agg.underrun, max_tx->agg.underrun);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg bt_prio_kill:",
+                         le32_to_cpu(tx->agg.bt_prio_kill),
+                         accum_tx->agg.bt_prio_kill,
+                         delta_tx->agg.bt_prio_kill,
+                         max_tx->agg.bt_prio_kill);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg rx_ba_rsp_cnt:",
+                         le32_to_cpu(tx->agg.rx_ba_rsp_cnt),
+                         accum_tx->agg.rx_ba_rsp_cnt,
+                         delta_tx->agg.rx_ba_rsp_cnt,
+                         max_tx->agg.rx_ba_rsp_cnt);
 
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
         kfree(buf);
@@ -1356,28 +1692,19 @@ static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         int pos = 0;
         char *buf;
-        int bufsz = sizeof(struct statistics_general) * 4 + 250;
+        int bufsz = sizeof(struct statistics_general) * 10 + 300;
         ssize_t ret;
-        struct statistics_general *general;
-        struct statistics_dbg *dbg;
-        struct statistics_div *div;
+        struct statistics_general *general, *accum_general;
+        struct statistics_general *delta_general, *max_general;
+        struct statistics_dbg *dbg, *accum_dbg, *delta_dbg, *max_dbg;
+        struct statistics_div *div, *accum_div, *delta_div, *max_div;
 
         if (!iwl_is_alive(priv))
                 return -EAGAIN;
 
-        /* make request to uCode to retrieve statistics information */
-        mutex_lock(&priv->mutex);
-        ret = iwl_send_statistics_request(priv, 0);
-        mutex_unlock(&priv->mutex);
-
-        if (ret) {
-                IWL_ERR(priv,
-                        "Error sending statistics request: %zd\n", ret);
-                return -EAGAIN;
-        }
         buf = kzalloc(bufsz, GFP_KERNEL);
         if (!buf) {
                 IWL_ERR(priv, "Can not allocate Buffer\n");
@@ -1391,34 +1718,79 @@ static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
         general = &priv->statistics.general;
         dbg = &priv->statistics.general.dbg;
         div = &priv->statistics.general.div;
+        accum_general = &priv->accum_statistics.general;
+        delta_general = &priv->delta_statistics.general;
+        max_general = &priv->max_delta.general;
+        accum_dbg = &priv->accum_statistics.general.dbg;
+        delta_dbg = &priv->delta_statistics.general.dbg;
+        max_dbg = &priv->max_delta.general.dbg;
+        accum_div = &priv->accum_statistics.general.div;
+        delta_div = &priv->delta_statistics.general.div;
+        max_div = &priv->max_delta.general.div;
         pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_General:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "temperature: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
+                        "Statistics_General:");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_short_format,
+                         "temperature:",
                          le32_to_cpu(general->temperature));
-        pos += scnprintf(buf + pos, bufsz - pos, "temperature_m: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_short_format,
+                         "temperature_m:",
                          le32_to_cpu(general->temperature_m));
-        pos += scnprintf(buf + pos, bufsz - pos, "burst_check: %u\n",
-                         le32_to_cpu(dbg->burst_check));
-        pos += scnprintf(buf + pos, bufsz - pos, "burst_count: %u\n",
-                         le32_to_cpu(dbg->burst_count));
-        pos += scnprintf(buf + pos, bufsz - pos, "sleep_time: %u\n",
-                         le32_to_cpu(general->sleep_time));
-        pos += scnprintf(buf + pos, bufsz - pos, "slots_out: %u\n",
-                         le32_to_cpu(general->slots_out));
-        pos += scnprintf(buf + pos, bufsz - pos, "slots_idle: %u\n",
-                         le32_to_cpu(general->slots_idle));
-        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "burst_check:",
+                         le32_to_cpu(dbg->burst_check),
+                         accum_dbg->burst_check,
+                         delta_dbg->burst_check, max_dbg->burst_check);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "burst_count:",
+                         le32_to_cpu(dbg->burst_count),
+                         accum_dbg->burst_count,
+                         delta_dbg->burst_count, max_dbg->burst_count);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sleep_time:",
+                         le32_to_cpu(general->sleep_time),
+                         accum_general->sleep_time,
+                         delta_general->sleep_time, max_general->sleep_time);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "slots_out:",
+                         le32_to_cpu(general->slots_out),
+                         accum_general->slots_out,
+                         delta_general->slots_out, max_general->slots_out);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "slots_idle:",
+                         le32_to_cpu(general->slots_idle),
+                         accum_general->slots_idle,
+                         delta_general->slots_idle, max_general->slots_idle);
+        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp:\t\t\t%u\n",
                          le32_to_cpu(general->ttl_timestamp));
-        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_a: %u\n",
-                         le32_to_cpu(div->tx_on_a));
-        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_b: %u\n",
-                         le32_to_cpu(div->tx_on_b));
-        pos += scnprintf(buf + pos, bufsz - pos, "exec_time: %u\n",
-                         le32_to_cpu(div->exec_time));
-        pos += scnprintf(buf + pos, bufsz - pos, "probe_time: %u\n",
-                         le32_to_cpu(div->probe_time));
-        pos += scnprintf(buf + pos, bufsz - pos, "rx_enable_counter: %u\n",
-                         le32_to_cpu(general->rx_enable_counter));
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "tx_on_a:",
+                         le32_to_cpu(div->tx_on_a), accum_div->tx_on_a,
+                         delta_div->tx_on_a, max_div->tx_on_a);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "tx_on_b:",
+                         le32_to_cpu(div->tx_on_b), accum_div->tx_on_b,
+                         delta_div->tx_on_b, max_div->tx_on_b);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "exec_time:",
+                         le32_to_cpu(div->exec_time), accum_div->exec_time,
+                         delta_div->exec_time, max_div->exec_time);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "probe_time:",
+                         le32_to_cpu(div->probe_time), accum_div->probe_time,
+                         delta_div->probe_time, max_div->probe_time);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "rx_enable_counter:",
+                         le32_to_cpu(general->rx_enable_counter),
+                         accum_general->rx_enable_counter,
+                         delta_general->rx_enable_counter,
+                         max_general->rx_enable_counter);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "num_of_sos_states:",
+                         le32_to_cpu(general->num_of_sos_states),
+                         accum_general->num_of_sos_states,
+                         delta_general->num_of_sos_states,
+                         max_general->num_of_sos_states);
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
         kfree(buf);
         return ret;
@@ -1428,7 +1800,7 @@ static ssize_t iwl_dbgfs_sensitivity_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos) {
 
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         int pos = 0;
         int cnt = 0;
         char *buf;
@@ -1509,7 +1881,7 @@ static ssize_t iwl_dbgfs_chain_noise_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos) {
 
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         int pos = 0;
         int cnt = 0;
         char *buf;
@@ -1567,26 +1939,15 @@ static ssize_t iwl_dbgfs_tx_power_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos) {
 
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
         char buf[128];
         int pos = 0;
-        ssize_t ret;
         const size_t bufsz = sizeof(buf);
         struct statistics_tx *tx;
 
         if (!iwl_is_alive(priv))
                 pos += scnprintf(buf + pos, bufsz - pos, "N/A\n");
         else {
-                /* make request to uCode to retrieve statistics information */
-                mutex_lock(&priv->mutex);
-                ret = iwl_send_statistics_request(priv, 0);
-                mutex_unlock(&priv->mutex);
-
-                if (ret) {
-                        IWL_ERR(priv, "Error sending statistics request: %zd\n",
-                                ret);
-                        return -EAGAIN;
-                }
                 tx = &priv->statistics.tx;
                 if (tx->tx_power.ant_a ||
                     tx->tx_power.ant_b ||
@@ -1614,8 +1975,311 @@ static ssize_t iwl_dbgfs_tx_power_read(struct file *file,
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
-DEBUGFS_READ_WRITE_FILE_OPS(rx_statistics);
-DEBUGFS_READ_WRITE_FILE_OPS(tx_statistics);
+static ssize_t iwl_dbgfs_power_save_status_read(struct file *file,
+                                                    char __user *user_buf,
+                                                    size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[60];
+        int pos = 0;
+        const size_t bufsz = sizeof(buf);
+        u32 pwrsave_status;
+
+        pwrsave_status = iwl_read32(priv, CSR_GP_CNTRL) &
+                        CSR_GP_REG_POWER_SAVE_STATUS_MSK;
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Power Save Status: ");
+        pos += scnprintf(buf + pos, bufsz - pos, "%s\n",
+                (pwrsave_status == CSR_GP_REG_NO_POWER_SAVE) ? "none" :
+                (pwrsave_status == CSR_GP_REG_MAC_POWER_SAVE) ? "MAC" :
+                (pwrsave_status == CSR_GP_REG_PHY_POWER_SAVE) ? "PHY" :
+                "error");
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+static ssize_t iwl_dbgfs_clear_ucode_statistics_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int clear;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &clear) != 1)
+                return -EFAULT;
+
+        /* make request to uCode to retrieve statistics information */
+        mutex_lock(&priv->mutex);
+        iwl_send_statistics_request(priv, CMD_SYNC, true);
+        mutex_unlock(&priv->mutex);
+
+        return count;
+}
+
+static ssize_t iwl_dbgfs_csr_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int csr;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &csr) != 1)
+                return -EFAULT;
+
+        if (priv->cfg->ops->lib->dump_csr)
+                priv->cfg->ops->lib->dump_csr(priv);
+
+        return count;
+}
+
+static ssize_t iwl_dbgfs_ucode_tracing_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        char buf[128];
+        const size_t bufsz = sizeof(buf);
+        ssize_t ret;
+
+        pos += scnprintf(buf + pos, bufsz - pos, "ucode trace timer is %s\n",
+                        priv->event_log.ucode_trace ? "On" : "Off");
+        pos += scnprintf(buf + pos, bufsz - pos, "non_wraps_count:\t\t %u\n",
+                        priv->event_log.non_wraps_count);
+        pos += scnprintf(buf + pos, bufsz - pos, "wraps_once_count:\t\t %u\n",
+                        priv->event_log.wraps_once_count);
+        pos += scnprintf(buf + pos, bufsz - pos, "wraps_more_count:\t\t %u\n",
+                        priv->event_log.wraps_more_count);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_ucode_tracing_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int trace;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &trace) != 1)
+                return -EFAULT;
+
+        if (trace) {
+                priv->event_log.ucode_trace = true;
+                /* schedule the ucode timer to occur in UCODE_TRACE_PERIOD */
+                mod_timer(&priv->ucode_trace,
+                        jiffies + msecs_to_jiffies(UCODE_TRACE_PERIOD));
+        } else {
+                priv->event_log.ucode_trace = false;
+                del_timer_sync(&priv->ucode_trace);
+        }
+
+        return count;
+}
+
+static ssize_t iwl_dbgfs_fh_reg_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        char *buf;
+        int pos = 0;
+        ssize_t ret = -EFAULT;
+
+        if (priv->cfg->ops->lib->dump_fh) {
+                ret = pos = priv->cfg->ops->lib->dump_fh(priv, &buf, true);
+                if (buf) {
+                        ret = simple_read_from_buffer(user_buf,
+                                                      count, ppos, buf, pos);
+                        kfree(buf);
+                }
+        }
+
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_missed_beacon_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char buf[12];
+        const size_t bufsz = sizeof(buf);
+        ssize_t ret;
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%d\n",
+                        priv->missed_beacon_threshold);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_missed_beacon_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int missed;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &missed) != 1)
+                return -EINVAL;
+
+        if (missed < IWL_MISSED_BEACON_THRESHOLD_MIN ||
+            missed > IWL_MISSED_BEACON_THRESHOLD_MAX)
+                priv->missed_beacon_threshold =
+                        IWL_MISSED_BEACON_THRESHOLD_DEF;
+        else
+                priv->missed_beacon_threshold = missed;
+
+        return count;
+}
+
+static ssize_t iwl_dbgfs_internal_scan_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int scan;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &scan) != 1)
+                return -EINVAL;
+
+        iwl_internal_short_hw_scan(priv);
+
+        return count;
+}
+
+static ssize_t iwl_dbgfs_plcp_delta_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        char buf[12];
+        const size_t bufsz = sizeof(buf);
+        ssize_t ret;
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%u\n",
+                        priv->cfg->plcp_delta_threshold);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_plcp_delta_write(struct file *file,
+                                        const char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int plcp;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &plcp) != 1)
+                return -EINVAL;
+        if ((plcp <= IWL_MAX_PLCP_ERR_THRESHOLD_MIN) ||
+                (plcp > IWL_MAX_PLCP_ERR_THRESHOLD_MAX))
+                priv->cfg->plcp_delta_threshold =
+                        IWL_MAX_PLCP_ERR_THRESHOLD_DEF;
+        else
+                priv->cfg->plcp_delta_threshold = plcp;
+        return count;
+}
+
+static ssize_t iwl_dbgfs_force_reset_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = file->private_data;
+        int i, pos = 0;
+        char buf[300];
+        const size_t bufsz = sizeof(buf);
+        struct iwl_force_reset *force_reset;
+
+        for (i = 0; i < IWL_MAX_FORCE_RESET; i++) {
+                force_reset = &priv->force_reset[i];
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                "Force reset method %d\n", i);
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                "\tnumber of reset request: %d\n",
+                                force_reset->reset_request_count);
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                "\tnumber of reset request success: %d\n",
+                                force_reset->reset_success_count);
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                "\tnumber of reset request reject: %d\n",
+                                force_reset->reset_reject_count);
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                "\treset duration: %lu\n",
+                                force_reset->reset_duration);
+        }
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+static ssize_t iwl_dbgfs_force_reset_write(struct file *file,
+                                        const char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int reset, ret;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &reset) != 1)
+                return -EINVAL;
+        switch (reset) {
+        case IWL_RF_RESET:
+        case IWL_FW_RESET:
+                ret = iwl_force_reset(priv, reset);
+                break;
+        default:
+                return -EINVAL;
+        }
+        return ret ? ret : count;
+}
+
+DEBUGFS_READ_FILE_OPS(rx_statistics);
+DEBUGFS_READ_FILE_OPS(tx_statistics);
 DEBUGFS_READ_WRITE_FILE_OPS(traffic_log);
 DEBUGFS_READ_FILE_OPS(rx_queue);
 DEBUGFS_READ_FILE_OPS(tx_queue);
@@ -1625,6 +2289,16 @@ DEBUGFS_READ_FILE_OPS(ucode_general_stats);
 DEBUGFS_READ_FILE_OPS(sensitivity);
 DEBUGFS_READ_FILE_OPS(chain_noise);
 DEBUGFS_READ_FILE_OPS(tx_power);
+DEBUGFS_READ_FILE_OPS(power_save_status);
+DEBUGFS_WRITE_FILE_OPS(clear_ucode_statistics);
+DEBUGFS_WRITE_FILE_OPS(clear_traffic_statistics);
+DEBUGFS_WRITE_FILE_OPS(csr);
+DEBUGFS_READ_WRITE_FILE_OPS(ucode_tracing);
+DEBUGFS_READ_FILE_OPS(fh_reg);
+DEBUGFS_READ_WRITE_FILE_OPS(missed_beacon);
+DEBUGFS_WRITE_FILE_OPS(internal_scan);
+DEBUGFS_READ_WRITE_FILE_OPS(plcp_delta);
+DEBUGFS_READ_WRITE_FILE_OPS(force_reset);
 
 /*
  * Create the debugfs files and directories
@@ -1632,68 +2306,74 @@ DEBUGFS_READ_FILE_OPS(tx_power);
  */
 int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
 {
-        struct iwl_debugfs *dbgfs;
         struct dentry *phyd = priv->hw->wiphy->debugfsdir;
-        int ret = 0;
+        struct dentry *dir_drv, *dir_data, *dir_rf, *dir_debug;
 
-        dbgfs = kzalloc(sizeof(struct iwl_debugfs), GFP_KERNEL);
-        if (!dbgfs) {
-                ret = -ENOMEM;
-                goto err;
-        }
+        dir_drv = debugfs_create_dir(name, phyd);
+        if (!dir_drv)
+                return -ENOMEM;
+
+        priv->debugfs_dir = dir_drv;
 
-        priv->dbgfs = dbgfs;
-        dbgfs->name = name;
-        dbgfs->dir_drv = debugfs_create_dir(name, phyd);
-        if (!dbgfs->dir_drv || IS_ERR(dbgfs->dir_drv)) {
-                ret = -ENOENT;
+        dir_data = debugfs_create_dir("data", dir_drv);
+        if (!dir_data)
+                goto err;
+        dir_rf = debugfs_create_dir("rf", dir_drv);
+        if (!dir_rf)
+                goto err;
+        dir_debug = debugfs_create_dir("debug", dir_drv);
+        if (!dir_debug)
                 goto err;
-        }
 
-        DEBUGFS_ADD_DIR(data, dbgfs->dir_drv);
-        DEBUGFS_ADD_DIR(rf, dbgfs->dir_drv);
-        DEBUGFS_ADD_DIR(debug, dbgfs->dir_drv);
-        DEBUGFS_ADD_FILE(nvm, data);
-        DEBUGFS_ADD_FILE(sram, data);
-        DEBUGFS_ADD_FILE(log_event, data);
-        DEBUGFS_ADD_FILE(stations, data);
-        DEBUGFS_ADD_FILE(channels, data);
-        DEBUGFS_ADD_FILE(status, data);
-        DEBUGFS_ADD_FILE(interrupt, data);
-        DEBUGFS_ADD_FILE(qos, data);
-#ifdef CONFIG_IWLWIFI_LEDS
-        DEBUGFS_ADD_FILE(led, data);
-#endif
-        DEBUGFS_ADD_FILE(sleep_level_override, data);
-        DEBUGFS_ADD_FILE(current_sleep_command, data);
-        DEBUGFS_ADD_FILE(thermal_throttling, data);
-        DEBUGFS_ADD_FILE(disable_ht40, data);
-        DEBUGFS_ADD_FILE(rx_statistics, debug);
-        DEBUGFS_ADD_FILE(tx_statistics, debug);
-        DEBUGFS_ADD_FILE(traffic_log, debug);
-        DEBUGFS_ADD_FILE(rx_queue, debug);
-        DEBUGFS_ADD_FILE(tx_queue, debug);
-        DEBUGFS_ADD_FILE(tx_power, debug);
+        DEBUGFS_ADD_FILE(nvm, dir_data, S_IRUSR);
+        DEBUGFS_ADD_FILE(sram, dir_data, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(log_event, dir_data, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(stations, dir_data, S_IRUSR);
+        DEBUGFS_ADD_FILE(channels, dir_data, S_IRUSR);
+        DEBUGFS_ADD_FILE(status, dir_data, S_IRUSR);
+        DEBUGFS_ADD_FILE(interrupt, dir_data, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(qos, dir_data, S_IRUSR);
+        DEBUGFS_ADD_FILE(led, dir_data, S_IRUSR);
+        DEBUGFS_ADD_FILE(sleep_level_override, dir_data, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(current_sleep_command, dir_data, S_IRUSR);
+        DEBUGFS_ADD_FILE(thermal_throttling, dir_data, S_IRUSR);
+        DEBUGFS_ADD_FILE(disable_ht40, dir_data, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(rx_statistics, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(tx_statistics, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(traffic_log, dir_debug, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(rx_queue, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(tx_queue, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(tx_power, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(power_save_status, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(clear_ucode_statistics, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(clear_traffic_statistics, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(csr, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(fh_reg, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(missed_beacon, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(internal_scan, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(plcp_delta, dir_debug, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(force_reset, dir_debug, S_IWUSR | S_IRUSR);
         if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
-                DEBUGFS_ADD_FILE(ucode_rx_stats, debug);
-                DEBUGFS_ADD_FILE(ucode_tx_stats, debug);
-                DEBUGFS_ADD_FILE(ucode_general_stats, debug);
-                DEBUGFS_ADD_FILE(sensitivity, debug);
-                DEBUGFS_ADD_FILE(chain_noise, debug);
+                DEBUGFS_ADD_FILE(ucode_rx_stats, dir_debug, S_IRUSR);
+                DEBUGFS_ADD_FILE(ucode_tx_stats, dir_debug, S_IRUSR);
+                DEBUGFS_ADD_FILE(ucode_general_stats, dir_debug, S_IRUSR);
+                DEBUGFS_ADD_FILE(sensitivity, dir_debug, S_IRUSR);
+                DEBUGFS_ADD_FILE(chain_noise, dir_debug, S_IRUSR);
+                DEBUGFS_ADD_FILE(ucode_tracing, dir_debug, S_IWUSR | S_IRUSR);
         }
-        DEBUGFS_ADD_BOOL(disable_sensitivity, rf, &priv->disable_sens_cal);
-        DEBUGFS_ADD_BOOL(disable_chain_noise, rf,
+        DEBUGFS_ADD_BOOL(disable_sensitivity, dir_rf, &priv->disable_sens_cal);
+        DEBUGFS_ADD_BOOL(disable_chain_noise, dir_rf,
                          &priv->disable_chain_noise_cal);
         if (((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965) ||
             ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_3945))
-                DEBUGFS_ADD_BOOL(disable_tx_power, rf,
+                DEBUGFS_ADD_BOOL(disable_tx_power, dir_rf,
                                 &priv->disable_tx_power_cal);
         return 0;
 
 err:
-        IWL_ERR(priv, "Can't open the debugfs directory\n");
+        IWL_ERR(priv, "Can't create the debugfs directory\n");
         iwl_dbgfs_unregister(priv);
-        return ret;
+        return -ENOMEM;
 }
 EXPORT_SYMBOL(iwl_dbgfs_register);
 
@@ -1703,53 +2383,11 @@ EXPORT_SYMBOL(iwl_dbgfs_register);
  */
 void iwl_dbgfs_unregister(struct iwl_priv *priv)
 {
-        if (!priv->dbgfs)
+        if (!priv->debugfs_dir)
                 return;
 
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_sleep_level_override);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_current_sleep_command);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_nvm);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_sram);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_log_event);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_stations);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_channels);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_status);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_interrupt);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_qos);
-#ifdef CONFIG_IWLWIFI_LEDS
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_led);
-#endif
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_thermal_throttling);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_disable_ht40);
-        DEBUGFS_REMOVE(priv->dbgfs->dir_data);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_rx_statistics);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_statistics);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_traffic_log);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_rx_queue);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_queue);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_power);
-        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
-                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
-                        file_ucode_rx_stats);
-                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
-                        file_ucode_tx_stats);
-                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
-                        file_ucode_general_stats);
-                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
-                        file_sensitivity);
-                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
-                        file_chain_noise);
-        }
-        DEBUGFS_REMOVE(priv->dbgfs->dir_debug);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_sensitivity);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_chain_noise);
-        if (((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965) ||
-            ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_3945))
-                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_tx_power);
-        DEBUGFS_REMOVE(priv->dbgfs->dir_rf);
-        DEBUGFS_REMOVE(priv->dbgfs->dir_drv);
-        kfree(priv->dbgfs);
-        priv->dbgfs = NULL;
+        debugfs_remove_recursive(priv->debugfs_dir);
+        priv->debugfs_dir = NULL;
 }
 EXPORT_SYMBOL(iwl_dbgfs_unregister);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 028d50599550..ef1720a852e9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -43,7 +43,6 @@
 #include "iwl-debug.h"
 #include "iwl-4965-hw.h"
 #include "iwl-3945-hw.h"
-#include "iwl-3945-led.h"
 #include "iwl-led.h"
 #include "iwl-power.h"
 #include "iwl-agn-rs.h"
@@ -53,21 +52,23 @@ extern struct iwl_cfg iwl4965_agn_cfg;
 extern struct iwl_cfg iwl5300_agn_cfg;
 extern struct iwl_cfg iwl5100_agn_cfg;
 extern struct iwl_cfg iwl5350_agn_cfg;
-extern struct iwl_cfg iwl5100_bg_cfg;
+extern struct iwl_cfg iwl5100_bgn_cfg;
 extern struct iwl_cfg iwl5100_abg_cfg;
 extern struct iwl_cfg iwl5150_agn_cfg;
-extern struct iwl_cfg iwl6000h_2agn_cfg;
+extern struct iwl_cfg iwl5150_abg_cfg;
 extern struct iwl_cfg iwl6000i_2agn_cfg;
+extern struct iwl_cfg iwl6000i_2abg_cfg;
+extern struct iwl_cfg iwl6000i_2bg_cfg;
 extern struct iwl_cfg iwl6000_3agn_cfg;
 extern struct iwl_cfg iwl6050_2agn_cfg;
-extern struct iwl_cfg iwl6050_3agn_cfg;
+extern struct iwl_cfg iwl6050_2abg_cfg;
 extern struct iwl_cfg iwl1000_bgn_cfg;
+extern struct iwl_cfg iwl1000_bg_cfg;
 
 struct iwl_tx_queue;
 
 /* shared structures from iwl-5000.c */
 extern struct iwl_mod_params iwl50_mod_params;
-extern struct iwl_ops iwl5000_ops;
 extern struct iwl_ucode_ops iwl5000_ucode;
 extern struct iwl_lib_ops iwl5000_lib;
 extern struct iwl_hcmd_ops iwl5000_hcmd;
@@ -81,9 +82,6 @@ extern void iwl5000_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
                                     __le32 *tx_flags);
 extern int iwl5000_calc_rssi(struct iwl_priv *priv,
                              struct iwl_rx_phy_res *rx_resp);
-extern int iwl5000_apm_init(struct iwl_priv *priv);
-extern void iwl5000_apm_stop(struct iwl_priv *priv);
-extern int iwl5000_apm_reset(struct iwl_priv *priv);
 extern void iwl5000_nic_config(struct iwl_priv *priv);
 extern u16 iwl5000_eeprom_calib_version(struct iwl_priv *priv);
 extern const u8 *iwl5000_eeprom_query_addr(const struct iwl_priv *priv,
@@ -144,12 +142,13 @@ extern void iwl5000_temperature(struct iwl_priv *priv);
 #define DEFAULT_LONG_RETRY_LIMIT  4U
 
 struct iwl_rx_mem_buffer {
-        dma_addr_t real_dma_addr;
-        dma_addr_t aligned_dma_addr;
-        struct sk_buff *skb;
+        dma_addr_t page_dma;
+        struct page *page;
         struct list_head list;
 };
 
+#define rxb_addr(r) page_address(r->page)
+
 /* defined below */
 struct iwl_device_cmd;
 
@@ -165,7 +164,7 @@ struct iwl_cmd_meta {
          */
         void (*callback)(struct iwl_priv *priv,
                          struct iwl_device_cmd *cmd,
-                         struct sk_buff *skb);
+                         struct iwl_rx_packet *pkt);
 
         /* The CMD_SIZE_HUGE flag bit indicates that the command
          * structure is stored at the end of the shared queue memory. */
@@ -293,9 +292,6 @@ struct iwl_channel_info {
 
         /* HT40 channel info */
         s8 ht40_max_power_avg;  /* (dBm) regul. eeprom, normal Tx, any rate */
-        s8 ht40_curr_txpow;     /* (dBm) regulatory/spectrum/user (not h/w) */
-        s8 ht40_min_power;      /* always 0 */
-        s8 ht40_scan_power;     /* (dBm) eeprom, direct scans, any rate */
         u8 ht40_flags;          /* flags copied from EEPROM */
         u8 ht40_extension_channel; /* HT_IE_EXT_CHANNEL_* */
 
@@ -321,6 +317,13 @@ struct iwl_channel_info {
  * queue, 2 (unused) HCCA queues, and 4 HT queues (one for each AC) */
 #define IWL_MIN_NUM_QUEUES      10
 
+/*
+ * Queue #4 is the command queue for 3945/4965/5x00/1000/6x00,
+ * the driver maps it into the appropriate device FIFO for the
+ * uCode.
+ */
+#define IWL_CMD_QUEUE_NUM       4
+
 /* Power management (not Tx power) structures */
 
 enum iwl_pwr_src {
@@ -356,7 +359,14 @@ enum {
         CMD_WANT_SKB = (1 << 2),
 };
 
-#define IWL_CMD_MAX_PAYLOAD 320
+#define DEF_CMD_PAYLOAD_SIZE 320
+
+/*
+ * IWL_LINK_HDR_MAX should include ieee80211_hdr, radiotap header,
+ * SNAP header and alignment. It should also be big enough for 802.11
+ * control frames.
+ */
+#define IWL_LINK_HDR_MAX 64
 
 /**
  * struct iwl_device_cmd
@@ -373,7 +383,8 @@ struct iwl_device_cmd {
                 u16 val16;
                 u32 val32;
                 struct iwl_tx_cmd tx;
-                u8 payload[IWL_CMD_MAX_PAYLOAD];
+                struct iwl6000_channel_switch_cmd chswitch;
+                u8 payload[DEF_CMD_PAYLOAD_SIZE];
         } __attribute__ ((packed)) cmd;
 } __attribute__ ((packed));
 
@@ -382,21 +393,15 @@ struct iwl_device_cmd {
 
 struct iwl_host_cmd {
         const void *data;
-        struct sk_buff *reply_skb;
+        unsigned long reply_page;
         void (*callback)(struct iwl_priv *priv,
                          struct iwl_device_cmd *cmd,
-                         struct sk_buff *skb);
+                         struct iwl_rx_packet *pkt);
         u32 flags;
         u16 len;
         u8 id;
 };
 
-/*
- * RX related structures and functions
- */
-#define RX_FREE_BUFFERS 64
-#define RX_LOW_WATERMARK 8
-
 #define SUP_RATE_11A_MAX_NUM_CHANNELS  8
 #define SUP_RATE_11B_MAX_NUM_CHANNELS  4
 #define SUP_RATE_11G_MAX_NUM_CHANNELS  12
@@ -502,12 +507,12 @@ union iwl_ht_rate_supp {
 #define CFG_HT_MPDU_DENSITY_4USEC   (0x5)
 #define CFG_HT_MPDU_DENSITY_DEF CFG_HT_MPDU_DENSITY_4USEC
 
-struct iwl_ht_info {
+struct iwl_ht_config {
         /* self configuration data */
-        u8 is_ht;
-        u8 supported_chan_width;
-        u8 sm_ps;
-        struct ieee80211_mcs_info mcs;
+        bool is_ht;
+        bool is_40mhz;
+        bool single_chain_sufficient;
+        enum ieee80211_smps_mode smps; /* current smps mode */
         /* BSS related data */
         u8 extension_chan_offset;
         u8 ht_protection;
@@ -541,26 +546,27 @@ struct iwl_qos_info {
         struct iwl_qosparam_cmd def_qos_parm;
 };
 
-#define STA_PS_STATUS_WAKE             0
-#define STA_PS_STATUS_SLEEP            1
-
-
-struct iwl3945_station_entry {
-        struct iwl3945_addsta_cmd sta;
-        struct iwl_tid_data tid[MAX_TID_COUNT];
-        u8 used;
-        u8 ps_status;
-        struct iwl_hw_key keyinfo;
-};
-
 struct iwl_station_entry {
         struct iwl_addsta_cmd sta;
         struct iwl_tid_data tid[MAX_TID_COUNT];
         u8 used;
-        u8 ps_status;
         struct iwl_hw_key keyinfo;
 };
 
+/*
+ * iwl_station_priv: Driver's private station information
+ *
+ * When mac80211 creates a station it reserves some space (hw->sta_data_size)
+ * in the structure for use by driver. This structure is places in that
+ * space.
+ */
+struct iwl_station_priv {
+        struct iwl_lq_sta lq_sta;
+        atomic_t pending_frames;
+        bool client;
+        bool asleep;
+};
+
 /* one for each uCode image (inst/data, boot/init/runtime) */
 struct fw_desc {
         void *v_addr;           /* access by driver */
@@ -622,6 +628,10 @@ struct iwl_sensitivity_ranges {
         u16 auto_corr_max_cck_mrc;
         u16 auto_corr_min_cck;
         u16 auto_corr_min_cck_mrc;
+
+        u16 barker_corr_th_min;
+        u16 barker_corr_th_min_mrc;
+        u16 nrg_th_cca;
 };
 
 
@@ -639,7 +649,7 @@ struct iwl_sensitivity_ranges {
  * @valid_tx/rx_ant: usable antennas
  * @max_rxq_size: Max # Rx frames in Rx queue (must be power-of-2)
  * @max_rxq_log: Log-base-2 of max_rxq_size
- * @rx_buf_size: Rx buffer size
+ * @rx_page_order: Rx buffer page order
  * @rx_wrt_ptr_reg: FH{39}_RSCSR_CHNL0_WPTR
  * @max_stations:
  * @bcast_sta_id:
@@ -662,9 +672,8 @@ struct iwl_hw_params {
         u8  valid_rx_ant;
         u16 max_rxq_size;
         u16 max_rxq_log;
-        u32 rx_buf_size;
+        u32 rx_page_order;
         u32 rx_wrt_ptr_reg;
-        u32 max_pkt_size;
         u8  max_stations;
         u8  bcast_sta_id;
         u8  ht40_channel;
@@ -703,7 +712,7 @@ extern void iwl_txq_ctx_stop(struct iwl_priv *priv);
 extern int iwl_queue_space(const struct iwl_queue *q);
 static inline int iwl_queue_used(const struct iwl_queue *q, int i)
 {
-        return q->write_ptr > q->read_ptr ?
+        return q->write_ptr >= q->read_ptr ?
                 (i >= q->read_ptr && i < q->write_ptr) :
                 !(i < q->read_ptr && i >= q->write_ptr);
 }
@@ -711,7 +720,11 @@ static inline int iwl_queue_used(const struct iwl_queue *q, int i)
 
 static inline u8 get_cmd_index(struct iwl_queue *q, u32 index, int is_huge)
 {
-        /* This is for scan command, the big buffer at end of command array */
+        /*
+         * This is for init calibration result and scan command which
+         * required buffer > TFD_MAX_PAYLOAD_SIZE,
+         * the big buffer at end of command array
+         */
         if (is_huge)
                 return q->n_window;     /* must be power of 2 */
 
@@ -726,9 +739,6 @@ struct iwl_dma_ptr {
         size_t size;
 };
 
-#define IWL_CHANNEL_WIDTH_20MHZ   0
-#define IWL_CHANNEL_WIDTH_40MHZ   1
-
 #define IWL_OPERATION_MODE_AUTO     0
 #define IWL_OPERATION_MODE_HT_ONLY  1
 #define IWL_OPERATION_MODE_MIXED    2
@@ -741,7 +751,8 @@ struct iwl_dma_ptr {
 
 /* Sensitivity and chain noise calibration */
 #define INITIALIZATION_VALUE            0xFFFF
-#define CAL_NUM_OF_BEACONS              20
+#define IWL4965_CAL_NUM_BEACONS         20
+#define IWL_CAL_NUM_BEACONS             16
 #define MAXIMUM_ALLOWED_PATHLOSS        15
 
 #define CHAIN_NOISE_MAX_DELTA_GAIN_CODE 3
@@ -845,6 +856,10 @@ struct iwl_sensitivity_data {
         s32 nrg_auto_corr_silence_diff;
         u32 num_in_cck_no_fa;
         u32 nrg_th_ofdm;
+
+        u16 barker_corr_th_min;
+        u16 barker_corr_th_min_mrc;
+        u16 nrg_th_cca;
 };
 
 /* Chain noise (differential Rx gain) calib data */
@@ -894,13 +909,11 @@ enum iwl_access_mode {
 /**
  * enum iwl_pa_type - Power Amplifier type
  * @IWL_PA_SYSTEM:  based on uCode configuration
- * @IWL_PA_HYBRID: use both Internal and external PA
  * @IWL_PA_INTERNAL: use Internal only
  */
 enum iwl_pa_type {
         IWL_PA_SYSTEM = 0,
-        IWL_PA_HYBRID = 1,
-        IWL_PA_INTERNAL = 2,
+        IWL_PA_INTERNAL = 1,
 };
 
 /* interrupt statistics */
@@ -961,7 +974,84 @@ struct traffic_stats {
 };
 #endif
 
-#define IWL_MAX_NUM_QUEUES      20 /* FIXME: do dynamic allocation */
+/*
+ * iwl_switch_rxon: "channel switch" structure
+ *
+ * @ switch_in_progress: channel switch in progress
+ * @ channel: new channel
+ */
+struct iwl_switch_rxon {
+        bool switch_in_progress;
+        __le16 channel;
+};
+
+/*
+ * schedule the timer to wake up every UCODE_TRACE_PERIOD milliseconds
+ * to perform continuous uCode event logging operation if enabled
+ */
+#define UCODE_TRACE_PERIOD (100)
+
+/*
+ * iwl_event_log: current uCode event log position
+ *
+ * @ucode_trace: enable/disable ucode continuous trace timer
+ * @num_wraps: how many times the event buffer wraps
+ * @next_entry:  the entry just before the next one that uCode would fill
+ * @non_wraps_count: counter for no wrap detected when dump ucode events
+ * @wraps_once_count: counter for wrap once detected when dump ucode events
+ * @wraps_more_count: counter for wrap more than once detected
+ *                    when dump ucode events
+ */
+struct iwl_event_log {
+        bool ucode_trace;
+        u32 num_wraps;
+        u32 next_entry;
+        int non_wraps_count;
+        int wraps_once_count;
+        int wraps_more_count;
+};
+
+/*
+ * host interrupt timeout value
+ * used with setting interrupt coalescing timer
+ * the CSR_INT_COALESCING is an 8 bit register in 32-usec unit
+ *
+ * default interrupt coalescing timer is 64 x 32 = 2048 usecs
+ * default interrupt coalescing calibration timer is 16 x 32 = 512 usecs
+ */
+#define IWL_HOST_INT_TIMEOUT_MAX        (0xFF)
+#define IWL_HOST_INT_TIMEOUT_DEF        (0x40)
+#define IWL_HOST_INT_TIMEOUT_MIN        (0x0)
+#define IWL_HOST_INT_CALIB_TIMEOUT_MAX  (0xFF)
+#define IWL_HOST_INT_CALIB_TIMEOUT_DEF  (0x10)
+#define IWL_HOST_INT_CALIB_TIMEOUT_MIN  (0x0)
+
+/*
+ * This is the threshold value of plcp error rate per 100mSecs.  It is
+ * used to set and check for the validity of plcp_delta.
+ */
+#define IWL_MAX_PLCP_ERR_THRESHOLD_MIN  (0)
+#define IWL_MAX_PLCP_ERR_THRESHOLD_DEF  (50)
+#define IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF     (100)
+#define IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF (200)
+#define IWL_MAX_PLCP_ERR_THRESHOLD_MAX  (255)
+
+#define IWL_DELAY_NEXT_FORCE_RF_RESET  (HZ*3)
+#define IWL_DELAY_NEXT_FORCE_FW_RELOAD (HZ*5)
+
+enum iwl_reset {
+        IWL_RF_RESET = 0,
+        IWL_FW_RESET,
+        IWL_MAX_FORCE_RESET,
+};
+
+struct iwl_force_reset {
+        int reset_request_count;
+        int reset_success_count;
+        int reset_reject_count;
+        unsigned long reset_duration;
+        unsigned long last_force_reset_jiffies;
+};
 
 struct iwl_priv {
 
@@ -976,20 +1066,26 @@ struct iwl_priv {
         int frames_count;
 
         enum ieee80211_band band;
-        int alloc_rxb_skb;
+        int alloc_rxb_page;
 
         void (*rx_handlers[REPLY_MAX])(struct iwl_priv *priv,
                                        struct iwl_rx_mem_buffer *rxb);
 
         struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
 
-#if defined(CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT) || defined(CONFIG_IWL3945_SPECTRUM_MEASUREMENT)
         /* spectrum measurement report caching */
         struct iwl_spectrum_notification measure_report;
         u8 measurement_status;
-#endif
+
         /* ucode beacon time */
         u32 ucode_beacon_time;
+        int missed_beacon_threshold;
+
+        /* storing the jiffies when the plcp error rate is received */
+        unsigned long plcp_jiffies;
+
+        /* force reset */
+        struct iwl_force_reset force_reset[IWL_MAX_FORCE_RESET];
 
         /* we allocate array of iwl4965_channel_info for NIC's valid channels.
          *    Access via channel # using indirect index array */
@@ -1008,7 +1104,6 @@ struct iwl_priv {
         struct iwl_calib_result calib_results[IWL_CALIB_MAX];
 
         /* Scan related variables */
-        unsigned long last_scan_jiffies;
         unsigned long next_scan_jiffies;
         unsigned long scan_start;
         unsigned long scan_pass_start;
@@ -1016,6 +1111,7 @@ struct iwl_priv {
         void *scan;
         int scan_bands;
         struct cfg80211_scan_request *scan_request;
+        bool is_internal_short_scan;
         u8 scan_tx_ant[IEEE80211_NUM_BANDS];
         u8 mgmt_tx_ant;
 
@@ -1024,6 +1120,7 @@ struct iwl_priv {
         spinlock_t hcmd_lock;   /* protect hcmd */
         spinlock_t reg_lock;    /* protect hw register access */
         struct mutex mutex;
+        struct mutex sync_cmd_mutex; /* enable serialization of sync commands */
 
         /* basic pci-network driver stuff */
         struct pci_dev *pci_dev;
@@ -1035,6 +1132,7 @@ struct iwl_priv {
         u8   rev_id;
 
         /* uCode images, save to reload in case of failure */
+        int fw_index;                   /* firmware we're trying to load */
         u32 ucode_ver;                  /* version of ucode, copy of
                                            iwl_ucode.ver */
         struct fw_desc ucode_code;      /* runtime inst */
@@ -1045,6 +1143,7 @@ struct iwl_priv {
         struct fw_desc ucode_boot;      /* bootstrap inst */
         enum ucode_type ucode_type;
         u8 ucode_write_complete;        /* the image write is complete */
+        char firmware_name[25];
 
 
         struct iwl_rxon_time_cmd rxon_timing;
@@ -1056,21 +1155,18 @@ struct iwl_priv {
         const struct iwl_rxon_cmd active_rxon;
         struct iwl_rxon_cmd staging_rxon;
 
-        struct iwl_rxon_cmd recovery_rxon;
+        struct iwl_switch_rxon switch_rxon;
 
         /* 1st responses from initialize and runtime uCode images.
          * 4965's initialize alive response contains some calibration data. */
         struct iwl_init_alive_resp card_alive_init;
         struct iwl_alive_resp card_alive;
 
-#ifdef CONFIG_IWLWIFI_LEDS
         unsigned long last_blink_time;
         u8 last_blink_rate;
         u8 allow_blinking;
         u64 led_tpt;
-        struct iwl_led led[IWL_LED_TRG_MAX];
-        unsigned int rxtxpackets;
-#endif
+
         u16 active_rate;
         u16 active_rate_basic;
 
@@ -1080,11 +1176,10 @@ struct iwl_priv {
         struct iwl_chain_noise_data chain_noise_data;
         __le16 sensitivity_tbl[HD_TABLE_SIZE];
 
-        struct iwl_ht_info current_ht_config;
+        struct iwl_ht_config current_ht_config;
         u8 last_phy_res[100];
 
         /* Rate scaling data */
-        s8 data_retry_limit;
         u8 retry_rate;
 
         wait_queue_head_t wait_command_queue;
@@ -1093,7 +1188,7 @@ struct iwl_priv {
 
         /* Rx and Tx DMA processing queues */
         struct iwl_rx_queue rxq;
-        struct iwl_tx_queue txq[IWL_MAX_NUM_QUEUES];
+        struct iwl_tx_queue *txq;
         unsigned long txq_ctx_active_msk;
         struct iwl_dma_ptr  kw; /* keep warm address */
         struct iwl_dma_ptr  scd_bc_tbls;
@@ -1116,7 +1211,11 @@ struct iwl_priv {
         struct iwl_tt_mgmt thermal_throttle;
 
         struct iwl_notif_statistics statistics;
-        unsigned long last_statistics_time;
+#ifdef CONFIG_IWLWIFI_DEBUG
+        struct iwl_notif_statistics accum_statistics;
+        struct iwl_notif_statistics delta_statistics;
+        struct iwl_notif_statistics max_delta;
+#endif
 
         /* context information */
         u16 rates_mask;
@@ -1149,7 +1248,7 @@ struct iwl_priv {
         u32 last_beacon_time;
         u64 last_tsf;
 
-        /* eeprom */
+        /* eeprom -- this is in the card's little endian byte order */
         u8 *eeprom;
         int    nvm_device_type;
         struct iwl_eeprom_calib_info *calib_info;
@@ -1188,20 +1287,16 @@ struct iwl_priv {
 
         struct workqueue_struct *workqueue;
 
-        struct work_struct up;
         struct work_struct restart;
-        struct work_struct calibrated_work;
         struct work_struct scan_completed;
         struct work_struct rx_replenish;
         struct work_struct abort_scan;
-        struct work_struct update_link_led;
-        struct work_struct auth_work;
-        struct work_struct report_work;
         struct work_struct request_scan;
         struct work_struct beacon_update;
         struct work_struct tt_work;
         struct work_struct ct_enter;
         struct work_struct ct_exit;
+        struct work_struct start_internal_scan;
 
         struct tasklet_struct irq_tasklet;
 
@@ -1216,6 +1311,7 @@ struct iwl_priv {
         /* TX Power */
         s8 tx_power_user_lmt;
         s8 tx_power_device_lmt;
+        s8 tx_power_lmt_in_half_dbm; /* max tx power in half-dBm format */
 
 
 #ifdef CONFIG_IWLWIFI_DEBUG
@@ -1231,7 +1327,8 @@ struct iwl_priv {
         u16 rx_traffic_idx;
         u8 *tx_traffic;
         u8 *rx_traffic;
-        struct iwl_debugfs *dbgfs;
+        struct dentry *debugfs_dir;
+        u32 dbgfs_sram_offset, dbgfs_sram_len;
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 #endif /* CONFIG_IWLWIFI_DEBUG */
 
@@ -1241,6 +1338,7 @@ struct iwl_priv {
         u32 disable_tx_power_cal;
         struct work_struct run_time_calib_work;
         struct timer_list statistics_periodic;
+        struct timer_list ucode_trace;
         bool hw_ready;
         /*For 3945*/
 #define IWL_DEFAULT_TX_POWER 0x0F
@@ -1248,6 +1346,8 @@ struct iwl_priv {
         struct iwl3945_notif_statistics statistics_39;
 
         u32 sta_supp_rates;
+
+        struct iwl_event_log event_log;
 }; /*iwl_priv */
 
 static inline void iwl_txq_ctx_activate(struct iwl_priv *priv, int txq_id)
@@ -1333,4 +1433,15 @@ static inline int is_channel_ibss(const struct iwl_channel_info *ch)
         return ((ch->flags & EEPROM_CHANNEL_IBSS)) ? 1 : 0;
 }
 
+static inline void __iwl_free_pages(struct iwl_priv *priv, struct page *page)
+{
+        __free_pages(page, priv->hw_params.rx_page_order);
+        priv->alloc_rxb_page--;
+}
+
+static inline void iwl_free_pages(struct iwl_priv *priv, unsigned long page)
+{
+        free_pages(page, priv->hw_params.rx_page_order);
+        priv->alloc_rxb_page--;
+}
 #endif                          /* __iwl_dev_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.c b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
new file mode 100644
index 000000000000..2ffc2edbf4f0
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
@@ -0,0 +1,44 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#include <linux/module.h>
+
+/* sparse doesn't like tracepoint macros */
+#ifndef __CHECKER__
+#include "iwl-dev.h"
+
+#define CREATE_TRACE_POINTS
+#include "iwl-devtrace.h"
+
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_iowrite8);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ioread32);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_iowrite32);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_rx);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_event);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_error);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_cont_event);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_wrap_event);
+#endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
new file mode 100644
index 000000000000..ae7319bb3a99
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -0,0 +1,266 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#if !defined(__IWLWIFI_DEVICE_TRACE) || defined(TRACE_HEADER_MULTI_READ)
+#define __IWLWIFI_DEVICE_TRACE
+
+#include <linux/tracepoint.h>
+
+#if !defined(CONFIG_IWLWIFI_DEVICE_TRACING) || defined(__CHECKER__)
+#undef TRACE_EVENT
+#define TRACE_EVENT(name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+#endif
+
+#define PRIV_ENTRY      __field(struct iwl_priv *, priv)
+#define PRIV_ASSIGN     __entry->priv = priv
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM iwlwifi_io
+
+TRACE_EVENT(iwlwifi_dev_ioread32,
+        TP_PROTO(struct iwl_priv *priv, u32 offs, u32 val),
+        TP_ARGS(priv, offs, val),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+                __field(u32, offs)
+                __field(u32, val)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                __entry->offs = offs;
+                __entry->val = val;
+        ),
+        TP_printk("[%p] read io[%#x] = %#x", __entry->priv, __entry->offs, __entry->val)
+);
+
+TRACE_EVENT(iwlwifi_dev_iowrite8,
+        TP_PROTO(struct iwl_priv *priv, u32 offs, u8 val),
+        TP_ARGS(priv, offs, val),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+                __field(u32, offs)
+                __field(u8, val)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                __entry->offs = offs;
+                __entry->val = val;
+        ),
+        TP_printk("[%p] write io[%#x] = %#x)", __entry->priv, __entry->offs, __entry->val)
+);
+
+TRACE_EVENT(iwlwifi_dev_iowrite32,
+        TP_PROTO(struct iwl_priv *priv, u32 offs, u32 val),
+        TP_ARGS(priv, offs, val),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+                __field(u32, offs)
+                __field(u32, val)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                __entry->offs = offs;
+                __entry->val = val;
+        ),
+        TP_printk("[%p] write io[%#x] = %#x)", __entry->priv, __entry->offs, __entry->val)
+);
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM iwlwifi_ucode
+
+TRACE_EVENT(iwlwifi_dev_ucode_cont_event,
+        TP_PROTO(struct iwl_priv *priv, u32 time, u32 data, u32 ev),
+        TP_ARGS(priv, time, data, ev),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+
+                __field(u32, time)
+                __field(u32, data)
+                __field(u32, ev)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                __entry->time = time;
+                __entry->data = data;
+                __entry->ev = ev;
+        ),
+        TP_printk("[%p] EVT_LOGT:%010u:0x%08x:%04u",
+                  __entry->priv, __entry->time, __entry->data, __entry->ev)
+);
+
+TRACE_EVENT(iwlwifi_dev_ucode_wrap_event,
+        TP_PROTO(struct iwl_priv *priv, u32 wraps, u32 n_entry, u32 p_entry),
+        TP_ARGS(priv, wraps, n_entry, p_entry),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+
+                __field(u32, wraps)
+                __field(u32, n_entry)
+                __field(u32, p_entry)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                __entry->wraps = wraps;
+                __entry->n_entry = n_entry;
+                __entry->p_entry = p_entry;
+        ),
+        TP_printk("[%p] wraps=#%02d n=0x%X p=0x%X",
+                  __entry->priv, __entry->wraps, __entry->n_entry,
+                  __entry->p_entry)
+);
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM iwlwifi
+
+TRACE_EVENT(iwlwifi_dev_hcmd,
+        TP_PROTO(struct iwl_priv *priv, void *hcmd, size_t len, u32 flags),
+        TP_ARGS(priv, hcmd, len, flags),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+                __dynamic_array(u8, hcmd, len)
+                __field(u32, flags)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                memcpy(__get_dynamic_array(hcmd), hcmd, len);
+                __entry->flags = flags;
+        ),
+        TP_printk("[%p] hcmd %#.2x (%ssync)",
+                  __entry->priv, ((u8 *)__get_dynamic_array(hcmd))[0],
+                  __entry->flags & CMD_ASYNC ? "a" : "")
+);
+
+TRACE_EVENT(iwlwifi_dev_rx,
+        TP_PROTO(struct iwl_priv *priv, void *rxbuf, size_t len),
+        TP_ARGS(priv, rxbuf, len),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+                __dynamic_array(u8, rxbuf, len)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                memcpy(__get_dynamic_array(rxbuf), rxbuf, len);
+        ),
+        TP_printk("[%p] RX cmd %#.2x",
+                  __entry->priv, ((u8 *)__get_dynamic_array(rxbuf))[4])
+);
+
+TRACE_EVENT(iwlwifi_dev_tx,
+        TP_PROTO(struct iwl_priv *priv, void *tfd, size_t tfdlen,
+                 void *buf0, size_t buf0_len,
+                 void *buf1, size_t buf1_len),
+        TP_ARGS(priv, tfd, tfdlen, buf0, buf0_len, buf1, buf1_len),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+
+                __field(size_t, framelen)
+                __dynamic_array(u8, tfd, tfdlen)
+
+                /*
+                 * Do not insert between or below these items,
+                 * we want to keep the frame together (except
+                 * for the possible padding).
+                 */
+                __dynamic_array(u8, buf0, buf0_len)
+                __dynamic_array(u8, buf1, buf1_len)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                __entry->framelen = buf0_len + buf1_len;
+                memcpy(__get_dynamic_array(tfd), tfd, tfdlen);
+                memcpy(__get_dynamic_array(buf0), buf0, buf0_len);
+                memcpy(__get_dynamic_array(buf1), buf1, buf0_len);
+        ),
+        TP_printk("[%p] TX %.2x (%zu bytes)",
+                  __entry->priv,
+                  ((u8 *)__get_dynamic_array(buf0))[0],
+                  __entry->framelen)
+);
+
+TRACE_EVENT(iwlwifi_dev_ucode_error,
+        TP_PROTO(struct iwl_priv *priv, u32 desc, u32 time,
+                 u32 data1, u32 data2, u32 line, u32 blink1,
+                 u32 blink2, u32 ilink1, u32 ilink2),
+        TP_ARGS(priv, desc, time, data1, data2, line,
+                blink1, blink2, ilink1, ilink2),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+                __field(u32, desc)
+                __field(u32, time)
+                __field(u32, data1)
+                __field(u32, data2)
+                __field(u32, line)
+                __field(u32, blink1)
+                __field(u32, blink2)
+                __field(u32, ilink1)
+                __field(u32, ilink2)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                __entry->desc = desc;
+                __entry->time = time;
+                __entry->data1 = data1;
+                __entry->data2 = data2;
+                __entry->line = line;
+                __entry->blink1 = blink1;
+                __entry->blink2 = blink2;
+                __entry->ilink1 = ilink1;
+                __entry->ilink2 = ilink2;
+        ),
+        TP_printk("[%p] #%02d %010u data 0x%08X 0x%08X line %u, "
+                  "blink 0x%05X 0x%05X ilink 0x%05X 0x%05X",
+                  __entry->priv, __entry->desc, __entry->time, __entry->data1,
+                  __entry->data2, __entry->line, __entry->blink1,
+                  __entry->blink2, __entry->ilink1, __entry->ilink2)
+);
+
+TRACE_EVENT(iwlwifi_dev_ucode_event,
+        TP_PROTO(struct iwl_priv *priv, u32 time, u32 data, u32 ev),
+        TP_ARGS(priv, time, data, ev),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+
+                __field(u32, time)
+                __field(u32, data)
+                __field(u32, ev)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                __entry->time = time;
+                __entry->data = data;
+                __entry->ev = ev;
+        ),
+        TP_printk("[%p] EVT_LOGT:%010u:0x%08x:%04u",
+                  __entry->priv, __entry->time, __entry->data, __entry->ev)
+);
+#endif /* __IWLWIFI_DEVICE_TRACE */
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE iwl-devtrace
+#include <trace/define_trace.h>
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index e14c9952a935..fb5bb487f3bc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -63,6 +63,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 
 #include <net/mac80211.h>
@@ -215,12 +216,35 @@ static const struct iwl_txpwr_section enhinfo[] = {
 
 int iwlcore_eeprom_verify_signature(struct iwl_priv *priv)
 {
-        u32 gp = iwl_read32(priv, CSR_EEPROM_GP);
-        if ((gp & CSR_EEPROM_GP_VALID_MSK) == CSR_EEPROM_GP_BAD_SIGNATURE) {
-                IWL_ERR(priv, "EEPROM not found, EEPROM_GP=0x%08x\n", gp);
-                return -ENOENT;
+        u32 gp = iwl_read32(priv, CSR_EEPROM_GP) & CSR_EEPROM_GP_VALID_MSK;
+        int ret = 0;
+
+        IWL_DEBUG_INFO(priv, "EEPROM signature=0x%08x\n", gp);
+        switch (gp) {
+        case CSR_EEPROM_GP_BAD_SIG_EEP_GOOD_SIG_OTP:
+                if (priv->nvm_device_type != NVM_DEVICE_TYPE_OTP) {
+                        IWL_ERR(priv, "EEPROM with bad signature: 0x%08x\n",
+                                gp);
+                        ret = -ENOENT;
+                }
+                break;
+        case CSR_EEPROM_GP_GOOD_SIG_EEP_LESS_THAN_4K:
+        case CSR_EEPROM_GP_GOOD_SIG_EEP_MORE_THAN_4K:
+                if (priv->nvm_device_type != NVM_DEVICE_TYPE_EEPROM) {
+                        IWL_ERR(priv, "OTP with bad signature: 0x%08x\n", gp);
+                        ret = -ENOENT;
+                }
+                break;
+        case CSR_EEPROM_GP_BAD_SIGNATURE_BOTH_EEP_AND_OTP:
+        default:
+                IWL_ERR(priv, "bad EEPROM/OTP signature, type=%s, "
+                        "EEPROM_GP=0x%08x\n",
+                        (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
+                        ? "OTP" : "EEPROM", gp);
+                ret = -ENOENT;
+                break;
         }
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL(iwlcore_eeprom_verify_signature);
 
@@ -283,7 +307,8 @@ int iwlcore_eeprom_acquire_semaphore(struct iwl_priv *priv)
                             CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM);
 
                 /* See if we got it */
-                ret = iwl_poll_direct_bit(priv, CSR_HW_IF_CONFIG_REG,
+                ret = iwl_poll_bit(priv, CSR_HW_IF_CONFIG_REG,
+                                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM,
                                 CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM,
                                 EEPROM_SEM_TIMEOUT);
                 if (ret >= 0) {
@@ -322,7 +347,8 @@ static int iwl_init_otp_access(struct iwl_priv *priv)
                      CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
 
         /* wait for clock to be ready */
-        ret = iwl_poll_direct_bit(priv, CSR_GP_CNTRL,
+        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
+                                  CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
                                   CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
                                   25000);
         if (ret < 0)
@@ -333,11 +359,19 @@ static int iwl_init_otp_access(struct iwl_priv *priv)
                 udelay(5);
                 iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG,
                                     APMG_PS_CTRL_VAL_RESET_REQ);
+
+                /*
+                 * CSR auto clock gate disable bit -
+                 * this is only applicable for HW with OTP shadow RAM
+                 */
+                if (priv->cfg->shadow_ram_support)
+                        iwl_set_bit(priv, CSR_DBG_LINK_PWR_MGMT_REG,
+                                CSR_RESET_LINK_PWR_MGMT_DISABLED);
         }
         return ret;
 }
 
-static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
+static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, __le16 *eeprom_data)
 {
         int ret = 0;
         u32 r;
@@ -345,7 +379,8 @@ static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
 
         _iwl_write32(priv, CSR_EEPROM_REG,
                      CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
-        ret = iwl_poll_direct_bit(priv, CSR_EEPROM_REG,
+        ret = iwl_poll_bit(priv, CSR_EEPROM_REG,
+                                  CSR_EEPROM_REG_READ_VALID_MSK,
                                   CSR_EEPROM_REG_READ_VALID_MSK,
                                   IWL_EEPROM_ACCESS_TIMEOUT);
         if (ret < 0) {
@@ -370,7 +405,7 @@ static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
                                 CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK);
                 IWL_ERR(priv, "Correctable OTP ECC error, continue read\n");
         }
-        *eeprom_data = le16_to_cpu((__force __le16)(r >> 16));
+        *eeprom_data = cpu_to_le16(r >> 16);
         return 0;
 }
 
@@ -379,7 +414,8 @@ static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
  */
 static bool iwl_is_otp_empty(struct iwl_priv *priv)
 {
-        u16 next_link_addr = 0, link_value;
+        u16 next_link_addr = 0;
+        __le16 link_value;
         bool is_empty = false;
 
         /* locate the beginning of OTP link list */
@@ -409,7 +445,8 @@ static bool iwl_is_otp_empty(struct iwl_priv *priv)
 static int iwl_find_otp_image(struct iwl_priv *priv,
                                         u16 *validblockaddr)
 {
-        u16 next_link_addr = 0, link_value = 0, valid_addr;
+        u16 next_link_addr = 0, valid_addr;
+        __le16 link_value = 0;
         int usedblocks = 0;
 
         /* set addressing mode to absolute to traverse the link list */
@@ -429,7 +466,7 @@ static int iwl_find_otp_image(struct iwl_priv *priv,
                  * check for more block on the link list
                  */
                 valid_addr = next_link_addr;
-                next_link_addr = link_value * sizeof(u16);
+                next_link_addr = le16_to_cpu(link_value) * sizeof(u16);
                 IWL_DEBUG_INFO(priv, "OTP blocks %d addr 0x%x\n",
                                usedblocks, next_link_addr);
                 if (iwl_read_otp_word(priv, next_link_addr, &link_value))
@@ -463,7 +500,7 @@ static int iwl_find_otp_image(struct iwl_priv *priv,
  */
 int iwl_eeprom_init(struct iwl_priv *priv)
 {
-        u16 *e;
+        __le16 *e;
         u32 gp = iwl_read32(priv, CSR_EEPROM_GP);
         int sz;
         int ret;
@@ -482,7 +519,9 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                 ret = -ENOMEM;
                 goto alloc_err;
         }
-        e = (u16 *)priv->eeprom;
+        e = (__le16 *)priv->eeprom;
+
+        priv->cfg->ops->lib->apm_ops.init(priv);
 
         ret = priv->cfg->ops->lib->eeprom_ops.verify_signature(priv);
         if (ret < 0) {
@@ -498,7 +537,9 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                 ret = -ENOENT;
                 goto err;
         }
+
         if (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP) {
+
                 ret = iwl_init_otp_access(priv);
                 if (ret) {
                         IWL_ERR(priv, "Failed to initialize OTP access.\n");
@@ -521,7 +562,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                 }
                 for (addr = validblockaddr; addr < validblockaddr + sz;
                      addr += sizeof(u16)) {
-                        u16 eeprom_data;
+                        __le16 eeprom_data;
 
                         ret = iwl_read_otp_word(priv, addr, &eeprom_data);
                         if (ret)
@@ -537,7 +578,8 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                         _iwl_write32(priv, CSR_EEPROM_REG,
                                      CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
 
-                        ret = iwl_poll_direct_bit(priv, CSR_EEPROM_REG,
+                        ret = iwl_poll_bit(priv, CSR_EEPROM_REG,
+                                                  CSR_EEPROM_REG_READ_VALID_MSK,
                                                   CSR_EEPROM_REG_READ_VALID_MSK,
                                                   IWL_EEPROM_ACCESS_TIMEOUT);
                         if (ret < 0) {
@@ -545,7 +587,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                                 goto done;
                         }
                         r = _iwl_read_direct32(priv, CSR_EEPROM_REG);
-                        e[addr / 2] = le16_to_cpu((__force __le16)(r >> 16));
+                        e[addr / 2] = cpu_to_le16(r >> 16);
                 }
         }
         ret = 0;
@@ -554,6 +596,8 @@ done:
 err:
         if (ret)
                 iwl_eeprom_free(priv);
+        /* Reset chip to save power until we load uCode during "up". */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
 alloc_err:
         return ret;
 }
@@ -705,11 +749,9 @@ static int iwl_mod_ht40_chan_info(struct iwl_priv *priv,
 
         ch_info->ht40_eeprom = *eeprom_ch;
         ch_info->ht40_max_power_avg = eeprom_ch->max_power_avg;
-        ch_info->ht40_curr_txpow = eeprom_ch->max_power_avg;
-        ch_info->ht40_min_power = 0;
-        ch_info->ht40_scan_power = eeprom_ch->max_power_avg;
         ch_info->ht40_flags = eeprom_ch->flags;
-        ch_info->ht40_extension_channel &= ~clear_ht40_extension_channel;
+        if (eeprom_ch->flags & EEPROM_CHANNEL_VALID)
+                ch_info->ht40_extension_channel &= ~clear_ht40_extension_channel;
 
         return 0;
 }
@@ -719,7 +761,8 @@ static int iwl_mod_ht40_chan_info(struct iwl_priv *priv,
  *     find the highest tx power from all chains for the channel
  */
 static s8 iwl_get_max_txpower_avg(struct iwl_priv *priv,
-                struct iwl_eeprom_enhanced_txpwr *enhanced_txpower, int element)
+                struct iwl_eeprom_enhanced_txpwr *enhanced_txpower,
+                int element, s8 *max_txpower_in_half_dbm)
 {
         s8 max_txpower_avg = 0; /* (dBm) */
 
@@ -751,10 +794,14 @@ static s8 iwl_get_max_txpower_avg(struct iwl_priv *priv,
             (enhanced_txpower[element].mimo3_max > max_txpower_avg))
                 max_txpower_avg = enhanced_txpower[element].mimo3_max;
 
-        /* max. tx power in EEPROM is in 1/2 dBm format
-         * convert from 1/2 dBm to dBm
+        /*
+         * max. tx power in EEPROM is in 1/2 dBm format
+         * convert from 1/2 dBm to dBm (round-up convert)
+         * but we also do not want to loss 1/2 dBm resolution which
+         * will impact performance
          */
-        return max_txpower_avg >> 1;
+        *max_txpower_in_half_dbm = max_txpower_avg;
+        return (max_txpower_avg & 0x01) + (max_txpower_avg >> 1);
 }
 
 /**
@@ -763,7 +810,7 @@ static s8 iwl_get_max_txpower_avg(struct iwl_priv *priv,
  */
 static s8 iwl_update_common_txpower(struct iwl_priv *priv,
                 struct iwl_eeprom_enhanced_txpwr *enhanced_txpower,
-                int section, int element)
+                int section, int element, s8 *max_txpower_in_half_dbm)
 {
         struct iwl_channel_info *ch_info;
         int ch;
@@ -777,25 +824,25 @@ static s8 iwl_update_common_txpower(struct iwl_priv *priv,
         if (element == EEPROM_TXPOWER_COMMON_HT40_INDEX)
                 is_ht40 = true;
         max_txpower_avg =
-                iwl_get_max_txpower_avg(priv, enhanced_txpower, element);
+                iwl_get_max_txpower_avg(priv, enhanced_txpower,
+                                        element, max_txpower_in_half_dbm);
+
         ch_info = priv->channel_info;
 
         for (ch = 0; ch < priv->channel_count; ch++) {
                 /* find matching band and update tx power if needed */
                 if ((ch_info->band == enhinfo[section].band) &&
-                    (ch_info->max_power_avg < max_txpower_avg) && (!is_ht40)) {
+                    (ch_info->max_power_avg < max_txpower_avg) &&
+                    (!is_ht40)) {
                         /* Update regulatory-based run-time data */
                         ch_info->max_power_avg = ch_info->curr_txpow =
-                            max_txpower_avg;
+                                max_txpower_avg;
                         ch_info->scan_power = max_txpower_avg;
                 }
                 if ((ch_info->band == enhinfo[section].band) && is_ht40 &&
-                    ch_info->ht40_max_power_avg &&
                     (ch_info->ht40_max_power_avg < max_txpower_avg)) {
                         /* Update regulatory-based run-time data */
                         ch_info->ht40_max_power_avg = max_txpower_avg;
-                        ch_info->ht40_curr_txpow = max_txpower_avg;
-                        ch_info->ht40_scan_power = max_txpower_avg;
                 }
                 ch_info++;
         }
@@ -808,7 +855,7 @@ static s8 iwl_update_common_txpower(struct iwl_priv *priv,
  */
 static s8 iwl_update_channel_txpower(struct iwl_priv *priv,
                 struct iwl_eeprom_enhanced_txpwr *enhanced_txpower,
-                int section, int element)
+                int section, int element, s8 *max_txpower_in_half_dbm)
 {
         struct iwl_channel_info *ch_info;
         int ch;
@@ -817,7 +864,8 @@ static s8 iwl_update_channel_txpower(struct iwl_priv *priv,
 
         channel = enhinfo[section].iwl_eeprom_section_channel[element];
         max_txpower_avg =
-                iwl_get_max_txpower_avg(priv, enhanced_txpower, element);
+                iwl_get_max_txpower_avg(priv, enhanced_txpower,
+                                        element, max_txpower_in_half_dbm);
 
         ch_info = priv->channel_info;
         for (ch = 0; ch < priv->channel_count; ch++) {
@@ -831,12 +879,9 @@ static s8 iwl_update_channel_txpower(struct iwl_priv *priv,
                                 ch_info->scan_power = max_txpower_avg;
                         }
                         if ((enhinfo[section].is_ht40) &&
-                            (ch_info->ht40_max_power_avg) &&
                             (ch_info->ht40_max_power_avg < max_txpower_avg)) {
                                 /* Update regulatory-based run-time data */
                                 ch_info->ht40_max_power_avg = max_txpower_avg;
-                                ch_info->ht40_curr_txpow = max_txpower_avg;
-                                ch_info->ht40_scan_power = max_txpower_avg;
                         }
                         break;
                 }
@@ -855,6 +900,7 @@ void iwlcore_eeprom_enhanced_txpower(struct iwl_priv *priv)
         struct iwl_eeprom_enhanced_txpwr *enhanced_txpower;
         u32 offset;
         s8 max_txpower_avg; /* (dBm) */
+        s8 max_txpower_in_half_dbm; /* (half-dBm) */
 
         /* Loop through all the sections
          * adjust bands and channel's max tx power
@@ -867,20 +913,43 @@ void iwlcore_eeprom_enhanced_txpower(struct iwl_priv *priv)
                 enhanced_txpower = (struct iwl_eeprom_enhanced_txpwr *)
                                 iwl_eeprom_query_addr(priv, offset);
 
+                /*
+                 * check for valid entry -
+                 * different version of EEPROM might contain different set
+                 * of enhanced tx power table
+                 * always check for valid entry before process
+                 * the information
+                 */
+                if (!enhanced_txpower->common || enhanced_txpower->reserved)
+                        continue;
+
                 for (element = 0; element < eeprom_section_count; element++) {
                         if (enhinfo[section].is_common)
                                 max_txpower_avg =
                                         iwl_update_common_txpower(priv,
-                                        enhanced_txpower, section, element);
+                                                enhanced_txpower, section,
+                                                element,
+                                                &max_txpower_in_half_dbm);
                         else
                                 max_txpower_avg =
                                         iwl_update_channel_txpower(priv,
-                                        enhanced_txpower, section, element);
+                                                enhanced_txpower, section,
+                                                element,
+                                                &max_txpower_in_half_dbm);
 
                         /* Update the tx_power_user_lmt to the highest power
                          * supported by any channel */
                         if (max_txpower_avg > priv->tx_power_user_lmt)
                                 priv->tx_power_user_lmt = max_txpower_avg;
+
+                        /*
+                         * Update the tx_power_lmt_in_half_dbm to
+                         * the highest power supported by any channel
+                         */
+                        if (max_txpower_in_half_dbm >
+                            priv->tx_power_lmt_in_half_dbm)
+                                priv->tx_power_lmt_in_half_dbm =
+                                        max_txpower_in_half_dbm;
                 }
         }
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 80b9e45d9b9c..8171c701e4e1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -63,6 +63,8 @@
 #ifndef __iwl_eeprom_h__
 #define __iwl_eeprom_h__
 
+#include <net/mac80211.h>
+
 struct iwl_priv;
 
 /*
@@ -125,19 +127,21 @@ struct iwl_eeprom_channel {
  *    Enhanced regulatory tx power portion of eeprom image can be broken down
  *    into individual structures; each one is 8 bytes in size and contain the
  *    following information
+ * @common: (desc + channel) not used by driver, should _NOT_ be "zero"
  * @chain_a_max_pwr: chain a max power in 1/2 dBm
  * @chain_b_max_pwr: chain b max power in 1/2 dBm
  * @chain_c_max_pwr: chain c max power in 1/2 dBm
+ * @reserved: not used, should be "zero"
  * @mimo2_max_pwr: mimo2 max power in 1/2 dBm
  * @mimo3_max_pwr: mimo3 max power in 1/2 dBm
  *
  */
 struct iwl_eeprom_enhanced_txpwr {
-        u16 reserved;
+        __le16 common;
         s8 chain_a_max;
         s8 chain_b_max;
         s8 chain_c_max;
-        s8 reserved1;
+        s8 reserved;
         s8 mimo2_max;
         s8 mimo3_max;
 } __attribute__ ((packed));
@@ -199,6 +203,10 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_5000_REG_BAND_52_HT40_CHANNELS  ((0x92)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22  bytes */
 
+/* 6000 regulatory - indirect access */
+#define EEPROM_6000_REG_BAND_24_HT40_CHANNELS  ((0x80)\
+                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
+
 /* 6000 and up regulatory tx power - indirect access */
 /* max. elements per section */
 #define EEPROM_MAX_TXPOWER_SECTION_ELEMENTS     (8)
@@ -256,6 +264,15 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_5050_TX_POWER_VERSION    (4)
 #define EEPROM_5050_EEPROM_VERSION      (0x21E)
 
+/* 1000 Specific */
+#define EEPROM_1000_EEPROM_VERSION      (0x15C)
+
+/* 6x00 Specific */
+#define EEPROM_6000_EEPROM_VERSION      (0x434)
+
+/* 6x50 Specific */
+#define EEPROM_6050_EEPROM_VERSION      (0x532)
+
 /* OTP */
 /* lower blocks contain EEPROM image and calibration data */
 #define OTP_LOW_IMAGE_SIZE              (2 * 512 * sizeof(u16)) /* 2 KB */
@@ -347,7 +364,7 @@ struct iwl_eeprom_calib_subband_info {
 struct iwl_eeprom_calib_info {
         u8 saturation_power24;  /* half-dBm (e.g. "34" = 17 dBm) */
         u8 saturation_power52;  /* half-dBm */
-        s16 voltage;            /* signed */
+        __le16 voltage;         /* signed */
         struct iwl_eeprom_calib_subband_info
                 band_info[EEPROM_TX_POWER_BANDS];
 } __attribute__ ((packed));
@@ -370,12 +387,10 @@ struct iwl_eeprom_calib_info {
 #define EEPROM_BOARD_PBA_NUMBER             (2*0x3B+1)  /* 9  bytes */
 #define EEPROM_VERSION                      (2*0x44)    /* 2  bytes */
 #define EEPROM_SKU_CAP                      (2*0x45)    /* 1  bytes */
-#define EEPROM_LEDS_MODE                    (2*0x45+1)  /* 1  bytes */
 #define EEPROM_OEM_MODE                     (2*0x46)    /* 2  bytes */
 #define EEPROM_WOWLAN_MODE                  (2*0x47)    /* 2  bytes */
 #define EEPROM_RADIO_CONFIG                 (2*0x48)    /* 2  bytes */
 #define EEPROM_3945_M_VERSION               (2*0x4A)    /* 1  bytes */
-#define EEPROM_ANTENNA_SWITCH_TYPE          (2*0x4A+1)  /* 1  bytes */
 
 /* The following masks are to be applied on EEPROM_RADIO_CONFIG */
 #define EEPROM_RF_CFG_TYPE_MSK(x)   (x & 0x3)         /* bits 0-1   */
@@ -387,7 +402,12 @@ struct iwl_eeprom_calib_info {
 
 #define EEPROM_3945_RF_CFG_TYPE_MAX  0x0
 #define EEPROM_4965_RF_CFG_TYPE_MAX  0x1
-#define EEPROM_5000_RF_CFG_TYPE_MAX  0x3
+
+/* Radio Config for 5000 and up */
+#define EEPROM_RF_CONFIG_TYPE_R3x3      0x0
+#define EEPROM_RF_CONFIG_TYPE_R2x2      0x1
+#define EEPROM_RF_CONFIG_TYPE_R1x2      0x2
+#define EEPROM_RF_CONFIG_TYPE_MAX       0x3
 
 /*
  * Per-channel regulatory data.
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index 65fa8a69fd5a..113c3669b9ce 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -379,6 +379,25 @@
 
 #define FH_TSSR_TX_STATUS_REG           (FH_TSSR_LOWER_BOUND + 0x010)
 
+/**
+ * Bit fields for TSSR(Tx Shared Status & Control) error status register:
+ * 31:  Indicates an address error when accessed to internal memory
+ *      uCode/driver must write "1" in order to clear this flag
+ * 30:  Indicates that Host did not send the expected number of dwords to FH
+ *      uCode/driver must write "1" in order to clear this flag
+ * 16-9:Each status bit is for one channel. Indicates that an (Error) ActDMA
+ *      command was received from the scheduler while the TRB was already full
+ *      with previous command
+ *      uCode/driver must write "1" in order to clear this flag
+ * 7-0: Each status bit indicates a channel's TxCredit error. When an error
+ *      bit is set, it indicates that the FH has received a full indication
+ *      from the RTC TxFIFO and the current value of the TxCredit counter was
+ *      not equal to zero. This mean that the credit mechanism was not
+ *      synchronized to the TxFIFO status
+ *      uCode/driver must write "1" in order to clear this flag
+ */
+#define FH_TSSR_TX_ERROR_REG            (FH_TSSR_LOWER_BOUND + 0x018)
+
 #define FH_TSSR_TX_STATUS_REG_BIT_BUFS_EMPTY(_chnl) ((1 << (_chnl)) << 24)
 #define FH_TSSR_TX_STATUS_REG_BIT_NO_PEND_REQ(_chnl) ((1 << (_chnl)) << 16)
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index a6856daf14cb..73681c4fefe7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -56,7 +56,8 @@ const char *get_cmd_string(u8 cmd)
                 IWL_CMD(REPLY_LEDS_CMD);
                 IWL_CMD(REPLY_TX_LINK_QUALITY_CMD);
                 IWL_CMD(COEX_PRIORITY_TABLE_CMD);
-                IWL_CMD(RADAR_NOTIFICATION);
+                IWL_CMD(COEX_MEDIUM_NOTIFICATION);
+                IWL_CMD(COEX_EVENT_CMD);
                 IWL_CMD(REPLY_QUIET_CMD);
                 IWL_CMD(REPLY_CHANNEL_SWITCH);
                 IWL_CMD(CHANNEL_SWITCH_NOTIFICATION);
@@ -93,6 +94,8 @@ const char *get_cmd_string(u8 cmd)
                 IWL_CMD(CALIBRATION_RES_NOTIFICATION);
                 IWL_CMD(CALIBRATION_COMPLETE_NOTIFICATION);
                 IWL_CMD(REPLY_TX_POWER_DBM_CMD);
+                IWL_CMD(TEMPERATURE_NOTIFICATION);
+                IWL_CMD(TX_ANT_CONFIGURATION_CMD);
         default:
                 return "UNKNOWN";
 
@@ -104,17 +107,8 @@ EXPORT_SYMBOL(get_cmd_string);
 
 static void iwl_generic_cmd_callback(struct iwl_priv *priv,
                                      struct iwl_device_cmd *cmd,
-                                     struct sk_buff *skb)
+                                     struct iwl_rx_packet *pkt)
 {
-        struct iwl_rx_packet *pkt = NULL;
-
-        if (!skb) {
-                IWL_ERR(priv, "Error: Response NULL in %s.\n",
-                                get_cmd_string(cmd->hdr.cmd));
-                return;
-        }
-
-        pkt = (struct iwl_rx_packet *)skb->data;
         if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from %s (0x%08X)\n",
                         get_cmd_string(cmd->hdr.cmd), pkt->hdr.flags);
@@ -170,15 +164,13 @@ int iwl_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
          /* A synchronous command can not have a callback set. */
         BUG_ON(cmd->callback);
 
-        if (test_and_set_bit(STATUS_HCMD_SYNC_ACTIVE, &priv->status)) {
-                IWL_ERR(priv,
-                        "Error sending %s: Already sending a host command\n",
+        IWL_DEBUG_INFO(priv, "Attempting to send sync command %s\n",
                         get_cmd_string(cmd->id));
-                ret = -EBUSY;
-                goto out;
-        }
+        mutex_lock(&priv->sync_cmd_mutex);
 
         set_bit(STATUS_HCMD_ACTIVE, &priv->status);
+        IWL_DEBUG_INFO(priv, "Setting HCMD_ACTIVE for command %s \n",
+                        get_cmd_string(cmd->id));
 
         cmd_idx = iwl_enqueue_hcmd(priv, cmd);
         if (cmd_idx < 0) {
@@ -199,24 +191,26 @@ int iwl_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                                 jiffies_to_msecs(HOST_COMPLETE_TIMEOUT));
 
                         clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
+                        IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s \n",
+                                       get_cmd_string(cmd->id));
                         ret = -ETIMEDOUT;
                         goto cancel;
                 }
         }
 
         if (test_bit(STATUS_RF_KILL_HW, &priv->status)) {
-                IWL_DEBUG_INFO(priv, "Command %s aborted: RF KILL Switch\n",
+                IWL_ERR(priv, "Command %s aborted: RF KILL Switch\n",
                                get_cmd_string(cmd->id));
                 ret = -ECANCELED;
                 goto fail;
         }
         if (test_bit(STATUS_FW_ERROR, &priv->status)) {
-                IWL_DEBUG_INFO(priv, "Command %s failed: FW Error\n",
+                IWL_ERR(priv, "Command %s failed: FW Error\n",
                                get_cmd_string(cmd->id));
                 ret = -EIO;
                 goto fail;
         }
-        if ((cmd->flags & CMD_WANT_SKB) && !cmd->reply_skb) {
+        if ((cmd->flags & CMD_WANT_SKB) && !cmd->reply_page) {
                 IWL_ERR(priv, "Error: Response NULL in '%s'\n",
                           get_cmd_string(cmd->id));
                 ret = -EIO;
@@ -238,12 +232,12 @@ cancel:
                                                         ~CMD_WANT_SKB;
         }
 fail:
-        if (cmd->reply_skb) {
-                dev_kfree_skb_any(cmd->reply_skb);
-                cmd->reply_skb = NULL;
+        if (cmd->reply_page) {
+                iwl_free_pages(priv, cmd->reply_page);
+                cmd->reply_page = 0;
         }
 out:
-        clear_bit(STATUS_HCMD_SYNC_ACTIVE, &priv->status);
+        mutex_unlock(&priv->sync_cmd_mutex);
         return ret;
 }
 EXPORT_SYMBOL(iwl_send_cmd_sync);
@@ -273,7 +267,7 @@ int iwl_send_cmd_pdu_async(struct iwl_priv *priv,
                            u8 id, u16 len, const void *data,
                            void (*callback)(struct iwl_priv *priv,
                                             struct iwl_device_cmd *cmd,
-                                            struct sk_buff *skb))
+                                            struct iwl_rx_packet *pkt))
 {
         struct iwl_host_cmd cmd = {
                 .id = id,
diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
index bd0b12efb5c7..51a67fb2e185 100644
--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
+++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -80,8 +80,8 @@ static inline void iwl_free_fw_desc(struct pci_dev *pci_dev,
                                     struct fw_desc *desc)
 {
         if (desc->v_addr)
-                pci_free_consistent(pci_dev, desc->len,
-                                    desc->v_addr, desc->p_addr);
+                dma_free_coherent(&pci_dev->dev, desc->len,
+                                  desc->v_addr, desc->p_addr);
         desc->v_addr = NULL;
         desc->len = 0;
 }
@@ -89,7 +89,8 @@ static inline void iwl_free_fw_desc(struct pci_dev *pci_dev,
 static inline int iwl_alloc_fw_desc(struct pci_dev *pci_dev,
                                     struct fw_desc *desc)
 {
-        desc->v_addr = pci_alloc_consistent(pci_dev, desc->len, &desc->p_addr);
+        desc->v_addr = dma_alloc_coherent(&pci_dev->dev, desc->len,
+                                          &desc->p_addr, GFP_KERNEL);
         return (desc->v_addr != NULL) ? 0 : -ENOMEM;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.h b/drivers/net/wireless/iwlwifi/iwl-io.h
index d30cb0275d19..16eb3ced9b30 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-io.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project.
  *
@@ -31,7 +31,9 @@
 
 #include <linux/io.h>
 
+#include "iwl-dev.h"
 #include "iwl-debug.h"
+#include "iwl-devtrace.h"
 
 /*
  * IO, register, and NIC memory access functions
@@ -61,7 +63,32 @@
  *
  */
 
-#define _iwl_write32(priv, ofs, val) iowrite32((val), (priv)->hw_base + (ofs))
+static inline void _iwl_write8(struct iwl_priv *priv, u32 ofs, u8 val)
+{
+        trace_iwlwifi_dev_iowrite8(priv, ofs, val);
+        iowrite8(val, priv->hw_base + ofs);
+}
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+static inline void __iwl_write8(const char *f, u32 l, struct iwl_priv *priv,
+                                 u32 ofs, u8 val)
+{
+        IWL_DEBUG_IO(priv, "write8(0x%08X, 0x%02X) - %s %d\n", ofs, val, f, l);
+        _iwl_write8(priv, ofs, val);
+}
+#define iwl_write8(priv, ofs, val) \
+        __iwl_write8(__FILE__, __LINE__, priv, ofs, val)
+#else
+#define iwl_write8(priv, ofs, val) _iwl_write8(priv, ofs, val)
+#endif
+
+
+static inline void _iwl_write32(struct iwl_priv *priv, u32 ofs, u32 val)
+{
+        trace_iwlwifi_dev_iowrite32(priv, ofs, val);
+        iowrite32(val, priv->hw_base + ofs);
+}
+
 #ifdef CONFIG_IWLWIFI_DEBUG
 static inline void __iwl_write32(const char *f, u32 l, struct iwl_priv *priv,
                                  u32 ofs, u32 val)
@@ -75,7 +102,13 @@ static inline void __iwl_write32(const char *f, u32 l, struct iwl_priv *priv,
 #define iwl_write32(priv, ofs, val) _iwl_write32(priv, ofs, val)
 #endif
 
-#define _iwl_read32(priv, ofs) ioread32((priv)->hw_base + (ofs))
+static inline u32 _iwl_read32(struct iwl_priv *priv, u32 ofs)
+{
+        u32 val = ioread32(priv->hw_base + ofs);
+        trace_iwlwifi_dev_ioread32(priv, ofs, val);
+        return val;
+}
+
 #ifdef CONFIG_IWLWIFI_DEBUG
 static inline u32 __iwl_read32(char *f, u32 l, struct iwl_priv *priv, u32 ofs)
 {
@@ -188,6 +221,26 @@ static inline int _iwl_grab_nic_access(struct iwl_priv *priv)
 
         /* this bit wakes up the NIC */
         _iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+
+        /*
+         * These bits say the device is running, and should keep running for
+         * at least a short while (at least as long as MAC_ACCESS_REQ stays 1),
+         * but they do not indicate that embedded SRAM is restored yet;
+         * 3945 and 4965 have volatile SRAM, and must save/restore contents
+         * to/from host DRAM when sleeping/waking for power-saving.
+         * Each direction takes approximately 1/4 millisecond; with this
+         * overhead, it's a good idea to grab and hold MAC_ACCESS_REQUEST if a
+         * series of register accesses are expected (e.g. reading Event Log),
+         * to keep device from sleeping.
+         *
+         * CSR_UCODE_DRV_GP1 register bit MAC_SLEEP == 0 indicates that
+         * SRAM is okay/restored.  We don't check that here because this call
+         * is just for hardware register access; but GP1 MAC_SLEEP check is a
+         * good idea before accessing 3945/4965 SRAM (e.g. reading Event Log).
+         *
+         * 5000 series and later (including 1000 series) have non-volatile SRAM,
+         * and do not save/restore SRAM when power cycling.
+         */
         ret = _iwl_poll_bit(priv, CSR_GP_CNTRL,
                            CSR_GP_CNTRL_REG_VAL_MAC_ACCESS_EN,
                            (CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY |
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.c b/drivers/net/wireless/iwlwifi/iwl-led.c
index f420c99e7240..a6f9c918aabc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-led.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -42,15 +42,11 @@
 #include "iwl-core.h"
 #include "iwl-io.h"
 
-#ifdef CONFIG_IWLWIFI_DEBUG
-static const char *led_type_str[] = {
-        __stringify(IWL_LED_TRG_TX),
-        __stringify(IWL_LED_TRG_RX),
-        __stringify(IWL_LED_TRG_ASSOC),
-        __stringify(IWL_LED_TRG_RADIO),
-        NULL
-};
-#endif /* CONFIG_IWLWIFI_DEBUG */
+/* default: IWL_LED_BLINK(0) using blinking index table */
+static int led_mode;
+module_param(led_mode, int, S_IRUGO);
+MODULE_PARM_DESC(led_mode, "led mode: 0=blinking, 1=On(RF On)/Off(RF Off), "
+                           "(default 0)\n");
 
 
 static const struct {
@@ -65,11 +61,11 @@ static const struct {
         {70, 65, 65},
         {50, 75, 75},
         {20, 85, 85},
-        {15, 95, 95 },
-        {10, 110, 110},
-        {5, 130, 130},
+        {10, 95, 95},
+        {5, 110, 110},
+        {1, 130, 130},
         {0, 167, 167},
-/* SOLID_ON */
+        /* SOLID_ON */
         {-1, IWL_LED_SOLID, 0}
 };
 
@@ -78,191 +74,74 @@ static const struct {
 #define IWL_MAX_BLINK_TBL (ARRAY_SIZE(blink_tbl) - 1) /* exclude SOLID_ON */
 #define IWL_SOLID_BLINK_IDX (ARRAY_SIZE(blink_tbl) - 1)
 
-/*  [0-256] -> [0..8] FIXME: we need [0..10] */
-static inline int iwl_brightness_to_idx(enum led_brightness brightness)
-{
-        return fls(0x000000FF & (u32)brightness);
-}
-
-/* Send led command */
-static int iwl_send_led_cmd(struct iwl_priv *priv, struct iwl_led_cmd *led_cmd)
+/*
+ * Adjust led blink rate to compensate on a MAC Clock difference on every HW
+ * Led blink rate analysis showed an average deviation of 0% on 3945,
+ * 5% on 4965 HW and 20% on 5000 series and up.
+ * Need to compensate on the led on/off time per HW according to the deviation
+ * to achieve the desired led frequency
+ * The calculation is: (100-averageDeviation)/100 * blinkTime
+ * For code efficiency the calculation will be:
+ *     compensation = (100 - averageDeviation) * 64 / 100
+ *     NewBlinkTime = (compensation * BlinkTime) / 64
+ */
+static inline u8 iwl_blink_compensation(struct iwl_priv *priv,
+                                    u8 time, u16 compensation)
 {
-        struct iwl_host_cmd cmd = {
-                .id = REPLY_LEDS_CMD,
-                .len = sizeof(struct iwl_led_cmd),
-                .data = led_cmd,
-                .flags = CMD_ASYNC,
-                .callback = NULL,
-        };
-        u32 reg;
-
-        reg = iwl_read32(priv, CSR_LED_REG);
-        if (reg != (reg & CSR_LED_BSM_CTRL_MSK))
-                iwl_write32(priv, CSR_LED_REG, reg & CSR_LED_BSM_CTRL_MSK);
+        if (!compensation) {
+                IWL_ERR(priv, "undefined blink compensation: "
+                        "use pre-defined blinking time\n");
+                return time;
+        }
 
-        return iwl_send_cmd(priv, &cmd);
+        return (u8)((time * compensation) >> 6);
 }
 
 /* Set led pattern command */
-static int iwl_led_pattern(struct iwl_priv *priv, int led_id,
-                               unsigned int idx)
+static int iwl_led_pattern(struct iwl_priv *priv, unsigned int idx)
 {
         struct iwl_led_cmd led_cmd = {
-                .id = led_id,
+                .id = IWL_LED_LINK,
                 .interval = IWL_DEF_LED_INTRVL
         };
 
         BUG_ON(idx > IWL_MAX_BLINK_TBL);
 
-        led_cmd.on = blink_tbl[idx].on_time;
-        led_cmd.off = blink_tbl[idx].off_time;
-
-        return iwl_send_led_cmd(priv, &led_cmd);
-}
-
-/* Set led register off */
-static int iwl_led_on_reg(struct iwl_priv *priv, int led_id)
-{
-        IWL_DEBUG_LED(priv, "led on %d\n", led_id);
-        iwl_write32(priv, CSR_LED_REG, CSR_LED_REG_TRUN_ON);
-        return 0;
-}
+        IWL_DEBUG_LED(priv, "Led blink time compensation= %u\n",
+                        priv->cfg->led_compensation);
+        led_cmd.on =
+                iwl_blink_compensation(priv, blink_tbl[idx].on_time,
+                                        priv->cfg->led_compensation);
+        led_cmd.off =
+                iwl_blink_compensation(priv, blink_tbl[idx].off_time,
+                                        priv->cfg->led_compensation);
 
-#if 0
-/* Set led on command */
-static int iwl_led_on(struct iwl_priv *priv, int led_id)
-{
-        struct iwl_led_cmd led_cmd = {
-                .id = led_id,
-                .on = IWL_LED_SOLID,
-                .off = 0,
-                .interval = IWL_DEF_LED_INTRVL
-        };
-        return iwl_send_led_cmd(priv, &led_cmd);
+        return priv->cfg->ops->led->cmd(priv, &led_cmd);
 }
 
-/* Set led off command */
-int iwl_led_off(struct iwl_priv *priv, int led_id)
+int iwl_led_start(struct iwl_priv *priv)
 {
-        struct iwl_led_cmd led_cmd = {
-                .id = led_id,
-                .on = 0,
-                .off = 0,
-                .interval = IWL_DEF_LED_INTRVL
-        };
-        IWL_DEBUG_LED(priv, "led off %d\n", led_id);
-        return iwl_send_led_cmd(priv, &led_cmd);
+        return priv->cfg->ops->led->on(priv);
 }
-#endif
-
+EXPORT_SYMBOL(iwl_led_start);
 
-/* Set led register off */
-static int iwl_led_off_reg(struct iwl_priv *priv, int led_id)
-{
-        IWL_DEBUG_LED(priv, "LED Reg off\n");
-        iwl_write32(priv, CSR_LED_REG, CSR_LED_REG_TRUN_OFF);
-        return 0;
-}
-
-/*
- * Set led register in case of disassociation according to rfkill state
- */
-static int iwl_led_associate(struct iwl_priv *priv, int led_id)
+int iwl_led_associate(struct iwl_priv *priv)
 {
         IWL_DEBUG_LED(priv, "Associated\n");
-        priv->allow_blinking = 1;
-        return iwl_led_on_reg(priv, led_id);
-}
-static int iwl_led_disassociate(struct iwl_priv *priv, int led_id)
-{
-        priv->allow_blinking = 0;
-
-        return 0;
-}
-
-/*
- * brightness call back function for Tx/Rx LED
- */
-static int iwl_led_associated(struct iwl_priv *priv, int led_id)
-{
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
-            !test_bit(STATUS_READY, &priv->status))
-                return 0;
-
+        if (led_mode == IWL_LED_BLINK)
+                priv->allow_blinking = 1;
+        priv->last_blink_time = jiffies;
 
-        /* start counting Tx/Rx bytes */
-        if (!priv->last_blink_time && priv->allow_blinking)
-                priv->last_blink_time = jiffies;
         return 0;
 }
 
-/*
- * brightness call back for association and radio
- */
-static void iwl_led_brightness_set(struct led_classdev *led_cdev,
-                                       enum led_brightness brightness)
+int iwl_led_disassociate(struct iwl_priv *priv)
 {
-        struct iwl_led *led = container_of(led_cdev, struct iwl_led, led_dev);
-        struct iwl_priv *priv = led->priv;
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-
-        IWL_DEBUG_LED(priv, "Led type = %s brightness = %d\n",
-                        led_type_str[led->type], brightness);
-        switch (brightness) {
-        case LED_FULL:
-                if (led->led_on)
-                        led->led_on(priv, IWL_LED_LINK);
-                break;
-        case LED_OFF:
-                if (led->led_off)
-                        led->led_off(priv, IWL_LED_LINK);
-                break;
-        default:
-                if (led->led_pattern) {
-                        int idx = iwl_brightness_to_idx(brightness);
-                        led->led_pattern(priv, IWL_LED_LINK, idx);
-                }
-                break;
-        }
-}
-
-
-
-/*
- * Register led class with the system
- */
-static int iwl_leds_register_led(struct iwl_priv *priv, struct iwl_led *led,
-                                   enum led_type type, u8 set_led,
-                                   char *trigger)
-{
-        struct device *device = wiphy_dev(priv->hw->wiphy);
-        int ret;
-
-        led->led_dev.name = led->name;
-        led->led_dev.brightness_set = iwl_led_brightness_set;
-        led->led_dev.default_trigger = trigger;
-
-        led->priv = priv;
-        led->type = type;
-
-        ret = led_classdev_register(device, &led->led_dev);
-        if (ret) {
-                IWL_ERR(priv, "Error: failed to register led handler.\n");
-                return ret;
-        }
-
-        led->registered = 1;
-
-        if (set_led && led->led_on)
-                led->led_on(priv, IWL_LED_LINK);
+        priv->allow_blinking = 0;
 
         return 0;
 }
 
-
 /*
  * calculate blink rate according to last second Tx/Rx activities
  */
@@ -288,7 +167,7 @@ static int iwl_get_blink_rate(struct iwl_priv *priv)
                 i = IWL_MAX_BLINK_TBL;
         else
                 for (i = 0; i < IWL_MAX_BLINK_TBL; i++)
-                        if (tpt  > (blink_tbl[i].tpt * IWL_1MB_RATE))
+                        if (tpt > (blink_tbl[i].tpt * IWL_1MB_RATE))
                                 break;
 
         IWL_DEBUG_LED(priv, "LED BLINK IDX=%d\n", i);
@@ -317,8 +196,7 @@ void iwl_leds_background(struct iwl_priv *priv)
                 priv->last_blink_time = 0;
                 if (priv->last_blink_rate != IWL_SOLID_BLINK_IDX) {
                         priv->last_blink_rate = IWL_SOLID_BLINK_IDX;
-                        iwl_led_pattern(priv, IWL_LED_LINK,
-                                            IWL_SOLID_BLINK_IDX);
+                        iwl_led_pattern(priv, IWL_SOLID_BLINK_IDX);
                 }
                 return;
         }
@@ -331,111 +209,17 @@ void iwl_leds_background(struct iwl_priv *priv)
 
         /* call only if blink rate change */
         if (blink_idx != priv->last_blink_rate)
-                iwl_led_pattern(priv, IWL_LED_LINK, blink_idx);
+                iwl_led_pattern(priv, blink_idx);
 
         priv->last_blink_time = jiffies;
         priv->last_blink_rate = blink_idx;
 }
+EXPORT_SYMBOL(iwl_leds_background);
 
-/* Register all led handler */
-int iwl_leds_register(struct iwl_priv *priv)
+void iwl_leds_init(struct iwl_priv *priv)
 {
-        char *trigger;
-        int ret;
-
         priv->last_blink_rate = 0;
-        priv->led_tpt = 0;
         priv->last_blink_time = 0;
         priv->allow_blinking = 0;
-
-        trigger = ieee80211_get_radio_led_name(priv->hw);
-        snprintf(priv->led[IWL_LED_TRG_RADIO].name,
-                 sizeof(priv->led[IWL_LED_TRG_RADIO].name), "iwl-%s::radio",
-                 wiphy_name(priv->hw->wiphy));
-
-        priv->led[IWL_LED_TRG_RADIO].led_on = iwl_led_on_reg;
-        priv->led[IWL_LED_TRG_RADIO].led_off = iwl_led_off_reg;
-        priv->led[IWL_LED_TRG_RADIO].led_pattern = NULL;
-
-        ret = iwl_leds_register_led(priv, &priv->led[IWL_LED_TRG_RADIO],
-                                   IWL_LED_TRG_RADIO, 1, trigger);
-        if (ret)
-                goto exit_fail;
-
-        trigger = ieee80211_get_assoc_led_name(priv->hw);
-        snprintf(priv->led[IWL_LED_TRG_ASSOC].name,
-                 sizeof(priv->led[IWL_LED_TRG_ASSOC].name), "iwl-%s::assoc",
-                 wiphy_name(priv->hw->wiphy));
-
-        ret = iwl_leds_register_led(priv, &priv->led[IWL_LED_TRG_ASSOC],
-                                   IWL_LED_TRG_ASSOC, 0, trigger);
-
-        /* for assoc always turn led on */
-        priv->led[IWL_LED_TRG_ASSOC].led_on = iwl_led_associate;
-        priv->led[IWL_LED_TRG_ASSOC].led_off = iwl_led_disassociate;
-        priv->led[IWL_LED_TRG_ASSOC].led_pattern = NULL;
-
-        if (ret)
-                goto exit_fail;
-
-        trigger = ieee80211_get_rx_led_name(priv->hw);
-        snprintf(priv->led[IWL_LED_TRG_RX].name,
-                 sizeof(priv->led[IWL_LED_TRG_RX].name), "iwl-%s::RX",
-                 wiphy_name(priv->hw->wiphy));
-
-        ret = iwl_leds_register_led(priv, &priv->led[IWL_LED_TRG_RX],
-                                   IWL_LED_TRG_RX, 0, trigger);
-
-        priv->led[IWL_LED_TRG_RX].led_on = iwl_led_associated;
-        priv->led[IWL_LED_TRG_RX].led_off = iwl_led_associated;
-        priv->led[IWL_LED_TRG_RX].led_pattern = iwl_led_pattern;
-
-        if (ret)
-                goto exit_fail;
-
-        trigger = ieee80211_get_tx_led_name(priv->hw);
-        snprintf(priv->led[IWL_LED_TRG_TX].name,
-                 sizeof(priv->led[IWL_LED_TRG_TX].name), "iwl-%s::TX",
-                 wiphy_name(priv->hw->wiphy));
-
-        ret = iwl_leds_register_led(priv, &priv->led[IWL_LED_TRG_TX],
-                                   IWL_LED_TRG_TX, 0, trigger);
-
-        priv->led[IWL_LED_TRG_TX].led_on = iwl_led_associated;
-        priv->led[IWL_LED_TRG_TX].led_off = iwl_led_associated;
-        priv->led[IWL_LED_TRG_TX].led_pattern = iwl_led_pattern;
-
-        if (ret)
-                goto exit_fail;
-
-        return 0;
-
-exit_fail:
-        iwl_leds_unregister(priv);
-        return ret;
 }
-EXPORT_SYMBOL(iwl_leds_register);
-
-/* unregister led class */
-static void iwl_leds_unregister_led(struct iwl_led *led, u8 set_led)
-{
-        if (!led->registered)
-                return;
-
-        led_classdev_unregister(&led->led_dev);
-
-        if (set_led)
-                led->led_dev.brightness_set(&led->led_dev, LED_OFF);
-        led->registered = 0;
-}
-
-/* Unregister all led handlers */
-void iwl_leds_unregister(struct iwl_priv *priv)
-{
-        iwl_leds_unregister_led(&priv->led[IWL_LED_TRG_ASSOC], 0);
-        iwl_leds_unregister_led(&priv->led[IWL_LED_TRG_RX], 0);
-        iwl_leds_unregister_led(&priv->led[IWL_LED_TRG_TX], 0);
-        iwl_leds_unregister_led(&priv->led[IWL_LED_TRG_RADIO], 1);
-}
-EXPORT_SYMBOL(iwl_leds_unregister);
-
+EXPORT_SYMBOL(iwl_leds_init);
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.h b/drivers/net/wireless/iwlwifi/iwl-led.h
index ef9b174c37ff..49a70baa3fb6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.h
+++ b/drivers/net/wireless/iwlwifi/iwl-led.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -30,9 +30,6 @@
 
 struct iwl_priv;
 
-#ifdef CONFIG_IWLWIFI_LEDS
-#include <linux/leds.h>
-
 #define IWL_LED_SOLID 11
 #define IWL_LED_NAME_LEN 31
 #define IWL_DEF_LED_INTRVL cpu_to_le32(1000)
@@ -47,38 +44,23 @@ enum led_type {
         IWL_LED_TRG_RADIO,
         IWL_LED_TRG_MAX,
 };
-#endif
-
-#ifdef CONFIG_IWLWIFI_LEDS
-
-struct iwl_led {
-        struct iwl_priv *priv;
-        struct led_classdev led_dev;
-        char name[32];
 
-        int (*led_on) (struct iwl_priv *priv, int led_id);
-        int (*led_off) (struct iwl_priv *priv, int led_id);
-        int (*led_pattern) (struct iwl_priv *priv, int led_id, unsigned int idx);
-
-        enum led_type type;
-        unsigned int registered;
+/*
+ * LED mode
+ *    IWL_LED_BLINK:    adjust led blink rate based on blink table
+ *    IWL_LED_RF_STATE: turn LED on/off based on RF state
+ *                      LED ON  = RF ON
+ *                      LED OFF = RF OFF
+ */
+enum iwl_led_mode {
+        IWL_LED_BLINK,
+        IWL_LED_RF_STATE,
 };
 
-int iwl_leds_register(struct iwl_priv *priv);
-void iwl_leds_unregister(struct iwl_priv *priv);
+void iwl_leds_init(struct iwl_priv *priv);
 void iwl_leds_background(struct iwl_priv *priv);
+int iwl_led_start(struct iwl_priv *priv);
+int iwl_led_associate(struct iwl_priv *priv);
+int iwl_led_disassociate(struct iwl_priv *priv);
 
-#else
-static inline int iwl_leds_register(struct iwl_priv *priv)
-{
-        return 0;
-}
-static inline void iwl_leds_unregister(struct iwl_priv *priv)
-{
-}
-static inline void iwl_leds_background(struct iwl_priv *priv)
-{
-}
-
-#endif /* CONFIG_IWLWIFI_LEDS */
 #endif /* __iwl_leds_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 60be976afff8..548dac2f6a96 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -29,6 +29,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 
 #include <net/mac80211.h>
@@ -66,7 +67,7 @@ MODULE_PARM_DESC(no_sleep_autoadjust,
 
 struct iwl_power_vec_entry {
         struct iwl_powertable_cmd cmd;
-        u8 no_dtim;
+        u8 no_dtim;     /* number of skip dtim */
 };
 
 #define IWL_DTIM_RANGE_0_MAX    2
@@ -83,8 +84,9 @@ struct iwl_power_vec_entry {
                                      cpu_to_le32(X4)}
 /* default power management (not Tx power) table values */
 /* for DTIM period 0 through IWL_DTIM_RANGE_0_MAX */
+/* DTIM 0 - 2 */
 static const struct iwl_power_vec_entry range_0[IWL_POWER_NUM] = {
-        {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 2, 2, 0xFF)}, 0},
+        {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 1, 2, 2, 0xFF)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(1, 2, 2, 2, 0xFF)}, 0},
         {{SLP, SLP_TOUT(50), SLP_TOUT(100), SLP_VEC(2, 2, 2, 2, 0xFF)}, 0},
         {{SLP, SLP_TOUT(50), SLP_TOUT(25), SLP_VEC(2, 2, 4, 4, 0xFF)}, 1},
@@ -93,15 +95,17 @@ static const struct iwl_power_vec_entry range_0[IWL_POWER_NUM] = {
 
 
 /* for DTIM period IWL_DTIM_RANGE_0_MAX + 1 through IWL_DTIM_RANGE_1_MAX */
+/* DTIM 3 - 10 */
 static const struct iwl_power_vec_entry range_1[IWL_POWER_NUM] = {
         {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 3, 4, 4)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(1, 2, 3, 4, 7)}, 0},
         {{SLP, SLP_TOUT(50), SLP_TOUT(100), SLP_VEC(2, 4, 6, 7, 9)}, 0},
         {{SLP, SLP_TOUT(50), SLP_TOUT(25), SLP_VEC(2, 4, 6, 9, 10)}, 1},
-        {{SLP, SLP_TOUT(25), SLP_TOUT(25), SLP_VEC(2, 4, 7, 10, 10)}, 2}
+        {{SLP, SLP_TOUT(25), SLP_TOUT(25), SLP_VEC(2, 4, 6, 10, 10)}, 2}
 };
 
 /* for DTIM period > IWL_DTIM_RANGE_1_MAX */
+/* DTIM 11 - */
 static const struct iwl_power_vec_entry range_2[IWL_POWER_NUM] = {
         {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 3, 4, 0xFF)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(2, 4, 6, 7, 0xFF)}, 0},
@@ -115,13 +119,15 @@ static void iwl_static_sleep_cmd(struct iwl_priv *priv,
                                  enum iwl_power_level lvl, int period)
 {
         const struct iwl_power_vec_entry *table;
-        int max_sleep, i;
-        bool skip;
+        int max_sleep[IWL_POWER_VEC_SIZE] = { 0 };
+        int i;
+        u8 skip;
+        u32 slp_itrvl;
 
         table = range_2;
-        if (period < IWL_DTIM_RANGE_1_MAX)
+        if (period <= IWL_DTIM_RANGE_1_MAX)
                 table = range_1;
-        if (period < IWL_DTIM_RANGE_0_MAX)
+        if (period <= IWL_DTIM_RANGE_0_MAX)
                 table = range_0;
 
         BUG_ON(lvl < 0 || lvl >= IWL_POWER_NUM);
@@ -129,34 +135,60 @@ static void iwl_static_sleep_cmd(struct iwl_priv *priv,
         *cmd = table[lvl].cmd;
 
         if (period == 0) {
-                skip = false;
+                skip = 0;
                 period = 1;
+                for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
+                        max_sleep[i] =  1;
+
         } else {
-                skip = !!table[lvl].no_dtim;
+                skip = table[lvl].no_dtim;
+                for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
+                        max_sleep[i] = le32_to_cpu(cmd->sleep_interval[i]);
+                max_sleep[IWL_POWER_VEC_SIZE - 1] = skip + 1;
         }
 
-        if (skip) {
-                __le32 slp_itrvl = cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1];
-                max_sleep = le32_to_cpu(slp_itrvl);
-                if (max_sleep == 0xFF)
-                        max_sleep = period * (skip + 1);
-                else if (max_sleep > period)
-                        max_sleep = (le32_to_cpu(slp_itrvl) / period) * period;
+        slp_itrvl = le32_to_cpu(cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1]);
+        /* figure out the listen interval based on dtim period and skip */
+        if (slp_itrvl == 0xFF)
+                cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1] =
+                        cpu_to_le32(period * (skip + 1));
+
+        slp_itrvl = le32_to_cpu(cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1]);
+        if (slp_itrvl > period)
+                cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1] =
+                        cpu_to_le32((slp_itrvl / period) * period);
+
+        if (skip)
                 cmd->flags |= IWL_POWER_SLEEP_OVER_DTIM_MSK;
-        } else {
-                max_sleep = period;
+        else
                 cmd->flags &= ~IWL_POWER_SLEEP_OVER_DTIM_MSK;
-        }
 
-        for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
-                if (le32_to_cpu(cmd->sleep_interval[i]) > max_sleep)
-                        cmd->sleep_interval[i] = cpu_to_le32(max_sleep);
+        slp_itrvl = le32_to_cpu(cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1]);
+        if (slp_itrvl > IWL_CONN_MAX_LISTEN_INTERVAL)
+                cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1] =
+                        cpu_to_le32(IWL_CONN_MAX_LISTEN_INTERVAL);
+
+        /* enforce max sleep interval */
+        for (i = IWL_POWER_VEC_SIZE - 1; i >= 0 ; i--) {
+                if (le32_to_cpu(cmd->sleep_interval[i]) >
+                    (max_sleep[i] * period))
+                        cmd->sleep_interval[i] =
+                                cpu_to_le32(max_sleep[i] * period);
+                if (i != (IWL_POWER_VEC_SIZE - 1)) {
+                        if (le32_to_cpu(cmd->sleep_interval[i]) >
+                            le32_to_cpu(cmd->sleep_interval[i+1]))
+                                cmd->sleep_interval[i] =
+                                        cmd->sleep_interval[i+1];
+                }
+        }
 
         if (priv->power_data.pci_pm)
                 cmd->flags |= IWL_POWER_PCI_PM_MSK;
         else
                 cmd->flags &= ~IWL_POWER_PCI_PM_MSK;
 
+        IWL_DEBUG_POWER(priv, "numSkipDtim = %u, dtimPeriod = %d\n",
+                        skip, period);
         IWL_DEBUG_POWER(priv, "Sleep command for index %d\n", lvl + 1);
 }
 
@@ -165,26 +197,26 @@ static void iwl_static_sleep_cmd(struct iwl_priv *priv,
  *=============================================================================
  *                 Condition Nxt State  Condition Nxt State Condition Nxt State
  *-----------------------------------------------------------------------------
- *     IWL_TI_0     T >= 115   CT_KILL  115>T>=105   TI_1      N/A      N/A
- *     IWL_TI_1     T >= 115   CT_KILL  115>T>=110   TI_2     T<=95     TI_0
- *     IWL_TI_2     T >= 115   CT_KILL                        T<=100    TI_1
+ *     IWL_TI_0     T >= 114   CT_KILL  114>T>=105   TI_1      N/A      N/A
+ *     IWL_TI_1     T >= 114   CT_KILL  114>T>=110   TI_2     T<=95     TI_0
+ *     IWL_TI_2     T >= 114   CT_KILL                        T<=100    TI_1
  *    IWL_CT_KILL      N/A       N/A       N/A        N/A     T<=95     TI_0
  *=============================================================================
  */
 static const struct iwl_tt_trans tt_range_0[IWL_TI_STATE_MAX - 1] = {
         {IWL_TI_0, IWL_ABSOLUTE_ZERO, 104},
-        {IWL_TI_1, 105, CT_KILL_THRESHOLD},
-        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD + 1, IWL_ABSOLUTE_MAX}
+        {IWL_TI_1, 105, CT_KILL_THRESHOLD - 1},
+        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD, IWL_ABSOLUTE_MAX}
 };
 static const struct iwl_tt_trans tt_range_1[IWL_TI_STATE_MAX - 1] = {
         {IWL_TI_0, IWL_ABSOLUTE_ZERO, 95},
-        {IWL_TI_2, 110, CT_KILL_THRESHOLD},
-        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD + 1, IWL_ABSOLUTE_MAX}
+        {IWL_TI_2, 110, CT_KILL_THRESHOLD - 1},
+        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD, IWL_ABSOLUTE_MAX}
 };
 static const struct iwl_tt_trans tt_range_2[IWL_TI_STATE_MAX - 1] = {
         {IWL_TI_1, IWL_ABSOLUTE_ZERO, 100},
-        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD + 1, IWL_ABSOLUTE_MAX},
-        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD + 1, IWL_ABSOLUTE_MAX}
+        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD, IWL_ABSOLUTE_MAX},
+        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD, IWL_ABSOLUTE_MAX}
 };
 static const struct iwl_tt_trans tt_range_3[IWL_TI_STATE_MAX - 1] = {
         {IWL_TI_0, IWL_ABSOLUTE_ZERO, CT_KILL_EXIT_THRESHOLD},
@@ -272,13 +304,12 @@ static int iwl_set_power(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd)
                                 sizeof(struct iwl_powertable_cmd), cmd);
 }
 
-
+/* priv->mutex must be held */
 int iwl_power_update_mode(struct iwl_priv *priv, bool force)
 {
         int ret = 0;
         struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-        bool enabled = (priv->iw_mode == NL80211_IFTYPE_STATION) &&
-                        (priv->hw->conf.flags & IEEE80211_CONF_PS);
+        bool enabled = priv->hw->conf.flags & IEEE80211_CONF_PS;
         bool update_chains;
         struct iwl_powertable_cmd cmd;
         int dtimper;
@@ -288,12 +319,15 @@ int iwl_power_update_mode(struct iwl_priv *priv, bool force)
                         priv->chain_noise_data.state == IWL_CHAIN_NOISE_ALIVE;
 
         if (priv->vif)
-                dtimper = priv->vif->bss_conf.dtim_period;
+                dtimper = priv->hw->conf.ps_dtim_period;
         else
                 dtimper = 1;
 
         if (priv->cfg->broken_powersave)
                 iwl_power_sleep_cam_cmd(priv, &cmd);
+        else if (priv->cfg->supports_idle &&
+                 priv->hw->conf.flags & IEEE80211_CONF_IDLE)
+                iwl_static_sleep_cmd(priv, &cmd, IWL_POWER_INDEX_5, 20);
         else if (tt->state >= IWL_TI_1)
                 iwl_static_sleep_cmd(priv, &cmd, tt->tt_power_mode, dtimper);
         else if (!enabled)
@@ -348,6 +382,23 @@ bool iwl_ht_enabled(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_ht_enabled);
 
+bool iwl_within_ct_kill_margin(struct iwl_priv *priv)
+{
+        s32 temp = priv->temperature; /* degrees CELSIUS except 4965 */
+        bool within_margin = false;
+
+        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
+                temp = KELVIN_TO_CELSIUS(priv->temperature);
+
+        if (!priv->thermal_throttle.advanced_tt)
+                within_margin = ((temp + IWL_TT_CT_KILL_MARGIN) >=
+                                CT_KILL_THRESHOLD_LEGACY) ? true : false;
+        else
+                within_margin = ((temp + IWL_TT_CT_KILL_MARGIN) >=
+                                CT_KILL_THRESHOLD) ? true : false;
+        return within_margin;
+}
+
 enum iwl_antenna_ok iwl_tx_ant_restriction(struct iwl_priv *priv)
 {
         struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
@@ -372,6 +423,7 @@ enum iwl_antenna_ok iwl_rx_ant_restriction(struct iwl_priv *priv)
 }
 
 #define CT_KILL_EXIT_DURATION (5)       /* 5 seconds duration */
+#define CT_KILL_WAITING_DURATION (300)  /* 300ms duration */
 
 /*
  * toggle the bit to wake up uCode and check the temperature
@@ -409,6 +461,7 @@ static void iwl_tt_check_exit_ct_kill(unsigned long data)
                 /* Reschedule the ct_kill timer to occur in
                  * CT_KILL_EXIT_DURATION seconds to ensure we get a
                  * thermal update */
+                IWL_DEBUG_POWER(priv, "schedule ct_kill exit timer\n");
                 mod_timer(&priv->thermal_throttle.ct_kill_exit_tm, jiffies +
                           CT_KILL_EXIT_DURATION * HZ);
         }
@@ -432,6 +485,33 @@ static void iwl_perform_ct_kill_task(struct iwl_priv *priv,
         }
 }
 
+static void iwl_tt_ready_for_ct_kill(unsigned long data)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)data;
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        /* temperature timer expired, ready to go into CT_KILL state */
+        if (tt->state != IWL_TI_CT_KILL) {
+                IWL_DEBUG_POWER(priv, "entering CT_KILL state when temperature timer expired\n");
+                tt->state = IWL_TI_CT_KILL;
+                set_bit(STATUS_CT_KILL, &priv->status);
+                iwl_perform_ct_kill_task(priv, true);
+        }
+}
+
+static void iwl_prepare_ct_kill_task(struct iwl_priv *priv)
+{
+        IWL_DEBUG_POWER(priv, "Prepare to enter IWL_TI_CT_KILL\n");
+        /* make request to retrieve statistics information */
+        iwl_send_statistics_request(priv, CMD_SYNC, false);
+        /* Reschedule the ct_kill wait timer */
+        mod_timer(&priv->thermal_throttle.ct_kill_waiting_tm,
+                 jiffies + msecs_to_jiffies(CT_KILL_WAITING_DURATION));
+}
+
 #define IWL_MINIMAL_POWER_THRESHOLD             (CT_KILL_THRESHOLD_LEGACY)
 #define IWL_REDUCED_PERFORMANCE_THRESHOLD_2     (100)
 #define IWL_REDUCED_PERFORMANCE_THRESHOLD_1     (90)
@@ -445,7 +525,7 @@ static void iwl_perform_ct_kill_task(struct iwl_priv *priv,
  *      Throttle early enough to lower the power consumption before
  *      drastic steps are needed
  */
-static void iwl_legacy_tt_handler(struct iwl_priv *priv, s32 temp)
+static void iwl_legacy_tt_handler(struct iwl_priv *priv, s32 temp, bool force)
 {
         struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
         enum iwl_tt_state old_state;
@@ -474,6 +554,8 @@ static void iwl_legacy_tt_handler(struct iwl_priv *priv, s32 temp)
 #ifdef CONFIG_IWLWIFI_DEBUG
         tt->tt_previous_temp = temp;
 #endif
+        /* stop ct_kill_waiting_tm timer */
+        del_timer_sync(&priv->thermal_throttle.ct_kill_waiting_tm);
         if (tt->state != old_state) {
                 switch (tt->state) {
                 case IWL_TI_0:
@@ -494,17 +576,28 @@ static void iwl_legacy_tt_handler(struct iwl_priv *priv, s32 temp)
                         break;
                 }
                 mutex_lock(&priv->mutex);
-                if (iwl_power_update_mode(priv, true)) {
+                if (old_state == IWL_TI_CT_KILL)
+                        clear_bit(STATUS_CT_KILL, &priv->status);
+                if (tt->state != IWL_TI_CT_KILL &&
+                    iwl_power_update_mode(priv, true)) {
                         /* TT state not updated
                          * try again during next temperature read
                          */
+                        if (old_state == IWL_TI_CT_KILL)
+                                set_bit(STATUS_CT_KILL, &priv->status);
                         tt->state = old_state;
                         IWL_ERR(priv, "Cannot update power mode, "
                                         "TT state not updated\n");
                 } else {
-                        if (tt->state == IWL_TI_CT_KILL)
-                                iwl_perform_ct_kill_task(priv, true);
-                        else if (old_state == IWL_TI_CT_KILL &&
+                        if (tt->state == IWL_TI_CT_KILL) {
+                                if (force) {
+                                        set_bit(STATUS_CT_KILL, &priv->status);
+                                        iwl_perform_ct_kill_task(priv, true);
+                                } else {
+                                        iwl_prepare_ct_kill_task(priv);
+                                        tt->state = old_state;
+                                }
+                        } else if (old_state == IWL_TI_CT_KILL &&
                                  tt->state != IWL_TI_CT_KILL)
                                 iwl_perform_ct_kill_task(priv, false);
                         IWL_DEBUG_POWER(priv, "Temperature state changed %u\n",
@@ -531,13 +624,13 @@ static void iwl_legacy_tt_handler(struct iwl_priv *priv, s32 temp)
  *=============================================================================
  *                 Condition Nxt State  Condition Nxt State Condition Nxt State
  *-----------------------------------------------------------------------------
- *     IWL_TI_0     T >= 115   CT_KILL  115>T>=105   TI_1      N/A      N/A
- *     IWL_TI_1     T >= 115   CT_KILL  115>T>=110   TI_2     T<=95     TI_0
- *     IWL_TI_2     T >= 115   CT_KILL                        T<=100    TI_1
+ *     IWL_TI_0     T >= 114   CT_KILL  114>T>=105   TI_1      N/A      N/A
+ *     IWL_TI_1     T >= 114   CT_KILL  114>T>=110   TI_2     T<=95     TI_0
+ *     IWL_TI_2     T >= 114   CT_KILL                        T<=100    TI_1
  *    IWL_CT_KILL      N/A       N/A       N/A        N/A     T<=95     TI_0
  *=============================================================================
  */
-static void iwl_advance_tt_handler(struct iwl_priv *priv, s32 temp)
+static void iwl_advance_tt_handler(struct iwl_priv *priv, s32 temp, bool force)
 {
         struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
         int i;
@@ -582,6 +675,8 @@ static void iwl_advance_tt_handler(struct iwl_priv *priv, s32 temp)
                         break;
                 }
         }
+        /* stop ct_kill_waiting_tm timer */
+        del_timer_sync(&priv->thermal_throttle.ct_kill_waiting_tm);
         if (changed) {
                 struct iwl_rxon_cmd *rxon = &priv->staging_rxon;
 
@@ -613,12 +708,17 @@ static void iwl_advance_tt_handler(struct iwl_priv *priv, s32 temp)
                         iwl_set_rxon_ht(priv, &priv->current_ht_config);
                 }
                 mutex_lock(&priv->mutex);
-                if (iwl_power_update_mode(priv, true)) {
+                if (old_state == IWL_TI_CT_KILL)
+                        clear_bit(STATUS_CT_KILL, &priv->status);
+                if (tt->state != IWL_TI_CT_KILL &&
+                    iwl_power_update_mode(priv, true)) {
                         /* TT state not updated
                          * try again during next temperature read
                          */
                         IWL_ERR(priv, "Cannot update power mode, "
                                         "TT state not updated\n");
+                        if (old_state == IWL_TI_CT_KILL)
+                                set_bit(STATUS_CT_KILL, &priv->status);
                         tt->state = old_state;
                 } else {
                         IWL_DEBUG_POWER(priv,
@@ -626,9 +726,15 @@ static void iwl_advance_tt_handler(struct iwl_priv *priv, s32 temp)
                                         tt->state);
                         if (old_state != IWL_TI_CT_KILL &&
                             tt->state == IWL_TI_CT_KILL) {
-                                IWL_DEBUG_POWER(priv, "Enter IWL_TI_CT_KILL\n");
-                                iwl_perform_ct_kill_task(priv, true);
-
+                                if (force) {
+                                        IWL_DEBUG_POWER(priv,
+                                                "Enter IWL_TI_CT_KILL\n");
+                                        set_bit(STATUS_CT_KILL, &priv->status);
+                                        iwl_perform_ct_kill_task(priv, true);
+                                } else {
+                                        iwl_prepare_ct_kill_task(priv);
+                                        tt->state = old_state;
+                                }
                         } else if (old_state == IWL_TI_CT_KILL &&
                                   tt->state != IWL_TI_CT_KILL) {
                                 IWL_DEBUG_POWER(priv, "Exit IWL_TI_CT_KILL\n");
@@ -665,10 +771,11 @@ static void iwl_bg_ct_enter(struct work_struct *work)
                               "- ucode going to sleep!\n");
                 if (!priv->thermal_throttle.advanced_tt)
                         iwl_legacy_tt_handler(priv,
-                                              IWL_MINIMAL_POWER_THRESHOLD);
+                                              IWL_MINIMAL_POWER_THRESHOLD,
+                                              true);
                 else
                         iwl_advance_tt_handler(priv,
-                                               CT_KILL_THRESHOLD + 1);
+                                               CT_KILL_THRESHOLD + 1, true);
         }
 }
 
@@ -695,11 +802,18 @@ static void iwl_bg_ct_exit(struct work_struct *work)
                 IWL_ERR(priv,
                         "Device temperature below critical"
                         "- ucode awake!\n");
+                /*
+                 * exit from CT_KILL state
+                 * reset the current temperature reading
+                 */
+                priv->temperature = 0;
                 if (!priv->thermal_throttle.advanced_tt)
                         iwl_legacy_tt_handler(priv,
-                                        IWL_REDUCED_PERFORMANCE_THRESHOLD_2);
+                                              IWL_REDUCED_PERFORMANCE_THRESHOLD_2,
+                                              true);
                 else
-                        iwl_advance_tt_handler(priv, CT_KILL_EXIT_THRESHOLD);
+                        iwl_advance_tt_handler(priv, CT_KILL_EXIT_THRESHOLD,
+                                               true);
         }
 }
 
@@ -735,9 +849,9 @@ static void iwl_bg_tt_work(struct work_struct *work)
                 temp = KELVIN_TO_CELSIUS(priv->temperature);
 
         if (!priv->thermal_throttle.advanced_tt)
-                iwl_legacy_tt_handler(priv, temp);
+                iwl_legacy_tt_handler(priv, temp, false);
         else
-                iwl_advance_tt_handler(priv, temp);
+                iwl_advance_tt_handler(priv, temp, false);
 }
 
 void iwl_tt_handler(struct iwl_priv *priv)
@@ -768,16 +882,18 @@ void iwl_tt_initialize(struct iwl_priv *priv)
         tt->state = IWL_TI_0;
         init_timer(&priv->thermal_throttle.ct_kill_exit_tm);
         priv->thermal_throttle.ct_kill_exit_tm.data = (unsigned long)priv;
-        priv->thermal_throttle.ct_kill_exit_tm.function = iwl_tt_check_exit_ct_kill;
-
+        priv->thermal_throttle.ct_kill_exit_tm.function =
+                iwl_tt_check_exit_ct_kill;
+        init_timer(&priv->thermal_throttle.ct_kill_waiting_tm);
+        priv->thermal_throttle.ct_kill_waiting_tm.data = (unsigned long)priv;
+        priv->thermal_throttle.ct_kill_waiting_tm.function =
+                iwl_tt_ready_for_ct_kill;
         /* setup deferred ct kill work */
         INIT_WORK(&priv->tt_work, iwl_bg_tt_work);
         INIT_WORK(&priv->ct_enter, iwl_bg_ct_enter);
         INIT_WORK(&priv->ct_exit, iwl_bg_ct_exit);
 
-        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
-        case CSR_HW_REV_TYPE_6x00:
-        case CSR_HW_REV_TYPE_6x50:
+        if (priv->cfg->adv_thermal_throttle) {
                 IWL_DEBUG_POWER(priv, "Advanced Thermal Throttling\n");
                 tt->restriction = kzalloc(sizeof(struct iwl_tt_restriction) *
                                          IWL_TI_STATE_MAX, GFP_KERNEL);
@@ -810,11 +926,9 @@ void iwl_tt_initialize(struct iwl_priv *priv)
                                 &restriction_range[0], size);
                         priv->thermal_throttle.advanced_tt = true;
                 }
-                break;
-        default:
+        } else {
                 IWL_DEBUG_POWER(priv, "Legacy Thermal Throttling\n");
                 priv->thermal_throttle.advanced_tt = false;
-                break;
         }
 }
 EXPORT_SYMBOL(iwl_tt_initialize);
@@ -826,6 +940,8 @@ void iwl_tt_exit(struct iwl_priv *priv)
 
         /* stop ct_kill_exit_tm timer if activated */
         del_timer_sync(&priv->thermal_throttle.ct_kill_exit_tm);
+        /* stop ct_kill_waiting_tm timer if activated */
+        del_timer_sync(&priv->thermal_throttle.ct_kill_waiting_tm);
         cancel_work_sync(&priv->tt_work);
         cancel_work_sync(&priv->ct_enter);
         cancel_work_sync(&priv->ct_exit);
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.h b/drivers/net/wireless/iwlwifi/iwl-power.h
index df6f6a49712b..5db91c10dcc8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.h
+++ b/drivers/net/wireless/iwlwifi/iwl-power.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -33,6 +33,7 @@
 #define IWL_ABSOLUTE_ZERO               0
 #define IWL_ABSOLUTE_MAX                0xFFFFFFFF
 #define IWL_TT_INCREASE_MARGIN  5
+#define IWL_TT_CT_KILL_MARGIN   3
 
 enum iwl_antenna_ok {
         IWL_ANT_OK_NONE,
@@ -110,6 +111,7 @@ struct iwl_tt_mgmt {
         struct iwl_tt_restriction *restriction;
         struct iwl_tt_trans *transaction;
         struct timer_list ct_kill_exit_tm;
+        struct timer_list ct_kill_waiting_tm;
 };
 
 enum iwl_power_level {
@@ -129,6 +131,7 @@ struct iwl_power_mgr {
 
 int iwl_power_update_mode(struct iwl_priv *priv, bool force);
 bool iwl_ht_enabled(struct iwl_priv *priv);
+bool iwl_within_ct_kill_margin(struct iwl_priv *priv);
 enum iwl_antenna_ok iwl_tx_ant_restriction(struct iwl_priv *priv);
 enum iwl_antenna_ok iwl_rx_ant_restriction(struct iwl_priv *priv);
 void iwl_tt_enter_ct_kill(struct iwl_priv *priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index d393e8f02102..d2d2a9174900 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -254,7 +254,8 @@
  * device.  A queue maps to only one (selectable by driver) Tx DMA channel,
  * but one DMA channel may take input from several queues.
  *
- * Tx DMA channels have dedicated purposes.  For 4965, they are used as follows:
+ * Tx DMA channels have dedicated purposes.  For 4965, they are used as follows
+ * (cf. default_queue_to_tx_fifo in iwl-4965.c):
  *
  * 0 -- EDCA BK (background) frames, lowest priority
  * 1 -- EDCA BE (best effort) frames, normal priority
@@ -265,9 +266,21 @@
  * 6 -- HCCA long frames
  * 7 -- not used by driver (device-internal only)
  *
+ * For 5000 series and up, they are used slightly differently
+ * (cf. iwl5000_default_queue_to_tx_fifo in iwl-5000.c):
+ *
+ * 0 -- EDCA BK (background) frames, lowest priority
+ * 1 -- EDCA BE (best effort) frames, normal priority
+ * 2 -- EDCA VI (video) frames, higher priority
+ * 3 -- EDCA VO (voice) and management frames, highest priority
+ * 4 -- (TBD)
+ * 5 -- HCCA short frames
+ * 6 -- HCCA long frames
+ * 7 -- Commands
+ *
  * Driver should normally map queues 0-6 to Tx DMA/FIFO channels 0-6.
- * In addition, driver can map queues 7-15 to Tx DMA/FIFO channels 0-3 to
- * support 11n aggregation via EDCA DMA channels.
+ * In addition, driver can map the remaining queues to Tx DMA/FIFO
+ * channels 0-3 to support 11n aggregation via EDCA DMA channels.
  *
  * The driver sets up each queue to work in one of two modes:
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 493626bcd3ec..e5eb339107dd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -28,6 +28,7 @@
  *****************************************************************************/
 
 #include <linux/etherdevice.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 #include <asm/unaligned.h>
 #include "iwl-eeprom.h"
@@ -123,12 +124,11 @@ EXPORT_SYMBOL(iwl_rx_queue_space);
 /**
  * iwl_rx_queue_update_write_ptr - Update the write pointer for the RX queue
  */
-int iwl_rx_queue_update_write_ptr(struct iwl_priv *priv, struct iwl_rx_queue *q)
+void iwl_rx_queue_update_write_ptr(struct iwl_priv *priv, struct iwl_rx_queue *q)
 {
         unsigned long flags;
         u32 rx_wrt_ptr_reg = priv->hw_params.rx_wrt_ptr_reg;
         u32 reg;
-        int ret = 0;
 
         spin_lock_irqsave(&q->lock, flags);
 
@@ -140,6 +140,8 @@ int iwl_rx_queue_update_write_ptr(struct iwl_priv *priv, struct iwl_rx_queue *q)
                 reg = iwl_read32(priv, CSR_UCODE_DRV_GP1);
 
                 if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
+                        IWL_DEBUG_INFO(priv, "Rx queue requesting wakeup, GP1 = 0x%x\n",
+                                      reg);
                         iwl_set_bit(priv, CSR_GP_CNTRL,
                                     CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
                         goto exit_unlock;
@@ -159,7 +161,6 @@ int iwl_rx_queue_update_write_ptr(struct iwl_priv *priv, struct iwl_rx_queue *q)
 
  exit_unlock:
         spin_unlock_irqrestore(&q->lock, flags);
-        return ret;
 }
 EXPORT_SYMBOL(iwl_rx_queue_update_write_ptr);
 /**
@@ -182,14 +183,13 @@ static inline __le32 iwl_dma_addr2rbd_ptr(struct iwl_priv *priv,
  * also updates the memory address in the firmware to reference the new
  * target buffer.
  */
-int iwl_rx_queue_restock(struct iwl_priv *priv)
+void iwl_rx_queue_restock(struct iwl_priv *priv)
 {
         struct iwl_rx_queue *rxq = &priv->rxq;
         struct list_head *element;
         struct iwl_rx_mem_buffer *rxb;
         unsigned long flags;
         int write;
-        int ret = 0;
 
         spin_lock_irqsave(&rxq->lock, flags);
         write = rxq->write & ~0x7;
@@ -200,7 +200,7 @@ int iwl_rx_queue_restock(struct iwl_priv *priv)
                 list_del(element);
 
                 /* Point to Rx buffer via next RBD in circular buffer */
-                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->aligned_dma_addr);
+                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->page_dma);
                 rxq->queue[rxq->write] = rxb;
                 rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
                 rxq->free_count--;
@@ -218,10 +218,8 @@ int iwl_rx_queue_restock(struct iwl_priv *priv)
                 spin_lock_irqsave(&rxq->lock, flags);
                 rxq->need_update = 1;
                 spin_unlock_irqrestore(&rxq->lock, flags);
-                ret = iwl_rx_queue_update_write_ptr(priv, rxq);
+                iwl_rx_queue_update_write_ptr(priv, rxq);
         }
-
-        return ret;
 }
 EXPORT_SYMBOL(iwl_rx_queue_restock);
 
@@ -239,8 +237,9 @@ void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
         struct iwl_rx_queue *rxq = &priv->rxq;
         struct list_head *element;
         struct iwl_rx_mem_buffer *rxb;
-        struct sk_buff *skb;
+        struct page *page;
         unsigned long flags;
+        gfp_t gfp_mask = priority;
 
         while (1) {
                 spin_lock_irqsave(&rxq->lock, flags);
@@ -251,30 +250,35 @@ void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                 spin_unlock_irqrestore(&rxq->lock, flags);
 
                 if (rxq->free_count > RX_LOW_WATERMARK)
-                        priority |= __GFP_NOWARN;
-                /* Alloc a new receive buffer */
-                skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
-                                                priority);
+                        gfp_mask |= __GFP_NOWARN;
+
+                if (priv->hw_params.rx_page_order > 0)
+                        gfp_mask |= __GFP_COMP;
 
-                if (!skb) {
+                /* Alloc a new receive buffer */
+                page = alloc_pages(gfp_mask, priv->hw_params.rx_page_order);
+                if (!page) {
                         if (net_ratelimit())
-                                IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n");
+                                IWL_DEBUG_INFO(priv, "alloc_pages failed, "
+                                               "order: %d\n",
+                                               priv->hw_params.rx_page_order);
+
                         if ((rxq->free_count <= RX_LOW_WATERMARK) &&
                             net_ratelimit())
-                                IWL_CRIT(priv, "Failed to allocate SKB buffer with %s. Only %u free buffers remaining.\n",
+                                IWL_CRIT(priv, "Failed to alloc_pages with %s. Only %u free buffers remaining.\n",
                                          priority == GFP_ATOMIC ?  "GFP_ATOMIC" : "GFP_KERNEL",
                                          rxq->free_count);
                         /* We don't reschedule replenish work here -- we will
                          * call the restock method and if it still needs
                          * more buffers it will schedule replenish */
-                        break;
+                        return;
                 }
 
                 spin_lock_irqsave(&rxq->lock, flags);
 
                 if (list_empty(&rxq->rx_used)) {
                         spin_unlock_irqrestore(&rxq->lock, flags);
-                        dev_kfree_skb_any(skb);
+                        __free_pages(page, priv->hw_params.rx_page_order);
                         return;
                 }
                 element = rxq->rx_used.next;
@@ -283,24 +287,21 @@ void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
 
                 spin_unlock_irqrestore(&rxq->lock, flags);
 
-                rxb->skb = skb;
-                /* Get physical address of RB/SKB */
-                rxb->real_dma_addr = pci_map_single(
-                                        priv->pci_dev,
-                                        rxb->skb->data,
-                                        priv->hw_params.rx_buf_size + 256,
-                                        PCI_DMA_FROMDEVICE);
+                rxb->page = page;
+                /* Get physical address of the RB */
+                rxb->page_dma = pci_map_page(priv->pci_dev, page, 0,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
                 /* dma address must be no more than 36 bits */
-                BUG_ON(rxb->real_dma_addr & ~DMA_BIT_MASK(36));
+                BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
                 /* and also 256 byte aligned! */
-                rxb->aligned_dma_addr = ALIGN(rxb->real_dma_addr, 256);
-                skb_reserve(rxb->skb, rxb->aligned_dma_addr - rxb->real_dma_addr);
+                BUG_ON(rxb->page_dma & DMA_BIT_MASK(8));
 
                 spin_lock_irqsave(&rxq->lock, flags);
 
                 list_add_tail(&rxb->list, &rxq->rx_free);
                 rxq->free_count++;
-                priv->alloc_rxb_skb++;
+                priv->alloc_rxb_page++;
 
                 spin_unlock_irqrestore(&rxq->lock, flags);
         }
@@ -336,19 +337,19 @@ void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
 {
         int i;
         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
-                if (rxq->pool[i].skb != NULL) {
-                        pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].real_dma_addr,
-                                         priv->hw_params.rx_buf_size + 256,
-                                         PCI_DMA_FROMDEVICE);
-                        dev_kfree_skb(rxq->pool[i].skb);
+                if (rxq->pool[i].page != NULL) {
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
+                        rxq->pool[i].page = NULL;
                 }
         }
 
-        pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
-                            rxq->dma_addr);
-        pci_free_consistent(priv->pci_dev, sizeof(struct iwl_rb_status),
-                            rxq->rb_stts, rxq->rb_stts_dma);
+        dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+                          rxq->dma_addr);
+        dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
+                          rxq->rb_stts, rxq->rb_stts_dma);
         rxq->bd = NULL;
         rxq->rb_stts  = NULL;
 }
@@ -357,7 +358,7 @@ EXPORT_SYMBOL(iwl_rx_queue_free);
 int iwl_rx_queue_alloc(struct iwl_priv *priv)
 {
         struct iwl_rx_queue *rxq = &priv->rxq;
-        struct pci_dev *dev = priv->pci_dev;
+        struct device *dev = &priv->pci_dev->dev;
         int i;
 
         spin_lock_init(&rxq->lock);
@@ -365,12 +366,13 @@ int iwl_rx_queue_alloc(struct iwl_priv *priv)
         INIT_LIST_HEAD(&rxq->rx_used);
 
         /* Alloc the circular buffer of Read Buffer Descriptors (RBDs) */
-        rxq->bd = pci_alloc_consistent(dev, 4 * RX_QUEUE_SIZE, &rxq->dma_addr);
+        rxq->bd = dma_alloc_coherent(dev, 4 * RX_QUEUE_SIZE, &rxq->dma_addr,
+                                     GFP_KERNEL);
         if (!rxq->bd)
                 goto err_bd;
 
-        rxq->rb_stts = pci_alloc_consistent(dev, sizeof(struct iwl_rb_status),
-                                        &rxq->rb_stts_dma);
+        rxq->rb_stts = dma_alloc_coherent(dev, sizeof(struct iwl_rb_status),
+                                          &rxq->rb_stts_dma, GFP_KERNEL);
         if (!rxq->rb_stts)
                 goto err_rb;
 
@@ -387,8 +389,8 @@ int iwl_rx_queue_alloc(struct iwl_priv *priv)
         return 0;
 
 err_rb:
-        pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
-                            rxq->dma_addr);
+        dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+                          rxq->dma_addr);
 err_bd:
         return -ENOMEM;
 }
@@ -405,14 +407,12 @@ void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
                 /* In the reset function, these buffers may have been allocated
                  * to an SKB, so we need to unmap and free potential storage */
-                if (rxq->pool[i].skb != NULL) {
-                        pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].real_dma_addr,
-                                         priv->hw_params.rx_buf_size + 256,
-                                         PCI_DMA_FROMDEVICE);
-                        priv->alloc_rxb_skb--;
-                        dev_kfree_skb(rxq->pool[i].skb);
-                        rxq->pool[i].skb = NULL;
+                if (rxq->pool[i].page != NULL) {
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
+                        rxq->pool[i].page = NULL;
                 }
                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
         }
@@ -470,7 +470,8 @@ int iwl_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
                            (rb_timeout << FH_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS)|
                            (rfdnlog << FH_RCSR_RX_CONFIG_RBDCB_SIZE_POS));
 
-        iwl_write32(priv, CSR_INT_COALESCING, 0x40);
+        /* Set interrupt coalescing timer to default (2048 usecs) */
+        iwl_write8(priv, CSR_INT_COALESCING, IWL_HOST_INT_TIMEOUT_DEF);
 
         return 0;
 }
@@ -491,13 +492,14 @@ void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_missed_beacon_notif *missed_beacon;
 
         missed_beacon = &pkt->u.missed_beacon;
-        if (le32_to_cpu(missed_beacon->consequtive_missed_beacons) > 5) {
+        if (le32_to_cpu(missed_beacon->consecutive_missed_beacons) >
+            priv->missed_beacon_threshold) {
                 IWL_DEBUG_CALIB(priv, "missed bcn cnsq %d totl %d rcd %d expctd %d\n",
-                    le32_to_cpu(missed_beacon->consequtive_missed_beacons),
+                    le32_to_cpu(missed_beacon->consecutive_missed_beacons),
                     le32_to_cpu(missed_beacon->total_missed_becons),
                     le32_to_cpu(missed_beacon->num_recvd_beacons),
                     le32_to_cpu(missed_beacon->num_expected_beacons));
@@ -507,6 +509,24 @@ void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_rx_missed_beacon_notif);
 
+void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
+                                          struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_spectrum_notification *report = &(pkt->u.spectrum_notif);
+
+        if (!report->state) {
+                IWL_DEBUG_11H(priv,
+                        "Spectrum Measure Notification: Start\n");
+                return;
+        }
+
+        memcpy(&priv->measure_report, report, sizeof(*report));
+        priv->measurement_status |= MEASUREMENT_READY;
+}
+EXPORT_SYMBOL(iwl_rx_spectrum_measure_notif);
+
+
 
 /* Calculate noise level, based on measurements during network silence just
  *   before arriving beacon.  This measurement can be done only if we know
@@ -548,13 +568,64 @@ static void iwl_rx_calc_noise(struct iwl_priv *priv)
                         priv->last_rx_noise);
 }
 
+#ifdef CONFIG_IWLWIFI_DEBUG
+/*
+ *  based on the assumption of all statistics counter are in DWORD
+ *  FIXME: This function is for debugging, do not deal with
+ *  the case of counters roll-over.
+ */
+static void iwl_accumulative_statistics(struct iwl_priv *priv,
+                                        __le32 *stats)
+{
+        int i;
+        __le32 *prev_stats;
+        u32 *accum_stats;
+        u32 *delta, *max_delta;
+
+        prev_stats = (__le32 *)&priv->statistics;
+        accum_stats = (u32 *)&priv->accum_statistics;
+        delta = (u32 *)&priv->delta_statistics;
+        max_delta = (u32 *)&priv->max_delta;
+
+        for (i = sizeof(__le32); i < sizeof(struct iwl_notif_statistics);
+             i += sizeof(__le32), stats++, prev_stats++, delta++,
+             max_delta++, accum_stats++) {
+                if (le32_to_cpu(*stats) > le32_to_cpu(*prev_stats)) {
+                        *delta = (le32_to_cpu(*stats) -
+                                le32_to_cpu(*prev_stats));
+                        *accum_stats += *delta;
+                        if (*delta > *max_delta)
+                                *max_delta = *delta;
+                }
+        }
+
+        /* reset accumulative statistics for "no-counter" type statistics */
+        priv->accum_statistics.general.temperature =
+                priv->statistics.general.temperature;
+        priv->accum_statistics.general.temperature_m =
+                priv->statistics.general.temperature_m;
+        priv->accum_statistics.general.ttl_timestamp =
+                priv->statistics.general.ttl_timestamp;
+        priv->accum_statistics.tx.tx_power.ant_a =
+                priv->statistics.tx.tx_power.ant_a;
+        priv->accum_statistics.tx.tx_power.ant_b =
+                priv->statistics.tx.tx_power.ant_b;
+        priv->accum_statistics.tx.tx_power.ant_c =
+                priv->statistics.tx.tx_power.ant_c;
+}
+#endif
+
 #define REG_RECALIB_PERIOD (60)
 
+#define PLCP_MSG "plcp_err exceeded %u, %u, %u, %u, %u, %d, %u mSecs\n"
 void iwl_rx_statistics(struct iwl_priv *priv,
                               struct iwl_rx_mem_buffer *rxb)
 {
         int change;
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        int combined_plcp_delta;
+        unsigned int plcp_msec;
+        unsigned long plcp_received_jiffies;
 
         IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
                      (int)sizeof(priv->statistics),
@@ -566,6 +637,59 @@ void iwl_rx_statistics(struct iwl_priv *priv,
                     STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
                    (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
 
+#ifdef CONFIG_IWLWIFI_DEBUG
+        iwl_accumulative_statistics(priv, (__le32 *)&pkt->u.stats);
+#endif
+        /*
+         * check for plcp_err and trigger radio reset if it exceeds
+         * the plcp error threshold plcp_delta.
+         */
+        plcp_received_jiffies = jiffies;
+        plcp_msec = jiffies_to_msecs((long) plcp_received_jiffies -
+                                        (long) priv->plcp_jiffies);
+        priv->plcp_jiffies = plcp_received_jiffies;
+        /*
+         * check to make sure plcp_msec is not 0 to prevent division
+         * by zero.
+         */
+        if (plcp_msec) {
+                combined_plcp_delta =
+                        (le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err) -
+                        le32_to_cpu(priv->statistics.rx.ofdm.plcp_err)) +
+                        (le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err) -
+                        le32_to_cpu(priv->statistics.rx.ofdm_ht.plcp_err));
+
+                if ((combined_plcp_delta > 0) &&
+                        ((combined_plcp_delta * 100) / plcp_msec) >
+                        priv->cfg->plcp_delta_threshold) {
+                        /*
+                         * if plcp_err exceed the threshold, the following
+                         * data is printed in csv format:
+                         *    Text: plcp_err exceeded %d,
+                         *    Received ofdm.plcp_err,
+                         *    Current ofdm.plcp_err,
+                         *    Received ofdm_ht.plcp_err,
+                         *    Current ofdm_ht.plcp_err,
+                         *    combined_plcp_delta,
+                         *    plcp_msec
+                         */
+                        IWL_DEBUG_RADIO(priv, PLCP_MSG,
+                                priv->cfg->plcp_delta_threshold,
+                                le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err),
+                                le32_to_cpu(priv->statistics.rx.ofdm.plcp_err),
+                                le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err),
+                                le32_to_cpu(
+                                        priv->statistics.rx.ofdm_ht.plcp_err),
+                                combined_plcp_delta, plcp_msec);
+
+                        /*
+                         * Reset the RF radio due to the high plcp
+                         * error rate
+                         */
+                        iwl_force_reset(priv, IWL_RF_RESET);
+                }
+        }
+
         memcpy(&priv->statistics, &pkt->u.stats, sizeof(priv->statistics));
 
         set_bit(STATUS_STATISTICS, &priv->status);
@@ -582,54 +706,30 @@ void iwl_rx_statistics(struct iwl_priv *priv,
                 iwl_rx_calc_noise(priv);
                 queue_work(priv->workqueue, &priv->run_time_calib_work);
         }
-
-        iwl_leds_background(priv);
-
         if (priv->cfg->ops->lib->temp_ops.temperature && change)
                 priv->cfg->ops->lib->temp_ops.temperature(priv);
 }
 EXPORT_SYMBOL(iwl_rx_statistics);
 
-#define PERFECT_RSSI (-20) /* dBm */
-#define WORST_RSSI (-95)   /* dBm */
-#define RSSI_RANGE (PERFECT_RSSI - WORST_RSSI)
-
-/* Calculate an indication of rx signal quality (a percentage, not dBm!).
- * See http://www.ces.clemson.edu/linux/signal_quality.shtml for info
- *   about formulas used below. */
-static int iwl_calc_sig_qual(int rssi_dbm, int noise_dbm)
+void iwl_reply_statistics(struct iwl_priv *priv,
+                              struct iwl_rx_mem_buffer *rxb)
 {
-        int sig_qual;
-        int degradation = PERFECT_RSSI - rssi_dbm;
-
-        /* If we get a noise measurement, use signal-to-noise ratio (SNR)
-         * as indicator; formula is (signal dbm - noise dbm).
-         * SNR at or above 40 is a great signal (100%).
-         * Below that, scale to fit SNR of 0 - 40 dB within 0 - 100% indicator.
-         * Weakest usable signal is usually 10 - 15 dB SNR. */
-        if (noise_dbm) {
-                if (rssi_dbm - noise_dbm >= 40)
-                        return 100;
-                else if (rssi_dbm < noise_dbm)
-                        return 0;
-                sig_qual = ((rssi_dbm - noise_dbm) * 5) / 2;
-
-        /* Else use just the signal level.
-         * This formula is a least squares fit of data points collected and
-         *   compared with a reference system that had a percentage (%) display
-         *   for signal quality. */
-        } else
-                sig_qual = (100 * (RSSI_RANGE * RSSI_RANGE) - degradation *
-                            (15 * RSSI_RANGE + 62 * degradation)) /
-                           (RSSI_RANGE * RSSI_RANGE);
-
-        if (sig_qual > 100)
-                sig_qual = 100;
-        else if (sig_qual < 1)
-                sig_qual = 0;
-
-        return sig_qual;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+
+        if (le32_to_cpu(pkt->u.stats.flag) & UCODE_STATISTICS_CLEAR_MSK) {
+#ifdef CONFIG_IWLWIFI_DEBUG
+                memset(&priv->accum_statistics, 0,
+                        sizeof(struct iwl_notif_statistics));
+                memset(&priv->delta_statistics, 0,
+                        sizeof(struct iwl_notif_statistics));
+                memset(&priv->max_delta, 0,
+                        sizeof(struct iwl_notif_statistics));
+#endif
+                IWL_DEBUG_RX(priv, "Statistics have been cleared\n");
+        }
+        iwl_rx_statistics(priv, rxb);
 }
+EXPORT_SYMBOL(iwl_reply_statistics);
 
 /* Calc max signal level (dBm) among 3 possible receivers */
 static inline int iwl_calc_rssi(struct iwl_priv *priv,
@@ -878,6 +978,10 @@ static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
                                         struct iwl_rx_mem_buffer *rxb,
                                         struct ieee80211_rx_status *stats)
 {
+        struct sk_buff *skb;
+        int ret = 0;
+        __le16 fc = hdr->frame_control;
+
         /* We only process data packets if the interface is open */
         if (unlikely(!priv->is_open)) {
                 IWL_DEBUG_DROP_LIMIT(priv,
@@ -890,15 +994,47 @@ static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
             iwl_set_decrypted_flag(priv, hdr, ampdu_status, stats))
                 return;
 
-        /* Resize SKB from mac header to end of packet */
-        skb_reserve(rxb->skb, (void *)hdr - (void *)rxb->skb->data);
-        skb_put(rxb->skb, len);
+        skb = alloc_skb(IWL_LINK_HDR_MAX * 2, GFP_ATOMIC);
+        if (!skb) {
+                IWL_ERR(priv, "alloc_skb failed\n");
+                return;
+        }
+
+        skb_reserve(skb, IWL_LINK_HDR_MAX);
+        skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len);
+
+        /* mac80211 currently doesn't support paged SKB. Convert it to
+         * linear SKB for management frame and data frame requires
+         * software decryption or software defragementation. */
+        if (ieee80211_is_mgmt(fc) ||
+            ieee80211_has_protected(fc) ||
+            ieee80211_has_morefrags(fc) ||
+            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG ||
+            (ieee80211_is_data_qos(fc) &&
+             *ieee80211_get_qos_ctl(hdr) &
+             IEEE80211_QOS_CONTROL_A_MSDU_PRESENT))
+                ret = skb_linearize(skb);
+        else
+                ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
+                         0 : -ENOMEM;
+
+        if (ret) {
+                kfree_skb(skb);
+                goto out;
+        }
 
-        iwl_update_stats(priv, false, hdr->frame_control, len);
-        memcpy(IEEE80211_SKB_RXCB(rxb->skb), stats, sizeof(*stats));
-        ieee80211_rx_irqsafe(priv->hw, rxb->skb);
-        priv->alloc_rxb_skb--;
-        rxb->skb = NULL;
+        /*
+         * XXX: We cannot touch the page and its virtual memory (hdr) after
+         * here. It might have already been freed by the above skb change.
+         */
+
+        iwl_update_stats(priv, false, fc, len);
+        memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
+
+        ieee80211_rx(priv->hw, skb);
+ out:
+        priv->alloc_rxb_page--;
+        rxb->page = NULL;
 }
 
 /* This is necessary only for a number of statistics, see the caller. */
@@ -926,13 +1062,12 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
 {
         struct ieee80211_hdr *header;
         struct ieee80211_rx_status rx_status;
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_rx_phy_res *phy_res;
         __le32 rx_pkt_status;
         struct iwl4965_rx_mpdu_res_start *amsdu;
         u32 len;
         u32 ampdu_status;
-        u16 fc;
         u32 rate_n_flags;
 
         /**
@@ -1009,11 +1144,8 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
         if (iwl_is_associated(priv) &&
             !test_bit(STATUS_SCANNING, &priv->status)) {
                 rx_status.noise = priv->last_rx_noise;
-                rx_status.qual = iwl_calc_sig_qual(rx_status.signal,
-                                                         rx_status.noise);
         } else {
                 rx_status.noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
-                rx_status.qual = iwl_calc_sig_qual(rx_status.signal, 0);
         }
 
         /* Reset beacon noise level if not associated. */
@@ -1026,8 +1158,8 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
                 iwl_dbg_report_frame(priv, phy_res, len, header, 1);
 #endif
         iwl_dbg_log_rx_data_frame(priv, len, header);
-        IWL_DEBUG_STATS_LIMIT(priv, "Rssi %d, noise %d, qual %d, TSF %llu\n",
-                rx_status.signal, rx_status.noise, rx_status.qual,
+        IWL_DEBUG_STATS_LIMIT(priv, "Rssi %d, noise %d, TSF %llu\n",
+                rx_status.signal, rx_status.noise,
                 (unsigned long long)rx_status.mactime);
 
         /*
@@ -1065,20 +1197,8 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
                 priv->last_tsf = le64_to_cpu(phy_res->timestamp);
         }
 
-        fc = le16_to_cpu(header->frame_control);
-        switch (fc & IEEE80211_FCTL_FTYPE) {
-        case IEEE80211_FTYPE_MGMT:
-        case IEEE80211_FTYPE_DATA:
-                if (priv->iw_mode == NL80211_IFTYPE_AP)
-                        iwl_update_ps_mode(priv, fc  & IEEE80211_FCTL_PM,
-                                                header->addr2);
-                /* fall through */
-        default:
-                iwl_pass_packet_to_mac80211(priv, header, len, ampdu_status,
-                                rxb, &rx_status);
-                break;
-
-        }
+        iwl_pass_packet_to_mac80211(priv, header, len, ampdu_status,
+                                    rxb, &rx_status);
 }
 EXPORT_SYMBOL(iwl_rx_reply_rx);
 
@@ -1087,7 +1207,7 @@ EXPORT_SYMBOL(iwl_rx_reply_rx);
 void iwl_rx_reply_rx_phy(struct iwl_priv *priv,
                                     struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         priv->last_phy_res[0] = 1;
         memcpy(&priv->last_phy_res[1], &(pkt->u.raw[0]),
                sizeof(struct iwl_rx_phy_res));
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 4f3a108fa990..741e65ec8301 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -25,9 +25,9 @@
  *  Intel Linux Wireless <ilw@linux.intel.com>
  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  *****************************************************************************/
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/etherdevice.h>
-#include <net/lib80211.h>
 #include <net/mac80211.h>
 
 #include "iwl-eeprom.h"
@@ -112,7 +112,7 @@ EXPORT_SYMBOL(iwl_scan_cancel_timeout);
 static int iwl_send_scan_abort(struct iwl_priv *priv)
 {
         int ret = 0;
-        struct iwl_rx_packet *res;
+        struct iwl_rx_packet *pkt;
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SCAN_ABORT_CMD,
                 .flags = CMD_WANT_SKB,
@@ -132,21 +132,20 @@ static int iwl_send_scan_abort(struct iwl_priv *priv)
                 return ret;
         }
 
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
-        if (res->u.status != CAN_ABORT_STATUS) {
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
+        if (pkt->u.status != CAN_ABORT_STATUS) {
                 /* The scan abort will return 1 for success or
                  * 2 for "failure".  A failure condition can be
                  * due to simply not being in an active scan which
                  * can occur if we send the scan abort before we
                  * the microcode has notified us that a scan is
                  * completed. */
-                IWL_DEBUG_INFO(priv, "SCAN_ABORT returned %d.\n", res->u.status);
+                IWL_DEBUG_INFO(priv, "SCAN_ABORT returned %d.\n", pkt->u.status);
                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
                 clear_bit(STATUS_SCAN_HW, &priv->status);
         }
 
-        priv->alloc_rxb_skb--;
-        dev_kfree_skb_any(cmd.reply_skb);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return ret;
 }
@@ -156,7 +155,7 @@ static void iwl_rx_reply_scan(struct iwl_priv *priv,
                               struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_scanreq_notification *notif =
             (struct iwl_scanreq_notification *)pkt->u.raw;
 
@@ -168,7 +167,7 @@ static void iwl_rx_reply_scan(struct iwl_priv *priv,
 static void iwl_rx_scan_start_notif(struct iwl_priv *priv,
                                     struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_scanstart_notification *notif =
             (struct iwl_scanstart_notification *)pkt->u.raw;
         priv->scan_start_tsf = le32_to_cpu(notif->tsf_low);
@@ -187,26 +186,24 @@ static void iwl_rx_scan_results_notif(struct iwl_priv *priv,
                                       struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_scanresults_notification *notif =
             (struct iwl_scanresults_notification *)pkt->u.raw;
 
         IWL_DEBUG_SCAN(priv, "Scan ch.res: "
                        "%d [802.11%s] "
                        "(TSF: 0x%08X:%08X) - %d "
-                       "elapsed=%lu usec (%dms since last)\n",
+                       "elapsed=%lu usec\n",
                        notif->channel,
                        notif->band ? "bg" : "a",
                        le32_to_cpu(notif->tsf_high),
                        le32_to_cpu(notif->tsf_low),
                        le32_to_cpu(notif->statistics[0]),
-                       le32_to_cpu(notif->tsf_low) - priv->scan_start_tsf,
-                       jiffies_to_msecs(elapsed_jiffies
-                                        (priv->last_scan_jiffies, jiffies)));
+                       le32_to_cpu(notif->tsf_low) - priv->scan_start_tsf);
 #endif
 
-        priv->last_scan_jiffies = jiffies;
-        priv->next_scan_jiffies = 0;
+        if (!priv->is_internal_short_scan)
+                priv->next_scan_jiffies = 0;
 }
 
 /* Service SCAN_COMPLETE_NOTIFICATION (0x84) */
@@ -214,7 +211,7 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
                                        struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_scancomplete_notification *scan_notif = (void *)pkt->u.raw;
 
         IWL_DEBUG_SCAN(priv, "Scan complete: %d channels (TSF 0x%08X:%08X) - %d\n",
@@ -252,8 +249,9 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
                         goto reschedule;
         }
 
-        priv->last_scan_jiffies = jiffies;
-        priv->next_scan_jiffies = 0;
+        if (!priv->is_internal_short_scan)
+                priv->next_scan_jiffies = 0;
+
         IWL_DEBUG_INFO(priv, "Setting scan to off\n");
 
         clear_bit(STATUS_SCANNING, &priv->status);
@@ -316,6 +314,72 @@ u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_get_passive_dwell_time);
 
+static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
+                                     enum ieee80211_band band,
+                                     struct iwl_scan_channel *scan_ch)
+{
+        const struct ieee80211_supported_band *sband;
+        const struct iwl_channel_info *ch_info;
+        u16 passive_dwell = 0;
+        u16 active_dwell = 0;
+        int i, added = 0;
+        u16 channel = 0;
+
+        sband = iwl_get_hw_mode(priv, band);
+        if (!sband) {
+                IWL_ERR(priv, "invalid band\n");
+                return added;
+        }
+
+        active_dwell = iwl_get_active_dwell_time(priv, band, 0);
+        passive_dwell = iwl_get_passive_dwell_time(priv, band);
+
+        if (passive_dwell <= active_dwell)
+                passive_dwell = active_dwell + 1;
+
+        /* only scan single channel, good enough to reset the RF */
+        /* pick the first valid not in-use channel */
+        if (band == IEEE80211_BAND_5GHZ) {
+                for (i = 14; i < priv->channel_count; i++) {
+                        if (priv->channel_info[i].channel !=
+                            le16_to_cpu(priv->staging_rxon.channel)) {
+                                channel = priv->channel_info[i].channel;
+                                ch_info = iwl_get_channel_info(priv,
+                                        band, channel);
+                                if (is_channel_valid(ch_info))
+                                        break;
+                        }
+                }
+        } else {
+                for (i = 0; i < 14; i++) {
+                        if (priv->channel_info[i].channel !=
+                            le16_to_cpu(priv->staging_rxon.channel)) {
+                                        channel =
+                                                priv->channel_info[i].channel;
+                                        ch_info = iwl_get_channel_info(priv,
+                                                band, channel);
+                                        if (is_channel_valid(ch_info))
+                                                break;
+                        }
+                }
+        }
+        if (channel) {
+                scan_ch->channel = cpu_to_le16(channel);
+                scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
+                scan_ch->active_dwell = cpu_to_le16(active_dwell);
+                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
+                /* Set txpower levels to defaults */
+                scan_ch->dsp_atten = 110;
+                if (band == IEEE80211_BAND_5GHZ)
+                        scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
+                else
+                        scan_ch->tx_gain = ((1 << 5) | (5 << 3));
+                added++;
+        } else
+                IWL_ERR(priv, "no valid channel found\n");
+        return added;
+}
+
 static int iwl_get_channels_for_scan(struct iwl_priv *priv,
                                      enum ieee80211_band band,
                                      u8 is_active, u8 n_probes,
@@ -402,26 +466,15 @@ void iwl_init_scan_params(struct iwl_priv *priv)
         if (!priv->scan_tx_ant[IEEE80211_BAND_2GHZ])
                 priv->scan_tx_ant[IEEE80211_BAND_2GHZ] = ant_idx;
 }
+EXPORT_SYMBOL(iwl_init_scan_params);
 
 static int iwl_scan_initiate(struct iwl_priv *priv)
 {
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_SCAN(priv, "Aborting scan due to not ready.\n");
-                return -EIO;
-        }
-
-        if (test_bit(STATUS_SCANNING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                return -EAGAIN;
-        }
-
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                return -EAGAIN;
-        }
+        WARN_ON(!mutex_is_locked(&priv->mutex));
 
         IWL_DEBUG_INFO(priv, "Starting scan...\n");
         set_bit(STATUS_SCANNING, &priv->status);
+        priv->is_internal_short_scan = false;
         priv->scan_start = jiffies;
         priv->scan_pass_start = priv->scan_start;
 
@@ -450,6 +503,18 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
                 goto out_unlock;
         }
 
+        if (test_bit(STATUS_SCANNING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
+                ret = -EAGAIN;
+                goto out_unlock;
+        }
+
+        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
+                ret = -EAGAIN;
+                goto out_unlock;
+        }
+
         /* We don't schedule scan within next_scan_jiffies period.
          * Avoid scanning during possible EAPOL exchange, return
          * success immediately.
@@ -462,15 +527,6 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
                 goto out_unlock;
         }
 
-        /* if we just finished scan ask for delay */
-        if (iwl_is_associated(priv) && priv->last_scan_jiffies &&
-            time_after(priv->last_scan_jiffies + IWL_DELAY_NEXT_SCAN, jiffies)) {
-                IWL_DEBUG_SCAN(priv, "scan rejected: within previous scan period\n");
-                queue_work(priv->workqueue, &priv->scan_completed);
-                ret = 0;
-                goto out_unlock;
-        }
-
         priv->scan_bands = 0;
         for (i = 0; i < req->n_channels; i++)
                 priv->scan_bands |= BIT(req->channels[i]->band);
@@ -489,6 +545,52 @@ out_unlock:
 }
 EXPORT_SYMBOL(iwl_mac_hw_scan);
 
+/*
+ * internal short scan, this function should only been called while associated.
+ * It will reset and tune the radio to prevent possible RF related problem
+ */
+void iwl_internal_short_hw_scan(struct iwl_priv *priv)
+{
+        queue_work(priv->workqueue, &priv->start_internal_scan);
+}
+
+static void iwl_bg_start_internal_scan(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+                container_of(work, struct iwl_priv, start_internal_scan);
+
+        mutex_lock(&priv->mutex);
+
+        if (!iwl_is_ready_rf(priv)) {
+                IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
+                goto unlock;
+        }
+
+        if (test_bit(STATUS_SCANNING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
+                goto unlock;
+        }
+
+        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
+                goto unlock;
+        }
+
+        priv->scan_bands = 0;
+        if (priv->band == IEEE80211_BAND_5GHZ)
+                priv->scan_bands |= BIT(IEEE80211_BAND_5GHZ);
+        else
+                priv->scan_bands |= BIT(IEEE80211_BAND_2GHZ);
+
+        IWL_DEBUG_SCAN(priv, "Start internal short scan...\n");
+        set_bit(STATUS_SCANNING, &priv->status);
+        priv->is_internal_short_scan = true;
+        queue_work(priv->workqueue, &priv->request_scan);
+ unlock:
+        mutex_unlock(&priv->mutex);
+}
+EXPORT_SYMBOL(iwl_internal_short_hw_scan);
+
 #define IWL_SCAN_CHECK_WATCHDOG (7 * HZ)
 
 void iwl_bg_scan_check(struct work_struct *data)
@@ -552,7 +654,8 @@ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
         if (WARN_ON(left < ie_len))
                 return len;
 
-        memcpy(pos, ies, ie_len);
+        if (ies)
+                memcpy(pos, ies, ie_len);
         len += ie_len;
         left -= ie_len;
 
@@ -581,6 +684,7 @@ static void iwl_bg_request_scan(struct work_struct *data)
         u8 rate;
         bool is_active = false;
         int  chan_mod;
+        u8 active_chains;
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
@@ -654,7 +758,6 @@ static void iwl_bg_request_scan(struct work_struct *data)
                 unsigned long flags;
 
                 IWL_DEBUG_INFO(priv, "Scanning while associated...\n");
-
                 spin_lock_irqsave(&priv->lock, flags);
                 interval = priv->beacon_int;
                 spin_unlock_irqrestore(&priv->lock, flags);
@@ -672,7 +775,9 @@ static void iwl_bg_request_scan(struct work_struct *data)
                                scan_suspend_time, interval);
         }
 
-        if (priv->scan_request->n_ssids) {
+        if (priv->is_internal_short_scan) {
+                IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
+        } else if (priv->scan_request->n_ssids) {
                 int i, p = 0;
                 IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
                 for (i = 0; i < priv->scan_request->n_ssids; i++) {
@@ -708,16 +813,29 @@ static void iwl_bg_request_scan(struct work_struct *data)
                         rate = IWL_RATE_1M_PLCP;
                         rate_flags = RATE_MCS_CCK_MSK;
                 }
-                scan->good_CRC_th = 0;
+                scan->good_CRC_th = IWL_GOOD_CRC_TH_DISABLED;
         } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
                 band = IEEE80211_BAND_5GHZ;
                 rate = IWL_RATE_6M_PLCP;
                 /*
-                 * If active scaning is requested but a certain channel
-                 * is marked passive, we can do active scanning if we
-                 * detect transmissions.
+                 * If active scanning is requested but a certain channel is
+                 * marked passive, we can do active scanning if we detect
+                 * transmissions.
+                 *
+                 * There is an issue with some firmware versions that triggers
+                 * a sysassert on a "good CRC threshold" of zero (== disabled),
+                 * on a radar channel even though this means that we should NOT
+                 * send probes.
+                 *
+                 * The "good CRC threshold" is the number of frames that we
+                 * need to receive during our dwell time on a channel before
+                 * sending out probes -- setting this to a huge value will
+                 * mean we never reach it, but at the same time work around
+                 * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
+                 * here instead of IWL_GOOD_CRC_TH_DISABLED.
                  */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_NEVER;
 
                 /* Force use of chains B and C (0x6) for scan Rx for 4965
                  * Avoid A (0x1) because of its off-channel reception on A-band.
@@ -734,30 +852,57 @@ static void iwl_bg_request_scan(struct work_struct *data)
         rate_flags |= iwl_ant_idx_to_flags(priv->scan_tx_ant[band]);
         scan->tx_cmd.rate_n_flags = iwl_hw_set_rate_n_flags(rate, rate_flags);
 
+        /* In power save mode use one chain, otherwise use all chains */
+        if (test_bit(STATUS_POWER_PMI, &priv->status)) {
+                /* rx_ant has been set to all valid chains previously */
+                active_chains = rx_ant &
+                                ((u8)(priv->chain_noise_data.active_chains));
+                if (!active_chains)
+                        active_chains = rx_ant;
+
+                IWL_DEBUG_SCAN(priv, "chain_noise_data.active_chains: %u\n",
+                                priv->chain_noise_data.active_chains);
+
+                rx_ant = first_antenna(active_chains);
+        }
         /* MIMO is not used here, but value is required */
-        rx_chain |= ANT_ABC << RXON_RX_CHAIN_VALID_POS;
-        rx_chain |= ANT_ABC << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
+        rx_chain |= priv->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
+        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
         rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
         rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
         scan->rx_chain = cpu_to_le16(rx_chain);
-        cmd_len = iwl_fill_probe_req(priv,
-                                (struct ieee80211_mgmt *)scan->data,
-                                priv->scan_request->ie,
-                                priv->scan_request->ie_len,
-                                IWL_MAX_SCAN_SIZE - sizeof(*scan));
+        if (!priv->is_internal_short_scan) {
+                cmd_len = iwl_fill_probe_req(priv,
+                                        (struct ieee80211_mgmt *)scan->data,
+                                        priv->scan_request->ie,
+                                        priv->scan_request->ie_len,
+                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
+        } else {
+                cmd_len = iwl_fill_probe_req(priv,
+                                        (struct ieee80211_mgmt *)scan->data,
+                                        NULL, 0,
+                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
 
+        }
         scan->tx_cmd.len = cpu_to_le16(cmd_len);
-
         if (iwl_is_monitor_mode(priv))
                 scan->filter_flags = RXON_FILTER_PROMISC_MSK;
 
         scan->filter_flags |= (RXON_FILTER_ACCEPT_GRP_MSK |
                                RXON_FILTER_BCON_AWARE_MSK);
 
-        scan->channel_count =
-                iwl_get_channels_for_scan(priv, band, is_active, n_probes,
-                        (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
-
+        if (priv->is_internal_short_scan) {
+                scan->channel_count =
+                        iwl_get_single_channel_for_scan(priv, band,
+                                (void *)&scan->data[le16_to_cpu(
+                                scan->tx_cmd.len)]);
+        } else {
+                scan->channel_count =
+                        iwl_get_channels_for_scan(priv, band,
+                                is_active, n_probes,
+                                (void *)&scan->data[le16_to_cpu(
+                                scan->tx_cmd.len)]);
+        }
         if (scan->channel_count == 0) {
                 IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
                 goto done;
@@ -818,7 +963,12 @@ void iwl_bg_scan_completed(struct work_struct *work)
 
         cancel_delayed_work(&priv->scan_check);
 
-        ieee80211_scan_completed(priv->hw, false);
+        if (!priv->is_internal_short_scan)
+                ieee80211_scan_completed(priv->hw, false);
+        else {
+                priv->is_internal_short_scan = false;
+                IWL_DEBUG_SCAN(priv, "internal short scan completed\n");
+        }
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
@@ -836,6 +986,7 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
         INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
         INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
+        INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
         INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 }
 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
diff --git a/drivers/net/wireless/iwlwifi/iwl-spectrum.c b/drivers/net/wireless/iwlwifi/iwl-spectrum.c
deleted file mode 100644
index 022bcf115731..000000000000
--- a/drivers/net/wireless/iwlwifi/iwl-spectrum.c
+++ /dev/null
@@ -1,198 +0,0 @@
-/******************************************************************************
- *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
- *
- * Portions of this file are derived from the ipw3945 project, as well
- * as portions of the ieee80211 subsystem header files.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
- *
- * The full GNU General Public License is included in this distribution in the
- * file called LICENSE.
- *
- * Contact Information:
- *  Intel Linux Wireless <ilw@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- *****************************************************************************/
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/pci.h>
-#include <linux/delay.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/wireless.h>
-
-#include <net/mac80211.h>
-
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
-#include "iwl-core.h"
-#include "iwl-io.h"
-#include "iwl-spectrum.h"
-
-#define BEACON_TIME_MASK_LOW    0x00FFFFFF
-#define BEACON_TIME_MASK_HIGH   0xFF000000
-#define TIME_UNIT               1024
-
-/*
- * extended beacon time format
- * time in usec will be changed into a 32-bit value in 8:24 format
- * the high 1 byte is the beacon counts
- * the lower 3 bytes is the time in usec within one beacon interval
- */
-
-/* TOOD: was used in sysfs debug interface need to add to mac */
-#if 0
-static u32 iwl_usecs_to_beacons(u32 usec, u32 beacon_interval)
-{
-        u32 quot;
-        u32 rem;
-        u32 interval = beacon_interval * 1024;
-
-        if (!interval || !usec)
-                return 0;
-
-        quot = (usec / interval) & (BEACON_TIME_MASK_HIGH >> 24);
-        rem = (usec % interval) & BEACON_TIME_MASK_LOW;
-
-        return (quot << 24) + rem;
-}
-
-/* base is usually what we get from ucode with each received frame,
- * the same as HW timer counter counting down
- */
-
-static __le32 iwl_add_beacon_time(u32 base, u32 addon, u32 beacon_interval)
-{
-        u32 base_low = base & BEACON_TIME_MASK_LOW;
-        u32 addon_low = addon & BEACON_TIME_MASK_LOW;
-        u32 interval = beacon_interval * TIME_UNIT;
-        u32 res = (base & BEACON_TIME_MASK_HIGH) +
-            (addon & BEACON_TIME_MASK_HIGH);
-
-        if (base_low > addon_low)
-                res += base_low - addon_low;
-        else if (base_low < addon_low) {
-                res += interval + base_low - addon_low;
-                res += (1 << 24);
-        } else
-                res += (1 << 24);
-
-        return cpu_to_le32(res);
-}
-static int iwl_get_measurement(struct iwl_priv *priv,
-                               struct ieee80211_measurement_params *params,
-                               u8 type)
-{
-        struct iwl4965_spectrum_cmd spectrum;
-        struct iwl_rx_packet *res;
-        struct iwl_host_cmd cmd = {
-                .id = REPLY_SPECTRUM_MEASUREMENT_CMD,
-                .data = (void *)&spectrum,
-                .meta.flags = CMD_WANT_SKB,
-        };
-        u32 add_time = le64_to_cpu(params->start_time);
-        int rc;
-        int spectrum_resp_status;
-        int duration = le16_to_cpu(params->duration);
-
-        if (iwl_is_associated(priv))
-                add_time =
-                    iwl_usecs_to_beacons(
-                        le64_to_cpu(params->start_time) - priv->last_tsf,
-                        le16_to_cpu(priv->rxon_timing.beacon_interval));
-
-        memset(&spectrum, 0, sizeof(spectrum));
-
-        spectrum.channel_count = cpu_to_le16(1);
-        spectrum.flags =
-            RXON_FLG_TSF2HOST_MSK | RXON_FLG_ANT_A_MSK | RXON_FLG_DIS_DIV_MSK;
-        spectrum.filter_flags = MEASUREMENT_FILTER_FLAG;
-        cmd.len = sizeof(spectrum);
-        spectrum.len = cpu_to_le16(cmd.len - sizeof(spectrum.len));
-
-        if (iwl_is_associated(priv))
-                spectrum.start_time =
-                    iwl_add_beacon_time(priv->last_beacon_time,
-                                add_time,
-                                le16_to_cpu(priv->rxon_timing.beacon_interval));
-        else
-                spectrum.start_time = 0;
-
-        spectrum.channels[0].duration = cpu_to_le32(duration * TIME_UNIT);
-        spectrum.channels[0].channel = params->channel;
-        spectrum.channels[0].type = type;
-        if (priv->active_rxon.flags & RXON_FLG_BAND_24G_MSK)
-                spectrum.flags |= RXON_FLG_BAND_24G_MSK |
-                    RXON_FLG_AUTO_DETECT_MSK | RXON_FLG_TGG_PROTECT_MSK;
-
-        rc = iwl_send_cmd_sync(priv, &cmd);
-        if (rc)
-                return rc;
-
-        res = (struct iwl_rx_packet *)cmd.meta.u.skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
-                IWL_ERR(priv, "Bad return from REPLY_RX_ON_ASSOC command\n");
-                rc = -EIO;
-        }
-
-        spectrum_resp_status = le16_to_cpu(res->u.spectrum.status);
-        switch (spectrum_resp_status) {
-        case 0:         /* Command will be handled */
-                if (res->u.spectrum.id != 0xff) {
-                        IWL_DEBUG_INFO(priv,
-                                "Replaced existing measurement: %d\n",
-                                res->u.spectrum.id);
-                        priv->measurement_status &= ~MEASUREMENT_READY;
-                }
-                priv->measurement_status |= MEASUREMENT_ACTIVE;
-                rc = 0;
-                break;
-
-        case 1:         /* Command will not be handled */
-                rc = -EAGAIN;
-                break;
-        }
-
-        dev_kfree_skb_any(cmd.meta.u.skb);
-
-        return rc;
-}
-#endif
-
-static void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
-                                          struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
-        struct iwl_spectrum_notification *report = &(pkt->u.spectrum_notif);
-
-        if (!report->state) {
-                IWL_DEBUG_11H(priv,
-                        "Spectrum Measure Notification: Start\n");
-                return;
-        }
-
-        memcpy(&priv->measure_report, report, sizeof(*report));
-        priv->measurement_status |= MEASUREMENT_READY;
-}
-
-void iwl_setup_spectrum_handlers(struct iwl_priv *priv)
-{
-        priv->rx_handlers[SPECTRUM_MEASURE_NOTIFICATION] =
-                        iwl_rx_spectrum_measure_notif;
-}
-EXPORT_SYMBOL(iwl_setup_spectrum_handlers);
diff --git a/drivers/net/wireless/iwlwifi/iwl-spectrum.h b/drivers/net/wireless/iwlwifi/iwl-spectrum.h
index a77c1e619062..af6babee2891 100644
--- a/drivers/net/wireless/iwlwifi/iwl-spectrum.h
+++ b/drivers/net/wireless/iwlwifi/iwl-spectrum.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ieee80211 subsystem header files.
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index c6633fec8216..4a6686fa6b36 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -80,59 +80,109 @@ int iwl_get_ra_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
 }
 EXPORT_SYMBOL(iwl_get_ra_sta_id);
 
+/* priv->sta_lock must be held */
 static void iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
 
         if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE))
-                IWL_ERR(priv, "ACTIVATE a non DRIVER active station %d\n",
-                        sta_id);
-
-        priv->stations[sta_id].used |= IWL_STA_UCODE_ACTIVE;
-        IWL_DEBUG_ASSOC(priv, "Added STA to Ucode: %pM\n",
-                        priv->stations[sta_id].sta.sta.addr);
+                IWL_ERR(priv, "ACTIVATE a non DRIVER active station id %u addr %pM\n",
+                        sta_id, priv->stations[sta_id].sta.sta.addr);
 
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
+        if (priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE) {
+                IWL_DEBUG_ASSOC(priv,
+                                "STA id %u addr %pM already present in uCode (according to driver)\n",
+                                sta_id, priv->stations[sta_id].sta.sta.addr);
+        } else {
+                priv->stations[sta_id].used |= IWL_STA_UCODE_ACTIVE;
+                IWL_DEBUG_ASSOC(priv, "Added STA id %u addr %pM to uCode\n",
+                                sta_id, priv->stations[sta_id].sta.sta.addr);
+        }
 }
 
-static void iwl_add_sta_callback(struct iwl_priv *priv,
-                                 struct iwl_device_cmd *cmd,
-                                 struct sk_buff *skb)
+static void iwl_process_add_sta_resp(struct iwl_priv *priv,
+                                     struct iwl_addsta_cmd *addsta,
+                                     struct iwl_rx_packet *pkt,
+                                     bool sync)
 {
-        struct iwl_rx_packet *res = NULL;
-        struct iwl_addsta_cmd *addsta =
-                (struct iwl_addsta_cmd *)cmd->cmd.payload;
         u8 sta_id = addsta->sta.sta_id;
+        unsigned long flags;
 
-        if (!skb) {
-                IWL_ERR(priv, "Error: Response NULL in REPLY_ADD_STA.\n");
-                return;
-        }
-
-        res = (struct iwl_rx_packet *)skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_ADD_STA (0x%08X)\n",
-                          res->hdr.flags);
+                        pkt->hdr.flags);
                 return;
         }
 
-        switch (res->u.add_sta.status) {
+        IWL_DEBUG_INFO(priv, "Processing response for adding station %u\n",
+                       sta_id);
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+
+        switch (pkt->u.add_sta.status) {
         case ADD_STA_SUCCESS_MSK:
+                IWL_DEBUG_INFO(priv, "REPLY_ADD_STA PASSED\n");
                 iwl_sta_ucode_activate(priv, sta_id);
-                 /* fall through */
+                break;
+        case ADD_STA_NO_ROOM_IN_TABLE:
+                IWL_ERR(priv, "Adding station %d failed, no room in table.\n",
+                        sta_id);
+                break;
+        case ADD_STA_NO_BLOCK_ACK_RESOURCE:
+                IWL_ERR(priv, "Adding station %d failed, no block ack resource.\n",
+                        sta_id);
+                break;
+        case ADD_STA_MODIFY_NON_EXIST_STA:
+                IWL_ERR(priv, "Attempting to modify non-existing station %d \n",
+                        sta_id);
+                break;
         default:
-                IWL_DEBUG_HC(priv, "Received REPLY_ADD_STA:(0x%08X)\n",
-                             res->u.add_sta.status);
+                IWL_DEBUG_ASSOC(priv, "Received REPLY_ADD_STA:(0x%08X)\n",
+                                pkt->u.add_sta.status);
                 break;
         }
+
+        IWL_DEBUG_INFO(priv, "%s station id %u addr %pM\n",
+                       priv->stations[sta_id].sta.mode ==
+                       STA_CONTROL_MODIFY_MSK ?  "Modified" : "Added",
+                       sta_id, priv->stations[sta_id].sta.sta.addr);
+
+        /*
+         * XXX: The MAC address in the command buffer is often changed from
+         * the original sent to the device. That is, the MAC address
+         * written to the command buffer often is not the same MAC adress
+         * read from the command buffer when the command returns. This
+         * issue has not yet been resolved and this debugging is left to
+         * observe the problem.
+         */
+        IWL_DEBUG_INFO(priv, "%s station according to cmd buffer %pM\n",
+                       priv->stations[sta_id].sta.mode ==
+                       STA_CONTROL_MODIFY_MSK ? "Modified" : "Added",
+                       addsta->sta.addr);
+
+        /*
+         * Determine if we wanted to modify or add a station,
+         * if adding a station succeeded we have some more initialization
+         * to do when using station notification. TODO
+         */
+
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+}
+
+static void iwl_add_sta_callback(struct iwl_priv *priv,
+                                 struct iwl_device_cmd *cmd,
+                                 struct iwl_rx_packet *pkt)
+{
+        struct iwl_addsta_cmd *addsta =
+                (struct iwl_addsta_cmd *)cmd->cmd.payload;
+
+        iwl_process_add_sta_resp(priv, addsta, pkt, false);
+
 }
 
 int iwl_send_add_sta(struct iwl_priv *priv,
                      struct iwl_addsta_cmd *sta, u8 flags)
 {
-        struct iwl_rx_packet *res = NULL;
+        struct iwl_rx_packet *pkt = NULL;
         int ret = 0;
         u8 data[sizeof(*sta)];
         struct iwl_host_cmd cmd = {
@@ -152,28 +202,11 @@ int iwl_send_add_sta(struct iwl_priv *priv,
         if (ret || (flags & CMD_ASYNC))
                 return ret;
 
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
-                IWL_ERR(priv, "Bad return from REPLY_ADD_STA (0x%08X)\n",
-                          res->hdr.flags);
-                ret = -EIO;
-        }
-
         if (ret == 0) {
-                switch (res->u.add_sta.status) {
-                case ADD_STA_SUCCESS_MSK:
-                        iwl_sta_ucode_activate(priv, sta->sta.sta_id);
-                        IWL_DEBUG_INFO(priv, "REPLY_ADD_STA PASSED\n");
-                        break;
-                default:
-                        ret = -EIO;
-                        IWL_WARN(priv, "REPLY_ADD_STA failed\n");
-                        break;
-                }
+                pkt = (struct iwl_rx_packet *)cmd.reply_page;
+                iwl_process_add_sta_resp(priv, sta, pkt, true);
         }
-
-        priv->alloc_rxb_skb--;
-        dev_kfree_skb_any(cmd.reply_skb);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return ret;
 }
@@ -189,6 +222,11 @@ static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
                 goto done;
 
         mimo_ps_mode = (sta_ht_inf->cap & IEEE80211_HT_CAP_SM_PS) >> 2;
+        IWL_DEBUG_ASSOC(priv, "spatial multiplexing power save mode: %s\n",
+                        (mimo_ps_mode == WLAN_HT_CAP_SM_PS_STATIC) ?
+                        "static" :
+                        (mimo_ps_mode == WLAN_HT_CAP_SM_PS_DYNAMIC) ?
+                        "dynamic" : "disabled");
 
         sta_flags = priv->stations[index].sta.station_flags;
 
@@ -301,7 +339,7 @@ u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
 }
 EXPORT_SYMBOL(iwl_add_station);
 
-static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const char *addr)
+static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const u8 *addr)
 {
         unsigned long flags;
         u8 sta_id = iwl_find_station(priv, addr);
@@ -324,26 +362,19 @@ static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const char *addr)
 
 static void iwl_remove_sta_callback(struct iwl_priv *priv,
                                     struct iwl_device_cmd *cmd,
-                                    struct sk_buff *skb)
+                                    struct iwl_rx_packet *pkt)
 {
-        struct iwl_rx_packet *res = NULL;
         struct iwl_rem_sta_cmd *rm_sta =
-                 (struct iwl_rem_sta_cmd *)cmd->cmd.payload;
-        const char *addr = rm_sta->addr;
-
-        if (!skb) {
-                IWL_ERR(priv, "Error: Response NULL in REPLY_REMOVE_STA.\n");
-                return;
-        }
+                        (struct iwl_rem_sta_cmd *)cmd->cmd.payload;
+        const u8 *addr = rm_sta->addr;
 
-        res = (struct iwl_rx_packet *)skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_REMOVE_STA (0x%08X)\n",
-                res->hdr.flags);
+                pkt->hdr.flags);
                 return;
         }
 
-        switch (res->u.rem_sta.status) {
+        switch (pkt->u.rem_sta.status) {
         case REM_STA_SUCCESS_MSK:
                 iwl_sta_ucode_deactivate(priv, addr);
                 break;
@@ -356,7 +387,7 @@ static void iwl_remove_sta_callback(struct iwl_priv *priv,
 static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
                                    u8 flags)
 {
-        struct iwl_rx_packet *res = NULL;
+        struct iwl_rx_packet *pkt;
         int ret;
 
         struct iwl_rem_sta_cmd rm_sta_cmd;
@@ -381,15 +412,15 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
         if (ret || (flags & CMD_ASYNC))
                 return ret;
 
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_REMOVE_STA (0x%08X)\n",
-                          res->hdr.flags);
+                          pkt->hdr.flags);
                 ret = -EIO;
         }
 
         if (!ret) {
-                switch (res->u.rem_sta.status) {
+                switch (pkt->u.rem_sta.status) {
                 case REM_STA_SUCCESS_MSK:
                         iwl_sta_ucode_deactivate(priv, addr);
                         IWL_DEBUG_ASSOC(priv, "REPLY_REMOVE_STA PASSED\n");
@@ -400,9 +431,7 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
                         break;
                 }
         }
-
-        priv->alloc_rxb_skb--;
-        dev_kfree_skb_any(cmd.reply_skb);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return ret;
 }
@@ -1016,24 +1045,19 @@ int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
         struct ieee80211_sta_ht_cap *cur_ht_config = NULL;
         u8 sta_id;
 
-        /* Add station to device's station table */
-
         /*
-         * XXX: This check is definitely not correct, if we're an AP
-         *      it'll always be false which is not what we want, but
-         *      it doesn't look like iwlagn is prepared to be an HT
-         *      AP anyway.
+         * Set HT capabilities. It is ok to set this struct even if not using
+         * HT config: the priv->current_ht_config.is_ht flag will just be false
          */
-        if (priv->current_ht_config.is_ht) {
-                rcu_read_lock();
-                sta = ieee80211_find_sta(priv->hw, addr);
-                if (sta) {
-                        memcpy(&ht_config, &sta->ht_cap, sizeof(ht_config));
-                        cur_ht_config = &ht_config;
-                }
-                rcu_read_unlock();
+        rcu_read_lock();
+        sta = ieee80211_find_sta(priv->vif, addr);
+        if (sta) {
+                memcpy(&ht_config, &sta->ht_cap, sizeof(ht_config));
+                cur_ht_config = &ht_config;
         }
+        rcu_read_unlock();
 
+        /* Add station to device's station table */
         sta_id = iwl_add_station(priv, addr, is_ap, CMD_SYNC, cur_ht_config);
 
         /* Set up default rate scaling table in device's station table */
@@ -1044,6 +1068,79 @@ int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
 EXPORT_SYMBOL(iwl_rxon_add_station);
 
 /**
+ * iwl_sta_init_bcast_lq - Initialize a bcast station's hardware rate table
+ *
+ * NOTE: Run REPLY_ADD_STA command to set up station table entry, before
+ *       calling this function (which runs REPLY_TX_LINK_QUALITY_CMD,
+ *       which requires station table entry to exist).
+ */
+static void iwl_sta_init_bcast_lq(struct iwl_priv *priv)
+{
+        int i, r;
+        struct iwl_link_quality_cmd link_cmd = {
+                .reserved1 = 0,
+        };
+        u32 rate_flags;
+
+        /* Set up the rate scaling to start at selected rate, fall back
+         * all the way down to 1M in IEEE order, and then spin on 1M */
+        if (priv->band == IEEE80211_BAND_5GHZ)
+                r = IWL_RATE_6M_INDEX;
+        else
+                r = IWL_RATE_1M_INDEX;
+
+        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
+                rate_flags = 0;
+                if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
+                        rate_flags |= RATE_MCS_CCK_MSK;
+
+                rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
+                                RATE_MCS_ANT_POS;
+
+                link_cmd.rs_table[i].rate_n_flags =
+                        iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
+                r = iwl_get_prev_ieee_rate(r);
+        }
+
+        link_cmd.general_params.single_stream_ant_msk =
+                                first_antenna(priv->hw_params.valid_tx_ant);
+        link_cmd.general_params.dual_stream_ant_msk = 3;
+        link_cmd.agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+        link_cmd.agg_params.agg_time_limit =
+                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
+
+        /* Update the rate scaling for control frame Tx to AP */
+        link_cmd.sta_id = priv->hw_params.bcast_sta_id;
+
+        iwl_send_cmd_pdu_async(priv, REPLY_TX_LINK_QUALITY_CMD,
+                               sizeof(link_cmd), &link_cmd, NULL);
+}
+
+
+/**
+ * iwl_add_bcast_station - add broadcast station into station table.
+ */
+void iwl_add_bcast_station(struct iwl_priv *priv)
+{
+        IWL_DEBUG_INFO(priv, "Adding broadcast station to station table\n");
+        iwl_add_station(priv, iwl_bcast_addr, false, CMD_SYNC, NULL);
+
+        /* Set up default rate scaling table in device's station table */
+        iwl_sta_init_bcast_lq(priv);
+}
+EXPORT_SYMBOL(iwl_add_bcast_station);
+
+/**
+ * iwl3945_add_bcast_station - add broadcast station into station table.
+ */
+void iwl3945_add_bcast_station(struct iwl_priv *priv)
+{
+        IWL_DEBUG_INFO(priv, "Adding broadcast station to station table\n");
+        iwl_add_station(priv, iwl_bcast_addr, false, CMD_SYNC, NULL);
+}
+EXPORT_SYMBOL(iwl3945_add_bcast_station);
+
+/**
  * iwl_get_sta_id - Find station's index within station table
  *
  * If new IBSS station, create new entry in station table
@@ -1163,7 +1260,7 @@ int iwl_sta_rx_agg_stop(struct iwl_priv *priv, const u8 *addr, int tid)
 }
 EXPORT_SYMBOL(iwl_sta_rx_agg_stop);
 
-static void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id)
+void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id)
 {
         unsigned long flags;
 
@@ -1171,27 +1268,26 @@ static void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id)
         priv->stations[sta_id].sta.station_flags &= ~STA_FLG_PWR_SAVE_MSK;
         priv->stations[sta_id].sta.station_flags_msk = STA_FLG_PWR_SAVE_MSK;
         priv->stations[sta_id].sta.sta.modify_mask = 0;
+        priv->stations[sta_id].sta.sleep_tx_count = 0;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
 }
+EXPORT_SYMBOL(iwl_sta_modify_ps_wake);
 
-void iwl_update_ps_mode(struct iwl_priv *priv, u16 ps_bit, u8 *addr)
+void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt)
 {
-        /* FIXME: need locking over ps_status ??? */
-        u8 sta_id = iwl_find_station(priv, addr);
+        unsigned long flags;
 
-        if (sta_id != IWL_INVALID_STATION) {
-                u8 sta_awake = priv->stations[sta_id].
-                                ps_status == STA_PS_STATUS_WAKE;
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        priv->stations[sta_id].sta.station_flags |= STA_FLG_PWR_SAVE_MSK;
+        priv->stations[sta_id].sta.station_flags_msk = STA_FLG_PWR_SAVE_MSK;
+        priv->stations[sta_id].sta.sta.modify_mask =
+                                        STA_MODIFY_SLEEP_TX_COUNT_MSK;
+        priv->stations[sta_id].sta.sleep_tx_count = cpu_to_le16(cnt);
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-                if (sta_awake && ps_bit)
-                        priv->stations[sta_id].ps_status = STA_PS_STATUS_SLEEP;
-                else if (!sta_awake && !ps_bit) {
-                        iwl_sta_modify_ps_wake(priv, sta_id);
-                        priv->stations[sta_id].ps_status = STA_PS_STATUS_WAKE;
-                }
-        }
+        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
 }
-
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.h b/drivers/net/wireless/iwlwifi/iwl-sta.h
index 6deebade6361..2dc35fe28f56 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.h
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -52,6 +52,8 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
                         const u8 *addr, u32 iv32, u16 *phase1key);
 
 int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap);
+void iwl_add_bcast_station(struct iwl_priv *priv);
+void iwl3945_add_bcast_station(struct iwl_priv *priv);
 int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap);
 void iwl_clear_stations_table(struct iwl_priv *priv);
 int iwl_get_free_ucode_key_index(struct iwl_priv *priv);
@@ -65,5 +67,6 @@ void iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid);
 int iwl_sta_rx_agg_start(struct iwl_priv *priv,
                          const u8 *addr, int tid, u16 ssn);
 int iwl_sta_rx_agg_stop(struct iwl_priv *priv, const u8 *addr, int tid);
-void iwl_update_ps_mode(struct iwl_priv *priv, u16 ps_bit, u8 *addr);
+void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id);
+void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt);
 #endif /* __iwl_sta_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index b7e196e3c8d3..8dd0c036d547 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -29,6 +29,7 @@
 
 #include <linux/etherdevice.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 #include "iwl-eeprom.h"
 #include "iwl-dev.h"
@@ -60,7 +61,8 @@ static const u16 default_tid_to_tx_fifo[] = {
 static inline int iwl_alloc_dma_ptr(struct iwl_priv *priv,
                                     struct iwl_dma_ptr *ptr, size_t size)
 {
-        ptr->addr = pci_alloc_consistent(priv->pci_dev, size, &ptr->dma);
+        ptr->addr = dma_alloc_coherent(&priv->pci_dev->dev, size, &ptr->dma,
+                                       GFP_KERNEL);
         if (!ptr->addr)
                 return -ENOMEM;
         ptr->size = size;
@@ -73,21 +75,20 @@ static inline void iwl_free_dma_ptr(struct iwl_priv *priv,
         if (unlikely(!ptr->addr))
                 return;
 
-        pci_free_consistent(priv->pci_dev, ptr->size, ptr->addr, ptr->dma);
+        dma_free_coherent(&priv->pci_dev->dev, ptr->size, ptr->addr, ptr->dma);
         memset(ptr, 0, sizeof(*ptr));
 }
 
 /**
  * iwl_txq_update_write_ptr - Send new write index to hardware
  */
-int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq)
+void iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq)
 {
         u32 reg = 0;
-        int ret = 0;
         int txq_id = txq->q.id;
 
         if (txq->need_update == 0)
-                return ret;
+                return;
 
         /* if we're trying to save power */
         if (test_bit(STATUS_POWER_PMI, &priv->status)) {
@@ -97,10 +98,11 @@ int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq)
                 reg = iwl_read32(priv, CSR_UCODE_DRV_GP1);
 
                 if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
-                        IWL_DEBUG_INFO(priv, "Requesting wakeup, GP1 = 0x%x\n", reg);
+                        IWL_DEBUG_INFO(priv, "Tx queue %d requesting wakeup, GP1 = 0x%x\n",
+                                      txq_id, reg);
                         iwl_set_bit(priv, CSR_GP_CNTRL,
                                     CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-                        return ret;
+                        return;
                 }
 
                 iwl_write_direct32(priv, HBUS_TARG_WRPTR,
@@ -113,12 +115,24 @@ int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq)
                             txq->q.write_ptr | (txq_id << 8));
 
         txq->need_update = 0;
-
-        return ret;
 }
 EXPORT_SYMBOL(iwl_txq_update_write_ptr);
 
 
+void iwl_free_tfds_in_queue(struct iwl_priv *priv,
+                            int sta_id, int tid, int freed)
+{
+        if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)
+                priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+        else {
+                IWL_DEBUG_TX(priv, "free more than tfds_in_queue (%u:%d)\n",
+                        priv->stations[sta_id].tid[tid].tfds_in_queue,
+                        freed);
+                priv->stations[sta_id].tid[tid].tfds_in_queue = 0;
+        }
+}
+EXPORT_SYMBOL(iwl_free_tfds_in_queue);
+
 /**
  * iwl_tx_queue_free - Deallocate DMA queue.
  * @txq: Transmit queue to deallocate.
@@ -131,8 +145,8 @@ void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id)
 {
         struct iwl_tx_queue *txq = &priv->txq[txq_id];
         struct iwl_queue *q = &txq->q;
-        struct pci_dev *dev = priv->pci_dev;
-        int i, len;
+        struct device *dev = &priv->pci_dev->dev;
+        int i;
 
         if (q->n_bd == 0)
                 return;
@@ -142,16 +156,14 @@ void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id)
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd))
                 priv->cfg->ops->lib->txq_free_tfd(priv, txq);
 
-        len = sizeof(struct iwl_device_cmd) * q->n_window;
-
         /* De-alloc array of command/tx buffers */
         for (i = 0; i < TFD_TX_CMD_SLOTS; i++)
                 kfree(txq->cmd[i]);
 
         /* De-alloc circular buffer of TFDs */
         if (txq->q.n_bd)
-                pci_free_consistent(dev, priv->hw_params.tfd_size *
-                                    txq->q.n_bd, txq->tfds, txq->q.dma_addr);
+                dma_free_coherent(dev, priv->hw_params.tfd_size *
+                                  txq->q.n_bd, txq->tfds, txq->q.dma_addr);
 
         /* De-alloc array of per-TFD driver data */
         kfree(txq->txb);
@@ -180,14 +192,35 @@ void iwl_cmd_queue_free(struct iwl_priv *priv)
 {
         struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
         struct iwl_queue *q = &txq->q;
-        struct pci_dev *dev = priv->pci_dev;
-        int i, len;
+        struct device *dev = &priv->pci_dev->dev;
+        int i;
+        bool huge = false;
 
         if (q->n_bd == 0)
                 return;
 
-        len = sizeof(struct iwl_device_cmd) * q->n_window;
-        len += IWL_MAX_SCAN_SIZE;
+        for (; q->read_ptr != q->write_ptr;
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+                /* we have no way to tell if it is a huge cmd ATM */
+                i = get_cmd_index(q, q->read_ptr, 0);
+
+                if (txq->meta[i].flags & CMD_SIZE_HUGE) {
+                        huge = true;
+                        continue;
+                }
+
+                pci_unmap_single(priv->pci_dev,
+                                 pci_unmap_addr(&txq->meta[i], mapping),
+                                 pci_unmap_len(&txq->meta[i], len),
+                                 PCI_DMA_BIDIRECTIONAL);
+        }
+        if (huge) {
+                i = q->n_window;
+                pci_unmap_single(priv->pci_dev,
+                                 pci_unmap_addr(&txq->meta[i], mapping),
+                                 pci_unmap_len(&txq->meta[i], len),
+                                 PCI_DMA_BIDIRECTIONAL);
+        }
 
         /* De-alloc array of command/tx buffers */
         for (i = 0; i <= TFD_CMD_SLOTS; i++)
@@ -195,8 +228,8 @@ void iwl_cmd_queue_free(struct iwl_priv *priv)
 
         /* De-alloc circular buffer of TFDs */
         if (txq->q.n_bd)
-                pci_free_consistent(dev, priv->hw_params.tfd_size *
-                                    txq->q.n_bd, txq->tfds, txq->q.dma_addr);
+                dma_free_coherent(dev, priv->hw_params.tfd_size * txq->q.n_bd,
+                                  txq->tfds, txq->q.dma_addr);
 
         /* deallocate arrays */
         kfree(txq->cmd);
@@ -287,7 +320,7 @@ static int iwl_queue_init(struct iwl_priv *priv, struct iwl_queue *q,
 static int iwl_tx_queue_alloc(struct iwl_priv *priv,
                               struct iwl_tx_queue *txq, u32 id)
 {
-        struct pci_dev *dev = priv->pci_dev;
+        struct device *dev = &priv->pci_dev->dev;
         size_t tfd_sz = priv->hw_params.tfd_size * TFD_QUEUE_SIZE_MAX;
 
         /* Driver private data, only for Tx (not command) queues,
@@ -306,8 +339,8 @@ static int iwl_tx_queue_alloc(struct iwl_priv *priv,
 
         /* Circular buffer of transmit frame descriptors (TFDs),
          * shared with device */
-        txq->tfds = pci_alloc_consistent(dev, tfd_sz, &txq->q.dma_addr);
-
+        txq->tfds = dma_alloc_coherent(dev, tfd_sz, &txq->q.dma_addr,
+                                       GFP_KERNEL);
         if (!txq->tfds) {
                 IWL_ERR(priv, "pci_alloc_consistent(%zd) failed\n", tfd_sz);
                 goto error;
@@ -356,7 +389,7 @@ int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
         for (i = 0; i < actual_slots; i++) {
                 /* only happens for cmd queue */
                 if (i == slots_num)
-                        len += IWL_MAX_SCAN_SIZE;
+                        len = IWL_MAX_CMD_SIZE;
 
                 txq->cmd[i] = kmalloc(len, GFP_KERNEL);
                 if (!txq->cmd[i])
@@ -370,8 +403,13 @@ int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
 
         txq->need_update = 0;
 
-        /* aggregation TX queues will get their ID when aggregation begins */
-        if (txq_id <= IWL_TX_FIFO_AC3)
+        /*
+         * Aggregation TX queues will get their ID when aggregation begins;
+         * they overwrite the setting done here. The command FIFO doesn't
+         * need an swq_id so don't set one to catch errors, all others can
+         * be set up to the identity mapping.
+         */
+        if (txq_id != IWL_CMD_QUEUE_NUM)
                 txq->swq_id = txq_id;
 
         /* TFD_QUEUE_SIZE_MAX must be power-of-two size, otherwise
@@ -396,6 +434,26 @@ out_free_arrays:
 }
 EXPORT_SYMBOL(iwl_tx_queue_init);
 
+void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
+                        int slots_num, u32 txq_id)
+{
+        int actual_slots = slots_num;
+
+        if (txq_id == IWL_CMD_QUEUE_NUM)
+                actual_slots++;
+
+        memset(txq->meta, 0, sizeof(struct iwl_cmd_meta) * actual_slots);
+
+        txq->need_update = 0;
+
+        /* Initialize queue's high/low-water marks, and head/tail indexes */
+        iwl_queue_init(priv, &txq->q, TFD_QUEUE_SIZE_MAX, slots_num, txq_id);
+
+        /* Tell device where to find queue */
+        priv->cfg->ops->lib->txq_init(priv, txq);
+}
+EXPORT_SYMBOL(iwl_tx_queue_reset);
+
 /**
  * iwl_hw_txq_ctx_free - Free TXQ Context
  *
@@ -406,28 +464,32 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv)
         int txq_id;
 
         /* Tx queues */
-        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
-                if (txq_id == IWL_CMD_QUEUE_NUM)
-                        iwl_cmd_queue_free(priv);
-                else
-                        iwl_tx_queue_free(priv, txq_id);
-
+        if (priv->txq) {
+                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
+                        if (txq_id == IWL_CMD_QUEUE_NUM)
+                                iwl_cmd_queue_free(priv);
+                        else
+                                iwl_tx_queue_free(priv, txq_id);
+        }
         iwl_free_dma_ptr(priv, &priv->kw);
 
         iwl_free_dma_ptr(priv, &priv->scd_bc_tbls);
+
+        /* free tx queue structure */
+        iwl_free_txq_mem(priv);
 }
 EXPORT_SYMBOL(iwl_hw_txq_ctx_free);
 
 /**
- * iwl_txq_ctx_reset - Reset TX queue context
- * Destroys all DMA structures and initialize them again
+ * iwl_txq_ctx_alloc - allocate TX queue context
+ * Allocate all Tx DMA structures and initialize them
  *
  * @param priv
  * @return error code
  */
-int iwl_txq_ctx_reset(struct iwl_priv *priv)
+int iwl_txq_ctx_alloc(struct iwl_priv *priv)
 {
-        int ret = 0;
+        int ret;
         int txq_id, slots_num;
         unsigned long flags;
 
@@ -446,6 +508,12 @@ int iwl_txq_ctx_reset(struct iwl_priv *priv)
                 IWL_ERR(priv, "Keep Warm allocation failed\n");
                 goto error_kw;
         }
+
+        /* allocate tx queue structure */
+        ret = iwl_alloc_txq_mem(priv);
+        if (ret)
+                goto error;
+
         spin_lock_irqsave(&priv->lock, flags);
 
         /* Turn off all Tx DMA fifos */
@@ -479,8 +547,31 @@ int iwl_txq_ctx_reset(struct iwl_priv *priv)
         return ret;
 }
 
+void iwl_txq_ctx_reset(struct iwl_priv *priv)
+{
+        int txq_id, slots_num;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Turn off all Tx DMA fifos */
+        priv->cfg->ops->lib->txq_set_sched(priv, 0);
+
+        /* Tell NIC where to find the "keep warm" buffer */
+        iwl_write_direct32(priv, FH_KW_MEM_ADDR_REG, priv->kw.dma >> 4);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        /* Alloc and init all Tx queues, including the command queue (#4) */
+        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
+                slots_num = txq_id == IWL_CMD_QUEUE_NUM ?
+                            TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
+                iwl_tx_queue_reset(priv, &priv->txq[txq_id], slots_num, txq_id);
+        }
+}
+
 /**
- * iwl_txq_ctx_stop - Stop all Tx DMA channels, free Tx queue memory
+ * iwl_txq_ctx_stop - Stop all Tx DMA channels
  */
 void iwl_txq_ctx_stop(struct iwl_priv *priv)
 {
@@ -500,9 +591,6 @@ void iwl_txq_ctx_stop(struct iwl_priv *priv)
                                     1000);
         }
         spin_unlock_irqrestore(&priv->lock, flags);
-
-        /* Deallocate memory for all Tx queues */
-        iwl_hw_txq_ctx_free(priv);
 }
 EXPORT_SYMBOL(iwl_txq_ctx_stop);
 
@@ -582,9 +670,7 @@ static void iwl_tx_cmd_build_rate(struct iwl_priv *priv,
         u8 rate_plcp;
 
         /* Set retry limit on DATA packets and Probe Responses*/
-        if (priv->data_retry_limit != -1)
-                data_retry_limit = priv->data_retry_limit;
-        else if (ieee80211_is_probe_resp(fc))
+        if (ieee80211_is_probe_resp(fc))
                 data_retry_limit = 3;
         else
                 data_retry_limit = IWL_DEFAULT_TX_RETRY;
@@ -701,6 +787,8 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_sta *sta = info->control.sta;
+        struct iwl_station_priv *sta_priv = NULL;
         struct iwl_tx_queue *txq;
         struct iwl_queue *q;
         struct iwl_device_cmd *out_cmd;
@@ -710,7 +798,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         dma_addr_t phys_addr;
         dma_addr_t txcmd_phys;
         dma_addr_t scratch_phys;
-        u16 len, len_org;
+        u16 len, len_org, firstlen, secondlen;
         u16 seq_number = 0;
         __le16 fc;
         u8 hdr_len;
@@ -719,7 +807,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         u8 tid = 0;
         u8 *qc = NULL;
         unsigned long flags;
-        int ret;
 
         spin_lock_irqsave(&priv->lock, flags);
         if (iwl_is_rfkill(priv)) {
@@ -763,6 +850,24 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
 
+        if (sta)
+                sta_priv = (void *)sta->drv_priv;
+
+        if (sta_priv && sta_id != priv->hw_params.bcast_sta_id &&
+            sta_priv->asleep) {
+                WARN_ON(!(info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE));
+                /*
+                 * This sends an asynchronous command to the device,
+                 * but we can rely on it being processed before the
+                 * next frame is processed -- and the next frame to
+                 * this station is the one that will consume this
+                 * counter.
+                 * For now set the counter to just 1 since we do not
+                 * support uAPSD yet.
+                 */
+                iwl_sta_modify_sleep_tx_count(priv, sta_id, 1);
+        }
+
         txq_id = skb_get_queue_mapping(skb);
         if (ieee80211_is_data_qos(fc)) {
                 qc = ieee80211_get_qos_ctl(hdr);
@@ -776,8 +881,10 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 hdr->seq_ctrl |= cpu_to_le16(seq_number);
                 seq_number += 0x10;
                 /* aggregation is on for this <sta,tid> */
-                if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                if (info->flags & IEEE80211_TX_CTL_AMPDU &&
+                    priv->stations[sta_id].tid[tid].agg.state == IWL_AGG_ON) {
                         txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
+                }
         }
 
         txq = &priv->txq[txq_id];
@@ -843,7 +950,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 sizeof(struct iwl_cmd_header) + hdr_len;
 
         len_org = len;
-        len = (len + 3) & ~3;
+        firstlen = len = (len + 3) & ~3;
 
         if (len_org != len)
                 len_org = 1;
@@ -877,7 +984,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         /* Set up TFD's 2nd entry to point directly to remainder of skb,
          * if any (802.11 null frames have no payload). */
-        len = skb->len - hdr_len;
+        secondlen = len = skb->len - hdr_len;
         if (len) {
                 phys_addr = pci_map_single(priv->pci_dev, skb->data + hdr_len,
                                            len, PCI_DMA_TODEVICE);
@@ -911,13 +1018,27 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         pci_dma_sync_single_for_device(priv->pci_dev, txcmd_phys,
                                        len, PCI_DMA_BIDIRECTIONAL);
 
+        trace_iwlwifi_dev_tx(priv,
+                             &((struct iwl_tfd *)txq->tfds)[txq->q.write_ptr],
+                             sizeof(struct iwl_tfd),
+                             &out_cmd->hdr, firstlen,
+                             skb->data + hdr_len, secondlen);
+
         /* Tell device the write index *just past* this latest filled TFD */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
-        ret = iwl_txq_update_write_ptr(priv, txq);
+        iwl_txq_update_write_ptr(priv, txq);
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        if (ret)
-                return ret;
+        /*
+         * At this point the frame is "transmitted" successfully
+         * and we will get a TX status notification eventually,
+         * regardless of the value of ret. "ret" only indicates
+         * whether or not we should update the write pointer.
+         */
+
+        /* avoid atomic ops if it isn't an associated client */
+        if (sta_priv && sta_priv->client)
+                atomic_inc(&sta_priv->pending_frames);
 
         if ((iwl_queue_space(q) < q->high_mark) && priv->mac80211_registered) {
                 if (wait_write_ptr) {
@@ -957,7 +1078,7 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         struct iwl_cmd_meta *out_meta;
         dma_addr_t phys_addr;
         unsigned long flags;
-        int len, ret;
+        int len;
         u32 idx;
         u16 fix_size;
 
@@ -966,22 +1087,40 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
 
         /* If any of the command structures end up being larger than
          * the TFD_MAX_PAYLOAD_SIZE, and it sent as a 'small' command then
-         * we will need to increase the size of the TFD entries */
+         * we will need to increase the size of the TFD entries
+         * Also, check to see if command buffer should not exceed the size
+         * of device_cmd and max_cmd_size. */
         BUG_ON((fix_size > TFD_MAX_PAYLOAD_SIZE) &&
                !(cmd->flags & CMD_SIZE_HUGE));
+        BUG_ON(fix_size > IWL_MAX_CMD_SIZE);
 
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_INFO(priv, "Not sending command - RF KILL\n");
+        if (iwl_is_rfkill(priv) || iwl_is_ctkill(priv)) {
+                IWL_WARN(priv, "Not sending command - %s KILL\n",
+                         iwl_is_rfkill(priv) ? "RF" : "CT");
                 return -EIO;
         }
 
         if (iwl_queue_space(q) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) {
-                IWL_ERR(priv, "No space for Tx\n");
+                IWL_ERR(priv, "No space in command queue\n");
+                if (iwl_within_ct_kill_margin(priv))
+                        iwl_tt_enter_ct_kill(priv);
+                else {
+                        IWL_ERR(priv, "Restarting adapter due to queue full\n");
+                        queue_work(priv->workqueue, &priv->restart);
+                }
                 return -ENOSPC;
         }
 
         spin_lock_irqsave(&priv->hcmd_lock, flags);
 
+        /* If this is a huge cmd, mark the huge flag also on the meta.flags
+         * of the _original_ cmd. This is used for DMA mapping clean up.
+         */
+        if (cmd->flags & CMD_SIZE_HUGE) {
+                idx = get_cmd_index(q, q->write_ptr, 0);
+                txq->meta[idx].flags = CMD_SIZE_HUGE;
+        }
+
         idx = get_cmd_index(q, q->write_ptr, cmd->flags & CMD_SIZE_HUGE);
         out_cmd = txq->cmd[idx];
         out_meta = &txq->meta[idx];
@@ -1005,8 +1144,8 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         if (cmd->flags & CMD_SIZE_HUGE)
                 out_cmd->hdr.sequence |= SEQ_HUGE_FRAME;
         len = sizeof(struct iwl_device_cmd);
-        len += (idx == TFD_CMD_SLOTS) ?  IWL_MAX_SCAN_SIZE : 0;
-
+        if (idx == TFD_CMD_SLOTS)
+                len = IWL_MAX_CMD_SIZE;
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         switch (out_cmd->hdr.cmd) {
@@ -1039,16 +1178,36 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         pci_unmap_addr_set(out_meta, mapping, phys_addr);
         pci_unmap_len_set(out_meta, len, fix_size);
 
+        trace_iwlwifi_dev_hcmd(priv, &out_cmd->hdr, fix_size, cmd->flags);
+
         priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
                                                    phys_addr, fix_size, 1,
                                                    U32_PAD(cmd->len));
 
         /* Increment and update queue's write index */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
-        ret = iwl_txq_update_write_ptr(priv, txq);
+        iwl_txq_update_write_ptr(priv, txq);
 
         spin_unlock_irqrestore(&priv->hcmd_lock, flags);
-        return ret ? ret : idx;
+        return idx;
+}
+
+static void iwl_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_sta *sta;
+        struct iwl_station_priv *sta_priv;
+
+        sta = ieee80211_find_sta(priv->vif, hdr->addr1);
+        if (sta) {
+                sta_priv = (void *)sta->drv_priv;
+                /* avoid atomic ops if this isn't a client */
+                if (sta_priv->client &&
+                    atomic_dec_return(&sta_priv->pending_frames) == 0)
+                        ieee80211_sta_block_awake(priv->hw, sta, false);
+        }
+
+        ieee80211_tx_status_irqsafe(priv->hw, skb);
 }
 
 int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
@@ -1057,6 +1216,7 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
         struct iwl_queue *q = &txq->q;
         struct iwl_tx_info *tx_info;
         int nfreed = 0;
+        struct ieee80211_hdr *hdr;
 
         if ((index >= q->n_bd) || (iwl_queue_used(q, index) == 0)) {
                 IWL_ERR(priv, "Read index for DMA queue txq id (%d), index %d, "
@@ -1070,14 +1230,17 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
 
                 tx_info = &txq->txb[txq->q.read_ptr];
-                ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb[0]);
+                iwl_tx_status(priv, tx_info->skb[0]);
+
+                hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
+                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                        nfreed++;
                 tx_info->skb[0] = NULL;
 
                 if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
                         priv->cfg->ops->lib->txq_inval_byte_cnt_tbl(priv, txq);
 
                 priv->cfg->ops->lib->txq_free_tfd(priv, txq);
-                nfreed++;
         }
         return nfreed;
 }
@@ -1105,11 +1268,6 @@ static void iwl_hcmd_queue_reclaim(struct iwl_priv *priv, int txq_id,
                 return;
         }
 
-        pci_unmap_single(priv->pci_dev,
-                pci_unmap_addr(&txq->meta[cmd_idx], mapping),
-                pci_unmap_len(&txq->meta[cmd_idx], len),
-                PCI_DMA_BIDIRECTIONAL);
-
         for (idx = iwl_queue_inc_wrap(idx, q->n_bd); q->read_ptr != idx;
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
 
@@ -1132,7 +1290,7 @@ static void iwl_hcmd_queue_reclaim(struct iwl_priv *priv, int txq_id,
  */
 void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
         int txq_id = SEQ_TO_QUEUE(sequence);
         int index = SEQ_TO_INDEX(sequence);
@@ -1140,6 +1298,7 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
         bool huge = !!(pkt->hdr.sequence & SEQ_HUGE_FRAME);
         struct iwl_device_cmd *cmd;
         struct iwl_cmd_meta *meta;
+        struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
 
         /* If a Tx command is being handled and it isn't in the actual
          * command queue then there a command routing bug has been introduced
@@ -1153,23 +1312,39 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
                 return;
         }
 
-        cmd_index = get_cmd_index(&priv->txq[IWL_CMD_QUEUE_NUM].q, index, huge);
-        cmd = priv->txq[IWL_CMD_QUEUE_NUM].cmd[cmd_index];
-        meta = &priv->txq[IWL_CMD_QUEUE_NUM].meta[cmd_index];
+        /* If this is a huge cmd, clear the huge flag on the meta.flags
+         * of the _original_ cmd. So that iwl_cmd_queue_free won't unmap
+         * the DMA buffer for the scan (huge) command.
+         */
+        if (huge) {
+                cmd_index = get_cmd_index(&txq->q, index, 0);
+                txq->meta[cmd_index].flags = 0;
+        }
+        cmd_index = get_cmd_index(&txq->q, index, huge);
+        cmd = txq->cmd[cmd_index];
+        meta = &txq->meta[cmd_index];
+
+        pci_unmap_single(priv->pci_dev,
+                         pci_unmap_addr(meta, mapping),
+                         pci_unmap_len(meta, len),
+                         PCI_DMA_BIDIRECTIONAL);
 
         /* Input error checking is done when commands are added to queue. */
         if (meta->flags & CMD_WANT_SKB) {
-                meta->source->reply_skb = rxb->skb;
-                rxb->skb = NULL;
+                meta->source->reply_page = (unsigned long)rxb_addr(rxb);
+                rxb->page = NULL;
         } else if (meta->callback)
-                meta->callback(priv, cmd, rxb->skb);
+                meta->callback(priv, cmd, pkt);
 
         iwl_hcmd_queue_reclaim(priv, txq_id, index, cmd_index);
 
         if (!(meta->flags & CMD_ASYNC)) {
                 clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
+                IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s \n",
+                               get_cmd_string(cmd->hdr.cmd));
                 wake_up_interruptible(&priv->wait_command_queue);
         }
+        meta->flags = 0;
 }
 EXPORT_SYMBOL(iwl_tx_cmd_complete);
 
@@ -1240,7 +1415,7 @@ int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
         if (tid_data->tfds_in_queue == 0) {
                 IWL_DEBUG_HT(priv, "HW queue is empty\n");
                 tid_data->agg.state = IWL_AGG_ON;
-                ieee80211_start_tx_ba_cb_irqsafe(priv->hw, ra, tid);
+                ieee80211_start_tx_ba_cb_irqsafe(priv->vif, ra, tid);
         } else {
                 IWL_DEBUG_HT(priv, "HW queue is NOT empty: %d packets in HW queue\n",
                              tid_data->tfds_in_queue);
@@ -1254,7 +1429,7 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
 {
         int tx_fifo_id, txq_id, sta_id, ssn = -1;
         struct iwl_tid_data *tid_data;
-        int ret, write_ptr, read_ptr;
+        int write_ptr, read_ptr;
         unsigned long flags;
 
         if (!ra) {
@@ -1280,7 +1455,7 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
         if (priv->stations[sta_id].tid[tid].agg.state ==
                                 IWL_EMPTYING_HW_QUEUE_ADDBA) {
                 IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
-                ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, ra, tid);
+                ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, ra, tid);
                 priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
                 return 0;
         }
@@ -1306,14 +1481,18 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
         priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
 
         spin_lock_irqsave(&priv->lock, flags);
-        ret = priv->cfg->ops->lib->txq_agg_disable(priv, txq_id, ssn,
+        /*
+         * the only reason this call can fail is queue number out of range,
+         * which can happen if uCode is reloaded and all the station
+         * information are lost. if it is outside the range, there is no need
+         * to deactivate the uCode queue, just return "success" to allow
+         *  mac80211 to clean up it own data.
+         */
+        priv->cfg->ops->lib->txq_agg_disable(priv, txq_id, ssn,
                                                    tx_fifo_id);
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        if (ret)
-                return ret;
-
-        ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, ra, tid);
+        ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, ra, tid);
 
         return 0;
 }
@@ -1337,7 +1516,7 @@ int iwl_txq_check_empty(struct iwl_priv *priv, int sta_id, u8 tid, int txq_id)
                         priv->cfg->ops->lib->txq_agg_disable(priv, txq_id,
                                                              ssn, tx_fifo);
                         tid_data->agg.state = IWL_AGG_OFF;
-                        ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, addr, tid);
+                        ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, addr, tid);
                 }
                 break;
         case IWL_EMPTYING_HW_QUEUE_ADDBA:
@@ -1345,7 +1524,7 @@ int iwl_txq_check_empty(struct iwl_priv *priv, int sta_id, u8 tid, int txq_id)
                 if (tid_data->tfds_in_queue == 0) {
                         IWL_DEBUG_HT(priv, "HW queue empty: continue ADDBA flow\n");
                         tid_data->agg.state = IWL_AGG_ON;
-                        ieee80211_start_tx_ba_cb_irqsafe(priv->hw, addr, tid);
+                        ieee80211_start_tx_ba_cb_irqsafe(priv->vif, addr, tid);
                 }
                 break;
         }
@@ -1409,7 +1588,7 @@ static int iwl_tx_status_reply_compressed_ba(struct iwl_priv *priv,
 
         info = IEEE80211_SKB_CB(priv->txq[scd_flow].txb[agg->start_idx].skb[0]);
         memset(&info->status, 0, sizeof(info->status));
-        info->flags = IEEE80211_TX_STAT_ACK;
+        info->flags |= IEEE80211_TX_STAT_ACK;
         info->flags |= IEEE80211_TX_STAT_AMPDU;
         info->status.ampdu_ack_map = successes;
         info->status.ampdu_ack_len = agg->frame_count;
@@ -1429,7 +1608,7 @@ static int iwl_tx_status_reply_compressed_ba(struct iwl_priv *priv,
 void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
                                            struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_compressed_ba_resp *ba_resp = &pkt->u.compressed_ba;
         struct iwl_tx_queue *txq = NULL;
         struct iwl_ht_agg *agg;
@@ -1485,7 +1664,7 @@ void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
         if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {
                 /* calculate mac80211 ampdu sw queue to wake */
                 int freed = iwl_tx_queue_reclaim(priv, scd_flow, index);
-                priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                 if ((iwl_queue_space(&txq->q) > txq->q.low_mark) &&
                     priv->mac80211_registered &&
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index d00a80334095..b74a56c48d26 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -31,6 +31,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/pci.h>
+#include <linux/slab.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
 #include <linux/sched.h>
@@ -42,7 +43,6 @@
 #include <linux/if_arp.h>
 
 #include <net/ieee80211_radiotap.h>
-#include <net/lib80211.h>
 #include <net/mac80211.h>
 
 #include <asm/div64.h>
@@ -54,9 +54,10 @@
 #include "iwl-commands.h"
 #include "iwl-sta.h"
 #include "iwl-3945.h"
-#include "iwl-helpers.h"
 #include "iwl-core.h"
+#include "iwl-helpers.h"
 #include "iwl-dev.h"
+#include "iwl-spectrum.h"
 
 /*
  * module name, copyright, version, etc.
@@ -71,17 +72,14 @@
 #define VD
 #endif
 
-#ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
-#define VS "s"
-#else
-#define VS
-#endif
-
-#define IWL39_VERSION "1.2.26k" VD VS
-#define DRV_COPYRIGHT   "Copyright(c) 2003-2009 Intel Corporation"
+/*
+ * add "s" to indicate spectrum measurement included.
+ * we add it here to be consistent with previous releases in which
+ * this was configurable.
+ */
+#define DRV_VERSION  IWLWIFI_VERSION VD "s"
+#define DRV_COPYRIGHT   "Copyright(c) 2003-2010 Intel Corporation"
 #define DRV_AUTHOR     "<ilw@linux.intel.com>"
-#define DRV_VERSION     IWL39_VERSION
-
 
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
 MODULE_VERSION(DRV_VERSION);
@@ -90,7 +88,6 @@ MODULE_LICENSE("GPL");
 
  /* module parameters */
 struct iwl_mod_params iwl3945_mod_params = {
-        .num_of_queues = IWL39_NUM_QUEUES, /* Not used */
         .sw_crypto = 1,
         .restart_fw = 1,
         /* the rest are 0 by default */
@@ -356,10 +353,10 @@ static int iwl3945_send_beacon_cmd(struct iwl_priv *priv)
 static void iwl3945_unset_hw_params(struct iwl_priv *priv)
 {
         if (priv->shared_virt)
-                pci_free_consistent(priv->pci_dev,
-                                    sizeof(struct iwl3945_shared),
-                                    priv->shared_virt,
-                                    priv->shared_phys);
+                dma_free_coherent(&priv->pci_dev->dev,
+                                  sizeof(struct iwl3945_shared),
+                                  priv->shared_virt,
+                                  priv->shared_phys);
 }
 
 static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
@@ -368,13 +365,13 @@ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
                                       struct sk_buff *skb_frag,
                                       int sta_id)
 {
-        struct iwl3945_tx_cmd *tx = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
+        struct iwl3945_tx_cmd *tx_cmd = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
         struct iwl_hw_key *keyinfo = &priv->stations[sta_id].keyinfo;
 
         switch (keyinfo->alg) {
         case ALG_CCMP:
-                tx->sec_ctl = TX_CMD_SEC_CCM;
-                memcpy(tx->key, keyinfo->key, keyinfo->keylen);
+                tx_cmd->sec_ctl = TX_CMD_SEC_CCM;
+                memcpy(tx_cmd->key, keyinfo->key, keyinfo->keylen);
                 IWL_DEBUG_TX(priv, "tx_cmd with AES hwcrypto\n");
                 break;
 
@@ -382,13 +379,13 @@ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
                 break;
 
         case ALG_WEP:
-                tx->sec_ctl = TX_CMD_SEC_WEP |
+                tx_cmd->sec_ctl = TX_CMD_SEC_WEP |
                     (info->control.hw_key->hw_key_idx & TX_CMD_SEC_MSK) << TX_CMD_SEC_SHIFT;
 
                 if (keyinfo->keylen == 13)
-                        tx->sec_ctl |= TX_CMD_SEC_KEY128;
+                        tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
 
-                memcpy(&tx->key[3], keyinfo->key, keyinfo->keylen);
+                memcpy(&tx_cmd->key[3], keyinfo->key, keyinfo->keylen);
 
                 IWL_DEBUG_TX(priv, "Configuring packet for WEP encryption "
                              "with key %d\n", info->control.hw_key->hw_key_idx);
@@ -408,12 +405,11 @@ static void iwl3945_build_tx_cmd_basic(struct iwl_priv *priv,
                                   struct ieee80211_tx_info *info,
                                   struct ieee80211_hdr *hdr, u8 std_id)
 {
-        struct iwl3945_tx_cmd *tx = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
-        __le32 tx_flags = tx->tx_flags;
+        struct iwl3945_tx_cmd *tx_cmd = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
+        __le32 tx_flags = tx_cmd->tx_flags;
         __le16 fc = hdr->frame_control;
-        u8 rc_flags = info->control.rates[0].flags;
 
-        tx->stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
+        tx_cmd->stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
                 tx_flags |= TX_CMD_FLG_ACK_MSK;
                 if (ieee80211_is_mgmt(fc))
@@ -426,25 +422,19 @@ static void iwl3945_build_tx_cmd_basic(struct iwl_priv *priv,
                 tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
         }
 
-        tx->sta_id = std_id;
+        tx_cmd->sta_id = std_id;
         if (ieee80211_has_morefrags(fc))
                 tx_flags |= TX_CMD_FLG_MORE_FRAG_MSK;
 
         if (ieee80211_is_data_qos(fc)) {
                 u8 *qc = ieee80211_get_qos_ctl(hdr);
-                tx->tid_tspec = qc[0] & 0xf;
+                tx_cmd->tid_tspec = qc[0] & 0xf;
                 tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
         } else {
                 tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
         }
 
-        if (rc_flags & IEEE80211_TX_RC_USE_RTS_CTS) {
-                tx_flags |= TX_CMD_FLG_RTS_MSK;
-                tx_flags &= ~TX_CMD_FLG_CTS_MSK;
-        } else if (rc_flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                tx_flags &= ~TX_CMD_FLG_RTS_MSK;
-                tx_flags |= TX_CMD_FLG_CTS_MSK;
-        }
+        priv->cfg->ops->utils->rts_tx_cmd_flag(info, &tx_flags);
 
         if ((tx_flags & TX_CMD_FLG_RTS_MSK) || (tx_flags & TX_CMD_FLG_CTS_MSK))
                 tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
@@ -452,19 +442,16 @@ static void iwl3945_build_tx_cmd_basic(struct iwl_priv *priv,
         tx_flags &= ~(TX_CMD_FLG_ANT_SEL_MSK);
         if (ieee80211_is_mgmt(fc)) {
                 if (ieee80211_is_assoc_req(fc) || ieee80211_is_reassoc_req(fc))
-                        tx->timeout.pm_frame_timeout = cpu_to_le16(3);
+                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(3);
                 else
-                        tx->timeout.pm_frame_timeout = cpu_to_le16(2);
+                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(2);
         } else {
-                tx->timeout.pm_frame_timeout = 0;
-#ifdef CONFIG_IWLWIFI_LEDS
-                priv->rxtxpackets += le16_to_cpu(cmd->cmd.tx.len);
-#endif
+                tx_cmd->timeout.pm_frame_timeout = 0;
         }
 
-        tx->driver_txop = 0;
-        tx->tx_flags = tx_flags;
-        tx->next_frame_len = 0;
+        tx_cmd->driver_txop = 0;
+        tx_cmd->tx_flags = tx_flags;
+        tx_cmd->next_frame_len = 0;
 }
 
 /*
@@ -474,7 +461,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct iwl3945_tx_cmd *tx;
+        struct iwl3945_tx_cmd *tx_cmd;
         struct iwl_tx_queue *txq = NULL;
         struct iwl_queue *q = NULL;
         struct iwl_device_cmd *out_cmd;
@@ -492,7 +479,6 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         u8 wait_write_ptr = 0;
         u8 *qc = NULL;
         unsigned long flags;
-        int rc;
 
         spin_lock_irqsave(&priv->lock, flags);
         if (iwl_is_rfkill(priv)) {
@@ -562,6 +548,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         txq = &priv->txq[txq_id];
         q = &txq->q;
 
+        if ((iwl_queue_space(q) < q->high_mark))
+                goto drop;
+
         spin_lock_irqsave(&priv->lock, flags);
 
         idx = get_cmd_index(q, q->write_ptr, 0);
@@ -573,9 +562,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         /* Init first empty entry in queue's array of Tx/cmd buffers */
         out_cmd = txq->cmd[idx];
         out_meta = &txq->meta[idx];
-        tx = (struct iwl3945_tx_cmd *)out_cmd->cmd.payload;
+        tx_cmd = (struct iwl3945_tx_cmd *)out_cmd->cmd.payload;
         memset(&out_cmd->hdr, 0, sizeof(out_cmd->hdr));
-        memset(tx, 0, sizeof(*tx));
+        memset(tx_cmd, 0, sizeof(*tx_cmd));
 
         /*
          * Set up the Tx-command (not MAC!) header.
@@ -588,7 +577,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                                 INDEX_TO_SEQ(q->write_ptr)));
 
         /* Copy MAC header from skb into command buffer */
-        memcpy(tx->hdr, hdr, hdr_len);
+        memcpy(tx_cmd->hdr, hdr, hdr_len);
 
 
         if (info->control.hw_key)
@@ -602,12 +591,12 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         /* Total # bytes to be transmitted */
         len = (u16)skb->len;
-        tx->len = cpu_to_le16(len);
+        tx_cmd->len = cpu_to_le16(len);
 
         iwl_dbg_log_tx_data_frame(priv, len, hdr);
         iwl_update_stats(priv, true, fc, len);
-        tx->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
-        tx->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
+        tx_cmd->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
+        tx_cmd->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
 
         if (!ieee80211_has_morefrags(hdr->frame_control)) {
                 txq->need_update = 1;
@@ -620,9 +609,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
                      le16_to_cpu(out_cmd->hdr.sequence));
-        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx->tx_flags));
-        iwl_print_hex_dump(priv, IWL_DL_TX, tx, sizeof(*tx));
-        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx->hdr,
+        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx_cmd->tx_flags));
+        iwl_print_hex_dump(priv, IWL_DL_TX, tx_cmd, sizeof(*tx_cmd));
+        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr,
                            ieee80211_hdrlen(fc));
 
         /*
@@ -674,12 +663,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         /* Tell device the write index *just past* this latest filled TFD */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
-        rc = iwl_txq_update_write_ptr(priv, txq);
+        iwl_txq_update_write_ptr(priv, txq);
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        if (rc)
-                return rc;
-
         if ((iwl_queue_space(q) < q->high_mark)
             && priv->mac80211_registered) {
                 if (wait_write_ptr) {
@@ -700,10 +686,6 @@ drop:
         return -1;
 }
 
-#ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
-
-#include "iwl-spectrum.h"
-
 #define BEACON_TIME_MASK_LOW    0x00FFFFFF
 #define BEACON_TIME_MASK_HIGH   0xFF000000
 #define TIME_UNIT               1024
@@ -758,7 +740,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
                                u8 type)
 {
         struct iwl_spectrum_cmd spectrum;
-        struct iwl_rx_packet *res;
+        struct iwl_rx_packet *pkt;
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SPECTRUM_MEASUREMENT_CMD,
                 .data = (void *)&spectrum,
@@ -803,18 +785,18 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
         if (rc)
                 return rc;
 
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_RX_ON_ASSOC command\n");
                 rc = -EIO;
         }
 
-        spectrum_resp_status = le16_to_cpu(res->u.spectrum.status);
+        spectrum_resp_status = le16_to_cpu(pkt->u.spectrum.status);
         switch (spectrum_resp_status) {
         case 0:         /* Command will be handled */
-                if (res->u.spectrum.id != 0xff) {
+                if (pkt->u.spectrum.id != 0xff) {
                         IWL_DEBUG_INFO(priv, "Replaced existing measurement: %d\n",
-                                                res->u.spectrum.id);
+                                                pkt->u.spectrum.id);
                         priv->measurement_status &= ~MEASUREMENT_READY;
                 }
                 priv->measurement_status |= MEASUREMENT_ACTIVE;
@@ -826,16 +808,15 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
                 break;
         }
 
-        dev_kfree_skb_any(cmd.reply_skb);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return rc;
 }
-#endif
 
 static void iwl3945_rx_reply_alive(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_alive_resp *palive;
         struct delayed_work *pwork;
 
@@ -872,7 +853,7 @@ static void iwl3945_rx_reply_add_sta(struct iwl_priv *priv,
                                  struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
 #endif
 
         IWL_DEBUG_RX(priv, "Received REPLY_ADD_STA: 0x%02X\n", pkt->u.status);
@@ -908,7 +889,7 @@ static void iwl3945_rx_beacon_notif(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl3945_beacon_notif *beacon = &(pkt->u.beacon_status);
         u8 rate = beacon->beacon_notify_hdr.rate;
 
@@ -931,7 +912,7 @@ static void iwl3945_rx_beacon_notif(struct iwl_priv *priv,
 static void iwl3945_rx_card_state_notif(struct iwl_priv *priv,
                                     struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u32 flags = le32_to_cpu(pkt->u.card_state_notif.flags);
         unsigned long status = priv->status;
 
@@ -973,6 +954,8 @@ static void iwl3945_setup_rx_handlers(struct iwl_priv *priv)
         priv->rx_handlers[REPLY_ADD_STA] = iwl3945_rx_reply_add_sta;
         priv->rx_handlers[REPLY_ERROR] = iwl_rx_reply_error;
         priv->rx_handlers[CHANNEL_SWITCH_NOTIFICATION] = iwl_rx_csa;
+        priv->rx_handlers[SPECTRUM_MEASURE_NOTIFICATION] =
+                        iwl_rx_spectrum_measure_notif;
         priv->rx_handlers[PM_SLEEP_NOTIFICATION] = iwl_rx_pm_sleep_notif;
         priv->rx_handlers[PM_DEBUG_STATISTIC_NOTIFIC] =
             iwl_rx_pm_debug_statistics_notif;
@@ -986,7 +969,6 @@ static void iwl3945_setup_rx_handlers(struct iwl_priv *priv)
         priv->rx_handlers[REPLY_STATISTICS_CMD] = iwl3945_hw_rx_statistics;
         priv->rx_handlers[STATISTICS_NOTIFICATION] = iwl3945_hw_rx_statistics;
 
-        iwl_setup_spectrum_handlers(priv);
         iwl_setup_rx_scan_handlers(priv);
         priv->rx_handlers[CARD_STATE_NOTIFICATION] = iwl3945_rx_card_state_notif;
 
@@ -1078,13 +1060,13 @@ static inline __le32 iwl3945_dma_addr2rbd_ptr(struct iwl_priv *priv,
  * also updates the memory address in the firmware to reference the new
  * target buffer.
  */
-static int iwl3945_rx_queue_restock(struct iwl_priv *priv)
+static void iwl3945_rx_queue_restock(struct iwl_priv *priv)
 {
         struct iwl_rx_queue *rxq = &priv->rxq;
         struct list_head *element;
         struct iwl_rx_mem_buffer *rxb;
         unsigned long flags;
-        int write, rc;
+        int write;
 
         spin_lock_irqsave(&rxq->lock, flags);
         write = rxq->write & ~0x7;
@@ -1095,7 +1077,7 @@ static int iwl3945_rx_queue_restock(struct iwl_priv *priv)
                 list_del(element);
 
                 /* Point to Rx buffer via next RBD in circular buffer */
-                rxq->bd[rxq->write] = iwl3945_dma_addr2rbd_ptr(priv, rxb->real_dma_addr);
+                rxq->bd[rxq->write] = iwl3945_dma_addr2rbd_ptr(priv, rxb->page_dma);
                 rxq->queue[rxq->write] = rxb;
                 rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
                 rxq->free_count--;
@@ -1114,12 +1096,8 @@ static int iwl3945_rx_queue_restock(struct iwl_priv *priv)
                 spin_lock_irqsave(&rxq->lock, flags);
                 rxq->need_update = 1;
                 spin_unlock_irqrestore(&rxq->lock, flags);
-                rc = iwl_rx_queue_update_write_ptr(priv, rxq);
-                if (rc)
-                        return rc;
+                iwl_rx_queue_update_write_ptr(priv, rxq);
         }
-
-        return 0;
 }
 
 /**
@@ -1135,8 +1113,9 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
         struct iwl_rx_queue *rxq = &priv->rxq;
         struct list_head *element;
         struct iwl_rx_mem_buffer *rxb;
-        struct sk_buff *skb;
+        struct page *page;
         unsigned long flags;
+        gfp_t gfp_mask = priority;
 
         while (1) {
                 spin_lock_irqsave(&rxq->lock, flags);
@@ -1148,10 +1127,14 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                 spin_unlock_irqrestore(&rxq->lock, flags);
 
                 if (rxq->free_count > RX_LOW_WATERMARK)
-                        priority |= __GFP_NOWARN;
+                        gfp_mask |= __GFP_NOWARN;
+
+                if (priv->hw_params.rx_page_order > 0)
+                        gfp_mask |= __GFP_COMP;
+
                 /* Alloc a new receive buffer */
-                skb = alloc_skb(priv->hw_params.rx_buf_size, priority);
-                if (!skb) {
+                page = alloc_pages(gfp_mask, priv->hw_params.rx_page_order);
+                if (!page) {
                         if (net_ratelimit())
                                 IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n");
                         if ((rxq->free_count <= RX_LOW_WATERMARK) &&
@@ -1168,7 +1151,7 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                 spin_lock_irqsave(&rxq->lock, flags);
                 if (list_empty(&rxq->rx_used)) {
                         spin_unlock_irqrestore(&rxq->lock, flags);
-                        dev_kfree_skb_any(skb);
+                        __free_pages(page, priv->hw_params.rx_page_order);
                         return;
                 }
                 element = rxq->rx_used.next;
@@ -1176,26 +1159,18 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                 list_del(element);
                 spin_unlock_irqrestore(&rxq->lock, flags);
 
-                rxb->skb = skb;
-
-                /* If radiotap head is required, reserve some headroom here.
-                 * The physical head count is a variable rx_stats->phy_count.
-                 * We reserve 4 bytes here. Plus these extra bytes, the
-                 * headroom of the physical head should be enough for the
-                 * radiotap head that iwl3945 supported. See iwl3945_rt.
-                 */
-                skb_reserve(rxb->skb, 4);
-
+                rxb->page = page;
                 /* Get physical address of RB/SKB */
-                rxb->real_dma_addr = pci_map_single(priv->pci_dev,
-                                                rxb->skb->data,
-                                                priv->hw_params.rx_buf_size,
-                                                PCI_DMA_FROMDEVICE);
+                rxb->page_dma = pci_map_page(priv->pci_dev, page, 0,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
 
                 spin_lock_irqsave(&rxq->lock, flags);
+
                 list_add_tail(&rxb->list, &rxq->rx_free);
-                priv->alloc_rxb_skb++;
                 rxq->free_count++;
+                priv->alloc_rxb_page++;
+
                 spin_unlock_irqrestore(&rxq->lock, flags);
         }
 }
@@ -1211,14 +1186,12 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
                 /* In the reset function, these buffers may have been allocated
                  * to an SKB, so we need to unmap and free potential storage */
-                if (rxq->pool[i].skb != NULL) {
-                        pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].real_dma_addr,
-                                         priv->hw_params.rx_buf_size,
-                                         PCI_DMA_FROMDEVICE);
-                        priv->alloc_rxb_skb--;
-                        dev_kfree_skb(rxq->pool[i].skb);
-                        rxq->pool[i].skb = NULL;
+                if (rxq->pool[i].page != NULL) {
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
+                        rxq->pool[i].page = NULL;
                 }
                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
         }
@@ -1226,8 +1199,8 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         /* Set us so that we have processed and used all buffers, but have
          * not restocked the Rx queue with fresh buffers */
         rxq->read = rxq->write = 0;
-        rxq->free_count = 0;
         rxq->write_actual = 0;
+        rxq->free_count = 0;
         spin_unlock_irqrestore(&rxq->lock, flags);
 }
 
@@ -1260,19 +1233,19 @@ static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rx
 {
         int i;
         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
-                if (rxq->pool[i].skb != NULL) {
-                        pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].real_dma_addr,
-                                         priv->hw_params.rx_buf_size,
-                                         PCI_DMA_FROMDEVICE);
-                        dev_kfree_skb(rxq->pool[i].skb);
+                if (rxq->pool[i].page != NULL) {
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
+                        rxq->pool[i].page = NULL;
                 }
         }
 
-        pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
-                            rxq->dma_addr);
-        pci_free_consistent(priv->pci_dev, sizeof(struct iwl_rb_status),
-                            rxq->rb_stts, rxq->rb_stts_dma);
+        dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+                          rxq->dma_addr);
+        dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
+                          rxq->rb_stts, rxq->rb_stts_dma);
         rxq->bd = NULL;
         rxq->rb_stts  = NULL;
 }
@@ -1315,47 +1288,6 @@ int iwl3945_calc_db_from_ratio(int sig_ratio)
         return (int)ratio2dB[sig_ratio];
 }
 
-#define PERFECT_RSSI (-20) /* dBm */
-#define WORST_RSSI (-95)   /* dBm */
-#define RSSI_RANGE (PERFECT_RSSI - WORST_RSSI)
-
-/* Calculate an indication of rx signal quality (a percentage, not dBm!).
- * See http://www.ces.clemson.edu/linux/signal_quality.shtml for info
- *   about formulas used below. */
-int iwl3945_calc_sig_qual(int rssi_dbm, int noise_dbm)
-{
-        int sig_qual;
-        int degradation = PERFECT_RSSI - rssi_dbm;
-
-        /* If we get a noise measurement, use signal-to-noise ratio (SNR)
-         * as indicator; formula is (signal dbm - noise dbm).
-         * SNR at or above 40 is a great signal (100%).
-         * Below that, scale to fit SNR of 0 - 40 dB within 0 - 100% indicator.
-         * Weakest usable signal is usually 10 - 15 dB SNR. */
-        if (noise_dbm) {
-                if (rssi_dbm - noise_dbm >= 40)
-                        return 100;
-                else if (rssi_dbm < noise_dbm)
-                        return 0;
-                sig_qual = ((rssi_dbm - noise_dbm) * 5) / 2;
-
-        /* Else use just the signal level.
-         * This formula is a least squares fit of data points collected and
-         *   compared with a reference system that had a percentage (%) display
-         *   for signal quality. */
-        } else
-                sig_qual = (100 * (RSSI_RANGE * RSSI_RANGE) - degradation *
-                            (15 * RSSI_RANGE + 62 * degradation)) /
-                           (RSSI_RANGE * RSSI_RANGE);
-
-        if (sig_qual > 100)
-                sig_qual = 100;
-        else if (sig_qual < 1)
-                sig_qual = 0;
-
-        return sig_qual;
-}
-
 /**
  * iwl3945_rx_handle - Main entry function for receiving responses from uCode
  *
@@ -1381,7 +1313,7 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
         i = rxq->read;
 
         /* calculate total frames need to be restock after handling RX */
-        total_empty = r - priv->rxq.write_actual;
+        total_empty = r - rxq->write_actual;
         if (total_empty < 0)
                 total_empty += RX_QUEUE_SIZE;
 
@@ -1401,10 +1333,13 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
 
                 rxq->queue[i] = NULL;
 
-                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
-                                priv->hw_params.rx_buf_size,
-                                PCI_DMA_FROMDEVICE);
-                pkt = (struct iwl_rx_packet *)rxb->skb->data;
+                pci_unmap_page(priv->pci_dev, rxb->page_dma,
+                               PAGE_SIZE << priv->hw_params.rx_page_order,
+                               PCI_DMA_FROMDEVICE);
+                pkt = rxb_addr(rxb);
+
+                trace_iwlwifi_dev_rx(priv, pkt,
+                        le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
 
                 /* Reclaim a command buffer only if this packet is a response
                  *   to a (driver-originated) command.
@@ -1422,44 +1357,55 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                 if (priv->rx_handlers[pkt->hdr.cmd]) {
                         IWL_DEBUG_RX(priv, "r = %d, i = %d, %s, 0x%02x\n", r, i,
                                 get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
-                        priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
                         priv->isr_stats.rx_handlers[pkt->hdr.cmd]++;
+                        priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
                 } else {
                         /* No handling needed */
-                        IWL_DEBUG_RX(priv, "r %d i %d No handler needed for %s, 0x%02x\n",
+                        IWL_DEBUG_RX(priv,
+                                "r %d i %d No handler needed for %s, 0x%02x\n",
                                 r, i, get_cmd_string(pkt->hdr.cmd),
                                 pkt->hdr.cmd);
                 }
 
+                /*
+                 * XXX: After here, we should always check rxb->page
+                 * against NULL before touching it or its virtual
+                 * memory (pkt). Because some rx_handler might have
+                 * already taken or freed the pages.
+                 */
+
                 if (reclaim) {
-                        /* Invoke any callbacks, transfer the skb to caller, and
-                         * fire off the (possibly) blocking iwl_send_cmd()
+                        /* Invoke any callbacks, transfer the buffer to caller,
+                         * and fire off the (possibly) blocking iwl_send_cmd()
                          * as we reclaim the driver command queue */
-                        if (rxb && rxb->skb)
+                        if (rxb->page)
                                 iwl_tx_cmd_complete(priv, rxb);
                         else
                                 IWL_WARN(priv, "Claim null rxb?\n");
                 }
 
-                /* For now we just don't re-use anything.  We can tweak this
-                 * later to try and re-use notification packets and SKBs that
-                 * fail to Rx correctly */
-                if (rxb->skb != NULL) {
-                        priv->alloc_rxb_skb--;
-                        dev_kfree_skb_any(rxb->skb);
-                        rxb->skb = NULL;
-                }
-
+                /* Reuse the page if possible. For notification packets and
+                 * SKBs that fail to Rx correctly, add them back into the
+                 * rx_free list for reuse later. */
                 spin_lock_irqsave(&rxq->lock, flags);
-                list_add_tail(&rxb->list, &priv->rxq.rx_used);
+                if (rxb->page != NULL) {
+                        rxb->page_dma = pci_map_page(priv->pci_dev, rxb->page,
+                                0, PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        list_add_tail(&rxb->list, &rxq->rx_free);
+                        rxq->free_count++;
+                } else
+                        list_add_tail(&rxb->list, &rxq->rx_used);
+
                 spin_unlock_irqrestore(&rxq->lock, flags);
+
                 i = (i + 1) & RX_QUEUE_MASK;
                 /* If there are a lot of unused frames,
                  * restock the Rx queue so ucode won't assert. */
                 if (fill_rx) {
                         count++;
                         if (count >= 8) {
-                                priv->rxq.read = i;
+                                rxq->read = i;
                                 iwl3945_rx_replenish_now(priv);
                                 count = 0;
                         }
@@ -1467,7 +1413,7 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
         }
 
         /* Backtrack one entry */
-        priv->rxq.read = i;
+        rxq->read = i;
         if (fill_rx)
                 iwl3945_rx_replenish_now(priv);
         else
@@ -1482,7 +1428,6 @@ static inline void iwl_synchronize_irq(struct iwl_priv *priv)
         tasklet_kill(&priv->irq_tasklet);
 }
 
-#ifdef CONFIG_IWLWIFI_DEBUG
 static const char *desc_lookup(int i)
 {
         switch (i) {
@@ -1551,8 +1496,9 @@ void iwl3945_dump_nic_error_log(struct iwl_priv *priv)
                         "%-13s (#%d) %010u 0x%05X 0x%05X 0x%05X 0x%05X %u\n\n",
                         desc_lookup(desc), desc, time, blink1, blink2,
                         ilink1, ilink2, data1);
+                trace_iwlwifi_dev_ucode_error(priv, desc, time, data1, 0,
+                                        0, blink1, blink2, ilink1, ilink2);
         }
-
 }
 
 #define EVENT_START_OFFSET  (6 * sizeof(u32))
@@ -1561,17 +1507,19 @@ void iwl3945_dump_nic_error_log(struct iwl_priv *priv)
  * iwl3945_print_event_log - Dump error event log to syslog
  *
  */
-static void iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
-                                u32 num_events, u32 mode)
+static int iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
+                                  u32 num_events, u32 mode,
+                                  int pos, char **buf, size_t bufsz)
 {
         u32 i;
         u32 base;       /* SRAM byte address of event log header */
         u32 event_size; /* 2 u32s, or 3 u32s if timestamp recorded */
         u32 ptr;        /* SRAM byte address of log data */
         u32 ev, time, data; /* event log data */
+        unsigned long reg_flags;
 
         if (num_events == 0)
-                return;
+                return pos;
 
         base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
 
@@ -1582,25 +1530,96 @@ static void iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
 
         ptr = base + EVENT_START_OFFSET + (start_idx * event_size);
 
+        /* Make sure device is powered up for SRAM reads */
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        iwl_grab_nic_access(priv);
+
+        /* Set starting address; reads will auto-increment */
+        _iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR, ptr);
+        rmb();
+
         /* "time" is actually "data" for mode 0 (no timestamp).
          * place event id # at far right for easier visual parsing. */
         for (i = 0; i < num_events; i++) {
-                ev = iwl_read_targ_mem(priv, ptr);
-                ptr += sizeof(u32);
-                time = iwl_read_targ_mem(priv, ptr);
-                ptr += sizeof(u32);
+                ev = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                time = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
                 if (mode == 0) {
                         /* data, ev */
-                        IWL_ERR(priv, "0x%08x\t%04u\n", time, ev);
+                        if (bufsz) {
+                                pos += scnprintf(*buf + pos, bufsz - pos,
+                                                "0x%08x:%04u\n",
+                                                time, ev);
+                        } else {
+                                IWL_ERR(priv, "0x%08x\t%04u\n", time, ev);
+                                trace_iwlwifi_dev_ucode_event(priv, 0,
+                                                              time, ev);
+                        }
                 } else {
-                        data = iwl_read_targ_mem(priv, ptr);
-                        ptr += sizeof(u32);
-                        IWL_ERR(priv, "%010u\t0x%08x\t%04u\n", time, data, ev);
+                        data = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                        if (bufsz) {
+                                pos += scnprintf(*buf + pos, bufsz - pos,
+                                                "%010u:0x%08x:%04u\n",
+                                                 time, data, ev);
+                        } else {
+                                IWL_ERR(priv, "%010u\t0x%08x\t%04u\n",
+                                        time, data, ev);
+                                trace_iwlwifi_dev_ucode_event(priv, time,
+                                                              data, ev);
+                        }
                 }
         }
+
+        /* Allow device to power down */
+        iwl_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+        return pos;
 }
 
-void iwl3945_dump_nic_event_log(struct iwl_priv *priv)
+/**
+ * iwl3945_print_last_event_logs - Dump the newest # of event log to syslog
+ */
+static int iwl3945_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
+                                      u32 num_wraps, u32 next_entry,
+                                      u32 size, u32 mode,
+                                      int pos, char **buf, size_t bufsz)
+{
+        /*
+         * display the newest DEFAULT_LOG_ENTRIES entries
+         * i.e the entries just before the next ont that uCode would fill.
+         */
+        if (num_wraps) {
+                if (next_entry < size) {
+                        pos = iwl3945_print_event_log(priv,
+                                             capacity - (size - next_entry),
+                                             size - next_entry, mode,
+                                             pos, buf, bufsz);
+                        pos = iwl3945_print_event_log(priv, 0,
+                                                      next_entry, mode,
+                                                      pos, buf, bufsz);
+                } else
+                        pos = iwl3945_print_event_log(priv, next_entry - size,
+                                                      size, mode,
+                                                      pos, buf, bufsz);
+        } else {
+                if (next_entry < size)
+                        pos = iwl3945_print_event_log(priv, 0,
+                                                      next_entry, mode,
+                                                      pos, buf, bufsz);
+                else
+                        pos = iwl3945_print_event_log(priv, next_entry - size,
+                                                      size, mode,
+                                                      pos, buf, bufsz);
+        }
+        return pos;
+}
+
+/* For sanity check only.  Actual size is determined by uCode, typ. 512 */
+#define IWL3945_MAX_EVENT_LOG_SIZE (512)
+
+#define DEFAULT_IWL3945_DUMP_EVENT_LOG_ENTRIES (20)
+
+int iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
+                            char **buf, bool display)
 {
         u32 base;       /* SRAM byte address of event log header */
         u32 capacity;   /* event log capacity in # entries */
@@ -1608,11 +1627,13 @@ void iwl3945_dump_nic_event_log(struct iwl_priv *priv)
         u32 num_wraps;  /* # times uCode wrapped to top of log */
         u32 next_entry; /* index of next entry to be written by uCode */
         u32 size;       /* # entries that we'll print */
+        int pos = 0;
+        size_t bufsz = 0;
 
         base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
         if (!iwl3945_hw_valid_rtc_data_addr(base)) {
                 IWL_ERR(priv, "Invalid event log pointer 0x%08X\n", base);
-                return;
+                return  -EINVAL;
         }
 
         /* event log header */
@@ -1621,37 +1642,72 @@ void iwl3945_dump_nic_event_log(struct iwl_priv *priv)
         num_wraps = iwl_read_targ_mem(priv, base + (2 * sizeof(u32)));
         next_entry = iwl_read_targ_mem(priv, base + (3 * sizeof(u32)));
 
+        if (capacity > IWL3945_MAX_EVENT_LOG_SIZE) {
+                IWL_ERR(priv, "Log capacity %d is bogus, limit to %d entries\n",
+                        capacity, IWL3945_MAX_EVENT_LOG_SIZE);
+                capacity = IWL3945_MAX_EVENT_LOG_SIZE;
+        }
+
+        if (next_entry > IWL3945_MAX_EVENT_LOG_SIZE) {
+                IWL_ERR(priv, "Log write index %d is bogus, limit to %d\n",
+                        next_entry, IWL3945_MAX_EVENT_LOG_SIZE);
+                next_entry = IWL3945_MAX_EVENT_LOG_SIZE;
+        }
+
         size = num_wraps ? capacity : next_entry;
 
         /* bail out if nothing in log */
         if (size == 0) {
                 IWL_ERR(priv, "Start IWL Event Log Dump: nothing in log\n");
-                return;
+                return pos;
         }
 
-        IWL_ERR(priv, "Start IWL Event Log Dump: display count %d, wraps %d\n",
-                  size, num_wraps);
-
-        /* if uCode has wrapped back to top of log, start at the oldest entry,
-         * i.e the next one that uCode would fill. */
-        if (num_wraps)
-                iwl3945_print_event_log(priv, next_entry,
-                                    capacity - next_entry, mode);
-
-        /* (then/else) start at top of log */
-        iwl3945_print_event_log(priv, 0, next_entry, mode);
-
-}
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (!(iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) && !full_log)
+                size = (size > DEFAULT_IWL3945_DUMP_EVENT_LOG_ENTRIES)
+                        ? DEFAULT_IWL3945_DUMP_EVENT_LOG_ENTRIES : size;
 #else
-void iwl3945_dump_nic_event_log(struct iwl_priv *priv)
-{
-}
+        size = (size > DEFAULT_IWL3945_DUMP_EVENT_LOG_ENTRIES)
+                ? DEFAULT_IWL3945_DUMP_EVENT_LOG_ENTRIES : size;
+#endif
 
-void iwl3945_dump_nic_error_log(struct iwl_priv *priv)
-{
-}
+        IWL_ERR(priv, "Start IWL Event Log Dump: display last %d count\n",
+                  size);
 
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (display) {
+                if (full_log)
+                        bufsz = capacity * 48;
+                else
+                        bufsz = size * 48;
+                *buf = kmalloc(bufsz, GFP_KERNEL);
+                if (!*buf)
+                        return -ENOMEM;
+        }
+        if ((iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) || full_log) {
+                /* if uCode has wrapped back to top of log,
+                 * start at the oldest entry,
+                 * i.e the next one that uCode would fill.
+                 */
+                if (num_wraps)
+                        pos = iwl3945_print_event_log(priv, next_entry,
+                                                capacity - next_entry, mode,
+                                                pos, buf, bufsz);
+
+                /* (then/else) start at top of log */
+                pos = iwl3945_print_event_log(priv, 0, next_entry, mode,
+                                              pos, buf, bufsz);
+        } else
+                pos = iwl3945_print_last_event_logs(priv, capacity, num_wraps,
+                                                    next_entry, size, mode,
+                                                    pos, buf, bufsz);
+#else
+        pos = iwl3945_print_last_event_logs(priv, capacity, num_wraps,
+                                            next_entry, size, mode,
+                                            pos, buf, bufsz);
 #endif
+        return pos;
+}
 
 static void iwl3945_irq_tasklet(struct iwl_priv *priv)
 {
@@ -1685,6 +1741,8 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
         }
 #endif
 
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         /* Since CSR_INT and CSR_FH_INT_STATUS reads and clears are not
          * atomic, make sure that inta covers all the interrupts that
          * we've discovered, even if FH interrupt came in just after
@@ -1706,8 +1764,6 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
 
                 handled |= CSR_INT_BIT_HW_ERR;
 
-                spin_unlock_irqrestore(&priv->lock, flags);
-
                 return;
         }
 
@@ -1799,7 +1855,6 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
                         "flags 0x%08lx\n", inta, inta_mask, inta_fh, flags);
         }
 #endif
-        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 static int iwl3945_get_channels_for_scan(struct iwl_priv *priv,
@@ -1901,7 +1956,7 @@ static void iwl3945_init_hw_rates(struct iwl_priv *priv,
 {
         int i;
 
-        for (i = 0; i < IWL_RATE_COUNT; i++) {
+        for (i = 0; i < IWL_RATE_COUNT_LEGACY; i++) {
                 rates[i].bitrate = iwl3945_rates[i].ieee * 5;
                 rates[i].hw_value = i; /* Rate scaling will work on indexes */
                 rates[i].hw_value_short = i;
@@ -2158,6 +2213,14 @@ static int iwl3945_read_ucode(struct iwl_priv *priv)
                 IWL_UCODE_API(priv->ucode_ver),
                 IWL_UCODE_SERIAL(priv->ucode_ver));
 
+        snprintf(priv->hw->wiphy->fw_version,
+                 sizeof(priv->hw->wiphy->fw_version),
+                 "%u.%u.%u.%u",
+                 IWL_UCODE_MAJOR(priv->ucode_ver),
+                 IWL_UCODE_MINOR(priv->ucode_ver),
+                 IWL_UCODE_API(priv->ucode_ver),
+                 IWL_UCODE_SERIAL(priv->ucode_ver));
+
         IWL_DEBUG_INFO(priv, "f/w package hdr ucode version raw = 0x%x\n",
                        priv->ucode_ver);
         IWL_DEBUG_INFO(priv, "f/w package hdr runtime inst size = %u\n",
@@ -2458,7 +2521,7 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
         priv->active_rate = priv->rates_mask;
         priv->active_rate_basic = priv->rates_mask & IWL_BASIC_RATES_MASK;
 
-        iwl_power_update_mode(priv, false);
+        iwl_power_update_mode(priv, true);
 
         if (iwl_is_associated(priv)) {
                 struct iwl3945_rxon_cmd *active_rxon =
@@ -2479,7 +2542,7 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
 
         iwl3945_reg_txpower_periodic(priv);
 
-        iwl3945_led_register(priv);
+        iwl_leds_init(priv);
 
         IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
         set_bit(STATUS_READY, &priv->status);
@@ -2517,7 +2580,6 @@ static void __iwl3945_down(struct iwl_priv *priv)
         if (!exit_pending)
                 set_bit(STATUS_EXIT_PENDING, &priv->status);
 
-        iwl3945_led_unregister(priv);
         iwl_clear_stations_table(priv);
 
         /* Unblock any waiting calls */
@@ -2563,23 +2625,15 @@ static void __iwl3945_down(struct iwl_priv *priv)
                         test_bit(STATUS_EXIT_PENDING, &priv->status) <<
                                 STATUS_EXIT_PENDING;
 
-        priv->cfg->ops->lib->apm_ops.reset(priv);
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         iwl3945_hw_txq_ctx_stop(priv);
         iwl3945_hw_rxq_stop(priv);
 
-        iwl_write_prph(priv, APMG_CLK_DIS_REG,
-                                APMG_CLK_VAL_DMA_CLK_RQT);
-
+        /* Power-down device's busmaster DMA clocks */
+        iwl_write_prph(priv, APMG_CLK_DIS_REG, APMG_CLK_VAL_DMA_CLK_RQT);
         udelay(5);
 
-        if (exit_pending)
-                priv->cfg->ops->lib->apm_ops.stop(priv);
-        else
-                priv->cfg->ops->lib->apm_ops.reset(priv);
+        /* Stop the device, and put it in low power state */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
 
  exit:
         memset(&priv->card_alive, 0, sizeof(struct iwl_alive_resp));
@@ -2724,19 +2778,34 @@ static void iwl3945_bg_alive_start(struct work_struct *data)
         mutex_unlock(&priv->mutex);
 }
 
+/*
+ * 3945 cannot interrupt driver when hardware rf kill switch toggles;
+ * driver must poll CSR_GP_CNTRL_REG register for change.  This register
+ * *is* readable even when device has been SW_RESET into low power mode
+ * (e.g. during RF KILL).
+ */
 static void iwl3945_rfkill_poll(struct work_struct *data)
 {
         struct iwl_priv *priv =
             container_of(data, struct iwl_priv, rfkill_poll.work);
+        bool old_rfkill = test_bit(STATUS_RF_KILL_HW, &priv->status);
+        bool new_rfkill = !(iwl_read32(priv, CSR_GP_CNTRL)
+                        & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW);
 
-        if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
-                clear_bit(STATUS_RF_KILL_HW, &priv->status);
-        else
-                set_bit(STATUS_RF_KILL_HW, &priv->status);
+        if (new_rfkill != old_rfkill) {
+                if (new_rfkill)
+                        set_bit(STATUS_RF_KILL_HW, &priv->status);
+                else
+                        clear_bit(STATUS_RF_KILL_HW, &priv->status);
 
-        wiphy_rfkill_set_hw_state(priv->hw->wiphy,
-                        test_bit(STATUS_RF_KILL_HW, &priv->status));
+                wiphy_rfkill_set_hw_state(priv->hw->wiphy, new_rfkill);
 
+                IWL_DEBUG_RF_KILL(priv, "RF_KILL bit toggled to %s.\n",
+                                new_rfkill ? "disable radio" : "enable radio");
+        }
+
+        /* Keep this running, even if radio now enabled.  This will be
+         * cancelled in mac_start() if system decides to start again */
         queue_delayed_work(priv->workqueue, &priv->rfkill_poll,
                            round_jiffies_relative(2 * HZ));
 
@@ -2898,7 +2967,8 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                  * is marked passive, we can do active scanning if we
                  * detect transmissions.
                  */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_DISABLED;
                 band = IEEE80211_BAND_5GHZ;
         } else {
                 IWL_WARN(priv, "Invalid scan band count\n");
@@ -2957,18 +3027,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
         mutex_unlock(&priv->mutex);
 }
 
-static void iwl3945_bg_up(struct work_struct *data)
-{
-        struct iwl_priv *priv = container_of(data, struct iwl_priv, up);
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        mutex_lock(&priv->mutex);
-        __iwl3945_up(priv);
-        mutex_unlock(&priv->mutex);
-}
-
 static void iwl3945_bg_restart(struct work_struct *data)
 {
         struct iwl_priv *priv = container_of(data, struct iwl_priv, restart);
@@ -2985,7 +3043,13 @@ static void iwl3945_bg_restart(struct work_struct *data)
                 ieee80211_restart_hw(priv->hw);
         } else {
                 iwl3945_down(priv);
-                queue_work(priv->workqueue, &priv->up);
+
+                if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                        return;
+
+                mutex_lock(&priv->mutex);
+                __iwl3945_up(priv);
+                mutex_unlock(&priv->mutex);
         }
 }
 
@@ -3152,6 +3216,8 @@ static int iwl3945_mac_start(struct ieee80211_hw *hw)
          * no need to poll the killswitch state anymore */
         cancel_delayed_work(&priv->rfkill_poll);
 
+        iwl_led_start(priv);
+
         priv->is_open = 1;
         IWL_DEBUG_MAC80211(priv, "leave\n");
         return 0;
@@ -3487,8 +3553,6 @@ static ssize_t store_filter_flags(struct device *d,
 static DEVICE_ATTR(filter_flags, S_IWUSR | S_IRUGO, show_filter_flags,
                    store_filter_flags);
 
-#ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
-
 static ssize_t show_measurement(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
@@ -3558,7 +3622,6 @@ static ssize_t store_measurement(struct device *d,
 
 static DEVICE_ATTR(measurement, S_IRUSR | S_IWUSR,
                    show_measurement, store_measurement);
-#endif /* CONFIG_IWL3945_SPECTRUM_MEASUREMENT */
 
 static ssize_t store_retry_rate(struct device *d,
                                 struct device_attribute *attr,
@@ -3606,7 +3669,7 @@ static ssize_t show_statistics(struct device *d,
                 return -EAGAIN;
 
         mutex_lock(&priv->mutex);
-        rc = iwl_send_statistics_request(priv, 0);
+        rc = iwl_send_statistics_request(priv, CMD_SYNC, false);
         mutex_unlock(&priv->mutex);
 
         if (rc) {
@@ -3707,7 +3770,6 @@ static void iwl3945_setup_deferred_work(struct iwl_priv *priv)
 
         init_waitqueue_head(&priv->wait_command_queue);
 
-        INIT_WORK(&priv->up, iwl3945_bg_up);
         INIT_WORK(&priv->restart, iwl3945_bg_restart);
         INIT_WORK(&priv->rx_replenish, iwl3945_bg_rx_replenish);
         INIT_WORK(&priv->beacon_update, iwl3945_bg_beacon_update);
@@ -3741,9 +3803,7 @@ static struct attribute *iwl3945_sysfs_entries[] = {
         &dev_attr_dump_errors.attr,
         &dev_attr_flags.attr,
         &dev_attr_filter_flags.attr,
-#ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
         &dev_attr_measurement.attr,
-#endif
         &dev_attr_retry_rate.attr,
         &dev_attr_statistics.attr,
         &dev_attr_status.attr,
@@ -3769,7 +3829,6 @@ static struct ieee80211_ops iwl3945_hw_ops = {
         .config = iwl_mac_config,
         .configure_filter = iwl_configure_filter,
         .set_key = iwl3945_mac_set_key,
-        .get_tx_stats = iwl_mac_get_tx_stats,
         .conf_tx = iwl_mac_conf_tx,
         .reset_tsf = iwl_mac_reset_tsf,
         .bss_info_changed = iwl_bss_info_changed,
@@ -3784,23 +3843,23 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         priv->retry_rate = 1;
         priv->ibss_beacon = NULL;
 
-        spin_lock_init(&priv->lock);
         spin_lock_init(&priv->sta_lock);
         spin_lock_init(&priv->hcmd_lock);
 
         INIT_LIST_HEAD(&priv->free_frames);
 
         mutex_init(&priv->mutex);
+        mutex_init(&priv->sync_cmd_mutex);
 
         /* Clear the driver's (not device's) station table */
         iwl_clear_stations_table(priv);
 
-        priv->data_retry_limit = -1;
         priv->ieee_channels = NULL;
         priv->ieee_rates = NULL;
         priv->band = IEEE80211_BAND_2GHZ;
 
         priv->iw_mode = NL80211_IFTYPE_STATION;
+        priv->missed_beacon_threshold = IWL_MISSED_BEACON_THRESHOLD_DEF;
 
         iwl_reset_qos(priv);
 
@@ -3854,18 +3913,18 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
         /* Tell mac80211 our characteristics */
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
                     IEEE80211_HW_NOISE_DBM |
-                    IEEE80211_HW_SPECTRUM_MGMT |
-                    IEEE80211_HW_SUPPORTS_PS |
-                    IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
+                    IEEE80211_HW_SPECTRUM_MGMT;
+
+        if (!priv->cfg->broken_powersave)
+                hw->flags |= IEEE80211_HW_SUPPORTS_PS |
+                             IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
 
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC);
 
-        hw->wiphy->custom_regulatory = true;
-
-        /* Firmware does not support this */
-        hw->wiphy->disable_beacon_hints = true;
+        hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY |
+                            WIPHY_FLAG_DISABLE_BEACON_HINTS;
 
         hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX_3945;
         /* we create the 802.11 header and a zero-length SSID element */
@@ -3977,17 +4036,18 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
          * PCI Tx retries from interfering with C3 CPU state */
         pci_write_config_byte(pdev, 0x41, 0x00);
 
-        /* this spin lock will be used in apm_ops.init and EEPROM access
+        /* these spin locks will be used in apm_ops.init and EEPROM access
          * we should init now
          */
         spin_lock_init(&priv->reg_lock);
+        spin_lock_init(&priv->lock);
 
-        /* amp init */
-        err = priv->cfg->ops->lib->apm_ops.init(priv);
-        if (err < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                goto out_iounmap;
-        }
+        /*
+         * stop and reset the on-board processor just in case it is in a
+         * strange state ... like being left stranded by a primary kernel
+         * and this is now the kdump kernel trying to start up
+         */
+        iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
 
         /***********************
          * 4. Read EEPROM
@@ -4054,6 +4114,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
                              &priv->bands[IEEE80211_BAND_2GHZ].channels[5]);
         iwl3945_setup_deferred_work(priv);
         iwl3945_setup_rx_handlers(priv);
+        iwl_power_initialize(priv);
 
         /*********************************
          * 8. Setup and Register mac80211
@@ -4124,6 +4185,15 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
                 iwl3945_down(priv);
         }
 
+        /*
+         * Make sure device is reset to low power before unloading driver.
+         * This may be redundant with iwl_down(), but there are paths to
+         * run iwl_down() without calling apm_ops.stop(), and there are
+         * paths to avoid running iwl_down() at all before leaving driver.
+         * This (inexpensive) call *makes sure* device is reset.
+         */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
+
         /* make sure we flush any pending irq or
          * tasklet for the driver
          */
@@ -4226,18 +4296,19 @@ static void __exit iwl3945_exit(void)
 
 MODULE_FIRMWARE(IWL3945_MODULE_FIRMWARE(IWL3945_UCODE_API_MAX));
 
-module_param_named(antenna, iwl3945_mod_params.antenna, int, 0444);
+module_param_named(antenna, iwl3945_mod_params.antenna, int, S_IRUGO);
 MODULE_PARM_DESC(antenna, "select antenna (1=Main, 2=Aux, default 0 [both])");
-module_param_named(swcrypto, iwl3945_mod_params.sw_crypto, int, 0444);
+module_param_named(swcrypto, iwl3945_mod_params.sw_crypto, int, S_IRUGO);
 MODULE_PARM_DESC(swcrypto,
                  "using software crypto (default 1 [software])\n");
 #ifdef CONFIG_IWLWIFI_DEBUG
-module_param_named(debug, iwl_debug_level, uint, 0644);
+module_param_named(debug, iwl_debug_level, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "debug output mask");
 #endif
-module_param_named(disable_hw_scan, iwl3945_mod_params.disable_hw_scan, int, 0444);
+module_param_named(disable_hw_scan, iwl3945_mod_params.disable_hw_scan,
+                   int, S_IRUGO);
 MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 0)");
-module_param_named(fw_restart3945, iwl3945_mod_params.restart_fw, int, 0444);
+module_param_named(fw_restart3945, iwl3945_mod_params.restart_fw, int, S_IRUGO);
 MODULE_PARM_DESC(fw_restart3945, "restart firmware in case of error");
 
 module_exit(iwl3945_exit);
diff --git a/drivers/net/wireless/iwmc3200wifi/Kconfig b/drivers/net/wireless/iwmc3200wifi/Kconfig
index c25a04371ca8..b9d34a766964 100644
--- a/drivers/net/wireless/iwmc3200wifi/Kconfig
+++ b/drivers/net/wireless/iwmc3200wifi/Kconfig
@@ -1,8 +1,9 @@
 config IWM
         tristate "Intel Wireless Multicomm 3200 WiFi driver"
-        depends on MMC && WLAN_80211 && EXPERIMENTAL
+        depends on MMC && EXPERIMENTAL
         depends on CFG80211
         select FW_LOADER
+        select IWMC3200TOP
         help
           The Intel Wireless Multicomm 3200 hardware is a combo
           card with GPS, Bluetooth, WiMax and 802.11 radios. It
diff --git a/drivers/net/wireless/iwmc3200wifi/cfg80211.c b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
index f3c55658225b..a1d45cce0ebc 100644
--- a/drivers/net/wireless/iwmc3200wifi/cfg80211.c
+++ b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
@@ -27,6 +27,7 @@
 #include <linux/etherdevice.h>
 #include <linux/wireless.h>
 #include <linux/ieee80211.h>
+#include <linux/slab.h>
 #include <net/cfg80211.h>
 
 #include "iwm.h"
@@ -405,39 +406,21 @@ static int iwm_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
 {
         struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
         struct ieee80211_channel *chan = params->channel;
-        struct cfg80211_bss *bss;
 
         if (!test_bit(IWM_STATUS_READY, &iwm->status))
                 return -EIO;
 
-        /* UMAC doesn't support creating IBSS network with specified bssid.
-         * This should be removed after we have join only mode supported. */
+        /* UMAC doesn't support creating or joining an IBSS network
+         * with specified bssid. */
         if (params->bssid)
                 return -EOPNOTSUPP;
 
-        bss = cfg80211_get_ibss(iwm_to_wiphy(iwm), NULL,
-                                params->ssid, params->ssid_len);
-        if (!bss) {
-                iwm_scan_one_ssid(iwm, params->ssid, params->ssid_len);
-                schedule_timeout_interruptible(2 * HZ);
-                bss = cfg80211_get_ibss(iwm_to_wiphy(iwm), NULL,
-                                        params->ssid, params->ssid_len);
-        }
-        /* IBSS join only mode is not supported by UMAC ATM */
-        if (bss) {
-                cfg80211_put_bss(bss);
-                return -EOPNOTSUPP;
-        }
-
         iwm->channel = ieee80211_frequency_to_channel(chan->center_freq);
         iwm->umac_profile->ibss.band = chan->band;
         iwm->umac_profile->ibss.channel = iwm->channel;
         iwm->umac_profile->ssid.ssid_len = params->ssid_len;
         memcpy(iwm->umac_profile->ssid.ssid, params->ssid, params->ssid_len);
 
-        if (params->bssid)
-                memcpy(&iwm->umac_profile->bssid[0], params->bssid, ETH_ALEN);
-
         return iwm_send_mlme_profile(iwm);
 }
 
@@ -490,12 +473,12 @@ static int iwm_set_wpa_version(struct iwm_priv *iwm, u32 wpa_version)
                 return 0;
         }
 
+        if (wpa_version & NL80211_WPA_VERSION_1)
+                iwm->umac_profile->sec.flags = UMAC_SEC_FLG_WPA_ON_MSK;
+
         if (wpa_version & NL80211_WPA_VERSION_2)
                 iwm->umac_profile->sec.flags = UMAC_SEC_FLG_RSNA_ON_MSK;
 
-        if (wpa_version & NL80211_WPA_VERSION_1)
-                iwm->umac_profile->sec.flags |= UMAC_SEC_FLG_WPA_ON_MSK;
-
         return 0;
 }
 
@@ -646,6 +629,13 @@ static int iwm_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                 iwm->default_key = sme->key_idx;
         }
 
+        /* WPA and open AUTH type from wpa_s means WPS (a.k.a. WSC) */
+        if ((iwm->umac_profile->sec.flags &
+             (UMAC_SEC_FLG_WPA_ON_MSK | UMAC_SEC_FLG_RSNA_ON_MSK)) &&
+            iwm->umac_profile->sec.auth_type == UMAC_AUTH_TYPE_OPEN) {
+                        iwm->umac_profile->sec.flags = UMAC_SEC_FLG_WSC_ON_MSK;
+        }
+
         ret = iwm_send_mlme_profile(iwm);
 
         if (iwm->umac_profile->sec.auth_type != UMAC_AUTH_TYPE_LEGACY_PSK ||
@@ -682,10 +672,24 @@ static int iwm_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
 static int iwm_cfg80211_set_txpower(struct wiphy *wiphy,
                                     enum tx_power_setting type, int dbm)
 {
+        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+        int ret;
+
         switch (type) {
         case TX_POWER_AUTOMATIC:
                 return 0;
+        case TX_POWER_FIXED:
+                if (!test_bit(IWM_STATUS_READY, &iwm->status))
+                        return 0;
+
+                ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
+                                              CFG_TX_PWR_LIMIT_USR, dbm * 2);
+                if (ret < 0)
+                        return ret;
+
+                return iwm_tx_power_trigger(iwm);
         default:
+                IWM_ERR(iwm, "Unsupported power type: %d\n", type);
                 return -EOPNOTSUPP;
         }
 
@@ -696,7 +700,7 @@ static int iwm_cfg80211_get_txpower(struct wiphy *wiphy, int *dbm)
 {
         struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
 
-        *dbm = iwm->txpower;
+        *dbm = iwm->txpower >> 1;
 
         return 0;
 }
@@ -722,6 +726,33 @@ static int iwm_cfg80211_set_power_mgmt(struct wiphy *wiphy,
                                        CFG_POWER_INDEX, iwm->conf.power_index);
 }
 
+int iwm_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *netdev,
+                           struct cfg80211_pmksa *pmksa)
+{
+        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+
+        return iwm_send_pmkid_update(iwm, pmksa, IWM_CMD_PMKID_ADD);
+}
+
+int iwm_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *netdev,
+                           struct cfg80211_pmksa *pmksa)
+{
+        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+
+        return iwm_send_pmkid_update(iwm, pmksa, IWM_CMD_PMKID_DEL);
+}
+
+int iwm_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *netdev)
+{
+        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+        struct cfg80211_pmksa pmksa;
+
+        memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
+
+        return iwm_send_pmkid_update(iwm, &pmksa, IWM_CMD_PMKID_FLUSH);
+}
+
+
 static struct cfg80211_ops iwm_cfg80211_ops = {
         .change_virtual_intf = iwm_cfg80211_change_iface,
         .add_key = iwm_cfg80211_add_key,
@@ -738,6 +769,9 @@ static struct cfg80211_ops iwm_cfg80211_ops = {
         .set_tx_power = iwm_cfg80211_set_txpower,
         .get_tx_power = iwm_cfg80211_get_txpower,
         .set_power_mgmt = iwm_cfg80211_set_power_mgmt,
+        .set_pmksa = iwm_cfg80211_set_pmksa,
+        .del_pmksa = iwm_cfg80211_del_pmksa,
+        .flush_pmksa = iwm_cfg80211_flush_pmksa,
 };
 
 static const u32 cipher_suites[] = {
@@ -783,6 +817,7 @@ struct wireless_dev *iwm_wdev_alloc(int sizeof_bus, struct device *dev)
 
         set_wiphy_dev(wdev->wiphy, dev);
         wdev->wiphy->max_scan_ssids = UMAC_WIFI_IF_PROBE_OPTION_MAX;
+        wdev->wiphy->max_num_pmkids = UMAC_MAX_NUM_PMKIDS;
         wdev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                                        BIT(NL80211_IFTYPE_ADHOC);
         wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &iwm_band_2ghz;
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
index 84158b6d35d8..42df7262f9f7 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ b/drivers/net/wireless/iwmc3200wifi/commands.c
@@ -41,6 +41,7 @@
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 
 #include "iwm.h"
 #include "bus.h"
@@ -77,6 +78,11 @@ int iwm_send_wifi_if_cmd(struct iwm_priv *iwm, void *payload, u16 payload_size,
         int ret;
         u8 oid = hdr->oid;
 
+        if (!test_bit(IWM_STATUS_READY, &iwm->status)) {
+                IWM_ERR(iwm, "Interface is not ready yet");
+                return -EAGAIN;
+        }
+
         umac_cmd.id = UMAC_CMD_OPCODE_WIFI_IF_WRAPPER;
         umac_cmd.resp = resp;
 
@@ -94,6 +100,10 @@ int iwm_send_wifi_if_cmd(struct iwm_priv *iwm, void *payload, u16 payload_size,
         return ret;
 }
 
+static int modparam_wiwi = COEX_MODE_CM;
+module_param_named(wiwi, modparam_wiwi, int, 0644);
+MODULE_PARM_DESC(wiwi, "Wifi-WiMAX coexistence: 1=SA, 2=XOR, 3=CM (default)");
+
 static struct coex_event iwm_sta_xor_prio_tbl[COEX_EVENTS_NUM] =
 {
         {4, 3, 0, COEX_UNASSOC_IDLE_FLAGS},
@@ -117,18 +127,18 @@ static struct coex_event iwm_sta_xor_prio_tbl[COEX_EVENTS_NUM] =
 static struct coex_event iwm_sta_cm_prio_tbl[COEX_EVENTS_NUM] =
 {
         {1, 1, 0, COEX_UNASSOC_IDLE_FLAGS},
-        {4, 3, 0, COEX_UNASSOC_MANUAL_SCAN_FLAGS},
+        {4, 4, 0, COEX_UNASSOC_MANUAL_SCAN_FLAGS},
         {3, 3, 0, COEX_UNASSOC_AUTO_SCAN_FLAGS},
-        {5, 5, 0, COEX_CALIBRATION_FLAGS},
+        {6, 6, 0, COEX_CALIBRATION_FLAGS},
         {3, 3, 0, COEX_PERIODIC_CALIBRATION_FLAGS},
-        {5, 4, 0, COEX_CONNECTION_ESTAB_FLAGS},
+        {6, 5, 0, COEX_CONNECTION_ESTAB_FLAGS},
         {4, 4, 0, COEX_ASSOCIATED_IDLE_FLAGS},
         {4, 4, 0, COEX_ASSOC_MANUAL_SCAN_FLAGS},
         {4, 4, 0, COEX_ASSOC_AUTO_SCAN_FLAGS},
         {4, 4, 0, COEX_ASSOC_ACTIVE_LEVEL_FLAGS},
         {1, 1, 0, COEX_RF_ON_FLAGS},
         {1, 1, 0, COEX_RF_OFF_FLAGS},
-        {6, 6, 0, COEX_STAND_ALONE_DEBUG_FLAGS},
+        {7, 7, 0, COEX_STAND_ALONE_DEBUG_FLAGS},
         {5, 4, 0, COEX_IPAN_ASSOC_LEVEL_FLAGS},
         {1, 1, 0, COEX_RSRVD1_FLAGS},
         {1, 1, 0, COEX_RSRVD2_FLAGS}
@@ -143,7 +153,7 @@ int iwm_send_prio_table(struct iwm_priv *iwm)
 
         coex_table_cmd.flags = COEX_FLAGS_STA_TABLE_VALID_MSK;
 
-        switch (iwm->conf.coexist_mode) {
+        switch (modparam_wiwi) {
         case COEX_MODE_XOR:
         case COEX_MODE_CM:
                 coex_enabled = 1;
@@ -168,7 +178,7 @@ int iwm_send_prio_table(struct iwm_priv *iwm)
                                         COEX_FLAGS_ASSOC_WAKEUP_UMASK_MSK |
                                         COEX_FLAGS_UNASSOC_WAKEUP_UMASK_MSK;
 
-                switch (iwm->conf.coexist_mode) {
+                switch (modparam_wiwi) {
                 case COEX_MODE_XOR:
                         memcpy(coex_table_cmd.sta_prio, iwm_sta_xor_prio_tbl,
                                sizeof(iwm_sta_xor_prio_tbl));
@@ -179,7 +189,7 @@ int iwm_send_prio_table(struct iwm_priv *iwm)
                         break;
                 default:
                         IWM_ERR(iwm, "Invalid coex_mode 0x%x\n",
-                                iwm->conf.coexist_mode);
+                                modparam_wiwi);
                         break;
                 }
         } else
@@ -187,7 +197,7 @@ int iwm_send_prio_table(struct iwm_priv *iwm)
 
         return iwm_send_lmac_ptrough_cmd(iwm, COEX_PRIORITY_TABLE_CMD,
                                 &coex_table_cmd,
-                                sizeof(struct iwm_coex_prio_table_cmd), 1);
+                                sizeof(struct iwm_coex_prio_table_cmd), 0);
 }
 
 int iwm_send_init_calib_cfg(struct iwm_priv *iwm, u8 calib_requested)
@@ -275,6 +285,17 @@ int iwm_send_calib_results(struct iwm_priv *iwm)
         return ret;
 }
 
+int iwm_send_ct_kill_cfg(struct iwm_priv *iwm, u8 entry, u8 exit)
+{
+        struct iwm_ct_kill_cfg_cmd cmd;
+
+        cmd.entry_threshold = entry;
+        cmd.exit_threshold = exit;
+
+        return iwm_send_lmac_ptrough_cmd(iwm, REPLY_CT_KILL_CONFIG_CMD, &cmd,
+                                         sizeof(struct iwm_ct_kill_cfg_cmd), 0);
+}
+
 int iwm_send_umac_reset(struct iwm_priv *iwm, __le32 reset_flags, bool resp)
 {
         struct iwm_udma_wifi_cmd udma_cmd = UDMA_UMAC_INIT;
@@ -380,7 +401,7 @@ int iwm_send_umac_config(struct iwm_priv *iwm, __le32 reset_flags)
                 return ret;
 
         ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_COEX_MODE, iwm->conf.coexist_mode);
+                                      CFG_COEX_MODE, modparam_wiwi);
         if (ret < 0)
                 return ret;
 
@@ -778,11 +799,24 @@ int iwm_invalidate_mlme_profile(struct iwm_priv *iwm)
                 return ret;
 
         ret = wait_event_interruptible_timeout(iwm->mlme_queue,
-                                (iwm->umac_profile_active == 0), 2 * HZ);
+                                (iwm->umac_profile_active == 0), 5 * HZ);
 
         return ret ? 0 : -EBUSY;
 }
 
+int iwm_tx_power_trigger(struct iwm_priv *iwm)
+{
+        struct iwm_umac_pwr_trigger pwr_trigger;
+
+        pwr_trigger.hdr.oid = UMAC_WIFI_IF_CMD_TX_PWR_TRIGGER;
+        pwr_trigger.hdr.buf_size =
+                cpu_to_le16(sizeof(struct iwm_umac_pwr_trigger) -
+                            sizeof(struct iwm_umac_wifi_if));
+
+
+        return iwm_send_wifi_if_cmd(iwm, &pwr_trigger, sizeof(pwr_trigger), 1);
+}
+
 int iwm_send_umac_stats_req(struct iwm_priv *iwm, u32 flags)
 {
         struct iwm_udma_wifi_cmd udma_cmd = UDMA_UMAC_INIT;
@@ -900,3 +934,62 @@ int iwm_target_reset(struct iwm_priv *iwm)
 
         return iwm_hal_send_target_cmd(iwm, &target_cmd, NULL);
 }
+
+int iwm_send_umac_stop_resume_tx(struct iwm_priv *iwm,
+                                 struct iwm_umac_notif_stop_resume_tx *ntf)
+{
+        struct iwm_udma_wifi_cmd udma_cmd = UDMA_UMAC_INIT;
+        struct iwm_umac_cmd umac_cmd;
+        struct iwm_umac_cmd_stop_resume_tx stp_res_cmd;
+        struct iwm_sta_info *sta_info;
+        u8 sta_id = STA_ID_N_COLOR_ID(ntf->sta_id);
+        int i;
+
+        sta_info = &iwm->sta_table[sta_id];
+        if (!sta_info->valid) {
+                IWM_ERR(iwm, "Invalid STA: %d\n", sta_id);
+                return -EINVAL;
+        }
+
+        umac_cmd.id = UMAC_CMD_OPCODE_STOP_RESUME_STA_TX;
+        umac_cmd.resp = 0;
+
+        stp_res_cmd.flags = ntf->flags;
+        stp_res_cmd.sta_id = ntf->sta_id;
+        stp_res_cmd.stop_resume_tid_msk = ntf->stop_resume_tid_msk;
+        for (i = 0; i < IWM_UMAC_TID_NR; i++)
+                stp_res_cmd.last_seq_num[i] =
+                        sta_info->tid_info[i].last_seq_num;
+
+        return iwm_hal_send_umac_cmd(iwm, &udma_cmd, &umac_cmd, &stp_res_cmd,
+                                 sizeof(struct iwm_umac_cmd_stop_resume_tx));
+
+}
+
+int iwm_send_pmkid_update(struct iwm_priv *iwm,
+                          struct cfg80211_pmksa *pmksa, u32 command)
+{
+        struct iwm_umac_pmkid_update update;
+        int ret;
+
+        memset(&update, 0, sizeof(struct iwm_umac_pmkid_update));
+
+        update.hdr.oid = UMAC_WIFI_IF_CMD_PMKID_UPDATE;
+        update.hdr.buf_size = cpu_to_le16(sizeof(struct iwm_umac_pmkid_update) -
+                                          sizeof(struct iwm_umac_wifi_if));
+
+        update.command = cpu_to_le32(command);
+        if (pmksa->bssid)
+                memcpy(&update.bssid, pmksa->bssid, ETH_ALEN);
+        if (pmksa->pmkid)
+                memcpy(&update.pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
+
+        ret = iwm_send_wifi_if_cmd(iwm, &update,
+                                   sizeof(struct iwm_umac_pmkid_update), 0);
+        if (ret) {
+                IWM_ERR(iwm, "PMKID update command failed\n");
+                return ret;
+        }
+
+        return 0;
+}
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.h b/drivers/net/wireless/iwmc3200wifi/commands.h
index e24d5b633997..3dfd9f0e9003 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.h
+++ b/drivers/net/wireless/iwmc3200wifi/commands.h
@@ -102,7 +102,6 @@ enum {
         CFG_SCAN_NUM_PASSIVE_CHAN_PER_PARTIAL_SCAN,
         CFG_TLC_SUPPORTED_TX_HT_RATES,
         CFG_TLC_SUPPORTED_TX_RATES,
-        CFG_TLC_VALID_ANTENNA,
         CFG_TLC_SPATIAL_STREAM_SUPPORTED,
         CFG_TLC_RETRY_PER_RATE,
         CFG_TLC_RETRY_PER_HT_RATE,
@@ -136,6 +135,10 @@ enum {
         CFG_TLC_RENEW_ADDBA_DELAY,
         CFG_TLC_NUM_OF_MULTISEC_TO_COUN_LOAD,
         CFG_TLC_IS_STABLE_IN_HT,
+        CFG_TLC_SR_SIC_1ST_FAIL,
+        CFG_TLC_SR_SIC_1ST_PASS,
+        CFG_TLC_SR_SIC_TOTAL_FAIL,
+        CFG_TLC_SR_SIC_TOTAL_PASS,
         CFG_RLC_CHAIN_CTRL,
         CFG_TRK_TABLE_OP_MODE,
         CFG_TRK_TABLE_RSSI_THRESHOLD,
@@ -147,6 +150,58 @@ enum {
         CFG_MLME_DBG_NOTIF_BLOCK,
         CFG_BT_OFF_BECONS_INTERVALS,
         CFG_BT_FRAG_DURATION,
+        CFG_ACTIVE_CHAINS,
+        CFG_CALIB_CTRL,
+        CFG_CAPABILITY_SUPPORTED_HT_RATES,
+        CFG_HT_MAC_PARAM_INFO,
+        CFG_MIMO_PS_MODE,
+        CFG_HT_DEFAULT_CAPABILIES_INFO,
+        CFG_LED_SC_RESOLUTION_FACTOR,
+        CFG_PTAM_ENERGY_CCK_DET_DEFAULT,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_MRC_DEFAULT,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_DEFAULT,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_MRC_DEFAULT,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_DEFAULT,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_MRC_DEFAULT,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_DEFAULT,
+        CFG_PTAM_ENERGY_CCK_DET_MIN_VAL,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_MRC_MIN_VAL,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_MIN_VAL,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_MRC_MIN_VAL,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_MIN_VAL,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_MRC_MIN_VAL,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_MIN_VAL,
+        CFG_PTAM_ENERGY_CCK_DET_MAX_VAL,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_MRC_MAX_VAL,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_MAX_VAL,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_MRC_MAX_VAL,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_MAX_VAL,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_MRC_MAX_VAL,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_MAX_VAL,
+        CFG_PTAM_ENERGY_CCK_DET_STEP_VAL,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_MRC_STEP_VAL,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_STEP_VAL,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_MRC_STEP_VAL,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_STEP_VAL,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_MRC_STEP_VAL,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_STEP_VAL,
+        CFG_PTAM_LINK_SENS_FA_OFDM_MAX,
+        CFG_PTAM_LINK_SENS_FA_OFDM_MIN,
+        CFG_PTAM_LINK_SENS_FA_CCK_MAX,
+        CFG_PTAM_LINK_SENS_FA_CCK_MIN,
+        CFG_PTAM_LINK_SENS_NRG_DIFF,
+        CFG_PTAM_LINK_SENS_NRG_MARGIN,
+        CFG_PTAM_LINK_SENS_MAX_NUMBER_OF_TIMES_IN_CCK_NO_FA,
+        CFG_PTAM_LINK_SENS_AUTO_CORR_MAX_TH_CCK,
+        CFG_AGG_MGG_TID_LOAD_ADDBA_THRESHOLD,
+        CFG_AGG_MGG_TID_LOAD_DELBA_THRESHOLD,
+        CFG_AGG_MGG_ADDBA_BUF_SIZE,
+        CFG_AGG_MGG_ADDBA_INACTIVE_TIMEOUT,
+        CFG_AGG_MGG_ADDBA_DEBUG_FLAGS,
+        CFG_SCAN_PERIODIC_RSSI_HIGH_THRESHOLD,
+        CFG_SCAN_PERIODIC_COEF_RSSI_HIGH,
+        CFG_11D_ENABLED,
+        CFG_11H_FEATURE_FLAGS,
 
         /* <-- LAST --> */
         CFG_TBL_FIX_LAST
@@ -155,7 +210,8 @@ enum {
 /* variable size table */
 enum {
         CFG_NET_ADDR = 0,
-        CFG_PROFILE,
+        CFG_LED_PATTERN_TABLE,
+
         /* <-- LAST --> */
         CFG_TBL_VAR_LAST
 };
@@ -288,6 +344,9 @@ struct iwm_umac_cmd_scan_request {
 /* iwm_umac_security.flag is WSC mode on -- bits [2:2] */
 #define UMAC_SEC_FLG_WSC_ON_POS         2
 #define UMAC_SEC_FLG_WSC_ON_SEED        1
+#define UMAC_SEC_FLG_WSC_ON_MSK         (UMAC_SEC_FLG_WSC_ON_SEED << \
+                                         UMAC_SEC_FLG_WSC_ON_POS)
+
 
 /* Legacy profile can use only WEP40 and WEP104 for encryption and
  * OPEN or PSK for authentication */
@@ -382,10 +441,35 @@ struct iwm_umac_tx_key_id {
         u8 reserved[3];
 } __attribute__ ((packed));
 
+struct iwm_umac_pwr_trigger {
+        struct iwm_umac_wifi_if hdr;
+        __le32 reseved;
+} __attribute__ ((packed));
+
 struct iwm_umac_cmd_stats_req {
         __le32 flags;
 } __attribute__ ((packed));
 
+struct iwm_umac_cmd_stop_resume_tx {
+        u8 flags;
+        u8 sta_id;
+        __le16 stop_resume_tid_msk;
+        __le16 last_seq_num[IWM_UMAC_TID_NR];
+        u16 reserved;
+} __attribute__ ((packed));
+
+#define IWM_CMD_PMKID_ADD   1
+#define IWM_CMD_PMKID_DEL   2
+#define IWM_CMD_PMKID_FLUSH 3
+
+struct iwm_umac_pmkid_update {
+        struct iwm_umac_wifi_if hdr;
+        __le32 command;
+        u8 bssid[ETH_ALEN];
+        __le16 reserved;
+        u8 pmkid[WLAN_PMKID_LEN];
+} __attribute__ ((packed));
+
 /* LMAC commands */
 int iwm_read_mac(struct iwm_priv *iwm, u8 *mac);
 int iwm_send_prio_table(struct iwm_priv *iwm);
@@ -393,6 +477,7 @@ int iwm_send_init_calib_cfg(struct iwm_priv *iwm, u8 calib_requested);
 int iwm_send_periodic_calib_cfg(struct iwm_priv *iwm, u8 calib_requested);
 int iwm_send_calib_results(struct iwm_priv *iwm);
 int iwm_store_rxiq_calib_result(struct iwm_priv *iwm);
+int iwm_send_ct_kill_cfg(struct iwm_priv *iwm, u8 entry, u8 exit);
 
 /* UMAC commands */
 int iwm_send_wifi_if_cmd(struct iwm_priv *iwm, void *payload, u16 payload_size,
@@ -407,11 +492,16 @@ int iwm_invalidate_mlme_profile(struct iwm_priv *iwm);
 int iwm_send_packet(struct iwm_priv *iwm, struct sk_buff *skb, int pool_id);
 int iwm_set_tx_key(struct iwm_priv *iwm, u8 key_idx);
 int iwm_set_key(struct iwm_priv *iwm, bool remove, struct iwm_key *key);
+int iwm_tx_power_trigger(struct iwm_priv *iwm);
 int iwm_send_umac_stats_req(struct iwm_priv *iwm, u32 flags);
 int iwm_send_umac_channel_list(struct iwm_priv *iwm);
 int iwm_scan_ssids(struct iwm_priv *iwm, struct cfg80211_ssid *ssids,
                    int ssid_num);
 int iwm_scan_one_ssid(struct iwm_priv *iwm, u8 *ssid, int ssid_len);
+int iwm_send_umac_stop_resume_tx(struct iwm_priv *iwm,
+                                 struct iwm_umac_notif_stop_resume_tx *ntf);
+int iwm_send_pmkid_update(struct iwm_priv *iwm,
+                          struct cfg80211_pmksa *pmksa, u32 command);
 
 /* UDMA commands */
 int iwm_target_reset(struct iwm_priv *iwm);
diff --git a/drivers/net/wireless/iwmc3200wifi/debugfs.c b/drivers/net/wireless/iwmc3200wifi/debugfs.c
index 1465379f900a..cbb81befdb55 100644
--- a/drivers/net/wireless/iwmc3200wifi/debugfs.c
+++ b/drivers/net/wireless/iwmc3200wifi/debugfs.c
@@ -21,6 +21,7 @@
  *
  */
 
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/bitops.h>
 #include <linux/debugfs.h>
@@ -89,7 +90,7 @@ static int iwm_debugfs_dbg_modules_write(void *data, u64 val)
         for (i = 0; i < __IWM_DM_NR; i++)
                 iwm->dbg.dbg_module[i] = 0;
 
-        for_each_bit(bit, &iwm->dbg.dbg_modules, __IWM_DM_NR)
+        for_each_set_bit(bit, &iwm->dbg.dbg_modules, __IWM_DM_NR)
                 iwm->dbg.dbg_module[bit] = iwm->dbg.dbg_level;
 
         return 0;
@@ -158,6 +159,29 @@ static ssize_t iwm_debugfs_txq_read(struct file *filp, char __user *buffer,
                 }
 
                 spin_unlock_irqrestore(&txq->queue.lock, flags);
+
+                spin_lock_irqsave(&txq->stopped_queue.lock, flags);
+
+                len += snprintf(buf + len, buf_len - len,
+                                "\tStopped Queue len:   %d\n",
+                                skb_queue_len(&txq->stopped_queue));
+                for (j = 0; j < skb_queue_len(&txq->stopped_queue); j++) {
+                        struct iwm_tx_info *tx_info;
+
+                        skb = skb->next;
+                        tx_info = skb_to_tx_info(skb);
+
+                        len += snprintf(buf + len, buf_len - len,
+                                        "\tSKB #%d\n", j);
+                        len += snprintf(buf + len, buf_len - len,
+                                        "\t\tsta:   %d\n", tx_info->sta);
+                        len += snprintf(buf + len, buf_len - len,
+                                        "\t\tcolor: %d\n", tx_info->color);
+                        len += snprintf(buf + len, buf_len - len,
+                                        "\t\ttid:   %d\n", tx_info->tid);
+                }
+
+                spin_unlock_irqrestore(&txq->stopped_queue.lock, flags);
         }
 
         ret = simple_read_from_buffer(buffer, len, ppos, buf, buf_len);
diff --git a/drivers/net/wireless/iwmc3200wifi/eeprom.c b/drivers/net/wireless/iwmc3200wifi/eeprom.c
index 365910fbe01e..e80e776b74f7 100644
--- a/drivers/net/wireless/iwmc3200wifi/eeprom.c
+++ b/drivers/net/wireless/iwmc3200wifi/eeprom.c
@@ -37,6 +37,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 
 #include "iwm.h"
 #include "umac.h"
@@ -66,6 +67,10 @@ static struct iwm_eeprom_entry eeprom_map[] = {
         [IWM_EEPROM_SKU_CAP] =
         {"SKU capabilities", IWM_EEPROM_SKU_CAP_OFF, IWM_EEPROM_SKU_CAP_LEN},
 
+        [IWM_EEPROM_FAT_CHANNELS_CAP] =
+        {"HT channels capabilities", IWM_EEPROM_FAT_CHANNELS_CAP_OFF,
+         IWM_EEPROM_FAT_CHANNELS_CAP_LEN},
+
         [IWM_EEPROM_CALIB_RXIQ_OFFSET] =
         {"RX IQ offset", IWM_EEPROM_CALIB_RXIQ_OFF, IWM_EEPROM_INDIRECT_LEN},
 
@@ -146,6 +151,52 @@ u8 *iwm_eeprom_access(struct iwm_priv *iwm, u8 eeprom_id)
         return iwm->eeprom + eeprom_map[eeprom_id].offset;
 }
 
+int iwm_eeprom_fat_channels(struct iwm_priv *iwm)
+{
+        struct wiphy *wiphy = iwm_to_wiphy(iwm);
+        struct ieee80211_supported_band *band;
+        u16 *channels, i;
+
+        channels = (u16 *)iwm_eeprom_access(iwm, IWM_EEPROM_FAT_CHANNELS_CAP);
+        if (IS_ERR(channels))
+                return PTR_ERR(channels);
+
+        band = wiphy->bands[IEEE80211_BAND_2GHZ];
+        band->ht_cap.ht_supported = true;
+
+        for (i = 0; i < IWM_EEPROM_FAT_CHANNELS_24; i++)
+                if (!(channels[i] & IWM_EEPROM_FAT_CHANNEL_ENABLED))
+                        band->ht_cap.ht_supported = false;
+
+        band = wiphy->bands[IEEE80211_BAND_5GHZ];
+        band->ht_cap.ht_supported = true;
+        for (i = IWM_EEPROM_FAT_CHANNELS_24; i < IWM_EEPROM_FAT_CHANNELS; i++)
+                if (!(channels[i] & IWM_EEPROM_FAT_CHANNEL_ENABLED))
+                        band->ht_cap.ht_supported = false;
+
+        return 0;
+}
+
+u32 iwm_eeprom_wireless_mode(struct iwm_priv *iwm)
+{
+        u16 sku_cap;
+        u32 wireless_mode = 0;
+
+        sku_cap = *((u16 *)iwm_eeprom_access(iwm, IWM_EEPROM_SKU_CAP));
+
+        if (sku_cap & IWM_EEPROM_SKU_CAP_BAND_24GHZ)
+                wireless_mode |= WIRELESS_MODE_11G;
+
+        if (sku_cap & IWM_EEPROM_SKU_CAP_BAND_52GHZ)
+                wireless_mode |= WIRELESS_MODE_11A;
+
+        if (sku_cap & IWM_EEPROM_SKU_CAP_11N_ENABLE)
+                wireless_mode |= WIRELESS_MODE_11N;
+
+        return wireless_mode;
+}
+
+
 int iwm_eeprom_init(struct iwm_priv *iwm)
 {
         int i, ret = 0;
diff --git a/drivers/net/wireless/iwmc3200wifi/eeprom.h b/drivers/net/wireless/iwmc3200wifi/eeprom.h
index cdb31a6a1f5f..4e3a3fdab0d3 100644
--- a/drivers/net/wireless/iwmc3200wifi/eeprom.h
+++ b/drivers/net/wireless/iwmc3200wifi/eeprom.h
@@ -48,6 +48,7 @@ enum {
         IWM_EEPROM_CARD_ID,
         IWM_EEPROM_RADIO_CONF,
         IWM_EEPROM_SKU_CAP,
+        IWM_EEPROM_FAT_CHANNELS_CAP,
 
         IWM_EEPROM_INDIRECT_OFFSET,
         IWM_EEPROM_CALIB_RXIQ_OFFSET = IWM_EEPROM_INDIRECT_OFFSET,
@@ -58,14 +59,15 @@ enum {
         IWM_EEPROM_LAST,
 };
 
-#define IWM_EEPROM_SIG_OFF             0x00
-#define IWM_EEPROM_VERSION_OFF        (0x54 << 1)
-#define IWM_EEPROM_OEM_HW_VERSION_OFF (0x56 << 1)
-#define IWM_EEPROM_MAC_VERSION_OFF    (0x30 << 1)
-#define IWM_EEPROM_CARD_ID_OFF        (0x5d << 1)
-#define IWM_EEPROM_RADIO_CONF_OFF     (0x58 << 1)
-#define IWM_EEPROM_SKU_CAP_OFF        (0x55 << 1)
-#define IWM_EEPROM_CALIB_CONFIG_OFF   (0x7c << 1)
+#define IWM_EEPROM_SIG_OFF                 0x00
+#define IWM_EEPROM_VERSION_OFF            (0x54 << 1)
+#define IWM_EEPROM_OEM_HW_VERSION_OFF     (0x56 << 1)
+#define IWM_EEPROM_MAC_VERSION_OFF        (0x30 << 1)
+#define IWM_EEPROM_CARD_ID_OFF            (0x5d << 1)
+#define IWM_EEPROM_RADIO_CONF_OFF         (0x58 << 1)
+#define IWM_EEPROM_SKU_CAP_OFF            (0x55 << 1)
+#define IWM_EEPROM_CALIB_CONFIG_OFF       (0x7c << 1)
+#define IWM_EEPROM_FAT_CHANNELS_CAP_OFF   (0xde << 1)
 
 #define IWM_EEPROM_SIG_LEN              4
 #define IWM_EEPROM_VERSION_LEN          2
@@ -74,6 +76,7 @@ enum {
 #define IWM_EEPROM_CARD_ID_LEN          2
 #define IWM_EEPROM_RADIO_CONF_LEN       2
 #define IWM_EEPROM_SKU_CAP_LEN          2
+#define IWM_EEPROM_FAT_CHANNELS_CAP_LEN 40
 #define IWM_EEPROM_INDIRECT_LEN         2
 
 #define IWM_MAX_EEPROM_DATA_LEN         240
@@ -87,6 +90,14 @@ enum {
 #define IWM_EEPROM_SKU_CAP_BAND_52GHZ           (1 << 5)
 #define IWM_EEPROM_SKU_CAP_11N_ENABLE           (1 << 6)
 
+#define IWM_EEPROM_FAT_CHANNELS 20
+/* 2.4 gHz FAT primary channels: 1, 2, 3, 4, 5, 6, 7, 8, 9 */
+#define IWM_EEPROM_FAT_CHANNELS_24 9
+/* 5.2 gHz FAT primary channels: 36,44,52,60,100,108,116,124,132,149,157 */
+#define IWM_EEPROM_FAT_CHANNELS_52 11
+
+#define IWM_EEPROM_FAT_CHANNEL_ENABLED (1 << 0)
+
 enum {
         IWM_EEPROM_CALIB_CAL_HDR,
         IWM_EEPROM_CALIB_TX_POWER,
@@ -110,5 +121,7 @@ struct iwm_eeprom_entry {
 int iwm_eeprom_init(struct iwm_priv *iwm);
 void iwm_eeprom_exit(struct iwm_priv *iwm);
 u8 *iwm_eeprom_access(struct iwm_priv *iwm, u8 eeprom_id);
+int iwm_eeprom_fat_channels(struct iwm_priv *iwm);
+u32 iwm_eeprom_wireless_mode(struct iwm_priv *iwm);
 
 #endif
diff --git a/drivers/net/wireless/iwmc3200wifi/fw.c b/drivers/net/wireless/iwmc3200wifi/fw.c
index 6b0bcad758ca..49067092d336 100644
--- a/drivers/net/wireless/iwmc3200wifi/fw.c
+++ b/drivers/net/wireless/iwmc3200wifi/fw.c
@@ -217,6 +217,13 @@ static int iwm_load_img(struct iwm_priv *iwm, const char *img_name)
                  IWM_BUILD_YEAR(build_date), IWM_BUILD_MONTH(build_date),
                  IWM_BUILD_DAY(build_date));
 
+        if (!strcmp(img_name, iwm->bus_ops->umac_name))
+                sprintf(iwm->umac_version, "%02X.%02X",
+                        ver->major, ver->minor);
+
+        if (!strcmp(img_name, iwm->bus_ops->lmac_name))
+                sprintf(iwm->lmac_version, "%02X.%02X",
+                        ver->major, ver->minor);
 
  err_release_fw:
         release_firmware(fw);
@@ -398,6 +405,8 @@ int iwm_load_fw(struct iwm_priv *iwm)
         iwm_send_prio_table(iwm);
         iwm_send_calib_results(iwm);
         iwm_send_periodic_calib_cfg(iwm, periodic_calib_map);
+        iwm_send_ct_kill_cfg(iwm, iwm->conf.ct_kill_entry,
+                             iwm->conf.ct_kill_exit);
 
         return 0;
 
diff --git a/drivers/net/wireless/iwmc3200wifi/hal.c b/drivers/net/wireless/iwmc3200wifi/hal.c
index c430418248b4..229de990379c 100644
--- a/drivers/net/wireless/iwmc3200wifi/hal.c
+++ b/drivers/net/wireless/iwmc3200wifi/hal.c
@@ -98,6 +98,7 @@
  */
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 
 #include "iwm.h"
 #include "bus.h"
@@ -411,7 +412,7 @@ static void iwm_build_lmac_hdr(struct iwm_priv *iwm, struct iwm_lmac_hdr *hdr,
 /*
  * iwm_hal_send_host_cmd(): sends commands to the UMAC or the LMAC.
  * Sending command to the LMAC is equivalent to sending a
- * regular UMAC command with the LMAC passtrough or the LMAC
+ * regular UMAC command with the LMAC passthrough or the LMAC
  * wrapper UMAC command IDs.
  */
 int iwm_hal_send_host_cmd(struct iwm_priv *iwm,
diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h
index 1b02a4e2a1ac..79ffa3b98d73 100644
--- a/drivers/net/wireless/iwmc3200wifi/iwm.h
+++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
@@ -65,6 +65,8 @@ struct iwm_conf {
         u32 sdio_ior_timeout;
         unsigned long calib_map;
         unsigned long expected_calib_map;
+        u8 ct_kill_entry;
+        u8 ct_kill_exit;
         bool reset_on_fatal_err;
         bool auto_connect;
         bool wimax_not_present;
@@ -79,7 +81,6 @@ struct iwm_conf {
         u32 assoc_timeout;
         u32 roam_timeout;
         u32 wireless_mode;
-        u32 coexist_mode;
 
         u8 ibss_band;
         u8 ibss_channel;
@@ -129,11 +130,18 @@ struct iwm_notif {
         unsigned long buf_size;
 };
 
+struct iwm_tid_info {
+        __le16 last_seq_num;
+        bool stopped;
+        struct mutex mutex;
+};
+
 struct iwm_sta_info {
         u8 addr[ETH_ALEN];
         bool valid;
         bool qos;
         u8 color;
+        struct iwm_tid_info tid_info[IWM_UMAC_TID_NR];
 };
 
 struct iwm_tx_info {
@@ -183,6 +191,8 @@ struct iwm_key {
 struct iwm_tx_queue {
         int id;
         struct sk_buff_head queue;
+        struct sk_buff_head stopped_queue;
+        spinlock_t lock;
         struct workqueue_struct *wq;
         struct work_struct worker;
         u8 concat_buf[IWM_HAL_CONCATENATE_BUF_SIZE];
@@ -276,12 +286,14 @@ struct iwm_priv {
         struct iw_statistics wstats;
         struct delayed_work stats_request;
         struct delayed_work disconnect;
+        struct delayed_work ct_kill_delay;
 
         struct iwm_debugfs dbg;
 
         u8 *eeprom;
         struct timer_list watchdog;
         struct work_struct reset_worker;
+        struct work_struct auth_retry_worker;
         struct mutex mutex;
 
         u8 *req_ie;
@@ -290,6 +302,8 @@ struct iwm_priv {
         int resp_ie_len;
 
         struct iwm_fw_error_hdr *last_fw_err;
+        char umac_version[8];
+        char lmac_version[8];
 
         char private[0] __attribute__((__aligned__(NETDEV_ALIGN)));
 };
@@ -335,6 +349,7 @@ int iwm_up(struct iwm_priv *iwm);
 int iwm_down(struct iwm_priv *iwm);
 
 /* TX API */
+int iwm_tid_to_queue(u16 tid);
 void iwm_tx_credit_inc(struct iwm_priv *iwm, int id, int total_freed_pages);
 void iwm_tx_worker(struct work_struct *work);
 int iwm_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
diff --git a/drivers/net/wireless/iwmc3200wifi/lmac.h b/drivers/net/wireless/iwmc3200wifi/lmac.h
index 6c1a14c4480f..a855a99e49b8 100644
--- a/drivers/net/wireless/iwmc3200wifi/lmac.h
+++ b/drivers/net/wireless/iwmc3200wifi/lmac.h
@@ -187,6 +187,14 @@ struct iwm_coex_prio_table_cmd {
                                      COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK | \
                                      COEX_EVT_FLAG_DELAY_MEDIUM_FREE_NTFY_MSK)
 
+/* CT kill config command */
+struct iwm_ct_kill_cfg_cmd {
+        u32 exit_threshold;
+        u32 reserved;
+        u32 entry_threshold;
+} __attribute__ ((packed));
+
+
 /* LMAC OP CODES */
 #define REPLY_PAD                       0x0
 #define REPLY_ALIVE                     0x1
@@ -254,7 +262,7 @@ struct iwm_coex_prio_table_cmd {
 
 /* Power Management */
 #define POWER_TABLE_CMD                 0x77
-#define SAVE_RESTORE_ADRESS_CMD         0x78
+#define SAVE_RESTORE_ADDRESS_CMD                0x78
 #define REPLY_WATERMARK_CMD             0x79
 #define PM_DEBUG_STATISTIC_NOTIFIC      0x7B
 #define PD_FLUSH_N_NOTIFICATION         0x7C
diff --git a/drivers/net/wireless/iwmc3200wifi/main.c b/drivers/net/wireless/iwmc3200wifi/main.c
index 222eb2cf1b30..23856d359e12 100644
--- a/drivers/net/wireless/iwmc3200wifi/main.c
+++ b/drivers/net/wireless/iwmc3200wifi/main.c
@@ -41,6 +41,7 @@
 #include <linux/sched.h>
 #include <linux/ieee80211.h>
 #include <linux/wireless.h>
+#include <linux/slab.h>
 
 #include "iwm.h"
 #include "debug.h"
@@ -64,9 +65,10 @@ static struct iwm_conf def_iwm_conf = {
                                   BIT(PHY_CALIBRATE_TX_IQ_CMD)  |
                                   BIT(PHY_CALIBRATE_RX_IQ_CMD)  |
                                   BIT(SHILOH_PHY_CALIBRATE_BASE_BAND_CMD),
+        .ct_kill_entry          = 110,
+        .ct_kill_exit           = 110,
         .reset_on_fatal_err     = 1,
         .auto_connect           = 1,
-        .wimax_not_present      = 0,
         .enable_qos             = 1,
         .mode                   = UMAC_MODE_BSS,
 
@@ -78,8 +80,8 @@ static struct iwm_conf def_iwm_conf = {
 
         .assoc_timeout          = 2,
         .roam_timeout           = 10,
-        .wireless_mode          = WIRELESS_MODE_11A | WIRELESS_MODE_11G,
-        .coexist_mode           = COEX_MODE_CM,
+        .wireless_mode          = WIRELESS_MODE_11A | WIRELESS_MODE_11G |
+                                  WIRELESS_MODE_11N,
 
         /* IBSS */
         .ibss_band              = UMAC_BAND_2GHZ,
@@ -92,6 +94,10 @@ static int modparam_reset;
 module_param_named(reset, modparam_reset, bool, 0644);
 MODULE_PARM_DESC(reset, "reset on firmware errors (default 0 [not reset])");
 
+static int modparam_wimax_enable = 1;
+module_param_named(wimax_enable, modparam_wimax_enable, bool, 0644);
+MODULE_PARM_DESC(wimax_enable, "Enable wimax core (default 1 [wimax enabled])");
+
 int iwm_mode_to_nl80211_iftype(int mode)
 {
         switch (mode) {
@@ -134,6 +140,17 @@ static void iwm_disconnect_work(struct work_struct *work)
         cfg80211_disconnected(iwm_to_ndev(iwm), 0, NULL, 0, GFP_KERNEL);
 }
 
+static void iwm_ct_kill_work(struct work_struct *work)
+{
+        struct iwm_priv *iwm =
+                container_of(work, struct iwm_priv, ct_kill_delay.work);
+        struct wiphy *wiphy = iwm_to_wiphy(iwm);
+
+        IWM_INFO(iwm, "CT kill delay timeout\n");
+
+        wiphy_rfkill_set_hw_state(wiphy, false);
+}
+
 static int __iwm_up(struct iwm_priv *iwm);
 static int __iwm_down(struct iwm_priv *iwm);
 
@@ -195,6 +212,33 @@ static void iwm_reset_worker(struct work_struct *work)
         mutex_unlock(&iwm->mutex);
 }
 
+static void iwm_auth_retry_worker(struct work_struct *work)
+{
+        struct iwm_priv *iwm;
+        int i, ret;
+
+        iwm = container_of(work, struct iwm_priv, auth_retry_worker);
+        if (iwm->umac_profile_active) {
+                ret = iwm_invalidate_mlme_profile(iwm);
+                if (ret < 0)
+                        return;
+        }
+
+        iwm->umac_profile->sec.auth_type = UMAC_AUTH_TYPE_LEGACY_PSK;
+
+        ret = iwm_send_mlme_profile(iwm);
+        if (ret < 0)
+                return;
+
+        for (i = 0; i < IWM_NUM_KEYS; i++)
+                if (iwm->keys[i].key_len)
+                        iwm_set_key(iwm, 0, &iwm->keys[i]);
+
+        iwm_set_tx_key(iwm, iwm->default_key);
+}
+
+
+
 static void iwm_watchdog(unsigned long data)
 {
         struct iwm_priv *iwm = (struct iwm_priv *)data;
@@ -207,7 +251,7 @@ static void iwm_watchdog(unsigned long data)
 
 int iwm_priv_init(struct iwm_priv *iwm)
 {
-        int i;
+        int i, j;
         char name[32];
 
         iwm->status = 0;
@@ -226,7 +270,9 @@ int iwm_priv_init(struct iwm_priv *iwm)
         iwm->scan_id = 1;
         INIT_DELAYED_WORK(&iwm->stats_request, iwm_statistics_request);
         INIT_DELAYED_WORK(&iwm->disconnect, iwm_disconnect_work);
+        INIT_DELAYED_WORK(&iwm->ct_kill_delay, iwm_ct_kill_work);
         INIT_WORK(&iwm->reset_worker, iwm_reset_worker);
+        INIT_WORK(&iwm->auth_retry_worker, iwm_auth_retry_worker);
         INIT_LIST_HEAD(&iwm->bss_list);
 
         skb_queue_head_init(&iwm->rx_list);
@@ -249,6 +295,8 @@ int iwm_priv_init(struct iwm_priv *iwm)
                         return -EAGAIN;
 
                 skb_queue_head_init(&iwm->txq[i].queue);
+                skb_queue_head_init(&iwm->txq[i].stopped_queue);
+                spin_lock_init(&iwm->txq[i].lock);
         }
 
         for (i = 0; i < IWM_NUM_KEYS; i++)
@@ -256,6 +304,12 @@ int iwm_priv_init(struct iwm_priv *iwm)
 
         iwm->default_key = -1;
 
+        for (i = 0; i < IWM_STA_TABLE_NUM; i++)
+                for (j = 0; j < IWM_UMAC_TID_NR; j++) {
+                        mutex_init(&iwm->sta_table[i].tid_info[j].mutex);
+                        iwm->sta_table[i].tid_info[j].stopped = false;
+                }
+
         init_timer(&iwm->watchdog);
         iwm->watchdog.function = iwm_watchdog;
         iwm->watchdog.data = (unsigned long)iwm;
@@ -436,7 +490,7 @@ static int iwm_config_boot_params(struct iwm_priv *iwm)
         int ret;
 
         /* check Wimax is off and config debug monitor */
-        if (iwm->conf.wimax_not_present) {
+        if (!modparam_wimax_enable) {
                 u32 data1 = 0x1f;
                 u32 addr1 = 0x606BE258;
 
@@ -529,6 +583,7 @@ void iwm_link_off(struct iwm_priv *iwm)
 
         for (i = 0; i < IWM_TX_QUEUES; i++) {
                 skb_queue_purge(&iwm->txq[i].queue);
+                skb_queue_purge(&iwm->txq[i].stopped_queue);
 
                 iwm->txq[i].concat_count = 0;
                 iwm->txq[i].concat_ptr = iwm->txq[i].concat_buf;
@@ -587,6 +642,8 @@ static int __iwm_up(struct iwm_priv *iwm)
 {
         int ret;
         struct iwm_notif *notif_reboot, *notif_ack = NULL;
+        struct wiphy *wiphy = iwm_to_wiphy(iwm);
+        u32 wireless_mode;
 
         ret = iwm_bus_enable(iwm);
         if (ret) {
@@ -638,6 +695,8 @@ static int __iwm_up(struct iwm_priv *iwm)
                 IWM_ERR(iwm, "MAC reading failed\n");
                 goto err_disable;
         }
+        memcpy(iwm_to_ndev(iwm)->perm_addr, iwm_to_ndev(iwm)->dev_addr,
+                ETH_ALEN);
 
         /* We can load the FWs */
         ret = iwm_load_fw(iwm);
@@ -646,6 +705,30 @@ static int __iwm_up(struct iwm_priv *iwm)
                 goto err_disable;
         }
 
+        ret = iwm_eeprom_fat_channels(iwm);
+        if (ret) {
+                IWM_ERR(iwm, "Couldnt read HT channels EEPROM entries\n");
+                goto err_fw;
+        }
+
+        /*
+         * Read our SKU capabilities.
+         * If it's valid, we AND the configured wireless mode with the
+         * device EEPROM value as the current profile wireless mode.
+         */
+        wireless_mode = iwm_eeprom_wireless_mode(iwm);
+        if (wireless_mode) {
+                iwm->conf.wireless_mode &= wireless_mode;
+                if (iwm->umac_profile)
+                        iwm->umac_profile->wireless_mode =
+                                        iwm->conf.wireless_mode;
+        } else
+                IWM_ERR(iwm, "Wrong SKU capabilities: 0x%x\n",
+                        *((u16 *)iwm_eeprom_access(iwm, IWM_EEPROM_SKU_CAP)));
+
+        snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "L%s_U%s",
+                 iwm->lmac_version, iwm->umac_version);
+
         /* We configure the UMAC and enable the wifi module */
         ret = iwm_send_umac_config(iwm,
                         cpu_to_le32(UMAC_RST_CTRL_FLG_WIFI_CORE_EN) |
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index 35ec006c2d2c..13a69ebf2a94 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -46,6 +46,7 @@
  *              -> sdio_disable_func()
  */
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 
 #include "iwm.h"
 #include "commands.h"
@@ -76,6 +77,14 @@ static int iwm_stop(struct net_device *ndev)
  */
 static const u16 iwm_1d_to_queue[8] = { 1, 0, 0, 1, 2, 2, 3, 3 };
 
+int iwm_tid_to_queue(u16 tid)
+{
+        if (tid > IWM_UMAC_TID_NR - 2)
+                return -EINVAL;
+
+        return iwm_1d_to_queue[tid];
+}
+
 static u16 iwm_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
         skb->priority = cfg80211_classify8021d(skb);
@@ -152,6 +161,7 @@ void iwm_if_free(struct iwm_priv *iwm)
         if (!iwm_to_ndev(iwm))
                 return;
 
+        cancel_delayed_work_sync(&iwm->ct_kill_delay);
         free_netdev(iwm_to_ndev(iwm));
         iwm_priv_deinit(iwm);
         kfree(iwm->umac_profile);
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 771a301003c9..3257d4fad835 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -44,6 +44,7 @@
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <net/iw_handler.h>
 
 #include "iwm.h"
@@ -423,7 +424,9 @@ static int iwm_ntf_rx_ticket(struct iwm_priv *iwm, u8 *buf,
                         if (IS_ERR(ticket_node))
                                 return PTR_ERR(ticket_node);
 
-                        IWM_DBG_RX(iwm, DBG, "TICKET RELEASE(%d)\n",
+                        IWM_DBG_RX(iwm, DBG, "TICKET %s(%d)\n",
+                                   ticket->action ==  IWM_RX_TICKET_RELEASE ?
+                                   "RELEASE" : "DROP",
                                    ticket->id);
                         list_add_tail(&ticket_node->node, &iwm->rx_tickets);
 
@@ -500,6 +503,18 @@ static int iwm_mlme_assoc_start(struct iwm_priv *iwm, u8 *buf,
         return 0;
 }
 
+static u8 iwm_is_open_wep_profile(struct iwm_priv *iwm)
+{
+        if ((iwm->umac_profile->sec.ucast_cipher == UMAC_CIPHER_TYPE_WEP_40 ||
+             iwm->umac_profile->sec.ucast_cipher == UMAC_CIPHER_TYPE_WEP_104) &&
+            (iwm->umac_profile->sec.ucast_cipher ==
+             iwm->umac_profile->sec.mcast_cipher) &&
+            (iwm->umac_profile->sec.auth_type == UMAC_AUTH_TYPE_OPEN))
+               return 1;
+
+       return 0;
+}
+
 static int iwm_mlme_assoc_complete(struct iwm_priv *iwm, u8 *buf,
                                    unsigned long buf_size,
                                    struct iwm_wifi_cmd *cmd)
@@ -565,11 +580,17 @@ static int iwm_mlme_assoc_complete(struct iwm_priv *iwm, u8 *buf,
                         goto ibss;
 
                 if (!test_bit(IWM_STATUS_RESETTING, &iwm->status))
-                        cfg80211_connect_result(iwm_to_ndev(iwm),
-                                                complete->bssid,
-                                                NULL, 0, NULL, 0,
-                                                WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                                GFP_KERNEL);
+                        if (!iwm_is_open_wep_profile(iwm)) {
+                                cfg80211_connect_result(iwm_to_ndev(iwm),
+                                               complete->bssid,
+                                               NULL, 0, NULL, 0,
+                                               WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                               GFP_KERNEL);
+                        } else {
+                                /* Let's try shared WEP auth */
+                                IWM_ERR(iwm, "Trying WEP shared auth\n");
+                                schedule_work(&iwm->auth_retry_worker);
+                        }
                 else
                         cfg80211_disconnected(iwm_to_ndev(iwm), 0, NULL, 0,
                                               GFP_KERNEL);
@@ -713,6 +734,19 @@ static int iwm_mlme_update_sta_table(struct iwm_priv *iwm, u8 *buf,
         return 0;
 }
 
+static int iwm_mlme_medium_lost(struct iwm_priv *iwm, u8 *buf,
+                                unsigned long buf_size,
+                                struct iwm_wifi_cmd *cmd)
+{
+        struct wiphy *wiphy = iwm_to_wiphy(iwm);
+
+        IWM_DBG_NTF(iwm, DBG, "WiFi/WiMax coexistence radio is OFF\n");
+
+        wiphy_rfkill_set_hw_state(wiphy, true);
+
+        return 0;
+}
+
 static int iwm_mlme_update_bss_table(struct iwm_priv *iwm, u8 *buf,
                                      unsigned long buf_size,
                                      struct iwm_wifi_cmd *cmd)
@@ -761,7 +795,7 @@ static int iwm_mlme_update_bss_table(struct iwm_priv *iwm, u8 *buf,
         }
 
         bss->bss = kzalloc(bss_len, GFP_KERNEL);
-        if (!bss) {
+        if (!bss->bss) {
                 kfree(bss);
                 IWM_ERR(iwm, "Couldn't allocate bss\n");
                 return -ENOMEM;
@@ -835,36 +869,35 @@ static int iwm_mlme_mgt_frame(struct iwm_priv *iwm, u8 *buf,
         struct iwm_umac_notif_mgt_frame *mgt_frame =
                         (struct iwm_umac_notif_mgt_frame *)buf;
         struct ieee80211_mgmt *mgt = (struct ieee80211_mgmt *)mgt_frame->frame;
-        u8 *ie;
 
         IWM_HEXDUMP(iwm, DBG, MLME, "MGT: ", mgt_frame->frame,
                     le16_to_cpu(mgt_frame->len));
 
         if (ieee80211_is_assoc_req(mgt->frame_control)) {
-                ie = mgt->u.assoc_req.variable;;
-                iwm->req_ie_len =
-                                le16_to_cpu(mgt_frame->len) - (ie - (u8 *)mgt);
+                iwm->req_ie_len = le16_to_cpu(mgt_frame->len)
+                                  - offsetof(struct ieee80211_mgmt,
+                                             u.assoc_req.variable);
                 kfree(iwm->req_ie);
                 iwm->req_ie = kmemdup(mgt->u.assoc_req.variable,
                                       iwm->req_ie_len, GFP_KERNEL);
         } else if (ieee80211_is_reassoc_req(mgt->frame_control)) {
-                ie = mgt->u.reassoc_req.variable;;
-                iwm->req_ie_len =
-                                le16_to_cpu(mgt_frame->len) - (ie - (u8 *)mgt);
+                iwm->req_ie_len = le16_to_cpu(mgt_frame->len)
+                                  - offsetof(struct ieee80211_mgmt,
+                                             u.reassoc_req.variable);
                 kfree(iwm->req_ie);
                 iwm->req_ie = kmemdup(mgt->u.reassoc_req.variable,
                                       iwm->req_ie_len, GFP_KERNEL);
         } else if (ieee80211_is_assoc_resp(mgt->frame_control)) {
-                ie = mgt->u.assoc_resp.variable;;
-                iwm->resp_ie_len =
-                                le16_to_cpu(mgt_frame->len) - (ie - (u8 *)mgt);
+                iwm->resp_ie_len = le16_to_cpu(mgt_frame->len)
+                                   - offsetof(struct ieee80211_mgmt,
+                                              u.assoc_resp.variable);
                 kfree(iwm->resp_ie);
                 iwm->resp_ie = kmemdup(mgt->u.assoc_resp.variable,
                                        iwm->resp_ie_len, GFP_KERNEL);
         } else if (ieee80211_is_reassoc_resp(mgt->frame_control)) {
-                ie = mgt->u.reassoc_resp.variable;;
-                iwm->resp_ie_len =
-                                le16_to_cpu(mgt_frame->len) - (ie - (u8 *)mgt);
+                iwm->resp_ie_len = le16_to_cpu(mgt_frame->len)
+                                   - offsetof(struct ieee80211_mgmt,
+                                              u.reassoc_resp.variable);
                 kfree(iwm->resp_ie);
                 iwm->resp_ie = kmemdup(mgt->u.reassoc_resp.variable,
                                        iwm->resp_ie_len, GFP_KERNEL);
@@ -899,6 +932,8 @@ static int iwm_ntf_mlme(struct iwm_priv *iwm, u8 *buf,
         case WIFI_IF_NTFY_EXTENDED_IE_REQUIRED:
                 IWM_DBG_MLME(iwm, DBG, "Extended IE required\n");
                 break;
+        case WIFI_IF_NTFY_RADIO_PREEMPTION:
+                return iwm_mlme_medium_lost(iwm, buf, buf_size, cmd);
         case WIFI_IF_NTFY_BSS_TRK_TABLE_CHANGED:
                 return iwm_mlme_update_bss_table(iwm, buf, buf_size, cmd);
         case WIFI_IF_NTFY_BSS_TRK_ENTRIES_REMOVED:
@@ -1052,12 +1087,83 @@ static int iwm_ntf_channel_info_list(struct iwm_priv *iwm, u8 *buf,
         return 0;
 }
 
+static int iwm_ntf_stop_resume_tx(struct iwm_priv *iwm, u8 *buf,
+                                  unsigned long buf_size,
+                                  struct iwm_wifi_cmd *cmd)
+{
+        struct iwm_umac_notif_stop_resume_tx *stp_res_tx =
+                (struct iwm_umac_notif_stop_resume_tx *)buf;
+        struct iwm_sta_info *sta_info;
+        struct iwm_tid_info *tid_info;
+        u8 sta_id = STA_ID_N_COLOR_ID(stp_res_tx->sta_id);
+        u16 tid_msk = le16_to_cpu(stp_res_tx->stop_resume_tid_msk);
+        int bit, ret = 0;
+        bool stop = false;
+
+        IWM_DBG_NTF(iwm, DBG, "stop/resume notification:\n"
+                    "\tflags:       0x%x\n"
+                    "\tSTA id:      %d\n"
+                    "\tTID bitmask: 0x%x\n",
+                    stp_res_tx->flags, stp_res_tx->sta_id,
+                    stp_res_tx->stop_resume_tid_msk);
+
+        if (stp_res_tx->flags & UMAC_STOP_TX_FLAG)
+                stop = true;
+
+        sta_info = &iwm->sta_table[sta_id];
+        if (!sta_info->valid) {
+                IWM_ERR(iwm, "Stoping an invalid STA: %d %d\n",
+                        sta_id, stp_res_tx->sta_id);
+                return -EINVAL;
+        }
+
+        for_each_set_bit(bit, (unsigned long *)&tid_msk, IWM_UMAC_TID_NR) {
+                tid_info = &sta_info->tid_info[bit];
+
+                mutex_lock(&tid_info->mutex);
+                tid_info->stopped = stop;
+                mutex_unlock(&tid_info->mutex);
+
+                if (!stop) {
+                        struct iwm_tx_queue *txq;
+                        int queue = iwm_tid_to_queue(bit);
+
+                        if (queue < 0)
+                                continue;
+
+                        txq = &iwm->txq[queue];
+                        /*
+                         * If we resume, we have to move our SKBs
+                         * back to the tx queue and queue some work.
+                         */
+                        spin_lock_bh(&txq->lock);
+                        skb_queue_splice_init(&txq->queue, &txq->stopped_queue);
+                        spin_unlock_bh(&txq->lock);
+
+                        queue_work(txq->wq, &txq->worker);
+                }
+
+        }
+
+        /* We send an ACK only for the stop case */
+        if (stop)
+                ret = iwm_send_umac_stop_resume_tx(iwm, stp_res_tx);
+
+        return ret;
+}
+
 static int iwm_ntf_wifi_if_wrapper(struct iwm_priv *iwm, u8 *buf,
                                    unsigned long buf_size,
                                    struct iwm_wifi_cmd *cmd)
 {
-        struct iwm_umac_wifi_if *hdr =
-                        (struct iwm_umac_wifi_if *)cmd->buf.payload;
+        struct iwm_umac_wifi_if *hdr;
+
+        if (cmd == NULL) {
+                IWM_ERR(iwm, "Couldn't find expected wifi command\n");
+                return -EINVAL;
+        }
+
+        hdr = (struct iwm_umac_wifi_if *)cmd->buf.payload;
 
         IWM_DBG_NTF(iwm, DBG, "WIFI_IF_WRAPPER cmd is delivered to UMAC: "
                     "oid is 0x%x\n", hdr->oid);
@@ -1079,6 +1185,7 @@ static int iwm_ntf_wifi_if_wrapper(struct iwm_priv *iwm, u8 *buf,
         return 0;
 }
 
+#define CT_KILL_DELAY (30 * HZ)
 static int iwm_ntf_card_state(struct iwm_priv *iwm, u8 *buf,
                               unsigned long buf_size, struct iwm_wifi_cmd *cmd)
 {
@@ -1091,7 +1198,20 @@ static int iwm_ntf_card_state(struct iwm_priv *iwm, u8 *buf,
                  flags & IWM_CARD_STATE_HW_DISABLED ? "ON" : "OFF",
                  flags & IWM_CARD_STATE_CTKILL_DISABLED ? "ON" : "OFF");
 
-        wiphy_rfkill_set_hw_state(wiphy, flags & IWM_CARD_STATE_HW_DISABLED);
+        if (flags & IWM_CARD_STATE_CTKILL_DISABLED) {
+                /*
+                 * We got a CTKILL event: We bring the interface down in
+                 * oder to cool the device down, and try to bring it up
+                 * 30 seconds later. If it's still too hot, we'll go through
+                 * this code path again.
+                 */
+                cancel_delayed_work_sync(&iwm->ct_kill_delay);
+                schedule_delayed_work(&iwm->ct_kill_delay, CT_KILL_DELAY);
+        }
+
+        wiphy_rfkill_set_hw_state(wiphy, flags &
+                                  (IWM_CARD_STATE_HW_DISABLED |
+                                   IWM_CARD_STATE_CTKILL_DISABLED));
 
         return 0;
 }
@@ -1282,6 +1402,14 @@ int iwm_rx_handle(struct iwm_priv *iwm, u8 *buf, unsigned long buf_size)
 
         switch (le32_to_cpu(hdr->cmd)) {
         case UMAC_REBOOT_BARKER:
+                if (test_bit(IWM_STATUS_READY, &iwm->status)) {
+                        IWM_ERR(iwm, "Unexpected BARKER\n");
+
+                        schedule_work(&iwm->reset_worker);
+
+                        return 0;
+                }
+
                 return iwm_notif_send(iwm, NULL, IWM_BARKER_REBOOT_NOTIFICATION,
                                       IWM_SRC_UDMA, buf, buf_size);
         case UMAC_ACK_BARKER:
@@ -1308,6 +1436,7 @@ static const iwm_handler iwm_umac_handlers[] =
         [UMAC_NOTIFY_OPCODE_STATS]              = iwm_ntf_statistics,
         [UMAC_CMD_OPCODE_EEPROM_PROXY]          = iwm_ntf_eeprom_proxy,
         [UMAC_CMD_OPCODE_GET_CHAN_INFO_LIST]    = iwm_ntf_channel_info_list,
+        [UMAC_CMD_OPCODE_STOP_RESUME_STA_TX]    = iwm_ntf_stop_resume_tx,
         [REPLY_RX_MPDU_CMD]                     = iwm_ntf_rx_packet,
         [UMAC_CMD_OPCODE_WIFI_IF_WRAPPER]       = iwm_ntf_wifi_if_wrapper,
 };
@@ -1405,6 +1534,33 @@ static void classify8023(struct sk_buff *skb)
         }
 }
 
+static void iwm_rx_process_amsdu(struct iwm_priv *iwm, struct sk_buff *skb)
+{
+        struct wireless_dev *wdev = iwm_to_wdev(iwm);
+        struct net_device *ndev = iwm_to_ndev(iwm);
+        struct sk_buff_head list;
+        struct sk_buff *frame;
+
+        IWM_HEXDUMP(iwm, DBG, RX, "A-MSDU: ", skb->data, skb->len);
+
+        __skb_queue_head_init(&list);
+        ieee80211_amsdu_to_8023s(skb, &list, ndev->dev_addr, wdev->iftype, 0);
+
+        while ((frame = __skb_dequeue(&list))) {
+                ndev->stats.rx_packets++;
+                ndev->stats.rx_bytes += frame->len;
+
+                frame->protocol = eth_type_trans(frame, ndev);
+                frame->ip_summed = CHECKSUM_NONE;
+                memset(frame->cb, 0, sizeof(frame->cb));
+
+                if (netif_rx_ni(frame) == NET_RX_DROP) {
+                        IWM_ERR(iwm, "Packet dropped\n");
+                        ndev->stats.rx_dropped++;
+                }
+        }
+}
+
 static void iwm_rx_process_packet(struct iwm_priv *iwm,
                                   struct iwm_rx_packet *packet,
                                   struct iwm_rx_ticket_node *ticket_node)
@@ -1419,36 +1575,46 @@ static void iwm_rx_process_packet(struct iwm_priv *iwm,
         switch (le16_to_cpu(ticket_node->ticket->action)) {
         case IWM_RX_TICKET_RELEASE:
                 IWM_DBG_RX(iwm, DBG, "RELEASE packet\n");
-                classify8023(skb);
+
                 iwm_rx_adjust_packet(iwm, packet, ticket_node);
+                skb->dev = iwm_to_ndev(iwm);
+                classify8023(skb);
+
+                if (le16_to_cpu(ticket_node->ticket->flags) &
+                    IWM_RX_TICKET_AMSDU_MSK) {
+                        iwm_rx_process_amsdu(iwm, skb);
+                        break;
+                }
+
                 ret = ieee80211_data_to_8023(skb, ndev->dev_addr, wdev->iftype);
                 if (ret < 0) {
                         IWM_DBG_RX(iwm, DBG, "Couldn't convert 802.11 header - "
                                    "%d\n", ret);
+                        kfree_skb(packet->skb);
                         break;
                 }
 
                 IWM_HEXDUMP(iwm, DBG, RX, "802.3: ", skb->data, skb->len);
 
-                skb->dev = iwm_to_ndev(iwm);
+                ndev->stats.rx_packets++;
+                ndev->stats.rx_bytes += skb->len;
+
                 skb->protocol = eth_type_trans(skb, ndev);
                 skb->ip_summed = CHECKSUM_NONE;
                 memset(skb->cb, 0, sizeof(skb->cb));
 
-                ndev->stats.rx_packets++;
-                ndev->stats.rx_bytes += skb->len;
-
                 if (netif_rx_ni(skb) == NET_RX_DROP) {
                         IWM_ERR(iwm, "Packet dropped\n");
                         ndev->stats.rx_dropped++;
                 }
                 break;
         case IWM_RX_TICKET_DROP:
-                IWM_DBG_RX(iwm, DBG, "DROP packet\n");
+                IWM_DBG_RX(iwm, DBG, "DROP packet: 0x%x\n",
+                           le16_to_cpu(ticket_node->ticket->flags));
                 kfree_skb(packet->skb);
                 break;
         default:
-                IWM_ERR(iwm, "Unknow ticket action: %d\n",
+                IWM_ERR(iwm, "Unknown ticket action: %d\n",
                         le16_to_cpu(ticket_node->ticket->action));
                 kfree_skb(packet->skb);
         }
diff --git a/drivers/net/wireless/iwmc3200wifi/sdio.c b/drivers/net/wireless/iwmc3200wifi/sdio.c
index 8b1de84003ca..1eafd6dec3fd 100644
--- a/drivers/net/wireless/iwmc3200wifi/sdio.c
+++ b/drivers/net/wireless/iwmc3200wifi/sdio.c
@@ -63,6 +63,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/netdevice.h>
 #include <linux/debugfs.h>
 #include <linux/mmc/sdio_ids.h>
@@ -224,8 +225,6 @@ static int if_sdio_disable(struct iwm_priv *iwm)
         struct iwm_sdio_priv *hw = iwm_to_if_sdio(iwm);
         int ret;
 
-        iwm_reset(iwm);
-
         sdio_claim_host(hw->func);
         sdio_writeb(hw->func, 0, IWM_SDIO_INTR_ENABLE_ADDR, &ret);
         if (ret < 0)
@@ -237,6 +236,8 @@ static int if_sdio_disable(struct iwm_priv *iwm)
 
         iwm_sdio_rx_free(hw);
 
+        iwm_reset(iwm);
+
         IWM_DBG_SDIO(iwm, INFO, "IWM SDIO disable\n");
 
         return 0;
@@ -399,6 +400,9 @@ static struct iwm_if_ops if_sdio_ops = {
         .calib_lmac_name = "iwmc3200wifi-calib-sdio.bin",
         .lmac_name = "iwmc3200wifi-lmac-sdio.bin",
 };
+MODULE_FIRMWARE("iwmc3200wifi-umac-sdio.bin");
+MODULE_FIRMWARE("iwmc3200wifi-calib-sdio.bin");
+MODULE_FIRMWARE("iwmc3200wifi-lmac-sdio.bin");
 
 static int iwm_sdio_probe(struct sdio_func *func,
                           const struct sdio_device_id *id)
@@ -493,8 +497,10 @@ static void iwm_sdio_remove(struct sdio_func *func)
 }
 
 static const struct sdio_device_id iwm_sdio_ids[] = {
-        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL,
-                      SDIO_DEVICE_ID_INTEL_IWMC3200WIFI) },
+        /* Global/AGN SKU */
+        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL, 0x1403) },
+        /* BGN SKU */
+        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL, 0x1408) },
         { /* end: all zeroes */ },
 };
 MODULE_DEVICE_TABLE(sdio, iwm_sdio_ids);
diff --git a/drivers/net/wireless/iwmc3200wifi/tx.c b/drivers/net/wireless/iwmc3200wifi/tx.c
index e3b4f7902daf..f6a02f123f31 100644
--- a/drivers/net/wireless/iwmc3200wifi/tx.c
+++ b/drivers/net/wireless/iwmc3200wifi/tx.c
@@ -64,6 +64,7 @@
  * (i.e. half of the max size). [iwm_tx_worker]
  */
 
+#include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/ieee80211.h>
@@ -329,7 +330,7 @@ static int iwm_tx_build_packet(struct iwm_priv *iwm, struct sk_buff *skb,
 
         memcpy(buf + sizeof(*hdr), skb->data, skb->len);
 
-        return 0;
+        return umac_cmd.seq_num;
 }
 
 static int iwm_tx_send_concat_packets(struct iwm_priv *iwm,
@@ -354,16 +355,15 @@ static int iwm_tx_send_concat_packets(struct iwm_priv *iwm,
         return ret;
 }
 
-#define CONFIG_IWM_TX_CONCATENATED 1
-
 void iwm_tx_worker(struct work_struct *work)
 {
         struct iwm_priv *iwm;
         struct iwm_tx_info *tx_info = NULL;
         struct sk_buff *skb;
-        int cmdlen, ret;
         struct iwm_tx_queue *txq;
-        int pool_id;
+        struct iwm_sta_info *sta_info;
+        struct iwm_tid_info *tid_info;
+        int cmdlen, ret, pool_id;
 
         txq = container_of(work, struct iwm_tx_queue, worker);
         iwm = container_of(txq, struct iwm_priv, txq[txq->id]);
@@ -373,19 +373,46 @@ void iwm_tx_worker(struct work_struct *work)
         while (!test_bit(pool_id, &iwm->tx_credit.full_pools_map) &&
                !skb_queue_empty(&txq->queue)) {
 
+                spin_lock_bh(&txq->lock);
                 skb = skb_dequeue(&txq->queue);
+                spin_unlock_bh(&txq->lock);
+
                 tx_info = skb_to_tx_info(skb);
+                sta_info = &iwm->sta_table[tx_info->sta];
+                if (!sta_info->valid) {
+                        IWM_ERR(iwm, "Trying to send a frame to unknown STA\n");
+                        kfree_skb(skb);
+                        continue;
+                }
+
+                tid_info = &sta_info->tid_info[tx_info->tid];
+
+                mutex_lock(&tid_info->mutex);
+
+                /*
+                 * If the RAxTID is stopped, we queue the skb to the stopped
+                 * queue.
+                 * Whenever we'll get a UMAC notification to resume the tx flow
+                 * for this RAxTID, we'll merge back the stopped queue into the
+                 * regular queue. See iwm_ntf_stop_resume_tx() from rx.c.
+                 */
+                if (tid_info->stopped) {
+                        IWM_DBG_TX(iwm, DBG, "%dx%d stopped\n",
+                                   tx_info->sta, tx_info->tid);
+                        spin_lock_bh(&txq->lock);
+                        skb_queue_tail(&txq->stopped_queue, skb);
+                        spin_unlock_bh(&txq->lock);
+
+                        mutex_unlock(&tid_info->mutex);
+                        continue;
+                }
+
                 cmdlen = IWM_UDMA_HDR_LEN + skb->len;
 
                 IWM_DBG_TX(iwm, DBG, "Tx frame on queue %d: skb: 0x%p, sta: "
                            "%d, color: %d\n", txq->id, skb, tx_info->sta,
                            tx_info->color);
 
-#if !CONFIG_IWM_TX_CONCATENATED
-                /* temporarily keep this to comparing the performance */
-                ret = iwm_send_packet(iwm, skb, pool_id);
-#else
-
                 if (txq->concat_count + cmdlen > IWM_HAL_CONCATENATE_BUF_SIZE)
                         iwm_tx_send_concat_packets(iwm, txq);
 
@@ -393,14 +420,21 @@ void iwm_tx_worker(struct work_struct *work)
                 if (ret) {
                         IWM_DBG_TX(iwm, DBG, "not enough tx_credit for queue "
                                    "%d, Tx worker stopped\n", txq->id);
+                        spin_lock_bh(&txq->lock);
                         skb_queue_head(&txq->queue, skb);
+                        spin_unlock_bh(&txq->lock);
+
+                        mutex_unlock(&tid_info->mutex);
                         break;
                 }
 
                 txq->concat_ptr = txq->concat_buf + txq->concat_count;
-                iwm_tx_build_packet(iwm, skb, pool_id, txq->concat_ptr);
+                tid_info->last_seq_num =
+                        iwm_tx_build_packet(iwm, skb, pool_id, txq->concat_ptr);
                 txq->concat_count += ALIGN(cmdlen, 16);
-#endif
+
+                mutex_unlock(&tid_info->mutex);
+
                 kfree_skb(skb);
         }
 
@@ -419,14 +453,14 @@ int iwm_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         struct iwm_priv *iwm = ndev_to_iwm(netdev);
         struct net_device *ndev = iwm_to_ndev(iwm);
         struct wireless_dev *wdev = iwm_to_wdev(iwm);
-        u8 *dst_addr;
         struct iwm_tx_info *tx_info;
         struct iwm_tx_queue *txq;
         struct iwm_sta_info *sta_info;
-        u8 sta_id;
+        u8 *dst_addr, sta_id;
         u16 queue;
         int ret;
 
+
         if (!test_bit(IWM_STATUS_ASSOCIATED, &iwm->status)) {
                 IWM_DBG_TX(iwm, DBG, "LINK: stop netif_all_queues: "
                            "not associated\n");
@@ -440,7 +474,8 @@ int iwm_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         txq = &iwm->txq[queue];
 
         /* No free space for Tx, tx_worker is too slow */
-        if (skb_queue_len(&txq->queue) > IWM_TX_LIST_SIZE) {
+        if ((skb_queue_len(&txq->queue) > IWM_TX_LIST_SIZE) ||
+            (skb_queue_len(&txq->stopped_queue) > IWM_TX_LIST_SIZE)) {
                 IWM_DBG_TX(iwm, DBG, "LINK: stop netif_subqueue[%d]\n", queue);
                 netif_stop_subqueue(netdev, queue);
                 return NETDEV_TX_BUSY;
@@ -477,7 +512,9 @@ int iwm_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         else
                 tx_info->tid = IWM_UMAC_MGMT_TID;
 
+        spin_lock_bh(&iwm->txq[queue].lock);
         skb_queue_tail(&iwm->txq[queue].queue, skb);
+        spin_unlock_bh(&iwm->txq[queue].lock);
 
         queue_work(iwm->txq[queue].wq, &iwm->txq[queue].worker);
 
diff --git a/drivers/net/wireless/iwmc3200wifi/umac.h b/drivers/net/wireless/iwmc3200wifi/umac.h
index c5a14ae3160a..7f54a145ca65 100644
--- a/drivers/net/wireless/iwmc3200wifi/umac.h
+++ b/drivers/net/wireless/iwmc3200wifi/umac.h
@@ -83,6 +83,20 @@ struct iwm_udma_out_wifi_hdr {
         ((UMAC_HDI_ACT_TBL_IDX_RA_UMAC << UMAC_HDI_ACT_TBL_IDX_RA_POS) |\
         (UMAC_HDI_ACT_TBL_IDX_TID_LMAC << UMAC_HDI_ACT_TBL_IDX_TID_POS))
 
+/* STA ID and color */
+#define STA_ID_SEED                        (0x0f)
+#define STA_ID_POS                         (0)
+#define STA_ID_MSK                         (STA_ID_SEED << STA_ID_POS)
+
+#define STA_COLOR_SEED                     (0x7)
+#define STA_COLOR_POS                      (4)
+#define STA_COLOR_MSK                      (STA_COLOR_SEED << STA_COLOR_POS)
+
+#define STA_ID_N_COLOR_COLOR(id_n_color) \
+        (((id_n_color) & STA_COLOR_MSK) >> STA_COLOR_POS)
+#define STA_ID_N_COLOR_ID(id_n_color) \
+        (((id_n_color) & STA_ID_MSK) >> STA_ID_POS)
+
 /* iwm_umac_notif_alive.page_grp_state Group number -- bits [3:0] */
 #define UMAC_ALIVE_PAGE_STS_GRP_NUM_POS         0
 #define UMAC_ALIVE_PAGE_STS_GRP_NUM_SEED        0xF
@@ -260,6 +274,9 @@ struct iwm_udma_out_wifi_hdr {
 #define UMAC_CMD_OPCODE_GET_CHAN_INFO_LIST      0x16
 #define UMAC_CMD_OPCODE_SET_PARAM_LIST          0x17
 #define UMAC_CMD_OPCODE_GET_PARAM_LIST          0x18
+#define UMAC_CMD_OPCODE_STOP_RESUME_STA_TX      0x19
+#define UMAC_CMD_OPCODE_TEST_BLOCK_ACK          0x1A
+
 #define UMAC_CMD_OPCODE_BASE_WRAPPER            0xFA
 #define UMAC_CMD_OPCODE_LMAC_WRAPPER            0xFB
 #define UMAC_CMD_OPCODE_HW_TEST_WRAPPER         0xFC
@@ -281,6 +298,7 @@ struct iwm_udma_out_wifi_hdr {
 #define UMAC_WIFI_IF_CMD_GLOBAL_TX_KEY_ID                0x1B
 #define UMAC_WIFI_IF_CMD_SET_HOST_EXTENDED_IE            0x1C
 #define UMAC_WIFI_IF_CMD_GET_SUPPORTED_CHANNELS          0x1E
+#define UMAC_WIFI_IF_CMD_PMKID_UPDATE                    0x1F
 #define UMAC_WIFI_IF_CMD_TX_PWR_TRIGGER                  0x20
 
 /* UMAC WiFi interface ports */
@@ -687,19 +705,24 @@ struct iwm_umac_notif_rx_ticket {
 /* Tx/Rx rates window (number of max of last update window per second) */
 #define UMAC_NTF_RATE_SAMPLE_NR 4
 
+/* Max numbers of bits required to go through all antennae in bitmasks */
+#define UMAC_PHY_NUM_CHAINS     3
+
 #define IWM_UMAC_MGMT_TID       8
-#define IWM_UMAC_TID_NR         8
+#define IWM_UMAC_TID_NR         9 /* 8 TIDs + MGMT */
 
 struct iwm_umac_notif_stats {
         struct iwm_umac_wifi_in_hdr hdr;
         __le32 flags;
         __le32 timestamp;
-        __le16 tid_load[IWM_UMAC_TID_NR + 2]; /* 1 non-QoS + 1 dword align */
+        __le16 tid_load[IWM_UMAC_TID_NR + 1]; /* 1 non-QoS + 1 dword align */
         __le16 tx_rate[UMAC_NTF_RATE_SAMPLE_NR];
         __le16 rx_rate[UMAC_NTF_RATE_SAMPLE_NR];
+        __le32 chain_energy[UMAC_PHY_NUM_CHAINS];
         s32 rssi_dbm;
         s32 noise_dbm;
         __le32 supp_rates;
+        __le32 supp_ht_rates;
         __le32 missed_beacons;
         __le32 rx_beacons;
         __le32 rx_dir_pkts;
@@ -737,6 +760,20 @@ struct iwm_umac_notif_stats {
         __le32 roam_ap_loadblance;
 } __attribute__ ((packed));
 
+#define UMAC_STOP_TX_FLAG    0x1
+#define UMAC_RESUME_TX_FLAG  0x2
+
+#define LAST_SEQ_NUM_INVALID     0xFFFF
+
+struct iwm_umac_notif_stop_resume_tx {
+        struct iwm_umac_wifi_in_hdr hdr;
+        u8 flags; /* UMAC_*_TX_FLAG_* */
+        u8 sta_id;
+        __le16 stop_resume_tid_msk; /* tid bitmask */
+} __attribute__ ((packed));
+
+#define UMAC_MAX_NUM_PMKIDS 4
+
 /* WiFi interface wrapper header */
 struct iwm_umac_wifi_if {
         u8 oid;
diff --git a/drivers/net/wireless/libertas/11d.c b/drivers/net/wireless/libertas/11d.c
deleted file mode 100644
index 5c6968101f0d..000000000000
--- a/drivers/net/wireless/libertas/11d.c
+++ /dev/null
@@ -1,696 +0,0 @@
-/**
-  * This file contains functions for 802.11D.
-  */
-#include <linux/ctype.h>
-#include <linux/kernel.h>
-#include <linux/wireless.h>
-
-#include "host.h"
-#include "decl.h"
-#include "11d.h"
-#include "dev.h"
-#include "wext.h"
-
-#define TX_PWR_DEFAULT  10
-
-static struct region_code_mapping region_code_mapping[] = {
-        {"US ", 0x10},          /* US FCC      */
-        {"CA ", 0x10},          /* IC Canada   */
-        {"SG ", 0x10},          /* Singapore   */
-        {"EU ", 0x30},          /* ETSI        */
-        {"AU ", 0x30},          /* Australia   */
-        {"KR ", 0x30},          /* Republic Of Korea */
-        {"ES ", 0x31},          /* Spain       */
-        {"FR ", 0x32},          /* France      */
-        {"JP ", 0x40},          /* Japan       */
-};
-
-/* Following 2 structure defines the supported channels */
-static struct chan_freq_power channel_freq_power_UN_BG[] = {
-        {1, 2412, TX_PWR_DEFAULT},
-        {2, 2417, TX_PWR_DEFAULT},
-        {3, 2422, TX_PWR_DEFAULT},
-        {4, 2427, TX_PWR_DEFAULT},
-        {5, 2432, TX_PWR_DEFAULT},
-        {6, 2437, TX_PWR_DEFAULT},
-        {7, 2442, TX_PWR_DEFAULT},
-        {8, 2447, TX_PWR_DEFAULT},
-        {9, 2452, TX_PWR_DEFAULT},
-        {10, 2457, TX_PWR_DEFAULT},
-        {11, 2462, TX_PWR_DEFAULT},
-        {12, 2467, TX_PWR_DEFAULT},
-        {13, 2472, TX_PWR_DEFAULT},
-        {14, 2484, TX_PWR_DEFAULT}
-};
-
-static u8 lbs_region_2_code(u8 *region)
-{
-        u8 i;
-
-        for (i = 0; i < COUNTRY_CODE_LEN && region[i]; i++)
-                region[i] = toupper(region[i]);
-
-        for (i = 0; i < ARRAY_SIZE(region_code_mapping); i++) {
-                if (!memcmp(region, region_code_mapping[i].region,
-                            COUNTRY_CODE_LEN))
-                        return (region_code_mapping[i].code);
-        }
-
-        /* default is US */
-        return (region_code_mapping[0].code);
-}
-
-static u8 *lbs_code_2_region(u8 code)
-{
-        u8 i;
-
-        for (i = 0; i < ARRAY_SIZE(region_code_mapping); i++) {
-                if (region_code_mapping[i].code == code)
-                        return (region_code_mapping[i].region);
-        }
-        /* default is US */
-        return (region_code_mapping[0].region);
-}
-
-/**
- *  @brief This function finds the nrchan-th chan after the firstchan
- *  @param band       band
- *  @param firstchan  first channel number
- *  @param nrchan   number of channels
- *  @return           the nrchan-th chan number
-*/
-static u8 lbs_get_chan_11d(u8 firstchan, u8 nrchan, u8 *chan)
-/*find the nrchan-th chan after the firstchan*/
-{
-        u8 i;
-        struct chan_freq_power *cfp;
-        u8 cfp_no;
-
-        cfp = channel_freq_power_UN_BG;
-        cfp_no = ARRAY_SIZE(channel_freq_power_UN_BG);
-
-        for (i = 0; i < cfp_no; i++) {
-                if ((cfp + i)->channel == firstchan) {
-                        lbs_deb_11d("firstchan found\n");
-                        break;
-                }
-        }
-
-        if (i < cfp_no) {
-                /*if beyond the boundary */
-                if (i + nrchan < cfp_no) {
-                        *chan = (cfp + i + nrchan)->channel;
-                        return 1;
-                }
-        }
-
-        return 0;
-}
-
-/**
- *  @brief This function Checks if chan txpwr is learned from AP/IBSS
- *  @param chan                 chan number
- *  @param parsed_region_chan   pointer to parsed_region_chan_11d
- *  @return                     TRUE; FALSE
-*/
-static u8 lbs_channel_known_11d(u8 chan,
-                          struct parsed_region_chan_11d * parsed_region_chan)
-{
-        struct chan_power_11d *chanpwr = parsed_region_chan->chanpwr;
-        u8 nr_chan = parsed_region_chan->nr_chan;
-        u8 i = 0;
-
-        lbs_deb_hex(LBS_DEB_11D, "parsed_region_chan", (char *)chanpwr,
-                sizeof(struct chan_power_11d) * nr_chan);
-
-        for (i = 0; i < nr_chan; i++) {
-                if (chan == chanpwr[i].chan) {
-                        lbs_deb_11d("found chan %d\n", chan);
-                        return 1;
-                }
-        }
-
-        lbs_deb_11d("chan %d not found\n", chan);
-        return 0;
-}
-
-u32 lbs_chan_2_freq(u8 chan)
-{
-        struct chan_freq_power *cf;
-        u16 i;
-        u32 freq = 0;
-
-        cf = channel_freq_power_UN_BG;
-
-        for (i = 0; i < ARRAY_SIZE(channel_freq_power_UN_BG); i++) {
-                if (chan == cf[i].channel)
-                        freq = cf[i].freq;
-        }
-
-        return freq;
-}
-
-static int generate_domain_info_11d(struct parsed_region_chan_11d
-                                  *parsed_region_chan,
-                                  struct lbs_802_11d_domain_reg *domaininfo)
-{
-        u8 nr_subband = 0;
-
-        u8 nr_chan = parsed_region_chan->nr_chan;
-        u8 nr_parsedchan = 0;
-
-        u8 firstchan = 0, nextchan = 0, maxpwr = 0;
-
-        u8 i, flag = 0;
-
-        memcpy(domaininfo->countrycode, parsed_region_chan->countrycode,
-               COUNTRY_CODE_LEN);
-
-        lbs_deb_11d("nrchan %d\n", nr_chan);
-        lbs_deb_hex(LBS_DEB_11D, "parsed_region_chan", (char *)parsed_region_chan,
-                sizeof(struct parsed_region_chan_11d));
-
-        for (i = 0; i < nr_chan; i++) {
-                if (!flag) {
-                        flag = 1;
-                        nextchan = firstchan =
-                            parsed_region_chan->chanpwr[i].chan;
-                        maxpwr = parsed_region_chan->chanpwr[i].pwr;
-                        nr_parsedchan = 1;
-                        continue;
-                }
-
-                if (parsed_region_chan->chanpwr[i].chan == nextchan + 1 &&
-                    parsed_region_chan->chanpwr[i].pwr == maxpwr) {
-                        nextchan++;
-                        nr_parsedchan++;
-                } else {
-                        domaininfo->subband[nr_subband].firstchan = firstchan;
-                        domaininfo->subband[nr_subband].nrchan =
-                            nr_parsedchan;
-                        domaininfo->subband[nr_subband].maxtxpwr = maxpwr;
-                        nr_subband++;
-                        nextchan = firstchan =
-                            parsed_region_chan->chanpwr[i].chan;
-                        maxpwr = parsed_region_chan->chanpwr[i].pwr;
-                }
-        }
-
-        if (flag) {
-                domaininfo->subband[nr_subband].firstchan = firstchan;
-                domaininfo->subband[nr_subband].nrchan = nr_parsedchan;
-                domaininfo->subband[nr_subband].maxtxpwr = maxpwr;
-                nr_subband++;
-        }
-        domaininfo->nr_subband = nr_subband;
-
-        lbs_deb_11d("nr_subband=%x\n", domaininfo->nr_subband);
-        lbs_deb_hex(LBS_DEB_11D, "domaininfo", (char *)domaininfo,
-                COUNTRY_CODE_LEN + 1 +
-                sizeof(struct ieee_subbandset) * nr_subband);
-        return 0;
-}
-
-/**
- *  @brief This function generates parsed_region_chan from Domain Info learned from AP/IBSS
- *  @param region_chan          pointer to struct region_channel
- *  @param *parsed_region_chan  pointer to parsed_region_chan_11d
- *  @return                     N/A
-*/
-static void lbs_generate_parsed_region_chan_11d(struct region_channel *region_chan,
-                                          struct parsed_region_chan_11d *
-                                          parsed_region_chan)
-{
-        u8 i;
-        struct chan_freq_power *cfp;
-
-        if (region_chan == NULL) {
-                lbs_deb_11d("region_chan is NULL\n");
-                return;
-        }
-
-        cfp = region_chan->CFP;
-        if (cfp == NULL) {
-                lbs_deb_11d("cfp is NULL \n");
-                return;
-        }
-
-        parsed_region_chan->band = region_chan->band;
-        parsed_region_chan->region = region_chan->region;
-        memcpy(parsed_region_chan->countrycode,
-               lbs_code_2_region(region_chan->region), COUNTRY_CODE_LEN);
-
-        lbs_deb_11d("region 0x%x, band %d\n", parsed_region_chan->region,
-               parsed_region_chan->band);
-
-        for (i = 0; i < region_chan->nrcfp; i++, cfp++) {
-                parsed_region_chan->chanpwr[i].chan = cfp->channel;
-                parsed_region_chan->chanpwr[i].pwr = cfp->maxtxpower;
-                lbs_deb_11d("chan %d, pwr %d\n",
-                       parsed_region_chan->chanpwr[i].chan,
-                       parsed_region_chan->chanpwr[i].pwr);
-        }
-        parsed_region_chan->nr_chan = region_chan->nrcfp;
-
-        lbs_deb_11d("nrchan %d\n", parsed_region_chan->nr_chan);
-
-        return;
-}
-
-/**
- *  @brief generate parsed_region_chan from Domain Info learned from AP/IBSS
- *  @param region               region ID
- *  @param band                 band
- *  @param chan                 chan
- *  @return                     TRUE;FALSE
-*/
-static u8 lbs_region_chan_supported_11d(u8 region, u8 chan)
-{
-        struct chan_freq_power *cfp;
-        int cfp_no;
-        u8 idx;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_11D);
-
-        cfp = lbs_get_region_cfp_table(region, &cfp_no);
-        if (cfp == NULL)
-                return 0;
-
-        for (idx = 0; idx < cfp_no; idx++) {
-                if (chan == (cfp + idx)->channel) {
-                        /* If Mrvl Chip Supported? */
-                        if ((cfp + idx)->unsupported) {
-                                ret = 0;
-                        } else {
-                                ret = 1;
-                        }
-                        goto done;
-                }
-        }
-
-        /*chan is not in the region table */
-
-done:
-        lbs_deb_leave_args(LBS_DEB_11D, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief This function checks if chan txpwr is learned from AP/IBSS
- *  @param chan                 chan number
- *  @param parsed_region_chan   pointer to parsed_region_chan_11d
- *  @return                     0
-*/
-static int parse_domain_info_11d(struct ieee_ie_country_info_full_set *countryinfo,
-                                 u8 band,
-                                 struct parsed_region_chan_11d *parsed_region_chan)
-{
-        u8 nr_subband, nrchan;
-        u8 lastchan, firstchan;
-        u8 region;
-        u8 curchan = 0;
-
-        u8 idx = 0;             /*chan index in parsed_region_chan */
-
-        u8 j, i;
-
-        lbs_deb_enter(LBS_DEB_11D);
-
-        /*validation Rules:
-           1. valid region Code
-           2. First Chan increment
-           3. channel range no overlap
-           4. channel is valid?
-           5. channel is supported by region?
-           6. Others
-         */
-
-        lbs_deb_hex(LBS_DEB_11D, "countryinfo", (u8 *) countryinfo, 30);
-
-        if ((*(countryinfo->countrycode)) == 0
-            || (countryinfo->header.len <= COUNTRY_CODE_LEN)) {
-                /* No region Info or Wrong region info: treat as No 11D info */
-                goto done;
-        }
-
-        /*Step1: check region_code */
-        parsed_region_chan->region = region =
-            lbs_region_2_code(countryinfo->countrycode);
-
-        lbs_deb_11d("regioncode=%x\n", (u8) parsed_region_chan->region);
-        lbs_deb_hex(LBS_DEB_11D, "countrycode", (char *)countryinfo->countrycode,
-                COUNTRY_CODE_LEN);
-
-        parsed_region_chan->band = band;
-
-        memcpy(parsed_region_chan->countrycode, countryinfo->countrycode,
-               COUNTRY_CODE_LEN);
-
-        nr_subband = (countryinfo->header.len - COUNTRY_CODE_LEN) /
-            sizeof(struct ieee_subbandset);
-
-        for (j = 0, lastchan = 0; j < nr_subband; j++) {
-
-                if (countryinfo->subband[j].firstchan <= lastchan) {
-                        /*Step2&3. Check First Chan Num increment and no overlap */
-                        lbs_deb_11d("chan %d>%d, overlap\n",
-                               countryinfo->subband[j].firstchan, lastchan);
-                        continue;
-                }
-
-                firstchan = countryinfo->subband[j].firstchan;
-                nrchan = countryinfo->subband[j].nrchan;
-
-                for (i = 0; idx < MAX_NO_OF_CHAN && i < nrchan; i++) {
-                        /*step4: channel is supported? */
-
-                        if (!lbs_get_chan_11d(firstchan, i, &curchan)) {
-                                /* Chan is not found in UN table */
-                                lbs_deb_11d("chan is not supported: %d \n", i);
-                                break;
-                        }
-
-                        lastchan = curchan;
-
-                        if (lbs_region_chan_supported_11d(region, curchan)) {
-                                /*step5: Check if curchan is supported by mrvl in region */
-                                parsed_region_chan->chanpwr[idx].chan = curchan;
-                                parsed_region_chan->chanpwr[idx].pwr =
-                                    countryinfo->subband[j].maxtxpwr;
-                                idx++;
-                        } else {
-                                /*not supported and ignore the chan */
-                                lbs_deb_11d(
-                                       "i %d, chan %d unsupported in region %x, band %d\n",
-                                       i, curchan, region, band);
-                        }
-                }
-
-                /*Step6: Add other checking if any */
-
-        }
-
-        parsed_region_chan->nr_chan = idx;
-
-        lbs_deb_11d("nrchan=%x\n", parsed_region_chan->nr_chan);
-        lbs_deb_hex(LBS_DEB_11D, "parsed_region_chan", (u8 *) parsed_region_chan,
-                2 + COUNTRY_CODE_LEN + sizeof(struct parsed_region_chan_11d) * idx);
-
-done:
-        lbs_deb_enter(LBS_DEB_11D);
-        return 0;
-}
-
-/**
- *  @brief This function calculates the scan type for channels
- *  @param chan                 chan number
- *  @param parsed_region_chan   pointer to parsed_region_chan_11d
- *  @return                     PASSIVE if chan is unknown; ACTIVE if chan is known
-*/
-u8 lbs_get_scan_type_11d(u8 chan,
-                          struct parsed_region_chan_11d * parsed_region_chan)
-{
-        u8 scan_type = CMD_SCAN_TYPE_PASSIVE;
-
-        lbs_deb_enter(LBS_DEB_11D);
-
-        if (lbs_channel_known_11d(chan, parsed_region_chan)) {
-                lbs_deb_11d("found, do active scan\n");
-                scan_type = CMD_SCAN_TYPE_ACTIVE;
-        } else {
-                lbs_deb_11d("not found, do passive scan\n");
-        }
-
-        lbs_deb_leave_args(LBS_DEB_11D, "ret scan_type %d", scan_type);
-        return scan_type;
-
-}
-
-void lbs_init_11d(struct lbs_private *priv)
-{
-        priv->enable11d = 0;
-        memset(&(priv->parsed_region_chan), 0,
-               sizeof(struct parsed_region_chan_11d));
-        return;
-}
-
-/**
- *  @brief This function sets DOMAIN INFO to FW
- *  @param priv       pointer to struct lbs_private
- *  @return           0; -1
-*/
-static int set_domain_info_11d(struct lbs_private *priv)
-{
-        int ret;
-
-        if (!priv->enable11d) {
-                lbs_deb_11d("dnld domain Info with 11d disabled\n");
-                return 0;
-        }
-
-        ret = lbs_prepare_and_send_command(priv, CMD_802_11D_DOMAIN_INFO,
-                                    CMD_ACT_SET,
-                                    CMD_OPTION_WAITFORRSP, 0, NULL);
-        if (ret)
-                lbs_deb_11d("fail to dnld domain info\n");
-
-        return ret;
-}
-
-/**
- *  @brief This function setups scan channels
- *  @param priv       pointer to struct lbs_private
- *  @param band       band
- *  @return           0
-*/
-int lbs_set_universaltable(struct lbs_private *priv, u8 band)
-{
-        u16 size = sizeof(struct chan_freq_power);
-        u16 i = 0;
-
-        memset(priv->universal_channel, 0,
-               sizeof(priv->universal_channel));
-
-        priv->universal_channel[i].nrcfp =
-            sizeof(channel_freq_power_UN_BG) / size;
-        lbs_deb_11d("BG-band nrcfp %d\n",
-               priv->universal_channel[i].nrcfp);
-
-        priv->universal_channel[i].CFP = channel_freq_power_UN_BG;
-        priv->universal_channel[i].valid = 1;
-        priv->universal_channel[i].region = UNIVERSAL_REGION_CODE;
-        priv->universal_channel[i].band = band;
-        i++;
-
-        return 0;
-}
-
-/**
- *  @brief This function implements command CMD_802_11D_DOMAIN_INFO
- *  @param priv       pointer to struct lbs_private
- *  @param cmd        pointer to cmd buffer
- *  @param cmdno      cmd ID
- *  @param cmdOption  cmd action
- *  @return           0
-*/
-int lbs_cmd_802_11d_domain_info(struct lbs_private *priv,
-                                 struct cmd_ds_command *cmd, u16 cmdno,
-                                 u16 cmdoption)
-{
-        struct cmd_ds_802_11d_domain_info *pdomaininfo =
-            &cmd->params.domaininfo;
-        struct mrvl_ie_domain_param_set *domain = &pdomaininfo->domain;
-        u8 nr_subband = priv->domainreg.nr_subband;
-
-        lbs_deb_enter(LBS_DEB_11D);
-
-        lbs_deb_11d("nr_subband=%x\n", nr_subband);
-
-        cmd->command = cpu_to_le16(cmdno);
-        pdomaininfo->action = cpu_to_le16(cmdoption);
-        if (cmdoption == CMD_ACT_GET) {
-                cmd->size =
-                    cpu_to_le16(sizeof(pdomaininfo->action) + S_DS_GEN);
-                lbs_deb_hex(LBS_DEB_11D, "802_11D_DOMAIN_INFO", (u8 *) cmd,
-                        le16_to_cpu(cmd->size));
-                goto done;
-        }
-
-        domain->header.type = cpu_to_le16(TLV_TYPE_DOMAIN);
-        memcpy(domain->countrycode, priv->domainreg.countrycode,
-               sizeof(domain->countrycode));
-
-        domain->header.len =
-            cpu_to_le16(nr_subband * sizeof(struct ieee_subbandset) +
-                             sizeof(domain->countrycode));
-
-        if (nr_subband) {
-                memcpy(domain->subband, priv->domainreg.subband,
-                       nr_subband * sizeof(struct ieee_subbandset));
-
-                cmd->size = cpu_to_le16(sizeof(pdomaininfo->action) +
-                                             le16_to_cpu(domain->header.len) +
-                                             sizeof(struct mrvl_ie_header) +
-                                             S_DS_GEN);
-        } else {
-                cmd->size =
-                    cpu_to_le16(sizeof(pdomaininfo->action) + S_DS_GEN);
-        }
-
-        lbs_deb_hex(LBS_DEB_11D, "802_11D_DOMAIN_INFO", (u8 *) cmd, le16_to_cpu(cmd->size));
-
-done:
-        lbs_deb_enter(LBS_DEB_11D);
-        return 0;
-}
-
-/**
- *  @brief This function parses countryinfo from AP and download country info to FW
- *  @param priv    pointer to struct lbs_private
- *  @param resp    pointer to command response buffer
- *  @return        0; -1
- */
-int lbs_ret_802_11d_domain_info(struct cmd_ds_command *resp)
-{
-        struct cmd_ds_802_11d_domain_info *domaininfo = &resp->params.domaininforesp;
-        struct mrvl_ie_domain_param_set *domain = &domaininfo->domain;
-        u16 action = le16_to_cpu(domaininfo->action);
-        s16 ret = 0;
-        u8 nr_subband = 0;
-
-        lbs_deb_enter(LBS_DEB_11D);
-
-        lbs_deb_hex(LBS_DEB_11D, "domain info resp", (u8 *) resp,
-                (int)le16_to_cpu(resp->size));
-
-        nr_subband = (le16_to_cpu(domain->header.len) - COUNTRY_CODE_LEN) /
-                      sizeof(struct ieee_subbandset);
-
-        lbs_deb_11d("domain info resp: nr_subband %d\n", nr_subband);
-
-        if (nr_subband > MRVDRV_MAX_SUBBAND_802_11D) {
-                lbs_deb_11d("Invalid Numrer of Subband returned!!\n");
-                return -1;
-        }
-
-        switch (action) {
-        case CMD_ACT_SET:       /*Proc Set action */
-                break;
-
-        case CMD_ACT_GET:
-                break;
-        default:
-                lbs_deb_11d("Invalid action:%d\n", domaininfo->action);
-                ret = -1;
-                break;
-        }
-
-        lbs_deb_leave_args(LBS_DEB_11D, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief This function parses countryinfo from AP and download country info to FW
- *  @param priv    pointer to struct lbs_private
- *  @return        0; -1
- */
-int lbs_parse_dnld_countryinfo_11d(struct lbs_private *priv,
-                                        struct bss_descriptor * bss)
-{
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_11D);
-        if (priv->enable11d) {
-                memset(&priv->parsed_region_chan, 0,
-                       sizeof(struct parsed_region_chan_11d));
-                ret = parse_domain_info_11d(&bss->countryinfo, 0,
-                                               &priv->parsed_region_chan);
-
-                if (ret == -1) {
-                        lbs_deb_11d("error parsing domain_info from AP\n");
-                        goto done;
-                }
-
-                memset(&priv->domainreg, 0,
-                       sizeof(struct lbs_802_11d_domain_reg));
-                generate_domain_info_11d(&priv->parsed_region_chan,
-                                      &priv->domainreg);
-
-                ret = set_domain_info_11d(priv);
-
-                if (ret) {
-                        lbs_deb_11d("error setting domain info\n");
-                        goto done;
-                }
-        }
-        ret = 0;
-
-done:
-        lbs_deb_leave_args(LBS_DEB_11D, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief This function generates 11D info from user specified regioncode and download to FW
- *  @param priv    pointer to struct lbs_private
- *  @return        0; -1
- */
-int lbs_create_dnld_countryinfo_11d(struct lbs_private *priv)
-{
-        int ret;
-        struct region_channel *region_chan;
-        u8 j;
-
-        lbs_deb_enter(LBS_DEB_11D);
-        lbs_deb_11d("curbssparams.band %d\n", priv->curbssparams.band);
-
-        if (priv->enable11d) {
-                /* update parsed_region_chan_11; dnld domaininf to FW */
-
-                for (j = 0; j < ARRAY_SIZE(priv->region_channel); j++) {
-                        region_chan = &priv->region_channel[j];
-
-                        lbs_deb_11d("%d region_chan->band %d\n", j,
-                               region_chan->band);
-
-                        if (!region_chan || !region_chan->valid
-                            || !region_chan->CFP)
-                                continue;
-                        if (region_chan->band != priv->curbssparams.band)
-                                continue;
-                        break;
-                }
-
-                if (j >= ARRAY_SIZE(priv->region_channel)) {
-                        lbs_deb_11d("region_chan not found, band %d\n",
-                               priv->curbssparams.band);
-                        ret = -1;
-                        goto done;
-                }
-
-                memset(&priv->parsed_region_chan, 0,
-                       sizeof(struct parsed_region_chan_11d));
-                lbs_generate_parsed_region_chan_11d(region_chan,
-                                                     &priv->
-                                                     parsed_region_chan);
-
-                memset(&priv->domainreg, 0,
-                       sizeof(struct lbs_802_11d_domain_reg));
-                generate_domain_info_11d(&priv->parsed_region_chan,
-                                         &priv->domainreg);
-
-                ret = set_domain_info_11d(priv);
-
-                if (ret) {
-                        lbs_deb_11d("error setting domain info\n");
-                        goto done;
-                }
-
-        }
-        ret = 0;
-
-done:
-        lbs_deb_leave_args(LBS_DEB_11D, "ret %d", ret);
-        return ret;
-}
diff --git a/drivers/net/wireless/libertas/11d.h b/drivers/net/wireless/libertas/11d.h
deleted file mode 100644
index fb75d3e321a0..000000000000
--- a/drivers/net/wireless/libertas/11d.h
+++ /dev/null
@@ -1,105 +0,0 @@
-/**
-  * This header file contains data structures and
-  * function declarations of 802.11d
-  */
-#ifndef _LBS_11D_
-#define _LBS_11D_
-
-#include "types.h"
-#include "defs.h"
-
-#define UNIVERSAL_REGION_CODE                   0xff
-
-/** (Beaconsize(256)-5(IEId,len,contrystr(3))/3(FirstChan,NoOfChan,MaxPwr)
- */
-#define MRVDRV_MAX_SUBBAND_802_11D              83
-
-#define COUNTRY_CODE_LEN                        3
-#define MAX_NO_OF_CHAN                          40
-
-struct cmd_ds_command;
-
-/** Data structure for Country IE*/
-struct ieee_subbandset {
-        u8 firstchan;
-        u8 nrchan;
-        u8 maxtxpwr;
-} __attribute__ ((packed));
-
-struct ieee_ie_country_info_set {
-        struct ieee_ie_header header;
-
-        u8 countrycode[COUNTRY_CODE_LEN];
-        struct ieee_subbandset subband[1];
-};
-
-struct ieee_ie_country_info_full_set {
-        struct ieee_ie_header header;
-
-        u8 countrycode[COUNTRY_CODE_LEN];
-        struct ieee_subbandset subband[MRVDRV_MAX_SUBBAND_802_11D];
-} __attribute__ ((packed));
-
-struct mrvl_ie_domain_param_set {
-        struct mrvl_ie_header header;
-
-        u8 countrycode[COUNTRY_CODE_LEN];
-        struct ieee_subbandset subband[1];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11d_domain_info {
-        __le16 action;
-        struct mrvl_ie_domain_param_set domain;
-} __attribute__ ((packed));
-
-/** domain regulatory information */
-struct lbs_802_11d_domain_reg {
-        /** country Code*/
-        u8 countrycode[COUNTRY_CODE_LEN];
-        /** No. of subband*/
-        u8 nr_subband;
-        struct ieee_subbandset subband[MRVDRV_MAX_SUBBAND_802_11D];
-};
-
-struct chan_power_11d {
-        u8 chan;
-        u8 pwr;
-} __attribute__ ((packed));
-
-struct parsed_region_chan_11d {
-        u8 band;
-        u8 region;
-        s8 countrycode[COUNTRY_CODE_LEN];
-        struct chan_power_11d chanpwr[MAX_NO_OF_CHAN];
-        u8 nr_chan;
-} __attribute__ ((packed));
-
-struct region_code_mapping {
-        u8 region[COUNTRY_CODE_LEN];
-        u8 code;
-};
-
-struct lbs_private;
-
-u8 lbs_get_scan_type_11d(u8 chan,
-                          struct parsed_region_chan_11d *parsed_region_chan);
-
-u32 lbs_chan_2_freq(u8 chan);
-
-void lbs_init_11d(struct lbs_private *priv);
-
-int lbs_set_universaltable(struct lbs_private *priv, u8 band);
-
-int lbs_cmd_802_11d_domain_info(struct lbs_private *priv,
-                                 struct cmd_ds_command *cmd, u16 cmdno,
-                                 u16 cmdOption);
-
-int lbs_ret_802_11d_domain_info(struct cmd_ds_command *resp);
-
-struct bss_descriptor;
-int lbs_parse_dnld_countryinfo_11d(struct lbs_private *priv,
-                                        struct bss_descriptor * bss);
-
-int lbs_create_dnld_countryinfo_11d(struct lbs_private *priv);
-
-#endif
diff --git a/drivers/net/wireless/libertas/Kconfig b/drivers/net/wireless/libertas/Kconfig
new file mode 100644
index 000000000000..0485c9957575
--- /dev/null
+++ b/drivers/net/wireless/libertas/Kconfig
@@ -0,0 +1,45 @@
+config LIBERTAS
+        tristate "Marvell 8xxx Libertas WLAN driver support"
+        depends on CFG80211
+        select WIRELESS_EXT
+        select WEXT_SPY
+        select LIB80211
+        select FW_LOADER
+        ---help---
+          A library for Marvell Libertas 8xxx devices.
+
+config LIBERTAS_USB
+        tristate "Marvell Libertas 8388 USB 802.11b/g cards"
+        depends on LIBERTAS && USB
+        ---help---
+          A driver for Marvell Libertas 8388 USB devices.
+
+config LIBERTAS_CS
+        tristate "Marvell Libertas 8385 CompactFlash 802.11b/g cards"
+        depends on LIBERTAS && PCMCIA
+        ---help---
+          A driver for Marvell Libertas 8385 CompactFlash devices.
+
+config LIBERTAS_SDIO
+        tristate "Marvell Libertas 8385/8686/8688 SDIO 802.11b/g cards"
+        depends on LIBERTAS && MMC
+        ---help---
+          A driver for Marvell Libertas 8385/8686/8688 SDIO devices.
+
+config LIBERTAS_SPI
+        tristate "Marvell Libertas 8686 SPI 802.11b/g cards"
+        depends on LIBERTAS && SPI
+        ---help---
+          A driver for Marvell Libertas 8686 SPI devices.
+
+config LIBERTAS_DEBUG
+        bool "Enable full debugging output in the Libertas module."
+        depends on LIBERTAS
+        ---help---
+          Debugging support.
+
+config LIBERTAS_MESH
+        bool "Enable mesh support"
+        depends on LIBERTAS
+        help
+          This enables Libertas' MESH support, used by e.g. the OLPC people.
diff --git a/drivers/net/wireless/libertas/Makefile b/drivers/net/wireless/libertas/Makefile
index 0b6918584503..45e870e33117 100644
--- a/drivers/net/wireless/libertas/Makefile
+++ b/drivers/net/wireless/libertas/Makefile
@@ -1,5 +1,15 @@
-libertas-objs := main.o wext.o rx.o tx.o cmd.o cmdresp.o scan.o 11d.o   \
-                 debugfs.o persistcfg.o ethtool.o assoc.o
+libertas-y += assoc.o
+libertas-y += cfg.o
+libertas-y += cmd.o
+libertas-y += cmdresp.o
+libertas-y += debugfs.o
+libertas-y += ethtool.o
+libertas-y += main.o
+libertas-y += rx.o
+libertas-y += scan.o
+libertas-y += tx.o
+libertas-y += wext.o
+libertas-$(CONFIG_LIBERTAS_MESH) += mesh.o
 
 usb8xxx-objs += if_usb.o
 libertas_cs-objs += if_cs.o
diff --git a/drivers/net/wireless/libertas/README b/drivers/net/wireless/libertas/README
index ab6a2d518af0..2726c044430f 100644
--- a/drivers/net/wireless/libertas/README
+++ b/drivers/net/wireless/libertas/README
@@ -1,5 +1,5 @@
 ================================================================================
-                        README for USB8388
+                        README for Libertas
 
  (c) Copyright © 2003-2006, Marvell International Ltd.
  All Rights Reserved
@@ -226,4 +226,28 @@ setuserscan
     All entries in the scan table (not just the new scan data when keep=1)
     will be displayed upon completion by use of the getscantable ioctl.
 
+========================
+IWCONFIG COMMANDS
+========================
+power period
+
+        This command is used to configure the station in deep sleep mode /
+        auto deep sleep mode.
+
+        The timer is implemented to monitor the activities (command, event,
+        etc.). When an activity is detected station will exit from deep
+        sleep mode automatically and restart the timer. At timer expiry
+        (no activity for defined time period) the deep sleep mode is entered
+        automatically.
+
+        Note: this command is for SDIO interface only.
+
+        Usage:
+        To enable deep sleep mode do:
+                iwconfig wlan0 power period 0
+        To enable auto deep sleep mode with idle time period 5 seconds do:
+                iwconfig wlan0 power period 5
+        To disable deep sleep/auto deep sleep mode do:
+                iwconfig wlan0 power period -1
+
 ==============================================================================
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index dd8732611ba9..12a2ef9dacea 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -4,6 +4,7 @@
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
+#include <linux/slab.h>
 #include <net/lib80211.h>
 
 #include "assoc.h"
@@ -23,6 +24,13 @@ static const u8 bssid_off[ETH_ALEN]  __attribute__ ((aligned (2))) =
  */
 #define CAPINFO_MASK    (~(0xda00))
 
+/**
+ * 802.11b/g supported bitrates (in 500Kb/s units)
+ */
+u8 lbs_bg_rates[MAX_RATES] =
+    { 0x02, 0x04, 0x0b, 0x16, 0x0c, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6c,
+0x00, 0x00 };
+
 
 /**
  *  @brief This function finds common rates between rates and card rates.
@@ -147,6 +155,395 @@ static int lbs_set_authentication(struct lbs_private *priv, u8 bssid[6], u8 auth
 }
 
 
+int lbs_cmd_802_11_set_wep(struct lbs_private *priv, uint16_t cmd_action,
+                           struct assoc_request *assoc)
+{
+        struct cmd_ds_802_11_set_wep cmd;
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.command = cpu_to_le16(CMD_802_11_SET_WEP);
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+
+        cmd.action = cpu_to_le16(cmd_action);
+
+        if (cmd_action == CMD_ACT_ADD) {
+                int i;
+
+                /* default tx key index */
+                cmd.keyindex = cpu_to_le16(assoc->wep_tx_keyidx &
+                                           CMD_WEP_KEY_INDEX_MASK);
+
+                /* Copy key types and material to host command structure */
+                for (i = 0; i < 4; i++) {
+                        struct enc_key *pkey = &assoc->wep_keys[i];
+
+                        switch (pkey->len) {
+                        case KEY_LEN_WEP_40:
+                                cmd.keytype[i] = CMD_TYPE_WEP_40_BIT;
+                                memmove(cmd.keymaterial[i], pkey->key, pkey->len);
+                                lbs_deb_cmd("SET_WEP: add key %d (40 bit)\n", i);
+                                break;
+                        case KEY_LEN_WEP_104:
+                                cmd.keytype[i] = CMD_TYPE_WEP_104_BIT;
+                                memmove(cmd.keymaterial[i], pkey->key, pkey->len);
+                                lbs_deb_cmd("SET_WEP: add key %d (104 bit)\n", i);
+                                break;
+                        case 0:
+                                break;
+                        default:
+                                lbs_deb_cmd("SET_WEP: invalid key %d, length %d\n",
+                                            i, pkey->len);
+                                ret = -1;
+                                goto done;
+                                break;
+                        }
+                }
+        } else if (cmd_action == CMD_ACT_REMOVE) {
+                /* ACT_REMOVE clears _all_ WEP keys */
+
+                /* default tx key index */
+                cmd.keyindex = cpu_to_le16(priv->wep_tx_keyidx &
+                                           CMD_WEP_KEY_INDEX_MASK);
+                lbs_deb_cmd("SET_WEP: remove key %d\n", priv->wep_tx_keyidx);
+        }
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
+done:
+        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
+        return ret;
+}
+
+int lbs_cmd_802_11_enable_rsn(struct lbs_private *priv, uint16_t cmd_action,
+                              uint16_t *enable)
+{
+        struct cmd_ds_802_11_enable_rsn cmd;
+        int ret;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+        cmd.action = cpu_to_le16(cmd_action);
+
+        if (cmd_action == CMD_ACT_GET)
+                cmd.enable = 0;
+        else {
+                if (*enable)
+                        cmd.enable = cpu_to_le16(CMD_ENABLE_RSN);
+                else
+                        cmd.enable = cpu_to_le16(CMD_DISABLE_RSN);
+                lbs_deb_cmd("ENABLE_RSN: %d\n", *enable);
+        }
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_ENABLE_RSN, &cmd);
+        if (!ret && cmd_action == CMD_ACT_GET)
+                *enable = le16_to_cpu(cmd.enable);
+
+        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
+        return ret;
+}
+
+static void set_one_wpa_key(struct MrvlIEtype_keyParamSet *keyparam,
+                struct enc_key *key)
+{
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        if (key->flags & KEY_INFO_WPA_ENABLED)
+                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_ENABLED);
+        if (key->flags & KEY_INFO_WPA_UNICAST)
+                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_UNICAST);
+        if (key->flags & KEY_INFO_WPA_MCAST)
+                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_MCAST);
+
+        keyparam->type = cpu_to_le16(TLV_TYPE_KEY_MATERIAL);
+        keyparam->keytypeid = cpu_to_le16(key->type);
+        keyparam->keylen = cpu_to_le16(key->len);
+        memcpy(keyparam->key, key->key, key->len);
+
+        /* Length field doesn't include the {type,length} header */
+        keyparam->length = cpu_to_le16(sizeof(*keyparam) - 4);
+        lbs_deb_leave(LBS_DEB_CMD);
+}
+
+int lbs_cmd_802_11_key_material(struct lbs_private *priv, uint16_t cmd_action,
+                                struct assoc_request *assoc)
+{
+        struct cmd_ds_802_11_key_material cmd;
+        int ret = 0;
+        int index = 0;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        cmd.action = cpu_to_le16(cmd_action);
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+
+        if (cmd_action == CMD_ACT_GET) {
+                cmd.hdr.size = cpu_to_le16(sizeof(struct cmd_header) + 2);
+        } else {
+                memset(cmd.keyParamSet, 0, sizeof(cmd.keyParamSet));
+
+                if (test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc->flags)) {
+                        set_one_wpa_key(&cmd.keyParamSet[index],
+                                        &assoc->wpa_unicast_key);
+                        index++;
+                }
+
+                if (test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc->flags)) {
+                        set_one_wpa_key(&cmd.keyParamSet[index],
+                                        &assoc->wpa_mcast_key);
+                        index++;
+                }
+
+                /* The common header and as many keys as we included */
+                cmd.hdr.size = cpu_to_le16(offsetof(typeof(cmd),
+                                                    keyParamSet[index]));
+        }
+        ret = lbs_cmd_with_response(priv, CMD_802_11_KEY_MATERIAL, &cmd);
+        /* Copy the returned key to driver private data */
+        if (!ret && cmd_action == CMD_ACT_GET) {
+                void *buf_ptr = cmd.keyParamSet;
+                void *resp_end = &(&cmd)[1];
+
+                while (buf_ptr < resp_end) {
+                        struct MrvlIEtype_keyParamSet *keyparam = buf_ptr;
+                        struct enc_key *key;
+                        uint16_t param_set_len = le16_to_cpu(keyparam->length);
+                        uint16_t key_len = le16_to_cpu(keyparam->keylen);
+                        uint16_t key_flags = le16_to_cpu(keyparam->keyinfo);
+                        uint16_t key_type = le16_to_cpu(keyparam->keytypeid);
+                        void *end;
+
+                        end = (void *)keyparam + sizeof(keyparam->type)
+                                + sizeof(keyparam->length) + param_set_len;
+
+                        /* Make sure we don't access past the end of the IEs */
+                        if (end > resp_end)
+                                break;
+
+                        if (key_flags & KEY_INFO_WPA_UNICAST)
+                                key = &priv->wpa_unicast_key;
+                        else if (key_flags & KEY_INFO_WPA_MCAST)
+                                key = &priv->wpa_mcast_key;
+                        else
+                                break;
+
+                        /* Copy returned key into driver */
+                        memset(key, 0, sizeof(struct enc_key));
+                        if (key_len > sizeof(key->key))
+                                break;
+                        key->type = key_type;
+                        key->flags = key_flags;
+                        key->len = key_len;
+                        memcpy(key->key, keyparam->key, key->len);
+
+                        buf_ptr = end + 1;
+                }
+        }
+
+        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
+        return ret;
+}
+
+static __le16 lbs_rate_to_fw_bitmap(int rate, int lower_rates_ok)
+{
+/*              Bit     Rate
+*               15:13 Reserved
+*               12    54 Mbps
+*               11    48 Mbps
+*               10    36 Mbps
+*               9     24 Mbps
+*               8     18 Mbps
+*               7     12 Mbps
+*               6     9 Mbps
+*               5     6 Mbps
+*               4     Reserved
+*               3     11 Mbps
+*               2     5.5 Mbps
+*               1     2 Mbps
+*               0     1 Mbps
+**/
+
+        uint16_t ratemask;
+        int i = lbs_data_rate_to_fw_index(rate);
+        if (lower_rates_ok)
+                ratemask = (0x1fef >> (12 - i));
+        else
+                ratemask = (1 << i);
+        return cpu_to_le16(ratemask);
+}
+
+int lbs_cmd_802_11_rate_adapt_rateset(struct lbs_private *priv,
+                                      uint16_t cmd_action)
+{
+        struct cmd_ds_802_11_rate_adapt_rateset cmd;
+        int ret;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        if (!priv->cur_rate && !priv->enablehwauto)
+                return -EINVAL;
+
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+
+        cmd.action = cpu_to_le16(cmd_action);
+        cmd.enablehwauto = cpu_to_le16(priv->enablehwauto);
+        cmd.bitmap = lbs_rate_to_fw_bitmap(priv->cur_rate, priv->enablehwauto);
+        ret = lbs_cmd_with_response(priv, CMD_802_11_RATE_ADAPT_RATESET, &cmd);
+        if (!ret && cmd_action == CMD_ACT_GET)
+                priv->enablehwauto = le16_to_cpu(cmd.enablehwauto);
+
+        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
+        return ret;
+}
+
+/**
+ *  @brief Set the data rate
+ *
+ *  @param priv         A pointer to struct lbs_private structure
+ *  @param rate         The desired data rate, or 0 to clear a locked rate
+ *
+ *  @return             0 on success, error on failure
+ */
+int lbs_set_data_rate(struct lbs_private *priv, u8 rate)
+{
+        struct cmd_ds_802_11_data_rate cmd;
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+
+        if (rate > 0) {
+                cmd.action = cpu_to_le16(CMD_ACT_SET_TX_FIX_RATE);
+                cmd.rates[0] = lbs_data_rate_to_fw_index(rate);
+                if (cmd.rates[0] == 0) {
+                        lbs_deb_cmd("DATA_RATE: invalid requested rate of"
+                                " 0x%02X\n", rate);
+                        ret = 0;
+                        goto out;
+                }
+                lbs_deb_cmd("DATA_RATE: set fixed 0x%02X\n", cmd.rates[0]);
+        } else {
+                cmd.action = cpu_to_le16(CMD_ACT_SET_TX_AUTO);
+                lbs_deb_cmd("DATA_RATE: setting auto\n");
+        }
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_DATA_RATE, &cmd);
+        if (ret)
+                goto out;
+
+        lbs_deb_hex(LBS_DEB_CMD, "DATA_RATE_RESP", (u8 *) &cmd, sizeof(cmd));
+
+        /* FIXME: get actual rates FW can do if this command actually returns
+         * all data rates supported.
+         */
+        priv->cur_rate = lbs_fw_index_to_data_rate(cmd.rates[0]);
+        lbs_deb_cmd("DATA_RATE: current rate is 0x%02x\n", priv->cur_rate);
+
+out:
+        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
+        return ret;
+}
+
+
+int lbs_cmd_802_11_rssi(struct lbs_private *priv,
+                                struct cmd_ds_command *cmd)
+{
+
+        lbs_deb_enter(LBS_DEB_CMD);
+        cmd->command = cpu_to_le16(CMD_802_11_RSSI);
+        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_802_11_rssi) +
+                sizeof(struct cmd_header));
+        cmd->params.rssi.N = cpu_to_le16(DEFAULT_BCN_AVG_FACTOR);
+
+        /* reset Beacon SNR/NF/RSSI values */
+        priv->SNR[TYPE_BEACON][TYPE_NOAVG] = 0;
+        priv->SNR[TYPE_BEACON][TYPE_AVG] = 0;
+        priv->NF[TYPE_BEACON][TYPE_NOAVG] = 0;
+        priv->NF[TYPE_BEACON][TYPE_AVG] = 0;
+        priv->RSSI[TYPE_BEACON][TYPE_NOAVG] = 0;
+        priv->RSSI[TYPE_BEACON][TYPE_AVG] = 0;
+
+        lbs_deb_leave(LBS_DEB_CMD);
+        return 0;
+}
+
+int lbs_ret_802_11_rssi(struct lbs_private *priv,
+                                struct cmd_ds_command *resp)
+{
+        struct cmd_ds_802_11_rssi_rsp *rssirsp = &resp->params.rssirsp;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        /* store the non average value */
+        priv->SNR[TYPE_BEACON][TYPE_NOAVG] = get_unaligned_le16(&rssirsp->SNR);
+        priv->NF[TYPE_BEACON][TYPE_NOAVG] =
+                get_unaligned_le16(&rssirsp->noisefloor);
+
+        priv->SNR[TYPE_BEACON][TYPE_AVG] = get_unaligned_le16(&rssirsp->avgSNR);
+        priv->NF[TYPE_BEACON][TYPE_AVG] =
+                get_unaligned_le16(&rssirsp->avgnoisefloor);
+
+        priv->RSSI[TYPE_BEACON][TYPE_NOAVG] =
+            CAL_RSSI(priv->SNR[TYPE_BEACON][TYPE_NOAVG],
+                     priv->NF[TYPE_BEACON][TYPE_NOAVG]);
+
+        priv->RSSI[TYPE_BEACON][TYPE_AVG] =
+            CAL_RSSI(priv->SNR[TYPE_BEACON][TYPE_AVG] / AVG_SCALE,
+                     priv->NF[TYPE_BEACON][TYPE_AVG] / AVG_SCALE);
+
+        lbs_deb_cmd("RSSI: beacon %d, avg %d\n",
+               priv->RSSI[TYPE_BEACON][TYPE_NOAVG],
+               priv->RSSI[TYPE_BEACON][TYPE_AVG]);
+
+        lbs_deb_leave(LBS_DEB_CMD);
+        return 0;
+}
+
+
+int lbs_cmd_bcn_ctrl(struct lbs_private *priv,
+                                struct cmd_ds_command *cmd,
+                                u16 cmd_action)
+{
+        struct cmd_ds_802_11_beacon_control
+                *bcn_ctrl = &cmd->params.bcn_ctrl;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+        cmd->size =
+            cpu_to_le16(sizeof(struct cmd_ds_802_11_beacon_control)
+                             + sizeof(struct cmd_header));
+        cmd->command = cpu_to_le16(CMD_802_11_BEACON_CTRL);
+
+        bcn_ctrl->action = cpu_to_le16(cmd_action);
+        bcn_ctrl->beacon_enable = cpu_to_le16(priv->beacon_enable);
+        bcn_ctrl->beacon_period = cpu_to_le16(priv->beacon_period);
+
+        lbs_deb_leave(LBS_DEB_CMD);
+        return 0;
+}
+
+int lbs_ret_802_11_bcn_ctrl(struct lbs_private *priv,
+                                        struct cmd_ds_command *resp)
+{
+        struct cmd_ds_802_11_beacon_control *bcn_ctrl =
+            &resp->params.bcn_ctrl;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        if (bcn_ctrl->action == CMD_ACT_GET) {
+                priv->beacon_enable = (u8) le16_to_cpu(bcn_ctrl->beacon_enable);
+                priv->beacon_period = le16_to_cpu(bcn_ctrl->beacon_period);
+        }
+
+        lbs_deb_enter(LBS_DEB_CMD);
+        return 0;
+}
+
+
+
 static int lbs_assoc_post(struct lbs_private *priv,
                           struct cmd_ds_802_11_associate_response *resp)
 {
@@ -226,7 +623,7 @@ static int lbs_assoc_post(struct lbs_private *priv,
         priv->connect_status = LBS_CONNECTED;
 
         /* Update current SSID and BSSID */
-        memcpy(&priv->curbssparams.ssid, &bss->ssid, IW_ESSID_MAX_SIZE);
+        memcpy(&priv->curbssparams.ssid, &bss->ssid, IEEE80211_MAX_SSID_LEN);
         priv->curbssparams.ssid_len = bss->ssid_len;
         memcpy(priv->curbssparams.bssid, bss->bssid, ETH_ALEN);
 
@@ -369,12 +766,7 @@ static int lbs_associate(struct lbs_private *priv,
                                    (u16)(pos - (u8 *) &cmd.iebuf));
 
         /* update curbssparams */
-        priv->curbssparams.channel = bss->phy.ds.channel;
-
-        if (lbs_parse_dnld_countryinfo_11d(priv, bss)) {
-                ret = -1;
-                goto done;
-        }
+        priv->channel = bss->phy.ds.channel;
 
         ret = lbs_cmd_with_response(priv, command, &cmd);
         if (ret == 0) {
@@ -414,8 +806,7 @@ static int lbs_try_associate(struct lbs_private *priv,
         }
 
         /* Use short preamble only when both the BSS and firmware support it */
-        if ((priv->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
-            (assoc_req->bss.capability & WLAN_CAPABILITY_SHORT_PREAMBLE))
+        if (assoc_req->bss.capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
                 preamble = RADIO_PREAMBLE_SHORT;
 
         ret = lbs_set_radio(priv, preamble, 1);
@@ -472,7 +863,7 @@ static int lbs_adhoc_post(struct lbs_private *priv,
         memcpy(&priv->curbssparams.bssid, bss->bssid, ETH_ALEN);
 
         /* Set the new SSID to current SSID */
-        memcpy(&priv->curbssparams.ssid, &bss->ssid, IW_ESSID_MAX_SIZE);
+        memcpy(&priv->curbssparams.ssid, &bss->ssid, IEEE80211_MAX_SSID_LEN);
         priv->curbssparams.ssid_len = bss->ssid_len;
 
         netif_carrier_on(priv->dev);
@@ -487,7 +878,7 @@ static int lbs_adhoc_post(struct lbs_private *priv,
         lbs_deb_join("ADHOC_RESP: Joined/started '%s', BSSID %pM, channel %d\n",
                      print_ssid(ssid, bss->ssid, bss->ssid_len),
                      priv->curbssparams.bssid,
-                     priv->curbssparams.channel);
+                     priv->channel);
 
 done:
         lbs_deb_leave_args(LBS_DEB_JOIN, "ret %d", ret);
@@ -546,8 +937,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
         }
 
         /* Use short preamble only when both the BSS and firmware support it */
-        if ((priv->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
-            (bss->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)) {
+        if (bss->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) {
                 lbs_deb_join("AdhocJoin: Short preamble\n");
                 preamble = RADIO_PREAMBLE_SHORT;
         }
@@ -560,7 +950,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
         lbs_deb_join("AdhocJoin: band = %c\n", assoc_req->band);
 
         priv->adhoccreate = 0;
-        priv->curbssparams.channel = bss->channel;
+        priv->channel = bss->channel;
 
         /* Build the join command */
         memset(&cmd, 0, sizeof(cmd));
@@ -633,11 +1023,6 @@ static int lbs_adhoc_join(struct lbs_private *priv,
                 }
         }
 
-        if (lbs_parse_dnld_countryinfo_11d(priv, bss)) {
-                ret = -1;
-                goto out;
-        }
-
         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_JOIN, &cmd);
         if (ret == 0) {
                 ret = lbs_adhoc_post(priv,
@@ -661,7 +1046,7 @@ static int lbs_adhoc_start(struct lbs_private *priv,
         struct assoc_request *assoc_req)
 {
         struct cmd_ds_802_11_ad_hoc_start cmd;
-        u8 preamble = RADIO_PREAMBLE_LONG;
+        u8 preamble = RADIO_PREAMBLE_SHORT;
         size_t ratesize = 0;
         u16 tmpcap = 0;
         int ret = 0;
@@ -669,11 +1054,6 @@ static int lbs_adhoc_start(struct lbs_private *priv,
 
         lbs_deb_enter(LBS_DEB_ASSOC);
 
-        if (priv->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) {
-                lbs_deb_join("ADHOC_START: Will use short preamble\n");
-                preamble = RADIO_PREAMBLE_SHORT;
-        }
-
         ret = lbs_set_radio(priv, preamble, 1);
         if (ret)
                 goto out;
@@ -737,12 +1117,6 @@ static int lbs_adhoc_start(struct lbs_private *priv,
         lbs_deb_join("ADHOC_START: rates=%02x %02x %02x %02x\n",
                cmd.rates[0], cmd.rates[1], cmd.rates[2], cmd.rates[3]);
 
-        if (lbs_create_dnld_countryinfo_11d(priv)) {
-                lbs_deb_join("ADHOC_START: dnld_countryinfo_11d failed\n");
-                ret = -1;
-                goto out;
-        }
-
         lbs_deb_join("ADHOC_START: Starting Ad-Hoc BSS on channel %d, band %d\n",
                      assoc_req->channel, assoc_req->band);
 
@@ -787,11 +1161,11 @@ int lbs_adhoc_stop(struct lbs_private *priv)
 static inline int match_bss_no_security(struct lbs_802_11_security *secinfo,
                                         struct bss_descriptor *match_bss)
 {
-        if (!secinfo->wep_enabled  && !secinfo->WPAenabled
-            && !secinfo->WPA2enabled
-            && match_bss->wpa_ie[0] != WLAN_EID_GENERIC
-            && match_bss->rsn_ie[0] != WLAN_EID_RSN
-            && !(match_bss->capability & WLAN_CAPABILITY_PRIVACY))
+        if (!secinfo->wep_enabled &&
+            !secinfo->WPAenabled && !secinfo->WPA2enabled &&
+            match_bss->wpa_ie[0] != WLAN_EID_GENERIC &&
+            match_bss->rsn_ie[0] != WLAN_EID_RSN &&
+            !(match_bss->capability & WLAN_CAPABILITY_PRIVACY))
                 return 1;
         else
                 return 0;
@@ -800,9 +1174,9 @@ static inline int match_bss_no_security(struct lbs_802_11_security *secinfo,
 static inline int match_bss_static_wep(struct lbs_802_11_security *secinfo,
                                        struct bss_descriptor *match_bss)
 {
-        if (secinfo->wep_enabled && !secinfo->WPAenabled
-            && !secinfo->WPA2enabled
-            && (match_bss->capability & WLAN_CAPABILITY_PRIVACY))
+        if (secinfo->wep_enabled &&
+            !secinfo->WPAenabled && !secinfo->WPA2enabled &&
+            (match_bss->capability & WLAN_CAPABILITY_PRIVACY))
                 return 1;
         else
                 return 0;
@@ -811,8 +1185,8 @@ static inline int match_bss_static_wep(struct lbs_802_11_security *secinfo,
 static inline int match_bss_wpa(struct lbs_802_11_security *secinfo,
                                 struct bss_descriptor *match_bss)
 {
-        if (!secinfo->wep_enabled && secinfo->WPAenabled
-            && (match_bss->wpa_ie[0] == WLAN_EID_GENERIC)
+        if (!secinfo->wep_enabled && secinfo->WPAenabled &&
+            (match_bss->wpa_ie[0] == WLAN_EID_GENERIC)
             /* privacy bit may NOT be set in some APs like LinkSys WRT54G
             && (match_bss->capability & WLAN_CAPABILITY_PRIVACY) */
            )
@@ -837,11 +1211,11 @@ static inline int match_bss_wpa2(struct lbs_802_11_security *secinfo,
 static inline int match_bss_dynamic_wep(struct lbs_802_11_security *secinfo,
                                         struct bss_descriptor *match_bss)
 {
-        if (!secinfo->wep_enabled && !secinfo->WPAenabled
-            && !secinfo->WPA2enabled
-            && (match_bss->wpa_ie[0] != WLAN_EID_GENERIC)
-            && (match_bss->rsn_ie[0] != WLAN_EID_RSN)
-            && (match_bss->capability & WLAN_CAPABILITY_PRIVACY))
+        if (!secinfo->wep_enabled &&
+            !secinfo->WPAenabled && !secinfo->WPA2enabled &&
+            (match_bss->wpa_ie[0] != WLAN_EID_GENERIC) &&
+            (match_bss->rsn_ie[0] != WLAN_EID_RSN) &&
+            (match_bss->capability & WLAN_CAPABILITY_PRIVACY))
                 return 1;
         else
                 return 0;
@@ -1099,7 +1473,7 @@ static int assoc_helper_essid(struct lbs_private *priv,
                         /* else send START command */
                         lbs_deb_assoc("SSID not found, creating adhoc network\n");
                         memcpy(&assoc_req->bss.ssid, &assoc_req->ssid,
-                                IW_ESSID_MAX_SIZE);
+                                IEEE80211_MAX_SSID_LEN);
                         assoc_req->bss.ssid_len = assoc_req->ssid_len;
                         lbs_adhoc_start(priv, assoc_req);
                 }
@@ -1152,8 +1526,8 @@ static int assoc_helper_associate(struct lbs_private *priv,
         /* If we're given and 'any' BSSID, try associating based on SSID */
 
         if (test_bit(ASSOC_FLAG_BSSID, &assoc_req->flags)) {
-                if (compare_ether_addr(bssid_any, assoc_req->bssid)
-                    && compare_ether_addr(bssid_off, assoc_req->bssid)) {
+                if (compare_ether_addr(bssid_any, assoc_req->bssid) &&
+                    compare_ether_addr(bssid_off, assoc_req->bssid)) {
                         ret = assoc_helper_bssid(priv, assoc_req);
                         done = 1;
                 }
@@ -1185,7 +1559,8 @@ static int assoc_helper_mode(struct lbs_private *priv,
         }
 
         priv->mode = assoc_req->mode;
-        ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE, assoc_req->mode);
+        ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE,
+                assoc_req->mode == IW_MODE_ADHOC ? 2 : 1);
 
 done:
         lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
@@ -1205,7 +1580,7 @@ static int assoc_helper_channel(struct lbs_private *priv,
                 goto done;
         }
 
-        if (assoc_req->channel == priv->curbssparams.channel)
+        if (assoc_req->channel == priv->channel)
                 goto done;
 
         if (priv->mesh_dev) {
@@ -1217,7 +1592,7 @@ static int assoc_helper_channel(struct lbs_private *priv,
         }
 
         lbs_deb_assoc("ASSOC: channel: %d -> %d\n",
-                      priv->curbssparams.channel, assoc_req->channel);
+                      priv->channel, assoc_req->channel);
 
         ret = lbs_set_channel(priv, assoc_req->channel);
         if (ret < 0)
@@ -1232,17 +1607,15 @@ static int assoc_helper_channel(struct lbs_private *priv,
                 goto done;
         }
 
-        if (assoc_req->channel != priv->curbssparams.channel) {
+        if (assoc_req->channel != priv->channel) {
                 lbs_deb_assoc("ASSOC: channel: failed to update channel to %d\n",
                               assoc_req->channel);
                 goto restore_mesh;
         }
 
-        if (   assoc_req->secinfo.wep_enabled
-            &&   (assoc_req->wep_keys[0].len
-               || assoc_req->wep_keys[1].len
-               || assoc_req->wep_keys[2].len
-               || assoc_req->wep_keys[3].len)) {
+        if (assoc_req->secinfo.wep_enabled &&
+            (assoc_req->wep_keys[0].len || assoc_req->wep_keys[1].len ||
+             assoc_req->wep_keys[2].len || assoc_req->wep_keys[3].len)) {
                 /* Make sure WEP keys are re-sent to firmware */
                 set_bit(ASSOC_FLAG_WEP_KEYS, &assoc_req->flags);
         }
@@ -1253,7 +1626,7 @@ static int assoc_helper_channel(struct lbs_private *priv,
  restore_mesh:
         if (priv->mesh_dev)
                 lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
-                                priv->curbssparams.channel);
+                                priv->channel);
 
  done:
         lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
@@ -1475,7 +1848,7 @@ static int should_stop_adhoc(struct lbs_private *priv,
         }
 
         if (test_bit(ASSOC_FLAG_CHANNEL, &assoc_req->flags)) {
-                if (assoc_req->channel != priv->curbssparams.channel)
+                if (assoc_req->channel != priv->channel)
                         return 1;
         }
 
@@ -1557,7 +1930,7 @@ static int lbs_find_best_network_ssid(struct lbs_private *priv,
 
         found = lbs_find_best_ssid_in_list(priv, preferred_mode);
         if (found && (found->ssid_len > 0)) {
-                memcpy(out_ssid, &found->ssid, IW_ESSID_MAX_SIZE);
+                memcpy(out_ssid, &found->ssid, IEEE80211_MAX_SSID_LEN);
                 *out_ssid_len = found->ssid_len;
                 *out_mode = found->mode;
                 ret = 0;
@@ -1609,14 +1982,14 @@ void lbs_association_worker(struct work_struct *work)
                 assoc_req->secinfo.auth_mode);
 
         /* If 'any' SSID was specified, find an SSID to associate with */
-        if (test_bit(ASSOC_FLAG_SSID, &assoc_req->flags)
-            && !assoc_req->ssid_len)
+        if (test_bit(ASSOC_FLAG_SSID, &assoc_req->flags) &&
+            !assoc_req->ssid_len)
                 find_any_ssid = 1;
 
         /* But don't use 'any' SSID if there's a valid locked BSSID to use */
         if (test_bit(ASSOC_FLAG_BSSID, &assoc_req->flags)) {
-                if (compare_ether_addr(assoc_req->bssid, bssid_any)
-                    && compare_ether_addr(assoc_req->bssid, bssid_off))
+                if (compare_ether_addr(assoc_req->bssid, bssid_any) &&
+                    compare_ether_addr(assoc_req->bssid, bssid_off))
                         find_any_ssid = 0;
         }
 
@@ -1678,13 +2051,6 @@ void lbs_association_worker(struct work_struct *work)
                         goto out;
         }
 
-        if (   test_bit(ASSOC_FLAG_WEP_KEYS, &assoc_req->flags)
-            || test_bit(ASSOC_FLAG_WEP_TX_KEYIDX, &assoc_req->flags)) {
-                ret = assoc_helper_wep_keys(priv, assoc_req);
-                if (ret)
-                        goto out;
-        }
-
         if (test_bit(ASSOC_FLAG_SECINFO, &assoc_req->flags)) {
                 ret = assoc_helper_secinfo(priv, assoc_req);
                 if (ret)
@@ -1697,18 +2063,31 @@ void lbs_association_worker(struct work_struct *work)
                         goto out;
         }
 
-        if (test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc_req->flags)
-            || test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc_req->flags)) {
+        /*
+         * v10 FW wants WPA keys to be set/cleared before WEP key operations,
+         * otherwise it will fail to correctly associate to WEP networks.
+         * Other firmware versions don't appear to care.
+         */
+        if (test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc_req->flags) ||
+            test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc_req->flags)) {
                 ret = assoc_helper_wpa_keys(priv, assoc_req);
                 if (ret)
                         goto out;
         }
 
+        if (test_bit(ASSOC_FLAG_WEP_KEYS, &assoc_req->flags) ||
+            test_bit(ASSOC_FLAG_WEP_TX_KEYIDX, &assoc_req->flags)) {
+                ret = assoc_helper_wep_keys(priv, assoc_req);
+                if (ret)
+                        goto out;
+        }
+
+
         /* SSID/BSSID should be the _last_ config option set, because they
          * trigger the association attempt.
          */
-        if (test_bit(ASSOC_FLAG_BSSID, &assoc_req->flags)
-            || test_bit(ASSOC_FLAG_SSID, &assoc_req->flags)) {
+        if (test_bit(ASSOC_FLAG_BSSID, &assoc_req->flags) ||
+            test_bit(ASSOC_FLAG_SSID, &assoc_req->flags)) {
                 int success = 1;
 
                 ret = assoc_helper_associate(priv, assoc_req);
@@ -1775,12 +2154,12 @@ struct assoc_request *lbs_get_association_request(struct lbs_private *priv)
         assoc_req = priv->pending_assoc_req;
         if (!test_bit(ASSOC_FLAG_SSID, &assoc_req->flags)) {
                 memcpy(&assoc_req->ssid, &priv->curbssparams.ssid,
-                       IW_ESSID_MAX_SIZE);
+                       IEEE80211_MAX_SSID_LEN);
                 assoc_req->ssid_len = priv->curbssparams.ssid_len;
         }
 
         if (!test_bit(ASSOC_FLAG_CHANNEL, &assoc_req->flags))
-                assoc_req->channel = priv->curbssparams.channel;
+                assoc_req->channel = priv->channel;
 
         if (!test_bit(ASSOC_FLAG_BAND, &assoc_req->flags))
                 assoc_req->band = priv->curbssparams.band;
diff --git a/drivers/net/wireless/libertas/assoc.h b/drivers/net/wireless/libertas/assoc.h
index 6e765e9f91a3..40621b789fc5 100644
--- a/drivers/net/wireless/libertas/assoc.h
+++ b/drivers/net/wireless/libertas/assoc.h
@@ -3,7 +3,126 @@
 #ifndef _LBS_ASSOC_H_
 #define _LBS_ASSOC_H_
 
-#include "dev.h"
+
+#include "defs.h"
+#include "host.h"
+
+
+struct lbs_private;
+
+/*
+ * In theory, the IE is limited to the IE length, 255,
+ * but in practice 64 bytes are enough.
+ */
+#define MAX_WPA_IE_LEN 64
+
+
+
+struct lbs_802_11_security {
+        u8 WPAenabled;
+        u8 WPA2enabled;
+        u8 wep_enabled;
+        u8 auth_mode;
+        u32 key_mgmt;
+};
+
+/** Current Basic Service Set State Structure */
+struct current_bss_params {
+        /** bssid */
+        u8 bssid[ETH_ALEN];
+        /** ssid */
+        u8 ssid[IEEE80211_MAX_SSID_LEN + 1];
+        u8 ssid_len;
+
+        /** band */
+        u8 band;
+        /** channel is directly in priv->channel */
+        /** zero-terminated array of supported data rates */
+        u8 rates[MAX_RATES + 1];
+};
+
+/**
+ *  @brief Structure used to store information for each beacon/probe response
+ */
+struct bss_descriptor {
+        u8 bssid[ETH_ALEN];
+
+        u8 ssid[IEEE80211_MAX_SSID_LEN + 1];
+        u8 ssid_len;
+
+        u16 capability;
+        u32 rssi;
+        u32 channel;
+        u16 beaconperiod;
+        __le16 atimwindow;
+
+        /* IW_MODE_AUTO, IW_MODE_ADHOC, IW_MODE_INFRA */
+        u8 mode;
+
+        /* zero-terminated array of supported data rates */
+        u8 rates[MAX_RATES + 1];
+
+        unsigned long last_scanned;
+
+        union ieee_phy_param_set phy;
+        union ieee_ss_param_set ss;
+
+        u8 wpa_ie[MAX_WPA_IE_LEN];
+        size_t wpa_ie_len;
+        u8 rsn_ie[MAX_WPA_IE_LEN];
+        size_t rsn_ie_len;
+
+        u8 mesh;
+
+        struct list_head list;
+};
+
+/** Association request
+ *
+ * Encapsulates all the options that describe a specific assocation request
+ * or configuration of the wireless card's radio, mode, and security settings.
+ */
+struct assoc_request {
+#define ASSOC_FLAG_SSID                 1
+#define ASSOC_FLAG_CHANNEL              2
+#define ASSOC_FLAG_BAND                 3
+#define ASSOC_FLAG_MODE                 4
+#define ASSOC_FLAG_BSSID                5
+#define ASSOC_FLAG_WEP_KEYS             6
+#define ASSOC_FLAG_WEP_TX_KEYIDX        7
+#define ASSOC_FLAG_WPA_MCAST_KEY        8
+#define ASSOC_FLAG_WPA_UCAST_KEY        9
+#define ASSOC_FLAG_SECINFO              10
+#define ASSOC_FLAG_WPA_IE               11
+        unsigned long flags;
+
+        u8 ssid[IEEE80211_MAX_SSID_LEN + 1];
+        u8 ssid_len;
+        u8 channel;
+        u8 band;
+        u8 mode;
+        u8 bssid[ETH_ALEN] __attribute__ ((aligned (2)));
+
+        /** WEP keys */
+        struct enc_key wep_keys[4];
+        u16 wep_tx_keyidx;
+
+        /** WPA keys */
+        struct enc_key wpa_mcast_key;
+        struct enc_key wpa_unicast_key;
+
+        struct lbs_802_11_security secinfo;
+
+        /** WPA Information Elements*/
+        u8 wpa_ie[MAX_WPA_IE_LEN];
+        u8 wpa_ie_len;
+
+        /* BSS to associate with for infrastructure of Ad-Hoc join */
+        struct bss_descriptor bss;
+};
+
+
+extern u8 lbs_bg_rates[MAX_RATES];
 
 void lbs_association_worker(struct work_struct *work);
 struct assoc_request *lbs_get_association_request(struct lbs_private *priv);
@@ -13,4 +132,24 @@ int lbs_adhoc_stop(struct lbs_private *priv);
 int lbs_cmd_80211_deauthenticate(struct lbs_private *priv,
                                  u8 bssid[ETH_ALEN], u16 reason);
 
+int lbs_cmd_802_11_rssi(struct lbs_private *priv,
+                                struct cmd_ds_command *cmd);
+int lbs_ret_802_11_rssi(struct lbs_private *priv,
+                                struct cmd_ds_command *resp);
+
+int lbs_cmd_bcn_ctrl(struct lbs_private *priv,
+                                struct cmd_ds_command *cmd,
+                                u16 cmd_action);
+int lbs_ret_802_11_bcn_ctrl(struct lbs_private *priv,
+                                        struct cmd_ds_command *resp);
+
+int lbs_cmd_802_11_set_wep(struct lbs_private *priv, uint16_t cmd_action,
+                           struct assoc_request *assoc);
+
+int lbs_cmd_802_11_enable_rsn(struct lbs_private *priv, uint16_t cmd_action,
+                              uint16_t *enable);
+
+int lbs_cmd_802_11_key_material(struct lbs_private *priv, uint16_t cmd_action,
+                                struct assoc_request *assoc);
+
 #endif /* _LBS_ASSOC_H */
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
new file mode 100644
index 000000000000..ce7bec402a33
--- /dev/null
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -0,0 +1,203 @@
+/*
+ * Implement cfg80211 ("iw") support.
+ *
+ * Copyright (C) 2009 M&N Solutions GmbH, 61191 Rosbach, Germany
+ * Holger Schurig <hs4233@mail.mn-solutions.de>
+ *
+ */
+
+#include <linux/slab.h>
+#include <net/cfg80211.h>
+
+#include "cfg.h"
+#include "cmd.h"
+
+
+#define CHAN2G(_channel, _freq, _flags) {        \
+        .band             = IEEE80211_BAND_2GHZ, \
+        .center_freq      = (_freq),             \
+        .hw_value         = (_channel),          \
+        .flags            = (_flags),            \
+        .max_antenna_gain = 0,                   \
+        .max_power        = 30,                  \
+}
+
+static struct ieee80211_channel lbs_2ghz_channels[] = {
+        CHAN2G(1,  2412, 0),
+        CHAN2G(2,  2417, 0),
+        CHAN2G(3,  2422, 0),
+        CHAN2G(4,  2427, 0),
+        CHAN2G(5,  2432, 0),
+        CHAN2G(6,  2437, 0),
+        CHAN2G(7,  2442, 0),
+        CHAN2G(8,  2447, 0),
+        CHAN2G(9,  2452, 0),
+        CHAN2G(10, 2457, 0),
+        CHAN2G(11, 2462, 0),
+        CHAN2G(12, 2467, 0),
+        CHAN2G(13, 2472, 0),
+        CHAN2G(14, 2484, 0),
+};
+
+#define RATETAB_ENT(_rate, _rateid, _flags) { \
+        .bitrate  = (_rate),                  \
+        .hw_value = (_rateid),                \
+        .flags    = (_flags),                 \
+}
+
+
+static struct ieee80211_rate lbs_rates[] = {
+        RATETAB_ENT(10,  0x1,   0),
+        RATETAB_ENT(20,  0x2,   0),
+        RATETAB_ENT(55,  0x4,   0),
+        RATETAB_ENT(110, 0x8,   0),
+        RATETAB_ENT(60,  0x10,  0),
+        RATETAB_ENT(90,  0x20,  0),
+        RATETAB_ENT(120, 0x40,  0),
+        RATETAB_ENT(180, 0x80,  0),
+        RATETAB_ENT(240, 0x100, 0),
+        RATETAB_ENT(360, 0x200, 0),
+        RATETAB_ENT(480, 0x400, 0),
+        RATETAB_ENT(540, 0x800, 0),
+};
+
+static struct ieee80211_supported_band lbs_band_2ghz = {
+        .channels = lbs_2ghz_channels,
+        .n_channels = ARRAY_SIZE(lbs_2ghz_channels),
+        .bitrates = lbs_rates,
+        .n_bitrates = ARRAY_SIZE(lbs_rates),
+};
+
+
+static const u32 cipher_suites[] = {
+        WLAN_CIPHER_SUITE_WEP40,
+        WLAN_CIPHER_SUITE_WEP104,
+        WLAN_CIPHER_SUITE_TKIP,
+        WLAN_CIPHER_SUITE_CCMP,
+};
+
+
+
+static int lbs_cfg_set_channel(struct wiphy *wiphy,
+        struct ieee80211_channel *chan,
+        enum nl80211_channel_type channel_type)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        int ret = -ENOTSUPP;
+
+        lbs_deb_enter_args(LBS_DEB_CFG80211, "freq %d, type %d", chan->center_freq, channel_type);
+
+        if (channel_type != NL80211_CHAN_NO_HT)
+                goto out;
+
+        ret = lbs_set_channel(priv, chan->hw_value);
+
+ out:
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+
+
+
+static struct cfg80211_ops lbs_cfg80211_ops = {
+        .set_channel = lbs_cfg_set_channel,
+};
+
+
+/*
+ * At this time lbs_private *priv doesn't even exist, so we just allocate
+ * memory and don't initialize the wiphy further. This is postponed until we
+ * can talk to the firmware and happens at registration time in
+ * lbs_cfg_wiphy_register().
+ */
+struct wireless_dev *lbs_cfg_alloc(struct device *dev)
+{
+        int ret = 0;
+        struct wireless_dev *wdev;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
+        if (!wdev) {
+                dev_err(dev, "cannot allocate wireless device\n");
+                return ERR_PTR(-ENOMEM);
+        }
+
+        wdev->wiphy = wiphy_new(&lbs_cfg80211_ops, sizeof(struct lbs_private));
+        if (!wdev->wiphy) {
+                dev_err(dev, "cannot allocate wiphy\n");
+                ret = -ENOMEM;
+                goto err_wiphy_new;
+        }
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+        return wdev;
+
+ err_wiphy_new:
+        kfree(wdev);
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ERR_PTR(ret);
+}
+
+
+/*
+ * This function get's called after lbs_setup_firmware() determined the
+ * firmware capabities. So we can setup the wiphy according to our
+ * hardware/firmware.
+ */
+int lbs_cfg_register(struct lbs_private *priv)
+{
+        struct wireless_dev *wdev = priv->wdev;
+        int ret;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        wdev->wiphy->max_scan_ssids = 1;
+        wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+
+        /* TODO: BIT(NL80211_IFTYPE_ADHOC); */
+        wdev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+
+        /* TODO: honor priv->regioncode */
+        wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &lbs_band_2ghz;
+
+        /*
+         * We could check priv->fwcapinfo && FW_CAPINFO_WPA, but I have
+         * never seen a firmware without WPA
+         */
+        wdev->wiphy->cipher_suites = cipher_suites;
+        wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+
+        ret = wiphy_register(wdev->wiphy);
+        if (ret < 0)
+                lbs_pr_err("cannot register wiphy device\n");
+
+        priv->wiphy_registered = true;
+
+        ret = register_netdev(priv->dev);
+        if (ret)
+                lbs_pr_err("cannot register network device\n");
+
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+
+void lbs_cfg_free(struct lbs_private *priv)
+{
+        struct wireless_dev *wdev = priv->wdev;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        if (!wdev)
+                return;
+
+        if (priv->wiphy_registered)
+                wiphy_unregister(wdev->wiphy);
+
+        if (wdev->wiphy)
+                wiphy_free(wdev->wiphy);
+
+        kfree(wdev);
+}
diff --git a/drivers/net/wireless/libertas/cfg.h b/drivers/net/wireless/libertas/cfg.h
new file mode 100644
index 000000000000..e09a193a34d6
--- /dev/null
+++ b/drivers/net/wireless/libertas/cfg.h
@@ -0,0 +1,16 @@
+#ifndef __LBS_CFG80211_H__
+#define __LBS_CFG80211_H__
+
+#include "dev.h"
+
+struct wireless_dev *lbs_cfg_alloc(struct device *dev);
+int lbs_cfg_register(struct lbs_private *priv);
+void lbs_cfg_free(struct lbs_private *priv);
+
+int lbs_send_specific_ssid_scan(struct lbs_private *priv, u8 *ssid,
+        u8 ssid_len);
+int lbs_scan_networks(struct lbs_private *priv, int full_scan);
+void lbs_cfg_scan_worker(struct work_struct *work);
+
+
+#endif
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 0a324dcd264c..cdb9b9650d73 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -3,21 +3,21 @@
   * It prepares command and sends it to firmware when it is ready.
   */
 
-#include <net/iw_handler.h>
-#include <net/lib80211.h>
 #include <linux/kfifo.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
+
 #include "host.h"
-#include "hostcmd.h"
 #include "decl.h"
 #include "defs.h"
 #include "dev.h"
 #include "assoc.h"
 #include "wext.h"
+#include "scan.h"
 #include "cmd.h"
 
-static struct cmd_ctrl_node *lbs_get_cmd_ctrl_node(struct lbs_private *priv);
 
+static struct cmd_ctrl_node *lbs_get_cmd_ctrl_node(struct lbs_private *priv);
 
 /**
  *  @brief Simple callback that copies response back into command
@@ -77,6 +77,30 @@ static u8 is_command_allowed_in_ps(u16 cmd)
 }
 
 /**
+ *  @brief This function checks if the command is allowed.
+ *
+ *  @param priv         A pointer to lbs_private structure
+ *  @return             allowed or not allowed.
+ */
+
+static int lbs_is_cmd_allowed(struct lbs_private *priv)
+{
+        int ret = 1;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        if (!priv->is_auto_deep_sleep_enabled) {
+                if (priv->is_deep_sleep) {
+                        lbs_deb_cmd("command not allowed in deep sleep\n");
+                        ret = 0;
+                }
+        }
+
+        lbs_deb_leave(LBS_DEB_CMD);
+        return ret;
+}
+
+/**
  *  @brief Updates the hardware details like MAC address and regulatory region
  *
  *  @param priv         A pointer to struct lbs_private structure
@@ -120,19 +144,6 @@ int lbs_update_hw_spec(struct lbs_private *priv)
         lbs_deb_cmd("GET_HW_SPEC: hardware interface 0x%x, hardware spec 0x%04x\n",
                     cmd.hwifversion, cmd.version);
 
-        /* Determine mesh_fw_ver from fwrelease and fwcapinfo */
-        /* 5.0.16p0 9.0.0.p0 is known to NOT support any mesh */
-        /* 5.110.22 have mesh command with 0xa3 command id */
-        /* 10.0.0.p0 FW brings in mesh config command with different id */
-        /* Check FW version MSB and initialize mesh_fw_ver */
-        if (MRVL_FW_MAJOR_REV(priv->fwrelease) == MRVL_FW_V5)
-                priv->mesh_fw_ver = MESH_FW_OLD;
-        else if ((MRVL_FW_MAJOR_REV(priv->fwrelease) >= MRVL_FW_V10) &&
-                (priv->fwcapinfo & MESH_CAPINFO_ENABLE_MASK))
-                priv->mesh_fw_ver = MESH_FW_NEW;
-        else
-                priv->mesh_fw_ver = MESH_NONE;
-
         /* Clamp region code to 8-bit since FW spec indicates that it should
          * only ever be 8-bit, even though the field size is 16-bit.  Some firmware
          * returns non-zero high 8 bits here.
@@ -169,11 +180,6 @@ int lbs_update_hw_spec(struct lbs_private *priv)
                 goto out;
         }
 
-        if (lbs_set_universaltable(priv, 0)) {
-                ret = -1;
-                goto out;
-        }
-
 out:
         lbs_deb_leave(LBS_DEB_CMD);
         return ret;
@@ -222,7 +228,7 @@ static int lbs_cmd_802_11_ps_mode(struct cmd_ds_command *cmd,
 
         cmd->command = cpu_to_le16(CMD_802_11_PS_MODE);
         cmd->size = cpu_to_le16(sizeof(struct cmd_ds_802_11_ps_mode) +
-                                S_DS_GEN);
+                                sizeof(struct cmd_header));
         psm->action = cpu_to_le16(cmd_action);
         psm->multipledtim = 0;
         switch (cmd_action) {
@@ -251,33 +257,6 @@ static int lbs_cmd_802_11_ps_mode(struct cmd_ds_command *cmd,
         return 0;
 }
 
-int lbs_cmd_802_11_inactivity_timeout(struct lbs_private *priv,
-                                      uint16_t cmd_action, uint16_t *timeout)
-{
-        struct cmd_ds_802_11_inactivity_timeout cmd;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        cmd.hdr.command = cpu_to_le16(CMD_802_11_INACTIVITY_TIMEOUT);
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        cmd.action = cpu_to_le16(cmd_action);
-
-        if (cmd_action == CMD_ACT_SET)
-                cmd.timeout = cpu_to_le16(*timeout);
-        else
-                cmd.timeout = 0;
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_INACTIVITY_TIMEOUT, &cmd);
-
-        if (!ret)
-                *timeout = le16_to_cpu(cmd.timeout);
-
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return 0;
-}
-
 int lbs_cmd_802_11_sleep_params(struct lbs_private *priv, uint16_t cmd_action,
                                 struct sleep_params *sp)
 {
@@ -320,190 +299,53 @@ int lbs_cmd_802_11_sleep_params(struct lbs_private *priv, uint16_t cmd_action,
         return 0;
 }
 
-int lbs_cmd_802_11_set_wep(struct lbs_private *priv, uint16_t cmd_action,
-                           struct assoc_request *assoc)
+static int lbs_wait_for_ds_awake(struct lbs_private *priv)
 {
-        struct cmd_ds_802_11_set_wep cmd;
         int ret = 0;
 
         lbs_deb_enter(LBS_DEB_CMD);
 
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.hdr.command = cpu_to_le16(CMD_802_11_SET_WEP);
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        cmd.action = cpu_to_le16(cmd_action);
-
-        if (cmd_action == CMD_ACT_ADD) {
-                int i;
-
-                /* default tx key index */
-                cmd.keyindex = cpu_to_le16(assoc->wep_tx_keyidx &
-                                           CMD_WEP_KEY_INDEX_MASK);
-
-                /* Copy key types and material to host command structure */
-                for (i = 0; i < 4; i++) {
-                        struct enc_key *pkey = &assoc->wep_keys[i];
-
-                        switch (pkey->len) {
-                        case KEY_LEN_WEP_40:
-                                cmd.keytype[i] = CMD_TYPE_WEP_40_BIT;
-                                memmove(cmd.keymaterial[i], pkey->key, pkey->len);
-                                lbs_deb_cmd("SET_WEP: add key %d (40 bit)\n", i);
-                                break;
-                        case KEY_LEN_WEP_104:
-                                cmd.keytype[i] = CMD_TYPE_WEP_104_BIT;
-                                memmove(cmd.keymaterial[i], pkey->key, pkey->len);
-                                lbs_deb_cmd("SET_WEP: add key %d (104 bit)\n", i);
-                                break;
-                        case 0:
-                                break;
-                        default:
-                                lbs_deb_cmd("SET_WEP: invalid key %d, length %d\n",
-                                            i, pkey->len);
-                                ret = -1;
-                                goto done;
-                                break;
-                        }
+        if (priv->is_deep_sleep) {
+                if (!wait_event_interruptible_timeout(priv->ds_awake_q,
+                                        !priv->is_deep_sleep, (10 * HZ))) {
+                        lbs_pr_err("ds_awake_q: timer expired\n");
+                        ret = -1;
                 }
-        } else if (cmd_action == CMD_ACT_REMOVE) {
-                /* ACT_REMOVE clears _all_ WEP keys */
-
-                /* default tx key index */
-                cmd.keyindex = cpu_to_le16(priv->wep_tx_keyidx &
-                                           CMD_WEP_KEY_INDEX_MASK);
-                lbs_deb_cmd("SET_WEP: remove key %d\n", priv->wep_tx_keyidx);
-        }
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
-done:
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-
-int lbs_cmd_802_11_enable_rsn(struct lbs_private *priv, uint16_t cmd_action,
-                              uint16_t *enable)
-{
-        struct cmd_ds_802_11_enable_rsn cmd;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-        cmd.action = cpu_to_le16(cmd_action);
-
-        if (cmd_action == CMD_ACT_GET)
-                cmd.enable = 0;
-        else {
-                if (*enable)
-                        cmd.enable = cpu_to_le16(CMD_ENABLE_RSN);
-                else
-                        cmd.enable = cpu_to_le16(CMD_DISABLE_RSN);
-                lbs_deb_cmd("ENABLE_RSN: %d\n", *enable);
         }
 
-        ret = lbs_cmd_with_response(priv, CMD_802_11_ENABLE_RSN, &cmd);
-        if (!ret && cmd_action == CMD_ACT_GET)
-                *enable = le16_to_cpu(cmd.enable);
-
         lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
         return ret;
 }
 
-static void set_one_wpa_key(struct MrvlIEtype_keyParamSet *keyparam,
-                            struct enc_key *key)
+int lbs_set_deep_sleep(struct lbs_private *priv, int deep_sleep)
 {
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        if (key->flags & KEY_INFO_WPA_ENABLED)
-                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_ENABLED);
-        if (key->flags & KEY_INFO_WPA_UNICAST)
-                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_UNICAST);
-        if (key->flags & KEY_INFO_WPA_MCAST)
-                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_MCAST);
-
-        keyparam->type = cpu_to_le16(TLV_TYPE_KEY_MATERIAL);
-        keyparam->keytypeid = cpu_to_le16(key->type);
-        keyparam->keylen = cpu_to_le16(key->len);
-        memcpy(keyparam->key, key->key, key->len);
-
-        /* Length field doesn't include the {type,length} header */
-        keyparam->length = cpu_to_le16(sizeof(*keyparam) - 4);
-        lbs_deb_leave(LBS_DEB_CMD);
-}
-
-int lbs_cmd_802_11_key_material(struct lbs_private *priv, uint16_t cmd_action,
-                                struct assoc_request *assoc)
-{
-        struct cmd_ds_802_11_key_material cmd;
-        int ret = 0;
-        int index = 0;
+        int ret =  0;
 
         lbs_deb_enter(LBS_DEB_CMD);
 
-        cmd.action = cpu_to_le16(cmd_action);
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        if (cmd_action == CMD_ACT_GET) {
-                cmd.hdr.size = cpu_to_le16(S_DS_GEN + 2);
-        } else {
-                memset(cmd.keyParamSet, 0, sizeof(cmd.keyParamSet));
-
-                if (test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc->flags)) {
-                        set_one_wpa_key(&cmd.keyParamSet[index],
-                                        &assoc->wpa_unicast_key);
-                        index++;
-                }
-
-                if (test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc->flags)) {
-                        set_one_wpa_key(&cmd.keyParamSet[index],
-                                        &assoc->wpa_mcast_key);
-                        index++;
+        if (deep_sleep) {
+                if (priv->is_deep_sleep != 1) {
+                        lbs_deb_cmd("deep sleep: sleep\n");
+                        BUG_ON(!priv->enter_deep_sleep);
+                        ret = priv->enter_deep_sleep(priv);
+                        if (!ret) {
+                                netif_stop_queue(priv->dev);
+                                netif_carrier_off(priv->dev);
+                        }
+                } else {
+                        lbs_pr_err("deep sleep: already enabled\n");
                 }
-
-                /* The common header and as many keys as we included */
-                cmd.hdr.size = cpu_to_le16(offsetof(typeof(cmd),
-                                                    keyParamSet[index]));
-        }
-        ret = lbs_cmd_with_response(priv, CMD_802_11_KEY_MATERIAL, &cmd);
-        /* Copy the returned key to driver private data */
-        if (!ret && cmd_action == CMD_ACT_GET) {
-                void *buf_ptr = cmd.keyParamSet;
-                void *resp_end = &(&cmd)[1];
-
-                while (buf_ptr < resp_end) {
-                        struct MrvlIEtype_keyParamSet *keyparam = buf_ptr;
-                        struct enc_key *key;
-                        uint16_t param_set_len = le16_to_cpu(keyparam->length);
-                        uint16_t key_len = le16_to_cpu(keyparam->keylen);
-                        uint16_t key_flags = le16_to_cpu(keyparam->keyinfo);
-                        uint16_t key_type = le16_to_cpu(keyparam->keytypeid);
-                        void *end;
-
-                        end = (void *)keyparam + sizeof(keyparam->type)
-                                + sizeof(keyparam->length) + param_set_len;
-
-                        /* Make sure we don't access past the end of the IEs */
-                        if (end > resp_end)
-                                break;
-
-                        if (key_flags & KEY_INFO_WPA_UNICAST)
-                                key = &priv->wpa_unicast_key;
-                        else if (key_flags & KEY_INFO_WPA_MCAST)
-                                key = &priv->wpa_mcast_key;
-                        else
-                                break;
-
-                        /* Copy returned key into driver */
-                        memset(key, 0, sizeof(struct enc_key));
-                        if (key_len > sizeof(key->key))
-                                break;
-                        key->type = key_type;
-                        key->flags = key_flags;
-                        key->len = key_len;
-                        memcpy(key->key, keyparam->key, key->len);
-
-                        buf_ptr = end + 1;
+        } else {
+                if (priv->is_deep_sleep) {
+                        lbs_deb_cmd("deep sleep: wakeup\n");
+                        BUG_ON(!priv->exit_deep_sleep);
+                        ret = priv->exit_deep_sleep(priv);
+                        if (!ret) {
+                                ret = lbs_wait_for_ds_awake(priv);
+                                if (ret)
+                                        lbs_pr_err("deep sleep: wakeup"
+                                                        "failed\n");
+                        }
                 }
         }
 
@@ -535,7 +377,7 @@ int lbs_set_snmp_mib(struct lbs_private *priv, u32 oid, u16 val)
         switch (oid) {
         case SNMP_MIB_OID_BSS_TYPE:
                 cmd.bufsize = cpu_to_le16(sizeof(u8));
-                cmd.value[0] = (val == IW_MODE_ADHOC) ? 2 : 1;
+                cmd.value[0] = val;
                 break;
         case SNMP_MIB_OID_11D_ENABLE:
         case SNMP_MIB_OID_FRAG_THRESHOLD:
@@ -588,13 +430,7 @@ int lbs_get_snmp_mib(struct lbs_private *priv, u32 oid, u16 *out_val)
 
         switch (le16_to_cpu(cmd.bufsize)) {
         case sizeof(u8):
-                if (oid == SNMP_MIB_OID_BSS_TYPE) {
-                        if (cmd.value[0] == 2)
-                                *out_val = IW_MODE_ADHOC;
-                        else
-                                *out_val = IW_MODE_INFRA;
-                } else
-                        *out_val = cmd.value[0];
+                *out_val = cmd.value[0];
                 break;
         case sizeof(u16):
                 *out_val = le16_to_cpu(*((__le16 *)(&cmd.value)));
@@ -681,7 +517,7 @@ static int lbs_cmd_802_11_monitor_mode(struct cmd_ds_command *cmd,
         cmd->command = cpu_to_le16(CMD_802_11_MONITOR_MODE);
         cmd->size =
             cpu_to_le16(sizeof(struct cmd_ds_802_11_monitor_mode) +
-                             S_DS_GEN);
+                             sizeof(struct cmd_header));
 
         monitor->action = cpu_to_le16(cmd_action);
         if (cmd_action == CMD_ACT_SET) {
@@ -692,111 +528,6 @@ static int lbs_cmd_802_11_monitor_mode(struct cmd_ds_command *cmd,
         return 0;
 }
 
-static __le16 lbs_rate_to_fw_bitmap(int rate, int lower_rates_ok)
-{
-/*              Bit     Rate
-*               15:13 Reserved
-*               12    54 Mbps
-*               11    48 Mbps
-*               10    36 Mbps
-*               9     24 Mbps
-*               8     18 Mbps
-*               7     12 Mbps
-*               6     9 Mbps
-*               5     6 Mbps
-*               4     Reserved
-*               3     11 Mbps
-*               2     5.5 Mbps
-*               1     2 Mbps
-*               0     1 Mbps
-**/
-
-        uint16_t ratemask;
-        int i = lbs_data_rate_to_fw_index(rate);
-        if (lower_rates_ok)
-                ratemask = (0x1fef >> (12 - i));
-        else
-                ratemask = (1 << i);
-        return cpu_to_le16(ratemask);
-}
-
-int lbs_cmd_802_11_rate_adapt_rateset(struct lbs_private *priv,
-                                      uint16_t cmd_action)
-{
-        struct cmd_ds_802_11_rate_adapt_rateset cmd;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        if (!priv->cur_rate && !priv->enablehwauto)
-                return -EINVAL;
-
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        cmd.action = cpu_to_le16(cmd_action);
-        cmd.enablehwauto = cpu_to_le16(priv->enablehwauto);
-        cmd.bitmap = lbs_rate_to_fw_bitmap(priv->cur_rate, priv->enablehwauto);
-        ret = lbs_cmd_with_response(priv, CMD_802_11_RATE_ADAPT_RATESET, &cmd);
-        if (!ret && cmd_action == CMD_ACT_GET) {
-                priv->ratebitmap = le16_to_cpu(cmd.bitmap);
-                priv->enablehwauto = le16_to_cpu(cmd.enablehwauto);
-        }
-
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(lbs_cmd_802_11_rate_adapt_rateset);
-
-/**
- *  @brief Set the data rate
- *
- *  @param priv         A pointer to struct lbs_private structure
- *  @param rate         The desired data rate, or 0 to clear a locked rate
- *
- *  @return             0 on success, error on failure
- */
-int lbs_set_data_rate(struct lbs_private *priv, u8 rate)
-{
-        struct cmd_ds_802_11_data_rate cmd;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        if (rate > 0) {
-                cmd.action = cpu_to_le16(CMD_ACT_SET_TX_FIX_RATE);
-                cmd.rates[0] = lbs_data_rate_to_fw_index(rate);
-                if (cmd.rates[0] == 0) {
-                        lbs_deb_cmd("DATA_RATE: invalid requested rate of"
-                                    " 0x%02X\n", rate);
-                        ret = 0;
-                        goto out;
-                }
-                lbs_deb_cmd("DATA_RATE: set fixed 0x%02X\n", cmd.rates[0]);
-        } else {
-                cmd.action = cpu_to_le16(CMD_ACT_SET_TX_AUTO);
-                lbs_deb_cmd("DATA_RATE: setting auto\n");
-        }
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_DATA_RATE, &cmd);
-        if (ret)
-                goto out;
-
-        lbs_deb_hex(LBS_DEB_CMD, "DATA_RATE_RESP", (u8 *) &cmd, sizeof (cmd));
-
-        /* FIXME: get actual rates FW can do if this command actually returns
-         * all data rates supported.
-         */
-        priv->cur_rate = lbs_fw_index_to_data_rate(cmd.rates[0]);
-        lbs_deb_cmd("DATA_RATE: current rate is 0x%02x\n", priv->cur_rate);
-
-out:
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-
 /**
  *  @brief Get the radio channel
  *
@@ -804,7 +535,7 @@ out:
  *
  *  @return             The channel on success, error on failure
  */
-int lbs_get_channel(struct lbs_private *priv)
+static int lbs_get_channel(struct lbs_private *priv)
 {
         struct cmd_ds_802_11_rf_channel cmd;
         int ret = 0;
@@ -836,7 +567,7 @@ int lbs_update_channel(struct lbs_private *priv)
 
         ret = lbs_get_channel(priv);
         if (ret > 0) {
-                priv->curbssparams.channel = ret;
+                priv->channel = ret;
                 ret = 0;
         }
         lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
@@ -855,7 +586,7 @@ int lbs_set_channel(struct lbs_private *priv, u8 channel)
 {
         struct cmd_ds_802_11_rf_channel cmd;
 #ifdef DEBUG
-        u8 old_channel = priv->curbssparams.channel;
+        u8 old_channel = priv->channel;
 #endif
         int ret = 0;
 
@@ -870,36 +601,15 @@ int lbs_set_channel(struct lbs_private *priv, u8 channel)
         if (ret)
                 goto out;
 
-        priv->curbssparams.channel = (uint8_t) le16_to_cpu(cmd.channel);
+        priv->channel = (uint8_t) le16_to_cpu(cmd.channel);
         lbs_deb_cmd("channel switch from %d to %d\n", old_channel,
-                priv->curbssparams.channel);
+                priv->channel);
 
 out:
         lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
         return ret;
 }
 
-static int lbs_cmd_802_11_rssi(struct lbs_private *priv,
-                                struct cmd_ds_command *cmd)
-{
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        cmd->command = cpu_to_le16(CMD_802_11_RSSI);
-        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_802_11_rssi) + S_DS_GEN);
-        cmd->params.rssi.N = cpu_to_le16(DEFAULT_BCN_AVG_FACTOR);
-
-        /* reset Beacon SNR/NF/RSSI values */
-        priv->SNR[TYPE_BEACON][TYPE_NOAVG] = 0;
-        priv->SNR[TYPE_BEACON][TYPE_AVG] = 0;
-        priv->NF[TYPE_BEACON][TYPE_NOAVG] = 0;
-        priv->NF[TYPE_BEACON][TYPE_AVG] = 0;
-        priv->RSSI[TYPE_BEACON][TYPE_NOAVG] = 0;
-        priv->RSSI[TYPE_BEACON][TYPE_AVG] = 0;
-
-        lbs_deb_leave(LBS_DEB_CMD);
-        return 0;
-}
-
 static int lbs_cmd_reg_access(struct cmd_ds_command *cmdptr,
                                u8 cmd_action, void *pdata_buf)
 {
@@ -916,7 +626,7 @@ static int lbs_cmd_reg_access(struct cmd_ds_command *cmdptr,
 
                         cmdptr->size =
                             cpu_to_le16(sizeof (struct cmd_ds_mac_reg_access)
-                                        + S_DS_GEN);
+                                        + sizeof(struct cmd_header));
                         macreg =
                             (struct cmd_ds_mac_reg_access *)&cmdptr->params.
                             macreg;
@@ -935,7 +645,7 @@ static int lbs_cmd_reg_access(struct cmd_ds_command *cmdptr,
                         cmdptr->size =
                             cpu_to_le16(sizeof
                                              (struct cmd_ds_bbp_reg_access)
-                                             + S_DS_GEN);
+                                             + sizeof(struct cmd_header));
                         bbpreg =
                             (struct cmd_ds_bbp_reg_access *)&cmdptr->params.
                             bbpreg;
@@ -954,7 +664,7 @@ static int lbs_cmd_reg_access(struct cmd_ds_command *cmdptr,
                         cmdptr->size =
                             cpu_to_le16(sizeof
                                              (struct cmd_ds_rf_reg_access) +
-                                             S_DS_GEN);
+                                             sizeof(struct cmd_header));
                         rfreg =
                             (struct cmd_ds_rf_reg_access *)&cmdptr->params.
                             rfreg;
@@ -974,192 +684,6 @@ static int lbs_cmd_reg_access(struct cmd_ds_command *cmdptr,
         return 0;
 }
 
-static int lbs_cmd_bt_access(struct cmd_ds_command *cmd,
-                               u16 cmd_action, void *pdata_buf)
-{
-        struct cmd_ds_bt_access *bt_access = &cmd->params.bt;
-        lbs_deb_enter_args(LBS_DEB_CMD, "action %d", cmd_action);
-
-        cmd->command = cpu_to_le16(CMD_BT_ACCESS);
-        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_bt_access) + S_DS_GEN);
-        cmd->result = 0;
-        bt_access->action = cpu_to_le16(cmd_action);
-
-        switch (cmd_action) {
-        case CMD_ACT_BT_ACCESS_ADD:
-                memcpy(bt_access->addr1, pdata_buf, 2 * ETH_ALEN);
-                lbs_deb_hex(LBS_DEB_MESH, "BT_ADD: blinded MAC addr", bt_access->addr1, 6);
-                break;
-        case CMD_ACT_BT_ACCESS_DEL:
-                memcpy(bt_access->addr1, pdata_buf, 1 * ETH_ALEN);
-                lbs_deb_hex(LBS_DEB_MESH, "BT_DEL: blinded MAC addr", bt_access->addr1, 6);
-                break;
-        case CMD_ACT_BT_ACCESS_LIST:
-                bt_access->id = cpu_to_le32(*(u32 *) pdata_buf);
-                break;
-        case CMD_ACT_BT_ACCESS_RESET:
-                break;
-        case CMD_ACT_BT_ACCESS_SET_INVERT:
-                bt_access->id = cpu_to_le32(*(u32 *) pdata_buf);
-                break;
-        case CMD_ACT_BT_ACCESS_GET_INVERT:
-                break;
-        default:
-                break;
-        }
-        lbs_deb_leave(LBS_DEB_CMD);
-        return 0;
-}
-
-static int lbs_cmd_fwt_access(struct cmd_ds_command *cmd,
-                               u16 cmd_action, void *pdata_buf)
-{
-        struct cmd_ds_fwt_access *fwt_access = &cmd->params.fwt;
-        lbs_deb_enter_args(LBS_DEB_CMD, "action %d", cmd_action);
-
-        cmd->command = cpu_to_le16(CMD_FWT_ACCESS);
-        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_fwt_access) + S_DS_GEN);
-        cmd->result = 0;
-
-        if (pdata_buf)
-                memcpy(fwt_access, pdata_buf, sizeof(*fwt_access));
-        else
-                memset(fwt_access, 0, sizeof(*fwt_access));
-
-        fwt_access->action = cpu_to_le16(cmd_action);
-
-        lbs_deb_leave(LBS_DEB_CMD);
-        return 0;
-}
-
-int lbs_mesh_access(struct lbs_private *priv, uint16_t cmd_action,
-                    struct cmd_ds_mesh_access *cmd)
-{
-        int ret;
-
-        lbs_deb_enter_args(LBS_DEB_CMD, "action %d", cmd_action);
-
-        cmd->hdr.command = cpu_to_le16(CMD_MESH_ACCESS);
-        cmd->hdr.size = cpu_to_le16(sizeof(*cmd));
-        cmd->hdr.result = 0;
-
-        cmd->action = cpu_to_le16(cmd_action);
-
-        ret = lbs_cmd_with_response(priv, CMD_MESH_ACCESS, cmd);
-
-        lbs_deb_leave(LBS_DEB_CMD);
-        return ret;
-}
-
-static int __lbs_mesh_config_send(struct lbs_private *priv,
-                                  struct cmd_ds_mesh_config *cmd,
-                                  uint16_t action, uint16_t type)
-{
-        int ret;
-        u16 command = CMD_MESH_CONFIG_OLD;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        /*
-         * Command id is 0xac for v10 FW along with mesh interface
-         * id in bits 14-13-12.
-         */
-        if (priv->mesh_fw_ver == MESH_FW_NEW)
-                command = CMD_MESH_CONFIG |
-                          (MESH_IFACE_ID << MESH_IFACE_BIT_OFFSET);
-
-        cmd->hdr.command = cpu_to_le16(command);
-        cmd->hdr.size = cpu_to_le16(sizeof(struct cmd_ds_mesh_config));
-        cmd->hdr.result = 0;
-
-        cmd->type = cpu_to_le16(type);
-        cmd->action = cpu_to_le16(action);
-
-        ret = lbs_cmd_with_response(priv, command, cmd);
-
-        lbs_deb_leave(LBS_DEB_CMD);
-        return ret;
-}
-
-int lbs_mesh_config_send(struct lbs_private *priv,
-                         struct cmd_ds_mesh_config *cmd,
-                         uint16_t action, uint16_t type)
-{
-        int ret;
-
-        if (!(priv->fwcapinfo & FW_CAPINFO_PERSISTENT_CONFIG))
-                return -EOPNOTSUPP;
-
-        ret = __lbs_mesh_config_send(priv, cmd, action, type);
-        return ret;
-}
-
-/* This function is the CMD_MESH_CONFIG legacy function.  It only handles the
- * START and STOP actions.  The extended actions supported by CMD_MESH_CONFIG
- * are all handled by preparing a struct cmd_ds_mesh_config and passing it to
- * lbs_mesh_config_send.
- */
-int lbs_mesh_config(struct lbs_private *priv, uint16_t action, uint16_t chan)
-{
-        struct cmd_ds_mesh_config cmd;
-        struct mrvl_meshie *ie;
-        DECLARE_SSID_BUF(ssid);
-
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.channel = cpu_to_le16(chan);
-        ie = (struct mrvl_meshie *)cmd.data;
-
-        switch (action) {
-        case CMD_ACT_MESH_CONFIG_START:
-                ie->id = WLAN_EID_GENERIC;
-                ie->val.oui[0] = 0x00;
-                ie->val.oui[1] = 0x50;
-                ie->val.oui[2] = 0x43;
-                ie->val.type = MARVELL_MESH_IE_TYPE;
-                ie->val.subtype = MARVELL_MESH_IE_SUBTYPE;
-                ie->val.version = MARVELL_MESH_IE_VERSION;
-                ie->val.active_protocol_id = MARVELL_MESH_PROTO_ID_HWMP;
-                ie->val.active_metric_id = MARVELL_MESH_METRIC_ID;
-                ie->val.mesh_capability = MARVELL_MESH_CAPABILITY;
-                ie->val.mesh_id_len = priv->mesh_ssid_len;
-                memcpy(ie->val.mesh_id, priv->mesh_ssid, priv->mesh_ssid_len);
-                ie->len = sizeof(struct mrvl_meshie_val) -
-                        IW_ESSID_MAX_SIZE + priv->mesh_ssid_len;
-                cmd.length = cpu_to_le16(sizeof(struct mrvl_meshie_val));
-                break;
-        case CMD_ACT_MESH_CONFIG_STOP:
-                break;
-        default:
-                return -1;
-        }
-        lbs_deb_cmd("mesh config action %d type %x channel %d SSID %s\n",
-                    action, priv->mesh_tlv, chan,
-                    print_ssid(ssid, priv->mesh_ssid, priv->mesh_ssid_len));
-
-        return __lbs_mesh_config_send(priv, &cmd, action, priv->mesh_tlv);
-}
-
-static int lbs_cmd_bcn_ctrl(struct lbs_private * priv,
-                                struct cmd_ds_command *cmd,
-                                u16 cmd_action)
-{
-        struct cmd_ds_802_11_beacon_control
-                *bcn_ctrl = &cmd->params.bcn_ctrl;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        cmd->size =
-            cpu_to_le16(sizeof(struct cmd_ds_802_11_beacon_control)
-                             + S_DS_GEN);
-        cmd->command = cpu_to_le16(CMD_802_11_BEACON_CTRL);
-
-        bcn_ctrl->action = cpu_to_le16(cmd_action);
-        bcn_ctrl->beacon_enable = cpu_to_le16(priv->beacon_enable);
-        bcn_ctrl->beacon_period = cpu_to_le16(priv->beacon_period);
-
-        lbs_deb_leave(LBS_DEB_CMD);
-        return 0;
-}
-
 static void lbs_queue_cmd(struct lbs_private *priv,
                           struct cmd_ctrl_node *cmdnode)
 {
@@ -1243,8 +767,17 @@ static void lbs_submit_command(struct lbs_private *priv,
                 timeo = HZ/4;
         }
 
-        /* Setup the timer after transmit command */
-        mod_timer(&priv->command_timer, jiffies + timeo);
+        if (command == CMD_802_11_DEEP_SLEEP) {
+                if (priv->is_auto_deep_sleep_enabled) {
+                        priv->wakeup_dev_required = 1;
+                        priv->dnld_sent = 0;
+                }
+                priv->is_deep_sleep = 1;
+                lbs_complete_command(priv, cmdnode, 0);
+        } else {
+                /* Setup the timer after transmit command */
+                mod_timer(&priv->command_timer, jiffies + timeo);
+        }
 
         lbs_deb_leave(LBS_DEB_HOST);
 }
@@ -1310,9 +843,6 @@ int lbs_set_radio(struct lbs_private *priv, u8 preamble, u8 radio_on)
         if (priv->fwrelease < 0x09000000) {
                 switch (preamble) {
                 case RADIO_PREAMBLE_SHORT:
-                        if (!(priv->capability & WLAN_CAPABILITY_SHORT_PREAMBLE))
-                                goto out;
-                        /* Fall through */
                 case RADIO_PREAMBLE_AUTO:
                 case RADIO_PREAMBLE_LONG:
                         cmd.control = cpu_to_le16(preamble);
@@ -1391,6 +921,11 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
                 goto done;
         }
 
+        if (!lbs_is_cmd_allowed(priv)) {
+                ret = -EBUSY;
+                goto done;
+        }
+
         cmdnode = lbs_get_cmd_ctrl_node(priv);
 
         if (cmdnode == NULL) {
@@ -1441,7 +976,7 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
 
                 cmdptr->command = cpu_to_le16(cmd_no);
                 cmdptr->size = cpu_to_le16(sizeof(struct cmd_ds_802_11_afc) +
-                                           S_DS_GEN);
+                                           sizeof(struct cmd_header));
 
                 memmove(&cmdptr->params.afc,
                         pdata_buf, sizeof(struct cmd_ds_802_11_afc));
@@ -1449,45 +984,19 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
                 ret = 0;
                 goto done;
 
-        case CMD_802_11D_DOMAIN_INFO:
-                ret = lbs_cmd_802_11d_domain_info(priv, cmdptr,
-                                                   cmd_no, cmd_action);
-                break;
-
         case CMD_802_11_TPC_CFG:
                 cmdptr->command = cpu_to_le16(CMD_802_11_TPC_CFG);
                 cmdptr->size =
                     cpu_to_le16(sizeof(struct cmd_ds_802_11_tpc_cfg) +
-                                     S_DS_GEN);
+                                     sizeof(struct cmd_header));
 
                 memmove(&cmdptr->params.tpccfg,
                         pdata_buf, sizeof(struct cmd_ds_802_11_tpc_cfg));
 
                 ret = 0;
                 break;
-        case CMD_802_11_LED_GPIO_CTRL:
-                {
-                        struct mrvl_ie_ledgpio *gpio =
-                            (struct mrvl_ie_ledgpio*)
-                            cmdptr->params.ledgpio.data;
-
-                        memmove(&cmdptr->params.ledgpio,
-                                pdata_buf,
-                                sizeof(struct cmd_ds_802_11_led_ctrl));
 
-                        cmdptr->command =
-                            cpu_to_le16(CMD_802_11_LED_GPIO_CTRL);
-
-#define ACTION_NUMLED_TLVTYPE_LEN_FIELDS_LEN 8
-                        cmdptr->size =
-                            cpu_to_le16(le16_to_cpu(gpio->header.len)
-                                + S_DS_GEN
-                                + ACTION_NUMLED_TLVTYPE_LEN_FIELDS_LEN);
-                        gpio->header.len = gpio->header.len;
-
-                        ret = 0;
-                        break;
-                }
+#ifdef CONFIG_LIBERTAS_MESH
 
         case CMD_BT_ACCESS:
                 ret = lbs_cmd_bt_access(cmdptr, cmd_action, pdata_buf);
@@ -1497,15 +1006,15 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
                 ret = lbs_cmd_fwt_access(cmdptr, cmd_action, pdata_buf);
                 break;
 
-        case CMD_GET_TSF:
-                cmdptr->command = cpu_to_le16(CMD_GET_TSF);
-                cmdptr->size = cpu_to_le16(sizeof(struct cmd_ds_get_tsf) +
-                                           S_DS_GEN);
-                ret = 0;
-                break;
+#endif
+
         case CMD_802_11_BEACON_CTRL:
                 ret = lbs_cmd_bcn_ctrl(priv, cmdptr, cmd_action);
                 break;
+        case CMD_802_11_DEEP_SLEEP:
+                cmdptr->command = cpu_to_le16(CMD_802_11_DEEP_SLEEP);
+                cmdptr->size = cpu_to_le16(sizeof(struct cmd_header));
+                break;
         default:
                 lbs_pr_err("PREP_CMD: unknown command 0x%04x\n", cmd_no);
                 ret = -1;
@@ -1797,7 +1306,7 @@ int lbs_execute_next_command(struct lbs_private *priv)
                 if ((priv->psmode != LBS802_11POWERMODECAM) &&
                     (priv->psstate == PS_STATE_FULL_POWER) &&
                     ((priv->connect_status == LBS_CONNECTED) ||
-                    (priv->mesh_connect_status == LBS_CONNECTED))) {
+                    lbs_mesh_connected(priv))) {
                         if (priv->secinfo.WPAenabled ||
                             priv->secinfo.WPA2enabled) {
                                 /* check for valid WPA group keys */
@@ -1823,30 +1332,6 @@ done:
         return ret;
 }
 
-void lbs_send_iwevcustom_event(struct lbs_private *priv, s8 *str)
-{
-        union iwreq_data iwrq;
-        u8 buf[50];
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        memset(&iwrq, 0, sizeof(union iwreq_data));
-        memset(buf, 0, sizeof(buf));
-
-        snprintf(buf, sizeof(buf) - 1, "%s", str);
-
-        iwrq.data.length = strlen(buf) + 1 + IW_EV_LCP_LEN;
-
-        /* Send Event to upper layer */
-        lbs_deb_wext("event indication string %s\n", (char *)buf);
-        lbs_deb_wext("event indication length %d\n", iwrq.data.length);
-        lbs_deb_wext("sending wireless event IWEVCUSTOM for %s\n", str);
-
-        wireless_send_event(priv->dev, IWEVCUSTOM, &iwrq, buf);
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-}
-
 static void lbs_send_confirmsleep(struct lbs_private *priv)
 {
         unsigned long flags;
@@ -1869,7 +1354,7 @@ static void lbs_send_confirmsleep(struct lbs_private *priv)
         priv->dnld_sent = DNLD_RES_RECEIVED;
 
         /* If nothing to do, go back to sleep (?) */
-        if (!__kfifo_len(priv->event_fifo) && !priv->resp_len[priv->resp_idx])
+        if (!kfifo_len(&priv->event_fifo) && !priv->resp_len[priv->resp_idx])
                 priv->psstate = PS_STATE_SLEEP;
 
         spin_unlock_irqrestore(&priv->driver_lock, flags);
@@ -1943,7 +1428,7 @@ void lbs_ps_confirm_sleep(struct lbs_private *priv)
         }
 
         /* Pending events or command responses? */
-        if (__kfifo_len(priv->event_fifo) || priv->resp_len[priv->resp_idx]) {
+        if (kfifo_len(&priv->event_fifo) || priv->resp_len[priv->resp_idx]) {
                 allowed = 0;
                 lbs_deb_host("pending events or command responses\n");
         }
@@ -2024,7 +1509,7 @@ int lbs_set_power_adapt_cfg(struct lbs_private *priv, int enable, int8_t p0,
 }
 
 
-static struct cmd_ctrl_node *__lbs_cmd_async(struct lbs_private *priv,
+struct cmd_ctrl_node *__lbs_cmd_async(struct lbs_private *priv,
         uint16_t command, struct cmd_header *in_cmd, int in_cmd_size,
         int (*callback)(struct lbs_private *, unsigned long, struct cmd_header *),
         unsigned long callback_arg)
@@ -2039,6 +1524,11 @@ static struct cmd_ctrl_node *__lbs_cmd_async(struct lbs_private *priv,
                 goto done;
         }
 
+        if (!lbs_is_cmd_allowed(priv)) {
+                cmdnode = ERR_PTR(-EBUSY);
+                goto done;
+        }
+
         cmdnode = lbs_get_cmd_ctrl_node(priv);
         if (cmdnode == NULL) {
                 lbs_deb_host("PREP_CMD: cmdnode is NULL\n");
@@ -2117,5 +1607,3 @@ done:
         return ret;
 }
 EXPORT_SYMBOL_GPL(__lbs_cmd);
-
-
diff --git a/drivers/net/wireless/libertas/cmd.h b/drivers/net/wireless/libertas/cmd.h
index 392e578ca095..cb4138a55fdf 100644
--- a/drivers/net/wireless/libertas/cmd.h
+++ b/drivers/net/wireless/libertas/cmd.h
@@ -3,11 +3,30 @@
 #ifndef _LBS_CMD_H_
 #define _LBS_CMD_H_
 
-#include "hostcmd.h"
+#include "host.h"
 #include "dev.h"
 
+
+/* Command & response transfer between host and card */
+
+struct cmd_ctrl_node {
+        struct list_head list;
+        int result;
+        /* command response */
+        int (*callback)(struct lbs_private *,
+                        unsigned long,
+                        struct cmd_header *);
+        unsigned long callback_arg;
+        /* command data */
+        struct cmd_header *cmdbuf;
+        /* wait queue */
+        u16 cmdwaitqwoken;
+        wait_queue_head_t cmdwait_q;
+};
+
+
 /* lbs_cmd() infers the size of the buffer to copy data back into, from
-   the size of the target of the pointer. Since the command to be sent 
+   the size of the target of the pointer. Since the command to be sent
    may often be smaller, that size is set in cmd->size by the caller.*/
 #define lbs_cmd(priv, cmdnr, cmd, cb, cb_arg)   ({              \
         uint16_t __sz = le16_to_cpu((cmd)->hdr.size);           \
@@ -18,6 +37,11 @@
 #define lbs_cmd_with_response(priv, cmdnr, cmd) \
         lbs_cmd(priv, cmdnr, cmd, lbs_cmd_copyback, (unsigned long) (cmd))
 
+int lbs_prepare_and_send_command(struct lbs_private *priv,
+        u16 cmd_no,
+        u16 cmd_action,
+        u16 wait_option, u32 cmd_oid, void *pdata_buf);
+
 void lbs_cmd_async(struct lbs_private *priv, uint16_t command,
         struct cmd_header *in_cmd, int in_cmd_size);
 
@@ -26,62 +50,81 @@ int __lbs_cmd(struct lbs_private *priv, uint16_t command,
               int (*callback)(struct lbs_private *, unsigned long, struct cmd_header *),
               unsigned long callback_arg);
 
-int lbs_set_power_adapt_cfg(struct lbs_private *priv, int enable, int8_t p0,
-                int8_t p1, int8_t p2);
+struct cmd_ctrl_node *__lbs_cmd_async(struct lbs_private *priv,
+        uint16_t command, struct cmd_header *in_cmd, int in_cmd_size,
+        int (*callback)(struct lbs_private *, unsigned long, struct cmd_header *),
+        unsigned long callback_arg);
 
-int lbs_set_tpc_cfg(struct lbs_private *priv, int enable, int8_t p0, int8_t p1,
-                int8_t p2, int usesnr);
+int lbs_cmd_copyback(struct lbs_private *priv, unsigned long extra,
+                     struct cmd_header *resp);
 
-int lbs_set_power_adapt_cfg(struct lbs_private *priv, int enable, int8_t p0,
-                int8_t p1, int8_t p2);
+int lbs_allocate_cmd_buffer(struct lbs_private *priv);
+int lbs_free_cmd_buffer(struct lbs_private *priv);
 
-int lbs_set_tpc_cfg(struct lbs_private *priv, int enable, int8_t p0, int8_t p1,
-                int8_t p2, int usesnr);
+int lbs_execute_next_command(struct lbs_private *priv);
+void lbs_complete_command(struct lbs_private *priv, struct cmd_ctrl_node *cmd,
+                          int result);
+int lbs_process_command_response(struct lbs_private *priv, u8 *data, u32 len);
 
-int lbs_cmd_copyback(struct lbs_private *priv, unsigned long extra,
-                     struct cmd_header *resp);
 
-int lbs_update_hw_spec(struct lbs_private *priv);
+/* From cmdresp.c */
 
-int lbs_mesh_access(struct lbs_private *priv, uint16_t cmd_action,
-                    struct cmd_ds_mesh_access *cmd);
+void lbs_mac_event_disconnected(struct lbs_private *priv);
 
-int lbs_set_data_rate(struct lbs_private *priv, u8 rate);
 
-int lbs_get_channel(struct lbs_private *priv);
+
+/* Events */
+
+int lbs_process_event(struct lbs_private *priv, u32 event);
+
+
+/* Actual commands */
+
+int lbs_update_hw_spec(struct lbs_private *priv);
+
 int lbs_set_channel(struct lbs_private *priv, u8 channel);
 
-int lbs_mesh_config_send(struct lbs_private *priv,
-                         struct cmd_ds_mesh_config *cmd,
-                         uint16_t action, uint16_t type);
-int lbs_mesh_config(struct lbs_private *priv, uint16_t enable, uint16_t chan);
+int lbs_update_channel(struct lbs_private *priv);
 
 int lbs_host_sleep_cfg(struct lbs_private *priv, uint32_t criteria,
                 struct wol_config *p_wol_config);
-int lbs_suspend(struct lbs_private *priv);
-void lbs_resume(struct lbs_private *priv);
 
-int lbs_cmd_802_11_rate_adapt_rateset(struct lbs_private *priv,
-                                      uint16_t cmd_action);
-int lbs_cmd_802_11_inactivity_timeout(struct lbs_private *priv,
-                                      uint16_t cmd_action, uint16_t *timeout);
 int lbs_cmd_802_11_sleep_params(struct lbs_private *priv, uint16_t cmd_action,
                                 struct sleep_params *sp);
-int lbs_cmd_802_11_set_wep(struct lbs_private *priv, uint16_t cmd_action,
-                           struct assoc_request *assoc);
-int lbs_cmd_802_11_enable_rsn(struct lbs_private *priv, uint16_t cmd_action,
-                              uint16_t *enable);
-int lbs_cmd_802_11_key_material(struct lbs_private *priv, uint16_t cmd_action,
-                                struct assoc_request *assoc);
 
-int lbs_get_tx_power(struct lbs_private *priv, s16 *curlevel, s16 *minlevel,
-                     s16 *maxlevel);
-int lbs_set_tx_power(struct lbs_private *priv, s16 dbm);
+void lbs_ps_sleep(struct lbs_private *priv, int wait_option);
+
+void lbs_ps_wakeup(struct lbs_private *priv, int wait_option);
+
+void lbs_ps_confirm_sleep(struct lbs_private *priv);
 
 int lbs_set_radio(struct lbs_private *priv, u8 preamble, u8 radio_on);
 
+void lbs_set_mac_control(struct lbs_private *priv);
+
+int lbs_get_tx_power(struct lbs_private *priv, s16 *curlevel, s16 *minlevel,
+                     s16 *maxlevel);
+
 int lbs_set_snmp_mib(struct lbs_private *priv, u32 oid, u16 val);
 
 int lbs_get_snmp_mib(struct lbs_private *priv, u32 oid, u16 *out_val);
 
+
+/* Commands only used in wext.c, assoc. and scan.c */
+
+int lbs_set_power_adapt_cfg(struct lbs_private *priv, int enable, int8_t p0,
+                int8_t p1, int8_t p2);
+
+int lbs_set_tpc_cfg(struct lbs_private *priv, int enable, int8_t p0, int8_t p1,
+                int8_t p2, int usesnr);
+
+int lbs_set_data_rate(struct lbs_private *priv, u8 rate);
+
+int lbs_cmd_802_11_rate_adapt_rateset(struct lbs_private *priv,
+                                      uint16_t cmd_action);
+
+int lbs_set_tx_power(struct lbs_private *priv, s16 dbm);
+
+int lbs_set_deep_sleep(struct lbs_private *priv, int deep_sleep);
+
 #endif /* _LBS_CMD_H */
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index 23f684337fdd..88f7131d66e9 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -2,6 +2,7 @@
   * This file contains the handling of command
   * responses as well as events generated by firmware.
   */
+#include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/sched.h>
 #include <linux/if_arp.h>
@@ -11,6 +12,7 @@
 
 #include "host.h"
 #include "decl.h"
+#include "cmd.h"
 #include "defs.h"
 #include "dev.h"
 #include "assoc.h"
@@ -26,23 +28,17 @@
  */
 void lbs_mac_event_disconnected(struct lbs_private *priv)
 {
-        union iwreq_data wrqu;
-
         if (priv->connect_status != LBS_CONNECTED)
                 return;
 
         lbs_deb_enter(LBS_DEB_ASSOC);
 
-        memset(wrqu.ap_addr.sa_data, 0x00, ETH_ALEN);
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-
         /*
          * Cisco AP sends EAP failure and de-auth in less than 0.5 ms.
          * It causes problem in the Supplicant
          */
-
         msleep_interruptible(1000);
-        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
+        lbs_send_disconnect_notification(priv);
 
         /* report disconnect to upper layer */
         netif_stop_queue(priv->dev);
@@ -67,7 +63,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv)
          * no longer valid.
          */
         memset(&priv->curbssparams.bssid, 0, ETH_ALEN);
-        memset(&priv->curbssparams.ssid, 0, IW_ESSID_MAX_SIZE);
+        memset(&priv->curbssparams.ssid, 0, IEEE80211_MAX_SSID_LEN);
         priv->curbssparams.ssid_len = 0;
 
         if (priv->psstate != PS_STATE_FULL_POWER) {
@@ -78,32 +74,6 @@ void lbs_mac_event_disconnected(struct lbs_private *priv)
         lbs_deb_leave(LBS_DEB_ASSOC);
 }
 
-/**
- *  @brief This function handles MIC failure event.
- *
- *  @param priv    A pointer to struct lbs_private structure
- *  @para  event   the event id
- *  @return        n/a
- */
-static void handle_mic_failureevent(struct lbs_private *priv, u32 event)
-{
-        char buf[50];
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        memset(buf, 0, sizeof(buf));
-
-        sprintf(buf, "%s", "MLME-MICHAELMICFAILURE.indication ");
-
-        if (event == MACREG_INT_CODE_MIC_ERR_UNICAST) {
-                strcat(buf, "unicast ");
-        } else {
-                strcat(buf, "multicast ");
-        }
-
-        lbs_send_iwevcustom_event(priv, buf);
-        lbs_deb_leave(LBS_DEB_CMD);
-}
-
 static int lbs_ret_reg_access(struct lbs_private *priv,
                                u16 type, struct cmd_ds_command *resp)
 {
@@ -147,53 +117,6 @@ static int lbs_ret_reg_access(struct lbs_private *priv,
         return ret;
 }
 
-static int lbs_ret_802_11_rssi(struct lbs_private *priv,
-                                struct cmd_ds_command *resp)
-{
-        struct cmd_ds_802_11_rssi_rsp *rssirsp = &resp->params.rssirsp;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        /* store the non average value */
-        priv->SNR[TYPE_BEACON][TYPE_NOAVG] = get_unaligned_le16(&rssirsp->SNR);
-        priv->NF[TYPE_BEACON][TYPE_NOAVG] = get_unaligned_le16(&rssirsp->noisefloor);
-
-        priv->SNR[TYPE_BEACON][TYPE_AVG] = get_unaligned_le16(&rssirsp->avgSNR);
-        priv->NF[TYPE_BEACON][TYPE_AVG] = get_unaligned_le16(&rssirsp->avgnoisefloor);
-
-        priv->RSSI[TYPE_BEACON][TYPE_NOAVG] =
-            CAL_RSSI(priv->SNR[TYPE_BEACON][TYPE_NOAVG],
-                     priv->NF[TYPE_BEACON][TYPE_NOAVG]);
-
-        priv->RSSI[TYPE_BEACON][TYPE_AVG] =
-            CAL_RSSI(priv->SNR[TYPE_BEACON][TYPE_AVG] / AVG_SCALE,
-                     priv->NF[TYPE_BEACON][TYPE_AVG] / AVG_SCALE);
-
-        lbs_deb_cmd("RSSI: beacon %d, avg %d\n",
-               priv->RSSI[TYPE_BEACON][TYPE_NOAVG],
-               priv->RSSI[TYPE_BEACON][TYPE_AVG]);
-
-        lbs_deb_leave(LBS_DEB_CMD);
-        return 0;
-}
-
-static int lbs_ret_802_11_bcn_ctrl(struct lbs_private * priv,
-                                        struct cmd_ds_command *resp)
-{
-        struct cmd_ds_802_11_beacon_control *bcn_ctrl =
-            &resp->params.bcn_ctrl;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        if (bcn_ctrl->action == CMD_ACT_GET) {
-                priv->beacon_enable = (u8) le16_to_cpu(bcn_ctrl->beacon_enable);
-                priv->beacon_period = le16_to_cpu(bcn_ctrl->beacon_period);
-        }
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        return 0;
-}
-
 static inline int handle_cmd_response(struct lbs_private *priv,
                                       struct cmd_header *cmd_response)
 {
@@ -227,29 +150,13 @@ static inline int handle_cmd_response(struct lbs_private *priv,
                 ret = lbs_ret_802_11_rssi(priv, resp);
                 break;
 
-        case CMD_RET(CMD_802_11D_DOMAIN_INFO):
-                ret = lbs_ret_802_11d_domain_info(resp);
-                break;
-
         case CMD_RET(CMD_802_11_TPC_CFG):
                 spin_lock_irqsave(&priv->driver_lock, flags);
                 memmove((void *)priv->cur_cmd->callback_arg, &resp->params.tpccfg,
                         sizeof(struct cmd_ds_802_11_tpc_cfg));
                 spin_unlock_irqrestore(&priv->driver_lock, flags);
                 break;
-        case CMD_RET(CMD_802_11_LED_GPIO_CTRL):
-                spin_lock_irqsave(&priv->driver_lock, flags);
-                memmove((void *)priv->cur_cmd->callback_arg, &resp->params.ledgpio,
-                        sizeof(struct cmd_ds_802_11_led_ctrl));
-                spin_unlock_irqrestore(&priv->driver_lock, flags);
-                break;
 
-        case CMD_RET(CMD_GET_TSF):
-                spin_lock_irqsave(&priv->driver_lock, flags);
-                memcpy((void *)priv->cur_cmd->callback_arg,
-                       &resp->params.gettsf.tsfvalue, sizeof(u64));
-                spin_unlock_irqrestore(&priv->driver_lock, flags);
-                break;
         case CMD_RET(CMD_BT_ACCESS):
                 spin_lock_irqsave(&priv->driver_lock, flags);
                 if (priv->cur_cmd->callback_arg)
@@ -334,11 +241,6 @@ int lbs_process_command_response(struct lbs_private *priv, u8 *data, u32 len)
         /* Now we got response from FW, cancel the command timer */
         del_timer(&priv->command_timer);
         priv->cmd_timed_out = 0;
-        if (priv->nr_retries) {
-                lbs_pr_info("Received result %x to command %x after %d retries\n",
-                            result, curcmd, priv->nr_retries);
-                priv->nr_retries = 0;
-        }
 
         /* Store the response code to cur_cmd_retcode. */
         priv->cur_cmd_retcode = result;
@@ -505,9 +407,21 @@ int lbs_process_event(struct lbs_private *priv, u32 event)
 
         case MACREG_INT_CODE_HOST_AWAKE:
                 lbs_deb_cmd("EVENT: host awake\n");
+                if (priv->reset_deep_sleep_wakeup)
+                        priv->reset_deep_sleep_wakeup(priv);
+                priv->is_deep_sleep = 0;
                 lbs_send_confirmwake(priv);
                 break;
 
+        case MACREG_INT_CODE_DEEP_SLEEP_AWAKE:
+                if (priv->reset_deep_sleep_wakeup)
+                        priv->reset_deep_sleep_wakeup(priv);
+                lbs_deb_cmd("EVENT: ds awake\n");
+                priv->is_deep_sleep = 0;
+                priv->wakeup_dev_required = 0;
+                wake_up_interruptible(&priv->ds_awake_q);
+                break;
+
         case MACREG_INT_CODE_PS_AWAKE:
                 lbs_deb_cmd("EVENT: ps awake\n");
                 /* handle unexpected PS AWAKE event */
@@ -533,12 +447,12 @@ int lbs_process_event(struct lbs_private *priv, u32 event)
 
         case MACREG_INT_CODE_MIC_ERR_UNICAST:
                 lbs_deb_cmd("EVENT: UNICAST MIC ERROR\n");
-                handle_mic_failureevent(priv, MACREG_INT_CODE_MIC_ERR_UNICAST);
+                lbs_send_mic_failureevent(priv, event);
                 break;
 
         case MACREG_INT_CODE_MIC_ERR_MULTICAST:
                 lbs_deb_cmd("EVENT: MULTICAST MIC ERROR\n");
-                handle_mic_failureevent(priv, MACREG_INT_CODE_MIC_ERR_MULTICAST);
+                lbs_send_mic_failureevent(priv, event);
                 break;
 
         case MACREG_INT_CODE_MIB_CHANGED:
@@ -567,20 +481,8 @@ int lbs_process_event(struct lbs_private *priv, u32 event)
                 break;
 
         case MACREG_INT_CODE_MESH_AUTO_STARTED:
-                /* Ignore spurious autostart events if autostart is disabled */
-                if (!priv->mesh_autostart_enabled) {
-                        lbs_pr_info("EVENT: MESH_AUTO_STARTED (ignoring)\n");
-                        break;
-                }
-                lbs_pr_info("EVENT: MESH_AUTO_STARTED\n");
-                priv->mesh_connect_status = LBS_CONNECTED;
-                if (priv->mesh_open) {
-                        netif_carrier_on(priv->mesh_dev);
-                        if (!priv->tx_pending_len)
-                                netif_wake_queue(priv->mesh_dev);
-                }
-                priv->mode = IW_MODE_ADHOC;
-                schedule_work(&priv->sync_channel);
+                /* Ignore spurious autostart events */
+                lbs_pr_info("EVENT: MESH_AUTO_STARTED (ignoring)\n");
                 break;
 
         default:
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index 893a55ca344a..a48ccaffb288 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -4,6 +4,7 @@
 #include <linux/delay.h>
 #include <linux/mm.h>
 #include <linux/string.h>
+#include <linux/slab.h>
 #include <net/iw_handler.h>
 #include <net/lib80211.h>
 
@@ -451,10 +452,12 @@ static ssize_t lbs_rdmac_read(struct file *file, char __user *userbuf,
                                 CMD_MAC_REG_ACCESS, 0,
                                 CMD_OPTION_WAITFORRSP, 0, &offval);
         mdelay(10);
-        pos += snprintf(buf+pos, len-pos, "MAC[0x%x] = 0x%08x\n",
+        if (!ret) {
+                pos += snprintf(buf+pos, len-pos, "MAC[0x%x] = 0x%08x\n",
                                 priv->mac_offset, priv->offsetvalue.value);
 
-        ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+                ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+        }
         free_page(addr);
         return ret;
 }
@@ -514,7 +517,8 @@ static ssize_t lbs_wrmac_write(struct file *file,
                                 CMD_OPTION_WAITFORRSP, 0, &offval);
         mdelay(10);
 
-        res = count;
+        if (!res)
+                res = count;
 out_unlock:
         free_page(addr);
         return res;
@@ -539,10 +543,12 @@ static ssize_t lbs_rdbbp_read(struct file *file, char __user *userbuf,
                                 CMD_BBP_REG_ACCESS, 0,
                                 CMD_OPTION_WAITFORRSP, 0, &offval);
         mdelay(10);
-        pos += snprintf(buf+pos, len-pos, "BBP[0x%x] = 0x%08x\n",
+        if (!ret) {
+                pos += snprintf(buf+pos, len-pos, "BBP[0x%x] = 0x%08x\n",
                                 priv->bbp_offset, priv->offsetvalue.value);
 
-        ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+                ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+        }
         free_page(addr);
 
         return ret;
@@ -603,7 +609,8 @@ static ssize_t lbs_wrbbp_write(struct file *file,
                                 CMD_OPTION_WAITFORRSP, 0, &offval);
         mdelay(10);
 
-        res = count;
+        if (!res)
+                res = count;
 out_unlock:
         free_page(addr);
         return res;
@@ -628,10 +635,12 @@ static ssize_t lbs_rdrf_read(struct file *file, char __user *userbuf,
                                 CMD_RF_REG_ACCESS, 0,
                                 CMD_OPTION_WAITFORRSP, 0, &offval);
         mdelay(10);
-        pos += snprintf(buf+pos, len-pos, "RF[0x%x] = 0x%08x\n",
+        if (!ret) {
+                pos += snprintf(buf+pos, len-pos, "RF[0x%x] = 0x%08x\n",
                                 priv->rf_offset, priv->offsetvalue.value);
 
-        ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+                ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+        }
         free_page(addr);
 
         return ret;
@@ -692,7 +701,8 @@ static ssize_t lbs_wrrf_write(struct file *file,
                                 CMD_OPTION_WAITFORRSP, 0, &offval);
         mdelay(10);
 
-        res = count;
+        if (!res)
+                res = count;
 out_unlock:
         free_page(addr);
         return res;
diff --git a/drivers/net/wireless/libertas/decl.h b/drivers/net/wireless/libertas/decl.h
index 8b15380ae6e1..709ffcad22ad 100644
--- a/drivers/net/wireless/libertas/decl.h
+++ b/drivers/net/wireless/libertas/decl.h
@@ -8,71 +8,46 @@
 
 #include <linux/netdevice.h>
 
-#include "defs.h"
 
-/** Function Prototype Declaration */
 struct lbs_private;
 struct sk_buff;
 struct net_device;
-struct cmd_ctrl_node;
-struct cmd_ds_command;
 
-void lbs_set_mac_control(struct lbs_private *priv);
 
-void lbs_send_tx_feedback(struct lbs_private *priv, u32 try_count);
-
-int lbs_free_cmd_buffer(struct lbs_private *priv);
-
-int lbs_prepare_and_send_command(struct lbs_private *priv,
-        u16 cmd_no,
-        u16 cmd_action,
-        u16 wait_option, u32 cmd_oid, void *pdata_buf);
+/* ethtool.c */
+extern const struct ethtool_ops lbs_ethtool_ops;
 
-int lbs_allocate_cmd_buffer(struct lbs_private *priv);
-int lbs_execute_next_command(struct lbs_private *priv);
-int lbs_process_event(struct lbs_private *priv, u32 event);
-void lbs_queue_event(struct lbs_private *priv, u32 event);
-void lbs_notify_command_response(struct lbs_private *priv, u8 resp_idx);
 
-u32 lbs_fw_index_to_data_rate(u8 index);
-u8 lbs_data_rate_to_fw_index(u32 rate);
-
-/** The proc fs interface */
-int lbs_process_command_response(struct lbs_private *priv, u8 *data, u32 len);
-void lbs_complete_command(struct lbs_private *priv, struct cmd_ctrl_node *cmd,
-                          int result);
+/* tx.c */
+void lbs_send_tx_feedback(struct lbs_private *priv, u32 try_count);
 netdev_tx_t lbs_hard_start_xmit(struct sk_buff *skb,
                                 struct net_device *dev);
-int lbs_set_regiontable(struct lbs_private *priv, u8 region, u8 band);
 
+/* rx.c */
 int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *);
 
-void lbs_ps_sleep(struct lbs_private *priv, int wait_option);
-void lbs_ps_confirm_sleep(struct lbs_private *priv);
-void lbs_ps_wakeup(struct lbs_private *priv, int wait_option);
-
-struct chan_freq_power *lbs_find_cfp_by_band_and_channel(
-        struct lbs_private *priv,
-        u8 band,
-        u16 channel);
-
-void lbs_mac_event_disconnected(struct lbs_private *priv);
-
-void lbs_send_iwevcustom_event(struct lbs_private *priv, s8 *str);
-
-/* persistcfg.c */
-void lbs_persist_config_init(struct net_device *net);
-void lbs_persist_config_remove(struct net_device *net);
 
 /* main.c */
-struct chan_freq_power *lbs_get_region_cfp_table(u8 region,
-        int *cfp_no);
 struct lbs_private *lbs_add_card(void *card, struct device *dmdev);
 void lbs_remove_card(struct lbs_private *priv);
 int lbs_start_card(struct lbs_private *priv);
 void lbs_stop_card(struct lbs_private *priv);
 void lbs_host_to_card_done(struct lbs_private *priv);
 
-int lbs_update_channel(struct lbs_private *priv);
+int lbs_set_mac_address(struct net_device *dev, void *addr);
+void lbs_set_multicast_list(struct net_device *dev);
+
+int lbs_suspend(struct lbs_private *priv);
+void lbs_resume(struct lbs_private *priv);
+
+void lbs_queue_event(struct lbs_private *priv, u32 event);
+void lbs_notify_command_response(struct lbs_private *priv, u8 resp_idx);
+
+int lbs_enter_auto_deep_sleep(struct lbs_private *priv);
+int lbs_exit_auto_deep_sleep(struct lbs_private *priv);
+
+u32 lbs_fw_index_to_data_rate(u8 index);
+u8 lbs_data_rate_to_fw_index(u32 rate);
+
 
 #endif
diff --git a/drivers/net/wireless/libertas/defs.h b/drivers/net/wireless/libertas/defs.h
index 72f3479a4d70..ea3f10ef4e00 100644
--- a/drivers/net/wireless/libertas/defs.h
+++ b/drivers/net/wireless/libertas/defs.h
@@ -42,6 +42,7 @@
 #define LBS_DEB_SDIO    0x00400000
 #define LBS_DEB_SYSFS   0x00800000
 #define LBS_DEB_SPI     0x01000000
+#define LBS_DEB_CFG80211 0x02000000
 
 extern unsigned int lbs_debug;
 
@@ -86,6 +87,7 @@ do { if ((lbs_debug & (grp)) == (grp)) \
 #define lbs_deb_sdio(fmt, args...)      LBS_DEB_LL(LBS_DEB_SDIO, " sdio", fmt, ##args)
 #define lbs_deb_sysfs(fmt, args...)     LBS_DEB_LL(LBS_DEB_SYSFS, " sysfs", fmt, ##args)
 #define lbs_deb_spi(fmt, args...)       LBS_DEB_LL(LBS_DEB_SPI, " spi", fmt, ##args)
+#define lbs_deb_cfg80211(fmt, args...)  LBS_DEB_LL(LBS_DEB_CFG80211, " cfg80211", fmt, ##args)
 
 #define lbs_pr_info(format, args...) \
         printk(KERN_INFO DRV_NAME": " format, ## args)
@@ -320,7 +322,6 @@ static inline void lbs_deb_hex(unsigned int grp, const char *prompt, u8 *buf, in
 extern const char lbs_driver_version[];
 extern u16 lbs_region_code_to_index[MRVDRV_MAX_REGION_CODE];
 
-extern u8 lbs_bg_rates[MAX_RATES];
 
 /** ENUM definition*/
 /** SNRNF_TYPE */
@@ -396,13 +397,6 @@ enum KEY_INFO_WPA {
         KEY_INFO_WPA_ENABLED = 0x04
 };
 
-/** mesh_fw_ver */
-enum _mesh_fw_ver {
-        MESH_NONE = 0, /* MESH is not supported */
-        MESH_FW_OLD,   /* MESH is supported in FW V5 */
-        MESH_FW_NEW,   /* MESH is supported in FW V10 and newer */
-};
-
 /* Default values for fwt commands. */
 #define FWT_DEFAULT_METRIC 0
 #define FWT_DEFAULT_DIR 1
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index d3b69a4b4b5e..6875e1498bd5 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -6,75 +6,11 @@
 #ifndef _LBS_DEV_H_
 #define _LBS_DEV_H_
 
-#include <linux/netdevice.h>
-#include <linux/wireless.h>
-#include <linux/ethtool.h>
-#include <linux/debugfs.h>
+#include "mesh.h"
+#include "scan.h"
+#include "assoc.h"
 
-#include "defs.h"
-#include "hostcmd.h"
-
-extern const struct ethtool_ops lbs_ethtool_ops;
-
-#define MAX_BSSID_PER_CHANNEL           16
-
-#define NR_TX_QUEUE                     3
-
-/* For the extended Scan */
-#define MAX_EXTENDED_SCAN_BSSID_LIST    MAX_BSSID_PER_CHANNEL * \
-                                                MRVDRV_MAX_CHANNEL_SIZE + 1
-
-#define MAX_REGION_CHANNEL_NUM  2
-
-/** Chan-freq-TxPower mapping table*/
-struct chan_freq_power {
-        /** channel Number              */
-        u16 channel;
-        /** frequency of this channel   */
-        u32 freq;
-        /** Max allowed Tx power level  */
-        u16 maxtxpower;
-        /** TRUE:channel unsupported;  FLASE:supported*/
-        u8 unsupported;
-};
-
-/** region-band mapping table*/
-struct region_channel {
-        /** TRUE if this entry is valid              */
-        u8 valid;
-        /** region code for US, Japan ...            */
-        u8 region;
-        /** band B/G/A, used for BAND_CONFIG cmd             */
-        u8 band;
-        /** Actual No. of elements in the array below */
-        u8 nrcfp;
-        /** chan-freq-txpower mapping table*/
-        struct chan_freq_power *CFP;
-};
-
-struct lbs_802_11_security {
-        u8 WPAenabled;
-        u8 WPA2enabled;
-        u8 wep_enabled;
-        u8 auth_mode;
-        u32 key_mgmt;
-};
-
-/** Current Basic Service Set State Structure */
-struct current_bss_params {
-        /** bssid */
-        u8 bssid[ETH_ALEN];
-        /** ssid */
-        u8 ssid[IW_ESSID_MAX_SIZE + 1];
-        u8 ssid_len;
-
-        /** band */
-        u8 band;
-        /** channel */
-        u8 channel;
-        /** zero-terminated array of supported data rates */
-        u8 rates[MAX_RATES + 1];
-};
+#include <linux/kfifo.h>
 
 /** sleep_params */
 struct sleep_params {
@@ -86,205 +22,173 @@ struct sleep_params {
         uint16_t sp_reserved;
 };
 
-/* Mesh statistics */
-struct lbs_mesh_stats {
-        u32     fwd_bcast_cnt;          /* Fwd: Broadcast counter */
-        u32     fwd_unicast_cnt;        /* Fwd: Unicast counter */
-        u32     fwd_drop_ttl;           /* Fwd: TTL zero */
-        u32     fwd_drop_rbt;           /* Fwd: Recently Broadcasted */
-        u32     fwd_drop_noroute;       /* Fwd: No route to Destination */
-        u32     fwd_drop_nobuf;         /* Fwd: Run out of internal buffers */
-        u32     drop_blind;             /* Rx:  Dropped by blinding table */
-        u32     tx_failed_cnt;          /* Tx:  Failed transmissions */
-};
 
 /** Private structure for the MV device */
 struct lbs_private {
-        int mesh_open;
-        int mesh_fw_ver;
-        int infra_open;
-        int mesh_autostart_enabled;
-
-        char name[DEV_NAME_LEN];
 
-        void *card;
+        /* Basic networking */
         struct net_device *dev;
+        u32 connect_status;
+        int infra_open;
+        struct work_struct mcast_work;
+        u32 nr_of_multicastmacaddr;
+        u8 multicastlist[MRVDRV_MAX_MULTICAST_LIST_SIZE][ETH_ALEN];
+
+        /* CFG80211 */
+        struct wireless_dev *wdev;
+        bool wiphy_registered;
 
+        /* Mesh */
         struct net_device *mesh_dev; /* Virtual device */
+#ifdef CONFIG_LIBERTAS_MESH
+        u32 mesh_connect_status;
+        struct lbs_mesh_stats mstats;
+        int mesh_open;
+        uint16_t mesh_tlv;
+        u8 mesh_ssid[IEEE80211_MAX_SSID_LEN + 1];
+        u8 mesh_ssid_len;
+#endif
+
+        /* Monitor mode */
         struct net_device *rtap_net_dev;
+        u32 monitormode;
 
-        struct iw_statistics wstats;
-        struct lbs_mesh_stats mstats;
+        /* Debugfs */
         struct dentry *debugfs_dir;
         struct dentry *debugfs_debug;
         struct dentry *debugfs_files[6];
-
         struct dentry *events_dir;
         struct dentry *debugfs_events_files[6];
-
         struct dentry *regs_dir;
         struct dentry *debugfs_regs_files[6];
 
+        /* Hardware debugging */
         u32 mac_offset;
         u32 bbp_offset;
         u32 rf_offset;
+        struct lbs_offset_value offsetvalue;
 
-        /* Download sent:
-           bit0 1/0=data_sent/data_tx_done,
-           bit1 1/0=cmd_sent/cmd_tx_done,
-           all other bits reserved 0 */
-        u8 dnld_sent;
-
-        /** thread to service interrupts */
-        struct task_struct *main_thread;
-        wait_queue_head_t waitq;
-        struct workqueue_struct *work_thread;
+        /* Power management */
+        u16 psmode;
+        u32 psstate;
+        u8 needtowakeup;
 
-        struct work_struct mcast_work;
+        /* Deep sleep */
+        int is_deep_sleep;
+        int is_auto_deep_sleep_enabled;
+        int wakeup_dev_required;
+        int is_activity_detected;
+        int auto_deep_sleep_timeout; /* in ms */
+        wait_queue_head_t ds_awake_q;
+        struct timer_list auto_deepsleep_timer;
 
-        /** Scanning */
-        struct delayed_work scan_work;
-        struct delayed_work assoc_work;
-        struct work_struct sync_channel;
-        /* remember which channel was scanned last, != 0 if currently scanning */
-        int scan_channel;
-        u8 scan_ssid[IW_ESSID_MAX_SIZE + 1];
-        u8 scan_ssid_len;
-
-        /** Hardware access */
+        /* Hardware access */
+        void *card;
+        u8 fw_ready;
+        u8 surpriseremoved;
         int (*hw_host_to_card) (struct lbs_private *priv, u8 type, u8 *payload, u16 nb);
         void (*reset_card) (struct lbs_private *priv);
+        int (*enter_deep_sleep) (struct lbs_private *priv);
+        int (*exit_deep_sleep) (struct lbs_private *priv);
+        int (*reset_deep_sleep_wakeup) (struct lbs_private *priv);
 
-        /* Wake On LAN */
-        uint32_t wol_criteria;
-        uint8_t wol_gpio;
-        uint8_t wol_gap;
-
-        /** Wlan adapter data structure*/
-        /** STATUS variables */
+        /* Adapter info (from EEPROM) */
         u32 fwrelease;
         u32 fwcapinfo;
+        u16 regioncode;
+        u8 current_addr[ETH_ALEN];
 
-        struct mutex lock;
-
-        /* TX packet ready to be sent... */
-        int tx_pending_len;             /* -1 while building packet */
-
-        u8 tx_pending_buf[LBS_UPLD_SIZE];
-        /* protected by hard_start_xmit serialization */
-
-        /** command-related variables */
+        /* Command download */
+        u8 dnld_sent;
+        /* bit0 1/0=data_sent/data_tx_done,
+           bit1 1/0=cmd_sent/cmd_tx_done,
+           all other bits reserved 0 */
         u16 seqnum;
-
         struct cmd_ctrl_node *cmd_array;
-        /** Current command */
         struct cmd_ctrl_node *cur_cmd;
-        int cur_cmd_retcode;
-        /** command Queues */
-        /** Free command buffers */
-        struct list_head cmdfreeq;
-        /** Pending command buffers */
-        struct list_head cmdpendingq;
-
+        struct list_head cmdfreeq;    /* free command buffers */
+        struct list_head cmdpendingq; /* pending command buffers */
         wait_queue_head_t cmd_pending;
+        struct timer_list command_timer;
+        int cmd_timed_out;
 
         /* Command responses sent from the hardware to the driver */
+        int cur_cmd_retcode;
         u8 resp_idx;
         u8 resp_buf[2][LBS_UPLD_SIZE];
         u32 resp_len[2];
 
         /* Events sent from hardware to driver */
-        struct kfifo *event_fifo;
-
-        /* nickname */
-        u8 nodename[16];
-
-        /** spin locks */
-        spinlock_t driver_lock;
-
-        /** Timers */
-        struct timer_list command_timer;
-        int nr_retries;
-        int cmd_timed_out;
-
-        /** current ssid/bssid related parameters*/
-        struct current_bss_params curbssparams;
+        struct kfifo event_fifo;
 
-        uint16_t mesh_tlv;
-        u8 mesh_ssid[IW_ESSID_MAX_SIZE + 1];
-        u8 mesh_ssid_len;
-
-        /* IW_MODE_* */
-        u8 mode;
-
-        /* Scan results list */
-        struct list_head network_list;
-        struct list_head network_free_list;
-        struct bss_descriptor *networks;
-
-        u16 beacon_period;
-        u8 beacon_enable;
-        u8 adhoccreate;
-
-        /** capability Info used in Association, start, join */
-        u16 capability;
-
-        /** MAC address information */
-        u8 current_addr[ETH_ALEN];
-        u8 multicastlist[MRVDRV_MAX_MULTICAST_LIST_SIZE][ETH_ALEN];
-        u32 nr_of_multicastmacaddr;
+        /** thread to service interrupts */
+        struct task_struct *main_thread;
+        wait_queue_head_t waitq;
+        struct workqueue_struct *work_thread;
 
-        /** 802.11 statistics */
-//      struct cmd_DS_802_11_GET_STAT wlan802_11Stat;
+        /** Encryption stuff */
+        struct lbs_802_11_security secinfo;
+        struct enc_key wpa_mcast_key;
+        struct enc_key wpa_unicast_key;
+        u8 wpa_ie[MAX_WPA_IE_LEN];
+        u8 wpa_ie_len;
+        u16 wep_tx_keyidx;
+        struct enc_key wep_keys[4];
 
-        uint16_t enablehwauto;
-        uint16_t ratebitmap;
+        /* Wake On LAN */
+        uint32_t wol_criteria;
+        uint8_t wol_gpio;
+        uint8_t wol_gap;
 
+        /* Transmitting */
+        int tx_pending_len;             /* -1 while building packet */
+        u8 tx_pending_buf[LBS_UPLD_SIZE];
+        /* protected by hard_start_xmit serialization */
         u8 txretrycount;
-
-        /** Tx-related variables (for single packet tx) */
         struct sk_buff *currenttxskb;
 
-        /** NIC Operation characteristics */
+        /* Locks */
+        struct mutex lock;
+        spinlock_t driver_lock;
+
+        /* NIC/link operation characteristics */
         u16 mac_control;
-        u32 connect_status;
-        u32 mesh_connect_status;
-        u16 regioncode;
+        u8 radio_on;
+        u8 channel;
         s16 txpower_cur;
         s16 txpower_min;
         s16 txpower_max;
 
-        /** POWER MANAGEMENT AND PnP SUPPORT */
-        u8 surpriseremoved;
-
-        u16 psmode;             /* Wlan802_11PowermodeCAM=disable
-                                   Wlan802_11PowermodeMAX_PSP=enable */
-        u32 psstate;
-        u8 needtowakeup;
+        /** Scanning */
+        struct delayed_work scan_work;
+        int scan_channel;
+        /* remember which channel was scanned last, != 0 if currently scanning */
+        u8 scan_ssid[IEEE80211_MAX_SSID_LEN + 1];
+        u8 scan_ssid_len;
 
+        /* Associating */
+        struct delayed_work assoc_work;
+        struct current_bss_params curbssparams;
+        u8 mode;
+        struct list_head network_list;
+        struct list_head network_free_list;
+        struct bss_descriptor *networks;
         struct assoc_request * pending_assoc_req;
         struct assoc_request * in_progress_assoc_req;
+        uint16_t enablehwauto;
 
-        /** Encryption parameter */
-        struct lbs_802_11_security secinfo;
-
-        /** WEP keys */
-        struct enc_key wep_keys[4];
-        u16 wep_tx_keyidx;
-
-        /** WPA keys */
-        struct enc_key wpa_mcast_key;
-        struct enc_key wpa_unicast_key;
-
-/*
- * In theory, the IE is limited to the IE length, 255,
- * but in practice 64 bytes are enough.
- */
-#define MAX_WPA_IE_LEN 64
+        /* ADHOC */
+        u16 beacon_period;
+        u8 beacon_enable;
+        u8 adhoccreate;
 
-        /** WPA Information Elements*/
-        u8 wpa_ie[MAX_WPA_IE_LEN];
-        u8 wpa_ie_len;
+        /* WEXT */
+        char name[DEV_NAME_LEN];
+        u8 nodename[16];
+        struct iw_statistics wstats;
+        u8 cur_rate;
+#define MAX_REGION_CHANNEL_NUM  2
+        struct region_channel region_channel[MAX_REGION_CHANNEL_NUM];
 
         /** Requested Signal Strength*/
         u16 SNR[MAX_TYPE_B][MAX_TYPE_AVG];
@@ -294,116 +198,8 @@ struct lbs_private {
         u8 rawNF[DEFAULT_DATA_AVG_FACTOR];
         u16 nextSNRNF;
         u16 numSNRNF;
-
-        u8 radio_on;
-
-        /** data rate stuff */
-        u8 cur_rate;
-
-        /** RF calibration data */
-
-#define MAX_REGION_CHANNEL_NUM  2
-        /** region channel data */
-        struct region_channel region_channel[MAX_REGION_CHANNEL_NUM];
-
-        struct region_channel universal_channel[MAX_REGION_CHANNEL_NUM];
-
-        /** 11D and Domain Regulatory Data */
-        struct lbs_802_11d_domain_reg domainreg;
-        struct parsed_region_chan_11d parsed_region_chan;
-
-        /** FSM variable for 11d support */
-        u32 enable11d;
-
-        /**     MISCELLANEOUS */
-        struct lbs_offset_value offsetvalue;
-
-        u32 monitormode;
-        u8 fw_ready;
 };
 
 extern struct cmd_confirm_sleep confirm_sleep;
 
-/**
- *  @brief Structure used to store information for each beacon/probe response
- */
-struct bss_descriptor {
-        u8 bssid[ETH_ALEN];
-
-        u8 ssid[IW_ESSID_MAX_SIZE + 1];
-        u8 ssid_len;
-
-        u16 capability;
-        u32 rssi;
-        u32 channel;
-        u16 beaconperiod;
-        __le16 atimwindow;
-
-        /* IW_MODE_AUTO, IW_MODE_ADHOC, IW_MODE_INFRA */
-        u8 mode;
-
-        /* zero-terminated array of supported data rates */
-        u8 rates[MAX_RATES + 1];
-
-        unsigned long last_scanned;
-
-        union ieee_phy_param_set phy;
-        union ieee_ss_param_set ss;
-
-        struct ieee_ie_country_info_full_set countryinfo;
-
-        u8 wpa_ie[MAX_WPA_IE_LEN];
-        size_t wpa_ie_len;
-        u8 rsn_ie[MAX_WPA_IE_LEN];
-        size_t rsn_ie_len;
-
-        u8 mesh;
-
-        struct list_head list;
-};
-
-/** Association request
- *
- * Encapsulates all the options that describe a specific assocation request
- * or configuration of the wireless card's radio, mode, and security settings.
- */
-struct assoc_request {
-#define ASSOC_FLAG_SSID                 1
-#define ASSOC_FLAG_CHANNEL              2
-#define ASSOC_FLAG_BAND                 3
-#define ASSOC_FLAG_MODE                 4
-#define ASSOC_FLAG_BSSID                5
-#define ASSOC_FLAG_WEP_KEYS             6
-#define ASSOC_FLAG_WEP_TX_KEYIDX        7
-#define ASSOC_FLAG_WPA_MCAST_KEY        8
-#define ASSOC_FLAG_WPA_UCAST_KEY        9
-#define ASSOC_FLAG_SECINFO              10
-#define ASSOC_FLAG_WPA_IE               11
-        unsigned long flags;
-
-        u8 ssid[IW_ESSID_MAX_SIZE + 1];
-        u8 ssid_len;
-        u8 channel;
-        u8 band;
-        u8 mode;
-        u8 bssid[ETH_ALEN] __attribute__ ((aligned (2)));
-
-        /** WEP keys */
-        struct enc_key wep_keys[4];
-        u16 wep_tx_keyidx;
-
-        /** WPA keys */
-        struct enc_key wpa_mcast_key;
-        struct enc_key wpa_unicast_key;
-
-        struct lbs_802_11_security secinfo;
-
-        /** WPA Information Elements*/
-        u8 wpa_ie[MAX_WPA_IE_LEN];
-        u8 wpa_ie_len;
-
-        /* BSS to associate with for infrastructure of Ad-Hoc join */
-        struct bss_descriptor bss;
-};
-
 #endif
diff --git a/drivers/net/wireless/libertas/ethtool.c b/drivers/net/wireless/libertas/ethtool.c
index 53d56ab83c03..3804a58d7f4e 100644
--- a/drivers/net/wireless/libertas/ethtool.c
+++ b/drivers/net/wireless/libertas/ethtool.c
@@ -8,17 +8,8 @@
 #include "dev.h"
 #include "wext.h"
 #include "cmd.h"
+#include "mesh.h"
 
-static const char * mesh_stat_strings[]= {
-                        "drop_duplicate_bcast",
-                        "drop_ttl_zero",
-                        "drop_no_fwd_route",
-                        "drop_no_buffers",
-                        "fwded_unicast_cnt",
-                        "fwded_bcast_cnt",
-                        "drop_blind_table",
-                        "tx_failed_cnt"
-};
 
 static void lbs_ethtool_get_drvinfo(struct net_device *dev,
                                          struct ethtool_drvinfo *info)
@@ -73,73 +64,6 @@ out:
         return ret;
 }
 
-static void lbs_ethtool_get_stats(struct net_device *dev,
-                                  struct ethtool_stats *stats, uint64_t *data)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        struct cmd_ds_mesh_access mesh_access;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_ETHTOOL);
-
-        /* Get Mesh Statistics */
-        ret = lbs_mesh_access(priv, CMD_ACT_MESH_GET_STATS, &mesh_access);
-
-        if (ret) {
-                memset(data, 0, MESH_STATS_NUM*(sizeof(uint64_t)));
-                return;
-        }
-
-        priv->mstats.fwd_drop_rbt = le32_to_cpu(mesh_access.data[0]);
-        priv->mstats.fwd_drop_ttl = le32_to_cpu(mesh_access.data[1]);
-        priv->mstats.fwd_drop_noroute = le32_to_cpu(mesh_access.data[2]);
-        priv->mstats.fwd_drop_nobuf = le32_to_cpu(mesh_access.data[3]);
-        priv->mstats.fwd_unicast_cnt = le32_to_cpu(mesh_access.data[4]);
-        priv->mstats.fwd_bcast_cnt = le32_to_cpu(mesh_access.data[5]);
-        priv->mstats.drop_blind = le32_to_cpu(mesh_access.data[6]);
-        priv->mstats.tx_failed_cnt = le32_to_cpu(mesh_access.data[7]);
-
-        data[0] = priv->mstats.fwd_drop_rbt;
-        data[1] = priv->mstats.fwd_drop_ttl;
-        data[2] = priv->mstats.fwd_drop_noroute;
-        data[3] = priv->mstats.fwd_drop_nobuf;
-        data[4] = priv->mstats.fwd_unicast_cnt;
-        data[5] = priv->mstats.fwd_bcast_cnt;
-        data[6] = priv->mstats.drop_blind;
-        data[7] = priv->mstats.tx_failed_cnt;
-
-        lbs_deb_enter(LBS_DEB_ETHTOOL);
-}
-
-static int lbs_ethtool_get_sset_count(struct net_device *dev, int sset)
-{
-        struct lbs_private *priv = dev->ml_priv;
-
-        if (sset == ETH_SS_STATS && dev == priv->mesh_dev)
-                return MESH_STATS_NUM;
-
-        return -EOPNOTSUPP;
-}
-
-static void lbs_ethtool_get_strings(struct net_device *dev,
-                                    uint32_t stringset, uint8_t *s)
-{
-        int i;
-
-        lbs_deb_enter(LBS_DEB_ETHTOOL);
-
-        switch (stringset) {
-        case ETH_SS_STATS:
-                for (i=0; i < MESH_STATS_NUM; i++) {
-                        memcpy(s + i * ETH_GSTRING_LEN,
-                                        mesh_stat_strings[i],
-                                        ETH_GSTRING_LEN);
-                }
-                break;
-        }
-        lbs_deb_enter(LBS_DEB_ETHTOOL);
-}
-
 static void lbs_ethtool_get_wol(struct net_device *dev,
                                 struct ethtool_wolinfo *wol)
 {
@@ -190,9 +114,11 @@ const struct ethtool_ops lbs_ethtool_ops = {
         .get_drvinfo = lbs_ethtool_get_drvinfo,
         .get_eeprom =  lbs_ethtool_get_eeprom,
         .get_eeprom_len = lbs_ethtool_get_eeprom_len,
-        .get_sset_count = lbs_ethtool_get_sset_count,
-        .get_ethtool_stats = lbs_ethtool_get_stats,
-        .get_strings = lbs_ethtool_get_strings,
+#ifdef CONFIG_LIBERTAS_MESH
+        .get_sset_count = lbs_mesh_ethtool_get_sset_count,
+        .get_ethtool_stats = lbs_mesh_ethtool_get_stats,
+        .get_strings = lbs_mesh_ethtool_get_strings,
+#endif
         .get_wol = lbs_ethtool_get_wol,
         .set_wol = lbs_ethtool_set_wol,
 };
diff --git a/drivers/net/wireless/libertas/host.h b/drivers/net/wireless/libertas/host.h
index fe8f0cb737bc..3809c0b49464 100644
--- a/drivers/net/wireless/libertas/host.h
+++ b/drivers/net/wireless/libertas/host.h
@@ -1,201 +1,190 @@
 /**
-  * This file contains definitions of WLAN commands.
+  * This file function prototypes, data structure
+  * and  definitions for all the host/station commands
   */
 
 #ifndef _LBS_HOST_H_
 #define _LBS_HOST_H_
 
-/** PUBLIC DEFINITIONS */
-#define DEFAULT_AD_HOC_CHANNEL                  6
-#define DEFAULT_AD_HOC_CHANNEL_A                36
+#include "types.h"
+#include "defs.h"
 
-#define CMD_OPTION_WAITFORRSP                   0x0002
+#define DEFAULT_AD_HOC_CHANNEL                  6
+
+#define CMD_OPTION_WAITFORRSP                   0x0002
 
 /** Host command IDs */
 
 /* Return command are almost always the same as the host command, but with
  * bit 15 set high.  There are a few exceptions, though...
  */
-#define CMD_RET(cmd)                    (0x8000 | cmd)
+#define CMD_RET(cmd)                            (0x8000 | cmd)
 
 /* Return command convention exceptions: */
-#define CMD_RET_802_11_ASSOCIATE                0x8012
+#define CMD_RET_802_11_ASSOCIATE                0x8012
 
 /* Command codes */
-#define CMD_GET_HW_SPEC                         0x0003
-#define CMD_EEPROM_UPDATE                       0x0004
-#define CMD_802_11_RESET                        0x0005
-#define CMD_802_11_SCAN                         0x0006
-#define CMD_802_11_GET_LOG                      0x000b
-#define CMD_MAC_MULTICAST_ADR                   0x0010
-#define CMD_802_11_AUTHENTICATE                 0x0011
-#define CMD_802_11_EEPROM_ACCESS                0x0059
-#define CMD_802_11_ASSOCIATE                    0x0050
-#define CMD_802_11_SET_WEP                      0x0013
-#define CMD_802_11_GET_STAT                     0x0014
-#define CMD_802_3_GET_STAT                      0x0015
-#define CMD_802_11_SNMP_MIB                     0x0016
-#define CMD_MAC_REG_MAP                         0x0017
-#define CMD_BBP_REG_MAP                         0x0018
-#define CMD_MAC_REG_ACCESS                      0x0019
-#define CMD_BBP_REG_ACCESS                      0x001a
-#define CMD_RF_REG_ACCESS                       0x001b
-#define CMD_802_11_RADIO_CONTROL                0x001c
-#define CMD_802_11_RF_CHANNEL                   0x001d
-#define CMD_802_11_RF_TX_POWER                  0x001e
-#define CMD_802_11_RSSI                         0x001f
-#define CMD_802_11_RF_ANTENNA                   0x0020
-#define CMD_802_11_PS_MODE                      0x0021
-#define CMD_802_11_DATA_RATE                    0x0022
-#define CMD_RF_REG_MAP                          0x0023
-#define CMD_802_11_DEAUTHENTICATE               0x0024
-#define CMD_802_11_REASSOCIATE                  0x0025
-#define CMD_MAC_CONTROL                         0x0028
-#define CMD_802_11_AD_HOC_START                 0x002b
-#define CMD_802_11_AD_HOC_JOIN                  0x002c
-#define CMD_802_11_QUERY_TKIP_REPLY_CNTRS       0x002e
-#define CMD_802_11_ENABLE_RSN                   0x002f
-#define CMD_802_11_SET_AFC                      0x003c
-#define CMD_802_11_GET_AFC                      0x003d
-#define CMD_802_11_AD_HOC_STOP                  0x0040
-#define CMD_802_11_HOST_SLEEP_CFG               0x0043
-#define CMD_802_11_WAKEUP_CONFIRM               0x0044
-#define CMD_802_11_HOST_SLEEP_ACTIVATE          0x0045
-#define CMD_802_11_BEACON_STOP                  0x0049
-#define CMD_802_11_MAC_ADDRESS                  0x004d
-#define CMD_802_11_LED_GPIO_CTRL                0x004e
-#define CMD_802_11_EEPROM_ACCESS                0x0059
-#define CMD_802_11_BAND_CONFIG                  0x0058
-#define CMD_GSPI_BUS_CONFIG                     0x005a
-#define CMD_802_11D_DOMAIN_INFO                 0x005b
-#define CMD_802_11_KEY_MATERIAL                 0x005e
-#define CMD_802_11_SLEEP_PARAMS                 0x0066
-#define CMD_802_11_INACTIVITY_TIMEOUT           0x0067
-#define CMD_802_11_SLEEP_PERIOD                 0x0068
-#define CMD_802_11_TPC_CFG                      0x0072
-#define CMD_802_11_PA_CFG                       0x0073
-#define CMD_802_11_FW_WAKE_METHOD               0x0074
-#define CMD_802_11_SUBSCRIBE_EVENT              0x0075
-#define CMD_802_11_RATE_ADAPT_RATESET           0x0076
-#define CMD_802_11_TX_RATE_QUERY                0x007f
-#define CMD_GET_TSF                             0x0080
-#define CMD_BT_ACCESS                           0x0087
-#define CMD_FWT_ACCESS                          0x0095
-#define CMD_802_11_MONITOR_MODE                 0x0098
-#define CMD_MESH_ACCESS                         0x009b
-#define CMD_MESH_CONFIG_OLD                     0x00a3
-#define CMD_MESH_CONFIG                         0x00ac
-#define CMD_SET_BOOT2_VER                       0x00a5
-#define CMD_FUNC_INIT                           0x00a9
-#define CMD_FUNC_SHUTDOWN                       0x00aa
-#define CMD_802_11_BEACON_CTRL                  0x00b0
+#define CMD_GET_HW_SPEC                         0x0003
+#define CMD_EEPROM_UPDATE                       0x0004
+#define CMD_802_11_RESET                        0x0005
+#define CMD_802_11_SCAN                         0x0006
+#define CMD_802_11_GET_LOG                      0x000b
+#define CMD_MAC_MULTICAST_ADR                   0x0010
+#define CMD_802_11_AUTHENTICATE                 0x0011
+#define CMD_802_11_EEPROM_ACCESS                0x0059
+#define CMD_802_11_ASSOCIATE                    0x0050
+#define CMD_802_11_SET_WEP                      0x0013
+#define CMD_802_11_GET_STAT                     0x0014
+#define CMD_802_3_GET_STAT                      0x0015
+#define CMD_802_11_SNMP_MIB                     0x0016
+#define CMD_MAC_REG_MAP                         0x0017
+#define CMD_BBP_REG_MAP                         0x0018
+#define CMD_MAC_REG_ACCESS                      0x0019
+#define CMD_BBP_REG_ACCESS                      0x001a
+#define CMD_RF_REG_ACCESS                       0x001b
+#define CMD_802_11_RADIO_CONTROL                0x001c
+#define CMD_802_11_RF_CHANNEL                   0x001d
+#define CMD_802_11_RF_TX_POWER                  0x001e
+#define CMD_802_11_RSSI                         0x001f
+#define CMD_802_11_RF_ANTENNA                   0x0020
+#define CMD_802_11_PS_MODE                      0x0021
+#define CMD_802_11_DATA_RATE                    0x0022
+#define CMD_RF_REG_MAP                          0x0023
+#define CMD_802_11_DEAUTHENTICATE               0x0024
+#define CMD_802_11_REASSOCIATE                  0x0025
+#define CMD_MAC_CONTROL                         0x0028
+#define CMD_802_11_AD_HOC_START                 0x002b
+#define CMD_802_11_AD_HOC_JOIN                  0x002c
+#define CMD_802_11_QUERY_TKIP_REPLY_CNTRS       0x002e
+#define CMD_802_11_ENABLE_RSN                   0x002f
+#define CMD_802_11_SET_AFC                      0x003c
+#define CMD_802_11_GET_AFC                      0x003d
+#define CMD_802_11_DEEP_SLEEP                   0x003e
+#define CMD_802_11_AD_HOC_STOP                  0x0040
+#define CMD_802_11_HOST_SLEEP_CFG               0x0043
+#define CMD_802_11_WAKEUP_CONFIRM               0x0044
+#define CMD_802_11_HOST_SLEEP_ACTIVATE          0x0045
+#define CMD_802_11_BEACON_STOP                  0x0049
+#define CMD_802_11_MAC_ADDRESS                  0x004d
+#define CMD_802_11_LED_GPIO_CTRL                0x004e
+#define CMD_802_11_EEPROM_ACCESS                0x0059
+#define CMD_802_11_BAND_CONFIG                  0x0058
+#define CMD_GSPI_BUS_CONFIG                     0x005a
+#define CMD_802_11D_DOMAIN_INFO                 0x005b
+#define CMD_802_11_KEY_MATERIAL                 0x005e
+#define CMD_802_11_SLEEP_PARAMS                 0x0066
+#define CMD_802_11_INACTIVITY_TIMEOUT           0x0067
+#define CMD_802_11_SLEEP_PERIOD                 0x0068
+#define CMD_802_11_TPC_CFG                      0x0072
+#define CMD_802_11_PA_CFG                       0x0073
+#define CMD_802_11_FW_WAKE_METHOD               0x0074
+#define CMD_802_11_SUBSCRIBE_EVENT              0x0075
+#define CMD_802_11_RATE_ADAPT_RATESET           0x0076
+#define CMD_802_11_TX_RATE_QUERY                0x007f
+#define CMD_GET_TSF                             0x0080
+#define CMD_BT_ACCESS                           0x0087
+#define CMD_FWT_ACCESS                          0x0095
+#define CMD_802_11_MONITOR_MODE                 0x0098
+#define CMD_MESH_ACCESS                         0x009b
+#define CMD_MESH_CONFIG_OLD                     0x00a3
+#define CMD_MESH_CONFIG                         0x00ac
+#define CMD_SET_BOOT2_VER                       0x00a5
+#define CMD_FUNC_INIT                           0x00a9
+#define CMD_FUNC_SHUTDOWN                       0x00aa
+#define CMD_802_11_BEACON_CTRL                  0x00b0
 
 /* For the IEEE Power Save */
-#define CMD_SUBCMD_ENTER_PS             0x0030
-#define CMD_SUBCMD_EXIT_PS              0x0031
-#define CMD_SUBCMD_SLEEP_CONFIRMED      0x0034
-#define CMD_SUBCMD_FULL_POWERDOWN       0x0035
-#define CMD_SUBCMD_FULL_POWERUP         0x0036
+#define CMD_SUBCMD_ENTER_PS                     0x0030
+#define CMD_SUBCMD_EXIT_PS                      0x0031
+#define CMD_SUBCMD_SLEEP_CONFIRMED              0x0034
+#define CMD_SUBCMD_FULL_POWERDOWN               0x0035
+#define CMD_SUBCMD_FULL_POWERUP                 0x0036
 
-#define CMD_ENABLE_RSN                  0x0001
-#define CMD_DISABLE_RSN                 0x0000
+#define CMD_ENABLE_RSN                          0x0001
+#define CMD_DISABLE_RSN                         0x0000
 
-#define CMD_ACT_GET                     0x0000
-#define CMD_ACT_SET                     0x0001
-#define CMD_ACT_GET_AES                 0x0002
-#define CMD_ACT_SET_AES                 0x0003
-#define CMD_ACT_REMOVE_AES              0x0004
+#define CMD_ACT_GET                             0x0000
+#define CMD_ACT_SET                             0x0001
 
 /* Define action or option for CMD_802_11_SET_WEP */
-#define CMD_ACT_ADD                     0x0002
-#define CMD_ACT_REMOVE                  0x0004
-#define CMD_ACT_USE_DEFAULT             0x0008
-
-#define CMD_TYPE_WEP_40_BIT             0x01
-#define CMD_TYPE_WEP_104_BIT            0x02
+#define CMD_ACT_ADD                             0x0002
+#define CMD_ACT_REMOVE                          0x0004
 
-#define CMD_NUM_OF_WEP_KEYS             4
+#define CMD_TYPE_WEP_40_BIT                     0x01
+#define CMD_TYPE_WEP_104_BIT                    0x02
 
-#define CMD_WEP_KEY_INDEX_MASK          0x3fff
+#define CMD_NUM_OF_WEP_KEYS                     4
 
-/* Define action or option for CMD_802_11_RESET */
-#define CMD_ACT_HALT                    0x0003
+#define CMD_WEP_KEY_INDEX_MASK                  0x3fff
 
 /* Define action or option for CMD_802_11_SCAN */
-#define CMD_BSS_TYPE_BSS                0x0001
-#define CMD_BSS_TYPE_IBSS               0x0002
-#define CMD_BSS_TYPE_ANY                0x0003
+#define CMD_BSS_TYPE_BSS                        0x0001
+#define CMD_BSS_TYPE_IBSS                       0x0002
+#define CMD_BSS_TYPE_ANY                        0x0003
 
 /* Define action or option for CMD_802_11_SCAN */
-#define CMD_SCAN_TYPE_ACTIVE            0x0000
-#define CMD_SCAN_TYPE_PASSIVE           0x0001
+#define CMD_SCAN_TYPE_ACTIVE                    0x0000
+#define CMD_SCAN_TYPE_PASSIVE                   0x0001
 
-#define CMD_SCAN_RADIO_TYPE_BG          0
+#define CMD_SCAN_RADIO_TYPE_BG                  0
 
-#define CMD_SCAN_PROBE_DELAY_TIME       0
+#define CMD_SCAN_PROBE_DELAY_TIME               0
 
 /* Define action or option for CMD_MAC_CONTROL */
-#define CMD_ACT_MAC_RX_ON                       0x0001
-#define CMD_ACT_MAC_TX_ON                       0x0002
-#define CMD_ACT_MAC_LOOPBACK_ON                 0x0004
-#define CMD_ACT_MAC_WEP_ENABLE                  0x0008
-#define CMD_ACT_MAC_INT_ENABLE                  0x0010
-#define CMD_ACT_MAC_MULTICAST_ENABLE            0x0020
-#define CMD_ACT_MAC_BROADCAST_ENABLE            0x0040
-#define CMD_ACT_MAC_PROMISCUOUS_ENABLE          0x0080
-#define CMD_ACT_MAC_ALL_MULTICAST_ENABLE        0x0100
-#define CMD_ACT_MAC_STRICT_PROTECTION_ENABLE    0x0400
+#define CMD_ACT_MAC_RX_ON                       0x0001
+#define CMD_ACT_MAC_TX_ON                       0x0002
+#define CMD_ACT_MAC_LOOPBACK_ON                 0x0004
+#define CMD_ACT_MAC_WEP_ENABLE                  0x0008
+#define CMD_ACT_MAC_INT_ENABLE                  0x0010
+#define CMD_ACT_MAC_MULTICAST_ENABLE            0x0020
+#define CMD_ACT_MAC_BROADCAST_ENABLE            0x0040
+#define CMD_ACT_MAC_PROMISCUOUS_ENABLE          0x0080
+#define CMD_ACT_MAC_ALL_MULTICAST_ENABLE        0x0100
+#define CMD_ACT_MAC_STRICT_PROTECTION_ENABLE    0x0400
 
 /* Event flags for CMD_802_11_SUBSCRIBE_EVENT */
-#define CMD_SUBSCRIBE_RSSI_LOW          0x0001
-#define CMD_SUBSCRIBE_SNR_LOW           0x0002
-#define CMD_SUBSCRIBE_FAILCOUNT         0x0004
-#define CMD_SUBSCRIBE_BCNMISS           0x0008
-#define CMD_SUBSCRIBE_RSSI_HIGH         0x0010
-#define CMD_SUBSCRIBE_SNR_HIGH          0x0020
+#define CMD_SUBSCRIBE_RSSI_LOW                  0x0001
+#define CMD_SUBSCRIBE_SNR_LOW                   0x0002
+#define CMD_SUBSCRIBE_FAILCOUNT                 0x0004
+#define CMD_SUBSCRIBE_BCNMISS                   0x0008
+#define CMD_SUBSCRIBE_RSSI_HIGH                 0x0010
+#define CMD_SUBSCRIBE_SNR_HIGH                  0x0020
 
-#define RADIO_PREAMBLE_LONG     0x00
-#define RADIO_PREAMBLE_SHORT    0x02
-#define RADIO_PREAMBLE_AUTO     0x04
+#define RADIO_PREAMBLE_LONG                     0x00
+#define RADIO_PREAMBLE_SHORT                    0x02
+#define RADIO_PREAMBLE_AUTO                     0x04
 
 /* Define action or option for CMD_802_11_RF_CHANNEL */
-#define CMD_OPT_802_11_RF_CHANNEL_GET   0x00
-#define CMD_OPT_802_11_RF_CHANNEL_SET   0x01
+#define CMD_OPT_802_11_RF_CHANNEL_GET           0x00
+#define CMD_OPT_802_11_RF_CHANNEL_SET           0x01
 
 /* Define action or option for CMD_802_11_DATA_RATE */
-#define CMD_ACT_SET_TX_AUTO             0x0000
-#define CMD_ACT_SET_TX_FIX_RATE         0x0001
-#define CMD_ACT_GET_TX_RATE             0x0002
-
-#define CMD_ACT_SET_RX                  0x0001
-#define CMD_ACT_SET_TX                  0x0002
-#define CMD_ACT_SET_BOTH                0x0003
-#define CMD_ACT_GET_RX                  0x0004
-#define CMD_ACT_GET_TX                  0x0008
-#define CMD_ACT_GET_BOTH                0x000c
+#define CMD_ACT_SET_TX_AUTO                     0x0000
+#define CMD_ACT_SET_TX_FIX_RATE                 0x0001
+#define CMD_ACT_GET_TX_RATE                     0x0002
 
 /* Define action or option for CMD_802_11_PS_MODE */
-#define CMD_TYPE_CAM                    0x0000
-#define CMD_TYPE_MAX_PSP                0x0001
-#define CMD_TYPE_FAST_PSP               0x0002
+#define CMD_TYPE_CAM                            0x0000
+#define CMD_TYPE_MAX_PSP                        0x0001
+#define CMD_TYPE_FAST_PSP                       0x0002
 
 /* Options for CMD_802_11_FW_WAKE_METHOD */
-#define CMD_WAKE_METHOD_UNCHANGED       0x0000
-#define CMD_WAKE_METHOD_COMMAND_INT     0x0001
-#define CMD_WAKE_METHOD_GPIO            0x0002
+#define CMD_WAKE_METHOD_UNCHANGED               0x0000
+#define CMD_WAKE_METHOD_COMMAND_INT             0x0001
+#define CMD_WAKE_METHOD_GPIO                    0x0002
 
 /* Object IDs for CMD_802_11_SNMP_MIB */
-#define SNMP_MIB_OID_BSS_TYPE           0x0000
-#define SNMP_MIB_OID_OP_RATE_SET        0x0001
-#define SNMP_MIB_OID_BEACON_PERIOD      0x0002  /* Reserved on v9+ */
-#define SNMP_MIB_OID_DTIM_PERIOD        0x0003  /* Reserved on v9+ */
-#define SNMP_MIB_OID_ASSOC_TIMEOUT      0x0004  /* Reserved on v9+ */
-#define SNMP_MIB_OID_RTS_THRESHOLD      0x0005
-#define SNMP_MIB_OID_SHORT_RETRY_LIMIT  0x0006
-#define SNMP_MIB_OID_LONG_RETRY_LIMIT   0x0007
-#define SNMP_MIB_OID_FRAG_THRESHOLD     0x0008
-#define SNMP_MIB_OID_11D_ENABLE         0x0009
-#define SNMP_MIB_OID_11H_ENABLE         0x000A
+#define SNMP_MIB_OID_BSS_TYPE                   0x0000
+#define SNMP_MIB_OID_OP_RATE_SET                0x0001
+#define SNMP_MIB_OID_BEACON_PERIOD              0x0002  /* Reserved on v9+ */
+#define SNMP_MIB_OID_DTIM_PERIOD                0x0003  /* Reserved on v9+ */
+#define SNMP_MIB_OID_ASSOC_TIMEOUT              0x0004  /* Reserved on v9+ */
+#define SNMP_MIB_OID_RTS_THRESHOLD              0x0005
+#define SNMP_MIB_OID_SHORT_RETRY_LIMIT          0x0006
+#define SNMP_MIB_OID_LONG_RETRY_LIMIT           0x0007
+#define SNMP_MIB_OID_FRAG_THRESHOLD             0x0008
+#define SNMP_MIB_OID_11D_ENABLE                 0x0009
+#define SNMP_MIB_OID_11H_ENABLE                 0x000A
 
 /* Define action or option for CMD_BT_ACCESS */
 enum cmd_bt_access_opts {
@@ -302,4 +291,672 @@ enum cmd_mesh_config_types {
 #define MACREG_INT_CODE_MESH_AUTO_STARTED       35
 #define MACREG_INT_CODE_FIRMWARE_READY          48
 
+
+/* 802.11-related definitions */
+
+/* TxPD descriptor */
+struct txpd {
+        /* union to cope up with later FW revisions */
+        union {
+                /* Current Tx packet status */
+                __le32 tx_status;
+                struct {
+                        /* BSS type: client, AP, etc. */
+                        u8 bss_type;
+                        /* BSS number */
+                        u8 bss_num;
+                        /* Reserved */
+                        __le16 reserved;
+                } bss;
+        } u;
+        /* Tx control */
+        __le32 tx_control;
+        __le32 tx_packet_location;
+        /* Tx packet length */
+        __le16 tx_packet_length;
+        /* First 2 byte of destination MAC address */
+        u8 tx_dest_addr_high[2];
+        /* Last 4 byte of destination MAC address */
+        u8 tx_dest_addr_low[4];
+        /* Pkt Priority */
+        u8 priority;
+        /* Pkt Trasnit Power control */
+        u8 powermgmt;
+        /* Amount of time the packet has been queued (units = 2ms) */
+        u8 pktdelay_2ms;
+        /* reserved */
+        u8 reserved1;
+} __attribute__ ((packed));
+
+/* RxPD Descriptor */
+struct rxpd {
+        /* union to cope up with later FW revisions */
+        union {
+                /* Current Rx packet status */
+                __le16 status;
+                struct {
+                        /* BSS type: client, AP, etc. */
+                        u8 bss_type;
+                        /* BSS number */
+                        u8 bss_num;
+                } __attribute__ ((packed)) bss;
+        } __attribute__ ((packed)) u;
+
+        /* SNR */
+        u8 snr;
+
+        /* Tx control */
+        u8 rx_control;
+
+        /* Pkt length */
+        __le16 pkt_len;
+
+        /* Noise Floor */
+        u8 nf;
+
+        /* Rx Packet Rate */
+        u8 rx_rate;
+
+        /* Pkt addr */
+        __le32 pkt_ptr;
+
+        /* Next Rx RxPD addr */
+        __le32 next_rxpd_ptr;
+
+        /* Pkt Priority */
+        u8 priority;
+        u8 reserved[3];
+} __attribute__ ((packed));
+
+struct cmd_header {
+        __le16 command;
+        __le16 size;
+        __le16 seqnum;
+        __le16 result;
+} __attribute__ ((packed));
+
+/* Generic structure to hold all key types. */
+struct enc_key {
+        u16 len;
+        u16 flags;  /* KEY_INFO_* from defs.h */
+        u16 type; /* KEY_TYPE_* from defs.h */
+        u8 key[32];
+};
+
+/* lbs_offset_value */
+struct lbs_offset_value {
+        u32 offset;
+        u32 value;
+} __attribute__ ((packed));
+
+/*
+ * Define data structure for CMD_GET_HW_SPEC
+ * This structure defines the response for the GET_HW_SPEC command
+ */
+struct cmd_ds_get_hw_spec {
+        struct cmd_header hdr;
+
+        /* HW Interface version number */
+        __le16 hwifversion;
+        /* HW version number */
+        __le16 version;
+        /* Max number of TxPD FW can handle */
+        __le16 nr_txpd;
+        /* Max no of Multicast address */
+        __le16 nr_mcast_adr;
+        /* MAC address */
+        u8 permanentaddr[6];
+
+        /* region Code */
+        __le16 regioncode;
+
+        /* Number of antenna used */
+        __le16 nr_antenna;
+
+        /* FW release number, example 0x01030304 = 2.3.4p1 */
+        __le32 fwrelease;
+
+        /* Base Address of TxPD queue */
+        __le32 wcb_base;
+        /* Read Pointer of RxPd queue */
+        __le32 rxpd_rdptr;
+
+        /* Write Pointer of RxPd queue */
+        __le32 rxpd_wrptr;
+
+        /*FW/HW capability */
+        __le32 fwcapinfo;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_subscribe_event {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 events;
+
+        /* A TLV to the CMD_802_11_SUBSCRIBE_EVENT command can contain a
+         * number of TLVs. From the v5.1 manual, those TLVs would add up to
+         * 40 bytes. However, future firmware might add additional TLVs, so I
+         * bump this up a bit.
+         */
+        uint8_t tlv[128];
+} __attribute__ ((packed));
+
+/*
+ * This scan handle Country Information IE(802.11d compliant)
+ * Define data structure for CMD_802_11_SCAN
+ */
+struct cmd_ds_802_11_scan {
+        struct cmd_header hdr;
+
+        uint8_t bsstype;
+        uint8_t bssid[ETH_ALEN];
+        uint8_t tlvbuffer[0];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_scan_rsp {
+        struct cmd_header hdr;
+
+        __le16 bssdescriptsize;
+        uint8_t nr_sets;
+        uint8_t bssdesc_and_tlvbuffer[0];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_get_log {
+        struct cmd_header hdr;
+
+        __le32 mcasttxframe;
+        __le32 failed;
+        __le32 retry;
+        __le32 multiretry;
+        __le32 framedup;
+        __le32 rtssuccess;
+        __le32 rtsfailure;
+        __le32 ackfailure;
+        __le32 rxfrag;
+        __le32 mcastrxframe;
+        __le32 fcserror;
+        __le32 txframe;
+        __le32 wepundecryptable;
+} __attribute__ ((packed));
+
+struct cmd_ds_mac_control {
+        struct cmd_header hdr;
+        __le16 action;
+        u16 reserved;
+} __attribute__ ((packed));
+
+struct cmd_ds_mac_multicast_adr {
+        struct cmd_header hdr;
+        __le16 action;
+        __le16 nr_of_adrs;
+        u8 maclist[ETH_ALEN * MRVDRV_MAX_MULTICAST_LIST_SIZE];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_authenticate {
+        struct cmd_header hdr;
+
+        u8 bssid[ETH_ALEN];
+        u8 authtype;
+        u8 reserved[10];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_deauthenticate {
+        struct cmd_header hdr;
+
+        u8 macaddr[ETH_ALEN];
+        __le16 reasoncode;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_associate {
+        struct cmd_header hdr;
+
+        u8 bssid[6];
+        __le16 capability;
+        __le16 listeninterval;
+        __le16 bcnperiod;
+        u8 dtimperiod;
+        u8 iebuf[512];    /* Enough for required and most optional IEs */
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_associate_response {
+        struct cmd_header hdr;
+
+        __le16 capability;
+        __le16 statuscode;
+        __le16 aid;
+        u8 iebuf[512];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_set_wep {
+        struct cmd_header hdr;
+
+        /* ACT_ADD, ACT_REMOVE or ACT_ENABLE */
+        __le16 action;
+
+        /* key Index selected for Tx */
+        __le16 keyindex;
+
+        /* 40, 128bit or TXWEP */
+        uint8_t keytype[4];
+        uint8_t keymaterial[4][16];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_snmp_mib {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 oid;
+        __le16 bufsize;
+        u8 value[128];
+} __attribute__ ((packed));
+
+struct cmd_ds_mac_reg_access {
+        __le16 action;
+        __le16 offset;
+        __le32 value;
+} __attribute__ ((packed));
+
+struct cmd_ds_bbp_reg_access {
+        __le16 action;
+        __le16 offset;
+        u8 value;
+        u8 reserved[3];
+} __attribute__ ((packed));
+
+struct cmd_ds_rf_reg_access {
+        __le16 action;
+        __le16 offset;
+        u8 value;
+        u8 reserved[3];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_radio_control {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 control;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_beacon_control {
+        __le16 action;
+        __le16 beacon_enable;
+        __le16 beacon_period;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_sleep_params {
+        struct cmd_header hdr;
+
+        /* ACT_GET/ACT_SET */
+        __le16 action;
+
+        /* Sleep clock error in ppm */
+        __le16 error;
+
+        /* Wakeup offset in usec */
+        __le16 offset;
+
+        /* Clock stabilization time in usec */
+        __le16 stabletime;
+
+        /* control periodic calibration */
+        uint8_t calcontrol;
+
+        /* control the use of external sleep clock */
+        uint8_t externalsleepclk;
+
+        /* reserved field, should be set to zero */
+        __le16 reserved;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_rf_channel {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 channel;
+        __le16 rftype;      /* unused */
+        __le16 reserved;    /* unused */
+        u8 channellist[32]; /* unused */
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_rssi {
+        /* weighting factor */
+        __le16 N;
+
+        __le16 reserved_0;
+        __le16 reserved_1;
+        __le16 reserved_2;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_rssi_rsp {
+        __le16 SNR;
+        __le16 noisefloor;
+        __le16 avgSNR;
+        __le16 avgnoisefloor;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_mac_address {
+        struct cmd_header hdr;
+
+        __le16 action;
+        u8 macadd[ETH_ALEN];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_rf_tx_power {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 curlevel;
+        s8 maxlevel;
+        s8 minlevel;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_monitor_mode {
+        __le16 action;
+        __le16 mode;
+} __attribute__ ((packed));
+
+struct cmd_ds_set_boot2_ver {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 version;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_fw_wake_method {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 method;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_ps_mode {
+        __le16 action;
+        __le16 nullpktinterval;
+        __le16 multipledtim;
+        __le16 reserved;
+        __le16 locallisteninterval;
+} __attribute__ ((packed));
+
+struct cmd_confirm_sleep {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 nullpktinterval;
+        __le16 multipledtim;
+        __le16 reserved;
+        __le16 locallisteninterval;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_data_rate {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 reserved;
+        u8 rates[MAX_RATES];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_rate_adapt_rateset {
+        struct cmd_header hdr;
+        __le16 action;
+        __le16 enablehwauto;
+        __le16 bitmap;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_ad_hoc_start {
+        struct cmd_header hdr;
+
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 bsstype;
+        __le16 beaconperiod;
+        u8 dtimperiod;   /* Reserved on v9 and later */
+        struct ieee_ie_ibss_param_set ibss;
+        u8 reserved1[4];
+        struct ieee_ie_ds_param_set ds;
+        u8 reserved2[4];
+        __le16 probedelay;  /* Reserved on v9 and later */
+        __le16 capability;
+        u8 rates[MAX_RATES];
+        u8 tlv_memory_size_pad[100];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_ad_hoc_result {
+        struct cmd_header hdr;
+
+        u8 pad[3];
+        u8 bssid[ETH_ALEN];
+} __attribute__ ((packed));
+
+struct adhoc_bssdesc {
+        u8 bssid[ETH_ALEN];
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 type;
+        __le16 beaconperiod;
+        u8 dtimperiod;
+        __le64 timestamp;
+        __le64 localtime;
+        struct ieee_ie_ds_param_set ds;
+        u8 reserved1[4];
+        struct ieee_ie_ibss_param_set ibss;
+        u8 reserved2[4];
+        __le16 capability;
+        u8 rates[MAX_RATES];
+
+        /* DO NOT ADD ANY FIELDS TO THIS STRUCTURE. It is used below in the
+         * Adhoc join command and will cause a binary layout mismatch with
+         * the firmware
+         */
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_ad_hoc_join {
+        struct cmd_header hdr;
+
+        struct adhoc_bssdesc bss;
+        __le16 failtimeout;   /* Reserved on v9 and later */
+        __le16 probedelay;    /* Reserved on v9 and later */
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_ad_hoc_stop {
+        struct cmd_header hdr;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_enable_rsn {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 enable;
+} __attribute__ ((packed));
+
+struct MrvlIEtype_keyParamSet {
+        /* type ID */
+        __le16 type;
+
+        /* length of Payload */
+        __le16 length;
+
+        /* type of key: WEP=0, TKIP=1, AES=2 */
+        __le16 keytypeid;
+
+        /* key control Info specific to a keytypeid */
+        __le16 keyinfo;
+
+        /* length of key */
+        __le16 keylen;
+
+        /* key material of size keylen */
+        u8 key[32];
+} __attribute__ ((packed));
+
+#define MAX_WOL_RULES           16
+
+struct host_wol_rule {
+        uint8_t rule_no;
+        uint8_t rule_ops;
+        __le16 sig_offset;
+        __le16 sig_length;
+        __le16 reserve;
+        __be32 sig_mask;
+        __be32 signature;
+} __attribute__ ((packed));
+
+struct wol_config {
+        uint8_t action;
+        uint8_t pattern;
+        uint8_t no_rules_in_cmd;
+        uint8_t result;
+        struct host_wol_rule rule[MAX_WOL_RULES];
+} __attribute__ ((packed));
+
+struct cmd_ds_host_sleep {
+        struct cmd_header hdr;
+        __le32 criteria;
+        uint8_t gpio;
+        uint16_t gap;
+        struct wol_config wol_conf;
+} __attribute__ ((packed));
+
+
+
+struct cmd_ds_802_11_key_material {
+        struct cmd_header hdr;
+
+        __le16 action;
+        struct MrvlIEtype_keyParamSet keyParamSet[2];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_eeprom_access {
+        struct cmd_header hdr;
+        __le16 action;
+        __le16 offset;
+        __le16 len;
+        /* firmware says it returns a maximum of 20 bytes */
+#define LBS_EEPROM_READ_LEN 20
+        u8 value[LBS_EEPROM_READ_LEN];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_tpc_cfg {
+        struct cmd_header hdr;
+
+        __le16 action;
+        uint8_t enable;
+        int8_t P0;
+        int8_t P1;
+        int8_t P2;
+        uint8_t usesnr;
+} __attribute__ ((packed));
+
+
+struct cmd_ds_802_11_pa_cfg {
+        struct cmd_header hdr;
+
+        __le16 action;
+        uint8_t enable;
+        int8_t P0;
+        int8_t P1;
+        int8_t P2;
+} __attribute__ ((packed));
+
+
+struct cmd_ds_802_11_led_ctrl {
+        __le16 action;
+        __le16 numled;
+        u8 data[256];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_afc {
+        __le16 afc_auto;
+        union {
+                struct {
+                        __le16 threshold;
+                        __le16 period;
+                };
+                struct {
+                        __le16 timing_offset; /* signed */
+                        __le16 carrier_offset; /* signed */
+                };
+        };
+} __attribute__ ((packed));
+
+struct cmd_tx_rate_query {
+        __le16 txrate;
+} __attribute__ ((packed));
+
+struct cmd_ds_get_tsf {
+        __le64 tsfvalue;
+} __attribute__ ((packed));
+
+struct cmd_ds_bt_access {
+        __le16 action;
+        __le32 id;
+        u8 addr1[ETH_ALEN];
+        u8 addr2[ETH_ALEN];
+} __attribute__ ((packed));
+
+struct cmd_ds_fwt_access {
+        __le16 action;
+        __le32 id;
+        u8 valid;
+        u8 da[ETH_ALEN];
+        u8 dir;
+        u8 ra[ETH_ALEN];
+        __le32 ssn;
+        __le32 dsn;
+        __le32 metric;
+        u8 rate;
+        u8 hopcount;
+        u8 ttl;
+        __le32 expiration;
+        u8 sleepmode;
+        __le32 snr;
+        __le32 references;
+        u8 prec[ETH_ALEN];
+} __attribute__ ((packed));
+
+struct cmd_ds_mesh_config {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 channel;
+        __le16 type;
+        __le16 length;
+        u8 data[128];   /* last position reserved */
+} __attribute__ ((packed));
+
+struct cmd_ds_mesh_access {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le32 data[32];        /* last position reserved */
+} __attribute__ ((packed));
+
+/* Number of stats counters returned by the firmware */
+#define MESH_STATS_NUM 8
+
+struct cmd_ds_command {
+        /* command header */
+        __le16 command;
+        __le16 size;
+        __le16 seqnum;
+        __le16 result;
+
+        /* command Body */
+        union {
+                struct cmd_ds_802_11_ps_mode psmode;
+                struct cmd_ds_802_11_monitor_mode monitor;
+                struct cmd_ds_802_11_rssi rssi;
+                struct cmd_ds_802_11_rssi_rsp rssirsp;
+                struct cmd_ds_mac_reg_access macreg;
+                struct cmd_ds_bbp_reg_access bbpreg;
+                struct cmd_ds_rf_reg_access rfreg;
+
+                struct cmd_ds_802_11_tpc_cfg tpccfg;
+                struct cmd_ds_802_11_afc afc;
+                struct cmd_ds_802_11_led_ctrl ledgpio;
+
+                struct cmd_ds_bt_access bt;
+                struct cmd_ds_fwt_access fwt;
+                struct cmd_ds_802_11_beacon_control bcn_ctrl;
+        } params;
+} __attribute__ ((packed));
+
 #endif
diff --git a/drivers/net/wireless/libertas/hostcmd.h b/drivers/net/wireless/libertas/hostcmd.h
deleted file mode 100644
index c8a1998d4744..000000000000
--- a/drivers/net/wireless/libertas/hostcmd.h
+++ /dev/null
@@ -1,800 +0,0 @@
-/*
- * This file contains the function prototypes, data structure
- * and defines for all the host/station commands
- */
-#ifndef _LBS_HOSTCMD_H
-#define _LBS_HOSTCMD_H
-
-#include <linux/wireless.h>
-#include "11d.h"
-#include "types.h"
-
-/* 802.11-related definitions */
-
-/* TxPD descriptor */
-struct txpd {
-        /* union to cope up with later FW revisions */
-        union {
-                /* Current Tx packet status */
-                __le32 tx_status;
-                struct {
-                        /* BSS type: client, AP, etc. */
-                        u8 bss_type;
-                        /* BSS number */
-                        u8 bss_num;
-                        /* Reserved */
-                        __le16 reserved;
-                } bss;
-        } u;
-        /* Tx control */
-        __le32 tx_control;
-        __le32 tx_packet_location;
-        /* Tx packet length */
-        __le16 tx_packet_length;
-        /* First 2 byte of destination MAC address */
-        u8 tx_dest_addr_high[2];
-        /* Last 4 byte of destination MAC address */
-        u8 tx_dest_addr_low[4];
-        /* Pkt Priority */
-        u8 priority;
-        /* Pkt Trasnit Power control */
-        u8 powermgmt;
-        /* Amount of time the packet has been queued in the driver (units = 2ms) */
-        u8 pktdelay_2ms;
-        /* reserved */
-        u8 reserved1;
-} __attribute__ ((packed));
-
-/* RxPD Descriptor */
-struct rxpd {
-        /* union to cope up with later FW revisions */
-        union {
-                /* Current Rx packet status */
-                __le16 status;
-                struct {
-                        /* BSS type: client, AP, etc. */
-                        u8 bss_type;
-                        /* BSS number */
-                        u8 bss_num;
-                } __attribute__ ((packed)) bss;
-        } __attribute__ ((packed)) u;
-
-        /* SNR */
-        u8 snr;
-
-        /* Tx control */
-        u8 rx_control;
-
-        /* Pkt length */
-        __le16 pkt_len;
-
-        /* Noise Floor */
-        u8 nf;
-
-        /* Rx Packet Rate */
-        u8 rx_rate;
-
-        /* Pkt addr */
-        __le32 pkt_ptr;
-
-        /* Next Rx RxPD addr */
-        __le32 next_rxpd_ptr;
-
-        /* Pkt Priority */
-        u8 priority;
-        u8 reserved[3];
-} __attribute__ ((packed));
-
-struct cmd_header {
-        __le16 command;
-        __le16 size;
-        __le16 seqnum;
-        __le16 result;
-} __attribute__ ((packed));
-
-struct cmd_ctrl_node {
-        struct list_head list;
-        int result;
-        /* command response */
-        int (*callback)(struct lbs_private *, unsigned long, struct cmd_header *);
-        unsigned long callback_arg;
-        /* command data */
-        struct cmd_header *cmdbuf;
-        /* wait queue */
-        u16 cmdwaitqwoken;
-        wait_queue_head_t cmdwait_q;
-};
-
-/* Generic structure to hold all key types. */
-struct enc_key {
-        u16 len;
-        u16 flags;  /* KEY_INFO_* from defs.h */
-        u16 type; /* KEY_TYPE_* from defs.h */
-        u8 key[32];
-};
-
-/* lbs_offset_value */
-struct lbs_offset_value {
-        u32 offset;
-        u32 value;
-} __attribute__ ((packed));
-
-/* Define general data structure */
-/* cmd_DS_GEN */
-struct cmd_ds_gen {
-        __le16 command;
-        __le16 size;
-        __le16 seqnum;
-        __le16 result;
-        void *cmdresp[0];
-} __attribute__ ((packed));
-
-#define S_DS_GEN sizeof(struct cmd_ds_gen)
-
-
-/*
- * Define data structure for CMD_GET_HW_SPEC
- * This structure defines the response for the GET_HW_SPEC command
- */
-struct cmd_ds_get_hw_spec {
-        struct cmd_header hdr;
-
-        /* HW Interface version number */
-        __le16 hwifversion;
-        /* HW version number */
-        __le16 version;
-        /* Max number of TxPD FW can handle */
-        __le16 nr_txpd;
-        /* Max no of Multicast address */
-        __le16 nr_mcast_adr;
-        /* MAC address */
-        u8 permanentaddr[6];
-
-        /* region Code */
-        __le16 regioncode;
-
-        /* Number of antenna used */
-        __le16 nr_antenna;
-
-        /* FW release number, example 0x01030304 = 2.3.4p1 */
-        __le32 fwrelease;
-
-        /* Base Address of TxPD queue */
-        __le32 wcb_base;
-        /* Read Pointer of RxPd queue */
-        __le32 rxpd_rdptr;
-
-        /* Write Pointer of RxPd queue */
-        __le32 rxpd_wrptr;
-
-        /*FW/HW capability */
-        __le32 fwcapinfo;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_subscribe_event {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 events;
-
-        /* A TLV to the CMD_802_11_SUBSCRIBE_EVENT command can contain a
-         * number of TLVs. From the v5.1 manual, those TLVs would add up to
-         * 40 bytes. However, future firmware might add additional TLVs, so I
-         * bump this up a bit.
-         */
-        uint8_t tlv[128];
-} __attribute__ ((packed));
-
-/*
- * This scan handle Country Information IE(802.11d compliant)
- * Define data structure for CMD_802_11_SCAN
- */
-struct cmd_ds_802_11_scan {
-        struct cmd_header hdr;
-
-        uint8_t bsstype;
-        uint8_t bssid[ETH_ALEN];
-        uint8_t tlvbuffer[0];
-#if 0
-        mrvlietypes_ssidparamset_t ssidParamSet;
-        mrvlietypes_chanlistparamset_t ChanListParamSet;
-        mrvlietypes_ratesparamset_t OpRateSet;
-#endif
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_scan_rsp {
-        struct cmd_header hdr;
-
-        __le16 bssdescriptsize;
-        uint8_t nr_sets;
-        uint8_t bssdesc_and_tlvbuffer[0];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_get_log {
-        struct cmd_header hdr;
-
-        __le32 mcasttxframe;
-        __le32 failed;
-        __le32 retry;
-        __le32 multiretry;
-        __le32 framedup;
-        __le32 rtssuccess;
-        __le32 rtsfailure;
-        __le32 ackfailure;
-        __le32 rxfrag;
-        __le32 mcastrxframe;
-        __le32 fcserror;
-        __le32 txframe;
-        __le32 wepundecryptable;
-} __attribute__ ((packed));
-
-struct cmd_ds_mac_control {
-        struct cmd_header hdr;
-        __le16 action;
-        u16 reserved;
-} __attribute__ ((packed));
-
-struct cmd_ds_mac_multicast_adr {
-        struct cmd_header hdr;
-        __le16 action;
-        __le16 nr_of_adrs;
-        u8 maclist[ETH_ALEN * MRVDRV_MAX_MULTICAST_LIST_SIZE];
-} __attribute__ ((packed));
-
-struct cmd_ds_gspi_bus_config {
-        struct cmd_header hdr;
-        __le16 action;
-        __le16 bus_delay_mode;
-        __le16 host_time_delay_to_read_port;
-        __le16 host_time_delay_to_read_register;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_authenticate {
-        struct cmd_header hdr;
-
-        u8 bssid[ETH_ALEN];
-        u8 authtype;
-        u8 reserved[10];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_deauthenticate {
-        struct cmd_header hdr;
-
-        u8 macaddr[ETH_ALEN];
-        __le16 reasoncode;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_associate {
-        struct cmd_header hdr;
-
-        u8 bssid[6];
-        __le16 capability;
-        __le16 listeninterval;
-        __le16 bcnperiod;
-        u8 dtimperiod;
-        u8 iebuf[512];    /* Enough for required and most optional IEs */
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_associate_response {
-        struct cmd_header hdr;
-
-        __le16 capability;
-        __le16 statuscode;
-        __le16 aid;
-        u8 iebuf[512];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_set_wep {
-        struct cmd_header hdr;
-
-        /* ACT_ADD, ACT_REMOVE or ACT_ENABLE */
-        __le16 action;
-
-        /* key Index selected for Tx */
-        __le16 keyindex;
-
-        /* 40, 128bit or TXWEP */
-        uint8_t keytype[4];
-        uint8_t keymaterial[4][16];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_3_get_stat {
-        __le32 xmitok;
-        __le32 rcvok;
-        __le32 xmiterror;
-        __le32 rcverror;
-        __le32 rcvnobuffer;
-        __le32 rcvcrcerror;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_get_stat {
-        __le32 txfragmentcnt;
-        __le32 mcasttxframecnt;
-        __le32 failedcnt;
-        __le32 retrycnt;
-        __le32 Multipleretrycnt;
-        __le32 rtssuccesscnt;
-        __le32 rtsfailurecnt;
-        __le32 ackfailurecnt;
-        __le32 frameduplicatecnt;
-        __le32 rxfragmentcnt;
-        __le32 mcastrxframecnt;
-        __le32 fcserrorcnt;
-        __le32 bcasttxframecnt;
-        __le32 bcastrxframecnt;
-        __le32 txbeacon;
-        __le32 rxbeacon;
-        __le32 wepundecryptable;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_snmp_mib {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 oid;
-        __le16 bufsize;
-        u8 value[128];
-} __attribute__ ((packed));
-
-struct cmd_ds_mac_reg_map {
-        __le16 buffersize;
-        u8 regmap[128];
-        __le16 reserved;
-} __attribute__ ((packed));
-
-struct cmd_ds_bbp_reg_map {
-        __le16 buffersize;
-        u8 regmap[128];
-        __le16 reserved;
-} __attribute__ ((packed));
-
-struct cmd_ds_rf_reg_map {
-        __le16 buffersize;
-        u8 regmap[64];
-        __le16 reserved;
-} __attribute__ ((packed));
-
-struct cmd_ds_mac_reg_access {
-        __le16 action;
-        __le16 offset;
-        __le32 value;
-} __attribute__ ((packed));
-
-struct cmd_ds_bbp_reg_access {
-        __le16 action;
-        __le16 offset;
-        u8 value;
-        u8 reserved[3];
-} __attribute__ ((packed));
-
-struct cmd_ds_rf_reg_access {
-        __le16 action;
-        __le16 offset;
-        u8 value;
-        u8 reserved[3];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_radio_control {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 control;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_beacon_control {
-        __le16 action;
-        __le16 beacon_enable;
-        __le16 beacon_period;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_sleep_params {
-        struct cmd_header hdr;
-
-        /* ACT_GET/ACT_SET */
-        __le16 action;
-
-        /* Sleep clock error in ppm */
-        __le16 error;
-
-        /* Wakeup offset in usec */
-        __le16 offset;
-
-        /* Clock stabilization time in usec */
-        __le16 stabletime;
-
-        /* control periodic calibration */
-        uint8_t calcontrol;
-
-        /* control the use of external sleep clock */
-        uint8_t externalsleepclk;
-
-        /* reserved field, should be set to zero */
-        __le16 reserved;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_inactivity_timeout {
-        struct cmd_header hdr;
-
-        /* ACT_GET/ACT_SET */
-        __le16 action;
-
-        /* Inactivity timeout in msec */
-        __le16 timeout;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_rf_channel {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 channel;
-        __le16 rftype;      /* unused */
-        __le16 reserved;    /* unused */
-        u8 channellist[32]; /* unused */
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_rssi {
-        /* weighting factor */
-        __le16 N;
-
-        __le16 reserved_0;
-        __le16 reserved_1;
-        __le16 reserved_2;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_rssi_rsp {
-        __le16 SNR;
-        __le16 noisefloor;
-        __le16 avgSNR;
-        __le16 avgnoisefloor;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_mac_address {
-        struct cmd_header hdr;
-
-        __le16 action;
-        u8 macadd[ETH_ALEN];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_rf_tx_power {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 curlevel;
-        s8 maxlevel;
-        s8 minlevel;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_rf_antenna {
-        __le16 action;
-
-        /* Number of antennas or 0xffff(diversity) */
-        __le16 antennamode;
-
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_monitor_mode {
-        __le16 action;
-        __le16 mode;
-} __attribute__ ((packed));
-
-struct cmd_ds_set_boot2_ver {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 version;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_fw_wake_method {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 method;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_sleep_period {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 period;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_ps_mode {
-        __le16 action;
-        __le16 nullpktinterval;
-        __le16 multipledtim;
-        __le16 reserved;
-        __le16 locallisteninterval;
-} __attribute__ ((packed));
-
-struct cmd_confirm_sleep {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 nullpktinterval;
-        __le16 multipledtim;
-        __le16 reserved;
-        __le16 locallisteninterval;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_data_rate {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 reserved;
-        u8 rates[MAX_RATES];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_rate_adapt_rateset {
-        struct cmd_header hdr;
-        __le16 action;
-        __le16 enablehwauto;
-        __le16 bitmap;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_ad_hoc_start {
-        struct cmd_header hdr;
-
-        u8 ssid[IW_ESSID_MAX_SIZE];
-        u8 bsstype;
-        __le16 beaconperiod;
-        u8 dtimperiod;   /* Reserved on v9 and later */
-        struct ieee_ie_ibss_param_set ibss;
-        u8 reserved1[4];
-        struct ieee_ie_ds_param_set ds;
-        u8 reserved2[4];
-        __le16 probedelay;  /* Reserved on v9 and later */
-        __le16 capability;
-        u8 rates[MAX_RATES];
-        u8 tlv_memory_size_pad[100];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_ad_hoc_result {
-        struct cmd_header hdr;
-
-        u8 pad[3];
-        u8 bssid[ETH_ALEN];
-} __attribute__ ((packed));
-
-struct adhoc_bssdesc {
-        u8 bssid[ETH_ALEN];
-        u8 ssid[IW_ESSID_MAX_SIZE];
-        u8 type;
-        __le16 beaconperiod;
-        u8 dtimperiod;
-        __le64 timestamp;
-        __le64 localtime;
-        struct ieee_ie_ds_param_set ds;
-        u8 reserved1[4];
-        struct ieee_ie_ibss_param_set ibss;
-        u8 reserved2[4];
-        __le16 capability;
-        u8 rates[MAX_RATES];
-
-        /* DO NOT ADD ANY FIELDS TO THIS STRUCTURE. It is used below in the
-         * Adhoc join command and will cause a binary layout mismatch with
-         * the firmware
-         */
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_ad_hoc_join {
-        struct cmd_header hdr;
-
-        struct adhoc_bssdesc bss;
-        __le16 failtimeout;   /* Reserved on v9 and later */
-        __le16 probedelay;    /* Reserved on v9 and later */
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_ad_hoc_stop {
-        struct cmd_header hdr;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_enable_rsn {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 enable;
-} __attribute__ ((packed));
-
-struct MrvlIEtype_keyParamSet {
-        /* type ID */
-        __le16 type;
-
-        /* length of Payload */
-        __le16 length;
-
-        /* type of key: WEP=0, TKIP=1, AES=2 */
-        __le16 keytypeid;
-
-        /* key control Info specific to a keytypeid */
-        __le16 keyinfo;
-
-        /* length of key */
-        __le16 keylen;
-
-        /* key material of size keylen */
-        u8 key[32];
-} __attribute__ ((packed));
-
-#define MAX_WOL_RULES           16
-
-struct host_wol_rule {
-        uint8_t rule_no;
-        uint8_t rule_ops;
-        __le16 sig_offset;
-        __le16 sig_length;
-        __le16 reserve;
-        __be32 sig_mask;
-        __be32 signature;
-} __attribute__ ((packed));
-
-struct wol_config {
-        uint8_t action;
-        uint8_t pattern;
-        uint8_t no_rules_in_cmd;
-        uint8_t result;
-        struct host_wol_rule rule[MAX_WOL_RULES];
-} __attribute__ ((packed));
-
-struct cmd_ds_host_sleep {
-        struct cmd_header hdr;
-        __le32 criteria;
-        uint8_t gpio;
-        uint16_t gap;
-        struct wol_config wol_conf;
-} __attribute__ ((packed));
-
-
-
-struct cmd_ds_802_11_key_material {
-        struct cmd_header hdr;
-
-        __le16 action;
-        struct MrvlIEtype_keyParamSet keyParamSet[2];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_eeprom_access {
-        struct cmd_header hdr;
-        __le16 action;
-        __le16 offset;
-        __le16 len;
-        /* firmware says it returns a maximum of 20 bytes */
-#define LBS_EEPROM_READ_LEN 20
-        u8 value[LBS_EEPROM_READ_LEN];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_tpc_cfg {
-        struct cmd_header hdr;
-
-        __le16 action;
-        uint8_t enable;
-        int8_t P0;
-        int8_t P1;
-        int8_t P2;
-        uint8_t usesnr;
-} __attribute__ ((packed));
-
-
-struct cmd_ds_802_11_pa_cfg {
-        struct cmd_header hdr;
-
-        __le16 action;
-        uint8_t enable;
-        int8_t P0;
-        int8_t P1;
-        int8_t P2;
-} __attribute__ ((packed));
-
-
-struct cmd_ds_802_11_led_ctrl {
-        __le16 action;
-        __le16 numled;
-        u8 data[256];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_afc {
-        __le16 afc_auto;
-        union {
-                struct {
-                        __le16 threshold;
-                        __le16 period;
-                };
-                struct {
-                        __le16 timing_offset; /* signed */
-                        __le16 carrier_offset; /* signed */
-                };
-        };
-} __attribute__ ((packed));
-
-struct cmd_tx_rate_query {
-        __le16 txrate;
-} __attribute__ ((packed));
-
-struct cmd_ds_get_tsf {
-        __le64 tsfvalue;
-} __attribute__ ((packed));
-
-struct cmd_ds_bt_access {
-        __le16 action;
-        __le32 id;
-        u8 addr1[ETH_ALEN];
-        u8 addr2[ETH_ALEN];
-} __attribute__ ((packed));
-
-struct cmd_ds_fwt_access {
-        __le16 action;
-        __le32 id;
-        u8 valid;
-        u8 da[ETH_ALEN];
-        u8 dir;
-        u8 ra[ETH_ALEN];
-        __le32 ssn;
-        __le32 dsn;
-        __le32 metric;
-        u8 rate;
-        u8 hopcount;
-        u8 ttl;
-        __le32 expiration;
-        u8 sleepmode;
-        __le32 snr;
-        __le32 references;
-        u8 prec[ETH_ALEN];
-} __attribute__ ((packed));
-
-
-struct cmd_ds_mesh_config {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 channel;
-        __le16 type;
-        __le16 length;
-        u8 data[128];   /* last position reserved */
-} __attribute__ ((packed));
-
-
-struct cmd_ds_mesh_access {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le32 data[32];        /* last position reserved */
-} __attribute__ ((packed));
-
-/* Number of stats counters returned by the firmware */
-#define MESH_STATS_NUM 8
-
-struct cmd_ds_command {
-        /* command header */
-        __le16 command;
-        __le16 size;
-        __le16 seqnum;
-        __le16 result;
-
-        /* command Body */
-        union {
-                struct cmd_ds_802_11_ps_mode psmode;
-                struct cmd_ds_802_11_get_stat gstat;
-                struct cmd_ds_802_3_get_stat gstat_8023;
-                struct cmd_ds_802_11_rf_antenna rant;
-                struct cmd_ds_802_11_monitor_mode monitor;
-                struct cmd_ds_802_11_rssi rssi;
-                struct cmd_ds_802_11_rssi_rsp rssirsp;
-                struct cmd_ds_mac_reg_access macreg;
-                struct cmd_ds_bbp_reg_access bbpreg;
-                struct cmd_ds_rf_reg_access rfreg;
-
-                struct cmd_ds_802_11d_domain_info domaininfo;
-                struct cmd_ds_802_11d_domain_info domaininforesp;
-
-                struct cmd_ds_802_11_tpc_cfg tpccfg;
-                struct cmd_ds_802_11_afc afc;
-                struct cmd_ds_802_11_led_ctrl ledgpio;
-
-                struct cmd_tx_rate_query txrate;
-                struct cmd_ds_bt_access bt;
-                struct cmd_ds_fwt_access fwt;
-                struct cmd_ds_get_tsf gettsf;
-                struct cmd_ds_802_11_beacon_control bcn_ctrl;
-        } params;
-} __attribute__ ((packed));
-
-#endif
diff --git a/drivers/net/wireless/libertas/if_cs.c b/drivers/net/wireless/libertas/if_cs.c
index 62381768f2d5..6d55439a7b97 100644
--- a/drivers/net/wireless/libertas/if_cs.c
+++ b/drivers/net/wireless/libertas/if_cs.c
@@ -22,6 +22,7 @@
 */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/moduleparam.h>
 #include <linux/firmware.h>
@@ -48,6 +49,7 @@
 MODULE_AUTHOR("Holger Schurig <hs4233@mail.mn-solutions.de>");
 MODULE_DESCRIPTION("Driver for Marvell 83xx compact flash WLAN cards");
 MODULE_LICENSE("GPL");
+MODULE_FIRMWARE("libertas_cs_helper.fw");
 
 
 
@@ -590,7 +592,7 @@ static int if_cs_prog_helper(struct if_cs_card *card)
 
         /* TODO: make firmware file configurable */
         ret = request_firmware(&fw, "libertas_cs_helper.fw",
-                &handle_to_dev(card->p_dev));
+                &card->p_dev->dev);
         if (ret) {
                 lbs_pr_err("can't load helper firmware\n");
                 ret = -ENODEV;
@@ -663,7 +665,7 @@ static int if_cs_prog_real(struct if_cs_card *card)
 
         /* TODO: make firmware file configurable */
         ret = request_firmware(&fw, "libertas_cs.fw",
-                &handle_to_dev(card->p_dev));
+                &card->p_dev->dev);
         if (ret) {
                 lbs_pr_err("can't load firmware\n");
                 ret = -ENODEV;
@@ -793,18 +795,37 @@ static void if_cs_release(struct pcmcia_device *p_dev)
  * configure the card at this point -- we wait until we receive a card
  * insertion event.
  */
+
+static int if_cs_ioprobe(struct pcmcia_device *p_dev,
+                         cistpl_cftable_entry_t *cfg,
+                         cistpl_cftable_entry_t *dflt,
+                         unsigned int vcc,
+                         void *priv_data)
+{
+        p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
+        p_dev->io.BasePort1 = cfg->io.win[0].base;
+        p_dev->io.NumPorts1 = cfg->io.win[0].len;
+
+        /* Do we need to allocate an interrupt? */
+        if (cfg->irq.IRQInfo1)
+                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+
+        /* IO window settings */
+        if (cfg->io.nwin != 1) {
+                lbs_pr_err("wrong CIS (check number of IO windows)\n");
+                return -ENODEV;
+        }
+
+        /* This reserves IO space but doesn't actually enable it */
+        return pcmcia_request_io(p_dev, &p_dev->io);
+}
+
 static int if_cs_probe(struct pcmcia_device *p_dev)
 {
         int ret = -ENOMEM;
         unsigned int prod_id;
         struct lbs_private *priv;
         struct if_cs_card *card;
-        /* CIS parsing */
-        tuple_t tuple;
-        cisparse_t parse;
-        cistpl_cftable_entry_t *cfg = &parse.cftable_entry;
-        cistpl_io_t *io = &cfg->io;
-        u_char buf[64];
 
         lbs_deb_enter(LBS_DEB_CS);
 
@@ -818,48 +839,15 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
 
         p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
         p_dev->irq.Handler = NULL;
-        p_dev->irq.IRQInfo1 = IRQ_INFO2_VALID | IRQ_LEVEL_ID;
 
         p_dev->conf.Attributes = 0;
         p_dev->conf.IntType = INT_MEMORY_AND_IO;
 
-        tuple.Attributes = 0;
-        tuple.TupleData = buf;
-        tuple.TupleDataMax = sizeof(buf);
-        tuple.TupleOffset = 0;
-
-        tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        if ((ret = pcmcia_get_first_tuple(p_dev, &tuple)) != 0 ||
-            (ret = pcmcia_get_tuple_data(p_dev, &tuple)) != 0 ||
-            (ret = pcmcia_parse_tuple(&tuple, &parse)) != 0)
-        {
-                lbs_pr_err("error in pcmcia_get_first_tuple etc\n");
-                goto out1;
-        }
-
-        p_dev->conf.ConfigIndex = cfg->index;
-
-        /* Do we need to allocate an interrupt? */
-        if (cfg->irq.IRQInfo1) {
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
-        }
-
-        /* IO window settings */
-        if (cfg->io.nwin != 1) {
-                lbs_pr_err("wrong CIS (check number of IO windows)\n");
-                ret = -ENODEV;
+        if (pcmcia_loop_config(p_dev, if_cs_ioprobe, NULL)) {
+                lbs_pr_err("error in pcmcia_loop_config\n");
                 goto out1;
         }
-        p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
-        p_dev->io.BasePort1 = io->win[0].base;
-        p_dev->io.NumPorts1 = io->win[0].len;
 
-        /* This reserves IO space but doesn't actually enable it */
-        ret = pcmcia_request_io(p_dev, &p_dev->io);
-        if (ret) {
-                lbs_pr_err("error in pcmcia_request_io\n");
-                goto out1;
-        }
 
         /*
          * Allocate an interrupt line.  Note that this does not assign
@@ -946,6 +934,9 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
         card->priv = priv;
         priv->card = card;
         priv->hw_host_to_card = if_cs_host_to_card;
+        priv->enter_deep_sleep = NULL;
+        priv->exit_deep_sleep = NULL;
+        priv->reset_deep_sleep_wakeup = NULL;
         priv->fw_ready = 1;
 
         /* Now actually get the IRQ */
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 485a8d406525..7d1a3c6b6ce0 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -28,6 +28,7 @@
 
 #include <linux/kernel.h>
 #include <linux/moduleparam.h>
+#include <linux/slab.h>
 #include <linux/firmware.h>
 #include <linux/netdevice.h>
 #include <linux/delay.h>
@@ -99,6 +100,12 @@ static struct if_sdio_model if_sdio_models[] = {
                 .firmware = "sd8688.bin",
         },
 };
+MODULE_FIRMWARE("sd8385_helper.bin");
+MODULE_FIRMWARE("sd8385.bin");
+MODULE_FIRMWARE("sd8686_helper.bin");
+MODULE_FIRMWARE("sd8686.bin");
+MODULE_FIRMWARE("sd8688_helper.bin");
+MODULE_FIRMWARE("sd8688.bin");
 
 struct if_sdio_packet {
         struct if_sdio_packet   *next;
@@ -831,6 +838,58 @@ out:
         return ret;
 }
 
+static int if_sdio_enter_deep_sleep(struct lbs_private *priv)
+{
+        int ret = -1;
+        struct cmd_header cmd;
+
+        memset(&cmd, 0, sizeof(cmd));
+
+        lbs_deb_sdio("send DEEP_SLEEP command\n");
+        ret = __lbs_cmd(priv, CMD_802_11_DEEP_SLEEP, &cmd, sizeof(cmd),
+                        lbs_cmd_copyback, (unsigned long) &cmd);
+        if (ret)
+                lbs_pr_err("DEEP_SLEEP cmd failed\n");
+
+        mdelay(200);
+        return ret;
+}
+
+static int if_sdio_exit_deep_sleep(struct lbs_private *priv)
+{
+        struct if_sdio_card *card = priv->card;
+        int ret = -1;
+
+        lbs_deb_enter(LBS_DEB_SDIO);
+        sdio_claim_host(card->func);
+
+        sdio_writeb(card->func, HOST_POWER_UP, CONFIGURATION_REG, &ret);
+        if (ret)
+                lbs_pr_err("sdio_writeb failed!\n");
+
+        sdio_release_host(card->func);
+        lbs_deb_leave_args(LBS_DEB_SDIO, "ret %d", ret);
+        return ret;
+}
+
+static int if_sdio_reset_deep_sleep_wakeup(struct lbs_private *priv)
+{
+        struct if_sdio_card *card = priv->card;
+        int ret = -1;
+
+        lbs_deb_enter(LBS_DEB_SDIO);
+        sdio_claim_host(card->func);
+
+        sdio_writeb(card->func, 0, CONFIGURATION_REG, &ret);
+        if (ret)
+                lbs_pr_err("sdio_writeb failed!\n");
+
+        sdio_release_host(card->func);
+        lbs_deb_leave_args(LBS_DEB_SDIO, "ret %d", ret);
+        return ret;
+
+}
+
 /*******************************************************************/
 /* SDIO callbacks                                                  */
 /*******************************************************************/
@@ -859,6 +918,7 @@ static void if_sdio_interrupt(struct sdio_func *func)
          * Ignore the define name, this really means the card has
          * successfully received the command.
          */
+        card->priv->is_activity_detected = 1;
         if (cause & IF_SDIO_H_INT_DNLD)
                 lbs_host_to_card_done(card->priv);
 
@@ -934,7 +994,7 @@ static int if_sdio_probe(struct sdio_func *func,
         }
 
         if (i == ARRAY_SIZE(if_sdio_models)) {
-                lbs_pr_err("unkown card model 0x%x\n", card->model);
+                lbs_pr_err("unknown card model 0x%x\n", card->model);
                 ret = -ENODEV;
                 goto free;
         }
@@ -998,6 +1058,9 @@ static int if_sdio_probe(struct sdio_func *func,
 
         priv->card = card;
         priv->hw_host_to_card = if_sdio_host_to_card;
+        priv->enter_deep_sleep = if_sdio_enter_deep_sleep;
+        priv->exit_deep_sleep = if_sdio_exit_deep_sleep;
+        priv->reset_deep_sleep_wakeup = if_sdio_reset_deep_sleep_wakeup;
 
         priv->fw_ready = 1;
 
diff --git a/drivers/net/wireless/libertas/if_sdio.h b/drivers/net/wireless/libertas/if_sdio.h
index 60c9b2fcef03..12179c1dc9c9 100644
--- a/drivers/net/wireless/libertas/if_sdio.h
+++ b/drivers/net/wireless/libertas/if_sdio.h
@@ -51,5 +51,6 @@
 #define IF_SDIO_EVENT           0x80fc
 
 #define IF_SDIO_BLOCK_SIZE      256
-
+#define CONFIGURATION_REG               0x03
+#define HOST_POWER_UP                   (0x1U << 1)
 #endif
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index 5b3672c4d0cc..fe3f08028eb3 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -23,6 +23,8 @@
 #include <linux/kthread.h>
 #include <linux/list.h>
 #include <linux/netdevice.h>
+#include <linux/semaphore.h>
+#include <linux/slab.h>
 #include <linux/spi/libertas_spi.h>
 #include <linux/spi/spi.h>
 
@@ -32,12 +34,6 @@
 #include "dev.h"
 #include "if_spi.h"
 
-struct if_spi_packet {
-        struct list_head                list;
-        u16                             blen;
-        u8                              buffer[0] __attribute__((aligned(4)));
-};
-
 struct if_spi_card {
         struct spi_device               *spi;
         struct lbs_private              *priv;
@@ -66,33 +62,10 @@ struct if_spi_card {
         struct semaphore                spi_thread_terminated;
 
         u8                              cmd_buffer[IF_SPI_CMD_BUF_SIZE];
-
-        /* A buffer of incoming packets from libertas core.
-         * Since we can't sleep in hw_host_to_card, we have to buffer
-         * them. */
-        struct list_head                cmd_packet_list;
-        struct list_head                data_packet_list;
-
-        /* Protects cmd_packet_list and data_packet_list */
-        spinlock_t                      buffer_lock;
 };
 
 static void free_if_spi_card(struct if_spi_card *card)
 {
-        struct list_head *cursor, *next;
-        struct if_spi_packet *packet;
-
-        BUG_ON(card->run_thread);
-        list_for_each_safe(cursor, next, &card->cmd_packet_list) {
-                packet = container_of(cursor, struct if_spi_packet, list);
-                list_del(&packet->list);
-                kfree(packet);
-        }
-        list_for_each_safe(cursor, next, &card->data_packet_list) {
-                packet = container_of(cursor, struct if_spi_packet, list);
-                list_del(&packet->list);
-                kfree(packet);
-        }
         spi_set_drvdata(card->spi, NULL);
         kfree(card);
 }
@@ -774,40 +747,6 @@ out:
         return err;
 }
 
-/* Move data or a command from the host to the card. */
-static void if_spi_h2c(struct if_spi_card *card,
-                        struct if_spi_packet *packet, int type)
-{
-        int err = 0;
-        u16 int_type, port_reg;
-
-        switch (type) {
-        case MVMS_DAT:
-                int_type = IF_SPI_CIC_TX_DOWNLOAD_OVER;
-                port_reg = IF_SPI_DATA_RDWRPORT_REG;
-                break;
-        case MVMS_CMD:
-                int_type = IF_SPI_CIC_CMD_DOWNLOAD_OVER;
-                port_reg = IF_SPI_CMD_RDWRPORT_REG;
-                break;
-        default:
-                lbs_pr_err("can't transfer buffer of type %d\n", type);
-                err = -EINVAL;
-                goto out;
-        }
-
-        /* Write the data to the card */
-        err = spu_write(card, port_reg, packet->buffer, packet->blen);
-        if (err)
-                goto out;
-
-out:
-        kfree(packet);
-
-        if (err)
-                lbs_pr_err("%s: error %d\n", __func__, err);
-}
-
 /* Inform the host about a card event */
 static void if_spi_e2h(struct if_spi_card *card)
 {
@@ -837,8 +776,6 @@ static int lbs_spi_thread(void *data)
         int err;
         struct if_spi_card *card = data;
         u16 hiStatus;
-        unsigned long flags;
-        struct if_spi_packet *packet;
 
         while (1) {
                 /* Wait to be woken up by one of two things.  First, our ISR
@@ -877,43 +814,9 @@ static int lbs_spi_thread(void *data)
                 if (hiStatus & IF_SPI_HIST_CMD_DOWNLOAD_RDY ||
                    (card->priv->psstate != PS_STATE_FULL_POWER &&
                     (hiStatus & IF_SPI_HIST_TX_DOWNLOAD_RDY))) {
-                        /* This means two things. First of all,
-                         * if there was a previous command sent, the card has
-                         * successfully received it.
-                         * Secondly, it is now ready to download another
-                         * command.
-                         */
                         lbs_host_to_card_done(card->priv);
-
-                        /* Do we have any command packets from the host to
-                         * send? */
-                        packet = NULL;
-                        spin_lock_irqsave(&card->buffer_lock, flags);
-                        if (!list_empty(&card->cmd_packet_list)) {
-                                packet = (struct if_spi_packet *)(card->
-                                                cmd_packet_list.next);
-                                list_del(&packet->list);
-                        }
-                        spin_unlock_irqrestore(&card->buffer_lock, flags);
-
-                        if (packet)
-                                if_spi_h2c(card, packet, MVMS_CMD);
                 }
-                if (hiStatus & IF_SPI_HIST_TX_DOWNLOAD_RDY) {
-                        /* Do we have any data packets from the host to
-                         * send? */
-                        packet = NULL;
-                        spin_lock_irqsave(&card->buffer_lock, flags);
-                        if (!list_empty(&card->data_packet_list)) {
-                                packet = (struct if_spi_packet *)(card->
-                                                data_packet_list.next);
-                                list_del(&packet->list);
-                        }
-                        spin_unlock_irqrestore(&card->buffer_lock, flags);
 
-                        if (packet)
-                                if_spi_h2c(card, packet, MVMS_DAT);
-                }
                 if (hiStatus & IF_SPI_HIST_CARD_EVENT)
                         if_spi_e2h(card);
 
@@ -942,40 +845,18 @@ static int if_spi_host_to_card(struct lbs_private *priv,
                                 u8 type, u8 *buf, u16 nb)
 {
         int err = 0;
-        unsigned long flags;
         struct if_spi_card *card = priv->card;
-        struct if_spi_packet *packet;
-        u16 blen;
 
         lbs_deb_enter_args(LBS_DEB_SPI, "type %d, bytes %d", type, nb);
 
-        if (nb == 0) {
-                lbs_pr_err("%s: invalid size requested: %d\n", __func__, nb);
-                err = -EINVAL;
-                goto out;
-        }
-        blen = ALIGN(nb, 4);
-        packet = kzalloc(sizeof(struct if_spi_packet) + blen, GFP_ATOMIC);
-        if (!packet) {
-                err = -ENOMEM;
-                goto out;
-        }
-        packet->blen = blen;
-        memcpy(packet->buffer, buf, nb);
-        memset(packet->buffer + nb, 0, blen - nb);
+        nb = ALIGN(nb, 4);
 
         switch (type) {
         case MVMS_CMD:
-                priv->dnld_sent = DNLD_CMD_SENT;
-                spin_lock_irqsave(&card->buffer_lock, flags);
-                list_add_tail(&packet->list, &card->cmd_packet_list);
-                spin_unlock_irqrestore(&card->buffer_lock, flags);
+                err = spu_write(card, IF_SPI_CMD_RDWRPORT_REG, buf, nb);
                 break;
         case MVMS_DAT:
-                priv->dnld_sent = DNLD_DATA_SENT;
-                spin_lock_irqsave(&card->buffer_lock, flags);
-                list_add_tail(&packet->list, &card->data_packet_list);
-                spin_unlock_irqrestore(&card->buffer_lock, flags);
+                err = spu_write(card, IF_SPI_DATA_RDWRPORT_REG, buf, nb);
                 break;
         default:
                 lbs_pr_err("can't transfer buffer of type %d", type);
@@ -983,9 +864,6 @@ static int if_spi_host_to_card(struct lbs_private *priv,
                 break;
         }
 
-        /* Wake up the spi thread */
-        up(&card->spi_ready);
-out:
         lbs_deb_leave_args(LBS_DEB_SPI, "err=%d", err);
         return err;
 }
@@ -1026,6 +904,10 @@ static int if_spi_calculate_fw_names(u16 card_id,
                  chip_id_to_device_name[i].name);
         return 0;
 }
+MODULE_FIRMWARE("libertas/gspi8385_hlp.bin");
+MODULE_FIRMWARE("libertas/gspi8385.bin");
+MODULE_FIRMWARE("libertas/gspi8686_hlp.bin");
+MODULE_FIRMWARE("libertas/gspi8686.bin");
 
 static int __devinit if_spi_probe(struct spi_device *spi)
 {
@@ -1062,9 +944,6 @@ static int __devinit if_spi_probe(struct spi_device *spi)
 
         sema_init(&card->spi_ready, 0);
         sema_init(&card->spi_thread_terminated, 0);
-        INIT_LIST_HEAD(&card->cmd_packet_list);
-        INIT_LIST_HEAD(&card->data_packet_list);
-        spin_lock_init(&card->buffer_lock);
 
         /* Initialize the SPI Interface Unit */
         err = spu_init(card, pdata->use_dummy_writes);
@@ -1117,6 +996,9 @@ static int __devinit if_spi_probe(struct spi_device *spi)
         card->priv = priv;
         priv->card = card;
         priv->hw_host_to_card = if_spi_host_to_card;
+        priv->enter_deep_sleep = NULL;
+        priv->exit_deep_sleep = NULL;
+        priv->reset_deep_sleep_wakeup = NULL;
         priv->fw_ready = 1;
 
         /* Initialize interrupt handling stuff. */
@@ -1138,6 +1020,9 @@ static int __devinit if_spi_probe(struct spi_device *spi)
                 goto terminate_thread;
         }
 
+        /* poke the IRQ handler so that we don't miss the first interrupt */
+        up(&card->spi_ready);
+
         /* Start the card.
          * This will call register_netdev, and we'll start
          * getting interrupts... */
diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
index 3fac4efa5ac8..fcea5741ba62 100644
--- a/drivers/net/wireless/libertas/if_usb.c
+++ b/drivers/net/wireless/libertas/if_usb.c
@@ -5,6 +5,7 @@
 #include <linux/moduleparam.h>
 #include <linux/firmware.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 
 #ifdef CONFIG_OLPC
@@ -28,6 +29,8 @@
 static char *lbs_fw_name = "usb8388.bin";
 module_param_named(fw_name, lbs_fw_name, charp, 0644);
 
+MODULE_FIRMWARE("usb8388.bin");
+
 static struct usb_device_id if_usb_table[] = {
         /* Enter the device signature inside */
         { USB_DEVICE(0x1286, 0x2001) },
@@ -300,6 +303,9 @@ static int if_usb_probe(struct usb_interface *intf,
         cardp->priv->fw_ready = 1;
 
         priv->hw_host_to_card = if_usb_host_to_card;
+        priv->enter_deep_sleep = NULL;
+        priv->exit_deep_sleep = NULL;
+        priv->reset_deep_sleep_wakeup = NULL;
 #ifdef CONFIG_OLPC
         if (machine_is_olpc())
                 priv->reset_card = if_usb_reset_olpc_card;
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 87b4e497faa2..598080414b17 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -13,12 +13,15 @@
 #include <linux/kfifo.h>
 #include <linux/stddef.h>
 #include <linux/ieee80211.h>
+#include <linux/slab.h>
 #include <net/iw_handler.h>
+#include <net/cfg80211.h>
 
 #include "host.h"
 #include "decl.h"
 #include "dev.h"
 #include "wext.h"
+#include "cfg.h"
 #include "debugfs.h"
 #include "scan.h"
 #include "assoc.h"
@@ -43,119 +46,6 @@ module_param_named(libertas_debug, lbs_debug, int, 0644);
 struct cmd_confirm_sleep confirm_sleep;
 
 
-#define LBS_TX_PWR_DEFAULT              20      /*100mW */
-#define LBS_TX_PWR_US_DEFAULT           20      /*100mW */
-#define LBS_TX_PWR_JP_DEFAULT           16      /*50mW */
-#define LBS_TX_PWR_FR_DEFAULT           20      /*100mW */
-#define LBS_TX_PWR_EMEA_DEFAULT 20      /*100mW */
-
-/* Format { channel, frequency (MHz), maxtxpower } */
-/* band: 'B/G', region: USA FCC/Canada IC */
-static struct chan_freq_power channel_freq_power_US_BG[] = {
-        {1, 2412, LBS_TX_PWR_US_DEFAULT},
-        {2, 2417, LBS_TX_PWR_US_DEFAULT},
-        {3, 2422, LBS_TX_PWR_US_DEFAULT},
-        {4, 2427, LBS_TX_PWR_US_DEFAULT},
-        {5, 2432, LBS_TX_PWR_US_DEFAULT},
-        {6, 2437, LBS_TX_PWR_US_DEFAULT},
-        {7, 2442, LBS_TX_PWR_US_DEFAULT},
-        {8, 2447, LBS_TX_PWR_US_DEFAULT},
-        {9, 2452, LBS_TX_PWR_US_DEFAULT},
-        {10, 2457, LBS_TX_PWR_US_DEFAULT},
-        {11, 2462, LBS_TX_PWR_US_DEFAULT}
-};
-
-/* band: 'B/G', region: Europe ETSI */
-static struct chan_freq_power channel_freq_power_EU_BG[] = {
-        {1, 2412, LBS_TX_PWR_EMEA_DEFAULT},
-        {2, 2417, LBS_TX_PWR_EMEA_DEFAULT},
-        {3, 2422, LBS_TX_PWR_EMEA_DEFAULT},
-        {4, 2427, LBS_TX_PWR_EMEA_DEFAULT},
-        {5, 2432, LBS_TX_PWR_EMEA_DEFAULT},
-        {6, 2437, LBS_TX_PWR_EMEA_DEFAULT},
-        {7, 2442, LBS_TX_PWR_EMEA_DEFAULT},
-        {8, 2447, LBS_TX_PWR_EMEA_DEFAULT},
-        {9, 2452, LBS_TX_PWR_EMEA_DEFAULT},
-        {10, 2457, LBS_TX_PWR_EMEA_DEFAULT},
-        {11, 2462, LBS_TX_PWR_EMEA_DEFAULT},
-        {12, 2467, LBS_TX_PWR_EMEA_DEFAULT},
-        {13, 2472, LBS_TX_PWR_EMEA_DEFAULT}
-};
-
-/* band: 'B/G', region: Spain */
-static struct chan_freq_power channel_freq_power_SPN_BG[] = {
-        {10, 2457, LBS_TX_PWR_DEFAULT},
-        {11, 2462, LBS_TX_PWR_DEFAULT}
-};
-
-/* band: 'B/G', region: France */
-static struct chan_freq_power channel_freq_power_FR_BG[] = {
-        {10, 2457, LBS_TX_PWR_FR_DEFAULT},
-        {11, 2462, LBS_TX_PWR_FR_DEFAULT},
-        {12, 2467, LBS_TX_PWR_FR_DEFAULT},
-        {13, 2472, LBS_TX_PWR_FR_DEFAULT}
-};
-
-/* band: 'B/G', region: Japan */
-static struct chan_freq_power channel_freq_power_JPN_BG[] = {
-        {1, 2412, LBS_TX_PWR_JP_DEFAULT},
-        {2, 2417, LBS_TX_PWR_JP_DEFAULT},
-        {3, 2422, LBS_TX_PWR_JP_DEFAULT},
-        {4, 2427, LBS_TX_PWR_JP_DEFAULT},
-        {5, 2432, LBS_TX_PWR_JP_DEFAULT},
-        {6, 2437, LBS_TX_PWR_JP_DEFAULT},
-        {7, 2442, LBS_TX_PWR_JP_DEFAULT},
-        {8, 2447, LBS_TX_PWR_JP_DEFAULT},
-        {9, 2452, LBS_TX_PWR_JP_DEFAULT},
-        {10, 2457, LBS_TX_PWR_JP_DEFAULT},
-        {11, 2462, LBS_TX_PWR_JP_DEFAULT},
-        {12, 2467, LBS_TX_PWR_JP_DEFAULT},
-        {13, 2472, LBS_TX_PWR_JP_DEFAULT},
-        {14, 2484, LBS_TX_PWR_JP_DEFAULT}
-};
-
-/**
- * the structure for channel, frequency and power
- */
-struct region_cfp_table {
-        u8 region;
-        struct chan_freq_power *cfp_BG;
-        int cfp_no_BG;
-};
-
-/**
- * the structure for the mapping between region and CFP
- */
-static struct region_cfp_table region_cfp_table[] = {
-        {0x10,                  /*US FCC */
-         channel_freq_power_US_BG,
-         ARRAY_SIZE(channel_freq_power_US_BG),
-         }
-        ,
-        {0x20,                  /*CANADA IC */
-         channel_freq_power_US_BG,
-         ARRAY_SIZE(channel_freq_power_US_BG),
-         }
-        ,
-        {0x30, /*EU*/ channel_freq_power_EU_BG,
-         ARRAY_SIZE(channel_freq_power_EU_BG),
-         }
-        ,
-        {0x31, /*SPAIN*/ channel_freq_power_SPN_BG,
-         ARRAY_SIZE(channel_freq_power_SPN_BG),
-         }
-        ,
-        {0x32, /*FRANCE*/ channel_freq_power_FR_BG,
-         ARRAY_SIZE(channel_freq_power_FR_BG),
-         }
-        ,
-        {0x40, /*JAPAN*/ channel_freq_power_JPN_BG,
-         ARRAY_SIZE(channel_freq_power_JPN_BG),
-         }
-        ,
-/*Add new region here */
-};
-
 /**
  * the table to keep region code
  */
@@ -163,13 +53,6 @@ u16 lbs_region_code_to_index[MRVDRV_MAX_REGION_CODE] =
     { 0x10, 0x20, 0x30, 0x31, 0x32, 0x40 };
 
 /**
- * 802.11b/g supported bitrates (in 500Kb/s units)
- */
-u8 lbs_bg_rates[MAX_RATES] =
-    { 0x02, 0x04, 0x0b, 0x16, 0x0c, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6c,
-0x00, 0x00 };
-
-/**
  * FW rate table.  FW refers to rates by their index in this table, not by the
  * rate value itself.  Values of 0x00 are
  * reserved positions.
@@ -212,107 +95,9 @@ u8 lbs_data_rate_to_fw_index(u32 rate)
         return 0;
 }
 
-/**
- * Attributes exported through sysfs
- */
-
-/**
- * @brief Get function for sysfs attribute anycast_mask
- */
-static ssize_t lbs_anycast_get(struct device *dev,
-                struct device_attribute *attr, char * buf)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        struct cmd_ds_mesh_access mesh_access;
-        int ret;
-
-        memset(&mesh_access, 0, sizeof(mesh_access));
-
-        ret = lbs_mesh_access(priv, CMD_ACT_MESH_GET_ANYCAST, &mesh_access);
-        if (ret)
-                return ret;
-
-        return snprintf(buf, 12, "0x%X\n", le32_to_cpu(mesh_access.data[0]));
-}
-
-/**
- * @brief Set function for sysfs attribute anycast_mask
- */
-static ssize_t lbs_anycast_set(struct device *dev,
-                struct device_attribute *attr, const char * buf, size_t count)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        struct cmd_ds_mesh_access mesh_access;
-        uint32_t datum;
-        int ret;
-
-        memset(&mesh_access, 0, sizeof(mesh_access));
-        sscanf(buf, "%x", &datum);
-        mesh_access.data[0] = cpu_to_le32(datum);
-
-        ret = lbs_mesh_access(priv, CMD_ACT_MESH_SET_ANYCAST, &mesh_access);
-        if (ret)
-                return ret;
-
-        return strlen(buf);
-}
-
-/**
- * @brief Get function for sysfs attribute prb_rsp_limit
- */
-static ssize_t lbs_prb_rsp_limit_get(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        struct cmd_ds_mesh_access mesh_access;
-        int ret;
-        u32 retry_limit;
-
-        memset(&mesh_access, 0, sizeof(mesh_access));
-        mesh_access.data[0] = cpu_to_le32(CMD_ACT_GET);
-
-        ret = lbs_mesh_access(priv, CMD_ACT_MESH_SET_GET_PRB_RSP_LIMIT,
-                        &mesh_access);
-        if (ret)
-                return ret;
-
-        retry_limit = le32_to_cpu(mesh_access.data[1]);
-        return snprintf(buf, 10, "%d\n", retry_limit);
-}
-
-/**
- * @brief Set function for sysfs attribute prb_rsp_limit
- */
-static ssize_t lbs_prb_rsp_limit_set(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t count)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        struct cmd_ds_mesh_access mesh_access;
-        int ret;
-        unsigned long retry_limit;
-
-        memset(&mesh_access, 0, sizeof(mesh_access));
-        mesh_access.data[0] = cpu_to_le32(CMD_ACT_SET);
-
-        if (!strict_strtoul(buf, 10, &retry_limit))
-                return -ENOTSUPP;
-        if (retry_limit > 15)
-                return -ENOTSUPP;
-
-        mesh_access.data[1] = cpu_to_le32(retry_limit);
-
-        ret = lbs_mesh_access(priv, CMD_ACT_MESH_SET_GET_PRB_RSP_LIMIT,
-                        &mesh_access);
-        if (ret)
-                return ret;
-
-        return strlen(buf);
-}
 
 static int lbs_add_rtap(struct lbs_private *priv);
 static void lbs_remove_rtap(struct lbs_private *priv);
-static int lbs_add_mesh(struct lbs_private *priv);
-static void lbs_remove_mesh(struct lbs_private *priv);
 
 
 /**
@@ -339,7 +124,7 @@ static ssize_t lbs_rtap_set(struct device *dev,
                 if (priv->monitormode == monitor_mode)
                         return strlen(buf);
                 if (!priv->monitormode) {
-                        if (priv->infra_open || priv->mesh_open)
+                        if (priv->infra_open || lbs_mesh_open(priv))
                                 return -EBUSY;
                         if (priv->mode == IW_MODE_INFRA)
                                 lbs_cmd_80211_deauthenticate(priv,
@@ -378,74 +163,7 @@ static ssize_t lbs_rtap_set(struct device *dev,
 static DEVICE_ATTR(lbs_rtap, 0644, lbs_rtap_get, lbs_rtap_set );
 
 /**
- * Get function for sysfs attribute mesh
- */
-static ssize_t lbs_mesh_get(struct device *dev,
-                struct device_attribute *attr, char * buf)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        return snprintf(buf, 5, "0x%X\n", !!priv->mesh_dev);
-}
-
-/**
- *  Set function for sysfs attribute mesh
- */
-static ssize_t lbs_mesh_set(struct device *dev,
-                struct device_attribute *attr, const char * buf, size_t count)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        int enable;
-        int ret, action = CMD_ACT_MESH_CONFIG_STOP;
-
-        sscanf(buf, "%x", &enable);
-        enable = !!enable;
-        if (enable == !!priv->mesh_dev)
-                return count;
-        if (enable)
-                action = CMD_ACT_MESH_CONFIG_START;
-        ret = lbs_mesh_config(priv, action, priv->curbssparams.channel);
-        if (ret)
-                return ret;
-
-        if (enable)
-                lbs_add_mesh(priv);
-        else
-                lbs_remove_mesh(priv);
-
-        return count;
-}
-
-/**
- * lbs_mesh attribute to be exported per ethX interface
- * through sysfs (/sys/class/net/ethX/lbs_mesh)
- */
-static DEVICE_ATTR(lbs_mesh, 0644, lbs_mesh_get, lbs_mesh_set);
-
-/**
- * anycast_mask attribute to be exported per mshX interface
- * through sysfs (/sys/class/net/mshX/anycast_mask)
- */
-static DEVICE_ATTR(anycast_mask, 0644, lbs_anycast_get, lbs_anycast_set);
-
-/**
- * prb_rsp_limit attribute to be exported per mshX interface
- * through sysfs (/sys/class/net/mshX/prb_rsp_limit)
- */
-static DEVICE_ATTR(prb_rsp_limit, 0644, lbs_prb_rsp_limit_get,
-                lbs_prb_rsp_limit_set);
-
-static struct attribute *lbs_mesh_sysfs_entries[] = {
-        &dev_attr_anycast_mask.attr,
-        &dev_attr_prb_rsp_limit.attr,
-        NULL,
-};
-
-static struct attribute_group lbs_mesh_attr_group = {
-        .attrs = lbs_mesh_sysfs_entries,
-};
-
-/**
- *  @brief This function opens the ethX or mshX interface
+ *  @brief This function opens the ethX interface
  *
  *  @param dev     A pointer to net_device structure
  *  @return        0 or -EBUSY if monitor mode active
@@ -464,18 +182,12 @@ static int lbs_dev_open(struct net_device *dev)
                 goto out;
         }
 
-        if (dev == priv->mesh_dev) {
-                priv->mesh_open = 1;
-                priv->mesh_connect_status = LBS_CONNECTED;
-                netif_carrier_on(dev);
-        } else {
-                priv->infra_open = 1;
+        priv->infra_open = 1;
 
-                if (priv->connect_status == LBS_CONNECTED)
-                        netif_carrier_on(dev);
-                else
-                        netif_carrier_off(dev);
-        }
+        if (priv->connect_status == LBS_CONNECTED)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
 
         if (!priv->tx_pending_len)
                 netif_wake_queue(dev);
@@ -487,33 +199,6 @@ static int lbs_dev_open(struct net_device *dev)
 }
 
 /**
- *  @brief This function closes the mshX interface
- *
- *  @param dev     A pointer to net_device structure
- *  @return        0
- */
-static int lbs_mesh_stop(struct net_device *dev)
-{
-        struct lbs_private *priv = dev->ml_priv;
-
-        lbs_deb_enter(LBS_DEB_MESH);
-        spin_lock_irq(&priv->driver_lock);
-
-        priv->mesh_open = 0;
-        priv->mesh_connect_status = LBS_DISCONNECTED;
-
-        netif_stop_queue(dev);
-        netif_carrier_off(dev);
-
-        spin_unlock_irq(&priv->driver_lock);
-
-        schedule_work(&priv->mcast_work);
-
-        lbs_deb_leave(LBS_DEB_MESH);
-        return 0;
-}
-
-/**
  *  @brief This function closes the ethX interface
  *
  *  @param dev     A pointer to net_device structure
@@ -574,15 +259,17 @@ void lbs_host_to_card_done(struct lbs_private *priv)
         priv->dnld_sent = DNLD_RES_RECEIVED;
 
         /* Wake main thread if commands are pending */
-        if (!priv->cur_cmd || priv->tx_pending_len > 0)
-                wake_up_interruptible(&priv->waitq);
+        if (!priv->cur_cmd || priv->tx_pending_len > 0) {
+                if (!priv->wakeup_dev_required)
+                        wake_up_interruptible(&priv->waitq);
+        }
 
         spin_unlock_irqrestore(&priv->driver_lock, flags);
         lbs_deb_leave(LBS_DEB_THREAD);
 }
 EXPORT_SYMBOL_GPL(lbs_host_to_card_done);
 
-static int lbs_set_mac_address(struct net_device *dev, void *addr)
+int lbs_set_mac_address(struct net_device *dev, void *addr)
 {
         int ret = 0;
         struct lbs_private *priv = dev->ml_priv;
@@ -633,15 +320,18 @@ static int lbs_add_mcast_addrs(struct cmd_ds_mac_multicast_adr *cmd,
 {
         int i = nr_addrs;
         struct dev_mc_list *mc_list;
+        int cnt;
 
         if ((dev->flags & (IFF_UP|IFF_MULTICAST)) != (IFF_UP|IFF_MULTICAST))
                 return nr_addrs;
 
         netif_addr_lock_bh(dev);
-        for (mc_list = dev->mc_list; mc_list; mc_list = mc_list->next) {
+        cnt = netdev_mc_count(dev);
+        netdev_for_each_mc_addr(mc_list, dev) {
                 if (mac_in_list(cmd->maclist, nr_addrs, mc_list->dmi_addr)) {
                         lbs_deb_net("mcast address %s:%pM skipped\n", dev->name,
                                     mc_list->dmi_addr);
+                        cnt--;
                         continue;
                 }
 
@@ -651,9 +341,10 @@ static int lbs_add_mcast_addrs(struct cmd_ds_mac_multicast_adr *cmd,
                 lbs_deb_net("mcast address %s:%pM added to filter\n", dev->name,
                             mc_list->dmi_addr);
                 i++;
+                cnt--;
         }
         netif_addr_unlock_bh(dev);
-        if (mc_list)
+        if (cnt)
                 return -EOVERFLOW;
 
         return i;
@@ -716,7 +407,7 @@ static void lbs_set_mcast_worker(struct work_struct *work)
         lbs_deb_leave(LBS_DEB_NET);
 }
 
-static void lbs_set_multicast_list(struct net_device *dev)
+void lbs_set_multicast_list(struct net_device *dev)
 {
         struct lbs_private *priv = dev->ml_priv;
 
@@ -770,9 +461,10 @@ static int lbs_thread(void *data)
                         shouldsleep = 0;        /* We have a command response */
                 else if (priv->cur_cmd)
                         shouldsleep = 1;        /* Can't send a command; one already running */
-                else if (!list_empty(&priv->cmdpendingq))
+                else if (!list_empty(&priv->cmdpendingq) &&
+                                        !(priv->wakeup_dev_required))
                         shouldsleep = 0;        /* We have a command to send */
-                else if (__kfifo_len(priv->event_fifo))
+                else if (kfifo_len(&priv->event_fifo))
                         shouldsleep = 0;        /* We have an event to process */
                 else
                         shouldsleep = 1;        /* No command */
@@ -822,46 +514,41 @@ static int lbs_thread(void *data)
                 }
                 spin_unlock_irq(&priv->driver_lock);
 
-                /* command timeout stuff */
-                if (priv->cmd_timed_out && priv->cur_cmd) {
-                        struct cmd_ctrl_node *cmdnode = priv->cur_cmd;
-
-                        if (++priv->nr_retries > 3) {
-                                lbs_pr_info("Excessive timeouts submitting "
-                                        "command 0x%04x\n",
-                                        le16_to_cpu(cmdnode->cmdbuf->command));
-                                lbs_complete_command(priv, cmdnode, -ETIMEDOUT);
-                                priv->nr_retries = 0;
-                                if (priv->reset_card)
-                                        priv->reset_card(priv);
-                        } else {
-                                priv->cur_cmd = NULL;
-                                priv->dnld_sent = DNLD_RES_RECEIVED;
-                                lbs_pr_info("requeueing command 0x%04x due "
-                                        "to timeout (#%d)\n",
-                                        le16_to_cpu(cmdnode->cmdbuf->command),
-                                        priv->nr_retries);
-
-                                /* Stick it back at the _top_ of the pending queue
-                                   for immediate resubmission */
-                                list_add(&cmdnode->list, &priv->cmdpendingq);
-                        }
-                }
-                priv->cmd_timed_out = 0;
-
                 /* Process hardware events, e.g. card removed, link lost */
                 spin_lock_irq(&priv->driver_lock);
-                while (__kfifo_len(priv->event_fifo)) {
+                while (kfifo_len(&priv->event_fifo)) {
                         u32 event;
 
-                        __kfifo_get(priv->event_fifo, (unsigned char *) &event,
-                                sizeof(event));
+                        if (kfifo_out(&priv->event_fifo,
+                                (unsigned char *) &event, sizeof(event)) !=
+                                sizeof(event))
+                                        break;
                         spin_unlock_irq(&priv->driver_lock);
                         lbs_process_event(priv, event);
                         spin_lock_irq(&priv->driver_lock);
                 }
                 spin_unlock_irq(&priv->driver_lock);
 
+                if (priv->wakeup_dev_required) {
+                        lbs_deb_thread("Waking up device...\n");
+                        /* Wake up device */
+                        if (priv->exit_deep_sleep(priv))
+                                lbs_deb_thread("Wakeup device failed\n");
+                        continue;
+                }
+
+                /* command timeout stuff */
+                if (priv->cmd_timed_out && priv->cur_cmd) {
+                        struct cmd_ctrl_node *cmdnode = priv->cur_cmd;
+
+                        lbs_pr_info("Timeout submitting command 0x%04x\n",
+                                le16_to_cpu(cmdnode->cmdbuf->command));
+                        lbs_complete_command(priv, cmdnode, -ETIMEDOUT);
+                        if (priv->reset_card)
+                                priv->reset_card(priv);
+                }
+                priv->cmd_timed_out = 0;
+
                 if (!priv->fw_ready)
                         continue;
 
@@ -894,6 +581,9 @@ static int lbs_thread(void *data)
                     (priv->psstate == PS_STATE_PRE_SLEEP))
                         continue;
 
+                if (priv->is_deep_sleep)
+                        continue;
+
                 /* Execute the next command */
                 if (!priv->dnld_sent && !priv->cur_cmd)
                         lbs_execute_next_command(priv);
@@ -920,7 +610,7 @@ static int lbs_thread(void *data)
                                 if (priv->connect_status == LBS_CONNECTED)
                                         netif_wake_queue(priv->dev);
                                 if (priv->mesh_dev &&
-                                    priv->mesh_connect_status == LBS_CONNECTED)
+                                    lbs_mesh_connected(priv))
                                         netif_wake_queue(priv->mesh_dev);
                         }
                 }
@@ -928,6 +618,7 @@ static int lbs_thread(void *data)
         }
 
         del_timer(&priv->command_timer);
+        del_timer(&priv->auto_deepsleep_timer);
         wake_up_all(&priv->cmd_pending);
 
         lbs_deb_leave(LBS_DEB_THREAD);
@@ -1029,7 +720,7 @@ done:
  *  This function handles the timeout of command sending.
  *  It will re-send the same command again.
  */
-static void command_timer_fn(unsigned long data)
+static void lbs_cmd_timeout_handler(unsigned long data)
 {
         struct lbs_private *priv = (struct lbs_private *)data;
         unsigned long flags;
@@ -1050,17 +741,61 @@ out:
         lbs_deb_leave(LBS_DEB_CMD);
 }
 
-static void lbs_sync_channel_worker(struct work_struct *work)
+/**
+ *  This function put the device back to deep sleep mode when timer expires
+ *  and no activity (command, event, data etc.) is detected.
+ */
+static void auto_deepsleep_timer_fn(unsigned long data)
 {
-        struct lbs_private *priv = container_of(work, struct lbs_private,
-                sync_channel);
+        struct lbs_private *priv = (struct lbs_private *)data;
+        int ret;
 
-        lbs_deb_enter(LBS_DEB_MAIN);
-        if (lbs_update_channel(priv))
-                lbs_pr_info("Channel synchronization failed.");
-        lbs_deb_leave(LBS_DEB_MAIN);
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        if (priv->is_activity_detected) {
+                priv->is_activity_detected = 0;
+        } else {
+                if (priv->is_auto_deep_sleep_enabled &&
+                                (!priv->wakeup_dev_required) &&
+                                (priv->connect_status != LBS_CONNECTED)) {
+                        lbs_deb_main("Entering auto deep sleep mode...\n");
+                        ret = lbs_prepare_and_send_command(priv,
+                                        CMD_802_11_DEEP_SLEEP, 0,
+                                        0, 0, NULL);
+                        if (ret)
+                                lbs_pr_err("Enter Deep Sleep command failed\n");
+                }
+        }
+        mod_timer(&priv->auto_deepsleep_timer , jiffies +
+                                (priv->auto_deep_sleep_timeout * HZ)/1000);
+        lbs_deb_leave(LBS_DEB_CMD);
+}
+
+int lbs_enter_auto_deep_sleep(struct lbs_private *priv)
+{
+        lbs_deb_enter(LBS_DEB_SDIO);
+
+        priv->is_auto_deep_sleep_enabled = 1;
+        if (priv->is_deep_sleep)
+                priv->wakeup_dev_required = 1;
+        mod_timer(&priv->auto_deepsleep_timer ,
+                        jiffies + (priv->auto_deep_sleep_timeout * HZ)/1000);
+
+        lbs_deb_leave(LBS_DEB_SDIO);
+        return 0;
 }
 
+int lbs_exit_auto_deep_sleep(struct lbs_private *priv)
+{
+        lbs_deb_enter(LBS_DEB_SDIO);
+
+        priv->is_auto_deep_sleep_enabled = 0;
+        priv->auto_deep_sleep_timeout = 0;
+        del_timer(&priv->auto_deepsleep_timer);
+
+        lbs_deb_leave(LBS_DEB_SDIO);
+        return 0;
+}
 
 static int lbs_init_adapter(struct lbs_private *priv)
 {
@@ -1089,21 +824,25 @@ static int lbs_init_adapter(struct lbs_private *priv)
         memset(priv->current_addr, 0xff, ETH_ALEN);
 
         priv->connect_status = LBS_DISCONNECTED;
-        priv->mesh_connect_status = LBS_DISCONNECTED;
         priv->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
         priv->mode = IW_MODE_INFRA;
-        priv->curbssparams.channel = DEFAULT_AD_HOC_CHANNEL;
+        priv->channel = DEFAULT_AD_HOC_CHANNEL;
         priv->mac_control = CMD_ACT_MAC_RX_ON | CMD_ACT_MAC_TX_ON;
         priv->radio_on = 1;
         priv->enablehwauto = 1;
-        priv->capability = WLAN_CAPABILITY_SHORT_PREAMBLE;
         priv->psmode = LBS802_11POWERMODECAM;
         priv->psstate = PS_STATE_FULL_POWER;
+        priv->is_deep_sleep = 0;
+        priv->is_auto_deep_sleep_enabled = 0;
+        priv->wakeup_dev_required = 0;
+        init_waitqueue_head(&priv->ds_awake_q);
 
         mutex_init(&priv->lock);
 
-        setup_timer(&priv->command_timer, command_timer_fn,
+        setup_timer(&priv->command_timer, lbs_cmd_timeout_handler,
                 (unsigned long)priv);
+        setup_timer(&priv->auto_deepsleep_timer, auto_deepsleep_timer_fn,
+                        (unsigned long)priv);
 
         INIT_LIST_HEAD(&priv->cmdfreeq);
         INIT_LIST_HEAD(&priv->cmdpendingq);
@@ -1121,10 +860,9 @@ static int lbs_init_adapter(struct lbs_private *priv)
         priv->resp_len[0] = priv->resp_len[1] = 0;
 
         /* Create the event FIFO */
-        priv->event_fifo = kfifo_alloc(sizeof(u32) * 16, GFP_KERNEL, NULL);
-        if (IS_ERR(priv->event_fifo)) {
+        ret = kfifo_alloc(&priv->event_fifo, sizeof(u32) * 16, GFP_KERNEL);
+        if (ret) {
                 lbs_pr_err("Out of memory allocating event FIFO buffer\n");
-                ret = -ENOMEM;
                 goto out;
         }
 
@@ -1139,9 +877,9 @@ static void lbs_free_adapter(struct lbs_private *priv)
         lbs_deb_enter(LBS_DEB_MAIN);
 
         lbs_free_cmd_buffer(priv);
-        if (priv->event_fifo)
-                kfifo_free(priv->event_fifo);
+        kfifo_free(&priv->event_fifo);
         del_timer(&priv->command_timer);
+        del_timer(&priv->auto_deepsleep_timer);
         kfree(priv->networks);
         priv->networks = NULL;
 
@@ -1168,31 +906,41 @@ static const struct net_device_ops lbs_netdev_ops = {
  */
 struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
 {
-        struct net_device *dev = NULL;
+        struct net_device *dev;
+        struct wireless_dev *wdev;
         struct lbs_private *priv = NULL;
 
         lbs_deb_enter(LBS_DEB_MAIN);
 
         /* Allocate an Ethernet device and register it */
-        dev = alloc_etherdev(sizeof(struct lbs_private));
-        if (!dev) {
-                lbs_pr_err("init wlanX device failed\n");
+        wdev = lbs_cfg_alloc(dmdev);
+        if (IS_ERR(wdev)) {
+                lbs_pr_err("cfg80211 init failed\n");
                 goto done;
         }
-        priv = netdev_priv(dev);
-        dev->ml_priv = priv;
+        /* TODO? */
+        wdev->iftype = NL80211_IFTYPE_STATION;
+        priv = wdev_priv(wdev);
+        priv->wdev = wdev;
 
         if (lbs_init_adapter(priv)) {
                 lbs_pr_err("failed to initialize adapter structure.\n");
-                goto err_init_adapter;
+                goto err_wdev;
         }
 
+        //TODO? dev = alloc_netdev_mq(0, "wlan%d", ether_setup, IWM_TX_QUEUES);
+        dev = alloc_netdev(0, "wlan%d", ether_setup);
+        if (!dev) {
+                dev_err(dmdev, "no memory for network device instance\n");
+                goto err_adapter;
+        }
+
+        dev->ieee80211_ptr = wdev;
+        dev->ml_priv = priv;
+        SET_NETDEV_DEV(dev, dmdev);
+        wdev->netdev = dev;
         priv->dev = dev;
-        priv->card = card;
-        priv->mesh_open = 0;
-        priv->infra_open = 0;
 
-        /* Setup the OS Interface to our functions */
         dev->netdev_ops = &lbs_netdev_ops;
         dev->watchdog_timeo = 5 * HZ;
         dev->ethtool_ops = &lbs_ethtool_ops;
@@ -1201,7 +949,13 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
 #endif
         dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
 
-        SET_NETDEV_DEV(dev, dmdev);
+
+        // TODO: kzalloc + iwm_init_default_profile(iwm, iwm->umac_profile); ??
+
+
+        priv->card = card;
+        priv->infra_open = 0;
+
 
         priv->rtap_net_dev = NULL;
         strcpy(dev->name, "wlan%d");
@@ -1211,26 +965,28 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
         priv->main_thread = kthread_run(lbs_thread, dev, "lbs_main");
         if (IS_ERR(priv->main_thread)) {
                 lbs_deb_thread("Error creating main thread.\n");
-                goto err_init_adapter;
+                goto err_ndev;
         }
 
         priv->work_thread = create_singlethread_workqueue("lbs_worker");
         INIT_DELAYED_WORK(&priv->assoc_work, lbs_association_worker);
         INIT_DELAYED_WORK(&priv->scan_work, lbs_scan_worker);
         INIT_WORK(&priv->mcast_work, lbs_set_mcast_worker);
-        INIT_WORK(&priv->sync_channel, lbs_sync_channel_worker);
-
-        sprintf(priv->mesh_ssid, "mesh");
-        priv->mesh_ssid_len = 4;
 
         priv->wol_criteria = 0xffffffff;
         priv->wol_gpio = 0xff;
 
         goto done;
 
-err_init_adapter:
-        lbs_free_adapter(priv);
+ err_ndev:
         free_netdev(dev);
+
+ err_adapter:
+        lbs_free_adapter(priv);
+
+ err_wdev:
+        lbs_cfg_free(priv);
+
         priv = NULL;
 
 done:
@@ -1243,7 +999,6 @@ EXPORT_SYMBOL_GPL(lbs_add_card);
 void lbs_remove_card(struct lbs_private *priv)
 {
         struct net_device *dev = priv->dev;
-        union iwreq_data wrqu;
 
         lbs_deb_enter(LBS_DEB_MAIN);
 
@@ -1268,15 +1023,19 @@ void lbs_remove_card(struct lbs_private *priv)
                 lbs_ps_wakeup(priv, CMD_OPTION_WAITFORRSP);
         }
 
-        memset(wrqu.ap_addr.sa_data, 0xaa, ETH_ALEN);
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
+        lbs_send_disconnect_notification(priv);
+
+        if (priv->is_deep_sleep) {
+                priv->is_deep_sleep = 0;
+                wake_up_interruptible(&priv->ds_awake_q);
+        }
 
         /* Stop the thread servicing the interrupts */
         priv->surpriseremoved = 1;
         kthread_stop(priv->main_thread);
 
         lbs_free_adapter(priv);
+        lbs_cfg_free(priv);
 
         priv->dev = NULL;
         free_netdev(dev);
@@ -1286,6 +1045,17 @@ void lbs_remove_card(struct lbs_private *priv)
 EXPORT_SYMBOL_GPL(lbs_remove_card);
 
 
+static int lbs_rtap_supported(struct lbs_private *priv)
+{
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) == MRVL_FW_V5)
+                return 1;
+
+        /* newer firmware use a capability mask */
+        return ((MRVL_FW_MAJOR_REV(priv->fwrelease) >= MRVL_FW_V10) &&
+                (priv->fwcapinfo & MESH_CAPINFO_ENABLE_MASK));
+}
+
+
 int lbs_start_card(struct lbs_private *priv)
 {
         struct net_device *dev = priv->dev;
@@ -1298,60 +1068,21 @@ int lbs_start_card(struct lbs_private *priv)
         if (ret)
                 goto done;
 
-        /* init 802.11d */
-        lbs_init_11d(priv);
-
-        if (register_netdev(dev)) {
-                lbs_pr_err("cannot register ethX device\n");
+        if (lbs_cfg_register(priv)) {
+                lbs_pr_err("cannot register device\n");
                 goto done;
         }
 
         lbs_update_channel(priv);
 
-        /* Check mesh FW version and appropriately send the mesh start
-         * command
-         */
-        if (priv->mesh_fw_ver == MESH_FW_OLD) {
-                /* Enable mesh, if supported, and work out which TLV it uses.
-                   0x100 + 291 is an unofficial value used in 5.110.20.pXX
-                   0x100 + 37 is the official value used in 5.110.21.pXX
-                   but we check them in that order because 20.pXX doesn't
-                   give an error -- it just silently fails. */
-
-                /* 5.110.20.pXX firmware will fail the command if the channel
-                   doesn't match the existing channel. But only if the TLV
-                   is correct. If the channel is wrong, _BOTH_ versions will
-                   give an error to 0x100+291, and allow 0x100+37 to succeed.
-                   It's just that 5.110.20.pXX will not have done anything
-                   useful */
-
-                priv->mesh_tlv = TLV_TYPE_OLD_MESH_ID;
-                if (lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
-                                    priv->curbssparams.channel)) {
-                        priv->mesh_tlv = TLV_TYPE_MESH_ID;
-                        if (lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
-                                            priv->curbssparams.channel))
-                                priv->mesh_tlv = 0;
-                }
-        } else if (priv->mesh_fw_ver == MESH_FW_NEW) {
-                /* 10.0.0.pXX new firmwares should succeed with TLV
-                 * 0x100+37; Do not invoke command with old TLV.
-                 */
-                priv->mesh_tlv = TLV_TYPE_MESH_ID;
-                if (lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
-                                    priv->curbssparams.channel))
-                        priv->mesh_tlv = 0;
-        }
-        if (priv->mesh_tlv) {
-                lbs_add_mesh(priv);
-
-                if (device_create_file(&dev->dev, &dev_attr_lbs_mesh))
-                        lbs_pr_err("cannot register lbs_mesh attribute\n");
+        lbs_init_mesh(priv);
 
-                /* While rtap isn't related to mesh, only mesh-enabled
-                 * firmware implements the rtap functionality via
-                 * CMD_802_11_MONITOR_MODE.
-                 */
+        /*
+         * While rtap isn't related to mesh, only mesh-enabled
+         * firmware implements the rtap functionality via
+         * CMD_802_11_MONITOR_MODE.
+         */
+        if (lbs_rtap_supported(priv)) {
                 if (device_create_file(&dev->dev, &dev_attr_lbs_rtap))
                         lbs_pr_err("cannot register lbs_rtap attribute\n");
         }
@@ -1385,13 +1116,14 @@ void lbs_stop_card(struct lbs_private *priv)
         netif_carrier_off(dev);
 
         lbs_debugfs_remove_one(priv);
-        if (priv->mesh_tlv) {
-                device_remove_file(&dev->dev, &dev_attr_lbs_mesh);
+        lbs_deinit_mesh(priv);
+
+        if (lbs_rtap_supported(priv))
                 device_remove_file(&dev->dev, &dev_attr_lbs_rtap);
-        }
 
         /* Delete the timeout of the currently processing command */
         del_timer_sync(&priv->command_timer);
+        del_timer_sync(&priv->auto_deepsleep_timer);
 
         /* Flush pending command nodes */
         spin_lock_irqsave(&priv->driver_lock, flags);
@@ -1420,157 +1152,6 @@ out:
 EXPORT_SYMBOL_GPL(lbs_stop_card);
 
 
-static const struct net_device_ops mesh_netdev_ops = {
-        .ndo_open               = lbs_dev_open,
-        .ndo_stop               = lbs_mesh_stop,
-        .ndo_start_xmit         = lbs_hard_start_xmit,
-        .ndo_set_mac_address    = lbs_set_mac_address,
-        .ndo_set_multicast_list = lbs_set_multicast_list,
-};
-
-/**
- * @brief This function adds mshX interface
- *
- *  @param priv    A pointer to the struct lbs_private structure
- *  @return        0 if successful, -X otherwise
- */
-static int lbs_add_mesh(struct lbs_private *priv)
-{
-        struct net_device *mesh_dev = NULL;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_MESH);
-
-        /* Allocate a virtual mesh device */
-        if (!(mesh_dev = alloc_netdev(0, "msh%d", ether_setup))) {
-                lbs_deb_mesh("init mshX device failed\n");
-                ret = -ENOMEM;
-                goto done;
-        }
-        mesh_dev->ml_priv = priv;
-        priv->mesh_dev = mesh_dev;
-
-        mesh_dev->netdev_ops = &mesh_netdev_ops;
-        mesh_dev->ethtool_ops = &lbs_ethtool_ops;
-        memcpy(mesh_dev->dev_addr, priv->dev->dev_addr,
-                        sizeof(priv->dev->dev_addr));
-
-        SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent);
-
-#ifdef  WIRELESS_EXT
-        mesh_dev->wireless_handlers = (struct iw_handler_def *)&mesh_handler_def;
-#endif
-        mesh_dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
-        /* Register virtual mesh interface */
-        ret = register_netdev(mesh_dev);
-        if (ret) {
-                lbs_pr_err("cannot register mshX virtual interface\n");
-                goto err_free;
-        }
-
-        ret = sysfs_create_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group);
-        if (ret)
-                goto err_unregister;
-
-        lbs_persist_config_init(mesh_dev);
-
-        /* Everything successful */
-        ret = 0;
-        goto done;
-
-err_unregister:
-        unregister_netdev(mesh_dev);
-
-err_free:
-        free_netdev(mesh_dev);
-
-done:
-        lbs_deb_leave_args(LBS_DEB_MESH, "ret %d", ret);
-        return ret;
-}
-
-static void lbs_remove_mesh(struct lbs_private *priv)
-{
-        struct net_device *mesh_dev;
-
-
-        mesh_dev = priv->mesh_dev;
-        if (!mesh_dev)
-                return;
-
-        lbs_deb_enter(LBS_DEB_MESH);
-        netif_stop_queue(mesh_dev);
-        netif_carrier_off(mesh_dev);
-        sysfs_remove_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group);
-        lbs_persist_config_remove(mesh_dev);
-        unregister_netdev(mesh_dev);
-        priv->mesh_dev = NULL;
-        free_netdev(mesh_dev);
-        lbs_deb_leave(LBS_DEB_MESH);
-}
-
-/**
- *  @brief This function finds the CFP in
- *  region_cfp_table based on region and band parameter.
- *
- *  @param region  The region code
- *  @param band    The band
- *  @param cfp_no  A pointer to CFP number
- *  @return        A pointer to CFP
- */
-struct chan_freq_power *lbs_get_region_cfp_table(u8 region, int *cfp_no)
-{
-        int i, end;
-
-        lbs_deb_enter(LBS_DEB_MAIN);
-
-        end = ARRAY_SIZE(region_cfp_table);
-
-        for (i = 0; i < end ; i++) {
-                lbs_deb_main("region_cfp_table[i].region=%d\n",
-                        region_cfp_table[i].region);
-                if (region_cfp_table[i].region == region) {
-                        *cfp_no = region_cfp_table[i].cfp_no_BG;
-                        lbs_deb_leave(LBS_DEB_MAIN);
-                        return region_cfp_table[i].cfp_BG;
-                }
-        }
-
-        lbs_deb_leave_args(LBS_DEB_MAIN, "ret NULL");
-        return NULL;
-}
-
-int lbs_set_regiontable(struct lbs_private *priv, u8 region, u8 band)
-{
-        int ret = 0;
-        int i = 0;
-
-        struct chan_freq_power *cfp;
-        int cfp_no;
-
-        lbs_deb_enter(LBS_DEB_MAIN);
-
-        memset(priv->region_channel, 0, sizeof(priv->region_channel));
-
-        cfp = lbs_get_region_cfp_table(region, &cfp_no);
-        if (cfp != NULL) {
-                priv->region_channel[i].nrcfp = cfp_no;
-                priv->region_channel[i].CFP = cfp;
-        } else {
-                lbs_deb_main("wrong region code %#x in band B/G\n",
-                       region);
-                ret = -1;
-                goto out;
-        }
-        priv->region_channel[i].valid = 1;
-        priv->region_channel[i].region = region;
-        priv->region_channel[i].band = band;
-        i++;
-out:
-        lbs_deb_leave_args(LBS_DEB_MAIN, "ret %d", ret);
-        return ret;
-}
-
 void lbs_queue_event(struct lbs_private *priv, u32 event)
 {
         unsigned long flags;
@@ -1581,7 +1162,7 @@ void lbs_queue_event(struct lbs_private *priv, u32 event)
         if (priv->psstate == PS_STATE_SLEEP)
                 priv->psstate = PS_STATE_AWAKE;
 
-        __kfifo_put(priv->event_fifo, (unsigned char *) &event, sizeof(u32));
+        kfifo_in(&priv->event_fifo, (unsigned char *) &event, sizeof(u32));
 
         wake_up_interruptible(&priv->waitq);
 
diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c
new file mode 100644
index 000000000000..e385af1f4583
--- /dev/null
+++ b/drivers/net/wireless/libertas/mesh.c
@@ -0,0 +1,1154 @@
+#include <linux/delay.h>
+#include <linux/etherdevice.h>
+#include <linux/netdevice.h>
+#include <linux/if_ether.h>
+#include <linux/if_arp.h>
+#include <linux/kthread.h>
+#include <linux/kfifo.h>
+
+#include "mesh.h"
+#include "decl.h"
+#include "cmd.h"
+
+
+/***************************************************************************
+ * Mesh sysfs support
+ */
+
+/**
+ * Attributes exported through sysfs
+ */
+
+/**
+ * @brief Get function for sysfs attribute anycast_mask
+ */
+static ssize_t lbs_anycast_get(struct device *dev,
+                struct device_attribute *attr, char * buf)
+{
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        struct cmd_ds_mesh_access mesh_access;
+        int ret;
+
+        memset(&mesh_access, 0, sizeof(mesh_access));
+
+        ret = lbs_mesh_access(priv, CMD_ACT_MESH_GET_ANYCAST, &mesh_access);
+        if (ret)
+                return ret;
+
+        return snprintf(buf, 12, "0x%X\n", le32_to_cpu(mesh_access.data[0]));
+}
+
+/**
+ * @brief Set function for sysfs attribute anycast_mask
+ */
+static ssize_t lbs_anycast_set(struct device *dev,
+                struct device_attribute *attr, const char * buf, size_t count)
+{
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        struct cmd_ds_mesh_access mesh_access;
+        uint32_t datum;
+        int ret;
+
+        memset(&mesh_access, 0, sizeof(mesh_access));
+        sscanf(buf, "%x", &datum);
+        mesh_access.data[0] = cpu_to_le32(datum);
+
+        ret = lbs_mesh_access(priv, CMD_ACT_MESH_SET_ANYCAST, &mesh_access);
+        if (ret)
+                return ret;
+
+        return strlen(buf);
+}
+
+/**
+ * @brief Get function for sysfs attribute prb_rsp_limit
+ */
+static ssize_t lbs_prb_rsp_limit_get(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        struct cmd_ds_mesh_access mesh_access;
+        int ret;
+        u32 retry_limit;
+
+        memset(&mesh_access, 0, sizeof(mesh_access));
+        mesh_access.data[0] = cpu_to_le32(CMD_ACT_GET);
+
+        ret = lbs_mesh_access(priv, CMD_ACT_MESH_SET_GET_PRB_RSP_LIMIT,
+                        &mesh_access);
+        if (ret)
+                return ret;
+
+        retry_limit = le32_to_cpu(mesh_access.data[1]);
+        return snprintf(buf, 10, "%d\n", retry_limit);
+}
+
+/**
+ * @brief Set function for sysfs attribute prb_rsp_limit
+ */
+static ssize_t lbs_prb_rsp_limit_set(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        struct cmd_ds_mesh_access mesh_access;
+        int ret;
+        unsigned long retry_limit;
+
+        memset(&mesh_access, 0, sizeof(mesh_access));
+        mesh_access.data[0] = cpu_to_le32(CMD_ACT_SET);
+
+        if (!strict_strtoul(buf, 10, &retry_limit))
+                return -ENOTSUPP;
+        if (retry_limit > 15)
+                return -ENOTSUPP;
+
+        mesh_access.data[1] = cpu_to_le32(retry_limit);
+
+        ret = lbs_mesh_access(priv, CMD_ACT_MESH_SET_GET_PRB_RSP_LIMIT,
+                        &mesh_access);
+        if (ret)
+                return ret;
+
+        return strlen(buf);
+}
+
+/**
+ * Get function for sysfs attribute mesh
+ */
+static ssize_t lbs_mesh_get(struct device *dev,
+                struct device_attribute *attr, char * buf)
+{
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        return snprintf(buf, 5, "0x%X\n", !!priv->mesh_dev);
+}
+
+/**
+ *  Set function for sysfs attribute mesh
+ */
+static ssize_t lbs_mesh_set(struct device *dev,
+                struct device_attribute *attr, const char * buf, size_t count)
+{
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        int enable;
+        int ret, action = CMD_ACT_MESH_CONFIG_STOP;
+
+        sscanf(buf, "%x", &enable);
+        enable = !!enable;
+        if (enable == !!priv->mesh_dev)
+                return count;
+        if (enable)
+                action = CMD_ACT_MESH_CONFIG_START;
+        ret = lbs_mesh_config(priv, action, priv->channel);
+        if (ret)
+                return ret;
+
+        if (enable)
+                lbs_add_mesh(priv);
+        else
+                lbs_remove_mesh(priv);
+
+        return count;
+}
+
+/**
+ * lbs_mesh attribute to be exported per ethX interface
+ * through sysfs (/sys/class/net/ethX/lbs_mesh)
+ */
+static DEVICE_ATTR(lbs_mesh, 0644, lbs_mesh_get, lbs_mesh_set);
+
+/**
+ * anycast_mask attribute to be exported per mshX interface
+ * through sysfs (/sys/class/net/mshX/anycast_mask)
+ */
+static DEVICE_ATTR(anycast_mask, 0644, lbs_anycast_get, lbs_anycast_set);
+
+/**
+ * prb_rsp_limit attribute to be exported per mshX interface
+ * through sysfs (/sys/class/net/mshX/prb_rsp_limit)
+ */
+static DEVICE_ATTR(prb_rsp_limit, 0644, lbs_prb_rsp_limit_get,
+                lbs_prb_rsp_limit_set);
+
+static struct attribute *lbs_mesh_sysfs_entries[] = {
+        &dev_attr_anycast_mask.attr,
+        &dev_attr_prb_rsp_limit.attr,
+        NULL,
+};
+
+static struct attribute_group lbs_mesh_attr_group = {
+        .attrs = lbs_mesh_sysfs_entries,
+};
+
+
+
+/***************************************************************************
+ * Initializing and starting, stopping mesh
+ */
+
+/*
+ * Check mesh FW version and appropriately send the mesh start
+ * command
+ */
+int lbs_init_mesh(struct lbs_private *priv)
+{
+        struct net_device *dev = priv->dev;
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_MESH);
+
+        priv->mesh_connect_status = LBS_DISCONNECTED;
+
+        /* Determine mesh_fw_ver from fwrelease and fwcapinfo */
+        /* 5.0.16p0 9.0.0.p0 is known to NOT support any mesh */
+        /* 5.110.22 have mesh command with 0xa3 command id */
+        /* 10.0.0.p0 FW brings in mesh config command with different id */
+        /* Check FW version MSB and initialize mesh_fw_ver */
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) == MRVL_FW_V5) {
+                /* Enable mesh, if supported, and work out which TLV it uses.
+                   0x100 + 291 is an unofficial value used in 5.110.20.pXX
+                   0x100 + 37 is the official value used in 5.110.21.pXX
+                   but we check them in that order because 20.pXX doesn't
+                   give an error -- it just silently fails. */
+
+                /* 5.110.20.pXX firmware will fail the command if the channel
+                   doesn't match the existing channel. But only if the TLV
+                   is correct. If the channel is wrong, _BOTH_ versions will
+                   give an error to 0x100+291, and allow 0x100+37 to succeed.
+                   It's just that 5.110.20.pXX will not have done anything
+                   useful */
+
+                priv->mesh_tlv = TLV_TYPE_OLD_MESH_ID;
+                if (lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
+                                    priv->channel)) {
+                        priv->mesh_tlv = TLV_TYPE_MESH_ID;
+                        if (lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
+                                            priv->channel))
+                                priv->mesh_tlv = 0;
+                }
+        } else
+        if ((MRVL_FW_MAJOR_REV(priv->fwrelease) >= MRVL_FW_V10) &&
+                (priv->fwcapinfo & MESH_CAPINFO_ENABLE_MASK)) {
+                /* 10.0.0.pXX new firmwares should succeed with TLV
+                 * 0x100+37; Do not invoke command with old TLV.
+                 */
+                priv->mesh_tlv = TLV_TYPE_MESH_ID;
+                if (lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
+                                    priv->channel))
+                        priv->mesh_tlv = 0;
+        }
+
+
+        if (priv->mesh_tlv) {
+                sprintf(priv->mesh_ssid, "mesh");
+                priv->mesh_ssid_len = 4;
+
+                lbs_add_mesh(priv);
+
+                if (device_create_file(&dev->dev, &dev_attr_lbs_mesh))
+                        lbs_pr_err("cannot register lbs_mesh attribute\n");
+
+                ret = 1;
+        }
+
+        lbs_deb_leave_args(LBS_DEB_MESH, "ret %d", ret);
+        return ret;
+}
+
+
+int lbs_deinit_mesh(struct lbs_private *priv)
+{
+        struct net_device *dev = priv->dev;
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_MESH);
+
+        if (priv->mesh_tlv) {
+                device_remove_file(&dev->dev, &dev_attr_lbs_mesh);
+                ret = 1;
+        }
+
+        lbs_deb_leave_args(LBS_DEB_MESH, "ret %d", ret);
+        return ret;
+}
+
+
+/**
+ *  @brief This function closes the mshX interface
+ *
+ *  @param dev     A pointer to net_device structure
+ *  @return        0
+ */
+static int lbs_mesh_stop(struct net_device *dev)
+{
+        struct lbs_private *priv = dev->ml_priv;
+
+        lbs_deb_enter(LBS_DEB_MESH);
+        spin_lock_irq(&priv->driver_lock);
+
+        priv->mesh_open = 0;
+        priv->mesh_connect_status = LBS_DISCONNECTED;
+
+        netif_stop_queue(dev);
+        netif_carrier_off(dev);
+
+        spin_unlock_irq(&priv->driver_lock);
+
+        schedule_work(&priv->mcast_work);
+
+        lbs_deb_leave(LBS_DEB_MESH);
+        return 0;
+}
+
+/**
+ *  @brief This function opens the mshX interface
+ *
+ *  @param dev     A pointer to net_device structure
+ *  @return        0 or -EBUSY if monitor mode active
+ */
+static int lbs_mesh_dev_open(struct net_device *dev)
+{
+        struct lbs_private *priv = dev->ml_priv;
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_NET);
+
+        spin_lock_irq(&priv->driver_lock);
+
+        if (priv->monitormode) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        priv->mesh_open = 1;
+        priv->mesh_connect_status = LBS_CONNECTED;
+        netif_carrier_on(dev);
+
+        if (!priv->tx_pending_len)
+                netif_wake_queue(dev);
+ out:
+
+        spin_unlock_irq(&priv->driver_lock);
+        lbs_deb_leave_args(LBS_DEB_NET, "ret %d", ret);
+        return ret;
+}
+
+static const struct net_device_ops mesh_netdev_ops = {
+        .ndo_open               = lbs_mesh_dev_open,
+        .ndo_stop               = lbs_mesh_stop,
+        .ndo_start_xmit         = lbs_hard_start_xmit,
+        .ndo_set_mac_address    = lbs_set_mac_address,
+        .ndo_set_multicast_list = lbs_set_multicast_list,
+};
+
+/**
+ * @brief This function adds mshX interface
+ *
+ *  @param priv    A pointer to the struct lbs_private structure
+ *  @return        0 if successful, -X otherwise
+ */
+int lbs_add_mesh(struct lbs_private *priv)
+{
+        struct net_device *mesh_dev = NULL;
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_MESH);
+
+        /* Allocate a virtual mesh device */
+        mesh_dev = alloc_netdev(0, "msh%d", ether_setup);
+        if (!mesh_dev) {
+                lbs_deb_mesh("init mshX device failed\n");
+                ret = -ENOMEM;
+                goto done;
+        }
+        mesh_dev->ml_priv = priv;
+        priv->mesh_dev = mesh_dev;
+
+        mesh_dev->netdev_ops = &mesh_netdev_ops;
+        mesh_dev->ethtool_ops = &lbs_ethtool_ops;
+        memcpy(mesh_dev->dev_addr, priv->dev->dev_addr, ETH_ALEN);
+
+        SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent);
+
+#ifdef  WIRELESS_EXT
+        mesh_dev->wireless_handlers = &mesh_handler_def;
+#endif
+        mesh_dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
+        /* Register virtual mesh interface */
+        ret = register_netdev(mesh_dev);
+        if (ret) {
+                lbs_pr_err("cannot register mshX virtual interface\n");
+                goto err_free;
+        }
+
+        ret = sysfs_create_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group);
+        if (ret)
+                goto err_unregister;
+
+        lbs_persist_config_init(mesh_dev);
+
+        /* Everything successful */
+        ret = 0;
+        goto done;
+
+err_unregister:
+        unregister_netdev(mesh_dev);
+
+err_free:
+        free_netdev(mesh_dev);
+
+done:
+        lbs_deb_leave_args(LBS_DEB_MESH, "ret %d", ret);
+        return ret;
+}
+
+void lbs_remove_mesh(struct lbs_private *priv)
+{
+        struct net_device *mesh_dev;
+
+        mesh_dev = priv->mesh_dev;
+        if (!mesh_dev)
+                return;
+
+        lbs_deb_enter(LBS_DEB_MESH);
+        netif_stop_queue(mesh_dev);
+        netif_carrier_off(mesh_dev);
+        sysfs_remove_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group);
+        lbs_persist_config_remove(mesh_dev);
+        unregister_netdev(mesh_dev);
+        priv->mesh_dev = NULL;
+        free_netdev(mesh_dev);
+        lbs_deb_leave(LBS_DEB_MESH);
+}
+
+
+
+/***************************************************************************
+ * Sending and receiving
+ */
+struct net_device *lbs_mesh_set_dev(struct lbs_private *priv,
+        struct net_device *dev, struct rxpd *rxpd)
+{
+        if (priv->mesh_dev) {
+                if (priv->mesh_tlv == TLV_TYPE_OLD_MESH_ID) {
+                        if (rxpd->rx_control & RxPD_MESH_FRAME)
+                                dev = priv->mesh_dev;
+                } else if (priv->mesh_tlv == TLV_TYPE_MESH_ID) {
+                        if (rxpd->u.bss.bss_num == MESH_IFACE_ID)
+                                dev = priv->mesh_dev;
+                }
+        }
+        return dev;
+}
+
+
+void lbs_mesh_set_txpd(struct lbs_private *priv,
+        struct net_device *dev, struct txpd *txpd)
+{
+        if (dev == priv->mesh_dev) {
+                if (priv->mesh_tlv == TLV_TYPE_OLD_MESH_ID)
+                        txpd->tx_control |= cpu_to_le32(TxPD_MESH_FRAME);
+                else if (priv->mesh_tlv == TLV_TYPE_MESH_ID)
+                        txpd->u.bss.bss_num = MESH_IFACE_ID;
+        }
+}
+
+
+/***************************************************************************
+ * Mesh command handling
+ */
+
+int lbs_cmd_bt_access(struct cmd_ds_command *cmd,
+                               u16 cmd_action, void *pdata_buf)
+{
+        struct cmd_ds_bt_access *bt_access = &cmd->params.bt;
+        lbs_deb_enter_args(LBS_DEB_CMD, "action %d", cmd_action);
+
+        cmd->command = cpu_to_le16(CMD_BT_ACCESS);
+        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_bt_access) +
+                sizeof(struct cmd_header));
+        cmd->result = 0;
+        bt_access->action = cpu_to_le16(cmd_action);
+
+        switch (cmd_action) {
+        case CMD_ACT_BT_ACCESS_ADD:
+                memcpy(bt_access->addr1, pdata_buf, 2 * ETH_ALEN);
+                lbs_deb_hex(LBS_DEB_MESH, "BT_ADD: blinded MAC addr",
+                        bt_access->addr1, 6);
+                break;
+        case CMD_ACT_BT_ACCESS_DEL:
+                memcpy(bt_access->addr1, pdata_buf, 1 * ETH_ALEN);
+                lbs_deb_hex(LBS_DEB_MESH, "BT_DEL: blinded MAC addr",
+                        bt_access->addr1, 6);
+                break;
+        case CMD_ACT_BT_ACCESS_LIST:
+                bt_access->id = cpu_to_le32(*(u32 *) pdata_buf);
+                break;
+        case CMD_ACT_BT_ACCESS_RESET:
+                break;
+        case CMD_ACT_BT_ACCESS_SET_INVERT:
+                bt_access->id = cpu_to_le32(*(u32 *) pdata_buf);
+                break;
+        case CMD_ACT_BT_ACCESS_GET_INVERT:
+                break;
+        default:
+                break;
+        }
+        lbs_deb_leave(LBS_DEB_CMD);
+        return 0;
+}
+
+int lbs_cmd_fwt_access(struct cmd_ds_command *cmd,
+                               u16 cmd_action, void *pdata_buf)
+{
+        struct cmd_ds_fwt_access *fwt_access = &cmd->params.fwt;
+        lbs_deb_enter_args(LBS_DEB_CMD, "action %d", cmd_action);
+
+        cmd->command = cpu_to_le16(CMD_FWT_ACCESS);
+        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_fwt_access) +
+                sizeof(struct cmd_header));
+        cmd->result = 0;
+
+        if (pdata_buf)
+                memcpy(fwt_access, pdata_buf, sizeof(*fwt_access));
+        else
+                memset(fwt_access, 0, sizeof(*fwt_access));
+
+        fwt_access->action = cpu_to_le16(cmd_action);
+
+        lbs_deb_leave(LBS_DEB_CMD);
+        return 0;
+}
+
+int lbs_mesh_access(struct lbs_private *priv, uint16_t cmd_action,
+                    struct cmd_ds_mesh_access *cmd)
+{
+        int ret;
+
+        lbs_deb_enter_args(LBS_DEB_CMD, "action %d", cmd_action);
+
+        cmd->hdr.command = cpu_to_le16(CMD_MESH_ACCESS);
+        cmd->hdr.size = cpu_to_le16(sizeof(*cmd));
+        cmd->hdr.result = 0;
+
+        cmd->action = cpu_to_le16(cmd_action);
+
+        ret = lbs_cmd_with_response(priv, CMD_MESH_ACCESS, cmd);
+
+        lbs_deb_leave(LBS_DEB_CMD);
+        return ret;
+}
+
+static int __lbs_mesh_config_send(struct lbs_private *priv,
+                                  struct cmd_ds_mesh_config *cmd,
+                                  uint16_t action, uint16_t type)
+{
+        int ret;
+        u16 command = CMD_MESH_CONFIG_OLD;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        /*
+         * Command id is 0xac for v10 FW along with mesh interface
+         * id in bits 14-13-12.
+         */
+        if (priv->mesh_tlv == TLV_TYPE_MESH_ID)
+                command = CMD_MESH_CONFIG |
+                          (MESH_IFACE_ID << MESH_IFACE_BIT_OFFSET);
+
+        cmd->hdr.command = cpu_to_le16(command);
+        cmd->hdr.size = cpu_to_le16(sizeof(struct cmd_ds_mesh_config));
+        cmd->hdr.result = 0;
+
+        cmd->type = cpu_to_le16(type);
+        cmd->action = cpu_to_le16(action);
+
+        ret = lbs_cmd_with_response(priv, command, cmd);
+
+        lbs_deb_leave(LBS_DEB_CMD);
+        return ret;
+}
+
+int lbs_mesh_config_send(struct lbs_private *priv,
+                         struct cmd_ds_mesh_config *cmd,
+                         uint16_t action, uint16_t type)
+{
+        int ret;
+
+        if (!(priv->fwcapinfo & FW_CAPINFO_PERSISTENT_CONFIG))
+                return -EOPNOTSUPP;
+
+        ret = __lbs_mesh_config_send(priv, cmd, action, type);
+        return ret;
+}
+
+/* This function is the CMD_MESH_CONFIG legacy function.  It only handles the
+ * START and STOP actions.  The extended actions supported by CMD_MESH_CONFIG
+ * are all handled by preparing a struct cmd_ds_mesh_config and passing it to
+ * lbs_mesh_config_send.
+ */
+int lbs_mesh_config(struct lbs_private *priv, uint16_t action, uint16_t chan)
+{
+        struct cmd_ds_mesh_config cmd;
+        struct mrvl_meshie *ie;
+        DECLARE_SSID_BUF(ssid);
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.channel = cpu_to_le16(chan);
+        ie = (struct mrvl_meshie *)cmd.data;
+
+        switch (action) {
+        case CMD_ACT_MESH_CONFIG_START:
+                ie->id = WLAN_EID_GENERIC;
+                ie->val.oui[0] = 0x00;
+                ie->val.oui[1] = 0x50;
+                ie->val.oui[2] = 0x43;
+                ie->val.type = MARVELL_MESH_IE_TYPE;
+                ie->val.subtype = MARVELL_MESH_IE_SUBTYPE;
+                ie->val.version = MARVELL_MESH_IE_VERSION;
+                ie->val.active_protocol_id = MARVELL_MESH_PROTO_ID_HWMP;
+                ie->val.active_metric_id = MARVELL_MESH_METRIC_ID;
+                ie->val.mesh_capability = MARVELL_MESH_CAPABILITY;
+                ie->val.mesh_id_len = priv->mesh_ssid_len;
+                memcpy(ie->val.mesh_id, priv->mesh_ssid, priv->mesh_ssid_len);
+                ie->len = sizeof(struct mrvl_meshie_val) -
+                        IEEE80211_MAX_SSID_LEN + priv->mesh_ssid_len;
+                cmd.length = cpu_to_le16(sizeof(struct mrvl_meshie_val));
+                break;
+        case CMD_ACT_MESH_CONFIG_STOP:
+                break;
+        default:
+                return -1;
+        }
+        lbs_deb_cmd("mesh config action %d type %x channel %d SSID %s\n",
+                    action, priv->mesh_tlv, chan,
+                    print_ssid(ssid, priv->mesh_ssid, priv->mesh_ssid_len));
+
+        return __lbs_mesh_config_send(priv, &cmd, action, priv->mesh_tlv);
+}
+
+
+
+/***************************************************************************
+ * Persistent configuration support
+ */
+
+static int mesh_get_default_parameters(struct device *dev,
+                                       struct mrvl_mesh_defaults *defs)
+{
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        struct cmd_ds_mesh_config cmd;
+        int ret;
+
+        memset(&cmd, 0, sizeof(struct cmd_ds_mesh_config));
+        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_GET,
+                                   CMD_TYPE_MESH_GET_DEFAULTS);
+
+        if (ret)
+                return -EOPNOTSUPP;
+
+        memcpy(defs, &cmd.data[0], sizeof(struct mrvl_mesh_defaults));
+
+        return 0;
+}
+
+/**
+ * @brief Get function for sysfs attribute bootflag
+ */
+static ssize_t bootflag_get(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        struct mrvl_mesh_defaults defs;
+        int ret;
+
+        ret = mesh_get_default_parameters(dev, &defs);
+
+        if (ret)
+                return ret;
+
+        return snprintf(buf, 12, "%d\n", le32_to_cpu(defs.bootflag));
+}
+
+/**
+ * @brief Set function for sysfs attribute bootflag
+ */
+static ssize_t bootflag_set(struct device *dev, struct device_attribute *attr,
+                            const char *buf, size_t count)
+{
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        struct cmd_ds_mesh_config cmd;
+        uint32_t datum;
+        int ret;
+
+        memset(&cmd, 0, sizeof(cmd));
+        ret = sscanf(buf, "%d", &datum);
+        if ((ret != 1) || (datum > 1))
+                return -EINVAL;
+
+        *((__le32 *)&cmd.data[0]) = cpu_to_le32(!!datum);
+        cmd.length = cpu_to_le16(sizeof(uint32_t));
+        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
+                                   CMD_TYPE_MESH_SET_BOOTFLAG);
+        if (ret)
+                return ret;
+
+        return strlen(buf);
+}
+
+/**
+ * @brief Get function for sysfs attribute boottime
+ */
+static ssize_t boottime_get(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        struct mrvl_mesh_defaults defs;
+        int ret;
+
+        ret = mesh_get_default_parameters(dev, &defs);
+
+        if (ret)
+                return ret;
+
+        return snprintf(buf, 12, "%d\n", defs.boottime);
+}
+
+/**
+ * @brief Set function for sysfs attribute boottime
+ */
+static ssize_t boottime_set(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        struct cmd_ds_mesh_config cmd;
+        uint32_t datum;
+        int ret;
+
+        memset(&cmd, 0, sizeof(cmd));
+        ret = sscanf(buf, "%d", &datum);
+        if ((ret != 1) || (datum > 255))
+                return -EINVAL;
+
+        /* A too small boot time will result in the device booting into
+         * standalone (no-host) mode before the host can take control of it,
+         * so the change will be hard to revert.  This may be a desired
+         * feature (e.g to configure a very fast boot time for devices that
+         * will not be attached to a host), but dangerous.  So I'm enforcing a
+         * lower limit of 20 seconds:  remove and recompile the driver if this
+         * does not work for you.
+         */
+        datum = (datum < 20) ? 20 : datum;
+        cmd.data[0] = datum;
+        cmd.length = cpu_to_le16(sizeof(uint8_t));
+        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
+                                   CMD_TYPE_MESH_SET_BOOTTIME);
+        if (ret)
+                return ret;
+
+        return strlen(buf);
+}
+
+/**
+ * @brief Get function for sysfs attribute channel
+ */
+static ssize_t channel_get(struct device *dev,
+                           struct device_attribute *attr, char *buf)
+{
+        struct mrvl_mesh_defaults defs;
+        int ret;
+
+        ret = mesh_get_default_parameters(dev, &defs);
+
+        if (ret)
+                return ret;
+
+        return snprintf(buf, 12, "%d\n", le16_to_cpu(defs.channel));
+}
+
+/**
+ * @brief Set function for sysfs attribute channel
+ */
+static ssize_t channel_set(struct device *dev, struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        struct cmd_ds_mesh_config cmd;
+        uint32_t datum;
+        int ret;
+
+        memset(&cmd, 0, sizeof(cmd));
+        ret = sscanf(buf, "%d", &datum);
+        if (ret != 1 || datum < 1 || datum > 11)
+                return -EINVAL;
+
+        *((__le16 *)&cmd.data[0]) = cpu_to_le16(datum);
+        cmd.length = cpu_to_le16(sizeof(uint16_t));
+        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
+                                   CMD_TYPE_MESH_SET_DEF_CHANNEL);
+        if (ret)
+                return ret;
+
+        return strlen(buf);
+}
+
+/**
+ * @brief Get function for sysfs attribute mesh_id
+ */
+static ssize_t mesh_id_get(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct mrvl_mesh_defaults defs;
+        int maxlen;
+        int ret;
+
+        ret = mesh_get_default_parameters(dev, &defs);
+
+        if (ret)
+                return ret;
+
+        if (defs.meshie.val.mesh_id_len > IEEE80211_MAX_SSID_LEN) {
+                lbs_pr_err("inconsistent mesh ID length");
+                defs.meshie.val.mesh_id_len = IEEE80211_MAX_SSID_LEN;
+        }
+
+        /* SSID not null terminated: reserve room for \0 + \n */
+        maxlen = defs.meshie.val.mesh_id_len + 2;
+        maxlen = (PAGE_SIZE > maxlen) ? maxlen : PAGE_SIZE;
+
+        defs.meshie.val.mesh_id[defs.meshie.val.mesh_id_len] = '\0';
+
+        return snprintf(buf, maxlen, "%s\n", defs.meshie.val.mesh_id);
+}
+
+/**
+ * @brief Set function for sysfs attribute mesh_id
+ */
+static ssize_t mesh_id_set(struct device *dev, struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        struct cmd_ds_mesh_config cmd;
+        struct mrvl_mesh_defaults defs;
+        struct mrvl_meshie *ie;
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        int len;
+        int ret;
+
+        if (count < 2 || count > IEEE80211_MAX_SSID_LEN + 1)
+                return -EINVAL;
+
+        memset(&cmd, 0, sizeof(struct cmd_ds_mesh_config));
+        ie = (struct mrvl_meshie *) &cmd.data[0];
+
+        /* fetch all other Information Element parameters */
+        ret = mesh_get_default_parameters(dev, &defs);
+
+        cmd.length = cpu_to_le16(sizeof(struct mrvl_meshie));
+
+        /* transfer IE elements */
+        memcpy(ie, &defs.meshie, sizeof(struct mrvl_meshie));
+
+        len = count - 1;
+        memcpy(ie->val.mesh_id, buf, len);
+        /* SSID len */
+        ie->val.mesh_id_len = len;
+        /* IE len */
+        ie->len = sizeof(struct mrvl_meshie_val) - IEEE80211_MAX_SSID_LEN + len;
+
+        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
+                                   CMD_TYPE_MESH_SET_MESH_IE);
+        if (ret)
+                return ret;
+
+        return strlen(buf);
+}
+
+/**
+ * @brief Get function for sysfs attribute protocol_id
+ */
+static ssize_t protocol_id_get(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        struct mrvl_mesh_defaults defs;
+        int ret;
+
+        ret = mesh_get_default_parameters(dev, &defs);
+
+        if (ret)
+                return ret;
+
+        return snprintf(buf, 5, "%d\n", defs.meshie.val.active_protocol_id);
+}
+
+/**
+ * @brief Set function for sysfs attribute protocol_id
+ */
+static ssize_t protocol_id_set(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct cmd_ds_mesh_config cmd;
+        struct mrvl_mesh_defaults defs;
+        struct mrvl_meshie *ie;
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        uint32_t datum;
+        int ret;
+
+        memset(&cmd, 0, sizeof(cmd));
+        ret = sscanf(buf, "%d", &datum);
+        if ((ret != 1) || (datum > 255))
+                return -EINVAL;
+
+        /* fetch all other Information Element parameters */
+        ret = mesh_get_default_parameters(dev, &defs);
+
+        cmd.length = cpu_to_le16(sizeof(struct mrvl_meshie));
+
+        /* transfer IE elements */
+        ie = (struct mrvl_meshie *) &cmd.data[0];
+        memcpy(ie, &defs.meshie, sizeof(struct mrvl_meshie));
+        /* update protocol id */
+        ie->val.active_protocol_id = datum;
+
+        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
+                                   CMD_TYPE_MESH_SET_MESH_IE);
+        if (ret)
+                return ret;
+
+        return strlen(buf);
+}
+
+/**
+ * @brief Get function for sysfs attribute metric_id
+ */
+static ssize_t metric_id_get(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct mrvl_mesh_defaults defs;
+        int ret;
+
+        ret = mesh_get_default_parameters(dev, &defs);
+
+        if (ret)
+                return ret;
+
+        return snprintf(buf, 5, "%d\n", defs.meshie.val.active_metric_id);
+}
+
+/**
+ * @brief Set function for sysfs attribute metric_id
+ */
+static ssize_t metric_id_set(struct device *dev, struct device_attribute *attr,
+                             const char *buf, size_t count)
+{
+        struct cmd_ds_mesh_config cmd;
+        struct mrvl_mesh_defaults defs;
+        struct mrvl_meshie *ie;
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        uint32_t datum;
+        int ret;
+
+        memset(&cmd, 0, sizeof(cmd));
+        ret = sscanf(buf, "%d", &datum);
+        if ((ret != 1) || (datum > 255))
+                return -EINVAL;
+
+        /* fetch all other Information Element parameters */
+        ret = mesh_get_default_parameters(dev, &defs);
+
+        cmd.length = cpu_to_le16(sizeof(struct mrvl_meshie));
+
+        /* transfer IE elements */
+        ie = (struct mrvl_meshie *) &cmd.data[0];
+        memcpy(ie, &defs.meshie, sizeof(struct mrvl_meshie));
+        /* update metric id */
+        ie->val.active_metric_id = datum;
+
+        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
+                                   CMD_TYPE_MESH_SET_MESH_IE);
+        if (ret)
+                return ret;
+
+        return strlen(buf);
+}
+
+/**
+ * @brief Get function for sysfs attribute capability
+ */
+static ssize_t capability_get(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct mrvl_mesh_defaults defs;
+        int ret;
+
+        ret = mesh_get_default_parameters(dev, &defs);
+
+        if (ret)
+                return ret;
+
+        return snprintf(buf, 5, "%d\n", defs.meshie.val.mesh_capability);
+}
+
+/**
+ * @brief Set function for sysfs attribute capability
+ */
+static ssize_t capability_set(struct device *dev, struct device_attribute *attr,
+                              const char *buf, size_t count)
+{
+        struct cmd_ds_mesh_config cmd;
+        struct mrvl_mesh_defaults defs;
+        struct mrvl_meshie *ie;
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
+        uint32_t datum;
+        int ret;
+
+        memset(&cmd, 0, sizeof(cmd));
+        ret = sscanf(buf, "%d", &datum);
+        if ((ret != 1) || (datum > 255))
+                return -EINVAL;
+
+        /* fetch all other Information Element parameters */
+        ret = mesh_get_default_parameters(dev, &defs);
+
+        cmd.length = cpu_to_le16(sizeof(struct mrvl_meshie));
+
+        /* transfer IE elements */
+        ie = (struct mrvl_meshie *) &cmd.data[0];
+        memcpy(ie, &defs.meshie, sizeof(struct mrvl_meshie));
+        /* update value */
+        ie->val.mesh_capability = datum;
+
+        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
+                                   CMD_TYPE_MESH_SET_MESH_IE);
+        if (ret)
+                return ret;
+
+        return strlen(buf);
+}
+
+
+static DEVICE_ATTR(bootflag, 0644, bootflag_get, bootflag_set);
+static DEVICE_ATTR(boottime, 0644, boottime_get, boottime_set);
+static DEVICE_ATTR(channel, 0644, channel_get, channel_set);
+static DEVICE_ATTR(mesh_id, 0644, mesh_id_get, mesh_id_set);
+static DEVICE_ATTR(protocol_id, 0644, protocol_id_get, protocol_id_set);
+static DEVICE_ATTR(metric_id, 0644, metric_id_get, metric_id_set);
+static DEVICE_ATTR(capability, 0644, capability_get, capability_set);
+
+static struct attribute *boot_opts_attrs[] = {
+        &dev_attr_bootflag.attr,
+        &dev_attr_boottime.attr,
+        &dev_attr_channel.attr,
+        NULL
+};
+
+static struct attribute_group boot_opts_group = {
+        .name = "boot_options",
+        .attrs = boot_opts_attrs,
+};
+
+static struct attribute *mesh_ie_attrs[] = {
+        &dev_attr_mesh_id.attr,
+        &dev_attr_protocol_id.attr,
+        &dev_attr_metric_id.attr,
+        &dev_attr_capability.attr,
+        NULL
+};
+
+static struct attribute_group mesh_ie_group = {
+        .name = "mesh_ie",
+        .attrs = mesh_ie_attrs,
+};
+
+void lbs_persist_config_init(struct net_device *dev)
+{
+        int ret;
+        ret = sysfs_create_group(&(dev->dev.kobj), &boot_opts_group);
+        ret = sysfs_create_group(&(dev->dev.kobj), &mesh_ie_group);
+}
+
+void lbs_persist_config_remove(struct net_device *dev)
+{
+        sysfs_remove_group(&(dev->dev.kobj), &boot_opts_group);
+        sysfs_remove_group(&(dev->dev.kobj), &mesh_ie_group);
+}
+
+
+
+/***************************************************************************
+ * Ethtool related
+ */
+
+static const char *mesh_stat_strings[] = {
+                        "drop_duplicate_bcast",
+                        "drop_ttl_zero",
+                        "drop_no_fwd_route",
+                        "drop_no_buffers",
+                        "fwded_unicast_cnt",
+                        "fwded_bcast_cnt",
+                        "drop_blind_table",
+                        "tx_failed_cnt"
+};
+
+void lbs_mesh_ethtool_get_stats(struct net_device *dev,
+        struct ethtool_stats *stats, uint64_t *data)
+{
+        struct lbs_private *priv = dev->ml_priv;
+        struct cmd_ds_mesh_access mesh_access;
+        int ret;
+
+        lbs_deb_enter(LBS_DEB_ETHTOOL);
+
+        /* Get Mesh Statistics */
+        ret = lbs_mesh_access(priv, CMD_ACT_MESH_GET_STATS, &mesh_access);
+
+        if (ret) {
+                memset(data, 0, MESH_STATS_NUM*(sizeof(uint64_t)));
+                return;
+        }
+
+        priv->mstats.fwd_drop_rbt = le32_to_cpu(mesh_access.data[0]);
+        priv->mstats.fwd_drop_ttl = le32_to_cpu(mesh_access.data[1]);
+        priv->mstats.fwd_drop_noroute = le32_to_cpu(mesh_access.data[2]);
+        priv->mstats.fwd_drop_nobuf = le32_to_cpu(mesh_access.data[3]);
+        priv->mstats.fwd_unicast_cnt = le32_to_cpu(mesh_access.data[4]);
+        priv->mstats.fwd_bcast_cnt = le32_to_cpu(mesh_access.data[5]);
+        priv->mstats.drop_blind = le32_to_cpu(mesh_access.data[6]);
+        priv->mstats.tx_failed_cnt = le32_to_cpu(mesh_access.data[7]);
+
+        data[0] = priv->mstats.fwd_drop_rbt;
+        data[1] = priv->mstats.fwd_drop_ttl;
+        data[2] = priv->mstats.fwd_drop_noroute;
+        data[3] = priv->mstats.fwd_drop_nobuf;
+        data[4] = priv->mstats.fwd_unicast_cnt;
+        data[5] = priv->mstats.fwd_bcast_cnt;
+        data[6] = priv->mstats.drop_blind;
+        data[7] = priv->mstats.tx_failed_cnt;
+
+        lbs_deb_enter(LBS_DEB_ETHTOOL);
+}
+
+int lbs_mesh_ethtool_get_sset_count(struct net_device *dev, int sset)
+{
+        struct lbs_private *priv = dev->ml_priv;
+
+        if (sset == ETH_SS_STATS && dev == priv->mesh_dev)
+                return MESH_STATS_NUM;
+
+        return -EOPNOTSUPP;
+}
+
+void lbs_mesh_ethtool_get_strings(struct net_device *dev,
+        uint32_t stringset, uint8_t *s)
+{
+        int i;
+
+        lbs_deb_enter(LBS_DEB_ETHTOOL);
+
+        switch (stringset) {
+        case ETH_SS_STATS:
+                for (i = 0; i < MESH_STATS_NUM; i++) {
+                        memcpy(s + i * ETH_GSTRING_LEN,
+                                        mesh_stat_strings[i],
+                                        ETH_GSTRING_LEN);
+                }
+                break;
+        }
+        lbs_deb_enter(LBS_DEB_ETHTOOL);
+}
diff --git a/drivers/net/wireless/libertas/mesh.h b/drivers/net/wireless/libertas/mesh.h
new file mode 100644
index 000000000000..e2573303a328
--- /dev/null
+++ b/drivers/net/wireless/libertas/mesh.h
@@ -0,0 +1,110 @@
+/**
+  * Contains all definitions needed for the Libertas' MESH implementation.
+  */
+#ifndef _LBS_MESH_H_
+#define _LBS_MESH_H_
+
+
+#include <net/iw_handler.h>
+#include <net/lib80211.h>
+
+
+#ifdef CONFIG_LIBERTAS_MESH
+
+/* Mesh statistics */
+struct lbs_mesh_stats {
+        u32     fwd_bcast_cnt;          /* Fwd: Broadcast counter */
+        u32     fwd_unicast_cnt;        /* Fwd: Unicast counter */
+        u32     fwd_drop_ttl;           /* Fwd: TTL zero */
+        u32     fwd_drop_rbt;           /* Fwd: Recently Broadcasted */
+        u32     fwd_drop_noroute;       /* Fwd: No route to Destination */
+        u32     fwd_drop_nobuf;         /* Fwd: Run out of internal buffers */
+        u32     drop_blind;             /* Rx:  Dropped by blinding table */
+        u32     tx_failed_cnt;          /* Tx:  Failed transmissions */
+};
+
+
+struct net_device;
+struct lbs_private;
+
+int lbs_init_mesh(struct lbs_private *priv);
+int lbs_deinit_mesh(struct lbs_private *priv);
+
+int lbs_add_mesh(struct lbs_private *priv);
+void lbs_remove_mesh(struct lbs_private *priv);
+
+
+/* Sending / Receiving */
+
+struct rxpd;
+struct txpd;
+
+struct net_device *lbs_mesh_set_dev(struct lbs_private *priv,
+        struct net_device *dev, struct rxpd *rxpd);
+void lbs_mesh_set_txpd(struct lbs_private *priv,
+        struct net_device *dev, struct txpd *txpd);
+
+
+/* Command handling */
+
+struct cmd_ds_command;
+struct cmd_ds_mesh_access;
+struct cmd_ds_mesh_config;
+
+int lbs_cmd_bt_access(struct cmd_ds_command *cmd,
+        u16 cmd_action, void *pdata_buf);
+int lbs_cmd_fwt_access(struct cmd_ds_command *cmd,
+        u16 cmd_action, void *pdata_buf);
+int lbs_mesh_access(struct lbs_private *priv, uint16_t cmd_action,
+                    struct cmd_ds_mesh_access *cmd);
+int lbs_mesh_config_send(struct lbs_private *priv,
+                         struct cmd_ds_mesh_config *cmd,
+                         uint16_t action, uint16_t type);
+int lbs_mesh_config(struct lbs_private *priv, uint16_t enable, uint16_t chan);
+
+
+
+/* Persistent configuration */
+
+void lbs_persist_config_init(struct net_device *net);
+void lbs_persist_config_remove(struct net_device *net);
+
+
+/* WEXT handler */
+
+extern struct iw_handler_def mesh_handler_def;
+
+
+/* Ethtool statistics */
+
+struct ethtool_stats;
+
+void lbs_mesh_ethtool_get_stats(struct net_device *dev,
+        struct ethtool_stats *stats, uint64_t *data);
+int lbs_mesh_ethtool_get_sset_count(struct net_device *dev, int sset);
+void lbs_mesh_ethtool_get_strings(struct net_device *dev,
+        uint32_t stringset, uint8_t *s);
+
+
+/* Accessors */
+
+#define lbs_mesh_open(priv) (priv->mesh_open)
+#define lbs_mesh_connected(priv) (priv->mesh_connect_status == LBS_CONNECTED)
+
+#else
+
+#define lbs_init_mesh(priv)
+#define lbs_deinit_mesh(priv)
+#define lbs_add_mesh(priv)
+#define lbs_remove_mesh(priv)
+#define lbs_mesh_set_dev(priv, dev, rxpd) (dev)
+#define lbs_mesh_set_txpd(priv, dev, txpd)
+#define lbs_mesh_config(priv, enable, chan)
+#define lbs_mesh_open(priv) (0)
+#define lbs_mesh_connected(priv) (0)
+
+#endif
+
+
+
+#endif
diff --git a/drivers/net/wireless/libertas/persistcfg.c b/drivers/net/wireless/libertas/persistcfg.c
deleted file mode 100644
index 18fe29faf99b..000000000000
--- a/drivers/net/wireless/libertas/persistcfg.c
+++ /dev/null
@@ -1,453 +0,0 @@
-#include <linux/moduleparam.h>
-#include <linux/delay.h>
-#include <linux/etherdevice.h>
-#include <linux/netdevice.h>
-#include <linux/if_arp.h>
-#include <linux/kthread.h>
-#include <linux/kfifo.h>
-
-#include "host.h"
-#include "decl.h"
-#include "dev.h"
-#include "wext.h"
-#include "debugfs.h"
-#include "scan.h"
-#include "assoc.h"
-#include "cmd.h"
-
-static int mesh_get_default_parameters(struct device *dev,
-                                       struct mrvl_mesh_defaults *defs)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        struct cmd_ds_mesh_config cmd;
-        int ret;
-
-        memset(&cmd, 0, sizeof(struct cmd_ds_mesh_config));
-        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_GET,
-                                   CMD_TYPE_MESH_GET_DEFAULTS);
-
-        if (ret)
-                return -EOPNOTSUPP;
-
-        memcpy(defs, &cmd.data[0], sizeof(struct mrvl_mesh_defaults));
-
-        return 0;
-}
-
-/**
- * @brief Get function for sysfs attribute bootflag
- */
-static ssize_t bootflag_get(struct device *dev,
-                            struct device_attribute *attr, char *buf)
-{
-        struct mrvl_mesh_defaults defs;
-        int ret;
-
-        ret = mesh_get_default_parameters(dev, &defs);
-
-        if (ret)
-                return ret;
-
-        return snprintf(buf, 12, "%d\n", le32_to_cpu(defs.bootflag));
-}
-
-/**
- * @brief Set function for sysfs attribute bootflag
- */
-static ssize_t bootflag_set(struct device *dev, struct device_attribute *attr,
-                            const char *buf, size_t count)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        struct cmd_ds_mesh_config cmd;
-        uint32_t datum;
-        int ret;
-
-        memset(&cmd, 0, sizeof(cmd));
-        ret = sscanf(buf, "%d", &datum);
-        if ((ret != 1) || (datum > 1))
-                return -EINVAL;
-
-        *((__le32 *)&cmd.data[0]) = cpu_to_le32(!!datum);
-        cmd.length = cpu_to_le16(sizeof(uint32_t));
-        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
-                                   CMD_TYPE_MESH_SET_BOOTFLAG);
-        if (ret)
-                return ret;
-
-        return strlen(buf);
-}
-
-/**
- * @brief Get function for sysfs attribute boottime
- */
-static ssize_t boottime_get(struct device *dev,
-                            struct device_attribute *attr, char *buf)
-{
-        struct mrvl_mesh_defaults defs;
-        int ret;
-
-        ret = mesh_get_default_parameters(dev, &defs);
-
-        if (ret)
-                return ret;
-
-        return snprintf(buf, 12, "%d\n", defs.boottime);
-}
-
-/**
- * @brief Set function for sysfs attribute boottime
- */
-static ssize_t boottime_set(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t count)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        struct cmd_ds_mesh_config cmd;
-        uint32_t datum;
-        int ret;
-
-        memset(&cmd, 0, sizeof(cmd));
-        ret = sscanf(buf, "%d", &datum);
-        if ((ret != 1) || (datum > 255))
-                return -EINVAL;
-
-        /* A too small boot time will result in the device booting into
-         * standalone (no-host) mode before the host can take control of it,
-         * so the change will be hard to revert.  This may be a desired
-         * feature (e.g to configure a very fast boot time for devices that
-         * will not be attached to a host), but dangerous.  So I'm enforcing a
-         * lower limit of 20 seconds:  remove and recompile the driver if this
-         * does not work for you.
-         */
-        datum = (datum < 20) ? 20 : datum;
-        cmd.data[0] = datum;
-        cmd.length = cpu_to_le16(sizeof(uint8_t));
-        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
-                                   CMD_TYPE_MESH_SET_BOOTTIME);
-        if (ret)
-                return ret;
-
-        return strlen(buf);
-}
-
-/**
- * @brief Get function for sysfs attribute channel
- */
-static ssize_t channel_get(struct device *dev,
-                           struct device_attribute *attr, char *buf)
-{
-        struct mrvl_mesh_defaults defs;
-        int ret;
-
-        ret = mesh_get_default_parameters(dev, &defs);
-
-        if (ret)
-                return ret;
-
-        return snprintf(buf, 12, "%d\n", le16_to_cpu(defs.channel));
-}
-
-/**
- * @brief Set function for sysfs attribute channel
- */
-static ssize_t channel_set(struct device *dev, struct device_attribute *attr,
-                           const char *buf, size_t count)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        struct cmd_ds_mesh_config cmd;
-        uint32_t datum;
-        int ret;
-
-        memset(&cmd, 0, sizeof(cmd));
-        ret = sscanf(buf, "%d", &datum);
-        if (ret != 1 || datum < 1 || datum > 11)
-                return -EINVAL;
-
-        *((__le16 *)&cmd.data[0]) = cpu_to_le16(datum);
-        cmd.length = cpu_to_le16(sizeof(uint16_t));
-        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
-                                   CMD_TYPE_MESH_SET_DEF_CHANNEL);
-        if (ret)
-                return ret;
-
-        return strlen(buf);
-}
-
-/**
- * @brief Get function for sysfs attribute mesh_id
- */
-static ssize_t mesh_id_get(struct device *dev, struct device_attribute *attr,
-                           char *buf)
-{
-        struct mrvl_mesh_defaults defs;
-        int maxlen;
-        int ret;
-
-        ret = mesh_get_default_parameters(dev, &defs);
-
-        if (ret)
-                return ret;
-
-        if (defs.meshie.val.mesh_id_len > IW_ESSID_MAX_SIZE) {
-                lbs_pr_err("inconsistent mesh ID length");
-                defs.meshie.val.mesh_id_len = IW_ESSID_MAX_SIZE;
-        }
-
-        /* SSID not null terminated: reserve room for \0 + \n */
-        maxlen = defs.meshie.val.mesh_id_len + 2;
-        maxlen = (PAGE_SIZE > maxlen) ? maxlen : PAGE_SIZE;
-
-        defs.meshie.val.mesh_id[defs.meshie.val.mesh_id_len] = '\0';
-
-        return snprintf(buf, maxlen, "%s\n", defs.meshie.val.mesh_id);
-}
-
-/**
- * @brief Set function for sysfs attribute mesh_id
- */
-static ssize_t mesh_id_set(struct device *dev, struct device_attribute *attr,
-                           const char *buf, size_t count)
-{
-        struct cmd_ds_mesh_config cmd;
-        struct mrvl_mesh_defaults defs;
-        struct mrvl_meshie *ie;
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        int len;
-        int ret;
-
-        if (count < 2 || count > IW_ESSID_MAX_SIZE + 1)
-                return -EINVAL;
-
-        memset(&cmd, 0, sizeof(struct cmd_ds_mesh_config));
-        ie = (struct mrvl_meshie *) &cmd.data[0];
-
-        /* fetch all other Information Element parameters */
-        ret = mesh_get_default_parameters(dev, &defs);
-
-        cmd.length = cpu_to_le16(sizeof(struct mrvl_meshie));
-
-        /* transfer IE elements */
-        memcpy(ie, &defs.meshie, sizeof(struct mrvl_meshie));
-
-        len = count - 1;
-        memcpy(ie->val.mesh_id, buf, len);
-        /* SSID len */
-        ie->val.mesh_id_len = len;
-        /* IE len */
-        ie->len = sizeof(struct mrvl_meshie_val) - IW_ESSID_MAX_SIZE + len;
-
-        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
-                                   CMD_TYPE_MESH_SET_MESH_IE);
-        if (ret)
-                return ret;
-
-        return strlen(buf);
-}
-
-/**
- * @brief Get function for sysfs attribute protocol_id
- */
-static ssize_t protocol_id_get(struct device *dev,
-                               struct device_attribute *attr, char *buf)
-{
-        struct mrvl_mesh_defaults defs;
-        int ret;
-
-        ret = mesh_get_default_parameters(dev, &defs);
-
-        if (ret)
-                return ret;
-
-        return snprintf(buf, 5, "%d\n", defs.meshie.val.active_protocol_id);
-}
-
-/**
- * @brief Set function for sysfs attribute protocol_id
- */
-static ssize_t protocol_id_set(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t count)
-{
-        struct cmd_ds_mesh_config cmd;
-        struct mrvl_mesh_defaults defs;
-        struct mrvl_meshie *ie;
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        uint32_t datum;
-        int ret;
-
-        memset(&cmd, 0, sizeof(cmd));
-        ret = sscanf(buf, "%d", &datum);
-        if ((ret != 1) || (datum > 255))
-                return -EINVAL;
-
-        /* fetch all other Information Element parameters */
-        ret = mesh_get_default_parameters(dev, &defs);
-
-        cmd.length = cpu_to_le16(sizeof(struct mrvl_meshie));
-
-        /* transfer IE elements */
-        ie = (struct mrvl_meshie *) &cmd.data[0];
-        memcpy(ie, &defs.meshie, sizeof(struct mrvl_meshie));
-        /* update protocol id */
-        ie->val.active_protocol_id = datum;
-
-        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
-                                   CMD_TYPE_MESH_SET_MESH_IE);
-        if (ret)
-                return ret;
-
-        return strlen(buf);
-}
-
-/**
- * @brief Get function for sysfs attribute metric_id
- */
-static ssize_t metric_id_get(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct mrvl_mesh_defaults defs;
-        int ret;
-
-        ret = mesh_get_default_parameters(dev, &defs);
-
-        if (ret)
-                return ret;
-
-        return snprintf(buf, 5, "%d\n", defs.meshie.val.active_metric_id);
-}
-
-/**
- * @brief Set function for sysfs attribute metric_id
- */
-static ssize_t metric_id_set(struct device *dev, struct device_attribute *attr,
-                             const char *buf, size_t count)
-{
-        struct cmd_ds_mesh_config cmd;
-        struct mrvl_mesh_defaults defs;
-        struct mrvl_meshie *ie;
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        uint32_t datum;
-        int ret;
-
-        memset(&cmd, 0, sizeof(cmd));
-        ret = sscanf(buf, "%d", &datum);
-        if ((ret != 1) || (datum > 255))
-                return -EINVAL;
-
-        /* fetch all other Information Element parameters */
-        ret = mesh_get_default_parameters(dev, &defs);
-
-        cmd.length = cpu_to_le16(sizeof(struct mrvl_meshie));
-
-        /* transfer IE elements */
-        ie = (struct mrvl_meshie *) &cmd.data[0];
-        memcpy(ie, &defs.meshie, sizeof(struct mrvl_meshie));
-        /* update metric id */
-        ie->val.active_metric_id = datum;
-
-        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
-                                   CMD_TYPE_MESH_SET_MESH_IE);
-        if (ret)
-                return ret;
-
-        return strlen(buf);
-}
-
-/**
- * @brief Get function for sysfs attribute capability
- */
-static ssize_t capability_get(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct mrvl_mesh_defaults defs;
-        int ret;
-
-        ret = mesh_get_default_parameters(dev, &defs);
-
-        if (ret)
-                return ret;
-
-        return snprintf(buf, 5, "%d\n", defs.meshie.val.mesh_capability);
-}
-
-/**
- * @brief Set function for sysfs attribute capability
- */
-static ssize_t capability_set(struct device *dev, struct device_attribute *attr,
-                              const char *buf, size_t count)
-{
-        struct cmd_ds_mesh_config cmd;
-        struct mrvl_mesh_defaults defs;
-        struct mrvl_meshie *ie;
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        uint32_t datum;
-        int ret;
-
-        memset(&cmd, 0, sizeof(cmd));
-        ret = sscanf(buf, "%d", &datum);
-        if ((ret != 1) || (datum > 255))
-                return -EINVAL;
-
-        /* fetch all other Information Element parameters */
-        ret = mesh_get_default_parameters(dev, &defs);
-
-        cmd.length = cpu_to_le16(sizeof(struct mrvl_meshie));
-
-        /* transfer IE elements */
-        ie = (struct mrvl_meshie *) &cmd.data[0];
-        memcpy(ie, &defs.meshie, sizeof(struct mrvl_meshie));
-        /* update value */
-        ie->val.mesh_capability = datum;
-
-        ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
-                                   CMD_TYPE_MESH_SET_MESH_IE);
-        if (ret)
-                return ret;
-
-        return strlen(buf);
-}
-
-
-static DEVICE_ATTR(bootflag, 0644, bootflag_get, bootflag_set);
-static DEVICE_ATTR(boottime, 0644, boottime_get, boottime_set);
-static DEVICE_ATTR(channel, 0644, channel_get, channel_set);
-static DEVICE_ATTR(mesh_id, 0644, mesh_id_get, mesh_id_set);
-static DEVICE_ATTR(protocol_id, 0644, protocol_id_get, protocol_id_set);
-static DEVICE_ATTR(metric_id, 0644, metric_id_get, metric_id_set);
-static DEVICE_ATTR(capability, 0644, capability_get, capability_set);
-
-static struct attribute *boot_opts_attrs[] = {
-        &dev_attr_bootflag.attr,
-        &dev_attr_boottime.attr,
-        &dev_attr_channel.attr,
-        NULL
-};
-
-static struct attribute_group boot_opts_group = {
-        .name = "boot_options",
-        .attrs = boot_opts_attrs,
-};
-
-static struct attribute *mesh_ie_attrs[] = {
-        &dev_attr_mesh_id.attr,
-        &dev_attr_protocol_id.attr,
-        &dev_attr_metric_id.attr,
-        &dev_attr_capability.attr,
-        NULL
-};
-
-static struct attribute_group mesh_ie_group = {
-        .name = "mesh_ie",
-        .attrs = mesh_ie_attrs,
-};
-
-void lbs_persist_config_init(struct net_device *dev)
-{
-        int ret;
-        ret = sysfs_create_group(&(dev->dev.kobj), &boot_opts_group);
-        ret = sysfs_create_group(&(dev->dev.kobj), &mesh_ie_group);
-}
-
-void lbs_persist_config_remove(struct net_device *dev)
-{
-        sysfs_remove_group(&(dev->dev.kobj), &boot_opts_group);
-        sysfs_remove_group(&(dev->dev.kobj), &mesh_ie_group);
-}
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index 65f02cc6752f..784dae714705 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -2,9 +2,10 @@
   * This file contains the handling of RX in wlan driver.
   */
 #include <linux/etherdevice.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 
-#include "hostcmd.h"
+#include "host.h"
 #include "radiotap.h"
 #include "decl.h"
 #include "dev.h"
@@ -160,15 +161,8 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
         p_rx_pd = (struct rxpd *) skb->data;
         p_rx_pkt = (struct rxpackethdr *) ((u8 *)p_rx_pd +
                 le32_to_cpu(p_rx_pd->pkt_ptr));
-        if (priv->mesh_dev) {
-                if (priv->mesh_fw_ver == MESH_FW_OLD) {
-                        if (p_rx_pd->rx_control & RxPD_MESH_FRAME)
-                                dev = priv->mesh_dev;
-                } else if (priv->mesh_fw_ver == MESH_FW_NEW) {
-                        if (p_rx_pd->u.bss.bss_num == MESH_IFACE_ID)
-                                dev = priv->mesh_dev;
-                }
-        }
+
+        dev = lbs_mesh_set_dev(priv, dev, p_rx_pd);
 
         lbs_deb_hex(LBS_DEB_RX, "RX Data: Before chop rxpd", skb->data,
                  min_t(unsigned int, skb->len, 100));
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 6c95af3023cc..24cd54b3a806 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -4,6 +4,7 @@
   * IOCTL handlers as well as command preperation and response routines
   *  for sending scan commands to the firmware.
   */
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/etherdevice.h>
@@ -12,18 +13,19 @@
 #include <net/lib80211.h>
 
 #include "host.h"
-#include "decl.h"
 #include "dev.h"
 #include "scan.h"
+#include "assoc.h"
+#include "wext.h"
 #include "cmd.h"
 
 //! Approximate amount of data needed to pass a scan result back to iwlist
 #define MAX_SCAN_CELL_SIZE  (IW_EV_ADDR_LEN             \
-                             + IW_ESSID_MAX_SIZE        \
+                             + IEEE80211_MAX_SSID_LEN   \
                              + IW_EV_UINT_LEN           \
                              + IW_EV_FREQ_LEN           \
                              + IW_EV_QUAL_LEN           \
-                             + IW_ESSID_MAX_SIZE        \
+                             + IEEE80211_MAX_SSID_LEN   \
                              + IW_EV_PARAM_LEN          \
                              + 40)      /* 40 for WPAIE */
 
@@ -121,6 +123,189 @@ static inline int is_same_network(struct bss_descriptor *src,
 
 
 
+/*********************************************************************/
+/*                                                                   */
+/* Region channel support                                            */
+/*                                                                   */
+/*********************************************************************/
+
+#define LBS_TX_PWR_DEFAULT              20      /*100mW */
+#define LBS_TX_PWR_US_DEFAULT           20      /*100mW */
+#define LBS_TX_PWR_JP_DEFAULT           16      /*50mW */
+#define LBS_TX_PWR_FR_DEFAULT           20      /*100mW */
+#define LBS_TX_PWR_EMEA_DEFAULT 20      /*100mW */
+
+/* Format { channel, frequency (MHz), maxtxpower } */
+/* band: 'B/G', region: USA FCC/Canada IC */
+static struct chan_freq_power channel_freq_power_US_BG[] = {
+        {1, 2412, LBS_TX_PWR_US_DEFAULT},
+        {2, 2417, LBS_TX_PWR_US_DEFAULT},
+        {3, 2422, LBS_TX_PWR_US_DEFAULT},
+        {4, 2427, LBS_TX_PWR_US_DEFAULT},
+        {5, 2432, LBS_TX_PWR_US_DEFAULT},
+        {6, 2437, LBS_TX_PWR_US_DEFAULT},
+        {7, 2442, LBS_TX_PWR_US_DEFAULT},
+        {8, 2447, LBS_TX_PWR_US_DEFAULT},
+        {9, 2452, LBS_TX_PWR_US_DEFAULT},
+        {10, 2457, LBS_TX_PWR_US_DEFAULT},
+        {11, 2462, LBS_TX_PWR_US_DEFAULT}
+};
+
+/* band: 'B/G', region: Europe ETSI */
+static struct chan_freq_power channel_freq_power_EU_BG[] = {
+        {1, 2412, LBS_TX_PWR_EMEA_DEFAULT},
+        {2, 2417, LBS_TX_PWR_EMEA_DEFAULT},
+        {3, 2422, LBS_TX_PWR_EMEA_DEFAULT},
+        {4, 2427, LBS_TX_PWR_EMEA_DEFAULT},
+        {5, 2432, LBS_TX_PWR_EMEA_DEFAULT},
+        {6, 2437, LBS_TX_PWR_EMEA_DEFAULT},
+        {7, 2442, LBS_TX_PWR_EMEA_DEFAULT},
+        {8, 2447, LBS_TX_PWR_EMEA_DEFAULT},
+        {9, 2452, LBS_TX_PWR_EMEA_DEFAULT},
+        {10, 2457, LBS_TX_PWR_EMEA_DEFAULT},
+        {11, 2462, LBS_TX_PWR_EMEA_DEFAULT},
+        {12, 2467, LBS_TX_PWR_EMEA_DEFAULT},
+        {13, 2472, LBS_TX_PWR_EMEA_DEFAULT}
+};
+
+/* band: 'B/G', region: Spain */
+static struct chan_freq_power channel_freq_power_SPN_BG[] = {
+        {10, 2457, LBS_TX_PWR_DEFAULT},
+        {11, 2462, LBS_TX_PWR_DEFAULT}
+};
+
+/* band: 'B/G', region: France */
+static struct chan_freq_power channel_freq_power_FR_BG[] = {
+        {10, 2457, LBS_TX_PWR_FR_DEFAULT},
+        {11, 2462, LBS_TX_PWR_FR_DEFAULT},
+        {12, 2467, LBS_TX_PWR_FR_DEFAULT},
+        {13, 2472, LBS_TX_PWR_FR_DEFAULT}
+};
+
+/* band: 'B/G', region: Japan */
+static struct chan_freq_power channel_freq_power_JPN_BG[] = {
+        {1, 2412, LBS_TX_PWR_JP_DEFAULT},
+        {2, 2417, LBS_TX_PWR_JP_DEFAULT},
+        {3, 2422, LBS_TX_PWR_JP_DEFAULT},
+        {4, 2427, LBS_TX_PWR_JP_DEFAULT},
+        {5, 2432, LBS_TX_PWR_JP_DEFAULT},
+        {6, 2437, LBS_TX_PWR_JP_DEFAULT},
+        {7, 2442, LBS_TX_PWR_JP_DEFAULT},
+        {8, 2447, LBS_TX_PWR_JP_DEFAULT},
+        {9, 2452, LBS_TX_PWR_JP_DEFAULT},
+        {10, 2457, LBS_TX_PWR_JP_DEFAULT},
+        {11, 2462, LBS_TX_PWR_JP_DEFAULT},
+        {12, 2467, LBS_TX_PWR_JP_DEFAULT},
+        {13, 2472, LBS_TX_PWR_JP_DEFAULT},
+        {14, 2484, LBS_TX_PWR_JP_DEFAULT}
+};
+
+/**
+ * the structure for channel, frequency and power
+ */
+struct region_cfp_table {
+        u8 region;
+        struct chan_freq_power *cfp_BG;
+        int cfp_no_BG;
+};
+
+/**
+ * the structure for the mapping between region and CFP
+ */
+static struct region_cfp_table region_cfp_table[] = {
+        {0x10,                  /*US FCC */
+         channel_freq_power_US_BG,
+         ARRAY_SIZE(channel_freq_power_US_BG),
+         }
+        ,
+        {0x20,                  /*CANADA IC */
+         channel_freq_power_US_BG,
+         ARRAY_SIZE(channel_freq_power_US_BG),
+         }
+        ,
+        {0x30, /*EU*/ channel_freq_power_EU_BG,
+         ARRAY_SIZE(channel_freq_power_EU_BG),
+         }
+        ,
+        {0x31, /*SPAIN*/ channel_freq_power_SPN_BG,
+         ARRAY_SIZE(channel_freq_power_SPN_BG),
+         }
+        ,
+        {0x32, /*FRANCE*/ channel_freq_power_FR_BG,
+         ARRAY_SIZE(channel_freq_power_FR_BG),
+         }
+        ,
+        {0x40, /*JAPAN*/ channel_freq_power_JPN_BG,
+         ARRAY_SIZE(channel_freq_power_JPN_BG),
+         }
+        ,
+/*Add new region here */
+};
+
+/**
+ *  @brief This function finds the CFP in
+ *  region_cfp_table based on region and band parameter.
+ *
+ *  @param region  The region code
+ *  @param band    The band
+ *  @param cfp_no  A pointer to CFP number
+ *  @return        A pointer to CFP
+ */
+static struct chan_freq_power *lbs_get_region_cfp_table(u8 region, int *cfp_no)
+{
+        int i, end;
+
+        lbs_deb_enter(LBS_DEB_MAIN);
+
+        end = ARRAY_SIZE(region_cfp_table);
+
+        for (i = 0; i < end ; i++) {
+                lbs_deb_main("region_cfp_table[i].region=%d\n",
+                        region_cfp_table[i].region);
+                if (region_cfp_table[i].region == region) {
+                        *cfp_no = region_cfp_table[i].cfp_no_BG;
+                        lbs_deb_leave(LBS_DEB_MAIN);
+                        return region_cfp_table[i].cfp_BG;
+                }
+        }
+
+        lbs_deb_leave_args(LBS_DEB_MAIN, "ret NULL");
+        return NULL;
+}
+
+int lbs_set_regiontable(struct lbs_private *priv, u8 region, u8 band)
+{
+        int ret = 0;
+        int i = 0;
+
+        struct chan_freq_power *cfp;
+        int cfp_no;
+
+        lbs_deb_enter(LBS_DEB_MAIN);
+
+        memset(priv->region_channel, 0, sizeof(priv->region_channel));
+
+        cfp = lbs_get_region_cfp_table(region, &cfp_no);
+        if (cfp != NULL) {
+                priv->region_channel[i].nrcfp = cfp_no;
+                priv->region_channel[i].CFP = cfp;
+        } else {
+                lbs_deb_main("wrong region code %#x in band B/G\n",
+                       region);
+                ret = -1;
+                goto out;
+        }
+        priv->region_channel[i].valid = 1;
+        priv->region_channel[i].region = region;
+        priv->region_channel[i].band = band;
+        i++;
+out:
+        lbs_deb_leave_args(LBS_DEB_MAIN, "ret %d", ret);
+        return ret;
+}
+
+
+
 
 /*********************************************************************/
 /*                                                                   */
@@ -161,31 +346,15 @@ static int lbs_scan_create_channel_list(struct lbs_private *priv,
         scantype = CMD_SCAN_TYPE_ACTIVE;
 
         for (rgnidx = 0; rgnidx < ARRAY_SIZE(priv->region_channel); rgnidx++) {
-                if (priv->enable11d && (priv->connect_status != LBS_CONNECTED)
-                    && (priv->mesh_connect_status != LBS_CONNECTED)) {
-                        /* Scan all the supported chan for the first scan */
-                        if (!priv->universal_channel[rgnidx].valid)
-                                continue;
-                        scanregion = &priv->universal_channel[rgnidx];
-
-                        /* clear the parsed_region_chan for the first scan */
-                        memset(&priv->parsed_region_chan, 0x00,
-                               sizeof(priv->parsed_region_chan));
-                } else {
-                        if (!priv->region_channel[rgnidx].valid)
-                                continue;
-                        scanregion = &priv->region_channel[rgnidx];
-                }
+                if (!priv->region_channel[rgnidx].valid)
+                        continue;
+                scanregion = &priv->region_channel[rgnidx];
 
                 for (nextchan = 0; nextchan < scanregion->nrcfp; nextchan++, chanidx++) {
                         struct chanscanparamset *chan = &scanchanlist[chanidx];
 
                         cfp = scanregion->CFP + nextchan;
 
-                        if (priv->enable11d)
-                                scantype = lbs_get_scan_type_11d(cfp->channel,
-                                                                 &priv->parsed_region_chan);
-
                         if (scanregion->band == BAND_B || scanregion->band == BAND_G)
                                 chan->radiotype = CMD_SCAN_RADIO_TYPE_BG;
 
@@ -399,11 +568,8 @@ int lbs_scan_networks(struct lbs_private *priv, int full_scan)
         chan_count = lbs_scan_create_channel_list(priv, chan_list);
 
         netif_stop_queue(priv->dev);
-        netif_carrier_off(priv->dev);
-        if (priv->mesh_dev) {
+        if (priv->mesh_dev)
                 netif_stop_queue(priv->mesh_dev);
-                netif_carrier_off(priv->mesh_dev);
-        }
 
         /* Prepare to continue an interrupted scan */
         lbs_deb_scan("chan_count %d, scan_channel %d\n",
@@ -467,16 +633,13 @@ out2:
         priv->scan_channel = 0;
 
 out:
-        if (priv->connect_status == LBS_CONNECTED) {
-                netif_carrier_on(priv->dev);
-                if (!priv->tx_pending_len)
-                        netif_wake_queue(priv->dev);
-        }
-        if (priv->mesh_dev && (priv->mesh_connect_status == LBS_CONNECTED)) {
-                netif_carrier_on(priv->mesh_dev);
-                if (!priv->tx_pending_len)
-                        netif_wake_queue(priv->mesh_dev);
-        }
+        if (priv->connect_status == LBS_CONNECTED && !priv->tx_pending_len)
+                netif_wake_queue(priv->dev);
+
+        if (priv->mesh_dev && lbs_mesh_connected(priv) &&
+            !priv->tx_pending_len)
+                netif_wake_queue(priv->mesh_dev);
+
         kfree(chan_list);
 
         lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
@@ -519,7 +682,6 @@ static int lbs_process_bss(struct bss_descriptor *bss,
         struct ieee_ie_cf_param_set *cf;
         struct ieee_ie_ibss_param_set *ibss;
         DECLARE_SSID_BUF(ssid);
-        struct ieee_ie_country_info_set *pcountryinfo;
         uint8_t *pos, *end, *p;
         uint8_t n_ex_rates = 0, got_basic_rates = 0, n_basic_rates = 0;
         uint16_t beaconsize = 0;
@@ -642,26 +804,6 @@ static int lbs_process_bss(struct bss_descriptor *bss,
                         lbs_deb_scan("got IBSS IE\n");
                         break;
 
-                case WLAN_EID_COUNTRY:
-                        pcountryinfo = (struct ieee_ie_country_info_set *) pos;
-                        lbs_deb_scan("got COUNTRY IE\n");
-                        if (pcountryinfo->header.len < sizeof(pcountryinfo->countrycode)
-                            || pcountryinfo->header.len > 254) {
-                                lbs_deb_scan("%s: 11D- Err CountryInfo len %d, min %zd, max 254\n",
-                                             __func__,
-                                             pcountryinfo->header.len,
-                                             sizeof(pcountryinfo->countrycode));
-                                ret = -1;
-                                goto done;
-                        }
-
-                        memcpy(&bss->countryinfo, pcountryinfo,
-                                pcountryinfo->header.len + 2);
-                        lbs_deb_hex(LBS_DEB_SCAN, "process_bss: 11d countryinfo",
-                                    (uint8_t *) pcountryinfo,
-                                    (int) (pcountryinfo->header.len + 2));
-                        break;
-
                 case WLAN_EID_EXT_SUPP_RATES:
                         /* only process extended supported rate if data rate is
                          * already found. Data rate IE should come before
@@ -812,7 +954,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
         /* SSID */
         iwe.cmd = SIOCGIWESSID;
         iwe.u.data.flags = 1;
-        iwe.u.data.length = min((uint32_t) bss->ssid_len, (uint32_t) IW_ESSID_MAX_SIZE);
+        iwe.u.data.length = min((uint32_t) bss->ssid_len, (uint32_t) IEEE80211_MAX_SSID_LEN);
         start = iwe_stream_add_point(info, start, stop, &iwe, bss->ssid);
 
         /* Mode */
@@ -1022,9 +1164,12 @@ int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
                 return -EAGAIN;
 
         /* Update RSSI if current BSS is a locally created ad-hoc BSS */
-        if ((priv->mode == IW_MODE_ADHOC) && priv->adhoccreate)
-                lbs_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
-                                             CMD_OPTION_WAITFORRSP, 0, NULL);
+        if ((priv->mode == IW_MODE_ADHOC) && priv->adhoccreate) {
+                err = lbs_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
+                                CMD_OPTION_WAITFORRSP, 0, NULL);
+                if (err)
+                        goto out;
+        }
 
         mutex_lock(&priv->lock);
         list_for_each_entry_safe (iter_bss, safe, &priv->network_list, list) {
@@ -1058,7 +1203,7 @@ int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
 
         dwrq->length = (ev - extra);
         dwrq->flags = 0;
-
+out:
         lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", err);
         return err;
 }
@@ -1141,11 +1286,11 @@ static int lbs_ret_80211_scan(struct lbs_private *priv, unsigned long dummy,
         /* The size of the TLV buffer is equal to the entire command response
          *   size (scanrespsize) minus the fixed fields (sizeof()'s), the
          *   BSS Descriptions (bssdescriptsize as bytesLef) and the command
-         *   response header (S_DS_GEN)
+         *   response header (sizeof(struct cmd_header))
          */
         tlvbufsize = scanrespsize - (bytesleft + sizeof(scanresp->bssdescriptsize)
                                      + sizeof(scanresp->nr_sets)
-                                     + S_DS_GEN);
+                                     + sizeof(struct cmd_header));
 
         /*
          *  Process each scan response returned (scanresp->nr_sets). Save
diff --git a/drivers/net/wireless/libertas/scan.h b/drivers/net/wireless/libertas/scan.h
index fab7d5d097fc..8fb1706d7526 100644
--- a/drivers/net/wireless/libertas/scan.h
+++ b/drivers/net/wireless/libertas/scan.h
@@ -9,8 +9,36 @@
 
 #include <net/iw_handler.h>
 
+struct lbs_private;
+
 #define MAX_NETWORK_COUNT 128
 
+/** Chan-freq-TxPower mapping table*/
+struct chan_freq_power {
+        /** channel Number              */
+        u16 channel;
+        /** frequency of this channel   */
+        u32 freq;
+        /** Max allowed Tx power level  */
+        u16 maxtxpower;
+        /** TRUE:channel unsupported;  FLASE:supported*/
+        u8 unsupported;
+};
+
+/** region-band mapping table*/
+struct region_channel {
+        /** TRUE if this entry is valid              */
+        u8 valid;
+        /** region code for US, Japan ...            */
+        u8 region;
+        /** band B/G/A, used for BAND_CONFIG cmd             */
+        u8 band;
+        /** Actual No. of elements in the array below */
+        u8 nrcfp;
+        /** chan-freq-txpower mapping table*/
+        struct chan_freq_power *CFP;
+};
+
 /**
  *  @brief Maximum number of channels that can be sent in a setuserscan ioctl
  */
@@ -18,6 +46,8 @@
 
 int lbs_ssid_cmp(u8 *ssid1, u8 ssid1_len, u8 *ssid2, u8 ssid2_len);
 
+int lbs_set_regiontable(struct lbs_private *priv, u8 region, u8 band);
+
 int lbs_send_specific_ssid_scan(struct lbs_private *priv, u8 *ssid,
                                 u8 ssid_len);
 
diff --git a/drivers/net/wireless/libertas/tx.c b/drivers/net/wireless/libertas/tx.c
index 8c3766a6e8e7..52d244ea3d97 100644
--- a/drivers/net/wireless/libertas/tx.c
+++ b/drivers/net/wireless/libertas/tx.c
@@ -5,7 +5,7 @@
 #include <linux/etherdevice.h>
 #include <linux/sched.h>
 
-#include "hostcmd.h"
+#include "host.h"
 #include "radiotap.h"
 #include "decl.h"
 #include "defs.h"
@@ -131,12 +131,7 @@ netdev_tx_t lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         txpd->tx_packet_length = cpu_to_le16(pkt_len);
         txpd->tx_packet_location = cpu_to_le32(sizeof(struct txpd));
 
-        if (dev == priv->mesh_dev) {
-                if (priv->mesh_fw_ver == MESH_FW_OLD)
-                        txpd->tx_control |= cpu_to_le32(TxPD_MESH_FRAME);
-                else if (priv->mesh_fw_ver == MESH_FW_NEW)
-                        txpd->u.bss.bss_num = MESH_IFACE_ID;
-        }
+        lbs_mesh_set_txpd(priv, dev, txpd);
 
         lbs_deb_hex(LBS_DEB_TX, "txpd", (u8 *) &txpd, sizeof(struct txpd));
 
@@ -203,7 +198,7 @@ void lbs_send_tx_feedback(struct lbs_private *priv, u32 try_count)
         if (priv->connect_status == LBS_CONNECTED)
                 netif_wake_queue(priv->dev);
 
-        if (priv->mesh_dev && (priv->mesh_connect_status == LBS_CONNECTED))
+        if (priv->mesh_dev && lbs_mesh_connected(priv))
                 netif_wake_queue(priv->mesh_dev);
 }
 EXPORT_SYMBOL_GPL(lbs_send_tx_feedback);
diff --git a/drivers/net/wireless/libertas/types.h b/drivers/net/wireless/libertas/types.h
index 99905df65b25..3e72c86ceca8 100644
--- a/drivers/net/wireless/libertas/types.h
+++ b/drivers/net/wireless/libertas/types.h
@@ -5,8 +5,8 @@
 #define _LBS_TYPES_H_
 
 #include <linux/if_ether.h>
+#include <linux/ieee80211.h>
 #include <asm/byteorder.h>
-#include <linux/wireless.h>
 
 struct ieee_ie_header {
         u8 id;
@@ -247,7 +247,7 @@ struct mrvl_meshie_val {
         uint8_t active_metric_id;
         uint8_t mesh_capability;
         uint8_t mesh_id_len;
-        uint8_t mesh_id[IW_ESSID_MAX_SIZE];
+        uint8_t mesh_id[IEEE80211_MAX_SSID_LEN];
 } __attribute__ ((packed));
 
 struct mrvl_meshie {
diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
index be837a0d2517..9b555884b08a 100644
--- a/drivers/net/wireless/libertas/wext.c
+++ b/drivers/net/wireless/libertas/wext.c
@@ -2,6 +2,7 @@
   * This file contains ioctl functions
   */
 #include <linux/ctype.h>
+#include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/if.h>
 #include <linux/if_arp.h>
@@ -45,6 +46,63 @@ static inline void lbs_cancel_association_work(struct lbs_private *priv)
         priv->pending_assoc_req = NULL;
 }
 
+void lbs_send_disconnect_notification(struct lbs_private *priv)
+{
+        union iwreq_data wrqu;
+
+        memset(wrqu.ap_addr.sa_data, 0x00, ETH_ALEN);
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
+}
+
+static void lbs_send_iwevcustom_event(struct lbs_private *priv, s8 *str)
+{
+        union iwreq_data iwrq;
+        u8 buf[50];
+
+        lbs_deb_enter(LBS_DEB_WEXT);
+
+        memset(&iwrq, 0, sizeof(union iwreq_data));
+        memset(buf, 0, sizeof(buf));
+
+        snprintf(buf, sizeof(buf) - 1, "%s", str);
+
+        iwrq.data.length = strlen(buf) + 1 + IW_EV_LCP_LEN;
+
+        /* Send Event to upper layer */
+        lbs_deb_wext("event indication string %s\n", (char *)buf);
+        lbs_deb_wext("event indication length %d\n", iwrq.data.length);
+        lbs_deb_wext("sending wireless event IWEVCUSTOM for %s\n", str);
+
+        wireless_send_event(priv->dev, IWEVCUSTOM, &iwrq, buf);
+
+        lbs_deb_leave(LBS_DEB_WEXT);
+}
+
+/**
+ *  @brief This function handles MIC failure event.
+ *
+ *  @param priv    A pointer to struct lbs_private structure
+ *  @para  event   the event id
+ *  @return        n/a
+ */
+void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event)
+{
+        char buf[50];
+
+        lbs_deb_enter(LBS_DEB_CMD);
+        memset(buf, 0, sizeof(buf));
+
+        sprintf(buf, "%s", "MLME-MICHAELMICFAILURE.indication ");
+
+        if (event == MACREG_INT_CODE_MIC_ERR_UNICAST)
+                strcat(buf, "unicast ");
+        else
+                strcat(buf, "multicast ");
+
+        lbs_send_iwevcustom_event(priv, buf);
+        lbs_deb_leave(LBS_DEB_CMD);
+}
 
 /**
  *  @brief Find the channel frequency power info with specific channel
@@ -66,8 +124,6 @@ struct chan_freq_power *lbs_find_cfp_by_band_and_channel(
         for (j = 0; !cfp && (j < ARRAY_SIZE(priv->region_channel)); j++) {
                 rc = &priv->region_channel[j];
 
-                if (priv->enable11d)
-                        rc = &priv->universal_channel[j];
                 if (!rc->valid || !rc->CFP)
                         continue;
                 if (rc->band != band)
@@ -107,8 +163,6 @@ static struct chan_freq_power *find_cfp_by_band_and_freq(
         for (j = 0; !cfp && (j < ARRAY_SIZE(priv->region_channel)); j++) {
                 rc = &priv->region_channel[j];
 
-                if (priv->enable11d)
-                        rc = &priv->universal_channel[j];
                 if (!rc->valid || !rc->CFP)
                         continue;
                 if (rc->band != band)
@@ -139,7 +193,7 @@ static void copy_active_data_rates(struct lbs_private *priv, u8 *rates)
         lbs_deb_enter(LBS_DEB_WEXT);
 
         if ((priv->connect_status != LBS_CONNECTED) &&
-                (priv->mesh_connect_status != LBS_CONNECTED))
+                !lbs_mesh_connected(priv))
                 memcpy(rates, lbs_bg_rates, MAX_RATES);
         else
                 memcpy(rates, priv->curbssparams.rates, MAX_RATES);
@@ -169,12 +223,12 @@ static int lbs_get_freq(struct net_device *dev, struct iw_request_info *info,
         lbs_deb_enter(LBS_DEB_WEXT);
 
         cfp = lbs_find_cfp_by_band_and_channel(priv, 0,
-                                           priv->curbssparams.channel);
+                                           priv->channel);
 
         if (!cfp) {
-                if (priv->curbssparams.channel)
+                if (priv->channel)
                         lbs_deb_wext("invalid channel %d\n",
-                               priv->curbssparams.channel);
+                               priv->channel);
                 return -EINVAL;
         }
 
@@ -245,6 +299,7 @@ static int lbs_get_nick(struct net_device *dev, struct iw_request_info *info,
         return 0;
 }
 
+#ifdef CONFIG_LIBERTAS_MESH
 static int mesh_get_nick(struct net_device *dev, struct iw_request_info *info,
                          struct iw_point *dwrq, char *extra)
 {
@@ -254,7 +309,7 @@ static int mesh_get_nick(struct net_device *dev, struct iw_request_info *info,
 
         /* Use nickname to indicate that mesh is on */
 
-        if (priv->mesh_connect_status == LBS_CONNECTED) {
+        if (lbs_mesh_connected(priv)) {
                 strncpy(extra, "Mesh", 12);
                 extra[12] = '\0';
                 dwrq->length = strlen(extra);
@@ -268,6 +323,7 @@ static int mesh_get_nick(struct net_device *dev, struct iw_request_info *info,
         lbs_deb_leave(LBS_DEB_WEXT);
         return 0;
 }
+#endif
 
 static int lbs_set_rts(struct net_device *dev, struct iw_request_info *info,
                         struct iw_param *vwrq, char *extra)
@@ -369,6 +425,7 @@ static int lbs_get_mode(struct net_device *dev,
         return 0;
 }
 
+#ifdef CONFIG_LIBERTAS_MESH
 static int mesh_wlan_get_mode(struct net_device *dev,
                               struct iw_request_info *info, u32 * uwrq,
                               char *extra)
@@ -380,6 +437,7 @@ static int mesh_wlan_get_mode(struct net_device *dev,
         lbs_deb_leave(LBS_DEB_WEXT);
         return 0;
 }
+#endif
 
 static int lbs_get_txpow(struct net_device *dev,
                           struct iw_request_info *info,
@@ -547,8 +605,6 @@ static int lbs_get_range(struct net_device *dev, struct iw_request_info *info,
         struct chan_freq_power *cfp;
         u8 rates[MAX_RATES + 1];
 
-        u8 flag = 0;
-
         lbs_deb_enter(LBS_DEB_WEXT);
 
         dwrq->length = sizeof(struct iw_range);
@@ -570,52 +626,21 @@ static int lbs_get_range(struct net_device *dev, struct iw_request_info *info,
 
         range->scan_capa = IW_SCAN_CAPA_ESSID;
 
-        if (priv->enable11d &&
-            (priv->connect_status == LBS_CONNECTED ||
-            priv->mesh_connect_status == LBS_CONNECTED)) {
-                u8 chan_no;
-                u8 band;
-
-                struct parsed_region_chan_11d *parsed_region_chan =
-                    &priv->parsed_region_chan;
-
-                if (parsed_region_chan == NULL) {
-                        lbs_deb_wext("11d: parsed_region_chan is NULL\n");
-                        goto out;
-                }
-                band = parsed_region_chan->band;
-                lbs_deb_wext("band %d, nr_char %d\n", band,
-                       parsed_region_chan->nr_chan);
-
+        for (j = 0; (range->num_frequency < IW_MAX_FREQUENCIES)
+             && (j < ARRAY_SIZE(priv->region_channel)); j++) {
+                cfp = priv->region_channel[j].CFP;
                 for (i = 0; (range->num_frequency < IW_MAX_FREQUENCIES)
-                     && (i < parsed_region_chan->nr_chan); i++) {
-                        chan_no = parsed_region_chan->chanpwr[i].chan;
-                        lbs_deb_wext("chan_no %d\n", chan_no);
-                        range->freq[range->num_frequency].i = (long)chan_no;
+                     && priv->region_channel[j].valid
+                     && cfp
+                     && (i < priv->region_channel[j].nrcfp); i++) {
+                        range->freq[range->num_frequency].i =
+                            (long)cfp->channel;
                         range->freq[range->num_frequency].m =
-                            (long)lbs_chan_2_freq(chan_no) * 100000;
+                            (long)cfp->freq * 100000;
                         range->freq[range->num_frequency].e = 1;
+                        cfp++;
                         range->num_frequency++;
                 }
-                flag = 1;
-        }
-        if (!flag) {
-                for (j = 0; (range->num_frequency < IW_MAX_FREQUENCIES)
-                     && (j < ARRAY_SIZE(priv->region_channel)); j++) {
-                        cfp = priv->region_channel[j].CFP;
-                        for (i = 0; (range->num_frequency < IW_MAX_FREQUENCIES)
-                             && priv->region_channel[j].valid
-                             && cfp
-                             && (i < priv->region_channel[j].nrcfp); i++) {
-                                range->freq[range->num_frequency].i =
-                                    (long)cfp->channel;
-                                range->freq[range->num_frequency].m =
-                                    (long)cfp->freq * 100000;
-                                range->freq[range->num_frequency].e = 1;
-                                cfp++;
-                                range->num_frequency++;
-                        }
-                }
         }
 
         lbs_deb_wext("IW_MAX_FREQUENCIES %d, num_frequency %d\n",
@@ -700,7 +725,6 @@ static int lbs_get_range(struct net_device *dev, struct iw_request_info *info,
                                   | IW_ENC_CAPA_CIPHER_CCMP;
         }
 
-out:
         lbs_deb_leave(LBS_DEB_WEXT);
         return 0;
 }
@@ -709,6 +733,7 @@ static int lbs_set_power(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
         struct lbs_private *priv = dev->ml_priv;
+        int ret = 0;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -737,8 +762,54 @@ static int lbs_set_power(struct net_device *dev, struct iw_request_info *info,
                        "setting power timeout is not supported\n");
                 return -EINVAL;
         } else if ((vwrq->flags & IW_POWER_TYPE) == IW_POWER_PERIOD) {
-                lbs_deb_wext("setting power period not supported\n");
-                return -EINVAL;
+                vwrq->value = vwrq->value / 1000;
+                if (!priv->enter_deep_sleep) {
+                        lbs_pr_err("deep sleep feature is not implemented "
+                                        "for this interface driver\n");
+                        return -EINVAL;
+                }
+
+                if (priv->connect_status == LBS_CONNECTED) {
+                        if ((priv->is_auto_deep_sleep_enabled) &&
+                                                (vwrq->value == -1000)) {
+                                lbs_exit_auto_deep_sleep(priv);
+                                return 0;
+                        } else {
+                                lbs_pr_err("can't use deep sleep cmd in "
+                                                "connected state\n");
+                                return -EINVAL;
+                        }
+                }
+
+                if ((vwrq->value < 0) && (vwrq->value != -1000)) {
+                        lbs_pr_err("unknown option\n");
+                        return -EINVAL;
+                }
+
+                if (vwrq->value > 0) {
+                        if (!priv->is_auto_deep_sleep_enabled) {
+                                priv->is_activity_detected = 0;
+                                priv->auto_deep_sleep_timeout = vwrq->value;
+                                lbs_enter_auto_deep_sleep(priv);
+                        } else {
+                                priv->auto_deep_sleep_timeout = vwrq->value;
+                                lbs_deb_debugfs("auto deep sleep: "
+                                                "already enabled\n");
+                        }
+                        return 0;
+                } else {
+                        if (priv->is_auto_deep_sleep_enabled) {
+                                lbs_exit_auto_deep_sleep(priv);
+                                /* Try to exit deep sleep if auto */
+                                /*deep sleep disabled */
+                                ret = lbs_set_deep_sleep(priv, 0);
+                        }
+                        if (vwrq->value == 0)
+                                ret = lbs_set_deep_sleep(priv, 1);
+                        else if (vwrq->value == -1000)
+                                ret = lbs_set_deep_sleep(priv, 0);
+                        return ret;
+                }
         }
 
         if (priv->psmode != LBS802_11POWERMODECAM) {
@@ -752,6 +823,7 @@ static int lbs_set_power(struct net_device *dev, struct iw_request_info *info,
         }
 
         lbs_deb_leave(LBS_DEB_WEXT);
+
         return 0;
 }
 
@@ -785,7 +857,7 @@ static struct iw_statistics *lbs_get_wireless_stats(struct net_device *dev)
         u32 rssi_qual;
         u32 tx_qual;
         u32 quality = 0;
-        int stats_valid = 0;
+        int ret, stats_valid = 0;
         u8 rssi;
         u32 tx_retries;
         struct cmd_ds_802_11_get_log log;
@@ -796,7 +868,7 @@ static struct iw_statistics *lbs_get_wireless_stats(struct net_device *dev)
 
         /* If we're not associated, all quality values are meaningless */
         if ((priv->connect_status != LBS_CONNECTED) &&
-            (priv->mesh_connect_status != LBS_CONNECTED))
+            !lbs_mesh_connected(priv))
                 goto out;
 
         /* Quality by RSSI */
@@ -834,7 +906,9 @@ static struct iw_statistics *lbs_get_wireless_stats(struct net_device *dev)
 
         memset(&log, 0, sizeof(log));
         log.hdr.size = cpu_to_le16(sizeof(log));
-        lbs_cmd_with_response(priv, CMD_802_11_GET_LOG, &log);
+        ret = lbs_cmd_with_response(priv, CMD_802_11_GET_LOG, &log);
+        if (ret)
+                goto out;
 
         tx_retries = le32_to_cpu(log.retry);
 
@@ -862,8 +936,10 @@ static struct iw_statistics *lbs_get_wireless_stats(struct net_device *dev)
         stats_valid = 1;
 
         /* update stats asynchronously for future calls */
-        lbs_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
+        ret = lbs_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
                                         0, 0, NULL);
+        if (ret)
+                lbs_pr_err("RSSI command failed\n");
 out:
         if (!stats_valid) {
                 priv->wstats.miss.beacon = 0;
@@ -939,6 +1015,7 @@ out:
         return ret;
 }
 
+#ifdef CONFIG_LIBERTAS_MESH
 static int lbs_mesh_set_freq(struct net_device *dev,
                              struct iw_request_info *info,
                              struct iw_freq *fwrq, char *extra)
@@ -973,7 +1050,7 @@ static int lbs_mesh_set_freq(struct net_device *dev,
                 goto out;
         }
 
-        if (fwrq->m != priv->curbssparams.channel) {
+        if (fwrq->m != priv->channel) {
                 lbs_deb_wext("mesh channel change forces eth disconnect\n");
                 if (priv->mode == IW_MODE_INFRA)
                         lbs_cmd_80211_deauthenticate(priv,
@@ -990,6 +1067,7 @@ out:
         lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
         return ret;
 }
+#endif
 
 static int lbs_set_rate(struct net_device *dev, struct iw_request_info *info,
                   struct iw_param *vwrq, char *extra)
@@ -1000,6 +1078,7 @@ static int lbs_set_rate(struct net_device *dev, struct iw_request_info *info,
         u8 rates[MAX_RATES + 1];
 
         lbs_deb_enter(LBS_DEB_WEXT);
+
         lbs_deb_wext("vwrq->value %d\n", vwrq->value);
         lbs_deb_wext("vwrq->fixed %d\n", vwrq->fixed);
 
@@ -1953,10 +2032,8 @@ static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
         if (priv->connect_status == LBS_CONNECTED) {
                 memcpy(extra, priv->curbssparams.ssid,
                        priv->curbssparams.ssid_len);
-                extra[priv->curbssparams.ssid_len] = '\0';
         } else {
                 memset(extra, 0, 32);
-                extra[priv->curbssparams.ssid_len] = '\0';
         }
         /*
          * If none, we may want to get the one that was set
@@ -1975,7 +2052,7 @@ static int lbs_set_essid(struct net_device *dev, struct iw_request_info *info,
 {
         struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
-        u8 ssid[IW_ESSID_MAX_SIZE];
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
         u8 ssid_len = 0;
         struct assoc_request * assoc_req;
         int in_ssid_len = dwrq->length;
@@ -1989,7 +2066,7 @@ static int lbs_set_essid(struct net_device *dev, struct iw_request_info *info,
         }
 
         /* Check the size of the string */
-        if (in_ssid_len > IW_ESSID_MAX_SIZE) {
+        if (in_ssid_len > IEEE80211_MAX_SSID_LEN) {
                 ret = -E2BIG;
                 goto out;
         }
@@ -2020,7 +2097,7 @@ out:
                         ret = -ENOMEM;
                 } else {
                         /* Copy the SSID to the association request */
-                        memcpy(&assoc_req->ssid, &ssid, IW_ESSID_MAX_SIZE);
+                        memcpy(&assoc_req->ssid, &ssid, IEEE80211_MAX_SSID_LEN);
                         assoc_req->ssid_len = ssid_len;
                         set_bit(ASSOC_FLAG_SSID, &assoc_req->flags);
                         lbs_postpone_association_work(priv);
@@ -2038,6 +2115,7 @@ out:
         return ret;
 }
 
+#ifdef CONFIG_LIBERTAS_MESH
 static int lbs_mesh_get_essid(struct net_device *dev,
                               struct iw_request_info *info,
                               struct iw_point *dwrq, char *extra)
@@ -2071,7 +2149,7 @@ static int lbs_mesh_set_essid(struct net_device *dev,
         }
 
         /* Check the size of the string */
-        if (dwrq->length > IW_ESSID_MAX_SIZE) {
+        if (dwrq->length > IEEE80211_MAX_SSID_LEN) {
                 ret = -E2BIG;
                 goto out;
         }
@@ -2086,11 +2164,12 @@ static int lbs_mesh_set_essid(struct net_device *dev,
         }
 
         lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
-                        priv->curbssparams.channel);
+                        priv->channel);
  out:
         lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
         return ret;
 }
+#endif
 
 /**
  *  @brief Connect to the AP or Ad-hoc Network with specific bssid
@@ -2197,7 +2276,13 @@ static const iw_handler lbs_handler[] = {
         (iw_handler) lbs_get_encodeext,/* SIOCGIWENCODEEXT */
         (iw_handler) NULL,              /* SIOCSIWPMKSA */
 };
+struct iw_handler_def lbs_handler_def = {
+        .num_standard   = ARRAY_SIZE(lbs_handler),
+        .standard       = (iw_handler *) lbs_handler,
+        .get_wireless_stats = lbs_get_wireless_stats,
+};
 
+#ifdef CONFIG_LIBERTAS_MESH
 static const iw_handler mesh_wlan_handler[] = {
         (iw_handler) NULL,      /* SIOCSIWCOMMIT */
         (iw_handler) lbs_get_name,      /* SIOCGIWNAME */
@@ -2255,14 +2340,10 @@ static const iw_handler mesh_wlan_handler[] = {
         (iw_handler) lbs_get_encodeext,/* SIOCGIWENCODEEXT */
         (iw_handler) NULL,              /* SIOCSIWPMKSA */
 };
-struct iw_handler_def lbs_handler_def = {
-        .num_standard   = ARRAY_SIZE(lbs_handler),
-        .standard       = (iw_handler *) lbs_handler,
-        .get_wireless_stats = lbs_get_wireless_stats,
-};
 
 struct iw_handler_def mesh_handler_def = {
         .num_standard   = ARRAY_SIZE(mesh_wlan_handler),
         .standard       = (iw_handler *) mesh_wlan_handler,
         .get_wireless_stats = lbs_get_wireless_stats,
 };
+#endif
diff --git a/drivers/net/wireless/libertas/wext.h b/drivers/net/wireless/libertas/wext.h
index 4c08db497606..f3f19fe8c6c6 100644
--- a/drivers/net/wireless/libertas/wext.h
+++ b/drivers/net/wireless/libertas/wext.h
@@ -4,7 +4,14 @@
 #ifndef _LBS_WEXT_H_
 #define _LBS_WEXT_H_
 
+void lbs_send_disconnect_notification(struct lbs_private *priv);
+void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event);
+
+struct chan_freq_power *lbs_find_cfp_by_band_and_channel(
+        struct lbs_private *priv,
+        u8 band,
+        u16 channel);
+
 extern struct iw_handler_def lbs_handler_def;
-extern struct iw_handler_def mesh_handler_def;
 
 #endif
diff --git a/drivers/net/wireless/libertas_tf/cmd.c b/drivers/net/wireless/libertas_tf/cmd.c
index 28790e03dc43..b620daf59ef7 100644
--- a/drivers/net/wireless/libertas_tf/cmd.c
+++ b/drivers/net/wireless/libertas_tf/cmd.c
@@ -7,6 +7,8 @@
  *  the Free Software Foundation; either version 2 of the License, or (at
  *  your option) any later version.
  */
+#include <linux/slab.h>
+
 #include "libertas_tf.h"
 
 static const struct channel_range channel_ranges[] = {
diff --git a/drivers/net/wireless/libertas_tf/if_usb.c b/drivers/net/wireless/libertas_tf/if_usb.c
index 392337b37b1d..8cc9db60c14b 100644
--- a/drivers/net/wireless/libertas_tf/if_usb.c
+++ b/drivers/net/wireless/libertas_tf/if_usb.c
@@ -11,6 +11,7 @@
 #include <linux/moduleparam.h>
 #include <linux/firmware.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 
 #define DRV_NAME "lbtf_usb"
@@ -23,6 +24,8 @@
 static char *lbtf_fw_name = "lbtf_usb.bin";
 module_param_named(fw_name, lbtf_fw_name, charp, 0644);
 
+MODULE_FIRMWARE("lbtf_usb.bin");
+
 static struct usb_device_id if_usb_table[] = {
         /* Enter the device signature inside */
         { USB_DEVICE(0x1286, 0x2001) },
diff --git a/drivers/net/wireless/libertas_tf/main.c b/drivers/net/wireless/libertas_tf/main.c
index 019431d2f8a9..7945ff5aa334 100644
--- a/drivers/net/wireless/libertas_tf/main.c
+++ b/drivers/net/wireless/libertas_tf/main.c
@@ -7,6 +7,8 @@
  *  the Free Software Foundation; either version 2 of the License, or (at
  *  your option) any later version.
  */
+#include <linux/slab.h>
+
 #include "libertas_tf.h"
 #include "linux/etherdevice.h"
 
@@ -318,14 +320,14 @@ static void lbtf_op_stop(struct ieee80211_hw *hw)
 }
 
 static int lbtf_op_add_interface(struct ieee80211_hw *hw,
-                        struct ieee80211_if_init_conf *conf)
+                        struct ieee80211_vif *vif)
 {
         struct lbtf_private *priv = hw->priv;
         if (priv->vif != NULL)
                 return -EOPNOTSUPP;
 
-        priv->vif = conf->vif;
-        switch (conf->type) {
+        priv->vif = vif;
+        switch (vif->type) {
         case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_AP:
                 lbtf_set_mode(priv, LBTF_AP_MODE);
@@ -337,12 +339,12 @@ static int lbtf_op_add_interface(struct ieee80211_hw *hw,
                 priv->vif = NULL;
                 return -EOPNOTSUPP;
         }
-        lbtf_set_mac_address(priv, (u8 *) conf->mac_addr);
+        lbtf_set_mac_address(priv, (u8 *) vif->addr);
         return 0;
 }
 
 static void lbtf_op_remove_interface(struct ieee80211_hw *hw,
-                        struct ieee80211_if_init_conf *conf)
+                        struct ieee80211_vif *vif)
 {
         struct lbtf_private *priv = hw->priv;
 
@@ -495,7 +497,6 @@ int lbtf_rx(struct lbtf_private *priv, struct sk_buff *skb)
         stats.band = IEEE80211_BAND_2GHZ;
         stats.signal = prxpd->snr;
         stats.noise = prxpd->nf;
-        stats.qual = prxpd->snr - prxpd->nf;
         /* Marvell rate index has a hole at value 4 */
         if (prxpd->rx_rate > 4)
                 --prxpd->rx_rate;
@@ -556,6 +557,9 @@ struct lbtf_private *lbtf_add_card(void *card, struct device *dmdev)
         priv->band.n_channels = ARRAY_SIZE(lbtf_channels);
         priv->band.channels = priv->channels;
         hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band;
+        hw->wiphy->interface_modes =
+                BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_ADHOC);
         skb_queue_head_init(&priv->bc_ps_buf);
 
         SET_IEEE80211_DEV(hw, dmdev);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 38cfd79e0590..7cd5f56662fc 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <net/dst.h>
 #include <net/xfrm.h>
@@ -32,6 +33,10 @@ static int radios = 2;
 module_param(radios, int, 0444);
 MODULE_PARM_DESC(radios, "Number of simulated radios");
 
+static bool fake_hw_scan;
+module_param(fake_hw_scan, bool, 0444);
+MODULE_PARM_DESC(fake_hw_scan, "Install fake (no-op) hw-scan handler");
+
 /**
  * enum hwsim_regtest - the type of regulatory tests we offer
  *
@@ -281,10 +286,12 @@ struct mac80211_hwsim_data {
         struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
         struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
 
+        struct mac_address addresses[2];
+
         struct ieee80211_channel *channel;
         unsigned long beacon_int; /* in jiffies unit */
         unsigned int rx_filter;
-        int started;
+        bool started, idle;
         struct timer_list beacon_timer;
         enum ps_mode {
                 PS_DISABLED, PS_ENABLED, PS_AUTO_POLL, PS_MANUAL_POLL
@@ -365,6 +372,49 @@ static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,
 }
 
 
+static void mac80211_hwsim_monitor_ack(struct ieee80211_hw *hw, const u8 *addr)
+{
+        struct mac80211_hwsim_data *data = hw->priv;
+        struct sk_buff *skb;
+        struct hwsim_radiotap_hdr *hdr;
+        u16 flags;
+        struct ieee80211_hdr *hdr11;
+
+        if (!netif_running(hwsim_mon))
+                return;
+
+        skb = dev_alloc_skb(100);
+        if (skb == NULL)
+                return;
+
+        hdr = (struct hwsim_radiotap_hdr *) skb_put(skb, sizeof(*hdr));
+        hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
+        hdr->hdr.it_pad = 0;
+        hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
+        hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
+                                          (1 << IEEE80211_RADIOTAP_CHANNEL));
+        hdr->rt_flags = 0;
+        hdr->rt_rate = 0;
+        hdr->rt_channel = cpu_to_le16(data->channel->center_freq);
+        flags = IEEE80211_CHAN_2GHZ;
+        hdr->rt_chbitmask = cpu_to_le16(flags);
+
+        hdr11 = (struct ieee80211_hdr *) skb_put(skb, 10);
+        hdr11->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
+                                           IEEE80211_STYPE_ACK);
+        hdr11->duration_id = cpu_to_le16(0);
+        memcpy(hdr11->addr1, addr, ETH_ALEN);
+
+        skb->dev = hwsim_mon;
+        skb_set_mac_header(skb, 0);
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = htons(ETH_P_802_2);
+        memset(skb->cb, 0, sizeof(skb->cb));
+        netif_rx(skb);
+}
+
+
 static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
                            struct sk_buff *skb)
 {
@@ -393,6 +443,38 @@ static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
 }
 
 
+struct mac80211_hwsim_addr_match_data {
+        bool ret;
+        const u8 *addr;
+};
+
+static void mac80211_hwsim_addr_iter(void *data, u8 *mac,
+                                     struct ieee80211_vif *vif)
+{
+        struct mac80211_hwsim_addr_match_data *md = data;
+        if (memcmp(mac, md->addr, ETH_ALEN) == 0)
+                md->ret = true;
+}
+
+
+static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
+                                      const u8 *addr)
+{
+        struct mac80211_hwsim_addr_match_data md;
+
+        if (memcmp(addr, data->hw->wiphy->perm_addr, ETH_ALEN) == 0)
+                return true;
+
+        md.ret = false;
+        md.addr = addr;
+        ieee80211_iterate_active_interfaces_atomic(data->hw,
+                                                   mac80211_hwsim_addr_iter,
+                                                   &md);
+
+        return md.ret;
+}
+
+
 static bool mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
                                     struct sk_buff *skb)
 {
@@ -402,6 +484,12 @@ static bool mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_rx_status rx_status;
 
+        if (data->idle) {
+                printk(KERN_DEBUG "%s: Trying to TX when idle - reject\n",
+                       wiphy_name(hw->wiphy));
+                return false;
+        }
+
         memset(&rx_status, 0, sizeof(rx_status));
         /* TODO: set mactime */
         rx_status.freq = data->channel->center_freq;
@@ -428,7 +516,8 @@ static bool mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
                 if (data == data2)
                         continue;
 
-                if (!data2->started || !hwsim_ps_rx_ok(data2, skb) ||
+                if (data2->idle || !data2->started ||
+                    !hwsim_ps_rx_ok(data2, skb) ||
                     !data->channel || !data2->channel ||
                     data->channel->center_freq != data2->channel->center_freq ||
                     !(data->group & data2->group))
@@ -438,8 +527,7 @@ static bool mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
                 if (nskb == NULL)
                         continue;
 
-                if (memcmp(hdr->addr1, data2->hw->wiphy->perm_addr,
-                           ETH_ALEN) == 0)
+                if (mac80211_hwsim_addr_match(data2, hdr->addr1))
                         ack = true;
                 memcpy(IEEE80211_SKB_RXCB(nskb), &rx_status, sizeof(rx_status));
                 ieee80211_rx_irqsafe(data2->hw, nskb);
@@ -464,6 +552,10 @@ static int mac80211_hwsim_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         }
 
         ack = mac80211_hwsim_tx_frame(hw, skb);
+        if (ack && skb->len >= 16) {
+                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+                mac80211_hwsim_monitor_ack(hw, hdr->addr2);
+        }
 
         txi = IEEE80211_SKB_CB(skb);
 
@@ -499,24 +591,24 @@ static void mac80211_hwsim_stop(struct ieee80211_hw *hw)
 
 
 static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
-                                        struct ieee80211_if_init_conf *conf)
+                                        struct ieee80211_vif *vif)
 {
         printk(KERN_DEBUG "%s:%s (type=%d mac_addr=%pM)\n",
-               wiphy_name(hw->wiphy), __func__, conf->type,
-               conf->mac_addr);
-        hwsim_set_magic(conf->vif);
+               wiphy_name(hw->wiphy), __func__, vif->type,
+               vif->addr);
+        hwsim_set_magic(vif);
         return 0;
 }
 
 
 static void mac80211_hwsim_remove_interface(
-        struct ieee80211_hw *hw, struct ieee80211_if_init_conf *conf)
+        struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
         printk(KERN_DEBUG "%s:%s (type=%d mac_addr=%pM)\n",
-               wiphy_name(hw->wiphy), __func__, conf->type,
-               conf->mac_addr);
-        hwsim_check_magic(conf->vif);
-        hwsim_clear_magic(conf->vif);
+               wiphy_name(hw->wiphy), __func__, vif->type,
+               vif->addr);
+        hwsim_check_magic(vif);
+        hwsim_clear_magic(vif);
 }
 
 
@@ -564,12 +656,28 @@ static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct mac80211_hwsim_data *data = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
-
-        printk(KERN_DEBUG "%s:%s (freq=%d idle=%d ps=%d)\n",
+        static const char *chantypes[4] = {
+                [NL80211_CHAN_NO_HT] = "noht",
+                [NL80211_CHAN_HT20] = "ht20",
+                [NL80211_CHAN_HT40MINUS] = "ht40-",
+                [NL80211_CHAN_HT40PLUS] = "ht40+",
+        };
+        static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
+                [IEEE80211_SMPS_AUTOMATIC] = "auto",
+                [IEEE80211_SMPS_OFF] = "off",
+                [IEEE80211_SMPS_STATIC] = "static",
+                [IEEE80211_SMPS_DYNAMIC] = "dynamic",
+        };
+
+        printk(KERN_DEBUG "%s:%s (freq=%d/%s idle=%d ps=%d smps=%s)\n",
                wiphy_name(hw->wiphy), __func__,
                conf->channel->center_freq,
+               chantypes[conf->channel_type],
                !!(conf->flags & IEEE80211_CONF_IDLE),
-               !!(conf->flags & IEEE80211_CONF_PS));
+               !!(conf->flags & IEEE80211_CONF_PS),
+               smps_modes[conf->smps_mode]);
+
+        data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
 
         data->channel = conf->channel;
         if (!data->started || !data->beacon_int)
@@ -664,23 +772,41 @@ static void mac80211_hwsim_bss_info_changed(struct ieee80211_hw *hw,
         }
 }
 
+static int mac80211_hwsim_sta_add(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_sta *sta)
+{
+        hwsim_check_magic(vif);
+        hwsim_set_sta_magic(sta);
+
+        return 0;
+}
+
+static int mac80211_hwsim_sta_remove(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_sta *sta)
+{
+        hwsim_check_magic(vif);
+        hwsim_clear_sta_magic(sta);
+
+        return 0;
+}
+
 static void mac80211_hwsim_sta_notify(struct ieee80211_hw *hw,
                                       struct ieee80211_vif *vif,
                                       enum sta_notify_cmd cmd,
                                       struct ieee80211_sta *sta)
 {
         hwsim_check_magic(vif);
+
         switch (cmd) {
-        case STA_NOTIFY_ADD:
-                hwsim_set_sta_magic(sta);
-                break;
-        case STA_NOTIFY_REMOVE:
-                hwsim_clear_sta_magic(sta);
-                break;
         case STA_NOTIFY_SLEEP:
         case STA_NOTIFY_AWAKE:
                 /* TODO: make good use of these flags */
                 break;
+        default:
+                WARN(1, "Invalid sta notify: %d\n", cmd);
+                break;
         }
 }
 
@@ -771,7 +897,77 @@ static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
 }
 #endif
 
-static const struct ieee80211_ops mac80211_hwsim_ops =
+static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       enum ieee80211_ampdu_mlme_action action,
+                                       struct ieee80211_sta *sta, u16 tid, u16 *ssn)
+{
+        switch (action) {
+        case IEEE80211_AMPDU_TX_START:
+                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+        case IEEE80211_AMPDU_TX_STOP:
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
+                break;
+        case IEEE80211_AMPDU_RX_START:
+        case IEEE80211_AMPDU_RX_STOP:
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        return 0;
+}
+
+static void mac80211_hwsim_flush(struct ieee80211_hw *hw, bool drop)
+{
+        /*
+         * In this special case, there's nothing we need to
+         * do because hwsim does transmission synchronously.
+         * In the future, when it does transmissions via
+         * userspace, we may need to do something.
+         */
+}
+
+struct hw_scan_done {
+        struct delayed_work w;
+        struct ieee80211_hw *hw;
+};
+
+static void hw_scan_done(struct work_struct *work)
+{
+        struct hw_scan_done *hsd =
+                container_of(work, struct hw_scan_done, w.work);
+
+        ieee80211_scan_completed(hsd->hw, false);
+        kfree(hsd);
+}
+
+static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
+                                  struct cfg80211_scan_request *req)
+{
+        struct hw_scan_done *hsd = kzalloc(sizeof(*hsd), GFP_KERNEL);
+        int i;
+
+        if (!hsd)
+                return -ENOMEM;
+
+        hsd->hw = hw;
+        INIT_DELAYED_WORK(&hsd->w, hw_scan_done);
+
+        printk(KERN_DEBUG "hwsim scan request\n");
+        for (i = 0; i < req->n_channels; i++)
+                printk(KERN_DEBUG "hwsim scan freq %d\n",
+                        req->channels[i]->center_freq);
+
+        ieee80211_queue_delayed_work(hw, &hsd->w, 2 * HZ);
+
+        return 0;
+}
+
+static struct ieee80211_ops mac80211_hwsim_ops =
 {
         .tx = mac80211_hwsim_tx,
         .start = mac80211_hwsim_start,
@@ -781,10 +977,14 @@ static const struct ieee80211_ops mac80211_hwsim_ops =
         .config = mac80211_hwsim_config,
         .configure_filter = mac80211_hwsim_configure_filter,
         .bss_info_changed = mac80211_hwsim_bss_info_changed,
+        .sta_add = mac80211_hwsim_sta_add,
+        .sta_remove = mac80211_hwsim_sta_remove,
         .sta_notify = mac80211_hwsim_sta_notify,
         .set_tim = mac80211_hwsim_set_tim,
         .conf_tx = mac80211_hwsim_conf_tx,
         CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)
+        .ampdu_action = mac80211_hwsim_ampdu_action,
+        .flush = mac80211_hwsim_flush,
 };
 
 
@@ -979,6 +1179,9 @@ static int __init init_mac80211_hwsim(void)
         if (radios < 1 || radios > 100)
                 return -EINVAL;
 
+        if (fake_hw_scan)
+                mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
+
         spin_lock_init(&hwsim_radio_lock);
         INIT_LIST_HEAD(&hwsim_radios);
 
@@ -1016,7 +1219,11 @@ static int __init init_mac80211_hwsim(void)
                 SET_IEEE80211_DEV(hw, data->dev);
                 addr[3] = i >> 8;
                 addr[4] = i;
-                SET_IEEE80211_PERM_ADDR(hw, addr);
+                memcpy(data->addresses[0].addr, addr, ETH_ALEN);
+                memcpy(data->addresses[1].addr, addr, ETH_ALEN);
+                data->addresses[1].addr[0] |= 0x40;
+                hw->wiphy->n_addresses = 2;
+                hw->wiphy->addresses = data->addresses;
 
                 hw->channel_change_time = 1;
                 hw->queues = 4;
@@ -1026,7 +1233,9 @@ static int __init init_mac80211_hwsim(void)
                         BIT(NL80211_IFTYPE_MESH_POINT);
 
                 hw->flags = IEEE80211_HW_MFP_CAPABLE |
-                            IEEE80211_HW_SIGNAL_DBM;
+                            IEEE80211_HW_SIGNAL_DBM |
+                            IEEE80211_HW_SUPPORTS_STATIC_SMPS |
+                            IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS;
 
                 /* ask mac80211 to reserve space for magic */
                 hw->vif_data_size = sizeof(struct hwsim_vif_priv);
@@ -1045,19 +1254,20 @@ static int __init init_mac80211_hwsim(void)
                                 sband->channels = data->channels_2ghz;
                                 sband->n_channels =
                                         ARRAY_SIZE(hwsim_channels_2ghz);
+                                sband->bitrates = data->rates;
+                                sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
                                 break;
                         case IEEE80211_BAND_5GHZ:
                                 sband->channels = data->channels_5ghz;
                                 sband->n_channels =
                                         ARRAY_SIZE(hwsim_channels_5ghz);
+                                sband->bitrates = data->rates + 4;
+                                sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
                                 break;
                         default:
                                 break;
                         }
 
-                        sband->bitrates = data->rates;
-                        sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
-
                         sband->ht_cap.ht_supported = true;
                         sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
                                 IEEE80211_HT_CAP_GRN_FLD |
@@ -1089,46 +1299,46 @@ static int __init init_mac80211_hwsim(void)
                         break;
                 case HWSIM_REGTEST_WORLD_ROAM:
                         if (i == 0) {
-                                hw->wiphy->custom_regulatory = true;
+                                hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
                                 wiphy_apply_custom_regulatory(hw->wiphy,
                                         &hwsim_world_regdom_custom_01);
                         }
                         break;
                 case HWSIM_REGTEST_CUSTOM_WORLD:
-                        hw->wiphy->custom_regulatory = true;
+                        hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
                         wiphy_apply_custom_regulatory(hw->wiphy,
                                 &hwsim_world_regdom_custom_01);
                         break;
                 case HWSIM_REGTEST_CUSTOM_WORLD_2:
                         if (i == 0) {
-                                hw->wiphy->custom_regulatory = true;
+                                hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
                                 wiphy_apply_custom_regulatory(hw->wiphy,
                                         &hwsim_world_regdom_custom_01);
                         } else if (i == 1) {
-                                hw->wiphy->custom_regulatory = true;
+                                hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
                                 wiphy_apply_custom_regulatory(hw->wiphy,
                                         &hwsim_world_regdom_custom_02);
                         }
                         break;
                 case HWSIM_REGTEST_STRICT_ALL:
-                        hw->wiphy->strict_regulatory = true;
+                        hw->wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
                         break;
                 case HWSIM_REGTEST_STRICT_FOLLOW:
                 case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
                         if (i == 0)
-                                hw->wiphy->strict_regulatory = true;
+                                hw->wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
                         break;
                 case HWSIM_REGTEST_ALL:
                         if (i == 0) {
-                                hw->wiphy->custom_regulatory = true;
+                                hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
                                 wiphy_apply_custom_regulatory(hw->wiphy,
                                         &hwsim_world_regdom_custom_01);
                         } else if (i == 1) {
-                                hw->wiphy->custom_regulatory = true;
+                                hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
                                 wiphy_apply_custom_regulatory(hw->wiphy,
                                         &hwsim_world_regdom_custom_02);
                         } else if (i == 4)
-                                hw->wiphy->strict_regulatory = true;
+                                hw->wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
                         break;
                 default:
                         break;
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 746532ebe5a8..12fdcb25fd38 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -2,7 +2,7 @@
  * drivers/net/wireless/mwl8k.c
  * Driver for Marvell TOPDOG 802.11 Wireless cards
  *
- * Copyright (C) 2008-2009 Marvell Semiconductor Inc.
+ * Copyright (C) 2008, 2009, 2010 Marvell Semiconductor Inc.
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2.  This program is licensed "as is" without any
@@ -12,12 +12,14 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/list.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/completion.h>
 #include <linux/etherdevice.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 #include <linux/moduleparam.h>
 #include <linux/firmware.h>
@@ -25,19 +27,7 @@
 
 #define MWL8K_DESC      "Marvell TOPDOG(R) 802.11 Wireless Network Driver"
 #define MWL8K_NAME      KBUILD_MODNAME
-#define MWL8K_VERSION   "0.10"
-
-MODULE_DESCRIPTION(MWL8K_DESC);
-MODULE_VERSION(MWL8K_VERSION);
-MODULE_AUTHOR("Lennert Buytenhek <buytenh@marvell.com>");
-MODULE_LICENSE("GPL");
-
-static DEFINE_PCI_DEVICE_TABLE(mwl8k_table) = {
-        { PCI_VDEVICE(MARVELL, 0x2a2b), .driver_data = 8687, },
-        { PCI_VDEVICE(MARVELL, 0x2a30), .driver_data = 8687, },
-        { }
-};
-MODULE_DEVICE_TABLE(pci, mwl8k_table);
+#define MWL8K_VERSION   "0.12"
 
 /* Register definitions */
 #define MWL8K_HIU_GEN_PTR                       0x00000c10
@@ -88,75 +78,94 @@ MODULE_DEVICE_TABLE(pci, mwl8k_table);
                                  MWL8K_A2H_INT_RX_READY | \
                                  MWL8K_A2H_INT_TX_DONE)
 
-/* WME stream classes */
-#define WME_AC_BE       0               /* best effort */
-#define WME_AC_BK       1               /* background */
-#define WME_AC_VI       2               /* video */
-#define WME_AC_VO       3               /* voice */
-
 #define MWL8K_RX_QUEUES         1
 #define MWL8K_TX_QUEUES         4
 
+struct rxd_ops {
+        int rxd_size;
+        void (*rxd_init)(void *rxd, dma_addr_t next_dma_addr);
+        void (*rxd_refill)(void *rxd, dma_addr_t addr, int len);
+        int (*rxd_process)(void *rxd, struct ieee80211_rx_status *status,
+                           __le16 *qos);
+};
+
+struct mwl8k_device_info {
+        char *part_name;
+        char *helper_image;
+        char *fw_image;
+        struct rxd_ops *ap_rxd_ops;
+};
+
 struct mwl8k_rx_queue {
-        int rx_desc_count;
+        int rxd_count;
 
         /* hw receives here */
-        int rx_head;
+        int head;
 
         /* refill descs here */
-        int rx_tail;
+        int tail;
 
-        struct mwl8k_rx_desc *rx_desc_area;
-        dma_addr_t rx_desc_dma;
-        struct sk_buff **rx_skb;
+        void *rxd;
+        dma_addr_t rxd_dma;
+        struct {
+                struct sk_buff *skb;
+                DECLARE_PCI_UNMAP_ADDR(dma)
+        } *buf;
 };
 
 struct mwl8k_tx_queue {
         /* hw transmits here */
-        int tx_head;
+        int head;
 
         /* sw appends here */
-        int tx_tail;
+        int tail;
 
-        struct ieee80211_tx_queue_stats tx_stats;
-        struct mwl8k_tx_desc *tx_desc_area;
-        dma_addr_t tx_desc_dma;
-        struct sk_buff **tx_skb;
-};
-
-/* Pointers to the firmware data and meta information about it.  */
-struct mwl8k_firmware {
-        /* Microcode */
-        struct firmware *ucode;
-
-        /* Boot helper code */
-        struct firmware *helper;
+        unsigned int len;
+        struct mwl8k_tx_desc *txd;
+        dma_addr_t txd_dma;
+        struct sk_buff **skb;
 };
 
 struct mwl8k_priv {
-        void __iomem *regs;
         struct ieee80211_hw *hw;
-
         struct pci_dev *pdev;
-        u8 name[16];
 
-        /* firmware files and meta data */
-        struct mwl8k_firmware fw;
-        u32 part_num;
+        struct mwl8k_device_info *device_info;
+
+        void __iomem *sram;
+        void __iomem *regs;
+
+        /* firmware */
+        struct firmware *fw_helper;
+        struct firmware *fw_ucode;
+
+        /* hardware/firmware parameters */
+        bool ap_fw;
+        struct rxd_ops *rxd_ops;
+        struct ieee80211_supported_band band_24;
+        struct ieee80211_channel channels_24[14];
+        struct ieee80211_rate rates_24[14];
+        struct ieee80211_supported_band band_50;
+        struct ieee80211_channel channels_50[4];
+        struct ieee80211_rate rates_50[9];
+        u32 ap_macids_supported;
+        u32 sta_macids_supported;
 
         /* firmware access */
         struct mutex fw_mutex;
         struct task_struct *fw_mutex_owner;
         int fw_mutex_depth;
-        struct completion *tx_wait;
         struct completion *hostcmd_wait;
 
         /* lock held over TX and TX reap */
         spinlock_t tx_lock;
 
-        struct ieee80211_vif *vif;
+        /* TX quiesce completion, protected by fw_mutex and tx_lock */
+        struct completion *tx_wait;
 
-        struct ieee80211_channel *current_channel;
+        /* List of interfaces.  */
+        u32 macids_used;
+        struct list_head vif_list;
 
         /* power management status cookie from firmware */
         u32 *cookie;
@@ -175,13 +184,9 @@ struct mwl8k_priv {
         struct mwl8k_rx_queue rxq[MWL8K_RX_QUEUES];
         struct mwl8k_tx_queue txq[MWL8K_TX_QUEUES];
 
-        /* PHY parameters */
-        struct ieee80211_supported_band band;
-        struct ieee80211_channel channels[14];
-        struct ieee80211_rate rates[12];
-
         bool radio_on;
         bool radio_short_preamble;
+        bool sniffer_enabled;
         bool wmm_enabled;
 
         /* XXX need to convert this to handle multiple interfaces */
@@ -197,44 +202,33 @@ struct mwl8k_priv {
          */
         struct work_struct finalize_join_worker;
 
-        /* Tasklet to reclaim TX descriptors and buffers after tx */
-        struct tasklet_struct tx_reclaim_task;
+        /* Tasklet to perform TX reclaim.  */
+        struct tasklet_struct poll_tx_task;
 
-        /* Work thread to serialize configuration requests */
-        struct workqueue_struct *config_wq;
+        /* Tasklet to perform RX.  */
+        struct tasklet_struct poll_rx_task;
 };
 
 /* Per interface specific private data */
 struct mwl8k_vif {
-        /* backpointer to parent config block */
-        struct mwl8k_priv *priv;
-
-        /* BSS config of AP or IBSS from mac80211*/
-        struct ieee80211_bss_conf bss_info;
-
-        /* BSSID of AP or IBSS */
-        u8      bssid[ETH_ALEN];
-        u8      mac_addr[ETH_ALEN];
-
-        /*
-         * Subset of supported legacy rates.
-         * Intersection of AP and STA supported rates.
-         */
-        struct ieee80211_rate legacy_rates[12];
-
-        /* number of supported legacy rates */
-        u8      legacy_nrates;
+        struct list_head list;
+        struct ieee80211_vif *vif;
 
-         /* Index into station database.Returned by update_sta_db call */
-        u8      peer_id;
+        /* Firmware macid for this vif.  */
+        int macid;
 
-        /* Non AMPDU sequence number assigned by driver */
-        u16     seqno;
+        /* Non AMPDU sequence number assigned by driver.  */
+        u16 seqno;
 };
-
 #define MWL8K_VIF(_vif) ((struct mwl8k_vif *)&((_vif)->drv_priv))
 
-static const struct ieee80211_channel mwl8k_channels[] = {
+struct mwl8k_sta {
+        /* Index into station database. Returned by UPDATE_STADB.  */
+        u8 peer_id;
+};
+#define MWL8K_STA(_sta) ((struct mwl8k_sta *)&((_sta)->drv_priv))
+
+static const struct ieee80211_channel mwl8k_channels_24[] = {
         { .center_freq = 2412, .hw_value = 1, },
         { .center_freq = 2417, .hw_value = 2, },
         { .center_freq = 2422, .hw_value = 3, },
@@ -246,21 +240,45 @@ static const struct ieee80211_channel mwl8k_channels[] = {
         { .center_freq = 2452, .hw_value = 9, },
         { .center_freq = 2457, .hw_value = 10, },
         { .center_freq = 2462, .hw_value = 11, },
+        { .center_freq = 2467, .hw_value = 12, },
+        { .center_freq = 2472, .hw_value = 13, },
+        { .center_freq = 2484, .hw_value = 14, },
 };
 
-static const struct ieee80211_rate mwl8k_rates[] = {
+static const struct ieee80211_rate mwl8k_rates_24[] = {
         { .bitrate = 10, .hw_value = 2, },
         { .bitrate = 20, .hw_value = 4, },
         { .bitrate = 55, .hw_value = 11, },
+        { .bitrate = 110, .hw_value = 22, },
+        { .bitrate = 220, .hw_value = 44, },
         { .bitrate = 60, .hw_value = 12, },
         { .bitrate = 90, .hw_value = 18, },
-        { .bitrate = 110, .hw_value = 22, },
         { .bitrate = 120, .hw_value = 24, },
         { .bitrate = 180, .hw_value = 36, },
         { .bitrate = 240, .hw_value = 48, },
         { .bitrate = 360, .hw_value = 72, },
         { .bitrate = 480, .hw_value = 96, },
         { .bitrate = 540, .hw_value = 108, },
+        { .bitrate = 720, .hw_value = 144, },
+};
+
+static const struct ieee80211_channel mwl8k_channels_50[] = {
+        { .center_freq = 5180, .hw_value = 36, },
+        { .center_freq = 5200, .hw_value = 40, },
+        { .center_freq = 5220, .hw_value = 44, },
+        { .center_freq = 5240, .hw_value = 48, },
+};
+
+static const struct ieee80211_rate mwl8k_rates_50[] = {
+        { .bitrate = 60, .hw_value = 12, },
+        { .bitrate = 90, .hw_value = 18, },
+        { .bitrate = 120, .hw_value = 24, },
+        { .bitrate = 180, .hw_value = 36, },
+        { .bitrate = 240, .hw_value = 48, },
+        { .bitrate = 360, .hw_value = 72, },
+        { .bitrate = 480, .hw_value = 96, },
+        { .bitrate = 540, .hw_value = 108, },
+        { .bitrate = 720, .hw_value = 144, },
 };
 
 /* Set or get info from Firmware */
@@ -270,10 +288,13 @@ static const struct ieee80211_rate mwl8k_rates[] = {
 /* Firmware command codes */
 #define MWL8K_CMD_CODE_DNLD             0x0001
 #define MWL8K_CMD_GET_HW_SPEC           0x0003
+#define MWL8K_CMD_SET_HW_SPEC           0x0004
 #define MWL8K_CMD_MAC_MULTICAST_ADR     0x0010
 #define MWL8K_CMD_GET_STAT              0x0014
 #define MWL8K_CMD_RADIO_CONTROL         0x001c
 #define MWL8K_CMD_RF_TX_POWER           0x001e
+#define MWL8K_CMD_RF_ANTENNA            0x0020
+#define MWL8K_CMD_SET_BEACON            0x0100          /* per-vif */
 #define MWL8K_CMD_SET_PRE_SCAN          0x0107
 #define MWL8K_CMD_SET_POST_SCAN         0x0108
 #define MWL8K_CMD_SET_RF_CHANNEL        0x010a
@@ -287,7 +308,10 @@ static const struct ieee80211_rate mwl8k_rates[] = {
 #define MWL8K_CMD_MIMO_CONFIG           0x0125
 #define MWL8K_CMD_USE_FIXED_RATE        0x0126
 #define MWL8K_CMD_ENABLE_SNIFFER        0x0150
+#define MWL8K_CMD_SET_MAC_ADDR          0x0202          /* per-vif */
 #define MWL8K_CMD_SET_RATEADAPT_MODE    0x0203
+#define MWL8K_CMD_BSS_START             0x1100          /* per-vif */
+#define MWL8K_CMD_SET_NEW_STN           0x1111          /* per-vif */
 #define MWL8K_CMD_UPDATE_STADB          0x1123
 
 static const char *mwl8k_cmd_name(u16 cmd, char *buf, int bufsize)
@@ -299,10 +323,13 @@ static const char *mwl8k_cmd_name(u16 cmd, char *buf, int bufsize)
         switch (cmd & ~0x8000) {
                 MWL8K_CMDNAME(CODE_DNLD);
                 MWL8K_CMDNAME(GET_HW_SPEC);
+                MWL8K_CMDNAME(SET_HW_SPEC);
                 MWL8K_CMDNAME(MAC_MULTICAST_ADR);
                 MWL8K_CMDNAME(GET_STAT);
                 MWL8K_CMDNAME(RADIO_CONTROL);
                 MWL8K_CMDNAME(RF_TX_POWER);
+                MWL8K_CMDNAME(RF_ANTENNA);
+                MWL8K_CMDNAME(SET_BEACON);
                 MWL8K_CMDNAME(SET_PRE_SCAN);
                 MWL8K_CMDNAME(SET_POST_SCAN);
                 MWL8K_CMDNAME(SET_RF_CHANNEL);
@@ -316,7 +343,10 @@ static const char *mwl8k_cmd_name(u16 cmd, char *buf, int bufsize)
                 MWL8K_CMDNAME(MIMO_CONFIG);
                 MWL8K_CMDNAME(USE_FIXED_RATE);
                 MWL8K_CMDNAME(ENABLE_SNIFFER);
+                MWL8K_CMDNAME(SET_MAC_ADDR);
                 MWL8K_CMDNAME(SET_RATEADAPT_MODE);
+                MWL8K_CMDNAME(BSS_START);
+                MWL8K_CMDNAME(SET_NEW_STN);
                 MWL8K_CMDNAME(UPDATE_STADB);
         default:
                 snprintf(buf, bufsize, "0x%x", cmd);
@@ -347,48 +377,42 @@ static void mwl8k_release_fw(struct firmware **fw)
 
 static void mwl8k_release_firmware(struct mwl8k_priv *priv)
 {
-        mwl8k_release_fw(&priv->fw.ucode);
-        mwl8k_release_fw(&priv->fw.helper);
+        mwl8k_release_fw(&priv->fw_ucode);
+        mwl8k_release_fw(&priv->fw_helper);
 }
 
 /* Request fw image */
 static int mwl8k_request_fw(struct mwl8k_priv *priv,
-                                const char *fname, struct firmware **fw)
+                            const char *fname, struct firmware **fw)
 {
         /* release current image */
         if (*fw != NULL)
                 mwl8k_release_fw(fw);
 
         return request_firmware((const struct firmware **)fw,
-                                                fname, &priv->pdev->dev);
+                                fname, &priv->pdev->dev);
 }
 
-static int mwl8k_request_firmware(struct mwl8k_priv *priv, u32 part_num)
+static int mwl8k_request_firmware(struct mwl8k_priv *priv)
 {
-        u8 filename[64];
+        struct mwl8k_device_info *di = priv->device_info;
         int rc;
 
-        priv->part_num = part_num;
-
-        snprintf(filename, sizeof(filename),
-                 "mwl8k/helper_%u.fw", priv->part_num);
-
-        rc = mwl8k_request_fw(priv, filename, &priv->fw.helper);
-        if (rc) {
-                printk(KERN_ERR
-                        "%s Error requesting helper firmware file %s\n",
-                        pci_name(priv->pdev), filename);
-                return rc;
+        if (di->helper_image != NULL) {
+                rc = mwl8k_request_fw(priv, di->helper_image, &priv->fw_helper);
+                if (rc) {
+                        printk(KERN_ERR "%s: Error requesting helper "
+                               "firmware file %s\n", pci_name(priv->pdev),
+                               di->helper_image);
+                        return rc;
+                }
         }
 
-        snprintf(filename, sizeof(filename),
-                 "mwl8k/fmimage_%u.fw", priv->part_num);
-
-        rc = mwl8k_request_fw(priv, filename, &priv->fw.ucode);
+        rc = mwl8k_request_fw(priv, di->fw_image, &priv->fw_ucode);
         if (rc) {
-                printk(KERN_ERR "%s Error requesting firmware file %s\n",
-                                        pci_name(priv->pdev), filename);
-                mwl8k_release_fw(&priv->fw.helper);
+                printk(KERN_ERR "%s: Error requesting firmware file %s\n",
+                       pci_name(priv->pdev), di->fw_image);
+                mwl8k_release_fw(&priv->fw_helper);
                 return rc;
         }
 
@@ -398,7 +422,8 @@ static int mwl8k_request_firmware(struct mwl8k_priv *priv, u32 part_num)
 struct mwl8k_cmd_pkt {
         __le16  code;
         __le16  length;
-        __le16  seq_num;
+        __u8    seq_num;
+        __u8    macid;
         __le16  result;
         char    payload[0];
 } __attribute__((packed));
@@ -434,6 +459,7 @@ mwl8k_send_fw_load_cmd(struct mwl8k_priv *priv, void *data, int length)
                         break;
                 }
 
+                cond_resched();
                 udelay(1);
         } while (--loops);
 
@@ -455,6 +481,7 @@ static int mwl8k_load_fw_image(struct mwl8k_priv *priv,
 
         cmd->code = cpu_to_le16(MWL8K_CMD_CODE_DNLD);
         cmd->seq_num = 0;
+        cmd->macid = 0;
         cmd->result = 0;
 
         done = 0;
@@ -542,43 +569,57 @@ static int mwl8k_feed_fw_image(struct mwl8k_priv *priv,
         return rc;
 }
 
-static int mwl8k_load_firmware(struct mwl8k_priv *priv)
+static int mwl8k_load_firmware(struct ieee80211_hw *hw)
 {
-        int loops, rc;
+        struct mwl8k_priv *priv = hw->priv;
+        struct firmware *fw = priv->fw_ucode;
+        int rc;
+        int loops;
 
-        const u8 *ucode = priv->fw.ucode->data;
-        size_t ucode_len = priv->fw.ucode->size;
-        const u8 *helper = priv->fw.helper->data;
-        size_t helper_len = priv->fw.helper->size;
+        if (!memcmp(fw->data, "\x01\x00\x00\x00", 4)) {
+                struct firmware *helper = priv->fw_helper;
 
-        if (!memcmp(ucode, "\x01\x00\x00\x00", 4)) {
-                rc = mwl8k_load_fw_image(priv, helper, helper_len);
+                if (helper == NULL) {
+                        printk(KERN_ERR "%s: helper image needed but none "
+                               "given\n", pci_name(priv->pdev));
+                        return -EINVAL;
+                }
+
+                rc = mwl8k_load_fw_image(priv, helper->data, helper->size);
                 if (rc) {
                         printk(KERN_ERR "%s: unable to load firmware "
-                                "helper image\n", pci_name(priv->pdev));
+                               "helper image\n", pci_name(priv->pdev));
                         return rc;
                 }
-                msleep(1);
+                msleep(5);
 
-                rc = mwl8k_feed_fw_image(priv, ucode, ucode_len);
+                rc = mwl8k_feed_fw_image(priv, fw->data, fw->size);
         } else {
-                rc = mwl8k_load_fw_image(priv, ucode, ucode_len);
+                rc = mwl8k_load_fw_image(priv, fw->data, fw->size);
         }
 
         if (rc) {
-                printk(KERN_ERR "%s: unable to load firmware data\n",
-                        pci_name(priv->pdev));
+                printk(KERN_ERR "%s: unable to load firmware image\n",
+                       pci_name(priv->pdev));
                 return rc;
         }
 
         iowrite32(MWL8K_MODE_STA, priv->regs + MWL8K_HIU_GEN_PTR);
-        msleep(1);
 
-        loops = 200000;
+        loops = 500000;
         do {
-                if (ioread32(priv->regs + MWL8K_HIU_INT_CODE)
-                                                == MWL8K_FWSTA_READY)
+                u32 ready_code;
+
+                ready_code = ioread32(priv->regs + MWL8K_HIU_INT_CODE);
+                if (ready_code == MWL8K_FWAP_READY) {
+                        priv->ap_fw = 1;
                         break;
+                } else if (ready_code == MWL8K_FWSTA_READY) {
+                        priv->ap_fw = 0;
+                        break;
+                }
+
+                cond_resched();
                 udelay(1);
         } while (--loops);
 
@@ -586,161 +627,177 @@ static int mwl8k_load_firmware(struct mwl8k_priv *priv)
 }
 
 
-/*
- * Defines shared between transmission and reception.
- */
-/* HT control fields for firmware */
-struct ewc_ht_info {
-        __le16  control1;
-        __le16  control2;
-        __le16  control3;
+/* DMA header used by firmware and hardware.  */
+struct mwl8k_dma_data {
+        __le16 fwlen;
+        struct ieee80211_hdr wh;
+        char data[0];
 } __attribute__((packed));
 
-/* Firmware Station database operations */
-#define MWL8K_STA_DB_ADD_ENTRY          0
-#define MWL8K_STA_DB_MODIFY_ENTRY       1
-#define MWL8K_STA_DB_DEL_ENTRY          2
-#define MWL8K_STA_DB_FLUSH              3
+/* Routines to add/remove DMA header from skb.  */
+static inline void mwl8k_remove_dma_header(struct sk_buff *skb, __le16 qos)
+{
+        struct mwl8k_dma_data *tr;
+        int hdrlen;
 
-/* Peer Entry flags - used to define the type of the peer node */
-#define MWL8K_PEER_TYPE_ACCESSPOINT     2
+        tr = (struct mwl8k_dma_data *)skb->data;
+        hdrlen = ieee80211_hdrlen(tr->wh.frame_control);
 
-#define MWL8K_IEEE_LEGACY_DATA_RATES    12
-#define MWL8K_MCS_BITMAP_SIZE           16
+        if (hdrlen != sizeof(tr->wh)) {
+                if (ieee80211_is_data_qos(tr->wh.frame_control)) {
+                        memmove(tr->data - hdrlen, &tr->wh, hdrlen - 2);
+                        *((__le16 *)(tr->data - 2)) = qos;
+                } else {
+                        memmove(tr->data - hdrlen, &tr->wh, hdrlen);
+                }
+        }
 
-struct peer_capability_info {
-        /* Peer type - AP vs. STA.  */
-        __u8    peer_type;
+        if (hdrlen != sizeof(*tr))
+                skb_pull(skb, sizeof(*tr) - hdrlen);
+}
 
-        /* Basic 802.11 capabilities from assoc resp.  */
-        __le16  basic_caps;
+static inline void mwl8k_add_dma_header(struct sk_buff *skb)
+{
+        struct ieee80211_hdr *wh;
+        int hdrlen;
+        struct mwl8k_dma_data *tr;
 
-        /* Set if peer supports 802.11n high throughput (HT).  */
-        __u8    ht_support;
+        /*
+         * Add a firmware DMA header; the firmware requires that we
+         * present a 2-byte payload length followed by a 4-address
+         * header (without QoS field), followed (optionally) by any
+         * WEP/ExtIV header (but only filled in for CCMP).
+         */
+        wh = (struct ieee80211_hdr *)skb->data;
 
-        /* Valid if HT is supported.  */
-        __le16  ht_caps;
-        __u8    extended_ht_caps;
-        struct ewc_ht_info      ewc_info;
+        hdrlen = ieee80211_hdrlen(wh->frame_control);
+        if (hdrlen != sizeof(*tr))
+                skb_push(skb, sizeof(*tr) - hdrlen);
 
-        /* Legacy rate table. Intersection of our rates and peer rates.  */
-        __u8    legacy_rates[MWL8K_IEEE_LEGACY_DATA_RATES];
+        if (ieee80211_is_data_qos(wh->frame_control))
+                hdrlen -= 2;
 
-        /* HT rate table. Intersection of our rates and peer rates.  */
-        __u8    ht_rates[MWL8K_MCS_BITMAP_SIZE];
-        __u8    pad[16];
+        tr = (struct mwl8k_dma_data *)skb->data;
+        if (wh != &tr->wh)
+                memmove(&tr->wh, wh, hdrlen);
+        if (hdrlen != sizeof(tr->wh))
+                memset(((void *)&tr->wh) + hdrlen, 0, sizeof(tr->wh) - hdrlen);
 
-        /* If set, interoperability mode, no proprietary extensions.  */
-        __u8    interop;
-        __u8    pad2;
-        __u8    station_id;
-        __le16  amsdu_enabled;
-} __attribute__((packed));
+        /*
+         * Firmware length is the length of the fully formed "802.11
+         * payload".  That is, everything except for the 802.11 header.
+         * This includes all crypto material including the MIC.
+         */
+        tr->fwlen = cpu_to_le16(skb->len - sizeof(*tr));
+}
 
-/* Inline functions to manipulate QoS field in data descriptor.  */
-static inline u16 mwl8k_qos_setbit_eosp(u16 qos)
-{
-        u16 val_mask = 1 << 4;
 
-        /* End of Service Period Bit 4 */
-        return qos | val_mask;
-}
+/*
+ * Packet reception for 88w8366 AP firmware.
+ */
+struct mwl8k_rxd_8366_ap {
+        __le16 pkt_len;
+        __u8 sq2;
+        __u8 rate;
+        __le32 pkt_phys_addr;
+        __le32 next_rxd_phys_addr;
+        __le16 qos_control;
+        __le16 htsig2;
+        __le32 hw_rssi_info;
+        __le32 hw_noise_floor_info;
+        __u8 noise_floor;
+        __u8 pad0[3];
+        __u8 rssi;
+        __u8 rx_status;
+        __u8 channel;
+        __u8 rx_ctrl;
+} __attribute__((packed));
 
-static inline u16 mwl8k_qos_setbit_ack(u16 qos, u8 ack_policy)
-{
-        u16 val_mask = 0x3;
-        u8      shift = 5;
-        u16 qos_mask = ~(val_mask << shift);
+#define MWL8K_8366_AP_RATE_INFO_MCS_FORMAT      0x80
+#define MWL8K_8366_AP_RATE_INFO_40MHZ           0x40
+#define MWL8K_8366_AP_RATE_INFO_RATEID(x)       ((x) & 0x3f)
 
-        /* Ack Policy Bit 5-6 */
-        return (qos & qos_mask) | ((ack_policy & val_mask) << shift);
-}
+#define MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST     0x80
 
-static inline u16 mwl8k_qos_setbit_amsdu(u16 qos)
+static void mwl8k_rxd_8366_ap_init(void *_rxd, dma_addr_t next_dma_addr)
 {
-        u16 val_mask = 1 << 7;
+        struct mwl8k_rxd_8366_ap *rxd = _rxd;
 
-        /* AMSDU present Bit 7 */
-        return qos | val_mask;
+        rxd->next_rxd_phys_addr = cpu_to_le32(next_dma_addr);
+        rxd->rx_ctrl = MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST;
 }
 
-static inline u16 mwl8k_qos_setbit_qlen(u16 qos, u8 len)
+static void mwl8k_rxd_8366_ap_refill(void *_rxd, dma_addr_t addr, int len)
 {
-        u16 val_mask = 0xff;
-        u8      shift = 8;
-        u16 qos_mask = ~(val_mask << shift);
+        struct mwl8k_rxd_8366_ap *rxd = _rxd;
 
-        /* Queue Length Bits 8-15 */
-        return (qos & qos_mask) | ((len & val_mask) << shift);
+        rxd->pkt_len = cpu_to_le16(len);
+        rxd->pkt_phys_addr = cpu_to_le32(addr);
+        wmb();
+        rxd->rx_ctrl = 0;
 }
 
-/* DMA header used by firmware and hardware.  */
-struct mwl8k_dma_data {
-        __le16 fwlen;
-        struct ieee80211_hdr wh;
-} __attribute__((packed));
-
-/* Routines to add/remove DMA header from skb.  */
-static inline void mwl8k_remove_dma_header(struct sk_buff *skb)
+static int
+mwl8k_rxd_8366_ap_process(void *_rxd, struct ieee80211_rx_status *status,
+                          __le16 *qos)
 {
-        struct mwl8k_dma_data *tr = (struct mwl8k_dma_data *)skb->data;
-        void *dst, *src = &tr->wh;
-        int hdrlen = ieee80211_hdrlen(tr->wh.frame_control);
-        u16 space = sizeof(struct mwl8k_dma_data) - hdrlen;
+        struct mwl8k_rxd_8366_ap *rxd = _rxd;
 
-        dst = (void *)tr + space;
-        if (dst != src) {
-                memmove(dst, src, hdrlen);
-                skb_pull(skb, space);
-        }
-}
+        if (!(rxd->rx_ctrl & MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST))
+                return -1;
+        rmb();
 
-static inline void mwl8k_add_dma_header(struct sk_buff *skb)
-{
-        struct ieee80211_hdr *wh;
-        u32 hdrlen, pktlen;
-        struct mwl8k_dma_data *tr;
+        memset(status, 0, sizeof(*status));
 
-        wh = (struct ieee80211_hdr *)skb->data;
-        hdrlen = ieee80211_hdrlen(wh->frame_control);
-        pktlen = skb->len;
+        status->signal = -rxd->rssi;
+        status->noise = -rxd->noise_floor;
 
-        /*
-         * Copy up/down the 802.11 header; the firmware requires
-         * we present a 2-byte payload length followed by a
-         * 4-address header (w/o QoS), followed (optionally) by
-         * any WEP/ExtIV header (but only filled in for CCMP).
-         */
-        if (hdrlen != sizeof(struct mwl8k_dma_data))
-                skb_push(skb, sizeof(struct mwl8k_dma_data) - hdrlen);
+        if (rxd->rate & MWL8K_8366_AP_RATE_INFO_MCS_FORMAT) {
+                status->flag |= RX_FLAG_HT;
+                if (rxd->rate & MWL8K_8366_AP_RATE_INFO_40MHZ)
+                        status->flag |= RX_FLAG_40MHZ;
+                status->rate_idx = MWL8K_8366_AP_RATE_INFO_RATEID(rxd->rate);
+        } else {
+                int i;
 
-        tr = (struct mwl8k_dma_data *)skb->data;
-        if (wh != &tr->wh)
-                memmove(&tr->wh, wh, hdrlen);
+                for (i = 0; i < ARRAY_SIZE(mwl8k_rates_24); i++) {
+                        if (mwl8k_rates_24[i].hw_value == rxd->rate) {
+                                status->rate_idx = i;
+                                break;
+                        }
+                }
+        }
 
-        /* Clear addr4 */
-        memset(tr->wh.addr4, 0, ETH_ALEN);
+        if (rxd->channel > 14) {
+                status->band = IEEE80211_BAND_5GHZ;
+                if (!(status->flag & RX_FLAG_HT))
+                        status->rate_idx -= 5;
+        } else {
+                status->band = IEEE80211_BAND_2GHZ;
+        }
+        status->freq = ieee80211_channel_to_frequency(rxd->channel);
 
-        /*
-         * Firmware length is the length of the fully formed "802.11
-         * payload".  That is, everything except for the 802.11 header.
-         * This includes all crypto material including the MIC.
-         */
-        tr->fwlen = cpu_to_le16(pktlen - hdrlen);
+        *qos = rxd->qos_control;
+
+        return le16_to_cpu(rxd->pkt_len);
 }
 
+static struct rxd_ops rxd_8366_ap_ops = {
+        .rxd_size       = sizeof(struct mwl8k_rxd_8366_ap),
+        .rxd_init       = mwl8k_rxd_8366_ap_init,
+        .rxd_refill     = mwl8k_rxd_8366_ap_refill,
+        .rxd_process    = mwl8k_rxd_8366_ap_process,
+};
 
 /*
- * Packet reception.
+ * Packet reception for STA firmware.
  */
-#define MWL8K_RX_CTRL_OWNED_BY_HOST     0x02
-
-struct mwl8k_rx_desc {
+struct mwl8k_rxd_sta {
         __le16 pkt_len;
         __u8 link_quality;
         __u8 noise_level;
         __le32 pkt_phys_addr;
-        __le32 next_rx_desc_phys_addr;
+        __le32 next_rxd_phys_addr;
         __le16 qos_control;
         __le16 rate_info;
         __le32 pad0[4];
@@ -752,6 +809,84 @@ struct mwl8k_rx_desc {
         __u8 pad2[2];
 } __attribute__((packed));
 
+#define MWL8K_STA_RATE_INFO_SHORTPRE            0x8000
+#define MWL8K_STA_RATE_INFO_ANTSELECT(x)        (((x) >> 11) & 0x3)
+#define MWL8K_STA_RATE_INFO_RATEID(x)           (((x) >> 3) & 0x3f)
+#define MWL8K_STA_RATE_INFO_40MHZ               0x0004
+#define MWL8K_STA_RATE_INFO_SHORTGI             0x0002
+#define MWL8K_STA_RATE_INFO_MCS_FORMAT          0x0001
+
+#define MWL8K_STA_RX_CTRL_OWNED_BY_HOST         0x02
+
+static void mwl8k_rxd_sta_init(void *_rxd, dma_addr_t next_dma_addr)
+{
+        struct mwl8k_rxd_sta *rxd = _rxd;
+
+        rxd->next_rxd_phys_addr = cpu_to_le32(next_dma_addr);
+        rxd->rx_ctrl = MWL8K_STA_RX_CTRL_OWNED_BY_HOST;
+}
+
+static void mwl8k_rxd_sta_refill(void *_rxd, dma_addr_t addr, int len)
+{
+        struct mwl8k_rxd_sta *rxd = _rxd;
+
+        rxd->pkt_len = cpu_to_le16(len);
+        rxd->pkt_phys_addr = cpu_to_le32(addr);
+        wmb();
+        rxd->rx_ctrl = 0;
+}
+
+static int
+mwl8k_rxd_sta_process(void *_rxd, struct ieee80211_rx_status *status,
+                       __le16 *qos)
+{
+        struct mwl8k_rxd_sta *rxd = _rxd;
+        u16 rate_info;
+
+        if (!(rxd->rx_ctrl & MWL8K_STA_RX_CTRL_OWNED_BY_HOST))
+                return -1;
+        rmb();
+
+        rate_info = le16_to_cpu(rxd->rate_info);
+
+        memset(status, 0, sizeof(*status));
+
+        status->signal = -rxd->rssi;
+        status->noise = -rxd->noise_level;
+        status->antenna = MWL8K_STA_RATE_INFO_ANTSELECT(rate_info);
+        status->rate_idx = MWL8K_STA_RATE_INFO_RATEID(rate_info);
+
+        if (rate_info & MWL8K_STA_RATE_INFO_SHORTPRE)
+                status->flag |= RX_FLAG_SHORTPRE;
+        if (rate_info & MWL8K_STA_RATE_INFO_40MHZ)
+                status->flag |= RX_FLAG_40MHZ;
+        if (rate_info & MWL8K_STA_RATE_INFO_SHORTGI)
+                status->flag |= RX_FLAG_SHORT_GI;
+        if (rate_info & MWL8K_STA_RATE_INFO_MCS_FORMAT)
+                status->flag |= RX_FLAG_HT;
+
+        if (rxd->channel > 14) {
+                status->band = IEEE80211_BAND_5GHZ;
+                if (!(status->flag & RX_FLAG_HT))
+                        status->rate_idx -= 5;
+        } else {
+                status->band = IEEE80211_BAND_2GHZ;
+        }
+        status->freq = ieee80211_channel_to_frequency(rxd->channel);
+
+        *qos = rxd->qos_control;
+
+        return le16_to_cpu(rxd->pkt_len);
+}
+
+static struct rxd_ops rxd_sta_ops = {
+        .rxd_size       = sizeof(struct mwl8k_rxd_sta),
+        .rxd_init       = mwl8k_rxd_sta_init,
+        .rxd_refill     = mwl8k_rxd_sta_refill,
+        .rxd_process    = mwl8k_rxd_sta_process,
+};
+
+
 #define MWL8K_RX_DESCS          256
 #define MWL8K_RX_MAXSZ          3800
 
@@ -762,43 +897,44 @@ static int mwl8k_rxq_init(struct ieee80211_hw *hw, int index)
         int size;
         int i;
 
-        rxq->rx_desc_count = 0;
-        rxq->rx_head = 0;
-        rxq->rx_tail = 0;
+        rxq->rxd_count = 0;
+        rxq->head = 0;
+        rxq->tail = 0;
 
-        size = MWL8K_RX_DESCS * sizeof(struct mwl8k_rx_desc);
+        size = MWL8K_RX_DESCS * priv->rxd_ops->rxd_size;
 
-        rxq->rx_desc_area =
-                pci_alloc_consistent(priv->pdev, size, &rxq->rx_desc_dma);
-        if (rxq->rx_desc_area == NULL) {
+        rxq->rxd = pci_alloc_consistent(priv->pdev, size, &rxq->rxd_dma);
+        if (rxq->rxd == NULL) {
                 printk(KERN_ERR "%s: failed to alloc RX descriptors\n",
-                       priv->name);
+                       wiphy_name(hw->wiphy));
                 return -ENOMEM;
         }
-        memset(rxq->rx_desc_area, 0, size);
+        memset(rxq->rxd, 0, size);
 
-        rxq->rx_skb = kmalloc(MWL8K_RX_DESCS *
-                                sizeof(*rxq->rx_skb), GFP_KERNEL);
-        if (rxq->rx_skb == NULL) {
+        rxq->buf = kmalloc(MWL8K_RX_DESCS * sizeof(*rxq->buf), GFP_KERNEL);
+        if (rxq->buf == NULL) {
                 printk(KERN_ERR "%s: failed to alloc RX skbuff list\n",
-                        priv->name);
-                pci_free_consistent(priv->pdev, size,
-                                    rxq->rx_desc_area, rxq->rx_desc_dma);
+                       wiphy_name(hw->wiphy));
+                pci_free_consistent(priv->pdev, size, rxq->rxd, rxq->rxd_dma);
                 return -ENOMEM;
         }
-        memset(rxq->rx_skb, 0, MWL8K_RX_DESCS * sizeof(*rxq->rx_skb));
+        memset(rxq->buf, 0, MWL8K_RX_DESCS * sizeof(*rxq->buf));
 
         for (i = 0; i < MWL8K_RX_DESCS; i++) {
-                struct mwl8k_rx_desc *rx_desc;
+                int desc_size;
+                void *rxd;
                 int nexti;
+                dma_addr_t next_dma_addr;
 
-                rx_desc = rxq->rx_desc_area + i;
-                nexti = (i + 1) % MWL8K_RX_DESCS;
+                desc_size = priv->rxd_ops->rxd_size;
+                rxd = rxq->rxd + (i * priv->rxd_ops->rxd_size);
 
-                rx_desc->next_rx_desc_phys_addr =
-                        cpu_to_le32(rxq->rx_desc_dma
-                                                + nexti * sizeof(*rx_desc));
-                rx_desc->rx_ctrl = MWL8K_RX_CTRL_OWNED_BY_HOST;
+                nexti = i + 1;
+                if (nexti == MWL8K_RX_DESCS)
+                        nexti = 0;
+                next_dma_addr = rxq->rxd_dma + (nexti * desc_size);
+
+                priv->rxd_ops->rxd_init(rxd, next_dma_addr);
         }
 
         return 0;
@@ -811,27 +947,28 @@ static int rxq_refill(struct ieee80211_hw *hw, int index, int limit)
         int refilled;
 
         refilled = 0;
-        while (rxq->rx_desc_count < MWL8K_RX_DESCS && limit--) {
+        while (rxq->rxd_count < MWL8K_RX_DESCS && limit--) {
                 struct sk_buff *skb;
+                dma_addr_t addr;
                 int rx;
+                void *rxd;
 
                 skb = dev_alloc_skb(MWL8K_RX_MAXSZ);
                 if (skb == NULL)
                         break;
 
-                rxq->rx_desc_count++;
-
-                rx = rxq->rx_tail;
-                rxq->rx_tail = (rx + 1) % MWL8K_RX_DESCS;
+                addr = pci_map_single(priv->pdev, skb->data,
+                                      MWL8K_RX_MAXSZ, DMA_FROM_DEVICE);
 
-                rxq->rx_desc_area[rx].pkt_phys_addr =
-                        cpu_to_le32(pci_map_single(priv->pdev, skb->data,
-                                        MWL8K_RX_MAXSZ, DMA_FROM_DEVICE));
+                rxq->rxd_count++;
+                rx = rxq->tail++;
+                if (rxq->tail == MWL8K_RX_DESCS)
+                        rxq->tail = 0;
+                rxq->buf[rx].skb = skb;
+                pci_unmap_addr_set(&rxq->buf[rx], dma, addr);
 
-                rxq->rx_desc_area[rx].pkt_len = cpu_to_le16(MWL8K_RX_MAXSZ);
-                rxq->rx_skb[rx] = skb;
-                wmb();
-                rxq->rx_desc_area[rx].rx_ctrl = 0;
+                rxd = rxq->rxd + (rx * priv->rxd_ops->rxd_size);
+                priv->rxd_ops->rxd_refill(rxd, addr, MWL8K_RX_MAXSZ);
 
                 refilled++;
         }
@@ -847,24 +984,24 @@ static void mwl8k_rxq_deinit(struct ieee80211_hw *hw, int index)
         int i;
 
         for (i = 0; i < MWL8K_RX_DESCS; i++) {
-                if (rxq->rx_skb[i] != NULL) {
-                        unsigned long addr;
-
-                        addr = le32_to_cpu(rxq->rx_desc_area[i].pkt_phys_addr);
-                        pci_unmap_single(priv->pdev, addr, MWL8K_RX_MAXSZ,
-                                         PCI_DMA_FROMDEVICE);
-                        kfree_skb(rxq->rx_skb[i]);
-                        rxq->rx_skb[i] = NULL;
+                if (rxq->buf[i].skb != NULL) {
+                        pci_unmap_single(priv->pdev,
+                                         pci_unmap_addr(&rxq->buf[i], dma),
+                                         MWL8K_RX_MAXSZ, PCI_DMA_FROMDEVICE);
+                        pci_unmap_addr_set(&rxq->buf[i], dma, 0);
+
+                        kfree_skb(rxq->buf[i].skb);
+                        rxq->buf[i].skb = NULL;
                 }
         }
 
-        kfree(rxq->rx_skb);
-        rxq->rx_skb = NULL;
+        kfree(rxq->buf);
+        rxq->buf = NULL;
 
         pci_free_consistent(priv->pdev,
-                            MWL8K_RX_DESCS * sizeof(struct mwl8k_rx_desc),
-                            rxq->rx_desc_area, rxq->rx_desc_dma);
-        rxq->rx_desc_area = NULL;
+                            MWL8K_RX_DESCS * priv->rxd_ops->rxd_size,
+                            rxq->rxd, rxq->rxd_dma);
+        rxq->rxd = NULL;
 }
 
 
@@ -880,9 +1017,11 @@ mwl8k_capture_bssid(struct mwl8k_priv *priv, struct ieee80211_hdr *wh)
                 !compare_ether_addr(wh->addr3, priv->capture_bssid);
 }
 
-static inline void mwl8k_save_beacon(struct mwl8k_priv *priv,
-                                                        struct sk_buff *skb)
+static inline void mwl8k_save_beacon(struct ieee80211_hw *hw,
+                                     struct sk_buff *skb)
 {
+        struct mwl8k_priv *priv = hw->priv;
+
         priv->capture_beacon = false;
         memset(priv->capture_bssid, 0, ETH_ALEN);
 
@@ -893,8 +1032,7 @@ static inline void mwl8k_save_beacon(struct mwl8k_priv *priv,
          */
         priv->beacon_skb = skb_copy(skb, GFP_ATOMIC);
         if (priv->beacon_skb != NULL)
-                queue_work(priv->config_wq,
-                                &priv->finalize_join_worker);
+                ieee80211_queue_work(hw, &priv->finalize_join_worker);
 }
 
 static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
@@ -904,53 +1042,47 @@ static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
         int processed;
 
         processed = 0;
-        while (rxq->rx_desc_count && limit--) {
-                struct mwl8k_rx_desc *rx_desc;
+        while (rxq->rxd_count && limit--) {
                 struct sk_buff *skb;
+                void *rxd;
+                int pkt_len;
                 struct ieee80211_rx_status status;
-                unsigned long addr;
-                struct ieee80211_hdr *wh;
+                __le16 qos;
 
-                rx_desc = rxq->rx_desc_area + rxq->rx_head;
-                if (!(rx_desc->rx_ctrl & MWL8K_RX_CTRL_OWNED_BY_HOST))
+                skb = rxq->buf[rxq->head].skb;
+                if (skb == NULL)
                         break;
-                rmb();
 
-                skb = rxq->rx_skb[rxq->rx_head];
-                if (skb == NULL)
+                rxd = rxq->rxd + (rxq->head * priv->rxd_ops->rxd_size);
+
+                pkt_len = priv->rxd_ops->rxd_process(rxd, &status, &qos);
+                if (pkt_len < 0)
                         break;
-                rxq->rx_skb[rxq->rx_head] = NULL;
 
-                rxq->rx_head = (rxq->rx_head + 1) % MWL8K_RX_DESCS;
-                rxq->rx_desc_count--;
+                rxq->buf[rxq->head].skb = NULL;
+
+                pci_unmap_single(priv->pdev,
+                                 pci_unmap_addr(&rxq->buf[rxq->head], dma),
+                                 MWL8K_RX_MAXSZ, PCI_DMA_FROMDEVICE);
+                pci_unmap_addr_set(&rxq->buf[rxq->head], dma, 0);
 
-                addr = le32_to_cpu(rx_desc->pkt_phys_addr);
-                pci_unmap_single(priv->pdev, addr,
-                                        MWL8K_RX_MAXSZ, PCI_DMA_FROMDEVICE);
+                rxq->head++;
+                if (rxq->head == MWL8K_RX_DESCS)
+                        rxq->head = 0;
 
-                skb_put(skb, le16_to_cpu(rx_desc->pkt_len));
-                mwl8k_remove_dma_header(skb);
+                rxq->rxd_count--;
 
-                wh = (struct ieee80211_hdr *)skb->data;
+                skb_put(skb, pkt_len);
+                mwl8k_remove_dma_header(skb, qos);
 
                 /*
-                 * Check for pending join operation. save a copy of
-                 * the beacon and schedule a tasklet to send finalize
-                 * join command to the firmware.
+                 * Check for a pending join operation.  Save a
+                 * copy of the beacon and schedule a tasklet to
+                 * send a FINALIZE_JOIN command to the firmware.
                  */
-                if (mwl8k_capture_bssid(priv, wh))
-                        mwl8k_save_beacon(priv, skb);
-
-                memset(&status, 0, sizeof(status));
-                status.mactime = 0;
-                status.signal = -rx_desc->rssi;
-                status.noise = -rx_desc->noise_level;
-                status.qual = rx_desc->link_quality;
-                status.antenna = 1;
-                status.rate_idx = 1;
-                status.flag = 0;
-                status.band = IEEE80211_BAND_2GHZ;
-                status.freq = ieee80211_channel_to_frequency(rx_desc->channel);
+                if (mwl8k_capture_bssid(priv, (void *)skb->data))
+                        mwl8k_save_beacon(hw, skb);
+
                 memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
                 ieee80211_rx_irqsafe(hw, skb);
 
@@ -965,30 +1097,18 @@ static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
  * Packet transmission.
  */
 
-/* Transmit queue assignment.  */
-enum {
-        MWL8K_WME_AC_BK = 0,            /* background access */
-        MWL8K_WME_AC_BE = 1,            /* best effort access */
-        MWL8K_WME_AC_VI = 2,            /* video access */
-        MWL8K_WME_AC_VO = 3,            /* voice access */
-};
-
-/* Transmit packet ACK policy */
-#define MWL8K_TXD_ACK_POLICY_NORMAL             0
-#define MWL8K_TXD_ACK_POLICY_BLOCKACK           3
-
-#define GET_TXQ(_ac) (\
-                ((_ac) == WME_AC_VO) ? MWL8K_WME_AC_VO : \
-                ((_ac) == WME_AC_VI) ? MWL8K_WME_AC_VI : \
-                ((_ac) == WME_AC_BK) ? MWL8K_WME_AC_BK : \
-                MWL8K_WME_AC_BE)
-
 #define MWL8K_TXD_STATUS_OK                     0x00000001
 #define MWL8K_TXD_STATUS_OK_RETRY               0x00000002
 #define MWL8K_TXD_STATUS_OK_MORE_RETRY          0x00000004
 #define MWL8K_TXD_STATUS_MULTICAST_TX           0x00000008
 #define MWL8K_TXD_STATUS_FW_OWNED               0x80000000
 
+#define MWL8K_QOS_QLEN_UNSPEC                   0xff00
+#define MWL8K_QOS_ACK_POLICY_MASK               0x0060
+#define MWL8K_QOS_ACK_POLICY_NORMAL             0x0000
+#define MWL8K_QOS_ACK_POLICY_BLOCKACK           0x0060
+#define MWL8K_QOS_EOSP                          0x0010
+
 struct mwl8k_tx_desc {
         __le32 status;
         __u8 data_rate;
@@ -997,7 +1117,7 @@ struct mwl8k_tx_desc {
         __le32 pkt_phys_addr;
         __le16 pkt_len;
         __u8 dest_MAC_addr[ETH_ALEN];
-        __le32 next_tx_desc_phys_addr;
+        __le32 next_txd_phys_addr;
         __le32 reserved;
         __le16 rate_info;
         __u8 peer_id;
@@ -1013,44 +1133,39 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index)
         int size;
         int i;
 
-        memset(&txq->tx_stats, 0, sizeof(struct ieee80211_tx_queue_stats));
-        txq->tx_stats.limit = MWL8K_TX_DESCS;
-        txq->tx_head = 0;
-        txq->tx_tail = 0;
+        txq->len = 0;
+        txq->head = 0;
+        txq->tail = 0;
 
         size = MWL8K_TX_DESCS * sizeof(struct mwl8k_tx_desc);
 
-        txq->tx_desc_area =
-                pci_alloc_consistent(priv->pdev, size, &txq->tx_desc_dma);
-        if (txq->tx_desc_area == NULL) {
+        txq->txd = pci_alloc_consistent(priv->pdev, size, &txq->txd_dma);
+        if (txq->txd == NULL) {
                 printk(KERN_ERR "%s: failed to alloc TX descriptors\n",
-                       priv->name);
+                       wiphy_name(hw->wiphy));
                 return -ENOMEM;
         }
-        memset(txq->tx_desc_area, 0, size);
+        memset(txq->txd, 0, size);
 
-        txq->tx_skb = kmalloc(MWL8K_TX_DESCS * sizeof(*txq->tx_skb),
-                                                                GFP_KERNEL);
-        if (txq->tx_skb == NULL) {
+        txq->skb = kmalloc(MWL8K_TX_DESCS * sizeof(*txq->skb), GFP_KERNEL);
+        if (txq->skb == NULL) {
                 printk(KERN_ERR "%s: failed to alloc TX skbuff list\n",
-                       priv->name);
-                pci_free_consistent(priv->pdev, size,
-                                    txq->tx_desc_area, txq->tx_desc_dma);
+                       wiphy_name(hw->wiphy));
+                pci_free_consistent(priv->pdev, size, txq->txd, txq->txd_dma);
                 return -ENOMEM;
         }
-        memset(txq->tx_skb, 0, MWL8K_TX_DESCS * sizeof(*txq->tx_skb));
+        memset(txq->skb, 0, MWL8K_TX_DESCS * sizeof(*txq->skb));
 
         for (i = 0; i < MWL8K_TX_DESCS; i++) {
                 struct mwl8k_tx_desc *tx_desc;
                 int nexti;
 
-                tx_desc = txq->tx_desc_area + i;
+                tx_desc = txq->txd + i;
                 nexti = (i + 1) % MWL8K_TX_DESCS;
 
                 tx_desc->status = 0;
-                tx_desc->next_tx_desc_phys_addr =
-                        cpu_to_le32(txq->tx_desc_dma +
-                                                nexti * sizeof(*tx_desc));
+                tx_desc->next_txd_phys_addr =
+                        cpu_to_le32(txq->txd_dma + nexti * sizeof(*tx_desc));
         }
 
         return 0;
@@ -1065,109 +1180,106 @@ static inline void mwl8k_tx_start(struct mwl8k_priv *priv)
         ioread32(priv->regs + MWL8K_HIU_INT_CODE);
 }
 
-static inline int mwl8k_txq_busy(struct mwl8k_priv *priv)
+static void mwl8k_dump_tx_rings(struct ieee80211_hw *hw)
 {
-        return priv->pending_tx_pkts;
-}
-
-struct mwl8k_txq_info {
-        u32 fw_owned;
-        u32 drv_owned;
-        u32 unused;
-        u32 len;
-        u32 head;
-        u32 tail;
-};
-
-static int mwl8k_scan_tx_ring(struct mwl8k_priv *priv,
-                                struct mwl8k_txq_info *txinfo)
-{
-        int count, desc, status;
-        struct mwl8k_tx_queue *txq;
-        struct mwl8k_tx_desc *tx_desc;
-        int ndescs = 0;
+        struct mwl8k_priv *priv = hw->priv;
+        int i;
 
-        memset(txinfo, 0, MWL8K_TX_QUEUES * sizeof(struct mwl8k_txq_info));
+        for (i = 0; i < MWL8K_TX_QUEUES; i++) {
+                struct mwl8k_tx_queue *txq = priv->txq + i;
+                int fw_owned = 0;
+                int drv_owned = 0;
+                int unused = 0;
+                int desc;
 
-        spin_lock_bh(&priv->tx_lock);
-        for (count = 0; count < MWL8K_TX_QUEUES; count++) {
-                txq = priv->txq + count;
-                txinfo[count].len = txq->tx_stats.len;
-                txinfo[count].head = txq->tx_head;
-                txinfo[count].tail = txq->tx_tail;
                 for (desc = 0; desc < MWL8K_TX_DESCS; desc++) {
-                        tx_desc = txq->tx_desc_area + desc;
-                        status = le32_to_cpu(tx_desc->status);
+                        struct mwl8k_tx_desc *tx_desc = txq->txd + desc;
+                        u32 status;
 
+                        status = le32_to_cpu(tx_desc->status);
                         if (status & MWL8K_TXD_STATUS_FW_OWNED)
-                                txinfo[count].fw_owned++;
+                                fw_owned++;
                         else
-                                txinfo[count].drv_owned++;
+                                drv_owned++;
 
                         if (tx_desc->pkt_len == 0)
-                                txinfo[count].unused++;
+                                unused++;
                 }
-        }
-        spin_unlock_bh(&priv->tx_lock);
 
-        return ndescs;
+                printk(KERN_ERR "%s: txq[%d] len=%d head=%d tail=%d "
+                       "fw_owned=%d drv_owned=%d unused=%d\n",
+                       wiphy_name(hw->wiphy), i,
+                       txq->len, txq->head, txq->tail,
+                       fw_owned, drv_owned, unused);
+        }
 }
 
 /*
- * Must be called with hw->fw_mutex held and tx queues stopped.
+ * Must be called with priv->fw_mutex held and tx queues stopped.
  */
+#define MWL8K_TX_WAIT_TIMEOUT_MS        5000
+
 static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
 {
         struct mwl8k_priv *priv = hw->priv;
-        DECLARE_COMPLETION_ONSTACK(cmd_wait);
-        u32 count;
-        unsigned long timeout;
+        DECLARE_COMPLETION_ONSTACK(tx_wait);
+        int retry;
+        int rc;
 
         might_sleep();
 
-        spin_lock_bh(&priv->tx_lock);
-        count = mwl8k_txq_busy(priv);
-        if (count) {
-                priv->tx_wait = &cmd_wait;
-                if (priv->radio_on)
-                        mwl8k_tx_start(priv);
-        }
-        spin_unlock_bh(&priv->tx_lock);
+        /*
+         * The TX queues are stopped at this point, so this test
+         * doesn't need to take ->tx_lock.
+         */
+        if (!priv->pending_tx_pkts)
+                return 0;
 
-        if (count) {
-                struct mwl8k_txq_info txinfo[MWL8K_TX_QUEUES];
-                int index;
-                int newcount;
+        retry = 0;
+        rc = 0;
 
-                timeout = wait_for_completion_timeout(&cmd_wait,
-                                        msecs_to_jiffies(5000));
-                if (timeout)
-                        return 0;
+        spin_lock_bh(&priv->tx_lock);
+        priv->tx_wait = &tx_wait;
+        while (!rc) {
+                int oldcount;
+                unsigned long timeout;
+
+                oldcount = priv->pending_tx_pkts;
 
-                spin_lock_bh(&priv->tx_lock);
-                priv->tx_wait = NULL;
-                newcount = mwl8k_txq_busy(priv);
                 spin_unlock_bh(&priv->tx_lock);
+                timeout = wait_for_completion_timeout(&tx_wait,
+                            msecs_to_jiffies(MWL8K_TX_WAIT_TIMEOUT_MS));
+                spin_lock_bh(&priv->tx_lock);
+
+                if (timeout) {
+                        WARN_ON(priv->pending_tx_pkts);
+                        if (retry) {
+                                printk(KERN_NOTICE "%s: tx rings drained\n",
+                                       wiphy_name(hw->wiphy));
+                        }
+                        break;
+                }
+
+                if (priv->pending_tx_pkts < oldcount) {
+                        printk(KERN_NOTICE "%s: waiting for tx rings "
+                               "to drain (%d -> %d pkts)\n",
+                               wiphy_name(hw->wiphy), oldcount,
+                               priv->pending_tx_pkts);
+                        retry = 1;
+                        continue;
+                }
 
-                printk(KERN_ERR "%s(%u) TIMEDOUT:5000ms Pend:%u-->%u\n",
-                       __func__, __LINE__, count, newcount);
+                priv->tx_wait = NULL;
 
-                mwl8k_scan_tx_ring(priv, txinfo);
-                for (index = 0; index < MWL8K_TX_QUEUES; index++)
-                        printk(KERN_ERR
-                                "TXQ:%u L:%u H:%u T:%u FW:%u DRV:%u U:%u\n",
-                                        index,
-                                        txinfo[index].len,
-                                        txinfo[index].head,
-                                        txinfo[index].tail,
-                                        txinfo[index].fw_owned,
-                                        txinfo[index].drv_owned,
-                                        txinfo[index].unused);
+                printk(KERN_ERR "%s: tx rings stuck for %d ms\n",
+                       wiphy_name(hw->wiphy), MWL8K_TX_WAIT_TIMEOUT_MS);
+                mwl8k_dump_tx_rings(hw);
 
-                return -ETIMEDOUT;
+                rc = -ETIMEDOUT;
         }
+        spin_unlock_bh(&priv->tx_lock);
 
-        return 0;
+        return rc;
 }
 
 #define MWL8K_TXD_SUCCESS(status)                               \
@@ -1175,13 +1287,15 @@ static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
                      MWL8K_TXD_STATUS_OK_RETRY |                \
                      MWL8K_TXD_STATUS_OK_MORE_RETRY))
 
-static void mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int force)
+static int
+mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
 {
         struct mwl8k_priv *priv = hw->priv;
         struct mwl8k_tx_queue *txq = priv->txq + index;
-        int wake = 0;
+        int processed;
 
-        while (txq->tx_stats.len > 0) {
+        processed = 0;
+        while (txq->len > 0 && limit--) {
                 int tx;
                 struct mwl8k_tx_desc *tx_desc;
                 unsigned long addr;
@@ -1190,8 +1304,8 @@ static void mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int force)
                 struct ieee80211_tx_info *info;
                 u32 status;
 
-                tx = txq->tx_head;
-                tx_desc = txq->tx_desc_area + tx;
+                tx = txq->head;
+                tx_desc = txq->txd + tx;
 
                 status = le32_to_cpu(tx_desc->status);
 
@@ -1202,20 +1316,20 @@ static void mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int force)
                                 ~cpu_to_le32(MWL8K_TXD_STATUS_FW_OWNED);
                 }
 
-                txq->tx_head = (tx + 1) % MWL8K_TX_DESCS;
-                BUG_ON(txq->tx_stats.len == 0);
-                txq->tx_stats.len--;
+                txq->head = (tx + 1) % MWL8K_TX_DESCS;
+                BUG_ON(txq->len == 0);
+                txq->len--;
                 priv->pending_tx_pkts--;
 
                 addr = le32_to_cpu(tx_desc->pkt_phys_addr);
                 size = le16_to_cpu(tx_desc->pkt_len);
-                skb = txq->tx_skb[tx];
-                txq->tx_skb[tx] = NULL;
+                skb = txq->skb[tx];
+                txq->skb[tx] = NULL;
 
                 BUG_ON(skb == NULL);
                 pci_unmap_single(priv->pdev, addr, size, PCI_DMA_TODEVICE);
 
-                mwl8k_remove_dma_header(skb);
+                mwl8k_remove_dma_header(skb, tx_desc->qos_control);
 
                 /* Mark descriptor as unused */
                 tx_desc->pkt_phys_addr = 0;
@@ -1228,11 +1342,13 @@ static void mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int force)
 
                 ieee80211_tx_status_irqsafe(hw, skb);
 
-                wake = 1;
+                processed++;
         }
 
-        if (wake && priv->radio_on && !mutex_is_locked(&priv->fw_mutex))
+        if (processed && priv->radio_on && !mutex_is_locked(&priv->fw_mutex))
                 ieee80211_wake_queue(hw, index);
+
+        return processed;
 }
 
 /* must be called only when the card's transmit is completely halted */
@@ -1241,15 +1357,15 @@ static void mwl8k_txq_deinit(struct ieee80211_hw *hw, int index)
         struct mwl8k_priv *priv = hw->priv;
         struct mwl8k_tx_queue *txq = priv->txq + index;
 
-        mwl8k_txq_reclaim(hw, index, 1);
+        mwl8k_txq_reclaim(hw, index, INT_MAX, 1);
 
-        kfree(txq->tx_skb);
-        txq->tx_skb = NULL;
+        kfree(txq->skb);
+        txq->skb = NULL;
 
         pci_free_consistent(priv->pdev,
                             MWL8K_TX_DESCS * sizeof(struct mwl8k_tx_desc),
-                            txq->tx_desc_area, txq->tx_desc_dma);
-        txq->tx_desc_area = NULL;
+                            txq->txd, txq->txd_dma);
+        txq->txd = NULL;
 }
 
 static int
@@ -1279,11 +1395,9 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
         mwl8k_vif = MWL8K_VIF(tx_info->control.vif);
 
         if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
-                u16 seqno = mwl8k_vif->seqno;
-
                 wh->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
-                wh->seq_ctrl |= cpu_to_le16(seqno << 4);
-                mwl8k_vif->seqno = seqno++ % 4096;
+                wh->seq_ctrl |= cpu_to_le16(mwl8k_vif->seqno);
+                mwl8k_vif->seqno += 0x10;
         }
 
         /* Setup firmware control bit fields for each frame type.  */
@@ -1292,24 +1406,17 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
         if (ieee80211_is_mgmt(wh->frame_control) ||
             ieee80211_is_ctl(wh->frame_control)) {
                 txdatarate = 0;
-                qos = mwl8k_qos_setbit_eosp(qos);
-                /* Set Queue size to unspecified */
-                qos = mwl8k_qos_setbit_qlen(qos, 0xff);
+                qos |= MWL8K_QOS_QLEN_UNSPEC | MWL8K_QOS_EOSP;
         } else if (ieee80211_is_data(wh->frame_control)) {
                 txdatarate = 1;
                 if (is_multicast_ether_addr(wh->addr1))
                         txstatus |= MWL8K_TXD_STATUS_MULTICAST_TX;
 
-                /* Send pkt in an aggregate if AMPDU frame.  */
+                qos &= ~MWL8K_QOS_ACK_POLICY_MASK;
                 if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
-                        qos = mwl8k_qos_setbit_ack(qos,
-                                MWL8K_TXD_ACK_POLICY_BLOCKACK);
+                        qos |= MWL8K_QOS_ACK_POLICY_BLOCKACK;
                 else
-                        qos = mwl8k_qos_setbit_ack(qos,
-                                MWL8K_TXD_ACK_POLICY_NORMAL);
-
-                if (qos & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
-                        qos = mwl8k_qos_setbit_amsdu(qos);
+                        qos |= MWL8K_QOS_ACK_POLICY_NORMAL;
         }
 
         dma = pci_map_single(priv->pdev, skb->data,
@@ -1317,7 +1424,7 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
 
         if (pci_dma_mapping_error(priv->pdev, dma)) {
                 printk(KERN_DEBUG "%s: failed to dma map skb, "
-                        "dropping TX frame.\n", priv->name);
+                       "dropping TX frame.\n", wiphy_name(hw->wiphy));
                 dev_kfree_skb(skb);
                 return NETDEV_TX_OK;
         }
@@ -1326,29 +1433,31 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
 
         txq = priv->txq + index;
 
-        BUG_ON(txq->tx_skb[txq->tx_tail] != NULL);
-        txq->tx_skb[txq->tx_tail] = skb;
+        BUG_ON(txq->skb[txq->tail] != NULL);
+        txq->skb[txq->tail] = skb;
 
-        tx = txq->tx_desc_area + txq->tx_tail;
+        tx = txq->txd + txq->tail;
         tx->data_rate = txdatarate;
         tx->tx_priority = index;
         tx->qos_control = cpu_to_le16(qos);
         tx->pkt_phys_addr = cpu_to_le32(dma);
         tx->pkt_len = cpu_to_le16(skb->len);
         tx->rate_info = 0;
-        tx->peer_id = mwl8k_vif->peer_id;
+        if (!priv->ap_fw && tx_info->control.sta != NULL)
+                tx->peer_id = MWL8K_STA(tx_info->control.sta)->peer_id;
+        else
+                tx->peer_id = 0;
         wmb();
         tx->status = cpu_to_le32(MWL8K_TXD_STATUS_FW_OWNED | txstatus);
 
-        txq->tx_stats.count++;
-        txq->tx_stats.len++;
+        txq->len++;
         priv->pending_tx_pkts++;
 
-        txq->tx_tail++;
-        if (txq->tx_tail == MWL8K_TX_DESCS)
-                txq->tx_tail = 0;
+        txq->tail++;
+        if (txq->tail == MWL8K_TX_DESCS)
+                txq->tail = 0;
 
-        if (txq->tx_head == txq->tx_tail)
+        if (txq->head == txq->tail)
                 ieee80211_stop_queue(hw, index);
 
         mwl8k_tx_start(priv);
@@ -1417,8 +1526,8 @@ static void mwl8k_fw_unlock(struct ieee80211_hw *hw)
  * Command processing.
  */
 
-/* Timeout firmware commands after 2000ms */
-#define MWL8K_CMD_TIMEOUT_MS    2000
+/* Timeout firmware commands after 10s */
+#define MWL8K_CMD_TIMEOUT_MS    10000
 
 static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
 {
@@ -1431,7 +1540,7 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
         unsigned long timeout = 0;
         u8 buf[32];
 
-        cmd->result = 0xFFFF;
+        cmd->result = 0xffff;
         dma_size = le16_to_cpu(cmd->length);
         dma_addr = pci_map_single(priv->pdev, cmd, dma_size,
                                   PCI_DMA_BIDIRECTIONAL);
@@ -1464,26 +1573,85 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
 
         if (!timeout) {
                 printk(KERN_ERR "%s: Command %s timeout after %u ms\n",
-                       priv->name,
+                       wiphy_name(hw->wiphy),
                        mwl8k_cmd_name(cmd->code, buf, sizeof(buf)),
                        MWL8K_CMD_TIMEOUT_MS);
                 rc = -ETIMEDOUT;
         } else {
+                int ms;
+
+                ms = MWL8K_CMD_TIMEOUT_MS - jiffies_to_msecs(timeout);
+
                 rc = cmd->result ? -EINVAL : 0;
                 if (rc)
                         printk(KERN_ERR "%s: Command %s error 0x%x\n",
-                               priv->name,
+                               wiphy_name(hw->wiphy),
                                mwl8k_cmd_name(cmd->code, buf, sizeof(buf)),
                                le16_to_cpu(cmd->result));
+                else if (ms > 2000)
+                        printk(KERN_NOTICE "%s: Command %s took %d ms\n",
+                               wiphy_name(hw->wiphy),
+                               mwl8k_cmd_name(cmd->code, buf, sizeof(buf)),
+                               ms);
         }
 
         return rc;
 }
 
+static int mwl8k_post_pervif_cmd(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 struct mwl8k_cmd_pkt *cmd)
+{
+        if (vif != NULL)
+                cmd->macid = MWL8K_VIF(vif)->macid;
+        return mwl8k_post_cmd(hw, cmd);
+}
+
 /*
- * GET_HW_SPEC.
+ * Setup code shared between STA and AP firmware images.
  */
-struct mwl8k_cmd_get_hw_spec {
+static void mwl8k_setup_2ghz_band(struct ieee80211_hw *hw)
+{
+        struct mwl8k_priv *priv = hw->priv;
+
+        BUILD_BUG_ON(sizeof(priv->channels_24) != sizeof(mwl8k_channels_24));
+        memcpy(priv->channels_24, mwl8k_channels_24, sizeof(mwl8k_channels_24));
+
+        BUILD_BUG_ON(sizeof(priv->rates_24) != sizeof(mwl8k_rates_24));
+        memcpy(priv->rates_24, mwl8k_rates_24, sizeof(mwl8k_rates_24));
+
+        priv->band_24.band = IEEE80211_BAND_2GHZ;
+        priv->band_24.channels = priv->channels_24;
+        priv->band_24.n_channels = ARRAY_SIZE(mwl8k_channels_24);
+        priv->band_24.bitrates = priv->rates_24;
+        priv->band_24.n_bitrates = ARRAY_SIZE(mwl8k_rates_24);
+
+        hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band_24;
+}
+
+static void mwl8k_setup_5ghz_band(struct ieee80211_hw *hw)
+{
+        struct mwl8k_priv *priv = hw->priv;
+
+        BUILD_BUG_ON(sizeof(priv->channels_50) != sizeof(mwl8k_channels_50));
+        memcpy(priv->channels_50, mwl8k_channels_50, sizeof(mwl8k_channels_50));
+
+        BUILD_BUG_ON(sizeof(priv->rates_50) != sizeof(mwl8k_rates_50));
+        memcpy(priv->rates_50, mwl8k_rates_50, sizeof(mwl8k_rates_50));
+
+        priv->band_50.band = IEEE80211_BAND_5GHZ;
+        priv->band_50.channels = priv->channels_50;
+        priv->band_50.n_channels = ARRAY_SIZE(mwl8k_channels_50);
+        priv->band_50.bitrates = priv->rates_50;
+        priv->band_50.n_bitrates = ARRAY_SIZE(mwl8k_rates_50);
+
+        hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &priv->band_50;
+}
+
+/*
+ * CMD_GET_HW_SPEC (STA version).
+ */
+struct mwl8k_cmd_get_hw_spec_sta {
         struct mwl8k_cmd_pkt header;
         __u8 hw_rev;
         __u8 host_interface;
@@ -1499,13 +1667,96 @@ struct mwl8k_cmd_get_hw_spec {
         __le32 tx_queue_ptrs[MWL8K_TX_QUEUES];
         __le32 caps2;
         __le32 num_tx_desc_per_queue;
-        __le32 total_rx_desc;
+        __le32 total_rxd;
 } __attribute__((packed));
 
-static int mwl8k_cmd_get_hw_spec(struct ieee80211_hw *hw)
+#define MWL8K_CAP_MAX_AMSDU             0x20000000
+#define MWL8K_CAP_GREENFIELD            0x08000000
+#define MWL8K_CAP_AMPDU                 0x04000000
+#define MWL8K_CAP_RX_STBC               0x01000000
+#define MWL8K_CAP_TX_STBC               0x00800000
+#define MWL8K_CAP_SHORTGI_40MHZ         0x00400000
+#define MWL8K_CAP_SHORTGI_20MHZ         0x00200000
+#define MWL8K_CAP_RX_ANTENNA_MASK       0x000e0000
+#define MWL8K_CAP_TX_ANTENNA_MASK       0x0001c000
+#define MWL8K_CAP_DELAY_BA              0x00003000
+#define MWL8K_CAP_MIMO                  0x00000200
+#define MWL8K_CAP_40MHZ                 0x00000100
+#define MWL8K_CAP_BAND_MASK             0x00000007
+#define MWL8K_CAP_5GHZ                  0x00000004
+#define MWL8K_CAP_2GHZ4                 0x00000001
+
+static void
+mwl8k_set_ht_caps(struct ieee80211_hw *hw,
+                  struct ieee80211_supported_band *band, u32 cap)
+{
+        int rx_streams;
+        int tx_streams;
+
+        band->ht_cap.ht_supported = 1;
+
+        if (cap & MWL8K_CAP_MAX_AMSDU)
+                band->ht_cap.cap |= IEEE80211_HT_CAP_MAX_AMSDU;
+        if (cap & MWL8K_CAP_GREENFIELD)
+                band->ht_cap.cap |= IEEE80211_HT_CAP_GRN_FLD;
+        if (cap & MWL8K_CAP_AMPDU) {
+                hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+                band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+                band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_NONE;
+        }
+        if (cap & MWL8K_CAP_RX_STBC)
+                band->ht_cap.cap |= IEEE80211_HT_CAP_RX_STBC;
+        if (cap & MWL8K_CAP_TX_STBC)
+                band->ht_cap.cap |= IEEE80211_HT_CAP_TX_STBC;
+        if (cap & MWL8K_CAP_SHORTGI_40MHZ)
+                band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+        if (cap & MWL8K_CAP_SHORTGI_20MHZ)
+                band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
+        if (cap & MWL8K_CAP_DELAY_BA)
+                band->ht_cap.cap |= IEEE80211_HT_CAP_DELAY_BA;
+        if (cap & MWL8K_CAP_40MHZ)
+                band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+
+        rx_streams = hweight32(cap & MWL8K_CAP_RX_ANTENNA_MASK);
+        tx_streams = hweight32(cap & MWL8K_CAP_TX_ANTENNA_MASK);
+
+        band->ht_cap.mcs.rx_mask[0] = 0xff;
+        if (rx_streams >= 2)
+                band->ht_cap.mcs.rx_mask[1] = 0xff;
+        if (rx_streams >= 3)
+                band->ht_cap.mcs.rx_mask[2] = 0xff;
+        band->ht_cap.mcs.rx_mask[4] = 0x01;
+        band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+
+        if (rx_streams != tx_streams) {
+                band->ht_cap.mcs.tx_params |= IEEE80211_HT_MCS_TX_RX_DIFF;
+                band->ht_cap.mcs.tx_params |= (tx_streams - 1) <<
+                                IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
+        }
+}
+
+static void
+mwl8k_set_caps(struct ieee80211_hw *hw, u32 caps)
 {
         struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_cmd_get_hw_spec *cmd;
+
+        if ((caps & MWL8K_CAP_2GHZ4) || !(caps & MWL8K_CAP_BAND_MASK)) {
+                mwl8k_setup_2ghz_band(hw);
+                if (caps & MWL8K_CAP_MIMO)
+                        mwl8k_set_ht_caps(hw, &priv->band_24, caps);
+        }
+
+        if (caps & MWL8K_CAP_5GHZ) {
+                mwl8k_setup_5ghz_band(hw);
+                if (caps & MWL8K_CAP_MIMO)
+                        mwl8k_set_ht_caps(hw, &priv->band_50, caps);
+        }
+}
+
+static int mwl8k_cmd_get_hw_spec_sta(struct ieee80211_hw *hw)
+{
+        struct mwl8k_priv *priv = hw->priv;
+        struct mwl8k_cmd_get_hw_spec_sta *cmd;
         int rc;
         int i;
 
@@ -1518,20 +1769,97 @@ static int mwl8k_cmd_get_hw_spec(struct ieee80211_hw *hw)
 
         memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
         cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
-        cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rx_desc_dma);
+        cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rxd_dma);
         cmd->num_tx_queues = cpu_to_le32(MWL8K_TX_QUEUES);
         for (i = 0; i < MWL8K_TX_QUEUES; i++)
-                cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[i].tx_desc_dma);
+                cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[i].txd_dma);
         cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
-        cmd->total_rx_desc = cpu_to_le32(MWL8K_RX_DESCS);
+        cmd->total_rxd = cpu_to_le32(MWL8K_RX_DESCS);
+
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+
+        if (!rc) {
+                SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
+                priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
+                priv->fw_rev = le32_to_cpu(cmd->fw_rev);
+                priv->hw_rev = cmd->hw_rev;
+                mwl8k_set_caps(hw, le32_to_cpu(cmd->caps));
+                priv->ap_macids_supported = 0x00000000;
+                priv->sta_macids_supported = 0x00000001;
+        }
+
+        kfree(cmd);
+        return rc;
+}
+
+/*
+ * CMD_GET_HW_SPEC (AP version).
+ */
+struct mwl8k_cmd_get_hw_spec_ap {
+        struct mwl8k_cmd_pkt header;
+        __u8 hw_rev;
+        __u8 host_interface;
+        __le16 num_wcb;
+        __le16 num_mcaddrs;
+        __u8 perm_addr[ETH_ALEN];
+        __le16 region_code;
+        __le16 num_antenna;
+        __le32 fw_rev;
+        __le32 wcbbase0;
+        __le32 rxwrptr;
+        __le32 rxrdptr;
+        __le32 ps_cookie;
+        __le32 wcbbase1;
+        __le32 wcbbase2;
+        __le32 wcbbase3;
+} __attribute__((packed));
+
+static int mwl8k_cmd_get_hw_spec_ap(struct ieee80211_hw *hw)
+{
+        struct mwl8k_priv *priv = hw->priv;
+        struct mwl8k_cmd_get_hw_spec_ap *cmd;
+        int rc;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_HW_SPEC);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+
+        memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
+        cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
 
         if (!rc) {
+                int off;
+
                 SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
                 priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
                 priv->fw_rev = le32_to_cpu(cmd->fw_rev);
                 priv->hw_rev = cmd->hw_rev;
+                mwl8k_setup_2ghz_band(hw);
+                priv->ap_macids_supported = 0x000000ff;
+                priv->sta_macids_supported = 0x00000000;
+
+                off = le32_to_cpu(cmd->wcbbase0) & 0xffff;
+                iowrite32(cpu_to_le32(priv->txq[0].txd_dma), priv->sram + off);
+
+                off = le32_to_cpu(cmd->rxwrptr) & 0xffff;
+                iowrite32(cpu_to_le32(priv->rxq[0].rxd_dma), priv->sram + off);
+
+                off = le32_to_cpu(cmd->rxrdptr) & 0xffff;
+                iowrite32(cpu_to_le32(priv->rxq[0].rxd_dma), priv->sram + off);
+
+                off = le32_to_cpu(cmd->wcbbase1) & 0xffff;
+                iowrite32(cpu_to_le32(priv->txq[1].txd_dma), priv->sram + off);
+
+                off = le32_to_cpu(cmd->wcbbase2) & 0xffff;
+                iowrite32(cpu_to_le32(priv->txq[2].txd_dma), priv->sram + off);
+
+                off = le32_to_cpu(cmd->wcbbase3) & 0xffff;
+                iowrite32(cpu_to_le32(priv->txq[3].txd_dma), priv->sram + off);
         }
 
         kfree(cmd);
@@ -1539,6 +1867,62 @@ static int mwl8k_cmd_get_hw_spec(struct ieee80211_hw *hw)
 }
 
 /*
+ * CMD_SET_HW_SPEC.
+ */
+struct mwl8k_cmd_set_hw_spec {
+        struct mwl8k_cmd_pkt header;
+        __u8 hw_rev;
+        __u8 host_interface;
+        __le16 num_mcaddrs;
+        __u8 perm_addr[ETH_ALEN];
+        __le16 region_code;
+        __le32 fw_rev;
+        __le32 ps_cookie;
+        __le32 caps;
+        __le32 rx_queue_ptr;
+        __le32 num_tx_queues;
+        __le32 tx_queue_ptrs[MWL8K_TX_QUEUES];
+        __le32 flags;
+        __le32 num_tx_desc_per_queue;
+        __le32 total_rxd;
+} __attribute__((packed));
+
+#define MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT           0x00000080
+#define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP       0x00000020
+#define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON          0x00000010
+
+static int mwl8k_cmd_set_hw_spec(struct ieee80211_hw *hw)
+{
+        struct mwl8k_priv *priv = hw->priv;
+        struct mwl8k_cmd_set_hw_spec *cmd;
+        int rc;
+        int i;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_HW_SPEC);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+
+        cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
+        cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rxd_dma);
+        cmd->num_tx_queues = cpu_to_le32(MWL8K_TX_QUEUES);
+        for (i = 0; i < MWL8K_TX_QUEUES; i++)
+                cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[i].txd_dma);
+        cmd->flags = cpu_to_le32(MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT |
+                                 MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP |
+                                 MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON);
+        cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
+        cmd->total_rxd = cpu_to_le32(MWL8K_RX_DESCS);
+
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
+
+        return rc;
+}
+
+/*
  * CMD_MAC_MULTICAST_ADR.
  */
 struct mwl8k_cmd_mac_multicast_adr {
@@ -1548,19 +1932,23 @@ struct mwl8k_cmd_mac_multicast_adr {
         __u8 addr[0][ETH_ALEN];
 };
 
-#define MWL8K_ENABLE_RX_MULTICAST 0x000F
+#define MWL8K_ENABLE_RX_DIRECTED        0x0001
+#define MWL8K_ENABLE_RX_MULTICAST       0x0002
+#define MWL8K_ENABLE_RX_ALL_MULTICAST   0x0004
+#define MWL8K_ENABLE_RX_BROADCAST       0x0008
 
 static struct mwl8k_cmd_pkt *
-__mwl8k_cmd_mac_multicast_adr(struct ieee80211_hw *hw,
+__mwl8k_cmd_mac_multicast_adr(struct ieee80211_hw *hw, int allmulti,
                               int mc_count, struct dev_addr_list *mclist)
 {
         struct mwl8k_priv *priv = hw->priv;
         struct mwl8k_cmd_mac_multicast_adr *cmd;
         int size;
-        int i;
 
-        if (mc_count > priv->num_mcaddrs)
-                mc_count = priv->num_mcaddrs;
+        if (allmulti || mc_count > priv->num_mcaddrs) {
+                allmulti = 1;
+                mc_count = 0;
+        }
 
         size = sizeof(*cmd) + mc_count * ETH_ALEN;
 
@@ -1570,27 +1958,34 @@ __mwl8k_cmd_mac_multicast_adr(struct ieee80211_hw *hw,
 
         cmd->header.code = cpu_to_le16(MWL8K_CMD_MAC_MULTICAST_ADR);
         cmd->header.length = cpu_to_le16(size);
-        cmd->action = cpu_to_le16(MWL8K_ENABLE_RX_MULTICAST);
-        cmd->numaddr = cpu_to_le16(mc_count);
-
-        for (i = 0; i < mc_count && mclist; i++) {
-                if (mclist->da_addrlen != ETH_ALEN) {
-                        kfree(cmd);
-                        return NULL;
+        cmd->action = cpu_to_le16(MWL8K_ENABLE_RX_DIRECTED |
+                                  MWL8K_ENABLE_RX_BROADCAST);
+
+        if (allmulti) {
+                cmd->action |= cpu_to_le16(MWL8K_ENABLE_RX_ALL_MULTICAST);
+        } else if (mc_count) {
+                int i;
+
+                cmd->action |= cpu_to_le16(MWL8K_ENABLE_RX_MULTICAST);
+                cmd->numaddr = cpu_to_le16(mc_count);
+                for (i = 0; i < mc_count && mclist; i++) {
+                        if (mclist->da_addrlen != ETH_ALEN) {
+                                kfree(cmd);
+                                return NULL;
+                        }
+                        memcpy(cmd->addr[i], mclist->da_addr, ETH_ALEN);
+                        mclist = mclist->next;
                 }
-                memcpy(cmd->addr[i], mclist->da_addr, ETH_ALEN);
-                mclist = mclist->next;
         }
 
         return &cmd->header;
 }
 
 /*
- * CMD_802_11_GET_STAT.
+ * CMD_GET_STAT.
  */
-struct mwl8k_cmd_802_11_get_stat {
+struct mwl8k_cmd_get_stat {
         struct mwl8k_cmd_pkt header;
-        __le16 action;
         __le32 stats[64];
 } __attribute__((packed));
 
@@ -1599,10 +1994,10 @@ struct mwl8k_cmd_802_11_get_stat {
 #define MWL8K_STAT_FCS_ERROR    24
 #define MWL8K_STAT_RTS_SUCCESS  11
 
-static int mwl8k_cmd_802_11_get_stat(struct ieee80211_hw *hw,
-                                struct ieee80211_low_level_stats *stats)
+static int mwl8k_cmd_get_stat(struct ieee80211_hw *hw,
+                              struct ieee80211_low_level_stats *stats)
 {
-        struct mwl8k_cmd_802_11_get_stat *cmd;
+        struct mwl8k_cmd_get_stat *cmd;
         int rc;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
@@ -1611,7 +2006,6 @@ static int mwl8k_cmd_802_11_get_stat(struct ieee80211_hw *hw,
 
         cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_STAT);
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le16(MWL8K_CMD_GET);
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         if (!rc) {
@@ -1630,9 +2024,9 @@ static int mwl8k_cmd_802_11_get_stat(struct ieee80211_hw *hw,
 }
 
 /*
- * CMD_802_11_RADIO_CONTROL.
+ * CMD_RADIO_CONTROL.
  */
-struct mwl8k_cmd_802_11_radio_control {
+struct mwl8k_cmd_radio_control {
         struct mwl8k_cmd_pkt header;
         __le16 action;
         __le16 control;
@@ -1640,10 +2034,10 @@ struct mwl8k_cmd_802_11_radio_control {
 } __attribute__((packed));
 
 static int
-mwl8k_cmd_802_11_radio_control(struct ieee80211_hw *hw, bool enable, bool force)
+mwl8k_cmd_radio_control(struct ieee80211_hw *hw, bool enable, bool force)
 {
         struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_cmd_802_11_radio_control *cmd;
+        struct mwl8k_cmd_radio_control *cmd;
         int rc;
 
         if (enable == priv->radio_on && !force)
@@ -1668,36 +2062,32 @@ mwl8k_cmd_802_11_radio_control(struct ieee80211_hw *hw, bool enable, bool force)
         return rc;
 }
 
-static int mwl8k_cmd_802_11_radio_disable(struct ieee80211_hw *hw)
+static int mwl8k_cmd_radio_disable(struct ieee80211_hw *hw)
 {
-        return mwl8k_cmd_802_11_radio_control(hw, 0, 0);
+        return mwl8k_cmd_radio_control(hw, 0, 0);
 }
 
-static int mwl8k_cmd_802_11_radio_enable(struct ieee80211_hw *hw)
+static int mwl8k_cmd_radio_enable(struct ieee80211_hw *hw)
 {
-        return mwl8k_cmd_802_11_radio_control(hw, 1, 0);
+        return mwl8k_cmd_radio_control(hw, 1, 0);
 }
 
 static int
 mwl8k_set_radio_preamble(struct ieee80211_hw *hw, bool short_preamble)
 {
-        struct mwl8k_priv *priv;
-
-        if (hw == NULL || hw->priv == NULL)
-                return -EINVAL;
-        priv = hw->priv;
+        struct mwl8k_priv *priv = hw->priv;
 
         priv->radio_short_preamble = short_preamble;
 
-        return mwl8k_cmd_802_11_radio_control(hw, 1, 1);
+        return mwl8k_cmd_radio_control(hw, 1, 1);
 }
 
 /*
- * CMD_802_11_RF_TX_POWER.
+ * CMD_RF_TX_POWER.
  */
 #define MWL8K_TX_POWER_LEVEL_TOTAL      8
 
-struct mwl8k_cmd_802_11_rf_tx_power {
+struct mwl8k_cmd_rf_tx_power {
         struct mwl8k_cmd_pkt header;
         __le16 action;
         __le16 support_level;
@@ -1706,9 +2096,9 @@ struct mwl8k_cmd_802_11_rf_tx_power {
         __le16 power_level_list[MWL8K_TX_POWER_LEVEL_TOTAL];
 } __attribute__((packed));
 
-static int mwl8k_cmd_802_11_rf_tx_power(struct ieee80211_hw *hw, int dBm)
+static int mwl8k_cmd_rf_tx_power(struct ieee80211_hw *hw, int dBm)
 {
-        struct mwl8k_cmd_802_11_rf_tx_power *cmd;
+        struct mwl8k_cmd_rf_tx_power *cmd;
         int rc;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
@@ -1727,6 +2117,69 @@ static int mwl8k_cmd_802_11_rf_tx_power(struct ieee80211_hw *hw, int dBm)
 }
 
 /*
+ * CMD_RF_ANTENNA.
+ */
+struct mwl8k_cmd_rf_antenna {
+        struct mwl8k_cmd_pkt header;
+        __le16 antenna;
+        __le16 mode;
+} __attribute__((packed));
+
+#define MWL8K_RF_ANTENNA_RX             1
+#define MWL8K_RF_ANTENNA_TX             2
+
+static int
+mwl8k_cmd_rf_antenna(struct ieee80211_hw *hw, int antenna, int mask)
+{
+        struct mwl8k_cmd_rf_antenna *cmd;
+        int rc;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_RF_ANTENNA);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->antenna = cpu_to_le16(antenna);
+        cmd->mode = cpu_to_le16(mask);
+
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
+
+        return rc;
+}
+
+/*
+ * CMD_SET_BEACON.
+ */
+struct mwl8k_cmd_set_beacon {
+        struct mwl8k_cmd_pkt header;
+        __le16 beacon_len;
+        __u8 beacon[0];
+};
+
+static int mwl8k_cmd_set_beacon(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif, u8 *beacon, int len)
+{
+        struct mwl8k_cmd_set_beacon *cmd;
+        int rc;
+
+        cmd = kzalloc(sizeof(*cmd) + len, GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_BEACON);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd) + len);
+        cmd->beacon_len = cpu_to_le16(len);
+        memcpy(cmd->beacon, beacon, len);
+
+        rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
+        kfree(cmd);
+
+        return rc;
+}
+
+/*
  * CMD_SET_PRE_SCAN.
  */
 struct mwl8k_cmd_set_pre_scan {
@@ -1761,7 +2214,7 @@ struct mwl8k_cmd_set_post_scan {
 } __attribute__((packed));
 
 static int
-mwl8k_cmd_set_post_scan(struct ieee80211_hw *hw, __u8 *mac)
+mwl8k_cmd_set_post_scan(struct ieee80211_hw *hw, const __u8 *mac)
 {
         struct mwl8k_cmd_set_post_scan *cmd;
         int rc;
@@ -1792,8 +2245,9 @@ struct mwl8k_cmd_set_rf_channel {
 } __attribute__((packed));
 
 static int mwl8k_cmd_set_rf_channel(struct ieee80211_hw *hw,
-                                    struct ieee80211_channel *channel)
+                                    struct ieee80211_conf *conf)
 {
+        struct ieee80211_channel *channel = conf->channel;
         struct mwl8k_cmd_set_rf_channel *cmd;
         int rc;
 
@@ -1805,10 +2259,19 @@ static int mwl8k_cmd_set_rf_channel(struct ieee80211_hw *hw,
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
         cmd->action = cpu_to_le16(MWL8K_CMD_SET);
         cmd->current_channel = channel->hw_value;
+
         if (channel->band == IEEE80211_BAND_2GHZ)
-                cmd->channel_flags = cpu_to_le32(0x00000081);
-        else
-                cmd->channel_flags = cpu_to_le32(0x00000000);
+                cmd->channel_flags |= cpu_to_le32(0x00000001);
+        else if (channel->band == IEEE80211_BAND_5GHZ)
+                cmd->channel_flags |= cpu_to_le32(0x00000004);
+
+        if (conf->channel_type == NL80211_CHAN_NO_HT ||
+            conf->channel_type == NL80211_CHAN_HT20)
+                cmd->channel_flags |= cpu_to_le32(0x00000080);
+        else if (conf->channel_type == NL80211_CHAN_HT40MINUS)
+                cmd->channel_flags |= cpu_to_le32(0x000001900);
+        else if (conf->channel_type == NL80211_CHAN_HT40PLUS)
+                cmd->channel_flags |= cpu_to_le32(0x000000900);
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
@@ -1817,58 +2280,75 @@ static int mwl8k_cmd_set_rf_channel(struct ieee80211_hw *hw,
 }
 
 /*
- * CMD_SET_SLOT.
+ * CMD_SET_AID.
  */
-struct mwl8k_cmd_set_slot {
-        struct mwl8k_cmd_pkt header;
-        __le16 action;
-        __u8 short_slot;
-} __attribute__((packed));
+#define MWL8K_FRAME_PROT_DISABLED                       0x00
+#define MWL8K_FRAME_PROT_11G                            0x07
+#define MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY              0x02
+#define MWL8K_FRAME_PROT_11N_HT_ALL                     0x06
 
-static int mwl8k_cmd_set_slot(struct ieee80211_hw *hw, bool short_slot_time)
-{
-        struct mwl8k_cmd_set_slot *cmd;
-        int rc;
+struct mwl8k_cmd_update_set_aid {
+        struct  mwl8k_cmd_pkt header;
+        __le16  aid;
 
-        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
-        if (cmd == NULL)
-                return -ENOMEM;
+         /* AP's MAC address (BSSID) */
+        __u8    bssid[ETH_ALEN];
+        __le16  protection_mode;
+        __u8    supp_rates[14];
+} __attribute__((packed));
 
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_SLOT);
-        cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le16(MWL8K_CMD_SET);
-        cmd->short_slot = short_slot_time;
+static void legacy_rate_mask_to_array(u8 *rates, u32 mask)
+{
+        int i;
+        int j;
 
-        rc = mwl8k_post_cmd(hw, &cmd->header);
-        kfree(cmd);
+        /*
+         * Clear nonstandard rates 4 and 13.
+         */
+        mask &= 0x1fef;
 
-        return rc;
+        for (i = 0, j = 0; i < 14; i++) {
+                if (mask & (1 << i))
+                        rates[j++] = mwl8k_rates_24[i].hw_value;
+        }
 }
 
-/*
- * CMD_MIMO_CONFIG.
- */
-struct mwl8k_cmd_mimo_config {
-        struct mwl8k_cmd_pkt header;
-        __le32 action;
-        __u8 rx_antenna_map;
-        __u8 tx_antenna_map;
-} __attribute__((packed));
-
-static int mwl8k_cmd_mimo_config(struct ieee80211_hw *hw, __u8 rx, __u8 tx)
+static int
+mwl8k_cmd_set_aid(struct ieee80211_hw *hw,
+                  struct ieee80211_vif *vif, u32 legacy_rate_mask)
 {
-        struct mwl8k_cmd_mimo_config *cmd;
+        struct mwl8k_cmd_update_set_aid *cmd;
+        u16 prot_mode;
         int rc;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
 
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_MIMO_CONFIG);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_AID);
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le32((u32)MWL8K_CMD_SET);
-        cmd->rx_antenna_map = rx;
-        cmd->tx_antenna_map = tx;
+        cmd->aid = cpu_to_le16(vif->bss_conf.aid);
+        memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
+
+        if (vif->bss_conf.use_cts_prot) {
+                prot_mode = MWL8K_FRAME_PROT_11G;
+        } else {
+                switch (vif->bss_conf.ht_operation_mode &
+                        IEEE80211_HT_OP_MODE_PROTECTION) {
+                case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
+                        prot_mode = MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY;
+                        break;
+                case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
+                        prot_mode = MWL8K_FRAME_PROT_11N_HT_ALL;
+                        break;
+                default:
+                        prot_mode = MWL8K_FRAME_PROT_DISABLED;
+                        break;
+                }
+        }
+        cmd->protection_mode = cpu_to_le16(prot_mode);
+
+        legacy_rate_mask_to_array(cmd->supp_rates, legacy_rate_mask);
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
@@ -1877,25 +2357,32 @@ static int mwl8k_cmd_mimo_config(struct ieee80211_hw *hw, __u8 rx, __u8 tx)
 }
 
 /*
- * CMD_ENABLE_SNIFFER.
+ * CMD_SET_RATE.
  */
-struct mwl8k_cmd_enable_sniffer {
-        struct mwl8k_cmd_pkt header;
-        __le32 action;
+struct mwl8k_cmd_set_rate {
+        struct  mwl8k_cmd_pkt header;
+        __u8    legacy_rates[14];
+
+        /* Bitmap for supported MCS codes.  */
+        __u8    mcs_set[16];
+        __u8    reserved[16];
 } __attribute__((packed));
 
-static int mwl8k_enable_sniffer(struct ieee80211_hw *hw, bool enable)
+static int
+mwl8k_cmd_set_rate(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                   u32 legacy_rate_mask, u8 *mcs_rates)
 {
-        struct mwl8k_cmd_enable_sniffer *cmd;
+        struct mwl8k_cmd_set_rate *cmd;
         int rc;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
 
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_ENABLE_SNIFFER);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATE);
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le32(!!enable);
+        legacy_rate_mask_to_array(cmd->legacy_rates, legacy_rate_mask);
+        memcpy(cmd->mcs_set, mcs_rates, 16);
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
@@ -1904,27 +2391,39 @@ static int mwl8k_enable_sniffer(struct ieee80211_hw *hw, bool enable)
 }
 
 /*
- * CMD_SET_RATEADAPT_MODE.
+ * CMD_FINALIZE_JOIN.
  */
-struct mwl8k_cmd_set_rate_adapt_mode {
+#define MWL8K_FJ_BEACON_MAXLEN  128
+
+struct mwl8k_cmd_finalize_join {
         struct mwl8k_cmd_pkt header;
-        __le16 action;
-        __le16 mode;
+        __le32 sleep_interval;  /* Number of beacon periods to sleep */
+        __u8 beacon_data[MWL8K_FJ_BEACON_MAXLEN];
 } __attribute__((packed));
 
-static int mwl8k_cmd_setrateadaptmode(struct ieee80211_hw *hw, __u16 mode)
+static int mwl8k_cmd_finalize_join(struct ieee80211_hw *hw, void *frame,
+                                   int framelen, int dtim)
 {
-        struct mwl8k_cmd_set_rate_adapt_mode *cmd;
+        struct mwl8k_cmd_finalize_join *cmd;
+        struct ieee80211_mgmt *payload = frame;
+        int payload_len;
         int rc;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
 
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATEADAPT_MODE);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_FINALIZE_JOIN);
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le16(MWL8K_CMD_SET);
-        cmd->mode = cpu_to_le16(mode);
+        cmd->sleep_interval = cpu_to_le32(dtim ? dtim : 1);
+
+        payload_len = framelen - ieee80211_hdrlen(payload->frame_control);
+        if (payload_len < 0)
+                payload_len = 0;
+        else if (payload_len > MWL8K_FJ_BEACON_MAXLEN)
+                payload_len = MWL8K_FJ_BEACON_MAXLEN;
+
+        memcpy(cmd->beacon_data, &payload->u.beacon, payload_len);
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
@@ -1933,59 +2432,57 @@ static int mwl8k_cmd_setrateadaptmode(struct ieee80211_hw *hw, __u16 mode)
 }
 
 /*
- * CMD_SET_WMM_MODE.
+ * CMD_SET_RTS_THRESHOLD.
  */
-struct mwl8k_cmd_set_wmm {
+struct mwl8k_cmd_set_rts_threshold {
         struct mwl8k_cmd_pkt header;
         __le16 action;
+        __le16 threshold;
 } __attribute__((packed));
 
-static int mwl8k_set_wmm(struct ieee80211_hw *hw, bool enable)
+static int
+mwl8k_cmd_set_rts_threshold(struct ieee80211_hw *hw, int rts_thresh)
 {
-        struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_cmd_set_wmm *cmd;
+        struct mwl8k_cmd_set_rts_threshold *cmd;
         int rc;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
 
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_WMM_MODE);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_RTS_THRESHOLD);
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le16(!!enable);
+        cmd->action = cpu_to_le16(MWL8K_CMD_SET);
+        cmd->threshold = cpu_to_le16(rts_thresh);
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
 
-        if (!rc)
-                priv->wmm_enabled = enable;
-
         return rc;
 }
 
 /*
- * CMD_SET_RTS_THRESHOLD.
+ * CMD_SET_SLOT.
  */
-struct mwl8k_cmd_rts_threshold {
+struct mwl8k_cmd_set_slot {
         struct mwl8k_cmd_pkt header;
         __le16 action;
-        __le16 threshold;
+        __u8 short_slot;
 } __attribute__((packed));
 
-static int mwl8k_rts_threshold(struct ieee80211_hw *hw,
-                               u16 action, u16 threshold)
+static int mwl8k_cmd_set_slot(struct ieee80211_hw *hw, bool short_slot_time)
 {
-        struct mwl8k_cmd_rts_threshold *cmd;
+        struct mwl8k_cmd_set_slot *cmd;
         int rc;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
 
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_RTS_THRESHOLD);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_SLOT);
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le16(action);
-        cmd->threshold = cpu_to_le16(threshold);
+        cmd->action = cpu_to_le16(MWL8K_CMD_SET);
+        cmd->short_slot = short_slot_time;
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
@@ -2005,17 +2502,34 @@ struct mwl8k_cmd_set_edca_params {
         /* TX opportunity in units of 32 us */
         __le16 txop;
 
-        /* Log exponent of max contention period: 0...15*/
-        __u8 log_cw_max;
+        union {
+                struct {
+                        /* Log exponent of max contention period: 0...15 */
+                        __le32 log_cw_max;
 
-        /* Log exponent of min contention period: 0...15 */
-        __u8 log_cw_min;
+                        /* Log exponent of min contention period: 0...15 */
+                        __le32 log_cw_min;
 
-        /* Adaptive interframe spacing in units of 32us */
-        __u8 aifs;
+                        /* Adaptive interframe spacing in units of 32us */
+                        __u8 aifs;
 
-        /* TX queue to configure */
-        __u8 txq;
+                        /* TX queue to configure */
+                        __u8 txq;
+                } ap;
+                struct {
+                        /* Log exponent of max contention period: 0...15 */
+                        __u8 log_cw_max;
+
+                        /* Log exponent of min contention period: 0...15 */
+                        __u8 log_cw_min;
+
+                        /* Adaptive interframe spacing in units of 32us */
+                        __u8 aifs;
+
+                        /* TX queue to configure */
+                        __u8 txq;
+                } sta;
+        };
 } __attribute__((packed));
 
 #define MWL8K_SET_EDCA_CW       0x01
@@ -2027,10 +2541,11 @@ struct mwl8k_cmd_set_edca_params {
                                  MWL8K_SET_EDCA_AIFS)
 
 static int
-mwl8k_set_edca_params(struct ieee80211_hw *hw, __u8 qnum,
-                __u16 cw_min, __u16 cw_max,
-                __u8 aifs, __u16 txop)
+mwl8k_cmd_set_edca_params(struct ieee80211_hw *hw, __u8 qnum,
+                          __u16 cw_min, __u16 cw_max,
+                          __u8 aifs, __u16 txop)
 {
+        struct mwl8k_priv *priv = hw->priv;
         struct mwl8k_cmd_set_edca_params *cmd;
         int rc;
 
@@ -2042,10 +2557,17 @@ mwl8k_set_edca_params(struct ieee80211_hw *hw, __u8 qnum,
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
         cmd->action = cpu_to_le16(MWL8K_SET_EDCA_ALL);
         cmd->txop = cpu_to_le16(txop);
-        cmd->log_cw_max = (u8)ilog2(cw_max + 1);
-        cmd->log_cw_min = (u8)ilog2(cw_min + 1);
-        cmd->aifs = aifs;
-        cmd->txq = qnum;
+        if (priv->ap_fw) {
+                cmd->ap.log_cw_max = cpu_to_le32(ilog2(cw_max + 1));
+                cmd->ap.log_cw_min = cpu_to_le32(ilog2(cw_min + 1));
+                cmd->ap.aifs = aifs;
+                cmd->ap.txq = qnum;
+        } else {
+                cmd->sta.log_cw_max = (u8)ilog2(cw_max + 1);
+                cmd->sta.log_cw_min = (u8)ilog2(cw_min + 1);
+                cmd->sta.aifs = aifs;
+                cmd->sta.txq = qnum;
+        }
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
@@ -2054,313 +2576,516 @@ mwl8k_set_edca_params(struct ieee80211_hw *hw, __u8 qnum,
 }
 
 /*
- * CMD_FINALIZE_JOIN.
+ * CMD_SET_WMM_MODE.
  */
-
-/* FJ beacon buffer size is compiled into the firmware.  */
-#define MWL8K_FJ_BEACON_MAXLEN  128
-
-struct mwl8k_cmd_finalize_join {
+struct mwl8k_cmd_set_wmm_mode {
         struct mwl8k_cmd_pkt header;
-        __le32 sleep_interval;  /* Number of beacon periods to sleep */
-        __u8 beacon_data[MWL8K_FJ_BEACON_MAXLEN];
+        __le16 action;
 } __attribute__((packed));
 
-static int mwl8k_finalize_join(struct ieee80211_hw *hw, void *frame,
-                                __u16 framelen, __u16 dtim)
+static int mwl8k_cmd_set_wmm_mode(struct ieee80211_hw *hw, bool enable)
 {
-        struct mwl8k_cmd_finalize_join *cmd;
-        struct ieee80211_mgmt *payload = frame;
-        u16 hdrlen;
-        u32 payload_len;
+        struct mwl8k_priv *priv = hw->priv;
+        struct mwl8k_cmd_set_wmm_mode *cmd;
         int rc;
 
-        if (frame == NULL)
-                return -EINVAL;
-
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
 
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_FINALIZE_JOIN);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_WMM_MODE);
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->sleep_interval = cpu_to_le32(dtim ? dtim : 1);
+        cmd->action = cpu_to_le16(!!enable);
 
-        hdrlen = ieee80211_hdrlen(payload->frame_control);
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
 
-        payload_len = framelen > hdrlen ? framelen - hdrlen : 0;
+        if (!rc)
+                priv->wmm_enabled = enable;
 
-        /* XXX TBD Might just have to abort and return an error */
-        if (payload_len > MWL8K_FJ_BEACON_MAXLEN)
-                printk(KERN_ERR "%s(): WARNING: Incomplete beacon "
-                        "sent to firmware. Sz=%u MAX=%u\n", __func__,
-                        payload_len, MWL8K_FJ_BEACON_MAXLEN);
+        return rc;
+}
 
-        if (payload_len > MWL8K_FJ_BEACON_MAXLEN)
-                payload_len = MWL8K_FJ_BEACON_MAXLEN;
+/*
+ * CMD_MIMO_CONFIG.
+ */
+struct mwl8k_cmd_mimo_config {
+        struct mwl8k_cmd_pkt header;
+        __le32 action;
+        __u8 rx_antenna_map;
+        __u8 tx_antenna_map;
+} __attribute__((packed));
+
+static int mwl8k_cmd_mimo_config(struct ieee80211_hw *hw, __u8 rx, __u8 tx)
+{
+        struct mwl8k_cmd_mimo_config *cmd;
+        int rc;
 
-        if (payload && payload_len)
-                memcpy(cmd->beacon_data, &payload->u.beacon, payload_len);
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_MIMO_CONFIG);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->action = cpu_to_le32((u32)MWL8K_CMD_SET);
+        cmd->rx_antenna_map = rx;
+        cmd->tx_antenna_map = tx;
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
+
         return rc;
 }
 
 /*
- * CMD_UPDATE_STADB.
+ * CMD_USE_FIXED_RATE (STA version).
  */
-struct mwl8k_cmd_update_sta_db {
+struct mwl8k_cmd_use_fixed_rate_sta {
         struct mwl8k_cmd_pkt header;
+        __le32 action;
+        __le32 allow_rate_drop;
+        __le32 num_rates;
+        struct {
+                __le32 is_ht_rate;
+                __le32 enable_retry;
+                __le32 rate;
+                __le32 retry_count;
+        } rate_entry[8];
+        __le32 rate_type;
+        __le32 reserved1;
+        __le32 reserved2;
+} __attribute__((packed));
 
-        /* See STADB_ACTION_TYPE */
-        __le32  action;
+#define MWL8K_USE_AUTO_RATE     0x0002
+#define MWL8K_UCAST_RATE        0
 
-        /* Peer MAC address */
-        __u8    peer_addr[ETH_ALEN];
+static int mwl8k_cmd_use_fixed_rate_sta(struct ieee80211_hw *hw)
+{
+        struct mwl8k_cmd_use_fixed_rate_sta *cmd;
+        int rc;
 
-        __le32  reserved;
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
 
-        /* Peer info - valid during add/update.  */
-        struct peer_capability_info     peer_info;
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_USE_FIXED_RATE);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->action = cpu_to_le32(MWL8K_USE_AUTO_RATE);
+        cmd->rate_type = cpu_to_le32(MWL8K_UCAST_RATE);
+
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
+
+        return rc;
+}
+
+/*
+ * CMD_USE_FIXED_RATE (AP version).
+ */
+struct mwl8k_cmd_use_fixed_rate_ap {
+        struct mwl8k_cmd_pkt header;
+        __le32 action;
+        __le32 allow_rate_drop;
+        __le32 num_rates;
+        struct mwl8k_rate_entry_ap {
+                __le32 is_ht_rate;
+                __le32 enable_retry;
+                __le32 rate;
+                __le32 retry_count;
+        } rate_entry[4];
+        u8 multicast_rate;
+        u8 multicast_rate_type;
+        u8 management_rate;
 } __attribute__((packed));
 
-static int mwl8k_cmd_update_sta_db(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif, __u32 action)
+static int
+mwl8k_cmd_use_fixed_rate_ap(struct ieee80211_hw *hw, int mcast, int mgmt)
 {
-        struct mwl8k_vif *mv_vif = MWL8K_VIF(vif);
-        struct ieee80211_bss_conf *info = &mv_vif->bss_info;
-        struct mwl8k_cmd_update_sta_db *cmd;
-        struct peer_capability_info *peer_info;
-        struct ieee80211_rate *bitrates = mv_vif->legacy_rates;
+        struct mwl8k_cmd_use_fixed_rate_ap *cmd;
         int rc;
-        __u8 count, *rates;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
 
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_STADB);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_USE_FIXED_RATE);
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->action = cpu_to_le32(MWL8K_USE_AUTO_RATE);
+        cmd->multicast_rate = mcast;
+        cmd->management_rate = mgmt;
 
-        cmd->action = cpu_to_le32(action);
-        peer_info = &cmd->peer_info;
-        memcpy(cmd->peer_addr, mv_vif->bssid, ETH_ALEN);
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
 
-        switch (action) {
-        case MWL8K_STA_DB_ADD_ENTRY:
-        case MWL8K_STA_DB_MODIFY_ENTRY:
-                /* Build peer_info block */
-                peer_info->peer_type = MWL8K_PEER_TYPE_ACCESSPOINT;
-                peer_info->basic_caps = cpu_to_le16(info->assoc_capability);
-                peer_info->interop = 1;
-                peer_info->amsdu_enabled = 0;
-
-                rates = peer_info->legacy_rates;
-                for (count = 0; count < mv_vif->legacy_nrates; count++)
-                        rates[count] = bitrates[count].hw_value;
-
-                rc = mwl8k_post_cmd(hw, &cmd->header);
-                if (rc == 0)
-                        mv_vif->peer_id = peer_info->station_id;
+        return rc;
+}
 
-                break;
+/*
+ * CMD_ENABLE_SNIFFER.
+ */
+struct mwl8k_cmd_enable_sniffer {
+        struct mwl8k_cmd_pkt header;
+        __le32 action;
+} __attribute__((packed));
 
-        case MWL8K_STA_DB_DEL_ENTRY:
-        case MWL8K_STA_DB_FLUSH:
-        default:
-                rc = mwl8k_post_cmd(hw, &cmd->header);
-                if (rc == 0)
-                        mv_vif->peer_id = 0;
-                break;
-        }
+static int mwl8k_cmd_enable_sniffer(struct ieee80211_hw *hw, bool enable)
+{
+        struct mwl8k_cmd_enable_sniffer *cmd;
+        int rc;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_ENABLE_SNIFFER);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->action = cpu_to_le32(!!enable);
+
+        rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
 
         return rc;
 }
 
 /*
- * CMD_SET_AID.
+ * CMD_SET_MAC_ADDR.
  */
-#define MWL8K_RATE_INDEX_MAX_ARRAY                      14
+struct mwl8k_cmd_set_mac_addr {
+        struct mwl8k_cmd_pkt header;
+        union {
+                struct {
+                        __le16 mac_type;
+                        __u8 mac_addr[ETH_ALEN];
+                } mbss;
+                __u8 mac_addr[ETH_ALEN];
+        };
+} __attribute__((packed));
 
-#define MWL8K_FRAME_PROT_DISABLED                       0x00
-#define MWL8K_FRAME_PROT_11G                            0x07
-#define MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY              0x02
-#define MWL8K_FRAME_PROT_11N_HT_ALL                     0x06
+#define MWL8K_MAC_TYPE_PRIMARY_CLIENT           0
+#define MWL8K_MAC_TYPE_SECONDARY_CLIENT         1
+#define MWL8K_MAC_TYPE_PRIMARY_AP               2
+#define MWL8K_MAC_TYPE_SECONDARY_AP             3
 
-struct mwl8k_cmd_update_set_aid {
-        struct  mwl8k_cmd_pkt header;
-        __le16  aid;
+static int mwl8k_cmd_set_mac_addr(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif, u8 *mac)
+{
+        struct mwl8k_priv *priv = hw->priv;
+        struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
+        struct mwl8k_cmd_set_mac_addr *cmd;
+        int mac_type;
+        int rc;
 
-         /* AP's MAC address (BSSID) */
-        __u8    bssid[ETH_ALEN];
-        __le16  protection_mode;
-        __u8    supp_rates[MWL8K_RATE_INDEX_MAX_ARRAY];
+        mac_type = MWL8K_MAC_TYPE_PRIMARY_AP;
+        if (vif != NULL && vif->type == NL80211_IFTYPE_STATION) {
+                if (mwl8k_vif->macid + 1 == ffs(priv->sta_macids_supported))
+                        mac_type = MWL8K_MAC_TYPE_PRIMARY_CLIENT;
+                else
+                        mac_type = MWL8K_MAC_TYPE_SECONDARY_CLIENT;
+        } else if (vif != NULL && vif->type == NL80211_IFTYPE_AP) {
+                if (mwl8k_vif->macid + 1 == ffs(priv->ap_macids_supported))
+                        mac_type = MWL8K_MAC_TYPE_PRIMARY_AP;
+                else
+                        mac_type = MWL8K_MAC_TYPE_SECONDARY_AP;
+        }
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_MAC_ADDR);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        if (priv->ap_fw) {
+                cmd->mbss.mac_type = cpu_to_le16(mac_type);
+                memcpy(cmd->mbss.mac_addr, mac, ETH_ALEN);
+        } else {
+                memcpy(cmd->mac_addr, mac, ETH_ALEN);
+        }
+
+        rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
+        kfree(cmd);
+
+        return rc;
+}
+
+/*
+ * CMD_SET_RATEADAPT_MODE.
+ */
+struct mwl8k_cmd_set_rate_adapt_mode {
+        struct mwl8k_cmd_pkt header;
+        __le16 action;
+        __le16 mode;
 } __attribute__((packed));
 
-static int mwl8k_cmd_set_aid(struct ieee80211_hw *hw,
-                                        struct ieee80211_vif *vif)
+static int mwl8k_cmd_set_rateadapt_mode(struct ieee80211_hw *hw, __u16 mode)
 {
-        struct mwl8k_vif *mv_vif = MWL8K_VIF(vif);
-        struct ieee80211_bss_conf *info = &mv_vif->bss_info;
-        struct mwl8k_cmd_update_set_aid *cmd;
-        struct ieee80211_rate *bitrates = mv_vif->legacy_rates;
-        int count;
-        u16 prot_mode;
+        struct mwl8k_cmd_set_rate_adapt_mode *cmd;
         int rc;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
 
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_AID);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATEADAPT_MODE);
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->aid = cpu_to_le16(info->aid);
+        cmd->action = cpu_to_le16(MWL8K_CMD_SET);
+        cmd->mode = cpu_to_le16(mode);
 
-        memcpy(cmd->bssid, mv_vif->bssid, ETH_ALEN);
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
 
-        if (info->use_cts_prot) {
-                prot_mode = MWL8K_FRAME_PROT_11G;
-        } else {
-                switch (info->ht_operation_mode &
-                        IEEE80211_HT_OP_MODE_PROTECTION) {
-                case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
-                        prot_mode = MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY;
-                        break;
-                case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
-                        prot_mode = MWL8K_FRAME_PROT_11N_HT_ALL;
-                        break;
-                default:
-                        prot_mode = MWL8K_FRAME_PROT_DISABLED;
-                        break;
-                }
-        }
-        cmd->protection_mode = cpu_to_le16(prot_mode);
+        return rc;
+}
 
-        for (count = 0; count < mv_vif->legacy_nrates; count++)
-                cmd->supp_rates[count] = bitrates[count].hw_value;
+/*
+ * CMD_BSS_START.
+ */
+struct mwl8k_cmd_bss_start {
+        struct mwl8k_cmd_pkt header;
+        __le32 enable;
+} __attribute__((packed));
 
-        rc = mwl8k_post_cmd(hw, &cmd->header);
+static int mwl8k_cmd_bss_start(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif, int enable)
+{
+        struct mwl8k_cmd_bss_start *cmd;
+        int rc;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_BSS_START);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->enable = cpu_to_le32(enable);
+
+        rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
         kfree(cmd);
 
         return rc;
 }
 
 /*
- * CMD_SET_RATE.
+ * CMD_SET_NEW_STN.
  */
-struct mwl8k_cmd_update_rateset {
-        struct  mwl8k_cmd_pkt header;
-        __u8    legacy_rates[MWL8K_RATE_INDEX_MAX_ARRAY];
-
-        /* Bitmap for supported MCS codes.  */
-        __u8    mcs_set[MWL8K_IEEE_LEGACY_DATA_RATES];
-        __u8    reserved[MWL8K_IEEE_LEGACY_DATA_RATES];
+struct mwl8k_cmd_set_new_stn {
+        struct mwl8k_cmd_pkt header;
+        __le16 aid;
+        __u8 mac_addr[6];
+        __le16 stn_id;
+        __le16 action;
+        __le16 rsvd;
+        __le32 legacy_rates;
+        __u8 ht_rates[4];
+        __le16 cap_info;
+        __le16 ht_capabilities_info;
+        __u8 mac_ht_param_info;
+        __u8 rev;
+        __u8 control_channel;
+        __u8 add_channel;
+        __le16 op_mode;
+        __le16 stbc;
+        __u8 add_qos_info;
+        __u8 is_qos_sta;
+        __le32 fw_sta_ptr;
 } __attribute__((packed));
 
-static int mwl8k_update_rateset(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif)
+#define MWL8K_STA_ACTION_ADD            0
+#define MWL8K_STA_ACTION_REMOVE         2
+
+static int mwl8k_cmd_set_new_stn_add(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_sta *sta)
 {
-        struct mwl8k_vif *mv_vif = MWL8K_VIF(vif);
-        struct mwl8k_cmd_update_rateset *cmd;
-        struct ieee80211_rate *bitrates = mv_vif->legacy_rates;
-        int count;
+        struct mwl8k_cmd_set_new_stn *cmd;
+        u32 rates;
         int rc;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
 
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATE);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_NEW_STN);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->aid = cpu_to_le16(sta->aid);
+        memcpy(cmd->mac_addr, sta->addr, ETH_ALEN);
+        cmd->stn_id = cpu_to_le16(sta->aid);
+        cmd->action = cpu_to_le16(MWL8K_STA_ACTION_ADD);
+        if (hw->conf.channel->band == IEEE80211_BAND_2GHZ)
+                rates = sta->supp_rates[IEEE80211_BAND_2GHZ];
+        else
+                rates = sta->supp_rates[IEEE80211_BAND_5GHZ] << 5;
+        cmd->legacy_rates = cpu_to_le32(rates);
+        if (sta->ht_cap.ht_supported) {
+                cmd->ht_rates[0] = sta->ht_cap.mcs.rx_mask[0];
+                cmd->ht_rates[1] = sta->ht_cap.mcs.rx_mask[1];
+                cmd->ht_rates[2] = sta->ht_cap.mcs.rx_mask[2];
+                cmd->ht_rates[3] = sta->ht_cap.mcs.rx_mask[3];
+                cmd->ht_capabilities_info = cpu_to_le16(sta->ht_cap.cap);
+                cmd->mac_ht_param_info = (sta->ht_cap.ampdu_factor & 3) |
+                        ((sta->ht_cap.ampdu_density & 7) << 2);
+                cmd->is_qos_sta = 1;
+        }
+
+        rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
+        kfree(cmd);
+
+        return rc;
+}
+
+static int mwl8k_cmd_set_new_stn_add_self(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif)
+{
+        struct mwl8k_cmd_set_new_stn *cmd;
+        int rc;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_NEW_STN);
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        memcpy(cmd->mac_addr, vif->addr, ETH_ALEN);
 
-        for (count = 0; count < mv_vif->legacy_nrates; count++)
-                cmd->legacy_rates[count] = bitrates[count].hw_value;
+        rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
+        kfree(cmd);
 
-        rc = mwl8k_post_cmd(hw, &cmd->header);
+        return rc;
+}
+
+static int mwl8k_cmd_set_new_stn_del(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif, u8 *addr)
+{
+        struct mwl8k_cmd_set_new_stn *cmd;
+        int rc;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_NEW_STN);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        memcpy(cmd->mac_addr, addr, ETH_ALEN);
+        cmd->action = cpu_to_le16(MWL8K_STA_ACTION_REMOVE);
+
+        rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
         kfree(cmd);
 
         return rc;
 }
 
 /*
- * CMD_USE_FIXED_RATE.
+ * CMD_UPDATE_STADB.
  */
-#define MWL8K_RATE_TABLE_SIZE   8
-#define MWL8K_UCAST_RATE        0
-#define MWL8K_USE_AUTO_RATE     0x0002
+struct ewc_ht_info {
+        __le16  control1;
+        __le16  control2;
+        __le16  control3;
+} __attribute__((packed));
+
+struct peer_capability_info {
+        /* Peer type - AP vs. STA.  */
+        __u8    peer_type;
 
-struct mwl8k_rate_entry {
-        /* Set to 1 if HT rate, 0 if legacy.  */
-        __le32  is_ht_rate;
+        /* Basic 802.11 capabilities from assoc resp.  */
+        __le16  basic_caps;
 
-        /* Set to 1 to use retry_count field.  */
-        __le32  enable_retry;
+        /* Set if peer supports 802.11n high throughput (HT).  */
+        __u8    ht_support;
 
-        /* Specified legacy rate or MCS.  */
-        __le32  rate;
+        /* Valid if HT is supported.  */
+        __le16  ht_caps;
+        __u8    extended_ht_caps;
+        struct ewc_ht_info      ewc_info;
 
-        /* Number of allowed retries.  */
-        __le32  retry_count;
-} __attribute__((packed));
+        /* Legacy rate table. Intersection of our rates and peer rates.  */
+        __u8    legacy_rates[12];
 
-struct mwl8k_rate_table {
-        /* 1 to allow specified rate and below */
-        __le32  allow_rate_drop;
-        __le32  num_rates;
-        struct mwl8k_rate_entry rate_entry[MWL8K_RATE_TABLE_SIZE];
+        /* HT rate table. Intersection of our rates and peer rates.  */
+        __u8    ht_rates[16];
+        __u8    pad[16];
+
+        /* If set, interoperability mode, no proprietary extensions.  */
+        __u8    interop;
+        __u8    pad2;
+        __u8    station_id;
+        __le16  amsdu_enabled;
 } __attribute__((packed));
 
-struct mwl8k_cmd_use_fixed_rate {
-        struct  mwl8k_cmd_pkt header;
+struct mwl8k_cmd_update_stadb {
+        struct mwl8k_cmd_pkt header;
+
+        /* See STADB_ACTION_TYPE */
         __le32  action;
-        struct mwl8k_rate_table rate_table;
 
-        /* Unicast, Broadcast or Multicast */
-        __le32  rate_type;
-        __le32  reserved1;
-        __le32  reserved2;
+        /* Peer MAC address */
+        __u8    peer_addr[ETH_ALEN];
+
+        __le32  reserved;
+
+        /* Peer info - valid during add/update.  */
+        struct peer_capability_info     peer_info;
 } __attribute__((packed));
 
-static int mwl8k_cmd_use_fixed_rate(struct ieee80211_hw *hw,
-        u32 action, u32 rate_type, struct mwl8k_rate_table *rate_table)
+#define MWL8K_STA_DB_MODIFY_ENTRY       1
+#define MWL8K_STA_DB_DEL_ENTRY          2
+
+/* Peer Entry flags - used to define the type of the peer node */
+#define MWL8K_PEER_TYPE_ACCESSPOINT     2
+
+static int mwl8k_cmd_update_stadb_add(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
+                                      struct ieee80211_sta *sta)
 {
-        struct mwl8k_cmd_use_fixed_rate *cmd;
-        int count;
+        struct mwl8k_cmd_update_stadb *cmd;
+        struct peer_capability_info *p;
+        u32 rates;
         int rc;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
 
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_USE_FIXED_RATE);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_STADB);
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->action = cpu_to_le32(MWL8K_STA_DB_MODIFY_ENTRY);
+        memcpy(cmd->peer_addr, sta->addr, ETH_ALEN);
+
+        p = &cmd->peer_info;
+        p->peer_type = MWL8K_PEER_TYPE_ACCESSPOINT;
+        p->basic_caps = cpu_to_le16(vif->bss_conf.assoc_capability);
+        p->ht_support = sta->ht_cap.ht_supported;
+        p->ht_caps = sta->ht_cap.cap;
+        p->extended_ht_caps = (sta->ht_cap.ampdu_factor & 3) |
+                ((sta->ht_cap.ampdu_density & 7) << 2);
+        if (hw->conf.channel->band == IEEE80211_BAND_2GHZ)
+                rates = sta->supp_rates[IEEE80211_BAND_2GHZ];
+        else
+                rates = sta->supp_rates[IEEE80211_BAND_5GHZ] << 5;
+        legacy_rate_mask_to_array(p->legacy_rates, rates);
+        memcpy(p->ht_rates, sta->ht_cap.mcs.rx_mask, 16);
+        p->interop = 1;
+        p->amsdu_enabled = 0;
 
-        cmd->action = cpu_to_le32(action);
-        cmd->rate_type = cpu_to_le32(rate_type);
-
-        if (rate_table != NULL) {
-                /* Copy over each field manually so
-                * that bitflipping can be done
-                */
-                cmd->rate_table.allow_rate_drop =
-                                cpu_to_le32(rate_table->allow_rate_drop);
-                cmd->rate_table.num_rates =
-                                cpu_to_le32(rate_table->num_rates);
-
-                for (count = 0; count < rate_table->num_rates; count++) {
-                        struct mwl8k_rate_entry *dst =
-                                &cmd->rate_table.rate_entry[count];
-                        struct mwl8k_rate_entry *src =
-                                &rate_table->rate_entry[count];
-
-                        dst->is_ht_rate = cpu_to_le32(src->is_ht_rate);
-                        dst->enable_retry = cpu_to_le32(src->enable_retry);
-                        dst->rate = cpu_to_le32(src->rate);
-                        dst->retry_count = cpu_to_le32(src->retry_count);
-                }
-        }
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
+
+        return rc ? rc : p->station_id;
+}
+
+static int mwl8k_cmd_update_stadb_del(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif, u8 *addr)
+{
+        struct mwl8k_cmd_update_stadb *cmd;
+        int rc;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_STADB);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->action = cpu_to_le32(MWL8K_STA_DB_DEL_ENTRY);
+        memcpy(cmd->peer_addr, addr, ETH_ALEN);
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
@@ -2379,19 +3104,22 @@ static irqreturn_t mwl8k_interrupt(int irq, void *dev_id)
         u32 status;
 
         status = ioread32(priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
-        iowrite32(~status, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
-
         if (!status)
                 return IRQ_NONE;
 
-        if (status & MWL8K_A2H_INT_TX_DONE)
-                tasklet_schedule(&priv->tx_reclaim_task);
+        if (status & MWL8K_A2H_INT_TX_DONE) {
+                status &= ~MWL8K_A2H_INT_TX_DONE;
+                tasklet_schedule(&priv->poll_tx_task);
+        }
 
         if (status & MWL8K_A2H_INT_RX_READY) {
-                while (rxq_process(hw, 0, 1))
-                        rxq_refill(hw, 0, 1);
+                status &= ~MWL8K_A2H_INT_RX_READY;
+                tasklet_schedule(&priv->poll_rx_task);
         }
 
+        if (status)
+                iowrite32(~status, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
+
         if (status & MWL8K_A2H_INT_OPC_DONE) {
                 if (priv->hostcmd_wait != NULL)
                         complete(priv->hostcmd_wait);
@@ -2399,13 +3127,60 @@ static irqreturn_t mwl8k_interrupt(int irq, void *dev_id)
 
         if (status & MWL8K_A2H_INT_QUEUE_EMPTY) {
                 if (!mutex_is_locked(&priv->fw_mutex) &&
-                    priv->radio_on && mwl8k_txq_busy(priv))
+                    priv->radio_on && priv->pending_tx_pkts)
                         mwl8k_tx_start(priv);
         }
 
         return IRQ_HANDLED;
 }
 
+static void mwl8k_tx_poll(unsigned long data)
+{
+        struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+        struct mwl8k_priv *priv = hw->priv;
+        int limit;
+        int i;
+
+        limit = 32;
+
+        spin_lock_bh(&priv->tx_lock);
+
+        for (i = 0; i < MWL8K_TX_QUEUES; i++)
+                limit -= mwl8k_txq_reclaim(hw, i, limit, 0);
+
+        if (!priv->pending_tx_pkts && priv->tx_wait != NULL) {
+                complete(priv->tx_wait);
+                priv->tx_wait = NULL;
+        }
+
+        spin_unlock_bh(&priv->tx_lock);
+
+        if (limit) {
+                writel(~MWL8K_A2H_INT_TX_DONE,
+                       priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
+        } else {
+                tasklet_schedule(&priv->poll_tx_task);
+        }
+}
+
+static void mwl8k_rx_poll(unsigned long data)
+{
+        struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+        struct mwl8k_priv *priv = hw->priv;
+        int limit;
+
+        limit = 32;
+        limit -= rxq_process(hw, 0, limit);
+        limit -= rxq_refill(hw, 0, limit);
+
+        if (limit) {
+                writel(~MWL8K_A2H_INT_RX_READY,
+                       priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
+        } else {
+                tasklet_schedule(&priv->poll_rx_task);
+        }
+}
+
 
 /*
  * Core driver operations.
@@ -2416,9 +3191,9 @@ static int mwl8k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         int index = skb_get_queue_mapping(skb);
         int rc;
 
-        if (priv->current_channel == NULL) {
+        if (!priv->radio_on) {
                 printk(KERN_DEBUG "%s: dropped TX frame since radio "
-                       "disabled\n", priv->name);
+                       "disabled\n", wiphy_name(hw->wiphy));
                 dev_kfree_skb(skb);
                 return NETDEV_TX_OK;
         }
@@ -2433,39 +3208,42 @@ static int mwl8k_start(struct ieee80211_hw *hw)
         struct mwl8k_priv *priv = hw->priv;
         int rc;
 
-        rc = request_irq(priv->pdev->irq, &mwl8k_interrupt,
+        rc = request_irq(priv->pdev->irq, mwl8k_interrupt,
                          IRQF_SHARED, MWL8K_NAME, hw);
         if (rc) {
                 printk(KERN_ERR "%s: failed to register IRQ handler\n",
-                       priv->name);
+                       wiphy_name(hw->wiphy));
                 return -EIO;
         }
 
-        /* Enable tx reclaim tasklet */
-        tasklet_enable(&priv->tx_reclaim_task);
+        /* Enable TX reclaim and RX tasklets.  */
+        tasklet_enable(&priv->poll_tx_task);
+        tasklet_enable(&priv->poll_rx_task);
 
         /* Enable interrupts */
         iowrite32(MWL8K_A2H_EVENTS, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
 
         rc = mwl8k_fw_lock(hw);
         if (!rc) {
-                rc = mwl8k_cmd_802_11_radio_enable(hw);
+                rc = mwl8k_cmd_radio_enable(hw);
 
-                if (!rc)
-                        rc = mwl8k_cmd_set_pre_scan(hw);
+                if (!priv->ap_fw) {
+                        if (!rc)
+                                rc = mwl8k_cmd_enable_sniffer(hw, 0);
 
-                if (!rc)
-                        rc = mwl8k_cmd_set_post_scan(hw,
-                                        "\x00\x00\x00\x00\x00\x00");
+                        if (!rc)
+                                rc = mwl8k_cmd_set_pre_scan(hw);
 
-                if (!rc)
-                        rc = mwl8k_cmd_setrateadaptmode(hw, 0);
+                        if (!rc)
+                                rc = mwl8k_cmd_set_post_scan(hw,
+                                                "\x00\x00\x00\x00\x00\x00");
+                }
 
                 if (!rc)
-                        rc = mwl8k_set_wmm(hw, 0);
+                        rc = mwl8k_cmd_set_rateadapt_mode(hw, 0);
 
                 if (!rc)
-                        rc = mwl8k_enable_sniffer(hw, 0);
+                        rc = mwl8k_cmd_set_wmm_mode(hw, 0);
 
                 mwl8k_fw_unlock(hw);
         }
@@ -2473,7 +3251,8 @@ static int mwl8k_start(struct ieee80211_hw *hw)
         if (rc) {
                 iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
                 free_irq(priv->pdev->irq, hw);
-                tasklet_disable(&priv->tx_reclaim_task);
+                tasklet_disable(&priv->poll_tx_task);
+                tasklet_disable(&priv->poll_rx_task);
         }
 
         return rc;
@@ -2484,7 +3263,7 @@ static void mwl8k_stop(struct ieee80211_hw *hw)
         struct mwl8k_priv *priv = hw->priv;
         int i;
 
-        mwl8k_cmd_802_11_radio_disable(hw);
+        mwl8k_cmd_radio_disable(hw);
 
         ieee80211_stop_queues(hw);
 
@@ -2497,68 +3276,83 @@ static void mwl8k_stop(struct ieee80211_hw *hw)
         if (priv->beacon_skb != NULL)
                 dev_kfree_skb(priv->beacon_skb);
 
-        /* Stop tx reclaim tasklet */
-        tasklet_disable(&priv->tx_reclaim_task);
-
-        /* Stop config thread */
-        flush_workqueue(priv->config_wq);
+        /* Stop TX reclaim and RX tasklets.  */
+        tasklet_disable(&priv->poll_tx_task);
+        tasklet_disable(&priv->poll_rx_task);
 
         /* Return all skbs to mac80211 */
         for (i = 0; i < MWL8K_TX_QUEUES; i++)
-                mwl8k_txq_reclaim(hw, i, 1);
+                mwl8k_txq_reclaim(hw, i, INT_MAX, 1);
 }
 
 static int mwl8k_add_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_if_init_conf *conf)
+                               struct ieee80211_vif *vif)
 {
         struct mwl8k_priv *priv = hw->priv;
         struct mwl8k_vif *mwl8k_vif;
+        u32 macids_supported;
+        int macid;
 
         /*
-         * We only support one active interface at a time.
+         * Reject interface creation if sniffer mode is active, as
+         * STA operation is mutually exclusive with hardware sniffer
+         * mode.  (Sniffer mode is only used on STA firmware.)
          */
-        if (priv->vif != NULL)
-                return -EBUSY;
-
-        /*
-         * We only support managed interfaces for now.
-         */
-        if (conf->type != NL80211_IFTYPE_STATION)
+        if (priv->sniffer_enabled) {
+                printk(KERN_INFO "%s: unable to create STA "
+                       "interface due to sniffer mode being enabled\n",
+                       wiphy_name(hw->wiphy));
                 return -EINVAL;
+        }
 
-        /* Clean out driver private area */
-        mwl8k_vif = MWL8K_VIF(conf->vif);
-        memset(mwl8k_vif, 0, sizeof(*mwl8k_vif));
-
-        /* Save the mac address */
-        memcpy(mwl8k_vif->mac_addr, conf->mac_addr, ETH_ALEN);
 
-        /* Back pointer to parent config block */
-        mwl8k_vif->priv = priv;
+        switch (vif->type) {
+        case NL80211_IFTYPE_AP:
+                macids_supported = priv->ap_macids_supported;
+                break;
+        case NL80211_IFTYPE_STATION:
+                macids_supported = priv->sta_macids_supported;
+                break;
+        default:
+                return -EINVAL;
+        }
 
-        /* Setup initial PHY parameters */
-        memcpy(mwl8k_vif->legacy_rates,
-                priv->rates, sizeof(mwl8k_vif->legacy_rates));
-        mwl8k_vif->legacy_nrates = ARRAY_SIZE(priv->rates);
+        macid = ffs(macids_supported & ~priv->macids_used);
+        if (!macid--)
+                return -EBUSY;
 
-        /* Set Initial sequence number to zero */
+        /* Setup driver private area. */
+        mwl8k_vif = MWL8K_VIF(vif);
+        memset(mwl8k_vif, 0, sizeof(*mwl8k_vif));
+        mwl8k_vif->vif = vif;
+        mwl8k_vif->macid = macid;
         mwl8k_vif->seqno = 0;
 
-        priv->vif = conf->vif;
-        priv->current_channel = NULL;
+        /* Set the mac address.  */
+        mwl8k_cmd_set_mac_addr(hw, vif, vif->addr);
+
+        if (priv->ap_fw)
+                mwl8k_cmd_set_new_stn_add_self(hw, vif);
+
+        priv->macids_used |= 1 << mwl8k_vif->macid;
+        list_add_tail(&mwl8k_vif->list, &priv->vif_list);
 
         return 0;
 }
 
 static void mwl8k_remove_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_if_init_conf *conf)
+                                   struct ieee80211_vif *vif)
 {
         struct mwl8k_priv *priv = hw->priv;
+        struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
 
-        if (priv->vif == NULL)
-                return;
+        if (priv->ap_fw)
+                mwl8k_cmd_set_new_stn_del(hw, vif, vif->addr);
+
+        mwl8k_cmd_set_mac_addr(hw, vif, "\x00\x00\x00\x00\x00\x00");
 
-        priv->vif = NULL;
+        priv->macids_used &= ~(1 << mwl8k_vif->macid);
+        list_del(&mwl8k_vif->list);
 }
 
 static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
@@ -2568,8 +3362,7 @@ static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
         int rc;
 
         if (conf->flags & IEEE80211_CONF_IDLE) {
-                mwl8k_cmd_802_11_radio_disable(hw);
-                priv->current_channel = NULL;
+                mwl8k_cmd_radio_disable(hw);
                 return 0;
         }
 
@@ -2577,24 +3370,27 @@ static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
         if (rc)
                 return rc;
 
-        rc = mwl8k_cmd_802_11_radio_enable(hw);
+        rc = mwl8k_cmd_radio_enable(hw);
         if (rc)
                 goto out;
 
-        rc = mwl8k_cmd_set_rf_channel(hw, conf->channel);
+        rc = mwl8k_cmd_set_rf_channel(hw, conf);
         if (rc)
                 goto out;
 
-        priv->current_channel = conf->channel;
-
         if (conf->power_level > 18)
                 conf->power_level = 18;
-        rc = mwl8k_cmd_802_11_rf_tx_power(hw, conf->power_level);
+        rc = mwl8k_cmd_rf_tx_power(hw, conf->power_level);
         if (rc)
                 goto out;
 
-        if (mwl8k_cmd_mimo_config(hw, 0x7, 0x7))
-                rc = -EINVAL;
+        if (priv->ap_fw) {
+                rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_RX, 0x7);
+                if (!rc)
+                        rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_TX, 0x7);
+        } else {
+                rc = mwl8k_cmd_mimo_config(hw, 0x7, 0x7);
+        }
 
 out:
         mwl8k_fw_unlock(hw);
@@ -2602,122 +3398,301 @@ out:
         return rc;
 }
 
-static void mwl8k_bss_info_changed(struct ieee80211_hw *hw,
-                                   struct ieee80211_vif *vif,
-                                   struct ieee80211_bss_conf *info,
-                                   u32 changed)
+static void
+mwl8k_bss_info_changed_sta(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                           struct ieee80211_bss_conf *info, u32 changed)
 {
         struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
+        u32 ap_legacy_rates;
+        u8 ap_mcs_rates[16];
         int rc;
 
-        if (changed & BSS_CHANGED_BSSID)
-                memcpy(mwl8k_vif->bssid, info->bssid, ETH_ALEN);
-
-        if ((changed & BSS_CHANGED_ASSOC) == 0)
+        if (mwl8k_fw_lock(hw))
                 return;
 
-        priv->capture_beacon = false;
+        /*
+         * No need to capture a beacon if we're no longer associated.
+         */
+        if ((changed & BSS_CHANGED_ASSOC) && !vif->bss_conf.assoc)
+                priv->capture_beacon = false;
 
-        rc = mwl8k_fw_lock(hw);
-        if (rc)
-                return;
+        /*
+         * Get the AP's legacy and MCS rates.
+         */
+        if (vif->bss_conf.assoc) {
+                struct ieee80211_sta *ap;
 
-        if (info->assoc) {
-                memcpy(&mwl8k_vif->bss_info, info,
-                        sizeof(struct ieee80211_bss_conf));
+                rcu_read_lock();
 
-                /* Install rates */
-                rc = mwl8k_update_rateset(hw, vif);
-                if (rc)
+                ap = ieee80211_find_sta(vif, vif->bss_conf.bssid);
+                if (ap == NULL) {
+                        rcu_read_unlock();
                         goto out;
+                }
 
-                /* Turn on rate adaptation */
-                rc = mwl8k_cmd_use_fixed_rate(hw, MWL8K_USE_AUTO_RATE,
-                        MWL8K_UCAST_RATE, NULL);
+                if (hw->conf.channel->band == IEEE80211_BAND_2GHZ) {
+                        ap_legacy_rates = ap->supp_rates[IEEE80211_BAND_2GHZ];
+                } else {
+                        ap_legacy_rates =
+                                ap->supp_rates[IEEE80211_BAND_5GHZ] << 5;
+                }
+                memcpy(ap_mcs_rates, ap->ht_cap.mcs.rx_mask, 16);
+
+                rcu_read_unlock();
+        }
+
+        if ((changed & BSS_CHANGED_ASSOC) && vif->bss_conf.assoc) {
+                rc = mwl8k_cmd_set_rate(hw, vif, ap_legacy_rates, ap_mcs_rates);
                 if (rc)
                         goto out;
 
-                /* Set radio preamble */
-                rc = mwl8k_set_radio_preamble(hw, info->use_short_preamble);
+                rc = mwl8k_cmd_use_fixed_rate_sta(hw);
                 if (rc)
                         goto out;
+        }
 
-                /* Set slot time */
-                rc = mwl8k_cmd_set_slot(hw, info->use_short_slot);
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                rc = mwl8k_set_radio_preamble(hw,
+                                vif->bss_conf.use_short_preamble);
                 if (rc)
                         goto out;
+        }
 
-                /* Update peer rate info */
-                rc = mwl8k_cmd_update_sta_db(hw, vif,
-                                MWL8K_STA_DB_MODIFY_ENTRY);
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rc = mwl8k_cmd_set_slot(hw, vif->bss_conf.use_short_slot);
                 if (rc)
                         goto out;
+        }
 
-                /* Set AID */
-                rc = mwl8k_cmd_set_aid(hw, vif);
+        if (vif->bss_conf.assoc &&
+            (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_ERP_CTS_PROT |
+                        BSS_CHANGED_HT))) {
+                rc = mwl8k_cmd_set_aid(hw, vif, ap_legacy_rates);
                 if (rc)
                         goto out;
+        }
 
+        if (vif->bss_conf.assoc &&
+            (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_BEACON_INT))) {
                 /*
                  * Finalize the join.  Tell rx handler to process
                  * next beacon from our BSSID.
                  */
-                memcpy(priv->capture_bssid, mwl8k_vif->bssid, ETH_ALEN);
+                memcpy(priv->capture_bssid, vif->bss_conf.bssid, ETH_ALEN);
                 priv->capture_beacon = true;
-        } else {
-                rc = mwl8k_cmd_update_sta_db(hw, vif, MWL8K_STA_DB_DEL_ENTRY);
-                memset(&mwl8k_vif->bss_info, 0,
-                        sizeof(struct ieee80211_bss_conf));
-                memset(mwl8k_vif->bssid, 0, ETH_ALEN);
         }
 
 out:
         mwl8k_fw_unlock(hw);
 }
 
+static void
+mwl8k_bss_info_changed_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                          struct ieee80211_bss_conf *info, u32 changed)
+{
+        int rc;
+
+        if (mwl8k_fw_lock(hw))
+                return;
+
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                rc = mwl8k_set_radio_preamble(hw,
+                                vif->bss_conf.use_short_preamble);
+                if (rc)
+                        goto out;
+        }
+
+        if (changed & BSS_CHANGED_BASIC_RATES) {
+                int idx;
+                int rate;
+
+                /*
+                 * Use lowest supported basic rate for multicasts
+                 * and management frames (such as probe responses --
+                 * beacons will always go out at 1 Mb/s).
+                 */
+                idx = ffs(vif->bss_conf.basic_rates);
+                if (idx)
+                        idx--;
+
+                if (hw->conf.channel->band == IEEE80211_BAND_2GHZ)
+                        rate = mwl8k_rates_24[idx].hw_value;
+                else
+                        rate = mwl8k_rates_50[idx].hw_value;
+
+                mwl8k_cmd_use_fixed_rate_ap(hw, rate, rate);
+        }
+
+        if (changed & (BSS_CHANGED_BEACON_INT | BSS_CHANGED_BEACON)) {
+                struct sk_buff *skb;
+
+                skb = ieee80211_beacon_get(hw, vif);
+                if (skb != NULL) {
+                        mwl8k_cmd_set_beacon(hw, vif, skb->data, skb->len);
+                        kfree_skb(skb);
+                }
+        }
+
+        if (changed & BSS_CHANGED_BEACON_ENABLED)
+                mwl8k_cmd_bss_start(hw, vif, info->enable_beacon);
+
+out:
+        mwl8k_fw_unlock(hw);
+}
+
+static void
+mwl8k_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                       struct ieee80211_bss_conf *info, u32 changed)
+{
+        struct mwl8k_priv *priv = hw->priv;
+
+        if (!priv->ap_fw)
+                mwl8k_bss_info_changed_sta(hw, vif, info, changed);
+        else
+                mwl8k_bss_info_changed_ap(hw, vif, info, changed);
+}
+
 static u64 mwl8k_prepare_multicast(struct ieee80211_hw *hw,
                                    int mc_count, struct dev_addr_list *mclist)
 {
         struct mwl8k_cmd_pkt *cmd;
 
-        cmd = __mwl8k_cmd_mac_multicast_adr(hw, mc_count, mclist);
+        /*
+         * Synthesize and return a command packet that programs the
+         * hardware multicast address filter.  At this point we don't
+         * know whether FIF_ALLMULTI is being requested, but if it is,
+         * we'll end up throwing this packet away and creating a new
+         * one in mwl8k_configure_filter().
+         */
+        cmd = __mwl8k_cmd_mac_multicast_adr(hw, 0, mc_count, mclist);
 
         return (unsigned long)cmd;
 }
 
+static int
+mwl8k_configure_filter_sniffer(struct ieee80211_hw *hw,
+                               unsigned int changed_flags,
+                               unsigned int *total_flags)
+{
+        struct mwl8k_priv *priv = hw->priv;
+
+        /*
+         * Hardware sniffer mode is mutually exclusive with STA
+         * operation, so refuse to enable sniffer mode if a STA
+         * interface is active.
+         */
+        if (!list_empty(&priv->vif_list)) {
+                if (net_ratelimit())
+                        printk(KERN_INFO "%s: not enabling sniffer "
+                               "mode because STA interface is active\n",
+                               wiphy_name(hw->wiphy));
+                return 0;
+        }
+
+        if (!priv->sniffer_enabled) {
+                if (mwl8k_cmd_enable_sniffer(hw, 1))
+                        return 0;
+                priv->sniffer_enabled = true;
+        }
+
+        *total_flags &= FIF_PROMISC_IN_BSS | FIF_ALLMULTI |
+                        FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL |
+                        FIF_OTHER_BSS;
+
+        return 1;
+}
+
+static struct mwl8k_vif *mwl8k_first_vif(struct mwl8k_priv *priv)
+{
+        if (!list_empty(&priv->vif_list))
+                return list_entry(priv->vif_list.next, struct mwl8k_vif, list);
+
+        return NULL;
+}
+
 static void mwl8k_configure_filter(struct ieee80211_hw *hw,
                                    unsigned int changed_flags,
                                    unsigned int *total_flags,
                                    u64 multicast)
 {
         struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_cmd_pkt *multicast_adr_cmd;
+        struct mwl8k_cmd_pkt *cmd = (void *)(unsigned long)multicast;
+
+        /*
+         * AP firmware doesn't allow fine-grained control over
+         * the receive filter.
+         */
+        if (priv->ap_fw) {
+                *total_flags &= FIF_ALLMULTI | FIF_BCN_PRBRESP_PROMISC;
+                kfree(cmd);
+                return;
+        }
+
+        /*
+         * Enable hardware sniffer mode if FIF_CONTROL or
+         * FIF_OTHER_BSS is requested.
+         */
+        if (*total_flags & (FIF_CONTROL | FIF_OTHER_BSS) &&
+            mwl8k_configure_filter_sniffer(hw, changed_flags, total_flags)) {
+                kfree(cmd);
+                return;
+        }
 
         /* Clear unsupported feature flags */
-        *total_flags &= FIF_BCN_PRBRESP_PROMISC;
+        *total_flags &= FIF_ALLMULTI | FIF_BCN_PRBRESP_PROMISC;
 
-        if (mwl8k_fw_lock(hw))
+        if (mwl8k_fw_lock(hw)) {
+                kfree(cmd);
                 return;
+        }
+
+        if (priv->sniffer_enabled) {
+                mwl8k_cmd_enable_sniffer(hw, 0);
+                priv->sniffer_enabled = false;
+        }
 
         if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
-                if (*total_flags & FIF_BCN_PRBRESP_PROMISC)
+                if (*total_flags & FIF_BCN_PRBRESP_PROMISC) {
+                        /*
+                         * Disable the BSS filter.
+                         */
                         mwl8k_cmd_set_pre_scan(hw);
-                else {
-                        u8 *bssid;
-
-                        bssid = "\x00\x00\x00\x00\x00\x00";
-                        if (priv->vif != NULL)
-                                bssid = MWL8K_VIF(priv->vif)->bssid;
+                } else {
+                        struct mwl8k_vif *mwl8k_vif;
+                        const u8 *bssid;
+
+                        /*
+                         * Enable the BSS filter.
+                         *
+                         * If there is an active STA interface, use that
+                         * interface's BSSID, otherwise use a dummy one
+                         * (where the OUI part needs to be nonzero for
+                         * the BSSID to be accepted by POST_SCAN).
+                         */
+                        mwl8k_vif = mwl8k_first_vif(priv);
+                        if (mwl8k_vif != NULL)
+                                bssid = mwl8k_vif->vif->bss_conf.bssid;
+                        else
+                                bssid = "\x01\x00\x00\x00\x00\x00";
 
                         mwl8k_cmd_set_post_scan(hw, bssid);
                 }
         }
 
-        multicast_adr_cmd = (void *)(unsigned long)multicast;
-        if (multicast_adr_cmd != NULL) {
-                mwl8k_post_cmd(hw, multicast_adr_cmd);
-                kfree(multicast_adr_cmd);
+        /*
+         * If FIF_ALLMULTI is being requested, throw away the command
+         * packet that ->prepare_multicast() built and replace it with
+         * a command packet that enables reception of all multicast
+         * packets.
+         */
+        if (*total_flags & FIF_ALLMULTI) {
+                kfree(cmd);
+                cmd = __mwl8k_cmd_mac_multicast_adr(hw, 1, 0, NULL);
+        }
+
+        if (cmd != NULL) {
+                mwl8k_post_cmd(hw, cmd);
+                kfree(cmd);
         }
 
         mwl8k_fw_unlock(hw);
@@ -2725,7 +3700,39 @@ static void mwl8k_configure_filter(struct ieee80211_hw *hw,
 
 static int mwl8k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
 {
-        return mwl8k_rts_threshold(hw, MWL8K_CMD_SET, value);
+        return mwl8k_cmd_set_rts_threshold(hw, value);
+}
+
+static int mwl8k_sta_remove(struct ieee80211_hw *hw,
+                            struct ieee80211_vif *vif,
+                            struct ieee80211_sta *sta)
+{
+        struct mwl8k_priv *priv = hw->priv;
+
+        if (priv->ap_fw)
+                return mwl8k_cmd_set_new_stn_del(hw, vif, sta->addr);
+        else
+                return mwl8k_cmd_update_stadb_del(hw, vif, sta->addr);
+}
+
+static int mwl8k_sta_add(struct ieee80211_hw *hw,
+                         struct ieee80211_vif *vif,
+                         struct ieee80211_sta *sta)
+{
+        struct mwl8k_priv *priv = hw->priv;
+        int ret;
+
+        if (!priv->ap_fw) {
+                ret = mwl8k_cmd_update_stadb_add(hw, vif, sta);
+                if (ret >= 0) {
+                        MWL8K_STA(sta)->peer_id = ret;
+                        return 0;
+                }
+
+                return ret;
+        }
+
+        return mwl8k_cmd_set_new_stn_add(hw, vif, sta);
 }
 
 static int mwl8k_conf_tx(struct ieee80211_hw *hw, u16 queue,
@@ -2737,14 +3744,14 @@ static int mwl8k_conf_tx(struct ieee80211_hw *hw, u16 queue,
         rc = mwl8k_fw_lock(hw);
         if (!rc) {
                 if (!priv->wmm_enabled)
-                        rc = mwl8k_set_wmm(hw, 1);
+                        rc = mwl8k_cmd_set_wmm_mode(hw, 1);
 
                 if (!rc)
-                        rc = mwl8k_set_edca_params(hw, queue,
-                                                   params->cw_min,
-                                                   params->cw_max,
-                                                   params->aifs,
-                                                   params->txop);
+                        rc = mwl8k_cmd_set_edca_params(hw, queue,
+                                                       params->cw_min,
+                                                       params->cw_max,
+                                                       params->aifs,
+                                                       params->txop);
 
                 mwl8k_fw_unlock(hw);
         }
@@ -2752,28 +3759,26 @@ static int mwl8k_conf_tx(struct ieee80211_hw *hw, u16 queue,
         return rc;
 }
 
-static int mwl8k_get_tx_stats(struct ieee80211_hw *hw,
-                              struct ieee80211_tx_queue_stats *stats)
+static int mwl8k_get_stats(struct ieee80211_hw *hw,
+                           struct ieee80211_low_level_stats *stats)
 {
-        struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_tx_queue *txq;
-        int index;
-
-        spin_lock_bh(&priv->tx_lock);
-        for (index = 0; index < MWL8K_TX_QUEUES; index++) {
-                txq = priv->txq + index;
-                memcpy(&stats[index], &txq->tx_stats,
-                        sizeof(struct ieee80211_tx_queue_stats));
-        }
-        spin_unlock_bh(&priv->tx_lock);
-
-        return 0;
+        return mwl8k_cmd_get_stat(hw, stats);
 }
 
-static int mwl8k_get_stats(struct ieee80211_hw *hw,
-                           struct ieee80211_low_level_stats *stats)
+static int
+mwl8k_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                   enum ieee80211_ampdu_mlme_action action,
+                   struct ieee80211_sta *sta, u16 tid, u16 *ssn)
 {
-        return mwl8k_cmd_802_11_get_stat(hw, stats);
+        switch (action) {
+        case IEEE80211_AMPDU_RX_START:
+        case IEEE80211_AMPDU_RX_STOP:
+                if (!(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
+                        return -ENOTSUPP;
+                return 0;
+        default:
+                return -ENOTSUPP;
+        }
 }
 
 static const struct ieee80211_ops mwl8k_ops = {
@@ -2787,41 +3792,77 @@ static const struct ieee80211_ops mwl8k_ops = {
         .prepare_multicast      = mwl8k_prepare_multicast,
         .configure_filter       = mwl8k_configure_filter,
         .set_rts_threshold      = mwl8k_set_rts_threshold,
+        .sta_add                = mwl8k_sta_add,
+        .sta_remove             = mwl8k_sta_remove,
         .conf_tx                = mwl8k_conf_tx,
-        .get_tx_stats           = mwl8k_get_tx_stats,
         .get_stats              = mwl8k_get_stats,
+        .ampdu_action           = mwl8k_ampdu_action,
 };
 
-static void mwl8k_tx_reclaim_handler(unsigned long data)
-{
-        int i;
-        struct ieee80211_hw *hw = (struct ieee80211_hw *) data;
-        struct mwl8k_priv *priv = hw->priv;
-
-        spin_lock_bh(&priv->tx_lock);
-        for (i = 0; i < MWL8K_TX_QUEUES; i++)
-                mwl8k_txq_reclaim(hw, i, 0);
-
-        if (priv->tx_wait != NULL && mwl8k_txq_busy(priv) == 0) {
-                complete(priv->tx_wait);
-                priv->tx_wait = NULL;
-        }
-        spin_unlock_bh(&priv->tx_lock);
-}
-
 static void mwl8k_finalize_join_worker(struct work_struct *work)
 {
         struct mwl8k_priv *priv =
                 container_of(work, struct mwl8k_priv, finalize_join_worker);
         struct sk_buff *skb = priv->beacon_skb;
-        u8 dtim = MWL8K_VIF(priv->vif)->bss_info.dtim_period;
+        struct ieee80211_mgmt *mgmt = (void *)skb->data;
+        int len = skb->len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
+        const u8 *tim = cfg80211_find_ie(WLAN_EID_TIM,
+                                         mgmt->u.beacon.variable, len);
+        int dtim_period = 1;
 
-        mwl8k_finalize_join(priv->hw, skb->data, skb->len, dtim);
-        dev_kfree_skb(skb);
+        if (tim && tim[1] >= 2)
+                dtim_period = tim[3];
+
+        mwl8k_cmd_finalize_join(priv->hw, skb->data, skb->len, dtim_period);
 
+        dev_kfree_skb(skb);
         priv->beacon_skb = NULL;
 }
 
+enum {
+        MWL8363 = 0,
+        MWL8687,
+        MWL8366,
+};
+
+static struct mwl8k_device_info mwl8k_info_tbl[] __devinitdata = {
+        [MWL8363] = {
+                .part_name      = "88w8363",
+                .helper_image   = "mwl8k/helper_8363.fw",
+                .fw_image       = "mwl8k/fmimage_8363.fw",
+        },
+        [MWL8687] = {
+                .part_name      = "88w8687",
+                .helper_image   = "mwl8k/helper_8687.fw",
+                .fw_image       = "mwl8k/fmimage_8687.fw",
+        },
+        [MWL8366] = {
+                .part_name      = "88w8366",
+                .helper_image   = "mwl8k/helper_8366.fw",
+                .fw_image       = "mwl8k/fmimage_8366.fw",
+                .ap_rxd_ops     = &rxd_8366_ap_ops,
+        },
+};
+
+MODULE_FIRMWARE("mwl8k/helper_8363.fw");
+MODULE_FIRMWARE("mwl8k/fmimage_8363.fw");
+MODULE_FIRMWARE("mwl8k/helper_8687.fw");
+MODULE_FIRMWARE("mwl8k/fmimage_8687.fw");
+MODULE_FIRMWARE("mwl8k/helper_8366.fw");
+MODULE_FIRMWARE("mwl8k/fmimage_8366.fw");
+
+static DEFINE_PCI_DEVICE_TABLE(mwl8k_pci_id_table) = {
+        { PCI_VDEVICE(MARVELL, 0x2a0a), .driver_data = MWL8363, },
+        { PCI_VDEVICE(MARVELL, 0x2a0c), .driver_data = MWL8363, },
+        { PCI_VDEVICE(MARVELL, 0x2a24), .driver_data = MWL8363, },
+        { PCI_VDEVICE(MARVELL, 0x2a2b), .driver_data = MWL8687, },
+        { PCI_VDEVICE(MARVELL, 0x2a30), .driver_data = MWL8687, },
+        { PCI_VDEVICE(MARVELL, 0x2a40), .driver_data = MWL8366, },
+        { PCI_VDEVICE(MARVELL, 0x2a43), .driver_data = MWL8366, },
+        { },
+};
+MODULE_DEVICE_TABLE(pci, mwl8k_pci_id_table);
+
 static int __devinit mwl8k_probe(struct pci_dev *pdev,
                                  const struct pci_device_id *id)
 {
@@ -2836,6 +3877,7 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
                 printed_version = 1;
         }
 
+
         rc = pci_enable_device(pdev);
         if (rc) {
                 printk(KERN_ERR "%s: Cannot enable new PCI device\n",
@@ -2847,11 +3889,12 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
         if (rc) {
                 printk(KERN_ERR "%s: Cannot obtain PCI resources\n",
                        MWL8K_NAME);
-                return rc;
+                goto err_disable_device;
         }
 
         pci_set_master(pdev);
 
+
         hw = ieee80211_alloc_hw(sizeof(*priv), &mwl8k_ops);
         if (hw == NULL) {
                 printk(KERN_ERR "%s: ieee80211 alloc failed\n", MWL8K_NAME);
@@ -2859,32 +3902,76 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
                 goto err_free_reg;
         }
 
+        SET_IEEE80211_DEV(hw, &pdev->dev);
+        pci_set_drvdata(pdev, hw);
+
         priv = hw->priv;
         priv->hw = hw;
         priv->pdev = pdev;
-        priv->wmm_enabled = false;
-        priv->pending_tx_pkts = 0;
-        strncpy(priv->name, MWL8K_NAME, sizeof(priv->name));
+        priv->device_info = &mwl8k_info_tbl[id->driver_data];
 
-        SET_IEEE80211_DEV(hw, &pdev->dev);
-        pci_set_drvdata(pdev, hw);
 
+        priv->sram = pci_iomap(pdev, 0, 0x10000);
+        if (priv->sram == NULL) {
+                printk(KERN_ERR "%s: Cannot map device SRAM\n",
+                       wiphy_name(hw->wiphy));
+                goto err_iounmap;
+        }
+
+        /*
+         * If BAR0 is a 32 bit BAR, the register BAR will be BAR1.
+         * If BAR0 is a 64 bit BAR, the register BAR will be BAR2.
+         */
         priv->regs = pci_iomap(pdev, 1, 0x10000);
         if (priv->regs == NULL) {
-                printk(KERN_ERR "%s: Cannot map device memory\n", priv->name);
-                goto err_iounmap;
+                priv->regs = pci_iomap(pdev, 2, 0x10000);
+                if (priv->regs == NULL) {
+                        printk(KERN_ERR "%s: Cannot map device registers\n",
+                               wiphy_name(hw->wiphy));
+                        goto err_iounmap;
+                }
+        }
+
+
+        /* Reset firmware and hardware */
+        mwl8k_hw_reset(priv);
+
+        /* Ask userland hotplug daemon for the device firmware */
+        rc = mwl8k_request_firmware(priv);
+        if (rc) {
+                printk(KERN_ERR "%s: Firmware files not found\n",
+                       wiphy_name(hw->wiphy));
+                goto err_stop_firmware;
         }
 
-        memcpy(priv->channels, mwl8k_channels, sizeof(mwl8k_channels));
-        priv->band.band = IEEE80211_BAND_2GHZ;
-        priv->band.channels = priv->channels;
-        priv->band.n_channels = ARRAY_SIZE(mwl8k_channels);
-        priv->band.bitrates = priv->rates;
-        priv->band.n_bitrates = ARRAY_SIZE(mwl8k_rates);
-        hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band;
+        /* Load firmware into hardware */
+        rc = mwl8k_load_firmware(hw);
+        if (rc) {
+                printk(KERN_ERR "%s: Cannot start firmware\n",
+                       wiphy_name(hw->wiphy));
+                goto err_stop_firmware;
+        }
+
+        /* Reclaim memory once firmware is successfully loaded */
+        mwl8k_release_firmware(priv);
+
+
+        if (priv->ap_fw) {
+                priv->rxd_ops = priv->device_info->ap_rxd_ops;
+                if (priv->rxd_ops == NULL) {
+                        printk(KERN_ERR "%s: Driver does not have AP "
+                               "firmware image support for this hardware\n",
+                               wiphy_name(hw->wiphy));
+                        goto err_stop_firmware;
+                }
+        } else {
+                priv->rxd_ops = &rxd_sta_ops;
+        }
+
+        priv->sniffer_enabled = false;
+        priv->wmm_enabled = false;
+        priv->pending_tx_pkts = 0;
 
-        BUILD_BUG_ON(sizeof(priv->rates) != sizeof(mwl8k_rates));
-        memcpy(priv->rates, mwl8k_rates, sizeof(mwl8k_rates));
 
         /*
          * Extra headroom is the size of the required DMA header
@@ -2897,12 +3984,13 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
 
         hw->queues = MWL8K_TX_QUEUES;
 
-        hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
-
         /* Set rssi and noise values to dBm */
         hw->flags |= IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_NOISE_DBM;
         hw->vif_data_size = sizeof(struct mwl8k_vif);
-        priv->vif = NULL;
+        hw->sta_data_size = sizeof(struct mwl8k_sta);
+
+        priv->macids_used = 0;
+        INIT_LIST_HEAD(&priv->vif_list);
 
         /* Set default radio state and preamble */
         priv->radio_on = 0;
@@ -2911,34 +3999,31 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
         /* Finalize join worker */
         INIT_WORK(&priv->finalize_join_worker, mwl8k_finalize_join_worker);
 
-        /* TX reclaim tasklet */
-        tasklet_init(&priv->tx_reclaim_task,
-                        mwl8k_tx_reclaim_handler, (unsigned long)hw);
-        tasklet_disable(&priv->tx_reclaim_task);
-
-        /* Config workthread */
-        priv->config_wq = create_singlethread_workqueue("mwl8k_config");
-        if (priv->config_wq == NULL)
-                goto err_iounmap;
+        /* TX reclaim and RX tasklets.  */
+        tasklet_init(&priv->poll_tx_task, mwl8k_tx_poll, (unsigned long)hw);
+        tasklet_disable(&priv->poll_tx_task);
+        tasklet_init(&priv->poll_rx_task, mwl8k_rx_poll, (unsigned long)hw);
+        tasklet_disable(&priv->poll_rx_task);
 
         /* Power management cookie */
         priv->cookie = pci_alloc_consistent(priv->pdev, 4, &priv->cookie_dma);
         if (priv->cookie == NULL)
-                goto err_iounmap;
+                goto err_stop_firmware;
 
         rc = mwl8k_rxq_init(hw, 0);
         if (rc)
-                goto err_iounmap;
+                goto err_free_cookie;
         rxq_refill(hw, 0, INT_MAX);
 
         mutex_init(&priv->fw_mutex);
         priv->fw_mutex_owner = NULL;
         priv->fw_mutex_depth = 0;
-        priv->tx_wait = NULL;
         priv->hostcmd_wait = NULL;
 
         spin_lock_init(&priv->tx_lock);
 
+        priv->tx_wait = NULL;
+
         for (i = 0; i < MWL8K_TX_QUEUES; i++) {
                 rc = mwl8k_txq_init(hw, i);
                 if (rc)
@@ -2947,56 +4032,59 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
 
         iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
         iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
-        iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_CLEAR_SEL);
+        iowrite32(MWL8K_A2H_INT_TX_DONE | MWL8K_A2H_INT_RX_READY,
+                  priv->regs + MWL8K_HIU_A2H_INTERRUPT_CLEAR_SEL);
         iowrite32(0xffffffff, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
 
-        rc = request_irq(priv->pdev->irq, &mwl8k_interrupt,
+        rc = request_irq(priv->pdev->irq, mwl8k_interrupt,
                          IRQF_SHARED, MWL8K_NAME, hw);
         if (rc) {
                 printk(KERN_ERR "%s: failed to register IRQ handler\n",
-                       priv->name);
+                       wiphy_name(hw->wiphy));
                 goto err_free_queues;
         }
 
-        /* Reset firmware and hardware */
-        mwl8k_hw_reset(priv);
-
-        /* Ask userland hotplug daemon for the device firmware */
-        rc = mwl8k_request_firmware(priv, (u32)id->driver_data);
-        if (rc) {
-                printk(KERN_ERR "%s: Firmware files not found\n", priv->name);
-                goto err_free_irq;
-        }
-
-        /* Load firmware into hardware */
-        rc = mwl8k_load_firmware(priv);
-        if (rc) {
-                printk(KERN_ERR "%s: Cannot start firmware\n", priv->name);
-                goto err_stop_firmware;
-        }
-
-        /* Reclaim memory once firmware is successfully loaded */
-        mwl8k_release_firmware(priv);
-
         /*
          * Temporarily enable interrupts.  Initial firmware host
-         * commands use interrupts and avoids polling.  Disable
+         * commands use interrupts and avoid polling.  Disable
          * interrupts when done.
          */
         iowrite32(MWL8K_A2H_EVENTS, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
 
         /* Get config data, mac addrs etc */
-        rc = mwl8k_cmd_get_hw_spec(hw);
+        if (priv->ap_fw) {
+                rc = mwl8k_cmd_get_hw_spec_ap(hw);
+                if (!rc)
+                        rc = mwl8k_cmd_set_hw_spec(hw);
+        } else {
+                rc = mwl8k_cmd_get_hw_spec_sta(hw);
+        }
         if (rc) {
-                printk(KERN_ERR "%s: Cannot initialise firmware\n", priv->name);
-                goto err_stop_firmware;
+                printk(KERN_ERR "%s: Cannot initialise firmware\n",
+                       wiphy_name(hw->wiphy));
+                goto err_free_irq;
         }
 
+        hw->wiphy->interface_modes = 0;
+        if (priv->ap_macids_supported)
+                hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP);
+        if (priv->sta_macids_supported)
+                hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_STATION);
+
+
         /* Turn radio off */
-        rc = mwl8k_cmd_802_11_radio_disable(hw);
+        rc = mwl8k_cmd_radio_disable(hw);
         if (rc) {
-                printk(KERN_ERR "%s: Cannot disable\n", priv->name);
-                goto err_stop_firmware;
+                printk(KERN_ERR "%s: Cannot disable\n", wiphy_name(hw->wiphy));
+                goto err_free_irq;
+        }
+
+        /* Clear MAC address */
+        rc = mwl8k_cmd_set_mac_addr(hw, NULL, "\x00\x00\x00\x00\x00\x00");
+        if (rc) {
+                printk(KERN_ERR "%s: Cannot clear MAC address\n",
+                       wiphy_name(hw->wiphy));
+                goto err_free_irq;
         }
 
         /* Disable interrupts */
@@ -3005,22 +4093,20 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
 
         rc = ieee80211_register_hw(hw);
         if (rc) {
-                printk(KERN_ERR "%s: Cannot register device\n", priv->name);
-                goto err_stop_firmware;
+                printk(KERN_ERR "%s: Cannot register device\n",
+                       wiphy_name(hw->wiphy));
+                goto err_free_queues;
         }
 
-        printk(KERN_INFO "%s: 88w%u v%d, %pM, firmware version %u.%u.%u.%u\n",
-               wiphy_name(hw->wiphy), priv->part_num, priv->hw_rev,
-               hw->wiphy->perm_addr,
+        printk(KERN_INFO "%s: %s v%d, %pM, %s firmware %u.%u.%u.%u\n",
+               wiphy_name(hw->wiphy), priv->device_info->part_name,
+               priv->hw_rev, hw->wiphy->perm_addr,
+               priv->ap_fw ? "AP" : "STA",
                (priv->fw_rev >> 24) & 0xff, (priv->fw_rev >> 16) & 0xff,
                (priv->fw_rev >> 8) & 0xff, priv->fw_rev & 0xff);
 
         return 0;
 
-err_stop_firmware:
-        mwl8k_hw_reset(priv);
-        mwl8k_release_firmware(priv);
-
 err_free_irq:
         iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
         free_irq(priv->pdev->irq, hw);
@@ -3030,22 +4116,29 @@ err_free_queues:
                 mwl8k_txq_deinit(hw, i);
         mwl8k_rxq_deinit(hw, 0);
 
-err_iounmap:
+err_free_cookie:
         if (priv->cookie != NULL)
                 pci_free_consistent(priv->pdev, 4,
                                 priv->cookie, priv->cookie_dma);
 
+err_stop_firmware:
+        mwl8k_hw_reset(priv);
+        mwl8k_release_firmware(priv);
+
+err_iounmap:
         if (priv->regs != NULL)
                 pci_iounmap(pdev, priv->regs);
 
-        if (priv->config_wq != NULL)
-                destroy_workqueue(priv->config_wq);
+        if (priv->sram != NULL)
+                pci_iounmap(pdev, priv->sram);
 
         pci_set_drvdata(pdev, NULL);
         ieee80211_free_hw(hw);
 
 err_free_reg:
         pci_release_regions(pdev);
+
+err_disable_device:
         pci_disable_device(pdev);
 
         return rc;
@@ -3070,28 +4163,26 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
 
         ieee80211_unregister_hw(hw);
 
-        /* Remove tx reclaim tasklet */
-        tasklet_kill(&priv->tx_reclaim_task);
-
-        /* Stop config thread */
-        destroy_workqueue(priv->config_wq);
+        /* Remove TX reclaim and RX tasklets.  */
+        tasklet_kill(&priv->poll_tx_task);
+        tasklet_kill(&priv->poll_rx_task);
 
         /* Stop hardware */
         mwl8k_hw_reset(priv);
 
         /* Return all skbs to mac80211 */
         for (i = 0; i < MWL8K_TX_QUEUES; i++)
-                mwl8k_txq_reclaim(hw, i, 1);
+                mwl8k_txq_reclaim(hw, i, INT_MAX, 1);
 
         for (i = 0; i < MWL8K_TX_QUEUES; i++)
                 mwl8k_txq_deinit(hw, i);
 
         mwl8k_rxq_deinit(hw, 0);
 
-        pci_free_consistent(priv->pdev, 4,
-                                priv->cookie, priv->cookie_dma);
+        pci_free_consistent(priv->pdev, 4, priv->cookie, priv->cookie_dma);
 
         pci_iounmap(pdev, priv->regs);
+        pci_iounmap(pdev, priv->sram);
         pci_set_drvdata(pdev, NULL);
         ieee80211_free_hw(hw);
         pci_release_regions(pdev);
@@ -3100,7 +4191,7 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
 
 static struct pci_driver mwl8k_driver = {
         .name           = MWL8K_NAME,
-        .id_table       = mwl8k_table,
+        .id_table       = mwl8k_pci_id_table,
         .probe          = mwl8k_probe,
         .remove         = __devexit_p(mwl8k_remove),
         .shutdown       = __devexit_p(mwl8k_shutdown),
@@ -3118,3 +4209,8 @@ static void __exit mwl8k_exit(void)
 
 module_init(mwl8k_init);
 module_exit(mwl8k_exit);
+
+MODULE_DESCRIPTION(MWL8K_DESC);
+MODULE_VERSION(MWL8K_VERSION);
+MODULE_AUTHOR("Lennert Buytenhek <buytenh@marvell.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/netwave_cs.c b/drivers/net/wireless/netwave_cs.c
deleted file mode 100644
index 9498b46c99a4..000000000000
--- a/drivers/net/wireless/netwave_cs.c
+++ /dev/null
@@ -1,1389 +0,0 @@
-/*********************************************************************
- *                
- * Filename:      netwave_cs.c
- * Version:       0.4.1
- * Description:   Netwave AirSurfer Wireless LAN PC Card driver
- * Status:        Experimental.
- * Authors:       John Markus Bjørndalen <johnm@cs.uit.no>
- *                Dag Brattli <dagb@cs.uit.no>
- *                David Hinds <dahinds@users.sourceforge.net>
- * Created at:    A long time ago!
- * Modified at:   Mon Nov 10 11:54:37 1997
- * Modified by:   Dag Brattli <dagb@cs.uit.no>
- * 
- *     Copyright (c) 1997 University of Tromsø, Norway
- *
- * Revision History:
- *
- *   08-Nov-97 15:14:47   John Markus Bjørndalen <johnm@cs.uit.no>
- *    - Fixed some bugs in netwave_rx and cleaned it up a bit. 
- *      (One of the bugs would have destroyed packets when receiving
- *      multiple packets per interrupt). 
- *    - Cleaned up parts of newave_hw_xmit. 
- *    - A few general cleanups. 
- *   24-Oct-97 13:17:36   Dag Brattli <dagb@cs.uit.no>
- *    - Fixed netwave_rx receive function (got updated docs)
- *   Others:
- *    - Changed name from xircnw to netwave, take a look at 
- *      http://www.netwave-wireless.com
- *    - Some reorganizing of the code
- *    - Removed possible race condition between interrupt handler and transmit
- *      function
- *    - Started to add wireless extensions, but still needs some coding
- *    - Added watchdog for better handling of transmission timeouts 
- *      (hopefully this works better)
- ********************************************************************/
-
-/* To have statistics (just packets sent) define this */
-#undef NETWAVE_STATS
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/types.h>
-#include <linux/fcntl.h>
-#include <linux/interrupt.h>
-#include <linux/ptrace.h>
-#include <linux/ioport.h>
-#include <linux/in.h>
-#include <linux/slab.h>
-#include <linux/string.h>
-#include <linux/timer.h>
-#include <linux/errno.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/skbuff.h>
-#include <linux/bitops.h>
-#include <linux/wireless.h>
-#include <net/iw_handler.h>
-
-#include <pcmcia/cs_types.h>
-#include <pcmcia/cs.h>
-#include <pcmcia/cistpl.h>
-#include <pcmcia/cisreg.h>
-#include <pcmcia/ds.h>
-#include <pcmcia/mem_op.h>
-
-#include <asm/system.h>
-#include <asm/io.h>
-#include <asm/dma.h>
-
-#define NETWAVE_REGOFF         0x8000
-/* The Netwave IO registers, offsets to iobase */
-#define NETWAVE_REG_COR        0x0
-#define NETWAVE_REG_CCSR       0x2
-#define NETWAVE_REG_ASR        0x4
-#define NETWAVE_REG_IMR        0xa
-#define NETWAVE_REG_PMR        0xc
-#define NETWAVE_REG_IOLOW      0x6
-#define NETWAVE_REG_IOHI       0x7
-#define NETWAVE_REG_IOCONTROL  0x8
-#define NETWAVE_REG_DATA       0xf
-/* The Netwave Extended IO registers, offsets to RamBase */
-#define NETWAVE_EREG_ASCC      0x114
-#define NETWAVE_EREG_RSER      0x120
-#define NETWAVE_EREG_RSERW     0x124
-#define NETWAVE_EREG_TSER      0x130
-#define NETWAVE_EREG_TSERW     0x134
-#define NETWAVE_EREG_CB        0x100
-#define NETWAVE_EREG_SPCQ      0x154
-#define NETWAVE_EREG_SPU       0x155
-#define NETWAVE_EREG_LIF       0x14e
-#define NETWAVE_EREG_ISPLQ     0x156
-#define NETWAVE_EREG_HHC       0x158
-#define NETWAVE_EREG_NI        0x16e
-#define NETWAVE_EREG_MHS       0x16b
-#define NETWAVE_EREG_TDP       0x140
-#define NETWAVE_EREG_RDP       0x150
-#define NETWAVE_EREG_PA        0x160
-#define NETWAVE_EREG_EC        0x180
-#define NETWAVE_EREG_CRBP      0x17a
-#define NETWAVE_EREG_ARW       0x166
-
-/*
- * Commands used in the extended command buffer
- * NETWAVE_EREG_CB (0x100-0x10F) 
- */
-#define NETWAVE_CMD_NOP        0x00
-#define NETWAVE_CMD_SRC        0x01
-#define NETWAVE_CMD_STC        0x02
-#define NETWAVE_CMD_AMA        0x03
-#define NETWAVE_CMD_DMA        0x04
-#define NETWAVE_CMD_SAMA       0x05
-#define NETWAVE_CMD_ER         0x06
-#define NETWAVE_CMD_DR         0x07
-#define NETWAVE_CMD_TL         0x08
-#define NETWAVE_CMD_SRP        0x09
-#define NETWAVE_CMD_SSK        0x0a
-#define NETWAVE_CMD_SMD        0x0b
-#define NETWAVE_CMD_SAPD       0x0c
-#define NETWAVE_CMD_SSS        0x11
-/* End of Command marker */
-#define NETWAVE_CMD_EOC        0x00
-
-/* ASR register bits */
-#define NETWAVE_ASR_RXRDY   0x80
-#define NETWAVE_ASR_TXBA    0x01
-
-#define TX_TIMEOUT              ((32*HZ)/100)
-
-static const unsigned int imrConfRFU1 = 0x10; /* RFU interrupt mask, keep high */
-static const unsigned int imrConfIENA = 0x02; /* Interrupt enable */
-
-static const unsigned int corConfIENA   = 0x01; /* Interrupt enable */
-static const unsigned int corConfLVLREQ = 0x40; /* Keep high */
-
-static const unsigned int rxConfRxEna  = 0x80; /* Receive Enable */
-static const unsigned int rxConfMAC    = 0x20; /* MAC host receive mode*/ 
-static const unsigned int rxConfPro    = 0x10; /* Promiscuous */
-static const unsigned int rxConfAMP    = 0x08; /* Accept Multicast Packets */
-static const unsigned int rxConfBcast  = 0x04; /* Accept Broadcast Packets */
-
-static const unsigned int txConfTxEna  = 0x80; /* Transmit Enable */
-static const unsigned int txConfMAC    = 0x20; /* Host sends MAC mode */
-static const unsigned int txConfEUD    = 0x10; /* Enable Uni-Data packets */
-static const unsigned int txConfKey    = 0x02; /* Scramble data packets */
-static const unsigned int txConfLoop   = 0x01; /* Loopback mode */
-
-/*
-   All the PCMCIA modules use PCMCIA_DEBUG to control debugging.  If
-   you do not define PCMCIA_DEBUG at all, all the debug code will be
-   left out.  If you compile with PCMCIA_DEBUG=0, the debug code will
-   be present but disabled -- but it can then be enabled for specific
-   modules at load time with a 'pc_debug=#' option to insmod.
-*/
-
-#ifdef PCMCIA_DEBUG
-static int pc_debug = PCMCIA_DEBUG;
-module_param(pc_debug, int, 0);
-#define DEBUG(n, args...) if (pc_debug>(n)) printk(KERN_DEBUG args)
-static char *version =
-"netwave_cs.c 0.3.0 Thu Jul 17 14:36:02 1997 (John Markus Bjørndalen)\n";
-#else
-#define DEBUG(n, args...)
-#endif
-
-/*====================================================================*/
-
-/* Parameters that can be set with 'insmod' */
-
-/* Choose the domain, default is 0x100 */
-static u_int  domain = 0x100;
-
-/* Scramble key, range from 0x0 to 0xffff.  
- * 0x0 is no scrambling. 
- */
-static u_int  scramble_key = 0x0;
-
-/* Shared memory speed, in ns. The documentation states that 
- * the card should not be read faster than every 400ns. 
- * This timing should be provided by the HBA. If it becomes a 
- * problem, try setting mem_speed to 400. 
- */
-static int mem_speed;
-
-module_param(domain, int, 0);
-module_param(scramble_key, int, 0);
-module_param(mem_speed, int, 0);
-
-/*====================================================================*/
-
-/* PCMCIA (Card Services) related functions */
-static void netwave_release(struct pcmcia_device *link);     /* Card removal */
-static int netwave_pcmcia_config(struct pcmcia_device *arg); /* Runs after card
-                                                                                                           insertion */
-static void netwave_detach(struct pcmcia_device *p_dev);    /* Destroy instance */
-
-/* Hardware configuration */
-static void netwave_doreset(unsigned int iobase, u_char __iomem *ramBase);
-static void netwave_reset(struct net_device *dev);
-
-/* Misc device stuff */
-static int netwave_open(struct net_device *dev);  /* Open the device */
-static int netwave_close(struct net_device *dev); /* Close the device */
-
-/* Packet transmission and Packet reception */
-static netdev_tx_t netwave_start_xmit( struct sk_buff *skb,
-                                             struct net_device *dev);
-static int netwave_rx( struct net_device *dev);
-
-/* Interrupt routines */
-static irqreturn_t netwave_interrupt(int irq, void *dev_id);
-static void netwave_watchdog(struct net_device *);
-
-/* Wireless extensions */
-static struct iw_statistics* netwave_get_wireless_stats(struct net_device *dev);
-
-static void set_multicast_list(struct net_device *dev);
-
-/*
-   A struct pcmcia_device structure has fields for most things that are needed
-   to keep track of a socket, but there will usually be some device
-   specific information that also needs to be kept track of.  The
-   'priv' pointer in a struct pcmcia_device structure can be used to point to
-   a device-specific private data structure, like this.
-
-   A driver needs to provide a dev_node_t structure for each device
-   on a card.  In some cases, there is only one device per card (for
-   example, ethernet cards, modems).  In other cases, there may be
-   many actual or logical devices (SCSI adapters, memory cards with
-   multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a struct pcmcia_device
-   structure.  We allocate them in the card's private data structure,
-   because they generally can't be allocated dynamically.
-*/
-
-static const struct iw_handler_def      netwave_handler_def;
-
-#define SIOCGIPSNAP     SIOCIWFIRSTPRIV + 1     /* Site Survey Snapshot */
-
-#define MAX_ESA 10
-
-typedef struct net_addr {
-    u_char addr48[6];
-} net_addr;
-
-struct site_survey {
-    u_short length;
-    u_char  struct_revision;
-    u_char  roaming_state;
-        
-    u_char  sp_existsFlag;
-    u_char  sp_link_quality;
-    u_char  sp_max_link_quality;
-    u_char  linkQualityGoodFairBoundary;
-    u_char  linkQualityFairPoorBoundary;
-    u_char  sp_utilization;
-    u_char  sp_goodness;
-    u_char  sp_hotheadcount;
-    u_char  roaming_condition;
-        
-    net_addr sp;
-    u_char   numAPs;
-    net_addr nearByAccessPoints[MAX_ESA];
-};      
-   
-typedef struct netwave_private {
-        struct pcmcia_device    *p_dev;
-    spinlock_t  spinlock;       /* Serialize access to the hardware (SMP) */
-    dev_node_t node;
-    u_char     __iomem *ramBase;
-    int        timeoutCounter;
-    int        lastExec;
-    struct timer_list      watchdog;    /* To avoid blocking state */
-    struct site_survey     nss;
-    struct iw_statistics   iw_stats;    /* Wireless stats */
-} netwave_private;
-
-/*
- * The Netwave card is little-endian, so won't work for big endian
- * systems.
- */
-static inline unsigned short get_uint16(u_char __iomem *staddr) 
-{
-    return readw(staddr); /* Return only 16 bits */
-}
-
-static inline short get_int16(u_char __iomem * staddr)
-{
-    return readw(staddr);
-}
-
-/* 
- * Wait until the WOC (Write Operation Complete) bit in the 
- * ASR (Adapter Status Register) is asserted. 
- * This should have aborted if it takes too long time. 
- */
-static inline void wait_WOC(unsigned int iobase)
-{
-    /* Spin lock */
-    while ((inb(iobase + NETWAVE_REG_ASR) & 0x8) != 0x8) ; 
-}
-
-static void netwave_snapshot(netwave_private *priv, u_char __iomem *ramBase, 
-                             unsigned int iobase) {
-    u_short resultBuffer;
-
-    /* if time since last snapshot is > 1 sec. (100 jiffies?)  then take 
-     * new snapshot, else return cached data. This is the recommended rate.  
-     */
-    if ( jiffies - priv->lastExec > 100) { 
-        /* Take site survey  snapshot */ 
-        /*printk( KERN_DEBUG "Taking new snapshot. %ld\n", jiffies -
-          priv->lastExec); */
-        wait_WOC(iobase); 
-        writeb(NETWAVE_CMD_SSS, ramBase + NETWAVE_EREG_CB + 0); 
-        writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 1); 
-        wait_WOC(iobase); 
-
-        /* Get result and copy to cach */ 
-        resultBuffer = readw(ramBase + NETWAVE_EREG_CRBP); 
-        copy_from_pc( &priv->nss, ramBase+resultBuffer, 
-                      sizeof(struct site_survey)); 
-    } 
-}
-
-/*
- * Function netwave_get_wireless_stats (dev)
- *
- *    Wireless extensions statistics
- *
- */
-static struct iw_statistics *netwave_get_wireless_stats(struct net_device *dev)
-{       
-    unsigned long flags;
-    unsigned int iobase = dev->base_addr;
-    netwave_private *priv = netdev_priv(dev);
-    u_char __iomem *ramBase = priv->ramBase;
-    struct iw_statistics* wstats;
-        
-    wstats = &priv->iw_stats;
-
-    spin_lock_irqsave(&priv->spinlock, flags);
-        
-    netwave_snapshot( priv, ramBase, iobase);
-
-    wstats->status = priv->nss.roaming_state;
-    wstats->qual.qual = readb( ramBase + NETWAVE_EREG_SPCQ); 
-    wstats->qual.level = readb( ramBase + NETWAVE_EREG_ISPLQ);
-    wstats->qual.noise = readb( ramBase + NETWAVE_EREG_SPU) & 0x3f;
-    wstats->discard.nwid = 0L;
-    wstats->discard.code = 0L;
-    wstats->discard.misc = 0L;
-
-    spin_unlock_irqrestore(&priv->spinlock, flags);
-    
-    return &priv->iw_stats;
-}
-
-static const struct net_device_ops netwave_netdev_ops = {
-        .ndo_open               = netwave_open,
-        .ndo_stop               = netwave_close,
-        .ndo_start_xmit         = netwave_start_xmit,
-        .ndo_set_multicast_list = set_multicast_list,
-        .ndo_tx_timeout         = netwave_watchdog,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_set_mac_address    = eth_mac_addr,
-        .ndo_validate_addr      = eth_validate_addr,
-};
-
-/*
- * Function netwave_attach (void)
- *
- *     Creates an "instance" of the driver, allocating local data 
- *     structures for one device.  The device is registered with Card 
- *     Services.
- *
- *     The dev_link structure is initialized, but we don't actually
- *     configure the card at this point -- we wait until we receive a
- *     card insertion event.
- */
-static int netwave_probe(struct pcmcia_device *link)
-{
-    struct net_device *dev;
-    netwave_private *priv;
-
-    DEBUG(0, "netwave_attach()\n");
-
-    /* Initialize the struct pcmcia_device structure */
-    dev = alloc_etherdev(sizeof(netwave_private));
-    if (!dev)
-        return -ENOMEM;
-    priv = netdev_priv(dev);
-    priv->p_dev = link;
-    link->priv = dev;
-
-    /* The io structure describes IO port mapping */
-    link->io.NumPorts1 = 16;
-    link->io.Attributes1 = IO_DATA_PATH_WIDTH_16;
-    /* link->io.NumPorts2 = 16; 
-       link->io.Attributes2 = IO_DATA_PATH_WIDTH_16; */
-    link->io.IOAddrLines = 5;
-    
-    /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING | IRQ_HANDLE_PRESENT;
-    link->irq.IRQInfo1 = IRQ_LEVEL_ID;
-    link->irq.Handler = &netwave_interrupt;
-    
-    /* General socket configuration */
-    link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.IntType = INT_MEMORY_AND_IO;
-    link->conf.ConfigIndex = 1;
-
-    /* Netwave private struct init. link/dev/node already taken care of,
-     * other stuff zero'd - Jean II */
-    spin_lock_init(&priv->spinlock);
-
-    /* Netwave specific entries in the device structure */
-    dev->netdev_ops = &netwave_netdev_ops;
-    /* wireless extensions */
-    dev->wireless_handlers = &netwave_handler_def;
-
-    dev->watchdog_timeo = TX_TIMEOUT;
-
-    link->irq.Instance = dev;
-
-    return netwave_pcmcia_config( link);
-} /* netwave_attach */
-
-/*
- * Function netwave_detach (link)
- *
- *    This deletes a driver "instance".  The device is de-registered
- *    with Card Services.  If it has been released, all local data
- *    structures are freed.  Otherwise, the structures will be freed
- *    when the device is released.
- */
-static void netwave_detach(struct pcmcia_device *link)
-{
-        struct net_device *dev = link->priv;
-
-        DEBUG(0, "netwave_detach(0x%p)\n", link);
-
-        netwave_release(link);
-
-        if (link->dev_node)
-                unregister_netdev(dev);
-
-        free_netdev(dev);
-} /* netwave_detach */
-
-/*
- * Wireless Handler : get protocol name
- */
-static int netwave_get_name(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        strcpy(wrqu->name, "Netwave");
-        return 0;
-}
-
-/*
- * Wireless Handler : set Network ID
- */
-static int netwave_set_nwid(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned long flags;
-        unsigned int iobase = dev->base_addr;
-        netwave_private *priv = netdev_priv(dev);
-        u_char __iomem *ramBase = priv->ramBase;
-
-        /* Disable interrupts & save flags */
-        spin_lock_irqsave(&priv->spinlock, flags);
-
-        if(!wrqu->nwid.disabled) {
-            domain = wrqu->nwid.value;
-            printk( KERN_DEBUG "Setting domain to 0x%x%02x\n", 
-                    (domain >> 8) & 0x01, domain & 0xff);
-            wait_WOC(iobase);
-            writeb(NETWAVE_CMD_SMD, ramBase + NETWAVE_EREG_CB + 0);
-            writeb( domain & 0xff, ramBase + NETWAVE_EREG_CB + 1);
-            writeb((domain >>8 ) & 0x01,ramBase + NETWAVE_EREG_CB+2);
-            writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 3);
-        }
-
-        /* ReEnable interrupts & restore flags */
-        spin_unlock_irqrestore(&priv->spinlock, flags);
-    
-        return 0;
-}
-
-/*
- * Wireless Handler : get Network ID
- */
-static int netwave_get_nwid(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        wrqu->nwid.value = domain;
-        wrqu->nwid.disabled = 0;
-        wrqu->nwid.fixed = 1;
-        return 0;
-}
-
-/*
- * Wireless Handler : set scramble key
- */
-static int netwave_set_scramble(struct net_device *dev,
-                                struct iw_request_info *info,
-                                union iwreq_data *wrqu,
-                                char *key)
-{
-        unsigned long flags;
-        unsigned int iobase = dev->base_addr;
-        netwave_private *priv = netdev_priv(dev);
-        u_char __iomem *ramBase = priv->ramBase;
-
-        /* Disable interrupts & save flags */
-        spin_lock_irqsave(&priv->spinlock, flags);
-
-        scramble_key = (key[0] << 8) | key[1];
-        wait_WOC(iobase);
-        writeb(NETWAVE_CMD_SSK, ramBase + NETWAVE_EREG_CB + 0);
-        writeb(scramble_key & 0xff, ramBase + NETWAVE_EREG_CB + 1);
-        writeb((scramble_key>>8) & 0xff, ramBase + NETWAVE_EREG_CB + 2);
-        writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 3);
-
-        /* ReEnable interrupts & restore flags */
-        spin_unlock_irqrestore(&priv->spinlock, flags);
-    
-        return 0;
-}
-
-/*
- * Wireless Handler : get scramble key
- */
-static int netwave_get_scramble(struct net_device *dev,
-                                struct iw_request_info *info,
-                                union iwreq_data *wrqu,
-                                char *key)
-{
-        key[1] = scramble_key & 0xff;
-        key[0] = (scramble_key>>8) & 0xff;
-        wrqu->encoding.flags = IW_ENCODE_ENABLED;
-        wrqu->encoding.length = 2;
-        return 0;
-}
-
-/*
- * Wireless Handler : get mode
- */
-static int netwave_get_mode(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        if(domain & 0x100)
-                wrqu->mode = IW_MODE_INFRA;
-        else
-                wrqu->mode = IW_MODE_ADHOC;
-
-        return 0;
-}
-
-/*
- * Wireless Handler : get range info
- */
-static int netwave_get_range(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu,
-                             char *extra)
-{
-        struct iw_range *range = (struct iw_range *) extra;
-        int ret = 0;
-
-        /* Set the length (very important for backward compatibility) */
-        wrqu->data.length = sizeof(struct iw_range);
-
-        /* Set all the info we don't care or don't know about to zero */
-        memset(range, 0, sizeof(struct iw_range));
-
-        /* Set the Wireless Extension versions */
-        range->we_version_compiled = WIRELESS_EXT;
-        range->we_version_source = 9;   /* Nothing for us in v10 and v11 */
-                   
-        /* Set information in the range struct */
-        range->throughput = 450 * 1000; /* don't argue on this ! */
-        range->min_nwid = 0x0000;
-        range->max_nwid = 0x01FF;
-
-        range->num_channels = range->num_frequency = 0;
-                   
-        range->sensitivity = 0x3F;
-        range->max_qual.qual = 255;
-        range->max_qual.level = 255;
-        range->max_qual.noise = 0;
-                   
-        range->num_bitrates = 1;
-        range->bitrate[0] = 1000000;    /* 1 Mb/s */
-
-        range->encoding_size[0] = 2;            /* 16 bits scrambling */
-        range->num_encoding_sizes = 1;
-        range->max_encoding_tokens = 1; /* Only one key possible */
-
-        return ret;
-}
-
-/*
- * Wireless Private Handler : get snapshot
- */
-static int netwave_get_snap(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned long flags;
-        unsigned int iobase = dev->base_addr;
-        netwave_private *priv = netdev_priv(dev);
-        u_char __iomem *ramBase = priv->ramBase;
-
-        /* Disable interrupts & save flags */
-        spin_lock_irqsave(&priv->spinlock, flags);
-
-        /* Take snapshot of environment */
-        netwave_snapshot( priv, ramBase, iobase);
-        wrqu->data.length = priv->nss.length;
-        memcpy(extra, (u_char *) &priv->nss, sizeof( struct site_survey));
-
-        priv->lastExec = jiffies;
-
-        /* ReEnable interrupts & restore flags */
-        spin_unlock_irqrestore(&priv->spinlock, flags);
-    
-        return(0);
-}
-
-/*
- * Structures to export the Wireless Handlers
- *     This is the stuff that are treated the wireless extensions (iwconfig)
- */
-
-static const struct iw_priv_args netwave_private_args[] = {
-/*{ cmd,         set_args,                            get_args, name } */
-  { SIOCGIPSNAP, 0, 
-    IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | sizeof(struct site_survey), 
-    "getsitesurvey" },
-};
-
-static const iw_handler         netwave_handler[] =
-{
-        NULL,                           /* SIOCSIWNAME */
-        netwave_get_name,               /* SIOCGIWNAME */
-        netwave_set_nwid,               /* SIOCSIWNWID */
-        netwave_get_nwid,               /* SIOCGIWNWID */
-        NULL,                           /* SIOCSIWFREQ */
-        NULL,                           /* SIOCGIWFREQ */
-        NULL,                           /* SIOCSIWMODE */
-        netwave_get_mode,               /* SIOCGIWMODE */
-        NULL,                           /* SIOCSIWSENS */
-        NULL,                           /* SIOCGIWSENS */
-        NULL,                           /* SIOCSIWRANGE */
-        netwave_get_range,              /* SIOCGIWRANGE */
-        NULL,                           /* SIOCSIWPRIV */
-        NULL,                           /* SIOCGIWPRIV */
-        NULL,                           /* SIOCSIWSTATS */
-        NULL,                           /* SIOCGIWSTATS */
-        NULL,                           /* SIOCSIWSPY */
-        NULL,                           /* SIOCGIWSPY */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* SIOCSIWAP */
-        NULL,                           /* SIOCGIWAP */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* SIOCGIWAPLIST */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* SIOCSIWESSID */
-        NULL,                           /* SIOCGIWESSID */
-        NULL,                           /* SIOCSIWNICKN */
-        NULL,                           /* SIOCGIWNICKN */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* SIOCSIWRATE */
-        NULL,                           /* SIOCGIWRATE */
-        NULL,                           /* SIOCSIWRTS */
-        NULL,                           /* SIOCGIWRTS */
-        NULL,                           /* SIOCSIWFRAG */
-        NULL,                           /* SIOCGIWFRAG */
-        NULL,                           /* SIOCSIWTXPOW */
-        NULL,                           /* SIOCGIWTXPOW */
-        NULL,                           /* SIOCSIWRETRY */
-        NULL,                           /* SIOCGIWRETRY */
-        netwave_set_scramble,           /* SIOCSIWENCODE */
-        netwave_get_scramble,           /* SIOCGIWENCODE */
-};
-
-static const iw_handler         netwave_private_handler[] =
-{
-        NULL,                           /* SIOCIWFIRSTPRIV */
-        netwave_get_snap,               /* SIOCIWFIRSTPRIV + 1 */
-};
-
-static const struct iw_handler_def      netwave_handler_def =
-{
-        .num_standard   = ARRAY_SIZE(netwave_handler),
-        .num_private    = ARRAY_SIZE(netwave_private_handler),
-        .num_private_args = ARRAY_SIZE(netwave_private_args),
-        .standard       = (iw_handler *) netwave_handler,
-        .private        = (iw_handler *) netwave_private_handler,
-        .private_args   = (struct iw_priv_args *) netwave_private_args,
-        .get_wireless_stats = netwave_get_wireless_stats,
-};
-
-/*
- * Function netwave_pcmcia_config (link)
- *
- *     netwave_pcmcia_config() is scheduled to run after a CARD_INSERTION 
- *     event is received, to configure the PCMCIA socket, and to make the
- *     device available to the system. 
- *
- */
-
-#define CS_CHECK(fn, ret) \
-do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
-
-static int netwave_pcmcia_config(struct pcmcia_device *link) {
-    struct net_device *dev = link->priv;
-    netwave_private *priv = netdev_priv(dev);
-    int i, j, last_ret, last_fn;
-    win_req_t req;
-    memreq_t mem;
-    u_char __iomem *ramBase = NULL;
-
-    DEBUG(0, "netwave_pcmcia_config(0x%p)\n", link);
-
-    /*
-     *  Try allocating IO ports.  This tries a few fixed addresses.
-     *  If you want, you can also read the card's config table to
-     *  pick addresses -- see the serial driver for an example.
-     */
-    for (i = j = 0x0; j < 0x400; j += 0x20) {
-        link->io.BasePort1 = j ^ 0x300;
-        i = pcmcia_request_io(link, &link->io);
-        if (i == 0)
-                break;
-    }
-    if (i != 0) {
-        cs_error(link, RequestIO, i);
-        goto failed;
-    }
-
-    /*
-     *  Now allocate an interrupt line.  Note that this does not
-     *  actually assign a handler to the interrupt.
-     */
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
-
-    /*
-     *  This actually configures the PCMCIA socket -- setting up
-     *  the I/O windows and the interrupt mapping.
-     */
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
-
-    /*
-     *  Allocate a 32K memory window.  Note that the struct pcmcia_device
-     *  structure provides space for one window handle -- if your
-     *  device needs several windows, you'll need to keep track of
-     *  the handles in your private data structure, dev->priv.
-     */
-    DEBUG(1, "Setting mem speed of %d\n", mem_speed);
-
-    req.Attributes = WIN_DATA_WIDTH_8|WIN_MEMORY_TYPE_CM|WIN_ENABLE;
-    req.Base = 0; req.Size = 0x8000;
-    req.AccessSpeed = mem_speed;
-    CS_CHECK(RequestWindow, pcmcia_request_window(&link, &req, &link->win));
-    mem.CardOffset = 0x20000; mem.Page = 0; 
-    CS_CHECK(MapMemPage, pcmcia_map_mem_page(link->win, &mem));
-
-    /* Store base address of the common window frame */
-    ramBase = ioremap(req.Base, 0x8000);
-    priv->ramBase = ramBase;
-
-    dev->irq = link->irq.AssignedIRQ;
-    dev->base_addr = link->io.BasePort1;
-    SET_NETDEV_DEV(dev, &handle_to_dev(link));
-
-    if (register_netdev(dev) != 0) {
-        printk(KERN_DEBUG "netwave_cs: register_netdev() failed\n");
-        goto failed;
-    }
-
-    strcpy(priv->node.dev_name, dev->name);
-    link->dev_node = &priv->node;
-
-    /* Reset card before reading physical address */
-    netwave_doreset(dev->base_addr, ramBase);
-
-    /* Read the ethernet address and fill in the Netwave registers. */
-    for (i = 0; i < 6; i++) 
-        dev->dev_addr[i] = readb(ramBase + NETWAVE_EREG_PA + i);
-
-    printk(KERN_INFO "%s: Netwave: port %#3lx, irq %d, mem %lx, "
-           "id %c%c, hw_addr %pM\n",
-           dev->name, dev->base_addr, dev->irq,
-           (u_long) ramBase,
-           (int) readb(ramBase+NETWAVE_EREG_NI),
-           (int) readb(ramBase+NETWAVE_EREG_NI+1),
-           dev->dev_addr);
-
-    /* get revision words */
-    printk(KERN_DEBUG "Netwave_reset: revision %04x %04x\n", 
-           get_uint16(ramBase + NETWAVE_EREG_ARW),
-           get_uint16(ramBase + NETWAVE_EREG_ARW+2));
-    return 0;
-
-cs_failed:
-    cs_error(link, last_fn, last_ret);
-failed:
-    netwave_release(link);
-    return -ENODEV;
-} /* netwave_pcmcia_config */
-
-/*
- * Function netwave_release (arg)
- *
- *    After a card is removed, netwave_release() will unregister the net
- *    device, and release the PCMCIA configuration.  If the device is
- *    still open, this will be postponed until it is closed.
- */
-static void netwave_release(struct pcmcia_device *link)
-{
-        struct net_device *dev = link->priv;
-        netwave_private *priv = netdev_priv(dev);
-
-        DEBUG(0, "netwave_release(0x%p)\n", link);
-
-        pcmcia_disable_device(link);
-        if (link->win)
-                iounmap(priv->ramBase);
-}
-
-static int netwave_suspend(struct pcmcia_device *link)
-{
-        struct net_device *dev = link->priv;
-
-        if (link->open)
-                netif_device_detach(dev);
-
-        return 0;
-}
-
-static int netwave_resume(struct pcmcia_device *link)
-{
-        struct net_device *dev = link->priv;
-
-        if (link->open) {
-                netwave_reset(dev);
-                netif_device_attach(dev);
-        }
-
-        return 0;
-}
-
-
-/*
- * Function netwave_doreset (ioBase, ramBase)
- *
- *    Proper hardware reset of the card.
- */
-static void netwave_doreset(unsigned int ioBase, u_char __iomem *ramBase)
-{
-    /* Reset card */
-    wait_WOC(ioBase);
-    outb(0x80, ioBase + NETWAVE_REG_PMR);
-    writeb(0x08, ramBase + NETWAVE_EREG_ASCC); /* Bit 3 is WOC */
-    outb(0x0, ioBase + NETWAVE_REG_PMR); /* release reset */
-}
-
-/*
- * Function netwave_reset (dev)
- *
- *    Reset and restore all of the netwave registers 
- */
-static void netwave_reset(struct net_device *dev) {
-    /* u_char state; */
-    netwave_private *priv = netdev_priv(dev);
-    u_char __iomem *ramBase = priv->ramBase;
-    unsigned int iobase = dev->base_addr;
-
-    DEBUG(0, "netwave_reset: Done with hardware reset\n");
-
-    priv->timeoutCounter = 0;
-
-    /* Reset card */
-    netwave_doreset(iobase, ramBase);
-    printk(KERN_DEBUG "netwave_reset: Done with hardware reset\n");
-        
-    /* Write a NOP to check the card */
-    wait_WOC(iobase);
-    writeb(NETWAVE_CMD_NOP, ramBase + NETWAVE_EREG_CB + 0);
-    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 1);
-        
-    /* Set receive conf */
-    wait_WOC(iobase);
-    writeb(NETWAVE_CMD_SRC, ramBase + NETWAVE_EREG_CB + 0);
-    writeb(rxConfRxEna + rxConfBcast, ramBase + NETWAVE_EREG_CB + 1);
-    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 2);
-    
-    /* Set transmit conf */
-    wait_WOC(iobase);
-    writeb(NETWAVE_CMD_STC, ramBase + NETWAVE_EREG_CB + 0);
-    writeb(txConfTxEna, ramBase + NETWAVE_EREG_CB + 1);
-    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 2);
-    
-    /* Now set the MU Domain */
-    printk(KERN_DEBUG "Setting domain to 0x%x%02x\n", (domain >> 8) & 0x01, domain & 0xff);
-    wait_WOC(iobase);
-    writeb(NETWAVE_CMD_SMD, ramBase + NETWAVE_EREG_CB + 0);
-    writeb(domain & 0xff, ramBase + NETWAVE_EREG_CB + 1);
-    writeb((domain>>8) & 0x01, ramBase + NETWAVE_EREG_CB + 2);
-    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 3);
-        
-    /* Set scramble key */
-    printk(KERN_DEBUG "Setting scramble key to 0x%x\n", scramble_key);
-    wait_WOC(iobase);
-    writeb(NETWAVE_CMD_SSK, ramBase + NETWAVE_EREG_CB + 0);
-    writeb(scramble_key & 0xff, ramBase + NETWAVE_EREG_CB + 1);
-    writeb((scramble_key>>8) & 0xff, ramBase + NETWAVE_EREG_CB + 2);
-    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 3);
-
-    /* Enable interrupts, bit 4 high to keep unused
-     * source from interrupting us, bit 2 high to 
-     * set interrupt enable, 567 to enable TxDN, 
-     * RxErr and RxRdy
-     */
-    wait_WOC(iobase);
-    outb(imrConfIENA+imrConfRFU1, iobase + NETWAVE_REG_IMR);
-
-    /* Hent 4 bytes fra 0x170. Skal vaere 0a,29,88,36
-     * waitWOC
-     * skriv 80 til d000:3688
-     * sjekk om det ble 80
-     */
-    
-    /* Enable Receiver */
-    wait_WOC(iobase);
-    writeb(NETWAVE_CMD_ER, ramBase + NETWAVE_EREG_CB + 0);
-    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 1);
-        
-    /* Set the IENA bit in COR */
-    wait_WOC(iobase);
-    outb(corConfIENA + corConfLVLREQ, iobase + NETWAVE_REG_COR);
-}
-
-/*
- * Function netwave_hw_xmit (data, len, dev)    
- */
-static int netwave_hw_xmit(unsigned char* data, int len,
-                           struct net_device* dev) {
-    unsigned long flags;
-    unsigned int TxFreeList,
-                 curBuff,
-                 MaxData, 
-                 DataOffset;
-    int tmpcount; 
-        
-    netwave_private *priv = netdev_priv(dev);
-    u_char __iomem * ramBase = priv->ramBase;
-    unsigned int iobase = dev->base_addr;
-
-    /* Disable interrupts & save flags */
-    spin_lock_irqsave(&priv->spinlock, flags);
-
-    /* Check if there are transmit buffers available */
-    wait_WOC(iobase);
-    if ((inb(iobase+NETWAVE_REG_ASR) & NETWAVE_ASR_TXBA) == 0) {
-        /* No buffers available */
-        printk(KERN_DEBUG "netwave_hw_xmit: %s - no xmit buffers available.\n",
-               dev->name);
-        spin_unlock_irqrestore(&priv->spinlock, flags);
-        return 1;
-    }
-
-    dev->stats.tx_bytes += len;
-
-    DEBUG(3, "Transmitting with SPCQ %x SPU %x LIF %x ISPLQ %x\n",
-          readb(ramBase + NETWAVE_EREG_SPCQ),
-          readb(ramBase + NETWAVE_EREG_SPU),
-          readb(ramBase + NETWAVE_EREG_LIF),
-          readb(ramBase + NETWAVE_EREG_ISPLQ));
-
-    /* Now try to insert it into the adapters free memory */
-    wait_WOC(iobase);
-    TxFreeList = get_uint16(ramBase + NETWAVE_EREG_TDP);
-    MaxData    = get_uint16(ramBase + NETWAVE_EREG_TDP+2);
-    DataOffset = get_uint16(ramBase + NETWAVE_EREG_TDP+4);
-        
-    DEBUG(3, "TxFreeList %x, MaxData %x, DataOffset %x\n",
-          TxFreeList, MaxData, DataOffset);
-
-    /* Copy packet to the adapter fragment buffers */
-    curBuff = TxFreeList; 
-    tmpcount = 0; 
-    while (tmpcount < len) {
-        int tmplen = len - tmpcount; 
-        copy_to_pc(ramBase + curBuff + DataOffset, data + tmpcount, 
-                   (tmplen < MaxData) ? tmplen : MaxData);
-        tmpcount += MaxData;
-                        
-        /* Advance to next buffer */
-        curBuff = get_uint16(ramBase + curBuff);
-    }
-    
-    /* Now issue transmit list */
-    wait_WOC(iobase);
-    writeb(NETWAVE_CMD_TL, ramBase + NETWAVE_EREG_CB + 0);
-    writeb(len & 0xff, ramBase + NETWAVE_EREG_CB + 1);
-    writeb((len>>8) & 0xff, ramBase + NETWAVE_EREG_CB + 2);
-    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 3);
-
-    spin_unlock_irqrestore(&priv->spinlock, flags);
-    return 0;
-}
-
-static netdev_tx_t netwave_start_xmit(struct sk_buff *skb,
-                                            struct net_device *dev) {
-        /* This flag indicate that the hardware can't perform a transmission.
-         * Theoritically, NET3 check it before sending a packet to the driver,
-         * but in fact it never do that and pool continuously.
-         * As the watchdog will abort too long transmissions, we are quite safe...
-         */
-
-    netif_stop_queue(dev);
-
-    {
-        short length = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
-        unsigned char* buf = skb->data;
-        
-        if (netwave_hw_xmit( buf, length, dev) == 1) {
-            /* Some error, let's make them call us another time? */
-            netif_start_queue(dev);
-        }
-        dev->trans_start = jiffies;
-    }
-    dev_kfree_skb(skb);
-    
-    return NETDEV_TX_OK;
-} /* netwave_start_xmit */
-
-/*
- * Function netwave_interrupt (irq, dev_id)
- *
- *    This function is the interrupt handler for the Netwave card. This
- *    routine will be called whenever: 
- *        1. A packet is received.
- *        2. A packet has successfully been transferred and the unit is
- *           ready to transmit another packet.
- *        3. A command has completed execution.
- */
-static irqreturn_t netwave_interrupt(int irq, void* dev_id)
-{
-    unsigned int iobase;
-    u_char __iomem *ramBase;
-    struct net_device *dev = (struct net_device *)dev_id;
-    struct netwave_private *priv = netdev_priv(dev);
-    struct pcmcia_device *link = priv->p_dev;
-    int i;
-    
-    if (!netif_device_present(dev))
-        return IRQ_NONE;
-    
-    iobase = dev->base_addr;
-    ramBase = priv->ramBase;
-        
-    /* Now find what caused the interrupt, check while interrupts ready */
-    for (i = 0; i < 10; i++) {
-        u_char status;
-                
-        wait_WOC(iobase);       
-        if (!(inb(iobase+NETWAVE_REG_CCSR) & 0x02))
-            break; /* None of the interrupt sources asserted (normal exit) */
-        
-        status = inb(iobase + NETWAVE_REG_ASR);
-                
-        if (!pcmcia_dev_present(link)) {
-            DEBUG(1, "netwave_interrupt: Interrupt with status 0x%x "
-                  "from removed or suspended card!\n", status);
-            break;
-        }
-                
-        /* RxRdy */
-        if (status & 0x80) {
-            netwave_rx(dev);
-            /* wait_WOC(iobase); */
-            /* RxRdy cannot be reset directly by the host */
-        }
-        /* RxErr */
-        if (status & 0x40) {
-            u_char rser;
-                        
-            rser = readb(ramBase + NETWAVE_EREG_RSER);                  
-            
-            if (rser & 0x04) {
-                ++dev->stats.rx_dropped;
-                ++dev->stats.rx_crc_errors;
-            }
-            if (rser & 0x02)
-                ++dev->stats.rx_frame_errors;
-                        
-            /* Clear the RxErr bit in RSER. RSER+4 is the
-             * write part. Also clear the RxCRC (0x04) and 
-             * RxBig (0x02) bits if present */
-            wait_WOC(iobase);
-            writeb(0x40 | (rser & 0x06), ramBase + NETWAVE_EREG_RSER + 4);
-
-            /* Write bit 6 high to ASCC to clear RxErr in ASR,
-             * WOC must be set first! 
-             */
-            wait_WOC(iobase);
-            writeb(0x40, ramBase + NETWAVE_EREG_ASCC);
-
-            /* Remember to count up dev->stats on error packets */
-            ++dev->stats.rx_errors;
-        }
-        /* TxDN */
-        if (status & 0x20) {
-            int txStatus;
-
-            txStatus = readb(ramBase + NETWAVE_EREG_TSER);
-            DEBUG(3, "Transmit done. TSER = %x id %x\n", 
-                  txStatus, readb(ramBase + NETWAVE_EREG_TSER + 1));
-            
-            if (txStatus & 0x20) {
-                /* Transmitting was okay, clear bits */
-                wait_WOC(iobase);
-                writeb(0x2f, ramBase + NETWAVE_EREG_TSER + 4);
-                ++dev->stats.tx_packets;
-            }
-                        
-            if (txStatus & 0xd0) {
-                if (txStatus & 0x80) {
-                    ++dev->stats.collisions; /* Because of /proc/net/dev*/
-                    /* ++dev->stats.tx_aborted_errors; */
-                    /* printk("Collision. %ld\n", jiffies - dev->trans_start); */
-                }
-                if (txStatus & 0x40) 
-                    ++dev->stats.tx_carrier_errors;
-                /* 0x80 TxGU Transmit giveup - nine times and no luck
-                 * 0x40 TxNOAP No access point. Discarded packet.
-                 * 0x10 TxErr Transmit error. Always set when 
-                 *      TxGU and TxNOAP is set. (Those are the only ones
-                 *      to set TxErr).
-                 */
-                DEBUG(3, "netwave_interrupt: TxDN with error status %x\n", 
-                      txStatus);
-                
-                /* Clear out TxGU, TxNOAP, TxErr and TxTrys */
-                wait_WOC(iobase);
-                writeb(0xdf & txStatus, ramBase+NETWAVE_EREG_TSER+4);
-                ++dev->stats.tx_errors;
-            }
-            DEBUG(3, "New status is TSER %x ASR %x\n",
-                  readb(ramBase + NETWAVE_EREG_TSER),
-                  inb(iobase + NETWAVE_REG_ASR));
-
-            netif_wake_queue(dev);
-        }
-        /* TxBA, this would trigger on all error packets received */
-        /* if (status & 0x01) {
-           DEBUG(4, "Transmit buffers available, %x\n", status);
-           }
-           */
-    }
-    /* Handled if we looped at least one time - Jean II */
-    return IRQ_RETVAL(i);
-} /* netwave_interrupt */
-
-/*
- * Function netwave_watchdog (a)
- *
- *    Watchdog : when we start a transmission, we set a timer in the
- *    kernel.  If the transmission complete, this timer is disabled. If
- *    it expire, we reset the card.
- *
- */
-static void netwave_watchdog(struct net_device *dev) {
-
-    DEBUG(1, "%s: netwave_watchdog: watchdog timer expired\n", dev->name);
-    netwave_reset(dev);
-    dev->trans_start = jiffies;
-    netif_wake_queue(dev);
-} /* netwave_watchdog */
-
-static int netwave_rx(struct net_device *dev)
-{
-    netwave_private *priv = netdev_priv(dev);
-    u_char __iomem *ramBase = priv->ramBase;
-    unsigned int iobase = dev->base_addr;
-    u_char rxStatus;
-    struct sk_buff *skb = NULL;
-    unsigned int curBuffer,
-                rcvList;
-    int rcvLen;
-    int tmpcount = 0;
-    int dataCount, dataOffset;
-    int i;
-    u_char *ptr;
-        
-    DEBUG(3, "xinw_rx: Receiving ... \n");
-
-    /* Receive max 10 packets for now. */
-    for (i = 0; i < 10; i++) {
-        /* Any packets? */
-        wait_WOC(iobase);
-        rxStatus = readb(ramBase + NETWAVE_EREG_RSER);          
-        if ( !( rxStatus & 0x80)) /* No more packets */
-            break;
-                
-        /* Check if multicast/broadcast or other */
-        /* multicast = (rxStatus & 0x20);  */
-                
-        /* The receive list pointer and length of the packet */
-        wait_WOC(iobase);
-        rcvLen  = get_int16( ramBase + NETWAVE_EREG_RDP);
-        rcvList = get_uint16( ramBase + NETWAVE_EREG_RDP + 2);
-                
-        if (rcvLen < 0) {
-            printk(KERN_DEBUG "netwave_rx: Receive packet with len %d\n", 
-                   rcvLen);
-            return 0;
-        }
-                
-        skb = dev_alloc_skb(rcvLen+5);
-        if (skb == NULL) {
-            DEBUG(1, "netwave_rx: Could not allocate an sk_buff of "
-                  "length %d\n", rcvLen);
-            ++dev->stats.rx_dropped;
-            /* Tell the adapter to skip the packet */
-            wait_WOC(iobase);
-            writeb(NETWAVE_CMD_SRP, ramBase + NETWAVE_EREG_CB + 0);
-            writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 1);
-            return 0;
-        }
-
-        skb_reserve( skb, 2);  /* Align IP on 16 byte */
-        skb_put( skb, rcvLen);
-
-        /* Copy packet fragments to the skb data area */
-        ptr = (u_char*) skb->data;
-        curBuffer = rcvList;
-        tmpcount = 0; 
-        while ( tmpcount < rcvLen) {
-            /* Get length and offset of current buffer */
-            dataCount  = get_uint16( ramBase+curBuffer+2);
-            dataOffset = get_uint16( ramBase+curBuffer+4);
-                
-            copy_from_pc( ptr + tmpcount,
-                          ramBase+curBuffer+dataOffset, dataCount);
-
-            tmpcount += dataCount;
-                
-            /* Point to next buffer */
-            curBuffer = get_uint16(ramBase + curBuffer);
-        }
-        
-        skb->protocol = eth_type_trans(skb,dev);
-        /* Queue packet for network layer */
-        netif_rx(skb);
-
-        dev->stats.rx_packets++;
-        dev->stats.rx_bytes += rcvLen;
-
-        /* Got the packet, tell the adapter to skip it */
-        wait_WOC(iobase);
-        writeb(NETWAVE_CMD_SRP, ramBase + NETWAVE_EREG_CB + 0);
-        writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 1);
-        DEBUG(3, "Packet reception ok\n");
-    }
-    return 0;
-}
-
-static int netwave_open(struct net_device *dev) {
-    netwave_private *priv = netdev_priv(dev);
-    struct pcmcia_device *link = priv->p_dev;
-
-    DEBUG(1, "netwave_open: starting.\n");
-    
-    if (!pcmcia_dev_present(link))
-        return -ENODEV;
-
-    link->open++;
-
-    netif_start_queue(dev);
-    netwave_reset(dev);
-        
-    return 0;
-}
-
-static int netwave_close(struct net_device *dev) {
-    netwave_private *priv = netdev_priv(dev);
-    struct pcmcia_device *link = priv->p_dev;
-
-    DEBUG(1, "netwave_close: finishing.\n");
-
-    link->open--;
-    netif_stop_queue(dev);
-
-    return 0;
-}
-
-static struct pcmcia_device_id netwave_ids[] = {
-        PCMCIA_DEVICE_PROD_ID12("Xircom", "CreditCard Netwave", 0x2e3ee845, 0x54e28a28),
-        PCMCIA_DEVICE_NULL,
-};
-MODULE_DEVICE_TABLE(pcmcia, netwave_ids);
-
-static struct pcmcia_driver netwave_driver = {
-        .owner          = THIS_MODULE,
-        .drv            = {
-                .name   = "netwave_cs",
-        },
-        .probe          = netwave_probe,
-        .remove         = netwave_detach,
-        .id_table       = netwave_ids,
-        .suspend        = netwave_suspend,
-        .resume         = netwave_resume,
-};
-
-static int __init init_netwave_cs(void)
-{
-        return pcmcia_register_driver(&netwave_driver);
-}
-
-static void __exit exit_netwave_cs(void)
-{
-        pcmcia_unregister_driver(&netwave_driver);
-}
-
-module_init(init_netwave_cs);
-module_exit(exit_netwave_cs);
-
-/* Set or clear the multicast filter for this adaptor.
-   num_addrs == -1      Promiscuous mode, receive all packets
-   num_addrs == 0       Normal mode, clear multicast list
-   num_addrs > 0        Multicast mode, receive normal and MC packets, and do
-   best-effort filtering.
- */
-static void set_multicast_list(struct net_device *dev)
-{
-    unsigned int iobase = dev->base_addr;
-    netwave_private *priv = netdev_priv(dev);
-    u_char __iomem * ramBase = priv->ramBase;
-    u_char  rcvMode = 0;
-   
-#ifdef PCMCIA_DEBUG
-    if (pc_debug > 2) {
-        static int old;
-        if (old != dev->mc_count) {
-            old = dev->mc_count;
-            DEBUG(0, "%s: setting Rx mode to %d addresses.\n",
-                  dev->name, dev->mc_count);
-        }
-    }
-#endif
-        
-    if (dev->mc_count || (dev->flags & IFF_ALLMULTI)) {
-        /* Multicast Mode */
-        rcvMode = rxConfRxEna + rxConfAMP + rxConfBcast;
-    } else if (dev->flags & IFF_PROMISC) {
-        /* Promiscous mode */
-        rcvMode = rxConfRxEna + rxConfPro + rxConfAMP + rxConfBcast;
-    } else {
-        /* Normal mode */
-        rcvMode = rxConfRxEna + rxConfBcast;
-    }
-        
-    /* printk("netwave set_multicast_list: rcvMode to %x\n", rcvMode);*/
-    /* Now set receive mode */
-    wait_WOC(iobase);
-    writeb(NETWAVE_CMD_SRC, ramBase + NETWAVE_EREG_CB + 0);
-    writeb(rcvMode, ramBase + NETWAVE_EREG_CB + 1);
-    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 2);
-}
-MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/orinoco/Kconfig b/drivers/net/wireless/orinoco/Kconfig
index 83b635fd7784..e2a2c18920aa 100644
--- a/drivers/net/wireless/orinoco/Kconfig
+++ b/drivers/net/wireless/orinoco/Kconfig
@@ -1,8 +1,10 @@
 config HERMES
         tristate "Hermes chipset 802.11b support (Orinoco/Prism2/Symbol)"
-        depends on (PPC_PMAC || PCI || PCMCIA) && WLAN_80211
-        depends on CFG80211
+        depends on (PPC_PMAC || PCI || PCMCIA)
+        depends on CFG80211 && CFG80211_WEXT
         select WIRELESS_EXT
+        select WEXT_SPY
+        select WEXT_PRIV
         select FW_LOADER
         select CRYPTO
         select CRYPTO_MICHAEL_MIC
diff --git a/drivers/net/wireless/orinoco/fw.c b/drivers/net/wireless/orinoco/fw.c
index 1257250a1e22..5ea0f7cf85b1 100644
--- a/drivers/net/wireless/orinoco/fw.c
+++ b/drivers/net/wireless/orinoco/fw.c
@@ -3,6 +3,7 @@
  * See copyright notice in main.c
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/firmware.h>
 #include <linux/device.h>
 
@@ -28,6 +29,12 @@ static const struct fw_info orinoco_fw[] = {
         { NULL, "prism_sta_fw.bin", "prism_ap_fw.bin", 0, 1024 },
         { "symbol_sp24t_prim_fw", "symbol_sp24t_sec_fw", NULL, 0x00003100, 512 }
 };
+MODULE_FIRMWARE("agere_sta_fw.bin");
+MODULE_FIRMWARE("agere_ap_fw.bin");
+MODULE_FIRMWARE("prism_sta_fw.bin");
+MODULE_FIRMWARE("prism_ap_fw.bin");
+MODULE_FIRMWARE("symbol_sp24t_prim_fw");
+MODULE_FIRMWARE("symbol_sp24t_sec_fw");
 
 /* Structure used to access fields in FW
  * Make sure LE decoding macros are used
diff --git a/drivers/net/wireless/orinoco/hermes_dld.c b/drivers/net/wireless/orinoco/hermes_dld.c
index a3eefe109df4..fb157eb889ca 100644
--- a/drivers/net/wireless/orinoco/hermes_dld.c
+++ b/drivers/net/wireless/orinoco/hermes_dld.c
@@ -427,7 +427,7 @@ int hermesi_program_init(hermes_t *hw, u32 offset)
         if (err)
                 return err;
 
-        pr_debug(KERN_DEBUG PFX "Enabling volatile, EP 0x%08x\n", offset);
+        pr_debug(PFX "Enabling volatile, EP 0x%08x\n", offset);
         err = hermes_doicmd_wait(hw,
                                  HERMES_PROGRAM_ENABLE_VOLATILE,
                                  offset & 0xFFFFu,
@@ -550,7 +550,7 @@ static const struct {							\
 
 #define DEFAULT_PDR(pid) default_pdr_data_##pid
 
-/*  HWIF Compatiblity */
+/*  HWIF Compatibility */
 DEFINE_DEFAULT_PDR(0x0005, 10, "\x00\x00\x06\x00\x01\x00\x01\x00\x01\x00");
 
 /* PPPPSign */
@@ -656,7 +656,7 @@ int hermes_apply_pda_with_defaults(hermes_t *hw,
                                          record_id + 1, pdi);
                         }
                         break;
-                case 0x5: /*  HWIF Compatiblity */
+                case 0x5: /*  HWIF Compatibility */
                         default_pdi = (struct pdi *) &DEFAULT_PDR(0x0005);
                         break;
                 case 0x108: /* PPPPSign */
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 359652d35e63..e6369242e49c 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -60,8 +60,15 @@ static inline fwtype_t determine_firmware_type(struct comp_id *nic_id)
 /* Set priv->firmware type, determine firmware properties
  * This function can be called before we have registerred with netdev,
  * so all errors go out with dev_* rather than printk
+ *
+ * If non-NULL stores a firmware description in fw_name.
+ * If non-NULL stores a HW version in hw_ver
+ *
+ * These are output via generic cfg80211 ethtool support.
  */
-int determine_fw_capabilities(struct orinoco_private *priv)
+int determine_fw_capabilities(struct orinoco_private *priv,
+                              char *fw_name, size_t fw_name_len,
+                              u32 *hw_ver)
 {
         struct device *dev = priv->dev;
         hermes_t *hw = &priv->hw;
@@ -85,6 +92,12 @@ int determine_fw_capabilities(struct orinoco_private *priv)
         dev_info(dev, "Hardware identity %04x:%04x:%04x:%04x\n",
                  nic_id.id, nic_id.variant, nic_id.major, nic_id.minor);
 
+        if (hw_ver)
+                *hw_ver = (((nic_id.id & 0xff) << 24) |
+                           ((nic_id.variant & 0xff) << 16) |
+                           ((nic_id.major & 0xff) << 8) |
+                           (nic_id.minor & 0xff));
+
         priv->firmware_type = determine_firmware_type(&nic_id);
 
         /* Get the firmware version */
@@ -135,8 +148,9 @@ int determine_fw_capabilities(struct orinoco_private *priv)
         case FIRMWARE_TYPE_AGERE:
                 /* Lucent Wavelan IEEE, Lucent Orinoco, Cabletron RoamAbout,
                    ELSA, Melco, HP, IBM, Dell 1150, Compaq 110/210 */
-                snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
-                         "Lucent/Agere %d.%02d", sta_id.major, sta_id.minor);
+                if (fw_name)
+                        snprintf(fw_name, fw_name_len, "Lucent/Agere %d.%02d",
+                                 sta_id.major, sta_id.minor);
 
                 firmver = ((unsigned long)sta_id.major << 16) | sta_id.minor;
 
@@ -185,8 +199,8 @@ int determine_fw_capabilities(struct orinoco_private *priv)
                         tmp[SYMBOL_MAX_VER_LEN] = '\0';
                 }
 
-                snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
-                         "Symbol %s", tmp);
+                if (fw_name)
+                        snprintf(fw_name, fw_name_len, "Symbol %s", tmp);
 
                 priv->has_ibss = (firmver >= 0x20000);
                 priv->has_wep = (firmver >= 0x15012);
@@ -224,9 +238,9 @@ int determine_fw_capabilities(struct orinoco_private *priv)
                  * different and less well tested */
                 /* D-Link MAC : 00:40:05:* */
                 /* Addtron MAC : 00:90:D1:* */
-                snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
-                         "Intersil %d.%d.%d", sta_id.major, sta_id.minor,
-                         sta_id.variant);
+                if (fw_name)
+                        snprintf(fw_name, fw_name_len, "Intersil %d.%d.%d",
+                                 sta_id.major, sta_id.minor, sta_id.variant);
 
                 firmver = ((unsigned long)sta_id.major << 16) |
                         ((unsigned long)sta_id.minor << 8) | sta_id.variant;
@@ -245,7 +259,8 @@ int determine_fw_capabilities(struct orinoco_private *priv)
                 }
                 break;
         }
-        dev_info(dev, "Firmware determined as %s\n", priv->fw_name);
+        if (fw_name)
+                dev_info(dev, "Firmware determined as %s\n", fw_name);
 
         return 0;
 }
@@ -1013,7 +1028,7 @@ int orinoco_clear_tkip_key(struct orinoco_private *priv, int key_idx)
 }
 
 int __orinoco_hw_set_multicast_list(struct orinoco_private *priv,
-                                    struct dev_addr_list *mc_list,
+                                    struct net_device *dev,
                                     int mc_count, int promisc)
 {
         hermes_t *hw = &priv->hw;
@@ -1034,24 +1049,16 @@ int __orinoco_hw_set_multicast_list(struct orinoco_private *priv,
          * group address if either we want to multicast, or if we were
          * multicasting and want to stop */
         if (!promisc && (mc_count || priv->mc_count)) {
-                struct dev_mc_list *p = mc_list;
+                struct dev_mc_list *p;
                 struct hermes_multicast mclist;
-                int i;
+                int i = 0;
 
-                for (i = 0; i < mc_count; i++) {
-                        /* paranoia: is list shorter than mc_count? */
-                        BUG_ON(!p);
-                        /* paranoia: bad address size in list? */
-                        BUG_ON(p->dmi_addrlen != ETH_ALEN);
-
-                        memcpy(mclist.addr[i], p->dmi_addr, ETH_ALEN);
-                        p = p->next;
+                netdev_for_each_mc_addr(p, dev) {
+                        if (i == mc_count)
+                                break;
+                        memcpy(mclist.addr[i++], p->dmi_addr, ETH_ALEN);
                 }
 
-                if (p)
-                        printk(KERN_WARNING "%s: Multicast list is "
-                               "longer than mc_count\n", priv->ndev->name);
-
                 err = hermes_write_ltv(hw, USER_BAP,
                                    HERMES_RID_CNFGROUPADDRESSES,
                                    HERMES_BYTES_TO_RECLEN(mc_count * ETH_ALEN),
diff --git a/drivers/net/wireless/orinoco/hw.h b/drivers/net/wireless/orinoco/hw.h
index 8df6e8752be6..9799a1d14a63 100644
--- a/drivers/net/wireless/orinoco/hw.h
+++ b/drivers/net/wireless/orinoco/hw.h
@@ -24,7 +24,8 @@
 struct orinoco_private;
 struct dev_addr_list;
 
-int determine_fw_capabilities(struct orinoco_private *priv);
+int determine_fw_capabilities(struct orinoco_private *priv, char *fw_name,
+                              size_t fw_name_len, u32 *hw_ver);
 int orinoco_hw_read_card_settings(struct orinoco_private *priv, u8 *dev_addr);
 int orinoco_hw_allocate_fid(struct orinoco_private *priv);
 int orinoco_get_bitratemode(int bitrate, int automatic);
@@ -42,7 +43,7 @@ int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx,
                               u8 *tsc, size_t tsc_len);
 int orinoco_clear_tkip_key(struct orinoco_private *priv, int key_idx);
 int __orinoco_hw_set_multicast_list(struct orinoco_private *priv,
-                                    struct dev_addr_list *mc_list,
+                                    struct net_device *dev,
                                     int mc_count, int promisc);
 int orinoco_hw_get_essid(struct orinoco_private *priv, int *active,
                          char buf[IW_ESSID_MAX_SIZE+1]);
diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c
index 7a32bcb0c037..413e9ab6cab3 100644
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -78,12 +78,12 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
-#include <linux/ethtool.h>
 #include <linux/suspend.h>
 #include <linux/if_arp.h>
 #include <linux/wireless.h>
@@ -162,8 +162,6 @@ static const u8 encaps_hdr[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
                                  | HERMES_EV_WTERR | HERMES_EV_INFO \
                                  | HERMES_EV_INFDROP)
 
-static const struct ethtool_ops orinoco_ethtool_ops;
-
 /********************************************************************/
 /* Data types                                                       */
 /********************************************************************/
@@ -1671,16 +1669,15 @@ __orinoco_set_multicast_list(struct net_device *dev)
         /* The Hermes doesn't seem to have an allmulti mode, so we go
          * into promiscuous mode and let the upper levels deal. */
         if ((dev->flags & IFF_PROMISC) || (dev->flags & IFF_ALLMULTI) ||
-            (dev->mc_count > MAX_MULTICAST(priv))) {
+            (netdev_mc_count(dev) > MAX_MULTICAST(priv))) {
                 promisc = 1;
                 mc_count = 0;
         } else {
                 promisc = 0;
-                mc_count = dev->mc_count;
+                mc_count = netdev_mc_count(dev);
         }
 
-        err = __orinoco_hw_set_multicast_list(priv, dev->mc_list, mc_count,
-                                              promisc);
+        err = __orinoco_hw_set_multicast_list(priv, dev, mc_count, promisc);
 
         return err;
 }
@@ -1994,7 +1991,9 @@ int orinoco_init(struct orinoco_private *priv)
                 goto out;
         }
 
-        err = determine_fw_capabilities(priv);
+        err = determine_fw_capabilities(priv, wiphy->fw_version,
+                                        sizeof(wiphy->fw_version),
+                                        &wiphy->hw_version);
         if (err != 0) {
                 dev_err(dev, "Incompatible firmware, aborting\n");
                 goto out;
@@ -2010,7 +2009,9 @@ int orinoco_init(struct orinoco_private *priv)
                         priv->do_fw_download = 0;
 
                 /* Check firmware version again */
-                err = determine_fw_capabilities(priv);
+                err = determine_fw_capabilities(priv, wiphy->fw_version,
+                                                sizeof(wiphy->fw_version),
+                                                &wiphy->hw_version);
                 if (err != 0) {
                         dev_err(dev, "Incompatible firmware, aborting\n");
                         goto out;
@@ -2212,7 +2213,6 @@ int orinoco_if_add(struct orinoco_private *priv,
         dev->ieee80211_ptr = wdev;
         dev->netdev_ops = &orinoco_netdev_ops;
         dev->watchdog_timeo = HZ; /* 1 second timeout */
-        dev->ethtool_ops = &orinoco_ethtool_ops;
         dev->wireless_handlers = &orinoco_handler_def;
 #ifdef WIRELESS_SPY
         dev->wireless_data = &priv->wireless_data;
@@ -2225,6 +2225,7 @@ int orinoco_if_add(struct orinoco_private *priv,
         netif_carrier_off(dev);
 
         memcpy(dev->dev_addr, wiphy->perm_addr, ETH_ALEN);
+        memcpy(dev->perm_addr, wiphy->perm_addr, ETH_ALEN);
 
         dev->base_addr = base_addr;
         dev->irq = irq;
@@ -2348,27 +2349,6 @@ void orinoco_down(struct orinoco_private *priv)
 }
 EXPORT_SYMBOL(orinoco_down);
 
-static void orinoco_get_drvinfo(struct net_device *dev,
-                                struct ethtool_drvinfo *info)
-{
-        struct orinoco_private *priv = ndev_priv(dev);
-
-        strncpy(info->driver, DRIVER_NAME, sizeof(info->driver) - 1);
-        strncpy(info->version, DRIVER_VERSION, sizeof(info->version) - 1);
-        strncpy(info->fw_version, priv->fw_name, sizeof(info->fw_version) - 1);
-        if (dev->dev.parent)
-                strncpy(info->bus_info, dev_name(dev->dev.parent),
-                        sizeof(info->bus_info) - 1);
-        else
-                snprintf(info->bus_info, sizeof(info->bus_info) - 1,
-                         "PCMCIA %p", priv->hw.iobase);
-}
-
-static const struct ethtool_ops orinoco_ethtool_ops = {
-        .get_drvinfo = orinoco_get_drvinfo,
-        .get_link = ethtool_op_get_link,
-};
-
 /********************************************************************/
 /* Module initialization                                            */
 /********************************************************************/
diff --git a/drivers/net/wireless/orinoco/orinoco.h b/drivers/net/wireless/orinoco/orinoco.h
index 9ac6f1dda4b0..665ef56f8382 100644
--- a/drivers/net/wireless/orinoco/orinoco.h
+++ b/drivers/net/wireless/orinoco/orinoco.h
@@ -93,7 +93,6 @@ struct orinoco_private {
 
         /* Capabilities of the hardware/firmware */
         fwtype_t firmware_type;
-        char fw_name[32];
         int ibss_port;
         int nicbuf_size;
         u16 channel_mask;
diff --git a/drivers/net/wireless/orinoco/orinoco_cs.c b/drivers/net/wireless/orinoco/orinoco_cs.c
index 38c1c9d2abb8..1d4ada188eda 100644
--- a/drivers/net/wireless/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco/orinoco_cs.c
@@ -109,7 +109,7 @@ orinoco_cs_probe(struct pcmcia_device *link)
         struct orinoco_private *priv;
         struct orinoco_pccard *card;
 
-        priv = alloc_orinocodev(sizeof(*card), &handle_to_dev(link),
+        priv = alloc_orinocodev(sizeof(*card), &link->dev,
                                 orinoco_cs_hard_reset, NULL);
         if (!priv)
                 return -ENOMEM;
@@ -120,10 +120,8 @@ orinoco_cs_probe(struct pcmcia_device *link)
         link->priv = priv;
 
         /* Interrupt setup */
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING | IRQ_HANDLE_PRESENT;
-        link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
         link->irq.Handler = orinoco_interrupt;
-        link->irq.Instance = priv;
 
         /* General socket configuration defaults can go here.  In this
          * client, we assume very little, and rely on the CIS for
@@ -160,12 +158,6 @@ static void orinoco_cs_detach(struct pcmcia_device *link)
  * device available to the system.
  */
 
-#define CS_CHECK(fn, ret) do { \
-        last_fn = (fn); \
-        if ((last_ret = (ret)) != 0) \
-                goto cs_failed; \
-} while (0)
-
 static int orinoco_cs_config_check(struct pcmcia_device *p_dev,
                                    cistpl_cftable_entry_t *cfg,
                                    cistpl_cftable_entry_t *dflt,
@@ -240,7 +232,7 @@ orinoco_cs_config(struct pcmcia_device *link)
         struct orinoco_private *priv = link->priv;
         struct orinoco_pccard *card = priv->card;
         hermes_t *hw = &priv->hw;
-        int last_fn, last_ret;
+        int ret;
         void __iomem *mem;
 
         /*
@@ -257,13 +249,12 @@ orinoco_cs_config(struct pcmcia_device *link)
          * and most client drivers will only use the CIS to fill in
          * implementation-defined details.
          */
-        last_ret = pcmcia_loop_config(link, orinoco_cs_config_check, NULL);
-        if (last_ret) {
+        ret = pcmcia_loop_config(link, orinoco_cs_config_check, NULL);
+        if (ret) {
                 if (!ignore_cis_vcc)
                         printk(KERN_ERR PFX "GetNextTuple(): No matching "
                                "CIS configuration.  Maybe you need the "
                                "ignore_cis_vcc=1 parameter.\n");
-                cs_error(link, RequestIO, last_ret);
                 goto failed;
         }
 
@@ -272,14 +263,16 @@ orinoco_cs_config(struct pcmcia_device *link)
          * a handler to the interrupt, unless the 'Handler' member of
          * the irq structure is initialized.
          */
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+        ret = pcmcia_request_irq(link, &link->irq);
+        if (ret)
+                goto failed;
 
         /* We initialize the hermes structure before completing PCMCIA
          * configuration just in case the interrupt handler gets
          * called. */
         mem = ioport_map(link->io.BasePort1, link->io.NumPorts1);
         if (!mem)
-                goto cs_failed;
+                goto failed;
 
         hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
 
@@ -288,8 +281,9 @@ orinoco_cs_config(struct pcmcia_device *link)
          * the I/O windows and the interrupt mapping, and putting the
          * card and host interface into "Memory and IO" mode.
          */
-        CS_CHECK(RequestConfiguration,
-                 pcmcia_request_configuration(link, &link->conf));
+        ret = pcmcia_request_configuration(link, &link->conf);
+        if (ret)
+                goto failed;
 
         /* Ok, we have the configuration, prepare to register the netdev */
         card->node.major = card->node.minor = 0;
@@ -315,9 +309,6 @@ orinoco_cs_config(struct pcmcia_device *link)
                                        * net_device has been registered */
         return 0;
 
- cs_failed:
-        cs_error(link, last_fn, last_ret);
-
  failed:
         orinoco_cs_release(link);
         return -ENODEV;
@@ -416,7 +407,6 @@ static struct pcmcia_device_id orinoco_cs_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("3Com", "3CRWE737A AirConnect Wireless LAN PC Card", 0x41240e5b, 0x56010af3),
         PCMCIA_DEVICE_PROD_ID12("ACTIONTEC", "PRISM Wireless LAN PC Card", 0x393089da, 0xa71e69d5),
         PCMCIA_DEVICE_PROD_ID12("Addtron", "AWP-100 Wireless PCMCIA", 0xe6ec52ce, 0x08649af2),
-        PCMCIA_DEVICE_PROD_ID123("AIRVAST", "IEEE 802.11b Wireless PCMCIA Card", "HFA3863", 0xea569531, 0x4bcb9645, 0x355cb092),
         PCMCIA_DEVICE_PROD_ID12("Allied Telesyn", "AT-WCL452 Wireless PCMCIA Radio", 0x5cd01705, 0x4271660f),
         PCMCIA_DEVICE_PROD_ID12("ASUS", "802_11b_PC_CARD_25", 0x78fc06ee, 0xdb9aa842),
         PCMCIA_DEVICE_PROD_ID12("ASUS", "802_11B_CF_CARD_25", 0x78fc06ee, 0x45a50c1e),
@@ -426,7 +416,6 @@ static struct pcmcia_device_id orinoco_cs_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("BUFFALO", "WLI-CF-S11G", 0x2decece3, 0x82067c18),
         PCMCIA_DEVICE_PROD_ID12("Cabletron", "RoamAbout 802.11 DS", 0x32d445f5, 0xedeffd90),
         PCMCIA_DEVICE_PROD_ID12("Compaq", "WL200_11Mbps_Wireless_PCI_Card", 0x54f7c49c, 0x15a75e5b),
-        PCMCIA_DEVICE_PROD_ID123("corega", "WL PCCL-11", "ISL37300P", 0x0a21501a, 0x59868926, 0xc9049a39),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "Wireless LAN PCC-11", 0x5261440f, 0xa6405584),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "Wireless LAN PCCA-11", 0x5261440f, 0xdf6115f9),
         PCMCIA_DEVICE_PROD_ID12("corega_K.K.", "Wireless_LAN_PCCB-11", 0x29e33311, 0xee7a27ae),
@@ -441,7 +430,6 @@ static struct pcmcia_device_id orinoco_cs_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("INTERSIL", "HFA384x/IEEE", 0x74c5e40d, 0xdb472a18),
         PCMCIA_DEVICE_PROD_ID12("INTERSIL", "I-GATE 11M PC Card / PC Card plus", 0x74c5e40d, 0x8304ff77),
         PCMCIA_DEVICE_PROD_ID12("Intersil", "PRISM 2_5 PCMCIA ADAPTER", 0x4b801a17, 0x6345a0bf),
-        PCMCIA_DEVICE_PROD_ID123("Intersil", "PRISM Freedom PCMCIA Adapter", "ISL37100P", 0x4b801a17, 0xf222ec2d, 0x630d52b2),
         PCMCIA_DEVICE_PROD_ID12("LeArtery", "SYNCBYAIR 11Mbps Wireless LAN PC Card", 0x7e3b326a, 0x49893e92),
         PCMCIA_DEVICE_PROD_ID12("Linksys", "Wireless CompactFlash Card", 0x0733cc81, 0x0c52f395),
         PCMCIA_DEVICE_PROD_ID12("Lucent Technologies", "WaveLAN/IEEE", 0x23eb9949, 0xc562e72a),
@@ -454,7 +442,6 @@ static struct pcmcia_device_id orinoco_cs_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("Nortel Networks", "emobility 802.11 Wireless LAN PC Card", 0x2d617ea0, 0x88cd5767),
         PCMCIA_DEVICE_PROD_ID12("OEM", "PRISM2 IEEE 802.11 PC-Card", 0xfea54c90, 0x48f2bdd6),
         PCMCIA_DEVICE_PROD_ID12("OTC", "Wireless AirEZY 2411-PCC WLAN Card", 0x4ac44287, 0x235a6bed),
-        PCMCIA_DEVICE_PROD_ID123("PCMCIA", "11M WLAN Card v2.5", "ISL37300P", 0x281f1c5d, 0x6e440487, 0xc9049a39),
         PCMCIA_DEVICE_PROD_ID12("PLANEX", "GeoWave/GW-CF110", 0x209f40ab, 0xd9715264),
         PCMCIA_DEVICE_PROD_ID12("PLANEX", "GeoWave/GW-NS110", 0x209f40ab, 0x46263178),
         PCMCIA_DEVICE_PROD_ID12("PROXIM", "LAN PC CARD HARMONY 80211B", 0xc6536a5e, 0x090c3cd9),
@@ -463,8 +450,11 @@ static struct pcmcia_device_id orinoco_cs_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("SMC", "SMC2532W-B EliteConnect Wireless Adapter", 0xc4f8b18b, 0x196bd757),
         PCMCIA_DEVICE_PROD_ID12("SMC", "SMC2632W", 0xc4f8b18b, 0x474a1f2a),
         PCMCIA_DEVICE_PROD_ID12("Symbol Technologies", "LA4111 Spectrum24 Wireless LAN PC Card", 0x3f02b4d6, 0x3663cb0e),
-        PCMCIA_DEVICE_PROD_ID123("The Linksys Group, Inc.", "Instant Wireless Network PC Card", "ISL37300P", 0xa5f472c2, 0x590eb502, 0xc9049a39),
         PCMCIA_DEVICE_PROD_ID12("ZoomAir 11Mbps High", "Rate wireless Networking", 0x273fe3db, 0x32a1eaee),
+        PCMCIA_DEVICE_PROD_ID3("HFA3863", 0x355cb092),
+        PCMCIA_DEVICE_PROD_ID3("ISL37100P", 0x630d52b2),
+        PCMCIA_DEVICE_PROD_ID3("ISL37101P-10", 0xdd97a26b),
+        PCMCIA_DEVICE_PROD_ID3("ISL37300P", 0xc9049a39),
         PCMCIA_DEVICE_NULL,
 };
 MODULE_DEVICE_TABLE(pcmcia, orinoco_cs_ids);
diff --git a/drivers/net/wireless/orinoco/orinoco_nortel.c b/drivers/net/wireless/orinoco/orinoco_nortel.c
index c13a4c383410..075f446b3139 100644
--- a/drivers/net/wireless/orinoco/orinoco_nortel.c
+++ b/drivers/net/wireless/orinoco/orinoco_nortel.c
@@ -274,7 +274,7 @@ static void __devexit orinoco_nortel_remove_one(struct pci_dev *pdev)
         pci_disable_device(pdev);
 }
 
-static struct pci_device_id orinoco_nortel_id_table[] = {
+static DEFINE_PCI_DEVICE_TABLE(orinoco_nortel_id_table) = {
         /* Nortel emobility PCI */
         {0x126c, 0x8030, PCI_ANY_ID, PCI_ANY_ID,},
         /* Symbol LA-4123 PCI */
diff --git a/drivers/net/wireless/orinoco/orinoco_pci.c b/drivers/net/wireless/orinoco/orinoco_pci.c
index fea7781948e7..bda5317cc596 100644
--- a/drivers/net/wireless/orinoco/orinoco_pci.c
+++ b/drivers/net/wireless/orinoco/orinoco_pci.c
@@ -212,7 +212,7 @@ static void __devexit orinoco_pci_remove_one(struct pci_dev *pdev)
         pci_disable_device(pdev);
 }
 
-static struct pci_device_id orinoco_pci_id_table[] = {
+static DEFINE_PCI_DEVICE_TABLE(orinoco_pci_id_table) = {
         /* Intersil Prism 3 */
         {0x1260, 0x3872, PCI_ANY_ID, PCI_ANY_ID,},
         /* Intersil Prism 2.5 */
diff --git a/drivers/net/wireless/orinoco/orinoco_plx.c b/drivers/net/wireless/orinoco/orinoco_plx.c
index 3f2942a1e4f5..e0d5874ab42f 100644
--- a/drivers/net/wireless/orinoco/orinoco_plx.c
+++ b/drivers/net/wireless/orinoco/orinoco_plx.c
@@ -310,7 +310,7 @@ static void __devexit orinoco_plx_remove_one(struct pci_dev *pdev)
         pci_disable_device(pdev);
 }
 
-static struct pci_device_id orinoco_plx_id_table[] = {
+static DEFINE_PCI_DEVICE_TABLE(orinoco_plx_id_table) = {
         {0x111a, 0x1023, PCI_ANY_ID, PCI_ANY_ID,},      /* Siemens SpeedStream SS1023 */
         {0x1385, 0x4100, PCI_ANY_ID, PCI_ANY_ID,},      /* Netgear MA301 */
         {0x15e8, 0x0130, PCI_ANY_ID, PCI_ANY_ID,},      /* Correga  - does this work? */
diff --git a/drivers/net/wireless/orinoco/orinoco_tmd.c b/drivers/net/wireless/orinoco/orinoco_tmd.c
index d3452548cc71..88cbc7902aa0 100644
--- a/drivers/net/wireless/orinoco/orinoco_tmd.c
+++ b/drivers/net/wireless/orinoco/orinoco_tmd.c
@@ -203,7 +203,7 @@ static void __devexit orinoco_tmd_remove_one(struct pci_dev *pdev)
         pci_disable_device(pdev);
 }
 
-static struct pci_device_id orinoco_tmd_id_table[] = {
+static DEFINE_PCI_DEVICE_TABLE(orinoco_tmd_id_table) = {
         {0x15e8, 0x0131, PCI_ANY_ID, PCI_ANY_ID,},      /* NDC and OEMs, e.g. pheecom */
         {0,},
 };
diff --git a/drivers/net/wireless/orinoco/scan.c b/drivers/net/wireless/orinoco/scan.c
index d2f10e9c2162..330d42d45333 100644
--- a/drivers/net/wireless/orinoco/scan.c
+++ b/drivers/net/wireless/orinoco/scan.c
@@ -3,6 +3,7 @@
  * See copyright notice in main.c
  */
 
+#include <linux/gfp.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/ieee80211.h>
diff --git a/drivers/net/wireless/orinoco/spectrum_cs.c b/drivers/net/wireless/orinoco/spectrum_cs.c
index c361310b885d..59bda240fdc2 100644
--- a/drivers/net/wireless/orinoco/spectrum_cs.c
+++ b/drivers/net/wireless/orinoco/spectrum_cs.c
@@ -73,9 +73,6 @@ static void spectrum_cs_release(struct pcmcia_device *link);
 #define HCR_MEM16       0x10    /* memory width bit, should be preserved */
 
 
-#define CS_CHECK(fn, ret) \
-  do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
-
 /*
  * Reset the card using configuration registers COR and CCSR.
  * If IDLE is 1, stop the firmware, so that it can be safely rewritten.
@@ -83,7 +80,7 @@ static void spectrum_cs_release(struct pcmcia_device *link);
 static int
 spectrum_reset(struct pcmcia_device *link, int idle)
 {
-        int last_ret, last_fn;
+        int ret;
         conf_reg_t reg;
         u_int save_cor;
 
@@ -95,23 +92,26 @@ spectrum_reset(struct pcmcia_device *link, int idle)
         reg.Function = 0;
         reg.Action = CS_READ;
         reg.Offset = CISREG_COR;
-        CS_CHECK(AccessConfigurationRegister,
-                 pcmcia_access_configuration_register(link, &reg));
+        ret = pcmcia_access_configuration_register(link, &reg);
+        if (ret)
+                goto failed;
         save_cor = reg.Value;
 
         /* Soft-Reset card */
         reg.Action = CS_WRITE;
         reg.Offset = CISREG_COR;
         reg.Value = (save_cor | COR_SOFT_RESET);
-        CS_CHECK(AccessConfigurationRegister,
-                 pcmcia_access_configuration_register(link, &reg));
+        ret = pcmcia_access_configuration_register(link, &reg);
+        if (ret)
+                goto failed;
         udelay(1000);
 
         /* Read CCSR */
         reg.Action = CS_READ;
         reg.Offset = CISREG_CCSR;
-        CS_CHECK(AccessConfigurationRegister,
-                 pcmcia_access_configuration_register(link, &reg));
+        ret = pcmcia_access_configuration_register(link, &reg);
+        if (ret)
+                goto failed;
 
         /*
          * Start or stop the firmware.  Memory width bit should be
@@ -120,21 +120,22 @@ spectrum_reset(struct pcmcia_device *link, int idle)
         reg.Action = CS_WRITE;
         reg.Offset = CISREG_CCSR;
         reg.Value = (idle ? HCR_IDLE : HCR_RUN) | (reg.Value & HCR_MEM16);
-        CS_CHECK(AccessConfigurationRegister,
-                 pcmcia_access_configuration_register(link, &reg));
+        ret = pcmcia_access_configuration_register(link, &reg);
+        if (ret)
+                goto failed;
         udelay(1000);
 
         /* Restore original COR configuration index */
         reg.Action = CS_WRITE;
         reg.Offset = CISREG_COR;
         reg.Value = (save_cor & ~COR_SOFT_RESET);
-        CS_CHECK(AccessConfigurationRegister,
-                 pcmcia_access_configuration_register(link, &reg));
+        ret = pcmcia_access_configuration_register(link, &reg);
+        if (ret)
+                goto failed;
         udelay(1000);
         return 0;
 
-cs_failed:
-        cs_error(link, last_fn, last_ret);
+failed:
         return -ENODEV;
 }
 
@@ -181,7 +182,7 @@ spectrum_cs_probe(struct pcmcia_device *link)
         struct orinoco_private *priv;
         struct orinoco_pccard *card;
 
-        priv = alloc_orinocodev(sizeof(*card), &handle_to_dev(link),
+        priv = alloc_orinocodev(sizeof(*card), &link->dev,
                                 spectrum_cs_hard_reset,
                                 spectrum_cs_stop_firmware);
         if (!priv)
@@ -193,10 +194,8 @@ spectrum_cs_probe(struct pcmcia_device *link)
         link->priv = priv;
 
         /* Interrupt setup */
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING | IRQ_HANDLE_PRESENT;
-        link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
         link->irq.Handler = orinoco_interrupt;
-        link->irq.Instance = priv;
 
         /* General socket configuration defaults can go here.  In this
          * client, we assume very little, and rely on the CIS for
@@ -307,7 +306,7 @@ spectrum_cs_config(struct pcmcia_device *link)
         struct orinoco_private *priv = link->priv;
         struct orinoco_pccard *card = priv->card;
         hermes_t *hw = &priv->hw;
-        int last_fn, last_ret;
+        int ret;
         void __iomem *mem;
 
         /*
@@ -324,13 +323,12 @@ spectrum_cs_config(struct pcmcia_device *link)
          * and most client drivers will only use the CIS to fill in
          * implementation-defined details.
          */
-        last_ret = pcmcia_loop_config(link, spectrum_cs_config_check, NULL);
-        if (last_ret) {
+        ret = pcmcia_loop_config(link, spectrum_cs_config_check, NULL);
+        if (ret) {
                 if (!ignore_cis_vcc)
                         printk(KERN_ERR PFX "GetNextTuple(): No matching "
                                "CIS configuration.  Maybe you need the "
                                "ignore_cis_vcc=1 parameter.\n");
-                cs_error(link, RequestIO, last_ret);
                 goto failed;
         }
 
@@ -339,14 +337,16 @@ spectrum_cs_config(struct pcmcia_device *link)
          * a handler to the interrupt, unless the 'Handler' member of
          * the irq structure is initialized.
          */
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+        ret = pcmcia_request_irq(link, &link->irq);
+        if (ret)
+                goto failed;
 
         /* We initialize the hermes structure before completing PCMCIA
          * configuration just in case the interrupt handler gets
          * called. */
         mem = ioport_map(link->io.BasePort1, link->io.NumPorts1);
         if (!mem)
-                goto cs_failed;
+                goto failed;
 
         hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
 
@@ -355,8 +355,9 @@ spectrum_cs_config(struct pcmcia_device *link)
          * the I/O windows and the interrupt mapping, and putting the
          * card and host interface into "Memory and IO" mode.
          */
-        CS_CHECK(RequestConfiguration,
-                 pcmcia_request_configuration(link, &link->conf));
+        ret = pcmcia_request_configuration(link, &link->conf);
+        if (ret)
+                goto failed;
 
         /* Ok, we have the configuration, prepare to register the netdev */
         card->node.major = card->node.minor = 0;
@@ -386,9 +387,6 @@ spectrum_cs_config(struct pcmcia_device *link)
                                        * net_device has been registered */
         return 0;
 
- cs_failed:
-        cs_error(link, last_fn, last_ret);
-
  failed:
         spectrum_cs_release(link);
         return -ENODEV;
diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
index 7698fdd6a3a2..fbcc6e1a2e1d 100644
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -2,6 +2,7 @@
  *
  * See copyright notice in main.c
  */
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/if_arp.h>
 #include <linux/wireless.h>
@@ -23,7 +24,7 @@
 #define MAX_RID_LEN 1024
 
 /* Helper routine to record keys
- * Do not call from interrupt context */
+ * It is called under orinoco_lock so it may not sleep */
 static int orinoco_set_key(struct orinoco_private *priv, int index,
                            enum orinoco_alg alg, const u8 *key, int key_len,
                            const u8 *seq, int seq_len)
@@ -32,14 +33,14 @@ static int orinoco_set_key(struct orinoco_private *priv, int index,
         kzfree(priv->keys[index].seq);
 
         if (key_len) {
-                priv->keys[index].key = kzalloc(key_len, GFP_KERNEL);
+                priv->keys[index].key = kzalloc(key_len, GFP_ATOMIC);
                 if (!priv->keys[index].key)
                         goto nomem;
         } else
                 priv->keys[index].key = NULL;
 
         if (seq_len) {
-                priv->keys[index].seq = kzalloc(seq_len, GFP_KERNEL);
+                priv->keys[index].seq = kzalloc(seq_len, GFP_ATOMIC);
                 if (!priv->keys[index].seq)
                         goto free_key;
         } else
diff --git a/drivers/net/wireless/p54/Kconfig b/drivers/net/wireless/p54/Kconfig
index b45d6a4ed1e8..b0342a520bf1 100644
--- a/drivers/net/wireless/p54/Kconfig
+++ b/drivers/net/wireless/p54/Kconfig
@@ -1,6 +1,6 @@
 config P54_COMMON
         tristate "Softmac Prism54 support"
-        depends on MAC80211 && WLAN_80211 && EXPERIMENTAL
+        depends on MAC80211 && EXPERIMENTAL
         select FW_LOADER
         ---help---
           This is common code for isl38xx/stlc45xx based modules.
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
index 0efe67deedee..187e263b045a 100644
--- a/drivers/net/wireless/p54/eeprom.c
+++ b/drivers/net/wireless/p54/eeprom.c
@@ -20,6 +20,7 @@
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 #include <linux/sort.h>
+#include <linux/slab.h>
 
 #include <net/mac80211.h>
 
@@ -126,7 +127,7 @@ static int p54_generate_band(struct ieee80211_hw *dev,
         int ret = -ENOMEM;
 
         if ((!list->entries) || (!list->band_channel_num[band]))
-                return 0;
+                return -EINVAL;
 
         tmp = kzalloc(sizeof(*tmp), GFP_KERNEL);
         if (!tmp)
@@ -158,6 +159,7 @@ static int p54_generate_band(struct ieee80211_hw *dev,
                                (list->channels[i].data & CHAN_HAS_CURVE ? "" :
                                 " [curve data]"),
                                list->channels[i].index, list->channels[i].freq);
+                        continue;
                 }
 
                 tmp->channels[j].band = list->channels[i].band;
@@ -165,7 +167,16 @@ static int p54_generate_band(struct ieee80211_hw *dev,
                 j++;
         }
 
-        tmp->n_channels = list->band_channel_num[band];
+        if (j == 0) {
+                printk(KERN_ERR "%s: Disabling totally damaged %s band.\n",
+                       wiphy_name(dev->wiphy), (band == IEEE80211_BAND_2GHZ) ?
+                       "2 GHz" : "5 GHz");
+
+                ret = -ENODATA;
+                goto err_out;
+        }
+
+        tmp->n_channels = j;
         old = priv->band_table[band];
         priv->band_table[band] = tmp;
         if (old) {
@@ -228,13 +239,13 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
         struct p54_common *priv = dev->priv;
         struct p54_channel_list *list;
         unsigned int i, j, max_channel_num;
-        int ret = -ENOMEM;
+        int ret = 0;
         u16 freq;
 
         if ((priv->iq_autocal_len != priv->curve_data->entries) ||
             (priv->iq_autocal_len != priv->output_limit->entries))
-                printk(KERN_ERR "%s: EEPROM is damaged... you may not be able"
-                                "to use all channels with this device.\n",
+                printk(KERN_ERR "%s: Unsupported or damaged EEPROM detected. "
+                                "You may not be able to use all channels.\n",
                                 wiphy_name(dev->wiphy));
 
         max_channel_num = max_t(unsigned int, priv->output_limit->entries,
@@ -243,8 +254,10 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
                                 priv->curve_data->entries);
 
         list = kzalloc(sizeof(*list), GFP_KERNEL);
-        if (!list)
+        if (!list) {
+                ret = -ENOMEM;
                 goto free;
+        }
 
         list->max_entries = max_channel_num;
         list->channels = kzalloc(sizeof(struct p54_channel_entry) *
@@ -282,13 +295,8 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
              p54_compare_channels, NULL);
 
         for (i = 0, j = 0; i < IEEE80211_NUM_BANDS; i++) {
-                if (list->band_channel_num[i]) {
-                        ret = p54_generate_band(dev, list, i);
-                        if (ret)
-                                goto free;
-
+                if (p54_generate_band(dev, list, i) == 0)
                         j++;
-                }
         }
         if (j == 0) {
                 /* no useable band available. */
diff --git a/drivers/net/wireless/p54/fwio.c b/drivers/net/wireless/p54/fwio.c
index e7b9e9cb39f5..c43a5d461ab2 100644
--- a/drivers/net/wireless/p54/fwio.c
+++ b/drivers/net/wireless/p54/fwio.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 4d486bf9f725..a7cb9eb759a1 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 
@@ -33,21 +34,29 @@ MODULE_DESCRIPTION("Softmac Prism54 common code");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("prism54common");
 
+static int p54_sta_add_remove(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_sta *sta)
+{
+        struct p54_common *priv = hw->priv;
+
+        /*
+         * Notify the firmware that we don't want or we don't
+         * need to buffer frames for this station anymore.
+         */
+
+        p54_sta_unlock(priv, sta->addr);
+
+        return 0;
+}
+
 static void p54_sta_notify(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
                               enum sta_notify_cmd notify_cmd,
                               struct ieee80211_sta *sta)
 {
         struct p54_common *priv = dev->priv;
-        switch (notify_cmd) {
-        case STA_NOTIFY_ADD:
-        case STA_NOTIFY_REMOVE:
-                /*
-                 * Notify the firmware that we don't want or we don't
-                 * need to buffer frames for this station anymore.
-                 */
 
-                p54_sta_unlock(priv, sta->addr);
-                break;
+        switch (notify_cmd) {
         case STA_NOTIFY_AWAKE:
                 /* update the firmware's filter table */
                 p54_sta_unlock(priv, sta->addr);
@@ -216,7 +225,7 @@ static void p54_stop(struct ieee80211_hw *dev)
 }
 
 static int p54_add_interface(struct ieee80211_hw *dev,
-                             struct ieee80211_if_init_conf *conf)
+                             struct ieee80211_vif *vif)
 {
         struct p54_common *priv = dev->priv;
 
@@ -226,28 +235,28 @@ static int p54_add_interface(struct ieee80211_hw *dev,
                 return -EOPNOTSUPP;
         }
 
-        priv->vif = conf->vif;
+        priv->vif = vif;
 
-        switch (conf->type) {
+        switch (vif->type) {
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_MESH_POINT:
-                priv->mode = conf->type;
+                priv->mode = vif->type;
                 break;
         default:
                 mutex_unlock(&priv->conf_mutex);
                 return -EOPNOTSUPP;
         }
 
-        memcpy(priv->mac_addr, conf->mac_addr, ETH_ALEN);
+        memcpy(priv->mac_addr, vif->addr, ETH_ALEN);
         p54_setup_mac(priv);
         mutex_unlock(&priv->conf_mutex);
         return 0;
 }
 
 static void p54_remove_interface(struct ieee80211_hw *dev,
-                                 struct ieee80211_if_init_conf *conf)
+                                 struct ieee80211_vif *vif)
 {
         struct p54_common *priv = dev->priv;
 
@@ -358,16 +367,6 @@ static int p54_get_stats(struct ieee80211_hw *dev,
         return 0;
 }
 
-static int p54_get_tx_stats(struct ieee80211_hw *dev,
-                            struct ieee80211_tx_queue_stats *stats)
-{
-        struct p54_common *priv = dev->priv;
-
-        memcpy(stats, &priv->tx_stats[P54_QUEUE_DATA],
-               sizeof(stats[0]) * dev->queues);
-        return 0;
-}
-
 static void p54_bss_info_changed(struct ieee80211_hw *dev,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_bss_conf *info,
@@ -516,13 +515,14 @@ static const struct ieee80211_ops p54_ops = {
         .remove_interface       = p54_remove_interface,
         .set_tim                = p54_set_tim,
         .sta_notify             = p54_sta_notify,
+        .sta_add                = p54_sta_add_remove,
+        .sta_remove             = p54_sta_add_remove,
         .set_key                = p54_set_key,
         .config                 = p54_config,
         .bss_info_changed       = p54_bss_info_changed,
         .configure_filter       = p54_configure_filter,
         .conf_tx                = p54_conf_tx,
         .get_stats              = p54_get_stats,
-        .get_tx_stats           = p54_get_tx_stats
 };
 
 struct ieee80211_hw *p54_init_common(size_t priv_data_len)
@@ -579,7 +579,7 @@ struct ieee80211_hw *p54_init_common(size_t priv_data_len)
          * For now, disable PS by default because it affects
          * link stability significantly.
          */
-        dev->wiphy->ps_default = false;
+        dev->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
         mutex_init(&priv->conf_mutex);
         mutex_init(&priv->eeprom_mutex);
diff --git a/drivers/net/wireless/p54/p54.h b/drivers/net/wireless/p54/p54.h
index 1afc39410e85..43a3b2ead81a 100644
--- a/drivers/net/wireless/p54/p54.h
+++ b/drivers/net/wireless/p54/p54.h
@@ -157,6 +157,12 @@ struct p54_led_dev {
 
 #endif /* CONFIG_P54_LEDS */
 
+struct p54_tx_queue_stats {
+        unsigned int len;
+        unsigned int limit;
+        unsigned int count;
+};
+
 struct p54_common {
         struct ieee80211_hw *hw;
         struct ieee80211_vif *vif;
@@ -183,7 +189,7 @@ struct p54_common {
         /* (e)DCF / QOS state */
         bool use_short_slot;
         spinlock_t tx_stats_lock;
-        struct ieee80211_tx_queue_stats tx_stats[8];
+        struct p54_tx_queue_stats tx_stats[8];
         struct p54_edcf_queue_param qos_params[8];
 
         /* Radio data */
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index d348c265e867..c24067f1a0cb 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -15,6 +15,7 @@
 
 #include <linux/init.h>
 #include <linux/pci.h>
+#include <linux/slab.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 #include <linux/delay.h>
@@ -31,7 +32,7 @@ MODULE_LICENSE("GPL");
 MODULE_ALIAS("prism54pci");
 MODULE_FIRMWARE("isl3886pci");
 
-static struct pci_device_id p54p_table[] __devinitdata = {
+static DEFINE_PCI_DEVICE_TABLE(p54p_table) = {
         /* Intersil PRISM Duette/Prism GT Wireless LAN adapter */
         { PCI_DEVICE(0x1260, 0x3890) },
         /* 3COM 3CRWE154G72 Wireless LAN adapter */
@@ -157,6 +158,14 @@ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
                                                  skb_tail_pointer(skb),
                                                  priv->common.rx_mtu + 32,
                                                  PCI_DMA_FROMDEVICE);
+
+                        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                                dev_kfree_skb_any(skb);
+                                dev_err(&priv->pdev->dev,
+                                        "RX DMA Mapping error\n");
+                                break;
+                        }
+
                         desc->host_addr = cpu_to_le32(mapping);
                         desc->device_addr = 0;  // FIXME: necessary?
                         desc->len = cpu_to_le16(priv->common.rx_mtu + 32);
@@ -197,6 +206,14 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
                         i %= ring_limit;
                         continue;
                 }
+
+                if (unlikely(len > priv->common.rx_mtu)) {
+                        if (net_ratelimit())
+                                dev_err(&priv->pdev->dev, "rx'd frame size "
+                                        "exceeds length threshold.\n");
+
+                        len = priv->common.rx_mtu;
+                }
                 skb_put(skb, len);
 
                 if (p54_rx(dev, skb)) {
@@ -218,25 +235,24 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
         p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf);
 }
 
-/* caller must hold priv->lock */
 static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
         int ring_index, struct p54p_desc *ring, u32 ring_limit,
-        void **tx_buf)
+        struct sk_buff **tx_buf)
 {
         struct p54p_priv *priv = dev->priv;
         struct p54p_ring_control *ring_control = priv->ring_control;
         struct p54p_desc *desc;
+        struct sk_buff *skb;
         u32 idx, i;
 
         i = (*index) % ring_limit;
-        (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+        (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
         idx %= ring_limit;
 
         while (i != idx) {
                 desc = &ring[i];
-                if (tx_buf[i])
-                        if (FREE_AFTER_TX((struct sk_buff *) tx_buf[i]))
-                                p54_free_skb(dev, tx_buf[i]);
+
+                skb = tx_buf[i];
                 tx_buf[i] = NULL;
 
                 pci_unmap_single(priv->pdev, le32_to_cpu(desc->host_addr),
@@ -247,17 +263,28 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
                 desc->len = 0;
                 desc->flags = 0;
 
+                if (skb && FREE_AFTER_TX(skb))
+                        p54_free_skb(dev, skb);
+
                 i++;
                 i %= ring_limit;
         }
 }
 
-static void p54p_rx_tasklet(unsigned long dev_id)
+static void p54p_tasklet(unsigned long dev_id)
 {
         struct ieee80211_hw *dev = (struct ieee80211_hw *)dev_id;
         struct p54p_priv *priv = dev->priv;
         struct p54p_ring_control *ring_control = priv->ring_control;
 
+        p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+                           ARRAY_SIZE(ring_control->tx_mgmt),
+                           priv->tx_buf_mgmt);
+
+        p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+                           ARRAY_SIZE(ring_control->tx_data),
+                           priv->tx_buf_data);
+
         p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
                 ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
 
@@ -272,59 +299,49 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
 {
         struct ieee80211_hw *dev = dev_id;
         struct p54p_priv *priv = dev->priv;
-        struct p54p_ring_control *ring_control = priv->ring_control;
         __le32 reg;
 
-        spin_lock(&priv->lock);
         reg = P54P_READ(int_ident);
         if (unlikely(reg == cpu_to_le32(0xFFFFFFFF))) {
-                spin_unlock(&priv->lock);
-                return IRQ_HANDLED;
+                goto out;
         }
-
         P54P_WRITE(int_ack, reg);
 
         reg &= P54P_READ(int_enable);
 
-        if (reg & cpu_to_le32(ISL38XX_INT_IDENT_UPDATE)) {
-                p54p_check_tx_ring(dev, &priv->tx_idx_mgmt,
-                                   3, ring_control->tx_mgmt,
-                                   ARRAY_SIZE(ring_control->tx_mgmt),
-                                   priv->tx_buf_mgmt);
-
-                p54p_check_tx_ring(dev, &priv->tx_idx_data,
-                                   1, ring_control->tx_data,
-                                   ARRAY_SIZE(ring_control->tx_data),
-                                   priv->tx_buf_data);
-
-                tasklet_schedule(&priv->rx_tasklet);
-
-        } else if (reg & cpu_to_le32(ISL38XX_INT_IDENT_INIT))
+        if (reg & cpu_to_le32(ISL38XX_INT_IDENT_UPDATE))
+                tasklet_schedule(&priv->tasklet);
+        else if (reg & cpu_to_le32(ISL38XX_INT_IDENT_INIT))
                 complete(&priv->boot_comp);
 
-        spin_unlock(&priv->lock);
-
+out:
         return reg ? IRQ_HANDLED : IRQ_NONE;
 }
 
 static void p54p_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
 {
+        unsigned long flags;
         struct p54p_priv *priv = dev->priv;
         struct p54p_ring_control *ring_control = priv->ring_control;
-        unsigned long flags;
         struct p54p_desc *desc;
         dma_addr_t mapping;
         u32 device_idx, idx, i;
 
         spin_lock_irqsave(&priv->lock, flags);
-
         device_idx = le32_to_cpu(ring_control->device_idx[1]);
         idx = le32_to_cpu(ring_control->host_idx[1]);
         i = idx % ARRAY_SIZE(ring_control->tx_data);
 
-        priv->tx_buf_data[i] = skb;
         mapping = pci_map_single(priv->pdev, skb->data, skb->len,
                                  PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                spin_unlock_irqrestore(&priv->lock, flags);
+                p54_free_skb(dev, skb);
+                dev_err(&priv->pdev->dev, "TX DMA mapping error\n");
+                return ;
+        }
+        priv->tx_buf_data[i] = skb;
+
         desc = &ring_control->tx_data[i];
         desc->host_addr = cpu_to_le32(mapping);
         desc->device_addr = ((struct p54_hdr *)skb->data)->req_id;
@@ -346,14 +363,14 @@ static void p54p_stop(struct ieee80211_hw *dev)
         unsigned int i;
         struct p54p_desc *desc;
 
-        tasklet_kill(&priv->rx_tasklet);
-
         P54P_WRITE(int_enable, cpu_to_le32(0));
         P54P_READ(int_enable);
         udelay(10);
 
         free_irq(priv->pdev->irq, dev);
 
+        tasklet_kill(&priv->tasklet);
+
         P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
 
         for (i = 0; i < ARRAY_SIZE(priv->rx_buf_data); i++) {
@@ -411,7 +428,7 @@ static int p54p_open(struct ieee80211_hw *dev)
         int err;
 
         init_completion(&priv->boot_comp);
-        err = request_irq(priv->pdev->irq, &p54p_interrupt,
+        err = request_irq(priv->pdev->irq, p54p_interrupt,
                           IRQF_SHARED, "p54pci", dev);
         if (err) {
                 dev_err(&priv->pdev->dev, "failed to register IRQ handler\n");
@@ -537,7 +554,7 @@ static int __devinit p54p_probe(struct pci_dev *pdev,
         priv->common.tx = p54p_tx;
 
         spin_lock_init(&priv->lock);
-        tasklet_init(&priv->rx_tasklet, p54p_rx_tasklet, (unsigned long)dev);
+        tasklet_init(&priv->tasklet, p54p_tasklet, (unsigned long)dev);
 
         err = request_firmware(&priv->firmware, "isl3886pci",
                                &priv->pdev->dev);
diff --git a/drivers/net/wireless/p54/p54pci.h b/drivers/net/wireless/p54/p54pci.h
index fbb683953fb2..2feead617a3b 100644
--- a/drivers/net/wireless/p54/p54pci.h
+++ b/drivers/net/wireless/p54/p54pci.h
@@ -92,7 +92,7 @@ struct p54p_priv {
         struct p54_common common;
         struct pci_dev *pdev;
         struct p54p_csr __iomem *map;
-        struct tasklet_struct rx_tasklet;
+        struct tasklet_struct tasklet;
         const struct firmware *firmware;
         spinlock_t lock;
         struct p54p_ring_control *ring_control;
@@ -101,8 +101,8 @@ struct p54p_priv {
         u32 rx_idx_mgmt, tx_idx_mgmt;
         struct sk_buff *rx_buf_data[8];
         struct sk_buff *rx_buf_mgmt[4];
-        void *tx_buf_data[32];
-        void *tx_buf_mgmt[4];
+        struct sk_buff *tx_buf_data[32];
+        struct sk_buff *tx_buf_mgmt[4];
         struct completion boot_comp;
 };
 
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index afd26bf06649..c8f09da1f84d 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -29,6 +29,7 @@
 #include <linux/spi/spi.h>
 #include <linux/etherdevice.h>
 #include <linux/gpio.h>
+#include <linux/slab.h>
 
 #include "p54spi.h"
 #include "p54spi_eeprom.h"
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 92af9b96bb7a..743a6c68b29d 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -15,6 +15,7 @@
 #include <linux/init.h>
 #include <linux/usb.h>
 #include <linux/pci.h>
+#include <linux/slab.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 #include <linux/delay.h>
@@ -35,7 +36,9 @@ MODULE_FIRMWARE("isl3887usb");
 static struct usb_device_id p54u_table[] __devinitdata = {
         /* Version 1 devices (pci chip + net2280) */
         {USB_DEVICE(0x0506, 0x0a11)},   /* 3COM 3CRWE254G72 */
+        {USB_DEVICE(0x06b9, 0x0120)},   /* Thomson SpeedTouch 120g */
         {USB_DEVICE(0x0707, 0xee06)},   /* SMC 2862W-G */
+        {USB_DEVICE(0x07aa, 0x001c)},   /* Corega CG-WLUSB2GT */
         {USB_DEVICE(0x083a, 0x4501)},   /* Accton 802.11g WN4501 USB */
         {USB_DEVICE(0x083a, 0x4502)},   /* Siemens Gigaset USB Adapter */
         {USB_DEVICE(0x083a, 0x5501)},   /* Phillips CPWUA054 */
@@ -60,6 +63,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x06b9, 0x0121)},   /* Thomson SpeedTouch 121g */
         {USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
         {USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
+        {USB_DEVICE(0x083a, 0xf503)},   /* Accton FD7050E ver 1010ec  */
         {USB_DEVICE(0x0846, 0x4240)},   /* Netgear WG111 (v2) */
         {USB_DEVICE(0x0915, 0x2000)},   /* Cohiba Proto board */
         {USB_DEVICE(0x0915, 0x2002)},   /* Cohiba Proto board */
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index b6dda2b27fb5..66057999a93c 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -183,10 +183,10 @@ static int p54_tx_qos_accounting_alloc(struct p54_common *priv,
                                        struct sk_buff *skb,
                                        const u16 p54_queue)
 {
-        struct ieee80211_tx_queue_stats *queue;
+        struct p54_tx_queue_stats *queue;
         unsigned long flags;
 
-        if (WARN_ON(p54_queue > P54_QUEUE_NUM))
+        if (WARN_ON(p54_queue >= P54_QUEUE_NUM))
                 return -EINVAL;
 
         queue = &priv->tx_stats[p54_queue];
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index bc08464d8323..a45818ebfdfb 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -23,6 +23,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/if_arp.h>
+#include <linux/slab.h>
 #include <linux/pci.h>
 
 #include <asm/uaccess.h>
@@ -1897,7 +1898,7 @@ prism54_get_mac(struct net_device *ndev, struct iw_request_info *info,
         return 0;
 }
 
-/* Setting policy also clears the MAC acl, even if we don't change the defaut
+/* Setting policy also clears the MAC acl, even if we don't change the default
  * policy
  */
 
@@ -2323,7 +2324,7 @@ prism54_process_trap_helper(islpci_private *priv, enum oid_num_t oid,
 
         case DOT11_OID_BEACON:
                 send_formatted_event(priv,
-                                     "Received a beacon from an unkown AP",
+                                     "Received a beacon from an unknown AP",
                                      mlme, 0);
                 break;
 
diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
index 2505be56ae39..689d59a13d5b 100644
--- a/drivers/net/wireless/prism54/islpci_dev.c
+++ b/drivers/net/wireless/prism54/islpci_dev.c
@@ -19,6 +19,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 
 #include <linux/netdevice.h>
 #include <linux/ethtool.h>
@@ -41,6 +42,9 @@
 #define ISL3877_IMAGE_FILE      "isl3877"
 #define ISL3886_IMAGE_FILE      "isl3886"
 #define ISL3890_IMAGE_FILE      "isl3890"
+MODULE_FIRMWARE(ISL3877_IMAGE_FILE);
+MODULE_FIRMWARE(ISL3886_IMAGE_FILE);
+MODULE_FIRMWARE(ISL3890_IMAGE_FILE);
 
 static int prism54_bring_down(islpci_private *);
 static int islpci_alloc_memory(islpci_private *);
diff --git a/drivers/net/wireless/prism54/islpci_eth.c b/drivers/net/wireless/prism54/islpci_eth.c
index 872b64783e78..ac99eaaeabce 100644
--- a/drivers/net/wireless/prism54/islpci_eth.c
+++ b/drivers/net/wireless/prism54/islpci_eth.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/gfp.h>
 
 #include <linux/pci.h>
 #include <linux/delay.h>
diff --git a/drivers/net/wireless/prism54/islpci_hotplug.c b/drivers/net/wireless/prism54/islpci_hotplug.c
index 83d366258c81..dc14420a9adc 100644
--- a/drivers/net/wireless/prism54/islpci_hotplug.c
+++ b/drivers/net/wireless/prism54/islpci_hotplug.c
@@ -39,7 +39,7 @@ module_param(init_pcitm, int, 0);
  * driver_data
  * If you have an update for this please contact prism54-devel@prism54.org
  * The latest list can be found at http://prism54.org/supported_cards.php */
-static const struct pci_device_id prism54_id_tbl[] = {
+static DEFINE_PCI_DEVICE_TABLE(prism54_id_tbl) = {
         /* Intersil PRISM Duette/Prism GT Wireless LAN adapter */
         {
          0x1260, 0x3890,
@@ -181,7 +181,7 @@ prism54_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         isl38xx_disable_interrupts(priv->device_base);
 
         /* request for the interrupt before uploading the firmware */
-        rvalue = request_irq(pdev->irq, &islpci_interrupt,
+        rvalue = request_irq(pdev->irq, islpci_interrupt,
                              IRQF_SHARED, ndev->name, priv);
 
         if (rvalue) {
diff --git a/drivers/net/wireless/prism54/islpci_mgt.c b/drivers/net/wireless/prism54/islpci_mgt.c
index 69d2f882fd06..adb289723a96 100644
--- a/drivers/net/wireless/prism54/islpci_mgt.c
+++ b/drivers/net/wireless/prism54/islpci_mgt.c
@@ -21,6 +21,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 
 #include <asm/io.h>
 #include <asm/system.h>
diff --git a/drivers/net/wireless/prism54/islpci_mgt.h b/drivers/net/wireless/prism54/islpci_mgt.h
index 87a1734663da..0b27e50fe0d5 100644
--- a/drivers/net/wireless/prism54/islpci_mgt.h
+++ b/drivers/net/wireless/prism54/islpci_mgt.h
@@ -22,6 +22,7 @@
 
 #include <linux/wireless.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 
 /*
  *  Function definitions
diff --git a/drivers/net/wireless/prism54/oid_mgt.c b/drivers/net/wireless/prism54/oid_mgt.c
index 1187e6112a64..d66933d70fb9 100644
--- a/drivers/net/wireless/prism54/oid_mgt.c
+++ b/drivers/net/wireless/prism54/oid_mgt.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 
 #include "prismcompat.h"
 #include "islpci_dev.h"
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 1c88c2ea59aa..11865ea21875 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -35,7 +35,6 @@
 #include <linux/proc_fs.h>
 #include <linux/ptrace.h>
 #include <linux/seq_file.h>
-#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/init.h>
@@ -71,25 +70,7 @@ typedef u_char mac_addr[ETH_ALEN];	/* Hardware address */
 #include "rayctl.h"
 #include "ray_cs.h"
 
-/* All the PCMCIA modules use PCMCIA_DEBUG to control debugging.  If
-   you do not define PCMCIA_DEBUG at all, all the debug code will be
-   left out.  If you compile with PCMCIA_DEBUG=0, the debug code will
-   be present but disabled -- but it can then be enabled for specific
-   modules at load time with a 'pc_debug=#' option to insmod.
-*/
 
-#ifdef RAYLINK_DEBUG
-#define PCMCIA_DEBUG RAYLINK_DEBUG
-#endif
-#ifdef PCMCIA_DEBUG
-static int ray_debug;
-static int pc_debug = PCMCIA_DEBUG;
-module_param(pc_debug, int, 0);
-/* #define DEBUG(n, args...) if (pc_debug>(n)) printk(KERN_DEBUG args); */
-#define DEBUG(n, args...) if (pc_debug > (n)) printk(args);
-#else
-#define DEBUG(n, args...)
-#endif
 /** Prototypes based on PCMCIA skeleton driver *******************************/
 static int ray_config(struct pcmcia_device *link);
 static void ray_release(struct pcmcia_device *link);
@@ -325,7 +306,7 @@ static int ray_probe(struct pcmcia_device *p_dev)
         ray_dev_t *local;
         struct net_device *dev;
 
-        DEBUG(1, "ray_attach()\n");
+        dev_dbg(&p_dev->dev, "ray_attach()\n");
 
         /* Allocate space for private device-specific data */
         dev = alloc_etherdev(sizeof(ray_dev_t));
@@ -341,8 +322,7 @@ static int ray_probe(struct pcmcia_device *p_dev)
         p_dev->io.IOAddrLines = 5;
 
         /* Interrupt setup. For PCMCIA, driver takes what's given */
-        p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING | IRQ_HANDLE_PRESENT;
-        p_dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
+        p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
         p_dev->irq.Handler = &ray_interrupt;
 
         /* General socket configuration */
@@ -351,13 +331,12 @@ static int ray_probe(struct pcmcia_device *p_dev)
         p_dev->conf.ConfigIndex = 1;
 
         p_dev->priv = dev;
-        p_dev->irq.Instance = dev;
 
         local->finder = p_dev;
         local->card_status = CARD_INSERTED;
         local->authentication_state = UNAUTHENTICATED;
         local->num_multi = 0;
-        DEBUG(2, "ray_attach p_dev = %p,  dev = %p,  local = %p, intr = %p\n",
+        dev_dbg(&p_dev->dev, "ray_attach p_dev = %p,  dev = %p,  local = %p, intr = %p\n",
               p_dev, dev, local, &ray_interrupt);
 
         /* Raylink entries in the device structure */
@@ -370,7 +349,7 @@ static int ray_probe(struct pcmcia_device *p_dev)
 #endif /* WIRELESS_SPY */
 
 
-        DEBUG(2, "ray_cs ray_attach calling ether_setup.)\n");
+        dev_dbg(&p_dev->dev, "ray_cs ray_attach calling ether_setup.)\n");
         netif_stop_queue(dev);
 
         init_timer(&local->timer);
@@ -393,7 +372,7 @@ static void ray_detach(struct pcmcia_device *link)
         struct net_device *dev;
         ray_dev_t *local;
 
-        DEBUG(1, "ray_detach(0x%p)\n", link);
+        dev_dbg(&link->dev, "ray_detach\n");
 
         this_device = NULL;
         dev = link->priv;
@@ -408,7 +387,7 @@ static void ray_detach(struct pcmcia_device *link)
                         unregister_netdev(dev);
                 free_netdev(dev);
         }
-        DEBUG(2, "ray_cs ray_detach ending\n");
+        dev_dbg(&link->dev, "ray_cs ray_detach ending\n");
 } /* ray_detach */
 
 /*=============================================================================
@@ -416,19 +395,17 @@ static void ray_detach(struct pcmcia_device *link)
     is received, to configure the PCMCIA socket, and to make the
     ethernet device available to the system.
 =============================================================================*/
-#define CS_CHECK(fn, ret) \
-do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 #define MAX_TUPLE_SIZE 128
 static int ray_config(struct pcmcia_device *link)
 {
-        int last_fn = 0, last_ret = 0;
+        int ret = 0;
         int i;
         win_req_t req;
         memreq_t mem;
         struct net_device *dev = (struct net_device *)link->priv;
         ray_dev_t *local = netdev_priv(dev);
 
-        DEBUG(1, "ray_config(0x%p)\n", link);
+        dev_dbg(&link->dev, "ray_config\n");
 
         /* Determine card type and firmware version */
         printk(KERN_INFO "ray_cs Detected: %s%s%s%s\n",
@@ -440,14 +417,17 @@ static int ray_config(struct pcmcia_device *link)
         /* Now allocate an interrupt line.  Note that this does not
            actually assign a handler to the interrupt.
          */
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+        ret = pcmcia_request_irq(link, &link->irq);
+        if (ret)
+                goto failed;
         dev->irq = link->irq.AssignedIRQ;
 
         /* This actually configures the PCMCIA socket -- setting up
            the I/O windows and the interrupt mapping.
          */
-        CS_CHECK(RequestConfiguration,
-                 pcmcia_request_configuration(link, &link->conf));
+        ret = pcmcia_request_configuration(link, &link->conf);
+        if (ret)
+                goto failed;
 
 /*** Set up 32k window for shared memory (transmit and control) ************/
         req.Attributes =
@@ -455,10 +435,14 @@ static int ray_config(struct pcmcia_device *link)
         req.Base = 0;
         req.Size = 0x8000;
         req.AccessSpeed = ray_mem_speed;
-        CS_CHECK(RequestWindow, pcmcia_request_window(&link, &req, &link->win));
+        ret = pcmcia_request_window(link, &req, &link->win);
+        if (ret)
+                goto failed;
         mem.CardOffset = 0x0000;
         mem.Page = 0;
-        CS_CHECK(MapMemPage, pcmcia_map_mem_page(link->win, &mem));
+        ret = pcmcia_map_mem_page(link, link->win, &mem);
+        if (ret)
+                goto failed;
         local->sram = ioremap(req.Base, req.Size);
 
 /*** Set up 16k window for shared memory (receive buffer) ***************/
@@ -467,11 +451,14 @@ static int ray_config(struct pcmcia_device *link)
         req.Base = 0;
         req.Size = 0x4000;
         req.AccessSpeed = ray_mem_speed;
-        CS_CHECK(RequestWindow,
-                 pcmcia_request_window(&link, &req, &local->rmem_handle));
+        ret = pcmcia_request_window(link, &req, &local->rmem_handle);
+        if (ret)
+                goto failed;
         mem.CardOffset = 0x8000;
         mem.Page = 0;
-        CS_CHECK(MapMemPage, pcmcia_map_mem_page(local->rmem_handle, &mem));
+        ret = pcmcia_map_mem_page(link, local->rmem_handle, &mem);
+        if (ret)
+                goto failed;
         local->rmem = ioremap(req.Base, req.Size);
 
 /*** Set up window for attribute memory ***********************************/
@@ -480,22 +467,25 @@ static int ray_config(struct pcmcia_device *link)
         req.Base = 0;
         req.Size = 0x1000;
         req.AccessSpeed = ray_mem_speed;
-        CS_CHECK(RequestWindow,
-                 pcmcia_request_window(&link, &req, &local->amem_handle));
+        ret = pcmcia_request_window(link, &req, &local->amem_handle);
+        if (ret)
+                goto failed;
         mem.CardOffset = 0x0000;
         mem.Page = 0;
-        CS_CHECK(MapMemPage, pcmcia_map_mem_page(local->amem_handle, &mem));
+        ret = pcmcia_map_mem_page(link, local->amem_handle, &mem);
+        if (ret)
+                goto failed;
         local->amem = ioremap(req.Base, req.Size);
 
-        DEBUG(3, "ray_config sram=%p\n", local->sram);
-        DEBUG(3, "ray_config rmem=%p\n", local->rmem);
-        DEBUG(3, "ray_config amem=%p\n", local->amem);
+        dev_dbg(&link->dev, "ray_config sram=%p\n", local->sram);
+        dev_dbg(&link->dev, "ray_config rmem=%p\n", local->rmem);
+        dev_dbg(&link->dev, "ray_config amem=%p\n", local->amem);
         if (ray_init(dev) < 0) {
                 ray_release(link);
                 return -ENODEV;
         }
 
-        SET_NETDEV_DEV(dev, &handle_to_dev(link));
+        SET_NETDEV_DEV(dev, &link->dev);
         i = register_netdev(dev);
         if (i != 0) {
                 printk("ray_config register_netdev() failed\n");
@@ -511,9 +501,7 @@ static int ray_config(struct pcmcia_device *link)
 
         return 0;
 
-cs_failed:
-        cs_error(link, last_fn, last_ret);
-
+failed:
         ray_release(link);
         return -ENODEV;
 } /* ray_config */
@@ -543,9 +531,9 @@ static int ray_init(struct net_device *dev)
         struct ccs __iomem *pccs;
         ray_dev_t *local = netdev_priv(dev);
         struct pcmcia_device *link = local->finder;
-        DEBUG(1, "ray_init(0x%p)\n", dev);
+        dev_dbg(&link->dev, "ray_init(0x%p)\n", dev);
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(0, "ray_init - device not present\n");
+                dev_dbg(&link->dev, "ray_init - device not present\n");
                 return -1;
         }
 
@@ -567,13 +555,13 @@ static int ray_init(struct net_device *dev)
         local->fw_ver = local->startup_res.firmware_version[0];
         local->fw_bld = local->startup_res.firmware_version[1];
         local->fw_var = local->startup_res.firmware_version[2];
-        DEBUG(1, "ray_init firmware version %d.%d \n", local->fw_ver,
+        dev_dbg(&link->dev, "ray_init firmware version %d.%d \n", local->fw_ver,
               local->fw_bld);
 
         local->tib_length = 0x20;
         if ((local->fw_ver == 5) && (local->fw_bld >= 30))
                 local->tib_length = local->startup_res.tib_length;
-        DEBUG(2, "ray_init tib_length = 0x%02x\n", local->tib_length);
+        dev_dbg(&link->dev, "ray_init tib_length = 0x%02x\n", local->tib_length);
         /* Initialize CCS's to buffer free state */
         pccs = ccs_base(local);
         for (i = 0; i < NUMBER_OF_CCS; i++) {
@@ -592,7 +580,7 @@ static int ray_init(struct net_device *dev)
 
         clear_interrupt(local); /* Clear any interrupt from the card */
         local->card_status = CARD_AWAITING_PARAM;
-        DEBUG(2, "ray_init ending\n");
+        dev_dbg(&link->dev, "ray_init ending\n");
         return 0;
 } /* ray_init */
 
@@ -605,9 +593,9 @@ static int dl_startup_params(struct net_device *dev)
         struct ccs __iomem *pccs;
         struct pcmcia_device *link = local->finder;
 
-        DEBUG(1, "dl_startup_params entered\n");
+        dev_dbg(&link->dev, "dl_startup_params entered\n");
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_cs dl_startup_params - device not present\n");
+                dev_dbg(&link->dev, "ray_cs dl_startup_params - device not present\n");
                 return -1;
         }
 
@@ -625,7 +613,7 @@ static int dl_startup_params(struct net_device *dev)
         local->dl_param_ccs = ccsindex;
         pccs = ccs_base(local) + ccsindex;
         writeb(CCS_DOWNLOAD_STARTUP_PARAMS, &pccs->cmd);
-        DEBUG(2, "dl_startup_params start ccsindex = %d\n",
+        dev_dbg(&link->dev, "dl_startup_params start ccsindex = %d\n",
               local->dl_param_ccs);
         /* Interrupt the firmware to process the command */
         if (interrupt_ecf(local, ccsindex)) {
@@ -641,7 +629,7 @@ static int dl_startup_params(struct net_device *dev)
         local->timer.data = (long)local;
         local->timer.function = &verify_dl_startup;
         add_timer(&local->timer);
-        DEBUG(2,
+        dev_dbg(&link->dev,
               "ray_cs dl_startup_params started timer for verify_dl_startup\n");
         return 0;
 } /* dl_startup_params */
@@ -717,11 +705,11 @@ static void verify_dl_startup(u_long data)
         struct pcmcia_device *link = local->finder;
 
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_cs verify_dl_startup - device not present\n");
+                dev_dbg(&link->dev, "ray_cs verify_dl_startup - device not present\n");
                 return;
         }
-#ifdef PCMCIA_DEBUG
-        if (pc_debug > 2) {
+#if 0
+        {
                 int i;
                 printk(KERN_DEBUG
                        "verify_dl_startup parameters sent via ccs %d:\n",
@@ -760,7 +748,7 @@ static void start_net(u_long data)
         int ccsindex;
         struct pcmcia_device *link = local->finder;
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_cs start_net - device not present\n");
+                dev_dbg(&link->dev, "ray_cs start_net - device not present\n");
                 return;
         }
         /* Fill in the CCS fields for the ECF */
@@ -771,7 +759,7 @@ static void start_net(u_long data)
         writeb(0, &pccs->var.start_network.update_param);
         /* Interrupt the firmware to process the command */
         if (interrupt_ecf(local, ccsindex)) {
-                DEBUG(1, "ray start net failed - card not ready for intr\n");
+                dev_dbg(&link->dev, "ray start net failed - card not ready for intr\n");
                 writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
                 return;
         }
@@ -790,7 +778,7 @@ static void join_net(u_long data)
         struct pcmcia_device *link = local->finder;
 
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_cs join_net - device not present\n");
+                dev_dbg(&link->dev, "ray_cs join_net - device not present\n");
                 return;
         }
         /* Fill in the CCS fields for the ECF */
@@ -802,7 +790,7 @@ static void join_net(u_long data)
         writeb(0, &pccs->var.join_network.net_initiated);
         /* Interrupt the firmware to process the command */
         if (interrupt_ecf(local, ccsindex)) {
-                DEBUG(1, "ray join net failed - card not ready for intr\n");
+                dev_dbg(&link->dev, "ray join net failed - card not ready for intr\n");
                 writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
                 return;
         }
@@ -821,7 +809,7 @@ static void ray_release(struct pcmcia_device *link)
         ray_dev_t *local = netdev_priv(dev);
         int i;
 
-        DEBUG(1, "ray_release(0x%p)\n", link);
+        dev_dbg(&link->dev, "ray_release\n");
 
         del_timer(&local->timer);
 
@@ -829,15 +817,15 @@ static void ray_release(struct pcmcia_device *link)
         iounmap(local->rmem);
         iounmap(local->amem);
         /* Do bother checking to see if these succeed or not */
-        i = pcmcia_release_window(local->amem_handle);
+        i = pcmcia_release_window(link, local->amem_handle);
         if (i != 0)
-                DEBUG(0, "ReleaseWindow(local->amem) ret = %x\n", i);
-        i = pcmcia_release_window(local->rmem_handle);
+                dev_dbg(&link->dev, "ReleaseWindow(local->amem) ret = %x\n", i);
+        i = pcmcia_release_window(link, local->rmem_handle);
         if (i != 0)
-                DEBUG(0, "ReleaseWindow(local->rmem) ret = %x\n", i);
+                dev_dbg(&link->dev, "ReleaseWindow(local->rmem) ret = %x\n", i);
         pcmcia_disable_device(link);
 
-        DEBUG(2, "ray_release ending\n");
+        dev_dbg(&link->dev, "ray_release ending\n");
 }
 
 static int ray_suspend(struct pcmcia_device *link)
@@ -871,9 +859,9 @@ static int ray_dev_init(struct net_device *dev)
         ray_dev_t *local = netdev_priv(dev);
         struct pcmcia_device *link = local->finder;
 
-        DEBUG(1, "ray_dev_init(dev=%p)\n", dev);
+        dev_dbg(&link->dev, "ray_dev_init(dev=%p)\n", dev);
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_dev_init - device not present\n");
+                dev_dbg(&link->dev, "ray_dev_init - device not present\n");
                 return -1;
         }
 #ifdef RAY_IMMEDIATE_INIT
@@ -887,7 +875,7 @@ static int ray_dev_init(struct net_device *dev)
         /* Postpone the card init so that we can still configure the card,
          * for example using the Wireless Extensions. The init will happen
          * in ray_open() - Jean II */
-        DEBUG(1,
+        dev_dbg(&link->dev,
               "ray_dev_init: postponing card init to ray_open() ; Status = %d\n",
               local->card_status);
 #endif /* RAY_IMMEDIATE_INIT */
@@ -896,7 +884,7 @@ static int ray_dev_init(struct net_device *dev)
         memcpy(dev->dev_addr, &local->sparm.b4.a_mac_addr, ADDRLEN);
         memset(dev->broadcast, 0xff, ETH_ALEN);
 
-        DEBUG(2, "ray_dev_init ending\n");
+        dev_dbg(&link->dev, "ray_dev_init ending\n");
         return 0;
 }
 
@@ -906,9 +894,9 @@ static int ray_dev_config(struct net_device *dev, struct ifmap *map)
         ray_dev_t *local = netdev_priv(dev);
         struct pcmcia_device *link = local->finder;
         /* Dummy routine to satisfy device structure */
-        DEBUG(1, "ray_dev_config(dev=%p,ifmap=%p)\n", dev, map);
+        dev_dbg(&link->dev, "ray_dev_config(dev=%p,ifmap=%p)\n", dev, map);
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_dev_config - device not present\n");
+                dev_dbg(&link->dev, "ray_dev_config - device not present\n");
                 return -1;
         }
 
@@ -924,14 +912,14 @@ static netdev_tx_t ray_dev_start_xmit(struct sk_buff *skb,
         short length = skb->len;
 
         if (!pcmcia_dev_present(link)) {
-                DEBUG(2, "ray_dev_start_xmit - device not present\n");
+                dev_dbg(&link->dev, "ray_dev_start_xmit - device not present\n");
                 dev_kfree_skb(skb);
                 return NETDEV_TX_OK;
         }
 
-        DEBUG(3, "ray_dev_start_xmit(skb=%p, dev=%p)\n", skb, dev);
+        dev_dbg(&link->dev, "ray_dev_start_xmit(skb=%p, dev=%p)\n", skb, dev);
         if (local->authentication_state == NEED_TO_AUTH) {
-                DEBUG(0, "ray_cs Sending authentication request.\n");
+                dev_dbg(&link->dev, "ray_cs Sending authentication request.\n");
                 if (!build_auth_frame(local, local->auth_id, OPEN_AUTH_REQUEST)) {
                         local->authentication_state = AUTHENTICATED;
                         netif_stop_queue(dev);
@@ -971,7 +959,7 @@ static int ray_hw_xmit(unsigned char *data, int len, struct net_device *dev,
         struct tx_msg __iomem *ptx;     /* Address of xmit buffer in PC space */
         short int addr;         /* Address of xmit buffer in card space */
 
-        DEBUG(3, "ray_hw_xmit(data=%p, len=%d, dev=%p)\n", data, len, dev);
+        pr_debug("ray_hw_xmit(data=%p, len=%d, dev=%p)\n", data, len, dev);
         if (len + TX_HEADER_LENGTH > TX_BUF_SIZE) {
                 printk(KERN_INFO "ray_hw_xmit packet too large: %d bytes\n",
                        len);
@@ -979,9 +967,9 @@ static int ray_hw_xmit(unsigned char *data, int len, struct net_device *dev,
         }
         switch (ccsindex = get_free_tx_ccs(local)) {
         case ECCSBUSY:
-                DEBUG(2, "ray_hw_xmit tx_ccs table busy\n");
+                pr_debug("ray_hw_xmit tx_ccs table busy\n");
         case ECCSFULL:
-                DEBUG(2, "ray_hw_xmit No free tx ccs\n");
+                pr_debug("ray_hw_xmit No free tx ccs\n");
         case ECARDGONE:
                 netif_stop_queue(dev);
                 return XMIT_NO_CCS;
@@ -1018,12 +1006,12 @@ static int ray_hw_xmit(unsigned char *data, int len, struct net_device *dev,
         writeb(PSM_CAM, &pccs->var.tx_request.pow_sav_mode);
         writeb(local->net_default_tx_rate, &pccs->var.tx_request.tx_rate);
         writeb(0, &pccs->var.tx_request.antenna);
-        DEBUG(3, "ray_hw_xmit default_tx_rate = 0x%x\n",
+        pr_debug("ray_hw_xmit default_tx_rate = 0x%x\n",
               local->net_default_tx_rate);
 
         /* Interrupt the firmware to process the command */
         if (interrupt_ecf(local, ccsindex)) {
-                DEBUG(2, "ray_hw_xmit failed - ECF not ready for intr\n");
+                pr_debug("ray_hw_xmit failed - ECF not ready for intr\n");
 /* TBD very inefficient to copy packet to buffer, and then not
    send it, but the alternative is to queue the messages and that
    won't be done for a while.  Maybe set tbusy until a CCS is free?
@@ -1040,7 +1028,7 @@ static int translate_frame(ray_dev_t *local, struct tx_msg __iomem *ptx,
 {
         __be16 proto = ((struct ethhdr *)data)->h_proto;
         if (ntohs(proto) >= 1536) { /* DIX II ethernet frame */
-                DEBUG(3, "ray_cs translate_frame DIX II\n");
+                pr_debug("ray_cs translate_frame DIX II\n");
                 /* Copy LLC header to card buffer */
                 memcpy_toio(&ptx->var, eth2_llc, sizeof(eth2_llc));
                 memcpy_toio(((void __iomem *)&ptx->var) + sizeof(eth2_llc),
@@ -1056,9 +1044,9 @@ static int translate_frame(ray_dev_t *local, struct tx_msg __iomem *ptx,
                             len - ETH_HLEN);
                 return (int)sizeof(struct snaphdr_t) - ETH_HLEN;
         } else { /* already  802 type, and proto is length */
-                DEBUG(3, "ray_cs translate_frame 802\n");
+                pr_debug("ray_cs translate_frame 802\n");
                 if (proto == htons(0xffff)) { /* evil netware IPX 802.3 without LLC */
-                        DEBUG(3, "ray_cs translate_frame evil IPX\n");
+                        pr_debug("ray_cs translate_frame evil IPX\n");
                         memcpy_toio(&ptx->var, data + ETH_HLEN, len - ETH_HLEN);
                         return 0 - ETH_HLEN;
                 }
@@ -1603,7 +1591,7 @@ static int ray_open(struct net_device *dev)
         struct pcmcia_device *link;
         link = local->finder;
 
-        DEBUG(1, "ray_open('%s')\n", dev->name);
+        dev_dbg(&link->dev, "ray_open('%s')\n", dev->name);
 
         if (link->open == 0)
                 local->num_multi = 0;
@@ -1613,7 +1601,7 @@ static int ray_open(struct net_device *dev)
         if (local->card_status == CARD_AWAITING_PARAM) {
                 int i;
 
-                DEBUG(1, "ray_open: doing init now !\n");
+                dev_dbg(&link->dev, "ray_open: doing init now !\n");
 
                 /* Download startup parameters */
                 if ((i = dl_startup_params(dev)) < 0) {
@@ -1629,7 +1617,7 @@ static int ray_open(struct net_device *dev)
         else
                 netif_start_queue(dev);
 
-        DEBUG(2, "ray_open ending\n");
+        dev_dbg(&link->dev, "ray_open ending\n");
         return 0;
 } /* end ray_open */
 
@@ -1640,7 +1628,7 @@ static int ray_dev_close(struct net_device *dev)
         struct pcmcia_device *link;
         link = local->finder;
 
-        DEBUG(1, "ray_dev_close('%s')\n", dev->name);
+        dev_dbg(&link->dev, "ray_dev_close('%s')\n", dev->name);
 
         link->open--;
         netif_stop_queue(dev);
@@ -1656,7 +1644,7 @@ static int ray_dev_close(struct net_device *dev)
 /*===========================================================================*/
 static void ray_reset(struct net_device *dev)
 {
-        DEBUG(1, "ray_reset entered\n");
+        pr_debug("ray_reset entered\n");
         return;
 }
 
@@ -1669,17 +1657,17 @@ static int interrupt_ecf(ray_dev_t *local, int ccs)
         struct pcmcia_device *link = local->finder;
 
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_cs interrupt_ecf - device not present\n");
+                dev_dbg(&link->dev, "ray_cs interrupt_ecf - device not present\n");
                 return -1;
         }
-        DEBUG(2, "interrupt_ecf(local=%p, ccs = 0x%x\n", local, ccs);
+        dev_dbg(&link->dev, "interrupt_ecf(local=%p, ccs = 0x%x\n", local, ccs);
 
         while (i &&
                (readb(local->amem + CIS_OFFSET + ECF_INTR_OFFSET) &
                 ECF_INTR_SET))
                 i--;
         if (i == 0) {
-                DEBUG(2, "ray_cs interrupt_ecf card not ready for interrupt\n");
+                dev_dbg(&link->dev, "ray_cs interrupt_ecf card not ready for interrupt\n");
                 return -1;
         }
         /* Fill the mailbox, then kick the card */
@@ -1698,12 +1686,12 @@ static int get_free_tx_ccs(ray_dev_t *local)
         struct pcmcia_device *link = local->finder;
 
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_cs get_free_tx_ccs - device not present\n");
+                dev_dbg(&link->dev, "ray_cs get_free_tx_ccs - device not present\n");
                 return ECARDGONE;
         }
 
         if (test_and_set_bit(0, &local->tx_ccs_lock)) {
-                DEBUG(1, "ray_cs tx_ccs_lock busy\n");
+                dev_dbg(&link->dev, "ray_cs tx_ccs_lock busy\n");
                 return ECCSBUSY;
         }
 
@@ -1716,7 +1704,7 @@ static int get_free_tx_ccs(ray_dev_t *local)
                 }
         }
         local->tx_ccs_lock = 0;
-        DEBUG(2, "ray_cs ERROR no free tx CCS for raylink card\n");
+        dev_dbg(&link->dev, "ray_cs ERROR no free tx CCS for raylink card\n");
         return ECCSFULL;
 } /* get_free_tx_ccs */
 
@@ -1730,11 +1718,11 @@ static int get_free_ccs(ray_dev_t *local)
         struct pcmcia_device *link = local->finder;
 
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_cs get_free_ccs - device not present\n");
+                dev_dbg(&link->dev, "ray_cs get_free_ccs - device not present\n");
                 return ECARDGONE;
         }
         if (test_and_set_bit(0, &local->ccs_lock)) {
-                DEBUG(1, "ray_cs ccs_lock busy\n");
+                dev_dbg(&link->dev, "ray_cs ccs_lock busy\n");
                 return ECCSBUSY;
         }
 
@@ -1747,7 +1735,7 @@ static int get_free_ccs(ray_dev_t *local)
                 }
         }
         local->ccs_lock = 0;
-        DEBUG(1, "ray_cs ERROR no free CCS for raylink card\n");
+        dev_dbg(&link->dev, "ray_cs ERROR no free CCS for raylink card\n");
         return ECCSFULL;
 } /* get_free_ccs */
 
@@ -1823,7 +1811,7 @@ static struct net_device_stats *ray_get_stats(struct net_device *dev)
         struct pcmcia_device *link = local->finder;
         struct status __iomem *p = local->sram + STATUS_BASE;
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_cs net_device_stats - device not present\n");
+                dev_dbg(&link->dev, "ray_cs net_device_stats - device not present\n");
                 return &local->stats;
         }
         if (readb(&p->mrx_overflow_for_host)) {
@@ -1856,12 +1844,12 @@ static void ray_update_parm(struct net_device *dev, UCHAR objid, UCHAR *value,
         struct ccs __iomem *pccs;
 
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_update_parm - device not present\n");
+                dev_dbg(&link->dev, "ray_update_parm - device not present\n");
                 return;
         }
 
         if ((ccsindex = get_free_ccs(local)) < 0) {
-                DEBUG(0, "ray_update_parm - No free ccs\n");
+                dev_dbg(&link->dev, "ray_update_parm - No free ccs\n");
                 return;
         }
         pccs = ccs_base(local) + ccsindex;
@@ -1874,7 +1862,7 @@ static void ray_update_parm(struct net_device *dev, UCHAR objid, UCHAR *value,
         }
         /* Interrupt the firmware to process the command */
         if (interrupt_ecf(local, ccsindex)) {
-                DEBUG(0, "ray_cs associate failed - ECF not ready for intr\n");
+                dev_dbg(&link->dev, "ray_cs associate failed - ECF not ready for intr\n");
                 writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
         }
 }
@@ -1882,21 +1870,19 @@ static void ray_update_parm(struct net_device *dev, UCHAR objid, UCHAR *value,
 /*===========================================================================*/
 static void ray_update_multi_list(struct net_device *dev, int all)
 {
-        struct dev_mc_list *dmi, **dmip;
         int ccsindex;
         struct ccs __iomem *pccs;
-        int i = 0;
         ray_dev_t *local = netdev_priv(dev);
         struct pcmcia_device *link = local->finder;
         void __iomem *p = local->sram + HOST_TO_ECF_BASE;
 
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_update_multi_list - device not present\n");
+                dev_dbg(&link->dev, "ray_update_multi_list - device not present\n");
                 return;
         } else
-                DEBUG(2, "ray_update_multi_list(%p)\n", dev);
+                dev_dbg(&link->dev, "ray_update_multi_list(%p)\n", dev);
         if ((ccsindex = get_free_ccs(local)) < 0) {
-                DEBUG(1, "ray_update_multi - No free ccs\n");
+                dev_dbg(&link->dev, "ray_update_multi - No free ccs\n");
                 return;
         }
         pccs = ccs_base(local) + ccsindex;
@@ -1906,11 +1892,13 @@ static void ray_update_multi_list(struct net_device *dev, int all)
                 writeb(0xff, &pccs->var);
                 local->num_multi = 0xff;
         } else {
+                struct dev_mc_list *dmi;
+                int i = 0;
+
                 /* Copy the kernel's list of MC addresses to card */
-                for (dmip = &dev->mc_list; (dmi = *dmip) != NULL;
-                     dmip = &dmi->next) {
+                netdev_for_each_mc_addr(dmi, dev) {
                         memcpy_toio(p, dmi->dmi_addr, ETH_ALEN);
-                        DEBUG(1,
+                        dev_dbg(&link->dev,
                               "ray_update_multi add addr %02x%02x%02x%02x%02x%02x\n",
                               dmi->dmi_addr[0], dmi->dmi_addr[1],
                               dmi->dmi_addr[2], dmi->dmi_addr[3],
@@ -1921,12 +1909,12 @@ static void ray_update_multi_list(struct net_device *dev, int all)
                 if (i > 256 / ADDRLEN)
                         i = 256 / ADDRLEN;
                 writeb((UCHAR) i, &pccs->var);
-                DEBUG(1, "ray_cs update_multi %d addresses in list\n", i);
+                dev_dbg(&link->dev, "ray_cs update_multi %d addresses in list\n", i);
                 /* Interrupt the firmware to process the command */
                 local->num_multi = i;
         }
         if (interrupt_ecf(local, ccsindex)) {
-                DEBUG(1,
+                dev_dbg(&link->dev,
                       "ray_cs update_multi failed - ECF not ready for intr\n");
                 writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
         }
@@ -1938,11 +1926,11 @@ static void set_multicast_list(struct net_device *dev)
         ray_dev_t *local = netdev_priv(dev);
         UCHAR promisc;
 
-        DEBUG(2, "ray_cs set_multicast_list(%p)\n", dev);
+        pr_debug("ray_cs set_multicast_list(%p)\n", dev);
 
         if (dev->flags & IFF_PROMISC) {
                 if (local->sparm.b5.a_promiscuous_mode == 0) {
-                        DEBUG(1, "ray_cs set_multicast_list promisc on\n");
+                        pr_debug("ray_cs set_multicast_list promisc on\n");
                         local->sparm.b5.a_promiscuous_mode = 1;
                         promisc = 1;
                         ray_update_parm(dev, OBJID_promiscuous_mode,
@@ -1950,7 +1938,7 @@ static void set_multicast_list(struct net_device *dev)
                 }
         } else {
                 if (local->sparm.b5.a_promiscuous_mode == 1) {
-                        DEBUG(1, "ray_cs set_multicast_list promisc off\n");
+                        pr_debug("ray_cs set_multicast_list promisc off\n");
                         local->sparm.b5.a_promiscuous_mode = 0;
                         promisc = 0;
                         ray_update_parm(dev, OBJID_promiscuous_mode,
@@ -1961,7 +1949,7 @@ static void set_multicast_list(struct net_device *dev)
         if (dev->flags & IFF_ALLMULTI)
                 ray_update_multi_list(dev, 1);
         else {
-                if (local->num_multi != dev->mc_count)
+                if (local->num_multi != netdev_mc_count(dev))
                         ray_update_multi_list(dev, 0);
         }
 } /* end set_multicast_list */
@@ -1984,19 +1972,19 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
         if (dev == NULL)        /* Note that we want interrupts with dev->start == 0 */
                 return IRQ_NONE;
 
-        DEBUG(4, "ray_cs: interrupt for *dev=%p\n", dev);
+        pr_debug("ray_cs: interrupt for *dev=%p\n", dev);
 
         local = netdev_priv(dev);
         link = (struct pcmcia_device *)local->finder;
         if (!pcmcia_dev_present(link)) {
-                DEBUG(2,
-                      "ray_cs interrupt from device not present or suspended.\n");
+                pr_debug(
+                        "ray_cs interrupt from device not present or suspended.\n");
                 return IRQ_NONE;
         }
         rcsindex = readb(&((struct scb __iomem *)(local->sram))->rcs_index);
 
         if (rcsindex >= (NUMBER_OF_CCS + NUMBER_OF_RCS)) {
-                DEBUG(1, "ray_cs interrupt bad rcsindex = 0x%x\n", rcsindex);
+                dev_dbg(&link->dev, "ray_cs interrupt bad rcsindex = 0x%x\n", rcsindex);
                 clear_interrupt(local);
                 return IRQ_HANDLED;
         }
@@ -2008,33 +1996,33 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
                 case CCS_DOWNLOAD_STARTUP_PARAMS:       /* Happens in firmware someday */
                         del_timer(&local->timer);
                         if (status == CCS_COMMAND_COMPLETE) {
-                                DEBUG(1,
+                                dev_dbg(&link->dev,
                                       "ray_cs interrupt download_startup_parameters OK\n");
                         } else {
-                                DEBUG(1,
+                                dev_dbg(&link->dev,
                                       "ray_cs interrupt download_startup_parameters fail\n");
                         }
                         break;
                 case CCS_UPDATE_PARAMS:
-                        DEBUG(1, "ray_cs interrupt update params done\n");
+                        dev_dbg(&link->dev, "ray_cs interrupt update params done\n");
                         if (status != CCS_COMMAND_COMPLETE) {
                                 tmp =
                                     readb(&pccs->var.update_param.
                                           failure_cause);
-                                DEBUG(0,
+                                dev_dbg(&link->dev,
                                       "ray_cs interrupt update params failed - reason %d\n",
                                       tmp);
                         }
                         break;
                 case CCS_REPORT_PARAMS:
-                        DEBUG(1, "ray_cs interrupt report params done\n");
+                        dev_dbg(&link->dev, "ray_cs interrupt report params done\n");
                         break;
                 case CCS_UPDATE_MULTICAST_LIST: /* Note that this CCS isn't returned */
-                        DEBUG(1,
+                        dev_dbg(&link->dev,
                               "ray_cs interrupt CCS Update Multicast List done\n");
                         break;
                 case CCS_UPDATE_POWER_SAVINGS_MODE:
-                        DEBUG(1,
+                        dev_dbg(&link->dev,
                               "ray_cs interrupt update power save mode done\n");
                         break;
                 case CCS_START_NETWORK:
@@ -2043,11 +2031,11 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
                                 if (readb
                                     (&pccs->var.start_network.net_initiated) ==
                                     1) {
-                                        DEBUG(0,
+                                        dev_dbg(&link->dev,
                                               "ray_cs interrupt network \"%s\" started\n",
                                               local->sparm.b4.a_current_ess_id);
                                 } else {
-                                        DEBUG(0,
+                                        dev_dbg(&link->dev,
                                               "ray_cs interrupt network \"%s\" joined\n",
                                               local->sparm.b4.a_current_ess_id);
                                 }
@@ -2075,12 +2063,12 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
                                 local->timer.expires = jiffies + HZ * 5;
                                 local->timer.data = (long)local;
                                 if (status == CCS_START_NETWORK) {
-                                        DEBUG(0,
+                                        dev_dbg(&link->dev,
                                               "ray_cs interrupt network \"%s\" start failed\n",
                                               local->sparm.b4.a_current_ess_id);
                                         local->timer.function = &start_net;
                                 } else {
-                                        DEBUG(0,
+                                        dev_dbg(&link->dev,
                                               "ray_cs interrupt network \"%s\" join failed\n",
                                               local->sparm.b4.a_current_ess_id);
                                         local->timer.function = &join_net;
@@ -2091,19 +2079,19 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
                 case CCS_START_ASSOCIATION:
                         if (status == CCS_COMMAND_COMPLETE) {
                                 local->card_status = CARD_ASSOC_COMPLETE;
-                                DEBUG(0, "ray_cs association successful\n");
+                                dev_dbg(&link->dev, "ray_cs association successful\n");
                         } else {
-                                DEBUG(0, "ray_cs association failed,\n");
+                                dev_dbg(&link->dev, "ray_cs association failed,\n");
                                 local->card_status = CARD_ASSOC_FAILED;
                                 join_net((u_long) local);
                         }
                         break;
                 case CCS_TX_REQUEST:
                         if (status == CCS_COMMAND_COMPLETE) {
-                                DEBUG(3,
+                                dev_dbg(&link->dev,
                                       "ray_cs interrupt tx request complete\n");
                         } else {
-                                DEBUG(1,
+                                dev_dbg(&link->dev,
                                       "ray_cs interrupt tx request failed\n");
                         }
                         if (!sniffer)
@@ -2111,21 +2099,21 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
                         netif_wake_queue(dev);
                         break;
                 case CCS_TEST_MEMORY:
-                        DEBUG(1, "ray_cs interrupt mem test done\n");
+                        dev_dbg(&link->dev, "ray_cs interrupt mem test done\n");
                         break;
                 case CCS_SHUTDOWN:
-                        DEBUG(1,
+                        dev_dbg(&link->dev,
                               "ray_cs interrupt Unexpected CCS returned - Shutdown\n");
                         break;
                 case CCS_DUMP_MEMORY:
-                        DEBUG(1, "ray_cs interrupt dump memory done\n");
+                        dev_dbg(&link->dev, "ray_cs interrupt dump memory done\n");
                         break;
                 case CCS_START_TIMER:
-                        DEBUG(2,
+                        dev_dbg(&link->dev,
                               "ray_cs interrupt DING - raylink timer expired\n");
                         break;
                 default:
-                        DEBUG(1,
+                        dev_dbg(&link->dev,
                               "ray_cs interrupt Unexpected CCS 0x%x returned 0x%x\n",
                               rcsindex, cmd);
                 }
@@ -2139,7 +2127,7 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
                         ray_rx(dev, local, prcs);
                         break;
                 case REJOIN_NET_COMPLETE:
-                        DEBUG(1, "ray_cs interrupt rejoin net complete\n");
+                        dev_dbg(&link->dev, "ray_cs interrupt rejoin net complete\n");
                         local->card_status = CARD_ACQ_COMPLETE;
                         /* do we need to clear tx buffers CCS's? */
                         if (local->sparm.b4.a_network_type == ADHOC) {
@@ -2149,7 +2137,7 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
                                 memcpy_fromio(&local->bss_id,
                                               prcs->var.rejoin_net_complete.
                                               bssid, ADDRLEN);
-                                DEBUG(1,
+                                dev_dbg(&link->dev,
                                       "ray_cs new BSSID = %02x%02x%02x%02x%02x%02x\n",
                                       local->bss_id[0], local->bss_id[1],
                                       local->bss_id[2], local->bss_id[3],
@@ -2159,15 +2147,15 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
                         }
                         break;
                 case ROAMING_INITIATED:
-                        DEBUG(1, "ray_cs interrupt roaming initiated\n");
+                        dev_dbg(&link->dev, "ray_cs interrupt roaming initiated\n");
                         netif_stop_queue(dev);
                         local->card_status = CARD_DOING_ACQ;
                         break;
                 case JAPAN_CALL_SIGN_RXD:
-                        DEBUG(1, "ray_cs interrupt japan call sign rx\n");
+                        dev_dbg(&link->dev, "ray_cs interrupt japan call sign rx\n");
                         break;
                 default:
-                        DEBUG(1,
+                        dev_dbg(&link->dev,
                               "ray_cs Unexpected interrupt for RCS 0x%x cmd = 0x%x\n",
                               rcsindex,
                               (unsigned int)readb(&prcs->interrupt_id));
@@ -2186,7 +2174,7 @@ static void ray_rx(struct net_device *dev, ray_dev_t *local,
         int rx_len;
         unsigned int pkt_addr;
         void __iomem *pmsg;
-        DEBUG(4, "ray_rx process rx packet\n");
+        pr_debug("ray_rx process rx packet\n");
 
         /* Calculate address of packet within Rx buffer */
         pkt_addr = ((readb(&prcs->var.rx_packet.rx_data_ptr[0]) << 8)
@@ -2199,28 +2187,28 @@ static void ray_rx(struct net_device *dev, ray_dev_t *local,
         pmsg = local->rmem + pkt_addr;
         switch (readb(pmsg)) {
         case DATA_TYPE:
-                DEBUG(4, "ray_rx data type\n");
+                pr_debug("ray_rx data type\n");
                 rx_data(dev, prcs, pkt_addr, rx_len);
                 break;
         case AUTHENTIC_TYPE:
-                DEBUG(4, "ray_rx authentic type\n");
+                pr_debug("ray_rx authentic type\n");
                 if (sniffer)
                         rx_data(dev, prcs, pkt_addr, rx_len);
                 else
                         rx_authenticate(local, prcs, pkt_addr, rx_len);
                 break;
         case DEAUTHENTIC_TYPE:
-                DEBUG(4, "ray_rx deauth type\n");
+                pr_debug("ray_rx deauth type\n");
                 if (sniffer)
                         rx_data(dev, prcs, pkt_addr, rx_len);
                 else
                         rx_deauthenticate(local, prcs, pkt_addr, rx_len);
                 break;
         case NULL_MSG_TYPE:
-                DEBUG(3, "ray_cs rx NULL msg\n");
+                pr_debug("ray_cs rx NULL msg\n");
                 break;
         case BEACON_TYPE:
-                DEBUG(4, "ray_rx beacon type\n");
+                pr_debug("ray_rx beacon type\n");
                 if (sniffer)
                         rx_data(dev, prcs, pkt_addr, rx_len);
 
@@ -2233,7 +2221,7 @@ static void ray_rx(struct net_device *dev, ray_dev_t *local,
                 ray_get_stats(dev);
                 break;
         default:
-                DEBUG(0, "ray_cs unknown pkt type %2x\n",
+                pr_debug("ray_cs unknown pkt type %2x\n",
                       (unsigned int)readb(pmsg));
                 break;
         }
@@ -2262,7 +2250,7 @@ static void rx_data(struct net_device *dev, struct rcs __iomem *prcs,
                             rx_len >
                             (dev->mtu + RX_MAC_HEADER_LENGTH + ETH_HLEN +
                              FCS_LEN)) {
-                                DEBUG(0,
+                                pr_debug(
                                       "ray_cs invalid packet length %d received \n",
                                       rx_len);
                                 return;
@@ -2273,17 +2261,17 @@ static void rx_data(struct net_device *dev, struct rcs __iomem *prcs,
                             rx_len >
                             (dev->mtu + RX_MAC_HEADER_LENGTH + ETH_HLEN +
                              FCS_LEN)) {
-                                DEBUG(0,
+                                pr_debug(
                                       "ray_cs invalid packet length %d received \n",
                                       rx_len);
                                 return;
                         }
                 }
         }
-        DEBUG(4, "ray_cs rx_data packet\n");
+        pr_debug("ray_cs rx_data packet\n");
         /* If fragmented packet, verify sizes of fragments add up */
         if (readb(&prcs->var.rx_packet.next_frag_rcs_index) != 0xFF) {
-                DEBUG(1, "ray_cs rx'ed fragment\n");
+                pr_debug("ray_cs rx'ed fragment\n");
                 tmp = (readb(&prcs->var.rx_packet.totalpacketlength[0]) << 8)
                     + readb(&prcs->var.rx_packet.totalpacketlength[1]);
                 total_len = tmp;
@@ -2301,7 +2289,7 @@ static void rx_data(struct net_device *dev, struct rcs __iomem *prcs,
                 } while (1);
 
                 if (tmp < 0) {
-                        DEBUG(0,
+                        pr_debug(
                               "ray_cs rx_data fragment lengths don't add up\n");
                         local->stats.rx_dropped++;
                         release_frag_chain(local, prcs);
@@ -2313,7 +2301,7 @@ static void rx_data(struct net_device *dev, struct rcs __iomem *prcs,
 
         skb = dev_alloc_skb(total_len + 5);
         if (skb == NULL) {
-                DEBUG(0, "ray_cs rx_data could not allocate skb\n");
+                pr_debug("ray_cs rx_data could not allocate skb\n");
                 local->stats.rx_dropped++;
                 if (readb(&prcs->var.rx_packet.next_frag_rcs_index) != 0xFF)
                         release_frag_chain(local, prcs);
@@ -2321,7 +2309,7 @@ static void rx_data(struct net_device *dev, struct rcs __iomem *prcs,
         }
         skb_reserve(skb, 2);    /* Align IP on 16 byte (TBD check this) */
 
-        DEBUG(4, "ray_cs rx_data total_len = %x, rx_len = %x\n", total_len,
+        pr_debug("ray_cs rx_data total_len = %x, rx_len = %x\n", total_len,
               rx_len);
 
 /************************/
@@ -2354,7 +2342,7 @@ static void rx_data(struct net_device *dev, struct rcs __iomem *prcs,
         tmp = 17;
         if (readb(&prcs->var.rx_packet.next_frag_rcs_index) != 0xFF) {
                 prcslink = prcs;
-                DEBUG(1, "ray_cs rx_data in fragment loop\n");
+                pr_debug("ray_cs rx_data in fragment loop\n");
                 do {
                         prcslink = rcs_base(local)
                             +
@@ -2426,8 +2414,8 @@ static void untranslate(ray_dev_t *local, struct sk_buff *skb, int len)
         memcpy(destaddr, ieee80211_get_DA(pmac), ADDRLEN);
         memcpy(srcaddr, ieee80211_get_SA(pmac), ADDRLEN);
 
-#ifdef PCMCIA_DEBUG
-        if (pc_debug > 3) {
+#if 0
+        if {
                 print_hex_dump(KERN_DEBUG, "skb->data before untranslate: ",
                                DUMP_PREFIX_NONE, 16, 1,
                                skb->data, 64, true);
@@ -2441,7 +2429,7 @@ static void untranslate(ray_dev_t *local, struct sk_buff *skb, int len)
 
         if (psnap->dsap != 0xaa || psnap->ssap != 0xaa || psnap->ctrl != 3) {
                 /* not a snap type so leave it alone */
-                DEBUG(3, "ray_cs untranslate NOT SNAP %02x %02x %02x\n",
+                pr_debug("ray_cs untranslate NOT SNAP %02x %02x %02x\n",
                       psnap->dsap, psnap->ssap, psnap->ctrl);
 
                 delta = RX_MAC_HEADER_LENGTH - ETH_HLEN;
@@ -2450,7 +2438,7 @@ static void untranslate(ray_dev_t *local, struct sk_buff *skb, int len)
         } else { /* Its a SNAP */
                 if (memcmp(psnap->org, org_bridge, 3) == 0) {
                 /* EtherII and nuke the LLC */
-                        DEBUG(3, "ray_cs untranslate Bridge encap\n");
+                        pr_debug("ray_cs untranslate Bridge encap\n");
                         delta = RX_MAC_HEADER_LENGTH
                             + sizeof(struct snaphdr_t) - ETH_HLEN;
                         peth = (struct ethhdr *)(skb->data + delta);
@@ -2459,14 +2447,14 @@ static void untranslate(ray_dev_t *local, struct sk_buff *skb, int len)
                         switch (ntohs(type)) {
                         case ETH_P_IPX:
                         case ETH_P_AARP:
-                                DEBUG(3, "ray_cs untranslate RFC IPX/AARP\n");
+                                pr_debug("ray_cs untranslate RFC IPX/AARP\n");
                                 delta = RX_MAC_HEADER_LENGTH - ETH_HLEN;
                                 peth = (struct ethhdr *)(skb->data + delta);
                                 peth->h_proto =
                                     htons(len - RX_MAC_HEADER_LENGTH);
                                 break;
                         default:
-                                DEBUG(3, "ray_cs untranslate RFC default\n");
+                                pr_debug("ray_cs untranslate RFC default\n");
                                 delta = RX_MAC_HEADER_LENGTH +
                                     sizeof(struct snaphdr_t) - ETH_HLEN;
                                 peth = (struct ethhdr *)(skb->data + delta);
@@ -2482,12 +2470,12 @@ static void untranslate(ray_dev_t *local, struct sk_buff *skb, int len)
         }
 /* TBD reserve  skb_reserve(skb, delta); */
         skb_pull(skb, delta);
-        DEBUG(3, "untranslate after skb_pull(%d), skb->data = %p\n", delta,
+        pr_debug("untranslate after skb_pull(%d), skb->data = %p\n", delta,
               skb->data);
         memcpy(peth->h_dest, destaddr, ADDRLEN);
         memcpy(peth->h_source, srcaddr, ADDRLEN);
-#ifdef PCMCIA_DEBUG
-        if (pc_debug > 3) {
+#if 0
+        {
                 int i;
                 printk(KERN_DEBUG "skb->data after untranslate:");
                 for (i = 0; i < 64; i++)
@@ -2529,7 +2517,7 @@ static void release_frag_chain(ray_dev_t *local, struct rcs __iomem *prcs)
         while (tmp--) {
                 writeb(CCS_BUFFER_FREE, &prcslink->buffer_status);
                 if (rcsindex >= (NUMBER_OF_CCS + NUMBER_OF_RCS)) {
-                        DEBUG(1, "ray_cs interrupt bad rcsindex = 0x%x\n",
+                        pr_debug("ray_cs interrupt bad rcsindex = 0x%x\n",
                               rcsindex);
                         break;
                 }
@@ -2543,9 +2531,9 @@ static void release_frag_chain(ray_dev_t *local, struct rcs __iomem *prcs)
 static void authenticate(ray_dev_t *local)
 {
         struct pcmcia_device *link = local->finder;
-        DEBUG(0, "ray_cs Starting authentication.\n");
+        dev_dbg(&link->dev, "ray_cs Starting authentication.\n");
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_cs authenticate - device not present\n");
+                dev_dbg(&link->dev, "ray_cs authenticate - device not present\n");
                 return;
         }
 
@@ -2573,11 +2561,11 @@ static void rx_authenticate(ray_dev_t *local, struct rcs __iomem *prcs,
         copy_from_rx_buff(local, buff, pkt_addr, rx_len & 0xff);
         /* if we are trying to get authenticated */
         if (local->sparm.b4.a_network_type == ADHOC) {
-                DEBUG(1, "ray_cs rx_auth var= %02x %02x %02x %02x %02x %02x\n",
+                pr_debug("ray_cs rx_auth var= %02x %02x %02x %02x %02x %02x\n",
                       msg->var[0], msg->var[1], msg->var[2], msg->var[3],
                       msg->var[4], msg->var[5]);
                 if (msg->var[2] == 1) {
-                        DEBUG(0, "ray_cs Sending authentication response.\n");
+                        pr_debug("ray_cs Sending authentication response.\n");
                         if (!build_auth_frame
                             (local, msg->mac.addr_2, OPEN_AUTH_RESPONSE)) {
                                 local->authentication_state = NEED_TO_AUTH;
@@ -2591,13 +2579,13 @@ static void rx_authenticate(ray_dev_t *local, struct rcs __iomem *prcs,
                         /* Verify authentication sequence #2 and success */
                         if (msg->var[2] == 2) {
                                 if ((msg->var[3] | msg->var[4]) == 0) {
-                                        DEBUG(1, "Authentication successful\n");
+                                        pr_debug("Authentication successful\n");
                                         local->card_status = CARD_AUTH_COMPLETE;
                                         associate(local);
                                         local->authentication_state =
                                             AUTHENTICATED;
                                 } else {
-                                        DEBUG(0, "Authentication refused\n");
+                                        pr_debug("Authentication refused\n");
                                         local->card_status = CARD_AUTH_REFUSED;
                                         join_net((u_long) local);
                                         local->authentication_state =
@@ -2617,22 +2605,22 @@ static void associate(ray_dev_t *local)
         struct net_device *dev = link->priv;
         int ccsindex;
         if (!(pcmcia_dev_present(link))) {
-                DEBUG(2, "ray_cs associate - device not present\n");
+                dev_dbg(&link->dev, "ray_cs associate - device not present\n");
                 return;
         }
         /* If no tx buffers available, return */
         if ((ccsindex = get_free_ccs(local)) < 0) {
 /* TBD should never be here but... what if we are? */
-                DEBUG(1, "ray_cs associate - No free ccs\n");
+                dev_dbg(&link->dev, "ray_cs associate - No free ccs\n");
                 return;
         }
-        DEBUG(1, "ray_cs Starting association with access point\n");
+        dev_dbg(&link->dev, "ray_cs Starting association with access point\n");
         pccs = ccs_base(local) + ccsindex;
         /* fill in the CCS */
         writeb(CCS_START_ASSOCIATION, &pccs->cmd);
         /* Interrupt the firmware to process the command */
         if (interrupt_ecf(local, ccsindex)) {
-                DEBUG(1, "ray_cs associate failed - ECF not ready for intr\n");
+                dev_dbg(&link->dev, "ray_cs associate failed - ECF not ready for intr\n");
                 writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
 
                 del_timer(&local->timer);
@@ -2655,7 +2643,7 @@ static void rx_deauthenticate(ray_dev_t *local, struct rcs __iomem *prcs,
 /*  UCHAR buff[256];
     struct rx_msg *msg = (struct rx_msg *)buff;
 */
-        DEBUG(0, "Deauthentication frame received\n");
+        pr_debug("Deauthentication frame received\n");
         local->authentication_state = UNAUTHENTICATED;
         /* Need to reauthenticate or rejoin depending on reason code */
 /*  copy_from_rx_buff(local, buff, pkt_addr, rx_len & 0xff);
@@ -2823,7 +2811,7 @@ static int build_auth_frame(ray_dev_t *local, UCHAR *dest, int auth_type)
 
         /* If no tx buffers available, return */
         if ((ccsindex = get_free_tx_ccs(local)) < 0) {
-                DEBUG(1, "ray_cs send authenticate - No free tx ccs\n");
+                pr_debug("ray_cs send authenticate - No free tx ccs\n");
                 return -1;
         }
 
@@ -2855,7 +2843,7 @@ static int build_auth_frame(ray_dev_t *local, UCHAR *dest, int auth_type)
 
         /* Interrupt the firmware to process the command */
         if (interrupt_ecf(local, ccsindex)) {
-                DEBUG(1,
+                pr_debug(
                       "ray_cs send authentication request failed - ECF not ready for intr\n");
                 writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
                 return -1;
@@ -2865,18 +2853,8 @@ static int build_auth_frame(ray_dev_t *local, UCHAR *dest, int auth_type)
 
 /*===========================================================================*/
 #ifdef CONFIG_PROC_FS
-static void raycs_write(const char *name, write_proc_t *w, void *data)
-{
-        struct proc_dir_entry *entry =
-            create_proc_entry(name, S_IFREG | S_IWUSR, NULL);
-        if (entry) {
-                entry->write_proc = w;
-                entry->data = data;
-        }
-}
-
-static int write_essid(struct file *file, const char __user *buffer,
-                       unsigned long count, void *data)
+static ssize_t ray_cs_essid_proc_write(struct file *file,
+                const char __user *buffer, size_t count, loff_t *pos)
 {
         static char proc_essid[33];
         unsigned int len = count;
@@ -2890,8 +2868,13 @@ static int write_essid(struct file *file, const char __user *buffer,
         return count;
 }
 
-static int write_int(struct file *file, const char __user *buffer,
-                     unsigned long count, void *data)
+static const struct file_operations ray_cs_essid_proc_fops = {
+        .owner          = THIS_MODULE,
+        .write          = ray_cs_essid_proc_write,
+};
+
+static ssize_t int_proc_write(struct file *file, const char __user *buffer,
+                              size_t count, loff_t *pos)
 {
         static char proc_number[10];
         char *p;
@@ -2914,9 +2897,14 @@ static int write_int(struct file *file, const char __user *buffer,
                 nr = nr * 10 + c;
                 p++;
         } while (--len);
-        *(int *)data = nr;
+        *(int *)PDE(file->f_path.dentry->d_inode)->data = nr;
         return count;
 }
+
+static const struct file_operations int_proc_fops = {
+        .owner          = THIS_MODULE,
+        .write          = int_proc_write,
+};
 #endif
 
 static struct pcmcia_device_id ray_ids[] = {
@@ -2942,18 +2930,18 @@ static int __init init_ray_cs(void)
 {
         int rc;
 
-        DEBUG(1, "%s\n", rcsid);
+        pr_debug("%s\n", rcsid);
         rc = pcmcia_register_driver(&ray_driver);
-        DEBUG(1, "raylink init_module register_pcmcia_driver returns 0x%x\n",
+        pr_debug("raylink init_module register_pcmcia_driver returns 0x%x\n",
               rc);
 
 #ifdef CONFIG_PROC_FS
         proc_mkdir("driver/ray_cs", NULL);
 
         proc_create("driver/ray_cs/ray_cs", 0, NULL, &ray_cs_proc_fops);
-        raycs_write("driver/ray_cs/essid", write_essid, NULL);
-        raycs_write("driver/ray_cs/net_type", write_int, &net_type);
-        raycs_write("driver/ray_cs/translate", write_int, &translate);
+        proc_create("driver/ray_cs/essid", S_IWUSR, NULL, &ray_cs_essid_proc_fops);
+        proc_create_data("driver/ray_cs/net_type", S_IWUSR, NULL, &int_proc_fops, &net_type);
+        proc_create_data("driver/ray_cs/translate", S_IWUSR, NULL, &int_proc_fops, &translate);
 #endif
         if (translate != 0)
                 translate = 1;
@@ -2964,7 +2952,7 @@ static int __init init_ray_cs(void)
 
 static void __exit exit_ray_cs(void)
 {
-        DEBUG(0, "ray_cs: cleanup_module\n");
+        pr_debug("ray_cs: cleanup_module\n");
 
 #ifdef CONFIG_PROC_FS
         remove_proc_entry("driver/ray_cs/ray_cs", NULL);
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 54175b6fa86c..1de5b22d3efe 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -41,6 +41,7 @@
 #include <linux/if_arp.h>
 #include <linux/ctype.h>
 #include <linux/spinlock.h>
+#include <linux/slab.h>
 #include <net/iw_handler.h>
 #include <net/cfg80211.h>
 #include <linux/usb/usbnet.h>
@@ -83,11 +84,11 @@ MODULE_PARM_DESC(roamdelta,
         "set roaming tendency: 0=aggressive, 1=moderate, "
                                 "2=conservative (default: moderate)");
 
-static int modparam_workaround_interval = 500;
+static int modparam_workaround_interval;
 module_param_named(workaround_interval, modparam_workaround_interval,
                                                         int, 0444);
 MODULE_PARM_DESC(workaround_interval,
-        "set stall workaround interval in msecs (default: 500)");
+        "set stall workaround interval in msecs (0=disabled) (default: 0)");
 
 
 /* various RNDIS OID defs */
@@ -728,21 +729,22 @@ static int rndis_query_oid(struct usbnet *dev, __le32 oid, void *data, int *len)
         ret = rndis_command(dev, u.header, buflen);
         priv->current_command_oid = 0;
         if (ret < 0)
-                devdbg(dev, "rndis_query_oid(%s): rndis_command() failed, %d "
-                        "(%08x)", oid_to_string(oid), ret,
-                        le32_to_cpu(u.get_c->status));
+                netdev_dbg(dev->net, "%s(%s): rndis_command() failed, %d (%08x)\n",
+                           __func__, oid_to_string(oid), ret,
+                           le32_to_cpu(u.get_c->status));
 
         if (ret == 0) {
+                memcpy(data, u.buf + le32_to_cpu(u.get_c->offset) + 8, *len);
+
                 ret = le32_to_cpu(u.get_c->len);
                 if (ret > *len)
                         *len = ret;
-                memcpy(data, u.buf + le32_to_cpu(u.get_c->offset) + 8, *len);
-                ret = rndis_error_status(u.get_c->status);
 
+                ret = rndis_error_status(u.get_c->status);
                 if (ret < 0)
-                        devdbg(dev, "rndis_query_oid(%s): device returned "
-                                "error,  0x%08x (%d)", oid_to_string(oid),
-                                le32_to_cpu(u.get_c->status), ret);
+                        netdev_dbg(dev->net, "%s(%s): device returned error,  0x%08x (%d)\n",
+                                   __func__, oid_to_string(oid),
+                                   le32_to_cpu(u.get_c->status), ret);
         }
 
         mutex_unlock(&priv->command_lock);
@@ -790,17 +792,17 @@ static int rndis_set_oid(struct usbnet *dev, __le32 oid, void *data, int len)
         ret = rndis_command(dev, u.header, buflen);
         priv->current_command_oid = 0;
         if (ret < 0)
-                devdbg(dev, "rndis_set_oid(%s): rndis_command() failed, %d "
-                        "(%08x)", oid_to_string(oid), ret,
-                        le32_to_cpu(u.set_c->status));
+                netdev_dbg(dev->net, "%s(%s): rndis_command() failed, %d (%08x)\n",
+                           __func__, oid_to_string(oid), ret,
+                           le32_to_cpu(u.set_c->status));
 
         if (ret == 0) {
                 ret = rndis_error_status(u.set_c->status);
 
                 if (ret < 0)
-                        devdbg(dev, "rndis_set_oid(%s): device returned error, "
-                                "0x%08x (%d)", oid_to_string(oid),
-                                le32_to_cpu(u.set_c->status), ret);
+                        netdev_dbg(dev->net, "%s(%s): device returned error, 0x%08x (%d)\n",
+                                   __func__, oid_to_string(oid),
+                                   le32_to_cpu(u.set_c->status), ret);
         }
 
         mutex_unlock(&priv->command_lock);
@@ -869,11 +871,11 @@ static int rndis_set_config_parameter(struct usbnet *dev, char *param,
 #endif
 
         if (value_type == 2)
-                devdbg(dev, "setting config parameter: %s, value: %s",
-                                                param, (u8 *)value);
+                netdev_dbg(dev->net, "setting config parameter: %s, value: %s\n",
+                           param, (u8 *)value);
         else
-                devdbg(dev, "setting config parameter: %s, value: %d",
-                                                param, *(u32 *)value);
+                netdev_dbg(dev->net, "setting config parameter: %s, value: %d\n",
+                           param, *(u32 *)value);
 
         infobuf->name_offs = cpu_to_le32(sizeof(*infobuf));
         infobuf->name_length = cpu_to_le32(param_len);
@@ -896,20 +898,21 @@ static int rndis_set_config_parameter(struct usbnet *dev, char *param,
         }
 
 #ifdef DEBUG
-        devdbg(dev, "info buffer (len: %d):", info_len);
+        netdev_dbg(dev->net, "info buffer (len: %d)\n", info_len);
         for (i = 0; i < info_len; i += 12) {
                 u32 *tmp = (u32 *)((u8 *)infobuf + i);
-                devdbg(dev, "%08X:%08X:%08X",
-                        cpu_to_be32(tmp[0]),
-                        cpu_to_be32(tmp[1]),
-                        cpu_to_be32(tmp[2]));
+                netdev_dbg(dev->net, "%08X:%08X:%08X\n",
+                           cpu_to_be32(tmp[0]),
+                           cpu_to_be32(tmp[1]),
+                           cpu_to_be32(tmp[2]));
         }
 #endif
 
         ret = rndis_set_oid(dev, OID_GEN_RNDIS_CONFIG_PARAMETER,
                                                         infobuf, info_len);
         if (ret != 0)
-                devdbg(dev, "setting rndis config parameter failed, %d.", ret);
+                netdev_dbg(dev->net, "setting rndis config parameter failed, %d\n",
+                           ret);
 
         kfree(infobuf);
         return ret;
@@ -944,13 +947,13 @@ static int set_essid(struct usbnet *usbdev, struct ndis_80211_ssid *ssid)
 
         ret = rndis_set_oid(usbdev, OID_802_11_SSID, ssid, sizeof(*ssid));
         if (ret < 0) {
-                devwarn(usbdev, "setting SSID failed (%08X)", ret);
+                netdev_warn(usbdev->net, "setting SSID failed (%08X)\n", ret);
                 return ret;
         }
         if (ret == 0) {
                 memcpy(&priv->essid, ssid, sizeof(priv->essid));
                 priv->radio_on = true;
-                devdbg(usbdev, "set_essid: radio_on = true");
+                netdev_dbg(usbdev->net, "%s(): radio_on = true\n", __func__);
         }
 
         return ret;
@@ -962,7 +965,8 @@ static int set_bssid(struct usbnet *usbdev, u8 bssid[ETH_ALEN])
 
         ret = rndis_set_oid(usbdev, OID_802_11_BSSID, bssid, ETH_ALEN);
         if (ret < 0) {
-                devwarn(usbdev, "setting BSSID[%pM] failed (%08X)", bssid, ret);
+                netdev_warn(usbdev->net, "setting BSSID[%pM] failed (%08X)\n",
+                            bssid, ret);
                 return ret;
         }
 
@@ -1020,7 +1024,8 @@ static int disassociate(struct usbnet *usbdev, bool reset_ssid)
                 ret = rndis_set_oid(usbdev, OID_802_11_DISASSOCIATE, NULL, 0);
                 if (ret == 0) {
                         priv->radio_on = false;
-                        devdbg(usbdev, "disassociate: radio_on = false");
+                        netdev_dbg(usbdev->net, "%s(): radio_on = false\n",
+                                   __func__);
 
                         if (reset_ssid)
                                 msleep(100);
@@ -1053,8 +1058,8 @@ static int set_auth_mode(struct usbnet *usbdev, u32 wpa_version,
         __le32 tmp;
         int auth_mode, ret;
 
-        devdbg(usbdev, "set_auth_mode: wpa_version=0x%x authalg=0x%x "
-                "keymgmt=0x%x", wpa_version, auth_type, keymgmt);
+        netdev_dbg(usbdev->net, "%s(): wpa_version=0x%x authalg=0x%x keymgmt=0x%x\n",
+                   __func__, wpa_version, auth_type, keymgmt);
 
         if (wpa_version & NL80211_WPA_VERSION_2) {
                 if (keymgmt & RNDIS_WLAN_KEY_MGMT_802_1X)
@@ -1072,6 +1077,8 @@ static int set_auth_mode(struct usbnet *usbdev, u32 wpa_version,
                 auth_mode = NDIS_80211_AUTH_SHARED;
         else if (auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM)
                 auth_mode = NDIS_80211_AUTH_OPEN;
+        else if (auth_type == NL80211_AUTHTYPE_AUTOMATIC)
+                auth_mode = NDIS_80211_AUTH_AUTO_SWITCH;
         else
                 return -ENOTSUPP;
 
@@ -1079,7 +1086,8 @@ static int set_auth_mode(struct usbnet *usbdev, u32 wpa_version,
         ret = rndis_set_oid(usbdev, OID_802_11_AUTHENTICATION_MODE, &tmp,
                                                                 sizeof(tmp));
         if (ret != 0) {
-                devwarn(usbdev, "setting auth mode failed (%08X)", ret);
+                netdev_warn(usbdev->net, "setting auth mode failed (%08X)\n",
+                            ret);
                 return ret;
         }
 
@@ -1095,7 +1103,8 @@ static int set_priv_filter(struct usbnet *usbdev)
         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
         __le32 tmp;
 
-        devdbg(usbdev, "set_priv_filter: wpa_version=0x%x", priv->wpa_version);
+        netdev_dbg(usbdev->net, "%s(): wpa_version=0x%x\n",
+                   __func__, priv->wpa_version);
 
         if (priv->wpa_version & NL80211_WPA_VERSION_2 ||
             priv->wpa_version & NL80211_WPA_VERSION_1)
@@ -1113,8 +1122,8 @@ static int set_encr_mode(struct usbnet *usbdev, int pairwise, int groupwise)
         __le32 tmp;
         int encr_mode, ret;
 
-        devdbg(usbdev, "set_encr_mode: cipher_pair=0x%x cipher_group=0x%x",
-                pairwise, groupwise);
+        netdev_dbg(usbdev->net, "%s(): cipher_pair=0x%x cipher_group=0x%x\n",
+                   __func__, pairwise, groupwise);
 
         if (pairwise & RNDIS_WLAN_ALG_CCMP)
                 encr_mode = NDIS_80211_ENCR_CCMP_ENABLED;
@@ -1133,7 +1142,8 @@ static int set_encr_mode(struct usbnet *usbdev, int pairwise, int groupwise)
         ret = rndis_set_oid(usbdev, OID_802_11_ENCRYPTION_STATUS, &tmp,
                                                                 sizeof(tmp));
         if (ret != 0) {
-                devwarn(usbdev, "setting encr mode failed (%08X)", ret);
+                netdev_warn(usbdev->net, "setting encr mode failed (%08X)\n",
+                            ret);
                 return ret;
         }
 
@@ -1148,13 +1158,15 @@ static int set_infra_mode(struct usbnet *usbdev, int mode)
         __le32 tmp;
         int ret;
 
-        devdbg(usbdev, "set_infra_mode: infra_mode=0x%x", priv->infra_mode);
+        netdev_dbg(usbdev->net, "%s(): infra_mode=0x%x\n",
+                   __func__, priv->infra_mode);
 
         tmp = cpu_to_le32(mode);
         ret = rndis_set_oid(usbdev, OID_802_11_INFRASTRUCTURE_MODE, &tmp,
                                                                 sizeof(tmp));
         if (ret != 0) {
-                devwarn(usbdev, "setting infra mode failed (%08X)", ret);
+                netdev_warn(usbdev->net, "setting infra mode failed (%08X)\n",
+                            ret);
                 return ret;
         }
 
@@ -1171,7 +1183,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
 {
         __le32 tmp;
 
-        devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
+        netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
 
         if (rts_threshold < 0 || rts_threshold > 2347)
                 rts_threshold = 2347;
@@ -1185,7 +1197,7 @@ static int set_frag_threshold(struct usbnet *usbdev, u32 frag_threshold)
 {
         __le32 tmp;
 
-        devdbg(usbdev, "set_frag_threshold %i", frag_threshold);
+        netdev_dbg(usbdev->net, "%s(): %i\n", __func__, frag_threshold);
 
         if (frag_threshold < 256 || frag_threshold > 2346)
                 frag_threshold = 2346;
@@ -1219,7 +1231,7 @@ static int set_channel(struct usbnet *usbdev, int channel)
         unsigned int dsconfig;
         int len, ret;
 
-        devdbg(usbdev, "set_channel(%d)", channel);
+        netdev_dbg(usbdev->net, "%s(%d)\n", __func__, channel);
 
         /* this OID is valid only when not associated */
         if (is_associated(usbdev))
@@ -1230,7 +1242,8 @@ static int set_channel(struct usbnet *usbdev, int channel)
         len = sizeof(config);
         ret = rndis_query_oid(usbdev, OID_802_11_CONFIGURATION, &config, &len);
         if (ret < 0) {
-                devdbg(usbdev, "set_channel: querying configuration failed");
+                netdev_dbg(usbdev->net, "%s(): querying configuration failed\n",
+                           __func__);
                 return ret;
         }
 
@@ -1238,7 +1251,7 @@ static int set_channel(struct usbnet *usbdev, int channel)
         ret = rndis_set_oid(usbdev, OID_802_11_CONFIGURATION, &config,
                                                                 sizeof(config));
 
-        devdbg(usbdev, "set_channel: %d -> %d", channel, ret);
+        netdev_dbg(usbdev->net, "%s(): %d -> %d\n", __func__, channel, ret);
 
         return ret;
 }
@@ -1252,7 +1265,8 @@ static int add_wep_key(struct usbnet *usbdev, const u8 *key, int key_len,
         u32 cipher;
         int ret;
 
-        devdbg(usbdev, "add_wep_key(idx: %d, len: %d)", index, key_len);
+        netdev_dbg(usbdev->net, "%s(idx: %d, len: %d)\n",
+                   __func__, index, key_len);
 
         if ((key_len != 5 && key_len != 13) || index < 0 || index > 3)
                 return -EINVAL;
@@ -1274,15 +1288,15 @@ static int add_wep_key(struct usbnet *usbdev, const u8 *key, int key_len,
                 ret = set_encr_mode(usbdev, RNDIS_WLAN_ALG_WEP,
                                                         RNDIS_WLAN_ALG_NONE);
                 if (ret)
-                        devwarn(usbdev, "encryption couldn't be enabled (%08X)",
-                                                                        ret);
+                        netdev_warn(usbdev->net, "encryption couldn't be enabled (%08X)\n",
+                                    ret);
         }
 
         ret = rndis_set_oid(usbdev, OID_802_11_ADD_WEP, &ndis_key,
                                                         sizeof(ndis_key));
         if (ret != 0) {
-                devwarn(usbdev, "adding encryption key %d failed (%08X)",
-                                                        index+1, ret);
+                netdev_warn(usbdev->net, "adding encryption key %d failed (%08X)\n",
+                            index + 1, ret);
                 return ret;
         }
 
@@ -1304,22 +1318,23 @@ static int add_wpa_key(struct usbnet *usbdev, const u8 *key, int key_len,
         int ret;
 
         if (index < 0 || index >= 4) {
-                devdbg(usbdev, "add_wpa_key: index out of range (%i)", index);
+                netdev_dbg(usbdev->net, "%s(): index out of range (%i)\n",
+                           __func__, index);
                 return -EINVAL;
         }
         if (key_len > sizeof(ndis_key.material) || key_len < 0) {
-                devdbg(usbdev, "add_wpa_key: key length out of range (%i)",
-                        key_len);
+                netdev_dbg(usbdev->net, "%s(): key length out of range (%i)\n",
+                           __func__, key_len);
                 return -EINVAL;
         }
         if (flags & NDIS_80211_ADDKEY_SET_INIT_RECV_SEQ) {
                 if (!rx_seq || seq_len <= 0) {
-                        devdbg(usbdev, "add_wpa_key: recv seq flag without"
-                                        "buffer");
+                        netdev_dbg(usbdev->net, "%s(): recv seq flag without buffer\n",
+                                   __func__);
                         return -EINVAL;
                 }
                 if (rx_seq && seq_len > sizeof(ndis_key.rsc)) {
-                        devdbg(usbdev, "add_wpa_key: too big recv seq buffer");
+                        netdev_dbg(usbdev->net, "%s(): too big recv seq buffer\n", __func__);
                         return -EINVAL;
                 }
         }
@@ -1327,15 +1342,16 @@ static int add_wpa_key(struct usbnet *usbdev, const u8 *key, int key_len,
         is_addr_ok = addr && !is_zero_ether_addr(addr) &&
                                         !is_broadcast_ether_addr(addr);
         if ((flags & NDIS_80211_ADDKEY_PAIRWISE_KEY) && !is_addr_ok) {
-                devdbg(usbdev, "add_wpa_key: pairwise but bssid invalid (%pM)",
-                        addr);
+                netdev_dbg(usbdev->net, "%s(): pairwise but bssid invalid (%pM)\n",
+                           __func__, addr);
                 return -EINVAL;
         }
 
-        devdbg(usbdev, "add_wpa_key(%i): flags:%i%i%i", index,
-                        !!(flags & NDIS_80211_ADDKEY_TRANSMIT_KEY),
-                        !!(flags & NDIS_80211_ADDKEY_PAIRWISE_KEY),
-                        !!(flags & NDIS_80211_ADDKEY_SET_INIT_RECV_SEQ));
+        netdev_dbg(usbdev->net, "%s(%i): flags:%i%i%i\n",
+                   __func__, index,
+                   !!(flags & NDIS_80211_ADDKEY_TRANSMIT_KEY),
+                   !!(flags & NDIS_80211_ADDKEY_PAIRWISE_KEY),
+                   !!(flags & NDIS_80211_ADDKEY_SET_INIT_RECV_SEQ));
 
         memset(&ndis_key, 0, sizeof(ndis_key));
 
@@ -1369,7 +1385,8 @@ static int add_wpa_key(struct usbnet *usbdev, const u8 *key, int key_len,
 
         ret = rndis_set_oid(usbdev, OID_802_11_ADD_KEY, &ndis_key,
                                         le32_to_cpu(ndis_key.size));
-        devdbg(usbdev, "add_wpa_key: OID_802_11_ADD_KEY -> %08X", ret);
+        netdev_dbg(usbdev->net, "%s(): OID_802_11_ADD_KEY -> %08X\n",
+                   __func__, ret);
         if (ret != 0)
                 return ret;
 
@@ -1398,7 +1415,7 @@ static int restore_key(struct usbnet *usbdev, int key_idx)
 
         key = priv->encr_keys[key_idx];
 
-        devdbg(usbdev, "restore_key: %i:%i", key_idx, key.len);
+        netdev_dbg(usbdev->net, "%s(): %i:%i\n", __func__, key_idx, key.len);
 
         if (key.len == 0)
                 return 0;
@@ -1433,8 +1450,9 @@ static int remove_key(struct usbnet *usbdev, int index, const u8 *bssid)
 
         is_wpa = is_wpa_key(priv, index);
 
-        devdbg(usbdev, "remove_key: %i:%s:%i", index, is_wpa ? "wpa" : "wep",
-                priv->encr_keys[index].len);
+        netdev_dbg(usbdev->net, "%s(): %i:%s:%i\n",
+                   __func__, index, is_wpa ? "wpa" : "wep",
+                   priv->encr_keys[index].len);
 
         clear_key(priv, index);
 
@@ -1461,9 +1479,9 @@ static int remove_key(struct usbnet *usbdev, int index, const u8 *bssid)
                 ret = rndis_set_oid(usbdev, OID_802_11_REMOVE_WEP, &keyindex,
                                                         sizeof(keyindex));
                 if (ret != 0) {
-                        devwarn(usbdev,
-                                "removing encryption key %d failed (%08X)",
-                                index, ret);
+                        netdev_warn(usbdev->net,
+                                    "removing encryption key %d failed (%08X)\n",
+                                    index, ret);
                         return ret;
                 }
         }
@@ -1479,59 +1497,76 @@ static void set_multicast_list(struct usbnet *usbdev)
 {
         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
         struct dev_mc_list *mclist;
-        __le32 filter;
-        int ret, i, size;
-        char *buf;
+        __le32 filter, basefilter;
+        int ret;
+        char *mc_addrs = NULL;
+        int mc_count;
 
-        filter = RNDIS_PACKET_TYPE_DIRECTED | RNDIS_PACKET_TYPE_BROADCAST;
+        basefilter = filter = RNDIS_PACKET_TYPE_DIRECTED |
+                              RNDIS_PACKET_TYPE_BROADCAST;
 
         if (usbdev->net->flags & IFF_PROMISC) {
                 filter |= RNDIS_PACKET_TYPE_PROMISCUOUS |
                         RNDIS_PACKET_TYPE_ALL_LOCAL;
-        } else if (usbdev->net->flags & IFF_ALLMULTI ||
-                   usbdev->net->mc_count > priv->multicast_size) {
+        } else if (usbdev->net->flags & IFF_ALLMULTI) {
                 filter |= RNDIS_PACKET_TYPE_ALL_MULTICAST;
-        } else if (usbdev->net->mc_count > 0) {
-                size = min(priv->multicast_size, usbdev->net->mc_count);
-                buf = kmalloc(size * ETH_ALEN, GFP_KERNEL);
-                if (!buf) {
-                        devwarn(usbdev,
-                                "couldn't alloc %d bytes of memory",
-                                size * ETH_ALEN);
+        }
+
+        if (filter != basefilter)
+                goto set_filter;
+
+        /*
+         * mc_list should be accessed holding the lock, so copy addresses to
+         * local buffer first.
+         */
+        netif_addr_lock_bh(usbdev->net);
+        mc_count = netdev_mc_count(usbdev->net);
+        if (mc_count > priv->multicast_size) {
+                filter |= RNDIS_PACKET_TYPE_ALL_MULTICAST;
+        } else if (mc_count) {
+                int i = 0;
+
+                mc_addrs = kmalloc(mc_count * ETH_ALEN, GFP_ATOMIC);
+                if (!mc_addrs) {
+                        netdev_warn(usbdev->net,
+                                    "couldn't alloc %d bytes of memory\n",
+                                    mc_count * ETH_ALEN);
+                        netif_addr_unlock_bh(usbdev->net);
                         return;
                 }
 
-                mclist = usbdev->net->mc_list;
-                for (i = 0; i < size && mclist; mclist = mclist->next) {
-                        if (mclist->dmi_addrlen != ETH_ALEN)
-                                continue;
+                netdev_for_each_mc_addr(mclist, usbdev->net)
+                        memcpy(mc_addrs + i++ * ETH_ALEN,
+                               mclist->dmi_addr, ETH_ALEN);
+        }
+        netif_addr_unlock_bh(usbdev->net);
 
-                        memcpy(buf + i * ETH_ALEN, mclist->dmi_addr, ETH_ALEN);
-                        i++;
-                }
+        if (filter != basefilter)
+                goto set_filter;
 
-                ret = rndis_set_oid(usbdev, OID_802_3_MULTICAST_LIST, buf,
-                                                                i * ETH_ALEN);
-                if (ret == 0 && i > 0)
+        if (mc_count) {
+                ret = rndis_set_oid(usbdev, OID_802_3_MULTICAST_LIST, mc_addrs,
+                                    mc_count * ETH_ALEN);
+                kfree(mc_addrs);
+                if (ret == 0)
                         filter |= RNDIS_PACKET_TYPE_MULTICAST;
                 else
                         filter |= RNDIS_PACKET_TYPE_ALL_MULTICAST;
 
-                devdbg(usbdev, "OID_802_3_MULTICAST_LIST(%d, max: %d) -> %d",
-                                                i, priv->multicast_size, ret);
-
-                kfree(buf);
+                netdev_dbg(usbdev->net, "OID_802_3_MULTICAST_LIST(%d, max: %d) -> %d\n",
+                           mc_count, priv->multicast_size, ret);
         }
 
+set_filter:
         ret = rndis_set_oid(usbdev, OID_GEN_CURRENT_PACKET_FILTER, &filter,
                                                         sizeof(filter));
         if (ret < 0) {
-                devwarn(usbdev, "couldn't set packet filter: %08x",
-                                                        le32_to_cpu(filter));
+                netdev_warn(usbdev->net, "couldn't set packet filter: %08x\n",
+                            le32_to_cpu(filter));
         }
 
-        devdbg(usbdev, "OID_GEN_CURRENT_PACKET_FILTER(%08x) -> %d",
-                                                le32_to_cpu(filter), ret);
+        netdev_dbg(usbdev->net, "OID_GEN_CURRENT_PACKET_FILTER(%08x) -> %d\n",
+                   le32_to_cpu(filter), ret);
 }
 
 /*
@@ -1589,7 +1624,8 @@ static int rndis_set_tx_power(struct wiphy *wiphy, enum tx_power_setting type,
         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
         struct usbnet *usbdev = priv->usbdev;
 
-        devdbg(usbdev, "rndis_set_tx_power type:0x%x dbm:%i", type, dbm);
+        netdev_dbg(usbdev->net, "%s(): type:0x%x dbm:%i\n",
+                   __func__, type, dbm);
 
         /* Device doesn't support changing txpower after initialization, only
          * turn off/on radio. Support 'auto' mode and setting same dBm that is
@@ -1612,7 +1648,7 @@ static int rndis_get_tx_power(struct wiphy *wiphy, int *dbm)
 
         *dbm = get_bcm4320_power_dbm(priv);
 
-        devdbg(usbdev, "rndis_get_tx_power dbm:%i", *dbm);
+        netdev_dbg(usbdev->net, "%s(): dbm:%i\n", __func__, *dbm);
 
         return 0;
 }
@@ -1626,7 +1662,7 @@ static int rndis_scan(struct wiphy *wiphy, struct net_device *dev,
         int ret;
         __le32 tmp;
 
-        devdbg(usbdev, "cfg80211.scan");
+        netdev_dbg(usbdev->net, "cfg80211.scan\n");
 
         /* Get current bssid list from device before new scan, as new scan
          * clears internal bssid list.
@@ -1666,8 +1702,8 @@ static struct cfg80211_bss *rndis_bss_info_update(struct usbnet *usbdev,
         int ie_len, bssid_len;
         u8 *ie;
 
-        devdbg(usbdev, " found bssid: '%.32s' [%pM]", bssid->ssid.essid,
-                                                        bssid->mac);
+        netdev_dbg(usbdev->net, " found bssid: '%.32s' [%pM]\n",
+                   bssid->ssid.essid, bssid->mac);
 
         /* parse bssid structure */
         bssid_len = le32_to_cpu(bssid->length);
@@ -1709,7 +1745,7 @@ static int rndis_check_bssid_list(struct usbnet *usbdev)
         int ret = -EINVAL, len, count, bssid_len;
         bool resized = false;
 
-        devdbg(usbdev, "check_bssid_list");
+        netdev_dbg(usbdev->net, "check_bssid_list\n");
 
         len = CONTROL_BUFFER_SIZE;
 resize_buf:
@@ -1733,8 +1769,8 @@ resize_buf:
         bssid = bssid_list->bssid;
         bssid_len = le32_to_cpu(bssid->length);
         count = le32_to_cpu(bssid_list->num_items);
-        devdbg(usbdev, "check_bssid_list: %d BSSIDs found (buflen: %d)", count,
-                                                                        len);
+        netdev_dbg(usbdev->net, "check_bssid_list: %d BSSIDs found (buflen: %d)\n",
+                   count, len);
 
         while (count && ((void *)bssid + bssid_len) <= (buf + len)) {
                 rndis_bss_info_update(usbdev, bssid);
@@ -1756,7 +1792,7 @@ static void rndis_get_scan_results(struct work_struct *work)
         struct usbnet *usbdev = priv->usbdev;
         int ret;
 
-        devdbg(usbdev, "get_scan_results");
+        netdev_dbg(usbdev->net, "get_scan_results\n");
 
         if (!priv->scan_request)
                 return;
@@ -1790,7 +1826,7 @@ static int rndis_connect(struct wiphy *wiphy, struct net_device *dev,
 
         if (sme->crypto.n_ciphers_pairwise > 0 &&
                         pairwise == RNDIS_WLAN_ALG_NONE) {
-                deverr(usbdev, "Unsupported pairwise cipher");
+                netdev_err(usbdev->net, "Unsupported pairwise cipher\n");
                 return -ENOTSUPP;
         }
 
@@ -1800,28 +1836,30 @@ static int rndis_connect(struct wiphy *wiphy, struct net_device *dev,
 
         if (sme->crypto.n_akm_suites > 0 &&
                         keymgmt == RNDIS_WLAN_KEY_MGMT_NONE) {
-                deverr(usbdev, "Invalid keymgmt");
+                netdev_err(usbdev->net, "Invalid keymgmt\n");
                 return -ENOTSUPP;
         }
 
-        devdbg(usbdev, "cfg80211.connect('%.32s':[%pM]:%d:[%d,0x%x:0x%x]:[0x%x:"
-                        "0x%x]:0x%x)", sme->ssid, sme->bssid, chan,
-                        sme->privacy, sme->crypto.wpa_versions, sme->auth_type,
-                        groupwise, pairwise, keymgmt);
+        netdev_dbg(usbdev->net, "cfg80211.connect('%.32s':[%pM]:%d:[%d,0x%x:0x%x]:[0x%x:0x%x]:0x%x)\n",
+                   sme->ssid, sme->bssid, chan,
+                   sme->privacy, sme->crypto.wpa_versions, sme->auth_type,
+                   groupwise, pairwise, keymgmt);
 
         if (is_associated(usbdev))
                 disassociate(usbdev, false);
 
         ret = set_infra_mode(usbdev, NDIS_80211_INFRA_INFRA);
         if (ret < 0) {
-                devdbg(usbdev, "connect: set_infra_mode failed, %d", ret);
+                netdev_dbg(usbdev->net, "connect: set_infra_mode failed, %d\n",
+                           ret);
                 goto err_turn_radio_on;
         }
 
         ret = set_auth_mode(usbdev, sme->crypto.wpa_versions, sme->auth_type,
                                                                 keymgmt);
         if (ret < 0) {
-                devdbg(usbdev, "connect: set_auth_mode failed, %d", ret);
+                netdev_dbg(usbdev->net, "connect: set_auth_mode failed, %d\n",
+                           ret);
                 goto err_turn_radio_on;
         }
 
@@ -1829,14 +1867,16 @@ static int rndis_connect(struct wiphy *wiphy, struct net_device *dev,
 
         ret = set_encr_mode(usbdev, pairwise, groupwise);
         if (ret < 0) {
-                devdbg(usbdev, "connect: set_encr_mode failed, %d", ret);
+                netdev_dbg(usbdev->net, "connect: set_encr_mode failed, %d\n",
+                           ret);
                 goto err_turn_radio_on;
         }
 
         if (channel) {
                 ret = set_channel(usbdev, chan);
                 if (ret < 0) {
-                        devdbg(usbdev, "connect: set_channel failed, %d", ret);
+                        netdev_dbg(usbdev->net, "connect: set_channel failed, %d\n",
+                                   ret);
                         goto err_turn_radio_on;
                 }
         }
@@ -1845,8 +1885,8 @@ static int rndis_connect(struct wiphy *wiphy, struct net_device *dev,
                 priv->encr_tx_key_index = sme->key_idx;
                 ret = add_wep_key(usbdev, sme->key, sme->key_len, sme->key_idx);
                 if (ret < 0) {
-                        devdbg(usbdev, "connect: add_wep_key failed, %d "
-                                "(%d, %d)", ret, sme->key_len, sme->key_idx);
+                        netdev_dbg(usbdev->net, "connect: add_wep_key failed, %d (%d, %d)\n",
+                                   ret, sme->key_len, sme->key_idx);
                         goto err_turn_radio_on;
                 }
         }
@@ -1855,7 +1895,8 @@ static int rndis_connect(struct wiphy *wiphy, struct net_device *dev,
                                 !is_broadcast_ether_addr(sme->bssid)) {
                 ret = set_bssid(usbdev, sme->bssid);
                 if (ret < 0) {
-                        devdbg(usbdev, "connect: set_bssid failed, %d", ret);
+                        netdev_dbg(usbdev->net, "connect: set_bssid failed, %d\n",
+                                   ret);
                         goto err_turn_radio_on;
                 }
         } else
@@ -1877,7 +1918,7 @@ static int rndis_connect(struct wiphy *wiphy, struct net_device *dev,
 
         ret = set_essid(usbdev, &ssid);
         if (ret < 0)
-                devdbg(usbdev, "connect: set_essid failed, %d", ret);
+                netdev_dbg(usbdev->net, "connect: set_essid failed, %d\n", ret);
         return ret;
 
 err_turn_radio_on:
@@ -1892,7 +1933,7 @@ static int rndis_disconnect(struct wiphy *wiphy, struct net_device *dev,
         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
         struct usbnet *usbdev = priv->usbdev;
 
-        devdbg(usbdev, "cfg80211.disconnect(%d)", reason_code);
+        netdev_dbg(usbdev->net, "cfg80211.disconnect(%d)\n", reason_code);
 
         priv->connected = false;
         memset(priv->bssid, 0, ETH_ALEN);
@@ -1926,21 +1967,23 @@ static int rndis_join_ibss(struct wiphy *wiphy, struct net_device *dev,
                 alg = RNDIS_WLAN_ALG_NONE;
         }
 
-        devdbg(usbdev, "cfg80211.join_ibss('%.32s':[%pM]:%d:%d)", params->ssid,
-                                        params->bssid, chan, params->privacy);
+        netdev_dbg(usbdev->net, "cfg80211.join_ibss('%.32s':[%pM]:%d:%d)\n",
+                   params->ssid, params->bssid, chan, params->privacy);
 
         if (is_associated(usbdev))
                 disassociate(usbdev, false);
 
         ret = set_infra_mode(usbdev, NDIS_80211_INFRA_ADHOC);
         if (ret < 0) {
-                devdbg(usbdev, "join_ibss: set_infra_mode failed, %d", ret);
+                netdev_dbg(usbdev->net, "join_ibss: set_infra_mode failed, %d\n",
+                           ret);
                 goto err_turn_radio_on;
         }
 
         ret = set_auth_mode(usbdev, 0, auth_type, RNDIS_WLAN_KEY_MGMT_NONE);
         if (ret < 0) {
-                devdbg(usbdev, "join_ibss: set_auth_mode failed, %d", ret);
+                netdev_dbg(usbdev->net, "join_ibss: set_auth_mode failed, %d\n",
+                           ret);
                 goto err_turn_radio_on;
         }
 
@@ -1948,15 +1991,16 @@ static int rndis_join_ibss(struct wiphy *wiphy, struct net_device *dev,
 
         ret = set_encr_mode(usbdev, alg, RNDIS_WLAN_ALG_NONE);
         if (ret < 0) {
-                devdbg(usbdev, "join_ibss: set_encr_mode failed, %d", ret);
+                netdev_dbg(usbdev->net, "join_ibss: set_encr_mode failed, %d\n",
+                           ret);
                 goto err_turn_radio_on;
         }
 
         if (channel) {
                 ret = set_channel(usbdev, chan);
                 if (ret < 0) {
-                        devdbg(usbdev, "join_ibss: set_channel failed, %d",
-                                ret);
+                        netdev_dbg(usbdev->net, "join_ibss: set_channel failed, %d\n",
+                                   ret);
                         goto err_turn_radio_on;
                 }
         }
@@ -1965,7 +2009,8 @@ static int rndis_join_ibss(struct wiphy *wiphy, struct net_device *dev,
                                 !is_broadcast_ether_addr(params->bssid)) {
                 ret = set_bssid(usbdev, params->bssid);
                 if (ret < 0) {
-                        devdbg(usbdev, "join_ibss: set_bssid failed, %d", ret);
+                        netdev_dbg(usbdev->net, "join_ibss: set_bssid failed, %d\n",
+                                   ret);
                         goto err_turn_radio_on;
                 }
         } else
@@ -1985,7 +2030,8 @@ static int rndis_join_ibss(struct wiphy *wiphy, struct net_device *dev,
 
         ret = set_essid(usbdev, &ssid);
         if (ret < 0)
-                devdbg(usbdev, "join_ibss: set_essid failed, %d", ret);
+                netdev_dbg(usbdev->net, "join_ibss: set_essid failed, %d\n",
+                           ret);
         return ret;
 
 err_turn_radio_on:
@@ -1999,7 +2045,7 @@ static int rndis_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
         struct usbnet *usbdev = priv->usbdev;
 
-        devdbg(usbdev, "cfg80211.leave_ibss()");
+        netdev_dbg(usbdev->net, "cfg80211.leave_ibss()\n");
 
         priv->connected = false;
         memset(priv->bssid, 0, ETH_ALEN);
@@ -2025,8 +2071,8 @@ static int rndis_add_key(struct wiphy *wiphy, struct net_device *netdev,
         struct usbnet *usbdev = priv->usbdev;
         __le32 flags;
 
-        devdbg(usbdev, "rndis_add_key(%i, %pM, %08x)", key_index, mac_addr,
-                                                        params->cipher);
+        netdev_dbg(usbdev->net, "%s(%i, %pM, %08x)\n",
+                   __func__, key_index, mac_addr, params->cipher);
 
         switch (params->cipher) {
         case WLAN_CIPHER_SUITE_WEP40:
@@ -2047,8 +2093,8 @@ static int rndis_add_key(struct wiphy *wiphy, struct net_device *netdev,
                                 key_index, mac_addr, params->seq,
                                 params->seq_len, params->cipher, flags);
         default:
-                devdbg(usbdev, "rndis_add_key: unsupported cipher %08x",
-                                                        params->cipher);
+                netdev_dbg(usbdev->net, "%s(): unsupported cipher %08x\n",
+                           __func__, params->cipher);
                 return -ENOTSUPP;
         }
 }
@@ -2059,7 +2105,7 @@ static int rndis_del_key(struct wiphy *wiphy, struct net_device *netdev,
         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
         struct usbnet *usbdev = priv->usbdev;
 
-        devdbg(usbdev, "rndis_del_key(%i, %pM)", key_index, mac_addr);
+        netdev_dbg(usbdev->net, "%s(%i, %pM)\n", __func__, key_index, mac_addr);
 
         return remove_key(usbdev, key_index, mac_addr);
 }
@@ -2071,7 +2117,7 @@ static int rndis_set_default_key(struct wiphy *wiphy, struct net_device *netdev,
         struct usbnet *usbdev = priv->usbdev;
         struct rndis_wlan_encr_key key;
 
-        devdbg(usbdev, "rndis_set_default_key(%i)", key_index);
+        netdev_dbg(usbdev->net, "%s(%i)\n", __func__, key_index);
 
         priv->encr_tx_key_index = key_index;
 
@@ -2185,7 +2231,8 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
         if (ret < 0)
                 memset(bssid, 0, sizeof(bssid));
 
-        devdbg(usbdev, "link up work: [%pM] %s", bssid, roamed ? "roamed" : "");
+        netdev_dbg(usbdev->net, "link up work: [%pM]%s\n",
+                   bssid, roamed ? " roamed" : "");
 
         /* Internal bss list in device always contains at least the currently
          * connected bss and we can get it to cfg80211 with
@@ -2267,8 +2314,8 @@ static void rndis_wlan_auth_indication(struct usbnet *usbdev,
         /* must have at least one array entry */
         if (len < offsetof(struct ndis_80211_status_indication, u) +
                                 sizeof(struct ndis_80211_auth_request)) {
-                devinfo(usbdev, "authentication indication: "
-                                "too short message (%i)", len);
+                netdev_info(usbdev->net, "authentication indication: too short message (%i)\n",
+                            len);
                 return;
         }
 
@@ -2295,8 +2342,8 @@ static void rndis_wlan_auth_indication(struct usbnet *usbdev,
                         type = "group_error";
                 }
 
-                devinfo(usbdev, "authentication indication: %s (0x%08x)", type,
-                                le32_to_cpu(auth_req->flags));
+                netdev_info(usbdev->net, "authentication indication: %s (0x%08x)\n",
+                            type, le32_to_cpu(auth_req->flags));
 
                 if (pairwise_error) {
                         key_type = NL80211_KEYTYPE_PAIRWISE;
@@ -2332,8 +2379,8 @@ static void rndis_wlan_pmkid_cand_list_indication(struct usbnet *usbdev,
 
         if (len < offsetof(struct ndis_80211_status_indication, u) +
                                 sizeof(struct ndis_80211_pmkid_cand_list)) {
-                devinfo(usbdev, "pmkid candidate list indication: "
-                                "too short message (%i)", len);
+                netdev_info(usbdev->net, "pmkid candidate list indication: too short message (%i)\n",
+                            len);
                 return;
         }
 
@@ -2343,18 +2390,16 @@ static void rndis_wlan_pmkid_cand_list_indication(struct usbnet *usbdev,
                         offsetof(struct ndis_80211_status_indication, u);
 
         if (len < expected_len) {
-                devinfo(usbdev, "pmkid candidate list indication: "
-                                "list larger than buffer (%i < %i)",
-                                len, expected_len);
+                netdev_info(usbdev->net, "pmkid candidate list indication: list larger than buffer (%i < %i)\n",
+                            len, expected_len);
                 return;
         }
 
         cand_list = &indication->u.cand_list;
 
-        devinfo(usbdev, "pmkid candidate list indication: "
-                        "version %i, candidates %i",
-                        le32_to_cpu(cand_list->version),
-                        le32_to_cpu(cand_list->num_candidates));
+        netdev_info(usbdev->net, "pmkid candidate list indication: version %i, candidates %i\n",
+                    le32_to_cpu(cand_list->version),
+                    le32_to_cpu(cand_list->num_candidates));
 
         if (le32_to_cpu(cand_list->version) != 1)
                 return;
@@ -2363,8 +2408,8 @@ static void rndis_wlan_pmkid_cand_list_indication(struct usbnet *usbdev,
                 struct ndis_80211_pmkid_candidate *cand =
                                                 &cand_list->candidate_list[i];
 
-                devdbg(usbdev, "cand[%i]: flags: 0x%08x, bssid: %pM",
-                                i, le32_to_cpu(cand->flags), cand->bssid);
+                netdev_dbg(usbdev->net, "cand[%i]: flags: 0x%08x, bssid: %pM\n",
+                           i, le32_to_cpu(cand->flags), cand->bssid);
 
 #if 0
                 struct iw_pmkid_cand pcand;
@@ -2395,15 +2440,14 @@ static void rndis_wlan_media_specific_indication(struct usbnet *usbdev,
         len = le32_to_cpu(msg->length);
 
         if (len < 8) {
-                devinfo(usbdev, "media specific indication, "
-                                "ignore too short message (%i < 8)", len);
+                netdev_info(usbdev->net, "media specific indication, ignore too short message (%i < 8)\n",
+                            len);
                 return;
         }
 
         if (offset + len > buflen) {
-                devinfo(usbdev, "media specific indication, "
-                                "too large to fit to buffer (%i > %i)",
-                                offset + len, buflen);
+                netdev_info(usbdev->net, "media specific indication, too large to fit to buffer (%i > %i)\n",
+                            offset + len, buflen);
                 return;
         }
 
@@ -2411,13 +2455,13 @@ static void rndis_wlan_media_specific_indication(struct usbnet *usbdev,
 
         switch (le32_to_cpu(indication->status_type)) {
         case NDIS_80211_STATUSTYPE_RADIOSTATE:
-                devinfo(usbdev, "radio state indication: %i",
-                        le32_to_cpu(indication->u.radio_status));
+                netdev_info(usbdev->net, "radio state indication: %i\n",
+                            le32_to_cpu(indication->u.radio_status));
                 return;
 
         case NDIS_80211_STATUSTYPE_MEDIASTREAMMODE:
-                devinfo(usbdev, "media stream mode indication: %i",
-                        le32_to_cpu(indication->u.media_stream_mode));
+                netdev_info(usbdev->net, "media stream mode indication: %i\n",
+                            le32_to_cpu(indication->u.media_stream_mode));
                 return;
 
         case NDIS_80211_STATUSTYPE_AUTHENTICATION:
@@ -2429,9 +2473,8 @@ static void rndis_wlan_media_specific_indication(struct usbnet *usbdev,
                 return;
 
         default:
-                devinfo(usbdev, "media specific indication: "
-                                "unknown status type 0x%08x",
-                                le32_to_cpu(indication->status_type));
+                netdev_info(usbdev->net, "media specific indication: unknown status type 0x%08x\n",
+                            le32_to_cpu(indication->status_type));
         }
 }
 
@@ -2448,14 +2491,13 @@ static void rndis_wlan_indication(struct usbnet *usbdev, void *ind, int buflen)
                          * and userspace to think that device is
                          * roaming/reassociating when it isn't.
                          */
-                        devdbg(usbdev, "ignored OID_802_11_ADD_KEY triggered "
-                                        "'media connect'");
+                        netdev_dbg(usbdev->net, "ignored OID_802_11_ADD_KEY triggered 'media connect'\n");
                         return;
                 }
 
                 usbnet_pause_rx(usbdev);
 
-                devinfo(usbdev, "media connect");
+                netdev_info(usbdev->net, "media connect\n");
 
                 /* queue work to avoid recursive calls into rndis_command */
                 set_bit(WORK_LINK_UP, &priv->work_pending);
@@ -2463,7 +2505,7 @@ static void rndis_wlan_indication(struct usbnet *usbdev, void *ind, int buflen)
                 break;
 
         case RNDIS_STATUS_MEDIA_DISCONNECT:
-                devinfo(usbdev, "media disconnect");
+                netdev_info(usbdev->net, "media disconnect\n");
 
                 /* queue work to avoid recursive calls into rndis_command */
                 set_bit(WORK_LINK_DOWN, &priv->work_pending);
@@ -2475,8 +2517,8 @@ static void rndis_wlan_indication(struct usbnet *usbdev, void *ind, int buflen)
                 break;
 
         default:
-                devinfo(usbdev, "indication: 0x%08x",
-                                le32_to_cpu(msg->status));
+                netdev_info(usbdev->net, "indication: 0x%08x\n",
+                            le32_to_cpu(msg->status));
                 break;
         }
 }
@@ -2541,13 +2583,13 @@ static void rndis_device_poller(struct work_struct *work)
         if (ret == 0)
                 priv->last_qual = level_to_qual(le32_to_cpu(rssi));
 
-        devdbg(usbdev, "dev-poller: OID_802_11_RSSI -> %d, rssi:%d, qual: %d",
-                ret, le32_to_cpu(rssi), level_to_qual(le32_to_cpu(rssi)));
+        netdev_dbg(usbdev->net, "dev-poller: OID_802_11_RSSI -> %d, rssi:%d, qual: %d\n",
+                   ret, le32_to_cpu(rssi), level_to_qual(le32_to_cpu(rssi)));
 
         /* Workaround transfer stalls on poor quality links.
          * TODO: find right way to fix these stalls (as stalls do not happen
          * with ndiswrapper/windows driver). */
-        if (priv->last_qual <= 25) {
+        if (priv->param_workaround_interval > 0 && priv->last_qual <= 25) {
                 /* Decrease stats worker interval to catch stalls.
                  * faster. Faster than 400-500ms causes packet loss,
                  * Slower doesn't catch stalls fast enough.
@@ -2591,23 +2633,9 @@ end:
 /*
  * driver/device initialization
  */
-static int bcm4320a_early_init(struct usbnet *usbdev)
-{
-        /* bcm4320a doesn't handle configuration parameters well. Try
-         * set any and you get partially zeroed mac and broken device.
-         */
-
-        return 0;
-}
-
-static int bcm4320b_early_init(struct usbnet *usbdev)
+static void rndis_copy_module_params(struct usbnet *usbdev)
 {
         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
-        char buf[8];
-
-        /* Early initialization settings, setting these won't have effect
-         * if called after generic_rndis_bind().
-         */
 
         priv->param_country[0] = modparam_country[0];
         priv->param_country[1] = modparam_country[1];
@@ -2649,6 +2677,32 @@ static int bcm4320b_early_init(struct usbnet *usbdev)
                 priv->param_workaround_interval = 500;
         else
                 priv->param_workaround_interval = modparam_workaround_interval;
+}
+
+static int bcm4320a_early_init(struct usbnet *usbdev)
+{
+        /* copy module parameters for bcm4320a so that iwconfig reports txpower
+         * and workaround parameter is copied to private structure correctly.
+         */
+        rndis_copy_module_params(usbdev);
+
+        /* bcm4320a doesn't handle configuration parameters well. Try
+         * set any and you get partially zeroed mac and broken device.
+         */
+
+        return 0;
+}
+
+static int bcm4320b_early_init(struct usbnet *usbdev)
+{
+        struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
+        char buf[8];
+
+        rndis_copy_module_params(usbdev);
+
+        /* Early initialization settings, setting these won't have effect
+         * if called after generic_rndis_bind().
+         */
 
         rndis_set_config_parameter_str(usbdev, "Country", priv->param_country);
         rndis_set_config_parameter_str(usbdev, "FrameBursting",
@@ -2823,11 +2877,11 @@ static int rndis_wlan_reset(struct usbnet *usbdev)
         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
         int retval;
 
-        devdbg(usbdev, "rndis_wlan_reset");
+        netdev_dbg(usbdev->net, "%s()\n", __func__);
 
         retval = rndis_reset(usbdev);
         if (retval)
-                devwarn(usbdev, "rndis_reset() failed: %d", retval);
+                netdev_warn(usbdev->net, "rndis_reset failed: %d\n", retval);
 
         /* rndis_reset cleared multicast list, so restore here.
            (set_multicast_list() also turns on current packet filter) */
@@ -2845,7 +2899,7 @@ static int rndis_wlan_stop(struct usbnet *usbdev)
         int retval;
         __le32 filter;
 
-        devdbg(usbdev, "rndis_wlan_stop");
+        netdev_dbg(usbdev->net, "%s()\n", __func__);
 
         retval = disassociate(usbdev, false);
 
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index ed1f997e3521..5239e082cd0f 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -1,6 +1,6 @@
 menuconfig RT2X00
         tristate "Ralink driver support"
-        depends on MAC80211 && WLAN_80211
+        depends on MAC80211
         ---help---
           This will enable the support for the Ralink drivers,
           developed in the rt2x00 project <http://rt2x00.serialmonkey.com>.
@@ -53,6 +53,62 @@ config RT61PCI
 
           When compiled as a module, this driver will be called rt61pci.
 
+config RT2800PCI_PCI
+        boolean
+        depends on PCI
+        default y
+
+config RT2800PCI_SOC
+        boolean
+        depends on RALINK_RT288X || RALINK_RT305X
+        default y
+
+config RT2800PCI
+        tristate "Ralink rt28xx/rt30xx/rt35xx (PCI/PCIe/PCMCIA) support (EXPERIMENTAL)"
+        depends on (RT2800PCI_PCI || RT2800PCI_SOC) && EXPERIMENTAL
+        select RT2800_LIB
+        select RT2X00_LIB_PCI if RT2800PCI_PCI
+        select RT2X00_LIB_SOC if RT2800PCI_SOC
+        select RT2X00_LIB_HT
+        select RT2X00_LIB_FIRMWARE
+        select RT2X00_LIB_CRYPTO
+        select CRC_CCITT
+        select EEPROM_93CX6
+        ---help---
+          This adds support for rt2800/rt3000/rt3500 wireless chipset family.
+          Supported chips: RT2760, RT2790, RT2860, RT2880, RT2890 & RT3052
+
+          This driver is non-functional at the moment and is intended for
+          developers.
+
+          When compiled as a module, this driver will be called "rt2800pci.ko".
+
+if RT2800PCI
+
+config RT2800PCI_RT30XX
+        bool "rt2800pci - Include support for rt30xx (PCI/PCIe/PCMCIA) devices"
+        default n
+        ---help---
+          This adds support for rt30xx wireless chipset family to the
+          rt2800pci driver.
+          Supported chips: RT3090, RT3091 & RT3092
+
+          Support for these devices is non-functional at the moment and is
+          intended for testers and developers.
+
+config RT2800PCI_RT35XX
+        bool "rt2800pci - Include support for rt35xx (PCI/PCIe/PCMCIA) devices"
+        default n
+        ---help---
+          This adds support for rt35xx wireless chipset family to the
+          rt2800pci driver.
+          Supported chips: RT3060, RT3062, RT3562, RT3592
+
+          Support for these devices is non-functional at the moment and is
+          intended for testers and developers.
+
+endif
+
 config RT2500USB
         tristate "Ralink rt2500 (USB) support"
         depends on USB
@@ -78,8 +134,9 @@ config RT73USB
           When compiled as a module, this driver will be called rt73usb.
 
 config RT2800USB
-        tristate "Ralink rt2800 (USB) support"
+        tristate "Ralink rt2800 (USB) support (EXPERIMENTAL)"
         depends on USB && EXPERIMENTAL
+        select RT2800_LIB
         select RT2X00_LIB_USB
         select RT2X00_LIB_HT
         select RT2X00_LIB_FIRMWARE
@@ -89,12 +146,60 @@ config RT2800USB
           This adds experimental support for rt2800 wireless chipset family.
           Supported chips: RT2770, RT2870 & RT3070.
 
+          Known issues:
+          - support for RT2870 chips doesn't work with 802.11n APs yet
+          - support for RT3070 chips is non-functional at the moment
+
           When compiled as a module, this driver will be called "rt2800usb.ko".
 
+if RT2800USB
+
+config RT2800USB_RT30XX
+        bool "rt2800usb - Include support for rt30xx (USB) devices"
+        default n
+        ---help---
+          This adds support for rt30xx wireless chipset family to the
+          rt2800usb driver.
+          Supported chips: RT3070, RT3071 & RT3072
+
+          Support for these devices is non-functional at the moment and is
+          intended for testers and developers.
+
+config RT2800USB_RT35XX
+        bool "rt2800usb - Include support for rt35xx (USB) devices"
+        default n
+        ---help---
+          This adds support for rt35xx wireless chipset family to the
+          rt2800usb driver.
+          Supported chips: RT3572
+
+          Support for these devices is non-functional at the moment and is
+          intended for testers and developers.
+
+config RT2800USB_UNKNOWN
+        bool "rt2800usb - Include support for unknown (USB) devices"
+        default n
+        ---help---
+          This adds support for rt2800 family devices that are known to
+          have a rt2800 family chipset, but for which the exact chipset
+          is unknown.
+
+          Support status for these devices is unknown, and enabling these
+          devices may or may not work.
+
+endif
+
+config RT2800_LIB
+        tristate
+
 config RT2X00_LIB_PCI
         tristate
         select RT2X00_LIB
 
+config RT2X00_LIB_SOC
+        tristate
+        select RT2X00_LIB
+
 config RT2X00_LIB_USB
         tristate
         select RT2X00_LIB
diff --git a/drivers/net/wireless/rt2x00/Makefile b/drivers/net/wireless/rt2x00/Makefile
index 13043ea97667..971339858297 100644
--- a/drivers/net/wireless/rt2x00/Makefile
+++ b/drivers/net/wireless/rt2x00/Makefile
@@ -11,10 +11,13 @@ rt2x00lib-$(CONFIG_RT2X00_LIB_HT)	+= rt2x00ht.o
 
 obj-$(CONFIG_RT2X00_LIB)                += rt2x00lib.o
 obj-$(CONFIG_RT2X00_LIB_PCI)            += rt2x00pci.o
+obj-$(CONFIG_RT2X00_LIB_SOC)            += rt2x00soc.o
 obj-$(CONFIG_RT2X00_LIB_USB)            += rt2x00usb.o
+obj-$(CONFIG_RT2800_LIB)                += rt2800lib.o
 obj-$(CONFIG_RT2400PCI)                 += rt2400pci.o
 obj-$(CONFIG_RT2500PCI)                 += rt2500pci.o
 obj-$(CONFIG_RT61PCI)                   += rt61pci.o
+obj-$(CONFIG_RT2800PCI)                 += rt2800pci.o
 obj-$(CONFIG_RT2500USB)                 += rt2500usb.o
 obj-$(CONFIG_RT73USB)                   += rt73usb.o
 obj-$(CONFIG_RT2800USB)                 += rt2800usb.o
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 798f625e38f7..5f5204b82891 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -31,6 +31,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/eeprom_93cx6.h>
+#include <linux/slab.h>
 
 #include "rt2x00.h"
 #include "rt2x00pci.h"
@@ -451,7 +452,7 @@ static void rt2400pci_config_channel(struct rt2x00_dev *rt2x00dev,
         /*
          * RF2420 chipset don't need any additional actions.
          */
-        if (rt2x00_rf(&rt2x00dev->chip, RF2420))
+        if (rt2x00_rf(rt2x00dev, RF2420))
                 return;
 
         /*
@@ -1340,10 +1341,10 @@ static int rt2400pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
          */
         value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
         rt2x00pci_register_read(rt2x00dev, CSR0, &reg);
-        rt2x00_set_chip_rf(rt2x00dev, value, reg);
+        rt2x00_set_chip(rt2x00dev, RT2460, value,
+                        rt2x00_get_field32(reg, CSR0_REVISION));
 
-        if (!rt2x00_rf(&rt2x00dev->chip, RF2420) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2421)) {
+        if (!rt2x00_rf(rt2x00dev, RF2420) && !rt2x00_rf(rt2x00dev, RF2421)) {
                 ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
                 return -ENODEV;
         }
@@ -1431,7 +1432,6 @@ static int rt2400pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                                IEEE80211_HW_SIGNAL_DBM |
                                IEEE80211_HW_SUPPORTS_PS |
                                IEEE80211_HW_PS_NULLFUNC_STACK;
-        rt2x00dev->hw->extra_tx_headroom = 0;
 
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
@@ -1562,7 +1562,6 @@ static const struct ieee80211_ops rt2400pci_mac80211_ops = {
         .get_stats              = rt2x00mac_get_stats,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
         .conf_tx                = rt2400pci_conf_tx,
-        .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt2400pci_get_tsf,
         .tx_last_beacon         = rt2400pci_tx_last_beacon,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
@@ -1622,27 +1621,28 @@ static const struct data_queue_desc rt2400pci_queue_atim = {
 };
 
 static const struct rt2x00_ops rt2400pci_ops = {
-        .name           = KBUILD_MODNAME,
-        .max_sta_intf   = 1,
-        .max_ap_intf    = 1,
-        .eeprom_size    = EEPROM_SIZE,
-        .rf_size        = RF_SIZE,
-        .tx_queues      = NUM_TX_QUEUES,
-        .rx             = &rt2400pci_queue_rx,
-        .tx             = &rt2400pci_queue_tx,
-        .bcn            = &rt2400pci_queue_bcn,
-        .atim           = &rt2400pci_queue_atim,
-        .lib            = &rt2400pci_rt2x00_ops,
-        .hw             = &rt2400pci_mac80211_ops,
+        .name                   = KBUILD_MODNAME,
+        .max_sta_intf           = 1,
+        .max_ap_intf            = 1,
+        .eeprom_size            = EEPROM_SIZE,
+        .rf_size                = RF_SIZE,
+        .tx_queues              = NUM_TX_QUEUES,
+        .extra_tx_headroom      = 0,
+        .rx                     = &rt2400pci_queue_rx,
+        .tx                     = &rt2400pci_queue_tx,
+        .bcn                    = &rt2400pci_queue_bcn,
+        .atim                   = &rt2400pci_queue_atim,
+        .lib                    = &rt2400pci_rt2x00_ops,
+        .hw                     = &rt2400pci_mac80211_ops,
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
-        .debugfs        = &rt2400pci_rt2x00debug,
+        .debugfs                = &rt2400pci_rt2x00debug,
 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
 };
 
 /*
  * RT2400pci module information.
  */
-static struct pci_device_id rt2400pci_device_table[] = {
+static DEFINE_PCI_DEVICE_TABLE(rt2400pci_device_table) = {
         { PCI_DEVICE(0x1814, 0x0101), PCI_DEVICE_DATA(&rt2400pci_ops) },
         { 0, }
 };
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.h b/drivers/net/wireless/rt2x00/rt2400pci.h
index ccd644104ad1..c048b18f4133 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.h
+++ b/drivers/net/wireless/rt2x00/rt2400pci.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -35,7 +35,7 @@
 
 /*
  * Signal information.
- * Defaul offset is required for RSSI <-> dBm conversion.
+ * Default offset is required for RSSI <-> dBm conversion.
  */
 #define DEFAULT_RSSI_OFFSET             100
 
@@ -65,6 +65,7 @@
  * CSR0: ASIC revision number.
  */
 #define CSR0                            0x0000
+#define CSR0_REVISION                   FIELD32(0x0000ffff)
 
 /*
  * CSR1: System control register.
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 2e872ac69826..2a73f593aab0 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -31,6 +31,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/eeprom_93cx6.h>
+#include <linux/slab.h>
 
 #include "rt2x00.h"
 #include "rt2x00pci.h"
@@ -440,8 +441,7 @@ static void rt2500pci_config_ant(struct rt2x00_dev *rt2x00dev,
         /*
          * RT2525E and RT5222 need to flip TX I/Q
          */
-        if (rt2x00_rf(&rt2x00dev->chip, RF2525E) ||
-            rt2x00_rf(&rt2x00dev->chip, RF5222)) {
+        if (rt2x00_rf(rt2x00dev, RF2525E) || rt2x00_rf(rt2x00dev, RF5222)) {
                 rt2x00_set_field8(&r2, BBP_R2_TX_IQ_FLIP, 1);
                 rt2x00_set_field32(&reg, BBPCSR1_CCK_FLIP, 1);
                 rt2x00_set_field32(&reg, BBPCSR1_OFDM_FLIP, 1);
@@ -449,7 +449,7 @@ static void rt2500pci_config_ant(struct rt2x00_dev *rt2x00dev,
                 /*
                  * RT2525E does not need RX I/Q Flip.
                  */
-                if (rt2x00_rf(&rt2x00dev->chip, RF2525E))
+                if (rt2x00_rf(rt2x00dev, RF2525E))
                         rt2x00_set_field8(&r14, BBP_R14_RX_IQ_FLIP, 0);
         } else {
                 rt2x00_set_field32(&reg, BBPCSR1_CCK_FLIP, 0);
@@ -475,14 +475,14 @@ static void rt2500pci_config_channel(struct rt2x00_dev *rt2x00dev,
          * Switch on tuning bits.
          * For RT2523 devices we do not need to update the R1 register.
          */
-        if (!rt2x00_rf(&rt2x00dev->chip, RF2523))
+        if (!rt2x00_rf(rt2x00dev, RF2523))
                 rt2x00_set_field32(&rf->rf1, RF1_TUNER, 1);
         rt2x00_set_field32(&rf->rf3, RF3_TUNER, 1);
 
         /*
          * For RT2525 we should first set the channel to half band higher.
          */
-        if (rt2x00_rf(&rt2x00dev->chip, RF2525)) {
+        if (rt2x00_rf(rt2x00dev, RF2525)) {
                 static const u32 vals[] = {
                         0x00080cbe, 0x00080d02, 0x00080d06, 0x00080d0a,
                         0x00080d0e, 0x00080d12, 0x00080d16, 0x00080d1a,
@@ -516,7 +516,7 @@ static void rt2500pci_config_channel(struct rt2x00_dev *rt2x00dev,
          * Switch off tuning bits.
          * For RT2523 devices we do not need to update the R1 register.
          */
-        if (!rt2x00_rf(&rt2x00dev->chip, RF2523)) {
+        if (!rt2x00_rf(rt2x00dev, RF2523)) {
                 rt2x00_set_field32(&rf->rf1, RF1_TUNER, 0);
                 rt2500pci_rf_write(rt2x00dev, 1, rf->rf1);
         }
@@ -640,7 +640,7 @@ static void rt2500pci_link_tuner(struct rt2x00_dev *rt2x00dev,
          * up to version C the link tuning should halt after 20
          * seconds while being associated.
          */
-        if (rt2x00_rev(&rt2x00dev->chip) < RT2560_VERSION_D &&
+        if (rt2x00_rev(rt2x00dev) < RT2560_VERSION_D &&
             rt2x00dev->intf_associated && count > 20)
                 return;
 
@@ -650,7 +650,7 @@ static void rt2500pci_link_tuner(struct rt2x00_dev *rt2x00dev,
          * should go straight to dynamic CCA tuning when they
          * are not associated.
          */
-        if (rt2x00_rev(&rt2x00dev->chip) < RT2560_VERSION_D ||
+        if (rt2x00_rev(rt2x00dev) < RT2560_VERSION_D ||
             !rt2x00dev->intf_associated)
                 goto dynamic_cca_tune;
 
@@ -1504,14 +1504,15 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
          */
         value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
         rt2x00pci_register_read(rt2x00dev, CSR0, &reg);
-        rt2x00_set_chip_rf(rt2x00dev, value, reg);
-
-        if (!rt2x00_rf(&rt2x00dev->chip, RF2522) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2523) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2524) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2525) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2525E) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF5222)) {
+        rt2x00_set_chip(rt2x00dev, RT2560, value,
+                        rt2x00_get_field32(reg, CSR0_REVISION));
+
+        if (!rt2x00_rf(rt2x00dev, RF2522) &&
+            !rt2x00_rf(rt2x00dev, RF2523) &&
+            !rt2x00_rf(rt2x00dev, RF2524) &&
+            !rt2x00_rf(rt2x00dev, RF2525) &&
+            !rt2x00_rf(rt2x00dev, RF2525E) &&
+            !rt2x00_rf(rt2x00dev, RF5222)) {
                 ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
                 return -ENODEV;
         }
@@ -1732,8 +1733,6 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                                IEEE80211_HW_SUPPORTS_PS |
                                IEEE80211_HW_PS_NULLFUNC_STACK;
 
-        rt2x00dev->hw->extra_tx_headroom = 0;
-
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
                                 rt2x00_eeprom_addr(rt2x00dev,
@@ -1745,22 +1744,22 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->supported_bands = SUPPORT_BAND_2GHZ;
         spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
 
-        if (rt2x00_rf(&rt2x00dev->chip, RF2522)) {
+        if (rt2x00_rf(rt2x00dev, RF2522)) {
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2522);
                 spec->channels = rf_vals_bg_2522;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2523)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2523)) {
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2523);
                 spec->channels = rf_vals_bg_2523;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2524)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2524)) {
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2524);
                 spec->channels = rf_vals_bg_2524;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2525)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2525)) {
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525);
                 spec->channels = rf_vals_bg_2525;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2525E)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2525E)) {
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525e);
                 spec->channels = rf_vals_bg_2525e;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF5222)) {
+        } else if (rt2x00_rf(rt2x00dev, RF5222)) {
                 spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_5222);
                 spec->channels = rf_vals_5222;
@@ -1861,7 +1860,6 @@ static const struct ieee80211_ops rt2500pci_mac80211_ops = {
         .get_stats              = rt2x00mac_get_stats,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
         .conf_tx                = rt2x00mac_conf_tx,
-        .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt2500pci_get_tsf,
         .tx_last_beacon         = rt2500pci_tx_last_beacon,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
@@ -1921,27 +1919,28 @@ static const struct data_queue_desc rt2500pci_queue_atim = {
 };
 
 static const struct rt2x00_ops rt2500pci_ops = {
-        .name           = KBUILD_MODNAME,
-        .max_sta_intf   = 1,
-        .max_ap_intf    = 1,
-        .eeprom_size    = EEPROM_SIZE,
-        .rf_size        = RF_SIZE,
-        .tx_queues      = NUM_TX_QUEUES,
-        .rx             = &rt2500pci_queue_rx,
-        .tx             = &rt2500pci_queue_tx,
-        .bcn            = &rt2500pci_queue_bcn,
-        .atim           = &rt2500pci_queue_atim,
-        .lib            = &rt2500pci_rt2x00_ops,
-        .hw             = &rt2500pci_mac80211_ops,
+        .name                   = KBUILD_MODNAME,
+        .max_sta_intf           = 1,
+        .max_ap_intf            = 1,
+        .eeprom_size            = EEPROM_SIZE,
+        .rf_size                = RF_SIZE,
+        .tx_queues              = NUM_TX_QUEUES,
+        .extra_tx_headroom      = 0,
+        .rx                     = &rt2500pci_queue_rx,
+        .tx                     = &rt2500pci_queue_tx,
+        .bcn                    = &rt2500pci_queue_bcn,
+        .atim                   = &rt2500pci_queue_atim,
+        .lib                    = &rt2500pci_rt2x00_ops,
+        .hw                     = &rt2500pci_mac80211_ops,
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
-        .debugfs        = &rt2500pci_rt2x00debug,
+        .debugfs                = &rt2500pci_rt2x00debug,
 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
 };
 
 /*
  * RT2500pci module information.
  */
-static struct pci_device_id rt2500pci_device_table[] = {
+static DEFINE_PCI_DEVICE_TABLE(rt2500pci_device_table) = {
         { PCI_DEVICE(0x1814, 0x0201), PCI_DEVICE_DATA(&rt2500pci_ops) },
         { 0, }
 };
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.h b/drivers/net/wireless/rt2x00/rt2500pci.h
index 54d37957883c..d708031361ac 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.h
+++ b/drivers/net/wireless/rt2x00/rt2500pci.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -46,7 +46,7 @@
 
 /*
  * Signal information.
- * Defaul offset is required for RSSI <-> dBm conversion.
+ * Default offset is required for RSSI <-> dBm conversion.
  */
 #define DEFAULT_RSSI_OFFSET             121
 
@@ -76,6 +76,7 @@
  * CSR0: ASIC revision number.
  */
 #define CSR0                            0x0000
+#define CSR0_REVISION                   FIELD32(0x0000ffff)
 
 /*
  * CSR1: System control register.
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 22dd6d9e2981..8ebb705fe106 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -29,6 +29,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 
 #include "rt2x00.h"
@@ -368,7 +369,7 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
 
                 /*
                  * The encryption key doesn't fit within the CSR cache,
-                 * this means we should allocate it seperately and use
+                 * this means we should allocate it separately and use
                  * rt2x00usb_vendor_request() to send the key to the hardware.
                  */
                 reg = KEY_ENTRY(key->hw_key_idx);
@@ -382,7 +383,7 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
                 /*
                  * The driver does not support the IV/EIV generation
                  * in hardware. However it demands the data to be provided
-                 * both seperately as well as inside the frame.
+                 * both separately as well as inside the frame.
                  * We already provided the CONFIG_CRYPTO_COPY_IV to rt2x00lib
                  * to ensure rt2x00lib will not strip the data from the
                  * frame after the copy, now we must tell mac80211
@@ -565,8 +566,7 @@ static void rt2500usb_config_ant(struct rt2x00_dev *rt2x00dev,
         /*
          * RT2525E and RT5222 need to flip TX I/Q
          */
-        if (rt2x00_rf(&rt2x00dev->chip, RF2525E) ||
-            rt2x00_rf(&rt2x00dev->chip, RF5222)) {
+        if (rt2x00_rf(rt2x00dev, RF2525E) || rt2x00_rf(rt2x00dev, RF5222)) {
                 rt2x00_set_field8(&r2, BBP_R2_TX_IQ_FLIP, 1);
                 rt2x00_set_field16(&csr5, PHY_CSR5_CCK_FLIP, 1);
                 rt2x00_set_field16(&csr6, PHY_CSR6_OFDM_FLIP, 1);
@@ -574,7 +574,7 @@ static void rt2500usb_config_ant(struct rt2x00_dev *rt2x00dev,
                 /*
                  * RT2525E does not need RX I/Q Flip.
                  */
-                if (rt2x00_rf(&rt2x00dev->chip, RF2525E))
+                if (rt2x00_rf(rt2x00dev, RF2525E))
                         rt2x00_set_field8(&r14, BBP_R14_RX_IQ_FLIP, 0);
         } else {
                 rt2x00_set_field16(&csr5, PHY_CSR5_CCK_FLIP, 0);
@@ -598,7 +598,7 @@ static void rt2500usb_config_channel(struct rt2x00_dev *rt2x00dev,
         /*
          * For RT2525E we should first set the channel to half band higher.
          */
-        if (rt2x00_rf(&rt2x00dev->chip, RF2525E)) {
+        if (rt2x00_rf(rt2x00dev, RF2525E)) {
                 static const u32 vals[] = {
                         0x000008aa, 0x000008ae, 0x000008ae, 0x000008b2,
                         0x000008b2, 0x000008b6, 0x000008b6, 0x000008ba,
@@ -716,139 +716,6 @@ static void rt2500usb_reset_tuner(struct rt2x00_dev *rt2x00dev,
 }
 
 /*
- * NOTE: This function is directly ported from legacy driver, but
- * despite it being declared it was never called. Although link tuning
- * sounds like a good idea, and usually works well for the other drivers,
- * it does _not_ work with rt2500usb. Enabling this function will result
- * in TX capabilities only until association kicks in. Immediately
- * after the successful association all TX frames will be kept in the
- * hardware queue and never transmitted.
- */
-#if 0
-static void rt2500usb_link_tuner(struct rt2x00_dev *rt2x00dev)
-{
-        int rssi = rt2x00_get_link_rssi(&rt2x00dev->link);
-        u16 bbp_thresh;
-        u16 vgc_bound;
-        u16 sens;
-        u16 r24;
-        u16 r25;
-        u16 r61;
-        u16 r17_sens;
-        u8 r17;
-        u8 up_bound;
-        u8 low_bound;
-
-        /*
-         * Read current r17 value, as well as the sensitivity values
-         * for the r17 register.
-         */
-        rt2500usb_bbp_read(rt2x00dev, 17, &r17);
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R17, &r17_sens);
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_VGC, &vgc_bound);
-        up_bound = rt2x00_get_field16(vgc_bound, EEPROM_BBPTUNE_VGCUPPER);
-        low_bound = rt2x00_get_field16(vgc_bound, EEPROM_BBPTUNE_VGCLOWER);
-
-        /*
-         * If we are not associated, we should go straight to the
-         * dynamic CCA tuning.
-         */
-        if (!rt2x00dev->intf_associated)
-                goto dynamic_cca_tune;
-
-        /*
-         * Determine the BBP tuning threshold and correctly
-         * set BBP 24, 25 and 61.
-         */
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE, &bbp_thresh);
-        bbp_thresh = rt2x00_get_field16(bbp_thresh, EEPROM_BBPTUNE_THRESHOLD);
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R24, &r24);
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R25, &r25);
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R61, &r61);
-
-        if ((rssi + bbp_thresh) > 0) {
-                r24 = rt2x00_get_field16(r24, EEPROM_BBPTUNE_R24_HIGH);
-                r25 = rt2x00_get_field16(r25, EEPROM_BBPTUNE_R25_HIGH);
-                r61 = rt2x00_get_field16(r61, EEPROM_BBPTUNE_R61_HIGH);
-        } else {
-                r24 = rt2x00_get_field16(r24, EEPROM_BBPTUNE_R24_LOW);
-                r25 = rt2x00_get_field16(r25, EEPROM_BBPTUNE_R25_LOW);
-                r61 = rt2x00_get_field16(r61, EEPROM_BBPTUNE_R61_LOW);
-        }
-
-        rt2500usb_bbp_write(rt2x00dev, 24, r24);
-        rt2500usb_bbp_write(rt2x00dev, 25, r25);
-        rt2500usb_bbp_write(rt2x00dev, 61, r61);
-
-        /*
-         * A too low RSSI will cause too much false CCA which will
-         * then corrupt the R17 tuning. To remidy this the tuning should
-         * be stopped (While making sure the R17 value will not exceed limits)
-         */
-        if (rssi >= -40) {
-                if (r17 != 0x60)
-                        rt2500usb_bbp_write(rt2x00dev, 17, 0x60);
-                return;
-        }
-
-        /*
-         * Special big-R17 for short distance
-         */
-        if (rssi >= -58) {
-                sens = rt2x00_get_field16(r17_sens, EEPROM_BBPTUNE_R17_LOW);
-                if (r17 != sens)
-                        rt2500usb_bbp_write(rt2x00dev, 17, sens);
-                return;
-        }
-
-        /*
-         * Special mid-R17 for middle distance
-         */
-        if (rssi >= -74) {
-                sens = rt2x00_get_field16(r17_sens, EEPROM_BBPTUNE_R17_HIGH);
-                if (r17 != sens)
-                        rt2500usb_bbp_write(rt2x00dev, 17, sens);
-                return;
-        }
-
-        /*
-         * Leave short or middle distance condition, restore r17
-         * to the dynamic tuning range.
-         */
-        low_bound = 0x32;
-        if (rssi < -77)
-                up_bound -= (-77 - rssi);
-
-        if (up_bound < low_bound)
-                up_bound = low_bound;
-
-        if (r17 > up_bound) {
-                rt2500usb_bbp_write(rt2x00dev, 17, up_bound);
-                rt2x00dev->link.vgc_level = up_bound;
-                return;
-        }
-
-dynamic_cca_tune:
-
-        /*
-         * R17 is inside the dynamic tuning range,
-         * start tuning the link based on the false cca counter.
-         */
-        if (rt2x00dev->link.qual.false_cca > 512 && r17 < up_bound) {
-                rt2500usb_bbp_write(rt2x00dev, 17, ++r17);
-                rt2x00dev->link.vgc_level = r17;
-        } else if (rt2x00dev->link.qual.false_cca < 100 && r17 > low_bound) {
-                rt2500usb_bbp_write(rt2x00dev, 17, --r17);
-                rt2x00dev->link.vgc_level = r17;
-        }
-}
-#else
-#define rt2500usb_link_tuner    NULL
-#endif
-
-/*
  * Initialization functions.
  */
 static int rt2500usb_init_registers(struct rt2x00_dev *rt2x00dev)
@@ -926,7 +793,7 @@ static int rt2500usb_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field16(&reg, MAC_CSR1_HOST_READY, 1);
         rt2500usb_register_write(rt2x00dev, MAC_CSR1, reg);
 
-        if (rt2x00_rev(&rt2x00dev->chip) >= RT2570_VERSION_C) {
+        if (rt2x00_rev(rt2x00dev) >= RT2570_VERSION_C) {
                 rt2500usb_register_read(rt2x00dev, PHY_CSR2, &reg);
                 rt2x00_set_field16(&reg, PHY_CSR2_LNA, 0);
         } else {
@@ -1543,19 +1410,17 @@ static int rt2500usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
         rt2500usb_register_read(rt2x00dev, MAC_CSR0, &reg);
         rt2x00_set_chip(rt2x00dev, RT2570, value, reg);
 
-        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0) ||
-            rt2x00_check_rev(&rt2x00dev->chip, 0x0000000f, 0)) {
-
+        if (((reg & 0xfff0) != 0) || ((reg & 0x0000000f) == 0)) {
                 ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
                 return -ENODEV;
         }
 
-        if (!rt2x00_rf(&rt2x00dev->chip, RF2522) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2523) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2524) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2525) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2525E) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF5222)) {
+        if (!rt2x00_rf(rt2x00dev, RF2522) &&
+            !rt2x00_rf(rt2x00dev, RF2523) &&
+            !rt2x00_rf(rt2x00dev, RF2524) &&
+            !rt2x00_rf(rt2x00dev, RF2525) &&
+            !rt2x00_rf(rt2x00dev, RF2525E) &&
+            !rt2x00_rf(rt2x00dev, RF5222)) {
                 ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
                 return -ENODEV;
         }
@@ -1779,6 +1644,11 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         unsigned int i;
 
         /*
+         * Disable powersaving as default.
+         */
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+        /*
          * Initialize all hw fields.
          */
         rt2x00dev->hw->flags =
@@ -1788,8 +1658,6 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK;
 
-        rt2x00dev->hw->extra_tx_headroom = TXD_DESC_SIZE;
-
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
                                 rt2x00_eeprom_addr(rt2x00dev,
@@ -1801,22 +1669,22 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->supported_bands = SUPPORT_BAND_2GHZ;
         spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
 
-        if (rt2x00_rf(&rt2x00dev->chip, RF2522)) {
+        if (rt2x00_rf(rt2x00dev, RF2522)) {
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2522);
                 spec->channels = rf_vals_bg_2522;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2523)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2523)) {
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2523);
                 spec->channels = rf_vals_bg_2523;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2524)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2524)) {
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2524);
                 spec->channels = rf_vals_bg_2524;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2525)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2525)) {
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525);
                 spec->channels = rf_vals_bg_2525;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2525E)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2525E)) {
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525e);
                 spec->channels = rf_vals_bg_2525e;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF5222)) {
+        } else if (rt2x00_rf(rt2x00dev, RF5222)) {
                 spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_5222);
                 spec->channels = rf_vals_5222;
@@ -1897,7 +1765,6 @@ static const struct ieee80211_ops rt2500usb_mac80211_ops = {
         .get_stats              = rt2x00mac_get_stats,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
         .conf_tx                = rt2x00mac_conf_tx,
-        .get_tx_stats           = rt2x00mac_get_tx_stats,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
 };
 
@@ -1910,7 +1777,6 @@ static const struct rt2x00lib_ops rt2500usb_rt2x00_ops = {
         .rfkill_poll            = rt2500usb_rfkill_poll,
         .link_stats             = rt2500usb_link_stats,
         .reset_tuner            = rt2500usb_reset_tuner,
-        .link_tuner             = rt2500usb_link_tuner,
         .write_tx_desc          = rt2500usb_write_tx_desc,
         .write_tx_data          = rt2x00usb_write_tx_data,
         .write_beacon           = rt2500usb_write_beacon,
@@ -1956,20 +1822,21 @@ static const struct data_queue_desc rt2500usb_queue_atim = {
 };
 
 static const struct rt2x00_ops rt2500usb_ops = {
-        .name           = KBUILD_MODNAME,
-        .max_sta_intf   = 1,
-        .max_ap_intf    = 1,
-        .eeprom_size    = EEPROM_SIZE,
-        .rf_size        = RF_SIZE,
-        .tx_queues      = NUM_TX_QUEUES,
-        .rx             = &rt2500usb_queue_rx,
-        .tx             = &rt2500usb_queue_tx,
-        .bcn            = &rt2500usb_queue_bcn,
-        .atim           = &rt2500usb_queue_atim,
-        .lib            = &rt2500usb_rt2x00_ops,
-        .hw             = &rt2500usb_mac80211_ops,
+        .name                   = KBUILD_MODNAME,
+        .max_sta_intf           = 1,
+        .max_ap_intf            = 1,
+        .eeprom_size            = EEPROM_SIZE,
+        .rf_size                = RF_SIZE,
+        .tx_queues              = NUM_TX_QUEUES,
+        .extra_tx_headroom      = TXD_DESC_SIZE,
+        .rx                     = &rt2500usb_queue_rx,
+        .tx                     = &rt2500usb_queue_tx,
+        .bcn                    = &rt2500usb_queue_bcn,
+        .atim                   = &rt2500usb_queue_atim,
+        .lib                    = &rt2500usb_rt2x00_ops,
+        .hw                     = &rt2500usb_mac80211_ops,
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
-        .debugfs        = &rt2500usb_rt2x00debug,
+        .debugfs                = &rt2500usb_rt2x00debug,
 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
 };
 
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.h b/drivers/net/wireless/rt2x00/rt2500usb.h
index b01edca42583..b493306a7eed 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.h
+++ b/drivers/net/wireless/rt2x00/rt2500usb.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -46,7 +46,7 @@
 
 /*
  * Signal information.
- * Defaul offset is required for RSSI <-> dBm conversion.
+ * Default offset is required for RSSI <-> dBm conversion.
  */
 #define DEFAULT_RSSI_OFFSET             120
 
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
new file mode 100644
index 000000000000..74c0433dba37
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -0,0 +1,1852 @@
+/*
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2009 Alban Browaeys <prahal@yahoo.com>
+        Copyright (C) 2009 Felix Fietkau <nbd@openwrt.org>
+        Copyright (C) 2009 Luis Correia <luis.f.correia@gmail.com>
+        Copyright (C) 2009 Mattias Nissler <mattias.nissler@gmx.de>
+        Copyright (C) 2009 Mark Asselstine <asselsm@gmail.com>
+        Copyright (C) 2009 Xose Vazquez Perez <xose.vazquez@gmail.com>
+        Copyright (C) 2009 Bart Zolnierkiewicz <bzolnier@gmail.com>
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2800
+        Abstract: Data structures and registers for the rt2800 modules.
+        Supported chipsets: RT2800E, RT2800ED & RT2800U.
+ */
+
+#ifndef RT2800_H
+#define RT2800_H
+
+/*
+ * RF chip defines.
+ *
+ * RF2820 2.4G 2T3R
+ * RF2850 2.4G/5G 2T3R
+ * RF2720 2.4G 1T2R
+ * RF2750 2.4G/5G 1T2R
+ * RF3020 2.4G 1T1R
+ * RF2020 2.4G B/G
+ * RF3021 2.4G 1T2R
+ * RF3022 2.4G 2T2R
+ * RF3052 2.4G 2T2R
+ */
+#define RF2820                          0x0001
+#define RF2850                          0x0002
+#define RF2720                          0x0003
+#define RF2750                          0x0004
+#define RF3020                          0x0005
+#define RF2020                          0x0006
+#define RF3021                          0x0007
+#define RF3022                          0x0008
+#define RF3052                          0x0009
+
+/*
+ * Chipset version.
+ */
+#define RT2860C_VERSION                 0x0100
+#define RT2860D_VERSION                 0x0101
+#define RT2880E_VERSION                 0x0200
+#define RT2883_VERSION                  0x0300
+#define RT3070_VERSION                  0x0200
+
+/*
+ * Signal information.
+ * Default offset is required for RSSI <-> dBm conversion.
+ */
+#define DEFAULT_RSSI_OFFSET             120 /* FIXME */
+
+/*
+ * Register layout information.
+ */
+#define CSR_REG_BASE                    0x1000
+#define CSR_REG_SIZE                    0x0800
+#define EEPROM_BASE                     0x0000
+#define EEPROM_SIZE                     0x0110
+#define BBP_BASE                        0x0000
+#define BBP_SIZE                        0x0080
+#define RF_BASE                         0x0004
+#define RF_SIZE                         0x0010
+
+/*
+ * Number of TX queues.
+ */
+#define NUM_TX_QUEUES                   4
+
+/*
+ * USB registers.
+ */
+
+/*
+ * INT_SOURCE_CSR: Interrupt source register.
+ * Write one to clear corresponding bit.
+ * TX_FIFO_STATUS: FIFO Statistics is full, sw should read 0x171c
+ */
+#define INT_SOURCE_CSR                  0x0200
+#define INT_SOURCE_CSR_RXDELAYINT       FIELD32(0x00000001)
+#define INT_SOURCE_CSR_TXDELAYINT       FIELD32(0x00000002)
+#define INT_SOURCE_CSR_RX_DONE          FIELD32(0x00000004)
+#define INT_SOURCE_CSR_AC0_DMA_DONE     FIELD32(0x00000008)
+#define INT_SOURCE_CSR_AC1_DMA_DONE     FIELD32(0x00000010)
+#define INT_SOURCE_CSR_AC2_DMA_DONE     FIELD32(0x00000020)
+#define INT_SOURCE_CSR_AC3_DMA_DONE     FIELD32(0x00000040)
+#define INT_SOURCE_CSR_HCCA_DMA_DONE    FIELD32(0x00000080)
+#define INT_SOURCE_CSR_MGMT_DMA_DONE    FIELD32(0x00000100)
+#define INT_SOURCE_CSR_MCU_COMMAND      FIELD32(0x00000200)
+#define INT_SOURCE_CSR_RXTX_COHERENT    FIELD32(0x00000400)
+#define INT_SOURCE_CSR_TBTT             FIELD32(0x00000800)
+#define INT_SOURCE_CSR_PRE_TBTT         FIELD32(0x00001000)
+#define INT_SOURCE_CSR_TX_FIFO_STATUS   FIELD32(0x00002000)
+#define INT_SOURCE_CSR_AUTO_WAKEUP      FIELD32(0x00004000)
+#define INT_SOURCE_CSR_GPTIMER          FIELD32(0x00008000)
+#define INT_SOURCE_CSR_RX_COHERENT      FIELD32(0x00010000)
+#define INT_SOURCE_CSR_TX_COHERENT      FIELD32(0x00020000)
+
+/*
+ * INT_MASK_CSR: Interrupt MASK register. 1: the interrupt is mask OFF.
+ */
+#define INT_MASK_CSR                    0x0204
+#define INT_MASK_CSR_RXDELAYINT         FIELD32(0x00000001)
+#define INT_MASK_CSR_TXDELAYINT         FIELD32(0x00000002)
+#define INT_MASK_CSR_RX_DONE            FIELD32(0x00000004)
+#define INT_MASK_CSR_AC0_DMA_DONE       FIELD32(0x00000008)
+#define INT_MASK_CSR_AC1_DMA_DONE       FIELD32(0x00000010)
+#define INT_MASK_CSR_AC2_DMA_DONE       FIELD32(0x00000020)
+#define INT_MASK_CSR_AC3_DMA_DONE       FIELD32(0x00000040)
+#define INT_MASK_CSR_HCCA_DMA_DONE      FIELD32(0x00000080)
+#define INT_MASK_CSR_MGMT_DMA_DONE      FIELD32(0x00000100)
+#define INT_MASK_CSR_MCU_COMMAND        FIELD32(0x00000200)
+#define INT_MASK_CSR_RXTX_COHERENT      FIELD32(0x00000400)
+#define INT_MASK_CSR_TBTT               FIELD32(0x00000800)
+#define INT_MASK_CSR_PRE_TBTT           FIELD32(0x00001000)
+#define INT_MASK_CSR_TX_FIFO_STATUS     FIELD32(0x00002000)
+#define INT_MASK_CSR_AUTO_WAKEUP        FIELD32(0x00004000)
+#define INT_MASK_CSR_GPTIMER            FIELD32(0x00008000)
+#define INT_MASK_CSR_RX_COHERENT        FIELD32(0x00010000)
+#define INT_MASK_CSR_TX_COHERENT        FIELD32(0x00020000)
+
+/*
+ * WPDMA_GLO_CFG
+ */
+#define WPDMA_GLO_CFG                   0x0208
+#define WPDMA_GLO_CFG_ENABLE_TX_DMA     FIELD32(0x00000001)
+#define WPDMA_GLO_CFG_TX_DMA_BUSY       FIELD32(0x00000002)
+#define WPDMA_GLO_CFG_ENABLE_RX_DMA     FIELD32(0x00000004)
+#define WPDMA_GLO_CFG_RX_DMA_BUSY       FIELD32(0x00000008)
+#define WPDMA_GLO_CFG_WP_DMA_BURST_SIZE FIELD32(0x00000030)
+#define WPDMA_GLO_CFG_TX_WRITEBACK_DONE FIELD32(0x00000040)
+#define WPDMA_GLO_CFG_BIG_ENDIAN        FIELD32(0x00000080)
+#define WPDMA_GLO_CFG_RX_HDR_SCATTER    FIELD32(0x0000ff00)
+#define WPDMA_GLO_CFG_HDR_SEG_LEN       FIELD32(0xffff0000)
+
+/*
+ * WPDMA_RST_IDX
+ */
+#define WPDMA_RST_IDX                   0x020c
+#define WPDMA_RST_IDX_DTX_IDX0          FIELD32(0x00000001)
+#define WPDMA_RST_IDX_DTX_IDX1          FIELD32(0x00000002)
+#define WPDMA_RST_IDX_DTX_IDX2          FIELD32(0x00000004)
+#define WPDMA_RST_IDX_DTX_IDX3          FIELD32(0x00000008)
+#define WPDMA_RST_IDX_DTX_IDX4          FIELD32(0x00000010)
+#define WPDMA_RST_IDX_DTX_IDX5          FIELD32(0x00000020)
+#define WPDMA_RST_IDX_DRX_IDX0          FIELD32(0x00010000)
+
+/*
+ * DELAY_INT_CFG
+ */
+#define DELAY_INT_CFG                   0x0210
+#define DELAY_INT_CFG_RXMAX_PTIME       FIELD32(0x000000ff)
+#define DELAY_INT_CFG_RXMAX_PINT        FIELD32(0x00007f00)
+#define DELAY_INT_CFG_RXDLY_INT_EN      FIELD32(0x00008000)
+#define DELAY_INT_CFG_TXMAX_PTIME       FIELD32(0x00ff0000)
+#define DELAY_INT_CFG_TXMAX_PINT        FIELD32(0x7f000000)
+#define DELAY_INT_CFG_TXDLY_INT_EN      FIELD32(0x80000000)
+
+/*
+ * WMM_AIFSN_CFG: Aifsn for each EDCA AC
+ * AIFSN0: AC_BE
+ * AIFSN1: AC_BK
+ * AIFSN2: AC_VI
+ * AIFSN3: AC_VO
+ */
+#define WMM_AIFSN_CFG                   0x0214
+#define WMM_AIFSN_CFG_AIFSN0            FIELD32(0x0000000f)
+#define WMM_AIFSN_CFG_AIFSN1            FIELD32(0x000000f0)
+#define WMM_AIFSN_CFG_AIFSN2            FIELD32(0x00000f00)
+#define WMM_AIFSN_CFG_AIFSN3            FIELD32(0x0000f000)
+
+/*
+ * WMM_CWMIN_CSR: CWmin for each EDCA AC
+ * CWMIN0: AC_BE
+ * CWMIN1: AC_BK
+ * CWMIN2: AC_VI
+ * CWMIN3: AC_VO
+ */
+#define WMM_CWMIN_CFG                   0x0218
+#define WMM_CWMIN_CFG_CWMIN0            FIELD32(0x0000000f)
+#define WMM_CWMIN_CFG_CWMIN1            FIELD32(0x000000f0)
+#define WMM_CWMIN_CFG_CWMIN2            FIELD32(0x00000f00)
+#define WMM_CWMIN_CFG_CWMIN3            FIELD32(0x0000f000)
+
+/*
+ * WMM_CWMAX_CSR: CWmax for each EDCA AC
+ * CWMAX0: AC_BE
+ * CWMAX1: AC_BK
+ * CWMAX2: AC_VI
+ * CWMAX3: AC_VO
+ */
+#define WMM_CWMAX_CFG                   0x021c
+#define WMM_CWMAX_CFG_CWMAX0            FIELD32(0x0000000f)
+#define WMM_CWMAX_CFG_CWMAX1            FIELD32(0x000000f0)
+#define WMM_CWMAX_CFG_CWMAX2            FIELD32(0x00000f00)
+#define WMM_CWMAX_CFG_CWMAX3            FIELD32(0x0000f000)
+
+/*
+ * AC_TXOP0: AC_BK/AC_BE TXOP register
+ * AC0TXOP: AC_BK in unit of 32us
+ * AC1TXOP: AC_BE in unit of 32us
+ */
+#define WMM_TXOP0_CFG                   0x0220
+#define WMM_TXOP0_CFG_AC0TXOP           FIELD32(0x0000ffff)
+#define WMM_TXOP0_CFG_AC1TXOP           FIELD32(0xffff0000)
+
+/*
+ * AC_TXOP1: AC_VO/AC_VI TXOP register
+ * AC2TXOP: AC_VI in unit of 32us
+ * AC3TXOP: AC_VO in unit of 32us
+ */
+#define WMM_TXOP1_CFG                   0x0224
+#define WMM_TXOP1_CFG_AC2TXOP           FIELD32(0x0000ffff)
+#define WMM_TXOP1_CFG_AC3TXOP           FIELD32(0xffff0000)
+
+/*
+ * GPIO_CTRL_CFG:
+ */
+#define GPIO_CTRL_CFG                   0x0228
+#define GPIO_CTRL_CFG_BIT0              FIELD32(0x00000001)
+#define GPIO_CTRL_CFG_BIT1              FIELD32(0x00000002)
+#define GPIO_CTRL_CFG_BIT2              FIELD32(0x00000004)
+#define GPIO_CTRL_CFG_BIT3              FIELD32(0x00000008)
+#define GPIO_CTRL_CFG_BIT4              FIELD32(0x00000010)
+#define GPIO_CTRL_CFG_BIT5              FIELD32(0x00000020)
+#define GPIO_CTRL_CFG_BIT6              FIELD32(0x00000040)
+#define GPIO_CTRL_CFG_BIT7              FIELD32(0x00000080)
+#define GPIO_CTRL_CFG_BIT8              FIELD32(0x00000100)
+
+/*
+ * MCU_CMD_CFG
+ */
+#define MCU_CMD_CFG                     0x022c
+
+/*
+ * AC_BK register offsets
+ */
+#define TX_BASE_PTR0                    0x0230
+#define TX_MAX_CNT0                     0x0234
+#define TX_CTX_IDX0                     0x0238
+#define TX_DTX_IDX0                     0x023c
+
+/*
+ * AC_BE register offsets
+ */
+#define TX_BASE_PTR1                    0x0240
+#define TX_MAX_CNT1                     0x0244
+#define TX_CTX_IDX1                     0x0248
+#define TX_DTX_IDX1                     0x024c
+
+/*
+ * AC_VI register offsets
+ */
+#define TX_BASE_PTR2                    0x0250
+#define TX_MAX_CNT2                     0x0254
+#define TX_CTX_IDX2                     0x0258
+#define TX_DTX_IDX2                     0x025c
+
+/*
+ * AC_VO register offsets
+ */
+#define TX_BASE_PTR3                    0x0260
+#define TX_MAX_CNT3                     0x0264
+#define TX_CTX_IDX3                     0x0268
+#define TX_DTX_IDX3                     0x026c
+
+/*
+ * HCCA register offsets
+ */
+#define TX_BASE_PTR4                    0x0270
+#define TX_MAX_CNT4                     0x0274
+#define TX_CTX_IDX4                     0x0278
+#define TX_DTX_IDX4                     0x027c
+
+/*
+ * MGMT register offsets
+ */
+#define TX_BASE_PTR5                    0x0280
+#define TX_MAX_CNT5                     0x0284
+#define TX_CTX_IDX5                     0x0288
+#define TX_DTX_IDX5                     0x028c
+
+/*
+ * RX register offsets
+ */
+#define RX_BASE_PTR                     0x0290
+#define RX_MAX_CNT                      0x0294
+#define RX_CRX_IDX                      0x0298
+#define RX_DRX_IDX                      0x029c
+
+/*
+ * PBF_SYS_CTRL
+ * HOST_RAM_WRITE: enable Host program ram write selection
+ */
+#define PBF_SYS_CTRL                    0x0400
+#define PBF_SYS_CTRL_READY              FIELD32(0x00000080)
+#define PBF_SYS_CTRL_HOST_RAM_WRITE     FIELD32(0x00010000)
+
+/*
+ * HOST-MCU shared memory
+ */
+#define HOST_CMD_CSR                    0x0404
+#define HOST_CMD_CSR_HOST_COMMAND       FIELD32(0x000000ff)
+
+/*
+ * PBF registers
+ * Most are for debug. Driver doesn't touch PBF register.
+ */
+#define PBF_CFG                         0x0408
+#define PBF_MAX_PCNT                    0x040c
+#define PBF_CTRL                        0x0410
+#define PBF_INT_STA                     0x0414
+#define PBF_INT_ENA                     0x0418
+
+/*
+ * BCN_OFFSET0:
+ */
+#define BCN_OFFSET0                     0x042c
+#define BCN_OFFSET0_BCN0                FIELD32(0x000000ff)
+#define BCN_OFFSET0_BCN1                FIELD32(0x0000ff00)
+#define BCN_OFFSET0_BCN2                FIELD32(0x00ff0000)
+#define BCN_OFFSET0_BCN3                FIELD32(0xff000000)
+
+/*
+ * BCN_OFFSET1:
+ */
+#define BCN_OFFSET1                     0x0430
+#define BCN_OFFSET1_BCN4                FIELD32(0x000000ff)
+#define BCN_OFFSET1_BCN5                FIELD32(0x0000ff00)
+#define BCN_OFFSET1_BCN6                FIELD32(0x00ff0000)
+#define BCN_OFFSET1_BCN7                FIELD32(0xff000000)
+
+/*
+ * PBF registers
+ * Most are for debug. Driver doesn't touch PBF register.
+ */
+#define TXRXQ_PCNT                      0x0438
+#define PBF_DBG                         0x043c
+
+/*
+ * RF registers
+ */
+#define RF_CSR_CFG                      0x0500
+#define RF_CSR_CFG_DATA                 FIELD32(0x000000ff)
+#define RF_CSR_CFG_REGNUM               FIELD32(0x00001f00)
+#define RF_CSR_CFG_WRITE                FIELD32(0x00010000)
+#define RF_CSR_CFG_BUSY                 FIELD32(0x00020000)
+
+/*
+ * EFUSE_CSR: RT30x0 EEPROM
+ */
+#define EFUSE_CTRL                      0x0580
+#define EFUSE_CTRL_ADDRESS_IN           FIELD32(0x03fe0000)
+#define EFUSE_CTRL_MODE                 FIELD32(0x000000c0)
+#define EFUSE_CTRL_KICK                 FIELD32(0x40000000)
+#define EFUSE_CTRL_PRESENT              FIELD32(0x80000000)
+
+/*
+ * EFUSE_DATA0
+ */
+#define EFUSE_DATA0                     0x0590
+
+/*
+ * EFUSE_DATA1
+ */
+#define EFUSE_DATA1                     0x0594
+
+/*
+ * EFUSE_DATA2
+ */
+#define EFUSE_DATA2                     0x0598
+
+/*
+ * EFUSE_DATA3
+ */
+#define EFUSE_DATA3                     0x059c
+
+/*
+ * MAC Control/Status Registers(CSR).
+ * Some values are set in TU, whereas 1 TU == 1024 us.
+ */
+
+/*
+ * MAC_CSR0: ASIC revision number.
+ * ASIC_REV: 0
+ * ASIC_VER: 2860 or 2870
+ */
+#define MAC_CSR0                        0x1000
+#define MAC_CSR0_REVISION               FIELD32(0x0000ffff)
+#define MAC_CSR0_CHIPSET                FIELD32(0xffff0000)
+
+/*
+ * MAC_SYS_CTRL:
+ */
+#define MAC_SYS_CTRL                    0x1004
+#define MAC_SYS_CTRL_RESET_CSR          FIELD32(0x00000001)
+#define MAC_SYS_CTRL_RESET_BBP          FIELD32(0x00000002)
+#define MAC_SYS_CTRL_ENABLE_TX          FIELD32(0x00000004)
+#define MAC_SYS_CTRL_ENABLE_RX          FIELD32(0x00000008)
+#define MAC_SYS_CTRL_CONTINUOUS_TX      FIELD32(0x00000010)
+#define MAC_SYS_CTRL_LOOPBACK           FIELD32(0x00000020)
+#define MAC_SYS_CTRL_WLAN_HALT          FIELD32(0x00000040)
+#define MAC_SYS_CTRL_RX_TIMESTAMP       FIELD32(0x00000080)
+
+/*
+ * MAC_ADDR_DW0: STA MAC register 0
+ */
+#define MAC_ADDR_DW0                    0x1008
+#define MAC_ADDR_DW0_BYTE0              FIELD32(0x000000ff)
+#define MAC_ADDR_DW0_BYTE1              FIELD32(0x0000ff00)
+#define MAC_ADDR_DW0_BYTE2              FIELD32(0x00ff0000)
+#define MAC_ADDR_DW0_BYTE3              FIELD32(0xff000000)
+
+/*
+ * MAC_ADDR_DW1: STA MAC register 1
+ * UNICAST_TO_ME_MASK:
+ * Used to mask off bits from byte 5 of the MAC address
+ * to determine the UNICAST_TO_ME bit for RX frames.
+ * The full mask is complemented by BSS_ID_MASK:
+ *    MASK = BSS_ID_MASK & UNICAST_TO_ME_MASK
+ */
+#define MAC_ADDR_DW1                    0x100c
+#define MAC_ADDR_DW1_BYTE4              FIELD32(0x000000ff)
+#define MAC_ADDR_DW1_BYTE5              FIELD32(0x0000ff00)
+#define MAC_ADDR_DW1_UNICAST_TO_ME_MASK FIELD32(0x00ff0000)
+
+/*
+ * MAC_BSSID_DW0: BSSID register 0
+ */
+#define MAC_BSSID_DW0                   0x1010
+#define MAC_BSSID_DW0_BYTE0             FIELD32(0x000000ff)
+#define MAC_BSSID_DW0_BYTE1             FIELD32(0x0000ff00)
+#define MAC_BSSID_DW0_BYTE2             FIELD32(0x00ff0000)
+#define MAC_BSSID_DW0_BYTE3             FIELD32(0xff000000)
+
+/*
+ * MAC_BSSID_DW1: BSSID register 1
+ * BSS_ID_MASK:
+ *     0: 1-BSSID mode (BSS index = 0)
+ *     1: 2-BSSID mode (BSS index: Byte5, bit 0)
+ *     2: 4-BSSID mode (BSS index: byte5, bit 0 - 1)
+ *     3: 8-BSSID mode (BSS index: byte5, bit 0 - 2)
+ * This mask is used to mask off bits 0, 1 and 2 of byte 5 of the
+ * BSSID. This will make sure that those bits will be ignored
+ * when determining the MY_BSS of RX frames.
+ */
+#define MAC_BSSID_DW1                   0x1014
+#define MAC_BSSID_DW1_BYTE4             FIELD32(0x000000ff)
+#define MAC_BSSID_DW1_BYTE5             FIELD32(0x0000ff00)
+#define MAC_BSSID_DW1_BSS_ID_MASK       FIELD32(0x00030000)
+#define MAC_BSSID_DW1_BSS_BCN_NUM       FIELD32(0x001c0000)
+
+/*
+ * MAX_LEN_CFG: Maximum frame length register.
+ * MAX_MPDU: rt2860b max 16k bytes
+ * MAX_PSDU: Maximum PSDU length
+ *      (power factor) 0:2^13, 1:2^14, 2:2^15, 3:2^16
+ */
+#define MAX_LEN_CFG                     0x1018
+#define MAX_LEN_CFG_MAX_MPDU            FIELD32(0x00000fff)
+#define MAX_LEN_CFG_MAX_PSDU            FIELD32(0x00003000)
+#define MAX_LEN_CFG_MIN_PSDU            FIELD32(0x0000c000)
+#define MAX_LEN_CFG_MIN_MPDU            FIELD32(0x000f0000)
+
+/*
+ * BBP_CSR_CFG: BBP serial control register
+ * VALUE: Register value to program into BBP
+ * REG_NUM: Selected BBP register
+ * READ_CONTROL: 0 write BBP, 1 read BBP
+ * BUSY: ASIC is busy executing BBP commands
+ * BBP_PAR_DUR: 0 4 MAC clocks, 1 8 MAC clocks
+ * BBP_RW_MODE: 0 serial, 1 paralell
+ */
+#define BBP_CSR_CFG                     0x101c
+#define BBP_CSR_CFG_VALUE               FIELD32(0x000000ff)
+#define BBP_CSR_CFG_REGNUM              FIELD32(0x0000ff00)
+#define BBP_CSR_CFG_READ_CONTROL        FIELD32(0x00010000)
+#define BBP_CSR_CFG_BUSY                FIELD32(0x00020000)
+#define BBP_CSR_CFG_BBP_PAR_DUR         FIELD32(0x00040000)
+#define BBP_CSR_CFG_BBP_RW_MODE         FIELD32(0x00080000)
+
+/*
+ * RF_CSR_CFG0: RF control register
+ * REGID_AND_VALUE: Register value to program into RF
+ * BITWIDTH: Selected RF register
+ * STANDBYMODE: 0 high when standby, 1 low when standby
+ * SEL: 0 RF_LE0 activate, 1 RF_LE1 activate
+ * BUSY: ASIC is busy executing RF commands
+ */
+#define RF_CSR_CFG0                     0x1020
+#define RF_CSR_CFG0_REGID_AND_VALUE     FIELD32(0x00ffffff)
+#define RF_CSR_CFG0_BITWIDTH            FIELD32(0x1f000000)
+#define RF_CSR_CFG0_REG_VALUE_BW        FIELD32(0x1fffffff)
+#define RF_CSR_CFG0_STANDBYMODE         FIELD32(0x20000000)
+#define RF_CSR_CFG0_SEL                 FIELD32(0x40000000)
+#define RF_CSR_CFG0_BUSY                FIELD32(0x80000000)
+
+/*
+ * RF_CSR_CFG1: RF control register
+ * REGID_AND_VALUE: Register value to program into RF
+ * RFGAP: Gap between BB_CONTROL_RF and RF_LE
+ *        0: 3 system clock cycle (37.5usec)
+ *        1: 5 system clock cycle (62.5usec)
+ */
+#define RF_CSR_CFG1                     0x1024
+#define RF_CSR_CFG1_REGID_AND_VALUE     FIELD32(0x00ffffff)
+#define RF_CSR_CFG1_RFGAP               FIELD32(0x1f000000)
+
+/*
+ * RF_CSR_CFG2: RF control register
+ * VALUE: Register value to program into RF
+ */
+#define RF_CSR_CFG2                     0x1028
+#define RF_CSR_CFG2_VALUE               FIELD32(0x00ffffff)
+
+/*
+ * LED_CFG: LED control
+ * color LED's:
+ *   0: off
+ *   1: blinking upon TX2
+ *   2: periodic slow blinking
+ *   3: always on
+ * LED polarity:
+ *   0: active low
+ *   1: active high
+ */
+#define LED_CFG                         0x102c
+#define LED_CFG_ON_PERIOD               FIELD32(0x000000ff)
+#define LED_CFG_OFF_PERIOD              FIELD32(0x0000ff00)
+#define LED_CFG_SLOW_BLINK_PERIOD       FIELD32(0x003f0000)
+#define LED_CFG_R_LED_MODE              FIELD32(0x03000000)
+#define LED_CFG_G_LED_MODE              FIELD32(0x0c000000)
+#define LED_CFG_Y_LED_MODE              FIELD32(0x30000000)
+#define LED_CFG_LED_POLAR               FIELD32(0x40000000)
+
+/*
+ * XIFS_TIME_CFG: MAC timing
+ * CCKM_SIFS_TIME: unit 1us. Applied after CCK RX/TX
+ * OFDM_SIFS_TIME: unit 1us. Applied after OFDM RX/TX
+ * OFDM_XIFS_TIME: unit 1us. Applied after OFDM RX
+ *      when MAC doesn't reference BBP signal BBRXEND
+ * EIFS: unit 1us
+ * BB_RXEND_ENABLE: reference RXEND signal to begin XIFS defer
+ *
+ */
+#define XIFS_TIME_CFG                   0x1100
+#define XIFS_TIME_CFG_CCKM_SIFS_TIME    FIELD32(0x000000ff)
+#define XIFS_TIME_CFG_OFDM_SIFS_TIME    FIELD32(0x0000ff00)
+#define XIFS_TIME_CFG_OFDM_XIFS_TIME    FIELD32(0x000f0000)
+#define XIFS_TIME_CFG_EIFS              FIELD32(0x1ff00000)
+#define XIFS_TIME_CFG_BB_RXEND_ENABLE   FIELD32(0x20000000)
+
+/*
+ * BKOFF_SLOT_CFG:
+ */
+#define BKOFF_SLOT_CFG                  0x1104
+#define BKOFF_SLOT_CFG_SLOT_TIME        FIELD32(0x000000ff)
+#define BKOFF_SLOT_CFG_CC_DELAY_TIME    FIELD32(0x0000ff00)
+
+/*
+ * NAV_TIME_CFG:
+ */
+#define NAV_TIME_CFG                    0x1108
+#define NAV_TIME_CFG_SIFS               FIELD32(0x000000ff)
+#define NAV_TIME_CFG_SLOT_TIME          FIELD32(0x0000ff00)
+#define NAV_TIME_CFG_EIFS               FIELD32(0x01ff0000)
+#define NAV_TIME_ZERO_SIFS              FIELD32(0x02000000)
+
+/*
+ * CH_TIME_CFG: count as channel busy
+ */
+#define CH_TIME_CFG                     0x110c
+
+/*
+ * PBF_LIFE_TIMER: TX/RX MPDU timestamp timer (free run) Unit: 1us
+ */
+#define PBF_LIFE_TIMER                  0x1110
+
+/*
+ * BCN_TIME_CFG:
+ * BEACON_INTERVAL: in unit of 1/16 TU
+ * TSF_TICKING: Enable TSF auto counting
+ * TSF_SYNC: Enable TSF sync, 00: disable, 01: infra mode, 10: ad-hoc mode
+ * BEACON_GEN: Enable beacon generator
+ */
+#define BCN_TIME_CFG                    0x1114
+#define BCN_TIME_CFG_BEACON_INTERVAL    FIELD32(0x0000ffff)
+#define BCN_TIME_CFG_TSF_TICKING        FIELD32(0x00010000)
+#define BCN_TIME_CFG_TSF_SYNC           FIELD32(0x00060000)
+#define BCN_TIME_CFG_TBTT_ENABLE        FIELD32(0x00080000)
+#define BCN_TIME_CFG_BEACON_GEN         FIELD32(0x00100000)
+#define BCN_TIME_CFG_TX_TIME_COMPENSATE FIELD32(0xf0000000)
+
+/*
+ * TBTT_SYNC_CFG:
+ */
+#define TBTT_SYNC_CFG                   0x1118
+
+/*
+ * TSF_TIMER_DW0: Local lsb TSF timer, read-only
+ */
+#define TSF_TIMER_DW0                   0x111c
+#define TSF_TIMER_DW0_LOW_WORD          FIELD32(0xffffffff)
+
+/*
+ * TSF_TIMER_DW1: Local msb TSF timer, read-only
+ */
+#define TSF_TIMER_DW1                   0x1120
+#define TSF_TIMER_DW1_HIGH_WORD         FIELD32(0xffffffff)
+
+/*
+ * TBTT_TIMER: TImer remains till next TBTT, read-only
+ */
+#define TBTT_TIMER                      0x1124
+
+/*
+ * INT_TIMER_CFG:
+ */
+#define INT_TIMER_CFG                   0x1128
+
+/*
+ * INT_TIMER_EN: GP-timer and pre-tbtt Int enable
+ */
+#define INT_TIMER_EN                    0x112c
+
+/*
+ * CH_IDLE_STA: channel idle time
+ */
+#define CH_IDLE_STA                     0x1130
+
+/*
+ * CH_BUSY_STA: channel busy time
+ */
+#define CH_BUSY_STA                     0x1134
+
+/*
+ * MAC_STATUS_CFG:
+ * BBP_RF_BUSY: When set to 0, BBP and RF are stable.
+ *      if 1 or higher one of the 2 registers is busy.
+ */
+#define MAC_STATUS_CFG                  0x1200
+#define MAC_STATUS_CFG_BBP_RF_BUSY      FIELD32(0x00000003)
+
+/*
+ * PWR_PIN_CFG:
+ */
+#define PWR_PIN_CFG                     0x1204
+
+/*
+ * AUTOWAKEUP_CFG: Manual power control / status register
+ * TBCN_BEFORE_WAKE: ForceWake has high privilege than PutToSleep when both set
+ * AUTOWAKE: 0:sleep, 1:awake
+ */
+#define AUTOWAKEUP_CFG                  0x1208
+#define AUTOWAKEUP_CFG_AUTO_LEAD_TIME   FIELD32(0x000000ff)
+#define AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE FIELD32(0x00007f00)
+#define AUTOWAKEUP_CFG_AUTOWAKE         FIELD32(0x00008000)
+
+/*
+ * EDCA_AC0_CFG:
+ */
+#define EDCA_AC0_CFG                    0x1300
+#define EDCA_AC0_CFG_TX_OP              FIELD32(0x000000ff)
+#define EDCA_AC0_CFG_AIFSN              FIELD32(0x00000f00)
+#define EDCA_AC0_CFG_CWMIN              FIELD32(0x0000f000)
+#define EDCA_AC0_CFG_CWMAX              FIELD32(0x000f0000)
+
+/*
+ * EDCA_AC1_CFG:
+ */
+#define EDCA_AC1_CFG                    0x1304
+#define EDCA_AC1_CFG_TX_OP              FIELD32(0x000000ff)
+#define EDCA_AC1_CFG_AIFSN              FIELD32(0x00000f00)
+#define EDCA_AC1_CFG_CWMIN              FIELD32(0x0000f000)
+#define EDCA_AC1_CFG_CWMAX              FIELD32(0x000f0000)
+
+/*
+ * EDCA_AC2_CFG:
+ */
+#define EDCA_AC2_CFG                    0x1308
+#define EDCA_AC2_CFG_TX_OP              FIELD32(0x000000ff)
+#define EDCA_AC2_CFG_AIFSN              FIELD32(0x00000f00)
+#define EDCA_AC2_CFG_CWMIN              FIELD32(0x0000f000)
+#define EDCA_AC2_CFG_CWMAX              FIELD32(0x000f0000)
+
+/*
+ * EDCA_AC3_CFG:
+ */
+#define EDCA_AC3_CFG                    0x130c
+#define EDCA_AC3_CFG_TX_OP              FIELD32(0x000000ff)
+#define EDCA_AC3_CFG_AIFSN              FIELD32(0x00000f00)
+#define EDCA_AC3_CFG_CWMIN              FIELD32(0x0000f000)
+#define EDCA_AC3_CFG_CWMAX              FIELD32(0x000f0000)
+
+/*
+ * EDCA_TID_AC_MAP:
+ */
+#define EDCA_TID_AC_MAP                 0x1310
+
+/*
+ * TX_PWR_CFG_0:
+ */
+#define TX_PWR_CFG_0                    0x1314
+#define TX_PWR_CFG_0_1MBS               FIELD32(0x0000000f)
+#define TX_PWR_CFG_0_2MBS               FIELD32(0x000000f0)
+#define TX_PWR_CFG_0_55MBS              FIELD32(0x00000f00)
+#define TX_PWR_CFG_0_11MBS              FIELD32(0x0000f000)
+#define TX_PWR_CFG_0_6MBS               FIELD32(0x000f0000)
+#define TX_PWR_CFG_0_9MBS               FIELD32(0x00f00000)
+#define TX_PWR_CFG_0_12MBS              FIELD32(0x0f000000)
+#define TX_PWR_CFG_0_18MBS              FIELD32(0xf0000000)
+
+/*
+ * TX_PWR_CFG_1:
+ */
+#define TX_PWR_CFG_1                    0x1318
+#define TX_PWR_CFG_1_24MBS              FIELD32(0x0000000f)
+#define TX_PWR_CFG_1_36MBS              FIELD32(0x000000f0)
+#define TX_PWR_CFG_1_48MBS              FIELD32(0x00000f00)
+#define TX_PWR_CFG_1_54MBS              FIELD32(0x0000f000)
+#define TX_PWR_CFG_1_MCS0               FIELD32(0x000f0000)
+#define TX_PWR_CFG_1_MCS1               FIELD32(0x00f00000)
+#define TX_PWR_CFG_1_MCS2               FIELD32(0x0f000000)
+#define TX_PWR_CFG_1_MCS3               FIELD32(0xf0000000)
+
+/*
+ * TX_PWR_CFG_2:
+ */
+#define TX_PWR_CFG_2                    0x131c
+#define TX_PWR_CFG_2_MCS4               FIELD32(0x0000000f)
+#define TX_PWR_CFG_2_MCS5               FIELD32(0x000000f0)
+#define TX_PWR_CFG_2_MCS6               FIELD32(0x00000f00)
+#define TX_PWR_CFG_2_MCS7               FIELD32(0x0000f000)
+#define TX_PWR_CFG_2_MCS8               FIELD32(0x000f0000)
+#define TX_PWR_CFG_2_MCS9               FIELD32(0x00f00000)
+#define TX_PWR_CFG_2_MCS10              FIELD32(0x0f000000)
+#define TX_PWR_CFG_2_MCS11              FIELD32(0xf0000000)
+
+/*
+ * TX_PWR_CFG_3:
+ */
+#define TX_PWR_CFG_3                    0x1320
+#define TX_PWR_CFG_3_MCS12              FIELD32(0x0000000f)
+#define TX_PWR_CFG_3_MCS13              FIELD32(0x000000f0)
+#define TX_PWR_CFG_3_MCS14              FIELD32(0x00000f00)
+#define TX_PWR_CFG_3_MCS15              FIELD32(0x0000f000)
+#define TX_PWR_CFG_3_UKNOWN1            FIELD32(0x000f0000)
+#define TX_PWR_CFG_3_UKNOWN2            FIELD32(0x00f00000)
+#define TX_PWR_CFG_3_UKNOWN3            FIELD32(0x0f000000)
+#define TX_PWR_CFG_3_UKNOWN4            FIELD32(0xf0000000)
+
+/*
+ * TX_PWR_CFG_4:
+ */
+#define TX_PWR_CFG_4                    0x1324
+#define TX_PWR_CFG_4_UKNOWN5            FIELD32(0x0000000f)
+#define TX_PWR_CFG_4_UKNOWN6            FIELD32(0x000000f0)
+#define TX_PWR_CFG_4_UKNOWN7            FIELD32(0x00000f00)
+#define TX_PWR_CFG_4_UKNOWN8            FIELD32(0x0000f000)
+
+/*
+ * TX_PIN_CFG:
+ */
+#define TX_PIN_CFG                      0x1328
+#define TX_PIN_CFG_PA_PE_A0_EN          FIELD32(0x00000001)
+#define TX_PIN_CFG_PA_PE_G0_EN          FIELD32(0x00000002)
+#define TX_PIN_CFG_PA_PE_A1_EN          FIELD32(0x00000004)
+#define TX_PIN_CFG_PA_PE_G1_EN          FIELD32(0x00000008)
+#define TX_PIN_CFG_PA_PE_A0_POL         FIELD32(0x00000010)
+#define TX_PIN_CFG_PA_PE_G0_POL         FIELD32(0x00000020)
+#define TX_PIN_CFG_PA_PE_A1_POL         FIELD32(0x00000040)
+#define TX_PIN_CFG_PA_PE_G1_POL         FIELD32(0x00000080)
+#define TX_PIN_CFG_LNA_PE_A0_EN         FIELD32(0x00000100)
+#define TX_PIN_CFG_LNA_PE_G0_EN         FIELD32(0x00000200)
+#define TX_PIN_CFG_LNA_PE_A1_EN         FIELD32(0x00000400)
+#define TX_PIN_CFG_LNA_PE_G1_EN         FIELD32(0x00000800)
+#define TX_PIN_CFG_LNA_PE_A0_POL        FIELD32(0x00001000)
+#define TX_PIN_CFG_LNA_PE_G0_POL        FIELD32(0x00002000)
+#define TX_PIN_CFG_LNA_PE_A1_POL        FIELD32(0x00004000)
+#define TX_PIN_CFG_LNA_PE_G1_POL        FIELD32(0x00008000)
+#define TX_PIN_CFG_RFTR_EN              FIELD32(0x00010000)
+#define TX_PIN_CFG_RFTR_POL             FIELD32(0x00020000)
+#define TX_PIN_CFG_TRSW_EN              FIELD32(0x00040000)
+#define TX_PIN_CFG_TRSW_POL             FIELD32(0x00080000)
+
+/*
+ * TX_BAND_CFG: 0x1 use upper 20MHz, 0x0 use lower 20MHz
+ */
+#define TX_BAND_CFG                     0x132c
+#define TX_BAND_CFG_HT40_PLUS           FIELD32(0x00000001)
+#define TX_BAND_CFG_A                   FIELD32(0x00000002)
+#define TX_BAND_CFG_BG                  FIELD32(0x00000004)
+
+/*
+ * TX_SW_CFG0:
+ */
+#define TX_SW_CFG0                      0x1330
+
+/*
+ * TX_SW_CFG1:
+ */
+#define TX_SW_CFG1                      0x1334
+
+/*
+ * TX_SW_CFG2:
+ */
+#define TX_SW_CFG2                      0x1338
+
+/*
+ * TXOP_THRES_CFG:
+ */
+#define TXOP_THRES_CFG                  0x133c
+
+/*
+ * TXOP_CTRL_CFG:
+ */
+#define TXOP_CTRL_CFG                   0x1340
+
+/*
+ * TX_RTS_CFG:
+ * RTS_THRES: unit:byte
+ * RTS_FBK_EN: enable rts rate fallback
+ */
+#define TX_RTS_CFG                      0x1344
+#define TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT FIELD32(0x000000ff)
+#define TX_RTS_CFG_RTS_THRES            FIELD32(0x00ffff00)
+#define TX_RTS_CFG_RTS_FBK_EN           FIELD32(0x01000000)
+
+/*
+ * TX_TIMEOUT_CFG:
+ * MPDU_LIFETIME: expiration time = 2^(9+MPDU LIFE TIME) us
+ * RX_ACK_TIMEOUT: unit:slot. Used for TX procedure
+ * TX_OP_TIMEOUT: TXOP timeout value for TXOP truncation.
+ *                it is recommended that:
+ *                (SLOT_TIME) > (TX_OP_TIMEOUT) > (RX_ACK_TIMEOUT)
+ */
+#define TX_TIMEOUT_CFG                  0x1348
+#define TX_TIMEOUT_CFG_MPDU_LIFETIME    FIELD32(0x000000f0)
+#define TX_TIMEOUT_CFG_RX_ACK_TIMEOUT   FIELD32(0x0000ff00)
+#define TX_TIMEOUT_CFG_TX_OP_TIMEOUT    FIELD32(0x00ff0000)
+
+/*
+ * TX_RTY_CFG:
+ * SHORT_RTY_LIMIT: short retry limit
+ * LONG_RTY_LIMIT: long retry limit
+ * LONG_RTY_THRE: Long retry threshoold
+ * NON_AGG_RTY_MODE: Non-Aggregate MPDU retry mode
+ *                   0:expired by retry limit, 1: expired by mpdu life timer
+ * AGG_RTY_MODE: Aggregate MPDU retry mode
+ *               0:expired by retry limit, 1: expired by mpdu life timer
+ * TX_AUTO_FB_ENABLE: Tx retry PHY rate auto fallback enable
+ */
+#define TX_RTY_CFG                      0x134c
+#define TX_RTY_CFG_SHORT_RTY_LIMIT      FIELD32(0x000000ff)
+#define TX_RTY_CFG_LONG_RTY_LIMIT       FIELD32(0x0000ff00)
+#define TX_RTY_CFG_LONG_RTY_THRE        FIELD32(0x0fff0000)
+#define TX_RTY_CFG_NON_AGG_RTY_MODE     FIELD32(0x10000000)
+#define TX_RTY_CFG_AGG_RTY_MODE         FIELD32(0x20000000)
+#define TX_RTY_CFG_TX_AUTO_FB_ENABLE    FIELD32(0x40000000)
+
+/*
+ * TX_LINK_CFG:
+ * REMOTE_MFB_LIFETIME: remote MFB life time. unit: 32us
+ * MFB_ENABLE: TX apply remote MFB 1:enable
+ * REMOTE_UMFS_ENABLE: remote unsolicit  MFB enable
+ *                     0: not apply remote remote unsolicit (MFS=7)
+ * TX_MRQ_EN: MCS request TX enable
+ * TX_RDG_EN: RDG TX enable
+ * TX_CF_ACK_EN: Piggyback CF-ACK enable
+ * REMOTE_MFB: remote MCS feedback
+ * REMOTE_MFS: remote MCS feedback sequence number
+ */
+#define TX_LINK_CFG                     0x1350
+#define TX_LINK_CFG_REMOTE_MFB_LIFETIME FIELD32(0x000000ff)
+#define TX_LINK_CFG_MFB_ENABLE          FIELD32(0x00000100)
+#define TX_LINK_CFG_REMOTE_UMFS_ENABLE  FIELD32(0x00000200)
+#define TX_LINK_CFG_TX_MRQ_EN           FIELD32(0x00000400)
+#define TX_LINK_CFG_TX_RDG_EN           FIELD32(0x00000800)
+#define TX_LINK_CFG_TX_CF_ACK_EN        FIELD32(0x00001000)
+#define TX_LINK_CFG_REMOTE_MFB          FIELD32(0x00ff0000)
+#define TX_LINK_CFG_REMOTE_MFS          FIELD32(0xff000000)
+
+/*
+ * HT_FBK_CFG0:
+ */
+#define HT_FBK_CFG0                     0x1354
+#define HT_FBK_CFG0_HTMCS0FBK           FIELD32(0x0000000f)
+#define HT_FBK_CFG0_HTMCS1FBK           FIELD32(0x000000f0)
+#define HT_FBK_CFG0_HTMCS2FBK           FIELD32(0x00000f00)
+#define HT_FBK_CFG0_HTMCS3FBK           FIELD32(0x0000f000)
+#define HT_FBK_CFG0_HTMCS4FBK           FIELD32(0x000f0000)
+#define HT_FBK_CFG0_HTMCS5FBK           FIELD32(0x00f00000)
+#define HT_FBK_CFG0_HTMCS6FBK           FIELD32(0x0f000000)
+#define HT_FBK_CFG0_HTMCS7FBK           FIELD32(0xf0000000)
+
+/*
+ * HT_FBK_CFG1:
+ */
+#define HT_FBK_CFG1                     0x1358
+#define HT_FBK_CFG1_HTMCS8FBK           FIELD32(0x0000000f)
+#define HT_FBK_CFG1_HTMCS9FBK           FIELD32(0x000000f0)
+#define HT_FBK_CFG1_HTMCS10FBK          FIELD32(0x00000f00)
+#define HT_FBK_CFG1_HTMCS11FBK          FIELD32(0x0000f000)
+#define HT_FBK_CFG1_HTMCS12FBK          FIELD32(0x000f0000)
+#define HT_FBK_CFG1_HTMCS13FBK          FIELD32(0x00f00000)
+#define HT_FBK_CFG1_HTMCS14FBK          FIELD32(0x0f000000)
+#define HT_FBK_CFG1_HTMCS15FBK          FIELD32(0xf0000000)
+
+/*
+ * LG_FBK_CFG0:
+ */
+#define LG_FBK_CFG0                     0x135c
+#define LG_FBK_CFG0_OFDMMCS0FBK         FIELD32(0x0000000f)
+#define LG_FBK_CFG0_OFDMMCS1FBK         FIELD32(0x000000f0)
+#define LG_FBK_CFG0_OFDMMCS2FBK         FIELD32(0x00000f00)
+#define LG_FBK_CFG0_OFDMMCS3FBK         FIELD32(0x0000f000)
+#define LG_FBK_CFG0_OFDMMCS4FBK         FIELD32(0x000f0000)
+#define LG_FBK_CFG0_OFDMMCS5FBK         FIELD32(0x00f00000)
+#define LG_FBK_CFG0_OFDMMCS6FBK         FIELD32(0x0f000000)
+#define LG_FBK_CFG0_OFDMMCS7FBK         FIELD32(0xf0000000)
+
+/*
+ * LG_FBK_CFG1:
+ */
+#define LG_FBK_CFG1                     0x1360
+#define LG_FBK_CFG0_CCKMCS0FBK          FIELD32(0x0000000f)
+#define LG_FBK_CFG0_CCKMCS1FBK          FIELD32(0x000000f0)
+#define LG_FBK_CFG0_CCKMCS2FBK          FIELD32(0x00000f00)
+#define LG_FBK_CFG0_CCKMCS3FBK          FIELD32(0x0000f000)
+
+/*
+ * CCK_PROT_CFG: CCK Protection
+ * PROTECT_RATE: Protection control frame rate for CCK TX(RTS/CTS/CFEnd)
+ * PROTECT_CTRL: Protection control frame type for CCK TX
+ *               0:none, 1:RTS/CTS, 2:CTS-to-self
+ * PROTECT_NAV: TXOP protection type for CCK TX
+ *              0:none, 1:ShortNAVprotect, 2:LongNAVProtect
+ * TX_OP_ALLOW_CCK: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_OFDM: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_MM20: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_MM40: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_GF20: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_GF40: CCK TXOP allowance, 0:disallow
+ * RTS_TH_EN: RTS threshold enable on CCK TX
+ */
+#define CCK_PROT_CFG                    0x1364
+#define CCK_PROT_CFG_PROTECT_RATE       FIELD32(0x0000ffff)
+#define CCK_PROT_CFG_PROTECT_CTRL       FIELD32(0x00030000)
+#define CCK_PROT_CFG_PROTECT_NAV        FIELD32(0x000c0000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_CCK    FIELD32(0x00100000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_OFDM   FIELD32(0x00200000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_MM20   FIELD32(0x00400000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_MM40   FIELD32(0x00800000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_GF20   FIELD32(0x01000000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_GF40   FIELD32(0x02000000)
+#define CCK_PROT_CFG_RTS_TH_EN          FIELD32(0x04000000)
+
+/*
+ * OFDM_PROT_CFG: OFDM Protection
+ */
+#define OFDM_PROT_CFG                   0x1368
+#define OFDM_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define OFDM_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define OFDM_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define OFDM_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * MM20_PROT_CFG: MM20 Protection
+ */
+#define MM20_PROT_CFG                   0x136c
+#define MM20_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define MM20_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define MM20_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define MM20_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * MM40_PROT_CFG: MM40 Protection
+ */
+#define MM40_PROT_CFG                   0x1370
+#define MM40_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define MM40_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define MM40_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define MM40_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * GF20_PROT_CFG: GF20 Protection
+ */
+#define GF20_PROT_CFG                   0x1374
+#define GF20_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define GF20_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define GF20_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define GF20_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * GF40_PROT_CFG: GF40 Protection
+ */
+#define GF40_PROT_CFG                   0x1378
+#define GF40_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define GF40_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define GF40_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define GF40_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * EXP_CTS_TIME:
+ */
+#define EXP_CTS_TIME                    0x137c
+
+/*
+ * EXP_ACK_TIME:
+ */
+#define EXP_ACK_TIME                    0x1380
+
+/*
+ * RX_FILTER_CFG: RX configuration register.
+ */
+#define RX_FILTER_CFG                   0x1400
+#define RX_FILTER_CFG_DROP_CRC_ERROR    FIELD32(0x00000001)
+#define RX_FILTER_CFG_DROP_PHY_ERROR    FIELD32(0x00000002)
+#define RX_FILTER_CFG_DROP_NOT_TO_ME    FIELD32(0x00000004)
+#define RX_FILTER_CFG_DROP_NOT_MY_BSSD  FIELD32(0x00000008)
+#define RX_FILTER_CFG_DROP_VER_ERROR    FIELD32(0x00000010)
+#define RX_FILTER_CFG_DROP_MULTICAST    FIELD32(0x00000020)
+#define RX_FILTER_CFG_DROP_BROADCAST    FIELD32(0x00000040)
+#define RX_FILTER_CFG_DROP_DUPLICATE    FIELD32(0x00000080)
+#define RX_FILTER_CFG_DROP_CF_END_ACK   FIELD32(0x00000100)
+#define RX_FILTER_CFG_DROP_CF_END       FIELD32(0x00000200)
+#define RX_FILTER_CFG_DROP_ACK          FIELD32(0x00000400)
+#define RX_FILTER_CFG_DROP_CTS          FIELD32(0x00000800)
+#define RX_FILTER_CFG_DROP_RTS          FIELD32(0x00001000)
+#define RX_FILTER_CFG_DROP_PSPOLL       FIELD32(0x00002000)
+#define RX_FILTER_CFG_DROP_BA           FIELD32(0x00004000)
+#define RX_FILTER_CFG_DROP_BAR          FIELD32(0x00008000)
+#define RX_FILTER_CFG_DROP_CNTL         FIELD32(0x00010000)
+
+/*
+ * AUTO_RSP_CFG:
+ * AUTORESPONDER: 0: disable, 1: enable
+ * BAC_ACK_POLICY: 0:long, 1:short preamble
+ * CTS_40_MMODE: Response CTS 40MHz duplicate mode
+ * CTS_40_MREF: Response CTS 40MHz duplicate mode
+ * AR_PREAMBLE: Auto responder preamble 0:long, 1:short preamble
+ * DUAL_CTS_EN: Power bit value in control frame
+ * ACK_CTS_PSM_BIT:Power bit value in control frame
+ */
+#define AUTO_RSP_CFG                    0x1404
+#define AUTO_RSP_CFG_AUTORESPONDER      FIELD32(0x00000001)
+#define AUTO_RSP_CFG_BAC_ACK_POLICY     FIELD32(0x00000002)
+#define AUTO_RSP_CFG_CTS_40_MMODE       FIELD32(0x00000004)
+#define AUTO_RSP_CFG_CTS_40_MREF        FIELD32(0x00000008)
+#define AUTO_RSP_CFG_AR_PREAMBLE        FIELD32(0x00000010)
+#define AUTO_RSP_CFG_DUAL_CTS_EN        FIELD32(0x00000040)
+#define AUTO_RSP_CFG_ACK_CTS_PSM_BIT    FIELD32(0x00000080)
+
+/*
+ * LEGACY_BASIC_RATE:
+ */
+#define LEGACY_BASIC_RATE               0x1408
+
+/*
+ * HT_BASIC_RATE:
+ */
+#define HT_BASIC_RATE                   0x140c
+
+/*
+ * HT_CTRL_CFG:
+ */
+#define HT_CTRL_CFG                     0x1410
+
+/*
+ * SIFS_COST_CFG:
+ */
+#define SIFS_COST_CFG                   0x1414
+
+/*
+ * RX_PARSER_CFG:
+ * Set NAV for all received frames
+ */
+#define RX_PARSER_CFG                   0x1418
+
+/*
+ * TX_SEC_CNT0:
+ */
+#define TX_SEC_CNT0                     0x1500
+
+/*
+ * RX_SEC_CNT0:
+ */
+#define RX_SEC_CNT0                     0x1504
+
+/*
+ * CCMP_FC_MUTE:
+ */
+#define CCMP_FC_MUTE                    0x1508
+
+/*
+ * TXOP_HLDR_ADDR0:
+ */
+#define TXOP_HLDR_ADDR0                 0x1600
+
+/*
+ * TXOP_HLDR_ADDR1:
+ */
+#define TXOP_HLDR_ADDR1                 0x1604
+
+/*
+ * TXOP_HLDR_ET:
+ */
+#define TXOP_HLDR_ET                    0x1608
+
+/*
+ * QOS_CFPOLL_RA_DW0:
+ */
+#define QOS_CFPOLL_RA_DW0               0x160c
+
+/*
+ * QOS_CFPOLL_RA_DW1:
+ */
+#define QOS_CFPOLL_RA_DW1               0x1610
+
+/*
+ * QOS_CFPOLL_QC:
+ */
+#define QOS_CFPOLL_QC                   0x1614
+
+/*
+ * RX_STA_CNT0: RX PLCP error count & RX CRC error count
+ */
+#define RX_STA_CNT0                     0x1700
+#define RX_STA_CNT0_CRC_ERR             FIELD32(0x0000ffff)
+#define RX_STA_CNT0_PHY_ERR             FIELD32(0xffff0000)
+
+/*
+ * RX_STA_CNT1: RX False CCA count & RX LONG frame count
+ */
+#define RX_STA_CNT1                     0x1704
+#define RX_STA_CNT1_FALSE_CCA           FIELD32(0x0000ffff)
+#define RX_STA_CNT1_PLCP_ERR            FIELD32(0xffff0000)
+
+/*
+ * RX_STA_CNT2:
+ */
+#define RX_STA_CNT2                     0x1708
+#define RX_STA_CNT2_RX_DUPLI_COUNT      FIELD32(0x0000ffff)
+#define RX_STA_CNT2_RX_FIFO_OVERFLOW    FIELD32(0xffff0000)
+
+/*
+ * TX_STA_CNT0: TX Beacon count
+ */
+#define TX_STA_CNT0                     0x170c
+#define TX_STA_CNT0_TX_FAIL_COUNT       FIELD32(0x0000ffff)
+#define TX_STA_CNT0_TX_BEACON_COUNT     FIELD32(0xffff0000)
+
+/*
+ * TX_STA_CNT1: TX tx count
+ */
+#define TX_STA_CNT1                     0x1710
+#define TX_STA_CNT1_TX_SUCCESS          FIELD32(0x0000ffff)
+#define TX_STA_CNT1_TX_RETRANSMIT       FIELD32(0xffff0000)
+
+/*
+ * TX_STA_CNT2: TX tx count
+ */
+#define TX_STA_CNT2                     0x1714
+#define TX_STA_CNT2_TX_ZERO_LEN_COUNT   FIELD32(0x0000ffff)
+#define TX_STA_CNT2_TX_UNDER_FLOW_COUNT FIELD32(0xffff0000)
+
+/*
+ * TX_STA_FIFO: TX Result for specific PID status fifo register
+ */
+#define TX_STA_FIFO                     0x1718
+#define TX_STA_FIFO_VALID               FIELD32(0x00000001)
+#define TX_STA_FIFO_PID_TYPE            FIELD32(0x0000001e)
+#define TX_STA_FIFO_TX_SUCCESS          FIELD32(0x00000020)
+#define TX_STA_FIFO_TX_AGGRE            FIELD32(0x00000040)
+#define TX_STA_FIFO_TX_ACK_REQUIRED     FIELD32(0x00000080)
+#define TX_STA_FIFO_WCID                FIELD32(0x0000ff00)
+#define TX_STA_FIFO_SUCCESS_RATE        FIELD32(0xffff0000)
+#define TX_STA_FIFO_MCS                 FIELD32(0x007f0000)
+#define TX_STA_FIFO_PHYMODE             FIELD32(0xc0000000)
+
+/*
+ * TX_AGG_CNT: Debug counter
+ */
+#define TX_AGG_CNT                      0x171c
+#define TX_AGG_CNT_NON_AGG_TX_COUNT     FIELD32(0x0000ffff)
+#define TX_AGG_CNT_AGG_TX_COUNT         FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT0:
+ */
+#define TX_AGG_CNT0                     0x1720
+#define TX_AGG_CNT0_AGG_SIZE_1_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT0_AGG_SIZE_2_COUNT    FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT1:
+ */
+#define TX_AGG_CNT1                     0x1724
+#define TX_AGG_CNT1_AGG_SIZE_3_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT1_AGG_SIZE_4_COUNT    FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT2:
+ */
+#define TX_AGG_CNT2                     0x1728
+#define TX_AGG_CNT2_AGG_SIZE_5_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT2_AGG_SIZE_6_COUNT    FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT3:
+ */
+#define TX_AGG_CNT3                     0x172c
+#define TX_AGG_CNT3_AGG_SIZE_7_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT3_AGG_SIZE_8_COUNT    FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT4:
+ */
+#define TX_AGG_CNT4                     0x1730
+#define TX_AGG_CNT4_AGG_SIZE_9_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT4_AGG_SIZE_10_COUNT   FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT5:
+ */
+#define TX_AGG_CNT5                     0x1734
+#define TX_AGG_CNT5_AGG_SIZE_11_COUNT   FIELD32(0x0000ffff)
+#define TX_AGG_CNT5_AGG_SIZE_12_COUNT   FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT6:
+ */
+#define TX_AGG_CNT6                     0x1738
+#define TX_AGG_CNT6_AGG_SIZE_13_COUNT   FIELD32(0x0000ffff)
+#define TX_AGG_CNT6_AGG_SIZE_14_COUNT   FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT7:
+ */
+#define TX_AGG_CNT7                     0x173c
+#define TX_AGG_CNT7_AGG_SIZE_15_COUNT   FIELD32(0x0000ffff)
+#define TX_AGG_CNT7_AGG_SIZE_16_COUNT   FIELD32(0xffff0000)
+
+/*
+ * MPDU_DENSITY_CNT:
+ * TX_ZERO_DEL: TX zero length delimiter count
+ * RX_ZERO_DEL: RX zero length delimiter count
+ */
+#define MPDU_DENSITY_CNT                0x1740
+#define MPDU_DENSITY_CNT_TX_ZERO_DEL    FIELD32(0x0000ffff)
+#define MPDU_DENSITY_CNT_RX_ZERO_DEL    FIELD32(0xffff0000)
+
+/*
+ * Security key table memory.
+ * MAC_WCID_BASE: 8-bytes (use only 6 bytes) * 256 entry
+ * PAIRWISE_KEY_TABLE_BASE: 32-byte * 256 entry
+ * MAC_IVEIV_TABLE_BASE: 8-byte * 256-entry
+ * MAC_WCID_ATTRIBUTE_BASE: 4-byte * 256-entry
+ * SHARED_KEY_TABLE_BASE: 32-byte * 16-entry
+ * SHARED_KEY_MODE_BASE: 4-byte * 16-entry
+ */
+#define MAC_WCID_BASE                   0x1800
+#define PAIRWISE_KEY_TABLE_BASE         0x4000
+#define MAC_IVEIV_TABLE_BASE            0x6000
+#define MAC_WCID_ATTRIBUTE_BASE         0x6800
+#define SHARED_KEY_TABLE_BASE           0x6c00
+#define SHARED_KEY_MODE_BASE            0x7000
+
+#define MAC_WCID_ENTRY(__idx) \
+        ( MAC_WCID_BASE + ((__idx) * sizeof(struct mac_wcid_entry)) )
+#define PAIRWISE_KEY_ENTRY(__idx) \
+        ( PAIRWISE_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)) )
+#define MAC_IVEIV_ENTRY(__idx) \
+        ( MAC_IVEIV_TABLE_BASE + ((__idx) * sizeof(struct mac_iveiv_entry)) )
+#define MAC_WCID_ATTR_ENTRY(__idx) \
+        ( MAC_WCID_ATTRIBUTE_BASE + ((__idx) * sizeof(u32)) )
+#define SHARED_KEY_ENTRY(__idx) \
+        ( SHARED_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)) )
+#define SHARED_KEY_MODE_ENTRY(__idx) \
+        ( SHARED_KEY_MODE_BASE + ((__idx) * sizeof(u32)) )
+
+struct mac_wcid_entry {
+        u8 mac[6];
+        u8 reserved[2];
+} __attribute__ ((packed));
+
+struct hw_key_entry {
+        u8 key[16];
+        u8 tx_mic[8];
+        u8 rx_mic[8];
+} __attribute__ ((packed));
+
+struct mac_iveiv_entry {
+        u8 iv[8];
+} __attribute__ ((packed));
+
+/*
+ * MAC_WCID_ATTRIBUTE:
+ */
+#define MAC_WCID_ATTRIBUTE_KEYTAB       FIELD32(0x00000001)
+#define MAC_WCID_ATTRIBUTE_CIPHER       FIELD32(0x0000000e)
+#define MAC_WCID_ATTRIBUTE_BSS_IDX      FIELD32(0x00000070)
+#define MAC_WCID_ATTRIBUTE_RX_WIUDF     FIELD32(0x00000380)
+
+/*
+ * SHARED_KEY_MODE:
+ */
+#define SHARED_KEY_MODE_BSS0_KEY0       FIELD32(0x00000007)
+#define SHARED_KEY_MODE_BSS0_KEY1       FIELD32(0x00000070)
+#define SHARED_KEY_MODE_BSS0_KEY2       FIELD32(0x00000700)
+#define SHARED_KEY_MODE_BSS0_KEY3       FIELD32(0x00007000)
+#define SHARED_KEY_MODE_BSS1_KEY0       FIELD32(0x00070000)
+#define SHARED_KEY_MODE_BSS1_KEY1       FIELD32(0x00700000)
+#define SHARED_KEY_MODE_BSS1_KEY2       FIELD32(0x07000000)
+#define SHARED_KEY_MODE_BSS1_KEY3       FIELD32(0x70000000)
+
+/*
+ * HOST-MCU communication
+ */
+
+/*
+ * H2M_MAILBOX_CSR: Host-to-MCU Mailbox.
+ */
+#define H2M_MAILBOX_CSR                 0x7010
+#define H2M_MAILBOX_CSR_ARG0            FIELD32(0x000000ff)
+#define H2M_MAILBOX_CSR_ARG1            FIELD32(0x0000ff00)
+#define H2M_MAILBOX_CSR_CMD_TOKEN       FIELD32(0x00ff0000)
+#define H2M_MAILBOX_CSR_OWNER           FIELD32(0xff000000)
+
+/*
+ * H2M_MAILBOX_CID:
+ */
+#define H2M_MAILBOX_CID                 0x7014
+#define H2M_MAILBOX_CID_CMD0            FIELD32(0x000000ff)
+#define H2M_MAILBOX_CID_CMD1            FIELD32(0x0000ff00)
+#define H2M_MAILBOX_CID_CMD2            FIELD32(0x00ff0000)
+#define H2M_MAILBOX_CID_CMD3            FIELD32(0xff000000)
+
+/*
+ * H2M_MAILBOX_STATUS:
+ */
+#define H2M_MAILBOX_STATUS              0x701c
+
+/*
+ * H2M_INT_SRC:
+ */
+#define H2M_INT_SRC                     0x7024
+
+/*
+ * H2M_BBP_AGENT:
+ */
+#define H2M_BBP_AGENT                   0x7028
+
+/*
+ * MCU_LEDCS: LED control for MCU Mailbox.
+ */
+#define MCU_LEDCS_LED_MODE              FIELD8(0x1f)
+#define MCU_LEDCS_POLARITY              FIELD8(0x01)
+
+/*
+ * HW_CS_CTS_BASE:
+ * Carrier-sense CTS frame base address.
+ * It's where mac stores carrier-sense frame for carrier-sense function.
+ */
+#define HW_CS_CTS_BASE                  0x7700
+
+/*
+ * HW_DFS_CTS_BASE:
+ * DFS CTS frame base address. It's where mac stores CTS frame for DFS.
+ */
+#define HW_DFS_CTS_BASE                 0x7780
+
+/*
+ * TXRX control registers - base address 0x3000
+ */
+
+/*
+ * TXRX_CSR1:
+ * rt2860b  UNKNOWN reg use R/O Reg Addr 0x77d0 first..
+ */
+#define TXRX_CSR1                       0x77d0
+
+/*
+ * HW_DEBUG_SETTING_BASE:
+ * since NULL frame won't be that long (256 byte)
+ * We steal 16 tail bytes to save debugging settings
+ */
+#define HW_DEBUG_SETTING_BASE           0x77f0
+#define HW_DEBUG_SETTING_BASE2          0x7770
+
+/*
+ * HW_BEACON_BASE
+ * In order to support maximum 8 MBSS and its maximum length
+ * is 512 bytes for each beacon
+ * Three section discontinue memory segments will be used.
+ * 1. The original region for BCN 0~3
+ * 2. Extract memory from FCE table for BCN 4~5
+ * 3. Extract memory from Pair-wise key table for BCN 6~7
+ *    It occupied those memory of wcid 238~253 for BCN 6
+ *    and wcid 222~237 for BCN 7
+ *
+ * IMPORTANT NOTE: Not sure why legacy driver does this,
+ * but HW_BEACON_BASE7 is 0x0200 bytes below HW_BEACON_BASE6.
+ */
+#define HW_BEACON_BASE0                 0x7800
+#define HW_BEACON_BASE1                 0x7a00
+#define HW_BEACON_BASE2                 0x7c00
+#define HW_BEACON_BASE3                 0x7e00
+#define HW_BEACON_BASE4                 0x7200
+#define HW_BEACON_BASE5                 0x7400
+#define HW_BEACON_BASE6                 0x5dc0
+#define HW_BEACON_BASE7                 0x5bc0
+
+#define HW_BEACON_OFFSET(__index) \
+        ( ((__index) < 4) ? ( HW_BEACON_BASE0 + (__index * 0x0200) ) : \
+          (((__index) < 6) ? ( HW_BEACON_BASE4 + ((__index - 4) * 0x0200) ) : \
+          (HW_BEACON_BASE6 - ((__index - 6) * 0x0200))) )
+
+/*
+ * BBP registers.
+ * The wordsize of the BBP is 8 bits.
+ */
+
+/*
+ * BBP 1: TX Antenna
+ */
+#define BBP1_TX_POWER                   FIELD8(0x07)
+#define BBP1_TX_ANTENNA                 FIELD8(0x18)
+
+/*
+ * BBP 3: RX Antenna
+ */
+#define BBP3_RX_ANTENNA                 FIELD8(0x18)
+#define BBP3_HT40_PLUS                  FIELD8(0x20)
+
+/*
+ * BBP 4: Bandwidth
+ */
+#define BBP4_TX_BF                      FIELD8(0x01)
+#define BBP4_BANDWIDTH                  FIELD8(0x18)
+
+/*
+ * RFCSR registers
+ * The wordsize of the RFCSR is 8 bits.
+ */
+
+/*
+ * RFCSR 6:
+ */
+#define RFCSR6_R                        FIELD8(0x03)
+
+/*
+ * RFCSR 7:
+ */
+#define RFCSR7_RF_TUNING                FIELD8(0x01)
+
+/*
+ * RFCSR 12:
+ */
+#define RFCSR12_TX_POWER                FIELD8(0x1f)
+
+/*
+ * RFCSR 22:
+ */
+#define RFCSR22_BASEBAND_LOOPBACK       FIELD8(0x01)
+
+/*
+ * RFCSR 23:
+ */
+#define RFCSR23_FREQ_OFFSET             FIELD8(0x7f)
+
+/*
+ * RFCSR 30:
+ */
+#define RFCSR30_RF_CALIBRATION          FIELD8(0x80)
+
+/*
+ * RF registers
+ */
+
+/*
+ * RF 2
+ */
+#define RF2_ANTENNA_RX2                 FIELD32(0x00000040)
+#define RF2_ANTENNA_TX1                 FIELD32(0x00004000)
+#define RF2_ANTENNA_RX1                 FIELD32(0x00020000)
+
+/*
+ * RF 3
+ */
+#define RF3_TXPOWER_G                   FIELD32(0x00003e00)
+#define RF3_TXPOWER_A_7DBM_BOOST        FIELD32(0x00000200)
+#define RF3_TXPOWER_A                   FIELD32(0x00003c00)
+
+/*
+ * RF 4
+ */
+#define RF4_TXPOWER_G                   FIELD32(0x000007c0)
+#define RF4_TXPOWER_A_7DBM_BOOST        FIELD32(0x00000040)
+#define RF4_TXPOWER_A                   FIELD32(0x00000780)
+#define RF4_FREQ_OFFSET                 FIELD32(0x001f8000)
+#define RF4_HT40                        FIELD32(0x00200000)
+
+/*
+ * EEPROM content.
+ * The wordsize of the EEPROM is 16 bits.
+ */
+
+/*
+ * EEPROM Version
+ */
+#define EEPROM_VERSION                  0x0001
+#define EEPROM_VERSION_FAE              FIELD16(0x00ff)
+#define EEPROM_VERSION_VERSION          FIELD16(0xff00)
+
+/*
+ * HW MAC address.
+ */
+#define EEPROM_MAC_ADDR_0               0x0002
+#define EEPROM_MAC_ADDR_BYTE0           FIELD16(0x00ff)
+#define EEPROM_MAC_ADDR_BYTE1           FIELD16(0xff00)
+#define EEPROM_MAC_ADDR_1               0x0003
+#define EEPROM_MAC_ADDR_BYTE2           FIELD16(0x00ff)
+#define EEPROM_MAC_ADDR_BYTE3           FIELD16(0xff00)
+#define EEPROM_MAC_ADDR_2               0x0004
+#define EEPROM_MAC_ADDR_BYTE4           FIELD16(0x00ff)
+#define EEPROM_MAC_ADDR_BYTE5           FIELD16(0xff00)
+
+/*
+ * EEPROM ANTENNA config
+ * RXPATH: 1: 1R, 2: 2R, 3: 3R
+ * TXPATH: 1: 1T, 2: 2T
+ */
+#define EEPROM_ANTENNA                  0x001a
+#define EEPROM_ANTENNA_RXPATH           FIELD16(0x000f)
+#define EEPROM_ANTENNA_TXPATH           FIELD16(0x00f0)
+#define EEPROM_ANTENNA_RF_TYPE          FIELD16(0x0f00)
+
+/*
+ * EEPROM NIC config
+ * CARDBUS_ACCEL: 0 - enable, 1 - disable
+ */
+#define EEPROM_NIC                      0x001b
+#define EEPROM_NIC_HW_RADIO             FIELD16(0x0001)
+#define EEPROM_NIC_DYNAMIC_TX_AGC       FIELD16(0x0002)
+#define EEPROM_NIC_EXTERNAL_LNA_BG      FIELD16(0x0004)
+#define EEPROM_NIC_EXTERNAL_LNA_A       FIELD16(0x0008)
+#define EEPROM_NIC_CARDBUS_ACCEL        FIELD16(0x0010)
+#define EEPROM_NIC_BW40M_SB_BG          FIELD16(0x0020)
+#define EEPROM_NIC_BW40M_SB_A           FIELD16(0x0040)
+#define EEPROM_NIC_WPS_PBC              FIELD16(0x0080)
+#define EEPROM_NIC_BW40M_BG             FIELD16(0x0100)
+#define EEPROM_NIC_BW40M_A              FIELD16(0x0200)
+
+/*
+ * EEPROM frequency
+ */
+#define EEPROM_FREQ                     0x001d
+#define EEPROM_FREQ_OFFSET              FIELD16(0x00ff)
+#define EEPROM_FREQ_LED_MODE            FIELD16(0x7f00)
+#define EEPROM_FREQ_LED_POLARITY        FIELD16(0x1000)
+
+/*
+ * EEPROM LED
+ * POLARITY_RDY_G: Polarity RDY_G setting.
+ * POLARITY_RDY_A: Polarity RDY_A setting.
+ * POLARITY_ACT: Polarity ACT setting.
+ * POLARITY_GPIO_0: Polarity GPIO0 setting.
+ * POLARITY_GPIO_1: Polarity GPIO1 setting.
+ * POLARITY_GPIO_2: Polarity GPIO2 setting.
+ * POLARITY_GPIO_3: Polarity GPIO3 setting.
+ * POLARITY_GPIO_4: Polarity GPIO4 setting.
+ * LED_MODE: Led mode.
+ */
+#define EEPROM_LED1                     0x001e
+#define EEPROM_LED2                     0x001f
+#define EEPROM_LED3                     0x0020
+#define EEPROM_LED_POLARITY_RDY_BG      FIELD16(0x0001)
+#define EEPROM_LED_POLARITY_RDY_A       FIELD16(0x0002)
+#define EEPROM_LED_POLARITY_ACT         FIELD16(0x0004)
+#define EEPROM_LED_POLARITY_GPIO_0      FIELD16(0x0008)
+#define EEPROM_LED_POLARITY_GPIO_1      FIELD16(0x0010)
+#define EEPROM_LED_POLARITY_GPIO_2      FIELD16(0x0020)
+#define EEPROM_LED_POLARITY_GPIO_3      FIELD16(0x0040)
+#define EEPROM_LED_POLARITY_GPIO_4      FIELD16(0x0080)
+#define EEPROM_LED_LED_MODE             FIELD16(0x1f00)
+
+/*
+ * EEPROM LNA
+ */
+#define EEPROM_LNA                      0x0022
+#define EEPROM_LNA_BG                   FIELD16(0x00ff)
+#define EEPROM_LNA_A0                   FIELD16(0xff00)
+
+/*
+ * EEPROM RSSI BG offset
+ */
+#define EEPROM_RSSI_BG                  0x0023
+#define EEPROM_RSSI_BG_OFFSET0          FIELD16(0x00ff)
+#define EEPROM_RSSI_BG_OFFSET1          FIELD16(0xff00)
+
+/*
+ * EEPROM RSSI BG2 offset
+ */
+#define EEPROM_RSSI_BG2                 0x0024
+#define EEPROM_RSSI_BG2_OFFSET2         FIELD16(0x00ff)
+#define EEPROM_RSSI_BG2_LNA_A1          FIELD16(0xff00)
+
+/*
+ * EEPROM RSSI A offset
+ */
+#define EEPROM_RSSI_A                   0x0025
+#define EEPROM_RSSI_A_OFFSET0           FIELD16(0x00ff)
+#define EEPROM_RSSI_A_OFFSET1           FIELD16(0xff00)
+
+/*
+ * EEPROM RSSI A2 offset
+ */
+#define EEPROM_RSSI_A2                  0x0026
+#define EEPROM_RSSI_A2_OFFSET2          FIELD16(0x00ff)
+#define EEPROM_RSSI_A2_LNA_A2           FIELD16(0xff00)
+
+/*
+ * EEPROM TXpower delta: 20MHZ AND 40 MHZ use different power.
+ *      This is delta in 40MHZ.
+ * VALUE: Tx Power dalta value (MAX=4)
+ * TYPE: 1: Plus the delta value, 0: minus the delta value
+ * TXPOWER: Enable:
+ */
+#define EEPROM_TXPOWER_DELTA            0x0028
+#define EEPROM_TXPOWER_DELTA_VALUE      FIELD16(0x003f)
+#define EEPROM_TXPOWER_DELTA_TYPE       FIELD16(0x0040)
+#define EEPROM_TXPOWER_DELTA_TXPOWER    FIELD16(0x0080)
+
+/*
+ * EEPROM TXPOWER 802.11BG
+ */
+#define EEPROM_TXPOWER_BG1              0x0029
+#define EEPROM_TXPOWER_BG2              0x0030
+#define EEPROM_TXPOWER_BG_SIZE          7
+#define EEPROM_TXPOWER_BG_1             FIELD16(0x00ff)
+#define EEPROM_TXPOWER_BG_2             FIELD16(0xff00)
+
+/*
+ * EEPROM TXPOWER 802.11A
+ */
+#define EEPROM_TXPOWER_A1               0x003c
+#define EEPROM_TXPOWER_A2               0x0053
+#define EEPROM_TXPOWER_A_SIZE           6
+#define EEPROM_TXPOWER_A_1              FIELD16(0x00ff)
+#define EEPROM_TXPOWER_A_2              FIELD16(0xff00)
+
+/*
+ * EEPROM TXpower byrate: 20MHZ power
+ */
+#define EEPROM_TXPOWER_BYRATE           0x006f
+
+/*
+ * EEPROM BBP.
+ */
+#define EEPROM_BBP_START                0x0078
+#define EEPROM_BBP_SIZE                 16
+#define EEPROM_BBP_VALUE                FIELD16(0x00ff)
+#define EEPROM_BBP_REG_ID               FIELD16(0xff00)
+
+/*
+ * MCU mailbox commands.
+ */
+#define MCU_SLEEP                       0x30
+#define MCU_WAKEUP                      0x31
+#define MCU_RADIO_OFF                   0x35
+#define MCU_CURRENT                     0x36
+#define MCU_LED                         0x50
+#define MCU_LED_STRENGTH                0x51
+#define MCU_LED_1                       0x52
+#define MCU_LED_2                       0x53
+#define MCU_LED_3                       0x54
+#define MCU_RADAR                       0x60
+#define MCU_BOOT_SIGNAL                 0x72
+#define MCU_BBP_SIGNAL                  0x80
+#define MCU_POWER_SAVE                  0x83
+
+/*
+ * MCU mailbox tokens
+ */
+#define TOKEN_WAKUP                     3
+
+/*
+ * DMA descriptor defines.
+ */
+#define TXWI_DESC_SIZE                  ( 4 * sizeof(__le32) )
+#define RXWI_DESC_SIZE                  ( 4 * sizeof(__le32) )
+
+/*
+ * TX WI structure
+ */
+
+/*
+ * Word0
+ * FRAG: 1 To inform TKIP engine this is a fragment.
+ * MIMO_PS: The remote peer is in dynamic MIMO-PS mode
+ * TX_OP: 0:HT TXOP rule , 1:PIFS TX ,2:Backoff, 3:sifs
+ * BW: Channel bandwidth 20MHz or 40 MHz
+ * STBC: 1: STBC support MCS =0-7, 2,3 : RESERVED
+ */
+#define TXWI_W0_FRAG                    FIELD32(0x00000001)
+#define TXWI_W0_MIMO_PS                 FIELD32(0x00000002)
+#define TXWI_W0_CF_ACK                  FIELD32(0x00000004)
+#define TXWI_W0_TS                      FIELD32(0x00000008)
+#define TXWI_W0_AMPDU                   FIELD32(0x00000010)
+#define TXWI_W0_MPDU_DENSITY            FIELD32(0x000000e0)
+#define TXWI_W0_TX_OP                   FIELD32(0x00000300)
+#define TXWI_W0_MCS                     FIELD32(0x007f0000)
+#define TXWI_W0_BW                      FIELD32(0x00800000)
+#define TXWI_W0_SHORT_GI                FIELD32(0x01000000)
+#define TXWI_W0_STBC                    FIELD32(0x06000000)
+#define TXWI_W0_IFS                     FIELD32(0x08000000)
+#define TXWI_W0_PHYMODE                 FIELD32(0xc0000000)
+
+/*
+ * Word1
+ */
+#define TXWI_W1_ACK                     FIELD32(0x00000001)
+#define TXWI_W1_NSEQ                    FIELD32(0x00000002)
+#define TXWI_W1_BW_WIN_SIZE             FIELD32(0x000000fc)
+#define TXWI_W1_WIRELESS_CLI_ID         FIELD32(0x0000ff00)
+#define TXWI_W1_MPDU_TOTAL_BYTE_COUNT   FIELD32(0x0fff0000)
+#define TXWI_W1_PACKETID                FIELD32(0xf0000000)
+
+/*
+ * Word2
+ */
+#define TXWI_W2_IV                      FIELD32(0xffffffff)
+
+/*
+ * Word3
+ */
+#define TXWI_W3_EIV                     FIELD32(0xffffffff)
+
+/*
+ * RX WI structure
+ */
+
+/*
+ * Word0
+ */
+#define RXWI_W0_WIRELESS_CLI_ID         FIELD32(0x000000ff)
+#define RXWI_W0_KEY_INDEX               FIELD32(0x00000300)
+#define RXWI_W0_BSSID                   FIELD32(0x00001c00)
+#define RXWI_W0_UDF                     FIELD32(0x0000e000)
+#define RXWI_W0_MPDU_TOTAL_BYTE_COUNT   FIELD32(0x0fff0000)
+#define RXWI_W0_TID                     FIELD32(0xf0000000)
+
+/*
+ * Word1
+ */
+#define RXWI_W1_FRAG                    FIELD32(0x0000000f)
+#define RXWI_W1_SEQUENCE                FIELD32(0x0000fff0)
+#define RXWI_W1_MCS                     FIELD32(0x007f0000)
+#define RXWI_W1_BW                      FIELD32(0x00800000)
+#define RXWI_W1_SHORT_GI                FIELD32(0x01000000)
+#define RXWI_W1_STBC                    FIELD32(0x06000000)
+#define RXWI_W1_PHYMODE                 FIELD32(0xc0000000)
+
+/*
+ * Word2
+ */
+#define RXWI_W2_RSSI0                   FIELD32(0x000000ff)
+#define RXWI_W2_RSSI1                   FIELD32(0x0000ff00)
+#define RXWI_W2_RSSI2                   FIELD32(0x00ff0000)
+
+/*
+ * Word3
+ */
+#define RXWI_W3_SNR0                    FIELD32(0x000000ff)
+#define RXWI_W3_SNR1                    FIELD32(0x0000ff00)
+
+/*
+ * Macros for converting txpower from EEPROM to mac80211 value
+ * and from mac80211 value to register value.
+ */
+#define MIN_G_TXPOWER   0
+#define MIN_A_TXPOWER   -7
+#define MAX_G_TXPOWER   31
+#define MAX_A_TXPOWER   15
+#define DEFAULT_TXPOWER 5
+
+#define TXPOWER_G_FROM_DEV(__txpower) \
+        ((__txpower) > MAX_G_TXPOWER) ? DEFAULT_TXPOWER : (__txpower)
+
+#define TXPOWER_G_TO_DEV(__txpower) \
+        clamp_t(char, __txpower, MIN_G_TXPOWER, MAX_G_TXPOWER)
+
+#define TXPOWER_A_FROM_DEV(__txpower) \
+        ((__txpower) > MAX_A_TXPOWER) ? DEFAULT_TXPOWER : (__txpower)
+
+#define TXPOWER_A_TO_DEV(__txpower) \
+        clamp_t(char, __txpower, MIN_A_TXPOWER, MAX_A_TXPOWER)
+
+#endif /* RT2800_H */
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
new file mode 100644
index 000000000000..c015ce9fdd09
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -0,0 +1,2325 @@
+/*
+        Copyright (C) 2009 Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+        Copyright (C) 2009 Gertjan van Wingerde <gwingerde@gmail.com>
+
+        Based on the original rt2800pci.c and rt2800usb.c.
+          Copyright (C) 2009 Ivo van Doorn <IvDoorn@gmail.com>
+          Copyright (C) 2009 Alban Browaeys <prahal@yahoo.com>
+          Copyright (C) 2009 Felix Fietkau <nbd@openwrt.org>
+          Copyright (C) 2009 Luis Correia <luis.f.correia@gmail.com>
+          Copyright (C) 2009 Mattias Nissler <mattias.nissler@gmx.de>
+          Copyright (C) 2009 Mark Asselstine <asselsm@gmail.com>
+          Copyright (C) 2009 Xose Vazquez Perez <xose.vazquez@gmail.com>
+          <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2800lib
+        Abstract: rt2800 generic device routines.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+
+#include "rt2x00.h"
+#if defined(CONFIG_RT2X00_LIB_USB) || defined(CONFIG_RT2X00_LIB_USB_MODULE)
+#include "rt2x00usb.h"
+#endif
+#if defined(CONFIG_RT2X00_LIB_PCI) || defined(CONFIG_RT2X00_LIB_PCI_MODULE)
+#include "rt2x00pci.h"
+#endif
+#include "rt2800lib.h"
+#include "rt2800.h"
+#include "rt2800usb.h"
+
+MODULE_AUTHOR("Bartlomiej Zolnierkiewicz");
+MODULE_DESCRIPTION("rt2800 library");
+MODULE_LICENSE("GPL");
+
+/*
+ * Register access.
+ * All access to the CSR registers will go through the methods
+ * rt2800_register_read and rt2800_register_write.
+ * BBP and RF register require indirect register access,
+ * and use the CSR registers BBPCSR and RFCSR to achieve this.
+ * These indirect registers work with busy bits,
+ * and we will try maximal REGISTER_BUSY_COUNT times to access
+ * the register while taking a REGISTER_BUSY_DELAY us delay
+ * between each attampt. When the busy bit is still set at that time,
+ * the access attempt is considered to have failed,
+ * and we will print an error.
+ * The _lock versions must be used if you already hold the csr_mutex
+ */
+#define WAIT_FOR_BBP(__dev, __reg) \
+        rt2800_regbusy_read((__dev), BBP_CSR_CFG, BBP_CSR_CFG_BUSY, (__reg))
+#define WAIT_FOR_RFCSR(__dev, __reg) \
+        rt2800_regbusy_read((__dev), RF_CSR_CFG, RF_CSR_CFG_BUSY, (__reg))
+#define WAIT_FOR_RF(__dev, __reg) \
+        rt2800_regbusy_read((__dev), RF_CSR_CFG0, RF_CSR_CFG0_BUSY, (__reg))
+#define WAIT_FOR_MCU(__dev, __reg) \
+        rt2800_regbusy_read((__dev), H2M_MAILBOX_CSR, \
+                            H2M_MAILBOX_CSR_OWNER, (__reg))
+
+static void rt2800_bbp_write(struct rt2x00_dev *rt2x00dev,
+                             const unsigned int word, const u8 value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the BBP becomes available, afterwards we
+         * can safely write the new data into the register.
+         */
+        if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_VALUE, value);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_REGNUM, word);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_BUSY, 1);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_READ_CONTROL, 0);
+                if (rt2x00_is_pci(rt2x00dev) || rt2x00_is_soc(rt2x00dev))
+                        rt2x00_set_field32(&reg, BBP_CSR_CFG_BBP_RW_MODE, 1);
+
+                rt2800_register_write_lock(rt2x00dev, BBP_CSR_CFG, reg);
+        }
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800_bbp_read(struct rt2x00_dev *rt2x00dev,
+                            const unsigned int word, u8 *value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the BBP becomes available, afterwards we
+         * can safely write the read request into the register.
+         * After the data has been written, we wait until hardware
+         * returns the correct value, if at any time the register
+         * doesn't become available in time, reg will be 0xffffffff
+         * which means we return 0xff to the caller.
+         */
+        if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_REGNUM, word);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_BUSY, 1);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_READ_CONTROL, 1);
+                if (rt2x00_is_pci(rt2x00dev) || rt2x00_is_soc(rt2x00dev))
+                        rt2x00_set_field32(&reg, BBP_CSR_CFG_BBP_RW_MODE, 1);
+
+                rt2800_register_write_lock(rt2x00dev, BBP_CSR_CFG, reg);
+
+                WAIT_FOR_BBP(rt2x00dev, &reg);
+        }
+
+        *value = rt2x00_get_field32(reg, BBP_CSR_CFG_VALUE);
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800_rfcsr_write(struct rt2x00_dev *rt2x00dev,
+                               const unsigned int word, const u8 value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the RFCSR becomes available, afterwards we
+         * can safely write the new data into the register.
+         */
+        if (WAIT_FOR_RFCSR(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, RF_CSR_CFG_DATA, value);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_REGNUM, word);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_WRITE, 1);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_BUSY, 1);
+
+                rt2800_register_write_lock(rt2x00dev, RF_CSR_CFG, reg);
+        }
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800_rfcsr_read(struct rt2x00_dev *rt2x00dev,
+                              const unsigned int word, u8 *value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the RFCSR becomes available, afterwards we
+         * can safely write the read request into the register.
+         * After the data has been written, we wait until hardware
+         * returns the correct value, if at any time the register
+         * doesn't become available in time, reg will be 0xffffffff
+         * which means we return 0xff to the caller.
+         */
+        if (WAIT_FOR_RFCSR(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, RF_CSR_CFG_REGNUM, word);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_WRITE, 0);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_BUSY, 1);
+
+                rt2800_register_write_lock(rt2x00dev, RF_CSR_CFG, reg);
+
+                WAIT_FOR_RFCSR(rt2x00dev, &reg);
+        }
+
+        *value = rt2x00_get_field32(reg, RF_CSR_CFG_DATA);
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800_rf_write(struct rt2x00_dev *rt2x00dev,
+                            const unsigned int word, const u32 value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the RF becomes available, afterwards we
+         * can safely write the new data into the register.
+         */
+        if (WAIT_FOR_RF(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, RF_CSR_CFG0_REG_VALUE_BW, value);
+                rt2x00_set_field32(&reg, RF_CSR_CFG0_STANDBYMODE, 0);
+                rt2x00_set_field32(&reg, RF_CSR_CFG0_SEL, 0);
+                rt2x00_set_field32(&reg, RF_CSR_CFG0_BUSY, 1);
+
+                rt2800_register_write_lock(rt2x00dev, RF_CSR_CFG0, reg);
+                rt2x00_rf_write(rt2x00dev, word, value);
+        }
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+void rt2800_mcu_request(struct rt2x00_dev *rt2x00dev,
+                        const u8 command, const u8 token,
+                        const u8 arg0, const u8 arg1)
+{
+        u32 reg;
+
+        /*
+         * SOC devices don't support MCU requests.
+         */
+        if (rt2x00_is_soc(rt2x00dev))
+                return;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the MCU becomes available, afterwards we
+         * can safely write the new data into the register.
+         */
+        if (WAIT_FOR_MCU(rt2x00dev, &reg)) {
+                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_OWNER, 1);
+                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_CMD_TOKEN, token);
+                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG0, arg0);
+                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG1, arg1);
+                rt2800_register_write_lock(rt2x00dev, H2M_MAILBOX_CSR, reg);
+
+                reg = 0;
+                rt2x00_set_field32(&reg, HOST_CMD_CSR_HOST_COMMAND, command);
+                rt2800_register_write_lock(rt2x00dev, HOST_CMD_CSR, reg);
+        }
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+EXPORT_SYMBOL_GPL(rt2800_mcu_request);
+
+int rt2800_wait_wpdma_ready(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u32 reg;
+
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+                if (!rt2x00_get_field32(reg, WPDMA_GLO_CFG_TX_DMA_BUSY) &&
+                    !rt2x00_get_field32(reg, WPDMA_GLO_CFG_RX_DMA_BUSY))
+                        return 0;
+
+                msleep(1);
+        }
+
+        ERROR(rt2x00dev, "WPDMA TX/RX busy, aborting.\n");
+        return -EACCES;
+}
+EXPORT_SYMBOL_GPL(rt2800_wait_wpdma_ready);
+
+#ifdef CONFIG_RT2X00_LIB_DEBUGFS
+const struct rt2x00debug rt2800_rt2x00debug = {
+        .owner  = THIS_MODULE,
+        .csr    = {
+                .read           = rt2800_register_read,
+                .write          = rt2800_register_write,
+                .flags          = RT2X00DEBUGFS_OFFSET,
+                .word_base      = CSR_REG_BASE,
+                .word_size      = sizeof(u32),
+                .word_count     = CSR_REG_SIZE / sizeof(u32),
+        },
+        .eeprom = {
+                .read           = rt2x00_eeprom_read,
+                .write          = rt2x00_eeprom_write,
+                .word_base      = EEPROM_BASE,
+                .word_size      = sizeof(u16),
+                .word_count     = EEPROM_SIZE / sizeof(u16),
+        },
+        .bbp    = {
+                .read           = rt2800_bbp_read,
+                .write          = rt2800_bbp_write,
+                .word_base      = BBP_BASE,
+                .word_size      = sizeof(u8),
+                .word_count     = BBP_SIZE / sizeof(u8),
+        },
+        .rf     = {
+                .read           = rt2x00_rf_read,
+                .write          = rt2800_rf_write,
+                .word_base      = RF_BASE,
+                .word_size      = sizeof(u32),
+                .word_count     = RF_SIZE / sizeof(u32),
+        },
+};
+EXPORT_SYMBOL_GPL(rt2800_rt2x00debug);
+#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
+
+int rt2800_rfkill_poll(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+        return rt2x00_get_field32(reg, GPIO_CTRL_CFG_BIT2);
+}
+EXPORT_SYMBOL_GPL(rt2800_rfkill_poll);
+
+#ifdef CONFIG_RT2X00_LIB_LEDS
+static void rt2800_brightness_set(struct led_classdev *led_cdev,
+                                  enum led_brightness brightness)
+{
+        struct rt2x00_led *led =
+            container_of(led_cdev, struct rt2x00_led, led_dev);
+        unsigned int enabled = brightness != LED_OFF;
+        unsigned int bg_mode =
+            (enabled && led->rt2x00dev->curr_band == IEEE80211_BAND_2GHZ);
+        unsigned int polarity =
+                rt2x00_get_field16(led->rt2x00dev->led_mcu_reg,
+                                   EEPROM_FREQ_LED_POLARITY);
+        unsigned int ledmode =
+                rt2x00_get_field16(led->rt2x00dev->led_mcu_reg,
+                                   EEPROM_FREQ_LED_MODE);
+
+        if (led->type == LED_TYPE_RADIO) {
+                rt2800_mcu_request(led->rt2x00dev, MCU_LED, 0xff, ledmode,
+                                      enabled ? 0x20 : 0);
+        } else if (led->type == LED_TYPE_ASSOC) {
+                rt2800_mcu_request(led->rt2x00dev, MCU_LED, 0xff, ledmode,
+                                      enabled ? (bg_mode ? 0x60 : 0xa0) : 0x20);
+        } else if (led->type == LED_TYPE_QUALITY) {
+                /*
+                 * The brightness is divided into 6 levels (0 - 5),
+                 * The specs tell us the following levels:
+                 *      0, 1 ,3, 7, 15, 31
+                 * to determine the level in a simple way we can simply
+                 * work with bitshifting:
+                 *      (1 << level) - 1
+                 */
+                rt2800_mcu_request(led->rt2x00dev, MCU_LED_STRENGTH, 0xff,
+                                      (1 << brightness / (LED_FULL / 6)) - 1,
+                                      polarity);
+        }
+}
+
+static int rt2800_blink_set(struct led_classdev *led_cdev,
+                            unsigned long *delay_on, unsigned long *delay_off)
+{
+        struct rt2x00_led *led =
+            container_of(led_cdev, struct rt2x00_led, led_dev);
+        u32 reg;
+
+        rt2800_register_read(led->rt2x00dev, LED_CFG, &reg);
+        rt2x00_set_field32(&reg, LED_CFG_ON_PERIOD, *delay_on);
+        rt2x00_set_field32(&reg, LED_CFG_OFF_PERIOD, *delay_off);
+        rt2x00_set_field32(&reg, LED_CFG_SLOW_BLINK_PERIOD, 3);
+        rt2x00_set_field32(&reg, LED_CFG_R_LED_MODE, 3);
+        rt2x00_set_field32(&reg, LED_CFG_G_LED_MODE, 3);
+        rt2x00_set_field32(&reg, LED_CFG_Y_LED_MODE, 3);
+        rt2x00_set_field32(&reg, LED_CFG_LED_POLAR, 1);
+        rt2800_register_write(led->rt2x00dev, LED_CFG, reg);
+
+        return 0;
+}
+
+static void rt2800_init_led(struct rt2x00_dev *rt2x00dev,
+                     struct rt2x00_led *led, enum led_type type)
+{
+        led->rt2x00dev = rt2x00dev;
+        led->type = type;
+        led->led_dev.brightness_set = rt2800_brightness_set;
+        led->led_dev.blink_set = rt2800_blink_set;
+        led->flags = LED_INITIALIZED;
+}
+#endif /* CONFIG_RT2X00_LIB_LEDS */
+
+/*
+ * Configuration handlers.
+ */
+static void rt2800_config_wcid_attr(struct rt2x00_dev *rt2x00dev,
+                                    struct rt2x00lib_crypto *crypto,
+                                    struct ieee80211_key_conf *key)
+{
+        struct mac_wcid_entry wcid_entry;
+        struct mac_iveiv_entry iveiv_entry;
+        u32 offset;
+        u32 reg;
+
+        offset = MAC_WCID_ATTR_ENTRY(key->hw_key_idx);
+
+        rt2800_register_read(rt2x00dev, offset, &reg);
+        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_KEYTAB,
+                           !!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE));
+        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_CIPHER,
+                           (crypto->cmd == SET_KEY) * crypto->cipher);
+        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_BSS_IDX,
+                           (crypto->cmd == SET_KEY) * crypto->bssidx);
+        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_RX_WIUDF, crypto->cipher);
+        rt2800_register_write(rt2x00dev, offset, reg);
+
+        offset = MAC_IVEIV_ENTRY(key->hw_key_idx);
+
+        memset(&iveiv_entry, 0, sizeof(iveiv_entry));
+        if ((crypto->cipher == CIPHER_TKIP) ||
+            (crypto->cipher == CIPHER_TKIP_NO_MIC) ||
+            (crypto->cipher == CIPHER_AES))
+                iveiv_entry.iv[3] |= 0x20;
+        iveiv_entry.iv[3] |= key->keyidx << 6;
+        rt2800_register_multiwrite(rt2x00dev, offset,
+                                      &iveiv_entry, sizeof(iveiv_entry));
+
+        offset = MAC_WCID_ENTRY(key->hw_key_idx);
+
+        memset(&wcid_entry, 0, sizeof(wcid_entry));
+        if (crypto->cmd == SET_KEY)
+                memcpy(&wcid_entry, crypto->address, ETH_ALEN);
+        rt2800_register_multiwrite(rt2x00dev, offset,
+                                      &wcid_entry, sizeof(wcid_entry));
+}
+
+int rt2800_config_shared_key(struct rt2x00_dev *rt2x00dev,
+                             struct rt2x00lib_crypto *crypto,
+                             struct ieee80211_key_conf *key)
+{
+        struct hw_key_entry key_entry;
+        struct rt2x00_field32 field;
+        u32 offset;
+        u32 reg;
+
+        if (crypto->cmd == SET_KEY) {
+                key->hw_key_idx = (4 * crypto->bssidx) + key->keyidx;
+
+                memcpy(key_entry.key, crypto->key,
+                       sizeof(key_entry.key));
+                memcpy(key_entry.tx_mic, crypto->tx_mic,
+                       sizeof(key_entry.tx_mic));
+                memcpy(key_entry.rx_mic, crypto->rx_mic,
+                       sizeof(key_entry.rx_mic));
+
+                offset = SHARED_KEY_ENTRY(key->hw_key_idx);
+                rt2800_register_multiwrite(rt2x00dev, offset,
+                                              &key_entry, sizeof(key_entry));
+        }
+
+        /*
+         * The cipher types are stored over multiple registers
+         * starting with SHARED_KEY_MODE_BASE each word will have
+         * 32 bits and contains the cipher types for 2 bssidx each.
+         * Using the correct defines correctly will cause overhead,
+         * so just calculate the correct offset.
+         */
+        field.bit_offset = 4 * (key->hw_key_idx % 8);
+        field.bit_mask = 0x7 << field.bit_offset;
+
+        offset = SHARED_KEY_MODE_ENTRY(key->hw_key_idx / 8);
+
+        rt2800_register_read(rt2x00dev, offset, &reg);
+        rt2x00_set_field32(&reg, field,
+                           (crypto->cmd == SET_KEY) * crypto->cipher);
+        rt2800_register_write(rt2x00dev, offset, reg);
+
+        /*
+         * Update WCID information
+         */
+        rt2800_config_wcid_attr(rt2x00dev, crypto, key);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2800_config_shared_key);
+
+int rt2800_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
+                               struct rt2x00lib_crypto *crypto,
+                               struct ieee80211_key_conf *key)
+{
+        struct hw_key_entry key_entry;
+        u32 offset;
+
+        if (crypto->cmd == SET_KEY) {
+                /*
+                 * 1 pairwise key is possible per AID, this means that the AID
+                 * equals our hw_key_idx. Make sure the WCID starts _after_ the
+                 * last possible shared key entry.
+                 */
+                if (crypto->aid > (256 - 32))
+                        return -ENOSPC;
+
+                key->hw_key_idx = 32 + crypto->aid;
+
+                memcpy(key_entry.key, crypto->key,
+                       sizeof(key_entry.key));
+                memcpy(key_entry.tx_mic, crypto->tx_mic,
+                       sizeof(key_entry.tx_mic));
+                memcpy(key_entry.rx_mic, crypto->rx_mic,
+                       sizeof(key_entry.rx_mic));
+
+                offset = PAIRWISE_KEY_ENTRY(key->hw_key_idx);
+                rt2800_register_multiwrite(rt2x00dev, offset,
+                                              &key_entry, sizeof(key_entry));
+        }
+
+        /*
+         * Update WCID information
+         */
+        rt2800_config_wcid_attr(rt2x00dev, crypto, key);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2800_config_pairwise_key);
+
+void rt2800_config_filter(struct rt2x00_dev *rt2x00dev,
+                          const unsigned int filter_flags)
+{
+        u32 reg;
+
+        /*
+         * Start configuration steps.
+         * Note that the version error will always be dropped
+         * and broadcast frames will always be accepted since
+         * there is no filter for it at this time.
+         */
+        rt2800_register_read(rt2x00dev, RX_FILTER_CFG, &reg);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CRC_ERROR,
+                           !(filter_flags & FIF_FCSFAIL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PHY_ERROR,
+                           !(filter_flags & FIF_PLCPFAIL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_TO_ME,
+                           !(filter_flags & FIF_PROMISC_IN_BSS));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_MY_BSSD, 0);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_VER_ERROR, 1);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_MULTICAST,
+                           !(filter_flags & FIF_ALLMULTI));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BROADCAST, 0);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_DUPLICATE, 1);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CF_END_ACK,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CF_END,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_ACK,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CTS,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_RTS,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PSPOLL,
+                           !(filter_flags & FIF_PSPOLL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BA, 1);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BAR, 0);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CNTL,
+                           !(filter_flags & FIF_CONTROL));
+        rt2800_register_write(rt2x00dev, RX_FILTER_CFG, reg);
+}
+EXPORT_SYMBOL_GPL(rt2800_config_filter);
+
+void rt2800_config_intf(struct rt2x00_dev *rt2x00dev, struct rt2x00_intf *intf,
+                        struct rt2x00intf_conf *conf, const unsigned int flags)
+{
+        unsigned int beacon_base;
+        u32 reg;
+
+        if (flags & CONFIG_UPDATE_TYPE) {
+                /*
+                 * Clear current synchronisation setup.
+                 * For the Beacon base registers we only need to clear
+                 * the first byte since that byte contains the VALID and OWNER
+                 * bits which (when set to 0) will invalidate the entire beacon.
+                 */
+                beacon_base = HW_BEACON_OFFSET(intf->beacon->entry_idx);
+                rt2800_register_write(rt2x00dev, beacon_base, 0);
+
+                /*
+                 * Enable synchronisation.
+                 */
+                rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_SYNC, conf->sync);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE,
+                                   (conf->sync == TSF_SYNC_BEACON));
+                rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+        }
+
+        if (flags & CONFIG_UPDATE_MAC) {
+                reg = le32_to_cpu(conf->mac[1]);
+                rt2x00_set_field32(&reg, MAC_ADDR_DW1_UNICAST_TO_ME_MASK, 0xff);
+                conf->mac[1] = cpu_to_le32(reg);
+
+                rt2800_register_multiwrite(rt2x00dev, MAC_ADDR_DW0,
+                                              conf->mac, sizeof(conf->mac));
+        }
+
+        if (flags & CONFIG_UPDATE_BSSID) {
+                reg = le32_to_cpu(conf->bssid[1]);
+                rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_ID_MASK, 0);
+                rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 0);
+                conf->bssid[1] = cpu_to_le32(reg);
+
+                rt2800_register_multiwrite(rt2x00dev, MAC_BSSID_DW0,
+                                              conf->bssid, sizeof(conf->bssid));
+        }
+}
+EXPORT_SYMBOL_GPL(rt2800_config_intf);
+
+void rt2800_config_erp(struct rt2x00_dev *rt2x00dev, struct rt2x00lib_erp *erp)
+{
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, TX_TIMEOUT_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_TIMEOUT_CFG_RX_ACK_TIMEOUT, 0x20);
+        rt2800_register_write(rt2x00dev, TX_TIMEOUT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, AUTO_RSP_CFG, &reg);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_BAC_ACK_POLICY,
+                           !!erp->short_preamble);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_AR_PREAMBLE,
+                           !!erp->short_preamble);
+        rt2800_register_write(rt2x00dev, AUTO_RSP_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_CTRL,
+                           erp->cts_protection ? 2 : 0);
+        rt2800_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+
+        rt2800_register_write(rt2x00dev, LEGACY_BASIC_RATE,
+                                 erp->basic_rates);
+        rt2800_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
+
+        rt2800_register_read(rt2x00dev, BKOFF_SLOT_CFG, &reg);
+        rt2x00_set_field32(&reg, BKOFF_SLOT_CFG_SLOT_TIME, erp->slot_time);
+        rt2x00_set_field32(&reg, BKOFF_SLOT_CFG_CC_DELAY_TIME, 2);
+        rt2800_register_write(rt2x00dev, BKOFF_SLOT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, XIFS_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_CCKM_SIFS_TIME, erp->sifs);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_OFDM_SIFS_TIME, erp->sifs);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_OFDM_XIFS_TIME, 4);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_EIFS, erp->eifs);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_BB_RXEND_ENABLE, 1);
+        rt2800_register_write(rt2x00dev, XIFS_TIME_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL,
+                           erp->beacon_int * 16);
+        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+}
+EXPORT_SYMBOL_GPL(rt2800_config_erp);
+
+void rt2800_config_ant(struct rt2x00_dev *rt2x00dev, struct antenna_setup *ant)
+{
+        u8 r1;
+        u8 r3;
+
+        rt2800_bbp_read(rt2x00dev, 1, &r1);
+        rt2800_bbp_read(rt2x00dev, 3, &r3);
+
+        /*
+         * Configure the TX antenna.
+         */
+        switch ((int)ant->tx) {
+        case 1:
+                rt2x00_set_field8(&r1, BBP1_TX_ANTENNA, 0);
+                if (rt2x00_is_pci(rt2x00dev) || rt2x00_is_soc(rt2x00dev))
+                        rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 0);
+                break;
+        case 2:
+                rt2x00_set_field8(&r1, BBP1_TX_ANTENNA, 2);
+                break;
+        case 3:
+                /* Do nothing */
+                break;
+        }
+
+        /*
+         * Configure the RX antenna.
+         */
+        switch ((int)ant->rx) {
+        case 1:
+                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 0);
+                break;
+        case 2:
+                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 1);
+                break;
+        case 3:
+                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 2);
+                break;
+        }
+
+        rt2800_bbp_write(rt2x00dev, 3, r3);
+        rt2800_bbp_write(rt2x00dev, 1, r1);
+}
+EXPORT_SYMBOL_GPL(rt2800_config_ant);
+
+static void rt2800_config_lna_gain(struct rt2x00_dev *rt2x00dev,
+                                   struct rt2x00lib_conf *libconf)
+{
+        u16 eeprom;
+        short lna_gain;
+
+        if (libconf->rf.channel <= 14) {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_LNA, &eeprom);
+                lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_BG);
+        } else if (libconf->rf.channel <= 64) {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_LNA, &eeprom);
+                lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_A0);
+        } else if (libconf->rf.channel <= 128) {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2, &eeprom);
+                lna_gain = rt2x00_get_field16(eeprom, EEPROM_RSSI_BG2_LNA_A1);
+        } else {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_A2, &eeprom);
+                lna_gain = rt2x00_get_field16(eeprom, EEPROM_RSSI_A2_LNA_A2);
+        }
+
+        rt2x00dev->lna_gain = lna_gain;
+}
+
+static void rt2800_config_channel_rt2x(struct rt2x00_dev *rt2x00dev,
+                                       struct ieee80211_conf *conf,
+                                       struct rf_channel *rf,
+                                       struct channel_info *info)
+{
+        rt2x00_set_field32(&rf->rf4, RF4_FREQ_OFFSET, rt2x00dev->freq_offset);
+
+        if (rt2x00dev->default_ant.tx == 1)
+                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_TX1, 1);
+
+        if (rt2x00dev->default_ant.rx == 1) {
+                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_RX1, 1);
+                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_RX2, 1);
+        } else if (rt2x00dev->default_ant.rx == 2)
+                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_RX2, 1);
+
+        if (rf->channel > 14) {
+                /*
+                 * When TX power is below 0, we should increase it by 7 to
+                 * make it a positive value (Minumum value is -7).
+                 * However this means that values between 0 and 7 have
+                 * double meaning, and we should set a 7DBm boost flag.
+                 */
+                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A_7DBM_BOOST,
+                                   (info->tx_power1 >= 0));
+
+                if (info->tx_power1 < 0)
+                        info->tx_power1 += 7;
+
+                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A,
+                                   TXPOWER_A_TO_DEV(info->tx_power1));
+
+                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A_7DBM_BOOST,
+                                   (info->tx_power2 >= 0));
+
+                if (info->tx_power2 < 0)
+                        info->tx_power2 += 7;
+
+                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A,
+                                   TXPOWER_A_TO_DEV(info->tx_power2));
+        } else {
+                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_G,
+                                   TXPOWER_G_TO_DEV(info->tx_power1));
+                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_G,
+                                   TXPOWER_G_TO_DEV(info->tx_power2));
+        }
+
+        rt2x00_set_field32(&rf->rf4, RF4_HT40, conf_is_ht40(conf));
+
+        rt2800_rf_write(rt2x00dev, 1, rf->rf1);
+        rt2800_rf_write(rt2x00dev, 2, rf->rf2);
+        rt2800_rf_write(rt2x00dev, 3, rf->rf3 & ~0x00000004);
+        rt2800_rf_write(rt2x00dev, 4, rf->rf4);
+
+        udelay(200);
+
+        rt2800_rf_write(rt2x00dev, 1, rf->rf1);
+        rt2800_rf_write(rt2x00dev, 2, rf->rf2);
+        rt2800_rf_write(rt2x00dev, 3, rf->rf3 | 0x00000004);
+        rt2800_rf_write(rt2x00dev, 4, rf->rf4);
+
+        udelay(200);
+
+        rt2800_rf_write(rt2x00dev, 1, rf->rf1);
+        rt2800_rf_write(rt2x00dev, 2, rf->rf2);
+        rt2800_rf_write(rt2x00dev, 3, rf->rf3 & ~0x00000004);
+        rt2800_rf_write(rt2x00dev, 4, rf->rf4);
+}
+
+static void rt2800_config_channel_rt3x(struct rt2x00_dev *rt2x00dev,
+                                       struct ieee80211_conf *conf,
+                                       struct rf_channel *rf,
+                                       struct channel_info *info)
+{
+        u8 rfcsr;
+
+        rt2800_rfcsr_write(rt2x00dev, 2, rf->rf1);
+        rt2800_rfcsr_write(rt2x00dev, 3, rf->rf3);
+
+        rt2800_rfcsr_read(rt2x00dev, 6, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR6_R, rf->rf2);
+        rt2800_rfcsr_write(rt2x00dev, 6, rfcsr);
+
+        rt2800_rfcsr_read(rt2x00dev, 12, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR12_TX_POWER,
+                          TXPOWER_G_TO_DEV(info->tx_power1));
+        rt2800_rfcsr_write(rt2x00dev, 12, rfcsr);
+
+        rt2800_rfcsr_read(rt2x00dev, 23, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR23_FREQ_OFFSET, rt2x00dev->freq_offset);
+        rt2800_rfcsr_write(rt2x00dev, 23, rfcsr);
+
+        rt2800_rfcsr_write(rt2x00dev, 24,
+                              rt2x00dev->calibration[conf_is_ht40(conf)]);
+
+        rt2800_rfcsr_read(rt2x00dev, 7, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR7_RF_TUNING, 1);
+        rt2800_rfcsr_write(rt2x00dev, 7, rfcsr);
+}
+
+static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
+                                  struct ieee80211_conf *conf,
+                                  struct rf_channel *rf,
+                                  struct channel_info *info)
+{
+        u32 reg;
+        unsigned int tx_pin;
+        u8 bbp;
+
+        if ((rt2x00_rt(rt2x00dev, RT3070) ||
+             rt2x00_rt(rt2x00dev, RT3090)) &&
+            (rt2x00_rf(rt2x00dev, RF2020) ||
+             rt2x00_rf(rt2x00dev, RF3020) ||
+             rt2x00_rf(rt2x00dev, RF3021) ||
+             rt2x00_rf(rt2x00dev, RF3022)))
+                rt2800_config_channel_rt3x(rt2x00dev, conf, rf, info);
+        else
+                rt2800_config_channel_rt2x(rt2x00dev, conf, rf, info);
+
+        /*
+         * Change BBP settings
+         */
+        rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
+        rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+        rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
+        rt2800_bbp_write(rt2x00dev, 86, 0);
+
+        if (rf->channel <= 14) {
+                if (test_bit(CONFIG_EXTERNAL_LNA_BG, &rt2x00dev->flags)) {
+                        rt2800_bbp_write(rt2x00dev, 82, 0x62);
+                        rt2800_bbp_write(rt2x00dev, 75, 0x46);
+                } else {
+                        rt2800_bbp_write(rt2x00dev, 82, 0x84);
+                        rt2800_bbp_write(rt2x00dev, 75, 0x50);
+                }
+        } else {
+                rt2800_bbp_write(rt2x00dev, 82, 0xf2);
+
+                if (test_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags))
+                        rt2800_bbp_write(rt2x00dev, 75, 0x46);
+                else
+                        rt2800_bbp_write(rt2x00dev, 75, 0x50);
+        }
+
+        rt2800_register_read(rt2x00dev, TX_BAND_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_BAND_CFG_HT40_PLUS, conf_is_ht40_plus(conf));
+        rt2x00_set_field32(&reg, TX_BAND_CFG_A, rf->channel > 14);
+        rt2x00_set_field32(&reg, TX_BAND_CFG_BG, rf->channel <= 14);
+        rt2800_register_write(rt2x00dev, TX_BAND_CFG, reg);
+
+        tx_pin = 0;
+
+        /* Turn on unused PA or LNA when not using 1T or 1R */
+        if (rt2x00dev->default_ant.tx != 1) {
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A1_EN, 1);
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G1_EN, 1);
+        }
+
+        /* Turn on unused PA or LNA when not using 1T or 1R */
+        if (rt2x00dev->default_ant.rx != 1) {
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A1_EN, 1);
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G1_EN, 1);
+        }
+
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A0_EN, 1);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G0_EN, 1);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_RFTR_EN, 1);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_TRSW_EN, 1);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G0_EN, rf->channel <= 14);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A0_EN, rf->channel > 14);
+
+        rt2800_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
+
+        rt2800_bbp_read(rt2x00dev, 4, &bbp);
+        rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
+        rt2800_bbp_write(rt2x00dev, 4, bbp);
+
+        rt2800_bbp_read(rt2x00dev, 3, &bbp);
+        rt2x00_set_field8(&bbp, BBP3_HT40_PLUS, conf_is_ht40_plus(conf));
+        rt2800_bbp_write(rt2x00dev, 3, bbp);
+
+        if (rt2x00_rt(rt2x00dev, RT2860) &&
+            (rt2x00_rev(rt2x00dev) == RT2860C_VERSION)) {
+                if (conf_is_ht40(conf)) {
+                        rt2800_bbp_write(rt2x00dev, 69, 0x1a);
+                        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
+                        rt2800_bbp_write(rt2x00dev, 73, 0x16);
+                } else {
+                        rt2800_bbp_write(rt2x00dev, 69, 0x16);
+                        rt2800_bbp_write(rt2x00dev, 70, 0x08);
+                        rt2800_bbp_write(rt2x00dev, 73, 0x11);
+                }
+        }
+
+        msleep(1);
+}
+
+static void rt2800_config_txpower(struct rt2x00_dev *rt2x00dev,
+                                  const int txpower)
+{
+        u32 reg;
+        u32 value = TXPOWER_G_TO_DEV(txpower);
+        u8 r1;
+
+        rt2800_bbp_read(rt2x00dev, 1, &r1);
+        rt2x00_set_field8(&reg, BBP1_TX_POWER, 0);
+        rt2800_bbp_write(rt2x00dev, 1, r1);
+
+        rt2800_register_read(rt2x00dev, TX_PWR_CFG_0, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_1MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_2MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_55MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_11MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_6MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_9MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_12MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_18MBS, value);
+        rt2800_register_write(rt2x00dev, TX_PWR_CFG_0, reg);
+
+        rt2800_register_read(rt2x00dev, TX_PWR_CFG_1, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_24MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_36MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_48MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_54MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS0, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS1, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS2, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS3, value);
+        rt2800_register_write(rt2x00dev, TX_PWR_CFG_1, reg);
+
+        rt2800_register_read(rt2x00dev, TX_PWR_CFG_2, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS4, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS5, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS6, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS7, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS8, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS9, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS10, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS11, value);
+        rt2800_register_write(rt2x00dev, TX_PWR_CFG_2, reg);
+
+        rt2800_register_read(rt2x00dev, TX_PWR_CFG_3, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS12, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS13, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS14, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS15, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN1, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN2, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN3, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN4, value);
+        rt2800_register_write(rt2x00dev, TX_PWR_CFG_3, reg);
+
+        rt2800_register_read(rt2x00dev, TX_PWR_CFG_4, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN5, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN6, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN7, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN8, value);
+        rt2800_register_write(rt2x00dev, TX_PWR_CFG_4, reg);
+}
+
+static void rt2800_config_retry_limit(struct rt2x00_dev *rt2x00dev,
+                                      struct rt2x00lib_conf *libconf)
+{
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, TX_RTY_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_SHORT_RTY_LIMIT,
+                           libconf->conf->short_frame_max_tx_count);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_LONG_RTY_LIMIT,
+                           libconf->conf->long_frame_max_tx_count);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_LONG_RTY_THRE, 2000);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_NON_AGG_RTY_MODE, 0);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_AGG_RTY_MODE, 0);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_TX_AUTO_FB_ENABLE, 1);
+        rt2800_register_write(rt2x00dev, TX_RTY_CFG, reg);
+}
+
+static void rt2800_config_ps(struct rt2x00_dev *rt2x00dev,
+                             struct rt2x00lib_conf *libconf)
+{
+        enum dev_state state =
+            (libconf->conf->flags & IEEE80211_CONF_PS) ?
+                STATE_SLEEP : STATE_AWAKE;
+        u32 reg;
+
+        if (state == STATE_SLEEP) {
+                rt2800_register_write(rt2x00dev, AUTOWAKEUP_CFG, 0);
+
+                rt2800_register_read(rt2x00dev, AUTOWAKEUP_CFG, &reg);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTO_LEAD_TIME, 5);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE,
+                                   libconf->conf->listen_interval - 1);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTOWAKE, 1);
+                rt2800_register_write(rt2x00dev, AUTOWAKEUP_CFG, reg);
+
+                rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
+        } else {
+                rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
+
+                rt2800_register_read(rt2x00dev, AUTOWAKEUP_CFG, &reg);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTO_LEAD_TIME, 0);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE, 0);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTOWAKE, 0);
+                rt2800_register_write(rt2x00dev, AUTOWAKEUP_CFG, reg);
+        }
+}
+
+void rt2800_config(struct rt2x00_dev *rt2x00dev,
+                   struct rt2x00lib_conf *libconf,
+                   const unsigned int flags)
+{
+        /* Always recalculate LNA gain before changing configuration */
+        rt2800_config_lna_gain(rt2x00dev, libconf);
+
+        if (flags & IEEE80211_CONF_CHANGE_CHANNEL)
+                rt2800_config_channel(rt2x00dev, libconf->conf,
+                                      &libconf->rf, &libconf->channel);
+        if (flags & IEEE80211_CONF_CHANGE_POWER)
+                rt2800_config_txpower(rt2x00dev, libconf->conf->power_level);
+        if (flags & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
+                rt2800_config_retry_limit(rt2x00dev, libconf);
+        if (flags & IEEE80211_CONF_CHANGE_PS)
+                rt2800_config_ps(rt2x00dev, libconf);
+}
+EXPORT_SYMBOL_GPL(rt2800_config);
+
+/*
+ * Link tuning
+ */
+void rt2800_link_stats(struct rt2x00_dev *rt2x00dev, struct link_qual *qual)
+{
+        u32 reg;
+
+        /*
+         * Update FCS error count from register.
+         */
+        rt2800_register_read(rt2x00dev, RX_STA_CNT0, &reg);
+        qual->rx_failed = rt2x00_get_field32(reg, RX_STA_CNT0_CRC_ERR);
+}
+EXPORT_SYMBOL_GPL(rt2800_link_stats);
+
+static u8 rt2800_get_default_vgc(struct rt2x00_dev *rt2x00dev)
+{
+        if (rt2x00dev->curr_band == IEEE80211_BAND_2GHZ) {
+                if (rt2x00_is_usb(rt2x00dev) &&
+                    rt2x00_rt(rt2x00dev, RT3070) &&
+                    (rt2x00_rev(rt2x00dev) == RT3070_VERSION))
+                        return 0x1c + (2 * rt2x00dev->lna_gain);
+                else
+                        return 0x2e + rt2x00dev->lna_gain;
+        }
+
+        if (!test_bit(CONFIG_CHANNEL_HT40, &rt2x00dev->flags))
+                return 0x32 + (rt2x00dev->lna_gain * 5) / 3;
+        else
+                return 0x3a + (rt2x00dev->lna_gain * 5) / 3;
+}
+
+static inline void rt2800_set_vgc(struct rt2x00_dev *rt2x00dev,
+                                  struct link_qual *qual, u8 vgc_level)
+{
+        if (qual->vgc_level != vgc_level) {
+                rt2800_bbp_write(rt2x00dev, 66, vgc_level);
+                qual->vgc_level = vgc_level;
+                qual->vgc_level_reg = vgc_level;
+        }
+}
+
+void rt2800_reset_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual)
+{
+        rt2800_set_vgc(rt2x00dev, qual, rt2800_get_default_vgc(rt2x00dev));
+}
+EXPORT_SYMBOL_GPL(rt2800_reset_tuner);
+
+void rt2800_link_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual,
+                       const u32 count)
+{
+        if (rt2x00_rt(rt2x00dev, RT2860) &&
+            (rt2x00_rev(rt2x00dev) == RT2860C_VERSION))
+                return;
+
+        /*
+         * When RSSI is better then -80 increase VGC level with 0x10
+         */
+        rt2800_set_vgc(rt2x00dev, qual,
+                       rt2800_get_default_vgc(rt2x00dev) +
+                       ((qual->rssi > -80) * 0x10));
+}
+EXPORT_SYMBOL_GPL(rt2800_link_tuner);
+
+/*
+ * Initialization functions.
+ */
+int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        unsigned int i;
+
+        if (rt2x00_is_usb(rt2x00dev)) {
+                /*
+                 * Wait until BBP and RF are ready.
+                 */
+                for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                        rt2800_register_read(rt2x00dev, MAC_CSR0, &reg);
+                        if (reg && reg != ~0)
+                                break;
+                        msleep(1);
+                }
+
+                if (i == REGISTER_BUSY_COUNT) {
+                        ERROR(rt2x00dev, "Unstable hardware.\n");
+                        return -EBUSY;
+                }
+
+                rt2800_register_read(rt2x00dev, PBF_SYS_CTRL, &reg);
+                rt2800_register_write(rt2x00dev, PBF_SYS_CTRL,
+                                      reg & ~0x00002000);
+        } else if (rt2x00_is_pci(rt2x00dev) || rt2x00_is_soc(rt2x00dev))
+                rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000003);
+
+        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_CSR, 1);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_BBP, 1);
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        if (rt2x00_is_usb(rt2x00dev)) {
+                rt2800_register_write(rt2x00dev, USB_DMA_CFG, 0x00000000);
+#if defined(CONFIG_RT2X00_LIB_USB) || defined(CONFIG_RT2X00_LIB_USB_MODULE)
+                rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0,
+                                            USB_MODE_RESET, REGISTER_TIMEOUT);
+#endif
+        }
+
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
+
+        rt2800_register_read(rt2x00dev, BCN_OFFSET0, &reg);
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN0, 0xe0); /* 0x3800 */
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN1, 0xe8); /* 0x3a00 */
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN2, 0xf0); /* 0x3c00 */
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN3, 0xf8); /* 0x3e00 */
+        rt2800_register_write(rt2x00dev, BCN_OFFSET0, reg);
+
+        rt2800_register_read(rt2x00dev, BCN_OFFSET1, &reg);
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN4, 0xc8); /* 0x3200 */
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN5, 0xd0); /* 0x3400 */
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN6, 0x77); /* 0x1dc0 */
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN7, 0x6f); /* 0x1bc0 */
+        rt2800_register_write(rt2x00dev, BCN_OFFSET1, reg);
+
+        rt2800_register_write(rt2x00dev, LEGACY_BASIC_RATE, 0x0000013f);
+        rt2800_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
+
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
+
+        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_SYNC, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TX_TIME_COMPENSATE, 0);
+        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+
+        if (rt2x00_is_usb(rt2x00dev) &&
+            rt2x00_rt(rt2x00dev, RT3070) &&
+            (rt2x00_rev(rt2x00dev) == RT3070_VERSION)) {
+                rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000400);
+                rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00000000);
+                rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
+        } else {
+                rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000000);
+                rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
+        }
+
+        rt2800_register_read(rt2x00dev, TX_LINK_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_MFB_LIFETIME, 32);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_MFB_ENABLE, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_UMFS_ENABLE, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_TX_MRQ_EN, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_TX_RDG_EN, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_TX_CF_ACK_EN, 1);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_MFB, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_MFS, 0);
+        rt2800_register_write(rt2x00dev, TX_LINK_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, TX_TIMEOUT_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_TIMEOUT_CFG_MPDU_LIFETIME, 9);
+        rt2x00_set_field32(&reg, TX_TIMEOUT_CFG_TX_OP_TIMEOUT, 10);
+        rt2800_register_write(rt2x00dev, TX_TIMEOUT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, MAX_LEN_CFG, &reg);
+        rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_MPDU, AGGREGATION_SIZE);
+        if ((rt2x00_rt(rt2x00dev, RT2872) &&
+             (rt2x00_rev(rt2x00dev) >= RT2880E_VERSION)) ||
+            rt2x00_rt(rt2x00dev, RT2880) ||
+            rt2x00_rt(rt2x00dev, RT2883) ||
+            rt2x00_rt(rt2x00dev, RT2890) ||
+            rt2x00_rt(rt2x00dev, RT3052) ||
+            (rt2x00_rt(rt2x00dev, RT3070) &&
+             (rt2x00_rev(rt2x00dev) < RT3070_VERSION)))
+                rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 2);
+        else
+                rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 1);
+        rt2x00_set_field32(&reg, MAX_LEN_CFG_MIN_PSDU, 0);
+        rt2x00_set_field32(&reg, MAX_LEN_CFG_MIN_MPDU, 0);
+        rt2800_register_write(rt2x00dev, MAX_LEN_CFG, reg);
+
+        rt2800_register_write(rt2x00dev, PBF_MAX_PCNT, 0x1f3fbf9f);
+
+        rt2800_register_read(rt2x00dev, AUTO_RSP_CFG, &reg);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_AUTORESPONDER, 1);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_CTS_40_MMODE, 0);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_CTS_40_MREF, 0);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_DUAL_CTS_EN, 0);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_ACK_CTS_PSM_BIT, 0);
+        rt2800_register_write(rt2x00dev, AUTO_RSP_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, CCK_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_PROTECT_RATE, 8);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_MM40, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_GF40, 1);
+        rt2800_register_write(rt2x00dev, CCK_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_RATE, 8);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_MM40, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_GF40, 1);
+        rt2800_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, MM20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_RATE, 0x4004);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_MM40, 0);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_GF40, 0);
+        rt2800_register_write(rt2x00dev, MM20_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, MM40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_RATE, 0x4084);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_MM40, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_GF40, 1);
+        rt2800_register_write(rt2x00dev, MM40_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, GF20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_RATE, 0x4004);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_MM40, 0);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_GF40, 0);
+        rt2800_register_write(rt2x00dev, GF20_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, GF40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_RATE, 0x4084);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_MM40, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_GF40, 1);
+        rt2800_register_write(rt2x00dev, GF40_PROT_CFG, reg);
+
+        if (rt2x00_is_usb(rt2x00dev)) {
+                rt2800_register_write(rt2x00dev, PBF_CFG, 0xf40006);
+
+                rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+                rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
+                rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_DMA_BUSY, 0);
+                rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
+                rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_DMA_BUSY, 0);
+                rt2x00_set_field32(&reg, WPDMA_GLO_CFG_WP_DMA_BURST_SIZE, 3);
+                rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 0);
+                rt2x00_set_field32(&reg, WPDMA_GLO_CFG_BIG_ENDIAN, 0);
+                rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_HDR_SCATTER, 0);
+                rt2x00_set_field32(&reg, WPDMA_GLO_CFG_HDR_SEG_LEN, 0);
+                rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+        }
+
+        rt2800_register_write(rt2x00dev, TXOP_CTRL_CFG, 0x0000583f);
+        rt2800_register_write(rt2x00dev, TXOP_HLDR_ET, 0x00000002);
+
+        rt2800_register_read(rt2x00dev, TX_RTS_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT, 32);
+        rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_THRES,
+                           IEEE80211_MAX_RTS_THRESHOLD);
+        rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_FBK_EN, 0);
+        rt2800_register_write(rt2x00dev, TX_RTS_CFG, reg);
+
+        rt2800_register_write(rt2x00dev, EXP_ACK_TIME, 0x002400ca);
+        rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000003);
+
+        /*
+         * ASIC will keep garbage value after boot, clear encryption keys.
+         */
+        for (i = 0; i < 4; i++)
+                rt2800_register_write(rt2x00dev,
+                                         SHARED_KEY_MODE_ENTRY(i), 0);
+
+        for (i = 0; i < 256; i++) {
+                u32 wcid[2] = { 0xffffffff, 0x00ffffff };
+                rt2800_register_multiwrite(rt2x00dev, MAC_WCID_ENTRY(i),
+                                              wcid, sizeof(wcid));
+
+                rt2800_register_write(rt2x00dev, MAC_WCID_ATTR_ENTRY(i), 1);
+                rt2800_register_write(rt2x00dev, MAC_IVEIV_ENTRY(i), 0);
+        }
+
+        /*
+         * Clear all beacons
+         * For the Beacon base registers we only need to clear
+         * the first byte since that byte contains the VALID and OWNER
+         * bits which (when set to 0) will invalidate the entire beacon.
+         */
+        rt2800_register_write(rt2x00dev, HW_BEACON_BASE0, 0);
+        rt2800_register_write(rt2x00dev, HW_BEACON_BASE1, 0);
+        rt2800_register_write(rt2x00dev, HW_BEACON_BASE2, 0);
+        rt2800_register_write(rt2x00dev, HW_BEACON_BASE3, 0);
+        rt2800_register_write(rt2x00dev, HW_BEACON_BASE4, 0);
+        rt2800_register_write(rt2x00dev, HW_BEACON_BASE5, 0);
+        rt2800_register_write(rt2x00dev, HW_BEACON_BASE6, 0);
+        rt2800_register_write(rt2x00dev, HW_BEACON_BASE7, 0);
+
+        if (rt2x00_is_usb(rt2x00dev)) {
+                rt2800_register_read(rt2x00dev, USB_CYC_CFG, &reg);
+                rt2x00_set_field32(&reg, USB_CYC_CFG_CLOCK_CYCLE, 30);
+                rt2800_register_write(rt2x00dev, USB_CYC_CFG, reg);
+        }
+
+        rt2800_register_read(rt2x00dev, HT_FBK_CFG0, &reg);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS0FBK, 0);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS1FBK, 0);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS2FBK, 1);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS3FBK, 2);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS4FBK, 3);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS5FBK, 4);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS6FBK, 5);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS7FBK, 6);
+        rt2800_register_write(rt2x00dev, HT_FBK_CFG0, reg);
+
+        rt2800_register_read(rt2x00dev, HT_FBK_CFG1, &reg);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS8FBK, 8);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS9FBK, 8);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS10FBK, 9);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS11FBK, 10);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS12FBK, 11);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS13FBK, 12);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS14FBK, 13);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS15FBK, 14);
+        rt2800_register_write(rt2x00dev, HT_FBK_CFG1, reg);
+
+        rt2800_register_read(rt2x00dev, LG_FBK_CFG0, &reg);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS0FBK, 8);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS1FBK, 8);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS2FBK, 9);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS3FBK, 10);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS4FBK, 11);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS5FBK, 12);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS6FBK, 13);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS7FBK, 14);
+        rt2800_register_write(rt2x00dev, LG_FBK_CFG0, reg);
+
+        rt2800_register_read(rt2x00dev, LG_FBK_CFG1, &reg);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS0FBK, 0);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS1FBK, 0);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS2FBK, 1);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS3FBK, 2);
+        rt2800_register_write(rt2x00dev, LG_FBK_CFG1, reg);
+
+        /*
+         * We must clear the error counters.
+         * These registers are cleared on read,
+         * so we may pass a useless variable to store the value.
+         */
+        rt2800_register_read(rt2x00dev, RX_STA_CNT0, &reg);
+        rt2800_register_read(rt2x00dev, RX_STA_CNT1, &reg);
+        rt2800_register_read(rt2x00dev, RX_STA_CNT2, &reg);
+        rt2800_register_read(rt2x00dev, TX_STA_CNT0, &reg);
+        rt2800_register_read(rt2x00dev, TX_STA_CNT1, &reg);
+        rt2800_register_read(rt2x00dev, TX_STA_CNT2, &reg);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2800_init_registers);
+
+static int rt2800_wait_bbp_rf_ready(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u32 reg;
+
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2800_register_read(rt2x00dev, MAC_STATUS_CFG, &reg);
+                if (!rt2x00_get_field32(reg, MAC_STATUS_CFG_BBP_RF_BUSY))
+                        return 0;
+
+                udelay(REGISTER_BUSY_DELAY);
+        }
+
+        ERROR(rt2x00dev, "BBP/RF register access failed, aborting.\n");
+        return -EACCES;
+}
+
+static int rt2800_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u8 value;
+
+        /*
+         * BBP was enabled after firmware was loaded,
+         * but we need to reactivate it now.
+         */
+        rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+        rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+        msleep(1);
+
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2800_bbp_read(rt2x00dev, 0, &value);
+                if ((value != 0xff) && (value != 0x00))
+                        return 0;
+                udelay(REGISTER_BUSY_DELAY);
+        }
+
+        ERROR(rt2x00dev, "BBP register access failed, aborting.\n");
+        return -EACCES;
+}
+
+int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u16 eeprom;
+        u8 reg_id;
+        u8 value;
+
+        if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev) ||
+                     rt2800_wait_bbp_ready(rt2x00dev)))
+                return -EACCES;
+
+        rt2800_bbp_write(rt2x00dev, 65, 0x2c);
+        rt2800_bbp_write(rt2x00dev, 66, 0x38);
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
+        rt2800_bbp_write(rt2x00dev, 73, 0x10);
+        rt2800_bbp_write(rt2x00dev, 81, 0x37);
+        rt2800_bbp_write(rt2x00dev, 82, 0x62);
+        rt2800_bbp_write(rt2x00dev, 83, 0x6a);
+        rt2800_bbp_write(rt2x00dev, 84, 0x99);
+        rt2800_bbp_write(rt2x00dev, 86, 0x00);
+        rt2800_bbp_write(rt2x00dev, 91, 0x04);
+        rt2800_bbp_write(rt2x00dev, 92, 0x00);
+        rt2800_bbp_write(rt2x00dev, 103, 0x00);
+        rt2800_bbp_write(rt2x00dev, 105, 0x05);
+
+        if (rt2x00_rt(rt2x00dev, RT2860) &&
+            (rt2x00_rev(rt2x00dev) == RT2860C_VERSION)) {
+                rt2800_bbp_write(rt2x00dev, 69, 0x16);
+                rt2800_bbp_write(rt2x00dev, 73, 0x12);
+        }
+
+        if (rt2x00_rt(rt2x00dev, RT2860) &&
+            (rt2x00_rev(rt2x00dev) > RT2860D_VERSION))
+                rt2800_bbp_write(rt2x00dev, 84, 0x19);
+
+        if (rt2x00_is_usb(rt2x00dev) &&
+            rt2x00_rt(rt2x00dev, RT3070) &&
+            (rt2x00_rev(rt2x00dev) == RT3070_VERSION)) {
+                rt2800_bbp_write(rt2x00dev, 70, 0x0a);
+                rt2800_bbp_write(rt2x00dev, 84, 0x99);
+                rt2800_bbp_write(rt2x00dev, 105, 0x05);
+        }
+
+        if (rt2x00_rt(rt2x00dev, RT3052)) {
+                rt2800_bbp_write(rt2x00dev, 31, 0x08);
+                rt2800_bbp_write(rt2x00dev, 78, 0x0e);
+                rt2800_bbp_write(rt2x00dev, 80, 0x08);
+        }
+
+        for (i = 0; i < EEPROM_BBP_SIZE; i++) {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i, &eeprom);
+
+                if (eeprom != 0xffff && eeprom != 0x0000) {
+                        reg_id = rt2x00_get_field16(eeprom, EEPROM_BBP_REG_ID);
+                        value = rt2x00_get_field16(eeprom, EEPROM_BBP_VALUE);
+                        rt2800_bbp_write(rt2x00dev, reg_id, value);
+                }
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2800_init_bbp);
+
+static u8 rt2800_init_rx_filter(struct rt2x00_dev *rt2x00dev,
+                                bool bw40, u8 rfcsr24, u8 filter_target)
+{
+        unsigned int i;
+        u8 bbp;
+        u8 rfcsr;
+        u8 passband;
+        u8 stopband;
+        u8 overtuned = 0;
+
+        rt2800_rfcsr_write(rt2x00dev, 24, rfcsr24);
+
+        rt2800_bbp_read(rt2x00dev, 4, &bbp);
+        rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * bw40);
+        rt2800_bbp_write(rt2x00dev, 4, bbp);
+
+        rt2800_rfcsr_read(rt2x00dev, 22, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR22_BASEBAND_LOOPBACK, 1);
+        rt2800_rfcsr_write(rt2x00dev, 22, rfcsr);
+
+        /*
+         * Set power & frequency of passband test tone
+         */
+        rt2800_bbp_write(rt2x00dev, 24, 0);
+
+        for (i = 0; i < 100; i++) {
+                rt2800_bbp_write(rt2x00dev, 25, 0x90);
+                msleep(1);
+
+                rt2800_bbp_read(rt2x00dev, 55, &passband);
+                if (passband)
+                        break;
+        }
+
+        /*
+         * Set power & frequency of stopband test tone
+         */
+        rt2800_bbp_write(rt2x00dev, 24, 0x06);
+
+        for (i = 0; i < 100; i++) {
+                rt2800_bbp_write(rt2x00dev, 25, 0x90);
+                msleep(1);
+
+                rt2800_bbp_read(rt2x00dev, 55, &stopband);
+
+                if ((passband - stopband) <= filter_target) {
+                        rfcsr24++;
+                        overtuned += ((passband - stopband) == filter_target);
+                } else
+                        break;
+
+                rt2800_rfcsr_write(rt2x00dev, 24, rfcsr24);
+        }
+
+        rfcsr24 -= !!overtuned;
+
+        rt2800_rfcsr_write(rt2x00dev, 24, rfcsr24);
+        return rfcsr24;
+}
+
+int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+{
+        u8 rfcsr;
+        u8 bbp;
+
+        if (rt2x00_is_usb(rt2x00dev) &&
+            rt2x00_rt(rt2x00dev, RT3070) &&
+            (rt2x00_rev(rt2x00dev) != RT3070_VERSION))
+                return 0;
+
+        if (rt2x00_is_pci(rt2x00dev) || rt2x00_is_soc(rt2x00dev)) {
+                if (!rt2x00_rf(rt2x00dev, RF3020) &&
+                    !rt2x00_rf(rt2x00dev, RF3021) &&
+                    !rt2x00_rf(rt2x00dev, RF3022))
+                        return 0;
+        }
+
+        /*
+         * Init RF calibration.
+         */
+        rt2800_rfcsr_read(rt2x00dev, 30, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 1);
+        rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
+        msleep(1);
+        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 0);
+        rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
+
+        if (rt2x00_is_usb(rt2x00dev)) {
+                rt2800_rfcsr_write(rt2x00dev, 4, 0x40);
+                rt2800_rfcsr_write(rt2x00dev, 5, 0x03);
+                rt2800_rfcsr_write(rt2x00dev, 6, 0x02);
+                rt2800_rfcsr_write(rt2x00dev, 7, 0x70);
+                rt2800_rfcsr_write(rt2x00dev, 9, 0x0f);
+                rt2800_rfcsr_write(rt2x00dev, 10, 0x71);
+                rt2800_rfcsr_write(rt2x00dev, 11, 0x21);
+                rt2800_rfcsr_write(rt2x00dev, 12, 0x7b);
+                rt2800_rfcsr_write(rt2x00dev, 14, 0x90);
+                rt2800_rfcsr_write(rt2x00dev, 15, 0x58);
+                rt2800_rfcsr_write(rt2x00dev, 16, 0xb3);
+                rt2800_rfcsr_write(rt2x00dev, 17, 0x92);
+                rt2800_rfcsr_write(rt2x00dev, 18, 0x2c);
+                rt2800_rfcsr_write(rt2x00dev, 19, 0x02);
+                rt2800_rfcsr_write(rt2x00dev, 20, 0xba);
+                rt2800_rfcsr_write(rt2x00dev, 21, 0xdb);
+                rt2800_rfcsr_write(rt2x00dev, 24, 0x16);
+                rt2800_rfcsr_write(rt2x00dev, 25, 0x01);
+                rt2800_rfcsr_write(rt2x00dev, 27, 0x03);
+                rt2800_rfcsr_write(rt2x00dev, 29, 0x1f);
+        } else if (rt2x00_is_pci(rt2x00dev) || rt2x00_is_soc(rt2x00dev)) {
+                rt2800_rfcsr_write(rt2x00dev, 0, 0x50);
+                rt2800_rfcsr_write(rt2x00dev, 1, 0x01);
+                rt2800_rfcsr_write(rt2x00dev, 2, 0xf7);
+                rt2800_rfcsr_write(rt2x00dev, 3, 0x75);
+                rt2800_rfcsr_write(rt2x00dev, 4, 0x40);
+                rt2800_rfcsr_write(rt2x00dev, 5, 0x03);
+                rt2800_rfcsr_write(rt2x00dev, 6, 0x02);
+                rt2800_rfcsr_write(rt2x00dev, 7, 0x50);
+                rt2800_rfcsr_write(rt2x00dev, 8, 0x39);
+                rt2800_rfcsr_write(rt2x00dev, 9, 0x0f);
+                rt2800_rfcsr_write(rt2x00dev, 10, 0x60);
+                rt2800_rfcsr_write(rt2x00dev, 11, 0x21);
+                rt2800_rfcsr_write(rt2x00dev, 12, 0x75);
+                rt2800_rfcsr_write(rt2x00dev, 13, 0x75);
+                rt2800_rfcsr_write(rt2x00dev, 14, 0x90);
+                rt2800_rfcsr_write(rt2x00dev, 15, 0x58);
+                rt2800_rfcsr_write(rt2x00dev, 16, 0xb3);
+                rt2800_rfcsr_write(rt2x00dev, 17, 0x92);
+                rt2800_rfcsr_write(rt2x00dev, 18, 0x2c);
+                rt2800_rfcsr_write(rt2x00dev, 19, 0x02);
+                rt2800_rfcsr_write(rt2x00dev, 20, 0xba);
+                rt2800_rfcsr_write(rt2x00dev, 21, 0xdb);
+                rt2800_rfcsr_write(rt2x00dev, 22, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 23, 0x31);
+                rt2800_rfcsr_write(rt2x00dev, 24, 0x08);
+                rt2800_rfcsr_write(rt2x00dev, 25, 0x01);
+                rt2800_rfcsr_write(rt2x00dev, 26, 0x25);
+                rt2800_rfcsr_write(rt2x00dev, 27, 0x23);
+                rt2800_rfcsr_write(rt2x00dev, 28, 0x13);
+                rt2800_rfcsr_write(rt2x00dev, 29, 0x83);
+        }
+
+        /*
+         * Set RX Filter calibration for 20MHz and 40MHz
+         */
+        rt2x00dev->calibration[0] =
+            rt2800_init_rx_filter(rt2x00dev, false, 0x07, 0x16);
+        rt2x00dev->calibration[1] =
+            rt2800_init_rx_filter(rt2x00dev, true, 0x27, 0x19);
+
+        /*
+         * Set back to initial state
+         */
+        rt2800_bbp_write(rt2x00dev, 24, 0);
+
+        rt2800_rfcsr_read(rt2x00dev, 22, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR22_BASEBAND_LOOPBACK, 0);
+        rt2800_rfcsr_write(rt2x00dev, 22, rfcsr);
+
+        /*
+         * set BBP back to BW20
+         */
+        rt2800_bbp_read(rt2x00dev, 4, &bbp);
+        rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 0);
+        rt2800_bbp_write(rt2x00dev, 4, bbp);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2800_init_rfcsr);
+
+int rt2800_efuse_detect(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, EFUSE_CTRL, &reg);
+
+        return rt2x00_get_field32(reg, EFUSE_CTRL_PRESENT);
+}
+EXPORT_SYMBOL_GPL(rt2800_efuse_detect);
+
+static void rt2800_efuse_read(struct rt2x00_dev *rt2x00dev, unsigned int i)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        rt2800_register_read_lock(rt2x00dev, EFUSE_CTRL, &reg);
+        rt2x00_set_field32(&reg, EFUSE_CTRL_ADDRESS_IN, i);
+        rt2x00_set_field32(&reg, EFUSE_CTRL_MODE, 0);
+        rt2x00_set_field32(&reg, EFUSE_CTRL_KICK, 1);
+        rt2800_register_write_lock(rt2x00dev, EFUSE_CTRL, reg);
+
+        /* Wait until the EEPROM has been loaded */
+        rt2800_regbusy_read(rt2x00dev, EFUSE_CTRL, EFUSE_CTRL_KICK, &reg);
+
+        /* Apparently the data is read from end to start */
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3,
+                                        (u32 *)&rt2x00dev->eeprom[i]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2,
+                                        (u32 *)&rt2x00dev->eeprom[i + 2]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1,
+                                        (u32 *)&rt2x00dev->eeprom[i + 4]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA0,
+                                        (u32 *)&rt2x00dev->eeprom[i + 6]);
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+void rt2800_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+
+        for (i = 0; i < EEPROM_SIZE / sizeof(u16); i += 8)
+                rt2800_efuse_read(rt2x00dev, i);
+}
+EXPORT_SYMBOL_GPL(rt2800_read_eeprom_efuse);
+
+int rt2800_validate_eeprom(struct rt2x00_dev *rt2x00dev)
+{
+        u16 word;
+        u8 *mac;
+        u8 default_lna_gain;
+
+        /*
+         * Start validation of the data that has been read.
+         */
+        mac = rt2x00_eeprom_addr(rt2x00dev, EEPROM_MAC_ADDR_0);
+        if (!is_valid_ether_addr(mac)) {
+                random_ether_addr(mac);
+                EEPROM(rt2x00dev, "MAC: %pM\n", mac);
+        }
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &word);
+        if (word == 0xffff) {
+                rt2x00_set_field16(&word, EEPROM_ANTENNA_RXPATH, 2);
+                rt2x00_set_field16(&word, EEPROM_ANTENNA_TXPATH, 1);
+                rt2x00_set_field16(&word, EEPROM_ANTENNA_RF_TYPE, RF2820);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
+                EEPROM(rt2x00dev, "Antenna: 0x%04x\n", word);
+        } else if (rt2x00_rt(rt2x00dev, RT2860) ||
+                   rt2x00_rt(rt2x00dev, RT2870) ||
+                   rt2x00_rt(rt2x00dev, RT2872) ||
+                   rt2x00_rt(rt2x00dev, RT2880) ||
+                   (rt2x00_rt(rt2x00dev, RT2883) &&
+                    (rt2x00_rev(rt2x00dev) < RT2883_VERSION))) {
+                /*
+                 * There is a max of 2 RX streams for RT28x0 series
+                 */
+                if (rt2x00_get_field16(word, EEPROM_ANTENNA_RXPATH) > 2)
+                        rt2x00_set_field16(&word, EEPROM_ANTENNA_RXPATH, 2);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
+        }
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC, &word);
+        if (word == 0xffff) {
+                rt2x00_set_field16(&word, EEPROM_NIC_HW_RADIO, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_DYNAMIC_TX_AGC, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_EXTERNAL_LNA_BG, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_EXTERNAL_LNA_A, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_CARDBUS_ACCEL, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_SB_BG, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_SB_A, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_WPS_PBC, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_BG, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_A, 0);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_NIC, word);
+                EEPROM(rt2x00dev, "NIC: 0x%04x\n", word);
+        }
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ, &word);
+        if ((word & 0x00ff) == 0x00ff) {
+                rt2x00_set_field16(&word, EEPROM_FREQ_OFFSET, 0);
+                rt2x00_set_field16(&word, EEPROM_FREQ_LED_MODE,
+                                   LED_MODE_TXRX_ACTIVITY);
+                rt2x00_set_field16(&word, EEPROM_FREQ_LED_POLARITY, 0);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_FREQ, word);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_LED1, 0x5555);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_LED2, 0x2221);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_LED3, 0xa9f8);
+                EEPROM(rt2x00dev, "Freq: 0x%04x\n", word);
+        }
+
+        /*
+         * During the LNA validation we are going to use
+         * lna0 as correct value. Note that EEPROM_LNA
+         * is never validated.
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LNA, &word);
+        default_lna_gain = rt2x00_get_field16(word, EEPROM_LNA_A0);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG, &word);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG_OFFSET0)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_BG_OFFSET0, 0);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG_OFFSET1)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_BG_OFFSET1, 0);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_BG, word);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2, &word);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG2_OFFSET2)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_BG2_OFFSET2, 0);
+        if (rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0x00 ||
+            rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0xff)
+                rt2x00_set_field16(&word, EEPROM_RSSI_BG2_LNA_A1,
+                                   default_lna_gain);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_BG2, word);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_A, &word);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A_OFFSET0)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_A_OFFSET0, 0);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A_OFFSET1)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_A_OFFSET1, 0);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_A, word);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_A2, &word);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A2_OFFSET2)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_A2_OFFSET2, 0);
+        if (rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0x00 ||
+            rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0xff)
+                rt2x00_set_field16(&word, EEPROM_RSSI_A2_LNA_A2,
+                                   default_lna_gain);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2800_validate_eeprom);
+
+int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        u16 value;
+        u16 eeprom;
+
+        /*
+         * Read EEPROM word for configuration.
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &eeprom);
+
+        /*
+         * Identify RF chipset.
+         */
+        value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
+        rt2800_register_read(rt2x00dev, MAC_CSR0, &reg);
+
+        rt2x00_set_chip(rt2x00dev, rt2x00_get_field32(reg, MAC_CSR0_CHIPSET),
+                        value, rt2x00_get_field32(reg, MAC_CSR0_REVISION));
+
+        if (!rt2x00_rt(rt2x00dev, RT2860) &&
+            !rt2x00_rt(rt2x00dev, RT2870) &&
+            !rt2x00_rt(rt2x00dev, RT2872) &&
+            !rt2x00_rt(rt2x00dev, RT2880) &&
+            !rt2x00_rt(rt2x00dev, RT2883) &&
+            !rt2x00_rt(rt2x00dev, RT2890) &&
+            !rt2x00_rt(rt2x00dev, RT3052) &&
+            !rt2x00_rt(rt2x00dev, RT3070) &&
+            !rt2x00_rt(rt2x00dev, RT3071) &&
+            !rt2x00_rt(rt2x00dev, RT3090) &&
+            !rt2x00_rt(rt2x00dev, RT3390) &&
+            !rt2x00_rt(rt2x00dev, RT3572)) {
+                ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
+                return -ENODEV;
+        }
+
+        if (!rt2x00_rf(rt2x00dev, RF2820) &&
+            !rt2x00_rf(rt2x00dev, RF2850) &&
+            !rt2x00_rf(rt2x00dev, RF2720) &&
+            !rt2x00_rf(rt2x00dev, RF2750) &&
+            !rt2x00_rf(rt2x00dev, RF3020) &&
+            !rt2x00_rf(rt2x00dev, RF2020) &&
+            !rt2x00_rf(rt2x00dev, RF3021) &&
+            !rt2x00_rf(rt2x00dev, RF3022) &&
+            !rt2x00_rf(rt2x00dev, RF3052)) {
+                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
+                return -ENODEV;
+        }
+
+        /*
+         * Identify default antenna configuration.
+         */
+        rt2x00dev->default_ant.tx =
+            rt2x00_get_field16(eeprom, EEPROM_ANTENNA_TXPATH);
+        rt2x00dev->default_ant.rx =
+            rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RXPATH);
+
+        /*
+         * Read frequency offset and RF programming sequence.
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ, &eeprom);
+        rt2x00dev->freq_offset = rt2x00_get_field16(eeprom, EEPROM_FREQ_OFFSET);
+
+        /*
+         * Read external LNA informations.
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC, &eeprom);
+
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_EXTERNAL_LNA_A))
+                __set_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags);
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_EXTERNAL_LNA_BG))
+                __set_bit(CONFIG_EXTERNAL_LNA_BG, &rt2x00dev->flags);
+
+        /*
+         * Detect if this device has an hardware controlled radio.
+         */
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_HW_RADIO))
+                __set_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags);
+
+        /*
+         * Store led settings, for correct led behaviour.
+         */
+#ifdef CONFIG_RT2X00_LIB_LEDS
+        rt2800_init_led(rt2x00dev, &rt2x00dev->led_radio, LED_TYPE_RADIO);
+        rt2800_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
+        rt2800_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ, &rt2x00dev->led_mcu_reg);
+#endif /* CONFIG_RT2X00_LIB_LEDS */
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2800_init_eeprom);
+
+/*
+ * RF value list for rt28x0
+ * Supports: 2.4 GHz (all) & 5.2 GHz (RF2850 & RF2750)
+ */
+static const struct rf_channel rf_vals[] = {
+        { 1,  0x18402ecc, 0x184c0786, 0x1816b455, 0x1800510b },
+        { 2,  0x18402ecc, 0x184c0786, 0x18168a55, 0x1800519f },
+        { 3,  0x18402ecc, 0x184c078a, 0x18168a55, 0x1800518b },
+        { 4,  0x18402ecc, 0x184c078a, 0x18168a55, 0x1800519f },
+        { 5,  0x18402ecc, 0x184c078e, 0x18168a55, 0x1800518b },
+        { 6,  0x18402ecc, 0x184c078e, 0x18168a55, 0x1800519f },
+        { 7,  0x18402ecc, 0x184c0792, 0x18168a55, 0x1800518b },
+        { 8,  0x18402ecc, 0x184c0792, 0x18168a55, 0x1800519f },
+        { 9,  0x18402ecc, 0x184c0796, 0x18168a55, 0x1800518b },
+        { 10, 0x18402ecc, 0x184c0796, 0x18168a55, 0x1800519f },
+        { 11, 0x18402ecc, 0x184c079a, 0x18168a55, 0x1800518b },
+        { 12, 0x18402ecc, 0x184c079a, 0x18168a55, 0x1800519f },
+        { 13, 0x18402ecc, 0x184c079e, 0x18168a55, 0x1800518b },
+        { 14, 0x18402ecc, 0x184c07a2, 0x18168a55, 0x18005193 },
+
+        /* 802.11 UNI / HyperLan 2 */
+        { 36, 0x18402ecc, 0x184c099a, 0x18158a55, 0x180ed1a3 },
+        { 38, 0x18402ecc, 0x184c099e, 0x18158a55, 0x180ed193 },
+        { 40, 0x18402ec8, 0x184c0682, 0x18158a55, 0x180ed183 },
+        { 44, 0x18402ec8, 0x184c0682, 0x18158a55, 0x180ed1a3 },
+        { 46, 0x18402ec8, 0x184c0686, 0x18158a55, 0x180ed18b },
+        { 48, 0x18402ec8, 0x184c0686, 0x18158a55, 0x180ed19b },
+        { 52, 0x18402ec8, 0x184c068a, 0x18158a55, 0x180ed193 },
+        { 54, 0x18402ec8, 0x184c068a, 0x18158a55, 0x180ed1a3 },
+        { 56, 0x18402ec8, 0x184c068e, 0x18158a55, 0x180ed18b },
+        { 60, 0x18402ec8, 0x184c0692, 0x18158a55, 0x180ed183 },
+        { 62, 0x18402ec8, 0x184c0692, 0x18158a55, 0x180ed193 },
+        { 64, 0x18402ec8, 0x184c0692, 0x18158a55, 0x180ed1a3 },
+
+        /* 802.11 HyperLan 2 */
+        { 100, 0x18402ec8, 0x184c06b2, 0x18178a55, 0x180ed783 },
+        { 102, 0x18402ec8, 0x184c06b2, 0x18578a55, 0x180ed793 },
+        { 104, 0x18402ec8, 0x185c06b2, 0x18578a55, 0x180ed1a3 },
+        { 108, 0x18402ecc, 0x185c0a32, 0x18578a55, 0x180ed193 },
+        { 110, 0x18402ecc, 0x184c0a36, 0x18178a55, 0x180ed183 },
+        { 112, 0x18402ecc, 0x184c0a36, 0x18178a55, 0x180ed19b },
+        { 116, 0x18402ecc, 0x184c0a3a, 0x18178a55, 0x180ed1a3 },
+        { 118, 0x18402ecc, 0x184c0a3e, 0x18178a55, 0x180ed193 },
+        { 120, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed183 },
+        { 124, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed193 },
+        { 126, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed15b },
+        { 128, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed1a3 },
+        { 132, 0x18402ec4, 0x184c0386, 0x18178a55, 0x180ed18b },
+        { 134, 0x18402ec4, 0x184c0386, 0x18178a55, 0x180ed193 },
+        { 136, 0x18402ec4, 0x184c0386, 0x18178a55, 0x180ed19b },
+        { 140, 0x18402ec4, 0x184c038a, 0x18178a55, 0x180ed183 },
+
+        /* 802.11 UNII */
+        { 149, 0x18402ec4, 0x184c038a, 0x18178a55, 0x180ed1a7 },
+        { 151, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed187 },
+        { 153, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed18f },
+        { 157, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed19f },
+        { 159, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed1a7 },
+        { 161, 0x18402ec4, 0x184c0392, 0x18178a55, 0x180ed187 },
+        { 165, 0x18402ec4, 0x184c0392, 0x18178a55, 0x180ed197 },
+        { 167, 0x18402ec4, 0x184c03d2, 0x18179855, 0x1815531f },
+        { 169, 0x18402ec4, 0x184c03d2, 0x18179855, 0x18155327 },
+        { 171, 0x18402ec4, 0x184c03d6, 0x18179855, 0x18155307 },
+        { 173, 0x18402ec4, 0x184c03d6, 0x18179855, 0x1815530f },
+
+        /* 802.11 Japan */
+        { 184, 0x15002ccc, 0x1500491e, 0x1509be55, 0x150c0a0b },
+        { 188, 0x15002ccc, 0x15004922, 0x1509be55, 0x150c0a13 },
+        { 192, 0x15002ccc, 0x15004926, 0x1509be55, 0x150c0a1b },
+        { 196, 0x15002ccc, 0x1500492a, 0x1509be55, 0x150c0a23 },
+        { 208, 0x15002ccc, 0x1500493a, 0x1509be55, 0x150c0a13 },
+        { 212, 0x15002ccc, 0x1500493e, 0x1509be55, 0x150c0a1b },
+        { 216, 0x15002ccc, 0x15004982, 0x1509be55, 0x150c0a23 },
+};
+
+/*
+ * RF value list for rt3070
+ * Supports: 2.4 GHz
+ */
+static const struct rf_channel rf_vals_302x[] = {
+        {1,  241, 2, 2 },
+        {2,  241, 2, 7 },
+        {3,  242, 2, 2 },
+        {4,  242, 2, 7 },
+        {5,  243, 2, 2 },
+        {6,  243, 2, 7 },
+        {7,  244, 2, 2 },
+        {8,  244, 2, 7 },
+        {9,  245, 2, 2 },
+        {10, 245, 2, 7 },
+        {11, 246, 2, 2 },
+        {12, 246, 2, 7 },
+        {13, 247, 2, 2 },
+        {14, 248, 2, 4 },
+};
+
+int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+{
+        struct hw_mode_spec *spec = &rt2x00dev->spec;
+        struct channel_info *info;
+        char *tx_power1;
+        char *tx_power2;
+        unsigned int i;
+        u16 eeprom;
+
+        /*
+         * Disable powersaving as default on PCI devices.
+         */
+        if (rt2x00_is_pci(rt2x00dev) || rt2x00_is_soc(rt2x00dev))
+                rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+        /*
+         * Initialize all hw fields.
+         */
+        rt2x00dev->hw->flags =
+            IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
+            IEEE80211_HW_SIGNAL_DBM |
+            IEEE80211_HW_SUPPORTS_PS |
+            IEEE80211_HW_PS_NULLFUNC_STACK;
+
+        SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
+        SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
+                                rt2x00_eeprom_addr(rt2x00dev,
+                                                   EEPROM_MAC_ADDR_0));
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &eeprom);
+
+        /*
+         * Initialize hw_mode information.
+         */
+        spec->supported_bands = SUPPORT_BAND_2GHZ;
+        spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
+
+        if (rt2x00_rf(rt2x00dev, RF2820) ||
+            rt2x00_rf(rt2x00dev, RF2720) ||
+            rt2x00_rf(rt2x00dev, RF3052)) {
+                spec->num_channels = 14;
+                spec->channels = rf_vals;
+        } else if (rt2x00_rf(rt2x00dev, RF2850) || rt2x00_rf(rt2x00dev, RF2750)) {
+                spec->supported_bands |= SUPPORT_BAND_5GHZ;
+                spec->num_channels = ARRAY_SIZE(rf_vals);
+                spec->channels = rf_vals;
+        } else if (rt2x00_rf(rt2x00dev, RF3020) ||
+                   rt2x00_rf(rt2x00dev, RF2020) ||
+                   rt2x00_rf(rt2x00dev, RF3021) ||
+                   rt2x00_rf(rt2x00dev, RF3022)) {
+                spec->num_channels = ARRAY_SIZE(rf_vals_302x);
+                spec->channels = rf_vals_302x;
+        }
+
+        /*
+         * Initialize HT information.
+         */
+        if (!rt2x00_rf(rt2x00dev, RF2020))
+                spec->ht.ht_supported = true;
+        else
+                spec->ht.ht_supported = false;
+
+        spec->ht.cap =
+            IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+            IEEE80211_HT_CAP_GRN_FLD |
+            IEEE80211_HT_CAP_SGI_20 |
+            IEEE80211_HT_CAP_SGI_40 |
+            IEEE80211_HT_CAP_TX_STBC |
+            IEEE80211_HT_CAP_RX_STBC;
+        spec->ht.ampdu_factor = 3;
+        spec->ht.ampdu_density = 4;
+        spec->ht.mcs.tx_params =
+            IEEE80211_HT_MCS_TX_DEFINED |
+            IEEE80211_HT_MCS_TX_RX_DIFF |
+            ((rt2x00_get_field16(eeprom, EEPROM_ANTENNA_TXPATH) - 1) <<
+                IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT);
+
+        switch (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RXPATH)) {
+        case 3:
+                spec->ht.mcs.rx_mask[2] = 0xff;
+        case 2:
+                spec->ht.mcs.rx_mask[1] = 0xff;
+        case 1:
+                spec->ht.mcs.rx_mask[0] = 0xff;
+                spec->ht.mcs.rx_mask[4] = 0x1; /* MCS32 */
+                break;
+        }
+
+        /*
+         * Create channel information array
+         */
+        info = kzalloc(spec->num_channels * sizeof(*info), GFP_KERNEL);
+        if (!info)
+                return -ENOMEM;
+
+        spec->channels_info = info;
+
+        tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
+        tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
+
+        for (i = 0; i < 14; i++) {
+                info[i].tx_power1 = TXPOWER_G_FROM_DEV(tx_power1[i]);
+                info[i].tx_power2 = TXPOWER_G_FROM_DEV(tx_power2[i]);
+        }
+
+        if (spec->num_channels > 14) {
+                tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A1);
+                tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
+
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].tx_power1 = TXPOWER_A_FROM_DEV(tx_power1[i]);
+                        info[i].tx_power2 = TXPOWER_A_FROM_DEV(tx_power2[i]);
+                }
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2800_probe_hw_mode);
+
+/*
+ * IEEE80211 stack callback functions.
+ */
+static void rt2800_get_tkip_seq(struct ieee80211_hw *hw, u8 hw_key_idx,
+                                u32 *iv32, u16 *iv16)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        struct mac_iveiv_entry iveiv_entry;
+        u32 offset;
+
+        offset = MAC_IVEIV_ENTRY(hw_key_idx);
+        rt2800_register_multiread(rt2x00dev, offset,
+                                      &iveiv_entry, sizeof(iveiv_entry));
+
+        memcpy(iv16, &iveiv_entry.iv[0], sizeof(*iv16));
+        memcpy(iv32, &iveiv_entry.iv[4], sizeof(*iv32));
+}
+
+static int rt2800_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        u32 reg;
+        bool enabled = (value < IEEE80211_MAX_RTS_THRESHOLD);
+
+        rt2800_register_read(rt2x00dev, TX_RTS_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_THRES, value);
+        rt2800_register_write(rt2x00dev, TX_RTS_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, CCK_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_RTS_TH_EN, enabled);
+        rt2800_register_write(rt2x00dev, CCK_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_RTS_TH_EN, enabled);
+        rt2800_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, MM20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_RTS_TH_EN, enabled);
+        rt2800_register_write(rt2x00dev, MM20_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, MM40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_RTS_TH_EN, enabled);
+        rt2800_register_write(rt2x00dev, MM40_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, GF20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_RTS_TH_EN, enabled);
+        rt2800_register_write(rt2x00dev, GF20_PROT_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, GF40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_RTS_TH_EN, enabled);
+        rt2800_register_write(rt2x00dev, GF40_PROT_CFG, reg);
+
+        return 0;
+}
+
+static int rt2800_conf_tx(struct ieee80211_hw *hw, u16 queue_idx,
+                          const struct ieee80211_tx_queue_params *params)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        struct data_queue *queue;
+        struct rt2x00_field32 field;
+        int retval;
+        u32 reg;
+        u32 offset;
+
+        /*
+         * First pass the configuration through rt2x00lib, that will
+         * update the queue settings and validate the input. After that
+         * we are free to update the registers based on the value
+         * in the queue parameter.
+         */
+        retval = rt2x00mac_conf_tx(hw, queue_idx, params);
+        if (retval)
+                return retval;
+
+        /*
+         * We only need to perform additional register initialization
+         * for WMM queues/
+         */
+        if (queue_idx >= 4)
+                return 0;
+
+        queue = rt2x00queue_get_queue(rt2x00dev, queue_idx);
+
+        /* Update WMM TXOP register */
+        offset = WMM_TXOP0_CFG + (sizeof(u32) * (!!(queue_idx & 2)));
+        field.bit_offset = (queue_idx & 1) * 16;
+        field.bit_mask = 0xffff << field.bit_offset;
+
+        rt2800_register_read(rt2x00dev, offset, &reg);
+        rt2x00_set_field32(&reg, field, queue->txop);
+        rt2800_register_write(rt2x00dev, offset, reg);
+
+        /* Update WMM registers */
+        field.bit_offset = queue_idx * 4;
+        field.bit_mask = 0xf << field.bit_offset;
+
+        rt2800_register_read(rt2x00dev, WMM_AIFSN_CFG, &reg);
+        rt2x00_set_field32(&reg, field, queue->aifs);
+        rt2800_register_write(rt2x00dev, WMM_AIFSN_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, WMM_CWMIN_CFG, &reg);
+        rt2x00_set_field32(&reg, field, queue->cw_min);
+        rt2800_register_write(rt2x00dev, WMM_CWMIN_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, WMM_CWMAX_CFG, &reg);
+        rt2x00_set_field32(&reg, field, queue->cw_max);
+        rt2800_register_write(rt2x00dev, WMM_CWMAX_CFG, reg);
+
+        /* Update EDCA registers */
+        offset = EDCA_AC0_CFG + (sizeof(u32) * queue_idx);
+
+        rt2800_register_read(rt2x00dev, offset, &reg);
+        rt2x00_set_field32(&reg, EDCA_AC0_CFG_TX_OP, queue->txop);
+        rt2x00_set_field32(&reg, EDCA_AC0_CFG_AIFSN, queue->aifs);
+        rt2x00_set_field32(&reg, EDCA_AC0_CFG_CWMIN, queue->cw_min);
+        rt2x00_set_field32(&reg, EDCA_AC0_CFG_CWMAX, queue->cw_max);
+        rt2800_register_write(rt2x00dev, offset, reg);
+
+        return 0;
+}
+
+static u64 rt2800_get_tsf(struct ieee80211_hw *hw)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        u64 tsf;
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, TSF_TIMER_DW1, &reg);
+        tsf = (u64) rt2x00_get_field32(reg, TSF_TIMER_DW1_HIGH_WORD) << 32;
+        rt2800_register_read(rt2x00dev, TSF_TIMER_DW0, &reg);
+        tsf |= rt2x00_get_field32(reg, TSF_TIMER_DW0_LOW_WORD);
+
+        return tsf;
+}
+
+const struct ieee80211_ops rt2800_mac80211_ops = {
+        .tx                     = rt2x00mac_tx,
+        .start                  = rt2x00mac_start,
+        .stop                   = rt2x00mac_stop,
+        .add_interface          = rt2x00mac_add_interface,
+        .remove_interface       = rt2x00mac_remove_interface,
+        .config                 = rt2x00mac_config,
+        .configure_filter       = rt2x00mac_configure_filter,
+        .set_tim                = rt2x00mac_set_tim,
+        .set_key                = rt2x00mac_set_key,
+        .get_stats              = rt2x00mac_get_stats,
+        .get_tkip_seq           = rt2800_get_tkip_seq,
+        .set_rts_threshold      = rt2800_set_rts_threshold,
+        .bss_info_changed       = rt2x00mac_bss_info_changed,
+        .conf_tx                = rt2800_conf_tx,
+        .get_tsf                = rt2800_get_tsf,
+        .rfkill_poll            = rt2x00mac_rfkill_poll,
+};
+EXPORT_SYMBOL_GPL(rt2800_mac80211_ops);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.h b/drivers/net/wireless/rt2x00/rt2800lib.h
new file mode 100644
index 000000000000..ebabeae62d1b
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
@@ -0,0 +1,150 @@
+/*
+        Copyright (C) 2009 Bartlomiej Zolnierkiewicz
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#ifndef RT2800LIB_H
+#define RT2800LIB_H
+
+struct rt2800_ops {
+        void (*register_read)(struct rt2x00_dev *rt2x00dev,
+                              const unsigned int offset, u32 *value);
+        void (*register_read_lock)(struct rt2x00_dev *rt2x00dev,
+                                   const unsigned int offset, u32 *value);
+        void (*register_write)(struct rt2x00_dev *rt2x00dev,
+                               const unsigned int offset, u32 value);
+        void (*register_write_lock)(struct rt2x00_dev *rt2x00dev,
+                                    const unsigned int offset, u32 value);
+
+        void (*register_multiread)(struct rt2x00_dev *rt2x00dev,
+                                   const unsigned int offset,
+                                   void *value, const u32 length);
+        void (*register_multiwrite)(struct rt2x00_dev *rt2x00dev,
+                                    const unsigned int offset,
+                                    const void *value, const u32 length);
+
+        int (*regbusy_read)(struct rt2x00_dev *rt2x00dev,
+                            const unsigned int offset,
+                            const struct rt2x00_field32 field, u32 *reg);
+};
+
+static inline void rt2800_register_read(struct rt2x00_dev *rt2x00dev,
+                                        const unsigned int offset,
+                                        u32 *value)
+{
+        const struct rt2800_ops *rt2800ops = rt2x00dev->priv;
+
+        rt2800ops->register_read(rt2x00dev, offset, value);
+}
+
+static inline void rt2800_register_read_lock(struct rt2x00_dev *rt2x00dev,
+                                             const unsigned int offset,
+                                             u32 *value)
+{
+        const struct rt2800_ops *rt2800ops = rt2x00dev->priv;
+
+        rt2800ops->register_read_lock(rt2x00dev, offset, value);
+}
+
+static inline void rt2800_register_write(struct rt2x00_dev *rt2x00dev,
+                                         const unsigned int offset,
+                                         u32 value)
+{
+        const struct rt2800_ops *rt2800ops = rt2x00dev->priv;
+
+        rt2800ops->register_write(rt2x00dev, offset, value);
+}
+
+static inline void rt2800_register_write_lock(struct rt2x00_dev *rt2x00dev,
+                                              const unsigned int offset,
+                                              u32 value)
+{
+        const struct rt2800_ops *rt2800ops = rt2x00dev->priv;
+
+        rt2800ops->register_write_lock(rt2x00dev, offset, value);
+}
+
+static inline void rt2800_register_multiread(struct rt2x00_dev *rt2x00dev,
+                                             const unsigned int offset,
+                                             void *value, const u32 length)
+{
+        const struct rt2800_ops *rt2800ops = rt2x00dev->priv;
+
+        rt2800ops->register_multiread(rt2x00dev, offset, value, length);
+}
+
+static inline void rt2800_register_multiwrite(struct rt2x00_dev *rt2x00dev,
+                                              const unsigned int offset,
+                                              const void *value,
+                                              const u32 length)
+{
+        const struct rt2800_ops *rt2800ops = rt2x00dev->priv;
+
+        rt2800ops->register_multiwrite(rt2x00dev, offset, value, length);
+}
+
+static inline int rt2800_regbusy_read(struct rt2x00_dev *rt2x00dev,
+                                      const unsigned int offset,
+                                      const struct rt2x00_field32 field,
+                                      u32 *reg)
+{
+        const struct rt2800_ops *rt2800ops = rt2x00dev->priv;
+
+        return rt2800ops->regbusy_read(rt2x00dev, offset, field, reg);
+}
+
+void rt2800_mcu_request(struct rt2x00_dev *rt2x00dev,
+                        const u8 command, const u8 token,
+                        const u8 arg0, const u8 arg1);
+
+extern const struct rt2x00debug rt2800_rt2x00debug;
+
+int rt2800_rfkill_poll(struct rt2x00_dev *rt2x00dev);
+int rt2800_config_shared_key(struct rt2x00_dev *rt2x00dev,
+                             struct rt2x00lib_crypto *crypto,
+                             struct ieee80211_key_conf *key);
+int rt2800_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
+                               struct rt2x00lib_crypto *crypto,
+                               struct ieee80211_key_conf *key);
+void rt2800_config_filter(struct rt2x00_dev *rt2x00dev,
+                          const unsigned int filter_flags);
+void rt2800_config_intf(struct rt2x00_dev *rt2x00dev, struct rt2x00_intf *intf,
+                        struct rt2x00intf_conf *conf, const unsigned int flags);
+void rt2800_config_erp(struct rt2x00_dev *rt2x00dev, struct rt2x00lib_erp *erp);
+void rt2800_config_ant(struct rt2x00_dev *rt2x00dev, struct antenna_setup *ant);
+void rt2800_config(struct rt2x00_dev *rt2x00dev,
+                   struct rt2x00lib_conf *libconf,
+                   const unsigned int flags);
+void rt2800_link_stats(struct rt2x00_dev *rt2x00dev, struct link_qual *qual);
+void rt2800_reset_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual);
+void rt2800_link_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual,
+                       const u32 count);
+
+int rt2800_init_registers(struct rt2x00_dev *rt2x00dev);
+int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev);
+int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev);
+int rt2800_wait_wpdma_ready(struct rt2x00_dev *rt2x00dev);
+
+int rt2800_efuse_detect(struct rt2x00_dev *rt2x00dev);
+void rt2800_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev);
+int rt2800_validate_eeprom(struct rt2x00_dev *rt2x00dev);
+int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev);
+int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev);
+
+extern const struct ieee80211_ops rt2800_mac80211_ops;
+
+#endif /* RT2800LIB_H */
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
new file mode 100644
index 000000000000..91cce2d0f6db
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -0,0 +1,1288 @@
+/*
+        Copyright (C) 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2009 Alban Browaeys <prahal@yahoo.com>
+        Copyright (C) 2009 Felix Fietkau <nbd@openwrt.org>
+        Copyright (C) 2009 Luis Correia <luis.f.correia@gmail.com>
+        Copyright (C) 2009 Mattias Nissler <mattias.nissler@gmx.de>
+        Copyright (C) 2009 Mark Asselstine <asselsm@gmail.com>
+        Copyright (C) 2009 Xose Vazquez Perez <xose.vazquez@gmail.com>
+        Copyright (C) 2009 Bart Zolnierkiewicz <bzolnier@gmail.com>
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2800pci
+        Abstract: rt2800pci device specific routines.
+        Supported chipsets: RT2800E & RT2800ED.
+ */
+
+#include <linux/crc-ccitt.h>
+#include <linux/delay.h>
+#include <linux/etherdevice.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/platform_device.h>
+#include <linux/eeprom_93cx6.h>
+
+#include "rt2x00.h"
+#include "rt2x00pci.h"
+#include "rt2x00soc.h"
+#include "rt2800lib.h"
+#include "rt2800.h"
+#include "rt2800pci.h"
+
+/*
+ * Allow hardware encryption to be disabled.
+ */
+static int modparam_nohwcrypt = 1;
+module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
+MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
+
+static void rt2800pci_mcu_status(struct rt2x00_dev *rt2x00dev, const u8 token)
+{
+        unsigned int i;
+        u32 reg;
+
+        for (i = 0; i < 200; i++) {
+                rt2800_register_read(rt2x00dev, H2M_MAILBOX_CID, &reg);
+
+                if ((rt2x00_get_field32(reg, H2M_MAILBOX_CID_CMD0) == token) ||
+                    (rt2x00_get_field32(reg, H2M_MAILBOX_CID_CMD1) == token) ||
+                    (rt2x00_get_field32(reg, H2M_MAILBOX_CID_CMD2) == token) ||
+                    (rt2x00_get_field32(reg, H2M_MAILBOX_CID_CMD3) == token))
+                        break;
+
+                udelay(REGISTER_BUSY_DELAY);
+        }
+
+        if (i == 200)
+                ERROR(rt2x00dev, "MCU request failed, no response from hardware\n");
+
+        rt2800_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
+        rt2800_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
+}
+
+#ifdef CONFIG_RT2800PCI_SOC
+static void rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
+{
+        u32 *base_addr = (u32 *) KSEG1ADDR(0x1F040000); /* XXX for RT3052 */
+
+        memcpy_fromio(rt2x00dev->eeprom, base_addr, EEPROM_SIZE);
+}
+#else
+static inline void rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
+{
+}
+#endif /* CONFIG_RT2800PCI_SOC */
+
+#ifdef CONFIG_RT2800PCI_PCI
+static void rt2800pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
+{
+        struct rt2x00_dev *rt2x00dev = eeprom->data;
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, E2PROM_CSR, &reg);
+
+        eeprom->reg_data_in = !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_IN);
+        eeprom->reg_data_out = !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_OUT);
+        eeprom->reg_data_clock =
+            !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_CLOCK);
+        eeprom->reg_chip_select =
+            !!rt2x00_get_field32(reg, E2PROM_CSR_CHIP_SELECT);
+}
+
+static void rt2800pci_eepromregister_write(struct eeprom_93cx6 *eeprom)
+{
+        struct rt2x00_dev *rt2x00dev = eeprom->data;
+        u32 reg = 0;
+
+        rt2x00_set_field32(&reg, E2PROM_CSR_DATA_IN, !!eeprom->reg_data_in);
+        rt2x00_set_field32(&reg, E2PROM_CSR_DATA_OUT, !!eeprom->reg_data_out);
+        rt2x00_set_field32(&reg, E2PROM_CSR_DATA_CLOCK,
+                           !!eeprom->reg_data_clock);
+        rt2x00_set_field32(&reg, E2PROM_CSR_CHIP_SELECT,
+                           !!eeprom->reg_chip_select);
+
+        rt2800_register_write(rt2x00dev, E2PROM_CSR, reg);
+}
+
+static void rt2800pci_read_eeprom_pci(struct rt2x00_dev *rt2x00dev)
+{
+        struct eeprom_93cx6 eeprom;
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, E2PROM_CSR, &reg);
+
+        eeprom.data = rt2x00dev;
+        eeprom.register_read = rt2800pci_eepromregister_read;
+        eeprom.register_write = rt2800pci_eepromregister_write;
+        eeprom.width = !rt2x00_get_field32(reg, E2PROM_CSR_TYPE) ?
+            PCI_EEPROM_WIDTH_93C46 : PCI_EEPROM_WIDTH_93C66;
+        eeprom.reg_data_in = 0;
+        eeprom.reg_data_out = 0;
+        eeprom.reg_data_clock = 0;
+        eeprom.reg_chip_select = 0;
+
+        eeprom_93cx6_multiread(&eeprom, EEPROM_BASE, rt2x00dev->eeprom,
+                               EEPROM_SIZE / sizeof(u16));
+}
+
+static int rt2800pci_efuse_detect(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2800_efuse_detect(rt2x00dev);
+}
+
+static inline void rt2800pci_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_read_eeprom_efuse(rt2x00dev);
+}
+#else
+static inline void rt2800pci_read_eeprom_pci(struct rt2x00_dev *rt2x00dev)
+{
+}
+
+static inline int rt2800pci_efuse_detect(struct rt2x00_dev *rt2x00dev)
+{
+        return 0;
+}
+
+static inline void rt2800pci_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev)
+{
+}
+#endif /* CONFIG_RT2800PCI_PCI */
+
+/*
+ * Firmware functions
+ */
+static char *rt2800pci_get_firmware_name(struct rt2x00_dev *rt2x00dev)
+{
+        return FIRMWARE_RT2860;
+}
+
+static int rt2800pci_check_firmware(struct rt2x00_dev *rt2x00dev,
+                                    const u8 *data, const size_t len)
+{
+        u16 fw_crc;
+        u16 crc;
+
+        /*
+         * Only support 8kb firmware files.
+         */
+        if (len != 8192)
+                return FW_BAD_LENGTH;
+
+        /*
+         * The last 2 bytes in the firmware array are the crc checksum itself,
+         * this means that we should never pass those 2 bytes to the crc
+         * algorithm.
+         */
+        fw_crc = (data[len - 2] << 8 | data[len - 1]);
+
+        /*
+         * Use the crc ccitt algorithm.
+         * This will return the same value as the legacy driver which
+         * used bit ordering reversion on the both the firmware bytes
+         * before input input as well as on the final output.
+         * Obviously using crc ccitt directly is much more efficient.
+         */
+        crc = crc_ccitt(~0, data, len - 2);
+
+        /*
+         * There is a small difference between the crc-itu-t + bitrev and
+         * the crc-ccitt crc calculation. In the latter method the 2 bytes
+         * will be swapped, use swab16 to convert the crc to the correct
+         * value.
+         */
+        crc = swab16(crc);
+
+        return (fw_crc == crc) ? FW_OK : FW_BAD_CRC;
+}
+
+static int rt2800pci_load_firmware(struct rt2x00_dev *rt2x00dev,
+                                   const u8 *data, const size_t len)
+{
+        unsigned int i;
+        u32 reg;
+
+        /*
+         * Wait for stable hardware.
+         */
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2800_register_read(rt2x00dev, MAC_CSR0, &reg);
+                if (reg && reg != ~0)
+                        break;
+                msleep(1);
+        }
+
+        if (i == REGISTER_BUSY_COUNT) {
+                ERROR(rt2x00dev, "Unstable hardware.\n");
+                return -EBUSY;
+        }
+
+        rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000002);
+        rt2800_register_write(rt2x00dev, AUTOWAKEUP_CFG, 0x00000000);
+
+        /*
+         * Disable DMA, will be reenabled later when enabling
+         * the radio.
+         */
+        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
+        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+        /*
+         * enable Host program ram write selection
+         */
+        reg = 0;
+        rt2x00_set_field32(&reg, PBF_SYS_CTRL_HOST_RAM_WRITE, 1);
+        rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, reg);
+
+        /*
+         * Write firmware to device.
+         */
+        rt2800_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
+                                      data, len);
+
+        rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000);
+        rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00001);
+
+        /*
+         * Wait for device to stabilize.
+         */
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2800_register_read(rt2x00dev, PBF_SYS_CTRL, &reg);
+                if (rt2x00_get_field32(reg, PBF_SYS_CTRL_READY))
+                        break;
+                msleep(1);
+        }
+
+        if (i == REGISTER_BUSY_COUNT) {
+                ERROR(rt2x00dev, "PBF system register not ready.\n");
+                return -EBUSY;
+        }
+
+        /*
+         * Disable interrupts
+         */
+        rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_RADIO_IRQ_OFF);
+
+        /*
+         * Initialize BBP R/W access agent
+         */
+        rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+        rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+
+        return 0;
+}
+
+/*
+ * Initialization functions.
+ */
+static bool rt2800pci_get_entry_state(struct queue_entry *entry)
+{
+        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        u32 word;
+
+        if (entry->queue->qid == QID_RX) {
+                rt2x00_desc_read(entry_priv->desc, 1, &word);
+
+                return (!rt2x00_get_field32(word, RXD_W1_DMA_DONE));
+        } else {
+                rt2x00_desc_read(entry_priv->desc, 1, &word);
+
+                return (!rt2x00_get_field32(word, TXD_W1_DMA_DONE));
+        }
+}
+
+static void rt2800pci_clear_entry(struct queue_entry *entry)
+{
+        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        u32 word;
+
+        if (entry->queue->qid == QID_RX) {
+                rt2x00_desc_read(entry_priv->desc, 0, &word);
+                rt2x00_set_field32(&word, RXD_W0_SDP0, skbdesc->skb_dma);
+                rt2x00_desc_write(entry_priv->desc, 0, word);
+
+                rt2x00_desc_read(entry_priv->desc, 1, &word);
+                rt2x00_set_field32(&word, RXD_W1_DMA_DONE, 0);
+                rt2x00_desc_write(entry_priv->desc, 1, word);
+        } else {
+                rt2x00_desc_read(entry_priv->desc, 1, &word);
+                rt2x00_set_field32(&word, TXD_W1_DMA_DONE, 1);
+                rt2x00_desc_write(entry_priv->desc, 1, word);
+        }
+}
+
+static int rt2800pci_init_queues(struct rt2x00_dev *rt2x00dev)
+{
+        struct queue_entry_priv_pci *entry_priv;
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX2, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX3, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX4, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX5, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DRX_IDX0, 1);
+        rt2800_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
+
+        rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e1f);
+        rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e00);
+
+        /*
+         * Initialize registers.
+         */
+        entry_priv = rt2x00dev->tx[0].entries[0].priv_data;
+        rt2800_register_write(rt2x00dev, TX_BASE_PTR0, entry_priv->desc_dma);
+        rt2800_register_write(rt2x00dev, TX_MAX_CNT0, rt2x00dev->tx[0].limit);
+        rt2800_register_write(rt2x00dev, TX_CTX_IDX0, 0);
+        rt2800_register_write(rt2x00dev, TX_DTX_IDX0, 0);
+
+        entry_priv = rt2x00dev->tx[1].entries[0].priv_data;
+        rt2800_register_write(rt2x00dev, TX_BASE_PTR1, entry_priv->desc_dma);
+        rt2800_register_write(rt2x00dev, TX_MAX_CNT1, rt2x00dev->tx[1].limit);
+        rt2800_register_write(rt2x00dev, TX_CTX_IDX1, 0);
+        rt2800_register_write(rt2x00dev, TX_DTX_IDX1, 0);
+
+        entry_priv = rt2x00dev->tx[2].entries[0].priv_data;
+        rt2800_register_write(rt2x00dev, TX_BASE_PTR2, entry_priv->desc_dma);
+        rt2800_register_write(rt2x00dev, TX_MAX_CNT2, rt2x00dev->tx[2].limit);
+        rt2800_register_write(rt2x00dev, TX_CTX_IDX2, 0);
+        rt2800_register_write(rt2x00dev, TX_DTX_IDX2, 0);
+
+        entry_priv = rt2x00dev->tx[3].entries[0].priv_data;
+        rt2800_register_write(rt2x00dev, TX_BASE_PTR3, entry_priv->desc_dma);
+        rt2800_register_write(rt2x00dev, TX_MAX_CNT3, rt2x00dev->tx[3].limit);
+        rt2800_register_write(rt2x00dev, TX_CTX_IDX3, 0);
+        rt2800_register_write(rt2x00dev, TX_DTX_IDX3, 0);
+
+        entry_priv = rt2x00dev->rx->entries[0].priv_data;
+        rt2800_register_write(rt2x00dev, RX_BASE_PTR, entry_priv->desc_dma);
+        rt2800_register_write(rt2x00dev, RX_MAX_CNT, rt2x00dev->rx[0].limit);
+        rt2800_register_write(rt2x00dev, RX_CRX_IDX, rt2x00dev->rx[0].limit - 1);
+        rt2800_register_write(rt2x00dev, RX_DRX_IDX, 0);
+
+        /*
+         * Enable global DMA configuration
+         */
+        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
+        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+        rt2800_register_write(rt2x00dev, DELAY_INT_CFG, 0);
+
+        return 0;
+}
+
+/*
+ * Device state switch handlers.
+ */
+static void rt2800pci_toggle_rx(struct rt2x00_dev *rt2x00dev,
+                                enum dev_state state)
+{
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX,
+                           (state == STATE_RADIO_RX_ON) ||
+                           (state == STATE_RADIO_RX_ON_LINK));
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+}
+
+static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
+                                 enum dev_state state)
+{
+        int mask = (state == STATE_RADIO_IRQ_ON);
+        u32 reg;
+
+        /*
+         * When interrupts are being enabled, the interrupt registers
+         * should clear the register to assure a clean state.
+         */
+        if (state == STATE_RADIO_IRQ_ON) {
+                rt2800_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
+                rt2800_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
+        }
+
+        rt2800_register_read(rt2x00dev, INT_MASK_CSR, &reg);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RXDELAYINT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_TXDELAYINT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RX_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC0_DMA_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC1_DMA_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC2_DMA_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC3_DMA_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_HCCA_DMA_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_MGMT_DMA_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_MCU_COMMAND, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RXTX_COHERENT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_TBTT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_PRE_TBTT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_TX_FIFO_STATUS, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AUTO_WAKEUP, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_GPTIMER, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RX_COHERENT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_TX_COHERENT, mask);
+        rt2800_register_write(rt2x00dev, INT_MASK_CSR, reg);
+}
+
+static int rt2800pci_enable_radio(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        u16 word;
+
+        /*
+         * Initialize all registers.
+         */
+        if (unlikely(rt2800_wait_wpdma_ready(rt2x00dev) ||
+                     rt2800pci_init_queues(rt2x00dev) ||
+                     rt2800_init_registers(rt2x00dev) ||
+                     rt2800_wait_wpdma_ready(rt2x00dev) ||
+                     rt2800_init_bbp(rt2x00dev) ||
+                     rt2800_init_rfcsr(rt2x00dev)))
+                return -EIO;
+
+        /*
+         * Send signal to firmware during boot time.
+         */
+        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0xff, 0, 0);
+
+        /*
+         * Enable RX.
+         */
+        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 0);
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 1);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 1);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_WP_DMA_BURST_SIZE, 2);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
+        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 1);
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        /*
+         * Initialize LED control
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED1, &word);
+        rt2800_mcu_request(rt2x00dev, MCU_LED_1, 0xff,
+                              word & 0xff, (word >> 8) & 0xff);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED2, &word);
+        rt2800_mcu_request(rt2x00dev, MCU_LED_2, 0xff,
+                              word & 0xff, (word >> 8) & 0xff);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED3, &word);
+        rt2800_mcu_request(rt2x00dev, MCU_LED_3, 0xff,
+                              word & 0xff, (word >> 8) & 0xff);
+
+        return 0;
+}
+
+static void rt2800pci_disable_radio(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
+        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0);
+        rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0);
+        rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0);
+
+        rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00001280);
+
+        rt2800_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX2, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX3, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX4, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX5, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DRX_IDX0, 1);
+        rt2800_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
+
+        rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e1f);
+        rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e00);
+
+        /* Wait for DMA, ignore error */
+        rt2800_wait_wpdma_ready(rt2x00dev);
+}
+
+static int rt2800pci_set_state(struct rt2x00_dev *rt2x00dev,
+                               enum dev_state state)
+{
+        /*
+         * Always put the device to sleep (even when we intend to wakeup!)
+         * if the device is booting and wasn't asleep it will return
+         * failure when attempting to wakeup.
+         */
+        rt2800_mcu_request(rt2x00dev, MCU_SLEEP, 0xff, 0, 2);
+
+        if (state == STATE_AWAKE) {
+                rt2800_mcu_request(rt2x00dev, MCU_WAKEUP, TOKEN_WAKUP, 0, 0);
+                rt2800pci_mcu_status(rt2x00dev, TOKEN_WAKUP);
+        }
+
+        return 0;
+}
+
+static int rt2800pci_set_device_state(struct rt2x00_dev *rt2x00dev,
+                                      enum dev_state state)
+{
+        int retval = 0;
+
+        switch (state) {
+        case STATE_RADIO_ON:
+                /*
+                 * Before the radio can be enabled, the device first has
+                 * to be woken up. After that it needs a bit of time
+                 * to be fully awake and then the radio can be enabled.
+                 */
+                rt2800pci_set_state(rt2x00dev, STATE_AWAKE);
+                msleep(1);
+                retval = rt2800pci_enable_radio(rt2x00dev);
+                break;
+        case STATE_RADIO_OFF:
+                /*
+                 * After the radio has been disabled, the device should
+                 * be put to sleep for powersaving.
+                 */
+                rt2800pci_disable_radio(rt2x00dev);
+                rt2800pci_set_state(rt2x00dev, STATE_SLEEP);
+                break;
+        case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+        case STATE_RADIO_RX_OFF:
+        case STATE_RADIO_RX_OFF_LINK:
+                rt2800pci_toggle_rx(rt2x00dev, state);
+                break;
+        case STATE_RADIO_IRQ_ON:
+        case STATE_RADIO_IRQ_OFF:
+                rt2800pci_toggle_irq(rt2x00dev, state);
+                break;
+        case STATE_DEEP_SLEEP:
+        case STATE_SLEEP:
+        case STATE_STANDBY:
+        case STATE_AWAKE:
+                retval = rt2800pci_set_state(rt2x00dev, state);
+                break;
+        default:
+                retval = -ENOTSUPP;
+                break;
+        }
+
+        if (unlikely(retval))
+                ERROR(rt2x00dev, "Device failed to enter state %d (%d).\n",
+                      state, retval);
+
+        return retval;
+}
+
+/*
+ * TX descriptor initialization
+ */
+static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
+                                    struct sk_buff *skb,
+                                    struct txentry_desc *txdesc)
+{
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
+        __le32 *txd = skbdesc->desc;
+        __le32 *txwi = (__le32 *)(skb->data - rt2x00dev->ops->extra_tx_headroom);
+        u32 word;
+
+        /*
+         * Initialize TX Info descriptor
+         */
+        rt2x00_desc_read(txwi, 0, &word);
+        rt2x00_set_field32(&word, TXWI_W0_FRAG,
+                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_MIMO_PS, 0);
+        rt2x00_set_field32(&word, TXWI_W0_CF_ACK, 0);
+        rt2x00_set_field32(&word, TXWI_W0_TS,
+                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_AMPDU,
+                           test_bit(ENTRY_TXD_HT_AMPDU, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_MPDU_DENSITY, txdesc->mpdu_density);
+        rt2x00_set_field32(&word, TXWI_W0_TX_OP, txdesc->ifs);
+        rt2x00_set_field32(&word, TXWI_W0_MCS, txdesc->mcs);
+        rt2x00_set_field32(&word, TXWI_W0_BW,
+                           test_bit(ENTRY_TXD_HT_BW_40, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_SHORT_GI,
+                           test_bit(ENTRY_TXD_HT_SHORT_GI, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_STBC, txdesc->stbc);
+        rt2x00_set_field32(&word, TXWI_W0_PHYMODE, txdesc->rate_mode);
+        rt2x00_desc_write(txwi, 0, word);
+
+        rt2x00_desc_read(txwi, 1, &word);
+        rt2x00_set_field32(&word, TXWI_W1_ACK,
+                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W1_NSEQ,
+                           test_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W1_BW_WIN_SIZE, txdesc->ba_size);
+        rt2x00_set_field32(&word, TXWI_W1_WIRELESS_CLI_ID,
+                           test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags) ?
+                           txdesc->key_idx : 0xff);
+        rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
+                           skb->len - txdesc->l2pad);
+        rt2x00_set_field32(&word, TXWI_W1_PACKETID,
+                           skbdesc->entry->queue->qid + 1);
+        rt2x00_desc_write(txwi, 1, word);
+
+        /*
+         * Always write 0 to IV/EIV fields, hardware will insert the IV
+         * from the IVEIV register when TXD_W3_WIV is set to 0.
+         * When TXD_W3_WIV is set to 1 it will use the IV data
+         * from the descriptor. The TXWI_W1_WIRELESS_CLI_ID indicates which
+         * crypto entry in the registers should be used to encrypt the frame.
+         */
+        _rt2x00_desc_write(txwi, 2, 0 /* skbdesc->iv[0] */);
+        _rt2x00_desc_write(txwi, 3, 0 /* skbdesc->iv[1] */);
+
+        /*
+         * The buffers pointed by SD_PTR0/SD_LEN0 and SD_PTR1/SD_LEN1
+         * must contains a TXWI structure + 802.11 header + padding + 802.11
+         * data. We choose to have SD_PTR0/SD_LEN0 only contains TXWI and
+         * SD_PTR1/SD_LEN1 contains 802.11 header + padding + 802.11
+         * data. It means that LAST_SEC0 is always 0.
+         */
+
+        /*
+         * Initialize TX descriptor
+         */
+        rt2x00_desc_read(txd, 0, &word);
+        rt2x00_set_field32(&word, TXD_W0_SD_PTR0, skbdesc->skb_dma);
+        rt2x00_desc_write(txd, 0, word);
+
+        rt2x00_desc_read(txd, 1, &word);
+        rt2x00_set_field32(&word, TXD_W1_SD_LEN1, skb->len);
+        rt2x00_set_field32(&word, TXD_W1_LAST_SEC1,
+                           !test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W1_BURST,
+                           test_bit(ENTRY_TXD_BURST, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W1_SD_LEN0,
+                           rt2x00dev->ops->extra_tx_headroom);
+        rt2x00_set_field32(&word, TXD_W1_LAST_SEC0, 0);
+        rt2x00_set_field32(&word, TXD_W1_DMA_DONE, 0);
+        rt2x00_desc_write(txd, 1, word);
+
+        rt2x00_desc_read(txd, 2, &word);
+        rt2x00_set_field32(&word, TXD_W2_SD_PTR1,
+                           skbdesc->skb_dma + rt2x00dev->ops->extra_tx_headroom);
+        rt2x00_desc_write(txd, 2, word);
+
+        rt2x00_desc_read(txd, 3, &word);
+        rt2x00_set_field32(&word, TXD_W3_WIV,
+                           !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W3_QSEL, 2);
+        rt2x00_desc_write(txd, 3, word);
+}
+
+/*
+ * TX data initialization
+ */
+static void rt2800pci_write_beacon(struct queue_entry *entry)
+{
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        unsigned int beacon_base;
+        u32 reg;
+
+        /*
+         * Disable beaconing while we are reloading the beacon data,
+         * otherwise we might be sending out invalid data.
+         */
+        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
+        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+
+        /*
+         * Write entire beacon with descriptor to register.
+         */
+        beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
+        rt2800_register_multiwrite(rt2x00dev,
+                                      beacon_base,
+                                      skbdesc->desc, skbdesc->desc_len);
+        rt2800_register_multiwrite(rt2x00dev,
+                                      beacon_base + skbdesc->desc_len,
+                                      entry->skb->data, entry->skb->len);
+
+        /*
+         * Clean up beacon skb.
+         */
+        dev_kfree_skb_any(entry->skb);
+        entry->skb = NULL;
+}
+
+static void rt2800pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
+                                    const enum data_queue_qid queue_idx)
+{
+        struct data_queue *queue;
+        unsigned int idx, qidx = 0;
+        u32 reg;
+
+        if (queue_idx == QID_BEACON) {
+                rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+                if (!rt2x00_get_field32(reg, BCN_TIME_CFG_BEACON_GEN)) {
+                        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
+                        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
+                        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
+                        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+                }
+                return;
+        }
+
+        if (queue_idx > QID_HCCA && queue_idx != QID_MGMT)
+                return;
+
+        queue = rt2x00queue_get_queue(rt2x00dev, queue_idx);
+        idx = queue->index[Q_INDEX];
+
+        if (queue_idx == QID_MGMT)
+                qidx = 5;
+        else
+                qidx = queue_idx;
+
+        rt2800_register_write(rt2x00dev, TX_CTX_IDX(qidx), idx);
+}
+
+static void rt2800pci_kill_tx_queue(struct rt2x00_dev *rt2x00dev,
+                                    const enum data_queue_qid qid)
+{
+        u32 reg;
+
+        if (qid == QID_BEACON) {
+                rt2800_register_write(rt2x00dev, BCN_TIME_CFG, 0);
+                return;
+        }
+
+        rt2800_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, (qid == QID_AC_BE));
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, (qid == QID_AC_BK));
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX2, (qid == QID_AC_VI));
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX3, (qid == QID_AC_VO));
+        rt2800_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
+}
+
+/*
+ * RX control handlers
+ */
+static void rt2800pci_fill_rxdone(struct queue_entry *entry,
+                                  struct rxdone_entry_desc *rxdesc)
+{
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        __le32 *rxd = entry_priv->desc;
+        __le32 *rxwi = (__le32 *)entry->skb->data;
+        u32 rxd3;
+        u32 rxwi0;
+        u32 rxwi1;
+        u32 rxwi2;
+        u32 rxwi3;
+
+        rt2x00_desc_read(rxd, 3, &rxd3);
+        rt2x00_desc_read(rxwi, 0, &rxwi0);
+        rt2x00_desc_read(rxwi, 1, &rxwi1);
+        rt2x00_desc_read(rxwi, 2, &rxwi2);
+        rt2x00_desc_read(rxwi, 3, &rxwi3);
+
+        if (rt2x00_get_field32(rxd3, RXD_W3_CRC_ERROR))
+                rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
+
+        if (test_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags)) {
+                /*
+                 * Unfortunately we don't know the cipher type used during
+                 * decryption. This prevents us from correct providing
+                 * correct statistics through debugfs.
+                 */
+                rxdesc->cipher = rt2x00_get_field32(rxwi0, RXWI_W0_UDF);
+                rxdesc->cipher_status =
+                    rt2x00_get_field32(rxd3, RXD_W3_CIPHER_ERROR);
+        }
+
+        if (rt2x00_get_field32(rxd3, RXD_W3_DECRYPTED)) {
+                /*
+                 * Hardware has stripped IV/EIV data from 802.11 frame during
+                 * decryption. Unfortunately the descriptor doesn't contain
+                 * any fields with the EIV/IV data either, so they can't
+                 * be restored by rt2x00lib.
+                 */
+                rxdesc->flags |= RX_FLAG_IV_STRIPPED;
+
+                if (rxdesc->cipher_status == RX_CRYPTO_SUCCESS)
+                        rxdesc->flags |= RX_FLAG_DECRYPTED;
+                else if (rxdesc->cipher_status == RX_CRYPTO_FAIL_MIC)
+                        rxdesc->flags |= RX_FLAG_MMIC_ERROR;
+        }
+
+        if (rt2x00_get_field32(rxd3, RXD_W3_MY_BSS))
+                rxdesc->dev_flags |= RXDONE_MY_BSS;
+
+        if (rt2x00_get_field32(rxd3, RXD_W3_L2PAD))
+                rxdesc->dev_flags |= RXDONE_L2PAD;
+
+        if (rt2x00_get_field32(rxwi1, RXWI_W1_SHORT_GI))
+                rxdesc->flags |= RX_FLAG_SHORT_GI;
+
+        if (rt2x00_get_field32(rxwi1, RXWI_W1_BW))
+                rxdesc->flags |= RX_FLAG_40MHZ;
+
+        /*
+         * Detect RX rate, always use MCS as signal type.
+         */
+        rxdesc->dev_flags |= RXDONE_SIGNAL_MCS;
+        rxdesc->rate_mode = rt2x00_get_field32(rxwi1, RXWI_W1_PHYMODE);
+        rxdesc->signal = rt2x00_get_field32(rxwi1, RXWI_W1_MCS);
+
+        /*
+         * Mask of 0x8 bit to remove the short preamble flag.
+         */
+        if (rxdesc->rate_mode == RATE_MODE_CCK)
+                rxdesc->signal &= ~0x8;
+
+        rxdesc->rssi =
+            (rt2x00_get_field32(rxwi2, RXWI_W2_RSSI0) +
+             rt2x00_get_field32(rxwi2, RXWI_W2_RSSI1)) / 2;
+
+        rxdesc->noise =
+            (rt2x00_get_field32(rxwi3, RXWI_W3_SNR0) +
+             rt2x00_get_field32(rxwi3, RXWI_W3_SNR1)) / 2;
+
+        rxdesc->size = rt2x00_get_field32(rxwi0, RXWI_W0_MPDU_TOTAL_BYTE_COUNT);
+
+        /*
+         * Set RX IDX in register to inform hardware that we have handled
+         * this entry and it is available for reuse again.
+         */
+        rt2800_register_write(rt2x00dev, RX_CRX_IDX, entry->entry_idx);
+
+        /*
+         * Remove TXWI descriptor from start of buffer.
+         */
+        skb_pull(entry->skb, RXWI_DESC_SIZE);
+}
+
+/*
+ * Interrupt functions.
+ */
+static void rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+        struct queue_entry *entry;
+        struct queue_entry *entry_done;
+        struct queue_entry_priv_pci *entry_priv;
+        struct txdone_entry_desc txdesc;
+        u32 word;
+        u32 reg;
+        u32 old_reg;
+        unsigned int type;
+        unsigned int index;
+        u16 mcs, real_mcs;
+
+        /*
+         * During each loop we will compare the freshly read
+         * TX_STA_FIFO register value with the value read from
+         * the previous loop. If the 2 values are equal then
+         * we should stop processing because the chance it
+         * quite big that the device has been unplugged and
+         * we risk going into an endless loop.
+         */
+        old_reg = 0;
+
+        while (1) {
+                rt2800_register_read(rt2x00dev, TX_STA_FIFO, &reg);
+                if (!rt2x00_get_field32(reg, TX_STA_FIFO_VALID))
+                        break;
+
+                if (old_reg == reg)
+                        break;
+                old_reg = reg;
+
+                /*
+                 * Skip this entry when it contains an invalid
+                 * queue identication number.
+                 */
+                type = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE) - 1;
+                if (type >= QID_RX)
+                        continue;
+
+                queue = rt2x00queue_get_queue(rt2x00dev, type);
+                if (unlikely(!queue))
+                        continue;
+
+                /*
+                 * Skip this entry when it contains an invalid
+                 * index number.
+                 */
+                index = rt2x00_get_field32(reg, TX_STA_FIFO_WCID) - 1;
+                if (unlikely(index >= queue->limit))
+                        continue;
+
+                entry = &queue->entries[index];
+                entry_priv = entry->priv_data;
+                rt2x00_desc_read((__le32 *)entry->skb->data, 0, &word);
+
+                entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+                while (entry != entry_done) {
+                        /*
+                         * Catch up.
+                         * Just report any entries we missed as failed.
+                         */
+                        WARNING(rt2x00dev,
+                                "TX status report missed for entry %d\n",
+                                entry_done->entry_idx);
+
+                        txdesc.flags = 0;
+                        __set_bit(TXDONE_UNKNOWN, &txdesc.flags);
+                        txdesc.retry = 0;
+
+                        rt2x00lib_txdone(entry_done, &txdesc);
+                        entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+                }
+
+                /*
+                 * Obtain the status about this packet.
+                 */
+                txdesc.flags = 0;
+                if (rt2x00_get_field32(reg, TX_STA_FIFO_TX_SUCCESS))
+                        __set_bit(TXDONE_SUCCESS, &txdesc.flags);
+                else
+                        __set_bit(TXDONE_FAILURE, &txdesc.flags);
+
+                /*
+                 * Ralink has a retry mechanism using a global fallback
+                 * table. We setup this fallback table to try immediate
+                 * lower rate for all rates. In the TX_STA_FIFO,
+                 * the MCS field contains the MCS used for the successfull
+                 * transmission. If the first transmission succeed,
+                 * we have mcs == tx_mcs. On the second transmission,
+                 * we have mcs = tx_mcs - 1. So the number of
+                 * retry is (tx_mcs - mcs).
+                 */
+                mcs = rt2x00_get_field32(word, TXWI_W0_MCS);
+                real_mcs = rt2x00_get_field32(reg, TX_STA_FIFO_MCS);
+                __set_bit(TXDONE_FALLBACK, &txdesc.flags);
+                txdesc.retry = mcs - min(mcs, real_mcs);
+
+                rt2x00lib_txdone(entry, &txdesc);
+        }
+}
+
+static irqreturn_t rt2800pci_interrupt(int irq, void *dev_instance)
+{
+        struct rt2x00_dev *rt2x00dev = dev_instance;
+        u32 reg;
+
+        /* Read status and ACK all interrupts */
+        rt2800_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
+        rt2800_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
+
+        if (!reg)
+                return IRQ_NONE;
+
+        if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+                return IRQ_HANDLED;
+
+        /*
+         * 1 - Rx ring done interrupt.
+         */
+        if (rt2x00_get_field32(reg, INT_SOURCE_CSR_RX_DONE))
+                rt2x00pci_rxdone(rt2x00dev);
+
+        if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS))
+                rt2800pci_txdone(rt2x00dev);
+
+        return IRQ_HANDLED;
+}
+
+/*
+ * Device probe functions.
+ */
+static int rt2800pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
+{
+        /*
+         * Read EEPROM into buffer
+         */
+        if (rt2x00_is_soc(rt2x00dev))
+                rt2800pci_read_eeprom_soc(rt2x00dev);
+        else if (rt2800pci_efuse_detect(rt2x00dev))
+                rt2800pci_read_eeprom_efuse(rt2x00dev);
+        else
+                rt2800pci_read_eeprom_pci(rt2x00dev);
+
+        return rt2800_validate_eeprom(rt2x00dev);
+}
+
+static const struct rt2800_ops rt2800pci_rt2800_ops = {
+        .register_read          = rt2x00pci_register_read,
+        .register_read_lock     = rt2x00pci_register_read, /* same for PCI */
+        .register_write         = rt2x00pci_register_write,
+        .register_write_lock    = rt2x00pci_register_write, /* same for PCI */
+
+        .register_multiread     = rt2x00pci_register_multiread,
+        .register_multiwrite    = rt2x00pci_register_multiwrite,
+
+        .regbusy_read           = rt2x00pci_regbusy_read,
+};
+
+static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
+{
+        int retval;
+
+        rt2x00dev->priv = (void *)&rt2800pci_rt2800_ops;
+
+        /*
+         * Allocate eeprom data.
+         */
+        retval = rt2800pci_validate_eeprom(rt2x00dev);
+        if (retval)
+                return retval;
+
+        retval = rt2800_init_eeprom(rt2x00dev);
+        if (retval)
+                return retval;
+
+        /*
+         * Initialize hw specifications.
+         */
+        retval = rt2800_probe_hw_mode(rt2x00dev);
+        if (retval)
+                return retval;
+
+        /*
+         * This device has multiple filters for control frames
+         * and has a separate filter for PS Poll frames.
+         */
+        __set_bit(DRIVER_SUPPORT_CONTROL_FILTERS, &rt2x00dev->flags);
+        __set_bit(DRIVER_SUPPORT_CONTROL_FILTER_PSPOLL, &rt2x00dev->flags);
+
+        /*
+         * This device requires firmware.
+         */
+        if (!rt2x00_is_soc(rt2x00dev))
+                __set_bit(DRIVER_REQUIRE_FIRMWARE, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags);
+        if (!modparam_nohwcrypt)
+                __set_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags);
+
+        /*
+         * Set the rssi offset.
+         */
+        rt2x00dev->rssi_offset = DEFAULT_RSSI_OFFSET;
+
+        return 0;
+}
+
+static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
+        .irq_handler            = rt2800pci_interrupt,
+        .probe_hw               = rt2800pci_probe_hw,
+        .get_firmware_name      = rt2800pci_get_firmware_name,
+        .check_firmware         = rt2800pci_check_firmware,
+        .load_firmware          = rt2800pci_load_firmware,
+        .initialize             = rt2x00pci_initialize,
+        .uninitialize           = rt2x00pci_uninitialize,
+        .get_entry_state        = rt2800pci_get_entry_state,
+        .clear_entry            = rt2800pci_clear_entry,
+        .set_device_state       = rt2800pci_set_device_state,
+        .rfkill_poll            = rt2800_rfkill_poll,
+        .link_stats             = rt2800_link_stats,
+        .reset_tuner            = rt2800_reset_tuner,
+        .link_tuner             = rt2800_link_tuner,
+        .write_tx_desc          = rt2800pci_write_tx_desc,
+        .write_tx_data          = rt2x00pci_write_tx_data,
+        .write_beacon           = rt2800pci_write_beacon,
+        .kick_tx_queue          = rt2800pci_kick_tx_queue,
+        .kill_tx_queue          = rt2800pci_kill_tx_queue,
+        .fill_rxdone            = rt2800pci_fill_rxdone,
+        .config_shared_key      = rt2800_config_shared_key,
+        .config_pairwise_key    = rt2800_config_pairwise_key,
+        .config_filter          = rt2800_config_filter,
+        .config_intf            = rt2800_config_intf,
+        .config_erp             = rt2800_config_erp,
+        .config_ant             = rt2800_config_ant,
+        .config                 = rt2800_config,
+};
+
+static const struct data_queue_desc rt2800pci_queue_rx = {
+        .entry_num              = RX_ENTRIES,
+        .data_size              = AGGREGATION_SIZE,
+        .desc_size              = RXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci),
+};
+
+static const struct data_queue_desc rt2800pci_queue_tx = {
+        .entry_num              = TX_ENTRIES,
+        .data_size              = AGGREGATION_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci),
+};
+
+static const struct data_queue_desc rt2800pci_queue_bcn = {
+        .entry_num              = 8 * BEACON_ENTRIES,
+        .data_size              = 0, /* No DMA required for beacons */
+        .desc_size              = TXWI_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci),
+};
+
+static const struct rt2x00_ops rt2800pci_ops = {
+        .name                   = KBUILD_MODNAME,
+        .max_sta_intf           = 1,
+        .max_ap_intf            = 8,
+        .eeprom_size            = EEPROM_SIZE,
+        .rf_size                = RF_SIZE,
+        .tx_queues              = NUM_TX_QUEUES,
+        .extra_tx_headroom      = TXWI_DESC_SIZE,
+        .rx                     = &rt2800pci_queue_rx,
+        .tx                     = &rt2800pci_queue_tx,
+        .bcn                    = &rt2800pci_queue_bcn,
+        .lib                    = &rt2800pci_rt2x00_ops,
+        .hw                     = &rt2800_mac80211_ops,
+#ifdef CONFIG_RT2X00_LIB_DEBUGFS
+        .debugfs                = &rt2800_rt2x00debug,
+#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
+};
+
+/*
+ * RT2800pci module information.
+ */
+static DEFINE_PCI_DEVICE_TABLE(rt2800pci_device_table) = {
+        { PCI_DEVICE(0x1814, 0x0601), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x0681), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x0701), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x0781), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7708), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7727), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7728), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7738), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7748), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7758), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7768), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1a3b, 0x1059), PCI_DEVICE_DATA(&rt2800pci_ops) },
+#ifdef CONFIG_RT2800PCI_RT30XX
+        { PCI_DEVICE(0x1814, 0x3090), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3091), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3092), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1462, 0x891a), PCI_DEVICE_DATA(&rt2800pci_ops) },
+#endif
+#ifdef CONFIG_RT2800PCI_RT35XX
+        { PCI_DEVICE(0x1814, 0x3060), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3062), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3562), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3592), PCI_DEVICE_DATA(&rt2800pci_ops) },
+#endif
+        { 0, }
+};
+
+MODULE_AUTHOR(DRV_PROJECT);
+MODULE_VERSION(DRV_VERSION);
+MODULE_DESCRIPTION("Ralink RT2800 PCI & PCMCIA Wireless LAN driver.");
+MODULE_SUPPORTED_DEVICE("Ralink RT2860 PCI & PCMCIA chipset based cards");
+#ifdef CONFIG_RT2800PCI_PCI
+MODULE_FIRMWARE(FIRMWARE_RT2860);
+MODULE_DEVICE_TABLE(pci, rt2800pci_device_table);
+#endif /* CONFIG_RT2800PCI_PCI */
+MODULE_LICENSE("GPL");
+
+#ifdef CONFIG_RT2800PCI_SOC
+static int rt2800soc_probe(struct platform_device *pdev)
+{
+        return rt2x00soc_probe(pdev, &rt2800pci_ops);
+}
+
+static struct platform_driver rt2800soc_driver = {
+        .driver         = {
+                .name           = "rt2800_wmac",
+                .owner          = THIS_MODULE,
+                .mod_name       = KBUILD_MODNAME,
+        },
+        .probe          = rt2800soc_probe,
+        .remove         = __devexit_p(rt2x00soc_remove),
+        .suspend        = rt2x00soc_suspend,
+        .resume         = rt2x00soc_resume,
+};
+#endif /* CONFIG_RT2800PCI_SOC */
+
+#ifdef CONFIG_RT2800PCI_PCI
+static struct pci_driver rt2800pci_driver = {
+        .name           = KBUILD_MODNAME,
+        .id_table       = rt2800pci_device_table,
+        .probe          = rt2x00pci_probe,
+        .remove         = __devexit_p(rt2x00pci_remove),
+        .suspend        = rt2x00pci_suspend,
+        .resume         = rt2x00pci_resume,
+};
+#endif /* CONFIG_RT2800PCI_PCI */
+
+static int __init rt2800pci_init(void)
+{
+        int ret = 0;
+
+#ifdef CONFIG_RT2800PCI_SOC
+        ret = platform_driver_register(&rt2800soc_driver);
+        if (ret)
+                return ret;
+#endif
+#ifdef CONFIG_RT2800PCI_PCI
+        ret = pci_register_driver(&rt2800pci_driver);
+        if (ret) {
+#ifdef CONFIG_RT2800PCI_SOC
+                platform_driver_unregister(&rt2800soc_driver);
+#endif
+                return ret;
+        }
+#endif
+
+        return ret;
+}
+
+static void __exit rt2800pci_exit(void)
+{
+#ifdef CONFIG_RT2800PCI_PCI
+        pci_unregister_driver(&rt2800pci_driver);
+#endif
+#ifdef CONFIG_RT2800PCI_SOC
+        platform_driver_unregister(&rt2800soc_driver);
+#endif
+}
+
+module_init(rt2800pci_init);
+module_exit(rt2800pci_exit);
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.h b/drivers/net/wireless/rt2x00/rt2800pci.h
new file mode 100644
index 000000000000..afc8e7da27cb
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2800pci.h
@@ -0,0 +1,159 @@
+/*
+        Copyright (C) 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2009 Alban Browaeys <prahal@yahoo.com>
+        Copyright (C) 2009 Felix Fietkau <nbd@openwrt.org>
+        Copyright (C) 2009 Luis Correia <luis.f.correia@gmail.com>
+        Copyright (C) 2009 Mattias Nissler <mattias.nissler@gmx.de>
+        Copyright (C) 2009 Mark Asselstine <asselsm@gmail.com>
+        Copyright (C) 2009 Xose Vazquez Perez <xose.vazquez@gmail.com>
+        Copyright (C) 2009 Bart Zolnierkiewicz <bzolnier@gmail.com>
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2800pci
+        Abstract: Data structures and registers for the rt2800pci module.
+        Supported chipsets: RT2800E & RT2800ED.
+ */
+
+#ifndef RT2800PCI_H
+#define RT2800PCI_H
+
+/*
+ * PCI registers.
+ */
+
+/*
+ * E2PROM_CSR: EEPROM control register.
+ * RELOAD: Write 1 to reload eeprom content.
+ * TYPE: 0: 93c46, 1:93c66.
+ * LOAD_STATUS: 1:loading, 0:done.
+ */
+#define E2PROM_CSR                      0x0004
+#define E2PROM_CSR_DATA_CLOCK           FIELD32(0x00000001)
+#define E2PROM_CSR_CHIP_SELECT          FIELD32(0x00000002)
+#define E2PROM_CSR_DATA_IN              FIELD32(0x00000004)
+#define E2PROM_CSR_DATA_OUT             FIELD32(0x00000008)
+#define E2PROM_CSR_TYPE                 FIELD32(0x00000030)
+#define E2PROM_CSR_LOAD_STATUS          FIELD32(0x00000040)
+#define E2PROM_CSR_RELOAD               FIELD32(0x00000080)
+
+/*
+ * Queue register offset macros
+ */
+#define TX_QUEUE_REG_OFFSET             0x10
+#define TX_BASE_PTR(__x)                TX_BASE_PTR0 + ((__x) * TX_QUEUE_REG_OFFSET)
+#define TX_MAX_CNT(__x)                 TX_MAX_CNT0 + ((__x) * TX_QUEUE_REG_OFFSET)
+#define TX_CTX_IDX(__x)                 TX_CTX_IDX0 + ((__x) * TX_QUEUE_REG_OFFSET)
+#define TX_DTX_IDX(__x)                 TX_DTX_IDX0 + ((__x) * TX_QUEUE_REG_OFFSET)
+
+/*
+ * 8051 firmware image.
+ */
+#define FIRMWARE_RT2860                 "rt2860.bin"
+#define FIRMWARE_IMAGE_BASE             0x2000
+
+/*
+ * DMA descriptor defines.
+ */
+#define TXD_DESC_SIZE                   ( 4 * sizeof(__le32) )
+#define RXD_DESC_SIZE                   ( 4 * sizeof(__le32) )
+
+/*
+ * TX descriptor format for TX, PRIO and Beacon Ring.
+ */
+
+/*
+ * Word0
+ */
+#define TXD_W0_SD_PTR0                  FIELD32(0xffffffff)
+
+/*
+ * Word1
+ */
+#define TXD_W1_SD_LEN1                  FIELD32(0x00003fff)
+#define TXD_W1_LAST_SEC1                FIELD32(0x00004000)
+#define TXD_W1_BURST                    FIELD32(0x00008000)
+#define TXD_W1_SD_LEN0                  FIELD32(0x3fff0000)
+#define TXD_W1_LAST_SEC0                FIELD32(0x40000000)
+#define TXD_W1_DMA_DONE                 FIELD32(0x80000000)
+
+/*
+ * Word2
+ */
+#define TXD_W2_SD_PTR1                  FIELD32(0xffffffff)
+
+/*
+ * Word3
+ * WIV: Wireless Info Valid. 1: Driver filled WI, 0: DMA needs to copy WI
+ * QSEL: Select on-chip FIFO ID for 2nd-stage output scheduler.
+ *       0:MGMT, 1:HCCA 2:EDCA
+ */
+#define TXD_W3_WIV                      FIELD32(0x01000000)
+#define TXD_W3_QSEL                     FIELD32(0x06000000)
+#define TXD_W3_TCO                      FIELD32(0x20000000)
+#define TXD_W3_UCO                      FIELD32(0x40000000)
+#define TXD_W3_ICO                      FIELD32(0x80000000)
+
+/*
+ * RX descriptor format for RX Ring.
+ */
+
+/*
+ * Word0
+ */
+#define RXD_W0_SDP0                     FIELD32(0xffffffff)
+
+/*
+ * Word1
+ */
+#define RXD_W1_SDL1                     FIELD32(0x00003fff)
+#define RXD_W1_SDL0                     FIELD32(0x3fff0000)
+#define RXD_W1_LS0                      FIELD32(0x40000000)
+#define RXD_W1_DMA_DONE                 FIELD32(0x80000000)
+
+/*
+ * Word2
+ */
+#define RXD_W2_SDP1                     FIELD32(0xffffffff)
+
+/*
+ * Word3
+ * AMSDU: RX with 802.3 header, not 802.11 header.
+ * DECRYPTED: This frame is being decrypted.
+ */
+#define RXD_W3_BA                       FIELD32(0x00000001)
+#define RXD_W3_DATA                     FIELD32(0x00000002)
+#define RXD_W3_NULLDATA                 FIELD32(0x00000004)
+#define RXD_W3_FRAG                     FIELD32(0x00000008)
+#define RXD_W3_UNICAST_TO_ME            FIELD32(0x00000010)
+#define RXD_W3_MULTICAST                FIELD32(0x00000020)
+#define RXD_W3_BROADCAST                FIELD32(0x00000040)
+#define RXD_W3_MY_BSS                   FIELD32(0x00000080)
+#define RXD_W3_CRC_ERROR                FIELD32(0x00000100)
+#define RXD_W3_CIPHER_ERROR             FIELD32(0x00000600)
+#define RXD_W3_AMSDU                    FIELD32(0x00000800)
+#define RXD_W3_HTC                      FIELD32(0x00001000)
+#define RXD_W3_RSSI                     FIELD32(0x00002000)
+#define RXD_W3_L2PAD                    FIELD32(0x00004000)
+#define RXD_W3_AMPDU                    FIELD32(0x00008000)
+#define RXD_W3_DECRYPTED                FIELD32(0x00010000)
+#define RXD_W3_PLCP_SIGNAL              FIELD32(0x00020000)
+#define RXD_W3_PLCP_RSSI                FIELD32(0x00040000)
+
+#endif /* RT2800PCI_H */
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 9fe770f7d7bb..d27d7d5d850c 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1,5 +1,9 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2009 Mattias Nissler <mattias.nissler@gmx.de>
+        Copyright (C) 2009 Felix Fietkau <nbd@openwrt.org>
+        Copyright (C) 2009 Xose Vazquez Perez <xose.vazquez@gmail.com>
+        Copyright (C) 2009 Axel Kollhofer <rain_maker@root-forum.org>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -34,6 +38,8 @@
 
 #include "rt2x00.h"
 #include "rt2x00usb.h"
+#include "rt2800lib.h"
+#include "rt2800.h"
 #include "rt2800usb.h"
 
 /*
@@ -44,1027 +50,6 @@ module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
 
 /*
- * Register access.
- * All access to the CSR registers will go through the methods
- * rt2x00usb_register_read and rt2x00usb_register_write.
- * BBP and RF register require indirect register access,
- * and use the CSR registers BBPCSR and RFCSR to achieve this.
- * These indirect registers work with busy bits,
- * and we will try maximal REGISTER_BUSY_COUNT times to access
- * the register while taking a REGISTER_BUSY_DELAY us delay
- * between each attampt. When the busy bit is still set at that time,
- * the access attempt is considered to have failed,
- * and we will print an error.
- * The _lock versions must be used if you already hold the csr_mutex
- */
-#define WAIT_FOR_BBP(__dev, __reg) \
-        rt2x00usb_regbusy_read((__dev), BBP_CSR_CFG, BBP_CSR_CFG_BUSY, (__reg))
-#define WAIT_FOR_RFCSR(__dev, __reg) \
-        rt2x00usb_regbusy_read((__dev), RF_CSR_CFG, RF_CSR_CFG_BUSY, (__reg))
-#define WAIT_FOR_RF(__dev, __reg) \
-        rt2x00usb_regbusy_read((__dev), RF_CSR_CFG0, RF_CSR_CFG0_BUSY, (__reg))
-#define WAIT_FOR_MCU(__dev, __reg) \
-        rt2x00usb_regbusy_read((__dev), H2M_MAILBOX_CSR, \
-                               H2M_MAILBOX_CSR_OWNER, (__reg))
-
-static void rt2800usb_bbp_write(struct rt2x00_dev *rt2x00dev,
-                                const unsigned int word, const u8 value)
-{
-        u32 reg;
-
-        mutex_lock(&rt2x00dev->csr_mutex);
-
-        /*
-         * Wait until the BBP becomes available, afterwards we
-         * can safely write the new data into the register.
-         */
-        if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
-                reg = 0;
-                rt2x00_set_field32(&reg, BBP_CSR_CFG_VALUE, value);
-                rt2x00_set_field32(&reg, BBP_CSR_CFG_REGNUM, word);
-                rt2x00_set_field32(&reg, BBP_CSR_CFG_BUSY, 1);
-                rt2x00_set_field32(&reg, BBP_CSR_CFG_READ_CONTROL, 0);
-
-                rt2x00usb_register_write_lock(rt2x00dev, BBP_CSR_CFG, reg);
-        }
-
-        mutex_unlock(&rt2x00dev->csr_mutex);
-}
-
-static void rt2800usb_bbp_read(struct rt2x00_dev *rt2x00dev,
-                               const unsigned int word, u8 *value)
-{
-        u32 reg;
-
-        mutex_lock(&rt2x00dev->csr_mutex);
-
-        /*
-         * Wait until the BBP becomes available, afterwards we
-         * can safely write the read request into the register.
-         * After the data has been written, we wait until hardware
-         * returns the correct value, if at any time the register
-         * doesn't become available in time, reg will be 0xffffffff
-         * which means we return 0xff to the caller.
-         */
-        if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
-                reg = 0;
-                rt2x00_set_field32(&reg, BBP_CSR_CFG_REGNUM, word);
-                rt2x00_set_field32(&reg, BBP_CSR_CFG_BUSY, 1);
-                rt2x00_set_field32(&reg, BBP_CSR_CFG_READ_CONTROL, 1);
-
-                rt2x00usb_register_write_lock(rt2x00dev, BBP_CSR_CFG, reg);
-
-                WAIT_FOR_BBP(rt2x00dev, &reg);
-        }
-
-        *value = rt2x00_get_field32(reg, BBP_CSR_CFG_VALUE);
-
-        mutex_unlock(&rt2x00dev->csr_mutex);
-}
-
-static void rt2800usb_rfcsr_write(struct rt2x00_dev *rt2x00dev,
-                                  const unsigned int word, const u8 value)
-{
-        u32 reg;
-
-        mutex_lock(&rt2x00dev->csr_mutex);
-
-        /*
-         * Wait until the RFCSR becomes available, afterwards we
-         * can safely write the new data into the register.
-         */
-        if (WAIT_FOR_RFCSR(rt2x00dev, &reg)) {
-                reg = 0;
-                rt2x00_set_field32(&reg, RF_CSR_CFG_DATA, value);
-                rt2x00_set_field32(&reg, RF_CSR_CFG_REGNUM, word);
-                rt2x00_set_field32(&reg, RF_CSR_CFG_WRITE, 1);
-                rt2x00_set_field32(&reg, RF_CSR_CFG_BUSY, 1);
-
-                rt2x00usb_register_write_lock(rt2x00dev, RF_CSR_CFG, reg);
-        }
-
-        mutex_unlock(&rt2x00dev->csr_mutex);
-}
-
-static void rt2800usb_rfcsr_read(struct rt2x00_dev *rt2x00dev,
-                                 const unsigned int word, u8 *value)
-{
-        u32 reg;
-
-        mutex_lock(&rt2x00dev->csr_mutex);
-
-        /*
-         * Wait until the RFCSR becomes available, afterwards we
-         * can safely write the read request into the register.
-         * After the data has been written, we wait until hardware
-         * returns the correct value, if at any time the register
-         * doesn't become available in time, reg will be 0xffffffff
-         * which means we return 0xff to the caller.
-         */
-        if (WAIT_FOR_RFCSR(rt2x00dev, &reg)) {
-                reg = 0;
-                rt2x00_set_field32(&reg, RF_CSR_CFG_REGNUM, word);
-                rt2x00_set_field32(&reg, RF_CSR_CFG_WRITE, 0);
-                rt2x00_set_field32(&reg, RF_CSR_CFG_BUSY, 1);
-
-                rt2x00usb_register_write_lock(rt2x00dev, BBP_CSR_CFG, reg);
-
-                WAIT_FOR_RFCSR(rt2x00dev, &reg);
-        }
-
-        *value = rt2x00_get_field32(reg, RF_CSR_CFG_DATA);
-
-        mutex_unlock(&rt2x00dev->csr_mutex);
-}
-
-static void rt2800usb_rf_write(struct rt2x00_dev *rt2x00dev,
-                               const unsigned int word, const u32 value)
-{
-        u32 reg;
-
-        mutex_lock(&rt2x00dev->csr_mutex);
-
-        /*
-         * Wait until the RF becomes available, afterwards we
-         * can safely write the new data into the register.
-         */
-        if (WAIT_FOR_RF(rt2x00dev, &reg)) {
-                reg = 0;
-                rt2x00_set_field32(&reg, RF_CSR_CFG0_REG_VALUE_BW, value);
-                rt2x00_set_field32(&reg, RF_CSR_CFG0_STANDBYMODE, 0);
-                rt2x00_set_field32(&reg, RF_CSR_CFG0_SEL, 0);
-                rt2x00_set_field32(&reg, RF_CSR_CFG0_BUSY, 1);
-
-                rt2x00usb_register_write_lock(rt2x00dev, RF_CSR_CFG0, reg);
-                rt2x00_rf_write(rt2x00dev, word, value);
-        }
-
-        mutex_unlock(&rt2x00dev->csr_mutex);
-}
-
-static void rt2800usb_mcu_request(struct rt2x00_dev *rt2x00dev,
-                                  const u8 command, const u8 token,
-                                  const u8 arg0, const u8 arg1)
-{
-        u32 reg;
-
-        mutex_lock(&rt2x00dev->csr_mutex);
-
-        /*
-         * Wait until the MCU becomes available, afterwards we
-         * can safely write the new data into the register.
-         */
-        if (WAIT_FOR_MCU(rt2x00dev, &reg)) {
-                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_OWNER, 1);
-                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_CMD_TOKEN, token);
-                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG0, arg0);
-                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG1, arg1);
-                rt2x00usb_register_write_lock(rt2x00dev, H2M_MAILBOX_CSR, reg);
-
-                reg = 0;
-                rt2x00_set_field32(&reg, HOST_CMD_CSR_HOST_COMMAND, command);
-                rt2x00usb_register_write_lock(rt2x00dev, HOST_CMD_CSR, reg);
-        }
-
-        mutex_unlock(&rt2x00dev->csr_mutex);
-}
-
-#ifdef CONFIG_RT2X00_LIB_DEBUGFS
-static const struct rt2x00debug rt2800usb_rt2x00debug = {
-        .owner  = THIS_MODULE,
-        .csr    = {
-                .read           = rt2x00usb_register_read,
-                .write          = rt2x00usb_register_write,
-                .flags          = RT2X00DEBUGFS_OFFSET,
-                .word_base      = CSR_REG_BASE,
-                .word_size      = sizeof(u32),
-                .word_count     = CSR_REG_SIZE / sizeof(u32),
-        },
-        .eeprom = {
-                .read           = rt2x00_eeprom_read,
-                .write          = rt2x00_eeprom_write,
-                .word_base      = EEPROM_BASE,
-                .word_size      = sizeof(u16),
-                .word_count     = EEPROM_SIZE / sizeof(u16),
-        },
-        .bbp    = {
-                .read           = rt2800usb_bbp_read,
-                .write          = rt2800usb_bbp_write,
-                .word_base      = BBP_BASE,
-                .word_size      = sizeof(u8),
-                .word_count     = BBP_SIZE / sizeof(u8),
-        },
-        .rf     = {
-                .read           = rt2x00_rf_read,
-                .write          = rt2800usb_rf_write,
-                .word_base      = RF_BASE,
-                .word_size      = sizeof(u32),
-                .word_count     = RF_SIZE / sizeof(u32),
-        },
-};
-#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
-
-static int rt2800usb_rfkill_poll(struct rt2x00_dev *rt2x00dev)
-{
-        u32 reg;
-
-        rt2x00usb_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
-        return rt2x00_get_field32(reg, GPIO_CTRL_CFG_BIT2);
-}
-
-#ifdef CONFIG_RT2X00_LIB_LEDS
-static void rt2800usb_brightness_set(struct led_classdev *led_cdev,
-                                     enum led_brightness brightness)
-{
-        struct rt2x00_led *led =
-            container_of(led_cdev, struct rt2x00_led, led_dev);
-        unsigned int enabled = brightness != LED_OFF;
-        unsigned int bg_mode =
-            (enabled && led->rt2x00dev->curr_band == IEEE80211_BAND_2GHZ);
-        unsigned int polarity =
-                rt2x00_get_field16(led->rt2x00dev->led_mcu_reg,
-                                   EEPROM_FREQ_LED_POLARITY);
-        unsigned int ledmode =
-                rt2x00_get_field16(led->rt2x00dev->led_mcu_reg,
-                                   EEPROM_FREQ_LED_MODE);
-
-        if (led->type == LED_TYPE_RADIO) {
-                rt2800usb_mcu_request(led->rt2x00dev, MCU_LED, 0xff, ledmode,
-                                      enabled ? 0x20 : 0);
-        } else if (led->type == LED_TYPE_ASSOC) {
-                rt2800usb_mcu_request(led->rt2x00dev, MCU_LED, 0xff, ledmode,
-                                      enabled ? (bg_mode ? 0x60 : 0xa0) : 0x20);
-        } else if (led->type == LED_TYPE_QUALITY) {
-                /*
-                 * The brightness is divided into 6 levels (0 - 5),
-                 * The specs tell us the following levels:
-                 *      0, 1 ,3, 7, 15, 31
-                 * to determine the level in a simple way we can simply
-                 * work with bitshifting:
-                 *      (1 << level) - 1
-                 */
-                rt2800usb_mcu_request(led->rt2x00dev, MCU_LED_STRENGTH, 0xff,
-                                      (1 << brightness / (LED_FULL / 6)) - 1,
-                                      polarity);
-        }
-}
-
-static int rt2800usb_blink_set(struct led_classdev *led_cdev,
-                               unsigned long *delay_on,
-                               unsigned long *delay_off)
-{
-        struct rt2x00_led *led =
-            container_of(led_cdev, struct rt2x00_led, led_dev);
-        u32 reg;
-
-        rt2x00usb_register_read(led->rt2x00dev, LED_CFG, &reg);
-        rt2x00_set_field32(&reg, LED_CFG_ON_PERIOD, *delay_on);
-        rt2x00_set_field32(&reg, LED_CFG_OFF_PERIOD, *delay_off);
-        rt2x00_set_field32(&reg, LED_CFG_SLOW_BLINK_PERIOD, 3);
-        rt2x00_set_field32(&reg, LED_CFG_R_LED_MODE, 3);
-        rt2x00_set_field32(&reg, LED_CFG_G_LED_MODE, 12);
-        rt2x00_set_field32(&reg, LED_CFG_Y_LED_MODE, 3);
-        rt2x00_set_field32(&reg, LED_CFG_LED_POLAR, 1);
-        rt2x00usb_register_write(led->rt2x00dev, LED_CFG, reg);
-
-        return 0;
-}
-
-static void rt2800usb_init_led(struct rt2x00_dev *rt2x00dev,
-                               struct rt2x00_led *led,
-                               enum led_type type)
-{
-        led->rt2x00dev = rt2x00dev;
-        led->type = type;
-        led->led_dev.brightness_set = rt2800usb_brightness_set;
-        led->led_dev.blink_set = rt2800usb_blink_set;
-        led->flags = LED_INITIALIZED;
-}
-#endif /* CONFIG_RT2X00_LIB_LEDS */
-
-/*
- * Configuration handlers.
- */
-static void rt2800usb_config_wcid_attr(struct rt2x00_dev *rt2x00dev,
-                                       struct rt2x00lib_crypto *crypto,
-                                       struct ieee80211_key_conf *key)
-{
-        struct mac_wcid_entry wcid_entry;
-        struct mac_iveiv_entry iveiv_entry;
-        u32 offset;
-        u32 reg;
-
-        offset = MAC_WCID_ATTR_ENTRY(key->hw_key_idx);
-
-        rt2x00usb_register_read(rt2x00dev, offset, &reg);
-        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_KEYTAB,
-                           !!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE));
-        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_CIPHER,
-                           (crypto->cmd == SET_KEY) * crypto->cipher);
-        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_BSS_IDX,
-                           (crypto->cmd == SET_KEY) * crypto->bssidx);
-        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_RX_WIUDF, crypto->cipher);
-        rt2x00usb_register_write(rt2x00dev, offset, reg);
-
-        offset = MAC_IVEIV_ENTRY(key->hw_key_idx);
-
-        memset(&iveiv_entry, 0, sizeof(iveiv_entry));
-        if ((crypto->cipher == CIPHER_TKIP) ||
-            (crypto->cipher == CIPHER_TKIP_NO_MIC) ||
-            (crypto->cipher == CIPHER_AES))
-                iveiv_entry.iv[3] |= 0x20;
-        iveiv_entry.iv[3] |= key->keyidx << 6;
-        rt2x00usb_register_multiwrite(rt2x00dev, offset,
-                                      &iveiv_entry, sizeof(iveiv_entry));
-
-        offset = MAC_WCID_ENTRY(key->hw_key_idx);
-
-        memset(&wcid_entry, 0, sizeof(wcid_entry));
-        if (crypto->cmd == SET_KEY)
-                memcpy(&wcid_entry, crypto->address, ETH_ALEN);
-        rt2x00usb_register_multiwrite(rt2x00dev, offset,
-                                      &wcid_entry, sizeof(wcid_entry));
-}
-
-static int rt2800usb_config_shared_key(struct rt2x00_dev *rt2x00dev,
-                                       struct rt2x00lib_crypto *crypto,
-                                       struct ieee80211_key_conf *key)
-{
-        struct hw_key_entry key_entry;
-        struct rt2x00_field32 field;
-        int timeout;
-        u32 offset;
-        u32 reg;
-
-        if (crypto->cmd == SET_KEY) {
-                key->hw_key_idx = (4 * crypto->bssidx) + key->keyidx;
-
-                memcpy(key_entry.key, crypto->key,
-                       sizeof(key_entry.key));
-                memcpy(key_entry.tx_mic, crypto->tx_mic,
-                       sizeof(key_entry.tx_mic));
-                memcpy(key_entry.rx_mic, crypto->rx_mic,
-                       sizeof(key_entry.rx_mic));
-
-                offset = SHARED_KEY_ENTRY(key->hw_key_idx);
-                timeout = REGISTER_TIMEOUT32(sizeof(key_entry));
-                rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
-                                                    USB_VENDOR_REQUEST_OUT,
-                                                    offset, &key_entry,
-                                                    sizeof(key_entry),
-                                                    timeout);
-        }
-
-        /*
-         * The cipher types are stored over multiple registers
-         * starting with SHARED_KEY_MODE_BASE each word will have
-         * 32 bits and contains the cipher types for 2 bssidx each.
-         * Using the correct defines correctly will cause overhead,
-         * so just calculate the correct offset.
-         */
-        field.bit_offset = 4 * (key->hw_key_idx % 8);
-        field.bit_mask = 0x7 << field.bit_offset;
-
-        offset = SHARED_KEY_MODE_ENTRY(key->hw_key_idx / 8);
-
-        rt2x00usb_register_read(rt2x00dev, offset, &reg);
-        rt2x00_set_field32(&reg, field,
-                           (crypto->cmd == SET_KEY) * crypto->cipher);
-        rt2x00usb_register_write(rt2x00dev, offset, reg);
-
-        /*
-         * Update WCID information
-         */
-        rt2800usb_config_wcid_attr(rt2x00dev, crypto, key);
-
-        return 0;
-}
-
-static int rt2800usb_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
-                                         struct rt2x00lib_crypto *crypto,
-                                         struct ieee80211_key_conf *key)
-{
-        struct hw_key_entry key_entry;
-        int timeout;
-        u32 offset;
-
-        if (crypto->cmd == SET_KEY) {
-                /*
-                 * 1 pairwise key is possible per AID, this means that the AID
-                 * equals our hw_key_idx. Make sure the WCID starts _after_ the
-                 * last possible shared key entry.
-                 */
-                if (crypto->aid > (256 - 32))
-                        return -ENOSPC;
-
-                key->hw_key_idx = 32 + crypto->aid;
-
-                memcpy(key_entry.key, crypto->key,
-                       sizeof(key_entry.key));
-                memcpy(key_entry.tx_mic, crypto->tx_mic,
-                       sizeof(key_entry.tx_mic));
-                memcpy(key_entry.rx_mic, crypto->rx_mic,
-                       sizeof(key_entry.rx_mic));
-
-                offset = PAIRWISE_KEY_ENTRY(key->hw_key_idx);
-                timeout = REGISTER_TIMEOUT32(sizeof(key_entry));
-                rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
-                                                    USB_VENDOR_REQUEST_OUT,
-                                                    offset, &key_entry,
-                                                    sizeof(key_entry),
-                                                    timeout);
-        }
-
-        /*
-         * Update WCID information
-         */
-        rt2800usb_config_wcid_attr(rt2x00dev, crypto, key);
-
-        return 0;
-}
-
-static void rt2800usb_config_filter(struct rt2x00_dev *rt2x00dev,
-                                    const unsigned int filter_flags)
-{
-        u32 reg;
-
-        /*
-         * Start configuration steps.
-         * Note that the version error will always be dropped
-         * and broadcast frames will always be accepted since
-         * there is no filter for it at this time.
-         */
-        rt2x00usb_register_read(rt2x00dev, RX_FILTER_CFG, &reg);
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CRC_ERROR,
-                           !(filter_flags & FIF_FCSFAIL));
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PHY_ERROR,
-                           !(filter_flags & FIF_PLCPFAIL));
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_TO_ME,
-                           !(filter_flags & FIF_PROMISC_IN_BSS));
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_MY_BSSD, 0);
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_VER_ERROR, 1);
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_MULTICAST,
-                           !(filter_flags & FIF_ALLMULTI));
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BROADCAST, 0);
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_DUPLICATE, 1);
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CF_END_ACK,
-                           !(filter_flags & FIF_CONTROL));
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CF_END,
-                           !(filter_flags & FIF_CONTROL));
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_ACK,
-                           !(filter_flags & FIF_CONTROL));
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CTS,
-                           !(filter_flags & FIF_CONTROL));
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_RTS,
-                           !(filter_flags & FIF_CONTROL));
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PSPOLL,
-                           !(filter_flags & FIF_PSPOLL));
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BA, 1);
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BAR, 0);
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CNTL,
-                           !(filter_flags & FIF_CONTROL));
-        rt2x00usb_register_write(rt2x00dev, RX_FILTER_CFG, reg);
-}
-
-static void rt2800usb_config_intf(struct rt2x00_dev *rt2x00dev,
-                                  struct rt2x00_intf *intf,
-                                  struct rt2x00intf_conf *conf,
-                                  const unsigned int flags)
-{
-        unsigned int beacon_base;
-        u32 reg;
-
-        if (flags & CONFIG_UPDATE_TYPE) {
-                /*
-                 * Clear current synchronisation setup.
-                 * For the Beacon base registers we only need to clear
-                 * the first byte since that byte contains the VALID and OWNER
-                 * bits which (when set to 0) will invalidate the entire beacon.
-                 */
-                beacon_base = HW_BEACON_OFFSET(intf->beacon->entry_idx);
-                rt2x00usb_register_write(rt2x00dev, beacon_base, 0);
-
-                /*
-                 * Enable synchronisation.
-                 */
-                rt2x00usb_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
-                rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
-                rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_SYNC, conf->sync);
-                rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
-                rt2x00usb_register_write(rt2x00dev, BCN_TIME_CFG, reg);
-        }
-
-        if (flags & CONFIG_UPDATE_MAC) {
-                reg = le32_to_cpu(conf->mac[1]);
-                rt2x00_set_field32(&reg, MAC_ADDR_DW1_UNICAST_TO_ME_MASK, 0xff);
-                conf->mac[1] = cpu_to_le32(reg);
-
-                rt2x00usb_register_multiwrite(rt2x00dev, MAC_ADDR_DW0,
-                                              conf->mac, sizeof(conf->mac));
-        }
-
-        if (flags & CONFIG_UPDATE_BSSID) {
-                reg = le32_to_cpu(conf->bssid[1]);
-                rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_ID_MASK, 0);
-                rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 0);
-                conf->bssid[1] = cpu_to_le32(reg);
-
-                rt2x00usb_register_multiwrite(rt2x00dev, MAC_BSSID_DW0,
-                                              conf->bssid, sizeof(conf->bssid));
-        }
-}
-
-static void rt2800usb_config_erp(struct rt2x00_dev *rt2x00dev,
-                                 struct rt2x00lib_erp *erp)
-{
-        u32 reg;
-
-        rt2x00usb_register_read(rt2x00dev, TX_TIMEOUT_CFG, &reg);
-        rt2x00_set_field32(&reg, TX_TIMEOUT_CFG_RX_ACK_TIMEOUT, 0x20);
-        rt2x00usb_register_write(rt2x00dev, TX_TIMEOUT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, AUTO_RSP_CFG, &reg);
-        rt2x00_set_field32(&reg, AUTO_RSP_CFG_BAC_ACK_POLICY,
-                           !!erp->short_preamble);
-        rt2x00_set_field32(&reg, AUTO_RSP_CFG_AR_PREAMBLE,
-                           !!erp->short_preamble);
-        rt2x00usb_register_write(rt2x00dev, AUTO_RSP_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_CTRL,
-                           erp->cts_protection ? 2 : 0);
-        rt2x00usb_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
-
-        rt2x00usb_register_write(rt2x00dev, LEGACY_BASIC_RATE,
-                                 erp->basic_rates);
-        rt2x00usb_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
-
-        rt2x00usb_register_read(rt2x00dev, BKOFF_SLOT_CFG, &reg);
-        rt2x00_set_field32(&reg, BKOFF_SLOT_CFG_SLOT_TIME, erp->slot_time);
-        rt2x00_set_field32(&reg, BKOFF_SLOT_CFG_CC_DELAY_TIME, 2);
-        rt2x00usb_register_write(rt2x00dev, BKOFF_SLOT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, XIFS_TIME_CFG, &reg);
-        rt2x00_set_field32(&reg, XIFS_TIME_CFG_CCKM_SIFS_TIME, erp->sifs);
-        rt2x00_set_field32(&reg, XIFS_TIME_CFG_OFDM_SIFS_TIME, erp->sifs);
-        rt2x00_set_field32(&reg, XIFS_TIME_CFG_OFDM_XIFS_TIME, 4);
-        rt2x00_set_field32(&reg, XIFS_TIME_CFG_EIFS, erp->eifs);
-        rt2x00_set_field32(&reg, XIFS_TIME_CFG_BB_RXEND_ENABLE, 1);
-        rt2x00usb_register_write(rt2x00dev, XIFS_TIME_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL,
-                           erp->beacon_int * 16);
-        rt2x00usb_register_write(rt2x00dev, BCN_TIME_CFG, reg);
-}
-
-static void rt2800usb_config_ant(struct rt2x00_dev *rt2x00dev,
-                                 struct antenna_setup *ant)
-{
-        u8 r1;
-        u8 r3;
-
-        rt2800usb_bbp_read(rt2x00dev, 1, &r1);
-        rt2800usb_bbp_read(rt2x00dev, 3, &r3);
-
-        /*
-         * Configure the TX antenna.
-         */
-        switch ((int)ant->tx) {
-        case 1:
-                rt2x00_set_field8(&r1, BBP1_TX_ANTENNA, 0);
-                break;
-        case 2:
-                rt2x00_set_field8(&r1, BBP1_TX_ANTENNA, 2);
-                break;
-        case 3:
-                /* Do nothing */
-                break;
-        }
-
-        /*
-         * Configure the RX antenna.
-         */
-        switch ((int)ant->rx) {
-        case 1:
-                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 0);
-                break;
-        case 2:
-                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 1);
-                break;
-        case 3:
-                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 2);
-                break;
-        }
-
-        rt2800usb_bbp_write(rt2x00dev, 3, r3);
-        rt2800usb_bbp_write(rt2x00dev, 1, r1);
-}
-
-static void rt2800usb_config_lna_gain(struct rt2x00_dev *rt2x00dev,
-                                      struct rt2x00lib_conf *libconf)
-{
-        u16 eeprom;
-        short lna_gain;
-
-        if (libconf->rf.channel <= 14) {
-                rt2x00_eeprom_read(rt2x00dev, EEPROM_LNA, &eeprom);
-                lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_BG);
-        } else if (libconf->rf.channel <= 64) {
-                rt2x00_eeprom_read(rt2x00dev, EEPROM_LNA, &eeprom);
-                lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_A0);
-        } else if (libconf->rf.channel <= 128) {
-                rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2, &eeprom);
-                lna_gain = rt2x00_get_field16(eeprom, EEPROM_RSSI_BG2_LNA_A1);
-        } else {
-                rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_A2, &eeprom);
-                lna_gain = rt2x00_get_field16(eeprom, EEPROM_RSSI_A2_LNA_A2);
-        }
-
-        rt2x00dev->lna_gain = lna_gain;
-}
-
-static void rt2800usb_config_channel_rt2x(struct rt2x00_dev *rt2x00dev,
-                                          struct ieee80211_conf *conf,
-                                          struct rf_channel *rf,
-                                          struct channel_info *info)
-{
-        rt2x00_set_field32(&rf->rf4, RF4_FREQ_OFFSET, rt2x00dev->freq_offset);
-
-        if (rt2x00dev->default_ant.tx == 1)
-                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_TX1, 1);
-
-        if (rt2x00dev->default_ant.rx == 1) {
-                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_RX1, 1);
-                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_RX2, 1);
-        } else if (rt2x00dev->default_ant.rx == 2)
-                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_RX2, 1);
-
-        if (rf->channel > 14) {
-                /*
-                 * When TX power is below 0, we should increase it by 7 to
-                 * make it a positive value (Minumum value is -7).
-                 * However this means that values between 0 and 7 have
-                 * double meaning, and we should set a 7DBm boost flag.
-                 */
-                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A_7DBM_BOOST,
-                                   (info->tx_power1 >= 0));
-
-                if (info->tx_power1 < 0)
-                        info->tx_power1 += 7;
-
-                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A,
-                                   TXPOWER_A_TO_DEV(info->tx_power1));
-
-                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A_7DBM_BOOST,
-                                   (info->tx_power2 >= 0));
-
-                if (info->tx_power2 < 0)
-                        info->tx_power2 += 7;
-
-                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A,
-                                   TXPOWER_A_TO_DEV(info->tx_power2));
-        } else {
-                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_G,
-                                   TXPOWER_G_TO_DEV(info->tx_power1));
-                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_G,
-                                   TXPOWER_G_TO_DEV(info->tx_power2));
-        }
-
-        rt2x00_set_field32(&rf->rf4, RF4_HT40, conf_is_ht40(conf));
-
-        rt2800usb_rf_write(rt2x00dev, 1, rf->rf1);
-        rt2800usb_rf_write(rt2x00dev, 2, rf->rf2);
-        rt2800usb_rf_write(rt2x00dev, 3, rf->rf3 & ~0x00000004);
-        rt2800usb_rf_write(rt2x00dev, 4, rf->rf4);
-
-        udelay(200);
-
-        rt2800usb_rf_write(rt2x00dev, 1, rf->rf1);
-        rt2800usb_rf_write(rt2x00dev, 2, rf->rf2);
-        rt2800usb_rf_write(rt2x00dev, 3, rf->rf3 | 0x00000004);
-        rt2800usb_rf_write(rt2x00dev, 4, rf->rf4);
-
-        udelay(200);
-
-        rt2800usb_rf_write(rt2x00dev, 1, rf->rf1);
-        rt2800usb_rf_write(rt2x00dev, 2, rf->rf2);
-        rt2800usb_rf_write(rt2x00dev, 3, rf->rf3 & ~0x00000004);
-        rt2800usb_rf_write(rt2x00dev, 4, rf->rf4);
-}
-
-static void rt2800usb_config_channel_rt3x(struct rt2x00_dev *rt2x00dev,
-                                          struct ieee80211_conf *conf,
-                                          struct rf_channel *rf,
-                                          struct channel_info *info)
-{
-        u8 rfcsr;
-
-        rt2800usb_rfcsr_write(rt2x00dev, 2, rf->rf1);
-        rt2800usb_rfcsr_write(rt2x00dev, 2, rf->rf3);
-
-        rt2800usb_rfcsr_read(rt2x00dev, 6, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR6_R, rf->rf2);
-        rt2800usb_rfcsr_write(rt2x00dev, 6, rfcsr);
-
-        rt2800usb_rfcsr_read(rt2x00dev, 12, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR12_TX_POWER,
-                          TXPOWER_G_TO_DEV(info->tx_power1));
-        rt2800usb_rfcsr_write(rt2x00dev, 12, rfcsr);
-
-        rt2800usb_rfcsr_read(rt2x00dev, 23, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR23_FREQ_OFFSET, rt2x00dev->freq_offset);
-        rt2800usb_rfcsr_write(rt2x00dev, 23, rfcsr);
-
-        rt2800usb_rfcsr_write(rt2x00dev, 24,
-                              rt2x00dev->calibration[conf_is_ht40(conf)]);
-
-        rt2800usb_rfcsr_read(rt2x00dev, 23, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR7_RF_TUNING, 1);
-        rt2800usb_rfcsr_write(rt2x00dev, 23, rfcsr);
-}
-
-static void rt2800usb_config_channel(struct rt2x00_dev *rt2x00dev,
-                                     struct ieee80211_conf *conf,
-                                     struct rf_channel *rf,
-                                     struct channel_info *info)
-{
-        u32 reg;
-        unsigned int tx_pin;
-        u8 bbp;
-
-        if (rt2x00_rev(&rt2x00dev->chip) != RT3070_VERSION)
-                rt2800usb_config_channel_rt2x(rt2x00dev, conf, rf, info);
-        else
-                rt2800usb_config_channel_rt3x(rt2x00dev, conf, rf, info);
-
-        /*
-         * Change BBP settings
-         */
-        rt2800usb_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
-        rt2800usb_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
-        rt2800usb_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
-        rt2800usb_bbp_write(rt2x00dev, 86, 0);
-
-        if (rf->channel <= 14) {
-                if (test_bit(CONFIG_EXTERNAL_LNA_BG, &rt2x00dev->flags)) {
-                        rt2800usb_bbp_write(rt2x00dev, 82, 0x62);
-                        rt2800usb_bbp_write(rt2x00dev, 75, 0x46);
-                } else {
-                        rt2800usb_bbp_write(rt2x00dev, 82, 0x84);
-                        rt2800usb_bbp_write(rt2x00dev, 75, 0x50);
-                }
-        } else {
-                rt2800usb_bbp_write(rt2x00dev, 82, 0xf2);
-
-                if (test_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags))
-                        rt2800usb_bbp_write(rt2x00dev, 75, 0x46);
-                else
-                        rt2800usb_bbp_write(rt2x00dev, 75, 0x50);
-        }
-
-        rt2x00usb_register_read(rt2x00dev, TX_BAND_CFG, &reg);
-        rt2x00_set_field32(&reg, TX_BAND_CFG_HT40_PLUS, conf_is_ht40_plus(conf));
-        rt2x00_set_field32(&reg, TX_BAND_CFG_A, rf->channel > 14);
-        rt2x00_set_field32(&reg, TX_BAND_CFG_BG, rf->channel <= 14);
-        rt2x00usb_register_write(rt2x00dev, TX_BAND_CFG, reg);
-
-        tx_pin = 0;
-
-        /* Turn on unused PA or LNA when not using 1T or 1R */
-        if (rt2x00dev->default_ant.tx != 1) {
-                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A1_EN, 1);
-                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G1_EN, 1);
-        }
-
-        /* Turn on unused PA or LNA when not using 1T or 1R */
-        if (rt2x00dev->default_ant.rx != 1) {
-                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A1_EN, 1);
-                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G1_EN, 1);
-        }
-
-        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A0_EN, 1);
-        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G0_EN, 1);
-        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_RFTR_EN, 1);
-        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_TRSW_EN, 1);
-        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G0_EN, rf->channel <= 14);
-        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A0_EN, rf->channel > 14);
-
-        rt2x00usb_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
-
-        rt2800usb_bbp_read(rt2x00dev, 4, &bbp);
-        rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
-        rt2800usb_bbp_write(rt2x00dev, 4, bbp);
-
-        rt2800usb_bbp_read(rt2x00dev, 3, &bbp);
-        rt2x00_set_field8(&bbp, BBP3_HT40_PLUS, conf_is_ht40_plus(conf));
-        rt2800usb_bbp_write(rt2x00dev, 3, bbp);
-
-        if (rt2x00_rev(&rt2x00dev->chip) == RT2860C_VERSION) {
-                if (conf_is_ht40(conf)) {
-                        rt2800usb_bbp_write(rt2x00dev, 69, 0x1a);
-                        rt2800usb_bbp_write(rt2x00dev, 70, 0x0a);
-                        rt2800usb_bbp_write(rt2x00dev, 73, 0x16);
-                } else {
-                        rt2800usb_bbp_write(rt2x00dev, 69, 0x16);
-                        rt2800usb_bbp_write(rt2x00dev, 70, 0x08);
-                        rt2800usb_bbp_write(rt2x00dev, 73, 0x11);
-                }
-        }
-
-        msleep(1);
-}
-
-static void rt2800usb_config_txpower(struct rt2x00_dev *rt2x00dev,
-                                     const int txpower)
-{
-        u32 reg;
-        u32 value = TXPOWER_G_TO_DEV(txpower);
-        u8 r1;
-
-        rt2800usb_bbp_read(rt2x00dev, 1, &r1);
-        rt2x00_set_field8(&reg, BBP1_TX_POWER, 0);
-        rt2800usb_bbp_write(rt2x00dev, 1, r1);
-
-        rt2x00usb_register_read(rt2x00dev, TX_PWR_CFG_0, &reg);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_0_1MBS, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_0_2MBS, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_0_55MBS, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_0_11MBS, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_0_6MBS, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_0_9MBS, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_0_12MBS, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_0_18MBS, value);
-        rt2x00usb_register_write(rt2x00dev, TX_PWR_CFG_0, reg);
-
-        rt2x00usb_register_read(rt2x00dev, TX_PWR_CFG_1, &reg);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_1_24MBS, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_1_36MBS, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_1_48MBS, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_1_54MBS, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS0, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS1, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS2, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS3, value);
-        rt2x00usb_register_write(rt2x00dev, TX_PWR_CFG_1, reg);
-
-        rt2x00usb_register_read(rt2x00dev, TX_PWR_CFG_2, &reg);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS4, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS5, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS6, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS7, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS8, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS9, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS10, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS11, value);
-        rt2x00usb_register_write(rt2x00dev, TX_PWR_CFG_2, reg);
-
-        rt2x00usb_register_read(rt2x00dev, TX_PWR_CFG_3, &reg);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS12, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS13, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS14, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS15, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN1, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN2, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN3, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN4, value);
-        rt2x00usb_register_write(rt2x00dev, TX_PWR_CFG_3, reg);
-
-        rt2x00usb_register_read(rt2x00dev, TX_PWR_CFG_4, &reg);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN5, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN6, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN7, value);
-        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN8, value);
-        rt2x00usb_register_write(rt2x00dev, TX_PWR_CFG_4, reg);
-}
-
-static void rt2800usb_config_retry_limit(struct rt2x00_dev *rt2x00dev,
-                                         struct rt2x00lib_conf *libconf)
-{
-        u32 reg;
-
-        rt2x00usb_register_read(rt2x00dev, TX_RTY_CFG, &reg);
-        rt2x00_set_field32(&reg, TX_RTY_CFG_SHORT_RTY_LIMIT,
-                           libconf->conf->short_frame_max_tx_count);
-        rt2x00_set_field32(&reg, TX_RTY_CFG_LONG_RTY_LIMIT,
-                           libconf->conf->long_frame_max_tx_count);
-        rt2x00_set_field32(&reg, TX_RTY_CFG_LONG_RTY_THRE, 2000);
-        rt2x00_set_field32(&reg, TX_RTY_CFG_NON_AGG_RTY_MODE, 0);
-        rt2x00_set_field32(&reg, TX_RTY_CFG_AGG_RTY_MODE, 0);
-        rt2x00_set_field32(&reg, TX_RTY_CFG_TX_AUTO_FB_ENABLE, 1);
-        rt2x00usb_register_write(rt2x00dev, TX_RTY_CFG, reg);
-}
-
-static void rt2800usb_config_ps(struct rt2x00_dev *rt2x00dev,
-                                struct rt2x00lib_conf *libconf)
-{
-        enum dev_state state =
-            (libconf->conf->flags & IEEE80211_CONF_PS) ?
-                STATE_SLEEP : STATE_AWAKE;
-        u32 reg;
-
-        if (state == STATE_SLEEP) {
-                rt2x00usb_register_write(rt2x00dev, AUTOWAKEUP_CFG, 0);
-
-                rt2x00usb_register_read(rt2x00dev, AUTOWAKEUP_CFG, &reg);
-                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTO_LEAD_TIME, 5);
-                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE,
-                                   libconf->conf->listen_interval - 1);
-                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTOWAKE, 1);
-                rt2x00usb_register_write(rt2x00dev, AUTOWAKEUP_CFG, reg);
-
-                rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
-        } else {
-                rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
-
-                rt2x00usb_register_read(rt2x00dev, AUTOWAKEUP_CFG, &reg);
-                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTO_LEAD_TIME, 0);
-                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE, 0);
-                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTOWAKE, 0);
-                rt2x00usb_register_write(rt2x00dev, AUTOWAKEUP_CFG, reg);
-        }
-}
-
-static void rt2800usb_config(struct rt2x00_dev *rt2x00dev,
-                             struct rt2x00lib_conf *libconf,
-                             const unsigned int flags)
-{
-        /* Always recalculate LNA gain before changing configuration */
-        rt2800usb_config_lna_gain(rt2x00dev, libconf);
-
-        if (flags & IEEE80211_CONF_CHANGE_CHANNEL)
-                rt2800usb_config_channel(rt2x00dev, libconf->conf,
-                                         &libconf->rf, &libconf->channel);
-        if (flags & IEEE80211_CONF_CHANGE_POWER)
-                rt2800usb_config_txpower(rt2x00dev, libconf->conf->power_level);
-        if (flags & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
-                rt2800usb_config_retry_limit(rt2x00dev, libconf);
-        if (flags & IEEE80211_CONF_CHANGE_PS)
-                rt2800usb_config_ps(rt2x00dev, libconf);
-}
-
-/*
- * Link tuning
- */
-static void rt2800usb_link_stats(struct rt2x00_dev *rt2x00dev,
-                                 struct link_qual *qual)
-{
-        u32 reg;
-
-        /*
-         * Update FCS error count from register.
-         */
-        rt2x00usb_register_read(rt2x00dev, RX_STA_CNT0, &reg);
-        qual->rx_failed = rt2x00_get_field32(reg, RX_STA_CNT0_CRC_ERR);
-}
-
-static u8 rt2800usb_get_default_vgc(struct rt2x00_dev *rt2x00dev)
-{
-        if (rt2x00dev->curr_band == IEEE80211_BAND_2GHZ) {
-                if (rt2x00_rev(&rt2x00dev->chip) == RT3070_VERSION)
-                        return 0x1c + (2 * rt2x00dev->lna_gain);
-                else
-                        return 0x2e + rt2x00dev->lna_gain;
-        }
-
-        if (!test_bit(CONFIG_CHANNEL_HT40, &rt2x00dev->flags))
-                return 0x32 + (rt2x00dev->lna_gain * 5) / 3;
-        else
-                return 0x3a + (rt2x00dev->lna_gain * 5) / 3;
-}
-
-static inline void rt2800usb_set_vgc(struct rt2x00_dev *rt2x00dev,
-                                     struct link_qual *qual, u8 vgc_level)
-{
-        if (qual->vgc_level != vgc_level) {
-                rt2800usb_bbp_write(rt2x00dev, 66, vgc_level);
-                qual->vgc_level = vgc_level;
-                qual->vgc_level_reg = vgc_level;
-        }
-}
-
-static void rt2800usb_reset_tuner(struct rt2x00_dev *rt2x00dev,
-                                  struct link_qual *qual)
-{
-        rt2800usb_set_vgc(rt2x00dev, qual,
-                          rt2800usb_get_default_vgc(rt2x00dev));
-}
-
-static void rt2800usb_link_tuner(struct rt2x00_dev *rt2x00dev,
-                                 struct link_qual *qual, const u32 count)
-{
-        if (rt2x00_rev(&rt2x00dev->chip) == RT2860C_VERSION)
-                return;
-
-        /*
-         * When RSSI is better then -80 increase VGC level with 0x10
-         */
-        rt2800usb_set_vgc(rt2x00dev, qual,
-                          rt2800usb_get_default_vgc(rt2x00dev) +
-                          ((qual->rssi > -80) * 0x10));
-}
-
-/*
  * Firmware functions
  */
 static char *rt2800usb_get_firmware_name(struct rt2x00_dev *rt2x00dev)
@@ -1107,7 +92,6 @@ static bool rt2800usb_check_crc(const u8 *data, const size_t len)
 static int rt2800usb_check_firmware(struct rt2x00_dev *rt2x00dev,
                                     const u8 *data, const size_t len)
 {
-        u16 chipset = (rt2x00_rev(&rt2x00dev->chip) >> 16) & 0xffff;
         size_t offset = 0;
 
         /*
@@ -1115,7 +99,7 @@ static int rt2800usb_check_firmware(struct rt2x00_dev *rt2x00dev,
          * There are 2 variations of the rt2870 firmware.
          * a) size: 4kb
          * b) size: 8kb
-         * Note that (b) contains 2 seperate firmware blobs of 4k
+         * Note that (b) contains 2 separate firmware blobs of 4k
          * within the file. The first blob is the same firmware as (a),
          * but the second blob is for the additional chipsets.
          */
@@ -1126,14 +110,14 @@ static int rt2800usb_check_firmware(struct rt2x00_dev *rt2x00dev,
          * Check if we need the upper 4kb firmware data or not.
          */
         if ((len == 4096) &&
-            (chipset != 0x2860) &&
-            (chipset != 0x2872) &&
-            (chipset != 0x3070))
+            !rt2x00_rt(rt2x00dev, RT2860) &&
+            !rt2x00_rt(rt2x00dev, RT2872) &&
+            !rt2x00_rt(rt2x00dev, RT3070))
                 return FW_BAD_VERSION;
 
         /*
          * 8kb firmware files must be checked as if it were
-         * 2 seperate firmware files.
+         * 2 separate firmware files.
          */
         while (offset < len) {
                 if (!rt2800usb_check_crc(data + offset, 4096))
@@ -1153,14 +137,13 @@ static int rt2800usb_load_firmware(struct rt2x00_dev *rt2x00dev,
         u32 reg;
         u32 offset;
         u32 length;
-        u16 chipset = (rt2x00_rev(&rt2x00dev->chip) >> 16) & 0xffff;
 
         /*
          * Check which section of the firmware we need.
          */
-        if ((chipset == 0x2860) ||
-            (chipset == 0x2872) ||
-            (chipset == 0x3070)) {
+        if (rt2x00_rt(rt2x00dev, RT2860) ||
+            rt2x00_rt(rt2x00dev, RT2872) ||
+            rt2x00_rt(rt2x00dev, RT3070)) {
                 offset = 0;
                 length = 4096;
         } else {
@@ -1172,7 +155,7 @@ static int rt2800usb_load_firmware(struct rt2x00_dev *rt2x00dev,
          * Wait for stable hardware.
          */
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00usb_register_read(rt2x00dev, MAC_CSR0, &reg);
+                rt2800_register_read(rt2x00dev, MAC_CSR0, &reg);
                 if (reg && reg != ~0)
                         break;
                 msleep(1);
@@ -1192,8 +175,8 @@ static int rt2800usb_load_firmware(struct rt2x00_dev *rt2x00dev,
                                             data + offset, length,
                                             REGISTER_TIMEOUT32(length));
 
-        rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
-        rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
+        rt2800_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
+        rt2800_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
 
         /*
          * Send firmware request to device to load firmware,
@@ -1208,18 +191,18 @@ static int rt2800usb_load_firmware(struct rt2x00_dev *rt2x00dev,
         }
 
         msleep(10);
-        rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+        rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
 
         /*
          * Send signal to firmware during boot time.
          */
-        rt2800usb_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0xff, 0, 0);
+        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0xff, 0, 0);
 
-        if ((chipset == 0x3070) ||
-            (chipset == 0x3071) ||
-            (chipset == 0x3572)) {
+        if (rt2x00_rt(rt2x00dev, RT3070) ||
+            rt2x00_rt(rt2x00dev, RT3071) ||
+            rt2x00_rt(rt2x00dev, RT3572)) {
                 udelay(200);
-                rt2800usb_mcu_request(rt2x00dev, MCU_CURRENT, 0, 0, 0);
+                rt2800_mcu_request(rt2x00dev, MCU_CURRENT, 0, 0, 0);
                 udelay(10);
         }
 
@@ -1227,7 +210,7 @@ static int rt2800usb_load_firmware(struct rt2x00_dev *rt2x00dev,
          * Wait for device to stabilize.
          */
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00usb_register_read(rt2x00dev, PBF_SYS_CTRL, &reg);
+                rt2800_register_read(rt2x00dev, PBF_SYS_CTRL, &reg);
                 if (rt2x00_get_field32(reg, PBF_SYS_CTRL_READY))
                         break;
                 msleep(1);
@@ -1241,536 +224,14 @@ static int rt2800usb_load_firmware(struct rt2x00_dev *rt2x00dev,
         /*
          * Initialize firmware.
          */
-        rt2x00usb_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
-        rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+        rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+        rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
         msleep(1);
 
         return 0;
 }
 
 /*
- * Initialization functions.
- */
-static int rt2800usb_init_registers(struct rt2x00_dev *rt2x00dev)
-{
-        u32 reg;
-        unsigned int i;
-
-        /*
-         * Wait untill BBP and RF are ready.
-         */
-        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00usb_register_read(rt2x00dev, MAC_CSR0, &reg);
-                if (reg && reg != ~0)
-                        break;
-                msleep(1);
-        }
-
-        if (i == REGISTER_BUSY_COUNT) {
-                ERROR(rt2x00dev, "Unstable hardware.\n");
-                return -EBUSY;
-        }
-
-        rt2x00usb_register_read(rt2x00dev, PBF_SYS_CTRL, &reg);
-        rt2x00usb_register_write(rt2x00dev, PBF_SYS_CTRL, reg & ~0x00002000);
-
-        rt2x00usb_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
-        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_CSR, 1);
-        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_BBP, 1);
-        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
-
-        rt2x00usb_register_write(rt2x00dev, USB_DMA_CFG, 0x00000000);
-
-        rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0,
-                                    USB_MODE_RESET, REGISTER_TIMEOUT);
-
-        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
-
-        rt2x00usb_register_read(rt2x00dev, BCN_OFFSET0, &reg);
-        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN0, 0xe0); /* 0x3800 */
-        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN1, 0xe8); /* 0x3a00 */
-        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN2, 0xf0); /* 0x3c00 */
-        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN3, 0xf8); /* 0x3e00 */
-        rt2x00usb_register_write(rt2x00dev, BCN_OFFSET0, reg);
-
-        rt2x00usb_register_read(rt2x00dev, BCN_OFFSET1, &reg);
-        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN4, 0xc8); /* 0x3200 */
-        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN5, 0xd0); /* 0x3400 */
-        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN6, 0x77); /* 0x1dc0 */
-        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN7, 0x6f); /* 0x1bc0 */
-        rt2x00usb_register_write(rt2x00dev, BCN_OFFSET1, reg);
-
-        rt2x00usb_register_write(rt2x00dev, LEGACY_BASIC_RATE, 0x0000013f);
-        rt2x00usb_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
-
-        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
-
-        rt2x00usb_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL, 0);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 0);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_SYNC, 0);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 0);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_TX_TIME_COMPENSATE, 0);
-        rt2x00usb_register_write(rt2x00dev, BCN_TIME_CFG, reg);
-
-        if (rt2x00_rev(&rt2x00dev->chip) == RT3070_VERSION) {
-                rt2x00usb_register_write(rt2x00dev, TX_SW_CFG0, 0x00000400);
-                rt2x00usb_register_write(rt2x00dev, TX_SW_CFG1, 0x00000000);
-                rt2x00usb_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
-        } else {
-                rt2x00usb_register_write(rt2x00dev, TX_SW_CFG0, 0x00000000);
-                rt2x00usb_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
-        }
-
-        rt2x00usb_register_read(rt2x00dev, TX_LINK_CFG, &reg);
-        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_MFB_LIFETIME, 32);
-        rt2x00_set_field32(&reg, TX_LINK_CFG_MFB_ENABLE, 0);
-        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_UMFS_ENABLE, 0);
-        rt2x00_set_field32(&reg, TX_LINK_CFG_TX_MRQ_EN, 0);
-        rt2x00_set_field32(&reg, TX_LINK_CFG_TX_RDG_EN, 0);
-        rt2x00_set_field32(&reg, TX_LINK_CFG_TX_CF_ACK_EN, 1);
-        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_MFB, 0);
-        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_MFS, 0);
-        rt2x00usb_register_write(rt2x00dev, TX_LINK_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, TX_TIMEOUT_CFG, &reg);
-        rt2x00_set_field32(&reg, TX_TIMEOUT_CFG_MPDU_LIFETIME, 9);
-        rt2x00_set_field32(&reg, TX_TIMEOUT_CFG_TX_OP_TIMEOUT, 10);
-        rt2x00usb_register_write(rt2x00dev, TX_TIMEOUT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, MAX_LEN_CFG, &reg);
-        rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_MPDU, AGGREGATION_SIZE);
-        if (rt2x00_rev(&rt2x00dev->chip) >= RT2880E_VERSION &&
-            rt2x00_rev(&rt2x00dev->chip) < RT3070_VERSION)
-                rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 2);
-        else
-                rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 1);
-        rt2x00_set_field32(&reg, MAX_LEN_CFG_MIN_PSDU, 0);
-        rt2x00_set_field32(&reg, MAX_LEN_CFG_MIN_MPDU, 0);
-        rt2x00usb_register_write(rt2x00dev, MAX_LEN_CFG, reg);
-
-        rt2x00usb_register_write(rt2x00dev, PBF_MAX_PCNT, 0x1f3fbf9f);
-
-        rt2x00usb_register_read(rt2x00dev, AUTO_RSP_CFG, &reg);
-        rt2x00_set_field32(&reg, AUTO_RSP_CFG_AUTORESPONDER, 1);
-        rt2x00_set_field32(&reg, AUTO_RSP_CFG_CTS_40_MMODE, 0);
-        rt2x00_set_field32(&reg, AUTO_RSP_CFG_CTS_40_MREF, 0);
-        rt2x00_set_field32(&reg, AUTO_RSP_CFG_DUAL_CTS_EN, 0);
-        rt2x00_set_field32(&reg, AUTO_RSP_CFG_ACK_CTS_PSM_BIT, 0);
-        rt2x00usb_register_write(rt2x00dev, AUTO_RSP_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, CCK_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, CCK_PROT_CFG_PROTECT_RATE, 8);
-        rt2x00_set_field32(&reg, CCK_PROT_CFG_PROTECT_CTRL, 0);
-        rt2x00_set_field32(&reg, CCK_PROT_CFG_PROTECT_NAV, 1);
-        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_CCK, 1);
-        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
-        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_MM20, 1);
-        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_MM40, 1);
-        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_GF20, 1);
-        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_GF40, 1);
-        rt2x00usb_register_write(rt2x00dev, CCK_PROT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_RATE, 8);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_CTRL, 0);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_NAV, 1);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_CCK, 1);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_MM20, 1);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_MM40, 1);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_GF20, 1);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_GF40, 1);
-        rt2x00usb_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, MM20_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_RATE, 0x4004);
-        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_CTRL, 0);
-        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_NAV, 1);
-        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_CCK, 1);
-        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
-        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_MM20, 1);
-        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_MM40, 0);
-        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_GF20, 1);
-        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_GF40, 0);
-        rt2x00usb_register_write(rt2x00dev, MM20_PROT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, MM40_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_RATE, 0x4084);
-        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_CTRL, 0);
-        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_NAV, 1);
-        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_CCK, 1);
-        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
-        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_MM20, 1);
-        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_MM40, 1);
-        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_GF20, 1);
-        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_GF40, 1);
-        rt2x00usb_register_write(rt2x00dev, MM40_PROT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, GF20_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_RATE, 0x4004);
-        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_CTRL, 0);
-        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_NAV, 1);
-        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_CCK, 1);
-        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
-        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_MM20, 1);
-        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_MM40, 0);
-        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_GF20, 1);
-        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_GF40, 0);
-        rt2x00usb_register_write(rt2x00dev, GF20_PROT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, GF40_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_RATE, 0x4084);
-        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_CTRL, 0);
-        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_NAV, 1);
-        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_CCK, 1);
-        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
-        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_MM20, 1);
-        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_MM40, 1);
-        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_GF20, 1);
-        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_GF40, 1);
-        rt2x00usb_register_write(rt2x00dev, GF40_PROT_CFG, reg);
-
-        rt2x00usb_register_write(rt2x00dev, PBF_CFG, 0xf40006);
-
-        rt2x00usb_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_DMA_BUSY, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_DMA_BUSY, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_WP_DMA_BURST_SIZE, 3);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_BIG_ENDIAN, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_HDR_SCATTER, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_HDR_SEG_LEN, 0);
-        rt2x00usb_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
-
-        rt2x00usb_register_write(rt2x00dev, TXOP_CTRL_CFG, 0x0000583f);
-        rt2x00usb_register_write(rt2x00dev, TXOP_HLDR_ET, 0x00000002);
-
-        rt2x00usb_register_read(rt2x00dev, TX_RTS_CFG, &reg);
-        rt2x00_set_field32(&reg, TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT, 32);
-        rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_THRES,
-                           IEEE80211_MAX_RTS_THRESHOLD);
-        rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_FBK_EN, 0);
-        rt2x00usb_register_write(rt2x00dev, TX_RTS_CFG, reg);
-
-        rt2x00usb_register_write(rt2x00dev, EXP_ACK_TIME, 0x002400ca);
-        rt2x00usb_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000003);
-
-        /*
-         * ASIC will keep garbage value after boot, clear encryption keys.
-         */
-        for (i = 0; i < 4; i++)
-                rt2x00usb_register_write(rt2x00dev,
-                                         SHARED_KEY_MODE_ENTRY(i), 0);
-
-        for (i = 0; i < 256; i++) {
-                u32 wcid[2] = { 0xffffffff, 0x00ffffff };
-                rt2x00usb_register_multiwrite(rt2x00dev, MAC_WCID_ENTRY(i),
-                                              wcid, sizeof(wcid));
-
-                rt2x00usb_register_write(rt2x00dev, MAC_WCID_ATTR_ENTRY(i), 1);
-                rt2x00usb_register_write(rt2x00dev, MAC_IVEIV_ENTRY(i), 0);
-        }
-
-        /*
-         * Clear all beacons
-         * For the Beacon base registers we only need to clear
-         * the first byte since that byte contains the VALID and OWNER
-         * bits which (when set to 0) will invalidate the entire beacon.
-         */
-        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE0, 0);
-        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE1, 0);
-        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE2, 0);
-        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE3, 0);
-        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE4, 0);
-        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE5, 0);
-        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE6, 0);
-        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE7, 0);
-
-        rt2x00usb_register_read(rt2x00dev, USB_CYC_CFG, &reg);
-        rt2x00_set_field32(&reg, USB_CYC_CFG_CLOCK_CYCLE, 30);
-        rt2x00usb_register_write(rt2x00dev, USB_CYC_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, HT_FBK_CFG0, &reg);
-        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS0FBK, 0);
-        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS1FBK, 0);
-        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS2FBK, 1);
-        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS3FBK, 2);
-        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS4FBK, 3);
-        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS5FBK, 4);
-        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS6FBK, 5);
-        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS7FBK, 6);
-        rt2x00usb_register_write(rt2x00dev, HT_FBK_CFG0, reg);
-
-        rt2x00usb_register_read(rt2x00dev, HT_FBK_CFG1, &reg);
-        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS8FBK, 8);
-        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS9FBK, 8);
-        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS10FBK, 9);
-        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS11FBK, 10);
-        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS12FBK, 11);
-        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS13FBK, 12);
-        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS14FBK, 13);
-        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS15FBK, 14);
-        rt2x00usb_register_write(rt2x00dev, HT_FBK_CFG1, reg);
-
-        rt2x00usb_register_read(rt2x00dev, LG_FBK_CFG0, &reg);
-        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS0FBK, 8);
-        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS1FBK, 8);
-        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS2FBK, 9);
-        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS3FBK, 10);
-        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS4FBK, 11);
-        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS5FBK, 12);
-        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS6FBK, 13);
-        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS7FBK, 14);
-        rt2x00usb_register_write(rt2x00dev, LG_FBK_CFG0, reg);
-
-        rt2x00usb_register_read(rt2x00dev, LG_FBK_CFG1, &reg);
-        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS0FBK, 0);
-        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS1FBK, 0);
-        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS2FBK, 1);
-        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS3FBK, 2);
-        rt2x00usb_register_write(rt2x00dev, LG_FBK_CFG1, reg);
-
-        /*
-         * We must clear the error counters.
-         * These registers are cleared on read,
-         * so we may pass a useless variable to store the value.
-         */
-        rt2x00usb_register_read(rt2x00dev, RX_STA_CNT0, &reg);
-        rt2x00usb_register_read(rt2x00dev, RX_STA_CNT1, &reg);
-        rt2x00usb_register_read(rt2x00dev, RX_STA_CNT2, &reg);
-        rt2x00usb_register_read(rt2x00dev, TX_STA_CNT0, &reg);
-        rt2x00usb_register_read(rt2x00dev, TX_STA_CNT1, &reg);
-        rt2x00usb_register_read(rt2x00dev, TX_STA_CNT2, &reg);
-
-        return 0;
-}
-
-static int rt2800usb_wait_bbp_rf_ready(struct rt2x00_dev *rt2x00dev)
-{
-        unsigned int i;
-        u32 reg;
-
-        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00usb_register_read(rt2x00dev, MAC_STATUS_CFG, &reg);
-                if (!rt2x00_get_field32(reg, MAC_STATUS_CFG_BBP_RF_BUSY))
-                        return 0;
-
-                udelay(REGISTER_BUSY_DELAY);
-        }
-
-        ERROR(rt2x00dev, "BBP/RF register access failed, aborting.\n");
-        return -EACCES;
-}
-
-static int rt2800usb_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
-{
-        unsigned int i;
-        u8 value;
-
-        /*
-         * BBP was enabled after firmware was loaded,
-         * but we need to reactivate it now.
-         */
-        rt2x00usb_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
-        rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
-        msleep(1);
-
-        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2800usb_bbp_read(rt2x00dev, 0, &value);
-                if ((value != 0xff) && (value != 0x00))
-                        return 0;
-                udelay(REGISTER_BUSY_DELAY);
-        }
-
-        ERROR(rt2x00dev, "BBP register access failed, aborting.\n");
-        return -EACCES;
-}
-
-static int rt2800usb_init_bbp(struct rt2x00_dev *rt2x00dev)
-{
-        unsigned int i;
-        u16 eeprom;
-        u8 reg_id;
-        u8 value;
-
-        if (unlikely(rt2800usb_wait_bbp_rf_ready(rt2x00dev) ||
-                     rt2800usb_wait_bbp_ready(rt2x00dev)))
-                return -EACCES;
-
-        rt2800usb_bbp_write(rt2x00dev, 65, 0x2c);
-        rt2800usb_bbp_write(rt2x00dev, 66, 0x38);
-        rt2800usb_bbp_write(rt2x00dev, 69, 0x12);
-        rt2800usb_bbp_write(rt2x00dev, 70, 0x0a);
-        rt2800usb_bbp_write(rt2x00dev, 73, 0x10);
-        rt2800usb_bbp_write(rt2x00dev, 81, 0x37);
-        rt2800usb_bbp_write(rt2x00dev, 82, 0x62);
-        rt2800usb_bbp_write(rt2x00dev, 83, 0x6a);
-        rt2800usb_bbp_write(rt2x00dev, 84, 0x99);
-        rt2800usb_bbp_write(rt2x00dev, 86, 0x00);
-        rt2800usb_bbp_write(rt2x00dev, 91, 0x04);
-        rt2800usb_bbp_write(rt2x00dev, 92, 0x00);
-        rt2800usb_bbp_write(rt2x00dev, 103, 0x00);
-        rt2800usb_bbp_write(rt2x00dev, 105, 0x05);
-
-        if (rt2x00_rev(&rt2x00dev->chip) == RT2860C_VERSION) {
-                rt2800usb_bbp_write(rt2x00dev, 69, 0x16);
-                rt2800usb_bbp_write(rt2x00dev, 73, 0x12);
-        }
-
-        if (rt2x00_rev(&rt2x00dev->chip) > RT2860D_VERSION) {
-                rt2800usb_bbp_write(rt2x00dev, 84, 0x19);
-        }
-
-        if (rt2x00_rev(&rt2x00dev->chip) == RT3070_VERSION) {
-                rt2800usb_bbp_write(rt2x00dev, 70, 0x0a);
-                rt2800usb_bbp_write(rt2x00dev, 84, 0x99);
-                rt2800usb_bbp_write(rt2x00dev, 105, 0x05);
-        }
-
-        for (i = 0; i < EEPROM_BBP_SIZE; i++) {
-                rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i, &eeprom);
-
-                if (eeprom != 0xffff && eeprom != 0x0000) {
-                        reg_id = rt2x00_get_field16(eeprom, EEPROM_BBP_REG_ID);
-                        value = rt2x00_get_field16(eeprom, EEPROM_BBP_VALUE);
-                        rt2800usb_bbp_write(rt2x00dev, reg_id, value);
-                }
-        }
-
-        return 0;
-}
-
-static u8 rt2800usb_init_rx_filter(struct rt2x00_dev *rt2x00dev,
-                                   bool bw40, u8 rfcsr24, u8 filter_target)
-{
-        unsigned int i;
-        u8 bbp;
-        u8 rfcsr;
-        u8 passband;
-        u8 stopband;
-        u8 overtuned = 0;
-
-        rt2800usb_rfcsr_write(rt2x00dev, 24, rfcsr24);
-
-        rt2800usb_bbp_read(rt2x00dev, 4, &bbp);
-        rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * bw40);
-        rt2800usb_bbp_write(rt2x00dev, 4, bbp);
-
-        rt2800usb_rfcsr_read(rt2x00dev, 22, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR22_BASEBAND_LOOPBACK, 1);
-        rt2800usb_rfcsr_write(rt2x00dev, 22, rfcsr);
-
-        /*
-         * Set power & frequency of passband test tone
-         */
-        rt2800usb_bbp_write(rt2x00dev, 24, 0);
-
-        for (i = 0; i < 100; i++) {
-                rt2800usb_bbp_write(rt2x00dev, 25, 0x90);
-                msleep(1);
-
-                rt2800usb_bbp_read(rt2x00dev, 55, &passband);
-                if (passband)
-                        break;
-        }
-
-        /*
-         * Set power & frequency of stopband test tone
-         */
-        rt2800usb_bbp_write(rt2x00dev, 24, 0x06);
-
-        for (i = 0; i < 100; i++) {
-                rt2800usb_bbp_write(rt2x00dev, 25, 0x90);
-                msleep(1);
-
-                rt2800usb_bbp_read(rt2x00dev, 55, &stopband);
-
-                if ((passband - stopband) <= filter_target) {
-                        rfcsr24++;
-                        overtuned += ((passband - stopband) == filter_target);
-                } else
-                        break;
-
-                rt2800usb_rfcsr_write(rt2x00dev, 24, rfcsr24);
-        }
-
-        rfcsr24 -= !!overtuned;
-
-        rt2800usb_rfcsr_write(rt2x00dev, 24, rfcsr24);
-        return rfcsr24;
-}
-
-static int rt2800usb_init_rfcsr(struct rt2x00_dev *rt2x00dev)
-{
-        u8 rfcsr;
-        u8 bbp;
-
-        if (rt2x00_rev(&rt2x00dev->chip) != RT3070_VERSION)
-                return 0;
-
-        /*
-         * Init RF calibration.
-         */
-        rt2800usb_rfcsr_read(rt2x00dev, 30, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 1);
-        rt2800usb_rfcsr_write(rt2x00dev, 30, rfcsr);
-        msleep(1);
-        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 0);
-        rt2800usb_rfcsr_write(rt2x00dev, 30, rfcsr);
-
-        rt2800usb_rfcsr_write(rt2x00dev, 4, 0x40);
-        rt2800usb_rfcsr_write(rt2x00dev, 5, 0x03);
-        rt2800usb_rfcsr_write(rt2x00dev, 6, 0x02);
-        rt2800usb_rfcsr_write(rt2x00dev, 7, 0x70);
-        rt2800usb_rfcsr_write(rt2x00dev, 9, 0x0f);
-        rt2800usb_rfcsr_write(rt2x00dev, 10, 0x71);
-        rt2800usb_rfcsr_write(rt2x00dev, 11, 0x21);
-        rt2800usb_rfcsr_write(rt2x00dev, 12, 0x7b);
-        rt2800usb_rfcsr_write(rt2x00dev, 14, 0x90);
-        rt2800usb_rfcsr_write(rt2x00dev, 15, 0x58);
-        rt2800usb_rfcsr_write(rt2x00dev, 16, 0xb3);
-        rt2800usb_rfcsr_write(rt2x00dev, 17, 0x92);
-        rt2800usb_rfcsr_write(rt2x00dev, 18, 0x2c);
-        rt2800usb_rfcsr_write(rt2x00dev, 19, 0x02);
-        rt2800usb_rfcsr_write(rt2x00dev, 20, 0xba);
-        rt2800usb_rfcsr_write(rt2x00dev, 21, 0xdb);
-        rt2800usb_rfcsr_write(rt2x00dev, 24, 0x16);
-        rt2800usb_rfcsr_write(rt2x00dev, 25, 0x01);
-        rt2800usb_rfcsr_write(rt2x00dev, 27, 0x03);
-        rt2800usb_rfcsr_write(rt2x00dev, 29, 0x1f);
-
-        /*
-         * Set RX Filter calibration for 20MHz and 40MHz
-         */
-        rt2x00dev->calibration[0] =
-            rt2800usb_init_rx_filter(rt2x00dev, false, 0x07, 0x16);
-        rt2x00dev->calibration[1] =
-            rt2800usb_init_rx_filter(rt2x00dev, true, 0x27, 0x19);
-
-        /*
-         * Set back to initial state
-         */
-        rt2800usb_bbp_write(rt2x00dev, 24, 0);
-
-        rt2800usb_rfcsr_read(rt2x00dev, 22, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR22_BASEBAND_LOOPBACK, 0);
-        rt2800usb_rfcsr_write(rt2x00dev, 22, rfcsr);
-
-        /*
-         * set BBP back to BW20
-         */
-        rt2800usb_bbp_read(rt2x00dev, 4, &bbp);
-        rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 0);
-        rt2800usb_bbp_write(rt2x00dev, 4, bbp);
-
-        return 0;
-}
-
-/*
  * Device state switch handlers.
  */
 static void rt2800usb_toggle_rx(struct rt2x00_dev *rt2x00dev,
@@ -1778,29 +239,11 @@ static void rt2800usb_toggle_rx(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        rt2x00usb_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
         rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX,
                            (state == STATE_RADIO_RX_ON) ||
                            (state == STATE_RADIO_RX_ON_LINK));
-        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
-}
-
-static int rt2800usb_wait_wpdma_ready(struct rt2x00_dev *rt2x00dev)
-{
-        unsigned int i;
-        u32 reg;
-
-        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00usb_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
-                if (!rt2x00_get_field32(reg, WPDMA_GLO_CFG_TX_DMA_BUSY) &&
-                    !rt2x00_get_field32(reg, WPDMA_GLO_CFG_RX_DMA_BUSY))
-                        return 0;
-
-                msleep(1);
-        }
-
-        ERROR(rt2x00dev, "WPDMA TX/RX busy, aborting.\n");
-        return -EACCES;
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
 }
 
 static int rt2800usb_enable_radio(struct rt2x00_dev *rt2x00dev)
@@ -1811,30 +254,28 @@ static int rt2800usb_enable_radio(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize all registers.
          */
-        if (unlikely(rt2800usb_wait_wpdma_ready(rt2x00dev) ||
-                     rt2800usb_init_registers(rt2x00dev) ||
-                     rt2800usb_init_bbp(rt2x00dev) ||
-                     rt2800usb_init_rfcsr(rt2x00dev)))
+        if (unlikely(rt2800_wait_wpdma_ready(rt2x00dev) ||
+                     rt2800_init_registers(rt2x00dev) ||
+                     rt2800_init_bbp(rt2x00dev) ||
+                     rt2800_init_rfcsr(rt2x00dev)))
                 return -EIO;
 
-        rt2x00usb_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
         rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
-        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
 
         udelay(50);
 
-        rt2x00usb_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
         rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
         rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 1);
         rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 1);
-        rt2x00usb_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
 
 
-        rt2x00usb_register_read(rt2x00dev, USB_DMA_CFG, &reg);
+        rt2800_register_read(rt2x00dev, USB_DMA_CFG, &reg);
         rt2x00_set_field32(&reg, USB_DMA_CFG_PHY_CLEAR, 0);
-        /* Don't use bulk in aggregation when working with USB 1.1 */
-        rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_AGG_EN,
-                           (rt2x00dev->rx->usb_maxpacket == 512));
+        rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_AGG_EN, 0);
         rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_AGG_TIMEOUT, 128);
         /*
          * Total room for RX frames in kilobytes, PBF might still exceed
@@ -1844,26 +285,26 @@ static int rt2800usb_enable_radio(struct rt2x00_dev *rt2x00dev)
                            ((RX_ENTRIES * DATA_FRAME_SIZE) / 1024) - 3);
         rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_EN, 1);
         rt2x00_set_field32(&reg, USB_DMA_CFG_TX_BULK_EN, 1);
-        rt2x00usb_register_write(rt2x00dev, USB_DMA_CFG, reg);
+        rt2800_register_write(rt2x00dev, USB_DMA_CFG, reg);
 
-        rt2x00usb_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
         rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
         rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 1);
-        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
 
         /*
          * Initialize LED control
          */
         rt2x00_eeprom_read(rt2x00dev, EEPROM_LED1, &word);
-        rt2800usb_mcu_request(rt2x00dev, MCU_LED_1, 0xff,
+        rt2800_mcu_request(rt2x00dev, MCU_LED_1, 0xff,
                               word & 0xff, (word >> 8) & 0xff);
 
         rt2x00_eeprom_read(rt2x00dev, EEPROM_LED2, &word);
-        rt2800usb_mcu_request(rt2x00dev, MCU_LED_2, 0xff,
+        rt2800_mcu_request(rt2x00dev, MCU_LED_2, 0xff,
                               word & 0xff, (word >> 8) & 0xff);
 
         rt2x00_eeprom_read(rt2x00dev, EEPROM_LED3, &word);
-        rt2800usb_mcu_request(rt2x00dev, MCU_LED_3, 0xff,
+        rt2800_mcu_request(rt2x00dev, MCU_LED_3, 0xff,
                               word & 0xff, (word >> 8) & 0xff);
 
         return 0;
@@ -1873,17 +314,17 @@ static void rt2800usb_disable_radio(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
 
-        rt2x00usb_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
         rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
         rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
-        rt2x00usb_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
 
-        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, 0);
-        rt2x00usb_register_write(rt2x00dev, PWR_PIN_CFG, 0);
-        rt2x00usb_register_write(rt2x00dev, TX_PIN_CFG, 0);
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0);
+        rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0);
+        rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0);
 
         /* Wait for DMA, ignore error */
-        rt2800usb_wait_wpdma_ready(rt2x00dev);
+        rt2800_wait_wpdma_ready(rt2x00dev);
 
         rt2x00usb_disable_radio(rt2x00dev);
 }
@@ -1892,9 +333,9 @@ static int rt2800usb_set_state(struct rt2x00_dev *rt2x00dev,
                                enum dev_state state)
 {
         if (state == STATE_AWAKE)
-                rt2800usb_mcu_request(rt2x00dev, MCU_WAKEUP, 0xff, 0, 0);
+                rt2800_mcu_request(rt2x00dev, MCU_WAKEUP, 0xff, 0, 0);
         else
-                rt2800usb_mcu_request(rt2x00dev, MCU_SLEEP, 0xff, 0, 2);
+                rt2800_mcu_request(rt2x00dev, MCU_SLEEP, 0xff, 0, 2);
 
         return 0;
 }
@@ -2048,9 +489,9 @@ static void rt2800usb_write_beacon(struct queue_entry *entry)
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
-        rt2x00usb_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
         rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
-        rt2x00usb_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
 
         /*
          * Write entire beacon with descriptor to register.
@@ -2093,12 +534,12 @@ static void rt2800usb_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
                 return;
         }
 
-        rt2x00usb_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
         if (!rt2x00_get_field32(reg, BCN_TIME_CFG_BEACON_GEN)) {
                 rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
                 rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
                 rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
-                rt2x00usb_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+                rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
         }
 }
 
@@ -2110,30 +551,46 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
-        __le32 *rxd = (__le32 *)entry->skb->data;
+        __le32 *rxi = (__le32 *)entry->skb->data;
         __le32 *rxwi;
-        u32 rxd0;
+        __le32 *rxd;
+        u32 rxi0;
         u32 rxwi0;
         u32 rxwi1;
         u32 rxwi2;
         u32 rxwi3;
+        u32 rxd0;
+        int rx_pkt_len;
+
+        /*
+         * RX frame format is :
+         * | RXINFO | RXWI | header | L2 pad | payload | pad | RXD | USB pad |
+         *          |<------------ rx_pkt_len -------------->|
+         */
+        rt2x00_desc_read(rxi, 0, &rxi0);
+        rx_pkt_len = rt2x00_get_field32(rxi0, RXINFO_W0_USB_DMA_RX_PKT_LEN);
+
+        rxwi = (__le32 *)(entry->skb->data + RXINFO_DESC_SIZE);
+
+        /*
+         * FIXME : we need to check for rx_pkt_len validity
+         */
+        rxd = (__le32 *)(entry->skb->data + RXINFO_DESC_SIZE + rx_pkt_len);
 
         /*
          * Copy descriptor to the skbdesc->desc buffer, making it safe from
          * moving of frame data in rt2x00usb.
          */
-        memcpy(skbdesc->desc, rxd, skbdesc->desc_len);
-        rxd = (__le32 *)skbdesc->desc;
-        rxwi = &rxd[RXD_DESC_SIZE / sizeof(__le32)];
+        memcpy(skbdesc->desc, rxi, skbdesc->desc_len);
 
         /*
          * It is now safe to read the descriptor on all architectures.
          */
-        rt2x00_desc_read(rxd, 0, &rxd0);
         rt2x00_desc_read(rxwi, 0, &rxwi0);
         rt2x00_desc_read(rxwi, 1, &rxwi1);
         rt2x00_desc_read(rxwi, 2, &rxwi2);
         rt2x00_desc_read(rxwi, 3, &rxwi3);
+        rt2x00_desc_read(rxd, 0, &rxd0);
 
         if (rt2x00_get_field32(rxd0, RXD_W0_CRC_ERROR))
                 rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
@@ -2162,10 +619,8 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
         if (rt2x00_get_field32(rxd0, RXD_W0_MY_BSS))
                 rxdesc->dev_flags |= RXDONE_MY_BSS;
 
-        if (rt2x00_get_field32(rxd0, RXD_W0_L2PAD)) {
+        if (rt2x00_get_field32(rxd0, RXD_W0_L2PAD))
                 rxdesc->dev_flags |= RXDONE_L2PAD;
-                skbdesc->flags |= SKBDESC_L2_PADDED;
-        }
 
         if (rt2x00_get_field32(rxwi1, RXWI_W1_SHORT_GI))
                 rxdesc->flags |= RX_FLAG_SHORT_GI;
@@ -2200,7 +655,6 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
          * Remove RXWI descriptor from start of buffer.
          */
         skb_pull(entry->skb, skbdesc->desc_len);
-        skb_trim(entry->skb, rxdesc->size);
 }
 
 /*
@@ -2208,402 +662,33 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
  */
 static int rt2800usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
 {
-        u16 word;
-        u8 *mac;
-        u8 default_lna_gain;
-
-        rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom, EEPROM_SIZE);
-
-        /*
-         * Start validation of the data that has been read.
-         */
-        mac = rt2x00_eeprom_addr(rt2x00dev, EEPROM_MAC_ADDR_0);
-        if (!is_valid_ether_addr(mac)) {
-                random_ether_addr(mac);
-                EEPROM(rt2x00dev, "MAC: %pM\n", mac);
-        }
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &word);
-        if (word == 0xffff) {
-                rt2x00_set_field16(&word, EEPROM_ANTENNA_RXPATH, 2);
-                rt2x00_set_field16(&word, EEPROM_ANTENNA_TXPATH, 1);
-                rt2x00_set_field16(&word, EEPROM_ANTENNA_RF_TYPE, RF2820);
-                rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
-                EEPROM(rt2x00dev, "Antenna: 0x%04x\n", word);
-        } else if (rt2x00_rev(&rt2x00dev->chip) < RT2883_VERSION) {
-                /*
-                 * There is a max of 2 RX streams for RT2870 series
-                 */
-                if (rt2x00_get_field16(word, EEPROM_ANTENNA_RXPATH) > 2)
-                        rt2x00_set_field16(&word, EEPROM_ANTENNA_RXPATH, 2);
-                rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
-        }
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC, &word);
-        if (word == 0xffff) {
-                rt2x00_set_field16(&word, EEPROM_NIC_HW_RADIO, 0);
-                rt2x00_set_field16(&word, EEPROM_NIC_DYNAMIC_TX_AGC, 0);
-                rt2x00_set_field16(&word, EEPROM_NIC_EXTERNAL_LNA_BG, 0);
-                rt2x00_set_field16(&word, EEPROM_NIC_EXTERNAL_LNA_A, 0);
-                rt2x00_set_field16(&word, EEPROM_NIC_CARDBUS_ACCEL, 0);
-                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_SB_BG, 0);
-                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_SB_A, 0);
-                rt2x00_set_field16(&word, EEPROM_NIC_WPS_PBC, 0);
-                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_BG, 0);
-                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_A, 0);
-                rt2x00_eeprom_write(rt2x00dev, EEPROM_NIC, word);
-                EEPROM(rt2x00dev, "NIC: 0x%04x\n", word);
-        }
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ, &word);
-        if ((word & 0x00ff) == 0x00ff) {
-                rt2x00_set_field16(&word, EEPROM_FREQ_OFFSET, 0);
-                rt2x00_set_field16(&word, EEPROM_FREQ_LED_MODE,
-                                   LED_MODE_TXRX_ACTIVITY);
-                rt2x00_set_field16(&word, EEPROM_FREQ_LED_POLARITY, 0);
-                rt2x00_eeprom_write(rt2x00dev, EEPROM_FREQ, word);
-                rt2x00_eeprom_write(rt2x00dev, EEPROM_LED1, 0x5555);
-                rt2x00_eeprom_write(rt2x00dev, EEPROM_LED2, 0x2221);
-                rt2x00_eeprom_write(rt2x00dev, EEPROM_LED3, 0xa9f8);
-                EEPROM(rt2x00dev, "Freq: 0x%04x\n", word);
-        }
-
-        /*
-         * During the LNA validation we are going to use
-         * lna0 as correct value. Note that EEPROM_LNA
-         * is never validated.
-         */
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_LNA, &word);
-        default_lna_gain = rt2x00_get_field16(word, EEPROM_LNA_A0);
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG, &word);
-        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG_OFFSET0)) > 10)
-                rt2x00_set_field16(&word, EEPROM_RSSI_BG_OFFSET0, 0);
-        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG_OFFSET1)) > 10)
-                rt2x00_set_field16(&word, EEPROM_RSSI_BG_OFFSET1, 0);
-        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_BG, word);
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2, &word);
-        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG2_OFFSET2)) > 10)
-                rt2x00_set_field16(&word, EEPROM_RSSI_BG2_OFFSET2, 0);
-        if (rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0x00 ||
-            rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0xff)
-                rt2x00_set_field16(&word, EEPROM_RSSI_BG2_LNA_A1,
-                                   default_lna_gain);
-        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_BG2, word);
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_A, &word);
-        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A_OFFSET0)) > 10)
-                rt2x00_set_field16(&word, EEPROM_RSSI_A_OFFSET0, 0);
-        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A_OFFSET1)) > 10)
-                rt2x00_set_field16(&word, EEPROM_RSSI_A_OFFSET1, 0);
-        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_A, word);
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_A2, &word);
-        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A2_OFFSET2)) > 10)
-                rt2x00_set_field16(&word, EEPROM_RSSI_A2_OFFSET2, 0);
-        if (rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0x00 ||
-            rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0xff)
-                rt2x00_set_field16(&word, EEPROM_RSSI_A2_LNA_A2,
-                                   default_lna_gain);
-        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
+        if (rt2800_efuse_detect(rt2x00dev))
+                rt2800_read_eeprom_efuse(rt2x00dev);
+        else
+                rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom,
+                                      EEPROM_SIZE);
 
-        return 0;
+        return rt2800_validate_eeprom(rt2x00dev);
 }
 
-static int rt2800usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
-{
-        u32 reg;
-        u16 value;
-        u16 eeprom;
-
-        /*
-         * Read EEPROM word for configuration.
-         */
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &eeprom);
-
-        /*
-         * Identify RF chipset.
-         */
-        value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
-        rt2x00usb_register_read(rt2x00dev, MAC_CSR0, &reg);
-        rt2x00_set_chip(rt2x00dev, RT2870, value, reg);
-
-        /*
-         * The check for rt2860 is not a typo, some rt2870 hardware
-         * identifies itself as rt2860 in the CSR register.
-         */
-        if (!rt2x00_check_rev(&rt2x00dev->chip, 0xfff00000, 0x28600000) &&
-            !rt2x00_check_rev(&rt2x00dev->chip, 0xfff00000, 0x28700000) &&
-            !rt2x00_check_rev(&rt2x00dev->chip, 0xfff00000, 0x28800000) &&
-            !rt2x00_check_rev(&rt2x00dev->chip, 0xffff0000, 0x30700000)) {
-                ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
-                return -ENODEV;
-        }
-
-        if (!rt2x00_rf(&rt2x00dev->chip, RF2820) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2850) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2720) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2750) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF3020) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2020)) {
-                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
-                return -ENODEV;
-        }
-
-        /*
-         * Identify default antenna configuration.
-         */
-        rt2x00dev->default_ant.tx =
-            rt2x00_get_field16(eeprom, EEPROM_ANTENNA_TXPATH);
-        rt2x00dev->default_ant.rx =
-            rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RXPATH);
-
-        /*
-         * Read frequency offset and RF programming sequence.
-         */
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ, &eeprom);
-        rt2x00dev->freq_offset = rt2x00_get_field16(eeprom, EEPROM_FREQ_OFFSET);
-
-        /*
-         * Read external LNA informations.
-         */
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC, &eeprom);
-
-        if (rt2x00_get_field16(eeprom, EEPROM_NIC_EXTERNAL_LNA_A))
-                __set_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags);
-        if (rt2x00_get_field16(eeprom, EEPROM_NIC_EXTERNAL_LNA_BG))
-                __set_bit(CONFIG_EXTERNAL_LNA_BG, &rt2x00dev->flags);
-
-        /*
-         * Detect if this device has an hardware controlled radio.
-         */
-        if (rt2x00_get_field16(eeprom, EEPROM_NIC_HW_RADIO))
-                __set_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags);
-
-        /*
-         * Store led settings, for correct led behaviour.
-         */
-#ifdef CONFIG_RT2X00_LIB_LEDS
-        rt2800usb_init_led(rt2x00dev, &rt2x00dev->led_radio, LED_TYPE_RADIO);
-        rt2800usb_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
-        rt2800usb_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
+static const struct rt2800_ops rt2800usb_rt2800_ops = {
+        .register_read          = rt2x00usb_register_read,
+        .register_read_lock     = rt2x00usb_register_read_lock,
+        .register_write         = rt2x00usb_register_write,
+        .register_write_lock    = rt2x00usb_register_write_lock,
 
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ,
-                           &rt2x00dev->led_mcu_reg);
-#endif /* CONFIG_RT2X00_LIB_LEDS */
+        .register_multiread     = rt2x00usb_register_multiread,
+        .register_multiwrite    = rt2x00usb_register_multiwrite,
 
-        return 0;
-}
-
-/*
- * RF value list for rt2870
- * Supports: 2.4 GHz (all) & 5.2 GHz (RF2850 & RF2750)
- */
-static const struct rf_channel rf_vals[] = {
-        { 1,  0x18402ecc, 0x184c0786, 0x1816b455, 0x1800510b },
-        { 2,  0x18402ecc, 0x184c0786, 0x18168a55, 0x1800519f },
-        { 3,  0x18402ecc, 0x184c078a, 0x18168a55, 0x1800518b },
-        { 4,  0x18402ecc, 0x184c078a, 0x18168a55, 0x1800519f },
-        { 5,  0x18402ecc, 0x184c078e, 0x18168a55, 0x1800518b },
-        { 6,  0x18402ecc, 0x184c078e, 0x18168a55, 0x1800519f },
-        { 7,  0x18402ecc, 0x184c0792, 0x18168a55, 0x1800518b },
-        { 8,  0x18402ecc, 0x184c0792, 0x18168a55, 0x1800519f },
-        { 9,  0x18402ecc, 0x184c0796, 0x18168a55, 0x1800518b },
-        { 10, 0x18402ecc, 0x184c0796, 0x18168a55, 0x1800519f },
-        { 11, 0x18402ecc, 0x184c079a, 0x18168a55, 0x1800518b },
-        { 12, 0x18402ecc, 0x184c079a, 0x18168a55, 0x1800519f },
-        { 13, 0x18402ecc, 0x184c079e, 0x18168a55, 0x1800518b },
-        { 14, 0x18402ecc, 0x184c07a2, 0x18168a55, 0x18005193 },
-
-        /* 802.11 UNI / HyperLan 2 */
-        { 36, 0x18402ecc, 0x184c099a, 0x18158a55, 0x180ed1a3 },
-        { 38, 0x18402ecc, 0x184c099e, 0x18158a55, 0x180ed193 },
-        { 40, 0x18402ec8, 0x184c0682, 0x18158a55, 0x180ed183 },
-        { 44, 0x18402ec8, 0x184c0682, 0x18158a55, 0x180ed1a3 },
-        { 46, 0x18402ec8, 0x184c0686, 0x18158a55, 0x180ed18b },
-        { 48, 0x18402ec8, 0x184c0686, 0x18158a55, 0x180ed19b },
-        { 52, 0x18402ec8, 0x184c068a, 0x18158a55, 0x180ed193 },
-        { 54, 0x18402ec8, 0x184c068a, 0x18158a55, 0x180ed1a3 },
-        { 56, 0x18402ec8, 0x184c068e, 0x18158a55, 0x180ed18b },
-        { 60, 0x18402ec8, 0x184c0692, 0x18158a55, 0x180ed183 },
-        { 62, 0x18402ec8, 0x184c0692, 0x18158a55, 0x180ed193 },
-        { 64, 0x18402ec8, 0x184c0692, 0x18158a55, 0x180ed1a3 },
-
-        /* 802.11 HyperLan 2 */
-        { 100, 0x18402ec8, 0x184c06b2, 0x18178a55, 0x180ed783 },
-        { 102, 0x18402ec8, 0x184c06b2, 0x18578a55, 0x180ed793 },
-        { 104, 0x18402ec8, 0x185c06b2, 0x18578a55, 0x180ed1a3 },
-        { 108, 0x18402ecc, 0x185c0a32, 0x18578a55, 0x180ed193 },
-        { 110, 0x18402ecc, 0x184c0a36, 0x18178a55, 0x180ed183 },
-        { 112, 0x18402ecc, 0x184c0a36, 0x18178a55, 0x180ed19b },
-        { 116, 0x18402ecc, 0x184c0a3a, 0x18178a55, 0x180ed1a3 },
-        { 118, 0x18402ecc, 0x184c0a3e, 0x18178a55, 0x180ed193 },
-        { 120, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed183 },
-        { 124, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed193 },
-        { 126, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed15b },
-        { 128, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed1a3 },
-        { 132, 0x18402ec4, 0x184c0386, 0x18178a55, 0x180ed18b },
-        { 134, 0x18402ec4, 0x184c0386, 0x18178a55, 0x180ed193 },
-        { 136, 0x18402ec4, 0x184c0386, 0x18178a55, 0x180ed19b },
-        { 140, 0x18402ec4, 0x184c038a, 0x18178a55, 0x180ed183 },
-
-        /* 802.11 UNII */
-        { 149, 0x18402ec4, 0x184c038a, 0x18178a55, 0x180ed1a7 },
-        { 151, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed187 },
-        { 153, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed18f },
-        { 157, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed19f },
-        { 159, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed1a7 },
-        { 161, 0x18402ec4, 0x184c0392, 0x18178a55, 0x180ed187 },
-        { 165, 0x18402ec4, 0x184c0392, 0x18178a55, 0x180ed197 },
-        { 167, 0x18402ec4, 0x184c03d2, 0x18179855, 0x1815531f },
-        { 169, 0x18402ec4, 0x184c03d2, 0x18179855, 0x18155327 },
-        { 171, 0x18402ec4, 0x184c03d6, 0x18179855, 0x18155307 },
-        { 173, 0x18402ec4, 0x184c03d6, 0x18179855, 0x1815530f },
-
-        /* 802.11 Japan */
-        { 184, 0x15002ccc, 0x1500491e, 0x1509be55, 0x150c0a0b },
-        { 188, 0x15002ccc, 0x15004922, 0x1509be55, 0x150c0a13 },
-        { 192, 0x15002ccc, 0x15004926, 0x1509be55, 0x150c0a1b },
-        { 196, 0x15002ccc, 0x1500492a, 0x1509be55, 0x150c0a23 },
-        { 208, 0x15002ccc, 0x1500493a, 0x1509be55, 0x150c0a13 },
-        { 212, 0x15002ccc, 0x1500493e, 0x1509be55, 0x150c0a1b },
-        { 216, 0x15002ccc, 0x15004982, 0x1509be55, 0x150c0a23 },
+        .regbusy_read           = rt2x00usb_regbusy_read,
 };
 
-/*
- * RF value list for rt3070
- * Supports: 2.4 GHz
- */
-static const struct rf_channel rf_vals_3070[] = {
-        {1,  241, 2, 2 },
-        {2,  241, 2, 7 },
-        {3,  242, 2, 2 },
-        {4,  242, 2, 7 },
-        {5,  243, 2, 2 },
-        {6,  243, 2, 7 },
-        {7,  244, 2, 2 },
-        {8,  244, 2, 7 },
-        {9,  245, 2, 2 },
-        {10, 245, 2, 7 },
-        {11, 246, 2, 2 },
-        {12, 246, 2, 7 },
-        {13, 247, 2, 2 },
-        {14, 248, 2, 4 },
-};
-
-static int rt2800usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
-{
-        struct hw_mode_spec *spec = &rt2x00dev->spec;
-        struct channel_info *info;
-        char *tx_power1;
-        char *tx_power2;
-        unsigned int i;
-        u16 eeprom;
-
-        /*
-         * Initialize all hw fields.
-         */
-        rt2x00dev->hw->flags =
-            IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
-            IEEE80211_HW_SIGNAL_DBM |
-            IEEE80211_HW_SUPPORTS_PS |
-            IEEE80211_HW_PS_NULLFUNC_STACK;
-        rt2x00dev->hw->extra_tx_headroom = TXINFO_DESC_SIZE + TXWI_DESC_SIZE;
-
-        SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
-        SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
-                                rt2x00_eeprom_addr(rt2x00dev,
-                                                   EEPROM_MAC_ADDR_0));
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &eeprom);
-
-        /*
-         * Initialize HT information.
-         */
-        spec->ht.ht_supported = true;
-        spec->ht.cap =
-            IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
-            IEEE80211_HT_CAP_GRN_FLD |
-            IEEE80211_HT_CAP_SGI_20 |
-            IEEE80211_HT_CAP_SGI_40 |
-            IEEE80211_HT_CAP_TX_STBC |
-            IEEE80211_HT_CAP_RX_STBC |
-            IEEE80211_HT_CAP_PSMP_SUPPORT;
-        spec->ht.ampdu_factor = 3;
-        spec->ht.ampdu_density = 4;
-        spec->ht.mcs.tx_params =
-            IEEE80211_HT_MCS_TX_DEFINED |
-            IEEE80211_HT_MCS_TX_RX_DIFF |
-            ((rt2x00_get_field16(eeprom, EEPROM_ANTENNA_TXPATH) - 1) <<
-                IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT);
-
-        switch (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RXPATH)) {
-        case 3:
-                spec->ht.mcs.rx_mask[2] = 0xff;
-        case 2:
-                spec->ht.mcs.rx_mask[1] = 0xff;
-        case 1:
-                spec->ht.mcs.rx_mask[0] = 0xff;
-                spec->ht.mcs.rx_mask[4] = 0x1; /* MCS32 */
-                break;
-        }
-
-        /*
-         * Initialize hw_mode information.
-         */
-        spec->supported_bands = SUPPORT_BAND_2GHZ;
-        spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
-
-        if (rt2x00_rf(&rt2x00dev->chip, RF2820) ||
-            rt2x00_rf(&rt2x00dev->chip, RF2720)) {
-                spec->num_channels = 14;
-                spec->channels = rf_vals;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2850) ||
-                   rt2x00_rf(&rt2x00dev->chip, RF2750)) {
-                spec->supported_bands |= SUPPORT_BAND_5GHZ;
-                spec->num_channels = ARRAY_SIZE(rf_vals);
-                spec->channels = rf_vals;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF3020) ||
-                   rt2x00_rf(&rt2x00dev->chip, RF2020)) {
-                spec->num_channels = ARRAY_SIZE(rf_vals_3070);
-                spec->channels = rf_vals_3070;
-        }
-
-        /*
-         * Create channel information array
-         */
-        info = kzalloc(spec->num_channels * sizeof(*info), GFP_KERNEL);
-        if (!info)
-                return -ENOMEM;
-
-        spec->channels_info = info;
-
-        tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
-        tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
-
-        for (i = 0; i < 14; i++) {
-                info[i].tx_power1 = TXPOWER_G_FROM_DEV(tx_power1[i]);
-                info[i].tx_power2 = TXPOWER_G_FROM_DEV(tx_power2[i]);
-        }
-
-        if (spec->num_channels > 14) {
-                tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A1);
-                tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
-
-                for (i = 14; i < spec->num_channels; i++) {
-                        info[i].tx_power1 = TXPOWER_A_FROM_DEV(tx_power1[i]);
-                        info[i].tx_power2 = TXPOWER_A_FROM_DEV(tx_power2[i]);
-                }
-        }
-
-        return 0;
-}
-
 static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
 
+        rt2x00dev->priv = (void *)&rt2800usb_rt2800_ops;
+
         /*
          * Allocate eeprom data.
          */
@@ -2611,14 +696,14 @@ static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
         if (retval)
                 return retval;
 
-        retval = rt2800usb_init_eeprom(rt2x00dev);
+        retval = rt2800_init_eeprom(rt2x00dev);
         if (retval)
                 return retval;
 
         /*
          * Initialize hw specifications.
          */
-        retval = rt2800usb_probe_hw_mode(rt2x00dev);
+        retval = rt2800_probe_hw_mode(rt2x00dev);
         if (retval)
                 return retval;
 
@@ -2645,162 +730,6 @@ static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
         return 0;
 }
 
-/*
- * IEEE80211 stack callback functions.
- */
-static void rt2800usb_get_tkip_seq(struct ieee80211_hw *hw, u8 hw_key_idx,
-                                   u32 *iv32, u16 *iv16)
-{
-        struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct mac_iveiv_entry iveiv_entry;
-        u32 offset;
-
-        offset = MAC_IVEIV_ENTRY(hw_key_idx);
-        rt2x00usb_register_multiread(rt2x00dev, offset,
-                                      &iveiv_entry, sizeof(iveiv_entry));
-
-        memcpy(&iveiv_entry.iv[0], iv16, sizeof(iv16));
-        memcpy(&iveiv_entry.iv[4], iv32, sizeof(iv32));
-}
-
-static int rt2800usb_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
-{
-        struct rt2x00_dev *rt2x00dev = hw->priv;
-        u32 reg;
-        bool enabled = (value < IEEE80211_MAX_RTS_THRESHOLD);
-
-        rt2x00usb_register_read(rt2x00dev, TX_RTS_CFG, &reg);
-        rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_THRES, value);
-        rt2x00usb_register_write(rt2x00dev, TX_RTS_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, CCK_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, CCK_PROT_CFG_RTS_TH_EN, enabled);
-        rt2x00usb_register_write(rt2x00dev, CCK_PROT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_RTS_TH_EN, enabled);
-        rt2x00usb_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, MM20_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, MM20_PROT_CFG_RTS_TH_EN, enabled);
-        rt2x00usb_register_write(rt2x00dev, MM20_PROT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, MM40_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, MM40_PROT_CFG_RTS_TH_EN, enabled);
-        rt2x00usb_register_write(rt2x00dev, MM40_PROT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, GF20_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, GF20_PROT_CFG_RTS_TH_EN, enabled);
-        rt2x00usb_register_write(rt2x00dev, GF20_PROT_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, GF40_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, GF40_PROT_CFG_RTS_TH_EN, enabled);
-        rt2x00usb_register_write(rt2x00dev, GF40_PROT_CFG, reg);
-
-        return 0;
-}
-
-static int rt2800usb_conf_tx(struct ieee80211_hw *hw, u16 queue_idx,
-                             const struct ieee80211_tx_queue_params *params)
-{
-        struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct data_queue *queue;
-        struct rt2x00_field32 field;
-        int retval;
-        u32 reg;
-        u32 offset;
-
-        /*
-         * First pass the configuration through rt2x00lib, that will
-         * update the queue settings and validate the input. After that
-         * we are free to update the registers based on the value
-         * in the queue parameter.
-         */
-        retval = rt2x00mac_conf_tx(hw, queue_idx, params);
-        if (retval)
-                return retval;
-
-        /*
-         * We only need to perform additional register initialization
-         * for WMM queues/
-         */
-        if (queue_idx >= 4)
-                return 0;
-
-        queue = rt2x00queue_get_queue(rt2x00dev, queue_idx);
-
-        /* Update WMM TXOP register */
-        offset = WMM_TXOP0_CFG + (sizeof(u32) * (!!(queue_idx & 2)));
-        field.bit_offset = (queue_idx & 1) * 16;
-        field.bit_mask = 0xffff << field.bit_offset;
-
-        rt2x00usb_register_read(rt2x00dev, offset, &reg);
-        rt2x00_set_field32(&reg, field, queue->txop);
-        rt2x00usb_register_write(rt2x00dev, offset, reg);
-
-        /* Update WMM registers */
-        field.bit_offset = queue_idx * 4;
-        field.bit_mask = 0xf << field.bit_offset;
-
-        rt2x00usb_register_read(rt2x00dev, WMM_AIFSN_CFG, &reg);
-        rt2x00_set_field32(&reg, field, queue->aifs);
-        rt2x00usb_register_write(rt2x00dev, WMM_AIFSN_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, WMM_CWMIN_CFG, &reg);
-        rt2x00_set_field32(&reg, field, queue->cw_min);
-        rt2x00usb_register_write(rt2x00dev, WMM_CWMIN_CFG, reg);
-
-        rt2x00usb_register_read(rt2x00dev, WMM_CWMAX_CFG, &reg);
-        rt2x00_set_field32(&reg, field, queue->cw_max);
-        rt2x00usb_register_write(rt2x00dev, WMM_CWMAX_CFG, reg);
-
-        /* Update EDCA registers */
-        offset = EDCA_AC0_CFG + (sizeof(u32) * queue_idx);
-
-        rt2x00usb_register_read(rt2x00dev, offset, &reg);
-        rt2x00_set_field32(&reg, EDCA_AC0_CFG_TX_OP, queue->txop);
-        rt2x00_set_field32(&reg, EDCA_AC0_CFG_AIFSN, queue->aifs);
-        rt2x00_set_field32(&reg, EDCA_AC0_CFG_CWMIN, queue->cw_min);
-        rt2x00_set_field32(&reg, EDCA_AC0_CFG_CWMAX, queue->cw_max);
-        rt2x00usb_register_write(rt2x00dev, offset, reg);
-
-        return 0;
-}
-
-static u64 rt2800usb_get_tsf(struct ieee80211_hw *hw)
-{
-        struct rt2x00_dev *rt2x00dev = hw->priv;
-        u64 tsf;
-        u32 reg;
-
-        rt2x00usb_register_read(rt2x00dev, TSF_TIMER_DW1, &reg);
-        tsf = (u64) rt2x00_get_field32(reg, TSF_TIMER_DW1_HIGH_WORD) << 32;
-        rt2x00usb_register_read(rt2x00dev, TSF_TIMER_DW0, &reg);
-        tsf |= rt2x00_get_field32(reg, TSF_TIMER_DW0_LOW_WORD);
-
-        return tsf;
-}
-
-static const struct ieee80211_ops rt2800usb_mac80211_ops = {
-        .tx                     = rt2x00mac_tx,
-        .start                  = rt2x00mac_start,
-        .stop                   = rt2x00mac_stop,
-        .add_interface          = rt2x00mac_add_interface,
-        .remove_interface       = rt2x00mac_remove_interface,
-        .config                 = rt2x00mac_config,
-        .configure_filter       = rt2x00mac_configure_filter,
-        .set_tim                = rt2x00mac_set_tim,
-        .set_key                = rt2x00mac_set_key,
-        .get_stats              = rt2x00mac_get_stats,
-        .get_tkip_seq           = rt2800usb_get_tkip_seq,
-        .set_rts_threshold      = rt2800usb_set_rts_threshold,
-        .bss_info_changed       = rt2x00mac_bss_info_changed,
-        .conf_tx                = rt2800usb_conf_tx,
-        .get_tx_stats           = rt2x00mac_get_tx_stats,
-        .get_tsf                = rt2800usb_get_tsf,
-        .rfkill_poll            = rt2x00mac_rfkill_poll,
-};
-
 static const struct rt2x00lib_ops rt2800usb_rt2x00_ops = {
         .probe_hw               = rt2800usb_probe_hw,
         .get_firmware_name      = rt2800usb_get_firmware_name,
@@ -2810,10 +739,10 @@ static const struct rt2x00lib_ops rt2800usb_rt2x00_ops = {
         .uninitialize           = rt2x00usb_uninitialize,
         .clear_entry            = rt2x00usb_clear_entry,
         .set_device_state       = rt2800usb_set_device_state,
-        .rfkill_poll            = rt2800usb_rfkill_poll,
-        .link_stats             = rt2800usb_link_stats,
-        .reset_tuner            = rt2800usb_reset_tuner,
-        .link_tuner             = rt2800usb_link_tuner,
+        .rfkill_poll            = rt2800_rfkill_poll,
+        .link_stats             = rt2800_link_stats,
+        .reset_tuner            = rt2800_reset_tuner,
+        .link_tuner             = rt2800_link_tuner,
         .write_tx_desc          = rt2800usb_write_tx_desc,
         .write_tx_data          = rt2x00usb_write_tx_data,
         .write_beacon           = rt2800usb_write_beacon,
@@ -2821,19 +750,19 @@ static const struct rt2x00lib_ops rt2800usb_rt2x00_ops = {
         .kick_tx_queue          = rt2800usb_kick_tx_queue,
         .kill_tx_queue          = rt2x00usb_kill_tx_queue,
         .fill_rxdone            = rt2800usb_fill_rxdone,
-        .config_shared_key      = rt2800usb_config_shared_key,
-        .config_pairwise_key    = rt2800usb_config_pairwise_key,
-        .config_filter          = rt2800usb_config_filter,
-        .config_intf            = rt2800usb_config_intf,
-        .config_erp             = rt2800usb_config_erp,
-        .config_ant             = rt2800usb_config_ant,
-        .config                 = rt2800usb_config,
+        .config_shared_key      = rt2800_config_shared_key,
+        .config_pairwise_key    = rt2800_config_pairwise_key,
+        .config_filter          = rt2800_config_filter,
+        .config_intf            = rt2800_config_intf,
+        .config_erp             = rt2800_config_erp,
+        .config_ant             = rt2800_config_ant,
+        .config                 = rt2800_config,
 };
 
 static const struct data_queue_desc rt2800usb_queue_rx = {
         .entry_num              = RX_ENTRIES,
         .data_size              = AGGREGATION_SIZE,
-        .desc_size              = RXD_DESC_SIZE + RXWI_DESC_SIZE,
+        .desc_size              = RXINFO_DESC_SIZE + RXWI_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_usb),
 };
 
@@ -2852,19 +781,20 @@ static const struct data_queue_desc rt2800usb_queue_bcn = {
 };
 
 static const struct rt2x00_ops rt2800usb_ops = {
-        .name           = KBUILD_MODNAME,
-        .max_sta_intf   = 1,
-        .max_ap_intf    = 8,
-        .eeprom_size    = EEPROM_SIZE,
-        .rf_size        = RF_SIZE,
-        .tx_queues      = NUM_TX_QUEUES,
-        .rx             = &rt2800usb_queue_rx,
-        .tx             = &rt2800usb_queue_tx,
-        .bcn            = &rt2800usb_queue_bcn,
-        .lib            = &rt2800usb_rt2x00_ops,
-        .hw             = &rt2800usb_mac80211_ops,
+        .name                   = KBUILD_MODNAME,
+        .max_sta_intf           = 1,
+        .max_ap_intf            = 8,
+        .eeprom_size            = EEPROM_SIZE,
+        .rf_size                = RF_SIZE,
+        .tx_queues              = NUM_TX_QUEUES,
+        .extra_tx_headroom      = TXINFO_DESC_SIZE + TXWI_DESC_SIZE,
+        .rx                     = &rt2800usb_queue_rx,
+        .tx                     = &rt2800usb_queue_tx,
+        .bcn                    = &rt2800usb_queue_bcn,
+        .lib                    = &rt2800usb_rt2x00_ops,
+        .hw                     = &rt2800_mac80211_ops,
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
-        .debugfs        = &rt2800usb_rt2x00debug,
+        .debugfs                = &rt2800_rt2x00debug,
 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
 };
 
@@ -2875,43 +805,27 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Abocom */
         { USB_DEVICE(0x07b8, 0x2870), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07b8, 0x2770), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07b8, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07b8, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07b8, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1482, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* AirTies */
-        { USB_DEVICE(0x1eda, 0x2310), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Amigo */
-        { USB_DEVICE(0x0e0b, 0x9031), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0e0b, 0x9041), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Amit */
         { USB_DEVICE(0x15c5, 0x0008), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Askey */
+        { USB_DEVICE(0x1690, 0x0740), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* ASUS */
         { USB_DEVICE(0x0b05, 0x1731), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0b05, 0x1732), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0b05, 0x1742), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0b05, 0x1760), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0b05, 0x1761), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* AzureWave */
         { USB_DEVICE(0x13d3, 0x3247), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x13d3, 0x3262), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x13d3, 0x3273), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x13d3, 0x3284), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Belkin */
         { USB_DEVICE(0x050d, 0x8053), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x050d, 0x805c), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x050d, 0x815c), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x050d, 0x825a), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Buffalo */
         { USB_DEVICE(0x0411, 0x00e8), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0411, 0x012e), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Conceptronic */
         { USB_DEVICE(0x14b2, 0x3c06), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x14b2, 0x3c07), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x14b2, 0x3c08), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x14b2, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x14b2, 0x3c11), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x14b2, 0x3c12), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x14b2, 0x3c23), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x14b2, 0x3c25), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x14b2, 0x3c27), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -2920,83 +834,38 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07aa, 0x002f), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07aa, 0x003c), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07aa, 0x003f), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x18c5, 0x0008), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x18c5, 0x0012), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* D-Link */
         { USB_DEVICE(0x07d1, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07d1, 0x3c0a), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07d1, 0x3c0b), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07d1, 0x3c0d), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07d1, 0x3c0e), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07d1, 0x3c0f), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c11), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07d1, 0x3c13), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Edimax */
-        { USB_DEVICE(0x7392, 0x7711), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x7392, 0x7717), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x7392, 0x7718), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Encore */
-        { USB_DEVICE(0x203d, 0x1480), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* EnGenius */
         { USB_DEVICE(0X1740, 0x9701), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1740, 0x9702), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1740, 0x9703), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1740, 0x9705), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1740, 0x9706), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1740, 0x9801), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Gemtek */
-        { USB_DEVICE(0x15a9, 0x0010), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Gigabyte */
         { USB_DEVICE(0x1044, 0x800b), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1044, 0x800c), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1044, 0x800d), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Hawking */
         { USB_DEVICE(0x0e66, 0x0001), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0e66, 0x0003), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0e66, 0x0009), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0e66, 0x000b), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* I-O DATA */
-        { USB_DEVICE(0x04bb, 0x0945), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* LevelOne */
-        { USB_DEVICE(0x1740, 0x0605), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1740, 0x0615), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Linksys */
         { USB_DEVICE(0x1737, 0x0070), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1737, 0x0071), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1737, 0x0077), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Logitec */
         { USB_DEVICE(0x0789, 0x0162), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0789, 0x0163), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0789, 0x0164), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Motorola */
         { USB_DEVICE(0x100d, 0x9031), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x100d, 0x9032), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Ovislink */
-        { USB_DEVICE(0x1b75, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Pegatron */
-        { USB_DEVICE(0x1d4d, 0x0002), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1d4d, 0x000c), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1d4d, 0x000e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* MSI */
+        { USB_DEVICE(0x0db0, 0x6899), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Philips */
         { USB_DEVICE(0x0471, 0x200f), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Planex */
         { USB_DEVICE(0x2019, 0xed06), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x2019, 0xab24), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x2019, 0xab25), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Qcom */
-        { USB_DEVICE(0x18e8, 0x6259), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Quanta */
-        { USB_DEVICE(0x1a32, 0x0304), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Ralink */
-        { USB_DEVICE(0x0db0, 0x3820), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x6899), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x148f, 0x2070), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x148f, 0x2770), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x148f, 0x2870), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x148f, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x148f, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x148f, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x148f, 0x3572), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Samsung */
         { USB_DEVICE(0x04e8, 0x2018), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Siemens */
@@ -3007,29 +876,18 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0df6, 0x002c), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x002d), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x0039), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x003b), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x003c), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x003d), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x003e), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x003f), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x0040), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x0042), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* SMC */
         { USB_DEVICE(0x083a, 0x6618), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x083a, 0x7511), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0x7512), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0x7522), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0x8522), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x083a, 0xa512), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0xa618), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0xb522), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x083a, 0xc522), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Sparklan */
         { USB_DEVICE(0x15a9, 0x0006), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Sweex */
-        { USB_DEVICE(0x177f, 0x0153), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x177f, 0x0302), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x177f, 0x0313), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* U-Media*/
         { USB_DEVICE(0x157e, 0x300e), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* ZCOM */
@@ -3038,11 +896,195 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Zinwell */
         { USB_DEVICE(0x5a57, 0x0280), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x5a57, 0x0282), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Zyxel */
+        { USB_DEVICE(0x0586, 0x3416), USB_DEVICE_DATA(&rt2800usb_ops) },
+#ifdef CONFIG_RT2800USB_RT30XX
+        /* Abocom */
+        { USB_DEVICE(0x07b8, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07b8, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07b8, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* AirTies */
+        { USB_DEVICE(0x1eda, 0x2310), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* AzureWave */
+        { USB_DEVICE(0x13d3, 0x3273), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Conceptronic */
+        { USB_DEVICE(0x14b2, 0x3c12), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Corega */
+        { USB_DEVICE(0x18c5, 0x0012), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* D-Link */
+        { USB_DEVICE(0x07d1, 0x3c0a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c0d), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c0e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c0f), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Edimax */
+        { USB_DEVICE(0x7392, 0x7711), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Encore */
+        { USB_DEVICE(0x203d, 0x1480), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* EnGenius */
+        { USB_DEVICE(0x1740, 0x9703), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9705), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9706), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Gigabyte */
+        { USB_DEVICE(0x1044, 0x800d), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* I-O DATA */
+        { USB_DEVICE(0x04bb, 0x0945), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* MSI */
+        { USB_DEVICE(0x0db0, 0x3820), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Pegatron */
+        { USB_DEVICE(0x1d4d, 0x000c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1d4d, 0x000e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Planex */
+        { USB_DEVICE(0x2019, 0xab25), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Quanta */
+        { USB_DEVICE(0x1a32, 0x0304), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Ralink */
+        { USB_DEVICE(0x148f, 0x2070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Sitecom */
+        { USB_DEVICE(0x0df6, 0x003e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0042), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* SMC */
+        { USB_DEVICE(0x083a, 0x7511), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Zinwell */
         { USB_DEVICE(0x5a57, 0x0283), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x5a57, 0x5257), USB_DEVICE_DATA(&rt2800usb_ops) },
+#endif
+#ifdef CONFIG_RT2800USB_RT35XX
+        /* Askey */
+        { USB_DEVICE(0x1690, 0x0744), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Cisco */
+        { USB_DEVICE(0x167b, 0x4001), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* EnGenius */
+        { USB_DEVICE(0x1740, 0x9801), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* I-O DATA */
+        { USB_DEVICE(0x04bb, 0x0944), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Ralink */
+        { USB_DEVICE(0x148f, 0x3370), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x3572), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x8070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Sitecom */
+        { USB_DEVICE(0x0df6, 0x0041), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Zinwell */
+        { USB_DEVICE(0x5a57, 0x0284), USB_DEVICE_DATA(&rt2800usb_ops) },
+#endif
+#ifdef CONFIG_RT2800USB_UNKNOWN
+        /*
+         * Unclear what kind of devices these are (they aren't supported by the
+         * vendor driver).
+         */
+        /* Allwin */
+        { USB_DEVICE(0x8516, 0x2070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x2770), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x2870), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x3572), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Amigo */
+        { USB_DEVICE(0x0e0b, 0x9031), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0e0b, 0x9041), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Askey */
+        { USB_DEVICE(0x0930, 0x0a07), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* ASUS */
+        { USB_DEVICE(0x0b05, 0x1760), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0b05, 0x1761), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0b05, 0x1784), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0b05, 0x1790), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1761, 0x0b05), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* AzureWave */
+        { USB_DEVICE(0x13d3, 0x3262), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3284), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3305), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Belkin */
+        { USB_DEVICE(0x050d, 0x825a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Buffalo */
+        { USB_DEVICE(0x0411, 0x012e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0411, 0x0148), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0411, 0x0150), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0411, 0x015d), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Conceptronic */
+        { USB_DEVICE(0x14b2, 0x3c08), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c11), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Corega */
+        { USB_DEVICE(0x07aa, 0x0041), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07aa, 0x0042), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x18c5, 0x0008), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* D-Link */
+        { USB_DEVICE(0x07d1, 0x3c0b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c13), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c15), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c16), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Encore */
+        { USB_DEVICE(0x203d, 0x14a1), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x203d, 0x14a9), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* EnGenius */
+        { USB_DEVICE(0x1740, 0x9707), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9708), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9709), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Gemtek */
+        { USB_DEVICE(0x15a9, 0x0010), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Gigabyte */
+        { USB_DEVICE(0x1044, 0x800c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Hawking */
+        { USB_DEVICE(0x0e66, 0x0009), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0e66, 0x000b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* I-O DATA */
+        { USB_DEVICE(0x04bb, 0x0947), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x04bb, 0x0948), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* LevelOne */
+        { USB_DEVICE(0x1740, 0x0605), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x0615), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Linksys */
+        { USB_DEVICE(0x1737, 0x0077), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1737, 0x0078), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1737, 0x0079), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Motorola */
+        { USB_DEVICE(0x100d, 0x9032), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* MSI */
+        { USB_DEVICE(0x0db0, 0x3821), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x3822), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x3870), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x3871), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x821a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x822a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x870a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x871a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x899a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Ovislink */
+        { USB_DEVICE(0x1b75, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Para */
+        { USB_DEVICE(0x20b8, 0x8888), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Pegatron */
+        { USB_DEVICE(0x05a6, 0x0101), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1d4d, 0x0002), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1d4d, 0x0010), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Planex */
+        { USB_DEVICE(0x2019, 0xab24), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Qcom */
+        { USB_DEVICE(0x18e8, 0x6259), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Sitecom */
+        { USB_DEVICE(0x0df6, 0x003b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x003c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x003d), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0040), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0047), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0048), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x004a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x004d), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* SMC */
+        { USB_DEVICE(0x083a, 0xa512), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xa701), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xa702), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xc522), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xd522), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Sweex */
+        { USB_DEVICE(0x177f, 0x0153), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x177f, 0x0313), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Zyxel */
-        { USB_DEVICE(0x0586, 0x3416), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0586, 0x341a), USB_DEVICE_DATA(&rt2800usb_ops) },
+#endif
         { 0, }
 };
 
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.h b/drivers/net/wireless/rt2x00/rt2800usb.h
index 4d9991c9a51c..d1d8ae94b4d4 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.h
+++ b/drivers/net/wireless/rt2x00/rt2800usb.h
@@ -1,5 +1,9 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2009 Mattias Nissler <mattias.nissler@gmx.de>
+        Copyright (C) 2009 Felix Fietkau <nbd@openwrt.org>
+        Copyright (C) 2009 Xose Vazquez Perez <xose.vazquez@gmail.com>
+        Copyright (C) 2009 Axel Kollhofer <rain_maker@root-forum.org>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -28,288 +32,10 @@
 #define RT2800USB_H
 
 /*
- * RF chip defines.
- *
- * RF2820 2.4G 2T3R
- * RF2850 2.4G/5G 2T3R
- * RF2720 2.4G 1T2R
- * RF2750 2.4G/5G 1T2R
- * RF3020 2.4G 1T1R
- * RF2020 2.4G B/G
- * RF3021 2.4G 1T2R
- * RF3022 2.4G 2T2R
- * RF3052 2.4G 2T2R
- */
-#define RF2820                          0x0001
-#define RF2850                          0x0002
-#define RF2720                          0x0003
-#define RF2750                          0x0004
-#define RF3020                          0x0005
-#define RF2020                          0x0006
-#define RF3021                          0x0007
-#define RF3022                          0x0008
-#define RF3052                          0x0009
-
-/*
- * RT2870 version
- */
-#define RT2860C_VERSION                 0x28600100
-#define RT2860D_VERSION                 0x28600101
-#define RT2880E_VERSION                 0x28720200
-#define RT2883_VERSION                  0x28830300
-#define RT3070_VERSION                  0x30700200
-
-/*
- * Signal information.
- * Defaul offset is required for RSSI <-> dBm conversion.
- */
-#define DEFAULT_RSSI_OFFSET             120 /* FIXME */
-
-/*
- * Register layout information.
- */
-#define CSR_REG_BASE                    0x1000
-#define CSR_REG_SIZE                    0x0800
-#define EEPROM_BASE                     0x0000
-#define EEPROM_SIZE                     0x0110
-#define BBP_BASE                        0x0000
-#define BBP_SIZE                        0x0080
-#define RF_BASE                         0x0004
-#define RF_SIZE                         0x0010
-
-/*
- * Number of TX queues.
- */
-#define NUM_TX_QUEUES                   4
-
-/*
  * USB registers.
  */
 
 /*
- * HOST-MCU shared memory
- */
-#define HOST_CMD_CSR                    0x0404
-#define HOST_CMD_CSR_HOST_COMMAND       FIELD32(0x000000ff)
-
-/*
- * INT_SOURCE_CSR: Interrupt source register.
- * Write one to clear corresponding bit.
- * TX_FIFO_STATUS: FIFO Statistics is full, sw should read 0x171c
- */
-#define INT_SOURCE_CSR                  0x0200
-#define INT_SOURCE_CSR_RXDELAYINT       FIELD32(0x00000001)
-#define INT_SOURCE_CSR_TXDELAYINT       FIELD32(0x00000002)
-#define INT_SOURCE_CSR_RX_DONE          FIELD32(0x00000004)
-#define INT_SOURCE_CSR_AC0_DMA_DONE     FIELD32(0x00000008)
-#define INT_SOURCE_CSR_AC1_DMA_DONE     FIELD32(0x00000010)
-#define INT_SOURCE_CSR_AC2_DMA_DONE     FIELD32(0x00000020)
-#define INT_SOURCE_CSR_AC3_DMA_DONE     FIELD32(0x00000040)
-#define INT_SOURCE_CSR_HCCA_DMA_DONE    FIELD32(0x00000080)
-#define INT_SOURCE_CSR_MGMT_DMA_DONE    FIELD32(0x00000100)
-#define INT_SOURCE_CSR_MCU_COMMAND      FIELD32(0x00000200)
-#define INT_SOURCE_CSR_RXTX_COHERENT    FIELD32(0x00000400)
-#define INT_SOURCE_CSR_TBTT             FIELD32(0x00000800)
-#define INT_SOURCE_CSR_PRE_TBTT         FIELD32(0x00001000)
-#define INT_SOURCE_CSR_TX_FIFO_STATUS   FIELD32(0x00002000)
-#define INT_SOURCE_CSR_AUTO_WAKEUP      FIELD32(0x00004000)
-#define INT_SOURCE_CSR_GPTIMER          FIELD32(0x00008000)
-#define INT_SOURCE_CSR_RX_COHERENT      FIELD32(0x00010000)
-#define INT_SOURCE_CSR_TX_COHERENT      FIELD32(0x00020000)
-
-/*
- * INT_MASK_CSR: Interrupt MASK register. 1: the interrupt is mask OFF.
- */
-#define INT_MASK_CSR                    0x0204
-#define INT_MASK_CSR_RXDELAYINT         FIELD32(0x00000001)
-#define INT_MASK_CSR_TXDELAYINT         FIELD32(0x00000002)
-#define INT_MASK_CSR_RX_DONE            FIELD32(0x00000004)
-#define INT_MASK_CSR_AC0_DMA_DONE       FIELD32(0x00000008)
-#define INT_MASK_CSR_AC1_DMA_DONE       FIELD32(0x00000010)
-#define INT_MASK_CSR_AC2_DMA_DONE       FIELD32(0x00000020)
-#define INT_MASK_CSR_AC3_DMA_DONE       FIELD32(0x00000040)
-#define INT_MASK_CSR_HCCA_DMA_DONE      FIELD32(0x00000080)
-#define INT_MASK_CSR_MGMT_DMA_DONE      FIELD32(0x00000100)
-#define INT_MASK_CSR_MCU_COMMAND        FIELD32(0x00000200)
-#define INT_MASK_CSR_RXTX_COHERENT      FIELD32(0x00000400)
-#define INT_MASK_CSR_TBTT               FIELD32(0x00000800)
-#define INT_MASK_CSR_PRE_TBTT           FIELD32(0x00001000)
-#define INT_MASK_CSR_TX_FIFO_STATUS     FIELD32(0x00002000)
-#define INT_MASK_CSR_AUTO_WAKEUP        FIELD32(0x00004000)
-#define INT_MASK_CSR_GPTIMER            FIELD32(0x00008000)
-#define INT_MASK_CSR_RX_COHERENT        FIELD32(0x00010000)
-#define INT_MASK_CSR_TX_COHERENT        FIELD32(0x00020000)
-
-/*
- * WPDMA_GLO_CFG
- */
-#define WPDMA_GLO_CFG                   0x0208
-#define WPDMA_GLO_CFG_ENABLE_TX_DMA     FIELD32(0x00000001)
-#define WPDMA_GLO_CFG_TX_DMA_BUSY       FIELD32(0x00000002)
-#define WPDMA_GLO_CFG_ENABLE_RX_DMA     FIELD32(0x00000004)
-#define WPDMA_GLO_CFG_RX_DMA_BUSY       FIELD32(0x00000008)
-#define WPDMA_GLO_CFG_WP_DMA_BURST_SIZE FIELD32(0x00000030)
-#define WPDMA_GLO_CFG_TX_WRITEBACK_DONE FIELD32(0x00000040)
-#define WPDMA_GLO_CFG_BIG_ENDIAN        FIELD32(0x00000080)
-#define WPDMA_GLO_CFG_RX_HDR_SCATTER    FIELD32(0x0000ff00)
-#define WPDMA_GLO_CFG_HDR_SEG_LEN       FIELD32(0xffff0000)
-
-/*
- * WPDMA_RST_IDX
- */
-#define WPDMA_RST_IDX                   0x020c
-#define WPDMA_RST_IDX_DTX_IDX0          FIELD32(0x00000001)
-#define WPDMA_RST_IDX_DTX_IDX1          FIELD32(0x00000002)
-#define WPDMA_RST_IDX_DTX_IDX2          FIELD32(0x00000004)
-#define WPDMA_RST_IDX_DTX_IDX3          FIELD32(0x00000008)
-#define WPDMA_RST_IDX_DTX_IDX4          FIELD32(0x00000010)
-#define WPDMA_RST_IDX_DTX_IDX5          FIELD32(0x00000020)
-#define WPDMA_RST_IDX_DRX_IDX0          FIELD32(0x00010000)
-
-/*
- * DELAY_INT_CFG
- */
-#define DELAY_INT_CFG                   0x0210
-#define DELAY_INT_CFG_RXMAX_PTIME       FIELD32(0x000000ff)
-#define DELAY_INT_CFG_RXMAX_PINT        FIELD32(0x00007f00)
-#define DELAY_INT_CFG_RXDLY_INT_EN      FIELD32(0x00008000)
-#define DELAY_INT_CFG_TXMAX_PTIME       FIELD32(0x00ff0000)
-#define DELAY_INT_CFG_TXMAX_PINT        FIELD32(0x7f000000)
-#define DELAY_INT_CFG_TXDLY_INT_EN      FIELD32(0x80000000)
-
-/*
- * WMM_AIFSN_CFG: Aifsn for each EDCA AC
- * AIFSN0: AC_BE
- * AIFSN1: AC_BK
- * AIFSN1: AC_VI
- * AIFSN1: AC_VO
- */
-#define WMM_AIFSN_CFG                   0x0214
-#define WMM_AIFSN_CFG_AIFSN0            FIELD32(0x0000000f)
-#define WMM_AIFSN_CFG_AIFSN1            FIELD32(0x000000f0)
-#define WMM_AIFSN_CFG_AIFSN2            FIELD32(0x00000f00)
-#define WMM_AIFSN_CFG_AIFSN3            FIELD32(0x0000f000)
-
-/*
- * WMM_CWMIN_CSR: CWmin for each EDCA AC
- * CWMIN0: AC_BE
- * CWMIN1: AC_BK
- * CWMIN1: AC_VI
- * CWMIN1: AC_VO
- */
-#define WMM_CWMIN_CFG                   0x0218
-#define WMM_CWMIN_CFG_CWMIN0            FIELD32(0x0000000f)
-#define WMM_CWMIN_CFG_CWMIN1            FIELD32(0x000000f0)
-#define WMM_CWMIN_CFG_CWMIN2            FIELD32(0x00000f00)
-#define WMM_CWMIN_CFG_CWMIN3            FIELD32(0x0000f000)
-
-/*
- * WMM_CWMAX_CSR: CWmax for each EDCA AC
- * CWMAX0: AC_BE
- * CWMAX1: AC_BK
- * CWMAX1: AC_VI
- * CWMAX1: AC_VO
- */
-#define WMM_CWMAX_CFG                   0x021c
-#define WMM_CWMAX_CFG_CWMAX0            FIELD32(0x0000000f)
-#define WMM_CWMAX_CFG_CWMAX1            FIELD32(0x000000f0)
-#define WMM_CWMAX_CFG_CWMAX2            FIELD32(0x00000f00)
-#define WMM_CWMAX_CFG_CWMAX3            FIELD32(0x0000f000)
-
-/*
- * AC_TXOP0: AC_BK/AC_BE TXOP register
- * AC0TXOP: AC_BK in unit of 32us
- * AC1TXOP: AC_BE in unit of 32us
- */
-#define WMM_TXOP0_CFG                   0x0220
-#define WMM_TXOP0_CFG_AC0TXOP           FIELD32(0x0000ffff)
-#define WMM_TXOP0_CFG_AC1TXOP           FIELD32(0xffff0000)
-
-/*
- * AC_TXOP1: AC_VO/AC_VI TXOP register
- * AC2TXOP: AC_VI in unit of 32us
- * AC3TXOP: AC_VO in unit of 32us
- */
-#define WMM_TXOP1_CFG                   0x0224
-#define WMM_TXOP1_CFG_AC2TXOP           FIELD32(0x0000ffff)
-#define WMM_TXOP1_CFG_AC3TXOP           FIELD32(0xffff0000)
-
-/*
- * GPIO_CTRL_CFG:
- */
-#define GPIO_CTRL_CFG                   0x0228
-#define GPIO_CTRL_CFG_BIT0              FIELD32(0x00000001)
-#define GPIO_CTRL_CFG_BIT1              FIELD32(0x00000002)
-#define GPIO_CTRL_CFG_BIT2              FIELD32(0x00000004)
-#define GPIO_CTRL_CFG_BIT3              FIELD32(0x00000008)
-#define GPIO_CTRL_CFG_BIT4              FIELD32(0x00000010)
-#define GPIO_CTRL_CFG_BIT5              FIELD32(0x00000020)
-#define GPIO_CTRL_CFG_BIT6              FIELD32(0x00000040)
-#define GPIO_CTRL_CFG_BIT7              FIELD32(0x00000080)
-#define GPIO_CTRL_CFG_BIT8              FIELD32(0x00000100)
-
-/*
- * MCU_CMD_CFG
- */
-#define MCU_CMD_CFG                     0x022c
-
-/*
- * AC_BK register offsets
- */
-#define TX_BASE_PTR0                    0x0230
-#define TX_MAX_CNT0                     0x0234
-#define TX_CTX_IDX0                     0x0238
-#define TX_DTX_IDX0                     0x023c
-
-/*
- * AC_BE register offsets
- */
-#define TX_BASE_PTR1                    0x0240
-#define TX_MAX_CNT1                     0x0244
-#define TX_CTX_IDX1                     0x0248
-#define TX_DTX_IDX1                     0x024c
-
-/*
- * AC_VI register offsets
- */
-#define TX_BASE_PTR2                    0x0250
-#define TX_MAX_CNT2                     0x0254
-#define TX_CTX_IDX2                     0x0258
-#define TX_DTX_IDX2                     0x025c
-
-/*
- * AC_VO register offsets
- */
-#define TX_BASE_PTR3                    0x0260
-#define TX_MAX_CNT3                     0x0264
-#define TX_CTX_IDX3                     0x0268
-#define TX_DTX_IDX3                     0x026c
-
-/*
- * HCCA register offsets
- */
-#define TX_BASE_PTR4                    0x0270
-#define TX_MAX_CNT4                     0x0274
-#define TX_CTX_IDX4                     0x0278
-#define TX_DTX_IDX4                     0x027c
-
-/*
- * MGMT register offsets
- */
-#define TX_BASE_PTR5                    0x0280
-#define TX_MAX_CNT5                     0x0284
-#define TX_CTX_IDX5                     0x0288
-#define TX_DTX_IDX5                     0x028c
-
-/*
- * RX register offsets
- */
-#define RX_BASE_PTR                     0x0290
-#define RX_MAX_CNT                      0x0294
-#define RX_CRX_IDX                      0x0298
-#define RX_DRX_IDX                      0x029c
-
-/*
  * USB_DMA_CFG
  * RX_BULK_AGG_TIMEOUT: Rx Bulk Aggregation TimeOut in unit of 33ns.
  * RX_BULK_AGG_LIMIT: Rx Bulk Aggregation Limit in unit of 256 bytes.
@@ -343,1448 +69,18 @@
 #define USB_CYC_CFG_CLOCK_CYCLE         FIELD32(0x000000ff)
 
 /*
- * PBF_SYS_CTRL
- * HOST_RAM_WRITE: enable Host program ram write selection
- */
-#define PBF_SYS_CTRL                    0x0400
-#define PBF_SYS_CTRL_READY              FIELD32(0x00000080)
-#define PBF_SYS_CTRL_HOST_RAM_WRITE     FIELD32(0x00010000)
-
-/*
- * PBF registers
- * Most are for debug. Driver doesn't touch PBF register.
- */
-#define PBF_CFG                         0x0408
-#define PBF_MAX_PCNT                    0x040c
-#define PBF_CTRL                        0x0410
-#define PBF_INT_STA                     0x0414
-#define PBF_INT_ENA                     0x0418
-
-/*
- * BCN_OFFSET0:
- */
-#define BCN_OFFSET0                     0x042c
-#define BCN_OFFSET0_BCN0                FIELD32(0x000000ff)
-#define BCN_OFFSET0_BCN1                FIELD32(0x0000ff00)
-#define BCN_OFFSET0_BCN2                FIELD32(0x00ff0000)
-#define BCN_OFFSET0_BCN3                FIELD32(0xff000000)
-
-/*
- * BCN_OFFSET1:
- */
-#define BCN_OFFSET1                     0x0430
-#define BCN_OFFSET1_BCN4                FIELD32(0x000000ff)
-#define BCN_OFFSET1_BCN5                FIELD32(0x0000ff00)
-#define BCN_OFFSET1_BCN6                FIELD32(0x00ff0000)
-#define BCN_OFFSET1_BCN7                FIELD32(0xff000000)
-
-/*
- * PBF registers
- * Most are for debug. Driver doesn't touch PBF register.
- */
-#define TXRXQ_PCNT                      0x0438
-#define PBF_DBG                         0x043c
-
-/*
- * RF registers
- */
-#define RF_CSR_CFG                      0x0500
-#define RF_CSR_CFG_DATA                 FIELD32(0x000000ff)
-#define RF_CSR_CFG_REGNUM               FIELD32(0x00001f00)
-#define RF_CSR_CFG_WRITE                FIELD32(0x00010000)
-#define RF_CSR_CFG_BUSY                 FIELD32(0x00020000)
-
-/*
- * MAC Control/Status Registers(CSR).
- * Some values are set in TU, whereas 1 TU == 1024 us.
- */
-
-/*
- * MAC_CSR0: ASIC revision number.
- * ASIC_REV: 0
- * ASIC_VER: 2870
- */
-#define MAC_CSR0                        0x1000
-#define MAC_CSR0_ASIC_REV               FIELD32(0x0000ffff)
-#define MAC_CSR0_ASIC_VER               FIELD32(0xffff0000)
-
-/*
- * MAC_SYS_CTRL:
- */
-#define MAC_SYS_CTRL                    0x1004
-#define MAC_SYS_CTRL_RESET_CSR          FIELD32(0x00000001)
-#define MAC_SYS_CTRL_RESET_BBP          FIELD32(0x00000002)
-#define MAC_SYS_CTRL_ENABLE_TX          FIELD32(0x00000004)
-#define MAC_SYS_CTRL_ENABLE_RX          FIELD32(0x00000008)
-#define MAC_SYS_CTRL_CONTINUOUS_TX      FIELD32(0x00000010)
-#define MAC_SYS_CTRL_LOOPBACK           FIELD32(0x00000020)
-#define MAC_SYS_CTRL_WLAN_HALT          FIELD32(0x00000040)
-#define MAC_SYS_CTRL_RX_TIMESTAMP       FIELD32(0x00000080)
-
-/*
- * MAC_ADDR_DW0: STA MAC register 0
- */
-#define MAC_ADDR_DW0                    0x1008
-#define MAC_ADDR_DW0_BYTE0              FIELD32(0x000000ff)
-#define MAC_ADDR_DW0_BYTE1              FIELD32(0x0000ff00)
-#define MAC_ADDR_DW0_BYTE2              FIELD32(0x00ff0000)
-#define MAC_ADDR_DW0_BYTE3              FIELD32(0xff000000)
-
-/*
- * MAC_ADDR_DW1: STA MAC register 1
- * UNICAST_TO_ME_MASK:
- * Used to mask off bits from byte 5 of the MAC address
- * to determine the UNICAST_TO_ME bit for RX frames.
- * The full mask is complemented by BSS_ID_MASK:
- *    MASK = BSS_ID_MASK & UNICAST_TO_ME_MASK
- */
-#define MAC_ADDR_DW1                    0x100c
-#define MAC_ADDR_DW1_BYTE4              FIELD32(0x000000ff)
-#define MAC_ADDR_DW1_BYTE5              FIELD32(0x0000ff00)
-#define MAC_ADDR_DW1_UNICAST_TO_ME_MASK FIELD32(0x00ff0000)
-
-/*
- * MAC_BSSID_DW0: BSSID register 0
- */
-#define MAC_BSSID_DW0                   0x1010
-#define MAC_BSSID_DW0_BYTE0             FIELD32(0x000000ff)
-#define MAC_BSSID_DW0_BYTE1             FIELD32(0x0000ff00)
-#define MAC_BSSID_DW0_BYTE2             FIELD32(0x00ff0000)
-#define MAC_BSSID_DW0_BYTE3             FIELD32(0xff000000)
-
-/*
- * MAC_BSSID_DW1: BSSID register 1
- * BSS_ID_MASK:
- *     0: 1-BSSID mode (BSS index = 0)
- *     1: 2-BSSID mode (BSS index: Byte5, bit 0)
- *     2: 4-BSSID mode (BSS index: byte5, bit 0 - 1)
- *     3: 8-BSSID mode (BSS index: byte5, bit 0 - 2)
- * This mask is used to mask off bits 0, 1 and 2 of byte 5 of the
- * BSSID. This will make sure that those bits will be ignored
- * when determining the MY_BSS of RX frames.
- */
-#define MAC_BSSID_DW1                   0x1014
-#define MAC_BSSID_DW1_BYTE4             FIELD32(0x000000ff)
-#define MAC_BSSID_DW1_BYTE5             FIELD32(0x0000ff00)
-#define MAC_BSSID_DW1_BSS_ID_MASK       FIELD32(0x00030000)
-#define MAC_BSSID_DW1_BSS_BCN_NUM       FIELD32(0x001c0000)
-
-/*
- * MAX_LEN_CFG: Maximum frame length register.
- * MAX_MPDU: rt2860b max 16k bytes
- * MAX_PSDU: Maximum PSDU length
- *      (power factor) 0:2^13, 1:2^14, 2:2^15, 3:2^16
- */
-#define MAX_LEN_CFG                     0x1018
-#define MAX_LEN_CFG_MAX_MPDU            FIELD32(0x00000fff)
-#define MAX_LEN_CFG_MAX_PSDU            FIELD32(0x00003000)
-#define MAX_LEN_CFG_MIN_PSDU            FIELD32(0x0000c000)
-#define MAX_LEN_CFG_MIN_MPDU            FIELD32(0x000f0000)
-
-/*
- * BBP_CSR_CFG: BBP serial control register
- * VALUE: Register value to program into BBP
- * REG_NUM: Selected BBP register
- * READ_CONTROL: 0 write BBP, 1 read BBP
- * BUSY: ASIC is busy executing BBP commands
- * BBP_PAR_DUR: 0 4 MAC clocks, 1 8 MAC clocks
- * BBP_RW_MODE: 0 serial, 1 paralell
- */
-#define BBP_CSR_CFG                     0x101c
-#define BBP_CSR_CFG_VALUE               FIELD32(0x000000ff)
-#define BBP_CSR_CFG_REGNUM              FIELD32(0x0000ff00)
-#define BBP_CSR_CFG_READ_CONTROL        FIELD32(0x00010000)
-#define BBP_CSR_CFG_BUSY                FIELD32(0x00020000)
-#define BBP_CSR_CFG_BBP_PAR_DUR         FIELD32(0x00040000)
-#define BBP_CSR_CFG_BBP_RW_MODE         FIELD32(0x00080000)
-
-/*
- * RF_CSR_CFG0: RF control register
- * REGID_AND_VALUE: Register value to program into RF
- * BITWIDTH: Selected RF register
- * STANDBYMODE: 0 high when standby, 1 low when standby
- * SEL: 0 RF_LE0 activate, 1 RF_LE1 activate
- * BUSY: ASIC is busy executing RF commands
- */
-#define RF_CSR_CFG0                     0x1020
-#define RF_CSR_CFG0_REGID_AND_VALUE     FIELD32(0x00ffffff)
-#define RF_CSR_CFG0_BITWIDTH            FIELD32(0x1f000000)
-#define RF_CSR_CFG0_REG_VALUE_BW        FIELD32(0x1fffffff)
-#define RF_CSR_CFG0_STANDBYMODE         FIELD32(0x20000000)
-#define RF_CSR_CFG0_SEL                 FIELD32(0x40000000)
-#define RF_CSR_CFG0_BUSY                FIELD32(0x80000000)
-
-/*
- * RF_CSR_CFG1: RF control register
- * REGID_AND_VALUE: Register value to program into RF
- * RFGAP: Gap between BB_CONTROL_RF and RF_LE
- *        0: 3 system clock cycle (37.5usec)
- *        1: 5 system clock cycle (62.5usec)
- */
-#define RF_CSR_CFG1                     0x1024
-#define RF_CSR_CFG1_REGID_AND_VALUE     FIELD32(0x00ffffff)
-#define RF_CSR_CFG1_RFGAP               FIELD32(0x1f000000)
-
-/*
- * RF_CSR_CFG2: RF control register
- * VALUE: Register value to program into RF
- * RFGAP: Gap between BB_CONTROL_RF and RF_LE
- *        0: 3 system clock cycle (37.5usec)
- *        1: 5 system clock cycle (62.5usec)
- */
-#define RF_CSR_CFG2                     0x1028
-#define RF_CSR_CFG2_VALUE               FIELD32(0x00ffffff)
-
-/*
- * LED_CFG: LED control
- * color LED's:
- *   0: off
- *   1: blinking upon TX2
- *   2: periodic slow blinking
- *   3: always on
- * LED polarity:
- *   0: active low
- *   1: active high
- */
-#define LED_CFG                         0x102c
-#define LED_CFG_ON_PERIOD               FIELD32(0x000000ff)
-#define LED_CFG_OFF_PERIOD              FIELD32(0x0000ff00)
-#define LED_CFG_SLOW_BLINK_PERIOD       FIELD32(0x003f0000)
-#define LED_CFG_R_LED_MODE              FIELD32(0x03000000)
-#define LED_CFG_G_LED_MODE              FIELD32(0x0c000000)
-#define LED_CFG_Y_LED_MODE              FIELD32(0x30000000)
-#define LED_CFG_LED_POLAR               FIELD32(0x40000000)
-
-/*
- * XIFS_TIME_CFG: MAC timing
- * CCKM_SIFS_TIME: unit 1us. Applied after CCK RX/TX
- * OFDM_SIFS_TIME: unit 1us. Applied after OFDM RX/TX
- * OFDM_XIFS_TIME: unit 1us. Applied after OFDM RX
- *      when MAC doesn't reference BBP signal BBRXEND
- * EIFS: unit 1us
- * BB_RXEND_ENABLE: reference RXEND signal to begin XIFS defer
- *
- */
-#define XIFS_TIME_CFG                   0x1100
-#define XIFS_TIME_CFG_CCKM_SIFS_TIME    FIELD32(0x000000ff)
-#define XIFS_TIME_CFG_OFDM_SIFS_TIME    FIELD32(0x0000ff00)
-#define XIFS_TIME_CFG_OFDM_XIFS_TIME    FIELD32(0x000f0000)
-#define XIFS_TIME_CFG_EIFS              FIELD32(0x1ff00000)
-#define XIFS_TIME_CFG_BB_RXEND_ENABLE   FIELD32(0x20000000)
-
-/*
- * BKOFF_SLOT_CFG:
- */
-#define BKOFF_SLOT_CFG                  0x1104
-#define BKOFF_SLOT_CFG_SLOT_TIME        FIELD32(0x000000ff)
-#define BKOFF_SLOT_CFG_CC_DELAY_TIME    FIELD32(0x0000ff00)
-
-/*
- * NAV_TIME_CFG:
- */
-#define NAV_TIME_CFG                    0x1108
-#define NAV_TIME_CFG_SIFS               FIELD32(0x000000ff)
-#define NAV_TIME_CFG_SLOT_TIME          FIELD32(0x0000ff00)
-#define NAV_TIME_CFG_EIFS               FIELD32(0x01ff0000)
-#define NAV_TIME_ZERO_SIFS              FIELD32(0x02000000)
-
-/*
- * CH_TIME_CFG: count as channel busy
- */
-#define CH_TIME_CFG                     0x110c
-
-/*
- * PBF_LIFE_TIMER: TX/RX MPDU timestamp timer (free run) Unit: 1us
- */
-#define PBF_LIFE_TIMER                  0x1110
-
-/*
- * BCN_TIME_CFG:
- * BEACON_INTERVAL: in unit of 1/16 TU
- * TSF_TICKING: Enable TSF auto counting
- * TSF_SYNC: Enable TSF sync, 00: disable, 01: infra mode, 10: ad-hoc mode
- * BEACON_GEN: Enable beacon generator
- */
-#define BCN_TIME_CFG                    0x1114
-#define BCN_TIME_CFG_BEACON_INTERVAL    FIELD32(0x0000ffff)
-#define BCN_TIME_CFG_TSF_TICKING        FIELD32(0x00010000)
-#define BCN_TIME_CFG_TSF_SYNC           FIELD32(0x00060000)
-#define BCN_TIME_CFG_TBTT_ENABLE        FIELD32(0x00080000)
-#define BCN_TIME_CFG_BEACON_GEN         FIELD32(0x00100000)
-#define BCN_TIME_CFG_TX_TIME_COMPENSATE FIELD32(0xf0000000)
-
-/*
- * TBTT_SYNC_CFG:
- */
-#define TBTT_SYNC_CFG                   0x1118
-
-/*
- * TSF_TIMER_DW0: Local lsb TSF timer, read-only
- */
-#define TSF_TIMER_DW0                   0x111c
-#define TSF_TIMER_DW0_LOW_WORD          FIELD32(0xffffffff)
-
-/*
- * TSF_TIMER_DW1: Local msb TSF timer, read-only
- */
-#define TSF_TIMER_DW1                   0x1120
-#define TSF_TIMER_DW1_HIGH_WORD         FIELD32(0xffffffff)
-
-/*
- * TBTT_TIMER: TImer remains till next TBTT, read-only
- */
-#define TBTT_TIMER                      0x1124
-
-/*
- * INT_TIMER_CFG:
- */
-#define INT_TIMER_CFG                   0x1128
-
-/*
- * INT_TIMER_EN: GP-timer and pre-tbtt Int enable
- */
-#define INT_TIMER_EN                    0x112c
-
-/*
- * CH_IDLE_STA: channel idle time
- */
-#define CH_IDLE_STA                     0x1130
-
-/*
- * CH_BUSY_STA: channel busy time
- */
-#define CH_BUSY_STA                     0x1134
-
-/*
- * MAC_STATUS_CFG:
- * BBP_RF_BUSY: When set to 0, BBP and RF are stable.
- *      if 1 or higher one of the 2 registers is busy.
- */
-#define MAC_STATUS_CFG                  0x1200
-#define MAC_STATUS_CFG_BBP_RF_BUSY      FIELD32(0x00000003)
-
-/*
- * PWR_PIN_CFG:
- */
-#define PWR_PIN_CFG                     0x1204
-
-/*
- * AUTOWAKEUP_CFG: Manual power control / status register
- * TBCN_BEFORE_WAKE: ForceWake has high privilege than PutToSleep when both set
- * AUTOWAKE: 0:sleep, 1:awake
- */
-#define AUTOWAKEUP_CFG                  0x1208
-#define AUTOWAKEUP_CFG_AUTO_LEAD_TIME   FIELD32(0x000000ff)
-#define AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE FIELD32(0x00007f00)
-#define AUTOWAKEUP_CFG_AUTOWAKE         FIELD32(0x00008000)
-
-/*
- * EDCA_AC0_CFG:
- */
-#define EDCA_AC0_CFG                    0x1300
-#define EDCA_AC0_CFG_TX_OP              FIELD32(0x000000ff)
-#define EDCA_AC0_CFG_AIFSN              FIELD32(0x00000f00)
-#define EDCA_AC0_CFG_CWMIN              FIELD32(0x0000f000)
-#define EDCA_AC0_CFG_CWMAX              FIELD32(0x000f0000)
-
-/*
- * EDCA_AC1_CFG:
- */
-#define EDCA_AC1_CFG                    0x1304
-#define EDCA_AC1_CFG_TX_OP              FIELD32(0x000000ff)
-#define EDCA_AC1_CFG_AIFSN              FIELD32(0x00000f00)
-#define EDCA_AC1_CFG_CWMIN              FIELD32(0x0000f000)
-#define EDCA_AC1_CFG_CWMAX              FIELD32(0x000f0000)
-
-/*
- * EDCA_AC2_CFG:
- */
-#define EDCA_AC2_CFG                    0x1308
-#define EDCA_AC2_CFG_TX_OP              FIELD32(0x000000ff)
-#define EDCA_AC2_CFG_AIFSN              FIELD32(0x00000f00)
-#define EDCA_AC2_CFG_CWMIN              FIELD32(0x0000f000)
-#define EDCA_AC2_CFG_CWMAX              FIELD32(0x000f0000)
-
-/*
- * EDCA_AC3_CFG:
- */
-#define EDCA_AC3_CFG                    0x130c
-#define EDCA_AC3_CFG_TX_OP              FIELD32(0x000000ff)
-#define EDCA_AC3_CFG_AIFSN              FIELD32(0x00000f00)
-#define EDCA_AC3_CFG_CWMIN              FIELD32(0x0000f000)
-#define EDCA_AC3_CFG_CWMAX              FIELD32(0x000f0000)
-
-/*
- * EDCA_TID_AC_MAP:
- */
-#define EDCA_TID_AC_MAP                 0x1310
-
-/*
- * TX_PWR_CFG_0:
- */
-#define TX_PWR_CFG_0                    0x1314
-#define TX_PWR_CFG_0_1MBS               FIELD32(0x0000000f)
-#define TX_PWR_CFG_0_2MBS               FIELD32(0x000000f0)
-#define TX_PWR_CFG_0_55MBS              FIELD32(0x00000f00)
-#define TX_PWR_CFG_0_11MBS              FIELD32(0x0000f000)
-#define TX_PWR_CFG_0_6MBS               FIELD32(0x000f0000)
-#define TX_PWR_CFG_0_9MBS               FIELD32(0x00f00000)
-#define TX_PWR_CFG_0_12MBS              FIELD32(0x0f000000)
-#define TX_PWR_CFG_0_18MBS              FIELD32(0xf0000000)
-
-/*
- * TX_PWR_CFG_1:
- */
-#define TX_PWR_CFG_1                    0x1318
-#define TX_PWR_CFG_1_24MBS              FIELD32(0x0000000f)
-#define TX_PWR_CFG_1_36MBS              FIELD32(0x000000f0)
-#define TX_PWR_CFG_1_48MBS              FIELD32(0x00000f00)
-#define TX_PWR_CFG_1_54MBS              FIELD32(0x0000f000)
-#define TX_PWR_CFG_1_MCS0               FIELD32(0x000f0000)
-#define TX_PWR_CFG_1_MCS1               FIELD32(0x00f00000)
-#define TX_PWR_CFG_1_MCS2               FIELD32(0x0f000000)
-#define TX_PWR_CFG_1_MCS3               FIELD32(0xf0000000)
-
-/*
- * TX_PWR_CFG_2:
- */
-#define TX_PWR_CFG_2                    0x131c
-#define TX_PWR_CFG_2_MCS4               FIELD32(0x0000000f)
-#define TX_PWR_CFG_2_MCS5               FIELD32(0x000000f0)
-#define TX_PWR_CFG_2_MCS6               FIELD32(0x00000f00)
-#define TX_PWR_CFG_2_MCS7               FIELD32(0x0000f000)
-#define TX_PWR_CFG_2_MCS8               FIELD32(0x000f0000)
-#define TX_PWR_CFG_2_MCS9               FIELD32(0x00f00000)
-#define TX_PWR_CFG_2_MCS10              FIELD32(0x0f000000)
-#define TX_PWR_CFG_2_MCS11              FIELD32(0xf0000000)
-
-/*
- * TX_PWR_CFG_3:
- */
-#define TX_PWR_CFG_3                    0x1320
-#define TX_PWR_CFG_3_MCS12              FIELD32(0x0000000f)
-#define TX_PWR_CFG_3_MCS13              FIELD32(0x000000f0)
-#define TX_PWR_CFG_3_MCS14              FIELD32(0x00000f00)
-#define TX_PWR_CFG_3_MCS15              FIELD32(0x0000f000)
-#define TX_PWR_CFG_3_UKNOWN1            FIELD32(0x000f0000)
-#define TX_PWR_CFG_3_UKNOWN2            FIELD32(0x00f00000)
-#define TX_PWR_CFG_3_UKNOWN3            FIELD32(0x0f000000)
-#define TX_PWR_CFG_3_UKNOWN4            FIELD32(0xf0000000)
-
-/*
- * TX_PWR_CFG_4:
- */
-#define TX_PWR_CFG_4                    0x1324
-#define TX_PWR_CFG_4_UKNOWN5            FIELD32(0x0000000f)
-#define TX_PWR_CFG_4_UKNOWN6            FIELD32(0x000000f0)
-#define TX_PWR_CFG_4_UKNOWN7            FIELD32(0x00000f00)
-#define TX_PWR_CFG_4_UKNOWN8            FIELD32(0x0000f000)
-
-/*
- * TX_PIN_CFG:
- */
-#define TX_PIN_CFG                      0x1328
-#define TX_PIN_CFG_PA_PE_A0_EN          FIELD32(0x00000001)
-#define TX_PIN_CFG_PA_PE_G0_EN          FIELD32(0x00000002)
-#define TX_PIN_CFG_PA_PE_A1_EN          FIELD32(0x00000004)
-#define TX_PIN_CFG_PA_PE_G1_EN          FIELD32(0x00000008)
-#define TX_PIN_CFG_PA_PE_A0_POL         FIELD32(0x00000010)
-#define TX_PIN_CFG_PA_PE_G0_POL         FIELD32(0x00000020)
-#define TX_PIN_CFG_PA_PE_A1_POL         FIELD32(0x00000040)
-#define TX_PIN_CFG_PA_PE_G1_POL         FIELD32(0x00000080)
-#define TX_PIN_CFG_LNA_PE_A0_EN         FIELD32(0x00000100)
-#define TX_PIN_CFG_LNA_PE_G0_EN         FIELD32(0x00000200)
-#define TX_PIN_CFG_LNA_PE_A1_EN         FIELD32(0x00000400)
-#define TX_PIN_CFG_LNA_PE_G1_EN         FIELD32(0x00000800)
-#define TX_PIN_CFG_LNA_PE_A0_POL        FIELD32(0x00001000)
-#define TX_PIN_CFG_LNA_PE_G0_POL        FIELD32(0x00002000)
-#define TX_PIN_CFG_LNA_PE_A1_POL        FIELD32(0x00004000)
-#define TX_PIN_CFG_LNA_PE_G1_POL        FIELD32(0x00008000)
-#define TX_PIN_CFG_RFTR_EN              FIELD32(0x00010000)
-#define TX_PIN_CFG_RFTR_POL             FIELD32(0x00020000)
-#define TX_PIN_CFG_TRSW_EN              FIELD32(0x00040000)
-#define TX_PIN_CFG_TRSW_POL             FIELD32(0x00080000)
-
-/*
- * TX_BAND_CFG: 0x1 use upper 20MHz, 0x0 use lower 20MHz
- */
-#define TX_BAND_CFG                     0x132c
-#define TX_BAND_CFG_HT40_PLUS           FIELD32(0x00000001)
-#define TX_BAND_CFG_A                   FIELD32(0x00000002)
-#define TX_BAND_CFG_BG                  FIELD32(0x00000004)
-
-/*
- * TX_SW_CFG0:
- */
-#define TX_SW_CFG0                      0x1330
-
-/*
- * TX_SW_CFG1:
- */
-#define TX_SW_CFG1                      0x1334
-
-/*
- * TX_SW_CFG2:
- */
-#define TX_SW_CFG2                      0x1338
-
-/*
- * TXOP_THRES_CFG:
- */
-#define TXOP_THRES_CFG                  0x133c
-
-/*
- * TXOP_CTRL_CFG:
- */
-#define TXOP_CTRL_CFG                   0x1340
-
-/*
- * TX_RTS_CFG:
- * RTS_THRES: unit:byte
- * RTS_FBK_EN: enable rts rate fallback
- */
-#define TX_RTS_CFG                      0x1344
-#define TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT FIELD32(0x000000ff)
-#define TX_RTS_CFG_RTS_THRES            FIELD32(0x00ffff00)
-#define TX_RTS_CFG_RTS_FBK_EN           FIELD32(0x01000000)
-
-/*
- * TX_TIMEOUT_CFG:
- * MPDU_LIFETIME: expiration time = 2^(9+MPDU LIFE TIME) us
- * RX_ACK_TIMEOUT: unit:slot. Used for TX procedure
- * TX_OP_TIMEOUT: TXOP timeout value for TXOP truncation.
- *                it is recommended that:
- *                (SLOT_TIME) > (TX_OP_TIMEOUT) > (RX_ACK_TIMEOUT)
- */
-#define TX_TIMEOUT_CFG                  0x1348
-#define TX_TIMEOUT_CFG_MPDU_LIFETIME    FIELD32(0x000000f0)
-#define TX_TIMEOUT_CFG_RX_ACK_TIMEOUT   FIELD32(0x0000ff00)
-#define TX_TIMEOUT_CFG_TX_OP_TIMEOUT    FIELD32(0x00ff0000)
-
-/*
- * TX_RTY_CFG:
- * SHORT_RTY_LIMIT: short retry limit
- * LONG_RTY_LIMIT: long retry limit
- * LONG_RTY_THRE: Long retry threshoold
- * NON_AGG_RTY_MODE: Non-Aggregate MPDU retry mode
- *                   0:expired by retry limit, 1: expired by mpdu life timer
- * AGG_RTY_MODE: Aggregate MPDU retry mode
- *               0:expired by retry limit, 1: expired by mpdu life timer
- * TX_AUTO_FB_ENABLE: Tx retry PHY rate auto fallback enable
- */
-#define TX_RTY_CFG                      0x134c
-#define TX_RTY_CFG_SHORT_RTY_LIMIT      FIELD32(0x000000ff)
-#define TX_RTY_CFG_LONG_RTY_LIMIT       FIELD32(0x0000ff00)
-#define TX_RTY_CFG_LONG_RTY_THRE        FIELD32(0x0fff0000)
-#define TX_RTY_CFG_NON_AGG_RTY_MODE     FIELD32(0x10000000)
-#define TX_RTY_CFG_AGG_RTY_MODE         FIELD32(0x20000000)
-#define TX_RTY_CFG_TX_AUTO_FB_ENABLE    FIELD32(0x40000000)
-
-/*
- * TX_LINK_CFG:
- * REMOTE_MFB_LIFETIME: remote MFB life time. unit: 32us
- * MFB_ENABLE: TX apply remote MFB 1:enable
- * REMOTE_UMFS_ENABLE: remote unsolicit  MFB enable
- *                     0: not apply remote remote unsolicit (MFS=7)
- * TX_MRQ_EN: MCS request TX enable
- * TX_RDG_EN: RDG TX enable
- * TX_CF_ACK_EN: Piggyback CF-ACK enable
- * REMOTE_MFB: remote MCS feedback
- * REMOTE_MFS: remote MCS feedback sequence number
- */
-#define TX_LINK_CFG                     0x1350
-#define TX_LINK_CFG_REMOTE_MFB_LIFETIME FIELD32(0x000000ff)
-#define TX_LINK_CFG_MFB_ENABLE          FIELD32(0x00000100)
-#define TX_LINK_CFG_REMOTE_UMFS_ENABLE  FIELD32(0x00000200)
-#define TX_LINK_CFG_TX_MRQ_EN           FIELD32(0x00000400)
-#define TX_LINK_CFG_TX_RDG_EN           FIELD32(0x00000800)
-#define TX_LINK_CFG_TX_CF_ACK_EN        FIELD32(0x00001000)
-#define TX_LINK_CFG_REMOTE_MFB          FIELD32(0x00ff0000)
-#define TX_LINK_CFG_REMOTE_MFS          FIELD32(0xff000000)
-
-/*
- * HT_FBK_CFG0:
- */
-#define HT_FBK_CFG0                     0x1354
-#define HT_FBK_CFG0_HTMCS0FBK           FIELD32(0x0000000f)
-#define HT_FBK_CFG0_HTMCS1FBK           FIELD32(0x000000f0)
-#define HT_FBK_CFG0_HTMCS2FBK           FIELD32(0x00000f00)
-#define HT_FBK_CFG0_HTMCS3FBK           FIELD32(0x0000f000)
-#define HT_FBK_CFG0_HTMCS4FBK           FIELD32(0x000f0000)
-#define HT_FBK_CFG0_HTMCS5FBK           FIELD32(0x00f00000)
-#define HT_FBK_CFG0_HTMCS6FBK           FIELD32(0x0f000000)
-#define HT_FBK_CFG0_HTMCS7FBK           FIELD32(0xf0000000)
-
-/*
- * HT_FBK_CFG1:
- */
-#define HT_FBK_CFG1                     0x1358
-#define HT_FBK_CFG1_HTMCS8FBK           FIELD32(0x0000000f)
-#define HT_FBK_CFG1_HTMCS9FBK           FIELD32(0x000000f0)
-#define HT_FBK_CFG1_HTMCS10FBK          FIELD32(0x00000f00)
-#define HT_FBK_CFG1_HTMCS11FBK          FIELD32(0x0000f000)
-#define HT_FBK_CFG1_HTMCS12FBK          FIELD32(0x000f0000)
-#define HT_FBK_CFG1_HTMCS13FBK          FIELD32(0x00f00000)
-#define HT_FBK_CFG1_HTMCS14FBK          FIELD32(0x0f000000)
-#define HT_FBK_CFG1_HTMCS15FBK          FIELD32(0xf0000000)
-
-/*
- * LG_FBK_CFG0:
- */
-#define LG_FBK_CFG0                     0x135c
-#define LG_FBK_CFG0_OFDMMCS0FBK         FIELD32(0x0000000f)
-#define LG_FBK_CFG0_OFDMMCS1FBK         FIELD32(0x000000f0)
-#define LG_FBK_CFG0_OFDMMCS2FBK         FIELD32(0x00000f00)
-#define LG_FBK_CFG0_OFDMMCS3FBK         FIELD32(0x0000f000)
-#define LG_FBK_CFG0_OFDMMCS4FBK         FIELD32(0x000f0000)
-#define LG_FBK_CFG0_OFDMMCS5FBK         FIELD32(0x00f00000)
-#define LG_FBK_CFG0_OFDMMCS6FBK         FIELD32(0x0f000000)
-#define LG_FBK_CFG0_OFDMMCS7FBK         FIELD32(0xf0000000)
-
-/*
- * LG_FBK_CFG1:
- */
-#define LG_FBK_CFG1                     0x1360
-#define LG_FBK_CFG0_CCKMCS0FBK          FIELD32(0x0000000f)
-#define LG_FBK_CFG0_CCKMCS1FBK          FIELD32(0x000000f0)
-#define LG_FBK_CFG0_CCKMCS2FBK          FIELD32(0x00000f00)
-#define LG_FBK_CFG0_CCKMCS3FBK          FIELD32(0x0000f000)
-
-/*
- * CCK_PROT_CFG: CCK Protection
- * PROTECT_RATE: Protection control frame rate for CCK TX(RTS/CTS/CFEnd)
- * PROTECT_CTRL: Protection control frame type for CCK TX
- *               0:none, 1:RTS/CTS, 2:CTS-to-self
- * PROTECT_NAV: TXOP protection type for CCK TX
- *              0:none, 1:ShortNAVprotect, 2:LongNAVProtect
- * TX_OP_ALLOW_CCK: CCK TXOP allowance, 0:disallow
- * TX_OP_ALLOW_OFDM: CCK TXOP allowance, 0:disallow
- * TX_OP_ALLOW_MM20: CCK TXOP allowance, 0:disallow
- * TX_OP_ALLOW_MM40: CCK TXOP allowance, 0:disallow
- * TX_OP_ALLOW_GF20: CCK TXOP allowance, 0:disallow
- * TX_OP_ALLOW_GF40: CCK TXOP allowance, 0:disallow
- * RTS_TH_EN: RTS threshold enable on CCK TX
- */
-#define CCK_PROT_CFG                    0x1364
-#define CCK_PROT_CFG_PROTECT_RATE       FIELD32(0x0000ffff)
-#define CCK_PROT_CFG_PROTECT_CTRL       FIELD32(0x00030000)
-#define CCK_PROT_CFG_PROTECT_NAV        FIELD32(0x000c0000)
-#define CCK_PROT_CFG_TX_OP_ALLOW_CCK    FIELD32(0x00100000)
-#define CCK_PROT_CFG_TX_OP_ALLOW_OFDM   FIELD32(0x00200000)
-#define CCK_PROT_CFG_TX_OP_ALLOW_MM20   FIELD32(0x00400000)
-#define CCK_PROT_CFG_TX_OP_ALLOW_MM40   FIELD32(0x00800000)
-#define CCK_PROT_CFG_TX_OP_ALLOW_GF20   FIELD32(0x01000000)
-#define CCK_PROT_CFG_TX_OP_ALLOW_GF40   FIELD32(0x02000000)
-#define CCK_PROT_CFG_RTS_TH_EN          FIELD32(0x04000000)
-
-/*
- * OFDM_PROT_CFG: OFDM Protection
- */
-#define OFDM_PROT_CFG                   0x1368
-#define OFDM_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
-#define OFDM_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
-#define OFDM_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
-#define OFDM_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
-#define OFDM_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
-#define OFDM_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
-#define OFDM_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
-#define OFDM_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
-#define OFDM_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
-#define OFDM_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
-
-/*
- * MM20_PROT_CFG: MM20 Protection
- */
-#define MM20_PROT_CFG                   0x136c
-#define MM20_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
-#define MM20_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
-#define MM20_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
-#define MM20_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
-#define MM20_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
-#define MM20_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
-#define MM20_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
-#define MM20_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
-#define MM20_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
-#define MM20_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
-
-/*
- * MM40_PROT_CFG: MM40 Protection
- */
-#define MM40_PROT_CFG                   0x1370
-#define MM40_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
-#define MM40_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
-#define MM40_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
-#define MM40_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
-#define MM40_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
-#define MM40_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
-#define MM40_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
-#define MM40_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
-#define MM40_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
-#define MM40_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
-
-/*
- * GF20_PROT_CFG: GF20 Protection
- */
-#define GF20_PROT_CFG                   0x1374
-#define GF20_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
-#define GF20_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
-#define GF20_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
-#define GF20_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
-#define GF20_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
-#define GF20_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
-#define GF20_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
-#define GF20_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
-#define GF20_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
-#define GF20_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
-
-/*
- * GF40_PROT_CFG: GF40 Protection
- */
-#define GF40_PROT_CFG                   0x1378
-#define GF40_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
-#define GF40_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
-#define GF40_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
-#define GF40_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
-#define GF40_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
-#define GF40_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
-#define GF40_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
-#define GF40_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
-#define GF40_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
-#define GF40_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
-
-/*
- * EXP_CTS_TIME:
- */
-#define EXP_CTS_TIME                    0x137c
-
-/*
- * EXP_ACK_TIME:
- */
-#define EXP_ACK_TIME                    0x1380
-
-/*
- * RX_FILTER_CFG: RX configuration register.
- */
-#define RX_FILTER_CFG                   0x1400
-#define RX_FILTER_CFG_DROP_CRC_ERROR    FIELD32(0x00000001)
-#define RX_FILTER_CFG_DROP_PHY_ERROR    FIELD32(0x00000002)
-#define RX_FILTER_CFG_DROP_NOT_TO_ME    FIELD32(0x00000004)
-#define RX_FILTER_CFG_DROP_NOT_MY_BSSD  FIELD32(0x00000008)
-#define RX_FILTER_CFG_DROP_VER_ERROR    FIELD32(0x00000010)
-#define RX_FILTER_CFG_DROP_MULTICAST    FIELD32(0x00000020)
-#define RX_FILTER_CFG_DROP_BROADCAST    FIELD32(0x00000040)
-#define RX_FILTER_CFG_DROP_DUPLICATE    FIELD32(0x00000080)
-#define RX_FILTER_CFG_DROP_CF_END_ACK   FIELD32(0x00000100)
-#define RX_FILTER_CFG_DROP_CF_END       FIELD32(0x00000200)
-#define RX_FILTER_CFG_DROP_ACK          FIELD32(0x00000400)
-#define RX_FILTER_CFG_DROP_CTS          FIELD32(0x00000800)
-#define RX_FILTER_CFG_DROP_RTS          FIELD32(0x00001000)
-#define RX_FILTER_CFG_DROP_PSPOLL       FIELD32(0x00002000)
-#define RX_FILTER_CFG_DROP_BA           FIELD32(0x00004000)
-#define RX_FILTER_CFG_DROP_BAR          FIELD32(0x00008000)
-#define RX_FILTER_CFG_DROP_CNTL         FIELD32(0x00010000)
-
-/*
- * AUTO_RSP_CFG:
- * AUTORESPONDER: 0: disable, 1: enable
- * BAC_ACK_POLICY: 0:long, 1:short preamble
- * CTS_40_MMODE: Response CTS 40MHz duplicate mode
- * CTS_40_MREF: Response CTS 40MHz duplicate mode
- * AR_PREAMBLE: Auto responder preamble 0:long, 1:short preamble
- * DUAL_CTS_EN: Power bit value in control frame
- * ACK_CTS_PSM_BIT:Power bit value in control frame
- */
-#define AUTO_RSP_CFG                    0x1404
-#define AUTO_RSP_CFG_AUTORESPONDER      FIELD32(0x00000001)
-#define AUTO_RSP_CFG_BAC_ACK_POLICY     FIELD32(0x00000002)
-#define AUTO_RSP_CFG_CTS_40_MMODE       FIELD32(0x00000004)
-#define AUTO_RSP_CFG_CTS_40_MREF        FIELD32(0x00000008)
-#define AUTO_RSP_CFG_AR_PREAMBLE        FIELD32(0x00000010)
-#define AUTO_RSP_CFG_DUAL_CTS_EN        FIELD32(0x00000040)
-#define AUTO_RSP_CFG_ACK_CTS_PSM_BIT    FIELD32(0x00000080)
-
-/*
- * LEGACY_BASIC_RATE:
- */
-#define LEGACY_BASIC_RATE               0x1408
-
-/*
- * HT_BASIC_RATE:
- */
-#define HT_BASIC_RATE                   0x140c
-
-/*
- * HT_CTRL_CFG:
- */
-#define HT_CTRL_CFG                     0x1410
-
-/*
- * SIFS_COST_CFG:
- */
-#define SIFS_COST_CFG                   0x1414
-
-/*
- * RX_PARSER_CFG:
- * Set NAV for all received frames
- */
-#define RX_PARSER_CFG                   0x1418
-
-/*
- * TX_SEC_CNT0:
- */
-#define TX_SEC_CNT0                     0x1500
-
-/*
- * RX_SEC_CNT0:
- */
-#define RX_SEC_CNT0                     0x1504
-
-/*
- * CCMP_FC_MUTE:
- */
-#define CCMP_FC_MUTE                    0x1508
-
-/*
- * TXOP_HLDR_ADDR0:
- */
-#define TXOP_HLDR_ADDR0                 0x1600
-
-/*
- * TXOP_HLDR_ADDR1:
- */
-#define TXOP_HLDR_ADDR1                 0x1604
-
-/*
- * TXOP_HLDR_ET:
- */
-#define TXOP_HLDR_ET                    0x1608
-
-/*
- * QOS_CFPOLL_RA_DW0:
- */
-#define QOS_CFPOLL_RA_DW0               0x160c
-
-/*
- * QOS_CFPOLL_RA_DW1:
- */
-#define QOS_CFPOLL_RA_DW1               0x1610
-
-/*
- * QOS_CFPOLL_QC:
- */
-#define QOS_CFPOLL_QC                   0x1614
-
-/*
- * RX_STA_CNT0: RX PLCP error count & RX CRC error count
- */
-#define RX_STA_CNT0                     0x1700
-#define RX_STA_CNT0_CRC_ERR             FIELD32(0x0000ffff)
-#define RX_STA_CNT0_PHY_ERR             FIELD32(0xffff0000)
-
-/*
- * RX_STA_CNT1: RX False CCA count & RX LONG frame count
- */
-#define RX_STA_CNT1                     0x1704
-#define RX_STA_CNT1_FALSE_CCA           FIELD32(0x0000ffff)
-#define RX_STA_CNT1_PLCP_ERR            FIELD32(0xffff0000)
-
-/*
- * RX_STA_CNT2:
- */
-#define RX_STA_CNT2                     0x1708
-#define RX_STA_CNT2_RX_DUPLI_COUNT      FIELD32(0x0000ffff)
-#define RX_STA_CNT2_RX_FIFO_OVERFLOW    FIELD32(0xffff0000)
-
-/*
- * TX_STA_CNT0: TX Beacon count
- */
-#define TX_STA_CNT0                     0x170c
-#define TX_STA_CNT0_TX_FAIL_COUNT       FIELD32(0x0000ffff)
-#define TX_STA_CNT0_TX_BEACON_COUNT     FIELD32(0xffff0000)
-
-/*
- * TX_STA_CNT1: TX tx count
- */
-#define TX_STA_CNT1                     0x1710
-#define TX_STA_CNT1_TX_SUCCESS          FIELD32(0x0000ffff)
-#define TX_STA_CNT1_TX_RETRANSMIT       FIELD32(0xffff0000)
-
-/*
- * TX_STA_CNT2: TX tx count
- */
-#define TX_STA_CNT2                     0x1714
-#define TX_STA_CNT2_TX_ZERO_LEN_COUNT   FIELD32(0x0000ffff)
-#define TX_STA_CNT2_TX_UNDER_FLOW_COUNT FIELD32(0xffff0000)
-
-/*
- * TX_STA_FIFO: TX Result for specific PID status fifo register
- */
-#define TX_STA_FIFO                     0x1718
-#define TX_STA_FIFO_VALID               FIELD32(0x00000001)
-#define TX_STA_FIFO_PID_TYPE            FIELD32(0x0000001e)
-#define TX_STA_FIFO_TX_SUCCESS          FIELD32(0x00000020)
-#define TX_STA_FIFO_TX_AGGRE            FIELD32(0x00000040)
-#define TX_STA_FIFO_TX_ACK_REQUIRED     FIELD32(0x00000080)
-#define TX_STA_FIFO_WCID                FIELD32(0x0000ff00)
-#define TX_STA_FIFO_SUCCESS_RATE        FIELD32(0xffff0000)
-
-/*
- * TX_AGG_CNT: Debug counter
- */
-#define TX_AGG_CNT                      0x171c
-#define TX_AGG_CNT_NON_AGG_TX_COUNT     FIELD32(0x0000ffff)
-#define TX_AGG_CNT_AGG_TX_COUNT         FIELD32(0xffff0000)
-
-/*
- * TX_AGG_CNT0:
- */
-#define TX_AGG_CNT0                     0x1720
-#define TX_AGG_CNT0_AGG_SIZE_1_COUNT    FIELD32(0x0000ffff)
-#define TX_AGG_CNT0_AGG_SIZE_2_COUNT    FIELD32(0xffff0000)
-
-/*
- * TX_AGG_CNT1:
- */
-#define TX_AGG_CNT1                     0x1724
-#define TX_AGG_CNT1_AGG_SIZE_3_COUNT    FIELD32(0x0000ffff)
-#define TX_AGG_CNT1_AGG_SIZE_4_COUNT    FIELD32(0xffff0000)
-
-/*
- * TX_AGG_CNT2:
- */
-#define TX_AGG_CNT2                     0x1728
-#define TX_AGG_CNT2_AGG_SIZE_5_COUNT    FIELD32(0x0000ffff)
-#define TX_AGG_CNT2_AGG_SIZE_6_COUNT    FIELD32(0xffff0000)
-
-/*
- * TX_AGG_CNT3:
- */
-#define TX_AGG_CNT3                     0x172c
-#define TX_AGG_CNT3_AGG_SIZE_7_COUNT    FIELD32(0x0000ffff)
-#define TX_AGG_CNT3_AGG_SIZE_8_COUNT    FIELD32(0xffff0000)
-
-/*
- * TX_AGG_CNT4:
- */
-#define TX_AGG_CNT4                     0x1730
-#define TX_AGG_CNT4_AGG_SIZE_9_COUNT    FIELD32(0x0000ffff)
-#define TX_AGG_CNT4_AGG_SIZE_10_COUNT   FIELD32(0xffff0000)
-
-/*
- * TX_AGG_CNT5:
- */
-#define TX_AGG_CNT5                     0x1734
-#define TX_AGG_CNT5_AGG_SIZE_11_COUNT   FIELD32(0x0000ffff)
-#define TX_AGG_CNT5_AGG_SIZE_12_COUNT   FIELD32(0xffff0000)
-
-/*
- * TX_AGG_CNT6:
- */
-#define TX_AGG_CNT6                     0x1738
-#define TX_AGG_CNT6_AGG_SIZE_13_COUNT   FIELD32(0x0000ffff)
-#define TX_AGG_CNT6_AGG_SIZE_14_COUNT   FIELD32(0xffff0000)
-
-/*
- * TX_AGG_CNT7:
- */
-#define TX_AGG_CNT7                     0x173c
-#define TX_AGG_CNT7_AGG_SIZE_15_COUNT   FIELD32(0x0000ffff)
-#define TX_AGG_CNT7_AGG_SIZE_16_COUNT   FIELD32(0xffff0000)
-
-/*
- * MPDU_DENSITY_CNT:
- * TX_ZERO_DEL: TX zero length delimiter count
- * RX_ZERO_DEL: RX zero length delimiter count
- */
-#define MPDU_DENSITY_CNT                0x1740
-#define MPDU_DENSITY_CNT_TX_ZERO_DEL    FIELD32(0x0000ffff)
-#define MPDU_DENSITY_CNT_RX_ZERO_DEL    FIELD32(0xffff0000)
-
-/*
- * Security key table memory.
- * MAC_WCID_BASE: 8-bytes (use only 6 bytes) * 256 entry
- * PAIRWISE_KEY_TABLE_BASE: 32-byte * 256 entry
- * MAC_IVEIV_TABLE_BASE: 8-byte * 256-entry
- * MAC_WCID_ATTRIBUTE_BASE: 4-byte * 256-entry
- * SHARED_KEY_TABLE_BASE: 32 bytes * 32-entry
- * SHARED_KEY_MODE_BASE: 4 bits * 32-entry
- */
-#define MAC_WCID_BASE                   0x1800
-#define PAIRWISE_KEY_TABLE_BASE         0x4000
-#define MAC_IVEIV_TABLE_BASE            0x6000
-#define MAC_WCID_ATTRIBUTE_BASE         0x6800
-#define SHARED_KEY_TABLE_BASE           0x6c00
-#define SHARED_KEY_MODE_BASE            0x7000
-
-#define MAC_WCID_ENTRY(__idx) \
-        ( MAC_WCID_BASE + ((__idx) * sizeof(struct mac_wcid_entry)) )
-#define PAIRWISE_KEY_ENTRY(__idx) \
-        ( PAIRWISE_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)) )
-#define MAC_IVEIV_ENTRY(__idx) \
-        ( MAC_IVEIV_TABLE_BASE + ((__idx) & sizeof(struct mac_iveiv_entry)) )
-#define MAC_WCID_ATTR_ENTRY(__idx) \
-        ( MAC_WCID_ATTRIBUTE_BASE + ((__idx) * sizeof(u32)) )
-#define SHARED_KEY_ENTRY(__idx) \
-        ( SHARED_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)) )
-#define SHARED_KEY_MODE_ENTRY(__idx) \
-        ( SHARED_KEY_MODE_BASE + ((__idx) * sizeof(u32)) )
-
-struct mac_wcid_entry {
-        u8 mac[6];
-        u8 reserved[2];
-} __attribute__ ((packed));
-
-struct hw_key_entry {
-        u8 key[16];
-        u8 tx_mic[8];
-        u8 rx_mic[8];
-} __attribute__ ((packed));
-
-struct mac_iveiv_entry {
-        u8 iv[8];
-} __attribute__ ((packed));
-
-/*
- * MAC_WCID_ATTRIBUTE:
- */
-#define MAC_WCID_ATTRIBUTE_KEYTAB       FIELD32(0x00000001)
-#define MAC_WCID_ATTRIBUTE_CIPHER       FIELD32(0x0000000e)
-#define MAC_WCID_ATTRIBUTE_BSS_IDX      FIELD32(0x00000070)
-#define MAC_WCID_ATTRIBUTE_RX_WIUDF     FIELD32(0x00000380)
-
-/*
- * SHARED_KEY_MODE:
- */
-#define SHARED_KEY_MODE_BSS0_KEY0       FIELD32(0x00000007)
-#define SHARED_KEY_MODE_BSS0_KEY1       FIELD32(0x00000070)
-#define SHARED_KEY_MODE_BSS0_KEY2       FIELD32(0x00000700)
-#define SHARED_KEY_MODE_BSS0_KEY3       FIELD32(0x00007000)
-#define SHARED_KEY_MODE_BSS1_KEY0       FIELD32(0x00070000)
-#define SHARED_KEY_MODE_BSS1_KEY1       FIELD32(0x00700000)
-#define SHARED_KEY_MODE_BSS1_KEY2       FIELD32(0x07000000)
-#define SHARED_KEY_MODE_BSS1_KEY3       FIELD32(0x70000000)
-
-/*
- * HOST-MCU communication
- */
-
-/*
- * H2M_MAILBOX_CSR: Host-to-MCU Mailbox.
- */
-#define H2M_MAILBOX_CSR                 0x7010
-#define H2M_MAILBOX_CSR_ARG0            FIELD32(0x000000ff)
-#define H2M_MAILBOX_CSR_ARG1            FIELD32(0x0000ff00)
-#define H2M_MAILBOX_CSR_CMD_TOKEN       FIELD32(0x00ff0000)
-#define H2M_MAILBOX_CSR_OWNER           FIELD32(0xff000000)
-
-/*
- * H2M_MAILBOX_CID:
- */
-#define H2M_MAILBOX_CID                 0x7014
-#define H2M_MAILBOX_CID_CMD0            FIELD32(0x000000ff)
-#define H2M_MAILBOX_CID_CMD1            FIELD32(0x0000ff00)
-#define H2M_MAILBOX_CID_CMD2            FIELD32(0x00ff0000)
-#define H2M_MAILBOX_CID_CMD3            FIELD32(0xff000000)
-
-/*
- * H2M_MAILBOX_STATUS:
- */
-#define H2M_MAILBOX_STATUS              0x701c
-
-/*
- * H2M_INT_SRC:
- */
-#define H2M_INT_SRC                     0x7024
-
-/*
- * H2M_BBP_AGENT:
- */
-#define H2M_BBP_AGENT                   0x7028
-
-/*
- * MCU_LEDCS: LED control for MCU Mailbox.
- */
-#define MCU_LEDCS_LED_MODE              FIELD8(0x1f)
-#define MCU_LEDCS_POLARITY              FIELD8(0x01)
-
-/*
- * HW_CS_CTS_BASE:
- * Carrier-sense CTS frame base address.
- * It's where mac stores carrier-sense frame for carrier-sense function.
- */
-#define HW_CS_CTS_BASE                  0x7700
-
-/*
- * HW_DFS_CTS_BASE:
- * FS CTS frame base address. It's where mac stores CTS frame for DFS.
- */
-#define HW_DFS_CTS_BASE                 0x7780
-
-/*
- * TXRX control registers - base address 0x3000
- */
-
-/*
- * TXRX_CSR1:
- * rt2860b  UNKNOWN reg use R/O Reg Addr 0x77d0 first..
- */
-#define TXRX_CSR1                       0x77d0
-
-/*
- * HW_DEBUG_SETTING_BASE:
- * since NULL frame won't be that long (256 byte)
- * We steal 16 tail bytes to save debugging settings
- */
-#define HW_DEBUG_SETTING_BASE           0x77f0
-#define HW_DEBUG_SETTING_BASE2          0x7770
-
-/*
- * HW_BEACON_BASE
- * In order to support maximum 8 MBSS and its maximum length
- * is 512 bytes for each beacon
- * Three section discontinue memory segments will be used.
- * 1. The original region for BCN 0~3
- * 2. Extract memory from FCE table for BCN 4~5
- * 3. Extract memory from Pair-wise key table for BCN 6~7
- *    It occupied those memory of wcid 238~253 for BCN 6
- *    and wcid 222~237 for BCN 7
- *
- * IMPORTANT NOTE: Not sure why legacy driver does this,
- * but HW_BEACON_BASE7 is 0x0200 bytes below HW_BEACON_BASE6.
- */
-#define HW_BEACON_BASE0                 0x7800
-#define HW_BEACON_BASE1                 0x7a00
-#define HW_BEACON_BASE2                 0x7c00
-#define HW_BEACON_BASE3                 0x7e00
-#define HW_BEACON_BASE4                 0x7200
-#define HW_BEACON_BASE5                 0x7400
-#define HW_BEACON_BASE6                 0x5dc0
-#define HW_BEACON_BASE7                 0x5bc0
-
-#define HW_BEACON_OFFSET(__index) \
-        ( ((__index) < 4) ? ( HW_BEACON_BASE0 + (__index * 0x0200) ) : \
-          (((__index) < 6) ? ( HW_BEACON_BASE4 + ((__index - 4) * 0x0200) ) : \
-          (HW_BEACON_BASE6 - ((__index - 6) * 0x0200))) )
-
-/*
  * 8051 firmware image.
  */
 #define FIRMWARE_RT2870                 "rt2870.bin"
 #define FIRMWARE_IMAGE_BASE             0x3000
 
 /*
- * BBP registers.
- * The wordsize of the BBP is 8 bits.
- */
-
-/*
- * BBP 1: TX Antenna
- */
-#define BBP1_TX_POWER                   FIELD8(0x07)
-#define BBP1_TX_ANTENNA                 FIELD8(0x18)
-
-/*
- * BBP 3: RX Antenna
- */
-#define BBP3_RX_ANTENNA                 FIELD8(0x18)
-#define BBP3_HT40_PLUS                  FIELD8(0x20)
-
-/*
- * BBP 4: Bandwidth
- */
-#define BBP4_TX_BF                      FIELD8(0x01)
-#define BBP4_BANDWIDTH                  FIELD8(0x18)
-
-/*
- * RFCSR registers
- * The wordsize of the RFCSR is 8 bits.
- */
-
-/*
- * RFCSR 6:
- */
-#define RFCSR6_R                        FIELD8(0x03)
-
-/*
- * RFCSR 7:
- */
-#define RFCSR7_RF_TUNING                FIELD8(0x01)
-
-/*
- * RFCSR 12:
- */
-#define RFCSR12_TX_POWER                FIELD8(0x1f)
-
-/*
- * RFCSR 22:
- */
-#define RFCSR22_BASEBAND_LOOPBACK       FIELD8(0x01)
-
-/*
- * RFCSR 23:
- */
-#define RFCSR23_FREQ_OFFSET             FIELD8(0x7f)
-
-/*
- * RFCSR 30:
- */
-#define RFCSR30_RF_CALIBRATION          FIELD8(0x80)
-
-/*
- * RF registers
- */
-
-/*
- * RF 2
- */
-#define RF2_ANTENNA_RX2                 FIELD32(0x00000040)
-#define RF2_ANTENNA_TX1                 FIELD32(0x00004000)
-#define RF2_ANTENNA_RX1                 FIELD32(0x00020000)
-
-/*
- * RF 3
- */
-#define RF3_TXPOWER_G                   FIELD32(0x00003e00)
-#define RF3_TXPOWER_A_7DBM_BOOST        FIELD32(0x00000200)
-#define RF3_TXPOWER_A                   FIELD32(0x00003c00)
-
-/*
- * RF 4
- */
-#define RF4_TXPOWER_G                   FIELD32(0x000007c0)
-#define RF4_TXPOWER_A_7DBM_BOOST        FIELD32(0x00000040)
-#define RF4_TXPOWER_A                   FIELD32(0x00000780)
-#define RF4_FREQ_OFFSET                 FIELD32(0x001f8000)
-#define RF4_HT40                        FIELD32(0x00200000)
-
-/*
- * EEPROM content.
- * The wordsize of the EEPROM is 16 bits.
- */
-
-/*
- * EEPROM Version
- */
-#define EEPROM_VERSION                  0x0001
-#define EEPROM_VERSION_FAE              FIELD16(0x00ff)
-#define EEPROM_VERSION_VERSION          FIELD16(0xff00)
-
-/*
- * HW MAC address.
- */
-#define EEPROM_MAC_ADDR_0               0x0002
-#define EEPROM_MAC_ADDR_BYTE0           FIELD16(0x00ff)
-#define EEPROM_MAC_ADDR_BYTE1           FIELD16(0xff00)
-#define EEPROM_MAC_ADDR_1               0x0003
-#define EEPROM_MAC_ADDR_BYTE2           FIELD16(0x00ff)
-#define EEPROM_MAC_ADDR_BYTE3           FIELD16(0xff00)
-#define EEPROM_MAC_ADDR_2               0x0004
-#define EEPROM_MAC_ADDR_BYTE4           FIELD16(0x00ff)
-#define EEPROM_MAC_ADDR_BYTE5           FIELD16(0xff00)
-
-/*
- * EEPROM ANTENNA config
- * RXPATH: 1: 1R, 2: 2R, 3: 3R
- * TXPATH: 1: 1T, 2: 2T
- */
-#define EEPROM_ANTENNA                  0x001a
-#define EEPROM_ANTENNA_RXPATH           FIELD16(0x000f)
-#define EEPROM_ANTENNA_TXPATH           FIELD16(0x00f0)
-#define EEPROM_ANTENNA_RF_TYPE          FIELD16(0x0f00)
-
-/*
- * EEPROM NIC config
- * CARDBUS_ACCEL: 0 - enable, 1 - disable
- */
-#define EEPROM_NIC                      0x001b
-#define EEPROM_NIC_HW_RADIO             FIELD16(0x0001)
-#define EEPROM_NIC_DYNAMIC_TX_AGC       FIELD16(0x0002)
-#define EEPROM_NIC_EXTERNAL_LNA_BG      FIELD16(0x0004)
-#define EEPROM_NIC_EXTERNAL_LNA_A       FIELD16(0x0008)
-#define EEPROM_NIC_CARDBUS_ACCEL        FIELD16(0x0010)
-#define EEPROM_NIC_BW40M_SB_BG          FIELD16(0x0020)
-#define EEPROM_NIC_BW40M_SB_A           FIELD16(0x0040)
-#define EEPROM_NIC_WPS_PBC              FIELD16(0x0080)
-#define EEPROM_NIC_BW40M_BG             FIELD16(0x0100)
-#define EEPROM_NIC_BW40M_A              FIELD16(0x0200)
-
-/*
- * EEPROM frequency
- */
-#define EEPROM_FREQ                     0x001d
-#define EEPROM_FREQ_OFFSET              FIELD16(0x00ff)
-#define EEPROM_FREQ_LED_MODE            FIELD16(0x7f00)
-#define EEPROM_FREQ_LED_POLARITY        FIELD16(0x1000)
-
-/*
- * EEPROM LED
- * POLARITY_RDY_G: Polarity RDY_G setting.
- * POLARITY_RDY_A: Polarity RDY_A setting.
- * POLARITY_ACT: Polarity ACT setting.
- * POLARITY_GPIO_0: Polarity GPIO0 setting.
- * POLARITY_GPIO_1: Polarity GPIO1 setting.
- * POLARITY_GPIO_2: Polarity GPIO2 setting.
- * POLARITY_GPIO_3: Polarity GPIO3 setting.
- * POLARITY_GPIO_4: Polarity GPIO4 setting.
- * LED_MODE: Led mode.
- */
-#define EEPROM_LED1                     0x001e
-#define EEPROM_LED2                     0x001f
-#define EEPROM_LED3                     0x0020
-#define EEPROM_LED_POLARITY_RDY_BG      FIELD16(0x0001)
-#define EEPROM_LED_POLARITY_RDY_A       FIELD16(0x0002)
-#define EEPROM_LED_POLARITY_ACT         FIELD16(0x0004)
-#define EEPROM_LED_POLARITY_GPIO_0      FIELD16(0x0008)
-#define EEPROM_LED_POLARITY_GPIO_1      FIELD16(0x0010)
-#define EEPROM_LED_POLARITY_GPIO_2      FIELD16(0x0020)
-#define EEPROM_LED_POLARITY_GPIO_3      FIELD16(0x0040)
-#define EEPROM_LED_POLARITY_GPIO_4      FIELD16(0x0080)
-#define EEPROM_LED_LED_MODE             FIELD16(0x1f00)
-
-/*
- * EEPROM LNA
- */
-#define EEPROM_LNA                      0x0022
-#define EEPROM_LNA_BG                   FIELD16(0x00ff)
-#define EEPROM_LNA_A0                   FIELD16(0xff00)
-
-/*
- * EEPROM RSSI BG offset
- */
-#define EEPROM_RSSI_BG                  0x0023
-#define EEPROM_RSSI_BG_OFFSET0          FIELD16(0x00ff)
-#define EEPROM_RSSI_BG_OFFSET1          FIELD16(0xff00)
-
-/*
- * EEPROM RSSI BG2 offset
- */
-#define EEPROM_RSSI_BG2                 0x0024
-#define EEPROM_RSSI_BG2_OFFSET2         FIELD16(0x00ff)
-#define EEPROM_RSSI_BG2_LNA_A1          FIELD16(0xff00)
-
-/*
- * EEPROM RSSI A offset
- */
-#define EEPROM_RSSI_A                   0x0025
-#define EEPROM_RSSI_A_OFFSET0           FIELD16(0x00ff)
-#define EEPROM_RSSI_A_OFFSET1           FIELD16(0xff00)
-
-/*
- * EEPROM RSSI A2 offset
- */
-#define EEPROM_RSSI_A2                  0x0026
-#define EEPROM_RSSI_A2_OFFSET2          FIELD16(0x00ff)
-#define EEPROM_RSSI_A2_LNA_A2           FIELD16(0xff00)
-
-/*
- * EEPROM TXpower delta: 20MHZ AND 40 MHZ use different power.
- *      This is delta in 40MHZ.
- * VALUE: Tx Power dalta value (MAX=4)
- * TYPE: 1: Plus the delta value, 0: minus the delta value
- * TXPOWER: Enable:
- */
-#define EEPROM_TXPOWER_DELTA            0x0028
-#define EEPROM_TXPOWER_DELTA_VALUE      FIELD16(0x003f)
-#define EEPROM_TXPOWER_DELTA_TYPE       FIELD16(0x0040)
-#define EEPROM_TXPOWER_DELTA_TXPOWER    FIELD16(0x0080)
-
-/*
- * EEPROM TXPOWER 802.11BG
- */
-#define EEPROM_TXPOWER_BG1              0x0029
-#define EEPROM_TXPOWER_BG2              0x0030
-#define EEPROM_TXPOWER_BG_SIZE          7
-#define EEPROM_TXPOWER_BG_1             FIELD16(0x00ff)
-#define EEPROM_TXPOWER_BG_2             FIELD16(0xff00)
-
-/*
- * EEPROM TXPOWER 802.11A
- */
-#define EEPROM_TXPOWER_A1               0x003c
-#define EEPROM_TXPOWER_A2               0x0053
-#define EEPROM_TXPOWER_A_SIZE           6
-#define EEPROM_TXPOWER_A_1              FIELD16(0x00ff)
-#define EEPROM_TXPOWER_A_2              FIELD16(0xff00)
-
-/*
- * EEPROM TXpower byrate: 20MHZ power
- */
-#define EEPROM_TXPOWER_BYRATE           0x006f
-
-/*
- * EEPROM BBP.
- */
-#define EEPROM_BBP_START                0x0078
-#define EEPROM_BBP_SIZE                 16
-#define EEPROM_BBP_VALUE                FIELD16(0x00ff)
-#define EEPROM_BBP_REG_ID               FIELD16(0xff00)
-
-/*
- * MCU mailbox commands.
- */
-#define MCU_SLEEP                       0x30
-#define MCU_WAKEUP                      0x31
-#define MCU_RADIO_OFF                   0x35
-#define MCU_CURRENT                     0x36
-#define MCU_LED                         0x50
-#define MCU_LED_STRENGTH                0x51
-#define MCU_LED_1                       0x52
-#define MCU_LED_2                       0x53
-#define MCU_LED_3                       0x54
-#define MCU_RADAR                       0x60
-#define MCU_BOOT_SIGNAL                 0x72
-#define MCU_BBP_SIGNAL                  0x80
-#define MCU_POWER_SAVE                  0x83
-
-/*
- * MCU mailbox tokens
- */
-#define TOKEN_WAKUP                     3
-
-/*
  * DMA descriptor defines.
  */
-#define TXD_DESC_SIZE                   ( 4 * sizeof(__le32) )
 #define TXINFO_DESC_SIZE                ( 1 * sizeof(__le32) )
-#define TXWI_DESC_SIZE                  ( 4 * sizeof(__le32) )
-#define RXD_DESC_SIZE                   ( 1 * sizeof(__le32) )
+#define RXINFO_DESC_SIZE                ( 1 * sizeof(__le32) )
 #define RXWI_DESC_SIZE                  ( 4 * sizeof(__le32) )
-
-/*
- * TX descriptor format for TX, PRIO and Beacon Ring.
- */
-
-/*
- * Word0
- */
-#define TXD_W0_SD_PTR0                  FIELD32(0xffffffff)
-
-/*
- * Word1
- */
-#define TXD_W1_SD_LEN1                  FIELD32(0x00003fff)
-#define TXD_W1_LAST_SEC1                FIELD32(0x00004000)
-#define TXD_W1_BURST                    FIELD32(0x00008000)
-#define TXD_W1_SD_LEN0                  FIELD32(0x3fff0000)
-#define TXD_W1_LAST_SEC0                FIELD32(0x40000000)
-#define TXD_W1_DMA_DONE                 FIELD32(0x80000000)
-
-/*
- * Word2
- */
-#define TXD_W2_SD_PTR1                  FIELD32(0xffffffff)
-
-/*
- * Word3
- * WIV: Wireless Info Valid. 1: Driver filled WI,  0: DMA needs to copy WI
- * QSEL: Select on-chip FIFO ID for 2nd-stage output scheduler.
- *       0:MGMT, 1:HCCA 2:EDCA
- */
-#define TXD_W3_WIV                      FIELD32(0x01000000)
-#define TXD_W3_QSEL                     FIELD32(0x06000000)
-#define TXD_W3_TCO                      FIELD32(0x20000000)
-#define TXD_W3_UCO                      FIELD32(0x40000000)
-#define TXD_W3_ICO                      FIELD32(0x80000000)
+#define RXD_DESC_SIZE                   ( 1 * sizeof(__le32) )
 
 /*
  * TX Info structure
@@ -1807,50 +103,52 @@ struct mac_iveiv_entry {
 #define TXINFO_W0_USB_DMA_TX_BURST      FIELD32(0x80000000)
 
 /*
- * TX WI structure
+ * RX Info structure
+ */
+
+/*
+ * Word 0
+ */
+
+#define RXINFO_W0_USB_DMA_RX_PKT_LEN    FIELD32(0x0000ffff)
+
+/*
+ * RX WI structure
  */
 
 /*
  * Word0
- * FRAG: 1 To inform TKIP engine this is a fragment.
- * MIMO_PS: The remote peer is in dynamic MIMO-PS mode
- * TX_OP: 0:HT TXOP rule , 1:PIFS TX ,2:Backoff, 3:sifs
- * BW: Channel bandwidth 20MHz or 40 MHz
- * STBC: 1: STBC support MCS =0-7, 2,3 : RESERVED
  */
-#define TXWI_W0_FRAG                    FIELD32(0x00000001)
-#define TXWI_W0_MIMO_PS                 FIELD32(0x00000002)
-#define TXWI_W0_CF_ACK                  FIELD32(0x00000004)
-#define TXWI_W0_TS                      FIELD32(0x00000008)
-#define TXWI_W0_AMPDU                   FIELD32(0x00000010)
-#define TXWI_W0_MPDU_DENSITY            FIELD32(0x000000e0)
-#define TXWI_W0_TX_OP                   FIELD32(0x00000300)
-#define TXWI_W0_MCS                     FIELD32(0x007f0000)
-#define TXWI_W0_BW                      FIELD32(0x00800000)
-#define TXWI_W0_SHORT_GI                FIELD32(0x01000000)
-#define TXWI_W0_STBC                    FIELD32(0x06000000)
-#define TXWI_W0_IFS                     FIELD32(0x08000000)
-#define TXWI_W0_PHYMODE                 FIELD32(0xc0000000)
+#define RXWI_W0_WIRELESS_CLI_ID         FIELD32(0x000000ff)
+#define RXWI_W0_KEY_INDEX               FIELD32(0x00000300)
+#define RXWI_W0_BSSID                   FIELD32(0x00001c00)
+#define RXWI_W0_UDF                     FIELD32(0x0000e000)
+#define RXWI_W0_MPDU_TOTAL_BYTE_COUNT   FIELD32(0x0fff0000)
+#define RXWI_W0_TID                     FIELD32(0xf0000000)
 
 /*
  * Word1
  */
-#define TXWI_W1_ACK                     FIELD32(0x00000001)
-#define TXWI_W1_NSEQ                    FIELD32(0x00000002)
-#define TXWI_W1_BW_WIN_SIZE             FIELD32(0x000000fc)
-#define TXWI_W1_WIRELESS_CLI_ID         FIELD32(0x0000ff00)
-#define TXWI_W1_MPDU_TOTAL_BYTE_COUNT   FIELD32(0x0fff0000)
-#define TXWI_W1_PACKETID                FIELD32(0xf0000000)
+#define RXWI_W1_FRAG                    FIELD32(0x0000000f)
+#define RXWI_W1_SEQUENCE                FIELD32(0x0000fff0)
+#define RXWI_W1_MCS                     FIELD32(0x007f0000)
+#define RXWI_W1_BW                      FIELD32(0x00800000)
+#define RXWI_W1_SHORT_GI                FIELD32(0x01000000)
+#define RXWI_W1_STBC                    FIELD32(0x06000000)
+#define RXWI_W1_PHYMODE                 FIELD32(0xc0000000)
 
 /*
  * Word2
  */
-#define TXWI_W2_IV                      FIELD32(0xffffffff)
+#define RXWI_W2_RSSI0                   FIELD32(0x000000ff)
+#define RXWI_W2_RSSI1                   FIELD32(0x0000ff00)
+#define RXWI_W2_RSSI2                   FIELD32(0x00ff0000)
 
 /*
  * Word3
  */
-#define TXWI_W3_EIV                     FIELD32(0xffffffff)
+#define RXWI_W3_SNR0                    FIELD32(0x000000ff)
+#define RXWI_W3_SNR1                    FIELD32(0x0000ff00)
 
 /*
  * RX descriptor format for RX Ring.
@@ -1888,64 +186,4 @@ struct mac_iveiv_entry {
 #define RXD_W0_LAST_AMSDU               FIELD32(0x00080000)
 #define RXD_W0_PLCP_SIGNAL              FIELD32(0xfff00000)
 
-/*
- * RX WI structure
- */
-
-/*
- * Word0
- */
-#define RXWI_W0_WIRELESS_CLI_ID         FIELD32(0x000000ff)
-#define RXWI_W0_KEY_INDEX               FIELD32(0x00000300)
-#define RXWI_W0_BSSID                   FIELD32(0x00001c00)
-#define RXWI_W0_UDF                     FIELD32(0x0000e000)
-#define RXWI_W0_MPDU_TOTAL_BYTE_COUNT   FIELD32(0x0fff0000)
-#define RXWI_W0_TID                     FIELD32(0xf0000000)
-
-/*
- * Word1
- */
-#define RXWI_W1_FRAG                    FIELD32(0x0000000f)
-#define RXWI_W1_SEQUENCE                FIELD32(0x0000fff0)
-#define RXWI_W1_MCS                     FIELD32(0x007f0000)
-#define RXWI_W1_BW                      FIELD32(0x00800000)
-#define RXWI_W1_SHORT_GI                FIELD32(0x01000000)
-#define RXWI_W1_STBC                    FIELD32(0x06000000)
-#define RXWI_W1_PHYMODE                 FIELD32(0xc0000000)
-
-/*
- * Word2
- */
-#define RXWI_W2_RSSI0                   FIELD32(0x000000ff)
-#define RXWI_W2_RSSI1                   FIELD32(0x0000ff00)
-#define RXWI_W2_RSSI2                   FIELD32(0x00ff0000)
-
-/*
- * Word3
- */
-#define RXWI_W3_SNR0                    FIELD32(0x000000ff)
-#define RXWI_W3_SNR1                    FIELD32(0x0000ff00)
-
-/*
- * Macros for converting txpower from EEPROM to mac80211 value
- * and from mac80211 value to register value.
- */
-#define MIN_G_TXPOWER   0
-#define MIN_A_TXPOWER   -7
-#define MAX_G_TXPOWER   31
-#define MAX_A_TXPOWER   15
-#define DEFAULT_TXPOWER 5
-
-#define TXPOWER_G_FROM_DEV(__txpower) \
-        ((__txpower) > MAX_G_TXPOWER) ? DEFAULT_TXPOWER : (__txpower)
-
-#define TXPOWER_G_TO_DEV(__txpower) \
-        clamp_t(char, __txpower, MIN_G_TXPOWER, MAX_G_TXPOWER)
-
-#define TXPOWER_A_FROM_DEV(__txpower) \
-        ((__txpower) > MAX_A_TXPOWER) ? DEFAULT_TXPOWER : (__txpower)
-
-#define TXPOWER_A_TO_DEV(__txpower) \
-        clamp_t(char, __txpower, MIN_A_TXPOWER, MAX_A_TXPOWER)
-
 #endif /* RT2800USB_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 27bc6b7fbfde..d9daa9c406fa 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -1,5 +1,6 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2004 - 2009 Gertjan van Wingerde <gwingerde@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -103,6 +104,12 @@
 #define GET_DURATION_RES(__size, __rate)(((__size) * 8 * 10) % (__rate))
 
 /*
+ * Determine the number of L2 padding bytes required between the header and
+ * the payload.
+ */
+#define L2PAD_SIZE(__hdrlen)    (-(__hdrlen) & 3)
+
+/*
  * Determine the alignment requirement,
  * to make sure the 802.11 payload is padded to a 4-byte boundrary
  * we must determine the address of the payload and calculate the
@@ -112,6 +119,12 @@
         (  ((unsigned long)((__skb)->data + (__header))) & 3 )
 
 /*
+ * Constants for extra TX headroom for alignment purposes.
+ */
+#define RT2X00_ALIGN_SIZE       4 /* Only whole frame needs alignment */
+#define RT2X00_L2PAD_SIZE       8 /* Both header & payload need alignment */
+
+/*
  * Standard timing and size defines.
  * These values should follow the ieee80211 specifications.
  */
@@ -144,6 +157,12 @@ struct avg_val {
         int avg_weight;
 };
 
+enum rt2x00_chip_intf {
+        RT2X00_CHIP_INTF_PCI,
+        RT2X00_CHIP_INTF_USB,
+        RT2X00_CHIP_INTF_SOC,
+};
+
 /*
  * Chipset identification
  * The chipset on the device is composed of a RT and RF chip.
@@ -151,17 +170,28 @@ struct avg_val {
  */
 struct rt2x00_chip {
         u16 rt;
-#define RT2460          0x0101
-#define RT2560          0x0201
-#define RT2570          0x1201
-#define RT2561s         0x0301  /* Turbo */
-#define RT2561          0x0302
-#define RT2661          0x0401
-#define RT2571          0x1300
-#define RT2870          0x1600
+#define RT2460          0x2460
+#define RT2560          0x2560
+#define RT2570          0x2570
+#define RT2661          0x2661
+#define RT2573          0x2573
+#define RT2860          0x2860  /* 2.4GHz PCI/CB */
+#define RT2870          0x2870
+#define RT2872          0x2872
+#define RT2880          0x2880  /* WSOC */
+#define RT2883          0x2883  /* WSOC */
+#define RT2890          0x2890  /* 2.4GHz PCIe */
+#define RT3052          0x3052  /* WSOC */
+#define RT3070          0x3070
+#define RT3071          0x3071
+#define RT3090          0x3090  /* 2.4GHz PCIe */
+#define RT3390          0x3390
+#define RT3572          0x3572
 
         u16 rf;
-        u32 rev;
+        u16 rev;
+
+        enum rt2x00_chip_intf intf;
 };
 
 /*
@@ -299,13 +329,6 @@ struct link {
         struct avg_val avg_rssi;
 
         /*
-         * Currently precalculated percentages of successful
-         * TX and RX frames.
-         */
-        int rx_percentage;
-        int tx_percentage;
-
-        /*
          * Work structure for scheduling periodic link tuning.
          */
         struct delayed_work work;
@@ -579,6 +602,7 @@ struct rt2x00_ops {
         const unsigned int eeprom_size;
         const unsigned int rf_size;
         const unsigned int tx_queues;
+        const unsigned int extra_tx_headroom;
         const struct data_queue_desc *rx;
         const struct data_queue_desc *tx;
         const struct data_queue_desc *bcn;
@@ -835,9 +859,23 @@ struct rt2x00_dev {
          * Firmware image.
          */
         const struct firmware *fw;
+
+        /*
+         * Driver specific data.
+         */
+        void *priv;
 };
 
 /*
+ * Register defines.
+ * Some registers require multiple attempts before success,
+ * in those cases REGISTER_BUSY_COUNT attempts should be
+ * taken with a REGISTER_BUSY_DELAY interval.
+ */
+#define REGISTER_BUSY_COUNT     5
+#define REGISTER_BUSY_DELAY     100
+
+/*
  * Generic RF access.
  * The RF is being accessed by word index.
  */
@@ -881,48 +919,57 @@ static inline void rt2x00_eeprom_write(struct rt2x00_dev *rt2x00dev,
  * Chipset handlers
  */
 static inline void rt2x00_set_chip(struct rt2x00_dev *rt2x00dev,
-                                   const u16 rt, const u16 rf, const u32 rev)
+                                   const u16 rt, const u16 rf, const u16 rev)
 {
-        INFO(rt2x00dev,
-             "Chipset detected - rt: %04x, rf: %04x, rev: %08x.\n",
-             rt, rf, rev);
-
         rt2x00dev->chip.rt = rt;
         rt2x00dev->chip.rf = rf;
         rt2x00dev->chip.rev = rev;
+
+        INFO(rt2x00dev,
+             "Chipset detected - rt: %04x, rf: %04x, rev: %04x.\n",
+             rt2x00dev->chip.rt, rt2x00dev->chip.rf, rt2x00dev->chip.rev);
 }
 
-static inline void rt2x00_set_chip_rt(struct rt2x00_dev *rt2x00dev,
-                                      const u16 rt)
+static inline char rt2x00_rt(struct rt2x00_dev *rt2x00dev, const u16 rt)
 {
-        rt2x00dev->chip.rt = rt;
+        return (rt2x00dev->chip.rt == rt);
+}
+
+static inline char rt2x00_rf(struct rt2x00_dev *rt2x00dev, const u16 rf)
+{
+        return (rt2x00dev->chip.rf == rf);
+}
+
+static inline u16 rt2x00_rev(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00dev->chip.rev;
 }
 
-static inline void rt2x00_set_chip_rf(struct rt2x00_dev *rt2x00dev,
-                                      const u16 rf, const u32 rev)
+static inline void rt2x00_set_chip_intf(struct rt2x00_dev *rt2x00dev,
+                                        enum rt2x00_chip_intf intf)
 {
-        rt2x00_set_chip(rt2x00dev, rt2x00dev->chip.rt, rf, rev);
+        rt2x00dev->chip.intf = intf;
 }
 
-static inline char rt2x00_rt(const struct rt2x00_chip *chipset, const u16 chip)
+static inline bool rt2x00_intf(struct rt2x00_dev *rt2x00dev,
+                               enum rt2x00_chip_intf intf)
 {
-        return (chipset->rt == chip);
+        return (rt2x00dev->chip.intf == intf);
 }
 
-static inline char rt2x00_rf(const struct rt2x00_chip *chipset, const u16 chip)
+static inline bool rt2x00_is_pci(struct rt2x00_dev *rt2x00dev)
 {
-        return (chipset->rf == chip);
+        return rt2x00_intf(rt2x00dev, RT2X00_CHIP_INTF_PCI);
 }
 
-static inline u32 rt2x00_rev(const struct rt2x00_chip *chipset)
+static inline bool rt2x00_is_usb(struct rt2x00_dev *rt2x00dev)
 {
-        return chipset->rev;
+        return rt2x00_intf(rt2x00dev, RT2X00_CHIP_INTF_USB);
 }
 
-static inline bool rt2x00_check_rev(const struct rt2x00_chip *chipset,
-                                    const u32 mask, const u32 rev)
+static inline bool rt2x00_is_soc(struct rt2x00_dev *rt2x00dev)
 {
-        return ((chipset->rev & mask) == rev);
+        return rt2x00_intf(rt2x00dev, RT2X00_CHIP_INTF_SOC);
 }
 
 /**
@@ -964,9 +1011,9 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
 int rt2x00mac_start(struct ieee80211_hw *hw);
 void rt2x00mac_stop(struct ieee80211_hw *hw);
 int rt2x00mac_add_interface(struct ieee80211_hw *hw,
-                            struct ieee80211_if_init_conf *conf);
+                            struct ieee80211_vif *vif);
 void rt2x00mac_remove_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_if_init_conf *conf);
+                                struct ieee80211_vif *vif);
 int rt2x00mac_config(struct ieee80211_hw *hw, u32 changed);
 void rt2x00mac_configure_filter(struct ieee80211_hw *hw,
                                 unsigned int changed_flags,
@@ -983,8 +1030,6 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 #endif /* CONFIG_RT2X00_LIB_CRYPTO */
 int rt2x00mac_get_stats(struct ieee80211_hw *hw,
                         struct ieee80211_low_level_stats *stats);
-int rt2x00mac_get_tx_stats(struct ieee80211_hw *hw,
-                           struct ieee80211_tx_queue_stats *stats);
 void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                                 struct ieee80211_vif *vif,
                                 struct ieee80211_bss_conf *bss_conf,
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 40a201e2e151..098315a271ca 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
diff --git a/drivers/net/wireless/rt2x00/rt2x00crypto.c b/drivers/net/wireless/rt2x00/rt2x00crypto.c
index de36837dcf86..d291c7862e10 100644
--- a/drivers/net/wireless/rt2x00/rt2x00crypto.c
+++ b/drivers/net/wireless/rt2x00/rt2x00crypto.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index 68bc9bb1dbf9..9569fb4e5bc5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -28,6 +28,7 @@
 #include <linux/module.h>
 #include <linux/poll.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/uaccess.h>
 
 #include "rt2x00.h"
@@ -109,7 +110,7 @@ struct rt2x00debug_intf {
 
         /*
          * HW crypto statistics.
-         * All statistics are stored seperately per cipher type.
+         * All statistics are stored separately per cipher type.
          */
         struct rt2x00debug_crypto crypto_stats[CIPHER_MAX];
 
@@ -184,7 +185,7 @@ void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
         dump_hdr->data_length = cpu_to_le32(skb->len);
         dump_hdr->chip_rt = cpu_to_le16(rt2x00dev->chip.rt);
         dump_hdr->chip_rf = cpu_to_le16(rt2x00dev->chip.rf);
-        dump_hdr->chip_rev = cpu_to_le32(rt2x00dev->chip.rev);
+        dump_hdr->chip_rev = cpu_to_le16(rt2x00dev->chip.rev);
         dump_hdr->type = cpu_to_le16(type);
         dump_hdr->queue_index = desc->entry->queue->qid;
         dump_hdr->entry_index = desc->entry->entry_idx;
@@ -573,7 +574,7 @@ static struct dentry *rt2x00debug_create_file_chipset(const char *name,
         blob->data = data;
         data += sprintf(data, "rt chip:\t%04x\n", intf->rt2x00dev->chip.rt);
         data += sprintf(data, "rf chip:\t%04x\n", intf->rt2x00dev->chip.rf);
-        data += sprintf(data, "revision:\t%08x\n", intf->rt2x00dev->chip.rev);
+        data += sprintf(data, "revision:\t%04x\n", intf->rt2x00dev->chip.rev);
         data += sprintf(data, "\n");
         data += sprintf(data, "register\tbase\twords\twordsize\n");
         data += sprintf(data, "csr\t%d\t%d\t%d\n",
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.h b/drivers/net/wireless/rt2x00/rt2x00debug.h
index 035cbc98c593..fa11409cb5c6 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.h
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 73bbec58341e..eda73ba735a6 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -25,6 +25,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 
 #include "rt2x00.h"
 #include "rt2x00lib.h"
@@ -205,6 +206,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         enum data_queue_qid qid = skb_get_queue_mapping(entry->skb);
         unsigned int header_length = ieee80211_get_hdrlen_from_skb(entry->skb);
         u8 rate_idx, rate_flags, retry_rates;
+        u8 skbdesc_flags = skbdesc->flags;
         unsigned int i;
         bool success;
 
@@ -287,12 +289,12 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         }
 
         /*
-         * Only send the status report to mac80211 when TX status was
-         * requested by it. If this was a extra frame coming through
-         * a mac80211 library call (RTS/CTS) then we should not send the
-         * status report back.
+         * Only send the status report to mac80211 when it's a frame
+         * that originated in mac80211. If this was a extra frame coming
+         * through a mac80211 library call (RTS/CTS) then we should not
+         * send the status report back.
          */
-        if (tx_info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)
+        if (!(skbdesc_flags & SKBDESC_NOT_MAC80211))
                 ieee80211_tx_status_irqsafe(rt2x00dev->hw, entry->skb);
         else
                 dev_kfree_skb_irq(entry->skb);
@@ -384,9 +386,6 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
         memset(&rxdesc, 0, sizeof(rxdesc));
         rt2x00dev->ops->lib->fill_rxdone(entry, &rxdesc);
 
-        /* Trim buffer to correct size */
-        skb_trim(entry->skb, rxdesc.size);
-
         /*
          * The data behind the ieee80211 header must be
          * aligned on a 4 byte boundary.
@@ -396,18 +395,23 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
         /*
          * Hardware might have stripped the IV/EIV/ICV data,
          * in that case it is possible that the data was
-         * provided seperately (through hardware descriptor)
+         * provided separately (through hardware descriptor)
          * in which case we should reinsert the data into the frame.
          */
         if ((rxdesc.dev_flags & RXDONE_CRYPTO_IV) &&
             (rxdesc.flags & RX_FLAG_IV_STRIPPED))
                 rt2x00crypto_rx_insert_iv(entry->skb, header_length,
                                           &rxdesc);
-        else if (rxdesc.dev_flags & RXDONE_L2PAD)
+        else if (header_length &&
+                 (rxdesc.size > header_length) &&
+                 (rxdesc.dev_flags & RXDONE_L2PAD))
                 rt2x00queue_remove_l2pad(entry->skb, header_length);
         else
                 rt2x00queue_align_payload(entry->skb, header_length);
 
+        /* Trim buffer to correct size */
+        skb_trim(entry->skb, rxdesc.size);
+
         /*
          * Check if the frame was received using HT. In that case,
          * the rate is the MCS index and should be passed to mac80211
@@ -430,7 +434,6 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
 
         rx_status->mactime = rxdesc.timestamp;
         rx_status->rate_idx = rate_idx;
-        rx_status->qual = rt2x00link_calculate_signal(rt2x00dev, rxdesc.rssi);
         rx_status->signal = rxdesc.rssi;
         rx_status->noise = rxdesc.noise;
         rx_status->flag = rxdesc.flags;
@@ -684,6 +687,21 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
         rt2x00dev->hw->queues = rt2x00dev->ops->tx_queues;
 
         /*
+         * Initialize extra TX headroom required.
+         */
+        rt2x00dev->hw->extra_tx_headroom =
+                max_t(unsigned int, IEEE80211_TX_STATUS_HEADROOM,
+                      rt2x00dev->ops->extra_tx_headroom);
+
+        /*
+         * Take TX headroom required for alignment into account.
+         */
+        if (test_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags))
+                rt2x00dev->hw->extra_tx_headroom += RT2X00_L2PAD_SIZE;
+        else if (test_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags))
+                rt2x00dev->hw->extra_tx_headroom += RT2X00_ALIGN_SIZE;
+
+        /*
          * Register HW.
          */
         status = ieee80211_register_hw(rt2x00dev->hw);
diff --git a/drivers/net/wireless/rt2x00/rt2x00dump.h b/drivers/net/wireless/rt2x00/rt2x00dump.h
index fdedb5122928..727019a748e7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dump.h
+++ b/drivers/net/wireless/rt2x00/rt2x00dump.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
diff --git a/drivers/net/wireless/rt2x00/rt2x00firmware.c b/drivers/net/wireless/rt2x00/rt2x00firmware.c
index d2deea2f2679..34beb00c4347 100644
--- a/drivers/net/wireless/rt2x00/rt2x00firmware.c
+++ b/drivers/net/wireless/rt2x00/rt2x00firmware.c
@@ -1,5 +1,6 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2004 - 2009 Gertjan van Wingerde <gwingerde@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
diff --git a/drivers/net/wireless/rt2x00/rt2x00ht.c b/drivers/net/wireless/rt2x00/rt2x00ht.c
index e3cec839e540..1056c92143a8 100644
--- a/drivers/net/wireless/rt2x00/rt2x00ht.c
+++ b/drivers/net/wireless/rt2x00/rt2x00ht.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
diff --git a/drivers/net/wireless/rt2x00/rt2x00leds.c b/drivers/net/wireless/rt2x00/rt2x00leds.c
index 49671fed91d7..ca585e34d00e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00leds.c
+++ b/drivers/net/wireless/rt2x00/rt2x00leds.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
diff --git a/drivers/net/wireless/rt2x00/rt2x00leds.h b/drivers/net/wireless/rt2x00/rt2x00leds.h
index 1046977e6a12..3b46f0c3332a 100644
--- a/drivers/net/wireless/rt2x00/rt2x00leds.h
+++ b/drivers/net/wireless/rt2x00/rt2x00leds.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -33,8 +33,6 @@ enum led_type {
         LED_TYPE_QUALITY,
 };
 
-#ifdef CONFIG_RT2X00_LIB_LEDS
-
 struct rt2x00_led {
         struct rt2x00_dev *rt2x00dev;
         struct led_classdev led_dev;
@@ -45,6 +43,4 @@ struct rt2x00_led {
 #define LED_REGISTERED          ( 1 << 1 )
 };
 
-#endif /* CONFIG_RT2X00_LIB_LEDS */
-
 #endif /* RT2X00LEDS_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index 567f029a8cda..be2e37fb4071 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -1,5 +1,6 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2004 - 2009 Gertjan van Wingerde <gwingerde@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -161,8 +162,10 @@ void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length);
  * rt2x00queue_write_tx_frame - Write TX frame to hardware
  * @queue: Queue over which the frame should be send
  * @skb: The skb to send
+ * @local: frame is not from mac80211
  */
-int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb);
+int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
+                               bool local);
 
 /**
  * rt2x00queue_update_beacon - Send new beacon from mac80211 to hardware
@@ -223,19 +226,6 @@ void rt2x00link_update_stats(struct rt2x00_dev *rt2x00dev,
                              struct rxdone_entry_desc *rxdesc);
 
 /**
- * rt2x00link_calculate_signal - Calculate signal quality
- * @rt2x00dev: Pointer to &struct rt2x00_dev.
- * @rssi: RX Frame RSSI
- *
- * Calculate the signal quality of a frame based on the rssi
- * measured during the receiving of the frame and the global
- * link quality statistics measured since the start of the
- * link tuning. The result is a value between 0 and 100 which
- * is an indication of the signal quality.
- */
-int rt2x00link_calculate_signal(struct rt2x00_dev *rt2x00dev, int rssi);
-
-/**
  * rt2x00link_start_tuner - Start periodic link tuner work
  * @rt2x00dev: Pointer to &struct rt2x00_dev.
  *
diff --git a/drivers/net/wireless/rt2x00/rt2x00link.c b/drivers/net/wireless/rt2x00/rt2x00link.c
index c708d0be9155..0efbf5a6c254 100644
--- a/drivers/net/wireless/rt2x00/rt2x00link.c
+++ b/drivers/net/wireless/rt2x00/rt2x00link.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -36,24 +36,6 @@
 #define DEFAULT_RSSI            -128
 
 /*
- * When no TX/RX percentage could be calculated due to lack of
- * frames on the air, we fallback to a percentage of 50%.
- * This will assure we will get at least get some decent value
- * when the link tuner starts.
- * The value will be dropped and overwritten with the correct (measured)
- * value anyway during the first run of the link tuner.
- */
-#define DEFAULT_PERCENTAGE      50
-
-/*
- * Small helper macro for percentage calculation
- * This is a very simple macro with the only catch that it will
- * produce a default value in case no total value was provided.
- */
-#define PERCENTAGE(__value, __total) \
-        ( (__total) ? (((__value) * 100) / (__total)) : (DEFAULT_PERCENTAGE) )
-
-/*
  * Helper struct and macro to work with moving/walking averages.
  * When adding a value to the average value the following calculation
  * is needed:
@@ -91,27 +73,6 @@
         __new; \
 })
 
-/*
- * For calculating the Signal quality we have determined
- * the total number of success and failed RX and TX frames.
- * With the addition of the average RSSI value we can determine
- * the link quality using the following algorithm:
- *
- *         rssi_percentage = (avg_rssi * 100) / rssi_offset
- *         rx_percentage = (rx_success * 100) / rx_total
- *         tx_percentage = (tx_success * 100) / tx_total
- *         avg_signal = ((WEIGHT_RSSI * avg_rssi) +
- *                       (WEIGHT_TX * tx_percentage) +
- *                       (WEIGHT_RX * rx_percentage)) / 100
- *
- * This value should then be checked to not be greater then 100.
- * This means the values of WEIGHT_RSSI, WEIGHT_RX, WEIGHT_TX must
- * sum up to 100 as well.
- */
-#define WEIGHT_RSSI     20
-#define WEIGHT_RX       40
-#define WEIGHT_TX       40
-
 static int rt2x00link_antenna_get_link_rssi(struct rt2x00_dev *rt2x00dev)
 {
         struct link_ant *ant = &rt2x00dev->link.ant;
@@ -304,46 +265,6 @@ void rt2x00link_update_stats(struct rt2x00_dev *rt2x00dev,
         ant->rssi_ant = MOVING_AVERAGE(ant->rssi_ant, rxdesc->rssi);
 }
 
-static void rt2x00link_precalculate_signal(struct rt2x00_dev *rt2x00dev)
-{
-        struct link *link = &rt2x00dev->link;
-        struct link_qual *qual = &rt2x00dev->link.qual;
-
-        link->rx_percentage =
-            PERCENTAGE(qual->rx_success, qual->rx_failed + qual->rx_success);
-        link->tx_percentage =
-            PERCENTAGE(qual->tx_success, qual->tx_failed + qual->tx_success);
-}
-
-int rt2x00link_calculate_signal(struct rt2x00_dev *rt2x00dev, int rssi)
-{
-        struct link *link = &rt2x00dev->link;
-        int rssi_percentage = 0;
-        int signal;
-
-        /*
-         * We need a positive value for the RSSI.
-         */
-        if (rssi < 0)
-                rssi += rt2x00dev->rssi_offset;
-
-        /*
-         * Calculate the different percentages,
-         * which will be used for the signal.
-         */
-        rssi_percentage = PERCENTAGE(rssi, rt2x00dev->rssi_offset);
-
-        /*
-         * Add the individual percentages and use the WEIGHT
-         * defines to calculate the current link signal.
-         */
-        signal = ((WEIGHT_RSSI * rssi_percentage) +
-                  (WEIGHT_TX * link->tx_percentage) +
-                  (WEIGHT_RX * link->rx_percentage)) / 100;
-
-        return max_t(int, signal, 100);
-}
-
 void rt2x00link_start_tuner(struct rt2x00_dev *rt2x00dev)
 {
         struct link *link = &rt2x00dev->link;
@@ -357,9 +278,6 @@ void rt2x00link_start_tuner(struct rt2x00_dev *rt2x00dev)
         if (!rt2x00dev->intf_ap_count && !rt2x00dev->intf_sta_count)
                 return;
 
-        link->rx_percentage = DEFAULT_PERCENTAGE;
-        link->tx_percentage = DEFAULT_PERCENTAGE;
-
         rt2x00link_reset_tuner(rt2x00dev, false);
 
         if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
@@ -448,12 +366,6 @@ static void rt2x00link_tuner(struct work_struct *work)
                 rt2x00dev->ops->lib->link_tuner(rt2x00dev, qual, link->count);
 
         /*
-         * Precalculate a portion of the link signal which is
-         * in based on the tx/rx success/failure counters.
-         */
-        rt2x00link_precalculate_signal(rt2x00dev);
-
-        /*
          * Send a signal to the led to update the led signal strength.
          */
         rt2x00leds_led_quality(rt2x00dev, qual->rssi);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 929b85f34f38..abbd857ec759 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -66,7 +66,6 @@ static int rt2x00mac_tx_rts_cts(struct rt2x00_dev *rt2x00dev,
         rts_info = IEEE80211_SKB_CB(skb);
         rts_info->control.rates[0].flags &= ~IEEE80211_TX_RC_USE_RTS_CTS;
         rts_info->control.rates[0].flags &= ~IEEE80211_TX_RC_USE_CTS_PROTECT;
-        rts_info->flags &= ~IEEE80211_TX_CTL_REQ_TX_STATUS;
 
         if (tx_info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
                 rts_info->flags |= IEEE80211_TX_CTL_NO_ACK;
@@ -91,7 +90,7 @@ static int rt2x00mac_tx_rts_cts(struct rt2x00_dev *rt2x00dev,
                                   frag_skb->data, data_length, tx_info,
                                   (struct ieee80211_rts *)(skb->data));
 
-        retval = rt2x00queue_write_tx_frame(queue, skb);
+        retval = rt2x00queue_write_tx_frame(queue, skb, true);
         if (retval) {
                 dev_kfree_skb_any(skb);
                 WARNING(rt2x00dev, "Failed to send RTS/CTS frame.\n");
@@ -104,10 +103,8 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_hdr *ieee80211hdr = (struct ieee80211_hdr *)skb->data;
         enum data_queue_qid qid = skb_get_queue_mapping(skb);
         struct data_queue *queue;
-        u16 frame_control;
 
         /*
          * Mac80211 might be calling this function while we are trying
@@ -142,7 +139,6 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          * either RTS or CTS-to-self frame and handles everything
          * inside the hardware.
          */
-        frame_control = le16_to_cpu(ieee80211hdr->frame_control);
         if ((tx_info->control.rates[0].flags & (IEEE80211_TX_RC_USE_RTS_CTS |
                                                 IEEE80211_TX_RC_USE_CTS_PROTECT)) &&
             !rt2x00dev->ops->hw->set_rts_threshold) {
@@ -153,7 +149,7 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                         goto exit_fail;
         }
 
-        if (rt2x00queue_write_tx_frame(queue, skb))
+        if (rt2x00queue_write_tx_frame(queue, skb, false))
                 goto exit_fail;
 
         if (rt2x00queue_threshold(queue))
@@ -191,10 +187,10 @@ void rt2x00mac_stop(struct ieee80211_hw *hw)
 EXPORT_SYMBOL_GPL(rt2x00mac_stop);
 
 int rt2x00mac_add_interface(struct ieee80211_hw *hw,
-                            struct ieee80211_if_init_conf *conf)
+                            struct ieee80211_vif *vif)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct rt2x00_intf *intf = vif_to_intf(conf->vif);
+        struct rt2x00_intf *intf = vif_to_intf(vif);
         struct data_queue *queue = rt2x00queue_get_queue(rt2x00dev, QID_BEACON);
         struct queue_entry *entry = NULL;
         unsigned int i;
@@ -207,7 +203,7 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
             !test_bit(DEVICE_STATE_STARTED, &rt2x00dev->flags))
                 return -ENODEV;
 
-        switch (conf->type) {
+        switch (vif->type) {
         case NL80211_IFTYPE_AP:
                 /*
                  * We don't support mixed combinations of
@@ -267,7 +263,7 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
          * increase interface count and start initialization.
          */
 
-        if (conf->type == NL80211_IFTYPE_AP)
+        if (vif->type == NL80211_IFTYPE_AP)
                 rt2x00dev->intf_ap_count++;
         else
                 rt2x00dev->intf_sta_count++;
@@ -277,16 +273,16 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
         mutex_init(&intf->beacon_skb_mutex);
         intf->beacon = entry;
 
-        if (conf->type == NL80211_IFTYPE_AP)
-                memcpy(&intf->bssid, conf->mac_addr, ETH_ALEN);
-        memcpy(&intf->mac, conf->mac_addr, ETH_ALEN);
+        if (vif->type == NL80211_IFTYPE_AP)
+                memcpy(&intf->bssid, vif->addr, ETH_ALEN);
+        memcpy(&intf->mac, vif->addr, ETH_ALEN);
 
         /*
          * The MAC adddress must be configured after the device
          * has been initialized. Otherwise the device can reset
          * the MAC registers.
          */
-        rt2x00lib_config_intf(rt2x00dev, intf, conf->type, intf->mac, NULL);
+        rt2x00lib_config_intf(rt2x00dev, intf, vif->type, intf->mac, NULL);
 
         /*
          * Some filters depend on the current working mode. We can force
@@ -300,10 +296,10 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
 EXPORT_SYMBOL_GPL(rt2x00mac_add_interface);
 
 void rt2x00mac_remove_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_if_init_conf *conf)
+                                struct ieee80211_vif *vif)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct rt2x00_intf *intf = vif_to_intf(conf->vif);
+        struct rt2x00_intf *intf = vif_to_intf(vif);
 
         /*
          * Don't allow interfaces to be remove while
@@ -311,11 +307,11 @@ void rt2x00mac_remove_interface(struct ieee80211_hw *hw,
          * no interface is present.
          */
         if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) ||
-            (conf->type == NL80211_IFTYPE_AP && !rt2x00dev->intf_ap_count) ||
-            (conf->type != NL80211_IFTYPE_AP && !rt2x00dev->intf_sta_count))
+            (vif->type == NL80211_IFTYPE_AP && !rt2x00dev->intf_ap_count) ||
+            (vif->type != NL80211_IFTYPE_AP && !rt2x00dev->intf_sta_count))
                 return;
 
-        if (conf->type == NL80211_IFTYPE_AP)
+        if (vif->type == NL80211_IFTYPE_AP)
                 rt2x00dev->intf_ap_count--;
         else
                 rt2x00dev->intf_sta_count--;
@@ -559,22 +555,6 @@ int rt2x00mac_get_stats(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_get_stats);
 
-int rt2x00mac_get_tx_stats(struct ieee80211_hw *hw,
-                           struct ieee80211_tx_queue_stats *stats)
-{
-        struct rt2x00_dev *rt2x00dev = hw->priv;
-        unsigned int i;
-
-        for (i = 0; i < rt2x00dev->ops->tx_queues; i++) {
-                stats[i].len = rt2x00dev->tx[i].length;
-                stats[i].limit = rt2x00dev->tx[i].limit;
-                stats[i].count = rt2x00dev->tx[i].count;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(rt2x00mac_get_tx_stats);
-
 void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                                 struct ieee80211_vif *vif,
                                 struct ieee80211_bss_conf *bss_conf,
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index cdd5154bd4c0..cf3f1c0c4382 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -27,6 +27,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <linux/slab.h>
 
 #include "rt2x00.h"
 #include "rt2x00pci.h"
@@ -41,6 +42,9 @@ int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
 {
         unsigned int i;
 
+        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+                return 0;
+
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
                 rt2x00pci_register_read(rt2x00dev, offset, reg);
                 if (!rt2x00_get_field32(*reg, field))
@@ -269,7 +273,6 @@ int rt2x00pci_probe(struct pci_dev *pci_dev, const struct pci_device_id *id)
         struct ieee80211_hw *hw;
         struct rt2x00_dev *rt2x00dev;
         int retval;
-        u16 chip;
 
         retval = pci_request_regions(pci_dev, pci_name(pci_dev));
         if (retval) {
@@ -310,11 +313,7 @@ int rt2x00pci_probe(struct pci_dev *pci_dev, const struct pci_device_id *id)
         rt2x00dev->irq = pci_dev->irq;
         rt2x00dev->name = pci_name(pci_dev);
 
-        /*
-         * Determine RT chipset by reading PCI header.
-         */
-        pci_read_config_word(pci_dev, PCI_DEVICE_ID, &chip);
-        rt2x00_set_chip_rt(rt2x00dev, chip);
+        rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_PCI);
 
         retval = rt2x00pci_alloc_reg(rt2x00dev);
         if (retval)
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.h b/drivers/net/wireless/rt2x00/rt2x00pci.h
index 15a12487e04b..8149ff68410a 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.h
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -27,6 +27,7 @@
 #define RT2X00PCI_H
 
 #include <linux/io.h>
+#include <linux/pci.h>
 
 /*
  * This variable should be used with the
@@ -35,15 +36,6 @@
 #define PCI_DEVICE_DATA(__ops)  .driver_data = (kernel_ulong_t)(__ops)
 
 /*
- * Register defines.
- * Some registers require multiple attempts before success,
- * in those cases REGISTER_BUSY_COUNT attempts should be
- * taken with a REGISTER_BUSY_DELAY interval.
- */
-#define REGISTER_BUSY_COUNT     5
-#define REGISTER_BUSY_DELAY     100
-
-/*
  * Register access.
  */
 static inline void rt2x00pci_register_read(struct rt2x00_dev *rt2x00dev,
@@ -53,10 +45,9 @@ static inline void rt2x00pci_register_read(struct rt2x00_dev *rt2x00dev,
         *value = readl(rt2x00dev->csr.base + offset);
 }
 
-static inline void
-rt2x00pci_register_multiread(struct rt2x00_dev *rt2x00dev,
-                             const unsigned int offset,
-                             void *value, const u16 length)
+static inline void rt2x00pci_register_multiread(struct rt2x00_dev *rt2x00dev,
+                                                const unsigned int offset,
+                                                void *value, const u32 length)
 {
         memcpy_fromio(value, rt2x00dev->csr.base + offset, length);
 }
@@ -68,10 +59,10 @@ static inline void rt2x00pci_register_write(struct rt2x00_dev *rt2x00dev,
         writel(value, rt2x00dev->csr.base + offset);
 }
 
-static inline void
-rt2x00pci_register_multiwrite(struct rt2x00_dev *rt2x00dev,
-                              const unsigned int offset,
-                              const void *value, const u16 length)
+static inline void rt2x00pci_register_multiwrite(struct rt2x00_dev *rt2x00dev,
+                                                 const unsigned int offset,
+                                                 const void *value,
+                                                 const u32 length)
 {
         memcpy_toio(rt2x00dev->csr.base + offset, value, length);
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 577029efe320..a0bd36fc4d2e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -1,5 +1,6 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2004 - 2009 Gertjan van Wingerde <gwingerde@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -23,6 +24,7 @@
         Abstract: rt2x00 queue specific routines.
  */
 
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/dma-mapping.h>
@@ -103,7 +105,7 @@ void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
          * is also mapped to the DMA so it can be used for transfering
          * additional descriptor information to the hardware.
          */
-        skb_push(skb, rt2x00dev->hw->extra_tx_headroom);
+        skb_push(skb, rt2x00dev->ops->extra_tx_headroom);
 
         skbdesc->skb_dma =
             dma_map_single(rt2x00dev->dev, skb->data, skb->len, DMA_TO_DEVICE);
@@ -111,7 +113,7 @@ void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
         /*
          * Restore data pointer to original location again.
          */
-        skb_pull(skb, rt2x00dev->hw->extra_tx_headroom);
+        skb_pull(skb, rt2x00dev->ops->extra_tx_headroom);
 
         skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
 }
@@ -133,7 +135,7 @@ void rt2x00queue_unmap_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
                  * by the driver, but it was actually mapped to DMA.
                  */
                 dma_unmap_single(rt2x00dev->dev, skbdesc->skb_dma,
-                                 skb->len + rt2x00dev->hw->extra_tx_headroom,
+                                 skb->len + rt2x00dev->ops->extra_tx_headroom,
                                  DMA_TO_DEVICE);
                 skbdesc->flags &= ~SKBDESC_DMA_MAPPED_TX;
         }
@@ -161,10 +163,10 @@ void rt2x00queue_align_frame(struct sk_buff *skb)
         skb_trim(skb, frame_length);
 }
 
-void rt2x00queue_align_payload(struct sk_buff *skb, unsigned int header_lengt)
+void rt2x00queue_align_payload(struct sk_buff *skb, unsigned int header_length)
 {
         unsigned int frame_length = skb->len;
-        unsigned int align = ALIGN_SIZE(skb, header_lengt);
+        unsigned int align = ALIGN_SIZE(skb, header_length);
 
         if (!align)
                 return;
@@ -176,55 +178,45 @@ void rt2x00queue_align_payload(struct sk_buff *skb, unsigned int header_lengt)
 
 void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        unsigned int frame_length = skb->len;
+        unsigned int payload_length = skb->len - header_length;
         unsigned int header_align = ALIGN_SIZE(skb, 0);
         unsigned int payload_align = ALIGN_SIZE(skb, header_length);
-        unsigned int l2pad = 4 - (payload_align - header_align);
+        unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0;
 
-        if (header_align == payload_align) {
-                /*
-                 * Both header and payload must be moved the same
-                 * amount of bytes to align them properly. This means
-                 * we don't use the L2 padding but just move the entire
-                 * frame.
-                 */
-                rt2x00queue_align_frame(skb);
-        } else if (!payload_align) {
-                /*
-                 * Simple L2 padding, only the header needs to be moved,
-                 * the payload is already properly aligned.
-                 */
-                skb_push(skb, header_align);
-                memmove(skb->data, skb->data + header_align, frame_length);
-                skbdesc->flags |= SKBDESC_L2_PADDED;
-        } else {
-                /*
-                 *
-                 * Complicated L2 padding, both header and payload need
-                 * to be moved. By default we only move to the start
-                 * of the buffer, so our header alignment needs to be
-                 * increased if there is not enough room for the header
-                 * to be moved.
-                 */
-                if (payload_align > header_align)
-                        header_align += 4;
+        /*
+         * Adjust the header alignment if the payload needs to be moved more
+         * than the header.
+         */
+        if (payload_align > header_align)
+                header_align += 4;
 
-                skb_push(skb, header_align);
-                memmove(skb->data, skb->data + header_align, header_length);
+        /* There is nothing to do if no alignment is needed */
+        if (!header_align)
+                return;
+
+        /* Reserve the amount of space needed in front of the frame */
+        skb_push(skb, header_align);
+
+        /*
+         * Move the header.
+         */
+        memmove(skb->data, skb->data + header_align, header_length);
+
+        /* Move the payload, if present and if required */
+        if (payload_length && payload_align)
                 memmove(skb->data + header_length + l2pad,
-                        skb->data + header_length + l2pad + header_align,
-                        frame_length - header_length);
-                skbdesc->flags |= SKBDESC_L2_PADDED;
-        }
+                        skb->data + header_length + l2pad + payload_align,
+                        payload_length);
+
+        /* Trim the skb to the correct size */
+        skb_trim(skb, header_length + l2pad + payload_length);
 }
 
 void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        unsigned int l2pad = 4 - (header_length & 3);
+        unsigned int l2pad = L2PAD_SIZE(header_length);
 
-        if (!l2pad || (skbdesc->flags & SKBDESC_L2_PADDED))
+        if (!l2pad)
                 return;
 
         memmove(skb->data + l2pad, skb->data, header_length);
@@ -345,7 +337,9 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
          * Header and alignment information.
          */
         txdesc->header_length = ieee80211_get_hdrlen_from_skb(entry->skb);
-        txdesc->l2pad = ALIGN_SIZE(entry->skb, txdesc->header_length);
+        if (test_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags) &&
+            (entry->skb->len > txdesc->header_length))
+                txdesc->l2pad = L2PAD_SIZE(txdesc->header_length);
 
         /*
          * Check whether this frame is to be acked.
@@ -386,10 +380,13 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
 
         /*
          * Beacons and probe responses require the tsf timestamp
-         * to be inserted into the frame.
+         * to be inserted into the frame, except for a frame that has been injected
+         * through a monitor interface. This latter is needed for testing a
+         * monitor interface.
          */
-        if (ieee80211_is_beacon(hdr->frame_control) ||
-            ieee80211_is_probe_resp(hdr->frame_control))
+        if ((ieee80211_is_beacon(hdr->frame_control) ||
+            ieee80211_is_probe_resp(hdr->frame_control)) &&
+            (!(tx_info->flags & IEEE80211_TX_CTL_INJECTED)))
                 __set_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags);
 
         /*
@@ -453,7 +450,8 @@ static void rt2x00queue_write_tx_descriptor(struct queue_entry *entry,
                 rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, queue->qid);
 }
 
-int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb)
+int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
+                               bool local)
 {
         struct ieee80211_tx_info *tx_info;
         struct queue_entry *entry = rt2x00queue_get_entry(queue, Q_INDEX);
@@ -494,10 +492,13 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb)
         skbdesc->tx_rate_idx = rate_idx;
         skbdesc->tx_rate_flags = rate_flags;
 
+        if (local)
+                skbdesc->flags |= SKBDESC_NOT_MAC80211;
+
         /*
          * When hardware encryption is supported, and this frame
          * is to be encrypted, we should strip the IV/EIV data from
-         * the frame so we can provide it to the driver seperately.
+         * the frame so we can provide it to the driver separately.
          */
         if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc.flags) &&
             !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags)) {
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index a5591fb2b191..c1e482bb37b3 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -92,14 +92,14 @@ enum data_queue_qid {
  * @SKBDESC_DMA_MAPPED_TX: &skb_dma field has been mapped for TX
  * @SKBDESC_IV_STRIPPED: Frame contained a IV/EIV provided by
  *      mac80211 but was stripped for processing by the driver.
- * @SKBDESC_L2_PADDED: Payload has been padded for 4-byte alignment,
- *      the padded bytes are located between header and payload.
+ * @SKBDESC_NOT_MAC80211: Frame didn't originate from mac80211,
+ *      don't try to pass it back.
  */
 enum skb_frame_desc_flags {
         SKBDESC_DMA_MAPPED_RX = 1 << 0,
         SKBDESC_DMA_MAPPED_TX = 1 << 1,
         SKBDESC_IV_STRIPPED = 1 << 2,
-        SKBDESC_L2_PADDED = 1 << 3
+        SKBDESC_NOT_MAC80211 = 1 << 3,
 };
 
 /**
diff --git a/drivers/net/wireless/rt2x00/rt2x00reg.h b/drivers/net/wireless/rt2x00/rt2x00reg.h
index 983e52e127a7..603bfc0adaa3 100644
--- a/drivers/net/wireless/rt2x00/rt2x00reg.h
+++ b/drivers/net/wireless/rt2x00/rt2x00reg.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
diff --git a/drivers/net/wireless/rt2x00/rt2x00soc.c b/drivers/net/wireless/rt2x00/rt2x00soc.c
new file mode 100644
index 000000000000..fc98063de71d
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00soc.c
@@ -0,0 +1,160 @@
+/*
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2004 - 2009 Felix Fietkau <nbd@openwrt.org>
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00soc
+        Abstract: rt2x00 generic soc device routines.
+ */
+
+#include <linux/bug.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+
+#include "rt2x00.h"
+#include "rt2x00soc.h"
+
+static void rt2x00soc_free_reg(struct rt2x00_dev *rt2x00dev)
+{
+        kfree(rt2x00dev->rf);
+        rt2x00dev->rf = NULL;
+
+        kfree(rt2x00dev->eeprom);
+        rt2x00dev->eeprom = NULL;
+}
+
+static int rt2x00soc_alloc_reg(struct rt2x00_dev *rt2x00dev)
+{
+        struct platform_device *pdev = to_platform_device(rt2x00dev->dev);
+        struct resource *res;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -ENODEV;
+
+        rt2x00dev->csr.base = (void __iomem *)KSEG1ADDR(res->start);
+        if (!rt2x00dev->csr.base)
+                goto exit;
+
+        rt2x00dev->eeprom = kzalloc(rt2x00dev->ops->eeprom_size, GFP_KERNEL);
+        if (!rt2x00dev->eeprom)
+                goto exit;
+
+        rt2x00dev->rf = kzalloc(rt2x00dev->ops->rf_size, GFP_KERNEL);
+        if (!rt2x00dev->rf)
+                goto exit;
+
+        return 0;
+
+exit:
+        ERROR_PROBE("Failed to allocate registers.\n");
+        rt2x00soc_free_reg(rt2x00dev);
+
+        return -ENOMEM;
+}
+
+int rt2x00soc_probe(struct platform_device *pdev, const struct rt2x00_ops *ops)
+{
+        struct ieee80211_hw *hw;
+        struct rt2x00_dev *rt2x00dev;
+        int retval;
+
+        hw = ieee80211_alloc_hw(sizeof(struct rt2x00_dev), ops->hw);
+        if (!hw) {
+                ERROR_PROBE("Failed to allocate hardware.\n");
+                return -ENOMEM;
+        }
+
+        platform_set_drvdata(pdev, hw);
+
+        rt2x00dev = hw->priv;
+        rt2x00dev->dev = &pdev->dev;
+        rt2x00dev->ops = ops;
+        rt2x00dev->hw = hw;
+        rt2x00dev->irq = platform_get_irq(pdev, 0);
+        rt2x00dev->name = pdev->dev.driver->name;
+
+        rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_SOC);
+
+        retval = rt2x00soc_alloc_reg(rt2x00dev);
+        if (retval)
+                goto exit_free_device;
+
+        retval = rt2x00lib_probe_dev(rt2x00dev);
+        if (retval)
+                goto exit_free_reg;
+
+        return 0;
+
+exit_free_reg:
+        rt2x00soc_free_reg(rt2x00dev);
+
+exit_free_device:
+        ieee80211_free_hw(hw);
+
+        return retval;
+}
+EXPORT_SYMBOL_GPL(rt2x00soc_probe);
+
+int rt2x00soc_remove(struct platform_device *pdev)
+{
+        struct ieee80211_hw *hw = platform_get_drvdata(pdev);
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+
+        /*
+         * Free all allocated data.
+         */
+        rt2x00lib_remove_dev(rt2x00dev);
+        rt2x00soc_free_reg(rt2x00dev);
+        ieee80211_free_hw(hw);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2x00soc_remove);
+
+#ifdef CONFIG_PM
+int rt2x00soc_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        struct ieee80211_hw *hw = platform_get_drvdata(pdev);
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+
+        return rt2x00lib_suspend(rt2x00dev, state);
+}
+EXPORT_SYMBOL_GPL(rt2x00soc_suspend);
+
+int rt2x00soc_resume(struct platform_device *pdev)
+{
+        struct ieee80211_hw *hw = platform_get_drvdata(pdev);
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+
+        return rt2x00lib_resume(rt2x00dev);
+}
+EXPORT_SYMBOL_GPL(rt2x00soc_resume);
+#endif /* CONFIG_PM */
+
+/*
+ * rt2x00soc module information.
+ */
+MODULE_AUTHOR(DRV_PROJECT);
+MODULE_VERSION(DRV_VERSION);
+MODULE_DESCRIPTION("rt2x00 soc library");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/rt2x00/rt2x00soc.h b/drivers/net/wireless/rt2x00/rt2x00soc.h
new file mode 100644
index 000000000000..474cbfc1efc7
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00soc.h
@@ -0,0 +1,42 @@
+/*
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00soc
+        Abstract: Data structures for the rt2x00soc module.
+ */
+
+#ifndef RT2X00SOC_H
+#define RT2X00SOC_H
+
+/*
+ * SoC driver handlers.
+ */
+int rt2x00soc_probe(struct platform_device *pdev, const struct rt2x00_ops *ops);
+int rt2x00soc_remove(struct platform_device *pdev);
+#ifdef CONFIG_PM
+int rt2x00soc_suspend(struct platform_device *pdev, pm_message_t state);
+int rt2x00soc_resume(struct platform_device *pdev);
+#else
+#define rt2x00soc_suspend       NULL
+#define rt2x00soc_resume        NULL
+#endif /* CONFIG_PM */
+
+#endif /* RT2X00SOC_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index f02b48a90593..f9a7f8b17411 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -25,6 +25,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 #include <linux/bug.h>
 
@@ -160,7 +161,7 @@ EXPORT_SYMBOL_GPL(rt2x00usb_vendor_request_large_buff);
 
 int rt2x00usb_regbusy_read(struct rt2x00_dev *rt2x00dev,
                            const unsigned int offset,
-                           struct rt2x00_field32 field,
+                           const struct rt2x00_field32 field,
                            u32 *reg)
 {
         unsigned int i;
@@ -653,6 +654,8 @@ int rt2x00usb_probe(struct usb_interface *usb_intf,
         rt2x00dev->ops = ops;
         rt2x00dev->hw = hw;
 
+        rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_USB);
+
         retval = rt2x00usb_alloc_reg(rt2x00dev);
         if (retval)
                 goto exit_free_device;
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index bd2d59c85f1b..3da6841b5d42 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -26,6 +26,8 @@
 #ifndef RT2X00USB_H
 #define RT2X00USB_H
 
+#include <linux/usb.h>
+
 #define to_usb_device_intf(d) \
 ({ \
         struct usb_interface *intf = to_usb_interface(d); \
@@ -39,17 +41,11 @@
 #define USB_DEVICE_DATA(__ops)  .driver_info = (kernel_ulong_t)(__ops)
 
 /*
- * Register defines.
- * Some registers require multiple attempts before success,
- * in those cases REGISTER_BUSY_COUNT attempts should be
- * taken with a REGISTER_BUSY_DELAY interval.
  * For USB vendor requests we need to pass a timeout
  * time in ms, for this we use the REGISTER_TIMEOUT,
  * however when loading firmware a higher value is
  * required. In that case we use the REGISTER_TIMEOUT_FIRMWARE.
  */
-#define REGISTER_BUSY_COUNT             5
-#define REGISTER_BUSY_DELAY             100
 #define REGISTER_TIMEOUT                500
 #define REGISTER_TIMEOUT_FIRMWARE       1000
 
@@ -232,7 +228,7 @@ static inline int rt2x00usb_eeprom_read(struct rt2x00_dev *rt2x00dev,
 }
 
 /**
- * rt2x00usb_regbusy_read - Read 32bit register word
+ * rt2x00usb_register_read - Read 32bit register word
  * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
  * @offset: Register offset
  * @value: Pointer to where register contents should be stored
@@ -340,12 +336,13 @@ static inline void rt2x00usb_register_write_lock(struct rt2x00_dev *rt2x00dev,
  * through rt2x00usb_vendor_request_buff().
  */
 static inline void rt2x00usb_register_multiwrite(struct rt2x00_dev *rt2x00dev,
-                                               const unsigned int offset,
-                                               void *value, const u32 length)
+                                                 const unsigned int offset,
+                                                 const void *value,
+                                                 const u32 length)
 {
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
                                       USB_VENDOR_REQUEST_OUT, offset,
-                                      value, length,
+                                      (void *)value, length,
                                       REGISTER_TIMEOUT32(length));
 }
 
@@ -364,7 +361,7 @@ static inline void rt2x00usb_register_multiwrite(struct rt2x00_dev *rt2x00dev,
  */
 int rt2x00usb_regbusy_read(struct rt2x00_dev *rt2x00dev,
                            const unsigned int offset,
-                           struct rt2x00_field32 field,
+                           const struct rt2x00_field32 field,
                            u32 *reg);
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index b20e3eac9d67..432e75f960b7 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -30,6 +30,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/eeprom_93cx6.h>
 
@@ -51,7 +52,7 @@ MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  * These indirect registers work with busy bits,
  * and we will try maximal REGISTER_BUSY_COUNT times to access
  * the register while taking a REGISTER_BUSY_DELAY us delay
- * between each attampt. When the busy bit is still set at that time,
+ * between each attempt. When the busy bit is still set at that time,
  * the access attempt is considered to have failed,
  * and we will print an error.
  */
@@ -386,7 +387,7 @@ static int rt61pci_config_shared_key(struct rt2x00_dev *rt2x00dev,
                  * The driver does not support the IV/EIV generation
                  * in hardware. However it doesn't support the IV/EIV
                  * inside the ieee80211 frame either, but requires it
-                 * to be provided seperately for the descriptor.
+                 * to be provided separately for the descriptor.
                  * rt2x00lib will cut the IV/EIV data out of all frames
                  * given to us by mac80211, but we must tell mac80211
                  * to generate the IV/EIV data.
@@ -397,7 +398,7 @@ static int rt61pci_config_shared_key(struct rt2x00_dev *rt2x00dev,
         /*
          * SEC_CSR0 contains only single-bit fields to indicate
          * a particular key is valid. Because using the FIELD32()
-         * defines directly will cause a lot of overhead we use
+         * defines directly will cause a lot of overhead, we use
          * a calculation to determine the correct bit directly.
          */
         mask = 1 << key->hw_key_idx;
@@ -425,11 +426,11 @@ static int rt61pci_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
                 /*
                  * rt2x00lib can't determine the correct free
                  * key_idx for pairwise keys. We have 2 registers
-                 * with key valid bits. The goal is simple, read
-                 * the first register, if that is full move to
+                 * with key valid bits. The goal is simple: read
+                 * the first register. If that is full, move to
                  * the next register.
-                 * When both registers are full, we drop the key,
-                 * otherwise we use the first invalid entry.
+                 * When both registers are full, we drop the key.
+                 * Otherwise, we use the first invalid entry.
                  */
                 rt2x00pci_register_read(rt2x00dev, SEC_CSR2, &reg);
                 if (reg && reg == ~0) {
@@ -464,8 +465,8 @@ static int rt61pci_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
                                               &addr_entry, sizeof(addr_entry));
 
                 /*
-                 * Enable pairwise lookup table for given BSS idx,
-                 * without this received frames will not be decrypted
+                 * Enable pairwise lookup table for given BSS idx.
+                 * Without this, received frames will not be decrypted
                  * by the hardware.
                  */
                 rt2x00pci_register_read(rt2x00dev, SEC_CSR4, &reg);
@@ -476,7 +477,7 @@ static int rt61pci_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
                  * The driver does not support the IV/EIV generation
                  * in hardware. However it doesn't support the IV/EIV
                  * inside the ieee80211 frame either, but requires it
-                 * to be provided seperately for the descriptor.
+                 * to be provided separately for the descriptor.
                  * rt2x00lib will cut the IV/EIV data out of all frames
                  * given to us by mac80211, but we must tell mac80211
                  * to generate the IV/EIV data.
@@ -487,7 +488,7 @@ static int rt61pci_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
         /*
          * SEC_CSR2 and SEC_CSR3 contain only single-bit fields to indicate
          * a particular key is valid. Because using the FIELD32()
-         * defines directly will cause a lot of overhead we use
+         * defines directly will cause a lot of overhead, we use
          * a calculation to determine the correct bit directly.
          */
         if (key->hw_key_idx < 32) {
@@ -556,7 +557,7 @@ static void rt61pci_config_intf(struct rt2x00_dev *rt2x00dev,
         if (flags & CONFIG_UPDATE_TYPE) {
                 /*
                  * Clear current synchronisation setup.
-                 * For the Beacon base registers we only need to clear
+                 * For the Beacon base registers, we only need to clear
                  * the first byte since that byte contains the VALID and OWNER
                  * bits which (when set to 0) will invalidate the entire beacon.
                  */
@@ -637,8 +638,7 @@ static void rt61pci_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
         rt61pci_bbp_read(rt2x00dev, 4, &r4);
         rt61pci_bbp_read(rt2x00dev, 77, &r77);
 
-        rt2x00_set_field8(&r3, BBP_R3_SMART_MODE,
-                          rt2x00_rf(&rt2x00dev->chip, RF5325));
+        rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, rt2x00_rf(rt2x00dev, RF5325));
 
         /*
          * Configure the RX antenna.
@@ -684,8 +684,7 @@ static void rt61pci_config_antenna_2x(struct rt2x00_dev *rt2x00dev,
         rt61pci_bbp_read(rt2x00dev, 4, &r4);
         rt61pci_bbp_read(rt2x00dev, 77, &r77);
 
-        rt2x00_set_field8(&r3, BBP_R3_SMART_MODE,
-                          rt2x00_rf(&rt2x00dev->chip, RF2529));
+        rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, rt2x00_rf(rt2x00dev, RF2529));
         rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END,
                           !test_bit(CONFIG_FRAME_TYPE, &rt2x00dev->flags));
 
@@ -833,12 +832,11 @@ static void rt61pci_config_ant(struct rt2x00_dev *rt2x00dev,
 
         rt2x00pci_register_write(rt2x00dev, PHY_CSR0, reg);
 
-        if (rt2x00_rf(&rt2x00dev->chip, RF5225) ||
-            rt2x00_rf(&rt2x00dev->chip, RF5325))
+        if (rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF5325))
                 rt61pci_config_antenna_5x(rt2x00dev, ant);
-        else if (rt2x00_rf(&rt2x00dev->chip, RF2527))
+        else if (rt2x00_rf(rt2x00dev, RF2527))
                 rt61pci_config_antenna_2x(rt2x00dev, ant);
-        else if (rt2x00_rf(&rt2x00dev->chip, RF2529)) {
+        else if (rt2x00_rf(rt2x00dev, RF2529)) {
                 if (test_bit(CONFIG_DOUBLE_ANTENNA, &rt2x00dev->flags))
                         rt61pci_config_antenna_2x(rt2x00dev, ant);
                 else
@@ -879,8 +877,7 @@ static void rt61pci_config_channel(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&rf->rf3, RF3_TXPOWER, TXPOWER_TO_DEV(txpower));
         rt2x00_set_field32(&rf->rf4, RF4_FREQ_OFFSET, rt2x00dev->freq_offset);
 
-        smart = !(rt2x00_rf(&rt2x00dev->chip, RF5225) ||
-                  rt2x00_rf(&rt2x00dev->chip, RF2527));
+        smart = !(rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF2527));
 
         rt61pci_bbp_read(rt2x00dev, 3, &r3);
         rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, smart);
@@ -1135,16 +1132,18 @@ dynamic_cca_tune:
  */
 static char *rt61pci_get_firmware_name(struct rt2x00_dev *rt2x00dev)
 {
+        u16 chip;
         char *fw_name;
 
-        switch (rt2x00dev->chip.rt) {
-        case RT2561:
+        pci_read_config_word(to_pci_dev(rt2x00dev->dev), PCI_DEVICE_ID, &chip);
+        switch (chip) {
+        case RT2561_PCI_ID:
                 fw_name = FIRMWARE_RT2561;
                 break;
-        case RT2561s:
+        case RT2561s_PCI_ID:
                 fw_name = FIRMWARE_RT2561s;
                 break;
-        case RT2661:
+        case RT2661_PCI_ID:
                 fw_name = FIRMWARE_RT2661;
                 break;
         default:
@@ -1168,8 +1167,8 @@ static int rt61pci_check_firmware(struct rt2x00_dev *rt2x00dev,
                 return FW_BAD_LENGTH;
 
         /*
-         * The last 2 bytes in the firmware array are the crc checksum itself,
-         * this means that we should never pass those 2 bytes to the crc
+         * The last 2 bytes in the firmware array are the crc checksum itself.
+         * This means that we should never pass those 2 bytes to the crc
          * algorithm.
          */
         fw_crc = (data[len - 2] << 8 | data[len - 1]);
@@ -1986,7 +1985,7 @@ static void rt61pci_fill_rxdone(struct queue_entry *entry,
 
                 /*
                  * Hardware has stripped IV/EIV data from 802.11 frame during
-                 * decryption. It has provided the data seperately but rt2x00lib
+                 * decryption. It has provided the data separately but rt2x00lib
                  * should decide if it should be reinserted.
                  */
                 rxdesc->flags |= RX_FLAG_IV_STRIPPED;
@@ -2042,7 +2041,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
          * During each loop we will compare the freshly read
          * STA_CSR4 register value with the value read from
          * the previous loop. If the 2 values are equal then
-         * we should stop processing because the chance it
+         * we should stop processing because the chance is
          * quite big that the device has been unplugged and
          * we risk going into an endless loop.
          */
@@ -2299,12 +2298,13 @@ static int rt61pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
          */
         value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
         rt2x00pci_register_read(rt2x00dev, MAC_CSR0, &reg);
-        rt2x00_set_chip_rf(rt2x00dev, value, reg);
+        rt2x00_set_chip(rt2x00dev, rt2x00_get_field32(reg, MAC_CSR0_CHIPSET),
+                        value, rt2x00_get_field32(reg, MAC_CSR0_REVISION));
 
-        if (!rt2x00_rf(&rt2x00dev->chip, RF5225) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF5325) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2527) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2529)) {
+        if (!rt2x00_rf(rt2x00dev, RF5225) &&
+            !rt2x00_rf(rt2x00dev, RF5325) &&
+            !rt2x00_rf(rt2x00dev, RF2527) &&
+            !rt2x00_rf(rt2x00dev, RF2529)) {
                 ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
                 return -ENODEV;
         }
@@ -2330,7 +2330,7 @@ static int rt61pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
                 __set_bit(CONFIG_FRAME_TYPE, &rt2x00dev->flags);
 
         /*
-         * Detect if this device has an hardware controlled radio.
+         * Detect if this device has a hardware controlled radio.
          */
         if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
                 __set_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags);
@@ -2355,11 +2355,11 @@ static int rt61pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
                 __set_bit(CONFIG_EXTERNAL_LNA_BG, &rt2x00dev->flags);
 
         /*
-         * When working with a RF2529 chip without double antenna
+         * When working with a RF2529 chip without double antenna,
          * the antenna settings should be gathered from the NIC
          * eeprom word.
          */
-        if (rt2x00_rf(&rt2x00dev->chip, RF2529) &&
+        if (rt2x00_rf(rt2x00dev, RF2529) &&
             !test_bit(CONFIG_DOUBLE_ANTENNA, &rt2x00dev->flags)) {
                 rt2x00dev->default_ant.rx =
                     ANTENNA_A + rt2x00_get_field16(eeprom, EEPROM_NIC_RX_FIXED);
@@ -2538,6 +2538,11 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         unsigned int i;
 
         /*
+         * Disable powersaving as default.
+         */
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+        /*
          * Initialize all hw fields.
          */
         rt2x00dev->hw->flags =
@@ -2545,7 +2550,6 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
             IEEE80211_HW_SIGNAL_DBM |
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK;
-        rt2x00dev->hw->extra_tx_headroom = 0;
 
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
@@ -2566,8 +2570,7 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                 spec->channels = rf_vals_seq;
         }
 
-        if (rt2x00_rf(&rt2x00dev->chip, RF5225) ||
-            rt2x00_rf(&rt2x00dev->chip, RF5325)) {
+        if (rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF5325)) {
                 spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_seq);
         }
@@ -2668,7 +2671,7 @@ static int rt61pci_conf_tx(struct ieee80211_hw *hw, u16 queue_idx,
 
         /*
          * We only need to perform additional register initialization
-         * for WMM queues/
+         * for WMM queues.
          */
         if (queue_idx >= 4)
                 return 0;
@@ -2730,7 +2733,6 @@ static const struct ieee80211_ops rt61pci_mac80211_ops = {
         .get_stats              = rt2x00mac_get_stats,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
         .conf_tx                = rt61pci_conf_tx,
-        .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt61pci_get_tsf,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
 };
@@ -2787,26 +2789,27 @@ static const struct data_queue_desc rt61pci_queue_bcn = {
 };
 
 static const struct rt2x00_ops rt61pci_ops = {
-        .name           = KBUILD_MODNAME,
-        .max_sta_intf   = 1,
-        .max_ap_intf    = 4,
-        .eeprom_size    = EEPROM_SIZE,
-        .rf_size        = RF_SIZE,
-        .tx_queues      = NUM_TX_QUEUES,
-        .rx             = &rt61pci_queue_rx,
-        .tx             = &rt61pci_queue_tx,
-        .bcn            = &rt61pci_queue_bcn,
-        .lib            = &rt61pci_rt2x00_ops,
-        .hw             = &rt61pci_mac80211_ops,
+        .name                   = KBUILD_MODNAME,
+        .max_sta_intf           = 1,
+        .max_ap_intf            = 4,
+        .eeprom_size            = EEPROM_SIZE,
+        .rf_size                = RF_SIZE,
+        .tx_queues              = NUM_TX_QUEUES,
+        .extra_tx_headroom      = 0,
+        .rx                     = &rt61pci_queue_rx,
+        .tx                     = &rt61pci_queue_tx,
+        .bcn                    = &rt61pci_queue_bcn,
+        .lib                    = &rt61pci_rt2x00_ops,
+        .hw                     = &rt61pci_mac80211_ops,
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
-        .debugfs        = &rt61pci_rt2x00debug,
+        .debugfs                = &rt61pci_rt2x00debug,
 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
 };
 
 /*
  * RT61pci module information.
  */
-static struct pci_device_id rt61pci_device_table[] = {
+static DEFINE_PCI_DEVICE_TABLE(rt61pci_device_table) = {
         /* RT2561s */
         { PCI_DEVICE(0x1814, 0x0301), PCI_DEVICE_DATA(&rt61pci_ops) },
         /* RT2561 v2 */
diff --git a/drivers/net/wireless/rt2x00/rt61pci.h b/drivers/net/wireless/rt2x00/rt61pci.h
index 93eb699165cc..df80f1af22a4 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.h
+++ b/drivers/net/wireless/rt2x00/rt61pci.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -28,6 +28,13 @@
 #define RT61PCI_H
 
 /*
+ * RT chip PCI IDs.
+ */
+#define RT2561s_PCI_ID                  0x0301
+#define RT2561_PCI_ID                   0x0302
+#define RT2661_PCI_ID                   0x0401
+
+/*
  * RF chip defines.
  */
 #define RF5225                          0x0001
@@ -37,7 +44,7 @@
 
 /*
  * Signal information.
- * Defaul offset is required for RSSI <-> dBm conversion.
+ * Default offset is required for RSSI <-> dBm conversion.
  */
 #define DEFAULT_RSSI_OFFSET             120
 
@@ -225,6 +232,8 @@ struct hw_pairwise_ta_entry {
  * MAC_CSR0: ASIC revision number.
  */
 #define MAC_CSR0                        0x3000
+#define MAC_CSR0_REVISION               FIELD32(0x0000000f)
+#define MAC_CSR0_CHIPSET                FIELD32(0x000ffff0)
 
 /*
  * MAC_CSR1: System control register.
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 14e7bb210075..bb58d797fb72 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -30,6 +30,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 
 #include "rt2x00.h"
@@ -136,8 +137,8 @@ static void rt73usb_rf_write(struct rt2x00_dev *rt2x00dev,
                  * all others contain 20 bits.
                  */
                 rt2x00_set_field32(&reg, PHY_CSR4_NUMBER_OF_BITS,
-                                   20 + (rt2x00_rf(&rt2x00dev->chip, RF5225) ||
-                                         rt2x00_rf(&rt2x00dev->chip, RF2527)));
+                                   20 + (rt2x00_rf(rt2x00dev, RF5225) ||
+                                         rt2x00_rf(rt2x00dev, RF2527)));
                 rt2x00_set_field32(&reg, PHY_CSR4_IF_SELECT, 0);
                 rt2x00_set_field32(&reg, PHY_CSR4_BUSY, 1);
 
@@ -339,7 +340,7 @@ static int rt73usb_config_shared_key(struct rt2x00_dev *rt2x00dev,
                  * The driver does not support the IV/EIV generation
                  * in hardware. However it doesn't support the IV/EIV
                  * inside the ieee80211 frame either, but requires it
-                 * to be provided seperately for the descriptor.
+                 * to be provided separately for the descriptor.
                  * rt2x00lib will cut the IV/EIV data out of all frames
                  * given to us by mac80211, but we must tell mac80211
                  * to generate the IV/EIV data.
@@ -439,7 +440,7 @@ static int rt73usb_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
                  * The driver does not support the IV/EIV generation
                  * in hardware. However it doesn't support the IV/EIV
                  * inside the ieee80211 frame either, but requires it
-                 * to be provided seperately for the descriptor.
+                 * to be provided separately for the descriptor.
                  * rt2x00lib will cut the IV/EIV data out of all frames
                  * given to us by mac80211, but we must tell mac80211
                  * to generate the IV/EIV data.
@@ -741,11 +742,9 @@ static void rt73usb_config_ant(struct rt2x00_dev *rt2x00dev,
 
         rt2x00usb_register_write(rt2x00dev, PHY_CSR0, reg);
 
-        if (rt2x00_rf(&rt2x00dev->chip, RF5226) ||
-            rt2x00_rf(&rt2x00dev->chip, RF5225))
+        if (rt2x00_rf(rt2x00dev, RF5226) || rt2x00_rf(rt2x00dev, RF5225))
                 rt73usb_config_antenna_5x(rt2x00dev, ant);
-        else if (rt2x00_rf(&rt2x00dev->chip, RF2528) ||
-                 rt2x00_rf(&rt2x00dev->chip, RF2527))
+        else if (rt2x00_rf(rt2x00dev, RF2528) || rt2x00_rf(rt2x00dev, RF2527))
                 rt73usb_config_antenna_2x(rt2x00dev, ant);
 }
 
@@ -779,8 +778,7 @@ static void rt73usb_config_channel(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&rf->rf3, RF3_TXPOWER, TXPOWER_TO_DEV(txpower));
         rt2x00_set_field32(&rf->rf4, RF4_FREQ_OFFSET, rt2x00dev->freq_offset);
 
-        smart = !(rt2x00_rf(&rt2x00dev->chip, RF5225) ||
-                  rt2x00_rf(&rt2x00dev->chip, RF2527));
+        smart = !(rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF2527));
 
         rt73usb_bbp_read(rt2x00dev, 3, &r3);
         rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, smart);
@@ -1210,8 +1208,7 @@ static int rt73usb_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00usb_register_write(rt2x00dev, SEC_CSR5, 0x00000000);
 
         reg = 0x000023b0;
-        if (rt2x00_rf(&rt2x00dev->chip, RF5225) ||
-            rt2x00_rf(&rt2x00dev->chip, RF2527))
+        if (rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF2527))
                 rt2x00_set_field32(&reg, PHY_CSR1_RF_RPI, 1);
         rt2x00usb_register_write(rt2x00dev, PHY_CSR1, reg);
 
@@ -1665,7 +1662,7 @@ static void rt73usb_fill_rxdone(struct queue_entry *entry,
 
                 /*
                  * Hardware has stripped IV/EIV data from 802.11 frame during
-                 * decryption. It has provided the data seperately but rt2x00lib
+                 * decryption. It has provided the data separately but rt2x00lib
                  * should decide if it should be reinserted.
                  */
                 rxdesc->flags |= RX_FLAG_IV_STRIPPED;
@@ -1824,18 +1821,18 @@ static int rt73usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
          */
         value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
         rt2x00usb_register_read(rt2x00dev, MAC_CSR0, &reg);
-        rt2x00_set_chip(rt2x00dev, RT2571, value, reg);
+        rt2x00_set_chip(rt2x00dev, rt2x00_get_field32(reg, MAC_CSR0_CHIPSET),
+                        value, rt2x00_get_field32(reg, MAC_CSR0_REVISION));
 
-        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0x25730) ||
-            rt2x00_check_rev(&rt2x00dev->chip, 0x0000000f, 0)) {
+        if (!rt2x00_rt(rt2x00dev, RT2573) || (rt2x00_rev(rt2x00dev) == 0)) {
                 ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
                 return -ENODEV;
         }
 
-        if (!rt2x00_rf(&rt2x00dev->chip, RF5226) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2528) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF5225) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2527)) {
+        if (!rt2x00_rf(rt2x00dev, RF5226) &&
+            !rt2x00_rf(rt2x00dev, RF2528) &&
+            !rt2x00_rf(rt2x00dev, RF5225) &&
+            !rt2x00_rf(rt2x00dev, RF2527)) {
                 ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
                 return -ENODEV;
         }
@@ -2068,7 +2065,6 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
             IEEE80211_HW_SIGNAL_DBM |
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK;
-        rt2x00dev->hw->extra_tx_headroom = TXD_DESC_SIZE;
 
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
@@ -2081,17 +2077,17 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->supported_bands = SUPPORT_BAND_2GHZ;
         spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
 
-        if (rt2x00_rf(&rt2x00dev->chip, RF2528)) {
+        if (rt2x00_rf(rt2x00dev, RF2528)) {
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2528);
                 spec->channels = rf_vals_bg_2528;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF5226)) {
+        } else if (rt2x00_rf(rt2x00dev, RF5226)) {
                 spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_5226);
                 spec->channels = rf_vals_5226;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2527)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2527)) {
                 spec->num_channels = 14;
                 spec->channels = rf_vals_5225_2527;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF5225)) {
+        } else if (rt2x00_rf(rt2x00dev, RF5225)) {
                 spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_5225_2527);
                 spec->channels = rf_vals_5225_2527;
@@ -2249,7 +2245,6 @@ static const struct ieee80211_ops rt73usb_mac80211_ops = {
         .get_stats              = rt2x00mac_get_stats,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
         .conf_tx                = rt73usb_conf_tx,
-        .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt73usb_get_tsf,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
 };
@@ -2305,19 +2300,20 @@ static const struct data_queue_desc rt73usb_queue_bcn = {
 };
 
 static const struct rt2x00_ops rt73usb_ops = {
-        .name           = KBUILD_MODNAME,
-        .max_sta_intf   = 1,
-        .max_ap_intf    = 4,
-        .eeprom_size    = EEPROM_SIZE,
-        .rf_size        = RF_SIZE,
-        .tx_queues      = NUM_TX_QUEUES,
-        .rx             = &rt73usb_queue_rx,
-        .tx             = &rt73usb_queue_tx,
-        .bcn            = &rt73usb_queue_bcn,
-        .lib            = &rt73usb_rt2x00_ops,
-        .hw             = &rt73usb_mac80211_ops,
+        .name                   = KBUILD_MODNAME,
+        .max_sta_intf           = 1,
+        .max_ap_intf            = 4,
+        .eeprom_size            = EEPROM_SIZE,
+        .rf_size                = RF_SIZE,
+        .tx_queues              = NUM_TX_QUEUES,
+        .extra_tx_headroom      = TXD_DESC_SIZE,
+        .rx                     = &rt73usb_queue_rx,
+        .tx                     = &rt73usb_queue_tx,
+        .bcn                    = &rt73usb_queue_bcn,
+        .lib                    = &rt73usb_rt2x00_ops,
+        .hw                     = &rt73usb_mac80211_ops,
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
-        .debugfs        = &rt73usb_rt2x00debug,
+        .debugfs                = &rt73usb_rt2x00debug,
 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
 };
 
@@ -2353,9 +2349,12 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x08dd, 0x0120), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Buffalo */
         { USB_DEVICE(0x0411, 0x00d8), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0411, 0x00d9), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0411, 0x00f4), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0411, 0x0116), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0411, 0x0119), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* CEIVA */
+        { USB_DEVICE(0x178d, 0x02be), USB_DEVICE_DATA(&rt73usb_ops) },
         /* CNet */
         { USB_DEVICE(0x1371, 0x9022), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x1371, 0x9032), USB_DEVICE_DATA(&rt73usb_ops) },
diff --git a/drivers/net/wireless/rt2x00/rt73usb.h b/drivers/net/wireless/rt2x00/rt73usb.h
index 81fe0be51c42..7abe7eb14555 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.h
+++ b/drivers/net/wireless/rt2x00/rt73usb.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -37,7 +37,7 @@
 
 /*
  * Signal information.
- * Defaul offset is required for RSSI <-> dBm conversion.
+ * Default offset is required for RSSI <-> dBm conversion.
  */
 #define DEFAULT_RSSI_OFFSET             120
 
@@ -142,6 +142,8 @@ struct hw_pairwise_ta_entry {
  * MAC_CSR0: ASIC revision number.
  */
 #define MAC_CSR0                        0x3000
+#define MAC_CSR0_REVISION               FIELD32(0x0000000f)
+#define MAC_CSR0_CHIPSET                FIELD32(0x000ffff0)
 
 /*
  * MAC_CSR1: System control register.
diff --git a/drivers/net/wireless/rtl818x/rtl8180.h b/drivers/net/wireless/rtl818x/rtl8180.h
index 8721282a8185..de3844fe06d8 100644
--- a/drivers/net/wireless/rtl818x/rtl8180.h
+++ b/drivers/net/wireless/rtl818x/rtl8180.h
@@ -60,7 +60,6 @@ struct rtl8180_priv {
         struct rtl818x_csr __iomem *map;
         const struct rtl818x_rf_ops *rf;
         struct ieee80211_vif *vif;
-        int mode;
 
         /* rtl8180 driver specific */
         spinlock_t lock;
diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
index 16429c49139c..2131a442831a 100644
--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
@@ -17,6 +17,7 @@
 
 #include <linux/init.h>
 #include <linux/pci.h>
+#include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
 #include <linux/eeprom_93cx6.h>
@@ -33,7 +34,7 @@ MODULE_AUTHOR("Andrea Merello <andreamrl@tiscali.it>");
 MODULE_DESCRIPTION("RTL8180 / RTL8185 PCI wireless driver");
 MODULE_LICENSE("GPL");
 
-static struct pci_device_id rtl8180_table[] __devinitdata = {
+static DEFINE_PCI_DEVICE_TABLE(rtl8180_table) = {
         /* rtl8185 */
         { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8185) },
         { PCI_DEVICE(PCI_VENDOR_ID_BELKIN, 0x700f) },
@@ -82,8 +83,6 @@ static const struct ieee80211_channel rtl818x_channels[] = {
 };
 
 
-
-
 void rtl8180_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data)
 {
         struct rtl8180_priv *priv = dev->priv;
@@ -132,7 +131,6 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
 
                         rx_status.antenna = (flags2 >> 15) & 1;
                         /* TODO: improve signal/rssi reporting */
-                        rx_status.qual = flags2 & 0xFF;
                         rx_status.signal = (flags2 >> 8) & 0x7F;
                         /* XXX: is this correct? */
                         rx_status.rate_idx = (flags >> 20) & 0xF;
@@ -548,7 +546,7 @@ static int rtl8180_start(struct ieee80211_hw *dev)
         rtl818x_iowrite32(priv, &priv->map->TNPDA, priv->tx_ring[1].dma);
         rtl818x_iowrite32(priv, &priv->map->TLPDA, priv->tx_ring[0].dma);
 
-        ret = request_irq(priv->pdev->irq, &rtl8180_interrupt,
+        ret = request_irq(priv->pdev->irq, rtl8180_interrupt,
                           IRQF_SHARED, KBUILD_MODNAME, dev);
         if (ret) {
                 printk(KERN_ERR "%s: failed to register IRQ handler\n",
@@ -616,7 +614,6 @@ static int rtl8180_start(struct ieee80211_hw *dev)
         reg |= RTL818X_CMD_TX_ENABLE;
         rtl818x_iowrite8(priv, &priv->map->CMD, reg);
 
-        priv->mode = NL80211_IFTYPE_MONITOR;
         return 0;
 
  err_free_rings:
@@ -634,8 +631,6 @@ static void rtl8180_stop(struct ieee80211_hw *dev)
         u8 reg;
         int i;
 
-        priv->mode = NL80211_IFTYPE_UNSPECIFIED;
-
         rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0);
 
         reg = rtl818x_ioread8(priv, &priv->map->CMD);
@@ -658,38 +653,39 @@ static void rtl8180_stop(struct ieee80211_hw *dev)
 }
 
 static int rtl8180_add_interface(struct ieee80211_hw *dev,
-                                 struct ieee80211_if_init_conf *conf)
+                                 struct ieee80211_vif *vif)
 {
         struct rtl8180_priv *priv = dev->priv;
 
-        if (priv->mode != NL80211_IFTYPE_MONITOR)
-                return -EOPNOTSUPP;
+        /*
+         * We only support one active interface at a time.
+         */
+        if (priv->vif)
+                return -EBUSY;
 
-        switch (conf->type) {
+        switch (vif->type) {
         case NL80211_IFTYPE_STATION:
-                priv->mode = conf->type;
                 break;
         default:
                 return -EOPNOTSUPP;
         }
 
-        priv->vif = conf->vif;
+        priv->vif = vif;
 
         rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
         rtl818x_iowrite32(priv, (__le32 __iomem *)&priv->map->MAC[0],
-                          le32_to_cpu(*(__le32 *)conf->mac_addr));
+                          le32_to_cpu(*(__le32 *)vif->addr));
         rtl818x_iowrite16(priv, (__le16 __iomem *)&priv->map->MAC[4],
-                          le16_to_cpu(*(__le16 *)(conf->mac_addr + 4)));
+                          le16_to_cpu(*(__le16 *)(vif->addr + 4)));
         rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
 
         return 0;
 }
 
 static void rtl8180_remove_interface(struct ieee80211_hw *dev,
-                                     struct ieee80211_if_init_conf *conf)
+                                     struct ieee80211_vif *vif)
 {
         struct rtl8180_priv *priv = dev->priv;
-        priv->mode = NL80211_IFTYPE_MONITOR;
         priv->vif = NULL;
 }
 
@@ -766,6 +762,14 @@ static void rtl8180_configure_filter(struct ieee80211_hw *dev,
         rtl818x_iowrite32(priv, &priv->map->RX_CONF, priv->rx_conf);
 }
 
+static u64 rtl8180_get_tsf(struct ieee80211_hw *dev)
+{
+        struct rtl8180_priv *priv = dev->priv;
+
+        return rtl818x_ioread32(priv, &priv->map->TSFT[0]) |
+               (u64)(rtl818x_ioread32(priv, &priv->map->TSFT[1])) << 32;
+}
+
 static const struct ieee80211_ops rtl8180_ops = {
         .tx                     = rtl8180_tx,
         .start                  = rtl8180_start,
@@ -776,6 +780,7 @@ static const struct ieee80211_ops rtl8180_ops = {
         .bss_info_changed       = rtl8180_bss_info_changed,
         .prepare_multicast      = rtl8180_prepare_multicast,
         .configure_filter       = rtl8180_configure_filter,
+        .get_tsf                = rtl8180_get_tsf,
 };
 
 static void rtl8180_eeprom_register_read(struct eeprom_93cx6 *eeprom)
diff --git a/drivers/net/wireless/rtl818x/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187.h
index bf9175a8c1f4..6bb32112e65c 100644
--- a/drivers/net/wireless/rtl818x/rtl8187.h
+++ b/drivers/net/wireless/rtl818x/rtl8187.h
@@ -23,6 +23,7 @@
 #define RTL8187_EEPROM_TXPWR_CHAN_1     0x16    /* 3 channels */
 #define RTL8187_EEPROM_TXPWR_CHAN_6     0x1B    /* 2 channels */
 #define RTL8187_EEPROM_TXPWR_CHAN_4     0x3D    /* 2 channels */
+#define RTL8187_EEPROM_SELECT_GPIO      0x3B
 
 #define RTL8187_REQT_READ       0xC0
 #define RTL8187_REQT_WRITE      0x40
@@ -31,6 +32,9 @@
 
 #define RTL8187_MAX_RX          0x9C4
 
+#define RFKILL_MASK_8187_89_97  0x2
+#define RFKILL_MASK_8198        0x4
+
 struct rtl8187_rx_info {
         struct urb *urb;
         struct ieee80211_hw *dev;
@@ -88,7 +92,7 @@ struct rtl8187_priv {
         struct rtl818x_csr *map;
         const struct rtl818x_rf_ops *rf;
         struct ieee80211_vif *vif;
-        int mode;
+
         /* The mutex protects the TX loopback state.
          * Any attempt to set channels concurrently locks the device.
          */
@@ -104,6 +108,7 @@ struct rtl8187_priv {
         struct delayed_work work;
         struct ieee80211_hw *dev;
 #ifdef CONFIG_RTL8187_LEDS
+        struct rtl8187_led led_radio;
         struct rtl8187_led led_tx;
         struct rtl8187_led led_rx;
         struct delayed_work led_on;
@@ -119,10 +124,10 @@ struct rtl8187_priv {
         } hw_rev;
         struct sk_buff_head rx_queue;
         u8 signal;
-        u8 quality;
         u8 noise;
         u8 slot_time;
         u8 aifsn[4];
+        u8 rfkill_mask;
         struct {
                 __le64 buf;
                 struct sk_buff_head queue;
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 2017ccc00145..1d30792973f5 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -22,6 +22,7 @@
 
 #include <linux/init.h>
 #include <linux/usb.h>
+#include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
 #include <linux/eeprom_93cx6.h>
@@ -65,6 +66,7 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         /* Sitecom */
         {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
         {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
+        {USB_DEVICE(0x0df6, 0x0029), .driver_info = DEVICE_RTL8187B},
         /* Sphairon Access Systems GmbH */
         {USB_DEVICE(0x114B, 0x0150), .driver_info = DEVICE_RTL8187},
         /* Dick Smith Electronics */
@@ -320,7 +322,6 @@ static void rtl8187_rx_cb(struct urb *urb)
         struct ieee80211_rx_status rx_status = { 0 };
         int rate, signal;
         u32 flags;
-        u32 quality;
         unsigned long f;
 
         spin_lock_irqsave(&priv->rx_queue.lock, f);
@@ -338,10 +339,9 @@ static void rtl8187_rx_cb(struct urb *urb)
                         (typeof(hdr))(skb_tail_pointer(skb) - sizeof(*hdr));
                 flags = le32_to_cpu(hdr->flags);
                 /* As with the RTL8187B below, the AGC is used to calculate
-                 * signal strength and quality. In this case, the scaling
+                 * signal strength. In this case, the scaling
                  * constants are derived from the output of p54usb.
                  */
-                quality = 130 - ((41 * hdr->agc) >> 6);
                 signal = -4 - ((27 * hdr->agc) >> 6);
                 rx_status.antenna = (hdr->signal >> 7) & 1;
                 rx_status.mactime = le64_to_cpu(hdr->mac_time);
@@ -354,23 +354,18 @@ static void rtl8187_rx_cb(struct urb *urb)
                  * In testing, none of these quantities show qualitative
                  * agreement with AP signal strength, except for the AGC,
                  * which is inversely proportional to the strength of the
-                 * signal. In the following, the quality and signal strength
-                 * are derived from the AGC. The arbitrary scaling constants
+                 * signal. In the following, the signal strength
+                 * is derived from the AGC. The arbitrary scaling constants
                  * are chosen to make the results close to the values obtained
                  * for a BCM4312 using b43 as the driver. The noise is ignored
                  * for now.
                  */
                 flags = le32_to_cpu(hdr->flags);
-                quality = 170 - hdr->agc;
                 signal = 14 - hdr->agc / 2;
                 rx_status.antenna = (hdr->rssi >> 7) & 1;
                 rx_status.mactime = le64_to_cpu(hdr->mac_time);
         }
 
-        if (quality > 100)
-                quality = 100;
-        rx_status.qual = quality;
-        priv->quality = quality;
         rx_status.signal = signal;
         priv->signal = signal;
         rate = (flags >> 20) & 0xF;
@@ -1025,31 +1020,30 @@ static void rtl8187_stop(struct ieee80211_hw *dev)
 }
 
 static int rtl8187_add_interface(struct ieee80211_hw *dev,
-                                 struct ieee80211_if_init_conf *conf)
+                                 struct ieee80211_vif *vif)
 {
         struct rtl8187_priv *priv = dev->priv;
         int i;
         int ret = -EOPNOTSUPP;
 
         mutex_lock(&priv->conf_mutex);
-        if (priv->mode != NL80211_IFTYPE_MONITOR)
+        if (priv->vif)
                 goto exit;
 
-        switch (conf->type) {
+        switch (vif->type) {
         case NL80211_IFTYPE_STATION:
-                priv->mode = conf->type;
                 break;
         default:
                 goto exit;
         }
 
         ret = 0;
-        priv->vif = conf->vif;
+        priv->vif = vif;
 
         rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
         for (i = 0; i < ETH_ALEN; i++)
                 rtl818x_iowrite8(priv, &priv->map->MAC[i],
-                                 ((u8 *)conf->mac_addr)[i]);
+                                 ((u8 *)vif->addr)[i]);
         rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
 
 exit:
@@ -1058,11 +1052,10 @@ exit:
 }
 
 static void rtl8187_remove_interface(struct ieee80211_hw *dev,
-                                     struct ieee80211_if_init_conf *conf)
+                                     struct ieee80211_vif *vif)
 {
         struct rtl8187_priv *priv = dev->priv;
         mutex_lock(&priv->conf_mutex);
-        priv->mode = NL80211_IFTYPE_MONITOR;
         priv->vif = NULL;
         mutex_unlock(&priv->conf_mutex);
 }
@@ -1274,6 +1267,14 @@ static int rtl8187_conf_tx(struct ieee80211_hw *dev, u16 queue,
         return 0;
 }
 
+static u64 rtl8187_get_tsf(struct ieee80211_hw *dev)
+{
+        struct rtl8187_priv *priv = dev->priv;
+
+        return rtl818x_ioread32(priv, &priv->map->TSFT[0]) |
+               (u64)(rtl818x_ioread32(priv, &priv->map->TSFT[1])) << 32;
+}
+
 static const struct ieee80211_ops rtl8187_ops = {
         .tx                     = rtl8187_tx,
         .start                  = rtl8187_start,
@@ -1285,7 +1286,8 @@ static const struct ieee80211_ops rtl8187_ops = {
         .prepare_multicast      = rtl8187_prepare_multicast,
         .configure_filter       = rtl8187_configure_filter,
         .conf_tx                = rtl8187_conf_tx,
-        .rfkill_poll            = rtl8187_rfkill_poll
+        .rfkill_poll            = rtl8187_rfkill_poll,
+        .get_tsf                = rtl8187_get_tsf,
 };
 
 static void rtl8187_eeprom_register_read(struct eeprom_93cx6 *eeprom)
@@ -1329,6 +1331,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         struct ieee80211_channel *channel;
         const char *chip_name;
         u16 txpwr, reg;
+        u16 product_id = le16_to_cpu(udev->descriptor.idProduct);
         int err, i;
 
         dev = ieee80211_alloc_hw(sizeof(*priv), &rtl8187_ops);
@@ -1371,7 +1374,6 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         dev->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band;
 
 
-        priv->mode = NL80211_IFTYPE_MONITOR;
         dev->flags = IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
                      IEEE80211_HW_SIGNAL_DBM |
                      IEEE80211_HW_RX_INCLUDES_FCS;
@@ -1488,6 +1490,13 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
                 (*channel++).hw_value = txpwr & 0xFF;
                 (*channel++).hw_value = txpwr >> 8;
         }
+        /* Handle the differing rfkill GPIO bit in different models */
+        priv->rfkill_mask = RFKILL_MASK_8187_89_97;
+        if (product_id == 0x8197 || product_id == 0x8198) {
+                eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_SELECT_GPIO, &reg);
+                if (reg & 0xFF00)
+                        priv->rfkill_mask = RFKILL_MASK_8198;
+        }
 
         /*
          * XXX: Once this driver supports anything that requires
@@ -1516,9 +1525,9 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         mutex_init(&priv->conf_mutex);
         skb_queue_head_init(&priv->b_tx_status.queue);
 
-        printk(KERN_INFO "%s: hwaddr %pM, %s V%d + %s\n",
+        printk(KERN_INFO "%s: hwaddr %pM, %s V%d + %s, rfkill mask %d\n",
                wiphy_name(dev->wiphy), dev->wiphy->perm_addr,
-               chip_name, priv->asic_rev, priv->rf->name);
+               chip_name, priv->asic_rev, priv->rf->name, priv->rfkill_mask);
 
 #ifdef CONFIG_RTL8187_LEDS
         eeprom_93cx6_read(&eeprom, 0x3F, &reg);
diff --git a/drivers/net/wireless/rtl818x/rtl8187_leds.c b/drivers/net/wireless/rtl818x/rtl8187_leds.c
index cf8a4a40fdf6..4637337d5ce6 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_leds.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_leds.c
@@ -33,7 +33,7 @@ static void led_turn_on(struct work_struct *work)
         struct rtl8187_led *led = &priv->led_tx;
 
         /* Don't change the LED, when the device is down. */
-        if (priv->mode == NL80211_IFTYPE_UNSPECIFIED)
+        if (!priv->vif || priv->vif->type == NL80211_IFTYPE_UNSPECIFIED)
                 return ;
 
         /* Skip if the LED is not registered. */
@@ -71,7 +71,7 @@ static void led_turn_off(struct work_struct *work)
         struct rtl8187_led *led = &priv->led_tx;
 
         /* Don't change the LED, when the device is down. */
-        if (priv->mode == NL80211_IFTYPE_UNSPECIFIED)
+        if (!priv->vif || priv->vif->type == NL80211_IFTYPE_UNSPECIFIED)
                 return ;
 
         /* Skip if the LED is not registered. */
@@ -105,19 +105,36 @@ static void rtl8187_led_brightness_set(struct led_classdev *led_dev,
         struct rtl8187_led *led = container_of(led_dev, struct rtl8187_led,
                                                led_dev);
         struct ieee80211_hw *hw = led->dev;
-        struct rtl8187_priv *priv = hw->priv;
+        struct rtl8187_priv *priv;
+        static bool radio_on;
 
-        if (brightness == LED_OFF) {
-                ieee80211_queue_delayed_work(hw, &priv->led_off, 0);
-                /* The LED is off for 1/20 sec so that it just blinks. */
-                ieee80211_queue_delayed_work(hw, &priv->led_on, HZ / 20);
-        } else
-                ieee80211_queue_delayed_work(hw, &priv->led_on, 0);
+        if (!hw)
+                return;
+        priv = hw->priv;
+        if (led->is_radio) {
+                if (brightness == LED_FULL) {
+                        ieee80211_queue_delayed_work(hw, &priv->led_on, 0);
+                        radio_on = true;
+                } else if (radio_on) {
+                        radio_on = false;
+                        cancel_delayed_work_sync(&priv->led_on);
+                        ieee80211_queue_delayed_work(hw, &priv->led_off, 0);
+                }
+        } else if (radio_on) {
+                if (brightness == LED_OFF) {
+                        ieee80211_queue_delayed_work(hw, &priv->led_off, 0);
+                        /* The LED is off for 1/20 sec - it just blinks. */
+                        ieee80211_queue_delayed_work(hw, &priv->led_on,
+                                                     HZ / 20);
+                } else
+                        ieee80211_queue_delayed_work(hw, &priv->led_on, 0);
+        }
 }
 
 static int rtl8187_register_led(struct ieee80211_hw *dev,
                                 struct rtl8187_led *led, const char *name,
-                                const char *default_trigger, u8 ledpin)
+                                const char *default_trigger, u8 ledpin,
+                                bool is_radio)
 {
         int err;
         struct rtl8187_priv *priv = dev->priv;
@@ -128,6 +145,7 @@ static int rtl8187_register_led(struct ieee80211_hw *dev,
                 return -EINVAL;
         led->dev = dev;
         led->ledpin = ledpin;
+        led->is_radio = is_radio;
         strncpy(led->name, name, sizeof(led->name));
 
         led->led_dev.name = led->name;
@@ -145,7 +163,11 @@ static int rtl8187_register_led(struct ieee80211_hw *dev,
 
 static void rtl8187_unregister_led(struct rtl8187_led *led)
 {
+        struct ieee80211_hw *hw = led->dev;
+        struct rtl8187_priv *priv = hw->priv;
+
         led_classdev_unregister(&led->led_dev);
+        flush_delayed_work(&priv->led_off);
         led->dev = NULL;
 }
 
@@ -183,37 +205,41 @@ void rtl8187_leds_init(struct ieee80211_hw *dev, u16 custid)
         INIT_DELAYED_WORK(&priv->led_off, led_turn_off);
 
         snprintf(name, sizeof(name),
+                 "rtl8187-%s::radio", wiphy_name(dev->wiphy));
+        err = rtl8187_register_led(dev, &priv->led_radio, name,
+                         ieee80211_get_radio_led_name(dev), ledpin, true);
+        if (err)
+                return;
+
+        snprintf(name, sizeof(name),
                  "rtl8187-%s::tx", wiphy_name(dev->wiphy));
         err = rtl8187_register_led(dev, &priv->led_tx, name,
-                         ieee80211_get_tx_led_name(dev), ledpin);
+                         ieee80211_get_tx_led_name(dev), ledpin, false);
         if (err)
-                goto error;
+                goto err_tx;
+
         snprintf(name, sizeof(name),
                  "rtl8187-%s::rx", wiphy_name(dev->wiphy));
         err = rtl8187_register_led(dev, &priv->led_rx, name,
-                         ieee80211_get_rx_led_name(dev), ledpin);
-        if (!err) {
-                ieee80211_queue_delayed_work(dev, &priv->led_on, 0);
+                         ieee80211_get_rx_led_name(dev), ledpin, false);
+        if (!err)
                 return;
-        }
-        /* registration of RX LED failed - unregister TX */
+
+        /* registration of RX LED failed - unregister */
         rtl8187_unregister_led(&priv->led_tx);
-error:
-        /* If registration of either failed, cancel delayed work */
-        cancel_delayed_work_sync(&priv->led_off);
-        cancel_delayed_work_sync(&priv->led_on);
+err_tx:
+        rtl8187_unregister_led(&priv->led_radio);
 }
 
 void rtl8187_leds_exit(struct ieee80211_hw *dev)
 {
         struct rtl8187_priv *priv = dev->priv;
 
-        /* turn the LED off before exiting */
-        ieee80211_queue_delayed_work(dev, &priv->led_off, 0);
+        rtl8187_unregister_led(&priv->led_radio);
         rtl8187_unregister_led(&priv->led_rx);
         rtl8187_unregister_led(&priv->led_tx);
         cancel_delayed_work_sync(&priv->led_off);
         cancel_delayed_work_sync(&priv->led_on);
 }
-#endif /* def CONFIG_RTL8187_LED */
+#endif /* def CONFIG_RTL8187_LEDS */
 
diff --git a/drivers/net/wireless/rtl818x/rtl8187_leds.h b/drivers/net/wireless/rtl818x/rtl8187_leds.h
index a0332027aead..d743c96d4a20 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_leds.h
+++ b/drivers/net/wireless/rtl818x/rtl8187_leds.h
@@ -47,11 +47,13 @@ struct rtl8187_led {
         u8 ledpin;
         /* The unique name string for this LED device. */
         char name[RTL8187_LED_MAX_NAME_LEN + 1];
+        /* If the LED is radio or tx/rx */
+        bool is_radio;
 };
 
 void rtl8187_leds_init(struct ieee80211_hw *dev, u16 code);
 void rtl8187_leds_exit(struct ieee80211_hw *dev);
 
-#endif /* def CONFIG_RTL8187_LED */
+#endif /* def CONFIG_RTL8187_LEDS */
 
 #endif /* RTL8187_LED_H */
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rfkill.c b/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
index cad8037ab2af..03555e1e0cab 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
@@ -25,10 +25,10 @@ static bool rtl8187_is_radio_enabled(struct rtl8187_priv *priv)
         u8 gpio;
 
         gpio = rtl818x_ioread8(priv, &priv->map->GPIO0);
-        rtl818x_iowrite8(priv, &priv->map->GPIO0, gpio & ~0x02);
+        rtl818x_iowrite8(priv, &priv->map->GPIO0, gpio & ~priv->rfkill_mask);
         gpio = rtl818x_ioread8(priv, &priv->map->GPIO1);
 
-        return gpio & 0x02;
+        return gpio & priv->rfkill_mask;
 }
 
 void rtl8187_rfkill_init(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
deleted file mode 100644
index ea6a87c19319..000000000000
--- a/drivers/net/wireless/strip.c
+++ /dev/null
@@ -1,2805 +0,0 @@
-/*
- * Copyright 1996 The Board of Trustees of The Leland Stanford
- * Junior University. All Rights Reserved.
- *
- * Permission to use, copy, modify, and distribute this
- * software and its documentation for any purpose and without
- * fee is hereby granted, provided that the above copyright
- * notice appear in all copies.  Stanford University
- * makes no representations about the suitability of this
- * software for any purpose.  It is provided "as is" without
- * express or implied warranty.
- *
- * strip.c      This module implements Starmode Radio IP (STRIP)
- *              for kernel-based devices like TTY.  It interfaces between a
- *              raw TTY, and the kernel's INET protocol layers (via DDI).
- *
- * Version:     @(#)strip.c     1.3     July 1997
- *
- * Author:      Stuart Cheshire <cheshire@cs.stanford.edu>
- *
- * Fixes:       v0.9 12th Feb 1996 (SC)
- *              New byte stuffing (2+6 run-length encoding)
- *              New watchdog timer task
- *              New Protocol key (SIP0)
- *              
- *              v0.9.1 3rd March 1996 (SC)
- *              Changed to dynamic device allocation -- no more compile
- *              time (or boot time) limit on the number of STRIP devices.
- *              
- *              v0.9.2 13th March 1996 (SC)
- *              Uses arp cache lookups (but doesn't send arp packets yet)
- *              
- *              v0.9.3 17th April 1996 (SC)
- *              Fixed bug where STR_ERROR flag was getting set unneccessarily
- *              (causing otherwise good packets to be unneccessarily dropped)
- *              
- *              v0.9.4 27th April 1996 (SC)
- *              First attempt at using "&COMMAND" Starmode AT commands
- *              
- *              v0.9.5 29th May 1996 (SC)
- *              First attempt at sending (unicast) ARP packets
- *              
- *              v0.9.6 5th June 1996 (Elliot)
- *              Put "message level" tags in every "printk" statement
- *              
- *              v0.9.7 13th June 1996 (laik)
- *              Added support for the /proc fs
- *
- *              v0.9.8 July 1996 (Mema)
- *              Added packet logging
- *
- *              v1.0 November 1996 (SC)
- *              Fixed (severe) memory leaks in the /proc fs code
- *              Fixed race conditions in the logging code
- *
- *              v1.1 January 1997 (SC)
- *              Deleted packet logging (use tcpdump instead)
- *              Added support for Metricom Firmware v204 features
- *              (like message checksums)
- *
- *              v1.2 January 1997 (SC)
- *              Put portables list back in
- *
- *              v1.3 July 1997 (SC)
- *              Made STRIP driver set the radio's baud rate automatically.
- *              It is no longer necessarily to manually set the radio's
- *              rate permanently to 115200 -- the driver handles setting
- *              the rate automatically.
- */
-
-#ifdef MODULE
-static const char StripVersion[] = "1.3A-STUART.CHESHIRE-MODULAR";
-#else
-static const char StripVersion[] = "1.3A-STUART.CHESHIRE";
-#endif
-
-#define TICKLE_TIMERS 0
-#define EXT_COUNTERS 1
-
-
-/************************************************************************/
-/* Header files                                                         */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/bitops.h>
-#include <asm/system.h>
-#include <asm/uaccess.h>
-
-# include <linux/ctype.h>
-#include <linux/string.h>
-#include <linux/mm.h>
-#include <linux/interrupt.h>
-#include <linux/in.h>
-#include <linux/tty.h>
-#include <linux/errno.h>
-#include <linux/netdevice.h>
-#include <linux/inetdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/skbuff.h>
-#include <linux/if_arp.h>
-#include <linux/if_strip.h>
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <linux/serial.h>
-#include <linux/serialP.h>
-#include <linux/rcupdate.h>
-#include <net/arp.h>
-#include <net/net_namespace.h>
-
-#include <linux/ip.h>
-#include <linux/tcp.h>
-#include <linux/time.h>
-#include <linux/jiffies.h>
-
-/************************************************************************/
-/* Useful structures and definitions                                    */
-
-/*
- * A MetricomKey identifies the protocol being carried inside a Metricom
- * Starmode packet.
- */
-
-typedef union {
-        __u8 c[4];
-        __u32 l;
-} MetricomKey;
-
-/*
- * An IP address can be viewed as four bytes in memory (which is what it is) or as
- * a single 32-bit long (which is convenient for assignment, equality testing etc.)
- */
-
-typedef union {
-        __u8 b[4];
-        __u32 l;
-} IPaddr;
-
-/*
- * A MetricomAddressString is used to hold a printable representation of
- * a Metricom address.
- */
-
-typedef struct {
-        __u8 c[24];
-} MetricomAddressString;
-
-/* Encapsulation can expand packet of size x to 65/64x + 1
- * Sent packet looks like "<CR>*<address>*<key><encaps payload><CR>"
- *                           1 1   1-18  1  4         ?         1
- * eg.                     <CR>*0000-1234*SIP0<encaps payload><CR>
- * We allow 31 bytes for the stars, the key, the address and the <CR>s
- */
-#define STRIP_ENCAP_SIZE(X) (32 + (X)*65L/64L)
-
-/*
- * A STRIP_Header is never really sent over the radio, but making a dummy
- * header for internal use within the kernel that looks like an Ethernet
- * header makes certain other software happier. For example, tcpdump
- * already understands Ethernet headers.
- */
-
-typedef struct {
-        MetricomAddress dst_addr;       /* Destination address, e.g. "0000-1234"   */
-        MetricomAddress src_addr;       /* Source address, e.g. "0000-5678"        */
-        unsigned short protocol;        /* The protocol type, using Ethernet codes */
-} STRIP_Header;
-
-typedef struct {
-        char c[60];
-} MetricomNode;
-
-#define NODE_TABLE_SIZE 32
-typedef struct {
-        struct timeval timestamp;
-        int num_nodes;
-        MetricomNode node[NODE_TABLE_SIZE];
-} MetricomNodeTable;
-
-enum { FALSE = 0, TRUE = 1 };
-
-/*
- * Holds the radio's firmware version.
- */
-typedef struct {
-        char c[50];
-} FirmwareVersion;
-
-/*
- * Holds the radio's serial number.
- */
-typedef struct {
-        char c[18];
-} SerialNumber;
-
-/*
- * Holds the radio's battery voltage.
- */
-typedef struct {
-        char c[11];
-} BatteryVoltage;
-
-typedef struct {
-        char c[8];
-} char8;
-
-enum {
-        NoStructure = 0,        /* Really old firmware */
-        StructuredMessages = 1, /* Parsable AT response msgs */
-        ChecksummedMessages = 2 /* Parsable AT response msgs with checksums */
-};
-
-struct strip {
-        int magic;
-        /*
-         * These are pointers to the malloc()ed frame buffers.
-         */
-
-        unsigned char *rx_buff; /* buffer for received IP packet */
-        unsigned char *sx_buff; /* buffer for received serial data */
-        int sx_count;           /* received serial data counter */
-        int sx_size;            /* Serial buffer size           */
-        unsigned char *tx_buff; /* transmitter buffer           */
-        unsigned char *tx_head; /* pointer to next byte to XMIT */
-        int tx_left;            /* bytes left in XMIT queue     */
-        int tx_size;            /* Serial buffer size           */
-
-        /*
-         * STRIP interface statistics.
-         */
-
-        unsigned long rx_packets;       /* inbound frames counter       */
-        unsigned long tx_packets;       /* outbound frames counter      */
-        unsigned long rx_errors;        /* Parity, etc. errors          */
-        unsigned long tx_errors;        /* Planned stuff                */
-        unsigned long rx_dropped;       /* No memory for skb            */
-        unsigned long tx_dropped;       /* When MTU change              */
-        unsigned long rx_over_errors;   /* Frame bigger than STRIP buf. */
-
-        unsigned long pps_timer;        /* Timer to determine pps       */
-        unsigned long rx_pps_count;     /* Counter to determine pps     */
-        unsigned long tx_pps_count;     /* Counter to determine pps     */
-        unsigned long sx_pps_count;     /* Counter to determine pps     */
-        unsigned long rx_average_pps;   /* rx packets per second * 8    */
-        unsigned long tx_average_pps;   /* tx packets per second * 8    */
-        unsigned long sx_average_pps;   /* sent packets per second * 8  */
-
-#ifdef EXT_COUNTERS
-        unsigned long rx_bytes;         /* total received bytes */
-        unsigned long tx_bytes;         /* total received bytes */
-        unsigned long rx_rbytes;        /* bytes thru radio i/f */
-        unsigned long tx_rbytes;        /* bytes thru radio i/f */
-        unsigned long rx_sbytes;        /* tot bytes thru serial i/f */
-        unsigned long tx_sbytes;        /* tot bytes thru serial i/f */
-        unsigned long rx_ebytes;        /* tot stat/err bytes */
-        unsigned long tx_ebytes;        /* tot stat/err bytes */
-#endif
-
-        /*
-         * Internal variables.
-         */
-
-        struct list_head  list;         /* Linked list of devices */
-
-        int discard;                    /* Set if serial error          */
-        int working;                    /* Is radio working correctly?  */
-        int firmware_level;             /* Message structuring level    */
-        int next_command;               /* Next periodic command        */
-        unsigned int user_baud;         /* The user-selected baud rate  */
-        int mtu;                        /* Our mtu (to spot changes!)   */
-        long watchdog_doprobe;          /* Next time to test the radio  */
-        long watchdog_doreset;          /* Time to do next reset        */
-        long gratuitous_arp;            /* Time to send next ARP refresh */
-        long arp_interval;              /* Next ARP interval            */
-        struct timer_list idle_timer;   /* For periodic wakeup calls    */
-        MetricomAddress true_dev_addr;  /* True address of radio        */
-        int manual_dev_addr;            /* Hack: See note below         */
-
-        FirmwareVersion firmware_version;       /* The radio's firmware version */
-        SerialNumber serial_number;     /* The radio's serial number    */
-        BatteryVoltage battery_voltage; /* The radio's battery voltage  */
-
-        /*
-         * Other useful structures.
-         */
-
-        struct tty_struct *tty;         /* ptr to TTY structure         */
-        struct net_device *dev;         /* Our device structure         */
-
-        /*
-         * Neighbour radio records
-         */
-
-        MetricomNodeTable portables;
-        MetricomNodeTable poletops;
-};
-
-/*
- * Note: manual_dev_addr hack
- * 
- * It is not possible to change the hardware address of a Metricom radio,
- * or to send packets with a user-specified hardware source address, thus
- * trying to manually set a hardware source address is a questionable
- * thing to do.  However, if the user *does* manually set the hardware
- * source address of a STRIP interface, then the kernel will believe it,
- * and use it in certain places. For example, the hardware address listed
- * by ifconfig will be the manual address, not the true one.
- * (Both addresses are listed in /proc/net/strip.)
- * Also, ARP packets will be sent out giving the user-specified address as
- * the source address, not the real address. This is dangerous, because
- * it means you won't receive any replies -- the ARP replies will go to
- * the specified address, which will be some other radio. The case where
- * this is useful is when that other radio is also connected to the same
- * machine. This allows you to connect a pair of radios to one machine,
- * and to use one exclusively for inbound traffic, and the other
- * exclusively for outbound traffic. Pretty neat, huh?
- * 
- * Here's the full procedure to set this up:
- * 
- * 1. "slattach" two interfaces, e.g. st0 for outgoing packets,
- *    and st1 for incoming packets
- * 
- * 2. "ifconfig" st0 (outbound radio) to have the hardware address
- *    which is the real hardware address of st1 (inbound radio).
- *    Now when it sends out packets, it will masquerade as st1, and
- *    replies will be sent to that radio, which is exactly what we want.
- * 
- * 3. Set the route table entry ("route add default ..." or
- *    "route add -net ...", as appropriate) to send packets via the st0
- *    interface (outbound radio). Do not add any route which sends packets
- *    out via the st1 interface -- that radio is for inbound traffic only.
- * 
- * 4. "ifconfig" st1 (inbound radio) to have hardware address zero.
- *    This tells the STRIP driver to "shut down" that interface and not
- *    send any packets through it. In particular, it stops sending the
- *    periodic gratuitous ARP packets that a STRIP interface normally sends.
- *    Also, when packets arrive on that interface, it will search the
- *    interface list to see if there is another interface who's manual
- *    hardware address matches its own real address (i.e. st0 in this
- *    example) and if so it will transfer ownership of the skbuff to
- *    that interface, so that it looks to the kernel as if the packet
- *    arrived on that interface. This is necessary because when the
- *    kernel sends an ARP packet on st0, it expects to get a reply on
- *    st0, and if it sees the reply come from st1 then it will ignore
- *    it (to be accurate, it puts the entry in the ARP table, but
- *    labelled in such a way that st0 can't use it).
- * 
- * Thanks to Petros Maniatis for coming up with the idea of splitting
- * inbound and outbound traffic between two interfaces, which turned
- * out to be really easy to implement, even if it is a bit of a hack.
- * 
- * Having set a manual address on an interface, you can restore it
- * to automatic operation (where the address is automatically kept
- * consistent with the real address of the radio) by setting a manual
- * address of all ones, e.g. "ifconfig st0 hw strip FFFFFFFFFFFF"
- * This 'turns off' manual override mode for the device address.
- * 
- * Note: The IEEE 802 headers reported in tcpdump will show the *real*
- * radio addresses the packets were sent and received from, so that you
- * can see what is really going on with packets, and which interfaces
- * they are really going through.
- */
-
-
-/************************************************************************/
-/* Constants                                                            */
-
-/*
- * CommandString1 works on all radios
- * Other CommandStrings are only used with firmware that provides structured responses.
- * 
- * ats319=1 Enables Info message for node additions and deletions
- * ats319=2 Enables Info message for a new best node
- * ats319=4 Enables checksums
- * ats319=8 Enables ACK messages
- */
-
-static const int MaxCommandStringLength = 32;
-static const int CompatibilityCommand = 1;
-
-static const char CommandString0[] = "*&COMMAND*ATS319=7";      /* Turn on checksums & info messages */
-static const char CommandString1[] = "*&COMMAND*ATS305?";       /* Query radio name */
-static const char CommandString2[] = "*&COMMAND*ATS325?";       /* Query battery voltage */
-static const char CommandString3[] = "*&COMMAND*ATS300?";       /* Query version information */
-static const char CommandString4[] = "*&COMMAND*ATS311?";       /* Query poletop list */
-static const char CommandString5[] = "*&COMMAND*AT~LA";         /* Query portables list */
-typedef struct {
-        const char *string;
-        long length;
-} StringDescriptor;
-
-static const StringDescriptor CommandString[] = {
-        {CommandString0, sizeof(CommandString0) - 1},
-        {CommandString1, sizeof(CommandString1) - 1},
-        {CommandString2, sizeof(CommandString2) - 1},
-        {CommandString3, sizeof(CommandString3) - 1},
-        {CommandString4, sizeof(CommandString4) - 1},
-        {CommandString5, sizeof(CommandString5) - 1}
-};
-
-#define GOT_ALL_RADIO_INFO(S)      \
-    ((S)->firmware_version.c[0] && \
-     (S)->battery_voltage.c[0]  && \
-     memcmp(&(S)->true_dev_addr, zero_address.c, sizeof(zero_address)))
-
-static const char hextable[16] = "0123456789ABCDEF";
-
-static const MetricomAddress zero_address;
-static const MetricomAddress broadcast_address =
-    { {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF} };
-
-static const MetricomKey SIP0Key = { "SIP0" };
-static const MetricomKey ARP0Key = { "ARP0" };
-static const MetricomKey ATR_Key = { "ATR " };
-static const MetricomKey ACK_Key = { "ACK_" };
-static const MetricomKey INF_Key = { "INF_" };
-static const MetricomKey ERR_Key = { "ERR_" };
-
-static const long MaxARPInterval = 60 * HZ;     /* One minute */
-
-/*
- * Maximum Starmode packet length is 1183 bytes. Allowing 4 bytes for
- * protocol key, 4 bytes for checksum, one byte for CR, and 65/64 expansion
- * for STRIP encoding, that translates to a maximum payload MTU of 1155.
- * Note: A standard NFS 1K data packet is a total of 0x480 (1152) bytes
- * long, including IP header, UDP header, and NFS header. Setting the STRIP
- * MTU to 1152 allows us to send default sized NFS packets without fragmentation.
- */
-static const unsigned short MAX_SEND_MTU = 1152;
-static const unsigned short MAX_RECV_MTU = 1500;        /* Hoping for Ethernet sized packets in the future! */
-static const unsigned short DEFAULT_STRIP_MTU = 1152;
-static const int STRIP_MAGIC = 0x5303;
-static const long LongTime = 0x7FFFFFFF;
-
-/************************************************************************/
-/* Global variables                                                     */
-
-static LIST_HEAD(strip_list);
-static DEFINE_SPINLOCK(strip_lock);
-
-/************************************************************************/
-/* Macros                                                               */
-
-/* Returns TRUE if text T begins with prefix P */
-#define has_prefix(T,L,P) (((L) >= sizeof(P)-1) && !strncmp((T), (P), sizeof(P)-1))
-
-/* Returns TRUE if text T of length L is equal to string S */
-#define text_equal(T,L,S) (((L) == sizeof(S)-1) && !strncmp((T), (S), sizeof(S)-1))
-
-#define READHEX(X) ((X)>='0' && (X)<='9' ? (X)-'0' :      \
-                    (X)>='a' && (X)<='f' ? (X)-'a'+10 :   \
-                    (X)>='A' && (X)<='F' ? (X)-'A'+10 : 0 )
-
-#define READHEX16(X) ((__u16)(READHEX(X)))
-
-#define READDEC(X) ((X)>='0' && (X)<='9' ? (X)-'0' : 0)
-
-#define ARRAY_END(X) (&((X)[ARRAY_SIZE(X)]))
-
-#define JIFFIE_TO_SEC(X) ((X) / HZ)
-
-
-/************************************************************************/
-/* Utility routines                                                     */
-
-static int arp_query(unsigned char *haddr, u32 paddr,
-                     struct net_device *dev)
-{
-        struct neighbour *neighbor_entry;
-        int ret = 0;
-
-        neighbor_entry = neigh_lookup(&arp_tbl, &paddr, dev);
-
-        if (neighbor_entry != NULL) {
-                neighbor_entry->used = jiffies;
-                if (neighbor_entry->nud_state & NUD_VALID) {
-                        memcpy(haddr, neighbor_entry->ha, dev->addr_len);
-                        ret = 1;
-                }
-                neigh_release(neighbor_entry);
-        }
-        return ret;
-}
-
-static void DumpData(char *msg, struct strip *strip_info, __u8 * ptr,
-                     __u8 * end)
-{
-        static const int MAX_DumpData = 80;
-        __u8 pkt_text[MAX_DumpData], *p = pkt_text;
-
-        *p++ = '\"';
-
-        while (ptr < end && p < &pkt_text[MAX_DumpData - 4]) {
-                if (*ptr == '\\') {
-                        *p++ = '\\';
-                        *p++ = '\\';
-                } else {
-                        if (*ptr >= 32 && *ptr <= 126) {
-                                *p++ = *ptr;
-                        } else {
-                                sprintf(p, "\\%02X", *ptr);
-                                p += 3;
-                        }
-                }
-                ptr++;
-        }
-
-        if (ptr == end)
-                *p++ = '\"';
-        *p++ = 0;
-
-        printk(KERN_INFO "%s: %-13s%s\n", strip_info->dev->name, msg, pkt_text);
-}
-
-
-/************************************************************************/
-/* Byte stuffing/unstuffing routines                                    */
-
-/* Stuffing scheme:
- * 00    Unused (reserved character)
- * 01-3F Run of 2-64 different characters
- * 40-7F Run of 1-64 different characters plus a single zero at the end
- * 80-BF Run of 1-64 of the same character
- * C0-FF Run of 1-64 zeroes (ASCII 0)
- */
-
-typedef enum {
-        Stuff_Diff = 0x00,
-        Stuff_DiffZero = 0x40,
-        Stuff_Same = 0x80,
-        Stuff_Zero = 0xC0,
-        Stuff_NoCode = 0xFF,    /* Special code, meaning no code selected */
-
-        Stuff_CodeMask = 0xC0,
-        Stuff_CountMask = 0x3F,
-        Stuff_MaxCount = 0x3F,
-        Stuff_Magic = 0x0D      /* The value we are eliminating */
-} StuffingCode;
-
-/* StuffData encodes the data starting at "src" for "length" bytes.
- * It writes it to the buffer pointed to by "dst" (which must be at least
- * as long as 1 + 65/64 of the input length). The output may be up to 1.6%
- * larger than the input for pathological input, but will usually be smaller.
- * StuffData returns the new value of the dst pointer as its result.
- * "code_ptr_ptr" points to a "__u8 *" which is used to hold encoding state
- * between calls, allowing an encoded packet to be incrementally built up
- * from small parts. On the first call, the "__u8 *" pointed to should be
- * initialized to NULL; between subsequent calls the calling routine should
- * leave the value alone and simply pass it back unchanged so that the
- * encoder can recover its current state.
- */
-
-#define StuffData_FinishBlock(X) \
-(*code_ptr = (X) ^ Stuff_Magic, code = Stuff_NoCode)
-
-static __u8 *StuffData(__u8 * src, __u32 length, __u8 * dst,
-                       __u8 ** code_ptr_ptr)
-{
-        __u8 *end = src + length;
-        __u8 *code_ptr = *code_ptr_ptr;
-        __u8 code = Stuff_NoCode, count = 0;
-
-        if (!length)
-                return (dst);
-
-        if (code_ptr) {
-                /*
-                 * Recover state from last call, if applicable
-                 */
-                code = (*code_ptr ^ Stuff_Magic) & Stuff_CodeMask;
-                count = (*code_ptr ^ Stuff_Magic) & Stuff_CountMask;
-        }
-
-        while (src < end) {
-                switch (code) {
-                        /* Stuff_NoCode: If no current code, select one */
-                case Stuff_NoCode:
-                        /* Record where we're going to put this code */
-                        code_ptr = dst++;
-                        count = 0;      /* Reset the count (zero means one instance) */
-                        /* Tentatively start a new block */
-                        if (*src == 0) {
-                                code = Stuff_Zero;
-                                src++;
-                        } else {
-                                code = Stuff_Same;
-                                *dst++ = *src++ ^ Stuff_Magic;
-                        }
-                        /* Note: We optimistically assume run of same -- */
-                        /* which will be fixed later in Stuff_Same */
-                        /* if it turns out not to be true. */
-                        break;
-
-                        /* Stuff_Zero: We already have at least one zero encoded */
-                case Stuff_Zero:
-                        /* If another zero, count it, else finish this code block */
-                        if (*src == 0) {
-                                count++;
-                                src++;
-                        } else {
-                                StuffData_FinishBlock(Stuff_Zero + count);
-                        }
-                        break;
-
-                        /* Stuff_Same: We already have at least one byte encoded */
-                case Stuff_Same:
-                        /* If another one the same, count it */
-                        if ((*src ^ Stuff_Magic) == code_ptr[1]) {
-                                count++;
-                                src++;
-                                break;
-                        }
-                        /* else, this byte does not match this block. */
-                        /* If we already have two or more bytes encoded, finish this code block */
-                        if (count) {
-                                StuffData_FinishBlock(Stuff_Same + count);
-                                break;
-                        }
-                        /* else, we only have one so far, so switch to Stuff_Diff code */
-                        code = Stuff_Diff;
-                        /* and fall through to Stuff_Diff case below
-                         * Note cunning cleverness here: case Stuff_Diff compares 
-                         * the current character with the previous two to see if it
-                         * has a run of three the same. Won't this be an error if
-                         * there aren't two previous characters stored to compare with?
-                         * No. Because we know the current character is *not* the same
-                         * as the previous one, the first test below will necessarily
-                         * fail and the send half of the "if" won't be executed.
-                         */
-
-                        /* Stuff_Diff: We have at least two *different* bytes encoded */
-                case Stuff_Diff:
-                        /* If this is a zero, must encode a Stuff_DiffZero, and begin a new block */
-                        if (*src == 0) {
-                                StuffData_FinishBlock(Stuff_DiffZero +
-                                                      count);
-                        }
-                        /* else, if we have three in a row, it is worth starting a Stuff_Same block */
-                        else if ((*src ^ Stuff_Magic) == dst[-1]
-                                 && dst[-1] == dst[-2]) {
-                                /* Back off the last two characters we encoded */
-                                code += count - 2;
-                                /* Note: "Stuff_Diff + 0" is an illegal code */
-                                if (code == Stuff_Diff + 0) {
-                                        code = Stuff_Same + 0;
-                                }
-                                StuffData_FinishBlock(code);
-                                code_ptr = dst - 2;
-                                /* dst[-1] already holds the correct value */
-                                count = 2;      /* 2 means three bytes encoded */
-                                code = Stuff_Same;
-                        }
-                        /* else, another different byte, so add it to the block */
-                        else {
-                                *dst++ = *src ^ Stuff_Magic;
-                                count++;
-                        }
-                        src++;  /* Consume the byte */
-                        break;
-                }
-                if (count == Stuff_MaxCount) {
-                        StuffData_FinishBlock(code + count);
-                }
-        }
-        if (code == Stuff_NoCode) {
-                *code_ptr_ptr = NULL;
-        } else {
-                *code_ptr_ptr = code_ptr;
-                StuffData_FinishBlock(code + count);
-        }
-        return (dst);
-}
-
-/*
- * UnStuffData decodes the data at "src", up to (but not including) "end".
- * It writes the decoded data into the buffer pointed to by "dst", up to a
- * maximum of "dst_length", and returns the new value of "src" so that a
- * follow-on call can read more data, continuing from where the first left off.
- * 
- * There are three types of results:
- * 1. The source data runs out before extracting "dst_length" bytes:
- *    UnStuffData returns NULL to indicate failure.
- * 2. The source data produces exactly "dst_length" bytes:
- *    UnStuffData returns new_src = end to indicate that all bytes were consumed.
- * 3. "dst_length" bytes are extracted, with more remaining.
- *    UnStuffData returns new_src < end to indicate that there are more bytes
- *    to be read.
- * 
- * Note: The decoding may be destructive, in that it may alter the source
- * data in the process of decoding it (this is necessary to allow a follow-on
- * call to resume correctly).
- */
-
-static __u8 *UnStuffData(__u8 * src, __u8 * end, __u8 * dst,
-                         __u32 dst_length)
-{
-        __u8 *dst_end = dst + dst_length;
-        /* Sanity check */
-        if (!src || !end || !dst || !dst_length)
-                return (NULL);
-        while (src < end && dst < dst_end) {
-                int count = (*src ^ Stuff_Magic) & Stuff_CountMask;
-                switch ((*src ^ Stuff_Magic) & Stuff_CodeMask) {
-                case Stuff_Diff:
-                        if (src + 1 + count >= end)
-                                return (NULL);
-                        do {
-                                *dst++ = *++src ^ Stuff_Magic;
-                        }
-                        while (--count >= 0 && dst < dst_end);
-                        if (count < 0)
-                                src += 1;
-                        else {
-                                if (count == 0)
-                                        *src = Stuff_Same ^ Stuff_Magic;
-                                else
-                                        *src =
-                                            (Stuff_Diff +
-                                             count) ^ Stuff_Magic;
-                        }
-                        break;
-                case Stuff_DiffZero:
-                        if (src + 1 + count >= end)
-                                return (NULL);
-                        do {
-                                *dst++ = *++src ^ Stuff_Magic;
-                        }
-                        while (--count >= 0 && dst < dst_end);
-                        if (count < 0)
-                                *src = Stuff_Zero ^ Stuff_Magic;
-                        else
-                                *src =
-                                    (Stuff_DiffZero + count) ^ Stuff_Magic;
-                        break;
-                case Stuff_Same:
-                        if (src + 1 >= end)
-                                return (NULL);
-                        do {
-                                *dst++ = src[1] ^ Stuff_Magic;
-                        }
-                        while (--count >= 0 && dst < dst_end);
-                        if (count < 0)
-                                src += 2;
-                        else
-                                *src = (Stuff_Same + count) ^ Stuff_Magic;
-                        break;
-                case Stuff_Zero:
-                        do {
-                                *dst++ = 0;
-                        }
-                        while (--count >= 0 && dst < dst_end);
-                        if (count < 0)
-                                src += 1;
-                        else
-                                *src = (Stuff_Zero + count) ^ Stuff_Magic;
-                        break;
-                }
-        }
-        if (dst < dst_end)
-                return (NULL);
-        else
-                return (src);
-}
-
-
-/************************************************************************/
-/* General routines for STRIP                                           */
-
-/*
- * set_baud sets the baud rate to the rate defined by baudcode
- */
-static void set_baud(struct tty_struct *tty, speed_t baudrate)
-{
-        struct ktermios old_termios;
-
-        mutex_lock(&tty->termios_mutex);
-        old_termios =*(tty->termios);
-        tty_encode_baud_rate(tty, baudrate, baudrate);
-        tty->ops->set_termios(tty, &old_termios);
-        mutex_unlock(&tty->termios_mutex);
-}
-
-/*
- * Convert a string to a Metricom Address.
- */
-
-#define IS_RADIO_ADDRESS(p) (                                                 \
-  isdigit((p)[0]) && isdigit((p)[1]) && isdigit((p)[2]) && isdigit((p)[3]) && \
-  (p)[4] == '-' &&                                                            \
-  isdigit((p)[5]) && isdigit((p)[6]) && isdigit((p)[7]) && isdigit((p)[8])    )
-
-static int string_to_radio_address(MetricomAddress * addr, __u8 * p)
-{
-        if (!IS_RADIO_ADDRESS(p))
-                return (1);
-        addr->c[0] = 0;
-        addr->c[1] = 0;
-        addr->c[2] = READHEX(p[0]) << 4 | READHEX(p[1]);
-        addr->c[3] = READHEX(p[2]) << 4 | READHEX(p[3]);
-        addr->c[4] = READHEX(p[5]) << 4 | READHEX(p[6]);
-        addr->c[5] = READHEX(p[7]) << 4 | READHEX(p[8]);
-        return (0);
-}
-
-/*
- * Convert a Metricom Address to a string.
- */
-
-static __u8 *radio_address_to_string(const MetricomAddress * addr,
-                                     MetricomAddressString * p)
-{
-        sprintf(p->c, "%02X%02X-%02X%02X", addr->c[2], addr->c[3],
-                addr->c[4], addr->c[5]);
-        return (p->c);
-}
-
-/*
- * Note: Must make sure sx_size is big enough to receive a stuffed
- * MAX_RECV_MTU packet. Additionally, we also want to ensure that it's
- * big enough to receive a large radio neighbour list (currently 4K).
- */
-
-static int allocate_buffers(struct strip *strip_info, int mtu)
-{
-        struct net_device *dev = strip_info->dev;
-        int sx_size = max_t(int, STRIP_ENCAP_SIZE(MAX_RECV_MTU), 4096);
-        int tx_size = STRIP_ENCAP_SIZE(mtu) + MaxCommandStringLength;
-        __u8 *r = kmalloc(MAX_RECV_MTU, GFP_ATOMIC);
-        __u8 *s = kmalloc(sx_size, GFP_ATOMIC);
-        __u8 *t = kmalloc(tx_size, GFP_ATOMIC);
-        if (r && s && t) {
-                strip_info->rx_buff = r;
-                strip_info->sx_buff = s;
-                strip_info->tx_buff = t;
-                strip_info->sx_size = sx_size;
-                strip_info->tx_size = tx_size;
-                strip_info->mtu = dev->mtu = mtu;
-                return (1);
-        }
-        kfree(r);
-        kfree(s);
-        kfree(t);
-        return (0);
-}
-
-/*
- * MTU has been changed by the IP layer. 
- * We could be in
- * an upcall from the tty driver, or in an ip packet queue.
- */
-static int strip_change_mtu(struct net_device *dev, int new_mtu)
-{
-        struct strip *strip_info = netdev_priv(dev);
-        int old_mtu = strip_info->mtu;
-        unsigned char *orbuff = strip_info->rx_buff;
-        unsigned char *osbuff = strip_info->sx_buff;
-        unsigned char *otbuff = strip_info->tx_buff;
-
-        if (new_mtu > MAX_SEND_MTU) {
-                printk(KERN_ERR
-                       "%s: MTU exceeds maximum allowable (%d), MTU change cancelled.\n",
-                       strip_info->dev->name, MAX_SEND_MTU);
-                return -EINVAL;
-        }
-
-        spin_lock_bh(&strip_lock);
-        if (!allocate_buffers(strip_info, new_mtu)) {
-                printk(KERN_ERR "%s: unable to grow strip buffers, MTU change cancelled.\n",
-                       strip_info->dev->name);
-                spin_unlock_bh(&strip_lock);
-                return -ENOMEM;
-        }
-
-        if (strip_info->sx_count) {
-                if (strip_info->sx_count <= strip_info->sx_size)
-                        memcpy(strip_info->sx_buff, osbuff,
-                               strip_info->sx_count);
-                else {
-                        strip_info->discard = strip_info->sx_count;
-                        strip_info->rx_over_errors++;
-                }
-        }
-
-        if (strip_info->tx_left) {
-                if (strip_info->tx_left <= strip_info->tx_size)
-                        memcpy(strip_info->tx_buff, strip_info->tx_head,
-                               strip_info->tx_left);
-                else {
-                        strip_info->tx_left = 0;
-                        strip_info->tx_dropped++;
-                }
-        }
-        strip_info->tx_head = strip_info->tx_buff;
-        spin_unlock_bh(&strip_lock);
-
-        printk(KERN_NOTICE "%s: strip MTU changed fom %d to %d.\n",
-               strip_info->dev->name, old_mtu, strip_info->mtu);
-
-        kfree(orbuff);
-        kfree(osbuff);
-        kfree(otbuff);
-        return 0;
-}
-
-static void strip_unlock(struct strip *strip_info)
-{
-        /*
-         * Set the timer to go off in one second.
-         */
-        strip_info->idle_timer.expires = jiffies + 1 * HZ;
-        add_timer(&strip_info->idle_timer);
-        netif_wake_queue(strip_info->dev);
-}
-
-
-
-/*
- * If the time is in the near future, time_delta prints the number of
- * seconds to go into the buffer and returns the address of the buffer.
- * If the time is not in the near future, it returns the address of the
- * string "Not scheduled" The buffer must be long enough to contain the
- * ascii representation of the number plus 9 charactes for the " seconds"
- * and the null character.
- */
-#ifdef CONFIG_PROC_FS
-static char *time_delta(char buffer[], long time)
-{
-        time -= jiffies;
-        if (time > LongTime / 2)
-                return ("Not scheduled");
-        if (time < 0)
-                time = 0;       /* Don't print negative times */
-        sprintf(buffer, "%ld seconds", time / HZ);
-        return (buffer);
-}
-
-/* get Nth element of the linked list */
-static struct strip *strip_get_idx(loff_t pos) 
-{
-        struct strip *str;
-        int i = 0;
-
-        list_for_each_entry_rcu(str, &strip_list, list) {
-                if (pos == i)
-                        return str;
-                ++i;
-        }
-        return NULL;
-}
-
-static void *strip_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(RCU)
-{
-        rcu_read_lock();
-        return *pos ? strip_get_idx(*pos - 1) : SEQ_START_TOKEN;
-}
-
-static void *strip_seq_next(struct seq_file *seq, void *v, loff_t *pos)
-{
-        struct list_head *l;
-        struct strip *s;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN)
-                return strip_get_idx(1);
-
-        s = v;
-        l = &s->list;
-        list_for_each_continue_rcu(l, &strip_list) {
-                return list_entry(l, struct strip, list);
-        }
-        return NULL;
-}
-
-static void strip_seq_stop(struct seq_file *seq, void *v)
-        __releases(RCU)
-{
-        rcu_read_unlock();
-}
-
-static void strip_seq_neighbours(struct seq_file *seq,
-                           const MetricomNodeTable * table,
-                           const char *title)
-{
-        /* We wrap this in a do/while loop, so if the table changes */
-        /* while we're reading it, we just go around and try again. */
-        struct timeval t;
-
-        do {
-                int i;
-                t = table->timestamp;
-                if (table->num_nodes)
-                        seq_printf(seq, "\n %s\n", title);
-                for (i = 0; i < table->num_nodes; i++) {
-                        MetricomNode node;
-
-                        spin_lock_bh(&strip_lock);
-                        node = table->node[i];
-                        spin_unlock_bh(&strip_lock);
-                        seq_printf(seq, "  %s\n", node.c);
-                }
-        } while (table->timestamp.tv_sec != t.tv_sec
-                 || table->timestamp.tv_usec != t.tv_usec);
-}
-
-/*
- * This function prints radio status information via the seq_file
- * interface.  The interface takes care of buffer size and over
- * run issues. 
- *
- * The buffer in seq_file is PAGESIZE (4K) 
- * so this routine should never print more or it will get truncated.
- * With the maximum of 32 portables and 32 poletops
- * reported, the routine outputs 3107 bytes into the buffer.
- */
-static void strip_seq_status_info(struct seq_file *seq, 
-                                  const struct strip *strip_info)
-{
-        char temp[32];
-        MetricomAddressString addr_string;
-
-        /* First, we must copy all of our data to a safe place, */
-        /* in case a serial interrupt comes in and changes it.  */
-        int tx_left = strip_info->tx_left;
-        unsigned long rx_average_pps = strip_info->rx_average_pps;
-        unsigned long tx_average_pps = strip_info->tx_average_pps;
-        unsigned long sx_average_pps = strip_info->sx_average_pps;
-        int working = strip_info->working;
-        int firmware_level = strip_info->firmware_level;
-        long watchdog_doprobe = strip_info->watchdog_doprobe;
-        long watchdog_doreset = strip_info->watchdog_doreset;
-        long gratuitous_arp = strip_info->gratuitous_arp;
-        long arp_interval = strip_info->arp_interval;
-        FirmwareVersion firmware_version = strip_info->firmware_version;
-        SerialNumber serial_number = strip_info->serial_number;
-        BatteryVoltage battery_voltage = strip_info->battery_voltage;
-        char *if_name = strip_info->dev->name;
-        MetricomAddress true_dev_addr = strip_info->true_dev_addr;
-        MetricomAddress dev_dev_addr =
-            *(MetricomAddress *) strip_info->dev->dev_addr;
-        int manual_dev_addr = strip_info->manual_dev_addr;
-#ifdef EXT_COUNTERS
-        unsigned long rx_bytes = strip_info->rx_bytes;
-        unsigned long tx_bytes = strip_info->tx_bytes;
-        unsigned long rx_rbytes = strip_info->rx_rbytes;
-        unsigned long tx_rbytes = strip_info->tx_rbytes;
-        unsigned long rx_sbytes = strip_info->rx_sbytes;
-        unsigned long tx_sbytes = strip_info->tx_sbytes;
-        unsigned long rx_ebytes = strip_info->rx_ebytes;
-        unsigned long tx_ebytes = strip_info->tx_ebytes;
-#endif
-
-        seq_printf(seq, "\nInterface name\t\t%s\n", if_name);
-        seq_printf(seq, " Radio working:\t\t%s\n", working ? "Yes" : "No");
-        radio_address_to_string(&true_dev_addr, &addr_string);
-        seq_printf(seq, " Radio address:\t\t%s\n", addr_string.c);
-        if (manual_dev_addr) {
-                radio_address_to_string(&dev_dev_addr, &addr_string);
-                seq_printf(seq, " Device address:\t%s\n", addr_string.c);
-        }
-        seq_printf(seq, " Firmware version:\t%s", !working ? "Unknown" :
-                     !firmware_level ? "Should be upgraded" :
-                     firmware_version.c);
-        if (firmware_level >= ChecksummedMessages)
-                seq_printf(seq, " (Checksums Enabled)");
-        seq_printf(seq, "\n");
-        seq_printf(seq, " Serial number:\t\t%s\n", serial_number.c);
-        seq_printf(seq, " Battery voltage:\t%s\n", battery_voltage.c);
-        seq_printf(seq, " Transmit queue (bytes):%d\n", tx_left);
-        seq_printf(seq, " Receive packet rate:   %ld packets per second\n",
-                     rx_average_pps / 8);
-        seq_printf(seq, " Transmit packet rate:  %ld packets per second\n",
-                     tx_average_pps / 8);
-        seq_printf(seq, " Sent packet rate:      %ld packets per second\n",
-                     sx_average_pps / 8);
-        seq_printf(seq, " Next watchdog probe:\t%s\n",
-                     time_delta(temp, watchdog_doprobe));
-        seq_printf(seq, " Next watchdog reset:\t%s\n",
-                     time_delta(temp, watchdog_doreset));
-        seq_printf(seq, " Next gratuitous ARP:\t");
-
-        if (!memcmp
-            (strip_info->dev->dev_addr, zero_address.c,
-             sizeof(zero_address)))
-                seq_printf(seq, "Disabled\n");
-        else {
-                seq_printf(seq, "%s\n", time_delta(temp, gratuitous_arp));
-                seq_printf(seq, " Next ARP interval:\t%ld seconds\n",
-                             JIFFIE_TO_SEC(arp_interval));
-        }
-
-        if (working) {
-#ifdef EXT_COUNTERS
-                seq_printf(seq, "\n");
-                seq_printf(seq,
-                             " Total bytes:         \trx:\t%lu\ttx:\t%lu\n",
-                             rx_bytes, tx_bytes);
-                seq_printf(seq,
-                             "  thru radio:         \trx:\t%lu\ttx:\t%lu\n",
-                             rx_rbytes, tx_rbytes);
-                seq_printf(seq,
-                             "  thru serial port:   \trx:\t%lu\ttx:\t%lu\n",
-                             rx_sbytes, tx_sbytes);
-                seq_printf(seq,
-                             " Total stat/err bytes:\trx:\t%lu\ttx:\t%lu\n",
-                             rx_ebytes, tx_ebytes);
-#endif
-                strip_seq_neighbours(seq, &strip_info->poletops,
-                                        "Poletops:");
-                strip_seq_neighbours(seq, &strip_info->portables,
-                                        "Portables:");
-        }
-}
-
-/*
- * This function is exports status information from the STRIP driver through
- * the /proc file system.
- */
-static int strip_seq_show(struct seq_file *seq, void *v)
-{
-        if (v == SEQ_START_TOKEN)
-                seq_printf(seq, "strip_version: %s\n", StripVersion);
-        else
-                strip_seq_status_info(seq, (const struct strip *)v);
-        return 0;
-}
-
-
-static const struct seq_operations strip_seq_ops = {
-        .start = strip_seq_start,
-        .next  = strip_seq_next,
-        .stop  = strip_seq_stop,
-        .show  = strip_seq_show,
-};
-
-static int strip_seq_open(struct inode *inode, struct file *file)
-{
-        return seq_open(file, &strip_seq_ops);
-}
-
-static const struct file_operations strip_seq_fops = {
-        .owner   = THIS_MODULE,
-        .open    = strip_seq_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = seq_release,
-};
-#endif
-
-
-
-/************************************************************************/
-/* Sending routines                                                     */
-
-static void ResetRadio(struct strip *strip_info)
-{
-        struct tty_struct *tty = strip_info->tty;
-        static const char init[] = "ate0q1dt**starmode\r**";
-        StringDescriptor s = { init, sizeof(init) - 1 };
-
-        /* 
-         * If the radio isn't working anymore,
-         * we should clear the old status information.
-         */
-        if (strip_info->working) {
-                printk(KERN_INFO "%s: No response: Resetting radio.\n",
-                       strip_info->dev->name);
-                strip_info->firmware_version.c[0] = '\0';
-                strip_info->serial_number.c[0] = '\0';
-                strip_info->battery_voltage.c[0] = '\0';
-                strip_info->portables.num_nodes = 0;
-                do_gettimeofday(&strip_info->portables.timestamp);
-                strip_info->poletops.num_nodes = 0;
-                do_gettimeofday(&strip_info->poletops.timestamp);
-        }
-
-        strip_info->pps_timer = jiffies;
-        strip_info->rx_pps_count = 0;
-        strip_info->tx_pps_count = 0;
-        strip_info->sx_pps_count = 0;
-        strip_info->rx_average_pps = 0;
-        strip_info->tx_average_pps = 0;
-        strip_info->sx_average_pps = 0;
-
-        /* Mark radio address as unknown */
-        *(MetricomAddress *) & strip_info->true_dev_addr = zero_address;
-        if (!strip_info->manual_dev_addr)
-                *(MetricomAddress *) strip_info->dev->dev_addr =
-                    zero_address;
-        strip_info->working = FALSE;
-        strip_info->firmware_level = NoStructure;
-        strip_info->next_command = CompatibilityCommand;
-        strip_info->watchdog_doprobe = jiffies + 10 * HZ;
-        strip_info->watchdog_doreset = jiffies + 1 * HZ;
-
-        /* If the user has selected a baud rate above 38.4 see what magic we have to do */
-        if (strip_info->user_baud > 38400) {
-                /*
-                 * Subtle stuff: Pay attention :-)
-                 * If the serial port is currently at the user's selected (>38.4) rate,
-                 * then we temporarily switch to 19.2 and issue the ATS304 command
-                 * to tell the radio to switch to the user's selected rate.
-                 * If the serial port is not currently at that rate, that means we just
-                 * issued the ATS304 command last time through, so this time we restore
-                 * the user's selected rate and issue the normal starmode reset string.
-                 */
-                if (strip_info->user_baud == tty_get_baud_rate(tty)) {
-                        static const char b0[] = "ate0q1s304=57600\r";
-                        static const char b1[] = "ate0q1s304=115200\r";
-                        static const StringDescriptor baudstring[2] =
-                            { {b0, sizeof(b0) - 1}
-                        , {b1, sizeof(b1) - 1}
-                        };
-                        set_baud(tty, 19200);
-                        if (strip_info->user_baud == 57600)
-                                s = baudstring[0];
-                        else if (strip_info->user_baud == 115200)
-                                s = baudstring[1];
-                        else
-                                s = baudstring[1];      /* For now */
-                } else
-                        set_baud(tty, strip_info->user_baud);
-        }
-
-        tty->ops->write(tty, s.string, s.length);
-#ifdef EXT_COUNTERS
-        strip_info->tx_ebytes += s.length;
-#endif
-}
-
-/*
- * Called by the driver when there's room for more data.  If we have
- * more packets to send, we send them here.
- */
-
-static void strip_write_some_more(struct tty_struct *tty)
-{
-        struct strip *strip_info = tty->disc_data;
-
-        /* First make sure we're connected. */
-        if (!strip_info || strip_info->magic != STRIP_MAGIC ||
-            !netif_running(strip_info->dev))
-                return;
-
-        if (strip_info->tx_left > 0) {
-                int num_written =
-                    tty->ops->write(tty, strip_info->tx_head,
-                                      strip_info->tx_left);
-                strip_info->tx_left -= num_written;
-                strip_info->tx_head += num_written;
-#ifdef EXT_COUNTERS
-                strip_info->tx_sbytes += num_written;
-#endif
-        } else {                /* Else start transmission of another packet */
-
-                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
-                strip_unlock(strip_info);
-        }
-}
-
-static __u8 *add_checksum(__u8 * buffer, __u8 * end)
-{
-        __u16 sum = 0;
-        __u8 *p = buffer;
-        while (p < end)
-                sum += *p++;
-        end[3] = hextable[sum & 0xF];
-        sum >>= 4;
-        end[2] = hextable[sum & 0xF];
-        sum >>= 4;
-        end[1] = hextable[sum & 0xF];
-        sum >>= 4;
-        end[0] = hextable[sum & 0xF];
-        return (end + 4);
-}
-
-static unsigned char *strip_make_packet(unsigned char *buffer,
-                                        struct strip *strip_info,
-                                        struct sk_buff *skb)
-{
-        __u8 *ptr = buffer;
-        __u8 *stuffstate = NULL;
-        STRIP_Header *header = (STRIP_Header *) skb->data;
-        MetricomAddress haddr = header->dst_addr;
-        int len = skb->len - sizeof(STRIP_Header);
-        MetricomKey key;
-
-        /*HexDump("strip_make_packet", strip_info, skb->data, skb->data + skb->len); */
-
-        if (header->protocol == htons(ETH_P_IP))
-                key = SIP0Key;
-        else if (header->protocol == htons(ETH_P_ARP))
-                key = ARP0Key;
-        else {
-                printk(KERN_ERR
-                       "%s: strip_make_packet: Unknown packet type 0x%04X\n",
-                       strip_info->dev->name, ntohs(header->protocol));
-                return (NULL);
-        }
-
-        if (len > strip_info->mtu) {
-                printk(KERN_ERR
-                       "%s: Dropping oversized transmit packet: %d bytes\n",
-                       strip_info->dev->name, len);
-                return (NULL);
-        }
-
-        /*
-         * If we're sending to ourselves, discard the packet.
-         * (Metricom radios choke if they try to send a packet to their own address.)
-         */
-        if (!memcmp(haddr.c, strip_info->true_dev_addr.c, sizeof(haddr))) {
-                printk(KERN_ERR "%s: Dropping packet addressed to self\n",
-                       strip_info->dev->name);
-                return (NULL);
-        }
-
-        /*
-         * If this is a broadcast packet, send it to our designated Metricom
-         * 'broadcast hub' radio (First byte of address being 0xFF means broadcast)
-         */
-        if (haddr.c[0] == 0xFF) {
-                __be32 brd = 0;
-                struct in_device *in_dev;
-
-                rcu_read_lock();
-                in_dev = __in_dev_get_rcu(strip_info->dev);
-                if (in_dev == NULL) {
-                        rcu_read_unlock();
-                        return NULL;
-                }
-                if (in_dev->ifa_list)
-                        brd = in_dev->ifa_list->ifa_broadcast;
-                rcu_read_unlock();
-
-                /* arp_query returns 1 if it succeeds in looking up the address, 0 if it fails */
-                if (!arp_query(haddr.c, brd, strip_info->dev)) {
-                        printk(KERN_ERR
-                               "%s: Unable to send packet (no broadcast hub configured)\n",
-                               strip_info->dev->name);
-                        return (NULL);
-                }
-                /*
-                 * If we are the broadcast hub, don't bother sending to ourselves.
-                 * (Metricom radios choke if they try to send a packet to their own address.)
-                 */
-                if (!memcmp
-                    (haddr.c, strip_info->true_dev_addr.c, sizeof(haddr)))
-                        return (NULL);
-        }
-
-        *ptr++ = 0x0D;
-        *ptr++ = '*';
-        *ptr++ = hextable[haddr.c[2] >> 4];
-        *ptr++ = hextable[haddr.c[2] & 0xF];
-        *ptr++ = hextable[haddr.c[3] >> 4];
-        *ptr++ = hextable[haddr.c[3] & 0xF];
-        *ptr++ = '-';
-        *ptr++ = hextable[haddr.c[4] >> 4];
-        *ptr++ = hextable[haddr.c[4] & 0xF];
-        *ptr++ = hextable[haddr.c[5] >> 4];
-        *ptr++ = hextable[haddr.c[5] & 0xF];
-        *ptr++ = '*';
-        *ptr++ = key.c[0];
-        *ptr++ = key.c[1];
-        *ptr++ = key.c[2];
-        *ptr++ = key.c[3];
-
-        ptr =
-            StuffData(skb->data + sizeof(STRIP_Header), len, ptr,
-                      &stuffstate);
-
-        if (strip_info->firmware_level >= ChecksummedMessages)
-                ptr = add_checksum(buffer + 1, ptr);
-
-        *ptr++ = 0x0D;
-        return (ptr);
-}
-
-static void strip_send(struct strip *strip_info, struct sk_buff *skb)
-{
-        MetricomAddress haddr;
-        unsigned char *ptr = strip_info->tx_buff;
-        int doreset = (long) jiffies - strip_info->watchdog_doreset >= 0;
-        int doprobe = (long) jiffies - strip_info->watchdog_doprobe >= 0
-            && !doreset;
-        __be32 addr, brd;
-
-        /*
-         * 1. If we have a packet, encapsulate it and put it in the buffer
-         */
-        if (skb) {
-                char *newptr = strip_make_packet(ptr, strip_info, skb);
-                strip_info->tx_pps_count++;
-                if (!newptr)
-                        strip_info->tx_dropped++;
-                else {
-                        ptr = newptr;
-                        strip_info->sx_pps_count++;
-                        strip_info->tx_packets++;       /* Count another successful packet */
-#ifdef EXT_COUNTERS
-                        strip_info->tx_bytes += skb->len;
-                        strip_info->tx_rbytes += ptr - strip_info->tx_buff;
-#endif
-                        /*DumpData("Sending:", strip_info, strip_info->tx_buff, ptr); */
-                        /*HexDump("Sending", strip_info, strip_info->tx_buff, ptr); */
-                }
-        }
-
-        /*
-         * 2. If it is time for another tickle, tack it on, after the packet
-         */
-        if (doprobe) {
-                StringDescriptor ts = CommandString[strip_info->next_command];
-#if TICKLE_TIMERS
-                {
-                        struct timeval tv;
-                        do_gettimeofday(&tv);
-                        printk(KERN_INFO "**** Sending tickle string %d      at %02d.%06d\n",
-                               strip_info->next_command, tv.tv_sec % 100,
-                               tv.tv_usec);
-                }
-#endif
-                if (ptr == strip_info->tx_buff)
-                        *ptr++ = 0x0D;
-
-                *ptr++ = '*';   /* First send "**" to provoke an error message */
-                *ptr++ = '*';
-
-                /* Then add the command */
-                memcpy(ptr, ts.string, ts.length);
-
-                /* Add a checksum ? */
-                if (strip_info->firmware_level < ChecksummedMessages)
-                        ptr += ts.length;
-                else
-                        ptr = add_checksum(ptr, ptr + ts.length);
-
-                *ptr++ = 0x0D;  /* Terminate the command with a <CR> */
-
-                /* Cycle to next periodic command? */
-                if (strip_info->firmware_level >= StructuredMessages)
-                        if (++strip_info->next_command >=
-                            ARRAY_SIZE(CommandString))
-                                strip_info->next_command = 0;
-#ifdef EXT_COUNTERS
-                strip_info->tx_ebytes += ts.length;
-#endif
-                strip_info->watchdog_doprobe = jiffies + 10 * HZ;
-                strip_info->watchdog_doreset = jiffies + 1 * HZ;
-                /*printk(KERN_INFO "%s: Routine radio test.\n", strip_info->dev->name); */
-        }
-
-        /*
-         * 3. Set up the strip_info ready to send the data (if any).
-         */
-        strip_info->tx_head = strip_info->tx_buff;
-        strip_info->tx_left = ptr - strip_info->tx_buff;
-        set_bit(TTY_DO_WRITE_WAKEUP, &strip_info->tty->flags);
-        /*
-         * 4. Debugging check to make sure we're not overflowing the buffer.
-         */
-        if (strip_info->tx_size - strip_info->tx_left < 20)
-                printk(KERN_ERR "%s: Sending%5d bytes;%5d bytes free.\n",
-                       strip_info->dev->name, strip_info->tx_left,
-                       strip_info->tx_size - strip_info->tx_left);
-
-        /*
-         * 5. If watchdog has expired, reset the radio. Note: if there's data waiting in
-         * the buffer, strip_write_some_more will send it after the reset has finished
-         */
-        if (doreset) {
-                ResetRadio(strip_info);
-                return;
-        }
-
-        if (1) {
-                struct in_device *in_dev;
-
-                brd = addr = 0;
-                rcu_read_lock();
-                in_dev = __in_dev_get_rcu(strip_info->dev);
-                if (in_dev) {
-                        if (in_dev->ifa_list) {
-                                brd = in_dev->ifa_list->ifa_broadcast;
-                                addr = in_dev->ifa_list->ifa_local;
-                        }
-                }
-                rcu_read_unlock();
-        }
-
-
-        /*
-         * 6. If it is time for a periodic ARP, queue one up to be sent.
-         * We only do this if:
-         *  1. The radio is working
-         *  2. It's time to send another periodic ARP
-         *  3. We really know what our address is (and it is not manually set to zero)
-         *  4. We have a designated broadcast address configured
-         * If we queue up an ARP packet when we don't have a designated broadcast
-         * address configured, then the packet will just have to be discarded in
-         * strip_make_packet. This is not fatal, but it causes misleading information
-         * to be displayed in tcpdump. tcpdump will report that periodic APRs are
-         * being sent, when in fact they are not, because they are all being dropped
-         * in the strip_make_packet routine.
-         */
-        if (strip_info->working
-            && (long) jiffies - strip_info->gratuitous_arp >= 0
-            && memcmp(strip_info->dev->dev_addr, zero_address.c,
-                      sizeof(zero_address))
-            && arp_query(haddr.c, brd, strip_info->dev)) {
-                /*printk(KERN_INFO "%s: Sending gratuitous ARP with interval %ld\n",
-                   strip_info->dev->name, strip_info->arp_interval / HZ); */
-                strip_info->gratuitous_arp =
-                    jiffies + strip_info->arp_interval;
-                strip_info->arp_interval *= 2;
-                if (strip_info->arp_interval > MaxARPInterval)
-                        strip_info->arp_interval = MaxARPInterval;
-                if (addr)
-                        arp_send(ARPOP_REPLY, ETH_P_ARP, addr,  /* Target address of ARP packet is our address */
-                                 strip_info->dev,       /* Device to send packet on */
-                                 addr,  /* Source IP address this ARP packet comes from */
-                                 NULL,  /* Destination HW address is NULL (broadcast it) */
-                                 strip_info->dev->dev_addr,     /* Source HW address is our HW address */
-                                 strip_info->dev->dev_addr);    /* Target HW address is our HW address (redundant) */
-        }
-
-        /*
-         * 7. All ready. Start the transmission
-         */
-        strip_write_some_more(strip_info->tty);
-}
-
-/* Encapsulate a datagram and kick it into a TTY queue. */
-static netdev_tx_t strip_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-        struct strip *strip_info = netdev_priv(dev);
-
-        if (!netif_running(dev)) {
-                printk(KERN_ERR "%s: xmit call when iface is down\n",
-                       dev->name);
-                return NETDEV_TX_BUSY;
-        }
-
-        netif_stop_queue(dev);
-
-        del_timer(&strip_info->idle_timer);
-
-
-        if (time_after(jiffies, strip_info->pps_timer + HZ)) {
-                unsigned long t = jiffies - strip_info->pps_timer;
-                unsigned long rx_pps_count =
-                        DIV_ROUND_CLOSEST(strip_info->rx_pps_count*HZ*8, t);
-                unsigned long tx_pps_count =
-                        DIV_ROUND_CLOSEST(strip_info->tx_pps_count*HZ*8, t);
-                unsigned long sx_pps_count =
-                        DIV_ROUND_CLOSEST(strip_info->sx_pps_count*HZ*8, t);
-
-                strip_info->pps_timer = jiffies;
-                strip_info->rx_pps_count = 0;
-                strip_info->tx_pps_count = 0;
-                strip_info->sx_pps_count = 0;
-
-                strip_info->rx_average_pps = (strip_info->rx_average_pps + rx_pps_count + 1) / 2;
-                strip_info->tx_average_pps = (strip_info->tx_average_pps + tx_pps_count + 1) / 2;
-                strip_info->sx_average_pps = (strip_info->sx_average_pps + sx_pps_count + 1) / 2;
-
-                if (rx_pps_count / 8 >= 10)
-                        printk(KERN_INFO "%s: WARNING: Receiving %ld packets per second.\n",
-                               strip_info->dev->name, rx_pps_count / 8);
-                if (tx_pps_count / 8 >= 10)
-                        printk(KERN_INFO "%s: WARNING: Tx        %ld packets per second.\n",
-                               strip_info->dev->name, tx_pps_count / 8);
-                if (sx_pps_count / 8 >= 10)
-                        printk(KERN_INFO "%s: WARNING: Sending   %ld packets per second.\n",
-                               strip_info->dev->name, sx_pps_count / 8);
-        }
-
-        spin_lock_bh(&strip_lock);
-
-        strip_send(strip_info, skb);
-
-        spin_unlock_bh(&strip_lock);
-
-        if (skb)
-                dev_kfree_skb(skb);
-        return NETDEV_TX_OK;
-}
-
-/*
- * IdleTask periodically calls strip_xmit, so even when we have no IP packets
- * to send for an extended period of time, the watchdog processing still gets
- * done to ensure that the radio stays in Starmode
- */
-
-static void strip_IdleTask(unsigned long parameter)
-{
-        strip_xmit(NULL, (struct net_device *) parameter);
-}
-
-/*
- * Create the MAC header for an arbitrary protocol layer
- *
- * saddr!=NULL        means use this specific address (n/a for Metricom)
- * saddr==NULL        means use default device source address
- * daddr!=NULL        means use this destination address
- * daddr==NULL        means leave destination address alone
- *                 (e.g. unresolved arp -- kernel will call
- *                 rebuild_header later to fill in the address)
- */
-
-static int strip_header(struct sk_buff *skb, struct net_device *dev,
-                        unsigned short type, const void *daddr,
-                        const void *saddr, unsigned len)
-{
-        struct strip *strip_info = netdev_priv(dev);
-        STRIP_Header *header = (STRIP_Header *) skb_push(skb, sizeof(STRIP_Header));
-
-        /*printk(KERN_INFO "%s: strip_header 0x%04X %s\n", dev->name, type,
-           type == ETH_P_IP ? "IP" : type == ETH_P_ARP ? "ARP" : ""); */
-
-        header->src_addr = strip_info->true_dev_addr;
-        header->protocol = htons(type);
-
-        /*HexDump("strip_header", netdev_priv(dev), skb->data, skb->data + skb->len); */
-
-        if (!daddr)
-                return (-dev->hard_header_len);
-
-        header->dst_addr = *(MetricomAddress *) daddr;
-        return (dev->hard_header_len);
-}
-
-/*
- * Rebuild the MAC header. This is called after an ARP
- * (or in future other address resolution) has completed on this
- * sk_buff. We now let ARP fill in the other fields.
- * I think this should return zero if packet is ready to send,
- * or non-zero if it needs more time to do an address lookup
- */
-
-static int strip_rebuild_header(struct sk_buff *skb)
-{
-#ifdef CONFIG_INET
-        STRIP_Header *header = (STRIP_Header *) skb->data;
-
-        /* Arp find returns zero if if knows the address, */
-        /* or if it doesn't know the address it sends an ARP packet and returns non-zero */
-        return arp_find(header->dst_addr.c, skb) ? 1 : 0;
-#else
-        return 0;
-#endif
-}
-
-
-/************************************************************************/
-/* Receiving routines                                                   */
-
-/*
- * This function parses the response to the ATS300? command,
- * extracting the radio version and serial number.
- */
-static void get_radio_version(struct strip *strip_info, __u8 * ptr, __u8 * end)
-{
-        __u8 *p, *value_begin, *value_end;
-        int len;
-
-        /* Determine the beginning of the second line of the payload */
-        p = ptr;
-        while (p < end && *p != 10)
-                p++;
-        if (p >= end)
-                return;
-        p++;
-        value_begin = p;
-
-        /* Determine the end of line */
-        while (p < end && *p != 10)
-                p++;
-        if (p >= end)
-                return;
-        value_end = p;
-        p++;
-
-        len = value_end - value_begin;
-        len = min_t(int, len, sizeof(FirmwareVersion) - 1);
-        if (strip_info->firmware_version.c[0] == 0)
-                printk(KERN_INFO "%s: Radio Firmware: %.*s\n",
-                       strip_info->dev->name, len, value_begin);
-        sprintf(strip_info->firmware_version.c, "%.*s", len, value_begin);
-
-        /* Look for the first colon */
-        while (p < end && *p != ':')
-                p++;
-        if (p >= end)
-                return;
-        /* Skip over the space */
-        p += 2;
-        len = sizeof(SerialNumber) - 1;
-        if (p + len <= end) {
-                sprintf(strip_info->serial_number.c, "%.*s", len, p);
-        } else {
-                printk(KERN_DEBUG
-                       "STRIP: radio serial number shorter (%zd) than expected (%d)\n",
-                       end - p, len);
-        }
-}
-
-/*
- * This function parses the response to the ATS325? command,
- * extracting the radio battery voltage.
- */
-static void get_radio_voltage(struct strip *strip_info, __u8 * ptr, __u8 * end)
-{
-        int len;
-
-        len = sizeof(BatteryVoltage) - 1;
-        if (ptr + len <= end) {
-                sprintf(strip_info->battery_voltage.c, "%.*s", len, ptr);
-        } else {
-                printk(KERN_DEBUG
-                       "STRIP: radio voltage string shorter (%zd) than expected (%d)\n",
-                       end - ptr, len);
-        }
-}
-
-/*
- * This function parses the responses to the AT~LA and ATS311 commands,
- * which list the radio's neighbours.
- */
-static void get_radio_neighbours(MetricomNodeTable * table, __u8 * ptr, __u8 * end)
-{
-        table->num_nodes = 0;
-        while (ptr < end && table->num_nodes < NODE_TABLE_SIZE) {
-                MetricomNode *node = &table->node[table->num_nodes++];
-                char *dst = node->c, *limit = dst + sizeof(*node) - 1;
-                while (ptr < end && *ptr <= 32)
-                        ptr++;
-                while (ptr < end && dst < limit && *ptr != 10)
-                        *dst++ = *ptr++;
-                *dst++ = 0;
-                while (ptr < end && ptr[-1] != 10)
-                        ptr++;
-        }
-        do_gettimeofday(&table->timestamp);
-}
-
-static int get_radio_address(struct strip *strip_info, __u8 * p)
-{
-        MetricomAddress addr;
-
-        if (string_to_radio_address(&addr, p))
-                return (1);
-
-        /* See if our radio address has changed */
-        if (memcmp(strip_info->true_dev_addr.c, addr.c, sizeof(addr))) {
-                MetricomAddressString addr_string;
-                radio_address_to_string(&addr, &addr_string);
-                printk(KERN_INFO "%s: Radio address = %s\n",
-                       strip_info->dev->name, addr_string.c);
-                strip_info->true_dev_addr = addr;
-                if (!strip_info->manual_dev_addr)
-                        *(MetricomAddress *) strip_info->dev->dev_addr =
-                            addr;
-                /* Give the radio a few seconds to get its head straight, then send an arp */
-                strip_info->gratuitous_arp = jiffies + 15 * HZ;
-                strip_info->arp_interval = 1 * HZ;
-        }
-        return (0);
-}
-
-static int verify_checksum(struct strip *strip_info)
-{
-        __u8 *p = strip_info->sx_buff;
-        __u8 *end = strip_info->sx_buff + strip_info->sx_count - 4;
-        u_short sum =
-            (READHEX16(end[0]) << 12) | (READHEX16(end[1]) << 8) |
-            (READHEX16(end[2]) << 4) | (READHEX16(end[3]));
-        while (p < end)
-                sum -= *p++;
-        if (sum == 0 && strip_info->firmware_level == StructuredMessages) {
-                strip_info->firmware_level = ChecksummedMessages;
-                printk(KERN_INFO "%s: Radio provides message checksums\n",
-                       strip_info->dev->name);
-        }
-        return (sum == 0);
-}
-
-static void RecvErr(char *msg, struct strip *strip_info)
-{
-        __u8 *ptr = strip_info->sx_buff;
-        __u8 *end = strip_info->sx_buff + strip_info->sx_count;
-        DumpData(msg, strip_info, ptr, end);
-        strip_info->rx_errors++;
-}
-
-static void RecvErr_Message(struct strip *strip_info, __u8 * sendername,
-                            const __u8 * msg, u_long len)
-{
-        if (has_prefix(msg, len, "001")) {      /* Not in StarMode! */
-                RecvErr("Error Msg:", strip_info);
-                printk(KERN_INFO "%s: Radio %s is not in StarMode\n",
-                       strip_info->dev->name, sendername);
-        }
-
-        else if (has_prefix(msg, len, "002")) { /* Remap handle */
-                /* We ignore "Remap handle" messages for now */
-        }
-
-        else if (has_prefix(msg, len, "003")) { /* Can't resolve name */
-                RecvErr("Error Msg:", strip_info);
-                printk(KERN_INFO "%s: Destination radio name is unknown\n",
-                       strip_info->dev->name);
-        }
-
-        else if (has_prefix(msg, len, "004")) { /* Name too small or missing */
-                strip_info->watchdog_doreset = jiffies + LongTime;
-#if TICKLE_TIMERS
-                {
-                        struct timeval tv;
-                        do_gettimeofday(&tv);
-                        printk(KERN_INFO
-                               "**** Got ERR_004 response         at %02d.%06d\n",
-                               tv.tv_sec % 100, tv.tv_usec);
-                }
-#endif
-                if (!strip_info->working) {
-                        strip_info->working = TRUE;
-                        printk(KERN_INFO "%s: Radio now in starmode\n",
-                               strip_info->dev->name);
-                        /*
-                         * If the radio has just entered a working state, we should do our first
-                         * probe ASAP, so that we find out our radio address etc. without delay.
-                         */
-                        strip_info->watchdog_doprobe = jiffies;
-                }
-                if (strip_info->firmware_level == NoStructure && sendername) {
-                        strip_info->firmware_level = StructuredMessages;
-                        strip_info->next_command = 0;   /* Try to enable checksums ASAP */
-                        printk(KERN_INFO
-                               "%s: Radio provides structured messages\n",
-                               strip_info->dev->name);
-                }
-                if (strip_info->firmware_level >= StructuredMessages) {
-                        /*
-                         * If this message has a valid checksum on the end, then the call to verify_checksum
-                         * will elevate the firmware_level to ChecksummedMessages for us. (The actual return
-                         * code from verify_checksum is ignored here.)
-                         */
-                        verify_checksum(strip_info);
-                        /*
-                         * If the radio has structured messages but we don't yet have all our information about it,
-                         * we should do probes without delay, until we have gathered all the information
-                         */
-                        if (!GOT_ALL_RADIO_INFO(strip_info))
-                                strip_info->watchdog_doprobe = jiffies;
-                }
-        }
-
-        else if (has_prefix(msg, len, "005"))   /* Bad count specification */
-                RecvErr("Error Msg:", strip_info);
-
-        else if (has_prefix(msg, len, "006"))   /* Header too big */
-                RecvErr("Error Msg:", strip_info);
-
-        else if (has_prefix(msg, len, "007")) { /* Body too big */
-                RecvErr("Error Msg:", strip_info);
-                printk(KERN_ERR
-                       "%s: Error! Packet size too big for radio.\n",
-                       strip_info->dev->name);
-        }
-
-        else if (has_prefix(msg, len, "008")) { /* Bad character in name */
-                RecvErr("Error Msg:", strip_info);
-                printk(KERN_ERR
-                       "%s: Radio name contains illegal character\n",
-                       strip_info->dev->name);
-        }
-
-        else if (has_prefix(msg, len, "009"))   /* No count or line terminator */
-                RecvErr("Error Msg:", strip_info);
-
-        else if (has_prefix(msg, len, "010"))   /* Invalid checksum */
-                RecvErr("Error Msg:", strip_info);
-
-        else if (has_prefix(msg, len, "011"))   /* Checksum didn't match */
-                RecvErr("Error Msg:", strip_info);
-
-        else if (has_prefix(msg, len, "012"))   /* Failed to transmit packet */
-                RecvErr("Error Msg:", strip_info);
-
-        else
-                RecvErr("Error Msg:", strip_info);
-}
-
-static void process_AT_response(struct strip *strip_info, __u8 * ptr,
-                                __u8 * end)
-{
-        u_long len;
-        __u8 *p = ptr;
-        while (p < end && p[-1] != 10)
-                p++;            /* Skip past first newline character */
-        /* Now ptr points to the AT command, and p points to the text of the response. */
-        len = p - ptr;
-
-#if TICKLE_TIMERS
-        {
-                struct timeval tv;
-                do_gettimeofday(&tv);
-                printk(KERN_INFO "**** Got AT response %.7s      at %02d.%06d\n",
-                       ptr, tv.tv_sec % 100, tv.tv_usec);
-        }
-#endif
-
-        if (has_prefix(ptr, len, "ATS300?"))
-                get_radio_version(strip_info, p, end);
-        else if (has_prefix(ptr, len, "ATS305?"))
-                get_radio_address(strip_info, p);
-        else if (has_prefix(ptr, len, "ATS311?"))
-                get_radio_neighbours(&strip_info->poletops, p, end);
-        else if (has_prefix(ptr, len, "ATS319=7"))
-                verify_checksum(strip_info);
-        else if (has_prefix(ptr, len, "ATS325?"))
-                get_radio_voltage(strip_info, p, end);
-        else if (has_prefix(ptr, len, "AT~LA"))
-                get_radio_neighbours(&strip_info->portables, p, end);
-        else
-                RecvErr("Unknown AT Response:", strip_info);
-}
-
-static void process_ACK(struct strip *strip_info, __u8 * ptr, __u8 * end)
-{
-        /* Currently we don't do anything with ACKs from the radio */
-}
-
-static void process_Info(struct strip *strip_info, __u8 * ptr, __u8 * end)
-{
-        if (ptr + 16 > end)
-                RecvErr("Bad Info Msg:", strip_info);
-}
-
-static struct net_device *get_strip_dev(struct strip *strip_info)
-{
-        /* If our hardware address is *manually set* to zero, and we know our */
-        /* real radio hardware address, try to find another strip device that has been */
-        /* manually set to that address that we can 'transfer ownership' of this packet to  */
-        if (strip_info->manual_dev_addr &&
-            !memcmp(strip_info->dev->dev_addr, zero_address.c,
-                    sizeof(zero_address))
-            && memcmp(&strip_info->true_dev_addr, zero_address.c,
-                      sizeof(zero_address))) {
-                struct net_device *dev;
-                read_lock_bh(&dev_base_lock);
-                for_each_netdev(&init_net, dev) {
-                        if (dev->type == strip_info->dev->type &&
-                            !memcmp(dev->dev_addr,
-                                    &strip_info->true_dev_addr,
-                                    sizeof(MetricomAddress))) {
-                                printk(KERN_INFO
-                                       "%s: Transferred packet ownership to %s.\n",
-                                       strip_info->dev->name, dev->name);
-                                read_unlock_bh(&dev_base_lock);
-                                return (dev);
-                        }
-                }
-                read_unlock_bh(&dev_base_lock);
-        }
-        return (strip_info->dev);
-}
-
-/*
- * Send one completely decapsulated datagram to the next layer.
- */
-
-static void deliver_packet(struct strip *strip_info, STRIP_Header * header,
-                           __u16 packetlen)
-{
-        struct sk_buff *skb = dev_alloc_skb(sizeof(STRIP_Header) + packetlen);
-        if (!skb) {
-                printk(KERN_ERR "%s: memory squeeze, dropping packet.\n",
-                       strip_info->dev->name);
-                strip_info->rx_dropped++;
-        } else {
-                memcpy(skb_put(skb, sizeof(STRIP_Header)), header,
-                       sizeof(STRIP_Header));
-                memcpy(skb_put(skb, packetlen), strip_info->rx_buff,
-                       packetlen);
-                skb->dev = get_strip_dev(strip_info);
-                skb->protocol = header->protocol;
-                skb_reset_mac_header(skb);
-
-                /* Having put a fake header on the front of the sk_buff for the */
-                /* benefit of tools like tcpdump, skb_pull now 'consumes' that  */
-                /* fake header before we hand the packet up to the next layer.  */
-                skb_pull(skb, sizeof(STRIP_Header));
-
-                /* Finally, hand the packet up to the next layer (e.g. IP or ARP, etc.) */
-                strip_info->rx_packets++;
-                strip_info->rx_pps_count++;
-#ifdef EXT_COUNTERS
-                strip_info->rx_bytes += packetlen;
-#endif
-                netif_rx(skb);
-        }
-}
-
-static void process_IP_packet(struct strip *strip_info,
-                              STRIP_Header * header, __u8 * ptr,
-                              __u8 * end)
-{
-        __u16 packetlen;
-
-        /* Decode start of the IP packet header */
-        ptr = UnStuffData(ptr, end, strip_info->rx_buff, 4);
-        if (!ptr) {
-                RecvErr("IP Packet too short", strip_info);
-                return;
-        }
-
-        packetlen = ((__u16) strip_info->rx_buff[2] << 8) | strip_info->rx_buff[3];
-
-        if (packetlen > MAX_RECV_MTU) {
-                printk(KERN_INFO "%s: Dropping oversized received IP packet: %d bytes\n",
-                       strip_info->dev->name, packetlen);
-                strip_info->rx_dropped++;
-                return;
-        }
-
-        /*printk(KERN_INFO "%s: Got %d byte IP packet\n", strip_info->dev->name, packetlen); */
-
-        /* Decode remainder of the IP packet */
-        ptr =
-            UnStuffData(ptr, end, strip_info->rx_buff + 4, packetlen - 4);
-        if (!ptr) {
-                RecvErr("IP Packet too short", strip_info);
-                return;
-        }
-
-        if (ptr < end) {
-                RecvErr("IP Packet too long", strip_info);
-                return;
-        }
-
-        header->protocol = htons(ETH_P_IP);
-
-        deliver_packet(strip_info, header, packetlen);
-}
-
-static void process_ARP_packet(struct strip *strip_info,
-                               STRIP_Header * header, __u8 * ptr,
-                               __u8 * end)
-{
-        __u16 packetlen;
-        struct arphdr *arphdr = (struct arphdr *) strip_info->rx_buff;
-
-        /* Decode start of the ARP packet */
-        ptr = UnStuffData(ptr, end, strip_info->rx_buff, 8);
-        if (!ptr) {
-                RecvErr("ARP Packet too short", strip_info);
-                return;
-        }
-
-        packetlen = 8 + (arphdr->ar_hln + arphdr->ar_pln) * 2;
-
-        if (packetlen > MAX_RECV_MTU) {
-                printk(KERN_INFO
-                       "%s: Dropping oversized received ARP packet: %d bytes\n",
-                       strip_info->dev->name, packetlen);
-                strip_info->rx_dropped++;
-                return;
-        }
-
-        /*printk(KERN_INFO "%s: Got %d byte ARP %s\n",
-           strip_info->dev->name, packetlen,
-           ntohs(arphdr->ar_op) == ARPOP_REQUEST ? "request" : "reply"); */
-
-        /* Decode remainder of the ARP packet */
-        ptr =
-            UnStuffData(ptr, end, strip_info->rx_buff + 8, packetlen - 8);
-        if (!ptr) {
-                RecvErr("ARP Packet too short", strip_info);
-                return;
-        }
-
-        if (ptr < end) {
-                RecvErr("ARP Packet too long", strip_info);
-                return;
-        }
-
-        header->protocol = htons(ETH_P_ARP);
-
-        deliver_packet(strip_info, header, packetlen);
-}
-
-/*
- * process_text_message processes a <CR>-terminated block of data received
- * from the radio that doesn't begin with a '*' character. All normal
- * Starmode communication messages with the radio begin with a '*',
- * so any text that does not indicates a serial port error, a radio that
- * is in Hayes command mode instead of Starmode, or a radio with really
- * old firmware that doesn't frame its Starmode responses properly.
- */
-static void process_text_message(struct strip *strip_info)
-{
-        __u8 *msg = strip_info->sx_buff;
-        int len = strip_info->sx_count;
-
-        /* Check for anything that looks like it might be our radio name */
-        /* (This is here for backwards compatibility with old firmware)  */
-        if (len == 9 && get_radio_address(strip_info, msg) == 0)
-                return;
-
-        if (text_equal(msg, len, "OK"))
-                return;         /* Ignore 'OK' responses from prior commands */
-        if (text_equal(msg, len, "ERROR"))
-                return;         /* Ignore 'ERROR' messages */
-        if (has_prefix(msg, len, "ate0q1"))
-                return;         /* Ignore character echo back from the radio */
-
-        /* Catch other error messages */
-        /* (This is here for backwards compatibility with old firmware) */
-        if (has_prefix(msg, len, "ERR_")) {
-                RecvErr_Message(strip_info, NULL, &msg[4], len - 4);
-                return;
-        }
-
-        RecvErr("No initial *", strip_info);
-}
-
-/*
- * process_message processes a <CR>-terminated block of data received
- * from the radio. If the radio is not in Starmode or has old firmware,
- * it may be a line of text in response to an AT command. Ideally, with
- * a current radio that's properly in Starmode, all data received should
- * be properly framed and checksummed radio message blocks, containing
- * either a starmode packet, or a other communication from the radio
- * firmware, like "INF_" Info messages and &COMMAND responses.
- */
-static void process_message(struct strip *strip_info)
-{
-        STRIP_Header header = { zero_address, zero_address, 0 };
-        __u8 *ptr = strip_info->sx_buff;
-        __u8 *end = strip_info->sx_buff + strip_info->sx_count;
-        __u8 sendername[32], *sptr = sendername;
-        MetricomKey key;
-
-        /*HexDump("Receiving", strip_info, ptr, end); */
-
-        /* Check for start of address marker, and then skip over it */
-        if (*ptr == '*')
-                ptr++;
-        else {
-                process_text_message(strip_info);
-                return;
-        }
-
-        /* Copy out the return address */
-        while (ptr < end && *ptr != '*'
-               && sptr < ARRAY_END(sendername) - 1)
-                *sptr++ = *ptr++;
-        *sptr = 0;              /* Null terminate the sender name */
-
-        /* Check for end of address marker, and skip over it */
-        if (ptr >= end || *ptr != '*') {
-                RecvErr("No second *", strip_info);
-                return;
-        }
-        ptr++;                  /* Skip the second '*' */
-
-        /* If the sender name is "&COMMAND", ignore this 'packet'       */
-        /* (This is here for backwards compatibility with old firmware) */
-        if (!strcmp(sendername, "&COMMAND")) {
-                strip_info->firmware_level = NoStructure;
-                strip_info->next_command = CompatibilityCommand;
-                return;
-        }
-
-        if (ptr + 4 > end) {
-                RecvErr("No proto key", strip_info);
-                return;
-        }
-
-        /* Get the protocol key out of the buffer */
-        key.c[0] = *ptr++;
-        key.c[1] = *ptr++;
-        key.c[2] = *ptr++;
-        key.c[3] = *ptr++;
-
-        /* If we're using checksums, verify the checksum at the end of the packet */
-        if (strip_info->firmware_level >= ChecksummedMessages) {
-                end -= 4;       /* Chop the last four bytes off the packet (they're the checksum) */
-                if (ptr > end) {
-                        RecvErr("Missing Checksum", strip_info);
-                        return;
-                }
-                if (!verify_checksum(strip_info)) {
-                        RecvErr("Bad Checksum", strip_info);
-                        return;
-                }
-        }
-
-        /*printk(KERN_INFO "%s: Got packet from \"%s\".\n", strip_info->dev->name, sendername); */
-
-        /*
-         * Fill in (pseudo) source and destination addresses in the packet.
-         * We assume that the destination address was our address (the radio does not
-         * tell us this). If the radio supplies a source address, then we use it.
-         */
-        header.dst_addr = strip_info->true_dev_addr;
-        string_to_radio_address(&header.src_addr, sendername);
-
-#ifdef EXT_COUNTERS
-        if (key.l == SIP0Key.l) {
-                strip_info->rx_rbytes += (end - ptr);
-                process_IP_packet(strip_info, &header, ptr, end);
-        } else if (key.l == ARP0Key.l) {
-                strip_info->rx_rbytes += (end - ptr);
-                process_ARP_packet(strip_info, &header, ptr, end);
-        } else if (key.l == ATR_Key.l) {
-                strip_info->rx_ebytes += (end - ptr);
-                process_AT_response(strip_info, ptr, end);
-        } else if (key.l == ACK_Key.l) {
-                strip_info->rx_ebytes += (end - ptr);
-                process_ACK(strip_info, ptr, end);
-        } else if (key.l == INF_Key.l) {
-                strip_info->rx_ebytes += (end - ptr);
-                process_Info(strip_info, ptr, end);
-        } else if (key.l == ERR_Key.l) {
-                strip_info->rx_ebytes += (end - ptr);
-                RecvErr_Message(strip_info, sendername, ptr, end - ptr);
-        } else
-                RecvErr("Unrecognized protocol key", strip_info);
-#else
-        if (key.l == SIP0Key.l)
-                process_IP_packet(strip_info, &header, ptr, end);
-        else if (key.l == ARP0Key.l)
-                process_ARP_packet(strip_info, &header, ptr, end);
-        else if (key.l == ATR_Key.l)
-                process_AT_response(strip_info, ptr, end);
-        else if (key.l == ACK_Key.l)
-                process_ACK(strip_info, ptr, end);
-        else if (key.l == INF_Key.l)
-                process_Info(strip_info, ptr, end);
-        else if (key.l == ERR_Key.l)
-                RecvErr_Message(strip_info, sendername, ptr, end - ptr);
-        else
-                RecvErr("Unrecognized protocol key", strip_info);
-#endif
-}
-
-#define TTYERROR(X) ((X) == TTY_BREAK   ? "Break"            : \
-                     (X) == TTY_FRAME   ? "Framing Error"    : \
-                     (X) == TTY_PARITY  ? "Parity Error"     : \
-                     (X) == TTY_OVERRUN ? "Hardware Overrun" : "Unknown Error")
-
-/*
- * Handle the 'receiver data ready' interrupt.
- * This function is called by the 'tty_io' module in the kernel when
- * a block of STRIP data has been received, which can now be decapsulated
- * and sent on to some IP layer for further processing.
- */
-
-static void strip_receive_buf(struct tty_struct *tty, const unsigned char *cp,
-                  char *fp, int count)
-{
-        struct strip *strip_info = tty->disc_data;
-        const unsigned char *end = cp + count;
-
-        if (!strip_info || strip_info->magic != STRIP_MAGIC
-            || !netif_running(strip_info->dev))
-                return;
-
-        spin_lock_bh(&strip_lock);
-#if 0
-        {
-                struct timeval tv;
-                do_gettimeofday(&tv);
-                printk(KERN_INFO
-                       "**** strip_receive_buf: %3d bytes at %02d.%06d\n",
-                       count, tv.tv_sec % 100, tv.tv_usec);
-        }
-#endif
-
-#ifdef EXT_COUNTERS
-        strip_info->rx_sbytes += count;
-#endif
-
-        /* Read the characters out of the buffer */
-        while (cp < end) {
-                if (fp && *fp)
-                        printk(KERN_INFO "%s: %s on serial port\n",
-                               strip_info->dev->name, TTYERROR(*fp));
-                if (fp && *fp++ && !strip_info->discard) {      /* If there's a serial error, record it */
-                        /* If we have some characters in the buffer, discard them */
-                        strip_info->discard = strip_info->sx_count;
-                        strip_info->rx_errors++;
-                }
-
-                /* Leading control characters (CR, NL, Tab, etc.) are ignored */
-                if (strip_info->sx_count > 0 || *cp >= ' ') {
-                        if (*cp == 0x0D) {      /* If end of packet, decide what to do with it */
-                                if (strip_info->sx_count > 3000)
-                                        printk(KERN_INFO
-                                               "%s: Cut a %d byte packet (%zd bytes remaining)%s\n",
-                                               strip_info->dev->name,
-                                               strip_info->sx_count,
-                                               end - cp - 1,
-                                               strip_info->
-                                               discard ? " (discarded)" :
-                                               "");
-                                if (strip_info->sx_count >
-                                    strip_info->sx_size) {
-                                        strip_info->rx_over_errors++;
-                                        printk(KERN_INFO
-                                               "%s: sx_buff overflow (%d bytes total)\n",
-                                               strip_info->dev->name,
-                                               strip_info->sx_count);
-                                } else if (strip_info->discard)
-                                        printk(KERN_INFO
-                                               "%s: Discarding bad packet (%d/%d)\n",
-                                               strip_info->dev->name,
-                                               strip_info->discard,
-                                               strip_info->sx_count);
-                                else
-                                        process_message(strip_info);
-                                strip_info->discard = 0;
-                                strip_info->sx_count = 0;
-                        } else {
-                                /* Make sure we have space in the buffer */
-                                if (strip_info->sx_count <
-                                    strip_info->sx_size)
-                                        strip_info->sx_buff[strip_info->
-                                                            sx_count] =
-                                            *cp;
-                                strip_info->sx_count++;
-                        }
-                }
-                cp++;
-        }
-        spin_unlock_bh(&strip_lock);
-}
-
-
-/************************************************************************/
-/* General control routines                                             */
-
-static int set_mac_address(struct strip *strip_info,
-                           MetricomAddress * addr)
-{
-        /*
-         * We're using a manually specified address if the address is set
-         * to anything other than all ones. Setting the address to all ones
-         * disables manual mode and goes back to automatic address determination
-         * (tracking the true address that the radio has).
-         */
-        strip_info->manual_dev_addr =
-            memcmp(addr->c, broadcast_address.c,
-                   sizeof(broadcast_address));
-        if (strip_info->manual_dev_addr)
-                *(MetricomAddress *) strip_info->dev->dev_addr = *addr;
-        else
-                *(MetricomAddress *) strip_info->dev->dev_addr =
-                    strip_info->true_dev_addr;
-        return 0;
-}
-
-static int strip_set_mac_address(struct net_device *dev, void *addr)
-{
-        struct strip *strip_info = netdev_priv(dev);
-        struct sockaddr *sa = addr;
-        printk(KERN_INFO "%s: strip_set_dev_mac_address called\n", dev->name);
-        set_mac_address(strip_info, (MetricomAddress *) sa->sa_data);
-        return 0;
-}
-
-static struct net_device_stats *strip_get_stats(struct net_device *dev)
-{
-        struct strip *strip_info = netdev_priv(dev);
-        static struct net_device_stats stats;
-
-        memset(&stats, 0, sizeof(struct net_device_stats));
-
-        stats.rx_packets = strip_info->rx_packets;
-        stats.tx_packets = strip_info->tx_packets;
-        stats.rx_dropped = strip_info->rx_dropped;
-        stats.tx_dropped = strip_info->tx_dropped;
-        stats.tx_errors = strip_info->tx_errors;
-        stats.rx_errors = strip_info->rx_errors;
-        stats.rx_over_errors = strip_info->rx_over_errors;
-        return (&stats);
-}
-
-
-/************************************************************************/
-/* Opening and closing                                                  */
-
-/*
- * Here's the order things happen:
- * When the user runs "slattach -p strip ..."
- *  1. The TTY module calls strip_open;;
- *  2. strip_open calls strip_alloc
- *  3.                  strip_alloc calls register_netdev
- *  4.                  register_netdev calls strip_dev_init
- *  5. then strip_open finishes setting up the strip_info
- *
- * When the user runs "ifconfig st<x> up address netmask ..."
- *  6. strip_open_low gets called
- *
- * When the user runs "ifconfig st<x> down"
- *  7. strip_close_low gets called
- *
- * When the user kills the slattach process
- *  8. strip_close gets called
- *  9. strip_close calls dev_close
- * 10. if the device is still up, then dev_close calls strip_close_low
- * 11. strip_close calls strip_free
- */
-
-/* Open the low-level part of the STRIP channel. Easy! */
-
-static int strip_open_low(struct net_device *dev)
-{
-        struct strip *strip_info = netdev_priv(dev);
-
-        if (strip_info->tty == NULL)
-                return (-ENODEV);
-
-        if (!allocate_buffers(strip_info, dev->mtu))
-                return (-ENOMEM);
-
-        strip_info->sx_count = 0;
-        strip_info->tx_left = 0;
-
-        strip_info->discard = 0;
-        strip_info->working = FALSE;
-        strip_info->firmware_level = NoStructure;
-        strip_info->next_command = CompatibilityCommand;
-        strip_info->user_baud = tty_get_baud_rate(strip_info->tty);
-
-        printk(KERN_INFO "%s: Initializing Radio.\n",
-               strip_info->dev->name);
-        ResetRadio(strip_info);
-        strip_info->idle_timer.expires = jiffies + 1 * HZ;
-        add_timer(&strip_info->idle_timer);
-        netif_wake_queue(dev);
-        return (0);
-}
-
-
-/*
- * Close the low-level part of the STRIP channel. Easy!
- */
-
-static int strip_close_low(struct net_device *dev)
-{
-        struct strip *strip_info = netdev_priv(dev);
-
-        if (strip_info->tty == NULL)
-                return -EBUSY;
-        clear_bit(TTY_DO_WRITE_WAKEUP, &strip_info->tty->flags);
-        netif_stop_queue(dev);
-
-        /*
-         * Free all STRIP frame buffers.
-         */
-        kfree(strip_info->rx_buff);
-        strip_info->rx_buff = NULL;
-        kfree(strip_info->sx_buff);
-        strip_info->sx_buff = NULL;
-        kfree(strip_info->tx_buff);
-        strip_info->tx_buff = NULL;
-
-        del_timer(&strip_info->idle_timer);
-        return 0;
-}
-
-static const struct header_ops strip_header_ops = {
-        .create = strip_header,
-        .rebuild = strip_rebuild_header,
-};
-
-
-static const struct net_device_ops strip_netdev_ops = {
-        .ndo_open       = strip_open_low,
-        .ndo_stop       = strip_close_low,
-        .ndo_start_xmit = strip_xmit,
-        .ndo_set_mac_address = strip_set_mac_address,
-        .ndo_get_stats  = strip_get_stats,
-        .ndo_change_mtu = strip_change_mtu,
-};
-
-/*
- * This routine is called by DDI when the
- * (dynamically assigned) device is registered
- */
-
-static void strip_dev_setup(struct net_device *dev)
-{
-        /*
-         * Finish setting up the DEVICE info.
-         */
-
-        dev->trans_start = 0;
-        dev->tx_queue_len = 30; /* Drop after 30 frames queued */
-
-        dev->flags = 0;
-        dev->mtu = DEFAULT_STRIP_MTU;
-        dev->type = ARPHRD_METRICOM;    /* dtang */
-        dev->hard_header_len = sizeof(STRIP_Header);
-        /*
-         *  netdev_priv(dev) Already holds a pointer to our struct strip
-         */
-
-        *(MetricomAddress *)dev->broadcast = broadcast_address;
-        dev->dev_addr[0] = 0;
-        dev->addr_len = sizeof(MetricomAddress);
-
-        dev->header_ops = &strip_header_ops,
-        dev->netdev_ops = &strip_netdev_ops;
-}
-
-/*
- * Free a STRIP channel.
- */
-
-static void strip_free(struct strip *strip_info)
-{
-        spin_lock_bh(&strip_lock);
-        list_del_rcu(&strip_info->list);
-        spin_unlock_bh(&strip_lock);
-
-        strip_info->magic = 0;
-
-        free_netdev(strip_info->dev);
-}
-
-
-/*
- * Allocate a new free STRIP channel
- */
-static struct strip *strip_alloc(void)
-{
-        struct list_head *n;
-        struct net_device *dev;
-        struct strip *strip_info;
-
-        dev = alloc_netdev(sizeof(struct strip), "st%d",
-                           strip_dev_setup);
-
-        if (!dev)
-                return NULL;    /* If no more memory, return */
-
-
-        strip_info = netdev_priv(dev);
-        strip_info->dev = dev;
-
-        strip_info->magic = STRIP_MAGIC;
-        strip_info->tty = NULL;
-
-        strip_info->gratuitous_arp = jiffies + LongTime;
-        strip_info->arp_interval = 0;
-        init_timer(&strip_info->idle_timer);
-        strip_info->idle_timer.data = (long) dev;
-        strip_info->idle_timer.function = strip_IdleTask;
-
-
-        spin_lock_bh(&strip_lock);
- rescan:
-        /*
-         * Search the list to find where to put our new entry
-         * (and in the process decide what channel number it is
-         * going to be)
-         */
-        list_for_each(n, &strip_list) {
-                struct strip *s = hlist_entry(n, struct strip, list);
-
-                if (s->dev->base_addr == dev->base_addr) {
-                        ++dev->base_addr;
-                        goto rescan;
-                }
-        }
-
-        sprintf(dev->name, "st%ld", dev->base_addr);
-
-        list_add_tail_rcu(&strip_info->list, &strip_list);
-        spin_unlock_bh(&strip_lock);
-
-        return strip_info;
-}
-
-/*
- * Open the high-level part of the STRIP channel.
- * This function is called by the TTY module when the
- * STRIP line discipline is called for.  Because we are
- * sure the tty line exists, we only have to link it to
- * a free STRIP channel...
- */
-
-static int strip_open(struct tty_struct *tty)
-{
-        struct strip *strip_info = tty->disc_data;
-
-        /*
-         * First make sure we're not already connected.
-         */
-
-        if (strip_info && strip_info->magic == STRIP_MAGIC)
-                return -EEXIST;
-
-        /*
-         * We need a write method.
-         */
-
-        if (tty->ops->write == NULL || tty->ops->set_termios == NULL)
-                return -EOPNOTSUPP;
-
-        /*
-         * OK.  Find a free STRIP channel to use.
-         */
-        if ((strip_info = strip_alloc()) == NULL)
-                return -ENFILE;
-
-        /*
-         * Register our newly created device so it can be ifconfig'd
-         * strip_dev_init() will be called as a side-effect
-         */
-
-        if (register_netdev(strip_info->dev) != 0) {
-                printk(KERN_ERR "strip: register_netdev() failed.\n");
-                strip_free(strip_info);
-                return -ENFILE;
-        }
-
-        strip_info->tty = tty;
-        tty->disc_data = strip_info;
-        tty->receive_room = 65536;
-
-        tty_driver_flush_buffer(tty);
-
-        /*
-         * Restore default settings
-         */
-
-        strip_info->dev->type = ARPHRD_METRICOM;        /* dtang */
-
-        /*
-         * Set tty options
-         */
-
-        tty->termios->c_iflag |= IGNBRK | IGNPAR;       /* Ignore breaks and parity errors. */
-        tty->termios->c_cflag |= CLOCAL;        /* Ignore modem control signals. */
-        tty->termios->c_cflag &= ~HUPCL;        /* Don't close on hup */
-
-        printk(KERN_INFO "STRIP: device \"%s\" activated\n",
-               strip_info->dev->name);
-
-        /*
-         * Done.  We have linked the TTY line to a channel.
-         */
-        return (strip_info->dev->base_addr);
-}
-
-/*
- * Close down a STRIP channel.
- * This means flushing out any pending queues, and then restoring the
- * TTY line discipline to what it was before it got hooked to STRIP
- * (which usually is TTY again).
- */
-
-static void strip_close(struct tty_struct *tty)
-{
-        struct strip *strip_info = tty->disc_data;
-
-        /*
-         * First make sure we're connected.
-         */
-
-        if (!strip_info || strip_info->magic != STRIP_MAGIC)
-                return;
-
-        unregister_netdev(strip_info->dev);
-
-        tty->disc_data = NULL;
-        strip_info->tty = NULL;
-        printk(KERN_INFO "STRIP: device \"%s\" closed down\n",
-               strip_info->dev->name);
-        strip_free(strip_info);
-        tty->disc_data = NULL;
-}
-
-
-/************************************************************************/
-/* Perform I/O control calls on an active STRIP channel.                */
-
-static int strip_ioctl(struct tty_struct *tty, struct file *file,
-                       unsigned int cmd, unsigned long arg)
-{
-        struct strip *strip_info = tty->disc_data;
-
-        /*
-         * First make sure we're connected.
-         */
-
-        if (!strip_info || strip_info->magic != STRIP_MAGIC)
-                return -EINVAL;
-
-        switch (cmd) {
-        case SIOCGIFNAME:
-                if(copy_to_user((void __user *) arg, strip_info->dev->name, strlen(strip_info->dev->name) + 1))
-                        return -EFAULT;
-                break;
-        case SIOCSIFHWADDR:
-        {
-                MetricomAddress addr;
-                //printk(KERN_INFO "%s: SIOCSIFHWADDR\n", strip_info->dev->name);
-                if(copy_from_user(&addr, (void __user *) arg, sizeof(MetricomAddress)))
-                        return -EFAULT;
-                return set_mac_address(strip_info, &addr);
-        }
-        default:
-                return tty_mode_ioctl(tty, file, cmd, arg);
-                break;
-        }
-        return 0;
-}
-
-
-/************************************************************************/
-/* Initialization                                                       */
-
-static struct tty_ldisc_ops strip_ldisc = {
-        .magic = TTY_LDISC_MAGIC,
-        .name = "strip",
-        .owner = THIS_MODULE,
-        .open = strip_open,
-        .close = strip_close,
-        .ioctl = strip_ioctl,
-        .receive_buf = strip_receive_buf,
-        .write_wakeup = strip_write_some_more,
-};
-
-/*
- * Initialize the STRIP driver.
- * This routine is called at boot time, to bootstrap the multi-channel
- * STRIP driver
- */
-
-static char signon[] __initdata =
-    KERN_INFO "STRIP: Version %s (unlimited channels)\n";
-
-static int __init strip_init_driver(void)
-{
-        int status;
-
-        printk(signon, StripVersion);
-
-        
-        /*
-         * Fill in our line protocol discipline, and register it
-         */
-        if ((status = tty_register_ldisc(N_STRIP, &strip_ldisc)))
-                printk(KERN_ERR "STRIP: can't register line discipline (err = %d)\n",
-                       status);
-
-        /*
-         * Register the status file with /proc
-         */
-        proc_net_fops_create(&init_net, "strip", S_IFREG | S_IRUGO, &strip_seq_fops);
-
-        return status;
-}
-
-module_init(strip_init_driver);
-
-static const char signoff[] __exitdata =
-    KERN_INFO "STRIP: Module Unloaded\n";
-
-static void __exit strip_exit_driver(void)
-{
-        int i;
-        struct list_head *p,*n;
-
-        /* module ref count rules assure that all entries are unregistered */
-        list_for_each_safe(p, n, &strip_list) {
-                struct strip *s = list_entry(p, struct strip, list);
-                strip_free(s);
-        }
-
-        /* Unregister with the /proc/net file here. */
-        proc_net_remove(&init_net, "strip");
-
-        if ((i = tty_unregister_ldisc(N_STRIP)))
-                printk(KERN_ERR "STRIP: can't unregister line discipline (err = %d)\n", i);
-
-        printk(signoff);
-}
-
-module_exit(strip_exit_driver);
-
-MODULE_AUTHOR("Stuart Cheshire <cheshire@cs.stanford.edu>");
-MODULE_DESCRIPTION("Starmode Radio IP (STRIP) Device Driver");
-MODULE_LICENSE("Dual BSD/GPL");
-
-MODULE_SUPPORTED_DEVICE("Starmode Radio IP (STRIP) modem");
diff --git a/drivers/net/wireless/wavelan.c b/drivers/net/wireless/wavelan.c
deleted file mode 100644
index d634b2da3b84..000000000000
--- a/drivers/net/wireless/wavelan.c
+++ /dev/null
@@ -1,4383 +0,0 @@
-/*
- *      WaveLAN ISA driver
- *
- *              Jean II - HPLB '96
- *
- * Reorganisation and extension of the driver.
- * Original copyright follows (also see the end of this file).
- * See wavelan.p.h for details.
- *
- *
- *
- * AT&T GIS (nee NCR) WaveLAN card:
- *      An Ethernet-like radio transceiver
- *      controlled by an Intel 82586 coprocessor.
- */
-
-#include "wavelan.p.h"          /* Private header */
-
-/************************* MISC SUBROUTINES **************************/
-/*
- * Subroutines which won't fit in one of the following category
- * (WaveLAN modem or i82586)
- */
-
-/*------------------------------------------------------------------*/
-/*
- * Translate irq number to PSA irq parameter
- */
-static u8 wv_irq_to_psa(int irq)
-{
-        if (irq < 0 || irq >= ARRAY_SIZE(irqvals))
-                return 0;
-
-        return irqvals[irq];
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Translate PSA irq parameter to irq number 
- */
-static int __init wv_psa_to_irq(u8 irqval)
-{
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(irqvals); i++)
-                if (irqvals[i] == irqval)
-                        return i;
-
-        return -1;
-}
-
-/********************* HOST ADAPTER SUBROUTINES *********************/
-/*
- * Useful subroutines to manage the WaveLAN ISA interface
- *
- * One major difference with the PCMCIA hardware (except the port mapping)
- * is that we have to keep the state of the Host Control Register
- * because of the interrupt enable & bus size flags.
- */
-
-/*------------------------------------------------------------------*/
-/*
- * Read from card's Host Adaptor Status Register.
- */
-static inline u16 hasr_read(unsigned long ioaddr)
-{
-        return (inw(HASR(ioaddr)));
-}                               /* hasr_read */
-
-/*------------------------------------------------------------------*/
-/*
- * Write to card's Host Adapter Command Register.
- */
-static inline void hacr_write(unsigned long ioaddr, u16 hacr)
-{
-        outw(hacr, HACR(ioaddr));
-}                               /* hacr_write */
-
-/*------------------------------------------------------------------*/
-/*
- * Write to card's Host Adapter Command Register. Include a delay for
- * those times when it is needed.
- */
-static void hacr_write_slow(unsigned long ioaddr, u16 hacr)
-{
-        hacr_write(ioaddr, hacr);
-        /* delay might only be needed sometimes */
-        mdelay(1);
-}                               /* hacr_write_slow */
-
-/*------------------------------------------------------------------*/
-/*
- * Set the channel attention bit.
- */
-static inline void set_chan_attn(unsigned long ioaddr, u16 hacr)
-{
-        hacr_write(ioaddr, hacr | HACR_CA);
-}                               /* set_chan_attn */
-
-/*------------------------------------------------------------------*/
-/*
- * Reset, and then set host adaptor into default mode.
- */
-static inline void wv_hacr_reset(unsigned long ioaddr)
-{
-        hacr_write_slow(ioaddr, HACR_RESET);
-        hacr_write(ioaddr, HACR_DEFAULT);
-}                               /* wv_hacr_reset */
-
-/*------------------------------------------------------------------*/
-/*
- * Set the I/O transfer over the ISA bus to 8-bit mode
- */
-static inline void wv_16_off(unsigned long ioaddr, u16 hacr)
-{
-        hacr &= ~HACR_16BITS;
-        hacr_write(ioaddr, hacr);
-}                               /* wv_16_off */
-
-/*------------------------------------------------------------------*/
-/*
- * Set the I/O transfer over the ISA bus to 8-bit mode
- */
-static inline void wv_16_on(unsigned long ioaddr, u16 hacr)
-{
-        hacr |= HACR_16BITS;
-        hacr_write(ioaddr, hacr);
-}                               /* wv_16_on */
-
-/*------------------------------------------------------------------*/
-/*
- * Disable interrupts on the WaveLAN hardware.
- * (called by wv_82586_stop())
- */
-static inline void wv_ints_off(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
-        
-        lp->hacr &= ~HACR_INTRON;
-        hacr_write(ioaddr, lp->hacr);
-}                               /* wv_ints_off */
-
-/*------------------------------------------------------------------*/
-/*
- * Enable interrupts on the WaveLAN hardware.
- * (called by wv_hw_reset())
- */
-static inline void wv_ints_on(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
-
-        lp->hacr |= HACR_INTRON;
-        hacr_write(ioaddr, lp->hacr);
-}                               /* wv_ints_on */
-
-/******************* MODEM MANAGEMENT SUBROUTINES *******************/
-/*
- * Useful subroutines to manage the modem of the WaveLAN
- */
-
-/*------------------------------------------------------------------*/
-/*
- * Read the Parameter Storage Area from the WaveLAN card's memory
- */
-/*
- * Read bytes from the PSA.
- */
-static void psa_read(unsigned long ioaddr, u16 hacr, int o,     /* offset in PSA */
-                     u8 * b,    /* buffer to fill */
-                     int n)
-{                               /* size to read */
-        wv_16_off(ioaddr, hacr);
-
-        while (n-- > 0) {
-                outw(o, PIOR2(ioaddr));
-                o++;
-                *b++ = inb(PIOP2(ioaddr));
-        }
-
-        wv_16_on(ioaddr, hacr);
-}                               /* psa_read */
-
-/*------------------------------------------------------------------*/
-/*
- * Write the Parameter Storage Area to the WaveLAN card's memory.
- */
-static void psa_write(unsigned long ioaddr, u16 hacr, int o,    /* Offset in PSA */
-                      u8 * b,   /* Buffer in memory */
-                      int n)
-{                               /* Length of buffer */
-        int count = 0;
-
-        wv_16_off(ioaddr, hacr);
-
-        while (n-- > 0) {
-                outw(o, PIOR2(ioaddr));
-                o++;
-
-                outb(*b, PIOP2(ioaddr));
-                b++;
-
-                /* Wait for the memory to finish its write cycle */
-                count = 0;
-                while ((count++ < 100) &&
-                       (hasr_read(ioaddr) & HASR_PSA_BUSY)) mdelay(1);
-        }
-
-        wv_16_on(ioaddr, hacr);
-}                               /* psa_write */
-
-#ifdef SET_PSA_CRC
-/*------------------------------------------------------------------*/
-/*
- * Calculate the PSA CRC
- * Thanks to Valster, Nico <NVALSTER@wcnd.nl.lucent.com> for the code
- * NOTE: By specifying a length including the CRC position the
- * returned value should be zero. (i.e. a correct checksum in the PSA)
- *
- * The Windows drivers don't use the CRC, but the AP and the PtP tool
- * depend on it.
- */
-static u16 psa_crc(u8 * psa,    /* The PSA */
-                              int size)
-{                               /* Number of short for CRC */
-        int byte_cnt;           /* Loop on the PSA */
-        u16 crc_bytes = 0;      /* Data in the PSA */
-        int bit_cnt;            /* Loop on the bits of the short */
-
-        for (byte_cnt = 0; byte_cnt < size; byte_cnt++) {
-                crc_bytes ^= psa[byte_cnt];     /* Its an xor */
-
-                for (bit_cnt = 1; bit_cnt < 9; bit_cnt++) {
-                        if (crc_bytes & 0x0001)
-                                crc_bytes = (crc_bytes >> 1) ^ 0xA001;
-                        else
-                                crc_bytes >>= 1;
-                }
-        }
-
-        return crc_bytes;
-}                               /* psa_crc */
-#endif                          /* SET_PSA_CRC */
-
-/*------------------------------------------------------------------*/
-/*
- * update the checksum field in the Wavelan's PSA
- */
-static void update_psa_checksum(struct net_device * dev, unsigned long ioaddr, u16 hacr)
-{
-#ifdef SET_PSA_CRC
-        psa_t psa;
-        u16 crc;
-
-        /* read the parameter storage area */
-        psa_read(ioaddr, hacr, 0, (unsigned char *) &psa, sizeof(psa));
-
-        /* update the checksum */
-        crc = psa_crc((unsigned char *) &psa,
-                      sizeof(psa) - sizeof(psa.psa_crc[0]) -
-                      sizeof(psa.psa_crc[1])
-                      - sizeof(psa.psa_crc_status));
-
-        psa.psa_crc[0] = crc & 0xFF;
-        psa.psa_crc[1] = (crc & 0xFF00) >> 8;
-
-        /* Write it ! */
-        psa_write(ioaddr, hacr, (char *) &psa.psa_crc - (char *) &psa,
-                  (unsigned char *) &psa.psa_crc, 2);
-
-#ifdef DEBUG_IOCTL_INFO
-        printk(KERN_DEBUG "%s: update_psa_checksum(): crc = 0x%02x%02x\n",
-               dev->name, psa.psa_crc[0], psa.psa_crc[1]);
-
-        /* Check again (luxury !) */
-        crc = psa_crc((unsigned char *) &psa,
-                      sizeof(psa) - sizeof(psa.psa_crc_status));
-
-        if (crc != 0)
-                printk(KERN_WARNING
-                       "%s: update_psa_checksum(): CRC does not agree with PSA data (even after recalculating)\n",
-                       dev->name);
-#endif                          /* DEBUG_IOCTL_INFO */
-#endif                          /* SET_PSA_CRC */
-}                               /* update_psa_checksum */
-
-/*------------------------------------------------------------------*/
-/*
- * Write 1 byte to the MMC.
- */
-static void mmc_out(unsigned long ioaddr, u16 o, u8 d)
-{
-        int count = 0;
-
-        /* Wait for MMC to go idle */
-        while ((count++ < 100) && (inw(HASR(ioaddr)) & HASR_MMC_BUSY))
-                udelay(10);
-
-        outw((u16) (((u16) d << 8) | (o << 1) | 1), MMCR(ioaddr));
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Routine to write bytes to the Modem Management Controller.
- * We start at the end because it is the way it should be!
- */
-static void mmc_write(unsigned long ioaddr, u8 o, u8 * b, int n)
-{
-        o += n;
-        b += n;
-
-        while (n-- > 0)
-                mmc_out(ioaddr, --o, *(--b));
-}                               /* mmc_write */
-
-/*------------------------------------------------------------------*/
-/*
- * Read a byte from the MMC.
- * Optimised version for 1 byte, avoid using memory.
- */
-static u8 mmc_in(unsigned long ioaddr, u16 o)
-{
-        int count = 0;
-
-        while ((count++ < 100) && (inw(HASR(ioaddr)) & HASR_MMC_BUSY))
-                udelay(10);
-        outw(o << 1, MMCR(ioaddr));
-
-        while ((count++ < 100) && (inw(HASR(ioaddr)) & HASR_MMC_BUSY))
-                udelay(10);
-        return (u8) (inw(MMCR(ioaddr)) >> 8);
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Routine to read bytes from the Modem Management Controller.
- * The implementation is complicated by a lack of address lines,
- * which prevents decoding of the low-order bit.
- * (code has just been moved in the above function)
- * We start at the end because it is the way it should be!
- */
-static inline void mmc_read(unsigned long ioaddr, u8 o, u8 * b, int n)
-{
-        o += n;
-        b += n;
-
-        while (n-- > 0)
-                *(--b) = mmc_in(ioaddr, --o);
-}                               /* mmc_read */
-
-/*------------------------------------------------------------------*/
-/*
- * Get the type of encryption available.
- */
-static inline int mmc_encr(unsigned long ioaddr)
-{                               /* I/O port of the card */
-        int temp;
-
-        temp = mmc_in(ioaddr, mmroff(0, mmr_des_avail));
-        if ((temp != MMR_DES_AVAIL_DES) && (temp != MMR_DES_AVAIL_AES))
-                return 0;
-        else
-                return temp;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wait for the frequency EEPROM to complete a command.
- * I hope this one will be optimally inlined.
- */
-static inline void fee_wait(unsigned long ioaddr,       /* I/O port of the card */
-                            int delay,  /* Base delay to wait for */
-                            int number)
-{                               /* Number of time to wait */
-        int count = 0;          /* Wait only a limited time */
-
-        while ((count++ < number) &&
-               (mmc_in(ioaddr, mmroff(0, mmr_fee_status)) &
-                MMR_FEE_STATUS_BUSY)) udelay(delay);
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Read bytes from the Frequency EEPROM (frequency select cards).
- */
-static void fee_read(unsigned long ioaddr,      /* I/O port of the card */
-                     u16 o,     /* destination offset */
-                     u16 * b,   /* data buffer */
-                     int n)
-{                               /* number of registers */
-        b += n;                 /* Position at the end of the area */
-
-        /* Write the address */
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), o + n - 1);
-
-        /* Loop on all buffer */
-        while (n-- > 0) {
-                /* Write the read command */
-                mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl),
-                        MMW_FEE_CTRL_READ);
-
-                /* Wait until EEPROM is ready (should be quick). */
-                fee_wait(ioaddr, 10, 100);
-
-                /* Read the value. */
-                *--b = ((mmc_in(ioaddr, mmroff(0, mmr_fee_data_h)) << 8) |
-                        mmc_in(ioaddr, mmroff(0, mmr_fee_data_l)));
-        }
-}
-
-
-/*------------------------------------------------------------------*/
-/*
- * Write bytes from the Frequency EEPROM (frequency select cards).
- * This is a bit complicated, because the frequency EEPROM has to
- * be unprotected and the write enabled.
- * Jean II
- */
-static void fee_write(unsigned long ioaddr,     /* I/O port of the card */
-                      u16 o,    /* destination offset */
-                      u16 * b,  /* data buffer */
-                      int n)
-{                               /* number of registers */
-        b += n;                 /* Position at the end of the area. */
-
-#ifdef EEPROM_IS_PROTECTED      /* disabled */
-#ifdef DOESNT_SEEM_TO_WORK      /* disabled */
-        /* Ask to read the protected register */
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRREAD);
-
-        fee_wait(ioaddr, 10, 100);
-
-        /* Read the protected register. */
-        printk("Protected 2:  %02X-%02X\n",
-               mmc_in(ioaddr, mmroff(0, mmr_fee_data_h)),
-               mmc_in(ioaddr, mmroff(0, mmr_fee_data_l)));
-#endif                          /* DOESNT_SEEM_TO_WORK */
-
-        /* Enable protected register. */
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), MMW_FEE_ADDR_EN);
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PREN);
-
-        fee_wait(ioaddr, 10, 100);
-
-        /* Unprotect area. */
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), o + n);
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRWRITE);
-#ifdef DOESNT_SEEM_TO_WORK      /* disabled */
-        /* or use: */
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRCLEAR);
-#endif                          /* DOESNT_SEEM_TO_WORK */
-
-        fee_wait(ioaddr, 10, 100);
-#endif                          /* EEPROM_IS_PROTECTED */
-
-        /* Write enable. */
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), MMW_FEE_ADDR_EN);
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_WREN);
-
-        fee_wait(ioaddr, 10, 100);
-
-        /* Write the EEPROM address. */
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), o + n - 1);
-
-        /* Loop on all buffer */
-        while (n-- > 0) {
-                /* Write the value. */
-                mmc_out(ioaddr, mmwoff(0, mmw_fee_data_h), (*--b) >> 8);
-                mmc_out(ioaddr, mmwoff(0, mmw_fee_data_l), *b & 0xFF);
-
-                /* Write the write command. */
-                mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl),
-                        MMW_FEE_CTRL_WRITE);
-
-                /* WaveLAN documentation says to wait at least 10 ms for EEBUSY = 0 */
-                mdelay(10);
-                fee_wait(ioaddr, 10, 100);
-        }
-
-        /* Write disable. */
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), MMW_FEE_ADDR_DS);
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_WDS);
-
-        fee_wait(ioaddr, 10, 100);
-
-#ifdef EEPROM_IS_PROTECTED      /* disabled */
-        /* Reprotect EEPROM. */
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), 0x00);
-        mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRWRITE);
-
-        fee_wait(ioaddr, 10, 100);
-#endif                          /* EEPROM_IS_PROTECTED */
-}
-
-/************************ I82586 SUBROUTINES *************************/
-/*
- * Useful subroutines to manage the Ethernet controller
- */
-
-/*------------------------------------------------------------------*/
-/*
- * Read bytes from the on-board RAM.
- * Why does inlining this function make it fail?
- */
-static /*inline */ void obram_read(unsigned long ioaddr,
-                                   u16 o, u8 * b, int n)
-{
-        outw(o, PIOR1(ioaddr));
-        insw(PIOP1(ioaddr), (unsigned short *) b, (n + 1) >> 1);
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Write bytes to the on-board RAM.
- */
-static inline void obram_write(unsigned long ioaddr, u16 o, u8 * b, int n)
-{
-        outw(o, PIOR1(ioaddr));
-        outsw(PIOP1(ioaddr), (unsigned short *) b, (n + 1) >> 1);
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Acknowledge the reading of the status issued by the i82586.
- */
-static void wv_ack(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
-        u16 scb_cs;
-        int i;
-
-        obram_read(ioaddr, scboff(OFFSET_SCB, scb_status),
-                   (unsigned char *) &scb_cs, sizeof(scb_cs));
-        scb_cs &= SCB_ST_INT;
-
-        if (scb_cs == 0)
-                return;
-
-        obram_write(ioaddr, scboff(OFFSET_SCB, scb_command),
-                    (unsigned char *) &scb_cs, sizeof(scb_cs));
-
-        set_chan_attn(ioaddr, lp->hacr);
-
-        for (i = 1000; i > 0; i--) {
-                obram_read(ioaddr, scboff(OFFSET_SCB, scb_command),
-                           (unsigned char *) &scb_cs, sizeof(scb_cs));
-                if (scb_cs == 0)
-                        break;
-
-                udelay(10);
-        }
-        udelay(100);
-
-#ifdef DEBUG_CONFIG_ERROR
-        if (i <= 0)
-                printk(KERN_INFO
-                       "%s: wv_ack(): board not accepting command.\n",
-                       dev->name);
-#endif
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Set channel attention bit and busy wait until command has
- * completed, then acknowledge completion of the command.
- */
-static int wv_synchronous_cmd(struct net_device * dev, const char *str)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
-        u16 scb_cmd;
-        ach_t cb;
-        int i;
-
-        scb_cmd = SCB_CMD_CUC & SCB_CMD_CUC_GO;
-        obram_write(ioaddr, scboff(OFFSET_SCB, scb_command),
-                    (unsigned char *) &scb_cmd, sizeof(scb_cmd));
-
-        set_chan_attn(ioaddr, lp->hacr);
-
-        for (i = 1000; i > 0; i--) {
-                obram_read(ioaddr, OFFSET_CU, (unsigned char *) &cb,
-                           sizeof(cb));
-                if (cb.ac_status & AC_SFLD_C)
-                        break;
-
-                udelay(10);
-        }
-        udelay(100);
-
-        if (i <= 0 || !(cb.ac_status & AC_SFLD_OK)) {
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_INFO "%s: %s failed; status = 0x%x\n",
-                       dev->name, str, cb.ac_status);
-#endif
-#ifdef DEBUG_I82586_SHOW
-                wv_scb_show(ioaddr);
-#endif
-                return -1;
-        }
-
-        /* Ack the status */
-        wv_ack(dev);
-
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Configuration commands completion interrupt.
- * Check if done, and if OK.
- */
-static int
-wv_config_complete(struct net_device * dev, unsigned long ioaddr, net_local * lp)
-{
-        unsigned short mcs_addr;
-        unsigned short status;
-        int ret;
-
-#ifdef DEBUG_INTERRUPT_TRACE
-        printk(KERN_DEBUG "%s: ->wv_config_complete()\n", dev->name);
-#endif
-
-        mcs_addr = lp->tx_first_in_use + sizeof(ac_tx_t) + sizeof(ac_nop_t)
-            + sizeof(tbd_t) + sizeof(ac_cfg_t) + sizeof(ac_ias_t);
-
-        /* Read the status of the last command (set mc list). */
-        obram_read(ioaddr, acoff(mcs_addr, ac_status),
-                   (unsigned char *) &status, sizeof(status));
-
-        /* If not completed -> exit */
-        if ((status & AC_SFLD_C) == 0)
-                ret = 0;        /* Not ready to be scrapped */
-        else {
-#ifdef DEBUG_CONFIG_ERROR
-                unsigned short cfg_addr;
-                unsigned short ias_addr;
-
-                /* Check mc_config command */
-                if ((status & AC_SFLD_OK) != AC_SFLD_OK)
-                        printk(KERN_INFO
-                               "%s: wv_config_complete(): set_multicast_address failed; status = 0x%x\n",
-                               dev->name, status);
-
-                /* check ia-config command */
-                ias_addr = mcs_addr - sizeof(ac_ias_t);
-                obram_read(ioaddr, acoff(ias_addr, ac_status),
-                           (unsigned char *) &status, sizeof(status));
-                if ((status & AC_SFLD_OK) != AC_SFLD_OK)
-                        printk(KERN_INFO
-                               "%s: wv_config_complete(): set_MAC_address failed; status = 0x%x\n",
-                               dev->name, status);
-
-                /* Check config command. */
-                cfg_addr = ias_addr - sizeof(ac_cfg_t);
-                obram_read(ioaddr, acoff(cfg_addr, ac_status),
-                           (unsigned char *) &status, sizeof(status));
-                if ((status & AC_SFLD_OK) != AC_SFLD_OK)
-                        printk(KERN_INFO
-                               "%s: wv_config_complete(): configure failed; status = 0x%x\n",
-                               dev->name, status);
-#endif  /* DEBUG_CONFIG_ERROR */
-
-                ret = 1;        /* Ready to be scrapped */
-        }
-
-#ifdef DEBUG_INTERRUPT_TRACE
-        printk(KERN_DEBUG "%s: <-wv_config_complete() - %d\n", dev->name,
-               ret);
-#endif
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Command completion interrupt.
- * Reclaim as many freed tx buffers as we can.
- * (called in wavelan_interrupt()).
- * Note : the spinlock is already grabbed for us.
- */
-static int wv_complete(struct net_device * dev, unsigned long ioaddr, net_local * lp)
-{
-        int nreaped = 0;
-
-#ifdef DEBUG_INTERRUPT_TRACE
-        printk(KERN_DEBUG "%s: ->wv_complete()\n", dev->name);
-#endif
-
-        /* Loop on all the transmit buffers */
-        while (lp->tx_first_in_use != I82586NULL) {
-                unsigned short tx_status;
-
-                /* Read the first transmit buffer */
-                obram_read(ioaddr, acoff(lp->tx_first_in_use, ac_status),
-                           (unsigned char *) &tx_status,
-                           sizeof(tx_status));
-
-                /* If not completed -> exit */
-                if ((tx_status & AC_SFLD_C) == 0)
-                        break;
-
-                /* Hack for reconfiguration */
-                if (tx_status == 0xFFFF)
-                        if (!wv_config_complete(dev, ioaddr, lp))
-                                break;  /* Not completed */
-
-                /* We now remove this buffer */
-                nreaped++;
-                --lp->tx_n_in_use;
-
-/*
-if (lp->tx_n_in_use > 0)
-        printk("%c", "0123456789abcdefghijk"[lp->tx_n_in_use]);
-*/
-
-                /* Was it the last one? */
-                if (lp->tx_n_in_use <= 0)
-                        lp->tx_first_in_use = I82586NULL;
-                else {
-                        /* Next one in the chain */
-                        lp->tx_first_in_use += TXBLOCKZ;
-                        if (lp->tx_first_in_use >=
-                            OFFSET_CU +
-                            NTXBLOCKS * TXBLOCKZ) lp->tx_first_in_use -=
-                                    NTXBLOCKS * TXBLOCKZ;
-                }
-
-                /* Hack for reconfiguration */
-                if (tx_status == 0xFFFF)
-                        continue;
-
-                /* Now, check status of the finished command */
-                if (tx_status & AC_SFLD_OK) {
-                        int ncollisions;
-
-                        dev->stats.tx_packets++;
-                        ncollisions = tx_status & AC_SFLD_MAXCOL;
-                        dev->stats.collisions += ncollisions;
-#ifdef DEBUG_TX_INFO
-                        if (ncollisions > 0)
-                                printk(KERN_DEBUG
-                                       "%s: wv_complete(): tx completed after %d collisions.\n",
-                                       dev->name, ncollisions);
-#endif
-                } else {
-                        dev->stats.tx_errors++;
-                        if (tx_status & AC_SFLD_S10) {
-                                dev->stats.tx_carrier_errors++;
-#ifdef DEBUG_TX_FAIL
-                                printk(KERN_DEBUG
-                                       "%s: wv_complete(): tx error: no CS.\n",
-                                       dev->name);
-#endif
-                        }
-                        if (tx_status & AC_SFLD_S9) {
-                                dev->stats.tx_carrier_errors++;
-#ifdef DEBUG_TX_FAIL
-                                printk(KERN_DEBUG
-                                       "%s: wv_complete(): tx error: lost CTS.\n",
-                                       dev->name);
-#endif
-                        }
-                        if (tx_status & AC_SFLD_S8) {
-                                dev->stats.tx_fifo_errors++;
-#ifdef DEBUG_TX_FAIL
-                                printk(KERN_DEBUG
-                                       "%s: wv_complete(): tx error: slow DMA.\n",
-                                       dev->name);
-#endif
-                        }
-                        if (tx_status & AC_SFLD_S6) {
-                                dev->stats.tx_heartbeat_errors++;
-#ifdef DEBUG_TX_FAIL
-                                printk(KERN_DEBUG
-                                       "%s: wv_complete(): tx error: heart beat.\n",
-                                       dev->name);
-#endif
-                        }
-                        if (tx_status & AC_SFLD_S5) {
-                                dev->stats.tx_aborted_errors++;
-#ifdef DEBUG_TX_FAIL
-                                printk(KERN_DEBUG
-                                       "%s: wv_complete(): tx error: too many collisions.\n",
-                                       dev->name);
-#endif
-                        }
-                }
-
-#ifdef DEBUG_TX_INFO
-                printk(KERN_DEBUG
-                       "%s: wv_complete(): tx completed, tx_status 0x%04x\n",
-                       dev->name, tx_status);
-#endif
-        }
-
-#ifdef DEBUG_INTERRUPT_INFO
-        if (nreaped > 1)
-                printk(KERN_DEBUG "%s: wv_complete(): reaped %d\n",
-                       dev->name, nreaped);
-#endif
-
-        /*
-         * Inform upper layers.
-         */
-        if (lp->tx_n_in_use < NTXBLOCKS - 1) {
-                netif_wake_queue(dev);
-        }
-#ifdef DEBUG_INTERRUPT_TRACE
-        printk(KERN_DEBUG "%s: <-wv_complete()\n", dev->name);
-#endif
-        return nreaped;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Reconfigure the i82586, or at least ask for it.
- * Because wv_82586_config uses a transmission buffer, we must do it
- * when we are sure that there is one left, so we do it now
- * or in wavelan_packet_xmit() (I can't find any better place,
- * wavelan_interrupt is not an option), so you may experience
- * delays sometimes.
- */
-static void wv_82586_reconfig(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long flags;
-
-        /* Arm the flag, will be cleard in wv_82586_config() */
-        lp->reconfig_82586 = 1;
-
-        /* Check if we can do it now ! */
-        if((netif_running(dev)) && !(netif_queue_stopped(dev))) {
-                spin_lock_irqsave(&lp->spinlock, flags);
-                /* May fail */
-                wv_82586_config(dev);
-                spin_unlock_irqrestore(&lp->spinlock, flags);
-        }
-        else {
-#ifdef DEBUG_CONFIG_INFO
-                printk(KERN_DEBUG
-                       "%s: wv_82586_reconfig(): delayed (state = %lX)\n",
-                               dev->name, dev->state);
-#endif
-        }
-}
-
-/********************* DEBUG & INFO SUBROUTINES *********************/
-/*
- * This routine is used in the code to show information for debugging.
- * Most of the time, it dumps the contents of hardware structures.
- */
-
-#ifdef DEBUG_PSA_SHOW
-/*------------------------------------------------------------------*/
-/*
- * Print the formatted contents of the Parameter Storage Area.
- */
-static void wv_psa_show(psa_t * p)
-{
-        printk(KERN_DEBUG "##### WaveLAN PSA contents: #####\n");
-        printk(KERN_DEBUG "psa_io_base_addr_1: 0x%02X %02X %02X %02X\n",
-               p->psa_io_base_addr_1,
-               p->psa_io_base_addr_2,
-               p->psa_io_base_addr_3, p->psa_io_base_addr_4);
-        printk(KERN_DEBUG "psa_rem_boot_addr_1: 0x%02X %02X %02X\n",
-               p->psa_rem_boot_addr_1,
-               p->psa_rem_boot_addr_2, p->psa_rem_boot_addr_3);
-        printk(KERN_DEBUG "psa_holi_params: 0x%02x, ", p->psa_holi_params);
-        printk("psa_int_req_no: %d\n", p->psa_int_req_no);
-#ifdef DEBUG_SHOW_UNUSED
-        printk(KERN_DEBUG "psa_unused0[]: %pM\n", p->psa_unused0);
-#endif                          /* DEBUG_SHOW_UNUSED */
-        printk(KERN_DEBUG "psa_univ_mac_addr[]: %pM\n", p->psa_univ_mac_addr);
-        printk(KERN_DEBUG "psa_local_mac_addr[]: %pM\n", p->psa_local_mac_addr);
-        printk(KERN_DEBUG "psa_univ_local_sel: %d, ",
-               p->psa_univ_local_sel);
-        printk("psa_comp_number: %d, ", p->psa_comp_number);
-        printk("psa_thr_pre_set: 0x%02x\n", p->psa_thr_pre_set);
-        printk(KERN_DEBUG "psa_feature_select/decay_prm: 0x%02x, ",
-               p->psa_feature_select);
-        printk("psa_subband/decay_update_prm: %d\n", p->psa_subband);
-        printk(KERN_DEBUG "psa_quality_thr: 0x%02x, ", p->psa_quality_thr);
-        printk("psa_mod_delay: 0x%02x\n", p->psa_mod_delay);
-        printk(KERN_DEBUG "psa_nwid: 0x%02x%02x, ", p->psa_nwid[0],
-               p->psa_nwid[1]);
-        printk("psa_nwid_select: %d\n", p->psa_nwid_select);
-        printk(KERN_DEBUG "psa_encryption_select: %d, ",
-               p->psa_encryption_select);
-        printk
-            ("psa_encryption_key[]: %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-             p->psa_encryption_key[0], p->psa_encryption_key[1],
-             p->psa_encryption_key[2], p->psa_encryption_key[3],
-             p->psa_encryption_key[4], p->psa_encryption_key[5],
-             p->psa_encryption_key[6], p->psa_encryption_key[7]);
-        printk(KERN_DEBUG "psa_databus_width: %d\n", p->psa_databus_width);
-        printk(KERN_DEBUG "psa_call_code/auto_squelch: 0x%02x, ",
-               p->psa_call_code[0]);
-        printk
-            ("psa_call_code[]: %02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X\n",
-             p->psa_call_code[0], p->psa_call_code[1], p->psa_call_code[2],
-             p->psa_call_code[3], p->psa_call_code[4], p->psa_call_code[5],
-             p->psa_call_code[6], p->psa_call_code[7]);
-#ifdef DEBUG_SHOW_UNUSED
-        printk(KERN_DEBUG "psa_reserved[]: %02X:%02X\n",
-               p->psa_reserved[0],
-               p->psa_reserved[1]);
-#endif                          /* DEBUG_SHOW_UNUSED */
-        printk(KERN_DEBUG "psa_conf_status: %d, ", p->psa_conf_status);
-        printk("psa_crc: 0x%02x%02x, ", p->psa_crc[0], p->psa_crc[1]);
-        printk("psa_crc_status: 0x%02x\n", p->psa_crc_status);
-}                               /* wv_psa_show */
-#endif                          /* DEBUG_PSA_SHOW */
-
-#ifdef DEBUG_MMC_SHOW
-/*------------------------------------------------------------------*/
-/*
- * Print the formatted status of the Modem Management Controller.
- * This function needs to be completed.
- */
-static void wv_mmc_show(struct net_device * dev)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        mmr_t m;
-
-        /* Basic check */
-        if (hasr_read(ioaddr) & HASR_NO_CLK) {
-                printk(KERN_WARNING
-                       "%s: wv_mmc_show: modem not connected\n",
-                       dev->name);
-                return;
-        }
-
-        /* Read the mmc */
-        mmc_out(ioaddr, mmwoff(0, mmw_freeze), 1);
-        mmc_read(ioaddr, 0, (u8 *) & m, sizeof(m));
-        mmc_out(ioaddr, mmwoff(0, mmw_freeze), 0);
-
-        /* Don't forget to update statistics */
-        lp->wstats.discard.nwid +=
-            (m.mmr_wrong_nwid_h << 8) | m.mmr_wrong_nwid_l;
-
-        printk(KERN_DEBUG "##### WaveLAN modem status registers: #####\n");
-#ifdef DEBUG_SHOW_UNUSED
-        printk(KERN_DEBUG
-               "mmc_unused0[]: %02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X\n",
-               m.mmr_unused0[0], m.mmr_unused0[1], m.mmr_unused0[2],
-               m.mmr_unused0[3], m.mmr_unused0[4], m.mmr_unused0[5],
-               m.mmr_unused0[6], m.mmr_unused0[7]);
-#endif                          /* DEBUG_SHOW_UNUSED */
-        printk(KERN_DEBUG "Encryption algorithm: %02X - Status: %02X\n",
-               m.mmr_des_avail, m.mmr_des_status);
-#ifdef DEBUG_SHOW_UNUSED
-        printk(KERN_DEBUG "mmc_unused1[]: %02X:%02X:%02X:%02X:%02X\n",
-               m.mmr_unused1[0],
-               m.mmr_unused1[1],
-               m.mmr_unused1[2], m.mmr_unused1[3], m.mmr_unused1[4]);
-#endif                          /* DEBUG_SHOW_UNUSED */
-        printk(KERN_DEBUG "dce_status: 0x%x [%s%s%s%s]\n",
-               m.mmr_dce_status,
-               (m.
-                mmr_dce_status & MMR_DCE_STATUS_RX_BUSY) ?
-               "energy detected," : "",
-               (m.
-                mmr_dce_status & MMR_DCE_STATUS_LOOPT_IND) ?
-               "loop test indicated," : "",
-               (m.
-                mmr_dce_status & MMR_DCE_STATUS_TX_BUSY) ?
-               "transmitter on," : "",
-               (m.
-                mmr_dce_status & MMR_DCE_STATUS_JBR_EXPIRED) ?
-               "jabber timer expired," : "");
-        printk(KERN_DEBUG "Dsp ID: %02X\n", m.mmr_dsp_id);
-#ifdef DEBUG_SHOW_UNUSED
-        printk(KERN_DEBUG "mmc_unused2[]: %02X:%02X\n",
-               m.mmr_unused2[0], m.mmr_unused2[1]);
-#endif                          /* DEBUG_SHOW_UNUSED */
-        printk(KERN_DEBUG "# correct_nwid: %d, # wrong_nwid: %d\n",
-               (m.mmr_correct_nwid_h << 8) | m.mmr_correct_nwid_l,
-               (m.mmr_wrong_nwid_h << 8) | m.mmr_wrong_nwid_l);
-        printk(KERN_DEBUG "thr_pre_set: 0x%x [current signal %s]\n",
-               m.mmr_thr_pre_set & MMR_THR_PRE_SET,
-               (m.
-                mmr_thr_pre_set & MMR_THR_PRE_SET_CUR) ? "above" :
-               "below");
-        printk(KERN_DEBUG "signal_lvl: %d [%s], ",
-               m.mmr_signal_lvl & MMR_SIGNAL_LVL,
-               (m.
-                mmr_signal_lvl & MMR_SIGNAL_LVL_VALID) ? "new msg" :
-               "no new msg");
-        printk("silence_lvl: %d [%s], ",
-               m.mmr_silence_lvl & MMR_SILENCE_LVL,
-               (m.
-                mmr_silence_lvl & MMR_SILENCE_LVL_VALID) ? "update done" :
-               "no new update");
-        printk("sgnl_qual: 0x%x [%s]\n", m.mmr_sgnl_qual & MMR_SGNL_QUAL,
-               (m.
-                mmr_sgnl_qual & MMR_SGNL_QUAL_ANT) ? "Antenna 1" :
-               "Antenna 0");
-#ifdef DEBUG_SHOW_UNUSED
-        printk(KERN_DEBUG "netw_id_l: %x\n", m.mmr_netw_id_l);
-#endif                          /* DEBUG_SHOW_UNUSED */
-}                               /* wv_mmc_show */
-#endif                          /* DEBUG_MMC_SHOW */
-
-#ifdef DEBUG_I82586_SHOW
-/*------------------------------------------------------------------*/
-/*
- * Print the last block of the i82586 memory.
- */
-static void wv_scb_show(unsigned long ioaddr)
-{
-        scb_t scb;
-
-        obram_read(ioaddr, OFFSET_SCB, (unsigned char *) &scb,
-                   sizeof(scb));
-
-        printk(KERN_DEBUG "##### WaveLAN system control block: #####\n");
-
-        printk(KERN_DEBUG "status: ");
-        printk("stat 0x%x[%s%s%s%s] ",
-               (scb.
-                scb_status & (SCB_ST_CX | SCB_ST_FR | SCB_ST_CNA |
-                              SCB_ST_RNR)) >> 12,
-               (scb.
-                scb_status & SCB_ST_CX) ? "command completion interrupt," :
-               "", (scb.scb_status & SCB_ST_FR) ? "frame received," : "",
-               (scb.
-                scb_status & SCB_ST_CNA) ? "command unit not active," : "",
-               (scb.
-                scb_status & SCB_ST_RNR) ? "receiving unit not ready," :
-               "");
-        printk("cus 0x%x[%s%s%s] ", (scb.scb_status & SCB_ST_CUS) >> 8,
-               ((scb.scb_status & SCB_ST_CUS) ==
-                SCB_ST_CUS_IDLE) ? "idle" : "",
-               ((scb.scb_status & SCB_ST_CUS) ==
-                SCB_ST_CUS_SUSP) ? "suspended" : "",
-               ((scb.scb_status & SCB_ST_CUS) ==
-                SCB_ST_CUS_ACTV) ? "active" : "");
-        printk("rus 0x%x[%s%s%s%s]\n", (scb.scb_status & SCB_ST_RUS) >> 4,
-               ((scb.scb_status & SCB_ST_RUS) ==
-                SCB_ST_RUS_IDLE) ? "idle" : "",
-               ((scb.scb_status & SCB_ST_RUS) ==
-                SCB_ST_RUS_SUSP) ? "suspended" : "",
-               ((scb.scb_status & SCB_ST_RUS) ==
-                SCB_ST_RUS_NRES) ? "no resources" : "",
-               ((scb.scb_status & SCB_ST_RUS) ==
-                SCB_ST_RUS_RDY) ? "ready" : "");
-
-        printk(KERN_DEBUG "command: ");
-        printk("ack 0x%x[%s%s%s%s] ",
-               (scb.
-                scb_command & (SCB_CMD_ACK_CX | SCB_CMD_ACK_FR |
-                               SCB_CMD_ACK_CNA | SCB_CMD_ACK_RNR)) >> 12,
-               (scb.
-                scb_command & SCB_CMD_ACK_CX) ? "ack cmd completion," : "",
-               (scb.
-                scb_command & SCB_CMD_ACK_FR) ? "ack frame received," : "",
-               (scb.
-                scb_command & SCB_CMD_ACK_CNA) ? "ack CU not active," : "",
-               (scb.
-                scb_command & SCB_CMD_ACK_RNR) ? "ack RU not ready," : "");
-        printk("cuc 0x%x[%s%s%s%s%s] ",
-               (scb.scb_command & SCB_CMD_CUC) >> 8,
-               ((scb.scb_command & SCB_CMD_CUC) ==
-                SCB_CMD_CUC_NOP) ? "nop" : "",
-               ((scb.scb_command & SCB_CMD_CUC) ==
-                SCB_CMD_CUC_GO) ? "start cbl_offset" : "",
-               ((scb.scb_command & SCB_CMD_CUC) ==
-                SCB_CMD_CUC_RES) ? "resume execution" : "",
-               ((scb.scb_command & SCB_CMD_CUC) ==
-                SCB_CMD_CUC_SUS) ? "suspend execution" : "",
-               ((scb.scb_command & SCB_CMD_CUC) ==
-                SCB_CMD_CUC_ABT) ? "abort execution" : "");
-        printk("ruc 0x%x[%s%s%s%s%s]\n",
-               (scb.scb_command & SCB_CMD_RUC) >> 4,
-               ((scb.scb_command & SCB_CMD_RUC) ==
-                SCB_CMD_RUC_NOP) ? "nop" : "",
-               ((scb.scb_command & SCB_CMD_RUC) ==
-                SCB_CMD_RUC_GO) ? "start rfa_offset" : "",
-               ((scb.scb_command & SCB_CMD_RUC) ==
-                SCB_CMD_RUC_RES) ? "resume reception" : "",
-               ((scb.scb_command & SCB_CMD_RUC) ==
-                SCB_CMD_RUC_SUS) ? "suspend reception" : "",
-               ((scb.scb_command & SCB_CMD_RUC) ==
-                SCB_CMD_RUC_ABT) ? "abort reception" : "");
-
-        printk(KERN_DEBUG "cbl_offset 0x%x ", scb.scb_cbl_offset);
-        printk("rfa_offset 0x%x\n", scb.scb_rfa_offset);
-
-        printk(KERN_DEBUG "crcerrs %d ", scb.scb_crcerrs);
-        printk("alnerrs %d ", scb.scb_alnerrs);
-        printk("rscerrs %d ", scb.scb_rscerrs);
-        printk("ovrnerrs %d\n", scb.scb_ovrnerrs);
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Print the formatted status of the i82586's receive unit.
- */
-static void wv_ru_show(struct net_device * dev)
-{
-        printk(KERN_DEBUG
-               "##### WaveLAN i82586 receiver unit status: #####\n");
-        printk(KERN_DEBUG "ru:");
-        /*
-         * Not implemented yet
-         */
-        printk("\n");
-}                               /* wv_ru_show */
-
-/*------------------------------------------------------------------*/
-/*
- * Display info about one control block of the i82586 memory.
- */
-static void wv_cu_show_one(struct net_device * dev, net_local * lp, int i, u16 p)
-{
-        unsigned long ioaddr;
-        ac_tx_t actx;
-
-        ioaddr = dev->base_addr;
-
-        printk("%d: 0x%x:", i, p);
-
-        obram_read(ioaddr, p, (unsigned char *) &actx, sizeof(actx));
-        printk(" status=0x%x,", actx.tx_h.ac_status);
-        printk(" command=0x%x,", actx.tx_h.ac_command);
-
-        /*
-           {
-           tbd_t      tbd;
-
-           obram_read(ioaddr, actx.tx_tbd_offset, (unsigned char *)&tbd, sizeof(tbd));
-           printk(" tbd_status=0x%x,", tbd.tbd_status);
-           }
-         */
-
-        printk("|");
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Print status of the command unit of the i82586.
- */
-static void wv_cu_show(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned int i;
-        u16 p;
-
-        printk(KERN_DEBUG
-               "##### WaveLAN i82586 command unit status: #####\n");
-
-        printk(KERN_DEBUG);
-        for (i = 0, p = lp->tx_first_in_use; i < NTXBLOCKS; i++) {
-                wv_cu_show_one(dev, lp, i, p);
-
-                p += TXBLOCKZ;
-                if (p >= OFFSET_CU + NTXBLOCKS * TXBLOCKZ)
-                        p -= NTXBLOCKS * TXBLOCKZ;
-        }
-        printk("\n");
-}
-#endif                          /* DEBUG_I82586_SHOW */
-
-#ifdef DEBUG_DEVICE_SHOW
-/*------------------------------------------------------------------*/
-/*
- * Print the formatted status of the WaveLAN PCMCIA device driver.
- */
-static void wv_dev_show(struct net_device * dev)
-{
-        printk(KERN_DEBUG "dev:");
-        printk(" state=%lX,", dev->state);
-        printk(" trans_start=%ld,", dev->trans_start);
-        printk(" flags=0x%x,", dev->flags);
-        printk("\n");
-}                               /* wv_dev_show */
-
-/*------------------------------------------------------------------*/
-/*
- * Print the formatted status of the WaveLAN PCMCIA device driver's
- * private information.
- */
-static void wv_local_show(struct net_device * dev)
-{
-        net_local *lp;
-
-        lp = netdev_priv(dev);
-
-        printk(KERN_DEBUG "local:");
-        printk(" tx_n_in_use=%d,", lp->tx_n_in_use);
-        printk(" hacr=0x%x,", lp->hacr);
-        printk(" rx_head=0x%x,", lp->rx_head);
-        printk(" rx_last=0x%x,", lp->rx_last);
-        printk(" tx_first_free=0x%x,", lp->tx_first_free);
-        printk(" tx_first_in_use=0x%x,", lp->tx_first_in_use);
-        printk("\n");
-}                               /* wv_local_show */
-#endif                          /* DEBUG_DEVICE_SHOW */
-
-#if defined(DEBUG_RX_INFO) || defined(DEBUG_TX_INFO)
-/*------------------------------------------------------------------*/
-/*
- * Dump packet header (and content if necessary) on the screen
- */
-static inline void wv_packet_info(u8 * p,       /* Packet to dump */
-                                  int length,   /* Length of the packet */
-                                  char *msg1,   /* Name of the device */
-                                  char *msg2)
-{                               /* Name of the function */
-        int i;
-        int maxi;
-
-        printk(KERN_DEBUG
-               "%s: %s(): dest %pM, length %d\n",
-               msg1, msg2, p, length);
-        printk(KERN_DEBUG
-               "%s: %s(): src %pM, type 0x%02X%02X\n",
-               msg1, msg2, &p[6], p[12], p[13]);
-
-#ifdef DEBUG_PACKET_DUMP
-
-        printk(KERN_DEBUG "data=\"");
-
-        if ((maxi = length) > DEBUG_PACKET_DUMP)
-                maxi = DEBUG_PACKET_DUMP;
-        for (i = 14; i < maxi; i++)
-                if (p[i] >= ' ' && p[i] <= '~')
-                        printk(" %c", p[i]);
-                else
-                        printk("%02X", p[i]);
-        if (maxi < length)
-                printk("..");
-        printk("\"\n");
-        printk(KERN_DEBUG "\n");
-#endif                          /* DEBUG_PACKET_DUMP */
-}
-#endif                          /* defined(DEBUG_RX_INFO) || defined(DEBUG_TX_INFO) */
-
-/*------------------------------------------------------------------*/
-/*
- * This is the information which is displayed by the driver at startup.
- * There are lots of flags for configuring it to your liking.
- */
-static void wv_init_info(struct net_device * dev)
-{
-        short ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        psa_t psa;
-
-        /* Read the parameter storage area */
-        psa_read(ioaddr, lp->hacr, 0, (unsigned char *) &psa, sizeof(psa));
-
-#ifdef DEBUG_PSA_SHOW
-        wv_psa_show(&psa);
-#endif
-#ifdef DEBUG_MMC_SHOW
-        wv_mmc_show(dev);
-#endif
-#ifdef DEBUG_I82586_SHOW
-        wv_cu_show(dev);
-#endif
-
-#ifdef DEBUG_BASIC_SHOW
-        /* Now, let's go for the basic stuff. */
-        printk(KERN_NOTICE "%s: WaveLAN at %#x, %pM, IRQ %d",
-               dev->name, ioaddr, dev->dev_addr, dev->irq);
-
-        /* Print current network ID. */
-        if (psa.psa_nwid_select)
-                printk(", nwid 0x%02X-%02X", psa.psa_nwid[0],
-                       psa.psa_nwid[1]);
-        else
-                printk(", nwid off");
-
-        /* If 2.00 card */
-        if (!(mmc_in(ioaddr, mmroff(0, mmr_fee_status)) &
-              (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY))) {
-                unsigned short freq;
-
-                /* Ask the EEPROM to read the frequency from the first area. */
-                fee_read(ioaddr, 0x00, &freq, 1);
-
-                /* Print frequency */
-                printk(", 2.00, %ld", (freq >> 6) + 2400L);
-
-                /* Hack! */
-                if (freq & 0x20)
-                        printk(".5");
-        } else {
-                printk(", PC");
-                switch (psa.psa_comp_number) {
-                case PSA_COMP_PC_AT_915:
-                case PSA_COMP_PC_AT_2400:
-                        printk("-AT");
-                        break;
-                case PSA_COMP_PC_MC_915:
-                case PSA_COMP_PC_MC_2400:
-                        printk("-MC");
-                        break;
-                case PSA_COMP_PCMCIA_915:
-                        printk("MCIA");
-                        break;
-                default:
-                        printk("?");
-                }
-                printk(", ");
-                switch (psa.psa_subband) {
-                case PSA_SUBBAND_915:
-                        printk("915");
-                        break;
-                case PSA_SUBBAND_2425:
-                        printk("2425");
-                        break;
-                case PSA_SUBBAND_2460:
-                        printk("2460");
-                        break;
-                case PSA_SUBBAND_2484:
-                        printk("2484");
-                        break;
-                case PSA_SUBBAND_2430_5:
-                        printk("2430.5");
-                        break;
-                default:
-                        printk("?");
-                }
-        }
-
-        printk(" MHz\n");
-#endif                          /* DEBUG_BASIC_SHOW */
-
-#ifdef DEBUG_VERSION_SHOW
-        /* Print version information */
-        printk(KERN_NOTICE "%s", version);
-#endif
-}                               /* wv_init_info */
-
-/********************* IOCTL, STATS & RECONFIG *********************/
-/*
- * We found here routines that are called by Linux on different
- * occasions after the configuration and not for transmitting data
- * These may be called when the user use ifconfig, /proc/net/dev
- * or wireless extensions
- */
-
-
-/*------------------------------------------------------------------*/
-/*
- * Set or clear the multicast filter for this adaptor.
- * num_addrs == -1      Promiscuous mode, receive all packets
- * num_addrs == 0       Normal mode, clear multicast list
- * num_addrs > 0        Multicast mode, receive normal and MC packets,
- *                      and do best-effort filtering.
- */
-static void wavelan_set_multicast_list(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-
-#ifdef DEBUG_IOCTL_TRACE
-        printk(KERN_DEBUG "%s: ->wavelan_set_multicast_list()\n",
-               dev->name);
-#endif
-
-#ifdef DEBUG_IOCTL_INFO
-        printk(KERN_DEBUG
-               "%s: wavelan_set_multicast_list(): setting Rx mode %02X to %d addresses.\n",
-               dev->name, dev->flags, dev->mc_count);
-#endif
-
-        /* Are we asking for promiscuous mode,
-         * or all multicast addresses (we don't have that!)
-         * or too many multicast addresses for the hardware filter? */
-        if ((dev->flags & IFF_PROMISC) ||
-            (dev->flags & IFF_ALLMULTI) ||
-            (dev->mc_count > I82586_MAX_MULTICAST_ADDRESSES)) {
-                /*
-                 * Enable promiscuous mode: receive all packets.
-                 */
-                if (!lp->promiscuous) {
-                        lp->promiscuous = 1;
-                        lp->mc_count = 0;
-
-                        wv_82586_reconfig(dev);
-                }
-        } else
-                /* Are there multicast addresses to send? */
-        if (dev->mc_list != (struct dev_mc_list *) NULL) {
-                /*
-                 * Disable promiscuous mode, but receive all packets
-                 * in multicast list
-                 */
-#ifdef MULTICAST_AVOID
-                if (lp->promiscuous || (dev->mc_count != lp->mc_count))
-#endif
-                {
-                        lp->promiscuous = 0;
-                        lp->mc_count = dev->mc_count;
-
-                        wv_82586_reconfig(dev);
-                }
-        } else {
-                /*
-                 * Switch to normal mode: disable promiscuous mode and 
-                 * clear the multicast list.
-                 */
-                if (lp->promiscuous || lp->mc_count == 0) {
-                        lp->promiscuous = 0;
-                        lp->mc_count = 0;
-
-                        wv_82586_reconfig(dev);
-                }
-        }
-#ifdef DEBUG_IOCTL_TRACE
-        printk(KERN_DEBUG "%s: <-wavelan_set_multicast_list()\n",
-               dev->name);
-#endif
-}
-
-/*------------------------------------------------------------------*/
-/*
- * This function doesn't exist.
- * (Note : it was a nice way to test the reconfigure stuff...)
- */
-#ifdef SET_MAC_ADDRESS
-static int wavelan_set_mac_address(struct net_device * dev, void *addr)
-{
-        struct sockaddr *mac = addr;
-
-        /* Copy the address. */
-        memcpy(dev->dev_addr, mac->sa_data, WAVELAN_ADDR_SIZE);
-
-        /* Reconfigure the beast. */
-        wv_82586_reconfig(dev);
-
-        return 0;
-}
-#endif                          /* SET_MAC_ADDRESS */
-
-
-/*------------------------------------------------------------------*/
-/*
- * Frequency setting (for hardware capable of it)
- * It's a bit complicated and you don't really want to look into it.
- * (called in wavelan_ioctl)
- */
-static int wv_set_frequency(unsigned long ioaddr,       /* I/O port of the card */
-                                   iw_freq * frequency)
-{
-        const int BAND_NUM = 10;        /* Number of bands */
-        long freq = 0L;         /* offset to 2.4 GHz in .5 MHz */
-#ifdef DEBUG_IOCTL_INFO
-        int i;
-#endif
-
-        /* Setting by frequency */
-        /* Theoretically, you may set any frequency between
-         * the two limits with a 0.5 MHz precision. In practice,
-         * I don't want you to have trouble with local regulations.
-         */
-        if ((frequency->e == 1) &&
-            (frequency->m >= (int) 2.412e8)
-            && (frequency->m <= (int) 2.487e8)) {
-                freq = ((frequency->m / 10000) - 24000L) / 5;
-        }
-
-        /* Setting by channel (same as wfreqsel) */
-        /* Warning: each channel is 22 MHz wide, so some of the channels
-         * will interfere. */
-        if ((frequency->e == 0) && (frequency->m < BAND_NUM)) {
-                /* Get frequency offset. */
-                freq = channel_bands[frequency->m] >> 1;
-        }
-
-        /* Verify that the frequency is allowed. */
-        if (freq != 0L) {
-                u16 table[10];  /* Authorized frequency table */
-
-                /* Read the frequency table. */
-                fee_read(ioaddr, 0x71, table, 10);
-
-#ifdef DEBUG_IOCTL_INFO
-                printk(KERN_DEBUG "Frequency table: ");
-                for (i = 0; i < 10; i++) {
-                        printk(" %04X", table[i]);
-                }
-                printk("\n");
-#endif
-
-                /* Look in the table to see whether the frequency is allowed. */
-                if (!(table[9 - ((freq - 24) / 16)] &
-                      (1 << ((freq - 24) % 16)))) return -EINVAL;       /* not allowed */
-        } else
-                return -EINVAL;
-
-        /* if we get a usable frequency */
-        if (freq != 0L) {
-                unsigned short area[16];
-                unsigned short dac[2];
-                unsigned short area_verify[16];
-                unsigned short dac_verify[2];
-                /* Corresponding gain (in the power adjust value table)
-                 * See AT&T WaveLAN Data Manual, REF 407-024689/E, page 3-8
-                 * and WCIN062D.DOC, page 6.2.9. */
-                unsigned short power_limit[] = { 40, 80, 120, 160, 0 };
-                int power_band = 0;     /* Selected band */
-                unsigned short power_adjust;    /* Correct value */
-
-                /* Search for the gain. */
-                power_band = 0;
-                while ((freq > power_limit[power_band]) &&
-                       (power_limit[++power_band] != 0));
-
-                /* Read the first area. */
-                fee_read(ioaddr, 0x00, area, 16);
-
-                /* Read the DAC. */
-                fee_read(ioaddr, 0x60, dac, 2);
-
-                /* Read the new power adjust value. */
-                fee_read(ioaddr, 0x6B - (power_band >> 1), &power_adjust,
-                         1);
-                if (power_band & 0x1)
-                        power_adjust >>= 8;
-                else
-                        power_adjust &= 0xFF;
-
-#ifdef DEBUG_IOCTL_INFO
-                printk(KERN_DEBUG "WaveLAN EEPROM Area 1: ");
-                for (i = 0; i < 16; i++) {
-                        printk(" %04X", area[i]);
-                }
-                printk("\n");
-
-                printk(KERN_DEBUG "WaveLAN EEPROM DAC: %04X %04X\n",
-                       dac[0], dac[1]);
-#endif
-
-                /* Frequency offset (for info only) */
-                area[0] = ((freq << 5) & 0xFFE0) | (area[0] & 0x1F);
-
-                /* Receiver Principle main divider coefficient */
-                area[3] = (freq >> 1) + 2400L - 352L;
-                area[2] = ((freq & 0x1) << 4) | (area[2] & 0xFFEF);
-
-                /* Transmitter Main divider coefficient */
-                area[13] = (freq >> 1) + 2400L;
-                area[12] = ((freq & 0x1) << 4) | (area[2] & 0xFFEF);
-
-                /* Other parts of the area are flags, bit streams or unused. */
-
-                /* Set the value in the DAC. */
-                dac[1] = ((power_adjust >> 1) & 0x7F) | (dac[1] & 0xFF80);
-                dac[0] = ((power_adjust & 0x1) << 4) | (dac[0] & 0xFFEF);
-
-                /* Write the first area. */
-                fee_write(ioaddr, 0x00, area, 16);
-
-                /* Write the DAC. */
-                fee_write(ioaddr, 0x60, dac, 2);
-
-                /* We now should verify here that the writing of the EEPROM went OK. */
-
-                /* Reread the first area. */
-                fee_read(ioaddr, 0x00, area_verify, 16);
-
-                /* Reread the DAC. */
-                fee_read(ioaddr, 0x60, dac_verify, 2);
-
-                /* Compare. */
-                if (memcmp(area, area_verify, 16 * 2) ||
-                    memcmp(dac, dac_verify, 2 * 2)) {
-#ifdef DEBUG_IOCTL_ERROR
-                        printk(KERN_INFO
-                               "WaveLAN: wv_set_frequency: unable to write new frequency to EEPROM(?).\n");
-#endif
-                        return -EOPNOTSUPP;
-                }
-
-                /* We must download the frequency parameters to the
-                 * synthesizers (from the EEPROM - area 1)
-                 * Note: as the EEPROM is automatically decremented, we set the end
-                 * if the area... */
-                mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), 0x0F);
-                mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl),
-                        MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD);
-
-                /* Wait until the download is finished. */
-                fee_wait(ioaddr, 100, 100);
-
-                /* We must now download the power adjust value (gain) to
-                 * the synthesizers (from the EEPROM - area 7 - DAC). */
-                mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), 0x61);
-                mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl),
-                        MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD);
-
-                /* Wait for the download to finish. */
-                fee_wait(ioaddr, 100, 100);
-
-#ifdef DEBUG_IOCTL_INFO
-                /* Verification of what we have done */
-
-                printk(KERN_DEBUG "WaveLAN EEPROM Area 1: ");
-                for (i = 0; i < 16; i++) {
-                        printk(" %04X", area_verify[i]);
-                }
-                printk("\n");
-
-                printk(KERN_DEBUG "WaveLAN EEPROM DAC:  %04X %04X\n",
-                       dac_verify[0], dac_verify[1]);
-#endif
-
-                return 0;
-        } else
-                return -EINVAL; /* Bah, never get there... */
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Give the list of available frequencies.
- */
-static int wv_frequency_list(unsigned long ioaddr,      /* I/O port of the card */
-                                    iw_freq * list,     /* List of frequencies to fill */
-                                    int max)
-{                               /* Maximum number of frequencies */
-        u16 table[10];  /* Authorized frequency table */
-        long freq = 0L;         /* offset to 2.4 GHz in .5 MHz + 12 MHz */
-        int i;                  /* index in the table */
-        int c = 0;              /* Channel number */
-
-        /* Read the frequency table. */
-        fee_read(ioaddr, 0x71 /* frequency table */ , table, 10);
-
-        /* Check all frequencies. */
-        i = 0;
-        for (freq = 0; freq < 150; freq++)
-                /* Look in the table if the frequency is allowed */
-                if (table[9 - (freq / 16)] & (1 << (freq % 16))) {
-                        /* Compute approximate channel number */
-                        while ((c < ARRAY_SIZE(channel_bands)) &&
-                                (((channel_bands[c] >> 1) - 24) < freq)) 
-                                c++;
-                        list[i].i = c;  /* Set the list index */
-
-                        /* put in the list */
-                        list[i].m = (((freq + 24) * 5) + 24000L) * 10000;
-                        list[i++].e = 1;
-
-                        /* Check number. */
-                        if (i >= max)
-                                return (i);
-                }
-
-        return (i);
-}
-
-#ifdef IW_WIRELESS_SPY
-/*------------------------------------------------------------------*/
-/*
- * Gather wireless spy statistics:  for each packet, compare the source
- * address with our list, and if they match, get the statistics.
- * Sorry, but this function really needs the wireless extensions.
- */
-static inline void wl_spy_gather(struct net_device * dev,
-                                 u8 *   mac,    /* MAC address */
-                                 u8 *   stats)  /* Statistics to gather */
-{
-        struct iw_quality wstats;
-
-        wstats.qual = stats[2] & MMR_SGNL_QUAL;
-        wstats.level = stats[0] & MMR_SIGNAL_LVL;
-        wstats.noise = stats[1] & MMR_SILENCE_LVL;
-        wstats.updated = 0x7;
-
-        /* Update spy records */
-        wireless_spy_update(dev, mac, &wstats);
-}
-#endif /* IW_WIRELESS_SPY */
-
-#ifdef HISTOGRAM
-/*------------------------------------------------------------------*/
-/*
- * This function calculates a histogram of the signal level.
- * As the noise is quite constant, it's like doing it on the SNR.
- * We have defined a set of interval (lp->his_range), and each time
- * the level goes in that interval, we increment the count (lp->his_sum).
- * With this histogram you may detect if one WaveLAN is really weak,
- * or you may also calculate the mean and standard deviation of the level.
- */
-static inline void wl_his_gather(struct net_device * dev, u8 * stats)
-{                               /* Statistics to gather */
-        net_local *lp = netdev_priv(dev);
-        u8 level = stats[0] & MMR_SIGNAL_LVL;
-        int i;
-
-        /* Find the correct interval. */
-        i = 0;
-        while ((i < (lp->his_number - 1))
-               && (level >= lp->his_range[i++]));
-
-        /* Increment interval counter. */
-        (lp->his_sum[i])++;
-}
-#endif /* HISTOGRAM */
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get protocol name
- */
-static int wavelan_get_name(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        strcpy(wrqu->name, "WaveLAN");
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : set NWID
- */
-static int wavelan_set_nwid(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-        psa_t psa;
-        mm_t m;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Set NWID in WaveLAN. */
-        if (!wrqu->nwid.disabled) {
-                /* Set NWID in psa */
-                psa.psa_nwid[0] = (wrqu->nwid.value & 0xFF00) >> 8;
-                psa.psa_nwid[1] = wrqu->nwid.value & 0xFF;
-                psa.psa_nwid_select = 0x01;
-                psa_write(ioaddr, lp->hacr,
-                          (char *) psa.psa_nwid - (char *) &psa,
-                          (unsigned char *) psa.psa_nwid, 3);
-
-                /* Set NWID in mmc. */
-                m.w.mmw_netw_id_l = psa.psa_nwid[1];
-                m.w.mmw_netw_id_h = psa.psa_nwid[0];
-                mmc_write(ioaddr,
-                          (char *) &m.w.mmw_netw_id_l -
-                          (char *) &m,
-                          (unsigned char *) &m.w.mmw_netw_id_l, 2);
-                mmc_out(ioaddr, mmwoff(0, mmw_loopt_sel), 0x00);
-        } else {
-                /* Disable NWID in the psa. */
-                psa.psa_nwid_select = 0x00;
-                psa_write(ioaddr, lp->hacr,
-                          (char *) &psa.psa_nwid_select -
-                          (char *) &psa,
-                          (unsigned char *) &psa.psa_nwid_select,
-                          1);
-
-                /* Disable NWID in the mmc (no filtering). */
-                mmc_out(ioaddr, mmwoff(0, mmw_loopt_sel),
-                        MMW_LOOPT_SEL_DIS_NWID);
-        }
-        /* update the Wavelan checksum */
-        update_psa_checksum(dev, ioaddr, lp->hacr);
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get NWID 
- */
-static int wavelan_get_nwid(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-        psa_t psa;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Read the NWID. */
-        psa_read(ioaddr, lp->hacr,
-                 (char *) psa.psa_nwid - (char *) &psa,
-                 (unsigned char *) psa.psa_nwid, 3);
-        wrqu->nwid.value = (psa.psa_nwid[0] << 8) + psa.psa_nwid[1];
-        wrqu->nwid.disabled = !(psa.psa_nwid_select);
-        wrqu->nwid.fixed = 1;   /* Superfluous */
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : set frequency
- */
-static int wavelan_set_freq(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-        unsigned long flags;
-        int ret;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable). */
-        if (!(mmc_in(ioaddr, mmroff(0, mmr_fee_status)) &
-              (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY)))
-                ret = wv_set_frequency(ioaddr, &(wrqu->freq));
-        else
-                ret = -EOPNOTSUPP;
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get frequency
- */
-static int wavelan_get_freq(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-        psa_t psa;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable).
-         * Does it work for everybody, especially old cards? */
-        if (!(mmc_in(ioaddr, mmroff(0, mmr_fee_status)) &
-              (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY))) {
-                unsigned short freq;
-
-                /* Ask the EEPROM to read the frequency from the first area. */
-                fee_read(ioaddr, 0x00, &freq, 1);
-                wrqu->freq.m = ((freq >> 5) * 5 + 24000L) * 10000;
-                wrqu->freq.e = 1;
-        } else {
-                psa_read(ioaddr, lp->hacr,
-                         (char *) &psa.psa_subband - (char *) &psa,
-                         (unsigned char *) &psa.psa_subband, 1);
-
-                if (psa.psa_subband <= 4) {
-                        wrqu->freq.m = fixed_bands[psa.psa_subband];
-                        wrqu->freq.e = (psa.psa_subband != 0);
-                } else
-                        ret = -EOPNOTSUPP;
-        }
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : set level threshold
- */
-static int wavelan_set_sens(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-        psa_t psa;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Set the level threshold. */
-        /* We should complain loudly if wrqu->sens.fixed = 0, because we
-         * can't set auto mode... */
-        psa.psa_thr_pre_set = wrqu->sens.value & 0x3F;
-        psa_write(ioaddr, lp->hacr,
-                  (char *) &psa.psa_thr_pre_set - (char *) &psa,
-                  (unsigned char *) &psa.psa_thr_pre_set, 1);
-        /* update the Wavelan checksum */
-        update_psa_checksum(dev, ioaddr, lp->hacr);
-        mmc_out(ioaddr, mmwoff(0, mmw_thr_pre_set),
-                psa.psa_thr_pre_set);
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get level threshold
- */
-static int wavelan_get_sens(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-        psa_t psa;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Read the level threshold. */
-        psa_read(ioaddr, lp->hacr,
-                 (char *) &psa.psa_thr_pre_set - (char *) &psa,
-                 (unsigned char *) &psa.psa_thr_pre_set, 1);
-        wrqu->sens.value = psa.psa_thr_pre_set & 0x3F;
-        wrqu->sens.fixed = 1;
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : set encryption key
- */
-static int wavelan_set_encode(struct net_device *dev,
-                              struct iw_request_info *info,
-                              union iwreq_data *wrqu,
-                              char *extra)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-        unsigned long flags;
-        psa_t psa;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-
-        /* Check if capable of encryption */
-        if (!mmc_encr(ioaddr)) {
-                ret = -EOPNOTSUPP;
-        }
-
-        /* Check the size of the key */
-        if((wrqu->encoding.length != 8) && (wrqu->encoding.length != 0)) {
-                ret = -EINVAL;
-        }
-
-        if(!ret) {
-                /* Basic checking... */
-                if (wrqu->encoding.length == 8) {
-                        /* Copy the key in the driver */
-                        memcpy(psa.psa_encryption_key, extra,
-                               wrqu->encoding.length);
-                        psa.psa_encryption_select = 1;
-
-                        psa_write(ioaddr, lp->hacr,
-                                  (char *) &psa.psa_encryption_select -
-                                  (char *) &psa,
-                                  (unsigned char *) &psa.
-                                  psa_encryption_select, 8 + 1);
-
-                        mmc_out(ioaddr, mmwoff(0, mmw_encr_enable),
-                                MMW_ENCR_ENABLE_EN | MMW_ENCR_ENABLE_MODE);
-                        mmc_write(ioaddr, mmwoff(0, mmw_encr_key),
-                                  (unsigned char *) &psa.
-                                  psa_encryption_key, 8);
-                }
-
-                /* disable encryption */
-                if (wrqu->encoding.flags & IW_ENCODE_DISABLED) {
-                        psa.psa_encryption_select = 0;
-                        psa_write(ioaddr, lp->hacr,
-                                  (char *) &psa.psa_encryption_select -
-                                  (char *) &psa,
-                                  (unsigned char *) &psa.
-                                  psa_encryption_select, 1);
-
-                        mmc_out(ioaddr, mmwoff(0, mmw_encr_enable), 0);
-                }
-                /* update the Wavelan checksum */
-                update_psa_checksum(dev, ioaddr, lp->hacr);
-        }
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get encryption key
- */
-static int wavelan_get_encode(struct net_device *dev,
-                              struct iw_request_info *info,
-                              union iwreq_data *wrqu,
-                              char *extra)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-        psa_t psa;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Check if encryption is available */
-        if (!mmc_encr(ioaddr)) {
-                ret = -EOPNOTSUPP;
-        } else {
-                /* Read the encryption key */
-                psa_read(ioaddr, lp->hacr,
-                         (char *) &psa.psa_encryption_select -
-                         (char *) &psa,
-                         (unsigned char *) &psa.
-                         psa_encryption_select, 1 + 8);
-
-                /* encryption is enabled ? */
-                if (psa.psa_encryption_select)
-                        wrqu->encoding.flags = IW_ENCODE_ENABLED;
-                else
-                        wrqu->encoding.flags = IW_ENCODE_DISABLED;
-                wrqu->encoding.flags |= mmc_encr(ioaddr);
-
-                /* Copy the key to the user buffer */
-                wrqu->encoding.length = 8;
-                memcpy(extra, psa.psa_encryption_key, wrqu->encoding.length);
-        }
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get range info
- */
-static int wavelan_get_range(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu,
-                             char *extra)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-        struct iw_range *range = (struct iw_range *) extra;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Set the length (very important for backward compatibility) */
-        wrqu->data.length = sizeof(struct iw_range);
-
-        /* Set all the info we don't care or don't know about to zero */
-        memset(range, 0, sizeof(struct iw_range));
-
-        /* Set the Wireless Extension versions */
-        range->we_version_compiled = WIRELESS_EXT;
-        range->we_version_source = 9;
-
-        /* Set information in the range struct.  */
-        range->throughput = 1.6 * 1000 * 1000;  /* don't argue on this ! */
-        range->min_nwid = 0x0000;
-        range->max_nwid = 0xFFFF;
-
-        range->sensitivity = 0x3F;
-        range->max_qual.qual = MMR_SGNL_QUAL;
-        range->max_qual.level = MMR_SIGNAL_LVL;
-        range->max_qual.noise = MMR_SILENCE_LVL;
-        range->avg_qual.qual = MMR_SGNL_QUAL; /* Always max */
-        /* Need to get better values for those two */
-        range->avg_qual.level = 30;
-        range->avg_qual.noise = 8;
-
-        range->num_bitrates = 1;
-        range->bitrate[0] = 2000000;    /* 2 Mb/s */
-
-        /* Event capability (kernel + driver) */
-        range->event_capa[0] = (IW_EVENT_CAPA_MASK(0x8B02) |
-                                IW_EVENT_CAPA_MASK(0x8B04));
-        range->event_capa[1] = IW_EVENT_CAPA_K_1;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable). */
-        if (!(mmc_in(ioaddr, mmroff(0, mmr_fee_status)) &
-              (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY))) {
-                range->num_channels = 10;
-                range->num_frequency = wv_frequency_list(ioaddr, range->freq,
-                                                        IW_MAX_FREQUENCIES);
-        } else
-                range->num_channels = range->num_frequency = 0;
-
-        /* Encryption supported ? */
-        if (mmc_encr(ioaddr)) {
-                range->encoding_size[0] = 8;    /* DES = 64 bits key */
-                range->num_encoding_sizes = 1;
-                range->max_encoding_tokens = 1; /* Only one key possible */
-        } else {
-                range->num_encoding_sizes = 0;
-                range->max_encoding_tokens = 0;
-        }
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Private Handler : set quality threshold
- */
-static int wavelan_set_qthr(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-        psa_t psa;
-        unsigned long flags;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        psa.psa_quality_thr = *(extra) & 0x0F;
-        psa_write(ioaddr, lp->hacr,
-                  (char *) &psa.psa_quality_thr - (char *) &psa,
-                  (unsigned char *) &psa.psa_quality_thr, 1);
-        /* update the Wavelan checksum */
-        update_psa_checksum(dev, ioaddr, lp->hacr);
-        mmc_out(ioaddr, mmwoff(0, mmw_quality_thr),
-                psa.psa_quality_thr);
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Private Handler : get quality threshold
- */
-static int wavelan_get_qthr(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-        psa_t psa;
-        unsigned long flags;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        psa_read(ioaddr, lp->hacr,
-                 (char *) &psa.psa_quality_thr - (char *) &psa,
-                 (unsigned char *) &psa.psa_quality_thr, 1);
-        *(extra) = psa.psa_quality_thr & 0x0F;
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return 0;
-}
-
-#ifdef HISTOGRAM
-/*------------------------------------------------------------------*/
-/*
- * Wireless Private Handler : set histogram
- */
-static int wavelan_set_histo(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu,
-                             char *extra)
-{
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-
-        /* Check the number of intervals. */
-        if (wrqu->data.length > 16) {
-                return(-E2BIG);
-        }
-
-        /* Disable histo while we copy the addresses.
-         * As we don't disable interrupts, we need to do this */
-        lp->his_number = 0;
-
-        /* Are there ranges to copy? */
-        if (wrqu->data.length > 0) {
-                /* Copy interval ranges to the driver */
-                memcpy(lp->his_range, extra, wrqu->data.length);
-
-                {
-                  int i;
-                  printk(KERN_DEBUG "Histo :");
-                  for(i = 0; i < wrqu->data.length; i++)
-                    printk(" %d", lp->his_range[i]);
-                  printk("\n");
-                }
-
-                /* Reset result structure. */
-                memset(lp->his_sum, 0x00, sizeof(long) * 16);
-        }
-
-        /* Now we can set the number of ranges */
-        lp->his_number = wrqu->data.length;
-
-        return(0);
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Private Handler : get histogram
- */
-static int wavelan_get_histo(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu,
-                             char *extra)
-{
-        net_local *lp = netdev_priv(dev);       /* lp is not unused */
-
-        /* Set the number of intervals. */
-        wrqu->data.length = lp->his_number;
-
-        /* Give back the distribution statistics */
-        if(lp->his_number > 0)
-                memcpy(extra, lp->his_sum, sizeof(long) * lp->his_number);
-
-        return(0);
-}
-#endif                  /* HISTOGRAM */
-
-/*------------------------------------------------------------------*/
-/*
- * Structures to export the Wireless Handlers
- */
-
-static const iw_handler         wavelan_handler[] =
-{
-        NULL,                           /* SIOCSIWNAME */
-        wavelan_get_name,               /* SIOCGIWNAME */
-        wavelan_set_nwid,               /* SIOCSIWNWID */
-        wavelan_get_nwid,               /* SIOCGIWNWID */
-        wavelan_set_freq,               /* SIOCSIWFREQ */
-        wavelan_get_freq,               /* SIOCGIWFREQ */
-        NULL,                           /* SIOCSIWMODE */
-        NULL,                           /* SIOCGIWMODE */
-        wavelan_set_sens,               /* SIOCSIWSENS */
-        wavelan_get_sens,               /* SIOCGIWSENS */
-        NULL,                           /* SIOCSIWRANGE */
-        wavelan_get_range,              /* SIOCGIWRANGE */
-        NULL,                           /* SIOCSIWPRIV */
-        NULL,                           /* SIOCGIWPRIV */
-        NULL,                           /* SIOCSIWSTATS */
-        NULL,                           /* SIOCGIWSTATS */
-        iw_handler_set_spy,             /* SIOCSIWSPY */
-        iw_handler_get_spy,             /* SIOCGIWSPY */
-        iw_handler_set_thrspy,          /* SIOCSIWTHRSPY */
-        iw_handler_get_thrspy,          /* SIOCGIWTHRSPY */
-        NULL,                           /* SIOCSIWAP */
-        NULL,                           /* SIOCGIWAP */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* SIOCGIWAPLIST */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* SIOCSIWESSID */
-        NULL,                           /* SIOCGIWESSID */
-        NULL,                           /* SIOCSIWNICKN */
-        NULL,                           /* SIOCGIWNICKN */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* SIOCSIWRATE */
-        NULL,                           /* SIOCGIWRATE */
-        NULL,                           /* SIOCSIWRTS */
-        NULL,                           /* SIOCGIWRTS */
-        NULL,                           /* SIOCSIWFRAG */
-        NULL,                           /* SIOCGIWFRAG */
-        NULL,                           /* SIOCSIWTXPOW */
-        NULL,                           /* SIOCGIWTXPOW */
-        NULL,                           /* SIOCSIWRETRY */
-        NULL,                           /* SIOCGIWRETRY */
-        /* Bummer ! Why those are only at the end ??? */
-        wavelan_set_encode,             /* SIOCSIWENCODE */
-        wavelan_get_encode,             /* SIOCGIWENCODE */
-};
-
-static const iw_handler         wavelan_private_handler[] =
-{
-        wavelan_set_qthr,               /* SIOCIWFIRSTPRIV */
-        wavelan_get_qthr,               /* SIOCIWFIRSTPRIV + 1 */
-#ifdef HISTOGRAM
-        wavelan_set_histo,              /* SIOCIWFIRSTPRIV + 2 */
-        wavelan_get_histo,              /* SIOCIWFIRSTPRIV + 3 */
-#endif  /* HISTOGRAM */
-};
-
-static const struct iw_priv_args wavelan_private_args[] = {
-/*{ cmd,         set_args,                            get_args, name } */
-  { SIOCSIPQTHR, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, 0, "setqualthr" },
-  { SIOCGIPQTHR, 0, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, "getqualthr" },
-  { SIOCSIPHISTO, IW_PRIV_TYPE_BYTE | 16,                    0, "sethisto" },
-  { SIOCGIPHISTO, 0,                     IW_PRIV_TYPE_INT | 16, "gethisto" },
-};
-
-static const struct iw_handler_def      wavelan_handler_def =
-{
-        .num_standard   = ARRAY_SIZE(wavelan_handler),
-        .num_private    = ARRAY_SIZE(wavelan_private_handler),
-        .num_private_args = ARRAY_SIZE(wavelan_private_args),
-        .standard       = wavelan_handler,
-        .private        = wavelan_private_handler,
-        .private_args   = wavelan_private_args,
-        .get_wireless_stats = wavelan_get_wireless_stats,
-};
-
-/*------------------------------------------------------------------*/
-/*
- * Get wireless statistics.
- * Called by /proc/net/wireless
- */
-static iw_stats *wavelan_get_wireless_stats(struct net_device * dev)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        mmr_t m;
-        iw_stats *wstats;
-        unsigned long flags;
-
-#ifdef DEBUG_IOCTL_TRACE
-        printk(KERN_DEBUG "%s: ->wavelan_get_wireless_stats()\n",
-               dev->name);
-#endif
-
-        /* Check */
-        if (lp == (net_local *) NULL)
-                return (iw_stats *) NULL;
-        
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        wstats = &lp->wstats;
-
-        /* Get data from the mmc. */
-        mmc_out(ioaddr, mmwoff(0, mmw_freeze), 1);
-
-        mmc_read(ioaddr, mmroff(0, mmr_dce_status), &m.mmr_dce_status, 1);
-        mmc_read(ioaddr, mmroff(0, mmr_wrong_nwid_l), &m.mmr_wrong_nwid_l,
-                 2);
-        mmc_read(ioaddr, mmroff(0, mmr_thr_pre_set), &m.mmr_thr_pre_set,
-                 4);
-
-        mmc_out(ioaddr, mmwoff(0, mmw_freeze), 0);
-
-        /* Copy data to wireless stuff. */
-        wstats->status = m.mmr_dce_status & MMR_DCE_STATUS;
-        wstats->qual.qual = m.mmr_sgnl_qual & MMR_SGNL_QUAL;
-        wstats->qual.level = m.mmr_signal_lvl & MMR_SIGNAL_LVL;
-        wstats->qual.noise = m.mmr_silence_lvl & MMR_SILENCE_LVL;
-        wstats->qual.updated = (((m. mmr_signal_lvl & MMR_SIGNAL_LVL_VALID) >> 7) 
-                        | ((m.mmr_signal_lvl & MMR_SIGNAL_LVL_VALID) >> 6) 
-                        | ((m.mmr_silence_lvl & MMR_SILENCE_LVL_VALID) >> 5));
-        wstats->discard.nwid += (m.mmr_wrong_nwid_h << 8) | m.mmr_wrong_nwid_l;
-        wstats->discard.code = 0L;
-        wstats->discard.misc = 0L;
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-#ifdef DEBUG_IOCTL_TRACE
-        printk(KERN_DEBUG "%s: <-wavelan_get_wireless_stats()\n",
-               dev->name);
-#endif
-        return &lp->wstats;
-}
-
-/************************* PACKET RECEPTION *************************/
-/*
- * This part deals with receiving the packets.
- * The interrupt handler gets an interrupt when a packet has been
- * successfully received and calls this part.
- */
-
-/*------------------------------------------------------------------*/
-/*
- * This routine does the actual copying of data (including the Ethernet
- * header structure) from the WaveLAN card to an sk_buff chain that
- * will be passed up to the network interface layer. NOTE: we
- * currently don't handle trailer protocols (neither does the rest of
- * the network interface), so if that is needed, it will (at least in
- * part) be added here.  The contents of the receive ring buffer are
- * copied to a message chain that is then passed to the kernel.
- *
- * Note: if any errors occur, the packet is "dropped on the floor".
- * (called by wv_packet_rcv())
- */
-static void
-wv_packet_read(struct net_device * dev, u16 buf_off, int sksize)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
-        struct sk_buff *skb;
-
-#ifdef DEBUG_RX_TRACE
-        printk(KERN_DEBUG "%s: ->wv_packet_read(0x%X, %d)\n",
-               dev->name, buf_off, sksize);
-#endif
-
-        /* Allocate buffer for the data */
-        if ((skb = dev_alloc_skb(sksize)) == (struct sk_buff *) NULL) {
-#ifdef DEBUG_RX_ERROR
-                printk(KERN_INFO
-                       "%s: wv_packet_read(): could not alloc_skb(%d, GFP_ATOMIC).\n",
-                       dev->name, sksize);
-#endif
-                dev->stats.rx_dropped++;
-                return;
-        }
-
-        /* Copy the packet to the buffer. */
-        obram_read(ioaddr, buf_off, skb_put(skb, sksize), sksize);
-        skb->protocol = eth_type_trans(skb, dev);
-
-#ifdef DEBUG_RX_INFO
-        wv_packet_info(skb_mac_header(skb), sksize, dev->name,
-                       "wv_packet_read");
-#endif                          /* DEBUG_RX_INFO */
-
-        /* Statistics-gathering and associated stuff.
-         * It seem a bit messy with all the define, but it's really
-         * simple... */
-        if (
-#ifdef IW_WIRELESS_SPY          /* defined in iw_handler.h */
-                   (lp->spy_data.spy_number > 0) ||
-#endif /* IW_WIRELESS_SPY */
-#ifdef HISTOGRAM
-                   (lp->his_number > 0) ||
-#endif /* HISTOGRAM */
-                   0) {
-                u8 stats[3];    /* signal level, noise level, signal quality */
-
-                /* Read signal level, silence level and signal quality bytes */
-                /* Note: in the PCMCIA hardware, these are part of the frame.
-                 * It seems that for the ISA hardware, it's nowhere to be
-                 * found in the frame, so I'm obliged to do this (it has a
-                 * side effect on /proc/net/wireless).
-                 * Any ideas?
-                 */
-                mmc_out(ioaddr, mmwoff(0, mmw_freeze), 1);
-                mmc_read(ioaddr, mmroff(0, mmr_signal_lvl), stats, 3);
-                mmc_out(ioaddr, mmwoff(0, mmw_freeze), 0);
-
-#ifdef DEBUG_RX_INFO
-                printk(KERN_DEBUG
-                       "%s: wv_packet_read(): Signal level %d/63, Silence level %d/63, signal quality %d/16\n",
-                       dev->name, stats[0] & 0x3F, stats[1] & 0x3F,
-                       stats[2] & 0x0F);
-#endif
-
-                /* Spying stuff */
-#ifdef IW_WIRELESS_SPY
-                wl_spy_gather(dev, skb_mac_header(skb) + WAVELAN_ADDR_SIZE,
-                              stats);
-#endif /* IW_WIRELESS_SPY */
-#ifdef HISTOGRAM
-                wl_his_gather(dev, stats);
-#endif /* HISTOGRAM */
-        }
-
-        /*
-         * Hand the packet to the network module.
-         */
-        netif_rx(skb);
-
-        /* Keep statistics up to date */
-        dev->stats.rx_packets++;
-        dev->stats.rx_bytes += sksize;
-
-#ifdef DEBUG_RX_TRACE
-        printk(KERN_DEBUG "%s: <-wv_packet_read()\n", dev->name);
-#endif
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Transfer as many packets as we can
- * from the device RAM.
- * (called in wavelan_interrupt()).
- * Note : the spinlock is already grabbed for us.
- */
-static void wv_receive(struct net_device * dev)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        fd_t fd;
-        rbd_t rbd;
-        int nreaped = 0;
-
-#ifdef DEBUG_RX_TRACE
-        printk(KERN_DEBUG "%s: ->wv_receive()\n", dev->name);
-#endif
-
-        /* Loop on each received packet. */
-        for (;;) {
-                obram_read(ioaddr, lp->rx_head, (unsigned char *) &fd,
-                           sizeof(fd));
-
-                /* Note about the status :
-                 * It start up to be 0 (the value we set). Then, when the RU
-                 * grab the buffer to prepare for reception, it sets the
-                 * FD_STATUS_B flag. When the RU has finished receiving the
-                 * frame, it clears FD_STATUS_B, set FD_STATUS_C to indicate
-                 * completion and set the other flags to indicate the eventual
-                 * errors. FD_STATUS_OK indicates that the reception was OK.
-                 */
-
-                /* If the current frame is not complete, we have reached the end. */
-                if ((fd.fd_status & FD_STATUS_C) != FD_STATUS_C)
-                        break;  /* This is how we exit the loop. */
-
-                nreaped++;
-
-                /* Check whether frame was correctly received. */
-                if ((fd.fd_status & FD_STATUS_OK) == FD_STATUS_OK) {
-                        /* Does the frame contain a pointer to the data?  Let's check. */
-                        if (fd.fd_rbd_offset != I82586NULL) {
-                                /* Read the receive buffer descriptor */
-                                obram_read(ioaddr, fd.fd_rbd_offset,
-                                           (unsigned char *) &rbd,
-                                           sizeof(rbd));
-
-#ifdef DEBUG_RX_ERROR
-                                if ((rbd.rbd_status & RBD_STATUS_EOF) !=
-                                    RBD_STATUS_EOF) printk(KERN_INFO
-                                                           "%s: wv_receive(): missing EOF flag.\n",
-                                                           dev->name);
-
-                                if ((rbd.rbd_status & RBD_STATUS_F) !=
-                                    RBD_STATUS_F) printk(KERN_INFO
-                                                         "%s: wv_receive(): missing F flag.\n",
-                                                         dev->name);
-#endif                          /* DEBUG_RX_ERROR */
-
-                                /* Read the packet and transmit to Linux */
-                                wv_packet_read(dev, rbd.rbd_bufl,
-                                               rbd.
-                                               rbd_status &
-                                               RBD_STATUS_ACNT);
-                        }
-#ifdef DEBUG_RX_ERROR
-                        else    /* if frame has no data */
-                                printk(KERN_INFO
-                                       "%s: wv_receive(): frame has no data.\n",
-                                       dev->name);
-#endif
-                } else {        /* If reception was no successful */
-
-                        dev->stats.rx_errors++;
-
-#ifdef DEBUG_RX_INFO
-                        printk(KERN_DEBUG
-                               "%s: wv_receive(): frame not received successfully (%X).\n",
-                               dev->name, fd.fd_status);
-#endif
-
-#ifdef DEBUG_RX_ERROR
-                        if ((fd.fd_status & FD_STATUS_S6) != 0)
-                                printk(KERN_INFO
-                                       "%s: wv_receive(): no EOF flag.\n",
-                                       dev->name);
-#endif
-
-                        if ((fd.fd_status & FD_STATUS_S7) != 0) {
-                                dev->stats.rx_length_errors++;
-#ifdef DEBUG_RX_FAIL
-                                printk(KERN_DEBUG
-                                       "%s: wv_receive(): frame too short.\n",
-                                       dev->name);
-#endif
-                        }
-
-                        if ((fd.fd_status & FD_STATUS_S8) != 0) {
-                                dev->stats.rx_over_errors++;
-#ifdef DEBUG_RX_FAIL
-                                printk(KERN_DEBUG
-                                       "%s: wv_receive(): rx DMA overrun.\n",
-                                       dev->name);
-#endif
-                        }
-
-                        if ((fd.fd_status & FD_STATUS_S9) != 0) {
-                                dev->stats.rx_fifo_errors++;
-#ifdef DEBUG_RX_FAIL
-                                printk(KERN_DEBUG
-                                       "%s: wv_receive(): ran out of resources.\n",
-                                       dev->name);
-#endif
-                        }
-
-                        if ((fd.fd_status & FD_STATUS_S10) != 0) {
-                                dev->stats.rx_frame_errors++;
-#ifdef DEBUG_RX_FAIL
-                                printk(KERN_DEBUG
-                                       "%s: wv_receive(): alignment error.\n",
-                                       dev->name);
-#endif
-                        }
-
-                        if ((fd.fd_status & FD_STATUS_S11) != 0) {
-                                dev->stats.rx_crc_errors++;
-#ifdef DEBUG_RX_FAIL
-                                printk(KERN_DEBUG
-                                       "%s: wv_receive(): CRC error.\n",
-                                       dev->name);
-#endif
-                        }
-                }
-
-                fd.fd_status = 0;
-                obram_write(ioaddr, fdoff(lp->rx_head, fd_status),
-                            (unsigned char *) &fd.fd_status,
-                            sizeof(fd.fd_status));
-
-                fd.fd_command = FD_COMMAND_EL;
-                obram_write(ioaddr, fdoff(lp->rx_head, fd_command),
-                            (unsigned char *) &fd.fd_command,
-                            sizeof(fd.fd_command));
-
-                fd.fd_command = 0;
-                obram_write(ioaddr, fdoff(lp->rx_last, fd_command),
-                            (unsigned char *) &fd.fd_command,
-                            sizeof(fd.fd_command));
-
-                lp->rx_last = lp->rx_head;
-                lp->rx_head = fd.fd_link_offset;
-        }                       /* for(;;) -> loop on all frames */
-
-#ifdef DEBUG_RX_INFO
-        if (nreaped > 1)
-                printk(KERN_DEBUG "%s: wv_receive(): reaped %d\n",
-                       dev->name, nreaped);
-#endif
-#ifdef DEBUG_RX_TRACE
-        printk(KERN_DEBUG "%s: <-wv_receive()\n", dev->name);
-#endif
-}
-
-/*********************** PACKET TRANSMISSION ***********************/
-/*
- * This part deals with sending packets through the WaveLAN.
- *
- */
-
-/*------------------------------------------------------------------*/
-/*
- * This routine fills in the appropriate registers and memory
- * locations on the WaveLAN card and starts the card off on
- * the transmit.
- *
- * The principle:
- * Each block contains a transmit command, a NOP command,
- * a transmit block descriptor and a buffer.
- * The CU read the transmit block which point to the tbd,
- * read the tbd and the content of the buffer.
- * When it has finish with it, it goes to the next command
- * which in our case is the NOP. The NOP points on itself,
- * so the CU stop here.
- * When we add the next block, we modify the previous nop
- * to make it point on the new tx command.
- * Simple, isn't it ?
- *
- * (called in wavelan_packet_xmit())
- */
-static int wv_packet_write(struct net_device * dev, void *buf, short length)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
-        unsigned short txblock;
-        unsigned short txpred;
-        unsigned short tx_addr;
-        unsigned short nop_addr;
-        unsigned short tbd_addr;
-        unsigned short buf_addr;
-        ac_tx_t tx;
-        ac_nop_t nop;
-        tbd_t tbd;
-        int clen = length;
-        unsigned long flags;
-
-#ifdef DEBUG_TX_TRACE
-        printk(KERN_DEBUG "%s: ->wv_packet_write(%d)\n", dev->name,
-               length);
-#endif
-
-        spin_lock_irqsave(&lp->spinlock, flags);
-
-        /* Check nothing bad has happened */
-        if (lp->tx_n_in_use == (NTXBLOCKS - 1)) {
-#ifdef DEBUG_TX_ERROR
-                printk(KERN_INFO "%s: wv_packet_write(): Tx queue full.\n",
-                       dev->name);
-#endif
-                spin_unlock_irqrestore(&lp->spinlock, flags);
-                return 1;
-        }
-
-        /* Calculate addresses of next block and previous block. */
-        txblock = lp->tx_first_free;
-        txpred = txblock - TXBLOCKZ;
-        if (txpred < OFFSET_CU)
-                txpred += NTXBLOCKS * TXBLOCKZ;
-        lp->tx_first_free += TXBLOCKZ;
-        if (lp->tx_first_free >= OFFSET_CU + NTXBLOCKS * TXBLOCKZ)
-                lp->tx_first_free -= NTXBLOCKS * TXBLOCKZ;
-
-        lp->tx_n_in_use++;
-
-        /* Calculate addresses of the different parts of the block. */
-        tx_addr = txblock;
-        nop_addr = tx_addr + sizeof(tx);
-        tbd_addr = nop_addr + sizeof(nop);
-        buf_addr = tbd_addr + sizeof(tbd);
-
-        /*
-         * Transmit command
-         */
-        tx.tx_h.ac_status = 0;
-        obram_write(ioaddr, toff(ac_tx_t, tx_addr, tx_h.ac_status),
-                    (unsigned char *) &tx.tx_h.ac_status,
-                    sizeof(tx.tx_h.ac_status));
-
-        /*
-         * NOP command
-         */
-        nop.nop_h.ac_status = 0;
-        obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_status),
-                    (unsigned char *) &nop.nop_h.ac_status,
-                    sizeof(nop.nop_h.ac_status));
-        nop.nop_h.ac_link = nop_addr;
-        obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_link),
-                    (unsigned char *) &nop.nop_h.ac_link,
-                    sizeof(nop.nop_h.ac_link));
-
-        /*
-         * Transmit buffer descriptor
-         */
-        tbd.tbd_status = TBD_STATUS_EOF | (TBD_STATUS_ACNT & clen);
-        tbd.tbd_next_bd_offset = I82586NULL;
-        tbd.tbd_bufl = buf_addr;
-        tbd.tbd_bufh = 0;
-        obram_write(ioaddr, tbd_addr, (unsigned char *) &tbd, sizeof(tbd));
-
-        /*
-         * Data
-         */
-        obram_write(ioaddr, buf_addr, buf, length);
-
-        /*
-         * Overwrite the predecessor NOP link
-         * so that it points to this txblock.
-         */
-        nop_addr = txpred + sizeof(tx);
-        nop.nop_h.ac_status = 0;
-        obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_status),
-                    (unsigned char *) &nop.nop_h.ac_status,
-                    sizeof(nop.nop_h.ac_status));
-        nop.nop_h.ac_link = txblock;
-        obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_link),
-                    (unsigned char *) &nop.nop_h.ac_link,
-                    sizeof(nop.nop_h.ac_link));
-
-        /* Make sure the watchdog will keep quiet for a while */
-        dev->trans_start = jiffies;
-
-        /* Keep stats up to date. */
-        dev->stats.tx_bytes += length;
-
-        if (lp->tx_first_in_use == I82586NULL)
-                lp->tx_first_in_use = txblock;
-
-        if (lp->tx_n_in_use < NTXBLOCKS - 1)
-                netif_wake_queue(dev);
-
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-        
-#ifdef DEBUG_TX_INFO
-        wv_packet_info((u8 *) buf, length, dev->name,
-                       "wv_packet_write");
-#endif                          /* DEBUG_TX_INFO */
-
-#ifdef DEBUG_TX_TRACE
-        printk(KERN_DEBUG "%s: <-wv_packet_write()\n", dev->name);
-#endif
-
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * This routine is called when we want to send a packet (NET3 callback)
- * In this routine, we check if the harware is ready to accept
- * the packet.  We also prevent reentrance.  Then we call the function
- * to send the packet.
- */
-static netdev_tx_t wavelan_packet_xmit(struct sk_buff *skb,
-                                             struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long flags;
-        char data[ETH_ZLEN];
-
-#ifdef DEBUG_TX_TRACE
-        printk(KERN_DEBUG "%s: ->wavelan_packet_xmit(0x%X)\n", dev->name,
-               (unsigned) skb);
-#endif
-
-        /*
-         * Block a timer-based transmit from overlapping.
-         * In other words, prevent reentering this routine.
-         */
-        netif_stop_queue(dev);
-
-        /* If somebody has asked to reconfigure the controller, 
-         * we can do it now.
-         */
-        if (lp->reconfig_82586) {
-                spin_lock_irqsave(&lp->spinlock, flags);
-                wv_82586_config(dev);
-                spin_unlock_irqrestore(&lp->spinlock, flags);
-                /* Check that we can continue */
-                if (lp->tx_n_in_use == (NTXBLOCKS - 1))
-                        return NETDEV_TX_BUSY;
-        }
-
-        /* Do we need some padding? */
-        /* Note : on wireless the propagation time is in the order of 1us,
-         * and we don't have the Ethernet specific requirement of beeing
-         * able to detect collisions, therefore in theory we don't really
-         * need to pad. Jean II */
-        if (skb->len < ETH_ZLEN) {
-                memset(data, 0, ETH_ZLEN);
-                skb_copy_from_linear_data(skb, data, skb->len);
-                /* Write packet on the card */
-                if(wv_packet_write(dev, data, ETH_ZLEN))
-                        return NETDEV_TX_BUSY;  /* We failed */
-        }
-        else if(wv_packet_write(dev, skb->data, skb->len))
-                return NETDEV_TX_BUSY;  /* We failed */
-
-
-        dev_kfree_skb(skb);
-
-#ifdef DEBUG_TX_TRACE
-        printk(KERN_DEBUG "%s: <-wavelan_packet_xmit()\n", dev->name);
-#endif
-        return NETDEV_TX_OK;
-}
-
-/*********************** HARDWARE CONFIGURATION ***********************/
-/*
- * This part does the real job of starting and configuring the hardware.
- */
-
-/*--------------------------------------------------------------------*/
-/*
- * Routine to initialize the Modem Management Controller.
- * (called by wv_hw_reset())
- */
-static int wv_mmc_init(struct net_device * dev)
-{
-        unsigned long ioaddr = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        psa_t psa;
-        mmw_t m;
-        int configured;
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: ->wv_mmc_init()\n", dev->name);
-#endif
-
-        /* Read the parameter storage area. */
-        psa_read(ioaddr, lp->hacr, 0, (unsigned char *) &psa, sizeof(psa));
-
-#ifdef USE_PSA_CONFIG
-        configured = psa.psa_conf_status & 1;
-#else
-        configured = 0;
-#endif
-
-        /* Is the PSA is not configured */
-        if (!configured) {
-                /* User will be able to configure NWID later (with iwconfig). */
-                psa.psa_nwid[0] = 0;
-                psa.psa_nwid[1] = 0;
-
-                /* no NWID checking since NWID is not set */
-                psa.psa_nwid_select = 0;
-
-                /* Disable encryption */
-                psa.psa_encryption_select = 0;
-
-                /* Set to standard values:
-                 * 0x04 for AT,
-                 * 0x01 for MCA,
-                 * 0x04 for PCMCIA and 2.00 card (AT&T 407-024689/E document)
-                 */
-                if (psa.psa_comp_number & 1)
-                        psa.psa_thr_pre_set = 0x01;
-                else
-                        psa.psa_thr_pre_set = 0x04;
-                psa.psa_quality_thr = 0x03;
-
-                /* It is configured */
-                psa.psa_conf_status |= 1;
-
-#ifdef USE_PSA_CONFIG
-                /* Write the psa. */
-                psa_write(ioaddr, lp->hacr,
-                          (char *) psa.psa_nwid - (char *) &psa,
-                          (unsigned char *) psa.psa_nwid, 4);
-                psa_write(ioaddr, lp->hacr,
-                          (char *) &psa.psa_thr_pre_set - (char *) &psa,
-                          (unsigned char *) &psa.psa_thr_pre_set, 1);
-                psa_write(ioaddr, lp->hacr,
-                          (char *) &psa.psa_quality_thr - (char *) &psa,
-                          (unsigned char *) &psa.psa_quality_thr, 1);
-                psa_write(ioaddr, lp->hacr,
-                          (char *) &psa.psa_conf_status - (char *) &psa,
-                          (unsigned char *) &psa.psa_conf_status, 1);
-                /* update the Wavelan checksum */
-                update_psa_checksum(dev, ioaddr, lp->hacr);
-#endif
-        }
-
-        /* Zero the mmc structure. */
-        memset(&m, 0x00, sizeof(m));
-
-        /* Copy PSA info to the mmc. */
-        m.mmw_netw_id_l = psa.psa_nwid[1];
-        m.mmw_netw_id_h = psa.psa_nwid[0];
-
-        if (psa.psa_nwid_select & 1)
-                m.mmw_loopt_sel = 0x00;
-        else
-                m.mmw_loopt_sel = MMW_LOOPT_SEL_DIS_NWID;
-
-        memcpy(&m.mmw_encr_key, &psa.psa_encryption_key,
-               sizeof(m.mmw_encr_key));
-
-        if (psa.psa_encryption_select)
-                m.mmw_encr_enable =
-                    MMW_ENCR_ENABLE_EN | MMW_ENCR_ENABLE_MODE;
-        else
-                m.mmw_encr_enable = 0;
-
-        m.mmw_thr_pre_set = psa.psa_thr_pre_set & 0x3F;
-        m.mmw_quality_thr = psa.psa_quality_thr & 0x0F;
-
-        /*
-         * Set default modem control parameters.
-         * See NCR document 407-0024326 Rev. A.
-         */
-        m.mmw_jabber_enable = 0x01;
-        m.mmw_freeze = 0;
-        m.mmw_anten_sel = MMW_ANTEN_SEL_ALG_EN;
-        m.mmw_ifs = 0x20;
-        m.mmw_mod_delay = 0x04;
-        m.mmw_jam_time = 0x38;
-
-        m.mmw_des_io_invert = 0;
-        m.mmw_decay_prm = 0;
-        m.mmw_decay_updat_prm = 0;
-
-        /* Write all info to MMC. */
-        mmc_write(ioaddr, 0, (u8 *) & m, sizeof(m));
-
-        /* The following code starts the modem of the 2.00 frequency
-         * selectable cards at power on.  It's not strictly needed for the
-         * following boots.
-         * The original patch was by Joe Finney for the PCMCIA driver, but
-         * I've cleaned it up a bit and added documentation.
-         * Thanks to Loeke Brederveld from Lucent for the info.
-         */
-
-        /* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable)
-         * Does it work for everybody, especially old cards? */
-        /* Note: WFREQSEL verifies that it is able to read a sensible
-         * frequency from EEPROM (address 0x00) and that MMR_FEE_STATUS_ID
-         * is 0xA (Xilinx version) or 0xB (Ariadne version).
-         * My test is more crude but does work. */
-        if (!(mmc_in(ioaddr, mmroff(0, mmr_fee_status)) &
-              (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY))) {
-                /* We must download the frequency parameters to the
-                 * synthesizers (from the EEPROM - area 1)
-                 * Note: as the EEPROM is automatically decremented, we set the end
-                 * if the area... */
-                m.mmw_fee_addr = 0x0F;
-                m.mmw_fee_ctrl = MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD;
-                mmc_write(ioaddr, (char *) &m.mmw_fee_ctrl - (char *) &m,
-                          (unsigned char *) &m.mmw_fee_ctrl, 2);
-
-                /* Wait until the download is finished. */
-                fee_wait(ioaddr, 100, 100);
-
-#ifdef DEBUG_CONFIG_INFO
-                /* The frequency was in the last word downloaded. */
-                mmc_read(ioaddr, (char *) &m.mmw_fee_data_l - (char *) &m,
-                         (unsigned char *) &m.mmw_fee_data_l, 2);
-
-                /* Print some info for the user. */
-                printk(KERN_DEBUG
-                       "%s: WaveLAN 2.00 recognised (frequency select).  Current frequency = %ld\n",
-                       dev->name,
-                       ((m.
-                         mmw_fee_data_h << 4) | (m.mmw_fee_data_l >> 4)) *
-                       5 / 2 + 24000L);
-#endif
-
-                /* We must now download the power adjust value (gain) to
-                 * the synthesizers (from the EEPROM - area 7 - DAC). */
-                m.mmw_fee_addr = 0x61;
-                m.mmw_fee_ctrl = MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD;
-                mmc_write(ioaddr, (char *) &m.mmw_fee_ctrl - (char *) &m,
-                          (unsigned char *) &m.mmw_fee_ctrl, 2);
-
-                /* Wait until the download is finished. */
-        }
-        /* if 2.00 card */
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: <-wv_mmc_init()\n", dev->name);
-#endif
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Construct the fd and rbd structures.
- * Start the receive unit.
- * (called by wv_hw_reset())
- */
-static int wv_ru_start(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
-        u16 scb_cs;
-        fd_t fd;
-        rbd_t rbd;
-        u16 rx;
-        u16 rx_next;
-        int i;
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: ->wv_ru_start()\n", dev->name);
-#endif
-
-        obram_read(ioaddr, scboff(OFFSET_SCB, scb_status),
-                   (unsigned char *) &scb_cs, sizeof(scb_cs));
-        if ((scb_cs & SCB_ST_RUS) == SCB_ST_RUS_RDY)
-                return 0;
-
-        lp->rx_head = OFFSET_RU;
-
-        for (i = 0, rx = lp->rx_head; i < NRXBLOCKS; i++, rx = rx_next) {
-                rx_next =
-                    (i == NRXBLOCKS - 1) ? lp->rx_head : rx + RXBLOCKZ;
-
-                fd.fd_status = 0;
-                fd.fd_command = (i == NRXBLOCKS - 1) ? FD_COMMAND_EL : 0;
-                fd.fd_link_offset = rx_next;
-                fd.fd_rbd_offset = rx + sizeof(fd);
-                obram_write(ioaddr, rx, (unsigned char *) &fd, sizeof(fd));
-
-                rbd.rbd_status = 0;
-                rbd.rbd_next_rbd_offset = I82586NULL;
-                rbd.rbd_bufl = rx + sizeof(fd) + sizeof(rbd);
-                rbd.rbd_bufh = 0;
-                rbd.rbd_el_size = RBD_EL | (RBD_SIZE & MAXDATAZ);
-                obram_write(ioaddr, rx + sizeof(fd),
-                            (unsigned char *) &rbd, sizeof(rbd));
-
-                lp->rx_last = rx;
-        }
-
-        obram_write(ioaddr, scboff(OFFSET_SCB, scb_rfa_offset),
-                    (unsigned char *) &lp->rx_head, sizeof(lp->rx_head));
-
-        scb_cs = SCB_CMD_RUC_GO;
-        obram_write(ioaddr, scboff(OFFSET_SCB, scb_command),
-                    (unsigned char *) &scb_cs, sizeof(scb_cs));
-
-        set_chan_attn(ioaddr, lp->hacr);
-
-        for (i = 1000; i > 0; i--) {
-                obram_read(ioaddr, scboff(OFFSET_SCB, scb_command),
-                           (unsigned char *) &scb_cs, sizeof(scb_cs));
-                if (scb_cs == 0)
-                        break;
-
-                udelay(10);
-        }
-
-        if (i <= 0) {
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_INFO
-                       "%s: wavelan_ru_start(): board not accepting command.\n",
-                       dev->name);
-#endif
-                return -1;
-        }
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: <-wv_ru_start()\n", dev->name);
-#endif
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Initialise the transmit blocks.
- * Start the command unit executing the NOP
- * self-loop of the first transmit block.
- *
- * Here we create the list of send buffers used to transmit packets
- * between the PC and the command unit. For each buffer, we create a
- * buffer descriptor (pointing on the buffer), a transmit command
- * (pointing to the buffer descriptor) and a NOP command.
- * The transmit command is linked to the NOP, and the NOP to itself.
- * When we will have finished executing the transmit command, we will
- * then loop on the NOP. By releasing the NOP link to a new command,
- * we may send another buffer.
- *
- * (called by wv_hw_reset())
- */
-static int wv_cu_start(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
-        int i;
-        u16 txblock;
-        u16 first_nop;
-        u16 scb_cs;
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: ->wv_cu_start()\n", dev->name);
-#endif
-
-        lp->tx_first_free = OFFSET_CU;
-        lp->tx_first_in_use = I82586NULL;
-
-        for (i = 0, txblock = OFFSET_CU;
-             i < NTXBLOCKS; i++, txblock += TXBLOCKZ) {
-                ac_tx_t tx;
-                ac_nop_t nop;
-                tbd_t tbd;
-                unsigned short tx_addr;
-                unsigned short nop_addr;
-                unsigned short tbd_addr;
-                unsigned short buf_addr;
-
-                tx_addr = txblock;
-                nop_addr = tx_addr + sizeof(tx);
-                tbd_addr = nop_addr + sizeof(nop);
-                buf_addr = tbd_addr + sizeof(tbd);
-
-                tx.tx_h.ac_status = 0;
-                tx.tx_h.ac_command = acmd_transmit | AC_CFLD_I;
-                tx.tx_h.ac_link = nop_addr;
-                tx.tx_tbd_offset = tbd_addr;
-                obram_write(ioaddr, tx_addr, (unsigned char *) &tx,
-                            sizeof(tx));
-
-                nop.nop_h.ac_status = 0;
-                nop.nop_h.ac_command = acmd_nop;
-                nop.nop_h.ac_link = nop_addr;
-                obram_write(ioaddr, nop_addr, (unsigned char *) &nop,
-                            sizeof(nop));
-
-                tbd.tbd_status = TBD_STATUS_EOF;
-                tbd.tbd_next_bd_offset = I82586NULL;
-                tbd.tbd_bufl = buf_addr;
-                tbd.tbd_bufh = 0;
-                obram_write(ioaddr, tbd_addr, (unsigned char *) &tbd,
-                            sizeof(tbd));
-        }
-
-        first_nop =
-            OFFSET_CU + (NTXBLOCKS - 1) * TXBLOCKZ + sizeof(ac_tx_t);
-        obram_write(ioaddr, scboff(OFFSET_SCB, scb_cbl_offset),
-                    (unsigned char *) &first_nop, sizeof(first_nop));
-
-        scb_cs = SCB_CMD_CUC_GO;
-        obram_write(ioaddr, scboff(OFFSET_SCB, scb_command),
-                    (unsigned char *) &scb_cs, sizeof(scb_cs));
-
-        set_chan_attn(ioaddr, lp->hacr);
-
-        for (i = 1000; i > 0; i--) {
-                obram_read(ioaddr, scboff(OFFSET_SCB, scb_command),
-                           (unsigned char *) &scb_cs, sizeof(scb_cs));
-                if (scb_cs == 0)
-                        break;
-
-                udelay(10);
-        }
-
-        if (i <= 0) {
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_INFO
-                       "%s: wavelan_cu_start(): board not accepting command.\n",
-                       dev->name);
-#endif
-                return -1;
-        }
-
-        lp->tx_n_in_use = 0;
-        netif_start_queue(dev);
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: <-wv_cu_start()\n", dev->name);
-#endif
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * This routine does a standard configuration of the WaveLAN 
- * controller (i82586).
- *
- * It initialises the scp, iscp and scb structure
- * The first two are just pointers to the next.
- * The last one is used for basic configuration and for basic
- * communication (interrupt status).
- *
- * (called by wv_hw_reset())
- */
-static int wv_82586_start(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
-        scp_t scp;              /* system configuration pointer */
-        iscp_t iscp;            /* intermediate scp */
-        scb_t scb;              /* system control block */
-        ach_t cb;               /* Action command header */
-        u8 zeroes[512];
-        int i;
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: ->wv_82586_start()\n", dev->name);
-#endif
-
-        /*
-         * Clear the onboard RAM.
-         */
-        memset(&zeroes[0], 0x00, sizeof(zeroes));
-        for (i = 0; i < I82586_MEMZ; i += sizeof(zeroes))
-                obram_write(ioaddr, i, &zeroes[0], sizeof(zeroes));
-
-        /*
-         * Construct the command unit structures:
-         * scp, iscp, scb, cb.
-         */
-        memset(&scp, 0x00, sizeof(scp));
-        scp.scp_sysbus = SCP_SY_16BBUS;
-        scp.scp_iscpl = OFFSET_ISCP;
-        obram_write(ioaddr, OFFSET_SCP, (unsigned char *) &scp,
-                    sizeof(scp));
-
-        memset(&iscp, 0x00, sizeof(iscp));
-        iscp.iscp_busy = 1;
-        iscp.iscp_offset = OFFSET_SCB;
-        obram_write(ioaddr, OFFSET_ISCP, (unsigned char *) &iscp,
-                    sizeof(iscp));
-
-        /* Our first command is to reset the i82586. */
-        memset(&scb, 0x00, sizeof(scb));
-        scb.scb_command = SCB_CMD_RESET;
-        scb.scb_cbl_offset = OFFSET_CU;
-        scb.scb_rfa_offset = OFFSET_RU;
-        obram_write(ioaddr, OFFSET_SCB, (unsigned char *) &scb,
-                    sizeof(scb));
-
-        set_chan_attn(ioaddr, lp->hacr);
-
-        /* Wait for command to finish. */
-        for (i = 1000; i > 0; i--) {
-                obram_read(ioaddr, OFFSET_ISCP, (unsigned char *) &iscp,
-                           sizeof(iscp));
-
-                if (iscp.iscp_busy == (unsigned short) 0)
-                        break;
-
-                udelay(10);
-        }
-
-        if (i <= 0) {
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_INFO
-                       "%s: wv_82586_start(): iscp_busy timeout.\n",
-                       dev->name);
-#endif
-                return -1;
-        }
-
-        /* Check command completion. */
-        for (i = 15; i > 0; i--) {
-                obram_read(ioaddr, OFFSET_SCB, (unsigned char *) &scb,
-                           sizeof(scb));
-
-                if (scb.scb_status == (SCB_ST_CX | SCB_ST_CNA))
-                        break;
-
-                udelay(10);
-        }
-
-        if (i <= 0) {
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_INFO
-                       "%s: wv_82586_start(): status: expected 0x%02x, got 0x%02x.\n",
-                       dev->name, SCB_ST_CX | SCB_ST_CNA, scb.scb_status);
-#endif
-                return -1;
-        }
-
-        wv_ack(dev);
-
-        /* Set the action command header. */
-        memset(&cb, 0x00, sizeof(cb));
-        cb.ac_command = AC_CFLD_EL | (AC_CFLD_CMD & acmd_diagnose);
-        cb.ac_link = OFFSET_CU;
-        obram_write(ioaddr, OFFSET_CU, (unsigned char *) &cb, sizeof(cb));
-
-        if (wv_synchronous_cmd(dev, "diag()") == -1)
-                return -1;
-
-        obram_read(ioaddr, OFFSET_CU, (unsigned char *) &cb, sizeof(cb));
-        if (cb.ac_status & AC_SFLD_FAIL) {
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_INFO
-                       "%s: wv_82586_start(): i82586 Self Test failed.\n",
-                       dev->name);
-#endif
-                return -1;
-        }
-#ifdef DEBUG_I82586_SHOW
-        wv_scb_show(ioaddr);
-#endif
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: <-wv_82586_start()\n", dev->name);
-#endif
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * This routine does a standard configuration of the WaveLAN
- * controller (i82586).
- *
- * This routine is a violent hack. We use the first free transmit block
- * to make our configuration. In the buffer area, we create the three
- * configuration commands (linked). We make the previous NOP point to
- * the beginning of the buffer instead of the tx command. After, we go
- * as usual to the NOP command.
- * Note that only the last command (mc_set) will generate an interrupt.
- *
- * (called by wv_hw_reset(), wv_82586_reconfig(), wavelan_packet_xmit())
- */
-static void wv_82586_config(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
-        unsigned short txblock;
-        unsigned short txpred;
-        unsigned short tx_addr;
-        unsigned short nop_addr;
-        unsigned short tbd_addr;
-        unsigned short cfg_addr;
-        unsigned short ias_addr;
-        unsigned short mcs_addr;
-        ac_tx_t tx;
-        ac_nop_t nop;
-        ac_cfg_t cfg;           /* Configure action */
-        ac_ias_t ias;           /* IA-setup action */
-        ac_mcs_t mcs;           /* Multicast setup */
-        struct dev_mc_list *dmi;
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: ->wv_82586_config()\n", dev->name);
-#endif
-
-        /* Check nothing bad has happened */
-        if (lp->tx_n_in_use == (NTXBLOCKS - 1)) {
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_INFO "%s: wv_82586_config(): Tx queue full.\n",
-                       dev->name);
-#endif
-                return;
-        }
-
-        /* Calculate addresses of next block and previous block. */
-        txblock = lp->tx_first_free;
-        txpred = txblock - TXBLOCKZ;
-        if (txpred < OFFSET_CU)
-                txpred += NTXBLOCKS * TXBLOCKZ;
-        lp->tx_first_free += TXBLOCKZ;
-        if (lp->tx_first_free >= OFFSET_CU + NTXBLOCKS * TXBLOCKZ)
-                lp->tx_first_free -= NTXBLOCKS * TXBLOCKZ;
-
-        lp->tx_n_in_use++;
-
-        /* Calculate addresses of the different parts of the block. */
-        tx_addr = txblock;
-        nop_addr = tx_addr + sizeof(tx);
-        tbd_addr = nop_addr + sizeof(nop);
-        cfg_addr = tbd_addr + sizeof(tbd_t);    /* beginning of the buffer */
-        ias_addr = cfg_addr + sizeof(cfg);
-        mcs_addr = ias_addr + sizeof(ias);
-
-        /*
-         * Transmit command
-         */
-        tx.tx_h.ac_status = 0xFFFF;     /* Fake completion value */
-        obram_write(ioaddr, toff(ac_tx_t, tx_addr, tx_h.ac_status),
-                    (unsigned char *) &tx.tx_h.ac_status,
-                    sizeof(tx.tx_h.ac_status));
-
-        /*
-         * NOP command
-         */
-        nop.nop_h.ac_status = 0;
-        obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_status),
-                    (unsigned char *) &nop.nop_h.ac_status,
-                    sizeof(nop.nop_h.ac_status));
-        nop.nop_h.ac_link = nop_addr;
-        obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_link),
-                    (unsigned char *) &nop.nop_h.ac_link,
-                    sizeof(nop.nop_h.ac_link));
-
-        /* Create a configure action. */
-        memset(&cfg, 0x00, sizeof(cfg));
-
-        /*
-         * For Linux we invert AC_CFG_ALOC() so as to conform
-         * to the way that net packets reach us from above.
-         * (See also ac_tx_t.)
-         *
-         * Updated from Wavelan Manual WCIN085B
-         */
-        cfg.cfg_byte_cnt =
-            AC_CFG_BYTE_CNT(sizeof(ac_cfg_t) - sizeof(ach_t));
-        cfg.cfg_fifolim = AC_CFG_FIFOLIM(4);
-        cfg.cfg_byte8 = AC_CFG_SAV_BF(1) | AC_CFG_SRDY(0);
-        cfg.cfg_byte9 = AC_CFG_ELPBCK(0) |
-            AC_CFG_ILPBCK(0) |
-            AC_CFG_PRELEN(AC_CFG_PLEN_2) |
-            AC_CFG_ALOC(1) | AC_CFG_ADDRLEN(WAVELAN_ADDR_SIZE);
-        cfg.cfg_byte10 = AC_CFG_BOFMET(1) |
-            AC_CFG_ACR(6) | AC_CFG_LINPRIO(0);
-        cfg.cfg_ifs = 0x20;
-        cfg.cfg_slotl = 0x0C;
-        cfg.cfg_byte13 = AC_CFG_RETRYNUM(15) | AC_CFG_SLTTMHI(0);
-        cfg.cfg_byte14 = AC_CFG_FLGPAD(0) |
-            AC_CFG_BTSTF(0) |
-            AC_CFG_CRC16(0) |
-            AC_CFG_NCRC(0) |
-            AC_CFG_TNCRS(1) |
-            AC_CFG_MANCH(0) |
-            AC_CFG_BCDIS(0) | AC_CFG_PRM(lp->promiscuous);
-        cfg.cfg_byte15 = AC_CFG_ICDS(0) |
-            AC_CFG_CDTF(0) | AC_CFG_ICSS(0) | AC_CFG_CSTF(0);
-/*
-  cfg.cfg_min_frm_len = AC_CFG_MNFRM(64);
-*/
-        cfg.cfg_min_frm_len = AC_CFG_MNFRM(8);
-
-        cfg.cfg_h.ac_command = (AC_CFLD_CMD & acmd_configure);
-        cfg.cfg_h.ac_link = ias_addr;
-        obram_write(ioaddr, cfg_addr, (unsigned char *) &cfg, sizeof(cfg));
-
-        /* Set up the MAC address */
-        memset(&ias, 0x00, sizeof(ias));
-        ias.ias_h.ac_command = (AC_CFLD_CMD & acmd_ia_setup);
-        ias.ias_h.ac_link = mcs_addr;
-        memcpy(&ias.ias_addr[0], (unsigned char *) &dev->dev_addr[0],
-               sizeof(ias.ias_addr));
-        obram_write(ioaddr, ias_addr, (unsigned char *) &ias, sizeof(ias));
-
-        /* Initialize adapter's Ethernet multicast addresses */
-        memset(&mcs, 0x00, sizeof(mcs));
-        mcs.mcs_h.ac_command = AC_CFLD_I | (AC_CFLD_CMD & acmd_mc_setup);
-        mcs.mcs_h.ac_link = nop_addr;
-        mcs.mcs_cnt = WAVELAN_ADDR_SIZE * lp->mc_count;
-        obram_write(ioaddr, mcs_addr, (unsigned char *) &mcs, sizeof(mcs));
-
-        /* Any address to set? */
-        if (lp->mc_count) {
-                for (dmi = dev->mc_list; dmi; dmi = dmi->next)
-                        outsw(PIOP1(ioaddr), (u16 *) dmi->dmi_addr,
-                              WAVELAN_ADDR_SIZE >> 1);
-
-#ifdef DEBUG_CONFIG_INFO
-                printk(KERN_DEBUG
-                       "%s: wv_82586_config(): set %d multicast addresses:\n",
-                       dev->name, lp->mc_count);
-                for (dmi = dev->mc_list; dmi; dmi = dmi->next)
-                        printk(KERN_DEBUG " %pM\n", dmi->dmi_addr);
-#endif
-        }
-
-        /*
-         * Overwrite the predecessor NOP link
-         * so that it points to the configure action.
-         */
-        nop_addr = txpred + sizeof(tx);
-        nop.nop_h.ac_status = 0;
-        obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_status),
-                    (unsigned char *) &nop.nop_h.ac_status,
-                    sizeof(nop.nop_h.ac_status));
-        nop.nop_h.ac_link = cfg_addr;
-        obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_link),
-                    (unsigned char *) &nop.nop_h.ac_link,
-                    sizeof(nop.nop_h.ac_link));
-
-        /* Job done, clear the flag */
-        lp->reconfig_82586 = 0;
-
-        if (lp->tx_first_in_use == I82586NULL)
-                lp->tx_first_in_use = txblock;
-
-        if (lp->tx_n_in_use == (NTXBLOCKS - 1))
-                netif_stop_queue(dev);
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: <-wv_82586_config()\n", dev->name);
-#endif
-}
-
-/*------------------------------------------------------------------*/
-/*
- * This routine, called by wavelan_close(), gracefully stops the 
- * WaveLAN controller (i82586).
- * (called by wavelan_close())
- */
-static void wv_82586_stop(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
-        u16 scb_cmd;
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: ->wv_82586_stop()\n", dev->name);
-#endif
-
-        /* Suspend both command unit and receive unit. */
-        scb_cmd =
-            (SCB_CMD_CUC & SCB_CMD_CUC_SUS) | (SCB_CMD_RUC &
-                                               SCB_CMD_RUC_SUS);
-        obram_write(ioaddr, scboff(OFFSET_SCB, scb_command),
-                    (unsigned char *) &scb_cmd, sizeof(scb_cmd));
-        set_chan_attn(ioaddr, lp->hacr);
-
-        /* No more interrupts */
-        wv_ints_off(dev);
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: <-wv_82586_stop()\n", dev->name);
-#endif
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Totally reset the WaveLAN and restart it.
- * Performs the following actions:
- *      1. A power reset (reset DMA)
- *      2. Initialize the radio modem (using wv_mmc_init)
- *      3. Reset & Configure LAN controller (using wv_82586_start)
- *      4. Start the LAN controller's command unit
- *      5. Start the LAN controller's receive unit
- * (called by wavelan_interrupt(), wavelan_watchdog() & wavelan_open())
- */
-static int wv_hw_reset(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: ->wv_hw_reset(dev=0x%x)\n", dev->name,
-               (unsigned int) dev);
-#endif
-
-        /* Increase the number of resets done. */
-        lp->nresets++;
-
-        wv_hacr_reset(ioaddr);
-        lp->hacr = HACR_DEFAULT;
-
-        if ((wv_mmc_init(dev) < 0) || (wv_82586_start(dev) < 0))
-                return -1;
-
-        /* Enable the card to send interrupts. */
-        wv_ints_on(dev);
-
-        /* Start card functions */
-        if (wv_cu_start(dev) < 0)
-                return -1;
-
-        /* Setup the controller and parameters */
-        wv_82586_config(dev);
-
-        /* Finish configuration with the receive unit */
-        if (wv_ru_start(dev) < 0)
-                return -1;
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: <-wv_hw_reset()\n", dev->name);
-#endif
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Check if there is a WaveLAN at the specific base address.
- * As a side effect, this reads the MAC address.
- * (called in wavelan_probe() and init_module())
- */
-static int wv_check_ioaddr(unsigned long ioaddr, u8 * mac)
-{
-        int i;                  /* Loop counter */
-
-        /* Check if the base address if available. */
-        if (!request_region(ioaddr, sizeof(ha_t), "wavelan probe"))
-                return -EBUSY;          /* ioaddr already used */
-
-        /* Reset host interface */
-        wv_hacr_reset(ioaddr);
-
-        /* Read the MAC address from the parameter storage area. */
-        psa_read(ioaddr, HACR_DEFAULT, psaoff(0, psa_univ_mac_addr),
-                 mac, 6);
-
-        release_region(ioaddr, sizeof(ha_t));
-
-        /*
-         * Check the first three octets of the address for the manufacturer's code.
-         * Note: if this can't find your WaveLAN card, you've got a
-         * non-NCR/AT&T/Lucent ISA card.  See wavelan.p.h for detail on
-         * how to configure your card.
-         */
-        for (i = 0; i < ARRAY_SIZE(MAC_ADDRESSES); i++)
-                if ((mac[0] == MAC_ADDRESSES[i][0]) &&
-                    (mac[1] == MAC_ADDRESSES[i][1]) &&
-                    (mac[2] == MAC_ADDRESSES[i][2]))
-                        return 0;
-
-#ifdef DEBUG_CONFIG_INFO
-        printk(KERN_WARNING
-               "WaveLAN (0x%3X): your MAC address might be %02X:%02X:%02X.\n",
-               ioaddr, mac[0], mac[1], mac[2]);
-#endif
-        return -ENODEV;
-}
-
-/************************ INTERRUPT HANDLING ************************/
-
-/*
- * This function is the interrupt handler for the WaveLAN card. This
- * routine will be called whenever: 
- */
-static irqreturn_t wavelan_interrupt(int irq, void *dev_id)
-{
-        struct net_device *dev;
-        unsigned long ioaddr;
-        net_local *lp;
-        u16 hasr;
-        u16 status;
-        u16 ack_cmd;
-
-        dev = dev_id;
-
-#ifdef DEBUG_INTERRUPT_TRACE
-        printk(KERN_DEBUG "%s: ->wavelan_interrupt()\n", dev->name);
-#endif
-
-        lp = netdev_priv(dev);
-        ioaddr = dev->base_addr;
-
-#ifdef DEBUG_INTERRUPT_INFO
-        /* Check state of our spinlock */
-        if(spin_is_locked(&lp->spinlock))
-                printk(KERN_DEBUG
-                       "%s: wavelan_interrupt(): spinlock is already locked !!!\n",
-                       dev->name);
-#endif
-
-        /* Prevent reentrancy. We need to do that because we may have
-         * multiple interrupt handler running concurrently.
-         * It is safe because interrupts are disabled before acquiring
-         * the spinlock. */
-        spin_lock(&lp->spinlock);
-
-        /* We always had spurious interrupts at startup, but lately I
-         * saw them comming *between* the request_irq() and the
-         * spin_lock_irqsave() in wavelan_open(), so the spinlock
-         * protection is no enough.
-         * So, we also check lp->hacr that will tell us is we enabled
-         * irqs or not (see wv_ints_on()).
-         * We can't use netif_running(dev) because we depend on the
-         * proper processing of the irq generated during the config. */
-
-        /* Which interrupt it is ? */
-        hasr = hasr_read(ioaddr);
-
-#ifdef DEBUG_INTERRUPT_INFO
-        printk(KERN_INFO
-               "%s: wavelan_interrupt(): hasr 0x%04x; hacr 0x%04x.\n",
-               dev->name, hasr, lp->hacr);
-#endif
-
-        /* Check modem interrupt */
-        if ((hasr & HASR_MMC_INTR) && (lp->hacr & HACR_MMC_INT_ENABLE)) {
-                u8 dce_status;
-
-                /*
-                 * Interrupt from the modem management controller.
-                 * This will clear it -- ignored for now.
-                 */
-                mmc_read(ioaddr, mmroff(0, mmr_dce_status), &dce_status,
-                         sizeof(dce_status));
-
-#ifdef DEBUG_INTERRUPT_ERROR
-                printk(KERN_INFO
-                       "%s: wavelan_interrupt(): unexpected mmc interrupt: status 0x%04x.\n",
-                       dev->name, dce_status);
-#endif
-        }
-
-        /* Check if not controller interrupt */
-        if (((hasr & HASR_82586_INTR) == 0) ||
-            ((lp->hacr & HACR_82586_INT_ENABLE) == 0)) {
-#ifdef DEBUG_INTERRUPT_ERROR
-                printk(KERN_INFO
-                       "%s: wavelan_interrupt(): interrupt not coming from i82586 - hasr 0x%04x.\n",
-                       dev->name, hasr);
-#endif
-                spin_unlock (&lp->spinlock);
-                return IRQ_NONE;
-        }
-
-        /* Read interrupt data. */
-        obram_read(ioaddr, scboff(OFFSET_SCB, scb_status),
-                   (unsigned char *) &status, sizeof(status));
-
-        /*
-         * Acknowledge the interrupt(s).
-         */
-        ack_cmd = status & SCB_ST_INT;
-        obram_write(ioaddr, scboff(OFFSET_SCB, scb_command),
-                    (unsigned char *) &ack_cmd, sizeof(ack_cmd));
-        set_chan_attn(ioaddr, lp->hacr);
-
-#ifdef DEBUG_INTERRUPT_INFO
-        printk(KERN_DEBUG "%s: wavelan_interrupt(): status 0x%04x.\n",
-               dev->name, status);
-#endif
-
-        /* Command completed. */
-        if ((status & SCB_ST_CX) == SCB_ST_CX) {
-#ifdef DEBUG_INTERRUPT_INFO
-                printk(KERN_DEBUG
-                       "%s: wavelan_interrupt(): command completed.\n",
-                       dev->name);
-#endif
-                wv_complete(dev, ioaddr, lp);
-        }
-
-        /* Frame received. */
-        if ((status & SCB_ST_FR) == SCB_ST_FR) {
-#ifdef DEBUG_INTERRUPT_INFO
-                printk(KERN_DEBUG
-                       "%s: wavelan_interrupt(): received packet.\n",
-                       dev->name);
-#endif
-                wv_receive(dev);
-        }
-
-        /* Check the state of the command unit. */
-        if (((status & SCB_ST_CNA) == SCB_ST_CNA) ||
-            (((status & SCB_ST_CUS) != SCB_ST_CUS_ACTV) &&
-             (netif_running(dev)))) {
-#ifdef DEBUG_INTERRUPT_ERROR
-                printk(KERN_INFO
-                       "%s: wavelan_interrupt(): CU inactive -- restarting\n",
-                       dev->name);
-#endif
-                wv_hw_reset(dev);
-        }
-
-        /* Check the state of the command unit. */
-        if (((status & SCB_ST_RNR) == SCB_ST_RNR) ||
-            (((status & SCB_ST_RUS) != SCB_ST_RUS_RDY) &&
-             (netif_running(dev)))) {
-#ifdef DEBUG_INTERRUPT_ERROR
-                printk(KERN_INFO
-                       "%s: wavelan_interrupt(): RU not ready -- restarting\n",
-                       dev->name);
-#endif
-                wv_hw_reset(dev);
-        }
-
-        /* Release spinlock */
-        spin_unlock (&lp->spinlock);
-
-#ifdef DEBUG_INTERRUPT_TRACE
-        printk(KERN_DEBUG "%s: <-wavelan_interrupt()\n", dev->name);
-#endif
-        return IRQ_HANDLED;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Watchdog: when we start a transmission, a timer is set for us in the
- * kernel.  If the transmission completes, this timer is disabled. If
- * the timer expires, we are called and we try to unlock the hardware.
- */
-static void wavelan_watchdog(struct net_device *        dev)
-{
-        net_local *lp = netdev_priv(dev);
-        u_long          ioaddr = dev->base_addr;
-        unsigned long   flags;
-        unsigned int    nreaped;
-
-#ifdef DEBUG_INTERRUPT_TRACE
-        printk(KERN_DEBUG "%s: ->wavelan_watchdog()\n", dev->name);
-#endif
-
-#ifdef DEBUG_INTERRUPT_ERROR
-        printk(KERN_INFO "%s: wavelan_watchdog: watchdog timer expired\n",
-               dev->name);
-#endif
-
-        /* Check that we came here for something */
-        if (lp->tx_n_in_use <= 0) {
-                return;
-        }
-
-        spin_lock_irqsave(&lp->spinlock, flags);
-
-        /* Try to see if some buffers are not free (in case we missed
-         * an interrupt */
-        nreaped = wv_complete(dev, ioaddr, lp);
-
-#ifdef DEBUG_INTERRUPT_INFO
-        printk(KERN_DEBUG
-               "%s: wavelan_watchdog(): %d reaped, %d remain.\n",
-               dev->name, nreaped, lp->tx_n_in_use);
-#endif
-
-#ifdef DEBUG_PSA_SHOW
-        {
-                psa_t psa;
-                psa_read(dev, 0, (unsigned char *) &psa, sizeof(psa));
-                wv_psa_show(&psa);
-        }
-#endif
-#ifdef DEBUG_MMC_SHOW
-        wv_mmc_show(dev);
-#endif
-#ifdef DEBUG_I82586_SHOW
-        wv_cu_show(dev);
-#endif
-
-        /* If no buffer has been freed */
-        if (nreaped == 0) {
-#ifdef DEBUG_INTERRUPT_ERROR
-                printk(KERN_INFO
-                       "%s: wavelan_watchdog(): cleanup failed, trying reset\n",
-                       dev->name);
-#endif
-                wv_hw_reset(dev);
-        }
-
-        /* At this point, we should have some free Tx buffer ;-) */
-        if (lp->tx_n_in_use < NTXBLOCKS - 1)
-                netif_wake_queue(dev);
-
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-        
-#ifdef DEBUG_INTERRUPT_TRACE
-        printk(KERN_DEBUG "%s: <-wavelan_watchdog()\n", dev->name);
-#endif
-}
-
-/********************* CONFIGURATION CALLBACKS *********************/
-/*
- * Here are the functions called by the Linux networking code (NET3)
- * for initialization, configuration and deinstallations of the 
- * WaveLAN ISA hardware.
- */
-
-/*------------------------------------------------------------------*/
-/*
- * Configure and start up the WaveLAN PCMCIA adaptor.
- * Called by NET3 when it "opens" the device.
- */
-static int wavelan_open(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long   flags;
-
-#ifdef DEBUG_CALLBACK_TRACE
-        printk(KERN_DEBUG "%s: ->wavelan_open(dev=0x%x)\n", dev->name,
-               (unsigned int) dev);
-#endif
-
-        /* Check irq */
-        if (dev->irq == 0) {
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_WARNING "%s: wavelan_open(): no IRQ\n",
-                       dev->name);
-#endif
-                return -ENXIO;
-        }
-
-        if (request_irq(dev->irq, &wavelan_interrupt, 0, "WaveLAN", dev) != 0) 
-        {
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_WARNING "%s: wavelan_open(): invalid IRQ\n",
-                       dev->name);
-#endif
-                return -EAGAIN;
-        }
-
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        if (wv_hw_reset(dev) != -1) {
-                netif_start_queue(dev);
-        } else {
-                free_irq(dev->irq, dev);
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_INFO
-                       "%s: wavelan_open(): impossible to start the card\n",
-                       dev->name);
-#endif
-                spin_unlock_irqrestore(&lp->spinlock, flags);
-                return -EAGAIN;
-        }
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-        
-#ifdef DEBUG_CALLBACK_TRACE
-        printk(KERN_DEBUG "%s: <-wavelan_open()\n", dev->name);
-#endif
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Shut down the WaveLAN ISA card.
- * Called by NET3 when it "closes" the device.
- */
-static int wavelan_close(struct net_device * dev)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long flags;
-
-#ifdef DEBUG_CALLBACK_TRACE
-        printk(KERN_DEBUG "%s: ->wavelan_close(dev=0x%x)\n", dev->name,
-               (unsigned int) dev);
-#endif
-
-        netif_stop_queue(dev);
-
-        /*
-         * Flush the Tx and disable Rx.
-         */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        wv_82586_stop(dev);
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        free_irq(dev->irq, dev);
-
-#ifdef DEBUG_CALLBACK_TRACE
-        printk(KERN_DEBUG "%s: <-wavelan_close()\n", dev->name);
-#endif
-        return 0;
-}
-
-static const struct net_device_ops wavelan_netdev_ops = {
-        .ndo_open               = wavelan_open,
-        .ndo_stop               = wavelan_close,
-        .ndo_start_xmit         = wavelan_packet_xmit,
-        .ndo_set_multicast_list = wavelan_set_multicast_list,
-        .ndo_tx_timeout         = wavelan_watchdog,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_validate_addr      = eth_validate_addr,
-#ifdef SET_MAC_ADDRESS
-        .ndo_set_mac_address    = wavelan_set_mac_address
-#else
-        .ndo_set_mac_address    = eth_mac_addr,
-#endif
-};
-
-
-/*------------------------------------------------------------------*/
-/*
- * Probe an I/O address, and if the WaveLAN is there configure the
- * device structure
- * (called by wavelan_probe() and via init_module()).
- */
-static int __init wavelan_config(struct net_device *dev, unsigned short ioaddr)
-{
-        u8 irq_mask;
-        int irq;
-        net_local *lp;
-        mac_addr mac;
-        int err;
-
-        if (!request_region(ioaddr, sizeof(ha_t), "wavelan"))
-                return -EADDRINUSE;
-
-        err = wv_check_ioaddr(ioaddr, mac);
-        if (err)
-                goto out;
-
-        memcpy(dev->dev_addr, mac, 6);
-
-        dev->base_addr = ioaddr;
-
-#ifdef DEBUG_CALLBACK_TRACE
-        printk(KERN_DEBUG "%s: ->wavelan_config(dev=0x%x, ioaddr=0x%lx)\n",
-               dev->name, (unsigned int) dev, ioaddr);
-#endif
-
-        /* Check IRQ argument on command line. */
-        if (dev->irq != 0) {
-                irq_mask = wv_irq_to_psa(dev->irq);
-
-                if (irq_mask == 0) {
-#ifdef DEBUG_CONFIG_ERROR
-                        printk(KERN_WARNING
-                               "%s: wavelan_config(): invalid IRQ %d ignored.\n",
-                               dev->name, dev->irq);
-#endif
-                        dev->irq = 0;
-                } else {
-#ifdef DEBUG_CONFIG_INFO
-                        printk(KERN_DEBUG
-                               "%s: wavelan_config(): changing IRQ to %d\n",
-                               dev->name, dev->irq);
-#endif
-                        psa_write(ioaddr, HACR_DEFAULT,
-                                  psaoff(0, psa_int_req_no), &irq_mask, 1);
-                        /* update the Wavelan checksum */
-                        update_psa_checksum(dev, ioaddr, HACR_DEFAULT);
-                        wv_hacr_reset(ioaddr);
-                }
-        }
-
-        psa_read(ioaddr, HACR_DEFAULT, psaoff(0, psa_int_req_no),
-                 &irq_mask, 1);
-        if ((irq = wv_psa_to_irq(irq_mask)) == -1) {
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_INFO
-                       "%s: wavelan_config(): could not wavelan_map_irq(%d).\n",
-                       dev->name, irq_mask);
-#endif
-                err = -EAGAIN;
-                goto out;
-        }
-
-        dev->irq = irq;
-
-        dev->mem_start = 0x0000;
-        dev->mem_end = 0x0000;
-        dev->if_port = 0;
-
-        /* Initialize device structures */
-        memset(netdev_priv(dev), 0, sizeof(net_local));
-        lp = netdev_priv(dev);
-
-        /* Back link to the device structure. */
-        lp->dev = dev;
-        /* Add the device at the beginning of the linked list. */
-        lp->next = wavelan_list;
-        wavelan_list = lp;
-
-        lp->hacr = HACR_DEFAULT;
-
-        /* Multicast stuff */
-        lp->promiscuous = 0;
-        lp->mc_count = 0;
-
-        /* Init spinlock */
-        spin_lock_init(&lp->spinlock);
-
-        dev->netdev_ops = &wavelan_netdev_ops;
-        dev->watchdog_timeo = WATCHDOG_JIFFIES;
-        dev->wireless_handlers = &wavelan_handler_def;
-        lp->wireless_data.spy_data = &lp->spy_data;
-        dev->wireless_data = &lp->wireless_data;
-
-        dev->mtu = WAVELAN_MTU;
-
-        /* Display nice information. */
-        wv_init_info(dev);
-
-#ifdef DEBUG_CALLBACK_TRACE
-        printk(KERN_DEBUG "%s: <-wavelan_config()\n", dev->name);
-#endif
-        return 0;
-out:
-        release_region(ioaddr, sizeof(ha_t));
-        return err;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Check for a network adaptor of this type.  Return '0' iff one 
- * exists.  There seem to be different interpretations of
- * the initial value of dev->base_addr.
- * We follow the example in drivers/net/ne.c.
- * (called in "Space.c")
- */
-struct net_device * __init wavelan_probe(int unit)
-{
-        struct net_device *dev;
-        short base_addr;
-        int def_irq;
-        int i;
-        int r = 0;
-
-        /* compile-time check the sizes of structures */
-        BUILD_BUG_ON(sizeof(psa_t) != PSA_SIZE);
-        BUILD_BUG_ON(sizeof(mmw_t) != MMW_SIZE);
-        BUILD_BUG_ON(sizeof(mmr_t) != MMR_SIZE);
-        BUILD_BUG_ON(sizeof(ha_t) != HA_SIZE);
-
-        dev = alloc_etherdev(sizeof(net_local));
-        if (!dev)
-                return ERR_PTR(-ENOMEM);
-
-        sprintf(dev->name, "eth%d", unit);
-        netdev_boot_setup_check(dev);
-        base_addr = dev->base_addr;
-        def_irq = dev->irq;
-
-#ifdef DEBUG_CALLBACK_TRACE
-        printk(KERN_DEBUG
-               "%s: ->wavelan_probe(dev=%p (base_addr=0x%x))\n",
-               dev->name, dev, (unsigned int) dev->base_addr);
-#endif
-
-        /* Don't probe at all. */
-        if (base_addr < 0) {
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_WARNING
-                       "%s: wavelan_probe(): invalid base address\n",
-                       dev->name);
-#endif
-                r = -ENXIO;
-        } else if (base_addr > 0x100) { /* Check a single specified location. */
-                r = wavelan_config(dev, base_addr);
-#ifdef DEBUG_CONFIG_INFO
-                if (r != 0)
-                        printk(KERN_DEBUG
-                               "%s: wavelan_probe(): no device at specified base address (0x%X) or address already in use\n",
-                               dev->name, base_addr);
-#endif
-
-#ifdef DEBUG_CALLBACK_TRACE
-                printk(KERN_DEBUG "%s: <-wavelan_probe()\n", dev->name);
-#endif
-        } else { /* Scan all possible addresses of the WaveLAN hardware. */
-                for (i = 0; i < ARRAY_SIZE(iobase); i++) {
-                        dev->irq = def_irq;
-                        if (wavelan_config(dev, iobase[i]) == 0) {
-#ifdef DEBUG_CALLBACK_TRACE
-                                printk(KERN_DEBUG
-                                       "%s: <-wavelan_probe()\n",
-                                       dev->name);
-#endif
-                                break;
-                        }
-                }
-                if (i == ARRAY_SIZE(iobase))
-                        r = -ENODEV;
-        }
-        if (r) 
-                goto out;
-        r = register_netdev(dev);
-        if (r)
-                goto out1;
-        return dev;
-out1:
-        release_region(dev->base_addr, sizeof(ha_t));
-        wavelan_list = wavelan_list->next;
-out:
-        free_netdev(dev);
-        return ERR_PTR(r);
-}
-
-/****************************** MODULE ******************************/
-/*
- * Module entry point: insertion and removal
- */
-
-#ifdef  MODULE
-/*------------------------------------------------------------------*/
-/*
- * Insertion of the module
- * I'm now quite proud of the multi-device support.
- */
-int __init init_module(void)
-{
-        int ret = -EIO;         /* Return error if no cards found */
-        int i;
-
-#ifdef DEBUG_MODULE_TRACE
-        printk(KERN_DEBUG "-> init_module()\n");
-#endif
-
-        /* If probing is asked */
-        if (io[0] == 0) {
-#ifdef DEBUG_CONFIG_ERROR
-                printk(KERN_WARNING
-                       "WaveLAN init_module(): doing device probing (bad !)\n");
-                printk(KERN_WARNING
-                       "Specify base addresses while loading module to correct the problem\n");
-#endif
-
-                /* Copy the basic set of address to be probed. */
-                for (i = 0; i < ARRAY_SIZE(iobase); i++)
-                        io[i] = iobase[i];
-        }
-
-
-        /* Loop on all possible base addresses. */
-        for (i = 0; i < ARRAY_SIZE(io) && io[i] != 0; i++) {
-                struct net_device *dev = alloc_etherdev(sizeof(net_local));
-                if (!dev)
-                        break;
-                if (name[i])
-                        strcpy(dev->name, name[i]);     /* Copy name */
-                dev->base_addr = io[i];
-                dev->irq = irq[i];
-
-                /* Check if there is something at this base address. */
-                if (wavelan_config(dev, io[i]) == 0) {
-                        if (register_netdev(dev) != 0) {
-                                release_region(dev->base_addr, sizeof(ha_t));
-                                wavelan_list = wavelan_list->next;
-                        } else {
-                                ret = 0;
-                                continue;
-                        }
-                }
-                free_netdev(dev);
-        }
-
-#ifdef DEBUG_CONFIG_ERROR
-        if (!wavelan_list)
-                printk(KERN_WARNING
-                       "WaveLAN init_module(): no device found\n");
-#endif
-
-#ifdef DEBUG_MODULE_TRACE
-        printk(KERN_DEBUG "<- init_module()\n");
-#endif
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Removal of the module
- */
-void cleanup_module(void)
-{
-#ifdef DEBUG_MODULE_TRACE
-        printk(KERN_DEBUG "-> cleanup_module()\n");
-#endif
-
-        /* Loop on all devices and release them. */
-        while (wavelan_list) {
-                struct net_device *dev = wavelan_list->dev;
-
-#ifdef DEBUG_CONFIG_INFO
-                printk(KERN_DEBUG
-                       "%s: cleanup_module(): removing device at 0x%x\n",
-                       dev->name, (unsigned int) dev);
-#endif
-                unregister_netdev(dev);
-
-                release_region(dev->base_addr, sizeof(ha_t));
-                wavelan_list = wavelan_list->next;
-
-                free_netdev(dev);
-        }
-
-#ifdef DEBUG_MODULE_TRACE
-        printk(KERN_DEBUG "<- cleanup_module()\n");
-#endif
-}
-#endif                          /* MODULE */
-MODULE_LICENSE("GPL");
-
-/*
- * This software may only be used and distributed
- * according to the terms of the GNU General Public License.
- *
- * This software was developed as a component of the
- * Linux operating system.
- * It is based on other device drivers and information
- * either written or supplied by:
- *      Ajay Bakre (bakre@paul.rutgers.edu),
- *      Donald Becker (becker@scyld.com),
- *      Loeke Brederveld (Loeke.Brederveld@Utrecht.NCR.com),
- *      Anders Klemets (klemets@it.kth.se),
- *      Vladimir V. Kolpakov (w@stier.koenig.ru),
- *      Marc Meertens (Marc.Meertens@Utrecht.NCR.com),
- *      Pauline Middelink (middelin@polyware.iaf.nl),
- *      Robert Morris (rtm@das.harvard.edu),
- *      Jean Tourrilhes (jt@hplb.hpl.hp.com),
- *      Girish Welling (welling@paul.rutgers.edu),
- *
- * Thanks go also to:
- *      James Ashton (jaa101@syseng.anu.edu.au),
- *      Alan Cox (alan@lxorguk.ukuu.org.uk),
- *      Allan Creighton (allanc@cs.usyd.edu.au),
- *      Matthew Geier (matthew@cs.usyd.edu.au),
- *      Remo di Giovanni (remo@cs.usyd.edu.au),
- *      Eckhard Grah (grah@wrcs1.urz.uni-wuppertal.de),
- *      Vipul Gupta (vgupta@cs.binghamton.edu),
- *      Mark Hagan (mhagan@wtcpost.daytonoh.NCR.COM),
- *      Tim Nicholson (tim@cs.usyd.edu.au),
- *      Ian Parkin (ian@cs.usyd.edu.au),
- *      John Rosenberg (johnr@cs.usyd.edu.au),
- *      George Rossi (george@phm.gov.au),
- *      Arthur Scott (arthur@cs.usyd.edu.au),
- *      Peter Storey,
- * for their assistance and advice.
- *
- * Please send bug reports, updates, comments to:
- *
- * Bruce Janson                                    Email:  bruce@cs.usyd.edu.au
- * Basser Department of Computer Science           Phone:  +61-2-9351-3423
- * University of Sydney, N.S.W., 2006, AUSTRALIA   Fax:    +61-2-9351-3838
- */
diff --git a/drivers/net/wireless/wavelan.h b/drivers/net/wireless/wavelan.h
deleted file mode 100644
index 9ab360558ffd..000000000000
--- a/drivers/net/wireless/wavelan.h
+++ /dev/null
@@ -1,370 +0,0 @@
-/*
- *      WaveLAN ISA driver
- *
- *              Jean II - HPLB '96
- *
- * Reorganisation and extension of the driver.
- * Original copyright follows. See wavelan.p.h for details.
- *
- * This file contains the declarations for the WaveLAN hardware. Note that
- * the WaveLAN ISA includes a i82586 controller (see definitions in
- * file i82586.h).
- *
- * The main difference between the ISA hardware and the PCMCIA one is
- * the Ethernet controller (i82586 instead of i82593).
- * The i82586 allows multiple transmit buffers.  The PSA needs to be accessed
- * through the host interface.
- */
-
-#ifndef _WAVELAN_H
-#define _WAVELAN_H
-
-/************************** MAGIC NUMBERS ***************************/
-
-/* Detection of the WaveLAN card is done by reading the MAC
- * address from the card and checking it.  If you have a non-AT&T
- * product (OEM, like DEC RoamAbout, Digital Ocean, or Epson),
- * you might need to modify this part to accommodate your hardware.
- */
-static const char       MAC_ADDRESSES[][3] =
-{
-  { 0x08, 0x00, 0x0E },         /* AT&T WaveLAN (standard) & DEC RoamAbout */
-  { 0x08, 0x00, 0x6A },         /* AT&T WaveLAN (alternate) */
-  { 0x00, 0x00, 0xE1 },         /* Hitachi Wavelan */
-  { 0x00, 0x60, 0x1D }          /* Lucent Wavelan (another one) */
-  /* Add your card here and send me the patch! */
-};
-
-#define WAVELAN_ADDR_SIZE       6       /* Size of a MAC address */
-
-#define WAVELAN_MTU             1500    /* Maximum size of WaveLAN packet */
-
-#define MAXDATAZ                (WAVELAN_ADDR_SIZE + WAVELAN_ADDR_SIZE + 2 + WAVELAN_MTU)
-
-/*
- * Constants used to convert channels to frequencies
- */
-
-/* Frequency available in the 2.0 modem, in units of 250 kHz
- * (as read in the offset register of the dac area).
- * Used to map channel numbers used by `wfreqsel' to frequencies
- */
-static const short      channel_bands[] = { 0x30, 0x58, 0x64, 0x7A, 0x80, 0xA8,
-                                    0xD0, 0xF0, 0xF8, 0x150 };
-
-/* Frequencies of the 1.0 modem (fixed frequencies).
- * Use to map the PSA `subband' to a frequency
- * Note : all frequencies apart from the first one need to be multiplied by 10
- */
-static const int        fixed_bands[] = { 915e6, 2.425e8, 2.46e8, 2.484e8, 2.4305e8 };
-
-
-
-/*************************** PC INTERFACE ****************************/
-
-/*
- * Host Adaptor structure.
- * (base is board port address).
- */
-typedef union hacs_u    hacs_u;
-union hacs_u
-{
-        unsigned short  hu_command;             /* Command register */
-#define         HACR_RESET              0x0001  /* Reset board */
-#define         HACR_CA                 0x0002  /* Set Channel Attention for 82586 */
-#define         HACR_16BITS             0x0004  /* 16-bit operation (0 => 8bits) */
-#define         HACR_OUT0               0x0008  /* General purpose output pin 0 */
-                                                /* not used - must be 1 */
-#define         HACR_OUT1               0x0010  /* General purpose output pin 1 */
-                                                /* not used - must be 1 */
-#define         HACR_82586_INT_ENABLE   0x0020  /* Enable 82586 interrupts */
-#define         HACR_MMC_INT_ENABLE     0x0040  /* Enable MMC interrupts */
-#define         HACR_INTR_CLR_ENABLE    0x0080  /* Enable interrupt status read/clear */
-        unsigned short  hu_status;              /* Status Register */
-#define         HASR_82586_INTR         0x0001  /* Interrupt request from 82586 */
-#define         HASR_MMC_INTR           0x0002  /* Interrupt request from MMC */
-#define         HASR_MMC_BUSY           0x0004  /* MMC busy indication */
-#define         HASR_PSA_BUSY           0x0008  /* LAN parameter storage area busy */
-} __attribute__ ((packed));
-
-typedef struct ha_t     ha_t;
-struct ha_t
-{
-        hacs_u          ha_cs;          /* Command and status registers */
-#define                 ha_command      ha_cs.hu_command
-#define                 ha_status       ha_cs.hu_status
-        unsigned short  ha_mmcr;        /* Modem Management Ctrl Register */
-        unsigned short  ha_pior0;       /* Program I/O Address Register Port 0 */
-        unsigned short  ha_piop0;       /* Program I/O Port 0 */
-        unsigned short  ha_pior1;       /* Program I/O Address Register Port 1 */
-        unsigned short  ha_piop1;       /* Program I/O Port 1 */
-        unsigned short  ha_pior2;       /* Program I/O Address Register Port 2 */
-        unsigned short  ha_piop2;       /* Program I/O Port 2 */
-};
-
-#define HA_SIZE         16
-
-#define hoff(p,f)       (unsigned short)((void *)(&((ha_t *)((void *)0 + (p)))->f) - (void *)0)
-#define HACR(p)         hoff(p, ha_command)
-#define HASR(p)         hoff(p, ha_status)
-#define MMCR(p)         hoff(p, ha_mmcr)
-#define PIOR0(p)        hoff(p, ha_pior0)
-#define PIOP0(p)        hoff(p, ha_piop0)
-#define PIOR1(p)        hoff(p, ha_pior1)
-#define PIOP1(p)        hoff(p, ha_piop1)
-#define PIOR2(p)        hoff(p, ha_pior2)
-#define PIOP2(p)        hoff(p, ha_piop2)
-
-/*
- * Program I/O Mode Register values.
- */
-#define STATIC_PIO              0       /* Mode 1: static mode */
-                                        /* RAM access ??? */
-#define AUTOINCR_PIO            1       /* Mode 2: auto increment mode */
-                                        /* RAM access ??? */
-#define AUTODECR_PIO            2       /* Mode 3: auto decrement mode */
-                                        /* RAM access ??? */
-#define PARAM_ACCESS_PIO        3       /* Mode 4: LAN parameter access mode */
-                                        /* Parameter access. */
-#define PIO_MASK                3       /* register mask */
-#define PIOM(cmd,piono)         ((u_short)cmd << 10 << (piono * 2))
-
-#define HACR_DEFAULT            (HACR_OUT0 | HACR_OUT1 | HACR_16BITS | PIOM(STATIC_PIO, 0) | PIOM(AUTOINCR_PIO, 1) | PIOM(PARAM_ACCESS_PIO, 2))
-#define HACR_INTRON             (HACR_82586_INT_ENABLE | HACR_MMC_INT_ENABLE | HACR_INTR_CLR_ENABLE)
-
-/************************** MEMORY LAYOUT **************************/
-
-/*
- * Onboard 64 k RAM layout.
- * (Offsets from 0x0000.)
- */
-#define OFFSET_RU               0x0000          /* 75% memory */
-#define OFFSET_CU               0xC000          /* 25% memory */
-#define OFFSET_SCB              (OFFSET_ISCP - sizeof(scb_t))
-#define OFFSET_ISCP             (OFFSET_SCP - sizeof(iscp_t))
-#define OFFSET_SCP              I82586_SCP_ADDR
-
-#define RXBLOCKZ                (sizeof(fd_t) + sizeof(rbd_t) + MAXDATAZ)
-#define TXBLOCKZ                (sizeof(ac_tx_t) + sizeof(ac_nop_t) + sizeof(tbd_t) + MAXDATAZ)
-
-#define NRXBLOCKS               ((OFFSET_CU - OFFSET_RU) / RXBLOCKZ)
-#define NTXBLOCKS               ((OFFSET_SCB - OFFSET_CU) / TXBLOCKZ)
-
-/********************** PARAMETER STORAGE AREA **********************/
-
-/*
- * Parameter Storage Area (PSA).
- */
-typedef struct psa_t    psa_t;
-struct psa_t
-{
-  unsigned char psa_io_base_addr_1;     /* [0x00] Base address 1 ??? */
-  unsigned char psa_io_base_addr_2;     /* [0x01] Base address 2 */
-  unsigned char psa_io_base_addr_3;     /* [0x02] Base address 3 */
-  unsigned char psa_io_base_addr_4;     /* [0x03] Base address 4 */
-  unsigned char psa_rem_boot_addr_1;    /* [0x04] Remote Boot Address 1 */
-  unsigned char psa_rem_boot_addr_2;    /* [0x05] Remote Boot Address 2 */
-  unsigned char psa_rem_boot_addr_3;    /* [0x06] Remote Boot Address 3 */
-  unsigned char psa_holi_params;        /* [0x07] HOst Lan Interface (HOLI) Parameters */
-  unsigned char psa_int_req_no;         /* [0x08] Interrupt Request Line */
-  unsigned char psa_unused0[7];         /* [0x09-0x0F] unused */
-
-  unsigned char psa_univ_mac_addr[WAVELAN_ADDR_SIZE];   /* [0x10-0x15] Universal (factory) MAC Address */
-  unsigned char psa_local_mac_addr[WAVELAN_ADDR_SIZE];  /* [0x16-1B] Local MAC Address */
-  unsigned char psa_univ_local_sel;     /* [0x1C] Universal Local Selection */
-#define         PSA_UNIVERSAL   0               /* Universal (factory) */
-#define         PSA_LOCAL       1               /* Local */
-  unsigned char psa_comp_number;        /* [0x1D] Compatibility Number:  */
-#define         PSA_COMP_PC_AT_915      0       /* PC-AT 915 MHz         */
-#define         PSA_COMP_PC_MC_915      1       /* PC-MC 915 MHz         */
-#define         PSA_COMP_PC_AT_2400     2       /* PC-AT 2.4 GHz         */
-#define         PSA_COMP_PC_MC_2400     3       /* PC-MC 2.4 GHz         */
-#define         PSA_COMP_PCMCIA_915     4       /* PCMCIA 915 MHz or 2.0 */
-  unsigned char psa_thr_pre_set;        /* [0x1E] Modem Threshold Preset */
-  unsigned char psa_feature_select;     /* [0x1F] Call code required (1=on) */
-#define         PSA_FEATURE_CALL_CODE   0x01    /* Call code required (Japan) */
-  unsigned char psa_subband;            /* [0x20] Subband         */
-#define         PSA_SUBBAND_915         0       /* 915 MHz or 2.0 */
-#define         PSA_SUBBAND_2425        1       /* 2425 MHz       */
-#define         PSA_SUBBAND_2460        2       /* 2460 MHz       */
-#define         PSA_SUBBAND_2484        3       /* 2484 MHz       */
-#define         PSA_SUBBAND_2430_5      4       /* 2430.5 MHz     */
-  unsigned char psa_quality_thr;        /* [0x21] Modem Quality Threshold */
-  unsigned char psa_mod_delay;          /* [0x22] Modem Delay (?) (reserved) */
-  unsigned char psa_nwid[2];            /* [0x23-0x24] Network ID */
-  unsigned char psa_nwid_select;        /* [0x25] Network ID Select On/Off */
-  unsigned char psa_encryption_select;  /* [0x26] Encryption On/Off */
-  unsigned char psa_encryption_key[8];  /* [0x27-0x2E] Encryption Key */
-  unsigned char psa_databus_width;      /* [0x2F] AT bus width select 8/16 */
-  unsigned char psa_call_code[8];       /* [0x30-0x37] (Japan) Call Code */
-  unsigned char psa_nwid_prefix[2];     /* [0x38-0x39] Roaming domain */
-  unsigned char psa_reserved[2];        /* [0x3A-0x3B] Reserved - fixed 00 */
-  unsigned char psa_conf_status;        /* [0x3C] Conf Status, bit 0=1:config*/
-  unsigned char psa_crc[2];             /* [0x3D] CRC-16 over PSA */
-  unsigned char psa_crc_status;         /* [0x3F] CRC Valid Flag */
-};
-
-#define PSA_SIZE        64
-
-/* Calculate offset of a field in the above structure.
- * Warning:  only even addresses are used. */
-#define psaoff(p,f)     ((unsigned short) ((void *)(&((psa_t *) ((void *) NULL + (p)))->f) - (void *) NULL))
-
-/******************** MODEM MANAGEMENT INTERFACE ********************/
-
-/*
- * Modem Management Controller (MMC) write structure.
- */
-typedef struct mmw_t    mmw_t;
-struct mmw_t
-{
-  unsigned char mmw_encr_key[8];        /* encryption key */
-  unsigned char mmw_encr_enable;        /* Enable or disable encryption. */
-#define MMW_ENCR_ENABLE_MODE    0x02    /* mode of security option */
-#define MMW_ENCR_ENABLE_EN      0x01    /* Enable security option. */
-  unsigned char mmw_unused0[1];         /* unused */
-  unsigned char mmw_des_io_invert;      /* encryption option */
-#define MMW_DES_IO_INVERT_RES   0x0F    /* reserved */
-#define MMW_DES_IO_INVERT_CTRL  0xF0    /* control (?) (set to 0) */
-  unsigned char mmw_unused1[5];         /* unused */
-  unsigned char mmw_loopt_sel;          /* looptest selection */
-#define MMW_LOOPT_SEL_DIS_NWID  0x40    /* Disable NWID filtering. */
-#define MMW_LOOPT_SEL_INT       0x20    /* Activate Attention Request. */
-#define MMW_LOOPT_SEL_LS        0x10    /* looptest, no collision avoidance */
-#define MMW_LOOPT_SEL_LT3A      0x08    /* looptest 3a */
-#define MMW_LOOPT_SEL_LT3B      0x04    /* looptest 3b */
-#define MMW_LOOPT_SEL_LT3C      0x02    /* looptest 3c */
-#define MMW_LOOPT_SEL_LT3D      0x01    /* looptest 3d */
-  unsigned char mmw_jabber_enable;      /* jabber timer enable */
-  /* Abort transmissions > 200 ms */
-  unsigned char mmw_freeze;             /* freeze or unfreeze signal level */
-  /* 0 : signal level & qual updated for every new message, 1 : frozen */
-  unsigned char mmw_anten_sel;          /* antenna selection */
-#define MMW_ANTEN_SEL_SEL       0x01    /* direct antenna selection */
-#define MMW_ANTEN_SEL_ALG_EN    0x02    /* antenna selection algo. enable */
-  unsigned char mmw_ifs;                /* inter frame spacing */
-  /* min time between transmission in bit periods (.5 us) - bit 0 ignored */
-  unsigned char mmw_mod_delay;          /* modem delay (synchro) */
-  unsigned char mmw_jam_time;           /* jamming time (after collision) */
-  unsigned char mmw_unused2[1];         /* unused */
-  unsigned char mmw_thr_pre_set;        /* level threshold preset */
-  /* Discard all packet with signal < this value (4) */
-  unsigned char mmw_decay_prm;          /* decay parameters */
-  unsigned char mmw_decay_updat_prm;    /* decay update parameters */
-  unsigned char mmw_quality_thr;        /* quality (z-quotient) threshold */
-  /* Discard all packet with quality < this value (3) */
-  unsigned char mmw_netw_id_l;          /* NWID low order byte */
-  unsigned char mmw_netw_id_h;          /* NWID high order byte */
-  /* Network ID or Domain : create virtual net on the air */
-
-  /* 2.0 Hardware extension - frequency selection support */
-  unsigned char mmw_mode_select;        /* for analog tests (set to 0) */
-  unsigned char mmw_unused3[1];         /* unused */
-  unsigned char mmw_fee_ctrl;           /* frequency EEPROM control */
-#define MMW_FEE_CTRL_PRE        0x10    /* Enable protected instructions. */
-#define MMW_FEE_CTRL_DWLD       0x08    /* Download EEPROM to mmc. */
-#define MMW_FEE_CTRL_CMD        0x07    /* EEPROM commands:  */
-#define MMW_FEE_CTRL_READ       0x06    /* Read */
-#define MMW_FEE_CTRL_WREN       0x04    /* Write enable */
-#define MMW_FEE_CTRL_WRITE      0x05    /* Write data to address. */
-#define MMW_FEE_CTRL_WRALL      0x04    /* Write data to all addresses. */
-#define MMW_FEE_CTRL_WDS        0x04    /* Write disable */
-#define MMW_FEE_CTRL_PRREAD     0x16    /* Read addr from protect register */
-#define MMW_FEE_CTRL_PREN       0x14    /* Protect register enable */
-#define MMW_FEE_CTRL_PRCLEAR    0x17    /* Unprotect all registers. */
-#define MMW_FEE_CTRL_PRWRITE    0x15    /* Write address in protect register */
-#define MMW_FEE_CTRL_PRDS       0x14    /* Protect register disable */
-  /* Never issue the PRDS command:  it's irreversible! */
-
-  unsigned char mmw_fee_addr;           /* EEPROM address */
-#define MMW_FEE_ADDR_CHANNEL    0xF0    /* Select the channel. */
-#define MMW_FEE_ADDR_OFFSET     0x0F    /* Offset in channel data */
-#define MMW_FEE_ADDR_EN         0xC0    /* FEE_CTRL enable operations */
-#define MMW_FEE_ADDR_DS         0x00    /* FEE_CTRL disable operations */
-#define MMW_FEE_ADDR_ALL        0x40    /* FEE_CTRL all operations */
-#define MMW_FEE_ADDR_CLEAR      0xFF    /* FEE_CTRL clear operations */
-
-  unsigned char mmw_fee_data_l;         /* Write data to EEPROM. */
-  unsigned char mmw_fee_data_h;         /* high octet */
-  unsigned char mmw_ext_ant;            /* Setting for external antenna */
-#define MMW_EXT_ANT_EXTANT      0x01    /* Select external antenna */
-#define MMW_EXT_ANT_POL         0x02    /* Polarity of the antenna */
-#define MMW_EXT_ANT_INTERNAL    0x00    /* Internal antenna */
-#define MMW_EXT_ANT_EXTERNAL    0x03    /* External antenna */
-#define MMW_EXT_ANT_IQ_TEST     0x1C    /* IQ test pattern (set to 0) */
-} __attribute__ ((packed));
-
-#define MMW_SIZE        37
-
-#define mmwoff(p,f)     (unsigned short)((void *)(&((mmw_t *)((void *)0 + (p)))->f) - (void *)0)
-
-/*
- * Modem Management Controller (MMC) read structure.
- */
-typedef struct mmr_t    mmr_t;
-struct mmr_t
-{
-  unsigned char mmr_unused0[8];         /* unused */
-  unsigned char mmr_des_status;         /* encryption status */
-  unsigned char mmr_des_avail;          /* encryption available (0x55 read) */
-#define MMR_DES_AVAIL_DES       0x55            /* DES available */
-#define MMR_DES_AVAIL_AES       0x33            /* AES (AT&T) available */
-  unsigned char mmr_des_io_invert;      /* des I/O invert register */
-  unsigned char mmr_unused1[5];         /* unused */
-  unsigned char mmr_dce_status;         /* DCE status */
-#define MMR_DCE_STATUS_RX_BUSY          0x01    /* receiver busy */
-#define MMR_DCE_STATUS_LOOPT_IND        0x02    /* loop test indicated */
-#define MMR_DCE_STATUS_TX_BUSY          0x04    /* transmitter on */
-#define MMR_DCE_STATUS_JBR_EXPIRED      0x08    /* jabber timer expired */
-#define MMR_DCE_STATUS                  0x0F    /* mask to get the bits */
-  unsigned char mmr_dsp_id;             /* DSP ID (AA = Daedalus rev A) */
-  unsigned char mmr_unused2[2];         /* unused */
-  unsigned char mmr_correct_nwid_l;     /* # of correct NWIDs rxd (low) */
-  unsigned char mmr_correct_nwid_h;     /* # of correct NWIDs rxd (high) */
-  /* Warning:  read high-order octet first! */
-  unsigned char mmr_wrong_nwid_l;       /* # of wrong NWIDs rxd (low) */
-  unsigned char mmr_wrong_nwid_h;       /* # of wrong NWIDs rxd (high) */
-  unsigned char mmr_thr_pre_set;        /* level threshold preset */
-#define MMR_THR_PRE_SET         0x3F            /* level threshold preset */
-#define MMR_THR_PRE_SET_CUR     0x80            /* Current signal above it */
-  unsigned char mmr_signal_lvl;         /* signal level */
-#define MMR_SIGNAL_LVL          0x3F            /* signal level */
-#define MMR_SIGNAL_LVL_VALID    0x80            /* Updated since last read */
-  unsigned char mmr_silence_lvl;        /* silence level (noise) */
-#define MMR_SILENCE_LVL         0x3F            /* silence level */
-#define MMR_SILENCE_LVL_VALID   0x80            /* Updated since last read */
-  unsigned char mmr_sgnl_qual;          /* signal quality */
-#define MMR_SGNL_QUAL           0x0F            /* signal quality */
-#define MMR_SGNL_QUAL_ANT       0x80            /* current antenna used */
-  unsigned char mmr_netw_id_l;          /* NWID low order byte (?) */
-  unsigned char mmr_unused3[3];         /* unused */
-
-  /* 2.0 Hardware extension - frequency selection support */
-  unsigned char mmr_fee_status;         /* Status of frequency EEPROM */
-#define MMR_FEE_STATUS_ID       0xF0            /* Modem revision ID */
-#define MMR_FEE_STATUS_DWLD     0x08            /* Download in progress */
-#define MMR_FEE_STATUS_BUSY     0x04            /* EEPROM busy */
-  unsigned char mmr_unused4[1];         /* unused */
-  unsigned char mmr_fee_data_l;         /* Read data from EEPROM (low) */
-  unsigned char mmr_fee_data_h;         /* Read data from EEPROM (high) */
-} __attribute__ ((packed));
-
-#define MMR_SIZE        36
-
-#define mmroff(p,f)     (unsigned short)((void *)(&((mmr_t *)((void *)0 + (p)))->f) - (void *)0)
-
-/* Make the two above structures one */
-typedef union mm_t
-{
-  struct mmw_t  w;      /* Write to the mmc */
-  struct mmr_t  r;      /* Read from the mmc */
-} mm_t;
-
-#endif /* _WAVELAN_H */
-
-/*
- * This software may only be used and distributed
- * according to the terms of the GNU General Public License.
- *
- * For more details, see wavelan.c.
- */
diff --git a/drivers/net/wireless/wavelan.p.h b/drivers/net/wireless/wavelan.p.h
deleted file mode 100644
index dbe8de6e5f52..000000000000
--- a/drivers/net/wireless/wavelan.p.h
+++ /dev/null
@@ -1,696 +0,0 @@
-/*
- *      WaveLAN ISA driver
- *
- *              Jean II - HPLB '96
- *
- * Reorganisation and extension of the driver.
- *
- * This file contains all definitions and declarations necessary for the
- * WaveLAN ISA driver.  This file is a private header, so it should
- * be included only in wavelan.c!
- */
-
-#ifndef WAVELAN_P_H
-#define WAVELAN_P_H
-
-/************************** DOCUMENTATION ***************************/
-/*
- * This driver provides a Linux interface to the WaveLAN ISA hardware.
- * The WaveLAN is a product of Lucent (http://www.wavelan.com/).
- * This division was formerly part of NCR and then AT&T.
- * WaveLANs are also distributed by DEC (RoamAbout DS) and Digital Ocean.
- *
- * To learn how to use this driver, read the NET3 HOWTO.
- * If you want to exploit the many other functionalities, read the comments
- * in the code.
- *
- * This driver is the result of the effort of many people (see below).
- */
-
-/* ------------------------ SPECIFIC NOTES ------------------------ */
-/*
- * Web page
- * --------
- *      I try to maintain a web page with the Wireless LAN Howto at :
- *          http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Wavelan.html
- *
- * SMP
- * ---
- *      We now are SMP compliant (I eventually fixed the remaining bugs).
- *      The driver has been tested on a dual P6-150 and survived my usual
- *      set of torture tests.
- *      Anyway, I spent enough time chasing interrupt re-entrancy during
- *      errors or reconfigure, and I designed the locked/unlocked sections
- *      of the driver with great care, and with the recent addition of
- *      the spinlock (thanks to the new API), we should be quite close to
- *      the truth.
- *      The SMP/IRQ locking is quite coarse and conservative (i.e. not fast),
- *      but better safe than sorry (especially at 2 Mb/s ;-).
- *
- *      I have also looked into disabling only our interrupt on the card
- *      (via HACR) instead of all interrupts in the processor (via cli),
- *      so that other driver are not impacted, and it look like it's
- *      possible, but it's very tricky to do right (full of races). As
- *      the gain would be mostly for SMP systems, it can wait...
- *
- * Debugging and options
- * ---------------------
- *      You will find below a set of '#define" allowing a very fine control
- *      on the driver behaviour and the debug messages printed.
- *      The main options are :
- *      o SET_PSA_CRC, to have your card correctly recognised by
- *        an access point and the Point-to-Point diagnostic tool.
- *      o USE_PSA_CONFIG, to read configuration from the PSA (EEprom)
- *        (otherwise we always start afresh with some defaults)
- *
- * wavelan.o is too darned big
- * ---------------------------
- *      That's true!  There is a very simple way to reduce the driver
- *      object by 33%!  Comment out the following line:
- *              #include <linux/wireless.h>
- *      Other compile options can also reduce the size of it...
- *
- * MAC address and hardware detection:
- * -----------------------------------
- *      The detection code for the WaveLAN checks that the first three
- *      octets of the MAC address fit the company code.  This type of
- *      detection works well for AT&T cards (because the AT&T code is
- *      hardcoded in wavelan.h), but of course will fail for other
- *      manufacturers.
- *
- *      If you are sure that your card is derived from the WaveLAN,
- *      here is the way to configure it:
- *      1) Get your MAC address
- *              a) With your card utilities (wfreqsel, instconf, etc.)
- *              b) With the driver:
- *                      o compile the kernel with DEBUG_CONFIG_INFO enabled
- *                      o Boot and look the card messages
- *      2) Set your MAC code (3 octets) in MAC_ADDRESSES[][3] (wavelan.h)
- *      3) Compile and verify
- *      4) Send me the MAC code.  I will include it in the next version.
- *
- */
-
-/* --------------------- WIRELESS EXTENSIONS --------------------- */
-/*
- * This driver is the first to support "wireless extensions".
- * This set of extensions provides a standard way to control the wireless
- * characteristics of the hardware.  Applications such as mobile IP may
- * take advantage of it.
- *
- * It might be a good idea as well to fetch the wireless tools to
- * configure the device and play a bit.
- */
-
-/* ---------------------------- FILES ---------------------------- */
-/*
- * wavelan.c:           actual code for the driver:  C functions
- *
- * wavelan.p.h:         private header:  local types and variables for driver
- *
- * wavelan.h:           description of the hardware interface and structs
- *
- * i82586.h:            description of the Ethernet controller
- */
-
-/* --------------------------- HISTORY --------------------------- */
-/*
- * This is based on information in the drivers' headers. It may not be
- * accurate, and I guarantee only my best effort.
- *
- * The history of the WaveLAN drivers is as complicated as the history of
- * the WaveLAN itself (NCR -> AT&T -> Lucent).
- *
- * It all started with Anders Klemets <klemets@paul.rutgers.edu>
- * writing a WaveLAN ISA driver for the Mach microkernel.  Girish
- * Welling <welling@paul.rutgers.edu> had also worked on it.
- * Keith Moore modified this for the PCMCIA hardware.
- * 
- * Robert Morris <rtm@das.harvard.edu> ported these two drivers to BSDI
- * and added specific PCMCIA support (there is currently no equivalent
- * of the PCMCIA package under BSD).
- *
- * Jim Binkley <jrb@cs.pdx.edu> ported both BSDI drivers to FreeBSD.
- *
- * Bruce Janson <bruce@cs.usyd.edu.au> ported the BSDI ISA driver to Linux.
- *
- * Anthony D. Joseph <adj@lcs.mit.edu> started to modify Bruce's driver
- * (with help of the BSDI PCMCIA driver) for PCMCIA.
- * Yunzhou Li <yunzhou@strat.iol.unh.edu> finished this work.
- * Joe Finney <joe@comp.lancs.ac.uk> patched the driver to start
- * 2.00 cards correctly (2.4 GHz with frequency selection).
- * David Hinds <dahinds@users.sourceforge.net> integrated the whole in his
- * PCMCIA package (and bug corrections).
- *
- * I (Jean Tourrilhes - jt@hplb.hpl.hp.com) then started to make some
- * patches to the PCMCIA driver.  Later, I added code in the ISA driver
- * for Wireless Extensions and full support of frequency selection
- * cards.  Then, I did the same to the PCMCIA driver, and did some
- * reorganisation.  Finally, I came back to the ISA driver to
- * upgrade it at the same level as the PCMCIA one and reorganise
- * the code.
- * Loeke Brederveld <lbrederv@wavelan.com> from Lucent has given me
- * much needed information on the WaveLAN hardware.
- */
-
-/* The original copyrights and literature mention others' names and
- * credits.  I don't know what their part in this development was.
- */
-
-/* By the way, for the copyright and legal stuff:
- * almost everybody wrote code under the GNU or BSD license (or similar),
- * and want their original copyright to remain somewhere in the
- * code (for myself, I go with the GPL).
- * Nobody wants to take responsibility for anything, except the fame.
- */
-
-/* --------------------------- CREDITS --------------------------- */
-/*
- * This software was developed as a component of the
- * Linux operating system.
- * It is based on other device drivers and information
- * either written or supplied by:
- *      Ajay Bakre <bakre@paul.rutgers.edu>,
- *      Donald Becker <becker@cesdis.gsfc.nasa.gov>,
- *      Loeke Brederveld <Loeke.Brederveld@Utrecht.NCR.com>,
- *      Brent Elphick <belphick@uwaterloo.ca>,
- *      Anders Klemets <klemets@it.kth.se>,
- *      Vladimir V. Kolpakov <w@stier.koenig.ru>,
- *      Marc Meertens <Marc.Meertens@Utrecht.NCR.com>,
- *      Pauline Middelink <middelin@polyware.iaf.nl>,
- *      Robert Morris <rtm@das.harvard.edu>,
- *      Jean Tourrilhes <jt@hpl.hp.com>,
- *      Girish Welling <welling@paul.rutgers.edu>,
- *      Clark Woodworth <clark@hiway1.exit109.com>
- *      Yongguang Zhang <ygz@isl.hrl.hac.com>
- *
- * Thanks go also to:
- *      James Ashton <jaa101@syseng.anu.edu.au>,
- *      Alan Cox <alan@lxorguk.ukuu.org.uk>,
- *      Allan Creighton <allanc@cs.usyd.edu.au>,
- *      Matthew Geier <matthew@cs.usyd.edu.au>,
- *      Remo di Giovanni <remo@cs.usyd.edu.au>,
- *      Eckhard Grah <grah@wrcs1.urz.uni-wuppertal.de>,
- *      Vipul Gupta <vgupta@cs.binghamton.edu>,
- *      Mark Hagan <mhagan@wtcpost.daytonoh.NCR.COM>,
- *      Tim Nicholson <tim@cs.usyd.edu.au>,
- *      Ian Parkin <ian@cs.usyd.edu.au>,
- *      John Rosenberg <johnr@cs.usyd.edu.au>,
- *      George Rossi <george@phm.gov.au>,
- *      Arthur Scott <arthur@cs.usyd.edu.au>,
- *      Stanislav Sinyagin <stas@isf.ru>
- *      and Peter Storey for their assistance and advice.
- *
- * Additional Credits:
- *
- *      My development has been done initially under Debian 1.1 (Linux 2.0.x)
- *      and now under Debian 2.2, initially with an HP Vectra XP/60, and now
- *      an HP Vectra XP/90.
- *
- */
-
-/* ------------------------- IMPROVEMENTS ------------------------- */
-/*
- * I proudly present:
- *
- * Changes made in first pre-release:
- * ----------------------------------
- *      - reorganisation of the code, function name change
- *      - creation of private header (wavelan.p.h)
- *      - reorganised debug messages
- *      - more comments, history, etc.
- *      - mmc_init:  configure the PSA if not done
- *      - mmc_init:  correct default value of level threshold for PCMCIA
- *      - mmc_init:  2.00 detection better code for 2.00 initialization
- *      - better info at startup
- *      - IRQ setting (note:  this setting is permanent)
- *      - watchdog:  change strategy (and solve module removal problems)
- *      - add wireless extensions (ioctl and get_wireless_stats)
- *        get/set nwid/frequency on fly, info for /proc/net/wireless
- *      - more wireless extensions:  SETSPY and GETSPY
- *      - make wireless extensions optional
- *      - private ioctl to set/get quality and level threshold, histogram
- *      - remove /proc/net/wavelan
- *      - suppress useless stuff from lp (net_local)
- *      - kernel 2.1 support (copy_to/from_user instead of memcpy_to/fromfs)
- *      - add message level (debug stuff in /var/adm/debug and errors not
- *        displayed at console and still in /var/adm/messages)
- *      - multi device support
- *      - start fixing the probe (init code)
- *      - more inlines
- *      - man page
- *      - many other minor details and cleanups
- *
- * Changes made in second pre-release:
- * -----------------------------------
- *      - clean up init code (probe and module init)
- *      - better multiple device support (module)
- *      - name assignment (module)
- *
- * Changes made in third pre-release:
- * ----------------------------------
- *      - be more conservative on timers
- *      - preliminary support for multicast (I still lack some details)
- *
- * Changes made in fourth pre-release:
- * -----------------------------------
- *      - multicast (revisited and finished)
- *      - avoid reset in set_multicast_list (a really big hack)
- *        if somebody could apply this code for other i82586 based drivers
- *      - share onboard memory 75% RU and 25% CU (instead of 50/50)
- *
- * Changes made for release in 2.1.15:
- * -----------------------------------
- *      - change the detection code for multi manufacturer code support
- *
- * Changes made for release in 2.1.17:
- * -----------------------------------
- *      - update to wireless extensions changes
- *      - silly bug in card initial configuration (psa_conf_status)
- *
- * Changes made for release in 2.1.27 & 2.0.30:
- * --------------------------------------------
- *      - small bug in debug code (probably not the last one...)
- *      - remove extern keyword for wavelan_probe()
- *      - level threshold is now a standard wireless extension (version 4 !)
- *      - modules parameters types (new module interface)
- *
- * Changes made for release in 2.1.36:
- * -----------------------------------
- *      - byte count stats (courtesy of David Hinds)
- *      - remove dev_tint stuff (courtesy of David Hinds)
- *      - encryption setting from Brent Elphick (thanks a lot!)
- *      - 'ioaddr' to 'u_long' for the Alpha (thanks to Stanislav Sinyagin)
- *
- * Other changes (not by me) :
- * -------------------------
- *      - Spelling and gramar "rectification".
- *
- * Changes made for release in 2.0.37 & 2.2.2 :
- * ------------------------------------------
- *      - Correct status in /proc/net/wireless
- *      - Set PSA CRC to make PtP diagnostic tool happy (Bob Gray)
- *      - Module init code don't fail if we found at least one card in
- *        the address list (Karlis Peisenieks)
- *      - Missing parenthesis (Christopher Peterson)
- *      - Correct i82586 configuration parameters
- *      - Encryption initialisation bug (Robert McCormack)
- *      - New mac addresses detected in the probe
- *      - Increase watchdog for busy environments
- *
- * Changes made for release in 2.0.38 & 2.2.7 :
- * ------------------------------------------
- *      - Correct the reception logic to better report errors and avoid
- *        sending bogus packet up the stack
- *      - Delay RU config to avoid corrupting first received packet
- *      - Change config completion code (to actually check something)
- *      - Avoid reading out of bound in skbuf to transmit
- *      - Rectify a lot of (useless) debugging code
- *      - Change the way to `#ifdef SET_PSA_CRC'
- *
- * Changes made for release in 2.2.11 & 2.3.13 :
- * -------------------------------------------
- *      - Change e-mail and web page addresses
- *      - Watchdog timer is now correctly expressed in HZ, not in jiffies
- *      - Add channel number to the list of frequencies in range
- *      - Add the (short) list of bit-rates in range
- *      - Developp a new sensitivity... (sens.value & sens.fixed)
- *
- * Changes made for release in 2.2.14 & 2.3.23 :
- * -------------------------------------------
- *      - Fix check for root permission (break instead of exit)
- *      - New nwid & encoding setting (Wireless Extension 9)
- *
- * Changes made for release in 2.3.49 :
- * ----------------------------------
- *      - Indentation reformating (Alan)
- *      - Update to new network API (softnet - 2.3.43) :
- *              o replace dev->tbusy (Alan)
- *              o replace dev->tstart (Alan)
- *              o remove dev->interrupt (Alan)
- *              o add SMP locking via spinlock in splxx (me)
- *              o add spinlock in interrupt handler (me)
- *              o use kernel watchdog instead of ours (me)
- *              o increase watchdog timeout (kernel is more sensitive) (me)
- *              o verify that all the changes make sense and work (me)
- *      - Fixup a potential gotcha when reconfiguring and thighten a bit
- *              the interactions with Tx queue.
- *
- * Changes made for release in 2.4.0 :
- * ---------------------------------
- *      - Fix spinlock stupid bugs that I left in. The driver is now SMP
- *              compliant and doesn't lockup at startup.
- *
- * Changes made for release in 2.5.2 :
- * ---------------------------------
- *      - Use new driver API for Wireless Extensions :
- *              o got rid of wavelan_ioctl()
- *              o use a bunch of iw_handler instead
- *
- * Changes made for release in 2.5.35 :
- * ----------------------------------
- *      - Set dev->trans_start to avoid filling the logs
- *      - Handle better spurious/bogus interrupt
- *      - Avoid deadlocks in mmc_out()/mmc_in()
- *
- * Wishes & dreams:
- * ----------------
- *      - roaming (see Pcmcia driver)
- */
-
-/***************************** INCLUDES *****************************/
-
-#include        <linux/module.h>
-
-#include        <linux/kernel.h>
-#include        <linux/sched.h>
-#include        <linux/types.h>
-#include        <linux/fcntl.h>
-#include        <linux/interrupt.h>
-#include        <linux/stat.h>
-#include        <linux/ptrace.h>
-#include        <linux/ioport.h>
-#include        <linux/in.h>
-#include        <linux/string.h>
-#include        <linux/delay.h>
-#include        <linux/bitops.h>
-#include        <asm/system.h>
-#include        <asm/io.h>
-#include        <asm/dma.h>
-#include        <asm/uaccess.h>
-#include        <linux/errno.h>
-#include        <linux/netdevice.h>
-#include        <linux/etherdevice.h>
-#include        <linux/skbuff.h>
-#include        <linux/slab.h>
-#include        <linux/timer.h>
-#include        <linux/init.h>
-
-#include <linux/wireless.h>             /* Wireless extensions */
-#include <net/iw_handler.h>             /* Wireless handlers */
-
-/* WaveLAN declarations */
-#include        "i82586.h"
-#include        "wavelan.h"
-
-/************************** DRIVER OPTIONS **************************/
-/*
- * `#define' or `#undef' the following constant to change the behaviour
- * of the driver...
- */
-#undef SET_PSA_CRC              /* Calculate and set the CRC on PSA (slower) */
-#define USE_PSA_CONFIG          /* Use info from the PSA. */
-#undef EEPROM_IS_PROTECTED      /* doesn't seem to be necessary */
-#define MULTICAST_AVOID         /* Avoid extra multicast (I'm sceptical). */
-#undef SET_MAC_ADDRESS          /* Experimental */
-
-/* Warning:  this stuff will slow down the driver. */
-#define WIRELESS_SPY            /* Enable spying addresses. */
-#undef HISTOGRAM                /* Enable histogram of signal level. */
-
-/****************************** DEBUG ******************************/
-
-#undef DEBUG_MODULE_TRACE       /* module insertion/removal */
-#undef DEBUG_CALLBACK_TRACE     /* calls made by Linux */
-#undef DEBUG_INTERRUPT_TRACE    /* calls to handler */
-#undef DEBUG_INTERRUPT_INFO     /* type of interrupt and so on */
-#define DEBUG_INTERRUPT_ERROR   /* problems */
-#undef DEBUG_CONFIG_TRACE       /* Trace the config functions. */
-#undef DEBUG_CONFIG_INFO        /* what's going on */
-#define DEBUG_CONFIG_ERROR      /* errors on configuration */
-#undef DEBUG_TX_TRACE           /* transmission calls */
-#undef DEBUG_TX_INFO            /* header of the transmitted packet */
-#undef DEBUG_TX_FAIL            /* Normal failure conditions */
-#define DEBUG_TX_ERROR          /* Unexpected conditions */
-#undef DEBUG_RX_TRACE           /* transmission calls */
-#undef DEBUG_RX_INFO            /* header of the received packet */
-#undef DEBUG_RX_FAIL            /* Normal failure conditions */
-#define DEBUG_RX_ERROR          /* Unexpected conditions */
-
-#undef DEBUG_PACKET_DUMP        /* Dump packet on the screen if defined to 32. */
-#undef DEBUG_IOCTL_TRACE        /* misc. call by Linux */
-#undef DEBUG_IOCTL_INFO         /* various debugging info */
-#define DEBUG_IOCTL_ERROR       /* what's going wrong */
-#define DEBUG_BASIC_SHOW        /* Show basic startup info. */
-#undef DEBUG_VERSION_SHOW       /* Print version info. */
-#undef DEBUG_PSA_SHOW           /* Dump PSA to screen. */
-#undef DEBUG_MMC_SHOW           /* Dump mmc to screen. */
-#undef DEBUG_SHOW_UNUSED        /* Show unused fields too. */
-#undef DEBUG_I82586_SHOW        /* Show i82586 status. */
-#undef DEBUG_DEVICE_SHOW        /* Show device parameters. */
-
-/************************ CONSTANTS & MACROS ************************/
-
-#ifdef DEBUG_VERSION_SHOW
-static const char       *version        = "wavelan.c : v24 (SMP + wireless extensions) 11/12/01\n";
-#endif
-
-/* Watchdog temporisation */
-#define WATCHDOG_JIFFIES        (512*HZ/100)
-
-/* ------------------------ PRIVATE IOCTL ------------------------ */
-
-#define SIOCSIPQTHR     SIOCIWFIRSTPRIV         /* Set quality threshold */
-#define SIOCGIPQTHR     SIOCIWFIRSTPRIV + 1     /* Get quality threshold */
-
-#define SIOCSIPHISTO    SIOCIWFIRSTPRIV + 2     /* Set histogram ranges */
-#define SIOCGIPHISTO    SIOCIWFIRSTPRIV + 3     /* Get histogram values */
-
-/****************************** TYPES ******************************/
-
-/* Shortcuts */
-typedef struct iw_statistics    iw_stats;
-typedef struct iw_quality       iw_qual;
-typedef struct iw_freq          iw_freq;typedef struct net_local        net_local;
-typedef struct timer_list       timer_list;
-
-/* Basic types */
-typedef u_char          mac_addr[WAVELAN_ADDR_SIZE];    /* Hardware address */
-
-/*
- * Static specific data for the interface.
- *
- * For each network interface, Linux keeps data in two structures:  "device"
- * keeps the generic data (same format for everybody) and "net_local" keeps
- * additional specific data.
- */
-struct net_local
-{
-  net_local *   next;           /* linked list of the devices */
-  struct net_device *   dev;            /* reverse link */
-  spinlock_t    spinlock;       /* Serialize access to the hardware (SMP) */
-  int           nresets;        /* number of hardware resets */
-  u_char        reconfig_82586; /* We need to reconfigure the controller. */
-  u_char        promiscuous;    /* promiscuous mode */
-  int           mc_count;       /* number of multicast addresses */
-  u_short       hacr;           /* current host interface state */
-
-  int           tx_n_in_use;
-  u_short       rx_head;
-  u_short       rx_last;
-  u_short       tx_first_free;
-  u_short       tx_first_in_use;
-
-  iw_stats      wstats;         /* Wireless-specific statistics */
-
-  struct iw_spy_data    spy_data;
-  struct iw_public_data wireless_data;
-
-#ifdef HISTOGRAM
-  int           his_number;             /* number of intervals */
-  u_char        his_range[16];          /* boundaries of interval ]n-1; n] */
-  u_long        his_sum[16];            /* sum in interval */
-#endif  /* HISTOGRAM */
-};
-
-/**************************** PROTOTYPES ****************************/
-
-/* ----------------------- MISC. SUBROUTINES ------------------------ */
-static u_char
-        wv_irq_to_psa(int);
-static int
-        wv_psa_to_irq(u_char);
-/* ------------------- HOST ADAPTER SUBROUTINES ------------------- */
-static inline u_short           /* data */
-        hasr_read(u_long);      /* Read the host interface:  base address */
-static inline void
-        hacr_write(u_long,      /* Write to host interface:  base address */
-                   u_short),    /* data */
-        hacr_write_slow(u_long,
-                   u_short),
-        set_chan_attn(u_long,   /* ioaddr */
-                      u_short), /* hacr   */
-        wv_hacr_reset(u_long),  /* ioaddr */
-        wv_16_off(u_long,       /* ioaddr */
-                  u_short),     /* hacr   */
-        wv_16_on(u_long,        /* ioaddr */
-                 u_short),      /* hacr   */
-        wv_ints_off(struct net_device *),
-        wv_ints_on(struct net_device *);
-/* ----------------- MODEM MANAGEMENT SUBROUTINES ----------------- */
-static void
-        psa_read(u_long,        /* Read the Parameter Storage Area. */
-                 u_short,       /* hacr */
-                 int,           /* offset in PSA */
-                 u_char *,      /* buffer to fill */
-                 int),          /* size to read */
-        psa_write(u_long,       /* Write to the PSA. */
-                  u_short,      /* hacr */
-                  int,          /* offset in PSA */
-                  u_char *,     /* buffer in memory */
-                  int);         /* length of buffer */
-static inline void
-        mmc_out(u_long,         /* Write 1 byte to the Modem Manag Control. */
-                u_short,
-                u_char),
-        mmc_write(u_long,       /* Write n bytes to the MMC. */
-                  u_char,
-                  u_char *,
-                  int);
-static inline u_char            /* Read 1 byte from the MMC. */
-        mmc_in(u_long,
-               u_short);
-static inline void
-        mmc_read(u_long,        /* Read n bytes from the MMC. */
-                 u_char,
-                 u_char *,
-                 int),
-        fee_wait(u_long,        /* Wait for frequency EEPROM:  base address */
-                 int,           /* base delay to wait for */
-                 int);          /* time to wait */
-static void
-        fee_read(u_long,        /* Read the frequency EEPROM:  base address */
-                 u_short,       /* destination offset */
-                 u_short *,     /* data buffer */
-                 int);          /* number of registers */
-/* ---------------------- I82586 SUBROUTINES ----------------------- */
-static /*inline*/ void
-        obram_read(u_long,      /* ioaddr */
-                   u_short,     /* o */
-                   u_char *,    /* b */
-                   int);        /* n */
-static inline void
-        obram_write(u_long,     /* ioaddr */
-                    u_short,    /* o */
-                    u_char *,   /* b */
-                    int);       /* n */
-static void
-        wv_ack(struct net_device *);
-static inline int
-        wv_synchronous_cmd(struct net_device *,
-                           const char *),
-        wv_config_complete(struct net_device *,
-                           u_long,
-                           net_local *);
-static int
-        wv_complete(struct net_device *,
-                    u_long,
-                    net_local *);
-static inline void
-        wv_82586_reconfig(struct net_device *);
-/* ------------------- DEBUG & INFO SUBROUTINES ------------------- */
-#ifdef DEBUG_I82586_SHOW
-static void
-        wv_scb_show(unsigned short);
-#endif
-static inline void
-        wv_init_info(struct net_device *);      /* display startup info */
-/* ------------------- IOCTL, STATS & RECONFIG ------------------- */
-static iw_stats *
-        wavelan_get_wireless_stats(struct net_device *);
-static void
-        wavelan_set_multicast_list(struct net_device *);
-/* ----------------------- PACKET RECEPTION ----------------------- */
-static inline void
-        wv_packet_read(struct net_device *,     /* Read a packet from a frame. */
-                       u_short,
-                       int),
-        wv_receive(struct net_device *);        /* Read all packets waiting. */
-/* --------------------- PACKET TRANSMISSION --------------------- */
-static inline int
-        wv_packet_write(struct net_device *,    /* Write a packet to the Tx buffer. */
-                        void *,
-                        short);
-static netdev_tx_t
-        wavelan_packet_xmit(struct sk_buff *,   /* Send a packet. */
-                            struct net_device *);
-/* -------------------- HARDWARE CONFIGURATION -------------------- */
-static inline int
-        wv_mmc_init(struct net_device *),       /* Initialize the modem. */
-        wv_ru_start(struct net_device *),       /* Start the i82586 receiver unit. */
-        wv_cu_start(struct net_device *),       /* Start the i82586 command unit. */
-        wv_82586_start(struct net_device *);    /* Start the i82586. */
-static void
-        wv_82586_config(struct net_device *);   /* Configure the i82586. */
-static inline void
-        wv_82586_stop(struct net_device *);
-static int
-        wv_hw_reset(struct net_device *),       /* Reset the WaveLAN hardware. */
-        wv_check_ioaddr(u_long,         /* ioaddr */
-                        u_char *);      /* mac address (read) */
-/* ---------------------- INTERRUPT HANDLING ---------------------- */
-static irqreturn_t
-        wavelan_interrupt(int,          /* interrupt handler */
-                          void *);
-static void
-        wavelan_watchdog(struct net_device *);  /* transmission watchdog */
-/* ------------------- CONFIGURATION CALLBACKS ------------------- */
-static int
-        wavelan_open(struct net_device *),      /* Open the device. */
-        wavelan_close(struct net_device *),     /* Close the device. */
-        wavelan_config(struct net_device *, unsigned short);/* Configure one device. */
-extern struct net_device *wavelan_probe(int unit);      /* See Space.c. */
-
-/**************************** VARIABLES ****************************/
-
-/*
- * This is the root of the linked list of WaveLAN drivers
- * It is use to verify that we don't reuse the same base address
- * for two different drivers and to clean up when removing the module.
- */
-static net_local *      wavelan_list    = (net_local *) NULL;
-
-/*
- * This table is used to translate the PSA value to IRQ number
- * and vice versa.
- */
-static u_char   irqvals[]       =
-{
-           0,    0,    0, 0x01,
-        0x02, 0x04,    0, 0x08,
-           0,    0, 0x10, 0x20,
-        0x40,    0,    0, 0x80,
-};
-
-/*
- * Table of the available I/O addresses (base addresses) for WaveLAN
- */
-static unsigned short   iobase[]        =
-{
-#if     0
-  /* Leave out 0x3C0 for now -- seems to clash with some video
-   * controllers.
-   * Leave out the others too -- we will always use 0x390 and leave
-   * 0x300 for the Ethernet device.
-   * Jean II:  0x3E0 is fine as well.
-   */
-  0x300, 0x390, 0x3E0, 0x3C0
-#endif  /* 0 */
-  0x390, 0x3E0
-};
-
-#ifdef  MODULE
-/* Parameters set by insmod */
-static int      io[4];
-static int      irq[4];
-static char     *name[4];
-module_param_array(io, int, NULL, 0);
-module_param_array(irq, int, NULL, 0);
-module_param_array(name, charp, NULL, 0);
-
-MODULE_PARM_DESC(io, "WaveLAN I/O base address(es),required");
-MODULE_PARM_DESC(irq, "WaveLAN IRQ number(s)");
-MODULE_PARM_DESC(name, "WaveLAN interface neme(s)");
-#endif  /* MODULE */
-
-#endif  /* WAVELAN_P_H */
diff --git a/drivers/net/wireless/wavelan_cs.c b/drivers/net/wireless/wavelan_cs.c
deleted file mode 100644
index 431a20ec6db6..000000000000
--- a/drivers/net/wireless/wavelan_cs.c
+++ /dev/null
@@ -1,4635 +0,0 @@
-/*
- *      Wavelan Pcmcia driver
- *
- *              Jean II - HPLB '96
- *
- * Reorganisation and extension of the driver.
- * Original copyright follow. See wavelan_cs.p.h for details.
- *
- * This code is derived from Anthony D. Joseph's code and all the changes here
- * are also under the original copyright below.
- *
- * This code supports version 2.00 of WaveLAN/PCMCIA cards (2.4GHz), and
- * can work on Linux 2.0.36 with support of David Hinds' PCMCIA Card Services
- *
- * Joe Finney (joe@comp.lancs.ac.uk) at Lancaster University in UK added
- * critical code in the routine to initialize the Modem Management Controller.
- *
- * Thanks to Alan Cox and Bruce Janson for their advice.
- *
- *      -- Yunzhou Li (scip4166@nus.sg)
- *
-#ifdef WAVELAN_ROAMING  
- * Roaming support added 07/22/98 by Justin Seger (jseger@media.mit.edu)
- * based on patch by Joe Finney from Lancaster University.
-#endif
- *
- * Lucent (formerly AT&T GIS, formerly NCR) WaveLAN PCMCIA card: An
- * Ethernet-like radio transceiver controlled by an Intel 82593 coprocessor.
- *
- *   A non-shared memory PCMCIA ethernet driver for linux
- *
- * ISA version modified to support PCMCIA by Anthony Joseph (adj@lcs.mit.edu)
- *
- *
- * Joseph O'Sullivan & John Langford (josullvn@cs.cmu.edu & jcl@cs.cmu.edu)
- *
- * Apr 2 '98  made changes to bring the i82593 control/int handling in line
- *             with offical specs...
- *
- ****************************************************************************
- *   Copyright 1995
- *   Anthony D. Joseph
- *   Massachusetts Institute of Technology
- *
- *   Permission to use, copy, modify, and distribute this program
- *   for any purpose and without fee is hereby granted, provided
- *   that this copyright and permission notice appear on all copies
- *   and supporting documentation, the name of M.I.T. not be used
- *   in advertising or publicity pertaining to distribution of the
- *   program without specific prior permission, and notice be given
- *   in supporting documentation that copying and distribution is
- *   by permission of M.I.T.  M.I.T. makes no representations about
- *   the suitability of this software for any purpose.  It is pro-
- *   vided "as is" without express or implied warranty.         
- ****************************************************************************
- *
- */
-
-/* Do *NOT* add other headers here, you are guaranteed to be wrong - Jean II */
-#include "wavelan_cs.p.h"               /* Private header */
-
-#ifdef WAVELAN_ROAMING
-static void wl_cell_expiry(unsigned long data);
-static void wl_del_wavepoint(wavepoint_history *wavepoint, struct net_local *lp);
-static void wv_nwid_filter(unsigned char mode, net_local *lp);
-#endif  /*  WAVELAN_ROAMING  */
-
-/************************* MISC SUBROUTINES **************************/
-/*
- * Subroutines which won't fit in one of the following category
- * (wavelan modem or i82593)
- */
-
-/******************* MODEM MANAGEMENT SUBROUTINES *******************/
-/*
- * Useful subroutines to manage the modem of the wavelan
- */
-
-/*------------------------------------------------------------------*/
-/*
- * Read from card's Host Adaptor Status Register.
- */
-static inline u_char
-hasr_read(u_long        base)
-{
-  return(inb(HASR(base)));
-} /* hasr_read */
-
-/*------------------------------------------------------------------*/
-/*
- * Write to card's Host Adapter Command Register.
- */
-static inline void
-hacr_write(u_long       base,
-           u_char       hacr)
-{
-  outb(hacr, HACR(base));
-} /* hacr_write */
-
-/*------------------------------------------------------------------*/
-/*
- * Write to card's Host Adapter Command Register. Include a delay for
- * those times when it is needed.
- */
-static void
-hacr_write_slow(u_long  base,
-                u_char  hacr)
-{
-  hacr_write(base, hacr);
-  /* delay might only be needed sometimes */
-  mdelay(1);
-} /* hacr_write_slow */
-
-/*------------------------------------------------------------------*/
-/*
- * Read the Parameter Storage Area from the WaveLAN card's memory
- */
-static void
-psa_read(struct net_device *    dev,
-         int            o,      /* offset in PSA */
-         u_char *       b,      /* buffer to fill */
-         int            n)      /* size to read */
-{
-  net_local *lp = netdev_priv(dev);
-  u_char __iomem *ptr = lp->mem + PSA_ADDR + (o << 1);
-
-  while(n-- > 0)
-    {
-      *b++ = readb(ptr);
-      /* Due to a lack of address decode pins, the WaveLAN PCMCIA card
-       * only supports reading even memory addresses. That means the
-       * increment here MUST be two.
-       * Because of that, we can't use memcpy_fromio()...
-       */
-      ptr += 2;
-    }
-} /* psa_read */
-
-/*------------------------------------------------------------------*/
-/*
- * Write the Parameter Storage Area to the WaveLAN card's memory
- */
-static void
-psa_write(struct net_device *   dev,
-          int           o,      /* Offset in psa */
-          u_char *      b,      /* Buffer in memory */
-          int           n)      /* Length of buffer */
-{
-  net_local *lp = netdev_priv(dev);
-  u_char __iomem *ptr = lp->mem + PSA_ADDR + (o << 1);
-  int           count = 0;
-  unsigned int  base = dev->base_addr;
-  /* As there seem to have no flag PSA_BUSY as in the ISA model, we are
-   * oblige to verify this address to know when the PSA is ready... */
-  volatile u_char __iomem *verify = lp->mem + PSA_ADDR +
-    (psaoff(0, psa_comp_number) << 1);
-
-  /* Authorize writing to PSA */
-  hacr_write(base, HACR_PWR_STAT | HACR_ROM_WEN);
-
-  while(n-- > 0)
-    {
-      /* write to PSA */
-      writeb(*b++, ptr);
-      ptr += 2;
-
-      /* I don't have the spec, so I don't know what the correct
-       * sequence to write is. This hack seem to work for me... */
-      count = 0;
-      while((readb(verify) != PSA_COMP_PCMCIA_915) && (count++ < 100))
-        mdelay(1);
-    }
-
-  /* Put the host interface back in standard state */
-  hacr_write(base, HACR_DEFAULT);
-} /* psa_write */
-
-#ifdef SET_PSA_CRC
-/*------------------------------------------------------------------*/
-/*
- * Calculate the PSA CRC
- * Thanks to Valster, Nico <NVALSTER@wcnd.nl.lucent.com> for the code
- * NOTE: By specifying a length including the CRC position the
- * returned value should be zero. (i.e. a correct checksum in the PSA)
- *
- * The Windows drivers don't use the CRC, but the AP and the PtP tool
- * depend on it.
- */
-static u_short
-psa_crc(unsigned char * psa,    /* The PSA */
-        int             size)   /* Number of short for CRC */
-{
-  int           byte_cnt;       /* Loop on the PSA */
-  u_short       crc_bytes = 0;  /* Data in the PSA */
-  int           bit_cnt;        /* Loop on the bits of the short */
-
-  for(byte_cnt = 0; byte_cnt < size; byte_cnt++ )
-    {
-      crc_bytes ^= psa[byte_cnt];       /* Its an xor */
-
-      for(bit_cnt = 1; bit_cnt < 9; bit_cnt++ )
-        {
-          if(crc_bytes & 0x0001)
-            crc_bytes = (crc_bytes >> 1) ^ 0xA001;
-          else
-            crc_bytes >>= 1 ;
-        }
-    }
-
-  return crc_bytes;
-} /* psa_crc */
-#endif  /* SET_PSA_CRC */
-
-/*------------------------------------------------------------------*/
-/*
- * update the checksum field in the Wavelan's PSA
- */
-static void
-update_psa_checksum(struct net_device * dev)
-{
-#ifdef SET_PSA_CRC
-  psa_t         psa;
-  u_short       crc;
-
-  /* read the parameter storage area */
-  psa_read(dev, 0, (unsigned char *) &psa, sizeof(psa));
-
-  /* update the checksum */
-  crc = psa_crc((unsigned char *) &psa,
-                sizeof(psa) - sizeof(psa.psa_crc[0]) - sizeof(psa.psa_crc[1])
-                - sizeof(psa.psa_crc_status));
-
-  psa.psa_crc[0] = crc & 0xFF;
-  psa.psa_crc[1] = (crc & 0xFF00) >> 8;
-
-  /* Write it ! */
-  psa_write(dev, (char *)&psa.psa_crc - (char *)&psa,
-            (unsigned char *)&psa.psa_crc, 2);
-
-#ifdef DEBUG_IOCTL_INFO
-  printk (KERN_DEBUG "%s: update_psa_checksum(): crc = 0x%02x%02x\n",
-          dev->name, psa.psa_crc[0], psa.psa_crc[1]);
-
-  /* Check again (luxury !) */
-  crc = psa_crc((unsigned char *) &psa,
-                 sizeof(psa) - sizeof(psa.psa_crc_status));
-
-  if(crc != 0)
-    printk(KERN_WARNING "%s: update_psa_checksum(): CRC does not agree with PSA data (even after recalculating)\n", dev->name);
-#endif /* DEBUG_IOCTL_INFO */
-#endif  /* SET_PSA_CRC */
-} /* update_psa_checksum */
-
-/*------------------------------------------------------------------*/
-/*
- * Write 1 byte to the MMC.
- */
-static void
-mmc_out(u_long          base,
-        u_short         o,
-        u_char          d)
-{
-  int count = 0;
-
-  /* Wait for MMC to go idle */
-  while((count++ < 100) && (inb(HASR(base)) & HASR_MMI_BUSY))
-    udelay(10);
-
-  outb((u_char)((o << 1) | MMR_MMI_WR), MMR(base));
-  outb(d, MMD(base));
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Routine to write bytes to the Modem Management Controller.
- * We start by the end because it is the way it should be !
- */
-static void
-mmc_write(u_long        base,
-          u_char        o,
-          u_char *      b,
-          int           n)
-{
-  o += n;
-  b += n;
-
-  while(n-- > 0 )
-    mmc_out(base, --o, *(--b));
-} /* mmc_write */
-
-/*------------------------------------------------------------------*/
-/*
- * Read 1 byte from the MMC.
- * Optimised version for 1 byte, avoid using memory...
- */
-static u_char
-mmc_in(u_long   base,
-       u_short  o)
-{
-  int count = 0;
-
-  while((count++ < 100) && (inb(HASR(base)) & HASR_MMI_BUSY))
-    udelay(10);
-  outb(o << 1, MMR(base));              /* Set the read address */
-
-  outb(0, MMD(base));                   /* Required dummy write */
-
-  while((count++ < 100) && (inb(HASR(base)) & HASR_MMI_BUSY))
-    udelay(10);
-  return (u_char) (inb(MMD(base)));     /* Now do the actual read */
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Routine to read bytes from the Modem Management Controller.
- * The implementation is complicated by a lack of address lines,
- * which prevents decoding of the low-order bit.
- * (code has just been moved in the above function)
- * We start by the end because it is the way it should be !
- */
-static void
-mmc_read(u_long         base,
-         u_char         o,
-         u_char *       b,
-         int            n)
-{
-  o += n;
-  b += n;
-
-  while(n-- > 0)
-    *(--b) = mmc_in(base, --o);
-} /* mmc_read */
-
-/*------------------------------------------------------------------*/
-/*
- * Get the type of encryption available...
- */
-static inline int
-mmc_encr(u_long         base)   /* i/o port of the card */
-{
-  int   temp;
-
-  temp = mmc_in(base, mmroff(0, mmr_des_avail));
-  if((temp != MMR_DES_AVAIL_DES) && (temp != MMR_DES_AVAIL_AES))
-    return 0;
-  else
-    return temp;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wait for the frequency EEprom to complete a command...
- */
-static void
-fee_wait(u_long         base,   /* i/o port of the card */
-         int            delay,  /* Base delay to wait for */
-         int            number) /* Number of time to wait */
-{
-  int           count = 0;      /* Wait only a limited time */
-
-  while((count++ < number) &&
-        (mmc_in(base, mmroff(0, mmr_fee_status)) & MMR_FEE_STATUS_BUSY))
-    udelay(delay);
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Read bytes from the Frequency EEprom (frequency select cards).
- */
-static void
-fee_read(u_long         base,   /* i/o port of the card */
-         u_short        o,      /* destination offset */
-         u_short *      b,      /* data buffer */
-         int            n)      /* number of registers */
-{
-  b += n;               /* Position at the end of the area */
-
-  /* Write the address */
-  mmc_out(base, mmwoff(0, mmw_fee_addr), o + n - 1);
-
-  /* Loop on all buffer */
-  while(n-- > 0)
-    {
-      /* Write the read command */
-      mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_READ);
-
-      /* Wait until EEprom is ready (should be quick !) */
-      fee_wait(base, 10, 100);
-
-      /* Read the value */
-      *--b = ((mmc_in(base, mmroff(0, mmr_fee_data_h)) << 8) |
-              mmc_in(base, mmroff(0, mmr_fee_data_l)));
-    }
-}
-
-
-/*------------------------------------------------------------------*/
-/*
- * Write bytes from the Frequency EEprom (frequency select cards).
- * This is a bit complicated, because the frequency eeprom has to
- * be unprotected and the write enabled.
- * Jean II
- */
-static void
-fee_write(u_long        base,   /* i/o port of the card */
-          u_short       o,      /* destination offset */
-          u_short *     b,      /* data buffer */
-          int           n)      /* number of registers */
-{
-  b += n;               /* Position at the end of the area */
-
-#ifdef EEPROM_IS_PROTECTED      /* disabled */
-#ifdef DOESNT_SEEM_TO_WORK      /* disabled */
-  /* Ask to read the protected register */
-  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRREAD);
-
-  fee_wait(base, 10, 100);
-
-  /* Read the protected register */
-  printk("Protected 2 : %02X-%02X\n",
-         mmc_in(base, mmroff(0, mmr_fee_data_h)),
-         mmc_in(base, mmroff(0, mmr_fee_data_l)));
-#endif  /* DOESNT_SEEM_TO_WORK */
-
-  /* Enable protected register */
-  mmc_out(base, mmwoff(0, mmw_fee_addr), MMW_FEE_ADDR_EN);
-  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PREN);
-
-  fee_wait(base, 10, 100);
-
-  /* Unprotect area */
-  mmc_out(base, mmwoff(0, mmw_fee_addr), o + n);
-  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRWRITE);
-#ifdef DOESNT_SEEM_TO_WORK      /* disabled */
-  /* Or use : */
-  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRCLEAR);
-#endif  /* DOESNT_SEEM_TO_WORK */
-
-  fee_wait(base, 10, 100);
-#endif  /* EEPROM_IS_PROTECTED */
-
-  /* Write enable */
-  mmc_out(base, mmwoff(0, mmw_fee_addr), MMW_FEE_ADDR_EN);
-  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_WREN);
-
-  fee_wait(base, 10, 100);
-
-  /* Write the EEprom address */
-  mmc_out(base, mmwoff(0, mmw_fee_addr), o + n - 1);
-
-  /* Loop on all buffer */
-  while(n-- > 0)
-    {
-      /* Write the value */
-      mmc_out(base, mmwoff(0, mmw_fee_data_h), (*--b) >> 8);
-      mmc_out(base, mmwoff(0, mmw_fee_data_l), *b & 0xFF);
-
-      /* Write the write command */
-      mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_WRITE);
-
-      /* Wavelan doc says : wait at least 10 ms for EEBUSY = 0 */
-      mdelay(10);
-      fee_wait(base, 10, 100);
-    }
-
-  /* Write disable */
-  mmc_out(base, mmwoff(0, mmw_fee_addr), MMW_FEE_ADDR_DS);
-  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_WDS);
-
-  fee_wait(base, 10, 100);
-
-#ifdef EEPROM_IS_PROTECTED      /* disabled */
-  /* Reprotect EEprom */
-  mmc_out(base, mmwoff(0, mmw_fee_addr), 0x00);
-  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRWRITE);
-
-  fee_wait(base, 10, 100);
-#endif  /* EEPROM_IS_PROTECTED */
-}
-
-/******************* WaveLAN Roaming routines... ********************/
-
-#ifdef WAVELAN_ROAMING  /* Conditional compile, see wavelan_cs.h */
-
-static unsigned char WAVELAN_BEACON_ADDRESS[] = {0x09,0x00,0x0e,0x20,0x03,0x00};
-  
-static void wv_roam_init(struct net_device *dev)
-{
-  net_local  *lp= netdev_priv(dev);
-
-  /* Do not remove this unless you have a good reason */
-  printk(KERN_NOTICE "%s: Warning, you have enabled roaming on"
-         " device %s !\n", dev->name, dev->name);
-  printk(KERN_NOTICE "Roaming is currently an experimental unsupported feature"
-         " of the Wavelan driver.\n");
-  printk(KERN_NOTICE "It may work, but may also make the driver behave in"
-         " erratic ways or crash.\n");
-
-  lp->wavepoint_table.head=NULL;           /* Initialise WavePoint table */
-  lp->wavepoint_table.num_wavepoints=0;
-  lp->wavepoint_table.locked=0;
-  lp->curr_point=NULL;                        /* No default WavePoint */
-  lp->cell_search=0;
-  
-  lp->cell_timer.data=(long)lp;               /* Start cell expiry timer */
-  lp->cell_timer.function=wl_cell_expiry;
-  lp->cell_timer.expires=jiffies+CELL_TIMEOUT;
-  add_timer(&lp->cell_timer);
-  
-  wv_nwid_filter(NWID_PROMISC,lp) ;    /* Enter NWID promiscuous mode */
-  /* to build up a good WavePoint */
-                                           /* table... */
-  printk(KERN_DEBUG "WaveLAN: Roaming enabled on device %s\n",dev->name);
-}
- 
-static void wv_roam_cleanup(struct net_device *dev)
-{
-  wavepoint_history *ptr,*old_ptr;
-  net_local *lp= netdev_priv(dev);
-  
-  printk(KERN_DEBUG "WaveLAN: Roaming Disabled on device %s\n",dev->name);
-  
-  /* Fixme : maybe we should check that the timer exist before deleting it */
-  del_timer(&lp->cell_timer);          /* Remove cell expiry timer       */
-  ptr=lp->wavepoint_table.head;        /* Clear device's WavePoint table */
-  while(ptr!=NULL)
-    {
-      old_ptr=ptr;
-      ptr=ptr->next;    
-      wl_del_wavepoint(old_ptr,lp);     
-    }
-}
-
-/* Enable/Disable NWID promiscuous mode on a given device */
-static void wv_nwid_filter(unsigned char mode, net_local *lp)
-{
-  mm_t                  m;
-  unsigned long         flags;
-  
-#ifdef WAVELAN_ROAMING_DEBUG
-  printk(KERN_DEBUG "WaveLAN: NWID promisc %s, device %s\n",(mode==NWID_PROMISC) ? "on" : "off", lp->dev->name);
-#endif
-  
-  /* Disable interrupts & save flags */
-  spin_lock_irqsave(&lp->spinlock, flags);
-  
-  m.w.mmw_loopt_sel = (mode==NWID_PROMISC) ? MMW_LOOPT_SEL_DIS_NWID : 0x00;
-  mmc_write(lp->dev->base_addr, (char *)&m.w.mmw_loopt_sel - (char *)&m, (unsigned char *)&m.w.mmw_loopt_sel, 1);
-  
-  if(mode==NWID_PROMISC)
-    lp->cell_search=1;
-  else
-    lp->cell_search=0;
-
-  /* ReEnable interrupts & restore flags */
-  spin_unlock_irqrestore(&lp->spinlock, flags);
-}
-
-/* Find a record in the WavePoint table matching a given NWID */
-static wavepoint_history *wl_roam_check(unsigned short nwid, net_local *lp)
-{
-  wavepoint_history     *ptr=lp->wavepoint_table.head;
-  
-  while(ptr!=NULL){
-    if(ptr->nwid==nwid)
-      return ptr;       
-    ptr=ptr->next;
-  }
-  return NULL;
-}
-
-/* Create a new wavepoint table entry */
-static wavepoint_history *wl_new_wavepoint(unsigned short nwid, unsigned char seq, net_local* lp)
-{
-  wavepoint_history *new_wavepoint;
-
-#ifdef WAVELAN_ROAMING_DEBUG    
-  printk(KERN_DEBUG "WaveLAN: New Wavepoint, NWID:%.4X\n",nwid);
-#endif
-  
-  if(lp->wavepoint_table.num_wavepoints==MAX_WAVEPOINTS)
-    return NULL;
-  
-  new_wavepoint = kmalloc(sizeof(wavepoint_history),GFP_ATOMIC);
-  if(new_wavepoint==NULL)
-    return NULL;
-  
-  new_wavepoint->nwid=nwid;                       /* New WavePoints NWID */
-  new_wavepoint->average_fast=0;                    /* Running Averages..*/
-  new_wavepoint->average_slow=0;
-  new_wavepoint->qualptr=0;                       /* Start of ringbuffer */
-  new_wavepoint->last_seq=seq-1;                /* Last sequence no.seen */
-  memset(new_wavepoint->sigqual,0,WAVEPOINT_HISTORY);/* Empty ringbuffer */
-  
-  new_wavepoint->next=lp->wavepoint_table.head;/* Add to wavepoint table */
-  new_wavepoint->prev=NULL;
-  
-  if(lp->wavepoint_table.head!=NULL)
-    lp->wavepoint_table.head->prev=new_wavepoint;
-  
-  lp->wavepoint_table.head=new_wavepoint;
-  
-  lp->wavepoint_table.num_wavepoints++;     /* no. of visible wavepoints */
-  
-  return new_wavepoint;
-}
-
-/* Remove a wavepoint entry from WavePoint table */
-static void wl_del_wavepoint(wavepoint_history *wavepoint, struct net_local *lp)
-{
-  if(wavepoint==NULL)
-    return;
-  
-  if(lp->curr_point==wavepoint)
-    lp->curr_point=NULL;
-  
-  if(wavepoint->prev!=NULL)
-    wavepoint->prev->next=wavepoint->next;
-  
-  if(wavepoint->next!=NULL)
-    wavepoint->next->prev=wavepoint->prev;
-  
-  if(lp->wavepoint_table.head==wavepoint)
-    lp->wavepoint_table.head=wavepoint->next;
-  
-  lp->wavepoint_table.num_wavepoints--;
-  kfree(wavepoint);
-}
-
-/* Timer callback function - checks WavePoint table for stale entries */ 
-static void wl_cell_expiry(unsigned long data)
-{
-  net_local *lp=(net_local *)data;
-  wavepoint_history *wavepoint=lp->wavepoint_table.head,*old_point;
-  
-#if WAVELAN_ROAMING_DEBUG > 1
-  printk(KERN_DEBUG "WaveLAN: Wavepoint timeout, dev %s\n",lp->dev->name);
-#endif
-  
-  if(lp->wavepoint_table.locked)
-    {
-#if WAVELAN_ROAMING_DEBUG > 1
-      printk(KERN_DEBUG "WaveLAN: Wavepoint table locked...\n");
-#endif
-      
-      lp->cell_timer.expires=jiffies+1; /* If table in use, come back later */
-      add_timer(&lp->cell_timer);
-      return;
-    }
-  
-  while(wavepoint!=NULL)
-    {
-      if(time_after(jiffies, wavepoint->last_seen + CELL_TIMEOUT))
-        {
-#ifdef WAVELAN_ROAMING_DEBUG
-          printk(KERN_DEBUG "WaveLAN: Bye bye %.4X\n",wavepoint->nwid);
-#endif
-          
-          old_point=wavepoint;
-          wavepoint=wavepoint->next;
-          wl_del_wavepoint(old_point,lp);
-        }
-      else
-        wavepoint=wavepoint->next;
-    }
-  lp->cell_timer.expires=jiffies+CELL_TIMEOUT;
-  add_timer(&lp->cell_timer);
-}
-
-/* Update SNR history of a wavepoint */
-static void wl_update_history(wavepoint_history *wavepoint, unsigned char sigqual, unsigned char seq)   
-{
-  int i=0,num_missed=0,ptr=0;
-  int average_fast=0,average_slow=0;
-  
-  num_missed=(seq-wavepoint->last_seq)%WAVEPOINT_HISTORY;/* Have we missed
-                                                            any beacons? */
-  if(num_missed)
-    for(i=0;i<num_missed;i++)
-      {
-        wavepoint->sigqual[wavepoint->qualptr++]=0; /* If so, enter them as 0's */
-        wavepoint->qualptr %=WAVEPOINT_HISTORY;    /* in the ringbuffer. */
-      }
-  wavepoint->last_seen=jiffies;                 /* Add beacon to history */
-  wavepoint->last_seq=seq;      
-  wavepoint->sigqual[wavepoint->qualptr++]=sigqual;          
-  wavepoint->qualptr %=WAVEPOINT_HISTORY;
-  ptr=(wavepoint->qualptr-WAVEPOINT_FAST_HISTORY+WAVEPOINT_HISTORY)%WAVEPOINT_HISTORY;
-  
-  for(i=0;i<WAVEPOINT_FAST_HISTORY;i++)       /* Update running averages */
-    {
-      average_fast+=wavepoint->sigqual[ptr++];
-      ptr %=WAVEPOINT_HISTORY;
-    }
-  
-  average_slow=average_fast;
-  for(i=WAVEPOINT_FAST_HISTORY;i<WAVEPOINT_HISTORY;i++)
-    {
-      average_slow+=wavepoint->sigqual[ptr++];
-      ptr %=WAVEPOINT_HISTORY;
-    }
-  
-  wavepoint->average_fast=average_fast/WAVEPOINT_FAST_HISTORY;
-  wavepoint->average_slow=average_slow/WAVEPOINT_HISTORY;       
-}
-
-/* Perform a handover to a new WavePoint */
-static void wv_roam_handover(wavepoint_history *wavepoint, net_local *lp)
-{
-  unsigned int          base = lp->dev->base_addr;
-  mm_t                  m;
-  unsigned long         flags;
-
-  if(wavepoint==lp->curr_point)          /* Sanity check... */
-    {
-      wv_nwid_filter(!NWID_PROMISC,lp);
-      return;
-    }
-  
-#ifdef WAVELAN_ROAMING_DEBUG
-  printk(KERN_DEBUG "WaveLAN: Doing handover to %.4X, dev %s\n",wavepoint->nwid,lp->dev->name);
-#endif
-        
-  /* Disable interrupts & save flags */
-  spin_lock_irqsave(&lp->spinlock, flags);
-
-  m.w.mmw_netw_id_l = wavepoint->nwid & 0xFF;
-  m.w.mmw_netw_id_h = (wavepoint->nwid & 0xFF00) >> 8;
-  
-  mmc_write(base, (char *)&m.w.mmw_netw_id_l - (char *)&m, (unsigned char *)&m.w.mmw_netw_id_l, 2);
-  
-  /* ReEnable interrupts & restore flags */
-  spin_unlock_irqrestore(&lp->spinlock, flags);
-
-  wv_nwid_filter(!NWID_PROMISC,lp);
-  lp->curr_point=wavepoint;
-}
-
-/* Called when a WavePoint beacon is received */
-static void wl_roam_gather(struct net_device *  dev,
-                           u_char *  hdr,   /* Beacon header */
-                           u_char *  stats) /* SNR, Signal quality
-                                                      of packet */
-{
-  wavepoint_beacon *beacon= (wavepoint_beacon *)hdr; /* Rcvd. Beacon */
-  unsigned short nwid=ntohs(beacon->nwid);  
-  unsigned short sigqual=stats[2] & MMR_SGNL_QUAL;   /* SNR of beacon */
-  wavepoint_history *wavepoint=NULL;                /* WavePoint table entry */
-  net_local *lp = netdev_priv(dev);              /* Device info */
-
-#ifdef I_NEED_THIS_FEATURE
-  /* Some people don't need this, some other may need it */
-  nwid=nwid^ntohs(beacon->domain_id);
-#endif
-
-#if WAVELAN_ROAMING_DEBUG > 1
-  printk(KERN_DEBUG "WaveLAN: beacon, dev %s:\n",dev->name);
-  printk(KERN_DEBUG "Domain: %.4X NWID: %.4X SigQual=%d\n",ntohs(beacon->domain_id),nwid,sigqual);
-#endif
-  
-  lp->wavepoint_table.locked=1;                            /* <Mutex> */
-  
-  wavepoint=wl_roam_check(nwid,lp);            /* Find WavePoint table entry */
-  if(wavepoint==NULL)                    /* If no entry, Create a new one... */
-    {
-      wavepoint=wl_new_wavepoint(nwid,beacon->seq,lp);
-      if(wavepoint==NULL)
-        goto out;
-    }
-  if(lp->curr_point==NULL)             /* If this is the only WavePoint, */
-    wv_roam_handover(wavepoint, lp);             /* Jump on it! */
-  
-  wl_update_history(wavepoint, sigqual, beacon->seq); /* Update SNR history
-                                                         stats. */
-  
-  if(lp->curr_point->average_slow < SEARCH_THRESH_LOW) /* If our current */
-    if(!lp->cell_search)                  /* WavePoint is getting faint, */
-      wv_nwid_filter(NWID_PROMISC,lp);    /* start looking for a new one */
-  
-  if(wavepoint->average_slow > 
-     lp->curr_point->average_slow + WAVELAN_ROAMING_DELTA)
-    wv_roam_handover(wavepoint, lp);   /* Handover to a better WavePoint */
-  
-  if(lp->curr_point->average_slow > SEARCH_THRESH_HIGH) /* If our SNR is */
-    if(lp->cell_search)  /* getting better, drop out of cell search mode */
-      wv_nwid_filter(!NWID_PROMISC,lp);
-  
-out:
-  lp->wavepoint_table.locked=0;                        /* </MUTEX>   :-) */
-}
-
-/* Test this MAC frame a WavePoint beacon */
-static inline int WAVELAN_BEACON(unsigned char *data)
-{
-  wavepoint_beacon *beacon= (wavepoint_beacon *)data;
-  static const wavepoint_beacon beacon_template={0xaa,0xaa,0x03,0x08,0x00,0x0e,0x20,0x03,0x00};
-  
-  if(memcmp(beacon,&beacon_template,9)==0)
-    return 1;
-  else
-    return 0;
-}
-#endif  /* WAVELAN_ROAMING */
-
-/************************ I82593 SUBROUTINES *************************/
-/*
- * Useful subroutines to manage the Ethernet controller
- */
-
-/*------------------------------------------------------------------*/
-/*
- * Routine to synchronously send a command to the i82593 chip. 
- * Should be called with interrupts disabled.
- * (called by wv_packet_write(), wv_ru_stop(), wv_ru_start(),
- *  wv_82593_config() & wv_diag())
- */
-static int
-wv_82593_cmd(struct net_device *        dev,
-             char *     str,
-             int        cmd,
-             int        result)
-{
-  unsigned int  base = dev->base_addr;
-  int           status;
-  int           wait_completed;
-  long          spin;
-
-  /* Spin until the chip finishes executing its current command (if any) */
-  spin = 1000;
-  do
-    {
-      /* Time calibration of the loop */
-      udelay(10);
-
-      /* Read the interrupt register */
-      outb(OP0_NOP | CR0_STATUS_3, LCCR(base));
-      status = inb(LCSR(base));
-    }
-  while(((status & SR3_EXEC_STATE_MASK) != SR3_EXEC_IDLE) && (spin-- > 0));
-
-  /* If the interrupt hasn't been posted */
-  if (spin < 0) {
-#ifdef DEBUG_INTERRUPT_ERROR
-      printk(KERN_INFO "wv_82593_cmd: %s timeout (previous command), status 0x%02x\n",
-             str, status);
-#endif
-      return(FALSE);
-    }
-
-  /* Issue the command to the controller */
-  outb(cmd, LCCR(base));
-
-  /* If we don't have to check the result of the command
-   * Note : this mean that the irq handler will deal with that */
-  if(result == SR0_NO_RESULT)
-    return(TRUE);
-
-  /* We are waiting for command completion */
-  wait_completed = TRUE;
-
-  /* Busy wait while the LAN controller executes the command. */
-  spin = 1000;
-  do
-    {
-      /* Time calibration of the loop */
-      udelay(10);
-
-      /* Read the interrupt register */
-      outb(CR0_STATUS_0 | OP0_NOP, LCCR(base));
-      status = inb(LCSR(base));
-
-      /* Check if there was an interrupt posted */
-      if((status & SR0_INTERRUPT))
-        {
-          /* Acknowledge the interrupt */
-          outb(CR0_INT_ACK | OP0_NOP, LCCR(base));
-
-          /* Check if interrupt is a command completion */
-          if(((status & SR0_BOTH_RX_TX) != SR0_BOTH_RX_TX) &&
-             ((status & SR0_BOTH_RX_TX) != 0x0) &&
-             !(status & SR0_RECEPTION))
-            {
-              /* Signal command completion */
-              wait_completed = FALSE;
-            }
-          else
-            {
-              /* Note : Rx interrupts will be handled later, because we can
-               * handle multiple Rx packets at once */
-#ifdef DEBUG_INTERRUPT_INFO
-              printk(KERN_INFO "wv_82593_cmd: not our interrupt\n");
-#endif
-            }
-        }
-    }
-  while(wait_completed && (spin-- > 0));
-
-  /* If the interrupt hasn't be posted */
-  if(wait_completed)
-    {
-#ifdef DEBUG_INTERRUPT_ERROR
-      printk(KERN_INFO "wv_82593_cmd: %s timeout, status 0x%02x\n",
-             str, status);
-#endif
-      return(FALSE);
-    }
-
-  /* Check the return code returned by the card (see above) against
-   * the expected return code provided by the caller */
-  if((status & SR0_EVENT_MASK) != result)
-    {
-#ifdef DEBUG_INTERRUPT_ERROR
-      printk(KERN_INFO "wv_82593_cmd: %s failed, status = 0x%x\n",
-             str, status);
-#endif
-      return(FALSE);
-    }
-
-  return(TRUE);
-} /* wv_82593_cmd */
-
-/*------------------------------------------------------------------*/
-/*
- * This routine does a 593 op-code number 7, and obtains the diagnose
- * status for the WaveLAN.
- */
-static inline int
-wv_diag(struct net_device *     dev)
-{
-  return(wv_82593_cmd(dev, "wv_diag(): diagnose",
-                      OP0_DIAGNOSE, SR0_DIAGNOSE_PASSED));
-} /* wv_diag */
-
-/*------------------------------------------------------------------*/
-/*
- * Routine to read len bytes from the i82593's ring buffer, starting at
- * chip address addr. The results read from the chip are stored in buf.
- * The return value is the address to use for next the call.
- */
-static int
-read_ringbuf(struct net_device *        dev,
-             int        addr,
-             char *     buf,
-             int        len)
-{
-  unsigned int  base = dev->base_addr;
-  int           ring_ptr = addr;
-  int           chunk_len;
-  char *        buf_ptr = buf;
-
-  /* Get all the buffer */
-  while(len > 0)
-    {
-      /* Position the Program I/O Register at the ring buffer pointer */
-      outb(ring_ptr & 0xff, PIORL(base));
-      outb(((ring_ptr >> 8) & PIORH_MASK), PIORH(base));
-
-      /* First, determine how much we can read without wrapping around the
-         ring buffer */
-      if((addr + len) < (RX_BASE + RX_SIZE))
-        chunk_len = len;
-      else
-        chunk_len = RX_BASE + RX_SIZE - addr;
-      insb(PIOP(base), buf_ptr, chunk_len);
-      buf_ptr += chunk_len;
-      len -= chunk_len;
-      ring_ptr = (ring_ptr - RX_BASE + chunk_len) % RX_SIZE + RX_BASE;
-    }
-  return(ring_ptr);
-} /* read_ringbuf */
-
-/*------------------------------------------------------------------*/
-/*
- * Reconfigure the i82593, or at least ask for it...
- * Because wv_82593_config use the transmission buffer, we must do it
- * when we are sure that there is no transmission, so we do it now
- * or in wavelan_packet_xmit() (I can't find any better place,
- * wavelan_interrupt is not an option...), so you may experience
- * some delay sometime...
- */
-static void
-wv_82593_reconfig(struct net_device *   dev)
-{
-  net_local *           lp = netdev_priv(dev);
-  struct pcmcia_device *                link = lp->link;
-  unsigned long         flags;
-
-  /* Arm the flag, will be cleard in wv_82593_config() */
-  lp->reconfig_82593 = TRUE;
-
-  /* Check if we can do it now ! */
-  if((link->open) && (netif_running(dev)) && !(netif_queue_stopped(dev)))
-    {
-      spin_lock_irqsave(&lp->spinlock, flags);  /* Disable interrupts */
-      wv_82593_config(dev);
-      spin_unlock_irqrestore(&lp->spinlock, flags);     /* Re-enable interrupts */
-    }
-  else
-    {
-#ifdef DEBUG_IOCTL_INFO
-      printk(KERN_DEBUG
-             "%s: wv_82593_reconfig(): delayed (state = %lX, link = %d)\n",
-             dev->name, dev->state, link->open);
-#endif
-    }
-}
-
-/********************* DEBUG & INFO SUBROUTINES *********************/
-/*
- * This routines are used in the code to show debug informations.
- * Most of the time, it dump the content of hardware structures...
- */
-
-#ifdef DEBUG_PSA_SHOW
-/*------------------------------------------------------------------*/
-/*
- * Print the formatted contents of the Parameter Storage Area.
- */
-static void
-wv_psa_show(psa_t *     p)
-{
-  printk(KERN_DEBUG "##### wavelan psa contents: #####\n");
-  printk(KERN_DEBUG "psa_io_base_addr_1: 0x%02X %02X %02X %02X\n",
-         p->psa_io_base_addr_1,
-         p->psa_io_base_addr_2,
-         p->psa_io_base_addr_3,
-         p->psa_io_base_addr_4);
-  printk(KERN_DEBUG "psa_rem_boot_addr_1: 0x%02X %02X %02X\n",
-         p->psa_rem_boot_addr_1,
-         p->psa_rem_boot_addr_2,
-         p->psa_rem_boot_addr_3);
-  printk(KERN_DEBUG "psa_holi_params: 0x%02x, ", p->psa_holi_params);
-  printk("psa_int_req_no: %d\n", p->psa_int_req_no);
-#ifdef DEBUG_SHOW_UNUSED
-  printk(KERN_DEBUG "psa_unused0[]: %pM\n", p->psa_unused0);
-#endif  /* DEBUG_SHOW_UNUSED */
-  printk(KERN_DEBUG "psa_univ_mac_addr[]: %pM\n", p->psa_univ_mac_addr);
-  printk(KERN_DEBUG "psa_local_mac_addr[]: %pM\n", p->psa_local_mac_addr);
-  printk(KERN_DEBUG "psa_univ_local_sel: %d, ", p->psa_univ_local_sel);
-  printk("psa_comp_number: %d, ", p->psa_comp_number);
-  printk("psa_thr_pre_set: 0x%02x\n", p->psa_thr_pre_set);
-  printk(KERN_DEBUG "psa_feature_select/decay_prm: 0x%02x, ",
-         p->psa_feature_select);
-  printk("psa_subband/decay_update_prm: %d\n", p->psa_subband);
-  printk(KERN_DEBUG "psa_quality_thr: 0x%02x, ", p->psa_quality_thr);
-  printk("psa_mod_delay: 0x%02x\n", p->psa_mod_delay);
-  printk(KERN_DEBUG "psa_nwid: 0x%02x%02x, ", p->psa_nwid[0], p->psa_nwid[1]);
-  printk("psa_nwid_select: %d\n", p->psa_nwid_select);
-  printk(KERN_DEBUG "psa_encryption_select: %d, ", p->psa_encryption_select);
-  printk("psa_encryption_key[]: %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-         p->psa_encryption_key[0],
-         p->psa_encryption_key[1],
-         p->psa_encryption_key[2],
-         p->psa_encryption_key[3],
-         p->psa_encryption_key[4],
-         p->psa_encryption_key[5],
-         p->psa_encryption_key[6],
-         p->psa_encryption_key[7]);
-  printk(KERN_DEBUG "psa_databus_width: %d\n", p->psa_databus_width);
-  printk(KERN_DEBUG "psa_call_code/auto_squelch: 0x%02x, ",
-         p->psa_call_code[0]);
-  printk("psa_call_code[]: %02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X\n",
-         p->psa_call_code[0],
-         p->psa_call_code[1],
-         p->psa_call_code[2],
-         p->psa_call_code[3],
-         p->psa_call_code[4],
-         p->psa_call_code[5],
-         p->psa_call_code[6],
-         p->psa_call_code[7]);
-#ifdef DEBUG_SHOW_UNUSED
-  printk(KERN_DEBUG "psa_reserved[]: %02X:%02X\n",
-         p->psa_reserved[0],
-         p->psa_reserved[1]);
-#endif  /* DEBUG_SHOW_UNUSED */
-  printk(KERN_DEBUG "psa_conf_status: %d, ", p->psa_conf_status);
-  printk("psa_crc: 0x%02x%02x, ", p->psa_crc[0], p->psa_crc[1]);
-  printk("psa_crc_status: 0x%02x\n", p->psa_crc_status);
-} /* wv_psa_show */
-#endif  /* DEBUG_PSA_SHOW */
-
-#ifdef DEBUG_MMC_SHOW
-/*------------------------------------------------------------------*/
-/*
- * Print the formatted status of the Modem Management Controller.
- * This function need to be completed...
- */
-static void
-wv_mmc_show(struct net_device * dev)
-{
-  unsigned int  base = dev->base_addr;
-  net_local *   lp = netdev_priv(dev);
-  mmr_t         m;
-
-  /* Basic check */
-  if(hasr_read(base) & HASR_NO_CLK)
-    {
-      printk(KERN_WARNING "%s: wv_mmc_show: modem not connected\n",
-             dev->name);
-      return;
-    }
-
-  spin_lock_irqsave(&lp->spinlock, flags);
-
-  /* Read the mmc */
-  mmc_out(base, mmwoff(0, mmw_freeze), 1);
-  mmc_read(base, 0, (u_char *)&m, sizeof(m));
-  mmc_out(base, mmwoff(0, mmw_freeze), 0);
-
-  /* Don't forget to update statistics */
-  lp->wstats.discard.nwid += (m.mmr_wrong_nwid_h << 8) | m.mmr_wrong_nwid_l;
-
-  spin_unlock_irqrestore(&lp->spinlock, flags);
-
-  printk(KERN_DEBUG "##### wavelan modem status registers: #####\n");
-#ifdef DEBUG_SHOW_UNUSED
-  printk(KERN_DEBUG "mmc_unused0[]: %02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X\n",
-         m.mmr_unused0[0],
-         m.mmr_unused0[1],
-         m.mmr_unused0[2],
-         m.mmr_unused0[3],
-         m.mmr_unused0[4],
-         m.mmr_unused0[5],
-         m.mmr_unused0[6],
-         m.mmr_unused0[7]);
-#endif  /* DEBUG_SHOW_UNUSED */
-  printk(KERN_DEBUG "Encryption algorithm: %02X - Status: %02X\n",
-         m.mmr_des_avail, m.mmr_des_status);
-#ifdef DEBUG_SHOW_UNUSED
-  printk(KERN_DEBUG "mmc_unused1[]: %02X:%02X:%02X:%02X:%02X\n",
-         m.mmr_unused1[0],
-         m.mmr_unused1[1],
-         m.mmr_unused1[2],
-         m.mmr_unused1[3],
-         m.mmr_unused1[4]);
-#endif  /* DEBUG_SHOW_UNUSED */
-  printk(KERN_DEBUG "dce_status: 0x%x [%s%s%s%s]\n",
-         m.mmr_dce_status,
-         (m.mmr_dce_status & MMR_DCE_STATUS_RX_BUSY) ? "energy detected,":"",
-         (m.mmr_dce_status & MMR_DCE_STATUS_LOOPT_IND) ?
-         "loop test indicated," : "",
-         (m.mmr_dce_status & MMR_DCE_STATUS_TX_BUSY) ? "transmitter on," : "",
-         (m.mmr_dce_status & MMR_DCE_STATUS_JBR_EXPIRED) ?
-         "jabber timer expired," : "");
-  printk(KERN_DEBUG "Dsp ID: %02X\n",
-         m.mmr_dsp_id);
-#ifdef DEBUG_SHOW_UNUSED
-  printk(KERN_DEBUG "mmc_unused2[]: %02X:%02X\n",
-         m.mmr_unused2[0],
-         m.mmr_unused2[1]);
-#endif  /* DEBUG_SHOW_UNUSED */
-  printk(KERN_DEBUG "# correct_nwid: %d, # wrong_nwid: %d\n",
-         (m.mmr_correct_nwid_h << 8) | m.mmr_correct_nwid_l,
-         (m.mmr_wrong_nwid_h << 8) | m.mmr_wrong_nwid_l);
-  printk(KERN_DEBUG "thr_pre_set: 0x%x [current signal %s]\n",
-         m.mmr_thr_pre_set & MMR_THR_PRE_SET,
-         (m.mmr_thr_pre_set & MMR_THR_PRE_SET_CUR) ? "above" : "below");
-  printk(KERN_DEBUG "signal_lvl: %d [%s], ",
-         m.mmr_signal_lvl & MMR_SIGNAL_LVL,
-         (m.mmr_signal_lvl & MMR_SIGNAL_LVL_VALID) ? "new msg" : "no new msg");
-  printk("silence_lvl: %d [%s], ", m.mmr_silence_lvl & MMR_SILENCE_LVL,
-         (m.mmr_silence_lvl & MMR_SILENCE_LVL_VALID) ? "update done" : "no new update");
-  printk("sgnl_qual: 0x%x [%s]\n", m.mmr_sgnl_qual & MMR_SGNL_QUAL,
-         (m.mmr_sgnl_qual & MMR_SGNL_QUAL_ANT) ? "Antenna 1" : "Antenna 0");
-#ifdef DEBUG_SHOW_UNUSED
-  printk(KERN_DEBUG "netw_id_l: %x\n", m.mmr_netw_id_l);
-#endif  /* DEBUG_SHOW_UNUSED */
-} /* wv_mmc_show */
-#endif  /* DEBUG_MMC_SHOW */
-
-#ifdef DEBUG_I82593_SHOW
-/*------------------------------------------------------------------*/
-/*
- * Print the formatted status of the i82593's receive unit.
- */
-static void
-wv_ru_show(struct net_device *  dev)
-{
-  net_local *lp = netdev_priv(dev);
-
-  printk(KERN_DEBUG "##### wavelan i82593 receiver status: #####\n");
-  printk(KERN_DEBUG "ru: rfp %d stop %d", lp->rfp, lp->stop);
-  /*
-   * Not implemented yet...
-   */
-  printk("\n");
-} /* wv_ru_show */
-#endif  /* DEBUG_I82593_SHOW */
-
-#ifdef DEBUG_DEVICE_SHOW
-/*------------------------------------------------------------------*/
-/*
- * Print the formatted status of the WaveLAN PCMCIA device driver.
- */
-static void
-wv_dev_show(struct net_device * dev)
-{
-  printk(KERN_DEBUG "dev:");
-  printk(" state=%lX,", dev->state);
-  printk(" trans_start=%ld,", dev->trans_start);
-  printk(" flags=0x%x,", dev->flags);
-  printk("\n");
-} /* wv_dev_show */
-
-/*------------------------------------------------------------------*/
-/*
- * Print the formatted status of the WaveLAN PCMCIA device driver's
- * private information.
- */
-static void
-wv_local_show(struct net_device *       dev)
-{
-  net_local *lp = netdev_priv(dev);
-
-  printk(KERN_DEBUG "local:");
-  /*
-   * Not implemented yet...
-   */
-  printk("\n");
-} /* wv_local_show */
-#endif  /* DEBUG_DEVICE_SHOW */
-
-#if defined(DEBUG_RX_INFO) || defined(DEBUG_TX_INFO)
-/*------------------------------------------------------------------*/
-/*
- * Dump packet header (and content if necessary) on the screen
- */
-static void
-wv_packet_info(u_char *         p,              /* Packet to dump */
-               int              length,         /* Length of the packet */
-               char *           msg1,           /* Name of the device */
-               char *           msg2)           /* Name of the function */
-{
-  int           i;
-  int           maxi;
-
-  printk(KERN_DEBUG "%s: %s(): dest %pM, length %d\n",
-         msg1, msg2, p, length);
-  printk(KERN_DEBUG "%s: %s(): src %pM, type 0x%02X%02X\n",
-         msg1, msg2, &p[6], p[12], p[13]);
-
-#ifdef DEBUG_PACKET_DUMP
-
-  printk(KERN_DEBUG "data=\"");
-
-  if((maxi = length) > DEBUG_PACKET_DUMP)
-    maxi = DEBUG_PACKET_DUMP;
-  for(i = 14; i < maxi; i++)
-    if(p[i] >= ' ' && p[i] <= '~')
-      printk(" %c", p[i]);
-    else
-      printk("%02X", p[i]);
-  if(maxi < length)
-    printk("..");
-  printk("\"\n");
-  printk(KERN_DEBUG "\n");
-#endif  /* DEBUG_PACKET_DUMP */
-}
-#endif  /* defined(DEBUG_RX_INFO) || defined(DEBUG_TX_INFO) */
-
-/*------------------------------------------------------------------*/
-/*
- * This is the information which is displayed by the driver at startup
- * There  is a lot of flag to configure it at your will...
- */
-static void
-wv_init_info(struct net_device *        dev)
-{
-  unsigned int  base = dev->base_addr;
-  psa_t         psa;
-
-  /* Read the parameter storage area */
-  psa_read(dev, 0, (unsigned char *) &psa, sizeof(psa));
-
-#ifdef DEBUG_PSA_SHOW
-  wv_psa_show(&psa);
-#endif
-#ifdef DEBUG_MMC_SHOW
-  wv_mmc_show(dev);
-#endif
-#ifdef DEBUG_I82593_SHOW
-  wv_ru_show(dev);
-#endif
-
-#ifdef DEBUG_BASIC_SHOW
-  /* Now, let's go for the basic stuff */
-  printk(KERN_NOTICE "%s: WaveLAN: port %#x, irq %d, hw_addr %pM",
-         dev->name, base, dev->irq, dev->dev_addr);
-
-  /* Print current network id */
-  if(psa.psa_nwid_select)
-    printk(", nwid 0x%02X-%02X", psa.psa_nwid[0], psa.psa_nwid[1]);
-  else
-    printk(", nwid off");
-
-  /* If 2.00 card */
-  if(!(mmc_in(base, mmroff(0, mmr_fee_status)) &
-       (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY)))
-    {
-      unsigned short    freq;
-
-      /* Ask the EEprom to read the frequency from the first area */
-      fee_read(base, 0x00 /* 1st area - frequency... */,
-               &freq, 1);
-
-      /* Print frequency */
-      printk(", 2.00, %ld", (freq >> 6) + 2400L);
-
-      /* Hack !!! */
-      if(freq & 0x20)
-        printk(".5");
-    }
-  else
-    {
-      printk(", PCMCIA, ");
-      switch (psa.psa_subband)
-        {
-        case PSA_SUBBAND_915:
-          printk("915");
-          break;
-        case PSA_SUBBAND_2425:
-          printk("2425");
-          break;
-        case PSA_SUBBAND_2460:
-          printk("2460");
-          break;
-        case PSA_SUBBAND_2484:
-          printk("2484");
-          break;
-        case PSA_SUBBAND_2430_5:
-          printk("2430.5");
-          break;
-        default:
-          printk("unknown");
-        }
-    }
-
-  printk(" MHz\n");
-#endif  /* DEBUG_BASIC_SHOW */
-
-#ifdef DEBUG_VERSION_SHOW
-  /* Print version information */
-  printk(KERN_NOTICE "%s", version);
-#endif
-} /* wv_init_info */
-
-/********************* IOCTL, STATS & RECONFIG *********************/
-/*
- * We found here routines that are called by Linux on differents
- * occasions after the configuration and not for transmitting data
- * These may be called when the user use ifconfig, /proc/net/dev
- * or wireless extensions
- */
-
-
-/*------------------------------------------------------------------*/
-/*
- * Set or clear the multicast filter for this adaptor.
- * num_addrs == -1      Promiscuous mode, receive all packets
- * num_addrs == 0       Normal mode, clear multicast list
- * num_addrs > 0        Multicast mode, receive normal and MC packets,
- *                      and do best-effort filtering.
- */
-
-static void
-wavelan_set_multicast_list(struct net_device *  dev)
-{
-  net_local *   lp = netdev_priv(dev);
-
-#ifdef DEBUG_IOCTL_TRACE
-  printk(KERN_DEBUG "%s: ->wavelan_set_multicast_list()\n", dev->name);
-#endif
-
-#ifdef DEBUG_IOCTL_INFO
-  printk(KERN_DEBUG "%s: wavelan_set_multicast_list(): setting Rx mode %02X to %d addresses.\n",
-         dev->name, dev->flags, dev->mc_count);
-#endif
-
-  if(dev->flags & IFF_PROMISC)
-    {
-      /*
-       * Enable promiscuous mode: receive all packets.
-       */
-      if(!lp->promiscuous)
-        {
-          lp->promiscuous = 1;
-          lp->allmulticast = 0;
-          lp->mc_count = 0;
-
-          wv_82593_reconfig(dev);
-        }
-    }
-  else
-    /* If all multicast addresses
-     * or too much multicast addresses for the hardware filter */
-    if((dev->flags & IFF_ALLMULTI) ||
-       (dev->mc_count > I82593_MAX_MULTICAST_ADDRESSES))
-      {
-        /*
-         * Disable promiscuous mode, but active the all multicast mode
-         */
-        if(!lp->allmulticast)
-          {
-            lp->promiscuous = 0;
-            lp->allmulticast = 1;
-            lp->mc_count = 0;
-
-            wv_82593_reconfig(dev);
-          }
-      }
-    else
-      /* If there is some multicast addresses to send */
-      if(dev->mc_list != (struct dev_mc_list *) NULL)
-        {
-          /*
-           * Disable promiscuous mode, but receive all packets
-           * in multicast list
-           */
-#ifdef MULTICAST_AVOID
-          if(lp->promiscuous || lp->allmulticast ||
-             (dev->mc_count != lp->mc_count))
-#endif
-            {
-              lp->promiscuous = 0;
-              lp->allmulticast = 0;
-              lp->mc_count = dev->mc_count;
-
-              wv_82593_reconfig(dev);
-            }
-        }
-      else
-        {
-          /*
-           * Switch to normal mode: disable promiscuous mode and 
-           * clear the multicast list.
-           */
-          if(lp->promiscuous || lp->mc_count == 0)
-            {
-              lp->promiscuous = 0;
-              lp->allmulticast = 0;
-              lp->mc_count = 0;
-
-              wv_82593_reconfig(dev);
-            }
-        }
-#ifdef DEBUG_IOCTL_TRACE
-  printk(KERN_DEBUG "%s: <-wavelan_set_multicast_list()\n", dev->name);
-#endif
-}
-
-/*------------------------------------------------------------------*/
-/*
- * This function doesn't exist...
- * (Note : it was a nice way to test the reconfigure stuff...)
- */
-#ifdef SET_MAC_ADDRESS
-static int
-wavelan_set_mac_address(struct net_device *     dev,
-                        void *          addr)
-{
-  struct sockaddr *     mac = addr;
-
-  /* Copy the address */
-  memcpy(dev->dev_addr, mac->sa_data, WAVELAN_ADDR_SIZE);
-
-  /* Reconfig the beast */
-  wv_82593_reconfig(dev);
-
-  return 0;
-}
-#endif  /* SET_MAC_ADDRESS */
-
-
-/*------------------------------------------------------------------*/
-/*
- * Frequency setting (for hardware able of it)
- * It's a bit complicated and you don't really want to look into it...
- */
-static int
-wv_set_frequency(u_long         base,   /* i/o port of the card */
-                 iw_freq *      frequency)
-{
-  const int     BAND_NUM = 10;  /* Number of bands */
-  long          freq = 0L;      /* offset to 2.4 GHz in .5 MHz */
-#ifdef DEBUG_IOCTL_INFO
-  int           i;
-#endif
-
-  /* Setting by frequency */
-  /* Theoritically, you may set any frequency between
-   * the two limits with a 0.5 MHz precision. In practice,
-   * I don't want you to have trouble with local
-   * regulations... */
-  if((frequency->e == 1) &&
-     (frequency->m >= (int) 2.412e8) && (frequency->m <= (int) 2.487e8))
-    {
-      freq = ((frequency->m / 10000) - 24000L) / 5;
-    }
-
-  /* Setting by channel (same as wfreqsel) */
-  /* Warning : each channel is 22MHz wide, so some of the channels
-   * will interfere... */
-  if((frequency->e == 0) &&
-     (frequency->m >= 0) && (frequency->m < BAND_NUM))
-    {
-      /* Get frequency offset. */
-      freq = channel_bands[frequency->m] >> 1;
-    }
-
-  /* Verify if the frequency is allowed */
-  if(freq != 0L)
-    {
-      u_short   table[10];      /* Authorized frequency table */
-
-      /* Read the frequency table */
-      fee_read(base, 0x71 /* frequency table */,
-               table, 10);
-
-#ifdef DEBUG_IOCTL_INFO
-      printk(KERN_DEBUG "Frequency table :");
-      for(i = 0; i < 10; i++)
-        {
-          printk(" %04X",
-                 table[i]);
-        }
-      printk("\n");
-#endif
-
-      /* Look in the table if the frequency is allowed */
-      if(!(table[9 - ((freq - 24) / 16)] &
-           (1 << ((freq - 24) % 16))))
-        return -EINVAL;         /* not allowed */
-    }
-  else
-    return -EINVAL;
-
-  /* If we get a usable frequency */
-  if(freq != 0L)
-    {
-      unsigned short    area[16];
-      unsigned short    dac[2];
-      unsigned short    area_verify[16];
-      unsigned short    dac_verify[2];
-      /* Corresponding gain (in the power adjust value table)
-       * see AT&T Wavelan Data Manual, REF 407-024689/E, page 3-8
-       * & WCIN062D.DOC, page 6.2.9 */
-      unsigned short    power_limit[] = { 40, 80, 120, 160, 0 };
-      int               power_band = 0;         /* Selected band */
-      unsigned short    power_adjust;           /* Correct value */
-
-      /* Search for the gain */
-      power_band = 0;
-      while((freq > power_limit[power_band]) &&
-            (power_limit[++power_band] != 0))
-        ;
-
-      /* Read the first area */
-      fee_read(base, 0x00,
-               area, 16);
-
-      /* Read the DAC */
-      fee_read(base, 0x60,
-               dac, 2);
-
-      /* Read the new power adjust value */
-      fee_read(base, 0x6B - (power_band >> 1),
-               &power_adjust, 1);
-      if(power_band & 0x1)
-        power_adjust >>= 8;
-      else
-        power_adjust &= 0xFF;
-
-#ifdef DEBUG_IOCTL_INFO
-      printk(KERN_DEBUG "Wavelan EEprom Area 1 :");
-      for(i = 0; i < 16; i++)
-        {
-          printk(" %04X",
-                 area[i]);
-        }
-      printk("\n");
-
-      printk(KERN_DEBUG "Wavelan EEprom DAC : %04X %04X\n",
-             dac[0], dac[1]);
-#endif
-
-      /* Frequency offset (for info only...) */
-      area[0] = ((freq << 5) & 0xFFE0) | (area[0] & 0x1F);
-
-      /* Receiver Principle main divider coefficient */
-      area[3] = (freq >> 1) + 2400L - 352L;
-      area[2] = ((freq & 0x1) << 4) | (area[2] & 0xFFEF);
-
-      /* Transmitter Main divider coefficient */
-      area[13] = (freq >> 1) + 2400L;
-      area[12] = ((freq & 0x1) << 4) | (area[2] & 0xFFEF);
-
-      /* Others part of the area are flags, bit streams or unused... */
-
-      /* Set the value in the DAC */
-      dac[1] = ((power_adjust >> 1) & 0x7F) | (dac[1] & 0xFF80);
-      dac[0] = ((power_adjust & 0x1) << 4) | (dac[0] & 0xFFEF);
-
-      /* Write the first area */
-      fee_write(base, 0x00,
-                area, 16);
-
-      /* Write the DAC */
-      fee_write(base, 0x60,
-                dac, 2);
-
-      /* We now should verify here that the EEprom writing was ok */
-
-      /* ReRead the first area */
-      fee_read(base, 0x00,
-               area_verify, 16);
-
-      /* ReRead the DAC */
-      fee_read(base, 0x60,
-               dac_verify, 2);
-
-      /* Compare */
-      if(memcmp(area, area_verify, 16 * 2) ||
-         memcmp(dac, dac_verify, 2 * 2))
-        {
-#ifdef DEBUG_IOCTL_ERROR
-          printk(KERN_INFO "Wavelan: wv_set_frequency : unable to write new frequency to EEprom (?)\n");
-#endif
-          return -EOPNOTSUPP;
-        }
-
-      /* We must download the frequency parameters to the
-       * synthetisers (from the EEprom - area 1)
-       * Note : as the EEprom is auto decremented, we set the end
-       * if the area... */
-      mmc_out(base, mmwoff(0, mmw_fee_addr), 0x0F);
-      mmc_out(base, mmwoff(0, mmw_fee_ctrl),
-              MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD);
-
-      /* Wait until the download is finished */
-      fee_wait(base, 100, 100);
-
-      /* We must now download the power adjust value (gain) to
-       * the synthetisers (from the EEprom - area 7 - DAC) */
-      mmc_out(base, mmwoff(0, mmw_fee_addr), 0x61);
-      mmc_out(base, mmwoff(0, mmw_fee_ctrl),
-              MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD);
-
-      /* Wait until the download is finished */
-      fee_wait(base, 100, 100);
-
-#ifdef DEBUG_IOCTL_INFO
-      /* Verification of what we have done... */
-
-      printk(KERN_DEBUG "Wavelan EEprom Area 1 :");
-      for(i = 0; i < 16; i++)
-        {
-          printk(" %04X",
-                 area_verify[i]);
-        }
-      printk("\n");
-
-      printk(KERN_DEBUG "Wavelan EEprom DAC : %04X %04X\n",
-             dac_verify[0], dac_verify[1]);
-#endif
-
-      return 0;
-    }
-  else
-    return -EINVAL;             /* Bah, never get there... */
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Give the list of available frequencies
- */
-static int
-wv_frequency_list(u_long        base,   /* i/o port of the card */
-                  iw_freq *     list,   /* List of frequency to fill */
-                  int           max)    /* Maximum number of frequencies */
-{
-  u_short       table[10];      /* Authorized frequency table */
-  long          freq = 0L;      /* offset to 2.4 GHz in .5 MHz + 12 MHz */
-  int           i;              /* index in the table */
-  const int     BAND_NUM = 10;  /* Number of bands */
-  int           c = 0;          /* Channel number */
-
-  /* Read the frequency table */
-  fee_read(base, 0x71 /* frequency table */,
-           table, 10);
-
-  /* Look all frequencies */
-  i = 0;
-  for(freq = 0; freq < 150; freq++)
-    /* Look in the table if the frequency is allowed */
-    if(table[9 - (freq / 16)] & (1 << (freq % 16)))
-      {
-        /* Compute approximate channel number */
-        while((((channel_bands[c] >> 1) - 24) < freq) &&
-              (c < BAND_NUM))
-          c++;
-        list[i].i = c;  /* Set the list index */
-
-        /* put in the list */
-        list[i].m = (((freq + 24) * 5) + 24000L) * 10000;
-        list[i++].e = 1;
-
-        /* Check number */
-        if(i >= max)
-          return(i);
-      }
-
-  return(i);
-}
-
-#ifdef IW_WIRELESS_SPY
-/*------------------------------------------------------------------*/
-/*
- * Gather wireless spy statistics : for each packet, compare the source
- * address with out list, and if match, get the stats...
- * Sorry, but this function really need wireless extensions...
- */
-static inline void
-wl_spy_gather(struct net_device *       dev,
-              u_char *  mac,            /* MAC address */
-              u_char *  stats)          /* Statistics to gather */
-{
-  struct iw_quality wstats;
-
-  wstats.qual = stats[2] & MMR_SGNL_QUAL;
-  wstats.level = stats[0] & MMR_SIGNAL_LVL;
-  wstats.noise = stats[1] & MMR_SILENCE_LVL;
-  wstats.updated = 0x7;
-
-  /* Update spy records */
-  wireless_spy_update(dev, mac, &wstats);
-}
-#endif  /* IW_WIRELESS_SPY */
-
-#ifdef HISTOGRAM
-/*------------------------------------------------------------------*/
-/*
- * This function calculate an histogram on the signal level.
- * As the noise is quite constant, it's like doing it on the SNR.
- * We have defined a set of interval (lp->his_range), and each time
- * the level goes in that interval, we increment the count (lp->his_sum).
- * With this histogram you may detect if one wavelan is really weak,
- * or you may also calculate the mean and standard deviation of the level...
- */
-static inline void
-wl_his_gather(struct net_device *       dev,
-              u_char *  stats)          /* Statistics to gather */
-{
-  net_local *   lp = netdev_priv(dev);
-  u_char        level = stats[0] & MMR_SIGNAL_LVL;
-  int           i;
-
-  /* Find the correct interval */
-  i = 0;
-  while((i < (lp->his_number - 1)) && (level >= lp->his_range[i++]))
-    ;
-
-  /* Increment interval counter */
-  (lp->his_sum[i])++;
-}
-#endif  /* HISTOGRAM */
-
-static void wl_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
-{
-        strncpy(info->driver, "wavelan_cs", sizeof(info->driver)-1);
-}
-
-static const struct ethtool_ops ops = {
-        .get_drvinfo = wl_get_drvinfo
-};
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get protocol name
- */
-static int wavelan_get_name(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        strcpy(wrqu->name, "WaveLAN");
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : set NWID
- */
-static int wavelan_set_nwid(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned int base = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        psa_t psa;
-        mm_t m;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Set NWID in WaveLAN. */
-        if (!wrqu->nwid.disabled) {
-                /* Set NWID in psa */
-                psa.psa_nwid[0] = (wrqu->nwid.value & 0xFF00) >> 8;
-                psa.psa_nwid[1] = wrqu->nwid.value & 0xFF;
-                psa.psa_nwid_select = 0x01;
-                psa_write(dev,
-                          (char *) psa.psa_nwid - (char *) &psa,
-                          (unsigned char *) psa.psa_nwid, 3);
-
-                /* Set NWID in mmc. */
-                m.w.mmw_netw_id_l = psa.psa_nwid[1];
-                m.w.mmw_netw_id_h = psa.psa_nwid[0];
-                mmc_write(base,
-                          (char *) &m.w.mmw_netw_id_l -
-                          (char *) &m,
-                          (unsigned char *) &m.w.mmw_netw_id_l, 2);
-                mmc_out(base, mmwoff(0, mmw_loopt_sel), 0x00);
-        } else {
-                /* Disable NWID in the psa. */
-                psa.psa_nwid_select = 0x00;
-                psa_write(dev,
-                          (char *) &psa.psa_nwid_select -
-                          (char *) &psa,
-                          (unsigned char *) &psa.psa_nwid_select,
-                          1);
-
-                /* Disable NWID in the mmc (no filtering). */
-                mmc_out(base, mmwoff(0, mmw_loopt_sel),
-                        MMW_LOOPT_SEL_DIS_NWID);
-        }
-        /* update the Wavelan checksum */
-        update_psa_checksum(dev);
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get NWID 
- */
-static int wavelan_get_nwid(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        net_local *lp = netdev_priv(dev);
-        psa_t psa;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Read the NWID. */
-        psa_read(dev,
-                 (char *) psa.psa_nwid - (char *) &psa,
-                 (unsigned char *) psa.psa_nwid, 3);
-        wrqu->nwid.value = (psa.psa_nwid[0] << 8) + psa.psa_nwid[1];
-        wrqu->nwid.disabled = !(psa.psa_nwid_select);
-        wrqu->nwid.fixed = 1;   /* Superfluous */
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : set frequency
- */
-static int wavelan_set_freq(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned int base = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        unsigned long flags;
-        int ret;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable). */
-        if (!(mmc_in(base, mmroff(0, mmr_fee_status)) &
-              (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY)))
-                ret = wv_set_frequency(base, &(wrqu->freq));
-        else
-                ret = -EOPNOTSUPP;
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get frequency
- */
-static int wavelan_get_freq(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned int base = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        psa_t psa;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable).
-         * Does it work for everybody, especially old cards? */
-        if (!(mmc_in(base, mmroff(0, mmr_fee_status)) &
-              (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY))) {
-                unsigned short freq;
-
-                /* Ask the EEPROM to read the frequency from the first area. */
-                fee_read(base, 0x00, &freq, 1);
-                wrqu->freq.m = ((freq >> 5) * 5 + 24000L) * 10000;
-                wrqu->freq.e = 1;
-        } else {
-                psa_read(dev,
-                         (char *) &psa.psa_subband - (char *) &psa,
-                         (unsigned char *) &psa.psa_subband, 1);
-
-                if (psa.psa_subband <= 4) {
-                        wrqu->freq.m = fixed_bands[psa.psa_subband];
-                        wrqu->freq.e = (psa.psa_subband != 0);
-                } else
-                        ret = -EOPNOTSUPP;
-        }
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : set level threshold
- */
-static int wavelan_set_sens(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned int base = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        psa_t psa;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Set the level threshold. */
-        /* We should complain loudly if wrqu->sens.fixed = 0, because we
-         * can't set auto mode... */
-        psa.psa_thr_pre_set = wrqu->sens.value & 0x3F;
-        psa_write(dev,
-                  (char *) &psa.psa_thr_pre_set - (char *) &psa,
-                  (unsigned char *) &psa.psa_thr_pre_set, 1);
-        /* update the Wavelan checksum */
-        update_psa_checksum(dev);
-        mmc_out(base, mmwoff(0, mmw_thr_pre_set),
-                psa.psa_thr_pre_set);
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get level threshold
- */
-static int wavelan_get_sens(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        net_local *lp = netdev_priv(dev);
-        psa_t psa;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Read the level threshold. */
-        psa_read(dev,
-                 (char *) &psa.psa_thr_pre_set - (char *) &psa,
-                 (unsigned char *) &psa.psa_thr_pre_set, 1);
-        wrqu->sens.value = psa.psa_thr_pre_set & 0x3F;
-        wrqu->sens.fixed = 1;
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : set encryption key
- */
-static int wavelan_set_encode(struct net_device *dev,
-                              struct iw_request_info *info,
-                              union iwreq_data *wrqu,
-                              char *extra)
-{
-        unsigned int base = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        unsigned long flags;
-        psa_t psa;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-
-        /* Check if capable of encryption */
-        if (!mmc_encr(base)) {
-                ret = -EOPNOTSUPP;
-        }
-
-        /* Check the size of the key */
-        if((wrqu->encoding.length != 8) && (wrqu->encoding.length != 0)) {
-                ret = -EINVAL;
-        }
-
-        if(!ret) {
-                /* Basic checking... */
-                if (wrqu->encoding.length == 8) {
-                        /* Copy the key in the driver */
-                        memcpy(psa.psa_encryption_key, extra,
-                               wrqu->encoding.length);
-                        psa.psa_encryption_select = 1;
-
-                        psa_write(dev,
-                                  (char *) &psa.psa_encryption_select -
-                                  (char *) &psa,
-                                  (unsigned char *) &psa.
-                                  psa_encryption_select, 8 + 1);
-
-                        mmc_out(base, mmwoff(0, mmw_encr_enable),
-                                MMW_ENCR_ENABLE_EN | MMW_ENCR_ENABLE_MODE);
-                        mmc_write(base, mmwoff(0, mmw_encr_key),
-                                  (unsigned char *) &psa.
-                                  psa_encryption_key, 8);
-                }
-
-                /* disable encryption */
-                if (wrqu->encoding.flags & IW_ENCODE_DISABLED) {
-                        psa.psa_encryption_select = 0;
-                        psa_write(dev,
-                                  (char *) &psa.psa_encryption_select -
-                                  (char *) &psa,
-                                  (unsigned char *) &psa.
-                                  psa_encryption_select, 1);
-
-                        mmc_out(base, mmwoff(0, mmw_encr_enable), 0);
-                }
-                /* update the Wavelan checksum */
-                update_psa_checksum(dev);
-        }
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get encryption key
- */
-static int wavelan_get_encode(struct net_device *dev,
-                              struct iw_request_info *info,
-                              union iwreq_data *wrqu,
-                              char *extra)
-{
-        unsigned int base = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        psa_t psa;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Check if encryption is available */
-        if (!mmc_encr(base)) {
-                ret = -EOPNOTSUPP;
-        } else {
-                /* Read the encryption key */
-                psa_read(dev,
-                         (char *) &psa.psa_encryption_select -
-                         (char *) &psa,
-                         (unsigned char *) &psa.
-                         psa_encryption_select, 1 + 8);
-
-                /* encryption is enabled ? */
-                if (psa.psa_encryption_select)
-                        wrqu->encoding.flags = IW_ENCODE_ENABLED;
-                else
-                        wrqu->encoding.flags = IW_ENCODE_DISABLED;
-                wrqu->encoding.flags |= mmc_encr(base);
-
-                /* Copy the key to the user buffer */
-                wrqu->encoding.length = 8;
-                memcpy(extra, psa.psa_encryption_key, wrqu->encoding.length);
-        }
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-#ifdef WAVELAN_ROAMING_EXT
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : set ESSID (domain)
- */
-static int wavelan_set_essid(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu,
-                             char *extra)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Check if disable */
-        if(wrqu->data.flags == 0)
-                lp->filter_domains = 0;
-        else {
-                char    essid[IW_ESSID_MAX_SIZE + 1];
-                char *  endp;
-
-                /* Terminate the string */
-                memcpy(essid, extra, wrqu->data.length);
-                essid[IW_ESSID_MAX_SIZE] = '\0';
-
-#ifdef DEBUG_IOCTL_INFO
-                printk(KERN_DEBUG "SetEssid : ``%s''\n", essid);
-#endif  /* DEBUG_IOCTL_INFO */
-
-                /* Convert to a number (note : Wavelan specific) */
-                lp->domain_id = simple_strtoul(essid, &endp, 16);
-                /* Has it worked  ? */
-                if(endp > essid)
-                        lp->filter_domains = 1;
-                else {
-                        lp->filter_domains = 0;
-                        ret = -EINVAL;
-                }
-        }
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get ESSID (domain)
- */
-static int wavelan_get_essid(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu,
-                             char *extra)
-{
-        net_local *lp = netdev_priv(dev);
-
-        /* Is the domain ID active ? */
-        wrqu->data.flags = lp->filter_domains;
-
-        /* Copy Domain ID into a string (Wavelan specific) */
-        /* Sound crazy, be we can't have a snprintf in the kernel !!! */
-        sprintf(extra, "%lX", lp->domain_id);
-        extra[IW_ESSID_MAX_SIZE] = '\0';
-
-        /* Set the length */
-        wrqu->data.length = strlen(extra);
-
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : set AP address
- */
-static int wavelan_set_wap(struct net_device *dev,
-                           struct iw_request_info *info,
-                           union iwreq_data *wrqu,
-                           char *extra)
-{
-#ifdef DEBUG_IOCTL_INFO
-        printk(KERN_DEBUG "Set AP to : %pM\n", wrqu->ap_addr.sa_data);
-#endif  /* DEBUG_IOCTL_INFO */
-
-        return -EOPNOTSUPP;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get AP address
- */
-static int wavelan_get_wap(struct net_device *dev,
-                           struct iw_request_info *info,
-                           union iwreq_data *wrqu,
-                           char *extra)
-{
-        /* Should get the real McCoy instead of own Ethernet address */
-        memcpy(wrqu->ap_addr.sa_data, dev->dev_addr, WAVELAN_ADDR_SIZE);
-        wrqu->ap_addr.sa_family = ARPHRD_ETHER;
-
-        return -EOPNOTSUPP;
-}
-#endif  /* WAVELAN_ROAMING_EXT */
-
-#ifdef WAVELAN_ROAMING
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : set mode
- */
-static int wavelan_set_mode(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long flags;
-        int ret = 0;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-
-        /* Check mode */
-        switch(wrqu->mode) {
-        case IW_MODE_ADHOC:
-                if(do_roaming) {
-                        wv_roam_cleanup(dev);
-                        do_roaming = 0;
-                }
-                break;
-        case IW_MODE_INFRA:
-                if(!do_roaming) {
-                        wv_roam_init(dev);
-                        do_roaming = 1;
-                }
-                break;
-        default:
-                ret = -EINVAL;
-        }
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get mode
- */
-static int wavelan_get_mode(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        if(do_roaming)
-                wrqu->mode = IW_MODE_INFRA;
-        else
-                wrqu->mode = IW_MODE_ADHOC;
-
-        return 0;
-}
-#endif  /* WAVELAN_ROAMING */
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Handler : get range info
- */
-static int wavelan_get_range(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu,
-                             char *extra)
-{
-        unsigned int base = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        struct iw_range *range = (struct iw_range *) extra;
-        unsigned long flags;
-        int ret = 0;
-
-        /* Set the length (very important for backward compatibility) */
-        wrqu->data.length = sizeof(struct iw_range);
-
-        /* Set all the info we don't care or don't know about to zero */
-        memset(range, 0, sizeof(struct iw_range));
-
-        /* Set the Wireless Extension versions */
-        range->we_version_compiled = WIRELESS_EXT;
-        range->we_version_source = 9;
-
-        /* Set information in the range struct.  */
-        range->throughput = 1.4 * 1000 * 1000;  /* don't argue on this ! */
-        range->min_nwid = 0x0000;
-        range->max_nwid = 0xFFFF;
-
-        range->sensitivity = 0x3F;
-        range->max_qual.qual = MMR_SGNL_QUAL;
-        range->max_qual.level = MMR_SIGNAL_LVL;
-        range->max_qual.noise = MMR_SILENCE_LVL;
-        range->avg_qual.qual = MMR_SGNL_QUAL; /* Always max */
-        /* Need to get better values for those two */
-        range->avg_qual.level = 30;
-        range->avg_qual.noise = 8;
-
-        range->num_bitrates = 1;
-        range->bitrate[0] = 2000000;    /* 2 Mb/s */
-
-        /* Event capability (kernel + driver) */
-        range->event_capa[0] = (IW_EVENT_CAPA_MASK(0x8B02) |
-                                IW_EVENT_CAPA_MASK(0x8B04) |
-                                IW_EVENT_CAPA_MASK(0x8B06));
-        range->event_capa[1] = IW_EVENT_CAPA_K_1;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable). */
-        if (!(mmc_in(base, mmroff(0, mmr_fee_status)) &
-              (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY))) {
-                range->num_channels = 10;
-                range->num_frequency = wv_frequency_list(base, range->freq,
-                                                        IW_MAX_FREQUENCIES);
-        } else
-                range->num_channels = range->num_frequency = 0;
-
-        /* Encryption supported ? */
-        if (mmc_encr(base)) {
-                range->encoding_size[0] = 8;    /* DES = 64 bits key */
-                range->num_encoding_sizes = 1;
-                range->max_encoding_tokens = 1; /* Only one key possible */
-        } else {
-                range->num_encoding_sizes = 0;
-                range->max_encoding_tokens = 0;
-        }
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return ret;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Private Handler : set quality threshold
- */
-static int wavelan_set_qthr(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        unsigned int base = dev->base_addr;
-        net_local *lp = netdev_priv(dev);
-        psa_t psa;
-        unsigned long flags;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        psa.psa_quality_thr = *(extra) & 0x0F;
-        psa_write(dev,
-                  (char *) &psa.psa_quality_thr - (char *) &psa,
-                  (unsigned char *) &psa.psa_quality_thr, 1);
-        /* update the Wavelan checksum */
-        update_psa_checksum(dev);
-        mmc_out(base, mmwoff(0, mmw_quality_thr),
-                psa.psa_quality_thr);
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Private Handler : get quality threshold
- */
-static int wavelan_get_qthr(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        net_local *lp = netdev_priv(dev);
-        psa_t psa;
-        unsigned long flags;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        psa_read(dev,
-                 (char *) &psa.psa_quality_thr - (char *) &psa,
-                 (unsigned char *) &psa.psa_quality_thr, 1);
-        *(extra) = psa.psa_quality_thr & 0x0F;
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return 0;
-}
-
-#ifdef WAVELAN_ROAMING
-/*------------------------------------------------------------------*/
-/*
- * Wireless Private Handler : set roaming
- */
-static int wavelan_set_roam(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        net_local *lp = netdev_priv(dev);
-        unsigned long flags;
-
-        /* Disable interrupts and save flags. */
-        spin_lock_irqsave(&lp->spinlock, flags);
-        
-        /* Note : should check if user == root */
-        if(do_roaming && (*extra)==0)
-                wv_roam_cleanup(dev);
-        else if(do_roaming==0 && (*extra)!=0)
-                wv_roam_init(dev);
-
-        do_roaming = (*extra);
-
-        /* Enable interrupts and restore flags. */
-        spin_unlock_irqrestore(&lp->spinlock, flags);
-
-        return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Private Handler : get quality threshold
- */
-static int wavelan_get_roam(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu,
-                            char *extra)
-{
-        *(extra) = do_roaming;
-
-        return 0;
-}
-#endif  /* WAVELAN_ROAMING */
-
-#ifdef HISTOGRAM
-/*------------------------------------------------------------------*/
-/*
- * Wireless Private Handler : set histogram
- */
-static int wavelan_set_histo(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu,
-                             char *extra)
-{
-        net_local *lp = netdev_priv(dev);
-
-        /* Check the number of intervals. */
-        if (wrqu->data.length > 16) {
-                return(-E2BIG);
-        }
-
-        /* Disable histo while we copy the addresses.
-         * As we don't disable interrupts, we need to do this */
-        lp->his_number = 0;
-
-        /* Are there ranges to copy? */
-        if (wrqu->data.length > 0) {
-                /* Copy interval ranges to the driver */
-                memcpy(lp->his_range, extra, wrqu->data.length);
-
-                {
-                  int i;
-                  printk(KERN_DEBUG "Histo :");
-                  for(i = 0; i < wrqu->data.length; i++)
-                    printk(" %d", lp->his_range[i]);
-                  printk("\n");
-                }
-
-                /* Reset result structure. */
-                memset(lp->his_sum, 0x00, sizeof(long) * 16);
-        }
-
-        /* Now we can set the number of ranges */
-        lp->his_number = wrqu->data.length;
-
-        return(0);
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Wireless Private Handler : get histogram
- */
-static int wavelan_get_histo(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu,
-                             char *extra)
-{
-        net_local *lp = netdev_priv(dev);
-
-        /* Set the number of intervals. */
-        wrqu->data.length = lp->his_number;
-
-        /* Give back the distribution statistics */
-        if(lp->his_number > 0)
-                memcpy(extra, lp->his_sum, sizeof(long) * lp->his_number);
-
-        return(0);
-}
-#endif                  /* HISTOGRAM */
-
-/*------------------------------------------------------------------*/
-/*
- * Structures to export the Wireless Handlers
- */
-
-static const struct iw_priv_args wavelan_private_args[] = {
-/*{ cmd,         set_args,                            get_args, name } */
-  { SIOCSIPQTHR, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, 0, "setqualthr" },
-  { SIOCGIPQTHR, 0, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, "getqualthr" },
-  { SIOCSIPROAM, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, 0, "setroam" },
-  { SIOCGIPROAM, 0, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, "getroam" },
-  { SIOCSIPHISTO, IW_PRIV_TYPE_BYTE | 16,                    0, "sethisto" },
-  { SIOCGIPHISTO, 0,                     IW_PRIV_TYPE_INT | 16, "gethisto" },
-};
-
-static const iw_handler         wavelan_handler[] =
-{
-        NULL,                           /* SIOCSIWNAME */
-        wavelan_get_name,               /* SIOCGIWNAME */
-        wavelan_set_nwid,               /* SIOCSIWNWID */
-        wavelan_get_nwid,               /* SIOCGIWNWID */
-        wavelan_set_freq,               /* SIOCSIWFREQ */
-        wavelan_get_freq,               /* SIOCGIWFREQ */
-#ifdef WAVELAN_ROAMING
-        wavelan_set_mode,               /* SIOCSIWMODE */
-        wavelan_get_mode,               /* SIOCGIWMODE */
-#else   /* WAVELAN_ROAMING */
-        NULL,                           /* SIOCSIWMODE */
-        NULL,                           /* SIOCGIWMODE */
-#endif  /* WAVELAN_ROAMING */
-        wavelan_set_sens,               /* SIOCSIWSENS */
-        wavelan_get_sens,               /* SIOCGIWSENS */
-        NULL,                           /* SIOCSIWRANGE */
-        wavelan_get_range,              /* SIOCGIWRANGE */
-        NULL,                           /* SIOCSIWPRIV */
-        NULL,                           /* SIOCGIWPRIV */
-        NULL,                           /* SIOCSIWSTATS */
-        NULL,                           /* SIOCGIWSTATS */
-        iw_handler_set_spy,             /* SIOCSIWSPY */
-        iw_handler_get_spy,             /* SIOCGIWSPY */
-        iw_handler_set_thrspy,          /* SIOCSIWTHRSPY */
-        iw_handler_get_thrspy,          /* SIOCGIWTHRSPY */
-#ifdef WAVELAN_ROAMING_EXT
-        wavelan_set_wap,                /* SIOCSIWAP */
-        wavelan_get_wap,                /* SIOCGIWAP */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* SIOCGIWAPLIST */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* -- hole -- */
-        wavelan_set_essid,              /* SIOCSIWESSID */
-        wavelan_get_essid,              /* SIOCGIWESSID */
-#else   /* WAVELAN_ROAMING_EXT */
-        NULL,                           /* SIOCSIWAP */
-        NULL,                           /* SIOCGIWAP */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* SIOCGIWAPLIST */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* SIOCSIWESSID */
-        NULL,                           /* SIOCGIWESSID */
-#endif  /* WAVELAN_ROAMING_EXT */
-        NULL,                           /* SIOCSIWNICKN */
-        NULL,                           /* SIOCGIWNICKN */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* -- hole -- */
-        NULL,                           /* SIOCSIWRATE */
-        NULL,                           /* SIOCGIWRATE */
-        NULL,                           /* SIOCSIWRTS */
-        NULL,                           /* SIOCGIWRTS */
-        NULL,                           /* SIOCSIWFRAG */
-        NULL,                           /* SIOCGIWFRAG */
-        NULL,                           /* SIOCSIWTXPOW */
-        NULL,                           /* SIOCGIWTXPOW */
-        NULL,                           /* SIOCSIWRETRY */
-        NULL,                           /* SIOCGIWRETRY */
-        wavelan_set_encode,             /* SIOCSIWENCODE */
-        wavelan_get_encode,             /* SIOCGIWENCODE */
-};
-
-static const iw_handler         wavelan_private_handler[] =
-{
-        wavelan_set_qthr,               /* SIOCIWFIRSTPRIV */
-        wavelan_get_qthr,               /* SIOCIWFIRSTPRIV + 1 */
-#ifdef WAVELAN_ROAMING
-        wavelan_set_roam,               /* SIOCIWFIRSTPRIV + 2 */
-        wavelan_get_roam,               /* SIOCIWFIRSTPRIV + 3 */
-#else   /* WAVELAN_ROAMING */
-        NULL,                           /* SIOCIWFIRSTPRIV + 2 */
-        NULL,                           /* SIOCIWFIRSTPRIV + 3 */
-#endif  /* WAVELAN_ROAMING */
-#ifdef HISTOGRAM
-        wavelan_set_histo,              /* SIOCIWFIRSTPRIV + 4 */
-        wavelan_get_histo,              /* SIOCIWFIRSTPRIV + 5 */
-#endif  /* HISTOGRAM */
-};
-
-static const struct iw_handler_def      wavelan_handler_def =
-{
-        .num_standard   = ARRAY_SIZE(wavelan_handler),
-        .num_private    = ARRAY_SIZE(wavelan_private_handler),
-        .num_private_args = ARRAY_SIZE(wavelan_private_args),
-        .standard       = wavelan_handler,
-        .private        = wavelan_private_handler,
-        .private_args   = wavelan_private_args,
-        .get_wireless_stats = wavelan_get_wireless_stats,
-};
-
-/*------------------------------------------------------------------*/
-/*
- * Get wireless statistics
- * Called by /proc/net/wireless...
- */
-static iw_stats *
-wavelan_get_wireless_stats(struct net_device *  dev)
-{
-  unsigned int          base = dev->base_addr;
-  net_local *           lp = netdev_priv(dev);
-  mmr_t                 m;
-  iw_stats *            wstats;
-  unsigned long         flags;
-
-#ifdef DEBUG_IOCTL_TRACE
-  printk(KERN_DEBUG "%s: ->wavelan_get_wireless_stats()\n", dev->name);
-#endif
-
-  /* Disable interrupts & save flags */
-  spin_lock_irqsave(&lp->spinlock, flags);
-
-  wstats = &lp->wstats;
-
-  /* Get data from the mmc */
-  mmc_out(base, mmwoff(0, mmw_freeze), 1);
-
-  mmc_read(base, mmroff(0, mmr_dce_status), &m.mmr_dce_status, 1);
-  mmc_read(base, mmroff(0, mmr_wrong_nwid_l), &m.mmr_wrong_nwid_l, 2);
-  mmc_read(base, mmroff(0, mmr_thr_pre_set), &m.mmr_thr_pre_set, 4);
-
-  mmc_out(base, mmwoff(0, mmw_freeze), 0);
-
-  /* Copy data to wireless stuff */
-  wstats->status = m.mmr_dce_status & MMR_DCE_STATUS;
-  wstats->qual.qual = m.mmr_sgnl_qual & MMR_SGNL_QUAL;
-  wstats->qual.level = m.mmr_signal_lvl & MMR_SIGNAL_LVL;
-  wstats->qual.noise = m.mmr_silence_lvl & MMR_SILENCE_LVL;
-  wstats->qual.updated = (((m.mmr_signal_lvl & MMR_SIGNAL_LVL_VALID) >> 7) |
-                          ((m.mmr_signal_lvl & MMR_SIGNAL_LVL_VALID) >> 6) |
-                          ((m.mmr_silence_lvl & MMR_SILENCE_LVL_VALID) >> 5));
-  wstats->discard.nwid += (m.mmr_wrong_nwid_h << 8) | m.mmr_wrong_nwid_l;
-  wstats->discard.code = 0L;
-  wstats->discard.misc = 0L;
-
-  /* ReEnable interrupts & restore flags */
-  spin_unlock_irqrestore(&lp->spinlock, flags);
-
-#ifdef DEBUG_IOCTL_TRACE
-  printk(KERN_DEBUG "%s: <-wavelan_get_wireless_stats()\n", dev->name);
-#endif
-  return &lp->wstats;
-}
-
-/************************* PACKET RECEPTION *************************/
-/*
- * This part deal with receiving the packets.
- * The interrupt handler get an interrupt when a packet has been
- * successfully received and called this part...
- */
-
-/*------------------------------------------------------------------*/
-/*
- * Calculate the starting address of the frame pointed to by the receive
- * frame pointer and verify that the frame seem correct
- * (called by wv_packet_rcv())
- */
-static int
-wv_start_of_frame(struct net_device *   dev,
-                  int           rfp,    /* end of frame */
-                  int           wrap)   /* start of buffer */
-{
-  unsigned int  base = dev->base_addr;
-  int           rp;
-  int           len;
-
-  rp = (rfp - 5 + RX_SIZE) % RX_SIZE;
-  outb(rp & 0xff, PIORL(base));
-  outb(((rp >> 8) & PIORH_MASK), PIORH(base));
-  len = inb(PIOP(base));
-  len |= inb(PIOP(base)) << 8;
-
-  /* Sanity checks on size */
-  /* Frame too big */
-  if(len > MAXDATAZ + 100)
-    {
-#ifdef DEBUG_RX_ERROR
-      printk(KERN_INFO "%s: wv_start_of_frame: Received frame too large, rfp %d len 0x%x\n",
-             dev->name, rfp, len);
-#endif
-      return(-1);
-    }
-  
-  /* Frame too short */
-  if(len < 7)
-    {
-#ifdef DEBUG_RX_ERROR
-      printk(KERN_INFO "%s: wv_start_of_frame: Received null frame, rfp %d len 0x%x\n",
-             dev->name, rfp, len);
-#endif
-      return(-1);
-    }
-  
-  /* Wrap around buffer */
-  if(len > ((wrap - (rfp - len) + RX_SIZE) % RX_SIZE))  /* magic formula ! */
-    {
-#ifdef DEBUG_RX_ERROR
-      printk(KERN_INFO "%s: wv_start_of_frame: wrap around buffer, wrap %d rfp %d len 0x%x\n",
-             dev->name, wrap, rfp, len);
-#endif
-      return(-1);
-    }
-
-  return((rp - len + RX_SIZE) % RX_SIZE);
-} /* wv_start_of_frame */
-
-/*------------------------------------------------------------------*/
-/*
- * This routine does the actual copy of data (including the ethernet
- * header structure) from the WaveLAN card to an sk_buff chain that
- * will be passed up to the network interface layer. NOTE: We
- * currently don't handle trailer protocols (neither does the rest of
- * the network interface), so if that is needed, it will (at least in
- * part) be added here.  The contents of the receive ring buffer are
- * copied to a message chain that is then passed to the kernel.
- *
- * Note: if any errors occur, the packet is "dropped on the floor"
- * (called by wv_packet_rcv())
- */
-static void
-wv_packet_read(struct net_device *              dev,
-               int              fd_p,
-               int              sksize)
-{
-  net_local *           lp = netdev_priv(dev);
-  struct sk_buff *      skb;
-
-#ifdef DEBUG_RX_TRACE
-  printk(KERN_DEBUG "%s: ->wv_packet_read(0x%X, %d)\n",
-         dev->name, fd_p, sksize);
-#endif
-
-  /* Allocate some buffer for the new packet */
-  if((skb = dev_alloc_skb(sksize+2)) == (struct sk_buff *) NULL)
-    {
-#ifdef DEBUG_RX_ERROR
-      printk(KERN_INFO "%s: wv_packet_read(): could not alloc_skb(%d, GFP_ATOMIC)\n",
-             dev->name, sksize);
-#endif
-      dev->stats.rx_dropped++;
-      /*
-       * Not only do we want to return here, but we also need to drop the
-       * packet on the floor to clear the interrupt.
-       */
-      return;
-    }
-
-  skb_reserve(skb, 2);
-  fd_p = read_ringbuf(dev, fd_p, (char *) skb_put(skb, sksize), sksize);
-  skb->protocol = eth_type_trans(skb, dev);
-
-#ifdef DEBUG_RX_INFO
-  wv_packet_info(skb_mac_header(skb), sksize, dev->name, "wv_packet_read");
-#endif  /* DEBUG_RX_INFO */
-     
-  /* Statistics gathering & stuff associated.
-   * It seem a bit messy with all the define, but it's really simple... */
-  if(
-#ifdef IW_WIRELESS_SPY
-     (lp->spy_data.spy_number > 0) ||
-#endif  /* IW_WIRELESS_SPY */
-#ifdef HISTOGRAM
-     (lp->his_number > 0) ||
-#endif  /* HISTOGRAM */
-#ifdef WAVELAN_ROAMING
-     (do_roaming) ||
-#endif  /* WAVELAN_ROAMING */
-     0)
-    {
-      u_char    stats[3];       /* Signal level, Noise level, Signal quality */
-
-      /* read signal level, silence level and signal quality bytes */
-      fd_p = read_ringbuf(dev, (fd_p + 4) % RX_SIZE + RX_BASE,
-                          stats, 3);
-#ifdef DEBUG_RX_INFO
-      printk(KERN_DEBUG "%s: wv_packet_read(): Signal level %d/63, Silence level %d/63, signal quality %d/16\n",
-             dev->name, stats[0] & 0x3F, stats[1] & 0x3F, stats[2] & 0x0F);
-#endif
-
-#ifdef WAVELAN_ROAMING
-      if(do_roaming)
-        if(WAVELAN_BEACON(skb->data))
-          wl_roam_gather(dev, skb->data, stats);
-#endif  /* WAVELAN_ROAMING */
-          
-#ifdef WIRELESS_SPY
-      wl_spy_gather(dev, skb_mac_header(skb) + WAVELAN_ADDR_SIZE, stats);
-#endif  /* WIRELESS_SPY */
-#ifdef HISTOGRAM
-      wl_his_gather(dev, stats);
-#endif  /* HISTOGRAM */
-    }
-
-  /*
-   * Hand the packet to the Network Module
-   */
-  netif_rx(skb);
-
-  /* Keep stats up to date */
-  dev->stats.rx_packets++;
-  dev->stats.rx_bytes += sksize;
-
-#ifdef DEBUG_RX_TRACE
-  printk(KERN_DEBUG "%s: <-wv_packet_read()\n", dev->name);
-#endif
-  return;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * This routine is called by the interrupt handler to initiate a
- * packet transfer from the card to the network interface layer above
- * this driver.  This routine checks if a buffer has been successfully
- * received by the WaveLAN card.  If so, the routine wv_packet_read is
- * called to do the actual transfer of the card's data including the
- * ethernet header into a packet consisting of an sk_buff chain.
- * (called by wavelan_interrupt())
- * Note : the spinlock is already grabbed for us and irq are disabled.
- */
-static void
-wv_packet_rcv(struct net_device *       dev)
-{
-  unsigned int  base = dev->base_addr;
-  net_local *   lp = netdev_priv(dev);
-  int           newrfp;
-  int           rp;
-  int           len;
-  int           f_start;
-  int           status;
-  int           i593_rfp;
-  int           stat_ptr;
-  u_char        c[4];
-
-#ifdef DEBUG_RX_TRACE
-  printk(KERN_DEBUG "%s: ->wv_packet_rcv()\n", dev->name);
-#endif
-
-  /* Get the new receive frame pointer from the i82593 chip */
-  outb(CR0_STATUS_2 | OP0_NOP, LCCR(base));
-  i593_rfp = inb(LCSR(base));
-  i593_rfp |= inb(LCSR(base)) << 8;
-  i593_rfp %= RX_SIZE;
-
-  /* Get the new receive frame pointer from the WaveLAN card.
-   * It is 3 bytes more than the increment of the i82593 receive
-   * frame pointer, for each packet. This is because it includes the
-   * 3 roaming bytes added by the mmc.
-   */
-  newrfp = inb(RPLL(base));
-  newrfp |= inb(RPLH(base)) << 8;
-  newrfp %= RX_SIZE;
-
-#ifdef DEBUG_RX_INFO
-  printk(KERN_DEBUG "%s: wv_packet_rcv(): i593_rfp %d stop %d newrfp %d lp->rfp %d\n",
-         dev->name, i593_rfp, lp->stop, newrfp, lp->rfp);
-#endif
-
-#ifdef DEBUG_RX_ERROR
-  /* If no new frame pointer... */
-  if(lp->overrunning || newrfp == lp->rfp)
-    printk(KERN_INFO "%s: wv_packet_rcv(): no new frame: i593_rfp %d stop %d newrfp %d lp->rfp %d\n",
-           dev->name, i593_rfp, lp->stop, newrfp, lp->rfp);
-#endif
-
-  /* Read all frames (packets) received */
-  while(newrfp != lp->rfp)
-    {
-      /* A frame is composed of the packet, followed by a status word,
-       * the length of the frame (word) and the mmc info (SNR & qual).
-       * It's because the length is at the end that we can only scan
-       * frames backward. */
-
-      /* Find the first frame by skipping backwards over the frames */
-      rp = newrfp;      /* End of last frame */
-      while(((f_start = wv_start_of_frame(dev, rp, newrfp)) != lp->rfp) &&
-            (f_start != -1))
-          rp = f_start;
-
-      /* If we had a problem */
-      if(f_start == -1)
-        {
-#ifdef DEBUG_RX_ERROR
-          printk(KERN_INFO "wavelan_cs: cannot find start of frame ");
-          printk(" i593_rfp %d stop %d newrfp %d lp->rfp %d\n",
-                 i593_rfp, lp->stop, newrfp, lp->rfp);
-#endif
-          lp->rfp = rp;         /* Get to the last usable frame */
-          continue;
-        }
-
-      /* f_start point to the beggining of the first frame received
-       * and rp to the beggining of the next one */
-
-      /* Read status & length of the frame */
-      stat_ptr = (rp - 7 + RX_SIZE) % RX_SIZE;
-      stat_ptr = read_ringbuf(dev, stat_ptr, c, 4);
-      status = c[0] | (c[1] << 8);
-      len = c[2] | (c[3] << 8);
-
-      /* Check status */
-      if((status & RX_RCV_OK) != RX_RCV_OK)
-        {
-          dev->stats.rx_errors++;
-          if(status & RX_NO_SFD)
-            dev->stats.rx_frame_errors++;
-          if(status & RX_CRC_ERR)
-            dev->stats.rx_crc_errors++;
-          if(status & RX_OVRRUN)
-            dev->stats.rx_over_errors++;
-
-#ifdef DEBUG_RX_FAIL
-          printk(KERN_DEBUG "%s: wv_packet_rcv(): packet not received ok, status = 0x%x\n",
-                 dev->name, status);
-#endif
-        }
-      else
-        /* Read the packet and transmit to Linux */
-        wv_packet_read(dev, f_start, len - 2);
-
-      /* One frame has been processed, skip it */
-      lp->rfp = rp;
-    }
-
-  /*
-   * Update the frame stop register, but set it to less than
-   * the full 8K to allow space for 3 bytes of signal strength
-   * per packet.
-   */
-  lp->stop = (i593_rfp + RX_SIZE - ((RX_SIZE / 64) * 3)) % RX_SIZE;
-  outb(OP0_SWIT_TO_PORT_1 | CR0_CHNL, LCCR(base));
-  outb(CR1_STOP_REG_UPDATE | (lp->stop >> RX_SIZE_SHIFT), LCCR(base));
-  outb(OP1_SWIT_TO_PORT_0, LCCR(base));
-
-#ifdef DEBUG_RX_TRACE
-  printk(KERN_DEBUG "%s: <-wv_packet_rcv()\n", dev->name);
-#endif
-}
-
-/*********************** PACKET TRANSMISSION ***********************/
-/*
- * This part deal with sending packet through the wavelan
- * We copy the packet to the send buffer and then issue the send
- * command to the i82593. The result of this operation will be
- * checked in wavelan_interrupt()
- */
-
-/*------------------------------------------------------------------*/
-/*
- * This routine fills in the appropriate registers and memory
- * locations on the WaveLAN card and starts the card off on
- * the transmit.
- * (called in wavelan_packet_xmit())
- */
-static void
-wv_packet_write(struct net_device *     dev,
-                void *          buf,
-                short           length)
-{
-  net_local *           lp = netdev_priv(dev);
-  unsigned int          base = dev->base_addr;
-  unsigned long         flags;
-  int                   clen = length;
-  register u_short      xmtdata_base = TX_BASE;
-
-#ifdef DEBUG_TX_TRACE
-  printk(KERN_DEBUG "%s: ->wv_packet_write(%d)\n", dev->name, length);
-#endif
-
-  spin_lock_irqsave(&lp->spinlock, flags);
-
-  /* Write the length of data buffer followed by the buffer */
-  outb(xmtdata_base & 0xff, PIORL(base));
-  outb(((xmtdata_base >> 8) & PIORH_MASK) | PIORH_SEL_TX, PIORH(base));
-  outb(clen & 0xff, PIOP(base));        /* lsb */
-  outb(clen >> 8, PIOP(base));          /* msb */
-
-  /* Send the data */
-  outsb(PIOP(base), buf, clen);
-
-  /* Indicate end of transmit chain */
-  outb(OP0_NOP, PIOP(base));
-  /* josullvn@cs.cmu.edu: need to send a second NOP for alignment... */
-  outb(OP0_NOP, PIOP(base));
-
-  /* Reset the transmit DMA pointer */
-  hacr_write_slow(base, HACR_PWR_STAT | HACR_TX_DMA_RESET);
-  hacr_write(base, HACR_DEFAULT);
-  /* Send the transmit command */
-  wv_82593_cmd(dev, "wv_packet_write(): transmit",
-               OP0_TRANSMIT, SR0_NO_RESULT);
-
-  /* Make sure the watchdog will keep quiet for a while */
-  dev->trans_start = jiffies;
-
-  /* Keep stats up to date */
-  dev->stats.tx_bytes += length;
-
-  spin_unlock_irqrestore(&lp->spinlock, flags);
-
-#ifdef DEBUG_TX_INFO
-  wv_packet_info((u_char *) buf, length, dev->name, "wv_packet_write");
-#endif  /* DEBUG_TX_INFO */
-
-#ifdef DEBUG_TX_TRACE
-  printk(KERN_DEBUG "%s: <-wv_packet_write()\n", dev->name);
-#endif
-}
-
-/*------------------------------------------------------------------*/
-/*
- * This routine is called when we want to send a packet (NET3 callback)
- * In this routine, we check if the harware is ready to accept
- * the packet. We also prevent reentrance. Then, we call the function
- * to send the packet...
- */
-static netdev_tx_t
-wavelan_packet_xmit(struct sk_buff *    skb,
-                    struct net_device *         dev)
-{
-  net_local *           lp = netdev_priv(dev);
-  unsigned long         flags;
-
-#ifdef DEBUG_TX_TRACE
-  printk(KERN_DEBUG "%s: ->wavelan_packet_xmit(0x%X)\n", dev->name,
-         (unsigned) skb);
-#endif
-
-  /*
-   * Block a timer-based transmit from overlapping a previous transmit.
-   * In other words, prevent reentering this routine.
-   */
-  netif_stop_queue(dev);
-
-  /* If somebody has asked to reconfigure the controller,
-   * we can do it now */
-  if(lp->reconfig_82593)
-    {
-      spin_lock_irqsave(&lp->spinlock, flags);  /* Disable interrupts */
-      wv_82593_config(dev);
-      spin_unlock_irqrestore(&lp->spinlock, flags);     /* Re-enable interrupts */
-      /* Note : the configure procedure was totally synchronous,
-       * so the Tx buffer is now free */
-    }
-
-        /* Check if we need some padding */
-        /* Note : on wireless the propagation time is in the order of 1us,
-         * and we don't have the Ethernet specific requirement of beeing
-         * able to detect collisions, therefore in theory we don't really
-         * need to pad. Jean II */
-        if (skb_padto(skb, ETH_ZLEN))
-                return NETDEV_TX_OK;
-
-  wv_packet_write(dev, skb->data, skb->len);
-
-  dev_kfree_skb(skb);
-
-#ifdef DEBUG_TX_TRACE
-  printk(KERN_DEBUG "%s: <-wavelan_packet_xmit()\n", dev->name);
-#endif
-  return NETDEV_TX_OK;
-}
-
-/********************** HARDWARE CONFIGURATION **********************/
-/*
- * This part do the real job of starting and configuring the hardware.
- */
-
-/*------------------------------------------------------------------*/
-/*
- * Routine to initialize the Modem Management Controller.
- * (called by wv_hw_config())
- */
-static int
-wv_mmc_init(struct net_device * dev)
-{
-  unsigned int  base = dev->base_addr;
-  psa_t         psa;
-  mmw_t         m;
-  int           configured;
-  int           i;              /* Loop counter */
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: ->wv_mmc_init()\n", dev->name);
-#endif
-
-  /* Read the parameter storage area */
-  psa_read(dev, 0, (unsigned char *) &psa, sizeof(psa));
-
-  /*
-   * Check the first three octets of the MAC addr for the manufacturer's code.
-   * Note: If you get the error message below, you've got a
-   * non-NCR/AT&T/Lucent PCMCIA cards, see wavelan_cs.h for detail on
-   * how to configure your card...
-   */
-  for (i = 0; i < ARRAY_SIZE(MAC_ADDRESSES); i++)
-    if ((psa.psa_univ_mac_addr[0] == MAC_ADDRESSES[i][0]) &&
-        (psa.psa_univ_mac_addr[1] == MAC_ADDRESSES[i][1]) &&
-        (psa.psa_univ_mac_addr[2] == MAC_ADDRESSES[i][2]))
-      break;
-
-  /* If we have not found it... */
-  if (i == ARRAY_SIZE(MAC_ADDRESSES))
-    {
-#ifdef DEBUG_CONFIG_ERRORS
-      printk(KERN_WARNING "%s: wv_mmc_init(): Invalid MAC address: %02X:%02X:%02X:...\n",
-             dev->name, psa.psa_univ_mac_addr[0],
-             psa.psa_univ_mac_addr[1], psa.psa_univ_mac_addr[2]);
-#endif
-      return FALSE;
-    }
-
-  /* Get the MAC address */
-  memcpy(&dev->dev_addr[0], &psa.psa_univ_mac_addr[0], WAVELAN_ADDR_SIZE);
-
-#ifdef USE_PSA_CONFIG
-  configured = psa.psa_conf_status & 1;
-#else
-  configured = 0;
-#endif
-
-  /* Is the PSA is not configured */
-  if(!configured)
-    {
-      /* User will be able to configure NWID after (with iwconfig) */
-      psa.psa_nwid[0] = 0;
-      psa.psa_nwid[1] = 0;
-
-      /* As NWID is not set : no NWID checking */
-      psa.psa_nwid_select = 0;
-
-      /* Disable encryption */
-      psa.psa_encryption_select = 0;
-
-      /* Set to standard values
-       * 0x04 for AT,
-       * 0x01 for MCA,
-       * 0x04 for PCMCIA and 2.00 card (AT&T 407-024689/E document)
-       */
-      if (psa.psa_comp_number & 1)
-        psa.psa_thr_pre_set = 0x01;
-      else
-        psa.psa_thr_pre_set = 0x04;
-      psa.psa_quality_thr = 0x03;
-
-      /* It is configured */
-      psa.psa_conf_status |= 1;
-
-#ifdef USE_PSA_CONFIG
-      /* Write the psa */
-      psa_write(dev, (char *)psa.psa_nwid - (char *)&psa,
-                (unsigned char *)psa.psa_nwid, 4);
-      psa_write(dev, (char *)&psa.psa_thr_pre_set - (char *)&psa,
-                (unsigned char *)&psa.psa_thr_pre_set, 1);
-      psa_write(dev, (char *)&psa.psa_quality_thr - (char *)&psa,
-                (unsigned char *)&psa.psa_quality_thr, 1);
-      psa_write(dev, (char *)&psa.psa_conf_status - (char *)&psa,
-                (unsigned char *)&psa.psa_conf_status, 1);
-      /* update the Wavelan checksum */
-      update_psa_checksum(dev);
-#endif  /* USE_PSA_CONFIG */
-    }
-
-  /* Zero the mmc structure */
-  memset(&m, 0x00, sizeof(m));
-
-  /* Copy PSA info to the mmc */
-  m.mmw_netw_id_l = psa.psa_nwid[1];
-  m.mmw_netw_id_h = psa.psa_nwid[0];
-  
-  if(psa.psa_nwid_select & 1)
-    m.mmw_loopt_sel = 0x00;
-  else
-    m.mmw_loopt_sel = MMW_LOOPT_SEL_DIS_NWID;
-
-  memcpy(&m.mmw_encr_key, &psa.psa_encryption_key, 
-         sizeof(m.mmw_encr_key));
-
-  if(psa.psa_encryption_select)
-    m.mmw_encr_enable = MMW_ENCR_ENABLE_EN | MMW_ENCR_ENABLE_MODE;
-  else
-    m.mmw_encr_enable = 0;
-
-  m.mmw_thr_pre_set = psa.psa_thr_pre_set & 0x3F;
-  m.mmw_quality_thr = psa.psa_quality_thr & 0x0F;
-
-  /*
-   * Set default modem control parameters.
-   * See NCR document 407-0024326 Rev. A.
-   */
-  m.mmw_jabber_enable = 0x01;
-  m.mmw_anten_sel = MMW_ANTEN_SEL_ALG_EN;
-  m.mmw_ifs = 0x20;
-  m.mmw_mod_delay = 0x04;
-  m.mmw_jam_time = 0x38;
-
-  m.mmw_des_io_invert = 0;
-  m.mmw_freeze = 0;
-  m.mmw_decay_prm = 0;
-  m.mmw_decay_updat_prm = 0;
-
-  /* Write all info to mmc */
-  mmc_write(base, 0, (u_char *)&m, sizeof(m));
-
-  /* The following code start the modem of the 2.00 frequency
-   * selectable cards at power on. It's not strictly needed for the
-   * following boots...
-   * The original patch was by Joe Finney for the PCMCIA driver, but
-   * I've cleaned it a bit and add documentation.
-   * Thanks to Loeke Brederveld from Lucent for the info.
-   */
-
-  /* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable)
-   * (does it work for everybody ? - especially old cards...) */
-  /* Note : WFREQSEL verify that it is able to read from EEprom
-   * a sensible frequency (address 0x00) + that MMR_FEE_STATUS_ID
-   * is 0xA (Xilinx version) or 0xB (Ariadne version).
-   * My test is more crude but do work... */
-  if(!(mmc_in(base, mmroff(0, mmr_fee_status)) &
-       (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY)))
-    {
-      /* We must download the frequency parameters to the
-       * synthetisers (from the EEprom - area 1)
-       * Note : as the EEprom is auto decremented, we set the end
-       * if the area... */
-      m.mmw_fee_addr = 0x0F;
-      m.mmw_fee_ctrl = MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD;
-      mmc_write(base, (char *)&m.mmw_fee_ctrl - (char *)&m,
-                (unsigned char *)&m.mmw_fee_ctrl, 2);
-
-      /* Wait until the download is finished */
-      fee_wait(base, 100, 100);
-
-#ifdef DEBUG_CONFIG_INFO
-      /* The frequency was in the last word downloaded... */
-      mmc_read(base, (char *)&m.mmw_fee_data_l - (char *)&m,
-               (unsigned char *)&m.mmw_fee_data_l, 2);
-
-      /* Print some info for the user */
-      printk(KERN_DEBUG "%s: Wavelan 2.00 recognised (frequency select) : Current frequency = %ld\n",
-             dev->name,
-             ((m.mmw_fee_data_h << 4) |
-              (m.mmw_fee_data_l >> 4)) * 5 / 2 + 24000L);
-#endif
-
-      /* We must now download the power adjust value (gain) to
-       * the synthetisers (from the EEprom - area 7 - DAC) */
-      m.mmw_fee_addr = 0x61;
-      m.mmw_fee_ctrl = MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD;
-      mmc_write(base, (char *)&m.mmw_fee_ctrl - (char *)&m,
-                (unsigned char *)&m.mmw_fee_ctrl, 2);
-
-      /* Wait until the download is finished */
-    }   /* if 2.00 card */
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: <-wv_mmc_init()\n", dev->name);
-#endif
-  return TRUE;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Routine to gracefully turn off reception, and wait for any commands
- * to complete.
- * (called in wv_ru_start() and wavelan_close() and wavelan_event())
- */
-static int
-wv_ru_stop(struct net_device *  dev)
-{
-  unsigned int  base = dev->base_addr;
-  net_local *   lp = netdev_priv(dev);
-  unsigned long flags;
-  int           status;
-  int           spin;
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: ->wv_ru_stop()\n", dev->name);
-#endif
-
-  spin_lock_irqsave(&lp->spinlock, flags);
-
-  /* First, send the LAN controller a stop receive command */
-  wv_82593_cmd(dev, "wv_graceful_shutdown(): stop-rcv",
-               OP0_STOP_RCV, SR0_NO_RESULT);
-
-  /* Then, spin until the receive unit goes idle */
-  spin = 300;
-  do
-    {
-      udelay(10);
-      outb(OP0_NOP | CR0_STATUS_3, LCCR(base));
-      status = inb(LCSR(base));
-    }
-  while(((status & SR3_RCV_STATE_MASK) != SR3_RCV_IDLE) && (spin-- > 0));
-
-  /* Now, spin until the chip finishes executing its current command */
-  do
-    {
-      udelay(10);
-      outb(OP0_NOP | CR0_STATUS_3, LCCR(base));
-      status = inb(LCSR(base));
-    }
-  while(((status & SR3_EXEC_STATE_MASK) != SR3_EXEC_IDLE) && (spin-- > 0));
-
-  spin_unlock_irqrestore(&lp->spinlock, flags);
-
-  /* If there was a problem */
-  if(spin <= 0)
-    {
-#ifdef DEBUG_CONFIG_ERRORS
-      printk(KERN_INFO "%s: wv_ru_stop(): The chip doesn't want to stop...\n",
-             dev->name);
-#endif
-      return FALSE;
-    }
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: <-wv_ru_stop()\n", dev->name);
-#endif
-  return TRUE;
-} /* wv_ru_stop */
-
-/*------------------------------------------------------------------*/
-/*
- * This routine starts the receive unit running.  First, it checks if
- * the card is actually ready. Then the card is instructed to receive
- * packets again.
- * (called in wv_hw_reset() & wavelan_open())
- */
-static int
-wv_ru_start(struct net_device * dev)
-{
-  unsigned int  base = dev->base_addr;
-  net_local *   lp = netdev_priv(dev);
-  unsigned long flags;
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: ->wv_ru_start()\n", dev->name);
-#endif
-
-  /*
-   * We need to start from a quiescent state. To do so, we could check
-   * if the card is already running, but instead we just try to shut
-   * it down. First, we disable reception (in case it was already enabled).
-   */
-  if(!wv_ru_stop(dev))
-    return FALSE;
-
-  spin_lock_irqsave(&lp->spinlock, flags);
-
-  /* Now we know that no command is being executed. */
-
-  /* Set the receive frame pointer and stop pointer */
-  lp->rfp = 0;
-  outb(OP0_SWIT_TO_PORT_1 | CR0_CHNL, LCCR(base));
-
-  /* Reset ring management.  This sets the receive frame pointer to 1 */
-  outb(OP1_RESET_RING_MNGMT, LCCR(base));
-
-#if 0
-  /* XXX the i82593 manual page 6-4 seems to indicate that the stop register
-     should be set as below */
-  /* outb(CR1_STOP_REG_UPDATE|((RX_SIZE - 0x40)>> RX_SIZE_SHIFT),LCCR(base));*/
-#elif 0
-  /* but I set it 0 instead */
-  lp->stop = 0;
-#else
-  /* but I set it to 3 bytes per packet less than 8K */
-  lp->stop = (0 + RX_SIZE - ((RX_SIZE / 64) * 3)) % RX_SIZE;
-#endif
-  outb(CR1_STOP_REG_UPDATE | (lp->stop >> RX_SIZE_SHIFT), LCCR(base));
-  outb(OP1_INT_ENABLE, LCCR(base));
-  outb(OP1_SWIT_TO_PORT_0, LCCR(base));
-
-  /* Reset receive DMA pointer */
-  hacr_write_slow(base, HACR_PWR_STAT | HACR_TX_DMA_RESET);
-  hacr_write_slow(base, HACR_DEFAULT);
-
-  /* Receive DMA on channel 1 */
-  wv_82593_cmd(dev, "wv_ru_start(): rcv-enable",
-               CR0_CHNL | OP0_RCV_ENABLE, SR0_NO_RESULT);
-
-#ifdef DEBUG_I82593_SHOW
-  {
-    int status;
-    int opri;
-    int spin = 10000;
-
-    /* spin until the chip starts receiving */
-    do
-      {
-        outb(OP0_NOP | CR0_STATUS_3, LCCR(base));
-        status = inb(LCSR(base));
-        if(spin-- <= 0)
-          break;
-      }
-    while(((status & SR3_RCV_STATE_MASK) != SR3_RCV_ACTIVE) &&
-          ((status & SR3_RCV_STATE_MASK) != SR3_RCV_READY));
-    printk(KERN_DEBUG "rcv status is 0x%x [i:%d]\n",
-           (status & SR3_RCV_STATE_MASK), i);
-  }
-#endif
-
-  spin_unlock_irqrestore(&lp->spinlock, flags);
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: <-wv_ru_start()\n", dev->name);
-#endif
-  return TRUE;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * This routine does a standard config of the WaveLAN controller (i82593).
- * In the ISA driver, this is integrated in wavelan_hardware_reset()
- * (called by wv_hw_config(), wv_82593_reconfig() & wavelan_packet_xmit())
- */
-static int
-wv_82593_config(struct net_device *     dev)
-{
-  unsigned int                  base = dev->base_addr;
-  net_local *                   lp = netdev_priv(dev);
-  struct i82593_conf_block      cfblk;
-  int                           ret = TRUE;
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: ->wv_82593_config()\n", dev->name);
-#endif
-
-  /* Create & fill i82593 config block
-   *
-   * Now conform to Wavelan document WCIN085B
-   */
-  memset(&cfblk, 0x00, sizeof(struct i82593_conf_block));
-  cfblk.d6mod = FALSE;          /* Run in i82593 advanced mode */
-  cfblk.fifo_limit = 5;         /* = 56 B rx and 40 B tx fifo thresholds */
-  cfblk.forgnesi = FALSE;       /* 0=82C501, 1=AMD7992B compatibility */
-  cfblk.fifo_32 = 1;
-  cfblk.throttle_enb = FALSE;
-  cfblk.contin = TRUE;          /* enable continuous mode */
-  cfblk.cntrxint = FALSE;       /* enable continuous mode receive interrupts */
-  cfblk.addr_len = WAVELAN_ADDR_SIZE;
-  cfblk.acloc = TRUE;           /* Disable source addr insertion by i82593 */
-  cfblk.preamb_len = 0;         /* 2 bytes preamble (SFD) */
-  cfblk.loopback = FALSE;
-  cfblk.lin_prio = 0;           /* conform to 802.3 backoff algorithm */
-  cfblk.exp_prio = 5;           /* conform to 802.3 backoff algorithm */
-  cfblk.bof_met = 1;            /* conform to 802.3 backoff algorithm */
-  cfblk.ifrm_spc = 0x20 >> 4;   /* 32 bit times interframe spacing */
-  cfblk.slottim_low = 0x20 >> 5;        /* 32 bit times slot time */
-  cfblk.slottim_hi = 0x0;
-  cfblk.max_retr = 15;
-  cfblk.prmisc = ((lp->promiscuous) ? TRUE: FALSE);     /* Promiscuous mode */
-  cfblk.bc_dis = FALSE;         /* Enable broadcast reception */
-  cfblk.crs_1 = TRUE;           /* Transmit without carrier sense */
-  cfblk.nocrc_ins = FALSE;      /* i82593 generates CRC */      
-  cfblk.crc_1632 = FALSE;       /* 32-bit Autodin-II CRC */
-  cfblk.crs_cdt = FALSE;        /* CD not to be interpreted as CS */
-  cfblk.cs_filter = 0;          /* CS is recognized immediately */
-  cfblk.crs_src = FALSE;        /* External carrier sense */
-  cfblk.cd_filter = 0;          /* CD is recognized immediately */
-  cfblk.min_fr_len = ETH_ZLEN >> 2;     /* Minimum frame length 64 bytes */
-  cfblk.lng_typ = FALSE;        /* Length field > 1500 = type field */
-  cfblk.lng_fld = TRUE;         /* Disable 802.3 length field check */
-  cfblk.rxcrc_xf = TRUE;        /* Don't transfer CRC to memory */
-  cfblk.artx = TRUE;            /* Disable automatic retransmission */
-  cfblk.sarec = TRUE;           /* Disable source addr trig of CD */
-  cfblk.tx_jabber = TRUE;       /* Disable jabber jam sequence */
-  cfblk.hash_1 = FALSE;         /* Use bits 0-5 in mc address hash */
-  cfblk.lbpkpol = TRUE;         /* Loopback pin active high */
-  cfblk.fdx = FALSE;            /* Disable full duplex operation */
-  cfblk.dummy_6 = 0x3f;         /* all ones */
-  cfblk.mult_ia = FALSE;        /* No multiple individual addresses */
-  cfblk.dis_bof = FALSE;        /* Disable the backoff algorithm ?! */
-  cfblk.dummy_1 = TRUE;         /* set to 1 */
-  cfblk.tx_ifs_retrig = 3;      /* Hmm... Disabled */
-#ifdef MULTICAST_ALL
-  cfblk.mc_all = (lp->allmulticast ? TRUE: FALSE);      /* Allow all multicasts */
-#else
-  cfblk.mc_all = FALSE;         /* No multicast all mode */
-#endif
-  cfblk.rcv_mon = 0;            /* Monitor mode disabled */
-  cfblk.frag_acpt = TRUE;       /* Do not accept fragments */
-  cfblk.tstrttrs = FALSE;       /* No start transmission threshold */
-  cfblk.fretx = TRUE;           /* FIFO automatic retransmission */
-  cfblk.syncrqs = FALSE;        /* Synchronous DRQ deassertion... */
-  cfblk.sttlen = TRUE;          /* 6 byte status registers */
-  cfblk.rx_eop = TRUE;          /* Signal EOP on packet reception */
-  cfblk.tx_eop = TRUE;          /* Signal EOP on packet transmission */
-  cfblk.rbuf_size = RX_SIZE>>11;        /* Set receive buffer size */
-  cfblk.rcvstop = TRUE;         /* Enable Receive Stop Register */
-
-#ifdef DEBUG_I82593_SHOW
-  print_hex_dump(KERN_DEBUG, "wavelan_cs: config block: ", DUMP_PREFIX_NONE,
-                 16, 1, &cfblk, sizeof(struct i82593_conf_block), false);
-#endif
-
-  /* Copy the config block to the i82593 */
-  outb(TX_BASE & 0xff, PIORL(base));
-  outb(((TX_BASE >> 8) & PIORH_MASK) | PIORH_SEL_TX, PIORH(base));
-  outb(sizeof(struct i82593_conf_block) & 0xff, PIOP(base));    /* lsb */
-  outb(sizeof(struct i82593_conf_block) >> 8, PIOP(base));      /* msb */
-  outsb(PIOP(base), (char *) &cfblk, sizeof(struct i82593_conf_block));
-
-  /* reset transmit DMA pointer */
-  hacr_write_slow(base, HACR_PWR_STAT | HACR_TX_DMA_RESET);
-  hacr_write(base, HACR_DEFAULT);
-  if(!wv_82593_cmd(dev, "wv_82593_config(): configure",
-                   OP0_CONFIGURE, SR0_CONFIGURE_DONE))
-    ret = FALSE;
-
-  /* Initialize adapter's ethernet MAC address */
-  outb(TX_BASE & 0xff, PIORL(base));
-  outb(((TX_BASE >> 8) & PIORH_MASK) | PIORH_SEL_TX, PIORH(base));
-  outb(WAVELAN_ADDR_SIZE, PIOP(base));  /* byte count lsb */
-  outb(0, PIOP(base));                  /* byte count msb */
-  outsb(PIOP(base), &dev->dev_addr[0], WAVELAN_ADDR_SIZE);
-
-  /* reset transmit DMA pointer */
-  hacr_write_slow(base, HACR_PWR_STAT | HACR_TX_DMA_RESET);
-  hacr_write(base, HACR_DEFAULT);
-  if(!wv_82593_cmd(dev, "wv_82593_config(): ia-setup",
-                   OP0_IA_SETUP, SR0_IA_SETUP_DONE))
-    ret = FALSE;
-
-#ifdef WAVELAN_ROAMING
-    /* If roaming is enabled, join the "Beacon Request" multicast group... */
-    /* But only if it's not in there already! */
-  if(do_roaming)
-    dev_mc_add(dev,WAVELAN_BEACON_ADDRESS, WAVELAN_ADDR_SIZE, 1);
-#endif  /* WAVELAN_ROAMING */
-
-  /* If any multicast address to set */
-  if(lp->mc_count)
-    {
-      struct dev_mc_list *      dmi;
-      int                       addrs_len = WAVELAN_ADDR_SIZE * lp->mc_count;
-
-#ifdef DEBUG_CONFIG_INFO
-      printk(KERN_DEBUG "%s: wv_hw_config(): set %d multicast addresses:\n",
-             dev->name, lp->mc_count);
-      for(dmi=dev->mc_list; dmi; dmi=dmi->next)
-        printk(KERN_DEBUG " %pM\n", dmi->dmi_addr);
-#endif
-
-      /* Initialize adapter's ethernet multicast addresses */
-      outb(TX_BASE & 0xff, PIORL(base));
-      outb(((TX_BASE >> 8) & PIORH_MASK) | PIORH_SEL_TX, PIORH(base));
-      outb(addrs_len & 0xff, PIOP(base));       /* byte count lsb */
-      outb((addrs_len >> 8), PIOP(base));       /* byte count msb */
-      for(dmi=dev->mc_list; dmi; dmi=dmi->next)
-        outsb(PIOP(base), dmi->dmi_addr, dmi->dmi_addrlen);
-
-      /* reset transmit DMA pointer */
-      hacr_write_slow(base, HACR_PWR_STAT | HACR_TX_DMA_RESET);
-      hacr_write(base, HACR_DEFAULT);
-      if(!wv_82593_cmd(dev, "wv_82593_config(): mc-setup",
-                       OP0_MC_SETUP, SR0_MC_SETUP_DONE))
-        ret = FALSE;
-      lp->mc_count = dev->mc_count;     /* remember to avoid repeated reset */
-    }
-
-  /* Job done, clear the flag */
-  lp->reconfig_82593 = FALSE;
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: <-wv_82593_config()\n", dev->name);
-#endif
-  return(ret);
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Read the Access Configuration Register, perform a software reset,
- * and then re-enable the card's software.
- *
- * If I understand correctly : reset the pcmcia interface of the
- * wavelan.
- * (called by wv_config())
- */
-static int
-wv_pcmcia_reset(struct net_device *     dev)
-{
-  int           i;
-  conf_reg_t    reg = { 0, CS_READ, CISREG_COR, 0 };
-  struct pcmcia_device *        link = ((net_local *)netdev_priv(dev))->link;
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: ->wv_pcmcia_reset()\n", dev->name);
-#endif
-
-  i = pcmcia_access_configuration_register(link, &reg);
-  if (i != 0)
-    {
-      cs_error(link, AccessConfigurationRegister, i);
-      return FALSE;
-    }
-      
-#ifdef DEBUG_CONFIG_INFO
-  printk(KERN_DEBUG "%s: wavelan_pcmcia_reset(): Config reg is 0x%x\n",
-         dev->name, (u_int) reg.Value);
-#endif
-
-  reg.Action = CS_WRITE;
-  reg.Value = reg.Value | COR_SW_RESET;
-  i = pcmcia_access_configuration_register(link, &reg);
-  if (i != 0)
-    {
-      cs_error(link, AccessConfigurationRegister, i);
-      return FALSE;
-    }
-      
-  reg.Action = CS_WRITE;
-  reg.Value = COR_LEVEL_IRQ | COR_CONFIG;
-  i = pcmcia_access_configuration_register(link, &reg);
-  if (i != 0)
-    {
-      cs_error(link, AccessConfigurationRegister, i);
-      return FALSE;
-    }
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: <-wv_pcmcia_reset()\n", dev->name);
-#endif
-  return TRUE;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * wavelan_hw_config() is called after a CARD_INSERTION event is
- * received, to configure the wavelan hardware.
- * Note that the reception will be enabled in wavelan->open(), so the
- * device is configured but idle...
- * Performs the following actions:
- *      1. A pcmcia software reset (using wv_pcmcia_reset())
- *      2. A power reset (reset DMA)
- *      3. Reset the LAN controller
- *      4. Initialize the radio modem (using wv_mmc_init)
- *      5. Configure LAN controller (using wv_82593_config)
- *      6. Perform a diagnostic on the LAN controller
- * (called by wavelan_event() & wv_hw_reset())
- */
-static int
-wv_hw_config(struct net_device *        dev)
-{
-  net_local *           lp = netdev_priv(dev);
-  unsigned int          base = dev->base_addr;
-  unsigned long         flags;
-  int                   ret = FALSE;
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: ->wv_hw_config()\n", dev->name);
-#endif
-
-  /* compile-time check the sizes of structures */
-  BUILD_BUG_ON(sizeof(psa_t) != PSA_SIZE);
-  BUILD_BUG_ON(sizeof(mmw_t) != MMW_SIZE);
-  BUILD_BUG_ON(sizeof(mmr_t) != MMR_SIZE);
-
-  /* Reset the pcmcia interface */
-  if(wv_pcmcia_reset(dev) == FALSE)
-    return FALSE;
-
-  /* Disable interrupts */
-  spin_lock_irqsave(&lp->spinlock, flags);
-
-  /* Disguised goto ;-) */
-  do
-    {
-      /* Power UP the module + reset the modem + reset host adapter
-       * (in fact, reset DMA channels) */
-      hacr_write_slow(base, HACR_RESET);
-      hacr_write(base, HACR_DEFAULT);
-
-      /* Check if the module has been powered up... */
-      if(hasr_read(base) & HASR_NO_CLK)
-        {
-#ifdef DEBUG_CONFIG_ERRORS
-          printk(KERN_WARNING "%s: wv_hw_config(): modem not connected or not a wavelan card\n",
-                 dev->name);
-#endif
-          break;
-        }
-
-      /* initialize the modem */
-      if(wv_mmc_init(dev) == FALSE)
-        {
-#ifdef DEBUG_CONFIG_ERRORS
-          printk(KERN_WARNING "%s: wv_hw_config(): Can't configure the modem\n",
-                 dev->name);
-#endif
-          break;
-        }
-
-      /* reset the LAN controller (i82593) */
-      outb(OP0_RESET, LCCR(base));
-      mdelay(1);        /* A bit crude ! */
-
-      /* Initialize the LAN controller */
-      if(wv_82593_config(dev) == FALSE)
-        {
-#ifdef DEBUG_CONFIG_ERRORS
-          printk(KERN_INFO "%s: wv_hw_config(): i82593 init failed\n",
-                 dev->name);
-#endif
-          break;
-        }
-
-      /* Diagnostic */
-      if(wv_diag(dev) == FALSE)
-        {
-#ifdef DEBUG_CONFIG_ERRORS
-          printk(KERN_INFO "%s: wv_hw_config(): i82593 diagnostic failed\n",
-                 dev->name);
-#endif
-          break;
-        }
-
-      /* 
-       * insert code for loopback test here
-       */
-
-      /* The device is now configured */
-      lp->configured = 1;
-      ret = TRUE;
-    }
-  while(0);
-
-  /* Re-enable interrupts */
-  spin_unlock_irqrestore(&lp->spinlock, flags);
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: <-wv_hw_config()\n", dev->name);
-#endif
-  return(ret);
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Totally reset the wavelan and restart it.
- * Performs the following actions:
- *      1. Call wv_hw_config()
- *      2. Start the LAN controller's receive unit
- * (called by wavelan_event(), wavelan_watchdog() and wavelan_open())
- */
-static void
-wv_hw_reset(struct net_device * dev)
-{
-  net_local *   lp = netdev_priv(dev);
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: ->wv_hw_reset()\n", dev->name);
-#endif
-
-  lp->nresets++;
-  lp->configured = 0;
-  
-  /* Call wv_hw_config() for most of the reset & init stuff */
-  if(wv_hw_config(dev) == FALSE)
-    return;
-
-  /* start receive unit */
-  wv_ru_start(dev);
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: <-wv_hw_reset()\n", dev->name);
-#endif
-}
-
-/*------------------------------------------------------------------*/
-/*
- * wv_pcmcia_config() is called after a CARD_INSERTION event is
- * received, to configure the PCMCIA socket, and to make the ethernet
- * device available to the system.
- * (called by wavelan_event())
- */
-static int
-wv_pcmcia_config(struct pcmcia_device * link)
-{
-  struct net_device *   dev = (struct net_device *) link->priv;
-  int                   i;
-  win_req_t             req;
-  memreq_t              mem;
-  net_local *           lp = netdev_priv(dev);
-
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "->wv_pcmcia_config(0x%p)\n", link);
-#endif
-
-  do
-    {
-      i = pcmcia_request_io(link, &link->io);
-      if (i != 0)
-        {
-          cs_error(link, RequestIO, i);
-          break;
-        }
-
-      /*
-       * Now allocate an interrupt line.  Note that this does not
-       * actually assign a handler to the interrupt.
-       */
-      i = pcmcia_request_irq(link, &link->irq);
-      if (i != 0)
-        {
-          cs_error(link, RequestIRQ, i);
-          break;
-        }
-
-      /*
-       * This actually configures the PCMCIA socket -- setting up
-       * the I/O windows and the interrupt mapping.
-       */
-      link->conf.ConfigIndex = 1;
-      i = pcmcia_request_configuration(link, &link->conf);
-      if (i != 0)
-        {
-          cs_error(link, RequestConfiguration, i);
-          break;
-        }
-
-      /*
-       * Allocate a small memory window.  Note that the struct pcmcia_device
-       * structure provides space for one window handle -- if your
-       * device needs several windows, you'll need to keep track of
-       * the handles in your private data structure, link->priv.
-       */
-      req.Attributes = WIN_DATA_WIDTH_8|WIN_MEMORY_TYPE_AM|WIN_ENABLE;
-      req.Base = req.Size = 0;
-      req.AccessSpeed = mem_speed;
-      i = pcmcia_request_window(&link, &req, &link->win);
-      if (i != 0)
-        {
-          cs_error(link, RequestWindow, i);
-          break;
-        }
-
-      lp->mem = ioremap(req.Base, req.Size);
-      dev->mem_start = (u_long)lp->mem;
-      dev->mem_end = dev->mem_start + req.Size;
-
-      mem.CardOffset = 0; mem.Page = 0;
-      i = pcmcia_map_mem_page(link->win, &mem);
-      if (i != 0)
-        {
-          cs_error(link, MapMemPage, i);
-          break;
-        }
-
-      /* Feed device with this info... */
-      dev->irq = link->irq.AssignedIRQ;
-      dev->base_addr = link->io.BasePort1;
-      netif_start_queue(dev);
-
-#ifdef DEBUG_CONFIG_INFO
-      printk(KERN_DEBUG "wv_pcmcia_config: MEMSTART %p IRQ %d IOPORT 0x%x\n",
-             lp->mem, dev->irq, (u_int) dev->base_addr);
-#endif
-
-      SET_NETDEV_DEV(dev, &handle_to_dev(link));
-      i = register_netdev(dev);
-      if(i != 0)
-        {
-#ifdef DEBUG_CONFIG_ERRORS
-          printk(KERN_INFO "wv_pcmcia_config(): register_netdev() failed\n");
-#endif
-          break;
-        }
-    }
-  while(0);             /* Humm... Disguised goto !!! */
-
-  /* If any step failed, release any partially configured state */
-  if(i != 0)
-    {
-      wv_pcmcia_release(link);
-      return FALSE;
-    }
-
-  strcpy(((net_local *) netdev_priv(dev))->node.dev_name, dev->name);
-  link->dev_node = &((net_local *) netdev_priv(dev))->node;
-
-#ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "<-wv_pcmcia_config()\n");
-#endif
-  return TRUE;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * After a card is removed, wv_pcmcia_release() will unregister the net
- * device, and release the PCMCIA configuration.  If the device is
- * still open, this will be postponed until it is closed.
- */
-static void
-wv_pcmcia_release(struct pcmcia_device *link)
-{
-        struct net_device *     dev = (struct net_device *) link->priv;
-        net_local *             lp = netdev_priv(dev);
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: -> wv_pcmcia_release(0x%p)\n", dev->name, link);
-#endif
-
-        iounmap(lp->mem);
-        pcmcia_disable_device(link);
-
-#ifdef DEBUG_CONFIG_TRACE
-        printk(KERN_DEBUG "%s: <- wv_pcmcia_release()\n", dev->name);
-#endif
-}
-
-/************************ INTERRUPT HANDLING ************************/
-
-/*
- * This function is the interrupt handler for the WaveLAN card. This
- * routine will be called whenever: 
- *      1. A packet is received.
- *      2. A packet has successfully been transferred and the unit is
- *         ready to transmit another packet.
- *      3. A command has completed execution.
- */
-static irqreturn_t
-wavelan_interrupt(int           irq,
-                  void *        dev_id)
-{
-  struct net_device *   dev = dev_id;
-  net_local *   lp;
-  unsigned int  base;
-  int           status0;
-  u_int         tx_status;
-
-#ifdef DEBUG_INTERRUPT_TRACE
-  printk(KERN_DEBUG "%s: ->wavelan_interrupt()\n", dev->name);
-#endif
-
-  lp = netdev_priv(dev);
-  base = dev->base_addr;
-
-#ifdef DEBUG_INTERRUPT_INFO
-  /* Check state of our spinlock (it should be cleared) */
-  if(spin_is_locked(&lp->spinlock))
-    printk(KERN_DEBUG
-           "%s: wavelan_interrupt(): spinlock is already locked !!!\n",
-           dev->name);
-#endif
-
-  /* Prevent reentrancy. We need to do that because we may have
-   * multiple interrupt handler running concurently.
-   * It is safe because interrupts are disabled before aquiring
-   * the spinlock. */
-  spin_lock(&lp->spinlock);
-
-  /* Treat all pending interrupts */
-  while(1)
-    {
-      /* ---------------- INTERRUPT CHECKING ---------------- */
-      /*
-       * Look for the interrupt and verify the validity
-       */
-      outb(CR0_STATUS_0 | OP0_NOP, LCCR(base));
-      status0 = inb(LCSR(base));
-
-#ifdef DEBUG_INTERRUPT_INFO
-      printk(KERN_DEBUG "status0 0x%x [%s => 0x%x]", status0, 
-             (status0&SR0_INTERRUPT)?"int":"no int",status0&~SR0_INTERRUPT);
-      if(status0&SR0_INTERRUPT)
-        {
-          printk(" [%s => %d]\n", (status0 & SR0_CHNL) ? "chnl" :
-                 ((status0 & SR0_EXECUTION) ? "cmd" :
-                  ((status0 & SR0_RECEPTION) ? "recv" : "unknown")),
-                 (status0 & SR0_EVENT_MASK));
-        }
-      else
-        printk("\n");
-#endif
-
-      /* Return if no actual interrupt from i82593 (normal exit) */
-      if(!(status0 & SR0_INTERRUPT))
-        break;
-
-      /* If interrupt is both Rx and Tx or none...
-       * This code in fact is there to catch the spurious interrupt
-       * when you remove the wavelan pcmcia card from the socket */
-      if(((status0 & SR0_BOTH_RX_TX) == SR0_BOTH_RX_TX) ||
-         ((status0 & SR0_BOTH_RX_TX) == 0x0))
-        {
-#ifdef DEBUG_INTERRUPT_INFO
-          printk(KERN_INFO "%s: wv_interrupt(): bogus interrupt (or from dead card) : %X\n",
-                 dev->name, status0);
-#endif
-          /* Acknowledge the interrupt */
-          outb(CR0_INT_ACK | OP0_NOP, LCCR(base));
-          break;
-        }
-
-      /* ----------------- RECEIVING PACKET ----------------- */
-      /*
-       * When the wavelan signal the reception of a new packet,
-       * we call wv_packet_rcv() to copy if from the buffer and
-       * send it to NET3
-       */
-      if(status0 & SR0_RECEPTION)
-        {
-#ifdef DEBUG_INTERRUPT_INFO
-          printk(KERN_DEBUG "%s: wv_interrupt(): receive\n", dev->name);
-#endif
-
-          if((status0 & SR0_EVENT_MASK) == SR0_STOP_REG_HIT)
-            {
-#ifdef DEBUG_INTERRUPT_ERROR
-              printk(KERN_INFO "%s: wv_interrupt(): receive buffer overflow\n",
-                     dev->name);
-#endif
-              dev->stats.rx_over_errors++;
-              lp->overrunning = 1;
-            }
-
-          /* Get the packet */
-          wv_packet_rcv(dev);
-          lp->overrunning = 0;
-
-          /* Acknowledge the interrupt */
-          outb(CR0_INT_ACK | OP0_NOP, LCCR(base));
-          continue;
-        }
-
-      /* ---------------- COMMAND COMPLETION ---------------- */
-      /*
-       * Interrupts issued when the i82593 has completed a command.
-       * Most likely : transmission done
-       */
-
-      /* If a transmission has been done */
-      if((status0 & SR0_EVENT_MASK) == SR0_TRANSMIT_DONE ||
-         (status0 & SR0_EVENT_MASK) == SR0_RETRANSMIT_DONE ||
-         (status0 & SR0_EVENT_MASK) == SR0_TRANSMIT_NO_CRC_DONE)
-        {
-#ifdef DEBUG_TX_ERROR
-          if((status0 & SR0_EVENT_MASK) == SR0_TRANSMIT_NO_CRC_DONE)
-            printk(KERN_INFO "%s: wv_interrupt(): packet transmitted without CRC.\n",
-                   dev->name);
-#endif
-
-          /* Get transmission status */
-          tx_status = inb(LCSR(base));
-          tx_status |= (inb(LCSR(base)) << 8);
-#ifdef DEBUG_INTERRUPT_INFO
-          printk(KERN_DEBUG "%s: wv_interrupt(): transmission done\n",
-                 dev->name);
-          {
-            u_int       rcv_bytes;
-            u_char      status3;
-            rcv_bytes = inb(LCSR(base));
-            rcv_bytes |= (inb(LCSR(base)) << 8);
-            status3 = inb(LCSR(base));
-            printk(KERN_DEBUG "tx_status 0x%02x rcv_bytes 0x%02x status3 0x%x\n",
-                   tx_status, rcv_bytes, (u_int) status3);
-          }
-#endif
-          /* Check for possible errors */
-          if((tx_status & TX_OK) != TX_OK)
-            {
-              dev->stats.tx_errors++;
-
-              if(tx_status & TX_FRTL)
-                {
-#ifdef DEBUG_TX_ERROR
-                  printk(KERN_INFO "%s: wv_interrupt(): frame too long\n",
-                         dev->name);
-#endif
-                }
-              if(tx_status & TX_UND_RUN)
-                {
-#ifdef DEBUG_TX_FAIL
-                  printk(KERN_DEBUG "%s: wv_interrupt(): DMA underrun\n",
-                         dev->name);
-#endif
-                  dev->stats.tx_aborted_errors++;
-                }
-              if(tx_status & TX_LOST_CTS)
-                {
-#ifdef DEBUG_TX_FAIL
-                  printk(KERN_DEBUG "%s: wv_interrupt(): no CTS\n", dev->name);
-#endif
-                  dev->stats.tx_carrier_errors++;
-                }
-              if(tx_status & TX_LOST_CRS)
-                {
-#ifdef DEBUG_TX_FAIL
-                  printk(KERN_DEBUG "%s: wv_interrupt(): no carrier\n",
-                         dev->name);
-#endif
-                  dev->stats.tx_carrier_errors++;
-                }
-              if(tx_status & TX_HRT_BEAT)
-                {
-#ifdef DEBUG_TX_FAIL
-                  printk(KERN_DEBUG "%s: wv_interrupt(): heart beat\n", dev->name);
-#endif
-                  dev->stats.tx_heartbeat_errors++;
-                }
-              if(tx_status & TX_DEFER)
-                {
-#ifdef DEBUG_TX_FAIL
-                  printk(KERN_DEBUG "%s: wv_interrupt(): channel jammed\n",
-                         dev->name);
-#endif
-                }
-              /* Ignore late collisions since they're more likely to happen
-               * here (the WaveLAN design prevents the LAN controller from
-               * receiving while it is transmitting). We take action only when
-               * the maximum retransmit attempts is exceeded.
-               */
-              if(tx_status & TX_COLL)
-                {
-                  if(tx_status & TX_MAX_COL)
-                    {
-#ifdef DEBUG_TX_FAIL
-                      printk(KERN_DEBUG "%s: wv_interrupt(): channel congestion\n",
-                             dev->name);
-#endif
-                      if(!(tx_status & TX_NCOL_MASK))
-                        {
-                          dev->stats.collisions += 0x10;
-                        }
-                    }
-                }
-            }   /* if(!(tx_status & TX_OK)) */
-
-          dev->stats.collisions += (tx_status & TX_NCOL_MASK);
-          dev->stats.tx_packets++;
-
-          netif_wake_queue(dev);
-          outb(CR0_INT_ACK | OP0_NOP, LCCR(base));      /* Acknowledge the interrupt */
-        } 
-      else      /* if interrupt = transmit done or retransmit done */
-        {
-#ifdef DEBUG_INTERRUPT_ERROR
-          printk(KERN_INFO "wavelan_cs: unknown interrupt, status0 = %02x\n",
-                 status0);
-#endif
-          outb(CR0_INT_ACK | OP0_NOP, LCCR(base));      /* Acknowledge the interrupt */
-        }
-    }   /* while(1) */
-
-  spin_unlock(&lp->spinlock);
-
-#ifdef DEBUG_INTERRUPT_TRACE
-  printk(KERN_DEBUG "%s: <-wavelan_interrupt()\n", dev->name);
-#endif
-
-  /* We always return IRQ_HANDLED, because we will receive empty
-   * interrupts under normal operations. Anyway, it doesn't matter
-   * as we are dealing with an ISA interrupt that can't be shared.
-   *
-   * Explanation : under heavy receive, the following happens :
-   * ->wavelan_interrupt()
-   *    (status0 & SR0_INTERRUPT) != 0
-   *       ->wv_packet_rcv()
-   *    (status0 & SR0_INTERRUPT) != 0
-   *       ->wv_packet_rcv()
-   *    (status0 & SR0_INTERRUPT) == 0  // i.e. no more event
-   * <-wavelan_interrupt()
-   * ->wavelan_interrupt()
-   *    (status0 & SR0_INTERRUPT) == 0  // i.e. empty interrupt
-   * <-wavelan_interrupt()
-   * Jean II */
-  return IRQ_HANDLED;
-} /* wv_interrupt */
-
-/*------------------------------------------------------------------*/
-/*
- * Watchdog: when we start a transmission, a timer is set for us in the
- * kernel.  If the transmission completes, this timer is disabled. If
- * the timer expires, we are called and we try to unlock the hardware.
- *
- * Note : This watchdog is move clever than the one in the ISA driver,
- * because it try to abort the current command before reseting
- * everything...
- * On the other hand, it's a bit simpler, because we don't have to
- * deal with the multiple Tx buffers...
- */
-static void
-wavelan_watchdog(struct net_device *    dev)
-{
-  net_local *           lp = netdev_priv(dev);
-  unsigned int          base = dev->base_addr;
-  unsigned long         flags;
-  int                   aborted = FALSE;
-
-#ifdef DEBUG_INTERRUPT_TRACE
-  printk(KERN_DEBUG "%s: ->wavelan_watchdog()\n", dev->name);
-#endif
-
-#ifdef DEBUG_INTERRUPT_ERROR
-  printk(KERN_INFO "%s: wavelan_watchdog: watchdog timer expired\n",
-         dev->name);
-#endif
-
-  spin_lock_irqsave(&lp->spinlock, flags);
-
-  /* Ask to abort the current command */
-  outb(OP0_ABORT, LCCR(base));
-
-  /* Wait for the end of the command (a bit hackish) */
-  if(wv_82593_cmd(dev, "wavelan_watchdog(): abort",
-                  OP0_NOP | CR0_STATUS_3, SR0_EXECUTION_ABORTED))
-    aborted = TRUE;
-
-  /* Release spinlock here so that wv_hw_reset() can grab it */
-  spin_unlock_irqrestore(&lp->spinlock, flags);
-
-  /* Check if we were successful in aborting it */
-  if(!aborted)
-    {
-      /* It seem that it wasn't enough */
-#ifdef DEBUG_INTERRUPT_ERROR
-      printk(KERN_INFO "%s: wavelan_watchdog: abort failed, trying reset\n",
-             dev->name);
-#endif
-      wv_hw_reset(dev);
-    }
-
-#ifdef DEBUG_PSA_SHOW
-  {
-    psa_t               psa;
-    psa_read(dev, 0, (unsigned char *) &psa, sizeof(psa));
-    wv_psa_show(&psa);
-  }
-#endif
-#ifdef DEBUG_MMC_SHOW
-  wv_mmc_show(dev);
-#endif
-#ifdef DEBUG_I82593_SHOW
-  wv_ru_show(dev);
-#endif
-
-  /* We are no more waiting for something... */
-  netif_wake_queue(dev);
-
-#ifdef DEBUG_INTERRUPT_TRACE
-  printk(KERN_DEBUG "%s: <-wavelan_watchdog()\n", dev->name);
-#endif
-}
-
-/********************* CONFIGURATION CALLBACKS *********************/
-/*
- * Here are the functions called by the pcmcia package (cardmgr) and
- * linux networking (NET3) for initialization, configuration and
- * deinstallations of the Wavelan Pcmcia Hardware.
- */
-
-/*------------------------------------------------------------------*/
-/*
- * Configure and start up the WaveLAN PCMCIA adaptor.
- * Called by NET3 when it "open" the device.
- */
-static int
-wavelan_open(struct net_device *        dev)
-{
-  net_local *   lp = netdev_priv(dev);
-  struct pcmcia_device *        link = lp->link;
-  unsigned int  base = dev->base_addr;
-
-#ifdef DEBUG_CALLBACK_TRACE
-  printk(KERN_DEBUG "%s: ->wavelan_open(dev=0x%x)\n", dev->name,
-         (unsigned int) dev);
-#endif
-
-  /* Check if the modem is powered up (wavelan_close() power it down */
-  if(hasr_read(base) & HASR_NO_CLK)
-    {
-      /* Power up (power up time is 250us) */
-      hacr_write(base, HACR_DEFAULT);
-
-      /* Check if the module has been powered up... */
-      if(hasr_read(base) & HASR_NO_CLK)
-        {
-#ifdef DEBUG_CONFIG_ERRORS
-          printk(KERN_WARNING "%s: wavelan_open(): modem not connected\n",
-                 dev->name);
-#endif
-          return FALSE;
-        }
-    }
-
-  /* Start reception and declare the driver ready */
-  if(!lp->configured)
-    return FALSE;
-  if(!wv_ru_start(dev))
-    wv_hw_reset(dev);           /* If problem : reset */
-  netif_start_queue(dev);
-
-  /* Mark the device as used */
-  link->open++;
-
-#ifdef WAVELAN_ROAMING
-  if(do_roaming)
-    wv_roam_init(dev);
-#endif  /* WAVELAN_ROAMING */
-
-#ifdef DEBUG_CALLBACK_TRACE
-  printk(KERN_DEBUG "%s: <-wavelan_open()\n", dev->name);
-#endif
-  return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Shutdown the WaveLAN PCMCIA adaptor.
- * Called by NET3 when it "close" the device.
- */
-static int
-wavelan_close(struct net_device *       dev)
-{
-  struct pcmcia_device *        link = ((net_local *)netdev_priv(dev))->link;
-  unsigned int  base = dev->base_addr;
-
-#ifdef DEBUG_CALLBACK_TRACE
-  printk(KERN_DEBUG "%s: ->wavelan_close(dev=0x%x)\n", dev->name,
-         (unsigned int) dev);
-#endif
-
-  /* If the device isn't open, then nothing to do */
-  if(!link->open)
-    {
-#ifdef DEBUG_CONFIG_INFO
-      printk(KERN_DEBUG "%s: wavelan_close(): device not open\n", dev->name);
-#endif
-      return 0;
-    }
-
-#ifdef WAVELAN_ROAMING
-  /* Cleanup of roaming stuff... */
-  if(do_roaming)
-    wv_roam_cleanup(dev);
-#endif  /* WAVELAN_ROAMING */
-
-  link->open--;
-
-  /* If the card is still present */
-  if(netif_running(dev))
-    {
-      netif_stop_queue(dev);
-
-      /* Stop receiving new messages and wait end of transmission */
-      wv_ru_stop(dev);
-
-      /* Power down the module */
-      hacr_write(base, HACR_DEFAULT & (~HACR_PWR_STAT));
-    }
-
-#ifdef DEBUG_CALLBACK_TRACE
-  printk(KERN_DEBUG "%s: <-wavelan_close()\n", dev->name);
-#endif
-  return 0;
-}
-
-static const struct net_device_ops wavelan_netdev_ops = {
-        .ndo_open               = wavelan_open,
-        .ndo_stop               = wavelan_close,
-        .ndo_start_xmit         = wavelan_packet_xmit,
-        .ndo_set_multicast_list = wavelan_set_multicast_list,
-#ifdef SET_MAC_ADDRESS
-        .ndo_set_mac_address    = wavelan_set_mac_address,
-#endif
-        .ndo_tx_timeout         = wavelan_watchdog,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_validate_addr      = eth_validate_addr,
-};
-
-/*------------------------------------------------------------------*/
-/*
- * wavelan_attach() creates an "instance" of the driver, allocating
- * local data structures for one device (one interface).  The device
- * is registered with Card Services.
- *
- * The dev_link structure is initialized, but we don't actually
- * configure the card at this point -- we wait until we receive a
- * card insertion event.
- */
-static int
-wavelan_probe(struct pcmcia_device *p_dev)
-{
-  struct net_device *   dev;            /* Interface generic data */
-  net_local *   lp;             /* Interface specific data */
-  int ret;
-
-#ifdef DEBUG_CALLBACK_TRACE
-  printk(KERN_DEBUG "-> wavelan_attach()\n");
-#endif
-
-  /* The io structure describes IO port mapping */
-  p_dev->io.NumPorts1 = 8;
-  p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
-  p_dev->io.IOAddrLines = 3;
-
-  /* Interrupt setup */
-  p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING | IRQ_HANDLE_PRESENT;
-  p_dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
-  p_dev->irq.Handler = wavelan_interrupt;
-
-  /* General socket configuration */
-  p_dev->conf.Attributes = CONF_ENABLE_IRQ;
-  p_dev->conf.IntType = INT_MEMORY_AND_IO;
-
-  /* Allocate the generic data structure */
-  dev = alloc_etherdev(sizeof(net_local));
-  if (!dev)
-      return -ENOMEM;
-
-  p_dev->priv = p_dev->irq.Instance = dev;
-
-  lp = netdev_priv(dev);
-
-  /* Init specific data */
-  lp->configured = 0;
-  lp->reconfig_82593 = FALSE;
-  lp->nresets = 0;
-  /* Multicast stuff */
-  lp->promiscuous = 0;
-  lp->allmulticast = 0;
-  lp->mc_count = 0;
-
-  /* Init spinlock */
-  spin_lock_init(&lp->spinlock);
-
-  /* back links */
-  lp->dev = dev;
-
-  /* wavelan NET3 callbacks */
-  dev->netdev_ops = &wavelan_netdev_ops;
-  dev->watchdog_timeo   = WATCHDOG_JIFFIES;
-  SET_ETHTOOL_OPS(dev, &ops);
-
-  dev->wireless_handlers = &wavelan_handler_def;
-  lp->wireless_data.spy_data = &lp->spy_data;
-  dev->wireless_data = &lp->wireless_data;
-
-  /* Other specific data */
-  dev->mtu = WAVELAN_MTU;
-
-  ret = wv_pcmcia_config(p_dev);
-  if (ret)
-          return ret;
-
-  ret = wv_hw_config(dev);
-  if (ret) {
-          dev->irq = 0;
-          pcmcia_disable_device(p_dev);
-          return ret;
-  }
-
-  wv_init_info(dev);
-
-#ifdef DEBUG_CALLBACK_TRACE
-  printk(KERN_DEBUG "<- wavelan_attach()\n");
-#endif
-
-  return 0;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * This deletes a driver "instance".  The device is de-registered with
- * Card Services.  If it has been released, all local data structures
- * are freed.  Otherwise, the structures will be freed when the device
- * is released.
- */
-static void
-wavelan_detach(struct pcmcia_device *link)
-{
-#ifdef DEBUG_CALLBACK_TRACE
-  printk(KERN_DEBUG "-> wavelan_detach(0x%p)\n", link);
-#endif
-
-  /* Some others haven't done their job : give them another chance */
-  wv_pcmcia_release(link);
-
-  /* Free pieces */
-  if(link->priv)
-    {
-      struct net_device *       dev = (struct net_device *) link->priv;
-
-      /* Remove ourselves from the kernel list of ethernet devices */
-      /* Warning : can't be called from interrupt, timer or wavelan_close() */
-      if (link->dev_node)
-        unregister_netdev(dev);
-      link->dev_node = NULL;
-      ((net_local *)netdev_priv(dev))->link = NULL;
-      ((net_local *)netdev_priv(dev))->dev = NULL;
-      free_netdev(dev);
-    }
-
-#ifdef DEBUG_CALLBACK_TRACE
-  printk(KERN_DEBUG "<- wavelan_detach()\n");
-#endif
-}
-
-static int wavelan_suspend(struct pcmcia_device *link)
-{
-        struct net_device *     dev = (struct net_device *) link->priv;
-
-        /* NB: wavelan_close will be called, but too late, so we are
-         * obliged to close nicely the wavelan here. David, could you
-         * close the device before suspending them ? And, by the way,
-         * could you, on resume, add a "route add -net ..." after the
-         * ifconfig up ? Thanks... */
-
-        /* Stop receiving new messages and wait end of transmission */
-        wv_ru_stop(dev);
-
-        if (link->open)
-                netif_device_detach(dev);
-
-        /* Power down the module */
-        hacr_write(dev->base_addr, HACR_DEFAULT & (~HACR_PWR_STAT));
-
-        return 0;
-}
-
-static int wavelan_resume(struct pcmcia_device *link)
-{
-        struct net_device *     dev = (struct net_device *) link->priv;
-
-        if (link->open) {
-                wv_hw_reset(dev);
-                netif_device_attach(dev);
-        }
-
-        return 0;
-}
-
-
-static struct pcmcia_device_id wavelan_ids[] = {
-        PCMCIA_DEVICE_PROD_ID12("AT&T","WaveLAN/PCMCIA", 0xe7c5affd, 0x1bc50975),
-        PCMCIA_DEVICE_PROD_ID12("Digital", "RoamAbout/DS", 0x9999ab35, 0x00d05e06),
-        PCMCIA_DEVICE_PROD_ID12("Lucent Technologies", "WaveLAN/PCMCIA", 0x23eb9949, 0x1bc50975),
-        PCMCIA_DEVICE_PROD_ID12("NCR", "WaveLAN/PCMCIA", 0x24358cd4, 0x1bc50975),
-        PCMCIA_DEVICE_NULL,
-};
-MODULE_DEVICE_TABLE(pcmcia, wavelan_ids);
-
-static struct pcmcia_driver wavelan_driver = {
-        .owner          = THIS_MODULE,
-        .drv            = {
-                .name   = "wavelan_cs",
-        },
-        .probe          = wavelan_probe,
-        .remove         = wavelan_detach,
-        .id_table       = wavelan_ids,
-        .suspend        = wavelan_suspend,
-        .resume         = wavelan_resume,
-};
-
-static int __init
-init_wavelan_cs(void)
-{
-        return pcmcia_register_driver(&wavelan_driver);
-}
-
-static void __exit
-exit_wavelan_cs(void)
-{
-        pcmcia_unregister_driver(&wavelan_driver);
-}
-
-module_init(init_wavelan_cs);
-module_exit(exit_wavelan_cs);
diff --git a/drivers/net/wireless/wavelan_cs.h b/drivers/net/wireless/wavelan_cs.h
deleted file mode 100644
index 2e4bfe4147c6..000000000000
--- a/drivers/net/wireless/wavelan_cs.h
+++ /dev/null
@@ -1,386 +0,0 @@
-/*
- *      Wavelan Pcmcia driver
- *
- *              Jean II - HPLB '96
- *
- * Reorganization and extension of the driver.
- * Original copyright follow. See wavelan_cs.h for details.
- *
- * This file contain the declarations of the Wavelan hardware. Note that
- * the Pcmcia Wavelan include a i82593 controller (see definitions in
- * file i82593.h).
- *
- * The main difference between the pcmcia hardware and the ISA one is
- * the Ethernet Controller (i82593 instead of i82586). The i82593 allow
- * only one send buffer. The PSA (Parameter Storage Area : EEprom for
- * permanent storage of various info) is memory mapped, but not the
- * MMI (Modem Management Interface).
- */
-
-/*
- * Definitions for the AT&T GIS (formerly NCR) WaveLAN PCMCIA card: 
- *   An Ethernet-like radio transceiver controlled by an Intel 82593
- *   coprocessor.
- *
- *
- ****************************************************************************
- *   Copyright 1995
- *   Anthony D. Joseph
- *   Massachusetts Institute of Technology
- *
- *   Permission to use, copy, modify, and distribute this program
- *   for any purpose and without fee is hereby granted, provided
- *   that this copyright and permission notice appear on all copies
- *   and supporting documentation, the name of M.I.T. not be used
- *   in advertising or publicity pertaining to distribution of the
- *   program without specific prior permission, and notice be given
- *   in supporting documentation that copying and distribution is
- *   by permission of M.I.T.  M.I.T. makes no representations about
- *   the suitability of this software for any purpose.  It is pro-
- *   vided "as is" without express or implied warranty.         
- ****************************************************************************
- *
- *
- * Credits:
- *     Special thanks to Jan Hoogendoorn of AT&T GIS Utrecht for
- *       providing extremely useful information about WaveLAN PCMCIA hardware
- *
- *     This driver is based upon several other drivers, in particular:
- *       David Hinds' Linux driver for the PCMCIA 3c589 ethernet adapter
- *       Bruce Janson's Linux driver for the AT-bus WaveLAN adapter
- *       Anders Klemets' PCMCIA WaveLAN adapter driver
- *       Robert Morris' BSDI driver for the PCMCIA WaveLAN adapter
- */
-
-#ifndef _WAVELAN_CS_H
-#define _WAVELAN_CS_H
-
-/************************** MAGIC NUMBERS ***************************/
-
-/* The detection of the wavelan card is made by reading the MAC address
- * from the card and checking it. If you have a non AT&T product (OEM,
- * like DEC RoamAbout, or Digital Ocean, Epson, ...), you must modify this
- * part to accommodate your hardware...
- */
-static const unsigned char      MAC_ADDRESSES[][3] =
-{
-  { 0x08, 0x00, 0x0E },         /* AT&T Wavelan (standard) & DEC RoamAbout */
-  { 0x08, 0x00, 0x6A },         /* AT&T Wavelan (alternate) */
-  { 0x00, 0x00, 0xE1 },         /* Hitachi Wavelan */
-  { 0x00, 0x60, 0x1D }          /* Lucent Wavelan (another one) */
-  /* Add your card here and send me the patch ! */
-};
-
-/*
- * Constants used to convert channels to frequencies
- */
-
-/* Frequency available in the 2.0 modem, in units of 250 kHz
- * (as read in the offset register of the dac area).
- * Used to map channel numbers used by `wfreqsel' to frequencies
- */
-static const short      channel_bands[] = { 0x30, 0x58, 0x64, 0x7A, 0x80, 0xA8,
-                                    0xD0, 0xF0, 0xF8, 0x150 };
-
-/* Frequencies of the 1.0 modem (fixed frequencies).
- * Use to map the PSA `subband' to a frequency
- * Note : all frequencies apart from the first one need to be multiplied by 10
- */
-static const int        fixed_bands[] = { 915e6, 2.425e8, 2.46e8, 2.484e8, 2.4305e8 };
-
-
-/*************************** PC INTERFACE ****************************/
-
-/* WaveLAN host interface definitions */
-
-#define LCCR(base)      (base)          /* LAN Controller Command Register */
-#define LCSR(base)      (base)          /* LAN Controller Status Register */
-#define HACR(base)      (base+0x1)      /* Host Adapter Command Register */
-#define HASR(base)      (base+0x1)      /* Host Adapter Status Register */
-#define PIORL(base)     (base+0x2)      /* Program I/O Register Low */
-#define RPLL(base)      (base+0x2)      /* Receive Pointer Latched Low */
-#define PIORH(base)     (base+0x3)      /* Program I/O Register High */
-#define RPLH(base)      (base+0x3)      /* Receive Pointer Latched High */
-#define PIOP(base)      (base+0x4)      /* Program I/O Port */
-#define MMR(base)       (base+0x6)      /* MMI Address Register */
-#define MMD(base)       (base+0x7)      /* MMI Data Register */
-
-/* Host Adaptor Command Register bit definitions */
-
-#define HACR_LOF          (1 << 3)      /* Lock Out Flag, toggle every 250ms */
-#define HACR_PWR_STAT     (1 << 4)      /* Power State, 1=active, 0=sleep */
-#define HACR_TX_DMA_RESET (1 << 5)      /* Reset transmit DMA ptr on high */
-#define HACR_RX_DMA_RESET (1 << 6)      /* Reset receive DMA ptr on high */
-#define HACR_ROM_WEN      (1 << 7)      /* EEPROM write enabled when true */
-
-#define HACR_RESET              (HACR_TX_DMA_RESET | HACR_RX_DMA_RESET)
-#define HACR_DEFAULT            (HACR_PWR_STAT)
-
-/* Host Adapter Status Register bit definitions */
-
-#define HASR_MMI_BUSY   (1 << 2)        /* MMI is busy when true */
-#define HASR_LOF        (1 << 3)        /* Lock out flag status */
-#define HASR_NO_CLK     (1 << 4)        /* active when modem not connected */
-
-/* Miscellaneous bit definitions */
-
-#define PIORH_SEL_TX    (1 << 5)        /* PIOR points to 0=rx/1=tx buffer */
-#define MMR_MMI_WR      (1 << 0)        /* Next MMI cycle is 0=read, 1=write */
-#define PIORH_MASK      0x1f            /* only low 5 bits are significant */
-#define RPLH_MASK       0x1f            /* only low 5 bits are significant */
-#define MMI_ADDR_MASK   0x7e            /* Bits 1-6 of MMR are significant */
-
-/* Attribute Memory map */
-
-#define CIS_ADDR        0x0000          /* Card Information Status Register */
-#define PSA_ADDR        0x0e00          /* Parameter Storage Area address */
-#define EEPROM_ADDR     0x1000          /* EEPROM address (unused ?) */
-#define COR_ADDR        0x4000          /* Configuration Option Register */
-
-/* Configuration Option Register bit definitions */
-
-#define COR_CONFIG      (1 << 0)        /* Config Index, 0 when unconfigured */
-#define COR_SW_RESET    (1 << 7)        /* Software Reset on true */
-#define COR_LEVEL_IRQ   (1 << 6)        /* Level IRQ */
-
-/* Local Memory map */
-
-#define RX_BASE         0x0000          /* Receive memory, 8 kB */
-#define TX_BASE         0x2000          /* Transmit memory, 2 kB */
-#define UNUSED_BASE     0x2800          /* Unused, 22 kB */
-#define RX_SIZE         (TX_BASE-RX_BASE)       /* Size of receive area */
-#define RX_SIZE_SHIFT   6               /* Bits to shift in stop register */
-
-#define TRUE  1
-#define FALSE 0
-
-#define MOD_ENAL 1
-#define MOD_PROM 2
-
-/* Size of a MAC address */
-#define WAVELAN_ADDR_SIZE       6
-
-/* Maximum size of Wavelan packet */
-#define WAVELAN_MTU     1500
-
-#define MAXDATAZ                (6 + 6 + 2 + WAVELAN_MTU)
-
-/********************** PARAMETER STORAGE AREA **********************/
-
-/*
- * Parameter Storage Area (PSA).
- */
-typedef struct psa_t    psa_t;
-struct psa_t
-{
-  /* For the PCMCIA Adapter, locations 0x00-0x0F are unused and fixed at 00 */
-  unsigned char psa_io_base_addr_1;     /* [0x00] Base address 1 ??? */
-  unsigned char psa_io_base_addr_2;     /* [0x01] Base address 2 */
-  unsigned char psa_io_base_addr_3;     /* [0x02] Base address 3 */
-  unsigned char psa_io_base_addr_4;     /* [0x03] Base address 4 */
-  unsigned char psa_rem_boot_addr_1;    /* [0x04] Remote Boot Address 1 */
-  unsigned char psa_rem_boot_addr_2;    /* [0x05] Remote Boot Address 2 */
-  unsigned char psa_rem_boot_addr_3;    /* [0x06] Remote Boot Address 3 */
-  unsigned char psa_holi_params;        /* [0x07] HOst Lan Interface (HOLI) Parameters */
-  unsigned char psa_int_req_no;         /* [0x08] Interrupt Request Line */
-  unsigned char psa_unused0[7];         /* [0x09-0x0F] unused */
-
-  unsigned char psa_univ_mac_addr[WAVELAN_ADDR_SIZE];   /* [0x10-0x15] Universal (factory) MAC Address */
-  unsigned char psa_local_mac_addr[WAVELAN_ADDR_SIZE];  /* [0x16-1B] Local MAC Address */
-  unsigned char psa_univ_local_sel;     /* [0x1C] Universal Local Selection */
-#define         PSA_UNIVERSAL   0               /* Universal (factory) */
-#define         PSA_LOCAL       1               /* Local */
-  unsigned char psa_comp_number;        /* [0x1D] Compatability Number: */
-#define         PSA_COMP_PC_AT_915      0       /* PC-AT 915 MHz        */
-#define         PSA_COMP_PC_MC_915      1       /* PC-MC 915 MHz        */
-#define         PSA_COMP_PC_AT_2400     2       /* PC-AT 2.4 GHz        */
-#define         PSA_COMP_PC_MC_2400     3       /* PC-MC 2.4 GHz        */
-#define         PSA_COMP_PCMCIA_915     4       /* PCMCIA 915 MHz or 2.0 */
-  unsigned char psa_thr_pre_set;        /* [0x1E] Modem Threshold Preset */
-  unsigned char psa_feature_select;     /* [0x1F] Call code required (1=on) */
-#define         PSA_FEATURE_CALL_CODE   0x01    /* Call code required (Japan) */
-  unsigned char psa_subband;            /* [0x20] Subband       */
-#define         PSA_SUBBAND_915         0       /* 915 MHz or 2.0 */
-#define         PSA_SUBBAND_2425        1       /* 2425 MHz     */
-#define         PSA_SUBBAND_2460        2       /* 2460 MHz     */
-#define         PSA_SUBBAND_2484        3       /* 2484 MHz     */
-#define         PSA_SUBBAND_2430_5      4       /* 2430.5 MHz   */
-  unsigned char psa_quality_thr;        /* [0x21] Modem Quality Threshold */
-  unsigned char psa_mod_delay;          /* [0x22] Modem Delay ??? (reserved) */
-  unsigned char psa_nwid[2];            /* [0x23-0x24] Network ID */
-  unsigned char psa_nwid_select;        /* [0x25] Network ID Select On Off */
-  unsigned char psa_encryption_select;  /* [0x26] Encryption On Off */
-  unsigned char psa_encryption_key[8];  /* [0x27-0x2E] Encryption Key */
-  unsigned char psa_databus_width;      /* [0x2F] AT bus width select 8/16 */
-  unsigned char psa_call_code[8];       /* [0x30-0x37] (Japan) Call Code */
-  unsigned char psa_nwid_prefix[2];     /* [0x38-0x39] Roaming domain */
-  unsigned char psa_reserved[2];        /* [0x3A-0x3B] Reserved - fixed 00 */
-  unsigned char psa_conf_status;        /* [0x3C] Conf Status, bit 0=1:config*/
-  unsigned char psa_crc[2];             /* [0x3D] CRC-16 over PSA */
-  unsigned char psa_crc_status;         /* [0x3F] CRC Valid Flag */
-};
-
-/* Size for structure checking (if padding is correct) */
-#define PSA_SIZE        64
-
-/* Calculate offset of a field in the above structure
- * Warning : only even addresses are used */
-#define psaoff(p,f)     ((unsigned short) ((void *)(&((psa_t *) ((void *) NULL + (p)))->f) - (void *) NULL))
-
-/******************** MODEM MANAGEMENT INTERFACE ********************/
-
-/*
- * Modem Management Controller (MMC) write structure.
- */
-typedef struct mmw_t    mmw_t;
-struct mmw_t
-{
-  unsigned char mmw_encr_key[8];        /* encryption key */
-  unsigned char mmw_encr_enable;        /* enable/disable encryption */
-#define MMW_ENCR_ENABLE_MODE    0x02    /* Mode of security option */
-#define MMW_ENCR_ENABLE_EN      0x01    /* Enable security option */
-  unsigned char mmw_unused0[1];         /* unused */
-  unsigned char mmw_des_io_invert;      /* Encryption option */
-#define MMW_DES_IO_INVERT_RES   0x0F    /* Reserved */
-#define MMW_DES_IO_INVERT_CTRL  0xF0    /* Control ??? (set to 0) */
-  unsigned char mmw_unused1[5];         /* unused */
-  unsigned char mmw_loopt_sel;          /* looptest selection */
-#define MMW_LOOPT_SEL_DIS_NWID  0x40    /* disable NWID filtering */
-#define MMW_LOOPT_SEL_INT       0x20    /* activate Attention Request */
-#define MMW_LOOPT_SEL_LS        0x10    /* looptest w/o collision avoidance */
-#define MMW_LOOPT_SEL_LT3A      0x08    /* looptest 3a */
-#define MMW_LOOPT_SEL_LT3B      0x04    /* looptest 3b */
-#define MMW_LOOPT_SEL_LT3C      0x02    /* looptest 3c */
-#define MMW_LOOPT_SEL_LT3D      0x01    /* looptest 3d */
-  unsigned char mmw_jabber_enable;      /* jabber timer enable */
-  /* Abort transmissions > 200 ms */
-  unsigned char mmw_freeze;             /* freeze / unfreeeze signal level */
-  /* 0 : signal level & qual updated for every new message, 1 : frozen */
-  unsigned char mmw_anten_sel;          /* antenna selection */
-#define MMW_ANTEN_SEL_SEL       0x01    /* direct antenna selection */
-#define MMW_ANTEN_SEL_ALG_EN    0x02    /* antenna selection algo. enable */
-  unsigned char mmw_ifs;                /* inter frame spacing */
-  /* min time between transmission in bit periods (.5 us) - bit 0 ignored */
-  unsigned char mmw_mod_delay;          /* modem delay (synchro) */
-  unsigned char mmw_jam_time;           /* jamming time (after collision) */
-  unsigned char mmw_unused2[1];         /* unused */
-  unsigned char mmw_thr_pre_set;        /* level threshold preset */
-  /* Discard all packet with signal < this value (4) */
-  unsigned char mmw_decay_prm;          /* decay parameters */
-  unsigned char mmw_decay_updat_prm;    /* decay update parameterz */
-  unsigned char mmw_quality_thr;        /* quality (z-quotient) threshold */
-  /* Discard all packet with quality < this value (3) */
-  unsigned char mmw_netw_id_l;          /* NWID low order byte */
-  unsigned char mmw_netw_id_h;          /* NWID high order byte */
-  /* Network ID or Domain : create virtual net on the air */
-
-  /* 2.0 Hardware extension - frequency selection support */
-  unsigned char mmw_mode_select;        /* for analog tests (set to 0) */
-  unsigned char mmw_unused3[1];         /* unused */
-  unsigned char mmw_fee_ctrl;           /* frequency eeprom control */
-#define MMW_FEE_CTRL_PRE        0x10    /* Enable protected instructions */
-#define MMW_FEE_CTRL_DWLD       0x08    /* Download eeprom to mmc */
-#define MMW_FEE_CTRL_CMD        0x07    /* EEprom commands : */
-#define MMW_FEE_CTRL_READ       0x06    /* Read */
-#define MMW_FEE_CTRL_WREN       0x04    /* Write enable */
-#define MMW_FEE_CTRL_WRITE      0x05    /* Write data to address */
-#define MMW_FEE_CTRL_WRALL      0x04    /* Write data to all addresses */
-#define MMW_FEE_CTRL_WDS        0x04    /* Write disable */
-#define MMW_FEE_CTRL_PRREAD     0x16    /* Read addr from protect register */
-#define MMW_FEE_CTRL_PREN       0x14    /* Protect register enable */
-#define MMW_FEE_CTRL_PRCLEAR    0x17    /* Unprotect all registers */
-#define MMW_FEE_CTRL_PRWRITE    0x15    /* Write addr in protect register */
-#define MMW_FEE_CTRL_PRDS       0x14    /* Protect register disable */
-  /* Never issue this command (PRDS) : it's irreversible !!! */
-
-  unsigned char mmw_fee_addr;           /* EEprom address */
-#define MMW_FEE_ADDR_CHANNEL    0xF0    /* Select the channel */
-#define MMW_FEE_ADDR_OFFSET     0x0F    /* Offset in channel data */
-#define MMW_FEE_ADDR_EN         0xC0    /* FEE_CTRL enable operations */
-#define MMW_FEE_ADDR_DS         0x00    /* FEE_CTRL disable operations */
-#define MMW_FEE_ADDR_ALL        0x40    /* FEE_CTRL all operations */
-#define MMW_FEE_ADDR_CLEAR      0xFF    /* FEE_CTRL clear operations */
-
-  unsigned char mmw_fee_data_l;         /* Write data to EEprom */
-  unsigned char mmw_fee_data_h;         /* high octet */
-  unsigned char mmw_ext_ant;            /* Setting for external antenna */
-#define MMW_EXT_ANT_EXTANT      0x01    /* Select external antenna */
-#define MMW_EXT_ANT_POL         0x02    /* Polarity of the antenna */
-#define MMW_EXT_ANT_INTERNAL    0x00    /* Internal antenna */
-#define MMW_EXT_ANT_EXTERNAL    0x03    /* External antenna */
-#define MMW_EXT_ANT_IQ_TEST     0x1C    /* IQ test pattern (set to 0) */
-} __attribute__((packed));
-
-/* Size for structure checking (if padding is correct) */
-#define MMW_SIZE        37
-
-/* Calculate offset of a field in the above structure */
-#define mmwoff(p,f)     (unsigned short)((void *)(&((mmw_t *)((void *)0 + (p)))->f) - (void *)0)
-
-
-/*
- * Modem Management Controller (MMC) read structure.
- */
-typedef struct mmr_t    mmr_t;
-struct mmr_t
-{
-  unsigned char mmr_unused0[8];         /* unused */
-  unsigned char mmr_des_status;         /* encryption status */
-  unsigned char mmr_des_avail;          /* encryption available (0x55 read) */
-#define MMR_DES_AVAIL_DES       0x55            /* DES available */
-#define MMR_DES_AVAIL_AES       0x33            /* AES (AT&T) available */
-  unsigned char mmr_des_io_invert;      /* des I/O invert register */
-  unsigned char mmr_unused1[5];         /* unused */
-  unsigned char mmr_dce_status;         /* DCE status */
-#define MMR_DCE_STATUS_RX_BUSY          0x01    /* receiver busy */
-#define MMR_DCE_STATUS_LOOPT_IND        0x02    /* loop test indicated */
-#define MMR_DCE_STATUS_TX_BUSY          0x04    /* transmitter on */
-#define MMR_DCE_STATUS_JBR_EXPIRED      0x08    /* jabber timer expired */
-#define MMR_DCE_STATUS                  0x0F    /* mask to get the bits */
-  unsigned char mmr_dsp_id;             /* DSP id (AA = Daedalus rev A) */
-  unsigned char mmr_unused2[2];         /* unused */
-  unsigned char mmr_correct_nwid_l;     /* # of correct NWID's rxd (low) */
-  unsigned char mmr_correct_nwid_h;     /* # of correct NWID's rxd (high) */
-  /* Warning : Read high order octet first !!! */
-  unsigned char mmr_wrong_nwid_l;       /* # of wrong NWID's rxd (low) */
-  unsigned char mmr_wrong_nwid_h;       /* # of wrong NWID's rxd (high) */
-  unsigned char mmr_thr_pre_set;        /* level threshold preset */
-#define MMR_THR_PRE_SET         0x3F            /* level threshold preset */
-#define MMR_THR_PRE_SET_CUR     0x80            /* Current signal above it */
-  unsigned char mmr_signal_lvl;         /* signal level */
-#define MMR_SIGNAL_LVL          0x3F            /* signal level */
-#define MMR_SIGNAL_LVL_VALID    0x80            /* Updated since last read */
-  unsigned char mmr_silence_lvl;        /* silence level (noise) */
-#define MMR_SILENCE_LVL         0x3F            /* silence level */
-#define MMR_SILENCE_LVL_VALID   0x80            /* Updated since last read */
-  unsigned char mmr_sgnl_qual;          /* signal quality */
-#define MMR_SGNL_QUAL           0x0F            /* signal quality */
-#define MMR_SGNL_QUAL_ANT       0x80            /* current antenna used */
-  unsigned char mmr_netw_id_l;          /* NWID low order byte ??? */
-  unsigned char mmr_unused3[3];         /* unused */
-
-  /* 2.0 Hardware extension - frequency selection support */
-  unsigned char mmr_fee_status;         /* Status of frequency eeprom */
-#define MMR_FEE_STATUS_ID       0xF0            /* Modem revision id */
-#define MMR_FEE_STATUS_DWLD     0x08            /* Download in progress */
-#define MMR_FEE_STATUS_BUSY     0x04            /* EEprom busy */
-  unsigned char mmr_unused4[1];         /* unused */
-  unsigned char mmr_fee_data_l;         /* Read data from eeprom (low) */
-  unsigned char mmr_fee_data_h;         /* Read data from eeprom (high) */
-};
-
-/* Size for structure checking (if padding is correct) */
-#define MMR_SIZE        36
-
-/* Calculate offset of a field in the above structure */
-#define mmroff(p,f)     (unsigned short)((void *)(&((mmr_t *)((void *)0 + (p)))->f) - (void *)0)
-
-
-/* Make the two above structures one */
-typedef union mm_t
-{
-  struct mmw_t  w;      /* Write to the mmc */
-  struct mmr_t  r;      /* Read from the mmc */
-} mm_t;
-
-#endif /* _WAVELAN_CS_H */
diff --git a/drivers/net/wireless/wavelan_cs.p.h b/drivers/net/wireless/wavelan_cs.p.h
deleted file mode 100644
index 81d91531c4f9..000000000000
--- a/drivers/net/wireless/wavelan_cs.p.h
+++ /dev/null
@@ -1,766 +0,0 @@
-/*
- *      Wavelan Pcmcia driver
- *
- *              Jean II - HPLB '96
- *
- * Reorganisation and extension of the driver.
- *
- * This file contain all definition and declarations necessary for the
- * wavelan pcmcia driver. This file is a private header, so it should
- * be included only on wavelan_cs.c !!!
- */
-
-#ifndef WAVELAN_CS_P_H
-#define WAVELAN_CS_P_H
-
-/************************** DOCUMENTATION **************************/
-/*
- * This driver provide a Linux interface to the Wavelan Pcmcia hardware
- * The Wavelan is a product of Lucent (http://www.wavelan.com/).
- * This division was formerly part of NCR and then AT&T.
- * Wavelan are also distributed by DEC (RoamAbout DS)...
- *
- * To know how to use this driver, read the PCMCIA HOWTO.
- * If you want to exploit the many other fonctionalities, look comments
- * in the code...
- *
- * This driver is the result of the effort of many peoples (see below).
- */
-
-/* ------------------------ SPECIFIC NOTES ------------------------ */
-/*
- * Web page
- * --------
- *      I try to maintain a web page with the Wireless LAN Howto at :
- *          http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Wavelan.html
- *
- * SMP
- * ---
- *      We now are SMP compliant (I eventually fixed the remaining bugs).
- *      The driver has been tested on a dual P6-150 and survived my usual
- *      set of torture tests.
- *      Anyway, I spent enough time chasing interrupt re-entrancy during
- *      errors or reconfigure, and I designed the locked/unlocked sections
- *      of the driver with great care, and with the recent addition of
- *      the spinlock (thanks to the new API), we should be quite close to
- *      the truth.
- *      The SMP/IRQ locking is quite coarse and conservative (i.e. not fast),
- *      but better safe than sorry (especially at 2 Mb/s ;-).
- *
- *      I have also looked into disabling only our interrupt on the card
- *      (via HACR) instead of all interrupts in the processor (via cli),
- *      so that other driver are not impacted, and it look like it's
- *      possible, but it's very tricky to do right (full of races). As
- *      the gain would be mostly for SMP systems, it can wait...
- *
- * Debugging and options
- * ---------------------
- *      You will find below a set of '#define" allowing a very fine control
- *      on the driver behaviour and the debug messages printed.
- *      The main options are :
- *      o WAVELAN_ROAMING, for the experimental roaming support.
- *      o SET_PSA_CRC, to have your card correctly recognised by
- *        an access point and the Point-to-Point diagnostic tool.
- *      o USE_PSA_CONFIG, to read configuration from the PSA (EEprom)
- *        (otherwise we always start afresh with some defaults)
- *
- * wavelan_cs.o is darn too big
- * -------------------------
- *      That's true ! There is a very simple way to reduce the driver
- *      object by 33% (yes !). Comment out the following line :
- *              #include <linux/wireless.h>
- *      Other compile options can also reduce the size of it...
- *
- * MAC address and hardware detection :
- * ----------------------------------
- *      The detection code of the wavelan chech that the first 3
- *      octets of the MAC address fit the company code. This type of
- *      detection work well for AT&T cards (because the AT&T code is
- *      hardcoded in wavelan_cs.h), but of course will fail for other
- *      manufacturer.
- *
- *      If you are sure that your card is derived from the wavelan,
- *      here is the way to configure it :
- *      1) Get your MAC address
- *              a) With your card utilities (wfreqsel, instconf, ...)
- *              b) With the driver :
- *                      o compile the kernel with DEBUG_CONFIG_INFO enabled
- *                      o Boot and look the card messages
- *      2) Set your MAC code (3 octets) in MAC_ADDRESSES[][3] (wavelan_cs.h)
- *      3) Compile & verify
- *      4) Send me the MAC code - I will include it in the next version...
- *
- */
-
-/* --------------------- WIRELESS EXTENSIONS --------------------- */
-/*
- * This driver is the first one to support "wireless extensions".
- * This set of extensions provide you some way to control the wireless
- * caracteristics of the hardware in a standard way and support for
- * applications for taking advantage of it (like Mobile IP).
- *
- * It might be a good idea as well to fetch the wireless tools to
- * configure the device and play a bit.
- */
-
-/* ---------------------------- FILES ---------------------------- */
-/*
- * wavelan_cs.c :       The actual code for the driver - C functions
- *
- * wavelan_cs.p.h :     Private header : local types / vars for the driver
- *
- * wavelan_cs.h :       Description of the hardware interface & structs
- *
- * i82593.h :           Description if the Ethernet controller
- */
-
-/* --------------------------- HISTORY --------------------------- */
-/*
- * The history of the Wavelan drivers is as complicated as history of
- * the Wavelan itself (NCR -> AT&T -> Lucent).
- *
- * All started with Anders Klemets <klemets@paul.rutgers.edu>,
- * writing a Wavelan ISA driver for the MACH microkernel. Girish
- * Welling <welling@paul.rutgers.edu> had also worked on it.
- * Keith Moore modify this for the Pcmcia hardware.
- * 
- * Robert Morris <rtm@das.harvard.edu> port these two drivers to BSDI
- * and add specific Pcmcia support (there is currently no equivalent
- * of the PCMCIA package under BSD...).
- *
- * Jim Binkley <jrb@cs.pdx.edu> port both BSDI drivers to FreeBSD.
- *
- * Bruce Janson <bruce@cs.usyd.edu.au> port the BSDI ISA driver to Linux.
- *
- * Anthony D. Joseph <adj@lcs.mit.edu> started modify Bruce driver
- * (with help of the BSDI PCMCIA driver) for PCMCIA.
- * Yunzhou Li <yunzhou@strat.iol.unh.edu> finished is work.
- * Joe Finney <joe@comp.lancs.ac.uk> patched the driver to start
- * correctly 2.00 cards (2.4 GHz with frequency selection).
- * David Hinds <dahinds@users.sourceforge.net> integrated the whole in his
- * Pcmcia package (+ bug corrections).
- *
- * I (Jean Tourrilhes - jt@hplb.hpl.hp.com) then started to make some
- * patchs to the Pcmcia driver. After, I added code in the ISA driver
- * for Wireless Extensions and full support of frequency selection
- * cards. Now, I'm doing the same to the Pcmcia driver + some
- * reorganisation.
- * Loeke Brederveld <lbrederv@wavelan.com> from Lucent has given me
- * much needed informations on the Wavelan hardware.
- */
-
-/* By the way : for the copyright & legal stuff :
- * Almost everybody wrote code under GNU or BSD license (or alike),
- * and want that their original copyright remain somewhere in the
- * code (for myself, I go with the GPL).
- * Nobody want to take responsibility for anything, except the fame...
- */
-
-/* --------------------------- CREDITS --------------------------- */
-/*
- * Credits:
- *    Special thanks to Jan Hoogendoorn of AT&T GIS Utrecht and
- *      Loeke Brederveld of Lucent for providing extremely useful
- *      information about WaveLAN PCMCIA hardware
- *
- *    This driver is based upon several other drivers, in particular:
- *      David Hinds' Linux driver for the PCMCIA 3c589 ethernet adapter
- *      Bruce Janson's Linux driver for the AT-bus WaveLAN adapter
- *      Anders Klemets' PCMCIA WaveLAN adapter driver
- *      Robert Morris' BSDI driver for the PCMCIA WaveLAN adapter
- *
- * Additional Credits:
- *
- *    This software was originally developed under Linux 1.2.3
- *      (Slackware 2.0 distribution).
- *    And then under Linux 2.0.x (Debian 1.1 -> 2.2 - pcmcia 2.8.18+)
- *      with an HP OmniBook 4000 and then a 5500.
- *
- *    It is based on other device drivers and information either written
- *    or supplied by:
- *      James Ashton (jaa101@syseng.anu.edu.au),
- *      Ajay Bakre (bakre@paul.rutgers.edu),
- *      Donald Becker (becker@super.org),
- *      Jim Binkley <jrb@cs.pdx.edu>,
- *      Loeke Brederveld <lbrederv@wavelan.com>,
- *      Allan Creighton (allanc@cs.su.oz.au),
- *      Brent Elphick <belphick@uwaterloo.ca>,
- *      Joe Finney <joe@comp.lancs.ac.uk>,
- *      Matthew Geier (matthew@cs.su.oz.au),
- *      Remo di Giovanni (remo@cs.su.oz.au),
- *      Mark Hagan (mhagan@wtcpost.daytonoh.NCR.COM),
- *      David Hinds <dahinds@users.sourceforge.net>,
- *      Jan Hoogendoorn (c/o marteijn@lucent.com),
- *      Bruce Janson <bruce@cs.usyd.edu.au>,
- *      Anthony D. Joseph <adj@lcs.mit.edu>,
- *      Anders Klemets (klemets@paul.rutgers.edu),
- *      Yunzhou Li <yunzhou@strat.iol.unh.edu>,
- *      Marc Meertens (mmeertens@lucent.com),
- *      Keith Moore,
- *      Robert Morris (rtm@das.harvard.edu),
- *      Ian Parkin (ian@cs.su.oz.au),
- *      John Rosenberg (johnr@cs.su.oz.au),
- *      George Rossi (george@phm.gov.au),
- *      Arthur Scott (arthur@cs.su.oz.au),
- *      Stanislav Sinyagin <stas@isf.ru>
- *      Peter Storey,
- *      Jean Tourrilhes <jt@hpl.hp.com>,
- *      Girish Welling (welling@paul.rutgers.edu)
- *      Clark Woodworth <clark@hiway1.exit109.com>
- *      Yongguang Zhang <ygz@isl.hrl.hac.com>...
- */
-
-/* ------------------------- IMPROVEMENTS ------------------------- */
-/*
- * I proudly present :
- *
- * Changes made in 2.8.22 :
- * ----------------------
- *      - improved wv_set_multicast_list
- *      - catch spurious interrupt
- *      - correct release of the device
- *
- * Changes mades in release :
- * ------------------------
- *      - Reorganisation of the code, function name change
- *      - Creation of private header (wavelan_cs.h)
- *      - Reorganised debug messages
- *      - More comments, history, ...
- *      - Configure earlier (in "insert" instead of "open")
- *        and do things only once
- *      - mmc_init : configure the PSA if not done
- *      - mmc_init : 2.00 detection better code for 2.00 init
- *      - better info at startup
- *      - Correct a HUGE bug (volatile & uncalibrated busy loop)
- *        in wv_82593_cmd => config speedup
- *      - Stop receiving & power down on close (and power up on open)
- *        use "ifconfig down" & "ifconfig up ; route add -net ..."
- *      - Send packets : add watchdog instead of pooling
- *      - Receive : check frame wrap around & try to recover some frames
- *      - wavelan_set_multicast_list : avoid reset
- *      - add wireless extensions (ioctl & get_wireless_stats)
- *        get/set nwid/frequency on fly, info for /proc/net/wireless
- *      - Suppress useless stuff from lp (net_local), but add link
- *      - More inlines
- *      - Lot of others minor details & cleanups
- *
- * Changes made in second release :
- * ------------------------------
- *      - Optimise wv_85893_reconfig stuff, fix potential problems
- *      - Change error values for ioctl
- *      - Non blocking wv_ru_stop() + call wv_reset() in case of problems
- *      - Remove development printk from wavelan_watchdog()
- *      - Remove of the watchdog to wavelan_close instead of wavelan_release
- *        fix potential problems...
- *      - Start debugging suspend stuff (but it's still a bit weird)
- *      - Debug & optimize dump header/packet in Rx & Tx (debug)
- *      - Use "readb" and "writeb" to be kernel 2.1 compliant
- *      - Better handling of bogus interrupts
- *      - Wireless extension : SETSPY and GETSPY
- *      - Remove old stuff (stats - for those needing it, just ask me...)
- *      - Make wireless extensions optional
- *
- * Changes made in third release :
- * -----------------------------
- *      - cleanups & typos
- *      - modif wireless ext (spy -> only one pointer)
- *      - new private ioctl to set/get quality & level threshold
- *      - Init : correct default value of level threshold for pcmcia
- *      - kill watchdog in hw_reset
- *      - more 2.1 support (copy_to/from_user instead of memcpy_to/fromfs)
- *      - Add message level (debug stuff in /var/adm/debug & errors not
- *        displayed at console and still in /var/adm/messages)
- *
- * Changes made in fourth release :
- * ------------------------------
- *      - multicast support (yes !) thanks to Yongguang Zhang.
- *
- * Changes made in fifth release (2.9.0) :
- * -------------------------------------
- *      - Revisited multicast code (it was mostly wrong).
- *      - protect code in wv_82593_reconfig with dev->tbusy (oups !)
- *
- * Changes made in sixth release (2.9.1a) :
- * --------------------------------------
- *      - Change the detection code for multi manufacturer code support
- *      - Correct bug (hang kernel) in init when we were "rejecting" a card 
- *
- * Changes made in seventh release (2.9.1b) :
- * ----------------------------------------
- *      - Update to wireless extensions changes
- *      - Silly bug in card initial configuration (psa_conf_status)
- *
- * Changes made in eigth release :
- * -----------------------------
- *      - Small bug in debug code (probably not the last one...)
- *      - 1.2.13 support (thanks to Clark Woodworth)
- *
- * Changes made for release in 2.9.2b :
- * ----------------------------------
- *      - Level threshold is now a standard wireless extension (version 4 !)
- *      - modules parameters types for kernel > 2.1.17
- *      - updated man page
- *      - Others cleanup from David Hinds
- *
- * Changes made for release in 2.9.5 :
- * ---------------------------------
- *      - byte count stats (courtesy of David Hinds)
- *      - Remove dev_tint stuff (courtesy of David Hinds)
- *      - Others cleanup from David Hinds
- *      - Encryption setting from Brent Elphick (thanks a lot !)
- *      - 'base' to 'u_long' for the Alpha (thanks to Stanislav Sinyagin)
- *
- * Changes made for release in 2.9.6 :
- * ---------------------------------
- *      - fix bug : no longuer disable watchdog in case of bogus interrupt
- *      - increase timeout in config code for picky hardware
- *      - mask unused bits in status (Wireless Extensions)
- *
- * Changes integrated by Justin Seger <jseger@MIT.EDU> & David Hinds :
- * -----------------------------------------------------------------
- *      - Roaming "hack" from Joe Finney <joe@comp.lancs.ac.uk>
- *      - PSA CRC code from Bob Gray <rgray@bald.cs.dartmouth.edu>
- *      - Better initialisation of the i82593 controller
- *        from Joseph K. O'Sullivan <josullvn+@cs.cmu.edu>
- *
- * Changes made for release in 3.0.10 :
- * ----------------------------------
- *      - Fix eject "hang" of the driver under 2.2.X :
- *              o create wv_flush_stale_links()
- *              o Rename wavelan_release to wv_pcmcia_release & move up
- *              o move unregister_netdev to wavelan_detach()
- *              o wavelan_release() no longer call wavelan_detach()
- *              o Suppress "release" timer
- *              o Other cleanups & fixes
- *      - New MAC address in the probe
- *      - Reorg PSA_CRC code (endian neutral & cleaner)
- *      - Correct initialisation of the i82593 from Lucent manual
- *      - Put back the watchdog, with larger timeout
- *      - TRANSMIT_NO_CRC is a "normal" error, so recover from it
- *        from Derrick J Brashear <shadow@dementia.org>
- *      - Better handling of TX and RX normal failure conditions
- *      - #ifdef out all the roaming code
- *      - Add ESSID & "AP current address" ioctl stubs
- *      - General cleanup of the code
- *
- * Changes made for release in 3.0.13 :
- * ----------------------------------
- *      - Re-enable compilation of roaming code by default, but with
- *        do_roaming = 0
- *      - Nuke `nwid=nwid^ntohs(beacon->domain_id)' in wl_roam_gather
- *        at the demand of John Carol Langford <jcl@gs176.sp.cs.cmu.edu>
- *      - Introduced WAVELAN_ROAMING_EXT for incomplete ESSID stuff.
- *
- * Changes made for release in 3.0.15 :
- * ----------------------------------
- *      - Change e-mail and web page addresses
- *      - Watchdog timer is now correctly expressed in HZ, not in jiffies
- *      - Add channel number to the list of frequencies in range
- *      - Add the (short) list of bit-rates in range
- *      - Developp a new sensitivity... (sens.value & sens.fixed)
- *
- * Changes made for release in 3.1.2 :
- * ---------------------------------
- *      - Fix check for root permission (break instead of exit)
- *      - New nwid & encoding setting (Wireless Extension 9)
- *
- * Changes made for release in 3.1.12 :
- * ----------------------------------
- *      - reworked wv_82593_cmd to avoid using the IRQ handler and doing
- *        ugly things with interrupts.
- *      - Add IRQ protection in 82593_config/ru_start/ru_stop/watchdog
- *      - Update to new network API (softnet - 2.3.43) :
- *              o replace dev->tbusy (David + me)
- *              o replace dev->tstart (David + me)
- *              o remove dev->interrupt (David)
- *              o add SMP locking via spinlock in splxx (me)
- *              o add spinlock in interrupt handler (me)
- *              o use kernel watchdog instead of ours (me)
- *              o verify that all the changes make sense and work (me)
- *      - Re-sync kernel/pcmcia versions (not much actually)
- *      - A few other cleanups (David & me)...
- *
- * Changes made for release in 3.1.22 :
- * ----------------------------------
- *      - Check that SMP works, remove annoying log message
- *
- * Changes made for release in 3.1.24 :
- * ----------------------------------
- *      - Fix unfrequent card lockup when watchdog was reseting the hardware :
- *              o control first busy loop in wv_82593_cmd()
- *              o Extend spinlock protection in wv_hw_config()
- *
- * Changes made for release in 3.1.33 :
- * ----------------------------------
- *      - Optional use new driver API for Wireless Extensions :
- *              o got rid of wavelan_ioctl()
- *              o use a bunch of iw_handler instead
- *
- * Changes made for release in 3.2.1 :
- * ---------------------------------
- *      - Set dev->trans_start to avoid filling the logs
- *              (and generating useless abort commands)
- *      - Avoid deadlocks in mmc_out()/mmc_in()
- *
- * Wishes & dreams:
- * ----------------
- *      - Cleanup and integrate the roaming code
- *        (std debug, set DomainID, decay avg and co...)
- */
-
-/***************************** INCLUDES *****************************/
-
-/* Linux headers that we need */
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/sched.h>
-#include <linux/ptrace.h>
-#include <linux/slab.h>
-#include <linux/string.h>
-#include <linux/timer.h>
-#include <linux/interrupt.h>
-#include <linux/spinlock.h>
-#include <linux/in.h>
-#include <linux/delay.h>
-#include <linux/bitops.h>
-#include <asm/uaccess.h>
-#include <asm/io.h>
-#include <asm/system.h>
-
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/skbuff.h>
-#include <linux/if_arp.h>
-#include <linux/ioport.h>
-#include <linux/fcntl.h>
-#include <linux/ethtool.h>
-#include <linux/wireless.h>             /* Wireless extensions */
-#include <net/iw_handler.h>             /* New driver API */
-
-/* Pcmcia headers that we need */
-#include <pcmcia/cs_types.h>
-#include <pcmcia/cs.h>
-#include <pcmcia/cistpl.h>
-#include <pcmcia/cisreg.h>
-#include <pcmcia/ds.h>
-
-/* Wavelan declarations */
-#include "i82593.h"     /* Definitions for the Intel chip */
-
-#include "wavelan_cs.h" /* Others bits of the hardware */
-
-/************************** DRIVER OPTIONS **************************/
-/*
- * `#define' or `#undef' the following constant to change the behaviour
- * of the driver...
- */
-#define WAVELAN_ROAMING         /* Include experimental roaming code */
-#undef WAVELAN_ROAMING_EXT      /* Enable roaming wireless extensions */
-#undef SET_PSA_CRC              /* Set the CRC in PSA (slower) */
-#define USE_PSA_CONFIG          /* Use info from the PSA */
-#undef EEPROM_IS_PROTECTED      /* Doesn't seem to be necessary */
-#define MULTICAST_AVOID         /* Avoid extra multicast (I'm sceptical) */
-#undef SET_MAC_ADDRESS          /* Experimental */
-
-/* Warning : these stuff will slow down the driver... */
-#define WIRELESS_SPY            /* Enable spying addresses */
-#undef HISTOGRAM                /* Enable histogram of sig level... */
-
-/****************************** DEBUG ******************************/
-
-#undef DEBUG_MODULE_TRACE       /* Module insertion/removal */
-#undef DEBUG_CALLBACK_TRACE     /* Calls made by Linux */
-#undef DEBUG_INTERRUPT_TRACE    /* Calls to handler */
-#undef DEBUG_INTERRUPT_INFO     /* type of interrupt & so on */
-#define DEBUG_INTERRUPT_ERROR   /* problems */
-#undef DEBUG_CONFIG_TRACE       /* Trace the config functions */
-#undef DEBUG_CONFIG_INFO        /* What's going on... */
-#define DEBUG_CONFIG_ERRORS     /* Errors on configuration */
-#undef DEBUG_TX_TRACE           /* Transmission calls */
-#undef DEBUG_TX_INFO            /* Header of the transmitted packet */
-#undef DEBUG_TX_FAIL            /* Normal failure conditions */
-#define DEBUG_TX_ERROR          /* Unexpected conditions */
-#undef DEBUG_RX_TRACE           /* Transmission calls */
-#undef DEBUG_RX_INFO            /* Header of the transmitted packet */
-#undef DEBUG_RX_FAIL            /* Normal failure conditions */
-#define DEBUG_RX_ERROR          /* Unexpected conditions */
-#undef DEBUG_PACKET_DUMP        /* Dump packet on the screen */
-#undef DEBUG_IOCTL_TRACE        /* Misc call by Linux */
-#undef DEBUG_IOCTL_INFO         /* Various debug info */
-#define DEBUG_IOCTL_ERROR       /* What's going wrong */
-#define DEBUG_BASIC_SHOW        /* Show basic startup info */
-#undef DEBUG_VERSION_SHOW       /* Print version info */
-#undef DEBUG_PSA_SHOW           /* Dump psa to screen */
-#undef DEBUG_MMC_SHOW           /* Dump mmc to screen */
-#undef DEBUG_SHOW_UNUSED        /* Show also unused fields */
-#undef DEBUG_I82593_SHOW        /* Show i82593 status */
-#undef DEBUG_DEVICE_SHOW        /* Show device parameters */
-
-/************************ CONSTANTS & MACROS ************************/
-
-#ifdef DEBUG_VERSION_SHOW
-static const char *version = "wavelan_cs.c : v24 (SMP + wireless extensions) 11/1/02\n";
-#endif
-
-/* Watchdog temporisation */
-#define WATCHDOG_JIFFIES        (256*HZ/100)
-
-/* Fix a bug in some old wireless extension definitions */
-#ifndef IW_ESSID_MAX_SIZE
-#define IW_ESSID_MAX_SIZE       32
-#endif
-
-/* ------------------------ PRIVATE IOCTL ------------------------ */
-
-#define SIOCSIPQTHR     SIOCIWFIRSTPRIV         /* Set quality threshold */
-#define SIOCGIPQTHR     SIOCIWFIRSTPRIV + 1     /* Get quality threshold */
-#define SIOCSIPROAM     SIOCIWFIRSTPRIV + 2     /* Set roaming state */
-#define SIOCGIPROAM     SIOCIWFIRSTPRIV + 3     /* Get roaming state */
-
-#define SIOCSIPHISTO    SIOCIWFIRSTPRIV + 4     /* Set histogram ranges */
-#define SIOCGIPHISTO    SIOCIWFIRSTPRIV + 5     /* Get histogram values */
-
-/*************************** WaveLAN Roaming  **************************/
-#ifdef WAVELAN_ROAMING          /* Conditional compile, see above in options */
-
-#define WAVELAN_ROAMING_DEBUG    0      /* 1 = Trace of handover decisions */
-                                        /* 2 = Info on each beacon rcvd... */
-#define MAX_WAVEPOINTS          7       /* Max visible at one time */
-#define WAVEPOINT_HISTORY       5       /* SNR sample history slow search */
-#define WAVEPOINT_FAST_HISTORY  2       /* SNR sample history fast search */
-#define SEARCH_THRESH_LOW       10      /* SNR to enter cell search */
-#define SEARCH_THRESH_HIGH      13      /* SNR to leave cell search */
-#define WAVELAN_ROAMING_DELTA   1       /* Hysteresis value (+/- SNR) */
-#define CELL_TIMEOUT            2*HZ    /* in jiffies */
-
-#define FAST_CELL_SEARCH        1       /* Boolean values... */
-#define NWID_PROMISC            1       /* for code clarity. */
-
-typedef struct wavepoint_beacon
-{
-  unsigned char         dsap,           /* Unused */
-                        ssap,           /* Unused */
-                        ctrl,           /* Unused */
-                        O,U,I,          /* Unused */
-                        spec_id1,       /* Unused */
-                        spec_id2,       /* Unused */
-                        pdu_type,       /* Unused */
-                        seq;            /* WavePoint beacon sequence number */
-  __be16                domain_id,      /* WavePoint Domain ID */
-                        nwid;           /* WavePoint NWID */
-} wavepoint_beacon;
-
-typedef struct wavepoint_history
-{
-  unsigned short        nwid;           /* WavePoint's NWID */
-  int                   average_slow;   /* SNR running average */
-  int                   average_fast;   /* SNR running average */
-  unsigned char   sigqual[WAVEPOINT_HISTORY]; /* Ringbuffer of recent SNR's */
-  unsigned char         qualptr;        /* Index into ringbuffer */
-  unsigned char         last_seq;       /* Last seq. no seen for WavePoint */
-  struct wavepoint_history *next;       /* Next WavePoint in table */
-  struct wavepoint_history *prev;       /* Previous WavePoint in table */
-  unsigned long         last_seen;      /* Time of last beacon recvd, jiffies */
-} wavepoint_history;
-
-struct wavepoint_table
-{
-  wavepoint_history     *head;          /* Start of ringbuffer */
-  int                   num_wavepoints; /* No. of WavePoints visible */
-  unsigned char         locked;         /* Table lock */
-};
-
-#endif  /* WAVELAN_ROAMING */
-
-/****************************** TYPES ******************************/
-
-/* Shortcuts */
-typedef struct iw_statistics    iw_stats;
-typedef struct iw_quality       iw_qual;
-typedef struct iw_freq          iw_freq;
-typedef struct net_local        net_local;
-typedef struct timer_list       timer_list;
-
-/* Basic types */
-typedef u_char          mac_addr[WAVELAN_ADDR_SIZE];    /* Hardware address */
-
-/*
- * Static specific data for the interface.
- *
- * For each network interface, Linux keep data in two structure. "device"
- * keep the generic data (same format for everybody) and "net_local" keep
- * the additional specific data.
- */
-struct net_local
-{
-  dev_node_t    node;           /* ???? What is this stuff ???? */
-  struct net_device *   dev;            /* Reverse link... */
-  spinlock_t    spinlock;       /* Serialize access to the hardware (SMP) */
-  struct pcmcia_device *        link;           /* pcmcia structure */
-  int           nresets;        /* Number of hw resets */
-  u_char        configured;     /* If it is configured */
-  u_char        reconfig_82593; /* Need to reconfigure the controller */
-  u_char        promiscuous;    /* Promiscuous mode */
-  u_char        allmulticast;   /* All Multicast mode */
-  int           mc_count;       /* Number of multicast addresses */
-
-  int           stop;           /* Current i82593 Stop Hit Register */
-  int           rfp;            /* Last DMA machine receive pointer */
-  int           overrunning;    /* Receiver overrun flag */
-
-  iw_stats      wstats;         /* Wireless specific stats */
-
-  struct iw_spy_data    spy_data;
-  struct iw_public_data wireless_data;
-
-#ifdef HISTOGRAM
-  int           his_number;             /* Number of intervals */
-  u_char        his_range[16];          /* Boundaries of interval ]n-1; n] */
-  u_long        his_sum[16];            /* Sum in interval */
-#endif  /* HISTOGRAM */
-#ifdef WAVELAN_ROAMING
-  u_long        domain_id;      /* Domain ID we lock on for roaming */
-  int           filter_domains; /* Check Domain ID of beacon found */
- struct wavepoint_table wavepoint_table;        /* Table of visible WavePoints*/
-  wavepoint_history *   curr_point;             /* Current wavepoint */
-  int                   cell_search;            /* Searching for new cell? */
-  struct timer_list     cell_timer;             /* Garbage collection */
-#endif  /* WAVELAN_ROAMING */
-  void __iomem *mem;
-};
-
-/* ----------------- MODEM MANAGEMENT SUBROUTINES ----------------- */
-static inline u_char            /* data */
-        hasr_read(u_long);      /* Read the host interface : base address */
-static void
-        hacr_write(u_long,      /* Write to host interface : base address */
-                   u_char),     /* data */
-        hacr_write_slow(u_long,
-                   u_char);
-static void
-        psa_read(struct net_device *,   /* Read the Parameter Storage Area */
-                 int,           /* offset in PSA */
-                 u_char *,      /* buffer to fill */
-                 int),          /* size to read */
-        psa_write(struct net_device *,  /* Write to the PSA */
-                  int,          /* Offset in psa */
-                  u_char *,     /* Buffer in memory */
-                  int);         /* Length of buffer */
-static void
-        mmc_out(u_long,         /* Write 1 byte to the Modem Manag Control */
-                u_short,
-                u_char),
-        mmc_write(u_long,       /* Write n bytes to the MMC */
-                  u_char,
-                  u_char *,
-                  int);
-static u_char                   /* Read 1 byte from the MMC */
-        mmc_in(u_long,
-               u_short);
-static void
-        mmc_read(u_long,        /* Read n bytes from the MMC */
-                 u_char,
-                 u_char *,
-                 int),
-        fee_wait(u_long,        /* Wait for frequency EEprom : base address */
-                 int,           /* Base delay to wait for */
-                 int);          /* Number of time to wait */
-static void
-        fee_read(u_long,        /* Read the frequency EEprom : base address */
-                 u_short,       /* destination offset */
-                 u_short *,     /* data buffer */
-                 int);          /* number of registers */
-/* ---------------------- I82593 SUBROUTINES ----------------------- */
-static int
-        wv_82593_cmd(struct net_device *,       /* synchronously send a command to i82593 */ 
-                     char *,
-                     int,
-                     int);
-static inline int
-        wv_diag(struct net_device *);   /* Diagnostique the i82593 */
-static int
-        read_ringbuf(struct net_device *,       /* Read a receive buffer */
-                     int,
-                     char *,
-                     int);
-static void
-        wv_82593_reconfig(struct net_device *); /* Reconfigure the controller */
-/* ------------------- DEBUG & INFO SUBROUTINES ------------------- */
-static void
-        wv_init_info(struct net_device *);      /* display startup info */
-/* ------------------- IOCTL, STATS & RECONFIG ------------------- */
-static iw_stats *
-        wavelan_get_wireless_stats(struct net_device *);
-/* ----------------------- PACKET RECEPTION ----------------------- */
-static int
-        wv_start_of_frame(struct net_device *,  /* Seek beggining of current frame */
-                          int,  /* end of frame */
-                          int); /* start of buffer */
-static void
-        wv_packet_read(struct net_device *,     /* Read a packet from a frame */
-                       int,
-                       int),
-        wv_packet_rcv(struct net_device *);     /* Read all packets waiting */
-/* --------------------- PACKET TRANSMISSION --------------------- */
-static void
-        wv_packet_write(struct net_device *,    /* Write a packet to the Tx buffer */
-                        void *,
-                        short);
-static netdev_tx_t
-        wavelan_packet_xmit(struct sk_buff *,   /* Send a packet */
-                            struct net_device *);
-/* -------------------- HARDWARE CONFIGURATION -------------------- */
-static int
-        wv_mmc_init(struct net_device *);       /* Initialize the modem */
-static int
-        wv_ru_stop(struct net_device *),        /* Stop the i82593 receiver unit */
-        wv_ru_start(struct net_device *);       /* Start the i82593 receiver unit */
-static int
-        wv_82593_config(struct net_device *);   /* Configure the i82593 */
-static int
-        wv_pcmcia_reset(struct net_device *);   /* Reset the pcmcia interface */
-static int
-        wv_hw_config(struct net_device *);      /* Reset & configure the whole hardware */
-static void
-        wv_hw_reset(struct net_device *);       /* Same, + start receiver unit */
-static int
-        wv_pcmcia_config(struct pcmcia_device *);       /* Configure the pcmcia interface */
-static void
-        wv_pcmcia_release(struct pcmcia_device *);/* Remove a device */
-/* ---------------------- INTERRUPT HANDLING ---------------------- */
-static irqreturn_t
-        wavelan_interrupt(int,  /* Interrupt handler */
-                          void *);
-static void
-        wavelan_watchdog(struct net_device *);  /* Transmission watchdog */
-/* ------------------- CONFIGURATION CALLBACKS ------------------- */
-static int
-        wavelan_open(struct net_device *),              /* Open the device */
-        wavelan_close(struct net_device *);     /* Close the device */
-static void
-        wavelan_detach(struct pcmcia_device *p_dev);    /* Destroy a removed device */
-
-/**************************** VARIABLES ****************************/
-
-/*
- * Parameters that can be set with 'insmod'
- * The exact syntax is 'insmod wavelan_cs.o <var>=<value>'
- */
-
-/* Shared memory speed, in ns */
-static int      mem_speed = 0;
-
-/* New module interface */
-module_param(mem_speed, int, 0);
-
-#ifdef WAVELAN_ROAMING          /* Conditional compile, see above in options */
-/* Enable roaming mode ? No ! Please keep this to 0 */
-static int      do_roaming = 0;
-module_param(do_roaming, bool, 0);
-#endif  /* WAVELAN_ROAMING */
-
-MODULE_LICENSE("GPL");
-
-#endif  /* WAVELAN_CS_P_H */
-
diff --git a/drivers/net/wireless/wl12xx/Kconfig b/drivers/net/wireless/wl12xx/Kconfig
index 88060e117541..785e0244e305 100644
--- a/drivers/net/wireless/wl12xx/Kconfig
+++ b/drivers/net/wireless/wl12xx/Kconfig
@@ -1,6 +1,6 @@
 menuconfig WL12XX
         tristate "TI wl12xx driver support"
-        depends on MAC80211 && WLAN_80211 && EXPERIMENTAL
+        depends on MAC80211 && EXPERIMENTAL
         ---help---
           This will enable TI wl12xx driver support. The drivers make
           use of the mac80211 stack.
@@ -42,6 +42,7 @@ config WL1251_SDIO
 config WL1271
         tristate "TI wl1271 support"
         depends on WL12XX && SPI_MASTER && GENERIC_HARDIRQS
+        depends on INET
         select FW_LOADER
         select CRC7
         ---help---
diff --git a/drivers/net/wireless/wl12xx/Makefile b/drivers/net/wireless/wl12xx/Makefile
index 62e37ad01cc0..f47ec94c16dc 100644
--- a/drivers/net/wireless/wl12xx/Makefile
+++ b/drivers/net/wireless/wl12xx/Makefile
@@ -10,5 +10,7 @@ obj-$(CONFIG_WL1251_SDIO)	+= wl1251_sdio.o
 wl1271-objs             = wl1271_main.o  wl1271_spi.o wl1271_cmd.o  \
                           wl1271_event.o wl1271_tx.o  wl1271_rx.o   \
                           wl1271_ps.o    wl1271_acx.o wl1271_boot.o \
-                          wl1271_init.o  wl1271_debugfs.o
+                          wl1271_init.o  wl1271_debugfs.o wl1271_io.o
+
+wl1271-$(CONFIG_NL80211_TESTMODE)       += wl1271_testmode.o
 obj-$(CONFIG_WL1271)    += wl1271.o
diff --git a/drivers/net/wireless/wl12xx/wl1251.h b/drivers/net/wireless/wl12xx/wl1251.h
index 998e4b6252bd..37c61c19cae5 100644
--- a/drivers/net/wireless/wl12xx/wl1251.h
+++ b/drivers/net/wireless/wl12xx/wl1251.h
@@ -247,6 +247,7 @@ struct wl1251_debugfs {
         struct dentry *rxpipe_tx_xfr_host_int_trig_rx_data;
 
         struct dentry *tx_queue_len;
+        struct dentry *tx_queue_status;
 
         struct dentry *retry_count;
         struct dentry *excessive_retries;
@@ -269,6 +270,7 @@ struct wl1251 {
 
         void (*set_power)(bool enable);
         int irq;
+        bool use_eeprom;
 
         enum wl1251_state state;
         struct mutex mutex;
@@ -339,9 +341,6 @@ struct wl1251 {
         /* Are we currently scanning */
         bool scanning;
 
-        /* Our association ID */
-        u16 aid;
-
         /* Default key (for WEP) */
         u32 default_key;
 
@@ -354,6 +353,8 @@ struct wl1251 {
         /* is firmware in elp mode */
         bool elp;
 
+        struct delayed_work elp_work;
+
         /* we can be in psm, but not in elp, we have to differentiate */
         bool psm;
 
@@ -374,6 +375,8 @@ struct wl1251 {
         u8 buffer_busyword[WL1251_BUSY_WORD_LEN];
         struct wl1251_rx_descriptor *rx_descriptor;
 
+        struct ieee80211_vif *vif;
+
         u32 chip_id;
         char fw_ver[21];
 };
diff --git a/drivers/net/wireless/wl12xx/wl1251_acx.c b/drivers/net/wireless/wl12xx/wl1251_acx.c
index 10b26c4532c9..91891f928070 100644
--- a/drivers/net/wireless/wl12xx/wl1251_acx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_acx.c
@@ -1,6 +1,7 @@
 #include "wl1251_acx.h"
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/crc7.h>
 
 #include "wl1251.h"
@@ -494,7 +495,7 @@ out:
         return ret;
 }
 
-int wl1251_acx_beacon_filter_opt(struct wl1251 *wl)
+int wl1251_acx_beacon_filter_opt(struct wl1251 *wl, bool enable_filter)
 {
         struct acx_beacon_filter_option *beacon_filter;
         int ret;
@@ -507,7 +508,7 @@ int wl1251_acx_beacon_filter_opt(struct wl1251 *wl)
                 goto out;
         }
 
-        beacon_filter->enable = 0;
+        beacon_filter->enable = enable_filter;
         beacon_filter->max_num_beacons = 0;
 
         ret = wl1251_cmd_configure(wl, ACX_BEACON_FILTER_OPT,
@@ -525,6 +526,7 @@ out:
 int wl1251_acx_beacon_filter_table(struct wl1251 *wl)
 {
         struct acx_beacon_filter_ie_table *ie_table;
+        int idx = 0;
         int ret;
 
         wl1251_debug(DEBUG_ACX, "acx beacon filter table");
@@ -535,8 +537,10 @@ int wl1251_acx_beacon_filter_table(struct wl1251 *wl)
                 goto out;
         }
 
-        ie_table->num_ie = 0;
-        memset(ie_table->table, 0, BEACON_FILTER_TABLE_MAX_SIZE);
+        /* configure default beacon pass-through rules */
+        ie_table->num_ie = 1;
+        ie_table->table[idx++] = BEACON_FILTER_IE_ID_CHANNEL_SWITCH_ANN;
+        ie_table->table[idx++] = BEACON_RULE_PASS_ON_APPEARANCE;
 
         ret = wl1251_cmd_configure(wl, ACX_BEACON_FILTER_TABLE,
                                    ie_table, sizeof(*ie_table));
@@ -550,6 +554,35 @@ out:
         return ret;
 }
 
+int wl1251_acx_conn_monit_params(struct wl1251 *wl)
+{
+        struct acx_conn_monit_params *acx;
+        int ret;
+
+        wl1251_debug(DEBUG_ACX, "acx connection monitor parameters");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->synch_fail_thold = SYNCH_FAIL_DEFAULT_THRESHOLD;
+        acx->bss_lose_timeout = NO_BEACON_DEFAULT_TIMEOUT;
+
+        ret = wl1251_cmd_configure(wl, ACX_CONN_MONIT_PARAMS,
+                                   acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1251_warning("failed to set connection monitor "
+                               "parameters: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
 int wl1251_acx_sg_enable(struct wl1251 *wl)
 {
         struct acx_bt_wlan_coex *pta;
@@ -916,3 +949,100 @@ out:
         kfree(mem_conf);
         return ret;
 }
+
+int wl1251_acx_wr_tbtt_and_dtim(struct wl1251 *wl, u16 tbtt, u8 dtim)
+{
+        struct wl1251_acx_wr_tbtt_and_dtim *acx;
+        int ret;
+
+        wl1251_debug(DEBUG_ACX, "acx tbtt and dtim");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->tbtt = tbtt;
+        acx->dtim = dtim;
+
+        ret = wl1251_cmd_configure(wl, ACX_WR_TBTT_AND_DTIM,
+                                   acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1251_warning("failed to set tbtt and dtim: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1251_acx_ac_cfg(struct wl1251 *wl, u8 ac, u8 cw_min, u16 cw_max,
+                      u8 aifs, u16 txop)
+{
+        struct wl1251_acx_ac_cfg *acx;
+        int ret = 0;
+
+        wl1251_debug(DEBUG_ACX, "acx ac cfg %d cw_ming %d cw_max %d "
+                     "aifs %d txop %d", ac, cw_min, cw_max, aifs, txop);
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->ac = ac;
+        acx->cw_min = cw_min;
+        acx->cw_max = cw_max;
+        acx->aifsn = aifs;
+        acx->txop_limit = txop;
+
+        ret = wl1251_cmd_configure(wl, ACX_AC_CFG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1251_warning("acx ac cfg failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1251_acx_tid_cfg(struct wl1251 *wl, u8 queue,
+                       enum wl1251_acx_channel_type type,
+                       u8 tsid, enum wl1251_acx_ps_scheme ps_scheme,
+                       enum wl1251_acx_ack_policy ack_policy)
+{
+        struct wl1251_acx_tid_cfg *acx;
+        int ret = 0;
+
+        wl1251_debug(DEBUG_ACX, "acx tid cfg %d type %d tsid %d "
+                     "ps_scheme %d ack_policy %d", queue, type, tsid,
+                     ps_scheme, ack_policy);
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->queue = queue;
+        acx->type = type;
+        acx->tsid = tsid;
+        acx->ps_scheme = ps_scheme;
+        acx->ack_policy = ack_policy;
+
+        ret = wl1251_cmd_configure(wl, ACX_TID_CFG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1251_warning("acx tid cfg failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1251_acx.h b/drivers/net/wireless/wl12xx/wl1251_acx.h
index cafb91459504..26160c45784c 100644
--- a/drivers/net/wireless/wl12xx/wl1251_acx.h
+++ b/drivers/net/wireless/wl12xx/wl1251_acx.h
@@ -450,6 +450,11 @@ struct acx_beacon_filter_option {
                            (BEACON_FILTER_TABLE_MAX_VENDOR_SPECIFIC_IE_NUM * \
                             BEACON_FILTER_TABLE_EXTRA_VENDOR_SPECIFIC_IE_SIZE))
 
+#define BEACON_RULE_PASS_ON_CHANGE                     BIT(0)
+#define BEACON_RULE_PASS_ON_APPEARANCE                 BIT(1)
+
+#define BEACON_FILTER_IE_ID_CHANNEL_SWITCH_ANN         (37)
+
 struct acx_beacon_filter_ie_table {
         struct acx_header header;
 
@@ -458,6 +463,16 @@ struct acx_beacon_filter_ie_table {
         u8 pad[3];
 } __attribute__ ((packed));
 
+#define SYNCH_FAIL_DEFAULT_THRESHOLD    10     /* number of beacons */
+#define NO_BEACON_DEFAULT_TIMEOUT       (500) /* in microseconds */
+
+struct acx_conn_monit_params {
+        struct acx_header header;
+
+        u32 synch_fail_thold; /* number of beacons missed */
+        u32 bss_lose_timeout; /* number of TU's from synch fail */
+};
+
 enum {
         SG_ENABLE = 0,
         SG_DISABLE,
@@ -1134,6 +1149,104 @@ struct wl1251_acx_mem_map {
         u32 num_rx_mem_blocks;
 } __attribute__ ((packed));
 
+
+struct wl1251_acx_wr_tbtt_and_dtim {
+
+        struct acx_header header;
+
+        /* Time in TUs between two consecutive beacons */
+        u16 tbtt;
+
+        /*
+         * DTIM period
+         * For BSS: Number of TBTTs in a DTIM period (range: 1-10)
+         * For IBSS: value shall be set to 1
+        */
+        u8  dtim;
+        u8  padding;
+} __attribute__ ((packed));
+
+struct wl1251_acx_ac_cfg {
+        struct acx_header header;
+
+        /*
+         * Access Category - The TX queue's access category
+         * (refer to AccessCategory_enum)
+         */
+        u8 ac;
+
+        /*
+         * The contention window minimum size (in slots) for
+         * the access class.
+         */
+        u8 cw_min;
+
+        /*
+         * The contention window maximum size (in slots) for
+         * the access class.
+         */
+        u16 cw_max;
+
+        /* The AIF value (in slots) for the access class. */
+        u8 aifsn;
+
+        u8 reserved;
+
+        /* The TX Op Limit (in microseconds) for the access class. */
+        u16 txop_limit;
+} __attribute__ ((packed));
+
+
+enum wl1251_acx_channel_type {
+        CHANNEL_TYPE_DCF        = 0,
+        CHANNEL_TYPE_EDCF       = 1,
+        CHANNEL_TYPE_HCCA       = 2,
+};
+
+enum wl1251_acx_ps_scheme {
+        /* regular ps: simple sending of packets */
+        WL1251_ACX_PS_SCHEME_LEGACY     = 0,
+
+        /* sending a packet triggers a unscheduled apsd downstream */
+        WL1251_ACX_PS_SCHEME_UPSD_TRIGGER       = 1,
+
+        /* a pspoll packet will be sent before every data packet */
+        WL1251_ACX_PS_SCHEME_LEGACY_PSPOLL      = 2,
+
+        /* scheduled apsd mode */
+        WL1251_ACX_PS_SCHEME_SAPSD              = 3,
+};
+
+enum wl1251_acx_ack_policy {
+        WL1251_ACX_ACK_POLICY_LEGACY    = 0,
+        WL1251_ACX_ACK_POLICY_NO_ACK    = 1,
+        WL1251_ACX_ACK_POLICY_BLOCK     = 2,
+};
+
+struct wl1251_acx_tid_cfg {
+        struct acx_header header;
+
+        /* tx queue id number (0-7) */
+        u8 queue;
+
+        /* channel access type for the queue, enum wl1251_acx_channel_type */
+        u8 type;
+
+        /* EDCA: ac index (0-3), HCCA: traffic stream id (8-15) */
+        u8 tsid;
+
+        /* ps scheme of the specified queue, enum wl1251_acx_ps_scheme */
+        u8 ps_scheme;
+
+        /* the tx queue ack policy, enum wl1251_acx_ack_policy */
+        u8 ack_policy;
+
+        u8 padding[3];
+
+        /* not supported */
+        u32 apsdconf[2];
+} __attribute__ ((packed));
+
 /*************************************************************************
 
     Host Interrupt Register (WiLink -> Host)
@@ -1273,8 +1386,9 @@ int wl1251_acx_slot(struct wl1251 *wl, enum acx_slot_type slot_time);
 int wl1251_acx_group_address_tbl(struct wl1251 *wl);
 int wl1251_acx_service_period_timeout(struct wl1251 *wl);
 int wl1251_acx_rts_threshold(struct wl1251 *wl, u16 rts_threshold);
-int wl1251_acx_beacon_filter_opt(struct wl1251 *wl);
+int wl1251_acx_beacon_filter_opt(struct wl1251 *wl, bool enable_filter);
 int wl1251_acx_beacon_filter_table(struct wl1251 *wl);
+int wl1251_acx_conn_monit_params(struct wl1251 *wl);
 int wl1251_acx_sg_enable(struct wl1251 *wl);
 int wl1251_acx_sg_cfg(struct wl1251 *wl);
 int wl1251_acx_cca_threshold(struct wl1251 *wl);
@@ -1288,5 +1402,12 @@ int wl1251_acx_statistics(struct wl1251 *wl, struct acx_statistics *stats);
 int wl1251_acx_tsf_info(struct wl1251 *wl, u64 *mactime);
 int wl1251_acx_rate_policies(struct wl1251 *wl);
 int wl1251_acx_mem_cfg(struct wl1251 *wl);
+int wl1251_acx_wr_tbtt_and_dtim(struct wl1251 *wl, u16 tbtt, u8 dtim);
+int wl1251_acx_ac_cfg(struct wl1251 *wl, u8 ac, u8 cw_min, u16 cw_max,
+                      u8 aifs, u16 txop);
+int wl1251_acx_tid_cfg(struct wl1251 *wl, u8 queue,
+                       enum wl1251_acx_channel_type type,
+                       u8 tsid, enum wl1251_acx_ps_scheme ps_scheme,
+                       enum wl1251_acx_ack_policy ack_policy);
 
 #endif /* __WL1251_ACX_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1251_boot.c b/drivers/net/wireless/wl12xx/wl1251_boot.c
index 452d748e42c6..d5ac79aeaa73 100644
--- a/drivers/net/wireless/wl12xx/wl1251_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1251_boot.c
@@ -22,6 +22,7 @@
  */
 
 #include <linux/gpio.h>
+#include <linux/slab.h>
 
 #include "wl1251_reg.h"
 #include "wl1251_boot.h"
@@ -256,7 +257,7 @@ int wl1251_boot_run_firmware(struct wl1251 *wl)
                 }
         }
 
-        if (loop >= INIT_LOOP) {
+        if (loop > INIT_LOOP) {
                 wl1251_error("timeout waiting for the hardware to "
                              "complete initialization");
                 return -EIO;
@@ -296,8 +297,12 @@ int wl1251_boot_run_firmware(struct wl1251 *wl)
                 WL1251_ACX_INTR_INIT_COMPLETE;
         wl1251_boot_target_enable_interrupts(wl);
 
-        /* unmask all mbox events  */
-        wl->event_mask = 0xffffffff;
+        wl->event_mask = SCAN_COMPLETE_EVENT_ID | BSS_LOSE_EVENT_ID |
+                SYNCHRONIZATION_TIMEOUT_EVENT_ID |
+                ROAMING_TRIGGER_LOW_RSSI_EVENT_ID |
+                ROAMING_TRIGGER_REGAINED_RSSI_EVENT_ID |
+                REGAINED_BSS_EVENT_ID | BT_PTA_SENSE_EVENT_ID |
+                BT_PTA_PREDICTION_EVENT_ID;
 
         ret = wl1251_event_unmask(wl);
         if (ret < 0) {
@@ -314,8 +319,8 @@ int wl1251_boot_run_firmware(struct wl1251 *wl)
 static int wl1251_boot_upload_firmware(struct wl1251 *wl)
 {
         int addr, chunk_num, partition_limit;
-        size_t fw_data_len;
-        u8 *p;
+        size_t fw_data_len, len;
+        u8 *p, *buf;
 
         /* whal_FwCtrl_LoadFwImageSm() */
 
@@ -334,6 +339,12 @@ static int wl1251_boot_upload_firmware(struct wl1251 *wl)
                 return -EIO;
         }
 
+        buf = kmalloc(CHUNK_SIZE, GFP_KERNEL);
+        if (!buf) {
+                wl1251_error("allocation for firmware upload chunk failed");
+                return -ENOMEM;
+        }
+
         wl1251_set_partition(wl, WL1251_PART_DOWN_MEM_START,
                              WL1251_PART_DOWN_MEM_SIZE,
                              WL1251_PART_DOWN_REG_START,
@@ -364,7 +375,11 @@ static int wl1251_boot_upload_firmware(struct wl1251 *wl)
                 p = wl->fw + FW_HDR_SIZE + chunk_num * CHUNK_SIZE;
                 wl1251_debug(DEBUG_BOOT, "uploading fw chunk 0x%p to 0x%x",
                              p, addr);
-                wl1251_mem_write(wl, addr, p, CHUNK_SIZE);
+
+                /* need to copy the chunk for dma */
+                len = CHUNK_SIZE;
+                memcpy(buf, p, len);
+                wl1251_mem_write(wl, addr, buf, len);
 
                 chunk_num++;
         }
@@ -372,9 +387,16 @@ static int wl1251_boot_upload_firmware(struct wl1251 *wl)
         /* 10.4 upload the last chunk */
         addr = WL1251_PART_DOWN_MEM_START + chunk_num * CHUNK_SIZE;
         p = wl->fw + FW_HDR_SIZE + chunk_num * CHUNK_SIZE;
+
+        /* need to copy the chunk for dma */
+        len = fw_data_len % CHUNK_SIZE;
+        memcpy(buf, p, len);
+
         wl1251_debug(DEBUG_BOOT, "uploading fw last chunk (%zu B) 0x%p to 0x%x",
-                     fw_data_len % CHUNK_SIZE, p, addr);
-        wl1251_mem_write(wl, addr, p, fw_data_len % CHUNK_SIZE);
+                     len, p, addr);
+        wl1251_mem_write(wl, addr, buf, len);
+
+        kfree(buf);
 
         return 0;
 }
@@ -473,13 +495,19 @@ int wl1251_boot(struct wl1251 *wl)
                 goto out;
 
         /* 2. start processing NVS file */
-        ret = wl1251_boot_upload_nvs(wl);
-        if (ret < 0)
-                goto out;
-
-        /* write firmware's last address (ie. it's length) to
-         * ACX_EEPROMLESS_IND_REG */
-        wl1251_reg_write32(wl, ACX_EEPROMLESS_IND_REG, wl->fw_len);
+        if (wl->use_eeprom) {
+                wl1251_reg_write32(wl, ACX_REG_EE_START, START_EEPROM_MGR);
+                msleep(4000);
+                wl1251_reg_write32(wl, ACX_EEPROMLESS_IND_REG, USE_EEPROM);
+        } else {
+                ret = wl1251_boot_upload_nvs(wl);
+                if (ret < 0)
+                        goto out;
+
+                /* write firmware's last address (ie. it's length) to
+                 * ACX_EEPROMLESS_IND_REG */
+                wl1251_reg_write32(wl, ACX_EEPROMLESS_IND_REG, wl->fw_len);
+        }
 
         /* 6. read the EEPROM parameters */
         tmp = wl1251_reg_read32(wl, SCR_PAD2);
diff --git a/drivers/net/wireless/wl12xx/wl1251_cmd.c b/drivers/net/wireless/wl12xx/wl1251_cmd.c
index 770f260726bd..a37b30cef489 100644
--- a/drivers/net/wireless/wl12xx/wl1251_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1251_cmd.c
@@ -1,6 +1,7 @@
 #include "wl1251_cmd.h"
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/crc7.h>
 
 #include "wl1251.h"
@@ -410,3 +411,86 @@ out:
         kfree(cmd);
         return ret;
 }
+
+int wl1251_cmd_scan(struct wl1251 *wl, u8 *ssid, size_t ssid_len,
+                    struct ieee80211_channel *channels[],
+                    unsigned int n_channels, unsigned int n_probes)
+{
+        struct wl1251_cmd_scan *cmd;
+        int i, ret = 0;
+
+        wl1251_debug(DEBUG_CMD, "cmd scan");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->params.rx_config_options = cpu_to_le32(CFG_RX_ALL_GOOD);
+        cmd->params.rx_filter_options = cpu_to_le32(CFG_RX_PRSP_EN |
+                                                    CFG_RX_MGMT_EN |
+                                                    CFG_RX_BCN_EN);
+        cmd->params.scan_options = 0;
+        cmd->params.num_channels = n_channels;
+        cmd->params.num_probe_requests = n_probes;
+        cmd->params.tx_rate = cpu_to_le16(1 << 1); /* 2 Mbps */
+        cmd->params.tid_trigger = 0;
+
+        for (i = 0; i < n_channels; i++) {
+                cmd->channels[i].min_duration =
+                        cpu_to_le32(WL1251_SCAN_MIN_DURATION);
+                cmd->channels[i].max_duration =
+                        cpu_to_le32(WL1251_SCAN_MAX_DURATION);
+                memset(&cmd->channels[i].bssid_lsb, 0xff, 4);
+                memset(&cmd->channels[i].bssid_msb, 0xff, 2);
+                cmd->channels[i].early_termination = 0;
+                cmd->channels[i].tx_power_att = 0;
+                cmd->channels[i].channel = channels[i]->hw_value;
+        }
+
+        cmd->params.ssid_len = ssid_len;
+        if (ssid)
+                memcpy(cmd->params.ssid, ssid, ssid_len);
+
+        ret = wl1251_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd));
+        if (ret < 0) {
+                wl1251_error("cmd scan failed: %d", ret);
+                goto out;
+        }
+
+        wl1251_mem_read(wl, wl->cmd_box_addr, cmd, sizeof(*cmd));
+
+        if (cmd->header.status != CMD_STATUS_SUCCESS) {
+                wl1251_error("cmd scan status wasn't success: %d",
+                             cmd->header.status);
+                ret = -EIO;
+                goto out;
+        }
+
+out:
+        kfree(cmd);
+        return ret;
+}
+
+int wl1251_cmd_trigger_scan_to(struct wl1251 *wl, u32 timeout)
+{
+        struct wl1251_cmd_trigger_scan_to *cmd;
+        int ret;
+
+        wl1251_debug(DEBUG_CMD, "cmd trigger scan to");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->timeout = timeout;
+
+        ret = wl1251_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd));
+        if (ret < 0) {
+                wl1251_error("cmd trigger scan to failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(cmd);
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1251_cmd.h b/drivers/net/wireless/wl12xx/wl1251_cmd.h
index dff798ad0ef5..4ad67cae94d2 100644
--- a/drivers/net/wireless/wl12xx/wl1251_cmd.h
+++ b/drivers/net/wireless/wl12xx/wl1251_cmd.h
@@ -27,6 +27,8 @@
 
 #include "wl1251.h"
 
+#include <net/cfg80211.h>
+
 struct acx_header;
 
 int wl1251_cmd_send(struct wl1251 *wl, u16 type, void *buf, size_t buf_len);
@@ -43,6 +45,10 @@ int wl1251_cmd_read_memory(struct wl1251 *wl, u32 addr, void *answer,
                            size_t len);
 int wl1251_cmd_template_set(struct wl1251 *wl, u16 cmd_id,
                             void *buf, size_t buf_len);
+int wl1251_cmd_scan(struct wl1251 *wl, u8 *ssid, size_t ssid_len,
+                    struct ieee80211_channel *channels[],
+                    unsigned int n_channels, unsigned int n_probes);
+int wl1251_cmd_trigger_scan_to(struct wl1251 *wl, u32 timeout);
 
 /* unit ms */
 #define WL1251_COMMAND_TIMEOUT 2000
@@ -163,8 +169,12 @@ struct cmd_read_write_memory {
 #define CMDMBOX_HEADER_LEN 4
 #define CMDMBOX_INFO_ELEM_HEADER_LEN 4
 
+#define WL1251_SCAN_MIN_DURATION 30000
+#define WL1251_SCAN_MAX_DURATION 60000
+
+#define WL1251_SCAN_NUM_PROBES 3
 
-struct basic_scan_parameters {
+struct wl1251_scan_parameters {
         u32 rx_config_options;
         u32 rx_filter_options;
 
@@ -189,11 +199,11 @@ struct basic_scan_parameters {
 
         u8 tid_trigger;
         u8 ssid_len;
-        u32 ssid[8];
+        u8 ssid[32];
 
 } __attribute__ ((packed));
 
-struct basic_scan_channel_parameters {
+struct wl1251_scan_ch_parameters {
         u32 min_duration; /* in TU */
         u32 max_duration; /* in TU */
         u32 bssid_lsb;
@@ -213,11 +223,11 @@ struct basic_scan_channel_parameters {
 /* SCAN parameters */
 #define SCAN_MAX_NUM_OF_CHANNELS 16
 
-struct cmd_scan {
+struct wl1251_cmd_scan {
         struct wl1251_cmd_header header;
 
-        struct basic_scan_parameters params;
-        struct basic_scan_channel_parameters channels[SCAN_MAX_NUM_OF_CHANNELS];
+        struct wl1251_scan_parameters params;
+        struct wl1251_scan_ch_parameters channels[SCAN_MAX_NUM_OF_CHANNELS];
 } __attribute__ ((packed));
 
 enum {
diff --git a/drivers/net/wireless/wl12xx/wl1251_debugfs.c b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
index a00723059f83..5e4465ac08fa 100644
--- a/drivers/net/wireless/wl12xx/wl1251_debugfs.c
+++ b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
@@ -24,6 +24,7 @@
 #include "wl1251_debugfs.h"
 
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 
 #include "wl1251.h"
 #include "wl1251_acx.h"
@@ -237,6 +238,27 @@ static const struct file_operations tx_queue_len_ops = {
         .open = wl1251_open_file_generic,
 };
 
+static ssize_t tx_queue_status_read(struct file *file, char __user *userbuf,
+                                    size_t count, loff_t *ppos)
+{
+        struct wl1251 *wl = file->private_data;
+        char buf[3], status;
+        int len;
+
+        if (wl->tx_queue_stopped)
+                status = 's';
+        else
+                status = 'r';
+
+        len = scnprintf(buf, sizeof(buf), "%c\n", status);
+        return simple_read_from_buffer(userbuf, count, ppos, buf, len);
+}
+
+static const struct file_operations tx_queue_status_ops = {
+        .read = tx_queue_status_read,
+        .open = wl1251_open_file_generic,
+};
+
 static void wl1251_debugfs_delete_files(struct wl1251 *wl)
 {
         DEBUGFS_FWSTATS_DEL(tx, internal_desc_overflow);
@@ -331,6 +353,7 @@ static void wl1251_debugfs_delete_files(struct wl1251 *wl)
         DEBUGFS_FWSTATS_DEL(rxpipe, tx_xfr_host_int_trig_rx_data);
 
         DEBUGFS_DEL(tx_queue_len);
+        DEBUGFS_DEL(tx_queue_status);
         DEBUGFS_DEL(retry_count);
         DEBUGFS_DEL(excessive_retries);
 }
@@ -431,6 +454,7 @@ static int wl1251_debugfs_add_files(struct wl1251 *wl)
         DEBUGFS_FWSTATS_ADD(rxpipe, tx_xfr_host_int_trig_rx_data);
 
         DEBUGFS_ADD(tx_queue_len, wl->debugfs.rootdir);
+        DEBUGFS_ADD(tx_queue_status, wl->debugfs.rootdir);
         DEBUGFS_ADD(retry_count, wl->debugfs.rootdir);
         DEBUGFS_ADD(excessive_retries, wl->debugfs.rootdir);
 
@@ -443,7 +467,8 @@ out:
 
 void wl1251_debugfs_reset(struct wl1251 *wl)
 {
-        memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
+        if (wl->stats.fw_stats != NULL)
+                memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
         wl->stats.retry_count = 0;
         wl->stats.excessive_retries = 0;
 }
diff --git a/drivers/net/wireless/wl12xx/wl1251_event.c b/drivers/net/wireless/wl12xx/wl1251_event.c
index 00076c4a8a21..020d764f9c13 100644
--- a/drivers/net/wireless/wl12xx/wl1251_event.c
+++ b/drivers/net/wireless/wl12xx/wl1251_event.c
@@ -79,6 +79,21 @@ static int wl1251_event_process(struct wl1251 *wl, struct event_mailbox *mbox)
                 }
         }
 
+        if (vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID && wl->psm) {
+                wl1251_debug(DEBUG_EVENT, "SYNCHRONIZATION_TIMEOUT_EVENT");
+
+                /* indicate to the stack, that beacons have been lost */
+                ieee80211_beacon_loss(wl->vif);
+        }
+
+        if (vector & REGAINED_BSS_EVENT_ID) {
+                if (wl->psm_requested) {
+                        ret = wl1251_ps_set_mode(wl, STATION_POWER_SAVE_MODE);
+                        if (ret < 0)
+                                return ret;
+                }
+        }
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/wl12xx/wl1251_init.c b/drivers/net/wireless/wl12xx/wl1251_init.c
index b2ee4f468fc4..b538bdd7b320 100644
--- a/drivers/net/wireless/wl12xx/wl1251_init.c
+++ b/drivers/net/wireless/wl12xx/wl1251_init.c
@@ -23,6 +23,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 
 #include "wl1251_init.h"
 #include "wl12xx_80211.h"
@@ -147,7 +148,8 @@ int wl1251_hw_init_beacon_filter(struct wl1251 *wl)
 {
         int ret;
 
-        ret = wl1251_acx_beacon_filter_opt(wl);
+        /* disable beacon filtering at this stage */
+        ret = wl1251_acx_beacon_filter_opt(wl, false);
         if (ret < 0)
                 return ret;
 
@@ -293,6 +295,11 @@ static int wl1251_hw_init_tx_queue_config(struct wl1251 *wl)
                         goto out;
         }
 
+        wl1251_acx_ac_cfg(wl, AC_BE, CWMIN_BE, CWMAX_BE, AIFS_DIFS, TXOP_BE);
+        wl1251_acx_ac_cfg(wl, AC_BK, CWMIN_BK, CWMAX_BK, AIFS_DIFS, TXOP_BK);
+        wl1251_acx_ac_cfg(wl, AC_VI, CWMIN_VI, CWMAX_VI, AIFS_DIFS, TXOP_VI);
+        wl1251_acx_ac_cfg(wl, AC_VO, CWMIN_VO, CWMAX_VO, AIFS_DIFS, TXOP_VO);
+
 out:
         kfree(config);
         return ret;
@@ -364,6 +371,11 @@ int wl1251_hw_init(struct wl1251 *wl)
         if (ret < 0)
                 goto out_free_data_path;
 
+        /* Initialize connection monitoring thresholds */
+        ret = wl1251_acx_conn_monit_params(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
         /* Beacon filtering */
         ret = wl1251_hw_init_beacon_filter(wl);
         if (ret < 0)
diff --git a/drivers/net/wireless/wl12xx/wl1251_init.h b/drivers/net/wireless/wl12xx/wl1251_init.h
index b3b25ec885ea..269cefb3e7d4 100644
--- a/drivers/net/wireless/wl12xx/wl1251_init.h
+++ b/drivers/net/wireless/wl12xx/wl1251_init.h
@@ -26,6 +26,53 @@
 
 #include "wl1251.h"
 
+enum {
+        /* best effort/legacy */
+        AC_BE = 0,
+
+        /* background */
+        AC_BK = 1,
+
+        /* video */
+        AC_VI = 2,
+
+        /* voice */
+        AC_VO = 3,
+
+        /* broadcast dummy access category */
+        AC_BCAST = 4,
+
+        NUM_ACCESS_CATEGORIES = 4
+};
+
+/* following are defult values for the IE fields*/
+#define CWMIN_BK  15
+#define CWMIN_BE  15
+#define CWMIN_VI  7
+#define CWMIN_VO  3
+#define CWMAX_BK  1023
+#define CWMAX_BE  63
+#define CWMAX_VI  15
+#define CWMAX_VO  7
+
+/* slot number setting to start transmission at PIFS interval */
+#define AIFS_PIFS 1
+
+/*
+ * slot number setting to start transmission at DIFS interval - normal DCF
+ * access
+ */
+#define AIFS_DIFS 2
+
+#define AIFSN_BK  7
+#define AIFSN_BE  3
+#define AIFSN_VI  AIFS_PIFS
+#define AIFSN_VO  AIFS_PIFS
+#define TXOP_BK   0
+#define TXOP_BE   0
+#define TXOP_VI   3008
+#define TXOP_VO   1504
+
 int wl1251_hw_init_hwenc_config(struct wl1251 *wl);
 int wl1251_hw_init_templates_config(struct wl1251 *wl);
 int wl1251_hw_init_rx_config(struct wl1251 *wl, u32 config, u32 filter);
diff --git a/drivers/net/wireless/wl12xx/wl1251_main.c b/drivers/net/wireless/wl12xx/wl1251_main.c
index 1103256ad989..1c8226eee409 100644
--- a/drivers/net/wireless/wl12xx/wl1251_main.c
+++ b/drivers/net/wireless/wl12xx/wl1251_main.c
@@ -28,6 +28,8 @@
 #include <linux/irq.h>
 #include <linux/crc32.h>
 #include <linux/etherdevice.h>
+#include <linux/vmalloc.h>
+#include <linux/slab.h>
 
 #include "wl1251.h"
 #include "wl12xx_80211.h"
@@ -83,7 +85,7 @@ static int wl1251_fetch_firmware(struct wl1251 *wl)
         }
 
         wl->fw_len = fw->size;
-        wl->fw = kmalloc(wl->fw_len, GFP_KERNEL);
+        wl->fw = vmalloc(wl->fw_len);
 
         if (!wl->fw) {
                 wl1251_error("could not allocate memory for the firmware");
@@ -183,8 +185,11 @@ static int wl1251_chip_wakeup(struct wl1251 *wl)
                 wl1251_debug(DEBUG_BOOT, "chip id 0x%x (1251 PG12)",
                              wl->chip_id);
                 break;
-        case CHIP_ID_1251_PG10:
         case CHIP_ID_1251_PG11:
+                wl1251_debug(DEBUG_BOOT, "chip id 0x%x (1251 PG11)",
+                             wl->chip_id);
+                break;
+        case CHIP_ID_1251_PG10:
         default:
                 wl1251_error("unsupported chip id: 0x%x", wl->chip_id);
                 ret = -ENODEV;
@@ -208,9 +213,10 @@ out:
         return ret;
 }
 
+#define WL1251_IRQ_LOOP_COUNT 10
 static void wl1251_irq_work(struct work_struct *work)
 {
-        u32 intr;
+        u32 intr, ctr = WL1251_IRQ_LOOP_COUNT;
         struct wl1251 *wl =
                 container_of(work, struct wl1251, irq_work);
         int ret;
@@ -231,78 +237,86 @@ static void wl1251_irq_work(struct work_struct *work)
         intr = wl1251_reg_read32(wl, ACX_REG_INTERRUPT_CLEAR);
         wl1251_debug(DEBUG_IRQ, "intr: 0x%x", intr);
 
-        if (wl->data_path) {
-                wl->rx_counter =
-                        wl1251_mem_read32(wl, wl->data_path->rx_control_addr);
-
-                /* We handle a frmware bug here */
-                switch ((wl->rx_counter - wl->rx_handled) & 0xf) {
-                case 0:
-                        wl1251_debug(DEBUG_IRQ, "RX: FW and host in sync");
-                        intr &= ~WL1251_ACX_INTR_RX0_DATA;
-                        intr &= ~WL1251_ACX_INTR_RX1_DATA;
-                        break;
-                case 1:
-                        wl1251_debug(DEBUG_IRQ, "RX: FW +1");
-                        intr |= WL1251_ACX_INTR_RX0_DATA;
-                        intr &= ~WL1251_ACX_INTR_RX1_DATA;
-                        break;
-                case 2:
-                        wl1251_debug(DEBUG_IRQ, "RX: FW +2");
-                        intr |= WL1251_ACX_INTR_RX0_DATA;
-                        intr |= WL1251_ACX_INTR_RX1_DATA;
-                        break;
-                default:
-                        wl1251_warning("RX: FW and host out of sync: %d",
-                                       wl->rx_counter - wl->rx_handled);
-                        break;
-                }
-
-                wl->rx_handled = wl->rx_counter;
+        do {
+                if (wl->data_path) {
+                        wl->rx_counter = wl1251_mem_read32(
+                                wl, wl->data_path->rx_control_addr);
+
+                        /* We handle a frmware bug here */
+                        switch ((wl->rx_counter - wl->rx_handled) & 0xf) {
+                        case 0:
+                                wl1251_debug(DEBUG_IRQ,
+                                             "RX: FW and host in sync");
+                                intr &= ~WL1251_ACX_INTR_RX0_DATA;
+                                intr &= ~WL1251_ACX_INTR_RX1_DATA;
+                                break;
+                        case 1:
+                                wl1251_debug(DEBUG_IRQ, "RX: FW +1");
+                                intr |= WL1251_ACX_INTR_RX0_DATA;
+                                intr &= ~WL1251_ACX_INTR_RX1_DATA;
+                                break;
+                        case 2:
+                                wl1251_debug(DEBUG_IRQ, "RX: FW +2");
+                                intr |= WL1251_ACX_INTR_RX0_DATA;
+                                intr |= WL1251_ACX_INTR_RX1_DATA;
+                                break;
+                        default:
+                                wl1251_warning(
+                                        "RX: FW and host out of sync: %d",
+                                        wl->rx_counter - wl->rx_handled);
+                                break;
+                        }
 
+                        wl->rx_handled = wl->rx_counter;
 
-                wl1251_debug(DEBUG_IRQ, "RX counter: %d", wl->rx_counter);
-        }
+                        wl1251_debug(DEBUG_IRQ, "RX counter: %d",
+                                     wl->rx_counter);
+                }
 
-        intr &= wl->intr_mask;
+                intr &= wl->intr_mask;
 
-        if (intr == 0) {
-                wl1251_debug(DEBUG_IRQ, "INTR is 0");
-                wl1251_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
-                                   ~(wl->intr_mask));
+                if (intr == 0) {
+                        wl1251_debug(DEBUG_IRQ, "INTR is 0");
+                        goto out_sleep;
+                }
 
-                goto out_sleep;
-        }
+                if (intr & WL1251_ACX_INTR_RX0_DATA) {
+                        wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_RX0_DATA");
+                        wl1251_rx(wl);
+                }
 
-        if (intr & WL1251_ACX_INTR_RX0_DATA) {
-                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_RX0_DATA");
-                wl1251_rx(wl);
-        }
+                if (intr & WL1251_ACX_INTR_RX1_DATA) {
+                        wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_RX1_DATA");
+                        wl1251_rx(wl);
+                }
 
-        if (intr & WL1251_ACX_INTR_RX1_DATA) {
-                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_RX1_DATA");
-                wl1251_rx(wl);
-        }
+                if (intr & WL1251_ACX_INTR_TX_RESULT) {
+                        wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_TX_RESULT");
+                        wl1251_tx_complete(wl);
+                }
 
-        if (intr & WL1251_ACX_INTR_TX_RESULT) {
-                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_TX_RESULT");
-                wl1251_tx_complete(wl);
-        }
+                if (intr & (WL1251_ACX_INTR_EVENT_A |
+                            WL1251_ACX_INTR_EVENT_B)) {
+                        wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_EVENT (0x%x)",
+                                     intr);
+                        if (intr & WL1251_ACX_INTR_EVENT_A)
+                                wl1251_event_handle(wl, 0);
+                        else
+                                wl1251_event_handle(wl, 1);
+                }
 
-        if (intr & (WL1251_ACX_INTR_EVENT_A | WL1251_ACX_INTR_EVENT_B)) {
-                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_EVENT (0x%x)", intr);
-                if (intr & WL1251_ACX_INTR_EVENT_A)
-                        wl1251_event_handle(wl, 0);
-                else
-                        wl1251_event_handle(wl, 1);
-        }
+                if (intr & WL1251_ACX_INTR_INIT_COMPLETE)
+                        wl1251_debug(DEBUG_IRQ,
+                                     "WL1251_ACX_INTR_INIT_COMPLETE");
 
-        if (intr & WL1251_ACX_INTR_INIT_COMPLETE)
-                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_INIT_COMPLETE");
+                if (--ctr == 0)
+                        break;
 
-        wl1251_reg_write32(wl, ACX_REG_INTERRUPT_MASK, ~(wl->intr_mask));
+                intr = wl1251_reg_read32(wl, ACX_REG_INTERRUPT_CLEAR);
+        } while (intr);
 
 out_sleep:
+        wl1251_reg_write32(wl, ACX_REG_INTERRUPT_MASK, ~(wl->intr_mask));
         wl1251_ps_elp_sleep(wl);
 
 out:
@@ -382,6 +396,7 @@ static int wl1251_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          * the queue here, otherwise the queue will get too long.
          */
         if (skb_queue_len(&wl->tx_queue) >= WL1251_TX_QUEUE_MAX_LENGTH) {
+                wl1251_debug(DEBUG_TX, "op_tx: tx_queue full, stop queues");
                 ieee80211_stop_queues(wl->hw);
 
                 /*
@@ -497,17 +512,23 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
 }
 
 static int wl1251_op_add_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_if_init_conf *conf)
+                                   struct ieee80211_vif *vif)
 {
         struct wl1251 *wl = hw->priv;
         int ret = 0;
 
         wl1251_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
-                     conf->type, conf->mac_addr);
+                     vif->type, vif->addr);
 
         mutex_lock(&wl->mutex);
+        if (wl->vif) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        wl->vif = vif;
 
-        switch (conf->type) {
+        switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 wl->bss_type = BSS_TYPE_STA_BSS;
                 break;
@@ -519,8 +540,8 @@ static int wl1251_op_add_interface(struct ieee80211_hw *hw,
                 goto out;
         }
 
-        if (memcmp(wl->mac_addr, conf->mac_addr, ETH_ALEN)) {
-                memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
+        if (memcmp(wl->mac_addr, vif->addr, ETH_ALEN)) {
+                memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
                 SET_IEEE80211_PERM_ADDR(wl->hw, wl->mac_addr);
                 ret = wl1251_acx_station_id(wl);
                 if (ret < 0)
@@ -533,44 +554,35 @@ out:
 }
 
 static void wl1251_op_remove_interface(struct ieee80211_hw *hw,
-                                         struct ieee80211_if_init_conf *conf)
+                                         struct ieee80211_vif *vif)
 {
+        struct wl1251 *wl = hw->priv;
+
+        mutex_lock(&wl->mutex);
         wl1251_debug(DEBUG_MAC80211, "mac80211 remove interface");
+        wl->vif = NULL;
+        mutex_unlock(&wl->mutex);
 }
 
-static int wl1251_build_null_data(struct wl1251 *wl)
+static int wl1251_build_qos_null_data(struct wl1251 *wl)
 {
-        struct wl12xx_null_data_template template;
+        struct ieee80211_qos_hdr template;
 
-        if (!is_zero_ether_addr(wl->bssid)) {
-                memcpy(template.header.da, wl->bssid, ETH_ALEN);
-                memcpy(template.header.bssid, wl->bssid, ETH_ALEN);
-        } else {
-                memset(template.header.da, 0xff, ETH_ALEN);
-                memset(template.header.bssid, 0xff, ETH_ALEN);
-        }
-
-        memcpy(template.header.sa, wl->mac_addr, ETH_ALEN);
-        template.header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_DATA |
-                                                IEEE80211_STYPE_NULLFUNC);
+        memset(&template, 0, sizeof(template));
 
-        return wl1251_cmd_template_set(wl, CMD_NULL_DATA, &template,
-                                       sizeof(template));
-
-}
+        memcpy(template.addr1, wl->bssid, ETH_ALEN);
+        memcpy(template.addr2, wl->mac_addr, ETH_ALEN);
+        memcpy(template.addr3, wl->bssid, ETH_ALEN);
 
-static int wl1251_build_ps_poll(struct wl1251 *wl, u16 aid)
-{
-        struct wl12xx_ps_poll_template template;
+        template.frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                             IEEE80211_STYPE_QOS_NULLFUNC |
+                                             IEEE80211_FCTL_TODS);
 
-        memcpy(template.bssid, wl->bssid, ETH_ALEN);
-        memcpy(template.ta, wl->mac_addr, ETH_ALEN);
-        template.aid = aid;
-        template.fc = cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL);
+        /* FIXME: not sure what priority to use here */
+        template.qos_ctrl = cpu_to_le16(0);
 
-        return wl1251_cmd_template_set(wl, CMD_PS_POLL, &template,
+        return wl1251_cmd_template_set(wl, CMD_QOS_NULL_DATA, &template,
                                        sizeof(template));
-
 }
 
 static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
@@ -601,35 +613,39 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                         goto out_sleep;
         }
 
-        ret = wl1251_build_null_data(wl);
-        if (ret < 0)
-                goto out_sleep;
-
         if (conf->flags & IEEE80211_CONF_PS && !wl->psm_requested) {
                 wl1251_debug(DEBUG_PSM, "psm enabled");
 
                 wl->psm_requested = true;
 
+                wl->dtim_period = conf->ps_dtim_period;
+
+                ret = wl1251_acx_wr_tbtt_and_dtim(wl, wl->beacon_int,
+                                                  wl->dtim_period);
+
                 /*
-                 * We enter PSM only if we're already associated.
-                 * If we're not, we'll enter it when joining an SSID,
-                 * through the bss_info_changed() hook.
+                 * mac80211 enables PSM only if we're already associated.
                  */
                 ret = wl1251_ps_set_mode(wl, STATION_POWER_SAVE_MODE);
+                if (ret < 0)
+                        goto out_sleep;
         } else if (!(conf->flags & IEEE80211_CONF_PS) &&
                    wl->psm_requested) {
                 wl1251_debug(DEBUG_PSM, "psm disabled");
 
                 wl->psm_requested = false;
 
-                if (wl->psm)
+                if (wl->psm) {
                         ret = wl1251_ps_set_mode(wl, STATION_ACTIVE_MODE);
+                        if (ret < 0)
+                                goto out_sleep;
+                }
         }
 
         if (conf->power_level != wl->power_level) {
                 ret = wl1251_acx_tx_power(wl, conf->power_level);
                 if (ret < 0)
-                        goto out;
+                        goto out_sleep;
 
                 wl->power_level = conf->power_level;
         }
@@ -840,199 +856,61 @@ out:
         return ret;
 }
 
-static int wl1251_build_basic_rates(char *rates)
-{
-        u8 index = 0;
-
-        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
-        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
-        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
-        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
-
-        return index;
-}
-
-static int wl1251_build_extended_rates(char *rates)
+static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
+                             struct cfg80211_scan_request *req)
 {
-        u8 index = 0;
-
-        rates[index++] = IEEE80211_OFDM_RATE_6MB;
-        rates[index++] = IEEE80211_OFDM_RATE_9MB;
-        rates[index++] = IEEE80211_OFDM_RATE_12MB;
-        rates[index++] = IEEE80211_OFDM_RATE_18MB;
-        rates[index++] = IEEE80211_OFDM_RATE_24MB;
-        rates[index++] = IEEE80211_OFDM_RATE_36MB;
-        rates[index++] = IEEE80211_OFDM_RATE_48MB;
-        rates[index++] = IEEE80211_OFDM_RATE_54MB;
-
-        return index;
-}
-
+        struct wl1251 *wl = hw->priv;
+        struct sk_buff *skb;
+        size_t ssid_len = 0;
+        u8 *ssid = NULL;
+        int ret;
 
-static int wl1251_build_probe_req(struct wl1251 *wl, u8 *ssid, size_t ssid_len)
-{
-        struct wl12xx_probe_req_template template;
-        struct wl12xx_ie_rates *rates;
-        char *ptr;
-        u16 size;
-
-        ptr = (char *)&template;
-        size = sizeof(struct ieee80211_header);
-
-        memset(template.header.da, 0xff, ETH_ALEN);
-        memset(template.header.bssid, 0xff, ETH_ALEN);
-        memcpy(template.header.sa, wl->mac_addr, ETH_ALEN);
-        template.header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
-
-        /* IEs */
-        /* SSID */
-        template.ssid.header.id = WLAN_EID_SSID;
-        template.ssid.header.len = ssid_len;
-        if (ssid_len && ssid)
-                memcpy(template.ssid.ssid, ssid, ssid_len);
-        size += sizeof(struct wl12xx_ie_header) + ssid_len;
-        ptr += size;
-
-        /* Basic Rates */
-        rates = (struct wl12xx_ie_rates *)ptr;
-        rates->header.id = WLAN_EID_SUPP_RATES;
-        rates->header.len = wl1251_build_basic_rates(rates->rates);
-        size += sizeof(struct wl12xx_ie_header) + rates->header.len;
-        ptr += sizeof(struct wl12xx_ie_header) + rates->header.len;
-
-        /* Extended rates */
-        rates = (struct wl12xx_ie_rates *)ptr;
-        rates->header.id = WLAN_EID_EXT_SUPP_RATES;
-        rates->header.len = wl1251_build_extended_rates(rates->rates);
-        size += sizeof(struct wl12xx_ie_header) + rates->header.len;
-
-        wl1251_dump(DEBUG_SCAN, "PROBE REQ: ", &template, size);
-
-        return wl1251_cmd_template_set(wl, CMD_PROBE_REQ, &template,
-                                      size);
-}
+        wl1251_debug(DEBUG_MAC80211, "mac80211 hw scan");
 
-static int wl1251_hw_scan(struct wl1251 *wl, u8 *ssid, size_t len,
-                          u8 active_scan, u8 high_prio, u8 num_channels,
-                          u8 probe_requests)
-{
-        struct wl1251_cmd_trigger_scan_to *trigger = NULL;
-        struct cmd_scan *params = NULL;
-        int i, ret;
-        u16 scan_options = 0;
-
-        if (wl->scanning)
-                return -EINVAL;
-
-        params = kzalloc(sizeof(*params), GFP_KERNEL);
-        if (!params)
-                return -ENOMEM;
-
-        params->params.rx_config_options = cpu_to_le32(CFG_RX_ALL_GOOD);
-        params->params.rx_filter_options =
-                cpu_to_le32(CFG_RX_PRSP_EN | CFG_RX_MGMT_EN | CFG_RX_BCN_EN);
-
-        /* High priority scan */
-        if (!active_scan)
-                scan_options |= SCAN_PASSIVE;
-        if (high_prio)
-                scan_options |= SCAN_PRIORITY_HIGH;
-        params->params.scan_options = scan_options;
-
-        params->params.num_channels = num_channels;
-        params->params.num_probe_requests = probe_requests;
-        params->params.tx_rate = cpu_to_le16(1 << 1); /* 2 Mbps */
-        params->params.tid_trigger = 0;
-
-        for (i = 0; i < num_channels; i++) {
-                params->channels[i].min_duration = cpu_to_le32(30000);
-                params->channels[i].max_duration = cpu_to_le32(60000);
-                memset(&params->channels[i].bssid_lsb, 0xff, 4);
-                memset(&params->channels[i].bssid_msb, 0xff, 2);
-                params->channels[i].early_termination = 0;
-                params->channels[i].tx_power_att = 0;
-                params->channels[i].channel = i + 1;
-                memset(params->channels[i].pad, 0, 3);
+        if (req->n_ssids) {
+                ssid = req->ssids[0].ssid;
+                ssid_len = req->ssids[0].ssid_len;
         }
 
-        for (i = num_channels; i < SCAN_MAX_NUM_OF_CHANNELS; i++)
-                memset(&params->channels[i], 0,
-                       sizeof(struct basic_scan_channel_parameters));
-
-        if (len && ssid) {
-                params->params.ssid_len = len;
-                memcpy(params->params.ssid, ssid, len);
-        } else {
-                params->params.ssid_len = 0;
-                memset(params->params.ssid, 0, 32);
-        }
+        mutex_lock(&wl->mutex);
 
-        ret = wl1251_build_probe_req(wl, ssid, len);
-        if (ret < 0) {
-                wl1251_error("PROBE request template failed");
+        if (wl->scanning) {
+                wl1251_debug(DEBUG_SCAN, "scan already in progress");
+                ret = -EINVAL;
                 goto out;
         }
 
-        trigger = kzalloc(sizeof(*trigger), GFP_KERNEL);
-        if (!trigger)
+        ret = wl1251_ps_elp_wakeup(wl);
+        if (ret < 0)
                 goto out;
 
-        trigger->timeout = 0;
-
-        ret = wl1251_cmd_send(wl, CMD_TRIGGER_SCAN_TO, trigger,
-                              sizeof(*trigger));
-        if (ret < 0) {
-                wl1251_error("trigger scan to failed for hw scan");
+        skb = ieee80211_probereq_get(wl->hw, wl->vif, ssid, ssid_len,
+                                     req->ie, req->ie_len);
+        if (!skb) {
+                ret = -ENOMEM;
                 goto out;
         }
 
-        wl1251_dump(DEBUG_SCAN, "SCAN: ", params, sizeof(*params));
-
-        wl->scanning = true;
+        ret = wl1251_cmd_template_set(wl, CMD_PROBE_REQ, skb->data,
+                                      skb->len);
+        dev_kfree_skb(skb);
+        if (ret < 0)
+                goto out_sleep;
 
-        ret = wl1251_cmd_send(wl, CMD_SCAN, params, sizeof(*params));
+        ret = wl1251_cmd_trigger_scan_to(wl, 0);
         if (ret < 0)
-                wl1251_error("SCAN failed");
+                goto out_sleep;
 
-        wl1251_mem_read(wl, wl->cmd_box_addr, params, sizeof(*params));
+        wl->scanning = true;
 
-        if (params->header.status != CMD_STATUS_SUCCESS) {
-                wl1251_error("TEST command answer error: %d",
-                             params->header.status);
+        ret = wl1251_cmd_scan(wl, ssid, ssid_len, req->channels,
+                              req->n_channels, WL1251_SCAN_NUM_PROBES);
+        if (ret < 0) {
                 wl->scanning = false;
-                ret = -EIO;
-                goto out;
-        }
-
-out:
-        kfree(params);
-        return ret;
-
-}
-
-static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
-                             struct cfg80211_scan_request *req)
-{
-        struct wl1251 *wl = hw->priv;
-        int ret;
-        u8 *ssid = NULL;
-        size_t ssid_len = 0;
-
-        wl1251_debug(DEBUG_MAC80211, "mac80211 hw scan");
-
-        if (req->n_ssids) {
-                ssid = req->ssids[0].ssid;
-                ssid_len = req->ssids[0].ssid_len;
+                goto out_sleep;
         }
 
-        mutex_lock(&wl->mutex);
-
-        ret = wl1251_ps_elp_wakeup(wl);
-        if (ret < 0)
-                goto out;
-
-        ret = wl1251_hw_scan(hw->priv, ssid, ssid_len, 1, 0, 13, 3);
-
+out_sleep:
         wl1251_ps_elp_sleep(wl);
 
 out:
@@ -1069,9 +947,8 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                                        struct ieee80211_bss_conf *bss_conf,
                                        u32 changed)
 {
-        enum wl1251_cmd_ps_mode mode;
         struct wl1251 *wl = hw->priv;
-        struct sk_buff *beacon;
+        struct sk_buff *beacon, *skb;
         int ret;
 
         wl1251_debug(DEBUG_MAC80211, "mac80211 bss info changed");
@@ -1082,30 +959,49 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
+        if (changed & BSS_CHANGED_BSSID) {
+                memcpy(wl->bssid, bss_conf->bssid, ETH_ALEN);
+
+                skb = ieee80211_nullfunc_get(wl->hw, wl->vif);
+                if (!skb)
+                        goto out_sleep;
+
+                ret = wl1251_cmd_template_set(wl, CMD_NULL_DATA,
+                                              skb->data, skb->len);
+                dev_kfree_skb(skb);
+                if (ret < 0)
+                        goto out_sleep;
+
+                ret = wl1251_build_qos_null_data(wl);
+                if (ret < 0)
+                        goto out;
+
+                if (wl->bss_type != BSS_TYPE_IBSS) {
+                        ret = wl1251_join(wl, wl->bss_type, wl->channel,
+                                          wl->beacon_int, wl->dtim_period);
+                        if (ret < 0)
+                                goto out_sleep;
+                }
+        }
+
         if (changed & BSS_CHANGED_ASSOC) {
                 if (bss_conf->assoc) {
                         wl->beacon_int = bss_conf->beacon_int;
-                        wl->dtim_period = bss_conf->dtim_period;
-
-                        /* FIXME: call join */
 
-                        wl->aid = bss_conf->aid;
+                        skb = ieee80211_pspoll_get(wl->hw, wl->vif);
+                        if (!skb)
+                                goto out_sleep;
 
-                        ret = wl1251_build_ps_poll(wl, wl->aid);
+                        ret = wl1251_cmd_template_set(wl, CMD_PS_POLL,
+                                                      skb->data,
+                                                      skb->len);
+                        dev_kfree_skb(skb);
                         if (ret < 0)
                                 goto out_sleep;
 
-                        ret = wl1251_acx_aid(wl, wl->aid);
+                        ret = wl1251_acx_aid(wl, bss_conf->aid);
                         if (ret < 0)
                                 goto out_sleep;
-
-                        /* If we want to go in PSM but we're not there yet */
-                        if (wl->psm_requested && !wl->psm) {
-                                mode = STATION_POWER_SAVE_MODE;
-                                ret = wl1251_ps_set_mode(wl, mode);
-                                if (ret < 0)
-                                        goto out_sleep;
-                        }
                 } else {
                         /* use defaults when not associated */
                         wl->beacon_int = WL1251_DEFAULT_BEACON_INT;
@@ -1137,23 +1033,6 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                         ret = wl1251_acx_cts_protect(wl, CTSPROTECT_DISABLE);
                 if (ret < 0) {
                         wl1251_warning("Set ctsprotect failed %d", ret);
-                        goto out;
-                }
-        }
-
-        if (changed & BSS_CHANGED_BSSID) {
-                memcpy(wl->bssid, bss_conf->bssid, ETH_ALEN);
-
-                ret = wl1251_build_null_data(wl);
-                if (ret < 0)
-                        goto out;
-
-                if (wl->bss_type != BSS_TYPE_IBSS) {
-                        ret = wl1251_join(wl, wl->bss_type, wl->channel,
-                                          wl->beacon_int, wl->dtim_period);
-                        if (ret < 0)
-                                goto out_sleep;
-                        wl1251_warning("Set ctsprotect failed %d", ret);
                         goto out_sleep;
                 }
         }
@@ -1165,7 +1044,7 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
 
                 if (ret < 0) {
                         dev_kfree_skb(beacon);
-                        goto out;
+                        goto out_sleep;
                 }
 
                 ret = wl1251_cmd_template_set(wl, CMD_PROBE_RESP, beacon->data,
@@ -1174,13 +1053,13 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                 dev_kfree_skb(beacon);
 
                 if (ret < 0)
-                        goto out;
+                        goto out_sleep;
 
                 ret = wl1251_join(wl, wl->bss_type, wl->beacon_int,
                                   wl->channel, wl->dtim_period);
 
                 if (ret < 0)
-                        goto out;
+                        goto out_sleep;
         }
 
 out_sleep:
@@ -1251,6 +1130,49 @@ static struct ieee80211_channel wl1251_channels[] = {
         { .hw_value = 13, .center_freq = 2472},
 };
 
+static int wl1251_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
+                             const struct ieee80211_tx_queue_params *params)
+{
+        enum wl1251_acx_ps_scheme ps_scheme;
+        struct wl1251 *wl = hw->priv;
+        int ret;
+
+        mutex_lock(&wl->mutex);
+
+        wl1251_debug(DEBUG_MAC80211, "mac80211 conf tx %d", queue);
+
+        ret = wl1251_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        /* mac80211 uses units of 32 usec */
+        ret = wl1251_acx_ac_cfg(wl, wl1251_tx_get_queue(queue),
+                                params->cw_min, params->cw_max,
+                                params->aifs, params->txop * 32);
+        if (ret < 0)
+                goto out_sleep;
+
+        if (params->uapsd)
+                ps_scheme = WL1251_ACX_PS_SCHEME_UPSD_TRIGGER;
+        else
+                ps_scheme = WL1251_ACX_PS_SCHEME_LEGACY;
+
+        ret = wl1251_acx_tid_cfg(wl, wl1251_tx_get_queue(queue),
+                                 CHANNEL_TYPE_EDCF,
+                                 wl1251_tx_get_queue(queue), ps_scheme,
+                                 WL1251_ACX_ACK_POLICY_LEGACY);
+        if (ret < 0)
+                goto out_sleep;
+
+out_sleep:
+        wl1251_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
 /* can't be const, mac80211 writes to this */
 static struct ieee80211_supported_band wl1251_band_2ghz = {
         .channels = wl1251_channels,
@@ -1271,6 +1193,7 @@ static const struct ieee80211_ops wl1251_ops = {
         .hw_scan = wl1251_op_hw_scan,
         .bss_info_changed = wl1251_op_bss_info_changed,
         .set_rts_threshold = wl1251_op_set_rts_threshold,
+        .conf_tx = wl1251_op_conf_tx,
 };
 
 static int wl1251_register_hw(struct wl1251 *wl)
@@ -1308,12 +1231,17 @@ int wl1251_init_ieee80211(struct wl1251 *wl)
         wl->hw->channel_change_time = 10000;
 
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_NOISE_DBM;
+                IEEE80211_HW_NOISE_DBM |
+                IEEE80211_HW_SUPPORTS_PS |
+                IEEE80211_HW_BEACON_FILTER |
+                IEEE80211_HW_SUPPORTS_UAPSD;
 
         wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
         wl->hw->wiphy->max_scan_ssids = 1;
         wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wl1251_band_2ghz;
 
+        wl->hw->queues = 4;
+
         ret = wl1251_register_hw(wl);
         if (ret)
                 goto out;
@@ -1351,6 +1279,7 @@ struct ieee80211_hw *wl1251_alloc_hw(void)
         skb_queue_head_init(&wl->tx_queue);
 
         INIT_WORK(&wl->filter_work, wl1251_filter_work);
+        INIT_DELAYED_WORK(&wl->elp_work, wl1251_elp_work);
         wl->channel = WL1251_DEFAULT_CHANNEL;
         wl->scanning = false;
         wl->default_key = 0;
@@ -1368,6 +1297,7 @@ struct ieee80211_hw *wl1251_alloc_hw(void)
         wl->power_level = WL1251_DEFAULT_POWER_LEVEL;
         wl->beacon_int = WL1251_DEFAULT_BEACON_INT;
         wl->dtim_period = WL1251_DEFAULT_DTIM_PERIOD;
+        wl->vif = NULL;
 
         for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
                 wl->tx_frames[i] = NULL;
@@ -1409,7 +1339,7 @@ int wl1251_free_hw(struct wl1251 *wl)
 
         kfree(wl->target_mem_map);
         kfree(wl->data_path);
-        kfree(wl->fw);
+        vfree(wl->fw);
         wl->fw = NULL;
         kfree(wl->nvs);
         wl->nvs = NULL;
@@ -1426,4 +1356,5 @@ EXPORT_SYMBOL_GPL(wl1251_free_hw);
 MODULE_DESCRIPTION("TI wl1251 Wireles LAN Driver Core");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Kalle Valo <kalle.valo@nokia.com>");
-MODULE_ALIAS("spi:wl12xx");
+MODULE_ALIAS("spi:wl1251");
+MODULE_FIRMWARE(WL1251_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/wl1251_ps.c b/drivers/net/wireless/wl12xx/wl1251_ps.c
index c53e28727ed4..851dfb65e474 100644
--- a/drivers/net/wireless/wl12xx/wl1251_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1251_ps.c
@@ -26,24 +26,49 @@
 #include "wl1251_cmd.h"
 #include "wl1251_io.h"
 
-#define WL1251_WAKEUP_TIMEOUT 2000
+/* in ms */
+#define WL1251_WAKEUP_TIMEOUT 100
 
-/* Routines to toggle sleep mode while in ELP */
-void wl1251_ps_elp_sleep(struct wl1251 *wl)
+void wl1251_elp_work(struct work_struct *work)
 {
+        struct delayed_work *dwork;
+        struct wl1251 *wl;
+
+        dwork = container_of(work, struct delayed_work, work);
+        wl = container_of(dwork, struct wl1251, elp_work);
+
+        wl1251_debug(DEBUG_PSM, "elp work");
+
+        mutex_lock(&wl->mutex);
+
         if (wl->elp || !wl->psm)
-                return;
+                goto out;
 
         wl1251_debug(DEBUG_PSM, "chip to elp");
-
         wl1251_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
-
         wl->elp = true;
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+#define ELP_ENTRY_DELAY  5
+
+/* Routines to toggle sleep mode while in ELP */
+void wl1251_ps_elp_sleep(struct wl1251 *wl)
+{
+        unsigned long delay;
+
+        if (wl->psm) {
+                cancel_delayed_work(&wl->elp_work);
+                delay = msecs_to_jiffies(ELP_ENTRY_DELAY);
+                ieee80211_queue_delayed_work(wl->hw, &wl->elp_work, delay);
+        }
 }
 
 int wl1251_ps_elp_wakeup(struct wl1251 *wl)
 {
-        unsigned long timeout;
+        unsigned long timeout, start;
         u32 elp_reg;
 
         if (!wl->elp)
@@ -51,6 +76,7 @@ int wl1251_ps_elp_wakeup(struct wl1251 *wl)
 
         wl1251_debug(DEBUG_PSM, "waking up chip from elp");
 
+        start = jiffies;
         timeout = jiffies + msecs_to_jiffies(WL1251_WAKEUP_TIMEOUT);
 
         wl1251_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
@@ -71,8 +97,7 @@ int wl1251_ps_elp_wakeup(struct wl1251 *wl)
         }
 
         wl1251_debug(DEBUG_PSM, "wakeup time: %u ms",
-                     jiffies_to_msecs(jiffies) -
-                     (jiffies_to_msecs(timeout) - WL1251_WAKEUP_TIMEOUT));
+                     jiffies_to_msecs(jiffies - start));
 
         wl->elp = false;
 
@@ -119,6 +144,11 @@ int wl1251_ps_set_mode(struct wl1251 *wl, enum wl1251_cmd_ps_mode mode)
         case STATION_POWER_SAVE_MODE:
                 wl1251_debug(DEBUG_PSM, "entering psm");
 
+                /* enable beacon filtering */
+                ret = wl1251_acx_beacon_filter_opt(wl, true);
+                if (ret < 0)
+                        return ret;
+
                 ret = wl1251_acx_wake_up_conditions(wl,
                                                     WAKE_UP_EVENT_DTIM_BITMAP,
                                                     wl->listen_int);
@@ -142,6 +172,11 @@ int wl1251_ps_set_mode(struct wl1251 *wl, enum wl1251_cmd_ps_mode mode)
                 if (ret < 0)
                         return ret;
 
+                /* disable beacon filtering */
+                ret = wl1251_acx_beacon_filter_opt(wl, false);
+                if (ret < 0)
+                        return ret;
+
                 ret = wl1251_acx_wake_up_conditions(wl,
                                                     WAKE_UP_EVENT_DTIM_BITMAP,
                                                     wl->listen_int);
diff --git a/drivers/net/wireless/wl12xx/wl1251_ps.h b/drivers/net/wireless/wl12xx/wl1251_ps.h
index db036fe12f25..c688ac57aee4 100644
--- a/drivers/net/wireless/wl12xx/wl1251_ps.h
+++ b/drivers/net/wireless/wl12xx/wl1251_ps.h
@@ -31,6 +31,7 @@
 int wl1251_ps_set_mode(struct wl1251 *wl, enum wl1251_cmd_ps_mode mode);
 void wl1251_ps_elp_sleep(struct wl1251 *wl);
 int wl1251_ps_elp_wakeup(struct wl1251 *wl);
+void wl1251_elp_work(struct work_struct *work);
 
 
 #endif /* __WL1251_PS_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1251_reg.h b/drivers/net/wireless/wl12xx/wl1251_reg.h
index 06e1bd94a739..0ca3b4326056 100644
--- a/drivers/net/wireless/wl12xx/wl1251_reg.h
+++ b/drivers/net/wireless/wl12xx/wl1251_reg.h
@@ -370,6 +370,7 @@ enum wl12xx_acx_int_reg {
  EEPROM location specified in the EE_ADDR register.
  The Wlan hardware hardware clears this bit automatically.
 *===============================================*/
+#define EE_CTL                              (REGISTERS_BASE + 0x2000)
 #define ACX_EE_CTL_REG                      EE_CTL
 #define EE_WRITE                            0x00000001ul
 #define EE_READ                             0x00000002ul
@@ -380,6 +381,7 @@ enum wl12xx_acx_int_reg {
   This register specifies the address
   within the EEPROM from/to which to read/write data.
   ===============================================*/
+#define EE_ADDR                             (REGISTERS_BASE + 0x2008)
 #define ACX_EE_ADDR_REG                     EE_ADDR
 
 /*===============================================
@@ -389,8 +391,12 @@ enum wl12xx_acx_int_reg {
   data from the EEPROM or the write data
   to be written to the EEPROM.
   ===============================================*/
+#define EE_DATA                             (REGISTERS_BASE + 0x2004)
 #define ACX_EE_DATA_REG                     EE_DATA
 
+#define EEPROM_ACCESS_TO                    10000   /* timeout counter */
+#define START_EEPROM_MGR                    0x00000001
+
 /*===============================================
   EEPROM Base Address  - 32bit RW
   ------------------------------------------
diff --git a/drivers/net/wireless/wl12xx/wl1251_rx.c b/drivers/net/wireless/wl12xx/wl1251_rx.c
index 17c54b59ef86..6f229e0990f4 100644
--- a/drivers/net/wireless/wl12xx/wl1251_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_rx.c
@@ -23,6 +23,7 @@
  */
 
 #include <linux/skbuff.h>
+#include <linux/gfp.h>
 #include <net/mac80211.h>
 
 #include "wl1251.h"
@@ -72,10 +73,6 @@ static void wl1251_rx_status(struct wl1251 *wl,
         }
 
         status->signal = desc->rssi;
-        status->qual = (desc->rssi - WL1251_RX_MIN_RSSI) * 100 /
-                (WL1251_RX_MAX_RSSI - WL1251_RX_MIN_RSSI);
-        status->qual = min(status->qual, 100);
-        status->qual = max(status->qual, 0);
 
         /*
          * FIXME: guessing that snr needs to be divided by two, otherwise
@@ -130,7 +127,7 @@ static void wl1251_rx_body(struct wl1251 *wl,
         if (wl->rx_current_buffer)
                 rx_packet_ring_addr += wl->data_path->rx_packet_ring_chunk_size;
 
-        skb = dev_alloc_skb(length);
+        skb = __dev_alloc_skb(length, GFP_KERNEL);
         if (!skb) {
                 wl1251_error("Couldn't allocate RX frame");
                 return;
@@ -153,7 +150,7 @@ static void wl1251_rx_body(struct wl1251 *wl,
                      beacon ? "beacon" : "");
 
         memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
-        ieee80211_rx(wl->hw, skb);
+        ieee80211_rx_ni(wl->hw, skb);
 }
 
 static void wl1251_rx_ack(struct wl1251 *wl)
diff --git a/drivers/net/wireless/wl12xx/wl1251_spi.c b/drivers/net/wireless/wl12xx/wl1251_spi.c
index 14eff2b3d4c6..3bfb59bd4635 100644
--- a/drivers/net/wireless/wl12xx/wl1251_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1251_spi.c
@@ -23,6 +23,7 @@
 
 #include <linux/irq.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/wl12xx.h>
@@ -270,6 +271,8 @@ static int __devinit wl1251_spi_probe(struct spi_device *spi)
                 return -ENODEV;
         }
 
+        wl->use_eeprom = pdata->use_eeprom;
+
         ret = request_irq(wl->irq, wl1251_irq, 0, DRIVER_NAME, wl);
         if (ret < 0) {
                 wl1251_error("request_irq() failed: %d", ret);
@@ -307,7 +310,7 @@ static int __devexit wl1251_spi_remove(struct spi_device *spi)
 
 static struct spi_driver wl1251_spi_driver = {
         .driver = {
-                .name           = "wl12xx",
+                .name           = "wl1251",
                 .bus            = &spi_bus_type,
                 .owner          = THIS_MODULE,
         },
diff --git a/drivers/net/wireless/wl12xx/wl1251_tx.c b/drivers/net/wireless/wl12xx/wl1251_tx.c
index f85970615849..c8223185efd2 100644
--- a/drivers/net/wireless/wl12xx/wl1251_tx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_tx.c
@@ -167,8 +167,7 @@ static int wl1251_tx_fill_hdr(struct wl1251 *wl, struct sk_buff *skb,
         tx_hdr->expiry_time = cpu_to_le32(1 << 16);
         tx_hdr->id = id;
 
-        /* FIXME: how to get the correct queue id? */
-        tx_hdr->xmit_queue = 0;
+        tx_hdr->xmit_queue = wl1251_tx_get_queue(skb_get_queue_mapping(skb));
 
         wl1251_tx_control(tx_hdr, control, fc);
         wl1251_tx_frag_block_num(tx_hdr);
@@ -220,6 +219,7 @@ static int wl1251_tx_send_packet(struct wl1251 *wl, struct sk_buff *skb,
                         /* align the buffer on a 4-byte boundary */
                         skb_reserve(skb, offset);
                         memmove(skb->data, src, skb->len);
+                        tx_hdr = (struct tx_double_buffer_desc *) skb->data;
                 } else {
                         wl1251_info("No handler, fixme!");
                         return -EINVAL;
@@ -237,8 +237,9 @@ static int wl1251_tx_send_packet(struct wl1251 *wl, struct sk_buff *skb,
 
         wl1251_mem_write(wl, addr, skb->data, len);
 
-        wl1251_debug(DEBUG_TX, "tx id %u skb 0x%p payload %u rate 0x%x",
-                     tx_hdr->id, skb, tx_hdr->length, tx_hdr->rate);
+        wl1251_debug(DEBUG_TX, "tx id %u skb 0x%p payload %u rate 0x%x "
+                     "queue %d", tx_hdr->id, skb, tx_hdr->length,
+                     tx_hdr->rate, tx_hdr->xmit_queue);
 
         return 0;
 }
diff --git a/drivers/net/wireless/wl12xx/wl1251_tx.h b/drivers/net/wireless/wl12xx/wl1251_tx.h
index 7c1c1665c810..55856c6bb97a 100644
--- a/drivers/net/wireless/wl12xx/wl1251_tx.h
+++ b/drivers/net/wireless/wl12xx/wl1251_tx.h
@@ -26,6 +26,7 @@
 #define __WL1251_TX_H__
 
 #include <linux/bitops.h>
+#include "wl1251_acx.h"
 
 /*
  *
@@ -209,6 +210,22 @@ struct tx_result {
         u8 done_2;
 } __attribute__ ((packed));
 
+static inline int wl1251_tx_get_queue(int queue)
+{
+        switch (queue) {
+        case 0:
+                return QOS_AC_VO;
+        case 1:
+                return QOS_AC_VI;
+        case 2:
+                return QOS_AC_BE;
+        case 3:
+                return QOS_AC_BK;
+        default:
+                return QOS_AC_BE;
+        }
+}
+
 void wl1251_tx_work(struct work_struct *work);
 void wl1251_tx_complete(struct wl1251 *wl);
 void wl1251_tx_flush(struct wl1251 *wl);
diff --git a/drivers/net/wireless/wl12xx/wl1271.h b/drivers/net/wireless/wl12xx/wl1271.h
index 55818f94017b..97ea5096bc8c 100644
--- a/drivers/net/wireless/wl12xx/wl1271.h
+++ b/drivers/net/wireless/wl12xx/wl1271.h
@@ -32,6 +32,8 @@
 #include <linux/bitops.h>
 #include <net/mac80211.h>
 
+#include "wl1271_conf.h"
+
 #define DRIVER_NAME "wl1271"
 #define DRIVER_PREFIX DRIVER_NAME ": "
 
@@ -41,7 +43,7 @@ enum {
         DEBUG_SPI       = BIT(1),
         DEBUG_BOOT      = BIT(2),
         DEBUG_MAILBOX   = BIT(3),
-        DEBUG_NETLINK   = BIT(4),
+        DEBUG_TESTMODE  = BIT(4),
         DEBUG_EVENT     = BIT(5),
         DEBUG_TX        = BIT(6),
         DEBUG_RX        = BIT(7),
@@ -97,7 +99,8 @@ enum {
         } while (0)
 
 #define WL1271_DEFAULT_RX_CONFIG (CFG_UNI_FILTER_EN |   \
-                                  CFG_BSSID_FILTER_EN)
+                                  CFG_BSSID_FILTER_EN | \
+                                  CFG_MC_FILTER_EN)
 
 #define WL1271_DEFAULT_RX_FILTER (CFG_RX_RCTS_ACK | CFG_RX_PRSP_EN |  \
                                   CFG_RX_MGMT_EN | CFG_RX_DATA_EN |   \
@@ -107,11 +110,56 @@ enum {
 #define WL1271_FW_NAME "wl1271-fw.bin"
 #define WL1271_NVS_NAME "wl1271-nvs.bin"
 
-#define WL1271_BUSY_WORD_LEN 8
+/* NVS data structure */
+#define WL1271_NVS_SECTION_SIZE                  468
+
+#define WL1271_NVS_GENERAL_PARAMS_SIZE            57
+#define WL1271_NVS_GENERAL_PARAMS_SIZE_PADDED \
+        (WL1271_NVS_GENERAL_PARAMS_SIZE + 1)
+#define WL1271_NVS_STAT_RADIO_PARAMS_SIZE         17
+#define WL1271_NVS_STAT_RADIO_PARAMS_SIZE_PADDED \
+        (WL1271_NVS_STAT_RADIO_PARAMS_SIZE + 1)
+#define WL1271_NVS_DYN_RADIO_PARAMS_SIZE          65
+#define WL1271_NVS_DYN_RADIO_PARAMS_SIZE_PADDED \
+        (WL1271_NVS_DYN_RADIO_PARAMS_SIZE + 1)
+#define WL1271_NVS_FEM_COUNT                       2
+#define WL1271_NVS_INI_SPARE_SIZE                124
+
+struct wl1271_nvs_file {
+        /* NVS section */
+        u8 nvs[WL1271_NVS_SECTION_SIZE];
+
+        /* INI section */
+        u8 general_params[WL1271_NVS_GENERAL_PARAMS_SIZE_PADDED];
+        u8 stat_radio_params[WL1271_NVS_STAT_RADIO_PARAMS_SIZE_PADDED];
+        u8 dyn_radio_params[WL1271_NVS_FEM_COUNT]
+                           [WL1271_NVS_DYN_RADIO_PARAMS_SIZE_PADDED];
+        u8 ini_spare[WL1271_NVS_INI_SPARE_SIZE];
+} __attribute__ ((packed));
+
+/*
+ * Enable/disable 802.11a support for WL1273
+ */
+#undef WL1271_80211A_ENABLED
+
+/*
+ * FIXME: for the wl1271, a busy word count of 1 here will result in a more
+ * optimal SPI interface. There is some SPI bug however, causing RXS time outs
+ * with this mode occasionally on boot, so lets have three for now. A value of
+ * three should make sure, that the chipset will always be ready, though this
+ * will impact throughput and latencies slightly.
+ */
+#define WL1271_BUSY_WORD_CNT 3
+#define WL1271_BUSY_WORD_LEN (WL1271_BUSY_WORD_CNT * sizeof(u32))
 
 #define WL1271_ELP_HW_STATE_ASLEEP 0
 #define WL1271_ELP_HW_STATE_IRQ    1
 
+#define WL1271_DEFAULT_BEACON_INT  100
+#define WL1271_DEFAULT_DTIM_PERIOD 1
+
+#define ACX_TX_DESCRIPTORS         32
+
 enum wl1271_state {
         WL1271_STATE_OFF,
         WL1271_STATE_ON,
@@ -134,6 +182,8 @@ struct wl1271_partition {
 struct wl1271_partition_set {
         struct wl1271_partition mem;
         struct wl1271_partition reg;
+        struct wl1271_partition mem2;
+        struct wl1271_partition mem3;
 };
 
 struct wl1271;
@@ -251,6 +301,7 @@ struct wl1271_debugfs {
 
         struct dentry *retry_count;
         struct dentry *excessive_retries;
+        struct dentry *gpio_power;
 };
 
 #define NUM_TX_QUEUES              4
@@ -258,15 +309,15 @@ struct wl1271_debugfs {
 
 /* FW status registers */
 struct wl1271_fw_status {
-        u32 intr;
+        __le32 intr;
         u8  fw_rx_counter;
         u8  drv_rx_counter;
         u8  reserved;
         u8  tx_results_counter;
-        u32 rx_pkt_descs[NUM_RX_PKT_DESC];
-        u32 tx_released_blks[NUM_TX_QUEUES];
-        u32 fw_localtime;
-        u32 padding[2];
+        __le32 rx_pkt_descs[NUM_RX_PKT_DESC];
+        __le32 tx_released_blks[NUM_TX_QUEUES];
+        __le32 fw_localtime;
+        __le32 padding[2];
 } __attribute__ ((packed));
 
 struct wl1271_rx_mem_pool_addr {
@@ -274,6 +325,15 @@ struct wl1271_rx_mem_pool_addr {
         u32 addr_extra;
 };
 
+struct wl1271_scan {
+        u8 state;
+        u8 ssid[IW_ESSID_MAX_SIZE+1];
+        size_t ssid_len;
+        u8 active;
+        u8 high_prio;
+        u8 probe_requests;
+};
+
 struct wl1271 {
         struct ieee80211_hw *hw;
         bool mac80211_registered;
@@ -288,10 +348,18 @@ struct wl1271 {
         enum wl1271_state state;
         struct mutex mutex;
 
-        int physical_mem_addr;
-        int physical_reg_addr;
-        int virtual_mem_addr;
-        int virtual_reg_addr;
+#define WL1271_FLAG_STA_RATES_CHANGED  (0)
+#define WL1271_FLAG_STA_ASSOCIATED     (1)
+#define WL1271_FLAG_JOINED             (2)
+#define WL1271_FLAG_GPIO_POWER         (3)
+#define WL1271_FLAG_TX_QUEUE_STOPPED   (4)
+#define WL1271_FLAG_SCANNING           (5)
+#define WL1271_FLAG_IN_ELP             (6)
+#define WL1271_FLAG_PSM                (7)
+#define WL1271_FLAG_PSM_REQUESTED      (8)
+        unsigned long flags;
+
+        struct wl1271_partition_set part;
 
         struct wl1271_chip chip;
 
@@ -300,15 +368,13 @@ struct wl1271 {
 
         u8 *fw;
         size_t fw_len;
-        u8 *nvs;
-        size_t nvs_len;
+        struct wl1271_nvs_file *nvs;
 
         u8 bssid[ETH_ALEN];
         u8 mac_addr[ETH_ALEN];
         u8 bss_type;
         u8 ssid[IW_ESSID_MAX_SIZE + 1];
         u8 ssid_len;
-        u8 listen_int;
         int channel;
 
         struct wl1271_acx_mem_map *target_mem_map;
@@ -329,13 +395,16 @@ struct wl1271 {
 
         /* Frames scheduled for transmission, not handled yet */
         struct sk_buff_head tx_queue;
-        bool tx_queue_stopped;
 
         struct work_struct tx_work;
-        struct work_struct filter_work;
 
         /* Pending TX frames */
-        struct sk_buff *tx_frames[16];
+        struct sk_buff *tx_frames[ACX_TX_DESCRIPTORS];
+
+        /* Security sequence number counters */
+        u8 tx_security_last_seq;
+        u16 tx_security_seq_16;
+        u32 tx_security_seq_32;
 
         /* FW Rx counter */
         u32 rx_counter;
@@ -353,27 +422,30 @@ struct wl1271 {
         u32 mbox_ptr[2];
 
         /* Are we currently scanning */
-        bool scanning;
+        struct wl1271_scan scan;
 
         /* Our association ID */
         u16 aid;
 
+        /* currently configured rate set */
+        u32 sta_rate_set;
+        u32 basic_rate_set;
+        u32 rate_set;
+
+        /* The current band */
+        enum ieee80211_band band;
+
         /* Default key (for WEP) */
         u32 default_key;
 
         unsigned int rx_config;
         unsigned int rx_filter;
 
-        /* is firmware in elp mode */
-        bool elp;
-
         struct completion *elp_compl;
+        struct delayed_work elp_work;
 
-        /* we can be in psm, but not in elp, we have to differentiate */
-        bool psm;
-
-        /* PSM mode requested */
-        bool psm_requested;
+        /* retry counter for PSM entries */
+        u8 psm_entry_retry;
 
         /* in dBm */
         int power_level;
@@ -383,11 +455,17 @@ struct wl1271 {
 
         u32 buffer_32;
         u32 buffer_cmd;
-        u8 buffer_busyword[WL1271_BUSY_WORD_LEN];
-        struct wl1271_rx_descriptor *rx_descriptor;
+        u32 buffer_busyword[WL1271_BUSY_WORD_CNT];
 
         struct wl1271_fw_status *fw_status;
         struct wl1271_tx_hw_res_if *tx_res_if;
+
+        struct ieee80211_vif *vif;
+
+        /* Current chipset configuration */
+        struct conf_drv_settings conf;
+
+        struct list_head list;
 };
 
 int wl1271_plt_start(struct wl1271 *wl);
@@ -401,7 +479,19 @@ int wl1271_plt_stop(struct wl1271 *wl);
 
 #define WL1271_TX_QUEUE_MAX_LENGTH 20
 
-/* WL1271 needs a 200ms sleep after power on */
+/* WL1271 needs a 200ms sleep after power on, and a 20ms sleep before power
+   on in case is has been shut down shortly before */
+#define WL1271_PRE_POWER_ON_SLEEP 20 /* in miliseconds */
 #define WL1271_POWER_ON_SLEEP 200 /* in miliseconds */
 
+static inline bool wl1271_11a_enabled(void)
+{
+        /* FIXME: this could be determined based on the NVS-INI file */
+#ifdef WL1271_80211A_ENABLED
+        return true;
+#else
+        return false;
+#endif
+}
+
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.c b/drivers/net/wireless/wl12xx/wl1271_acx.c
index f622a4092615..308782421fce 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.c
@@ -27,6 +27,7 @@
 #include <linux/platform_device.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
+#include <linux/slab.h>
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
@@ -34,8 +35,7 @@
 #include "wl1271_spi.h"
 #include "wl1271_ps.h"
 
-int wl1271_acx_wake_up_conditions(struct wl1271 *wl, u8 wake_up_event,
-                                  u8 listen_interval)
+int wl1271_acx_wake_up_conditions(struct wl1271 *wl)
 {
         struct acx_wake_up_condition *wake_up;
         int ret;
@@ -48,8 +48,8 @@ int wl1271_acx_wake_up_conditions(struct wl1271 *wl, u8 wake_up_event,
                 goto out;
         }
 
-        wake_up->wake_up_event = wake_up_event;
-        wake_up->listen_interval = listen_interval;
+        wake_up->wake_up_event = wl->conf.conn.wake_up_event;
+        wake_up->listen_interval = wl->conf.conn.listen_interval;
 
         ret = wl1271_cmd_configure(wl, ACX_WAKE_UP_CONDITIONS,
                                    wake_up, sizeof(*wake_up));
@@ -137,7 +137,12 @@ int wl1271_acx_tx_power(struct wl1271 *wl, int power)
                 goto out;
         }
 
-        acx->current_tx_power = power * 10;
+        /*
+         * FIXME: This is a workaround needed while we don't the correct
+         * calibration, to avoid distortions
+         */
+        /* acx->current_tx_power = power * 10; */
+        acx->current_tx_power = 120;
 
         ret = wl1271_cmd_configure(wl, DOT11_CUR_TX_PWR, acx, sizeof(*acx));
         if (ret < 0) {
@@ -193,7 +198,7 @@ int wl1271_acx_mem_map(struct wl1271 *wl, struct acx_header *mem_map,
         return 0;
 }
 
-int wl1271_acx_rx_msdu_life_time(struct wl1271 *wl, u32 life_time)
+int wl1271_acx_rx_msdu_life_time(struct wl1271 *wl)
 {
         struct acx_rx_msdu_lifetime *acx;
         int ret;
@@ -206,7 +211,7 @@ int wl1271_acx_rx_msdu_life_time(struct wl1271 *wl, u32 life_time)
                 goto out;
         }
 
-        acx->lifetime = life_time;
+        acx->lifetime = cpu_to_le32(wl->conf.rx.rx_msdu_life_time);
         ret = wl1271_cmd_configure(wl, DOT11_RX_MSDU_LIFE_TIME,
                                    acx, sizeof(*acx));
         if (ret < 0) {
@@ -232,8 +237,8 @@ int wl1271_acx_rx_config(struct wl1271 *wl, u32 config, u32 filter)
                 goto out;
         }
 
-        rx_config->config_options = config;
-        rx_config->filter_options = filter;
+        rx_config->config_options = cpu_to_le32(config);
+        rx_config->filter_options = cpu_to_le32(filter);
 
         ret = wl1271_cmd_configure(wl, ACX_RX_CFG,
                                    rx_config, sizeof(*rx_config));
@@ -260,7 +265,7 @@ int wl1271_acx_pd_threshold(struct wl1271 *wl)
                 goto out;
         }
 
-        /* FIXME: threshold value not set */
+        pd->threshold = cpu_to_le32(wl->conf.rx.packet_detection_threshold);
 
         ret = wl1271_cmd_configure(wl, ACX_PD_THRESHOLD, pd, sizeof(*pd));
         if (ret < 0) {
@@ -300,7 +305,8 @@ out:
         return ret;
 }
 
-int wl1271_acx_group_address_tbl(struct wl1271 *wl)
+int wl1271_acx_group_address_tbl(struct wl1271 *wl, bool enable,
+                                 void *mc_list, u32 mc_list_len)
 {
         struct acx_dot11_grp_addr_tbl *acx;
         int ret;
@@ -314,9 +320,9 @@ int wl1271_acx_group_address_tbl(struct wl1271 *wl)
         }
 
         /* MAC filtering */
-        acx->enabled = 0;
-        acx->num_groups = 0;
-        memset(acx->mac_table, 0, ADDRESS_GROUP_MAX_LEN);
+        acx->enabled = enable;
+        acx->num_groups = mc_list_len;
+        memcpy(acx->mac_table, mc_list, mc_list_len * ETH_ALEN);
 
         ret = wl1271_cmd_configure(wl, DOT11_GROUP_ADDRESS_TBL,
                                    acx, sizeof(*acx));
@@ -343,8 +349,8 @@ int wl1271_acx_service_period_timeout(struct wl1271 *wl)
 
         wl1271_debug(DEBUG_ACX, "acx service period timeout");
 
-        rx_timeout->ps_poll_timeout = RX_TIMEOUT_PS_POLL_DEF;
-        rx_timeout->upsd_timeout = RX_TIMEOUT_UPSD_DEF;
+        rx_timeout->ps_poll_timeout = cpu_to_le16(wl->conf.rx.ps_poll_timeout);
+        rx_timeout->upsd_timeout = cpu_to_le16(wl->conf.rx.upsd_timeout);
 
         ret = wl1271_cmd_configure(wl, ACX_SERVICE_PERIOD_TIMEOUT,
                                    rx_timeout, sizeof(*rx_timeout));
@@ -372,7 +378,7 @@ int wl1271_acx_rts_threshold(struct wl1271 *wl, u16 rts_threshold)
                 goto out;
         }
 
-        rts->threshold = rts_threshold;
+        rts->threshold = cpu_to_le16(rts_threshold);
 
         ret = wl1271_cmd_configure(wl, DOT11_RTS_THRESHOLD, rts, sizeof(*rts));
         if (ret < 0) {
@@ -385,20 +391,58 @@ out:
         return ret;
 }
 
-int wl1271_acx_beacon_filter_opt(struct wl1271 *wl)
+int wl1271_acx_dco_itrim_params(struct wl1271 *wl)
 {
-        struct acx_beacon_filter_option *beacon_filter;
+        struct acx_dco_itrim_params *dco;
+        struct conf_itrim_settings *c = &wl->conf.itrim;
         int ret;
 
+        wl1271_debug(DEBUG_ACX, "acx dco itrim parameters");
+
+        dco = kzalloc(sizeof(*dco), GFP_KERNEL);
+        if (!dco) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        dco->enable = c->enable;
+        dco->timeout = cpu_to_le32(c->timeout);
+
+        ret = wl1271_cmd_configure(wl, ACX_SET_DCO_ITRIM_PARAMS,
+                                   dco, sizeof(*dco));
+        if (ret < 0) {
+                wl1271_warning("failed to set dco itrim parameters: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(dco);
+        return ret;
+}
+
+int wl1271_acx_beacon_filter_opt(struct wl1271 *wl, bool enable_filter)
+{
+        struct acx_beacon_filter_option *beacon_filter = NULL;
+        int ret = 0;
+
         wl1271_debug(DEBUG_ACX, "acx beacon filter opt");
 
+        if (enable_filter &&
+            wl->conf.conn.bcn_filt_mode == CONF_BCN_FILT_MODE_DISABLED)
+                goto out;
+
         beacon_filter = kzalloc(sizeof(*beacon_filter), GFP_KERNEL);
         if (!beacon_filter) {
                 ret = -ENOMEM;
                 goto out;
         }
 
-        beacon_filter->enable = 0;
+        beacon_filter->enable = enable_filter;
+
+        /*
+         * When set to zero, and the filter is enabled, beacons
+         * without the unicast TIM bit set are dropped.
+         */
         beacon_filter->max_num_beacons = 0;
 
         ret = wl1271_cmd_configure(wl, ACX_BEACON_FILTER_OPT,
@@ -416,7 +460,9 @@ out:
 int wl1271_acx_beacon_filter_table(struct wl1271 *wl)
 {
         struct acx_beacon_filter_ie_table *ie_table;
+        int i, idx = 0;
         int ret;
+        bool vendor_spec = false;
 
         wl1271_debug(DEBUG_ACX, "acx beacon filter table");
 
@@ -426,8 +472,32 @@ int wl1271_acx_beacon_filter_table(struct wl1271 *wl)
                 goto out;
         }
 
+        /* configure default beacon pass-through rules */
         ie_table->num_ie = 0;
-        memset(ie_table->table, 0, BEACON_FILTER_TABLE_MAX_SIZE);
+        for (i = 0; i < wl->conf.conn.bcn_filt_ie_count; i++) {
+                struct conf_bcn_filt_rule *r = &(wl->conf.conn.bcn_filt_ie[i]);
+                ie_table->table[idx++] = r->ie;
+                ie_table->table[idx++] = r->rule;
+
+                if (r->ie == WLAN_EID_VENDOR_SPECIFIC) {
+                        /* only one vendor specific ie allowed */
+                        if (vendor_spec)
+                                continue;
+
+                        /* for vendor specific rules configure the
+                           additional fields */
+                        memcpy(&(ie_table->table[idx]), r->oui,
+                               CONF_BCN_IE_OUI_LEN);
+                        idx += CONF_BCN_IE_OUI_LEN;
+                        ie_table->table[idx++] = r->type;
+                        memcpy(&(ie_table->table[idx]), r->version,
+                               CONF_BCN_IE_VER_LEN);
+                        idx += CONF_BCN_IE_VER_LEN;
+                        vendor_spec = true;
+                }
+
+                ie_table->num_ie++;
+        }
 
         ret = wl1271_cmd_configure(wl, ACX_BEACON_FILTER_TABLE,
                                    ie_table, sizeof(*ie_table));
@@ -441,6 +511,36 @@ out:
         return ret;
 }
 
+int wl1271_acx_conn_monit_params(struct wl1271 *wl)
+{
+        struct acx_conn_monit_params *acx;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx connection monitor parameters");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->synch_fail_thold = cpu_to_le32(wl->conf.conn.synch_fail_thold);
+        acx->bss_lose_timeout = cpu_to_le32(wl->conf.conn.bss_lose_timeout);
+
+        ret = wl1271_cmd_configure(wl, ACX_CONN_MONIT_PARAMS,
+                                   acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("failed to set connection monitor "
+                               "parameters: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+
 int wl1271_acx_sg_enable(struct wl1271 *wl)
 {
         struct acx_bt_wlan_coex *pta;
@@ -470,6 +570,7 @@ out:
 int wl1271_acx_sg_cfg(struct wl1271 *wl)
 {
         struct acx_bt_wlan_coex_param *param;
+        struct conf_sg_settings *c = &wl->conf.sg;
         int ret;
 
         wl1271_debug(DEBUG_ACX, "acx sg cfg");
@@ -481,34 +582,19 @@ int wl1271_acx_sg_cfg(struct wl1271 *wl)
         }
 
         /* BT-WLAN coext parameters */
-        param->min_rate = RATE_INDEX_24MBPS;
-        param->bt_hp_max_time = PTA_BT_HP_MAXTIME_DEF;
-        param->wlan_hp_max_time = PTA_WLAN_HP_MAX_TIME_DEF;
-        param->sense_disable_timer = PTA_SENSE_DISABLE_TIMER_DEF;
-        param->rx_time_bt_hp = PTA_PROTECTIVE_RX_TIME_DEF;
-        param->tx_time_bt_hp = PTA_PROTECTIVE_TX_TIME_DEF;
-        param->rx_time_bt_hp_fast = PTA_PROTECTIVE_RX_TIME_FAST_DEF;
-        param->tx_time_bt_hp_fast = PTA_PROTECTIVE_TX_TIME_FAST_DEF;
-        param->wlan_cycle_fast = PTA_CYCLE_TIME_FAST_DEF;
-        param->bt_anti_starvation_period = PTA_ANTI_STARVE_PERIOD_DEF;
-        param->next_bt_lp_packet = PTA_TIMEOUT_NEXT_BT_LP_PACKET_DEF;
-        param->wake_up_beacon = PTA_TIME_BEFORE_BEACON_DEF;
-        param->hp_dm_max_guard_time = PTA_HPDM_MAX_TIME_DEF;
-        param->next_wlan_packet = PTA_TIME_OUT_NEXT_WLAN_DEF;
-        param->antenna_type = PTA_ANTENNA_TYPE_DEF;
-        param->signal_type = PTA_SIGNALING_TYPE_DEF;
-        param->afh_leverage_on = PTA_AFH_LEVERAGE_ON_DEF;
-        param->quiet_cycle_num = PTA_NUMBER_QUIET_CYCLE_DEF;
-        param->max_cts = PTA_MAX_NUM_CTS_DEF;
-        param->wlan_packets_num = PTA_NUMBER_OF_WLAN_PACKETS_DEF;
-        param->bt_packets_num = PTA_NUMBER_OF_BT_PACKETS_DEF;
-        param->missed_rx_avalanche = PTA_RX_FOR_AVALANCHE_DEF;
-        param->wlan_elp_hp = PTA_ELP_HP_DEF;
-        param->bt_anti_starvation_cycles = PTA_ANTI_STARVE_NUM_CYCLE_DEF;
-        param->ack_mode_dual_ant = PTA_ACK_MODE_DEF;
-        param->pa_sd_enable = PTA_ALLOW_PA_SD_DEF;
-        param->pta_auto_mode_enable = PTA_AUTO_MODE_NO_CTS_DEF;
-        param->bt_hp_respected_num = PTA_BT_HP_RESPECTED_DEF;
+        param->per_threshold = cpu_to_le32(c->per_threshold);
+        param->max_scan_compensation_time =
+                cpu_to_le32(c->max_scan_compensation_time);
+        param->nfs_sample_interval = cpu_to_le16(c->nfs_sample_interval);
+        param->load_ratio = c->load_ratio;
+        param->auto_ps_mode = c->auto_ps_mode;
+        param->probe_req_compensation = c->probe_req_compensation;
+        param->scan_window_compensation = c->scan_window_compensation;
+        param->antenna_config = c->antenna_config;
+        param->beacon_miss_threshold = c->beacon_miss_threshold;
+        param->rate_adaptation_threshold =
+                cpu_to_le32(c->rate_adaptation_threshold);
+        param->rate_adaptation_snr = c->rate_adaptation_snr;
 
         ret = wl1271_cmd_configure(wl, ACX_SG_CFG, param, sizeof(*param));
         if (ret < 0) {
@@ -534,8 +620,8 @@ int wl1271_acx_cca_threshold(struct wl1271 *wl)
                 goto out;
         }
 
-        detection->rx_cca_threshold = CCA_THRSH_DISABLE_ENERGY_D;
-        detection->tx_energy_detection = 0;
+        detection->rx_cca_threshold = cpu_to_le16(wl->conf.rx.rx_cca_threshold);
+        detection->tx_energy_detection = wl->conf.tx.tx_energy_detection;
 
         ret = wl1271_cmd_configure(wl, ACX_CCA_THRESHOLD,
                                    detection, sizeof(*detection));
@@ -562,10 +648,10 @@ int wl1271_acx_bcn_dtim_options(struct wl1271 *wl)
                 goto out;
         }
 
-        bb->beacon_rx_timeout = BCN_RX_TIMEOUT_DEF_VALUE;
-        bb->broadcast_timeout = BROADCAST_RX_TIMEOUT_DEF_VALUE;
-        bb->rx_broadcast_in_ps = RX_BROADCAST_IN_PS_DEF_VALUE;
-        bb->ps_poll_threshold = CONSECUTIVE_PS_POLL_FAILURE_DEF;
+        bb->beacon_rx_timeout = cpu_to_le16(wl->conf.conn.beacon_rx_timeout);
+        bb->broadcast_timeout = cpu_to_le16(wl->conf.conn.broadcast_timeout);
+        bb->rx_broadcast_in_ps = wl->conf.conn.rx_broadcast_in_ps;
+        bb->ps_poll_threshold = wl->conf.conn.ps_poll_threshold;
 
         ret = wl1271_cmd_configure(wl, ACX_BCN_DTIM_OPTIONS, bb, sizeof(*bb));
         if (ret < 0) {
@@ -591,7 +677,7 @@ int wl1271_acx_aid(struct wl1271 *wl, u16 aid)
                 goto out;
         }
 
-        acx_aid->aid = aid;
+        acx_aid->aid = cpu_to_le16(aid);
 
         ret = wl1271_cmd_configure(wl, ACX_AID, acx_aid, sizeof(*acx_aid));
         if (ret < 0) {
@@ -618,9 +704,8 @@ int wl1271_acx_event_mbox_mask(struct wl1271 *wl, u32 event_mask)
         }
 
         /* high event mask is unused */
-        mask->high_event_mask = 0xffffffff;
-
-        mask->event_mask = event_mask;
+        mask->high_event_mask = cpu_to_le32(0xffffffff);
+        mask->event_mask = cpu_to_le32(event_mask);
 
         ret = wl1271_cmd_configure(wl, ACX_EVENT_MBOX_MASK,
                                    mask, sizeof(*mask));
@@ -706,6 +791,8 @@ int wl1271_acx_statistics(struct wl1271 *wl, struct acx_statistics *stats)
 int wl1271_acx_rate_policies(struct wl1271 *wl)
 {
         struct acx_rate_policy *acx;
+        struct conf_tx_rate_class *c = &wl->conf.tx.rc_conf;
+        int idx = 0;
         int ret = 0;
 
         wl1271_debug(DEBUG_ACX, "acx rate policies");
@@ -717,12 +804,21 @@ int wl1271_acx_rate_policies(struct wl1271 *wl)
                 goto out;
         }
 
-        /* configure one default (one-size-fits-all) rate class */
-        acx->rate_class_cnt = 1;
-        acx->rate_class[0].enabled_rates = ACX_RATE_MASK_ALL;
-        acx->rate_class[0].short_retry_limit = ACX_RATE_RETRY_LIMIT;
-        acx->rate_class[0].long_retry_limit = ACX_RATE_RETRY_LIMIT;
-        acx->rate_class[0].aflags = 0;
+        /* configure one basic rate class */
+        idx = ACX_TX_BASIC_RATE;
+        acx->rate_class[idx].enabled_rates = cpu_to_le32(wl->basic_rate_set);
+        acx->rate_class[idx].short_retry_limit = c->short_retry_limit;
+        acx->rate_class[idx].long_retry_limit = c->long_retry_limit;
+        acx->rate_class[idx].aflags = c->aflags;
+
+        /* configure one AP supported rate class */
+        idx = ACX_TX_AP_FULL_RATE;
+        acx->rate_class[idx].enabled_rates = cpu_to_le32(wl->rate_set);
+        acx->rate_class[idx].short_retry_limit = c->short_retry_limit;
+        acx->rate_class[idx].long_retry_limit = c->long_retry_limit;
+        acx->rate_class[idx].aflags = c->aflags;
+
+        acx->rate_class_cnt = cpu_to_le32(ACX_TX_RATE_POLICY_CNT);
 
         ret = wl1271_cmd_configure(wl, ACX_RATE_POLICY, acx, sizeof(*acx));
         if (ret < 0) {
@@ -735,12 +831,14 @@ out:
         return ret;
 }
 
-int wl1271_acx_ac_cfg(struct wl1271 *wl)
+int wl1271_acx_ac_cfg(struct wl1271 *wl, u8 ac, u8 cw_min, u16 cw_max,
+                      u8 aifsn, u16 txop)
 {
         struct acx_ac_cfg *acx;
-        int i, ret = 0;
+        int ret = 0;
 
-        wl1271_debug(DEBUG_ACX, "acx access category config");
+        wl1271_debug(DEBUG_ACX, "acx ac cfg %d cw_ming %d cw_max %d "
+                     "aifs %d txop %d", ac, cw_min, cw_max, aifsn, txop);
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
 
@@ -749,29 +847,16 @@ int wl1271_acx_ac_cfg(struct wl1271 *wl)
                 goto out;
         }
 
-        /*
-         * FIXME: Configure each AC with appropriate values (most suitable
-         * values will probably be different for each AC.
-         */
-        for (i = 0; i < WL1271_ACX_AC_COUNT; i++) {
-                acx->ac = i;
-
-                /*
-                 * FIXME: The following default values originate from
-                 * the TI reference driver. What do they mean?
-                 */
-                acx->cw_min = 15;
-                acx->cw_max = 63;
-                acx->aifsn = 3;
-                acx->reserved = 0;
-                acx->tx_op_limit = 0;
-
-                ret = wl1271_cmd_configure(wl, ACX_AC_CFG, acx, sizeof(*acx));
-                if (ret < 0) {
-                        wl1271_warning("Setting of access category "
-                                       "config: %d", ret);
-                        goto out;
-                }
+        acx->ac = ac;
+        acx->cw_min = cw_min;
+        acx->cw_max = cpu_to_le16(cw_max);
+        acx->aifsn = aifsn;
+        acx->tx_op_limit = cpu_to_le16(txop);
+
+        ret = wl1271_cmd_configure(wl, ACX_AC_CFG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx ac cfg failed: %d", ret);
+                goto out;
         }
 
 out:
@@ -779,10 +864,12 @@ out:
         return ret;
 }
 
-int wl1271_acx_tid_cfg(struct wl1271 *wl)
+int wl1271_acx_tid_cfg(struct wl1271 *wl, u8 queue_id, u8 channel_type,
+                       u8 tsid, u8 ps_scheme, u8 ack_policy,
+                       u32 apsd_conf0, u32 apsd_conf1)
 {
         struct acx_tid_config *acx;
-        int i, ret = 0;
+        int ret = 0;
 
         wl1271_debug(DEBUG_ACX, "acx tid config");
 
@@ -793,18 +880,18 @@ int wl1271_acx_tid_cfg(struct wl1271 *wl)
                 goto out;
         }
 
-        /* FIXME: configure each TID with a different AC reference */
-        for (i = 0; i < WL1271_ACX_TID_COUNT; i++) {
-                acx->queue_id = i;
-                acx->tsid = WL1271_ACX_AC_BE;
-                acx->ps_scheme = WL1271_ACX_PS_SCHEME_LEGACY;
-                acx->ack_policy = WL1271_ACX_ACK_POLICY_LEGACY;
+        acx->queue_id = queue_id;
+        acx->channel_type = channel_type;
+        acx->tsid = tsid;
+        acx->ps_scheme = ps_scheme;
+        acx->ack_policy = ack_policy;
+        acx->apsd_conf[0] = cpu_to_le32(apsd_conf0);
+        acx->apsd_conf[1] = cpu_to_le32(apsd_conf1);
 
-                ret = wl1271_cmd_configure(wl, ACX_TID_CFG, acx, sizeof(*acx));
-                if (ret < 0) {
-                        wl1271_warning("Setting of tid config failed: %d", ret);
-                        goto out;
-                }
+        ret = wl1271_cmd_configure(wl, ACX_TID_CFG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("Setting of tid config failed: %d", ret);
+                goto out;
         }
 
 out:
@@ -826,7 +913,7 @@ int wl1271_acx_frag_threshold(struct wl1271 *wl)
                 goto out;
         }
 
-        acx->frag_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
+        acx->frag_threshold = cpu_to_le16(wl->conf.tx.frag_threshold);
         ret = wl1271_cmd_configure(wl, ACX_FRAG_CFG, acx, sizeof(*acx));
         if (ret < 0) {
                 wl1271_warning("Setting of frag threshold failed: %d", ret);
@@ -852,8 +939,8 @@ int wl1271_acx_tx_config_options(struct wl1271 *wl)
                 goto out;
         }
 
-        acx->tx_compl_timeout = WL1271_ACX_TX_COMPL_TIMEOUT;
-        acx->tx_compl_threshold = WL1271_ACX_TX_COMPL_THRESHOLD;
+        acx->tx_compl_timeout = cpu_to_le16(wl->conf.tx.tx_compl_timeout);
+        acx->tx_compl_threshold = cpu_to_le16(wl->conf.tx.tx_compl_threshold);
         ret = wl1271_cmd_configure(wl, ACX_TX_CONFIG_OPT, acx, sizeof(*acx));
         if (ret < 0) {
                 wl1271_warning("Setting of tx options failed: %d", ret);
@@ -879,11 +966,11 @@ int wl1271_acx_mem_cfg(struct wl1271 *wl)
         }
 
         /* memory config */
-        mem_conf->num_stations = cpu_to_le16(DEFAULT_NUM_STATIONS);
+        mem_conf->num_stations = DEFAULT_NUM_STATIONS;
         mem_conf->rx_mem_block_num = ACX_RX_MEM_BLOCKS;
         mem_conf->tx_min_mem_block_num = ACX_TX_MIN_MEM_BLOCKS;
         mem_conf->num_ssid_profiles = ACX_NUM_SSID_PROFILES;
-        mem_conf->total_tx_descriptors = ACX_TX_DESCRIPTORS;
+        mem_conf->total_tx_descriptors = cpu_to_le32(ACX_TX_DESCRIPTORS);
 
         ret = wl1271_cmd_configure(wl, ACX_MEM_CFG, mem_conf,
                                    sizeof(*mem_conf));
@@ -906,7 +993,7 @@ int wl1271_acx_init_mem_config(struct wl1271 *wl)
                 return ret;
 
         wl->target_mem_map = kzalloc(sizeof(struct wl1271_acx_mem_map),
-                                          GFP_KERNEL);
+                                     GFP_KERNEL);
         if (!wl->target_mem_map) {
                 wl1271_error("couldn't allocate target memory map");
                 return -ENOMEM;
@@ -923,7 +1010,8 @@ int wl1271_acx_init_mem_config(struct wl1271 *wl)
         }
 
         /* initialize TX block book keeping */
-        wl->tx_blocks_available = wl->target_mem_map->num_tx_mem_blocks;
+        wl->tx_blocks_available =
+                le32_to_cpu(wl->target_mem_map->num_tx_mem_blocks);
         wl1271_debug(DEBUG_TX, "available tx blocks: %d",
                      wl->tx_blocks_available);
 
@@ -943,10 +1031,10 @@ int wl1271_acx_init_rx_interrupt(struct wl1271 *wl)
                 goto out;
         }
 
-        rx_conf->threshold = WL1271_RX_INTR_THRESHOLD_DEF;
-        rx_conf->timeout = WL1271_RX_INTR_TIMEOUT_DEF;
-        rx_conf->mblk_threshold = USHORT_MAX; /* Disabled */
-        rx_conf->queue_type = RX_QUEUE_TYPE_RX_LOW_PRIORITY;
+        rx_conf->threshold = cpu_to_le16(wl->conf.rx.irq_pkt_threshold);
+        rx_conf->timeout = cpu_to_le16(wl->conf.rx.irq_timeout);
+        rx_conf->mblk_threshold = cpu_to_le16(wl->conf.rx.irq_blk_threshold);
+        rx_conf->queue_type = wl->conf.rx.queue_type;
 
         ret = wl1271_cmd_configure(wl, ACX_RX_CONFIG_OPT, rx_conf,
                                    sizeof(*rx_conf));
@@ -959,3 +1047,99 @@ out:
         kfree(rx_conf);
         return ret;
 }
+
+int wl1271_acx_bet_enable(struct wl1271 *wl, bool enable)
+{
+        struct wl1271_acx_bet_enable *acx = NULL;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx bet enable");
+
+        if (enable && wl->conf.conn.bet_enable == CONF_BET_MODE_DISABLE)
+                goto out;
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->enable = enable ? CONF_BET_MODE_ENABLE : CONF_BET_MODE_DISABLE;
+        acx->max_consecutive = wl->conf.conn.bet_max_consecutive;
+
+        ret = wl1271_cmd_configure(wl, ACX_BET_ENABLE, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx bet enable failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_arp_ip_filter(struct wl1271 *wl, bool enable, u8 *address,
+                             u8 version)
+{
+        struct wl1271_acx_arp_filter *acx;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx arp ip filter, enable: %d", enable);
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->version = version;
+        acx->enable = enable;
+
+        if (enable == true) {
+                if (version == ACX_IPV4_VERSION)
+                        memcpy(acx->address, address, ACX_IPV4_ADDR_SIZE);
+                else if (version == ACX_IPV6_VERSION)
+                        memcpy(acx->address, address, sizeof(acx->address));
+                else
+                        wl1271_error("Invalid IP version");
+        }
+
+        ret = wl1271_cmd_configure(wl, ACX_ARP_IP_FILTER,
+                                   acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("failed to set arp ip filter: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_pm_config(struct wl1271 *wl)
+{
+        struct wl1271_acx_pm_config *acx = NULL;
+        struct  conf_pm_config_settings *c = &wl->conf.pm_config;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx pm config");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->host_clk_settling_time = cpu_to_le32(c->host_clk_settling_time);
+        acx->host_fast_wakeup_support = c->host_fast_wakeup_support;
+
+        ret = wl1271_cmd_configure(wl, ACX_PM_CONFIG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx pm config failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.h b/drivers/net/wireless/wl12xx/wl1271_acx.h
index 9068daaf0ddf..aeccc98581eb 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.h
@@ -2,7 +2,7 @@
  * This file is part of wl1271
  *
  * Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
- * Copyright (C) 2008-2009 Nokia Corporation
+ * Copyright (C) 2008-2010 Nokia Corporation
  *
  * Contact: Luciano Coelho <luciano.coelho@nokia.com>
  *
@@ -61,8 +61,9 @@
                                             WL1271_ACX_INTR_HW_AVAILABLE  | \
                                             WL1271_ACX_INTR_DATA)
 
-#define WL1271_INTR_MASK                   (WL1271_ACX_INTR_EVENT_A |   \
-                                            WL1271_ACX_INTR_EVENT_B | \
+#define WL1271_INTR_MASK                   (WL1271_ACX_INTR_EVENT_A      | \
+                                            WL1271_ACX_INTR_EVENT_B      | \
+                                            WL1271_ACX_INTR_HW_AVAILABLE | \
                                             WL1271_ACX_INTR_DATA)
 
 /* Target's information element */
@@ -70,11 +71,11 @@ struct acx_header {
         struct wl1271_cmd_header cmd;
 
         /* acx (or information element) header */
-        u16 id;
+        __le16 id;
 
         /* payload length (not including headers */
-        u16 len;
-};
+        __le16 len;
+} __attribute__ ((packed));
 
 struct acx_error_counter {
         struct acx_header header;
@@ -82,21 +83,21 @@ struct acx_error_counter {
         /* The number of PLCP errors since the last time this */
         /* information element was interrogated. This field is */
         /* automatically cleared when it is interrogated.*/
-        u32 PLCP_error;
+        __le32 PLCP_error;
 
         /* The number of FCS errors since the last time this */
         /* information element was interrogated. This field is */
         /* automatically cleared when it is interrogated.*/
-        u32 FCS_error;
+        __le32 FCS_error;
 
         /* The number of MPDUs without PLCP header errors received*/
         /* since the last time this information element was interrogated. */
         /* This field is automatically cleared when it is interrogated.*/
-        u32 valid_frame;
+        __le32 valid_frame;
 
         /* the number of missed sequence numbers in the squentially */
         /* values of frames seq numbers */
-        u32 seq_num_miss;
+        __le32 seq_num_miss;
 } __attribute__ ((packed));
 
 struct acx_revision {
@@ -125,7 +126,7 @@ struct acx_revision {
          *              (1 = first spin, 2 = second spin, and so on).
          * bits 24 - 31: Chip ID - The WiLink chip ID.
          */
-        u32 hw_version;
+        __le32 hw_version;
 } __attribute__ ((packed));
 
 enum wl1271_psm_mode {
@@ -170,7 +171,6 @@ enum {
 #define  DP_RX_PACKET_RING_CHUNK_NUM 2
 #define  DP_TX_PACKET_RING_CHUNK_NUM 2
 #define  DP_TX_COMPLETE_TIME_OUT 20
-#define  FW_TX_CMPLT_BLOCK_SIZE 16
 
 #define TX_MSDU_LIFETIME_MIN       0
 #define TX_MSDU_LIFETIME_MAX       3000
@@ -186,7 +186,7 @@ struct acx_rx_msdu_lifetime {
          * The maximum amount of time, in TU, before the
          * firmware discards the MSDU.
          */
-        u32 lifetime;
+        __le32 lifetime;
 } __attribute__ ((packed));
 
 /*
@@ -273,14 +273,14 @@ struct acx_rx_msdu_lifetime {
 struct acx_rx_config {
         struct acx_header header;
 
-        u32 config_options;
-        u32 filter_options;
+        __le32 config_options;
+        __le32 filter_options;
 } __attribute__ ((packed));
 
 struct acx_packet_detection {
         struct acx_header header;
 
-        u32 threshold;
+        __le32 threshold;
 } __attribute__ ((packed));
 
 
@@ -302,8 +302,8 @@ struct acx_slot {
 } __attribute__ ((packed));
 
 
-#define ADDRESS_GROUP_MAX       (8)
-#define ADDRESS_GROUP_MAX_LEN   (ETH_ALEN * ADDRESS_GROUP_MAX)
+#define ACX_MC_ADDRESS_GROUP_MAX        (8)
+#define ADDRESS_GROUP_MAX_LEN           (ETH_ALEN * ACX_MC_ADDRESS_GROUP_MAX)
 
 struct acx_dot11_grp_addr_tbl {
         struct acx_header header;
@@ -314,40 +314,17 @@ struct acx_dot11_grp_addr_tbl {
         u8 mac_table[ADDRESS_GROUP_MAX_LEN];
 } __attribute__ ((packed));
 
-
-#define  RX_TIMEOUT_PS_POLL_MIN    0
-#define  RX_TIMEOUT_PS_POLL_MAX    (200000)
-#define  RX_TIMEOUT_PS_POLL_DEF    (15)
-#define  RX_TIMEOUT_UPSD_MIN       0
-#define  RX_TIMEOUT_UPSD_MAX       (200000)
-#define  RX_TIMEOUT_UPSD_DEF       (15)
-
 struct acx_rx_timeout {
         struct acx_header header;
 
-        /*
-         * The longest time the STA will wait to receive
-         * traffic from the AP after a PS-poll has been
-         * transmitted.
-         */
-        u16 ps_poll_timeout;
-
-        /*
-         * The longest time the STA will wait to receive
-         * traffic from the AP after a frame has been sent
-         * from an UPSD enabled queue.
-         */
-        u16 upsd_timeout;
+        __le16 ps_poll_timeout;
+        __le16 upsd_timeout;
 } __attribute__ ((packed));
 
-#define RTS_THRESHOLD_MIN              0
-#define RTS_THRESHOLD_MAX              4096
-#define RTS_THRESHOLD_DEF              2347
-
 struct acx_rts_threshold {
         struct acx_header header;
 
-        u16 threshold;
+        __le16 threshold;
         u8 pad[2];
 } __attribute__ ((packed));
 
@@ -371,7 +348,7 @@ struct acx_beacon_filter_option {
  * ACXBeaconFilterEntry (not 221)
  * Byte Offset     Size (Bytes)    Definition
  * ===========     ============    ==========
- * 0                            1               IE identifier
+ * 0               1               IE identifier
  * 1               1               Treatment bit mask
  *
  * ACXBeaconFilterEntry (221)
@@ -404,8 +381,15 @@ struct acx_beacon_filter_ie_table {
         struct acx_header header;
 
         u8 num_ie;
-        u8 table[BEACON_FILTER_TABLE_MAX_SIZE];
         u8 pad[3];
+        u8 table[BEACON_FILTER_TABLE_MAX_SIZE];
+} __attribute__ ((packed));
+
+struct acx_conn_monit_params {
+       struct acx_header header;
+
+       __le32 synch_fail_thold; /* number of beacons missed */
+       __le32 bss_lose_timeout; /* number of TU's from synch fail */
 } __attribute__ ((packed));
 
 enum {
@@ -431,6 +415,14 @@ struct acx_bt_wlan_coex {
         u8 pad[3];
 } __attribute__ ((packed));
 
+struct acx_dco_itrim_params {
+        struct acx_header header;
+
+        u8 enable;
+        u8 padding[3];
+        __le32 timeout;
+} __attribute__ ((packed));
+
 #define PTA_ANTENNA_TYPE_DEF              (0)
 #define PTA_BT_HP_MAXTIME_DEF             (2000)
 #define PTA_WLAN_HP_MAX_TIME_DEF          (5000)
@@ -463,150 +455,34 @@ struct acx_bt_wlan_coex {
 struct acx_bt_wlan_coex_param {
         struct acx_header header;
 
-        /*
-         * The minimum rate of a received WLAN packet in the STA,
-         * during protective mode, of which a new BT-HP request
-         * during this Rx will always be respected and gain the antenna.
-         */
-        u32 min_rate;
-
-        /* Max time the BT HP will be respected. */
-        u16 bt_hp_max_time;
-
-        /* Max time the WLAN HP will be respected. */
-        u16 wlan_hp_max_time;
-
-        /*
-         * The time between the last BT activity
-         * and the moment when the sense mode returns
-         * to SENSE_INACTIVE.
-         */
-        u16 sense_disable_timer;
-
-        /* Time before the next BT HP instance */
-        u16 rx_time_bt_hp;
-        u16 tx_time_bt_hp;
-
-        /* range: 10-20000    default: 1500 */
-        u16 rx_time_bt_hp_fast;
-        u16 tx_time_bt_hp_fast;
-
-        /* range: 2000-65535  default: 8700 */
-        u16 wlan_cycle_fast;
-
-        /* range: 0 - 15000 (Msec) default: 1000 */
-        u16 bt_anti_starvation_period;
-
-        /* range 400-10000(Usec) default: 3000 */
-        u16 next_bt_lp_packet;
-
-        /* Deafult: worst case for BT DH5 traffic */
-        u16 wake_up_beacon;
-
-        /* range: 0-50000(Usec) default: 1050 */
-        u16 hp_dm_max_guard_time;
-
-        /*
-         * This is to prevent both BT & WLAN antenna
-         * starvation.
-         * Range: 100-50000(Usec) default:2550
-         */
-        u16 next_wlan_packet;
-
-        /* 0 -> shared antenna */
-        u8 antenna_type;
-
-        /*
-         * 0 -> TI legacy
-         * 1 -> Palau
-         */
-        u8 signal_type;
-
-        /*
-         * BT AFH status
-         * 0 -> no AFH
-         * 1 -> from dedicated GPIO
-         * 2 -> AFH on (from host)
-         */
-        u8 afh_leverage_on;
-
-        /*
-         * The number of cycles during which no
-         * TX will be sent after 1 cycle of RX
-         * transaction in protective mode
-         */
-        u8 quiet_cycle_num;
-
-        /*
-         * The maximum number of CTSs that will
-         * be sent for receiving RX packet in
-         * protective mode
-         */
-        u8 max_cts;
-
-        /*
-         * The number of WLAN packets
-         * transferred in common mode before
-         * switching to BT.
-         */
-        u8 wlan_packets_num;
-
-        /*
-         * The number of BT packets
-         * transferred in common mode before
-         * switching to WLAN.
-         */
-        u8 bt_packets_num;
-
-        /* range: 1-255  default: 5 */
-        u8 missed_rx_avalanche;
-
-        /* range: 0-1    default: 1 */
-        u8 wlan_elp_hp;
-
-        /* range: 0 - 15  default: 4 */
-        u8 bt_anti_starvation_cycles;
-
-        u8 ack_mode_dual_ant;
-
-        /*
-         * Allow PA_SD assertion/de-assertion
-         * during enabled BT activity.
-         */
-        u8 pa_sd_enable;
-
-        /*
-         * Enable/Disable PTA in auto mode:
-         * Support Both Active & P.S modes
-         */
-        u8 pta_auto_mode_enable;
-
-        /* range: 0 - 20  default: 1 */
-        u8 bt_hp_respected_num;
+        __le32 per_threshold;
+        __le32 max_scan_compensation_time;
+        __le16 nfs_sample_interval;
+        u8 load_ratio;
+        u8 auto_ps_mode;
+        u8 probe_req_compensation;
+        u8 scan_window_compensation;
+        u8 antenna_config;
+        u8 beacon_miss_threshold;
+        __le32 rate_adaptation_threshold;
+        s8 rate_adaptation_snr;
+        u8 padding[3];
 } __attribute__ ((packed));
 
-#define CCA_THRSH_ENABLE_ENERGY_D       0x140A
-#define CCA_THRSH_DISABLE_ENERGY_D      0xFFEF
-
 struct acx_energy_detection {
         struct acx_header header;
 
         /* The RX Clear Channel Assessment threshold in the PHY */
-        u16 rx_cca_threshold;
+        __le16 rx_cca_threshold;
         u8 tx_energy_detection;
         u8 pad;
 } __attribute__ ((packed));
 
-#define BCN_RX_TIMEOUT_DEF_VALUE        10000
-#define BROADCAST_RX_TIMEOUT_DEF_VALUE  20000
-#define RX_BROADCAST_IN_PS_DEF_VALUE    1
-#define CONSECUTIVE_PS_POLL_FAILURE_DEF 4
-
 struct acx_beacon_broadcast {
         struct acx_header header;
 
-        u16 beacon_rx_timeout;
-        u16 broadcast_timeout;
+        __le16 beacon_rx_timeout;
+        __le16 broadcast_timeout;
 
         /* Enables receiving of broadcast packets in PS mode */
         u8 rx_broadcast_in_ps;
@@ -619,8 +495,8 @@ struct acx_beacon_broadcast {
 struct acx_event_mask {
         struct acx_header header;
 
-        u32 event_mask;
-        u32 high_event_mask; /* Unused */
+        __le32 event_mask;
+        __le32 high_event_mask; /* Unused */
 } __attribute__ ((packed));
 
 #define CFG_RX_FCS              BIT(2)
@@ -657,11 +533,15 @@ struct acx_event_mask {
 #define SCAN_TRIGGERED          BIT(2)
 #define SCAN_PRIORITY_HIGH      BIT(3)
 
+/* When set, disable HW encryption */
+#define DF_ENCRYPTION_DISABLE      0x01
+#define DF_SNIFF_MODE_ENABLE       0x80
+
 struct acx_feature_config {
         struct acx_header header;
 
-        u32 options;
-        u32 data_flow_options;
+        __le32 options;
+        __le32 data_flow_options;
 } __attribute__ ((packed));
 
 struct acx_current_tx_power {
@@ -671,14 +551,6 @@ struct acx_current_tx_power {
         u8  padding[3];
 } __attribute__ ((packed));
 
-enum acx_wake_up_event {
-        WAKE_UP_EVENT_BEACON_BITMAP     = 0x01, /* Wake on every Beacon*/
-        WAKE_UP_EVENT_DTIM_BITMAP       = 0x02, /* Wake on every DTIM*/
-        WAKE_UP_EVENT_N_DTIM_BITMAP     = 0x04, /* Wake on every Nth DTIM */
-        WAKE_UP_EVENT_N_BEACONS_BITMAP  = 0x08, /* Wake on every Nth Beacon */
-        WAKE_UP_EVENT_BITS_MASK         = 0x0F
-};
-
 struct acx_wake_up_condition {
         struct acx_header header;
 
@@ -693,7 +565,7 @@ struct acx_aid {
         /*
          * To be set when associated with an AP.
          */
-        u16 aid;
+        __le16 aid;
         u8 pad[2];
 } __attribute__ ((packed));
 
@@ -725,152 +597,152 @@ struct acx_ctsprotect {
 } __attribute__ ((packed));
 
 struct acx_tx_statistics {
-        u32 internal_desc_overflow;
+        __le32 internal_desc_overflow;
 }  __attribute__ ((packed));
 
 struct acx_rx_statistics {
-        u32 out_of_mem;
-        u32 hdr_overflow;
-        u32 hw_stuck;
-        u32 dropped;
-        u32 fcs_err;
-        u32 xfr_hint_trig;
-        u32 path_reset;
-        u32 reset_counter;
+        __le32 out_of_mem;
+        __le32 hdr_overflow;
+        __le32 hw_stuck;
+        __le32 dropped;
+        __le32 fcs_err;
+        __le32 xfr_hint_trig;
+        __le32 path_reset;
+        __le32 reset_counter;
 } __attribute__ ((packed));
 
 struct acx_dma_statistics {
-        u32 rx_requested;
-        u32 rx_errors;
-        u32 tx_requested;
-        u32 tx_errors;
+        __le32 rx_requested;
+        __le32 rx_errors;
+        __le32 tx_requested;
+        __le32 tx_errors;
 }  __attribute__ ((packed));
 
 struct acx_isr_statistics {
         /* host command complete */
-        u32 cmd_cmplt;
+        __le32 cmd_cmplt;
 
         /* fiqisr() */
-        u32 fiqs;
+        __le32 fiqs;
 
         /* (INT_STS_ND & INT_TRIG_RX_HEADER) */
-        u32 rx_headers;
+        __le32 rx_headers;
 
         /* (INT_STS_ND & INT_TRIG_RX_CMPLT) */
-        u32 rx_completes;
+        __le32 rx_completes;
 
         /* (INT_STS_ND & INT_TRIG_NO_RX_BUF) */
-        u32 rx_mem_overflow;
+        __le32 rx_mem_overflow;
 
         /* (INT_STS_ND & INT_TRIG_S_RX_RDY) */
-        u32 rx_rdys;
+        __le32 rx_rdys;
 
         /* irqisr() */
-        u32 irqs;
+        __le32 irqs;
 
         /* (INT_STS_ND & INT_TRIG_TX_PROC) */
-        u32 tx_procs;
+        __le32 tx_procs;
 
         /* (INT_STS_ND & INT_TRIG_DECRYPT_DONE) */
-        u32 decrypt_done;
+        __le32 decrypt_done;
 
         /* (INT_STS_ND & INT_TRIG_DMA0) */
-        u32 dma0_done;
+        __le32 dma0_done;
 
         /* (INT_STS_ND & INT_TRIG_DMA1) */
-        u32 dma1_done;
+        __le32 dma1_done;
 
         /* (INT_STS_ND & INT_TRIG_TX_EXC_CMPLT) */
-        u32 tx_exch_complete;
+        __le32 tx_exch_complete;
 
         /* (INT_STS_ND & INT_TRIG_COMMAND) */
-        u32 commands;
+        __le32 commands;
 
         /* (INT_STS_ND & INT_TRIG_RX_PROC) */
-        u32 rx_procs;
+        __le32 rx_procs;
 
         /* (INT_STS_ND & INT_TRIG_PM_802) */
-        u32 hw_pm_mode_changes;
+        __le32 hw_pm_mode_changes;
 
         /* (INT_STS_ND & INT_TRIG_ACKNOWLEDGE) */
-        u32 host_acknowledges;
+        __le32 host_acknowledges;
 
         /* (INT_STS_ND & INT_TRIG_PM_PCI) */
-        u32 pci_pm;
+        __le32 pci_pm;
 
         /* (INT_STS_ND & INT_TRIG_ACM_WAKEUP) */
-        u32 wakeups;
+        __le32 wakeups;
 
         /* (INT_STS_ND & INT_TRIG_LOW_RSSI) */
-        u32 low_rssi;
+        __le32 low_rssi;
 } __attribute__ ((packed));
 
 struct acx_wep_statistics {
         /* WEP address keys configured */
-        u32 addr_key_count;
+        __le32 addr_key_count;
 
         /* default keys configured */
-        u32 default_key_count;
+        __le32 default_key_count;
 
-        u32 reserved;
+        __le32 reserved;
 
         /* number of times that WEP key not found on lookup */
-        u32 key_not_found;
+        __le32 key_not_found;
 
         /* number of times that WEP key decryption failed */
-        u32 decrypt_fail;
+        __le32 decrypt_fail;
 
         /* WEP packets decrypted */
-        u32 packets;
+        __le32 packets;
 
         /* WEP decrypt interrupts */
-        u32 interrupt;
+        __le32 interrupt;
 } __attribute__ ((packed));
 
 #define ACX_MISSED_BEACONS_SPREAD 10
 
 struct acx_pwr_statistics {
         /* the amount of enters into power save mode (both PD & ELP) */
-        u32 ps_enter;
+        __le32 ps_enter;
 
         /* the amount of enters into ELP mode */
-        u32 elp_enter;
+        __le32 elp_enter;
 
         /* the amount of missing beacon interrupts to the host */
-        u32 missing_bcns;
+        __le32 missing_bcns;
 
         /* the amount of wake on host-access times */
-        u32 wake_on_host;
+        __le32 wake_on_host;
 
         /* the amount of wake on timer-expire */
-        u32 wake_on_timer_exp;
+        __le32 wake_on_timer_exp;
 
         /* the number of packets that were transmitted with PS bit set */
-        u32 tx_with_ps;
+        __le32 tx_with_ps;
 
         /* the number of packets that were transmitted with PS bit clear */
-        u32 tx_without_ps;
+        __le32 tx_without_ps;
 
         /* the number of received beacons */
-        u32 rcvd_beacons;
+        __le32 rcvd_beacons;
 
         /* the number of entering into PowerOn (power save off) */
-        u32 power_save_off;
+        __le32 power_save_off;
 
         /* the number of entries into power save mode */
-        u16 enable_ps;
+        __le16 enable_ps;
 
         /*
          * the number of exits from power save, not including failed PS
          * transitions
          */
-        u16 disable_ps;
+        __le16 disable_ps;
 
         /*
          * the number of times the TSF counter was adjusted because
          * of drift
          */
-        u32 fix_tsf_ps;
+        __le32 fix_tsf_ps;
 
         /* Gives statistics about the spread continuous missed beacons.
          * The 16 LSB are dedicated for the PS mode.
@@ -881,53 +753,53 @@ struct acx_pwr_statistics {
          * ...
          * cont_miss_bcns_spread[9] - ten and more continuous missed beacons.
         */
-        u32 cont_miss_bcns_spread[ACX_MISSED_BEACONS_SPREAD];
+        __le32 cont_miss_bcns_spread[ACX_MISSED_BEACONS_SPREAD];
 
         /* the number of beacons in awake mode */
-        u32 rcvd_awake_beacons;
+        __le32 rcvd_awake_beacons;
 } __attribute__ ((packed));
 
 struct acx_mic_statistics {
-        u32 rx_pkts;
-        u32 calc_failure;
+        __le32 rx_pkts;
+        __le32 calc_failure;
 } __attribute__ ((packed));
 
 struct acx_aes_statistics {
-        u32 encrypt_fail;
-        u32 decrypt_fail;
-        u32 encrypt_packets;
-        u32 decrypt_packets;
-        u32 encrypt_interrupt;
-        u32 decrypt_interrupt;
+        __le32 encrypt_fail;
+        __le32 decrypt_fail;
+        __le32 encrypt_packets;
+        __le32 decrypt_packets;
+        __le32 encrypt_interrupt;
+        __le32 decrypt_interrupt;
 } __attribute__ ((packed));
 
 struct acx_event_statistics {
-        u32 heart_beat;
-        u32 calibration;
-        u32 rx_mismatch;
-        u32 rx_mem_empty;
-        u32 rx_pool;
-        u32 oom_late;
-        u32 phy_transmit_error;
-        u32 tx_stuck;
+        __le32 heart_beat;
+        __le32 calibration;
+        __le32 rx_mismatch;
+        __le32 rx_mem_empty;
+        __le32 rx_pool;
+        __le32 oom_late;
+        __le32 phy_transmit_error;
+        __le32 tx_stuck;
 } __attribute__ ((packed));
 
 struct acx_ps_statistics {
-        u32 pspoll_timeouts;
-        u32 upsd_timeouts;
-        u32 upsd_max_sptime;
-        u32 upsd_max_apturn;
-        u32 pspoll_max_apturn;
-        u32 pspoll_utilization;
-        u32 upsd_utilization;
+        __le32 pspoll_timeouts;
+        __le32 upsd_timeouts;
+        __le32 upsd_max_sptime;
+        __le32 upsd_max_apturn;
+        __le32 pspoll_max_apturn;
+        __le32 pspoll_utilization;
+        __le32 upsd_utilization;
 } __attribute__ ((packed));
 
 struct acx_rxpipe_statistics {
-        u32 rx_prep_beacon_drop;
-        u32 descr_host_int_trig_rx_data;
-        u32 beacon_buffer_thres_host_int_trig_rx_data;
-        u32 missed_beacon_host_int_trig_rx_data;
-        u32 tx_xfr_host_int_trig_rx_data;
+        __le32 rx_prep_beacon_drop;
+        __le32 descr_host_int_trig_rx_data;
+        __le32 beacon_buffer_thres_host_int_trig_rx_data;
+        __le32 missed_beacon_host_int_trig_rx_data;
+        __le32 tx_xfr_host_int_trig_rx_data;
 } __attribute__ ((packed));
 
 struct acx_statistics {
@@ -946,63 +818,34 @@ struct acx_statistics {
         struct acx_rxpipe_statistics rxpipe;
 } __attribute__ ((packed));
 
-#define ACX_MAX_RATE_CLASSES       8
-#define ACX_RATE_MASK_UNSPECIFIED  0
-#define ACX_RATE_MASK_ALL          0x1eff
-#define ACX_RATE_RETRY_LIMIT       10
-
 struct acx_rate_class {
-        u32 enabled_rates;
+        __le32 enabled_rates;
         u8 short_retry_limit;
         u8 long_retry_limit;
         u8 aflags;
         u8 reserved;
 };
 
+#define ACX_TX_BASIC_RATE      0
+#define ACX_TX_AP_FULL_RATE    1
+#define ACX_TX_RATE_POLICY_CNT 2
 struct acx_rate_policy {
         struct acx_header header;
 
-        u32 rate_class_cnt;
-        struct acx_rate_class rate_class[ACX_MAX_RATE_CLASSES];
+        __le32 rate_class_cnt;
+        struct acx_rate_class rate_class[CONF_TX_MAX_RATE_CLASSES];
 } __attribute__ ((packed));
 
-#define WL1271_ACX_AC_COUNT 4
-
 struct acx_ac_cfg {
         struct acx_header header;
         u8 ac;
         u8 cw_min;
-        u16 cw_max;
+        __le16 cw_max;
         u8 aifsn;
         u8 reserved;
-        u16 tx_op_limit;
+        __le16 tx_op_limit;
 } __attribute__ ((packed));
 
-enum wl1271_acx_ac {
-        WL1271_ACX_AC_BE = 0,
-        WL1271_ACX_AC_BK = 1,
-        WL1271_ACX_AC_VI = 2,
-        WL1271_ACX_AC_VO = 3,
-        WL1271_ACX_AC_CTS2SELF = 4,
-        WL1271_ACX_AC_ANY_TID = 0x1F,
-        WL1271_ACX_AC_INVALID = 0xFF,
-};
-
-enum wl1271_acx_ps_scheme {
-        WL1271_ACX_PS_SCHEME_LEGACY = 0,
-        WL1271_ACX_PS_SCHEME_UPSD_TRIGGER = 1,
-        WL1271_ACX_PS_SCHEME_LEGACY_PSPOLL = 2,
-        WL1271_ACX_PS_SCHEME_SAPSD = 3,
-};
-
-enum wl1271_acx_ack_policy {
-        WL1271_ACX_ACK_POLICY_LEGACY = 0,
-        WL1271_ACX_ACK_POLICY_NO_ACK = 1,
-        WL1271_ACX_ACK_POLICY_BLOCK = 2,
-};
-
-#define WL1271_ACX_TID_COUNT 7
-
 struct acx_tid_config {
         struct acx_header header;
         u8 queue_id;
@@ -1011,26 +854,23 @@ struct acx_tid_config {
         u8 ps_scheme;
         u8 ack_policy;
         u8 padding[3];
-        u32 apsd_conf[2];
+        __le32 apsd_conf[2];
 } __attribute__ ((packed));
 
 struct acx_frag_threshold {
         struct acx_header header;
-        u16 frag_threshold;
+        __le16 frag_threshold;
         u8 padding[2];
 } __attribute__ ((packed));
 
-#define WL1271_ACX_TX_COMPL_TIMEOUT   5
-#define WL1271_ACX_TX_COMPL_THRESHOLD 5
-
 struct acx_tx_config_options {
         struct acx_header header;
-        u16 tx_compl_timeout;     /* msec */
-        u16 tx_compl_threshold;   /* number of packets */
+        __le16 tx_compl_timeout;     /* msec */
+        __le16 tx_compl_threshold;   /* number of packets */
 } __attribute__ ((packed));
 
-#define ACX_RX_MEM_BLOCKS     64
-#define ACX_TX_MIN_MEM_BLOCKS 64
+#define ACX_RX_MEM_BLOCKS     70
+#define ACX_TX_MIN_MEM_BLOCKS 40
 #define ACX_TX_DESCRIPTORS    32
 #define ACX_NUM_SSID_PROFILES 1
 
@@ -1041,79 +881,94 @@ struct wl1271_acx_config_memory {
         u8 tx_min_mem_block_num;
         u8 num_stations;
         u8 num_ssid_profiles;
-        u32 total_tx_descriptors;
+        __le32 total_tx_descriptors;
 } __attribute__ ((packed));
 
 struct wl1271_acx_mem_map {
         struct acx_header header;
 
-        void *code_start;
-        void *code_end;
+        __le32 code_start;
+        __le32 code_end;
 
-        void *wep_defkey_start;
-        void *wep_defkey_end;
+        __le32 wep_defkey_start;
+        __le32 wep_defkey_end;
 
-        void *sta_table_start;
-        void *sta_table_end;
+        __le32 sta_table_start;
+        __le32 sta_table_end;
 
-        void *packet_template_start;
-        void *packet_template_end;
+        __le32 packet_template_start;
+        __le32 packet_template_end;
 
         /* Address of the TX result interface (control block) */
-        u32 tx_result;
-        u32 tx_result_queue_start;
+        __le32 tx_result;
+        __le32 tx_result_queue_start;
 
-        void *queue_memory_start;
-        void *queue_memory_end;
+        __le32 queue_memory_start;
+        __le32 queue_memory_end;
 
-        u32 packet_memory_pool_start;
-        u32 packet_memory_pool_end;
+        __le32 packet_memory_pool_start;
+        __le32 packet_memory_pool_end;
 
-        void *debug_buffer1_start;
-        void *debug_buffer1_end;
+        __le32 debug_buffer1_start;
+        __le32 debug_buffer1_end;
 
-        void *debug_buffer2_start;
-        void *debug_buffer2_end;
+        __le32 debug_buffer2_start;
+        __le32 debug_buffer2_end;
 
         /* Number of blocks FW allocated for TX packets */
-        u32 num_tx_mem_blocks;
+        __le32 num_tx_mem_blocks;
 
         /* Number of blocks FW allocated for RX packets */
-        u32 num_rx_mem_blocks;
+        __le32 num_rx_mem_blocks;
 
         /* the following 4 fields are valid in SLAVE mode only */
         u8 *tx_cbuf;
         u8 *rx_cbuf;
-        void *rx_ctrl;
-        void *tx_ctrl;
+        __le32 rx_ctrl;
+        __le32 tx_ctrl;
 } __attribute__ ((packed));
 
-enum wl1271_acx_rx_queue_type {
-        RX_QUEUE_TYPE_RX_LOW_PRIORITY,    /* All except the high priority */
-        RX_QUEUE_TYPE_RX_HIGH_PRIORITY,   /* Management and voice packets */
-        RX_QUEUE_TYPE_NUM,
-        RX_QUEUE_TYPE_MAX = USHORT_MAX
-};
-
-#define WL1271_RX_INTR_THRESHOLD_DEF  0       /* no pacing, send interrupt on
-                                               * every event */
-#define WL1271_RX_INTR_THRESHOLD_MIN  0
-#define WL1271_RX_INTR_THRESHOLD_MAX  15
-
-#define WL1271_RX_INTR_TIMEOUT_DEF    5
-#define WL1271_RX_INTR_TIMEOUT_MIN    1
-#define WL1271_RX_INTR_TIMEOUT_MAX    100
-
 struct wl1271_acx_rx_config_opt {
         struct acx_header header;
 
-        u16 mblk_threshold;
-        u16 threshold;
-        u16 timeout;
+        __le16 mblk_threshold;
+        __le16 threshold;
+        __le16 timeout;
         u8 queue_type;
         u8 reserved;
 } __attribute__ ((packed));
 
+
+struct wl1271_acx_bet_enable {
+        struct acx_header header;
+
+        u8 enable;
+        u8 max_consecutive;
+        u8 padding[2];
+} __attribute__ ((packed));
+
+#define ACX_IPV4_VERSION 4
+#define ACX_IPV6_VERSION 6
+#define ACX_IPV4_ADDR_SIZE 4
+struct wl1271_acx_arp_filter {
+        struct acx_header header;
+        u8 version;         /* ACX_IPV4_VERSION, ACX_IPV6_VERSION */
+        u8 enable;          /* 1 to enable ARP filtering, 0 to disable */
+        u8 padding[2];
+        u8 address[16];     /* The configured device IP address - all ARP
+                               requests directed to this IP address will pass
+                               through. For IPv4, the first four bytes are
+                               used. */
+} __attribute__((packed));
+
+struct wl1271_acx_pm_config {
+        struct acx_header header;
+
+        __le32 host_clk_settling_time;
+        u8 host_fast_wakeup_support;
+        u8 padding[3];
+} __attribute__ ((packed));
+
 enum {
         ACX_WAKE_UP_CONDITIONS      = 0x0002,
         ACX_MEM_CFG                 = 0x0003,
@@ -1170,11 +1025,14 @@ enum {
         ACX_PEER_HT_CAP             = 0x0057,
         ACX_HT_BSS_OPERATION        = 0x0058,
         ACX_COEX_ACTIVITY           = 0x0059,
+        ACX_SET_SMART_REFLEX_DEBUG  = 0x005A,
+        ACX_SET_DCO_ITRIM_PARAMS    = 0x0061,
         DOT11_RX_MSDU_LIFE_TIME     = 0x1004,
         DOT11_CUR_TX_PWR            = 0x100D,
         DOT11_RX_DOT11_MODE         = 0x1012,
         DOT11_RTS_THRESHOLD         = 0x1013,
         DOT11_GROUP_ADDRESS_TBL     = 0x1014,
+        ACX_PM_CONFIG               = 0x1016,
 
         MAX_DOT11_IE = DOT11_GROUP_ADDRESS_TBL,
 
@@ -1182,23 +1040,25 @@ enum {
 };
 
 
-int wl1271_acx_wake_up_conditions(struct wl1271 *wl, u8 wake_up_event,
-                                  u8 listen_interval);
+int wl1271_acx_wake_up_conditions(struct wl1271 *wl);
 int wl1271_acx_sleep_auth(struct wl1271 *wl, u8 sleep_auth);
 int wl1271_acx_fw_version(struct wl1271 *wl, char *buf, size_t len);
 int wl1271_acx_tx_power(struct wl1271 *wl, int power);
 int wl1271_acx_feature_cfg(struct wl1271 *wl);
 int wl1271_acx_mem_map(struct wl1271 *wl,
                        struct acx_header *mem_map, size_t len);
-int wl1271_acx_rx_msdu_life_time(struct wl1271 *wl, u32 life_time);
+int wl1271_acx_rx_msdu_life_time(struct wl1271 *wl);
 int wl1271_acx_rx_config(struct wl1271 *wl, u32 config, u32 filter);
 int wl1271_acx_pd_threshold(struct wl1271 *wl);
 int wl1271_acx_slot(struct wl1271 *wl, enum acx_slot_type slot_time);
-int wl1271_acx_group_address_tbl(struct wl1271 *wl);
+int wl1271_acx_group_address_tbl(struct wl1271 *wl, bool enable,
+                                 void *mc_list, u32 mc_list_len);
 int wl1271_acx_service_period_timeout(struct wl1271 *wl);
 int wl1271_acx_rts_threshold(struct wl1271 *wl, u16 rts_threshold);
-int wl1271_acx_beacon_filter_opt(struct wl1271 *wl);
+int wl1271_acx_dco_itrim_params(struct wl1271 *wl);
+int wl1271_acx_beacon_filter_opt(struct wl1271 *wl, bool enable_filter);
 int wl1271_acx_beacon_filter_table(struct wl1271 *wl);
+int wl1271_acx_conn_monit_params(struct wl1271 *wl);
 int wl1271_acx_sg_enable(struct wl1271 *wl);
 int wl1271_acx_sg_cfg(struct wl1271 *wl);
 int wl1271_acx_cca_threshold(struct wl1271 *wl);
@@ -1207,15 +1067,23 @@ int wl1271_acx_aid(struct wl1271 *wl, u16 aid);
 int wl1271_acx_event_mbox_mask(struct wl1271 *wl, u32 event_mask);
 int wl1271_acx_set_preamble(struct wl1271 *wl, enum acx_preamble_type preamble);
 int wl1271_acx_cts_protect(struct wl1271 *wl,
-                            enum acx_ctsprotect_type ctsprotect);
+                           enum acx_ctsprotect_type ctsprotect);
 int wl1271_acx_statistics(struct wl1271 *wl, struct acx_statistics *stats);
 int wl1271_acx_rate_policies(struct wl1271 *wl);
-int wl1271_acx_ac_cfg(struct wl1271 *wl);
-int wl1271_acx_tid_cfg(struct wl1271 *wl);
+int wl1271_acx_ac_cfg(struct wl1271 *wl, u8 ac, u8 cw_min, u16 cw_max,
+                      u8 aifsn, u16 txop);
+int wl1271_acx_tid_cfg(struct wl1271 *wl, u8 queue_id, u8 channel_type,
+                       u8 tsid, u8 ps_scheme, u8 ack_policy,
+                       u32 apsd_conf0, u32 apsd_conf1);
 int wl1271_acx_frag_threshold(struct wl1271 *wl);
 int wl1271_acx_tx_config_options(struct wl1271 *wl);
 int wl1271_acx_mem_cfg(struct wl1271 *wl);
 int wl1271_acx_init_mem_config(struct wl1271 *wl);
 int wl1271_acx_init_rx_interrupt(struct wl1271 *wl);
+int wl1271_acx_smart_reflex(struct wl1271 *wl);
+int wl1271_acx_bet_enable(struct wl1271 *wl, bool enable);
+int wl1271_acx_arp_ip_filter(struct wl1271 *wl, bool enable, u8 *address,
+                             u8 version);
+int wl1271_acx_pm_config(struct wl1271 *wl);
 
 #endif /* __WL1271_ACX_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.c b/drivers/net/wireless/wl12xx/wl1271_boot.c
index 8228ef474a7e..024356263065 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.c
@@ -22,11 +22,13 @@
  */
 
 #include <linux/gpio.h>
+#include <linux/slab.h>
 
 #include "wl1271_acx.h"
 #include "wl1271_reg.h"
 #include "wl1271_boot.h"
 #include "wl1271_spi.h"
+#include "wl1271_io.h"
 #include "wl1271_event.h"
 
 static struct wl1271_partition_set part_table[PART_TABLE_LEN] = {
@@ -39,6 +41,14 @@ static struct wl1271_partition_set part_table[PART_TABLE_LEN] = {
                         .start = REGISTERS_BASE,
                         .size  = 0x00008800
                 },
+                .mem2 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
+                },
+                .mem3 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
+                },
         },
 
         [PART_WORK] = {
@@ -48,7 +58,15 @@ static struct wl1271_partition_set part_table[PART_TABLE_LEN] = {
                 },
                 .reg = {
                         .start = REGISTERS_BASE,
-                        .size  = 0x0000b000
+                        .size  = 0x0000a000
+                },
+                .mem2 = {
+                        .start = 0x003004f8,
+                        .size  = 0x00000004
+                },
+                .mem3 = {
+                        .start = 0x00040404,
+                        .size  = 0x00000000
                 },
         },
 
@@ -60,6 +78,14 @@ static struct wl1271_partition_set part_table[PART_TABLE_LEN] = {
                 .reg = {
                         .start = DRPW_BASE,
                         .size  = 0x00006000
+                },
+                .mem2 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
+                },
+                .mem3 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
                 }
         }
 };
@@ -69,19 +95,19 @@ static void wl1271_boot_set_ecpu_ctrl(struct wl1271 *wl, u32 flag)
         u32 cpu_ctrl;
 
         /* 10.5.0 run the firmware (I) */
-        cpu_ctrl = wl1271_reg_read32(wl, ACX_REG_ECPU_CONTROL);
+        cpu_ctrl = wl1271_read32(wl, ACX_REG_ECPU_CONTROL);
 
         /* 10.5.1 run the firmware (II) */
         cpu_ctrl |= flag;
-        wl1271_reg_write32(wl, ACX_REG_ECPU_CONTROL, cpu_ctrl);
+        wl1271_write32(wl, ACX_REG_ECPU_CONTROL, cpu_ctrl);
 }
 
 static void wl1271_boot_fw_version(struct wl1271 *wl)
 {
         struct wl1271_static_data static_data;
 
-        wl1271_spi_mem_read(wl, wl->cmd_box_addr,
-                            &static_data, sizeof(static_data));
+        wl1271_read(wl, wl->cmd_box_addr, &static_data, sizeof(static_data),
+                    false);
 
         strncpy(wl->chip.fw_ver, static_data.fw_version,
                 sizeof(wl->chip.fw_ver));
@@ -93,8 +119,9 @@ static void wl1271_boot_fw_version(struct wl1271 *wl)
 static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
                                              size_t fw_data_len, u32 dest)
 {
+        struct wl1271_partition_set partition;
         int addr, chunk_num, partition_limit;
-        u8 *p;
+        u8 *p, *chunk;
 
         /* whal_FwCtrl_LoadFwImageSm() */
 
@@ -103,16 +130,20 @@ static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
         wl1271_debug(DEBUG_BOOT, "fw_data_len %zd chunk_size %d",
                      fw_data_len, CHUNK_SIZE);
 
-
         if ((fw_data_len % 4) != 0) {
                 wl1271_error("firmware length not multiple of four");
                 return -EIO;
         }
 
-        wl1271_set_partition(wl, dest,
-                             part_table[PART_DOWN].mem.size,
-                             part_table[PART_DOWN].reg.start,
-                             part_table[PART_DOWN].reg.size);
+        chunk = kmalloc(CHUNK_SIZE, GFP_KERNEL);
+        if (!chunk) {
+                wl1271_error("allocation for firmware upload chunk failed");
+                return -ENOMEM;
+        }
+
+        memcpy(&partition, &part_table[PART_DOWN], sizeof(partition));
+        partition.mem.start = dest;
+        wl1271_set_partition(wl, &partition);
 
         /* 10.1 set partition limit and chunk num */
         chunk_num = 0;
@@ -125,21 +156,17 @@ static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
                         addr = dest + chunk_num * CHUNK_SIZE;
                         partition_limit = chunk_num * CHUNK_SIZE +
                                 part_table[PART_DOWN].mem.size;
-
-                        /* FIXME: Over 80 chars! */
-                        wl1271_set_partition(wl,
-                                             addr,
-                                             part_table[PART_DOWN].mem.size,
-                                             part_table[PART_DOWN].reg.start,
-                                             part_table[PART_DOWN].reg.size);
+                        partition.mem.start = addr;
+                        wl1271_set_partition(wl, &partition);
                 }
 
                 /* 10.3 upload the chunk */
                 addr = dest + chunk_num * CHUNK_SIZE;
                 p = buf + chunk_num * CHUNK_SIZE;
+                memcpy(chunk, p, CHUNK_SIZE);
                 wl1271_debug(DEBUG_BOOT, "uploading fw chunk 0x%p to 0x%x",
                              p, addr);
-                wl1271_spi_mem_write(wl, addr, p, CHUNK_SIZE);
+                wl1271_write(wl, addr, chunk, CHUNK_SIZE, false);
 
                 chunk_num++;
         }
@@ -147,28 +174,31 @@ static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
         /* 10.4 upload the last chunk */
         addr = dest + chunk_num * CHUNK_SIZE;
         p = buf + chunk_num * CHUNK_SIZE;
+        memcpy(chunk, p, fw_data_len % CHUNK_SIZE);
         wl1271_debug(DEBUG_BOOT, "uploading fw last chunk (%zd B) 0x%p to 0x%x",
                      fw_data_len % CHUNK_SIZE, p, addr);
-        wl1271_spi_mem_write(wl, addr, p, fw_data_len % CHUNK_SIZE);
+        wl1271_write(wl, addr, chunk, fw_data_len % CHUNK_SIZE, false);
 
+        kfree(chunk);
         return 0;
 }
 
 static int wl1271_boot_upload_firmware(struct wl1271 *wl)
 {
         u32 chunks, addr, len;
+        int ret = 0;
         u8 *fw;
 
         fw = wl->fw;
-        chunks = be32_to_cpup((u32 *) fw);
+        chunks = be32_to_cpup((__be32 *) fw);
         fw += sizeof(u32);
 
         wl1271_debug(DEBUG_BOOT, "firmware chunks to be uploaded: %u", chunks);
 
         while (chunks--) {
-                addr = be32_to_cpup((u32 *) fw);
+                addr = be32_to_cpup((__be32 *) fw);
                 fw += sizeof(u32);
-                len = be32_to_cpup((u32 *) fw);
+                len = be32_to_cpup((__be32 *) fw);
                 fw += sizeof(u32);
 
                 if (len > 300000) {
@@ -177,11 +207,13 @@ static int wl1271_boot_upload_firmware(struct wl1271 *wl)
                 }
                 wl1271_debug(DEBUG_BOOT, "chunk %d addr 0x%x len %u",
                              chunks, addr, len);
-                wl1271_boot_upload_firmware_chunk(wl, fw, len, addr);
+                ret = wl1271_boot_upload_firmware_chunk(wl, fw, len, addr);
+                if (ret != 0)
+                        break;
                 fw += len;
         }
 
-        return 0;
+        return ret;
 }
 
 static int wl1271_boot_upload_nvs(struct wl1271 *wl)
@@ -189,23 +221,14 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
         size_t nvs_len, burst_len;
         int i;
         u32 dest_addr, val;
-        u8 *nvs_ptr, *nvs, *nvs_aligned;
+        u8 *nvs_ptr, *nvs_aligned;
 
-        nvs = wl->nvs;
-        if (nvs == NULL)
+        if (wl->nvs == NULL)
                 return -ENODEV;
 
-        nvs_ptr = nvs;
-
-        nvs_len = wl->nvs_len;
-
-        /* Update the device MAC address into the nvs */
-        nvs[11] = wl->mac_addr[0];
-        nvs[10] = wl->mac_addr[1];
-        nvs[6] = wl->mac_addr[2];
-        nvs[5] = wl->mac_addr[3];
-        nvs[4] = wl->mac_addr[4];
-        nvs[3] = wl->mac_addr[5];
+        /* only the first part of the NVS needs to be uploaded */
+        nvs_len = sizeof(wl->nvs->nvs);
+        nvs_ptr = (u8 *)wl->nvs->nvs;
 
         /*
          * Layout before the actual NVS tables:
@@ -235,7 +258,7 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
                         wl1271_debug(DEBUG_BOOT,
                                      "nvs burst write 0x%x: 0x%x",
                                      dest_addr, val);
-                        wl1271_reg_write32(wl, dest_addr, val);
+                        wl1271_write32(wl, dest_addr, val);
 
                         nvs_ptr += 4;
                         dest_addr += 4;
@@ -247,26 +270,29 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
          * is 7 bytes further.
          */
         nvs_ptr += 7;
-        nvs_len -= nvs_ptr - nvs;
+        nvs_len -= nvs_ptr - (u8 *)wl->nvs->nvs;
         nvs_len = ALIGN(nvs_len, 4);
 
         /* FIXME: The driver sets the partition here, but this is not needed,
            since it sets to the same one as currently in use */
         /* Now we must set the partition correctly */
-        wl1271_set_partition(wl,
-                             part_table[PART_WORK].mem.start,
-                             part_table[PART_WORK].mem.size,
-                             part_table[PART_WORK].reg.start,
-                             part_table[PART_WORK].reg.size);
+        wl1271_set_partition(wl, &part_table[PART_WORK]);
 
         /* Copy the NVS tables to a new block to ensure alignment */
-        nvs_aligned = kmemdup(nvs_ptr, nvs_len, GFP_KERNEL);
+        /* FIXME: We jump 3 more bytes before uploading the NVS.  It seems
+        that our NVS files have three extra zeros here.  I'm not sure whether
+        the problem is in our NVS generation or we should really jumpt these
+        3 bytes here */
+        nvs_ptr += 3;
+
+        nvs_aligned = kmemdup(nvs_ptr, nvs_len, GFP_KERNEL); if
+        (!nvs_aligned) return -ENOMEM;
 
         /* And finally we upload the NVS tables */
         /* FIXME: In wl1271, we upload everything at once.
            No endianness handling needed here?! The ref driver doesn't do
            anything about it at this point */
-        wl1271_spi_mem_write(wl, CMD_MBOX_ADDRESS, nvs_aligned, nvs_len);
+        wl1271_write(wl, CMD_MBOX_ADDRESS, nvs_aligned, nvs_len, false);
 
         kfree(nvs_aligned);
         return 0;
@@ -275,9 +301,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
 static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
 {
         enable_irq(wl->irq);
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
-                           WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
-        wl1271_reg_write32(wl, HI_CFG, HI_CFG_DEF_VAL);
+        wl1271_write32(wl, ACX_REG_INTERRUPT_MASK,
+                       WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
+        wl1271_write32(wl, HI_CFG, HI_CFG_DEF_VAL);
 }
 
 static int wl1271_boot_soft_reset(struct wl1271 *wl)
@@ -286,12 +312,12 @@ static int wl1271_boot_soft_reset(struct wl1271 *wl)
         u32 boot_data;
 
         /* perform soft reset */
-        wl1271_reg_write32(wl, ACX_REG_SLV_SOFT_RESET, ACX_SLV_SOFT_RESET_BIT);
+        wl1271_write32(wl, ACX_REG_SLV_SOFT_RESET, ACX_SLV_SOFT_RESET_BIT);
 
         /* SOFT_RESET is self clearing */
         timeout = jiffies + usecs_to_jiffies(SOFT_RESET_MAX_TIME);
         while (1) {
-                boot_data = wl1271_reg_read32(wl, ACX_REG_SLV_SOFT_RESET);
+                boot_data = wl1271_read32(wl, ACX_REG_SLV_SOFT_RESET);
                 wl1271_debug(DEBUG_BOOT, "soft reset bootdata 0x%x", boot_data);
                 if ((boot_data & ACX_SLV_SOFT_RESET_BIT) == 0)
                         break;
@@ -307,10 +333,10 @@ static int wl1271_boot_soft_reset(struct wl1271 *wl)
         }
 
         /* disable Rx/Tx */
-        wl1271_reg_write32(wl, ENABLE, 0x0);
+        wl1271_write32(wl, ENABLE, 0x0);
 
         /* disable auto calibration on start*/
-        wl1271_reg_write32(wl, SPARE_A2, 0xffff);
+        wl1271_write32(wl, SPARE_A2, 0xffff);
 
         return 0;
 }
@@ -322,7 +348,7 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
 
         wl1271_boot_set_ecpu_ctrl(wl, ECPU_CONTROL_HALT);
 
-        chip_id = wl1271_reg_read32(wl, CHIP_ID_B);
+        chip_id = wl1271_read32(wl, CHIP_ID_B);
 
         wl1271_debug(DEBUG_BOOT, "chip id after firmware boot: 0x%x", chip_id);
 
@@ -335,7 +361,7 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
         loop = 0;
         while (loop++ < INIT_LOOP) {
                 udelay(INIT_LOOP_DELAY);
-                interrupt = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+                interrupt = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
 
                 if (interrupt == 0xffffffff) {
                         wl1271_error("error reading hardware complete "
@@ -344,30 +370,26 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
                 }
                 /* check that ACX_INTR_INIT_COMPLETE is enabled */
                 else if (interrupt & WL1271_ACX_INTR_INIT_COMPLETE) {
-                        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_ACK,
-                                           WL1271_ACX_INTR_INIT_COMPLETE);
+                        wl1271_write32(wl, ACX_REG_INTERRUPT_ACK,
+                                       WL1271_ACX_INTR_INIT_COMPLETE);
                         break;
                 }
         }
 
-        if (loop >= INIT_LOOP) {
+        if (loop > INIT_LOOP) {
                 wl1271_error("timeout waiting for the hardware to "
                              "complete initialization");
                 return -EIO;
         }
 
         /* get hardware config command mail box */
-        wl->cmd_box_addr = wl1271_reg_read32(wl, REG_COMMAND_MAILBOX_PTR);
+        wl->cmd_box_addr = wl1271_read32(wl, REG_COMMAND_MAILBOX_PTR);
 
         /* get hardware config event mail box */
-        wl->event_box_addr = wl1271_reg_read32(wl, REG_EVENT_MAILBOX_PTR);
+        wl->event_box_addr = wl1271_read32(wl, REG_EVENT_MAILBOX_PTR);
 
         /* set the working partition to its "running" mode offset */
-        wl1271_set_partition(wl,
-                             part_table[PART_WORK].mem.start,
-                             part_table[PART_WORK].mem.size,
-                             part_table[PART_WORK].reg.start,
-                             part_table[PART_WORK].reg.size);
+        wl1271_set_partition(wl, &part_table[PART_WORK]);
 
         wl1271_debug(DEBUG_MAILBOX, "cmd_box_addr 0x%x event_box_addr 0x%x",
                      wl->cmd_box_addr, wl->event_box_addr);
@@ -379,11 +401,10 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
          * ready to receive event from the command mailbox
          */
 
-        /* enable gpio interrupts */
-        wl1271_boot_enable_interrupts(wl);
-
-        /* unmask all mbox events  */
-        wl->event_mask = 0xffffffff;
+        /* unmask required mbox events  */
+        wl->event_mask = BSS_LOSE_EVENT_ID |
+                SCAN_COMPLETE_EVENT_ID |
+                PS_REPORT_EVENT_ID;
 
         ret = wl1271_event_unmask(wl);
         if (ret < 0) {
@@ -399,34 +420,13 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
 
 static int wl1271_boot_write_irq_polarity(struct wl1271 *wl)
 {
-        u32 polarity, status, i;
-
-        wl1271_reg_write32(wl, OCP_POR_CTR, OCP_REG_POLARITY);
-        wl1271_reg_write32(wl, OCP_CMD, OCP_CMD_READ);
-
-        /* Wait until the command is complete (ie. bit 18 is set) */
-        for (i = 0; i < OCP_CMD_LOOP; i++) {
-                polarity = wl1271_reg_read32(wl, OCP_DATA_READ);
-                if (polarity & OCP_READY_MASK)
-                        break;
-        }
-        if (i == OCP_CMD_LOOP) {
-                wl1271_error("OCP command timeout!");
-                return -EIO;
-        }
+        u32 polarity;
 
-        status = polarity & OCP_STATUS_MASK;
-        if (status != OCP_STATUS_OK) {
-                wl1271_error("OCP command failed (%d)", status);
-                return -EIO;
-        }
+        polarity = wl1271_top_reg_read(wl, OCP_REG_POLARITY);
 
         /* We use HIGH polarity, so unset the LOW bit */
         polarity &= ~POLARITY_LOW;
-
-        wl1271_reg_write32(wl, OCP_POR_CTR, OCP_REG_POLARITY);
-        wl1271_reg_write32(wl, OCP_DATA_WRITE, polarity);
-        wl1271_reg_write32(wl, OCP_CMD, OCP_CMD_WRITE);
+        wl1271_top_reg_write(wl, OCP_REG_POLARITY, polarity);
 
         return 0;
 }
@@ -436,16 +436,32 @@ int wl1271_boot(struct wl1271 *wl)
         int ret = 0;
         u32 tmp, clk, pause;
 
-        if (REF_CLOCK == 0 || REF_CLOCK == 2)
-                /* ref clk: 19.2/38.4 */
+        if (REF_CLOCK == 0 || REF_CLOCK == 2 || REF_CLOCK == 4)
+                /* ref clk: 19.2/38.4/38.4-XTAL */
                 clk = 0x3;
         else if (REF_CLOCK == 1 || REF_CLOCK == 3)
                 /* ref clk: 26/52 */
                 clk = 0x5;
 
-        wl1271_reg_write32(wl, PLL_PARAMETERS, clk);
+        if (REF_CLOCK != 0) {
+                u16 val;
+                /* Set clock type */
+                val = wl1271_top_reg_read(wl, OCP_REG_CLK_TYPE);
+                val &= FREF_CLK_TYPE_BITS;
+                val |= CLK_REQ_PRCM;
+                wl1271_top_reg_write(wl, OCP_REG_CLK_TYPE, val);
+        } else {
+                u16 val;
+                /* Set clock polarity */
+                val = wl1271_top_reg_read(wl, OCP_REG_CLK_POLARITY);
+                val &= FREF_CLK_POLARITY_BITS;
+                val |= CLK_REQ_OUTN_SEL;
+                wl1271_top_reg_write(wl, OCP_REG_CLK_POLARITY, val);
+        }
+
+        wl1271_write32(wl, PLL_PARAMETERS, clk);
 
-        pause = wl1271_reg_read32(wl, PLL_PARAMETERS);
+        pause = wl1271_read32(wl, PLL_PARAMETERS);
 
         wl1271_debug(DEBUG_BOOT, "pause1 0x%x", pause);
 
@@ -454,39 +470,31 @@ int wl1271_boot(struct wl1271 *wl)
                                            * 0x3ff (magic number ).  How does
                                            * this work?! */
         pause |= WU_COUNTER_PAUSE_VAL;
-        wl1271_reg_write32(wl, WU_COUNTER_PAUSE, pause);
+        wl1271_write32(wl, WU_COUNTER_PAUSE, pause);
 
         /* Continue the ELP wake up sequence */
-        wl1271_reg_write32(wl, WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL);
+        wl1271_write32(wl, WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL);
         udelay(500);
 
-        wl1271_set_partition(wl,
-                             part_table[PART_DRPW].mem.start,
-                             part_table[PART_DRPW].mem.size,
-                             part_table[PART_DRPW].reg.start,
-                             part_table[PART_DRPW].reg.size);
+        wl1271_set_partition(wl, &part_table[PART_DRPW]);
 
         /* Read-modify-write DRPW_SCRATCH_START register (see next state)
            to be used by DRPw FW. The RTRIM value will be added by the FW
            before taking DRPw out of reset */
 
         wl1271_debug(DEBUG_BOOT, "DRPW_SCRATCH_START %08x", DRPW_SCRATCH_START);
-        clk = wl1271_reg_read32(wl, DRPW_SCRATCH_START);
+        clk = wl1271_read32(wl, DRPW_SCRATCH_START);
 
         wl1271_debug(DEBUG_BOOT, "clk2 0x%x", clk);
 
         /* 2 */
         clk |= (REF_CLOCK << 1) << 4;
-        wl1271_reg_write32(wl, DRPW_SCRATCH_START, clk);
+        wl1271_write32(wl, DRPW_SCRATCH_START, clk);
 
-        wl1271_set_partition(wl,
-                             part_table[PART_WORK].mem.start,
-                             part_table[PART_WORK].mem.size,
-                             part_table[PART_WORK].reg.start,
-                             part_table[PART_WORK].reg.size);
+        wl1271_set_partition(wl, &part_table[PART_WORK]);
 
         /* Disable interrupts */
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
+        wl1271_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
 
         ret = wl1271_boot_soft_reset(wl);
         if (ret < 0)
@@ -501,22 +509,22 @@ int wl1271_boot(struct wl1271 *wl)
          * ACX_EEPROMLESS_IND_REG */
         wl1271_debug(DEBUG_BOOT, "ACX_EEPROMLESS_IND_REG");
 
-        wl1271_reg_write32(wl, ACX_EEPROMLESS_IND_REG, ACX_EEPROMLESS_IND_REG);
+        wl1271_write32(wl, ACX_EEPROMLESS_IND_REG, ACX_EEPROMLESS_IND_REG);
 
-        tmp = wl1271_reg_read32(wl, CHIP_ID_B);
+        tmp = wl1271_read32(wl, CHIP_ID_B);
 
         wl1271_debug(DEBUG_BOOT, "chip id 0x%x", tmp);
 
         /* 6. read the EEPROM parameters */
-        tmp = wl1271_reg_read32(wl, SCR_PAD2);
+        tmp = wl1271_read32(wl, SCR_PAD2);
 
         ret = wl1271_boot_write_irq_polarity(wl);
         if (ret < 0)
                 goto out;
 
         /* FIXME: Need to check whether this is really what we want */
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
-                           WL1271_ACX_ALL_EVENTS_VECTOR);
+        wl1271_write32(wl, ACX_REG_INTERRUPT_MASK,
+                       WL1271_ACX_ALL_EVENTS_VECTOR);
 
         /* WL1271: The reference driver skips steps 7 to 10 (jumps directly
          * to upload_fw) */
@@ -530,6 +538,9 @@ int wl1271_boot(struct wl1271 *wl)
         if (ret < 0)
                 goto out;
 
+        /* Enable firmware interrupts now */
+        wl1271_boot_enable_interrupts(wl);
+
         /* set the wl1271 default filters */
         wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
         wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.h b/drivers/net/wireless/wl12xx/wl1271_boot.h
index b0d8fb46a439..412443ee655a 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.h
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.h
@@ -50,23 +50,17 @@ struct wl1271_static_data {
 #define WU_COUNTER_PAUSE_VAL 0x3FF
 #define WELP_ARM_COMMAND_VAL 0x4
 
-#define OCP_CMD_LOOP  32
-
-#define OCP_CMD_WRITE 0x1
-#define OCP_CMD_READ  0x2
-
-#define OCP_READY_MASK  BIT(18)
-#define OCP_STATUS_MASK (BIT(16) | BIT(17))
-
-#define OCP_STATUS_NO_RESP    0x00000
-#define OCP_STATUS_OK         0x10000
-#define OCP_STATUS_REQ_FAILED 0x20000
-#define OCP_STATUS_RESP_ERROR 0x30000
-
-#define OCP_REG_POLARITY 0x30032
+#define OCP_REG_POLARITY     0x0064
+#define OCP_REG_CLK_TYPE     0x0448
+#define OCP_REG_CLK_POLARITY 0x0cb2
 
 #define CMD_MBOX_ADDRESS 0x407B4
 
 #define POLARITY_LOW BIT(1)
 
+#define FREF_CLK_TYPE_BITS     0xfffffe7f
+#define CLK_REQ_PRCM           0x100
+#define FREF_CLK_POLARITY_BITS 0xfffff8ff
+#define CLK_REQ_OUTN_SEL       0x700
+
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.c b/drivers/net/wireless/wl12xx/wl1271_cmd.c
index 2a4351ff54dc..e7832f3318eb 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.c
@@ -26,10 +26,12 @@
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
 #include <linux/etherdevice.h>
+#include <linux/slab.h>
 
 #include "wl1271.h"
 #include "wl1271_reg.h"
 #include "wl1271_spi.h"
+#include "wl1271_io.h"
 #include "wl1271_acx.h"
 #include "wl12xx_80211.h"
 #include "wl1271_cmd.h"
@@ -42,26 +44,28 @@
  * @buf: buffer containing the command, must work with dma
  * @len: length of the buffer
  */
-int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len)
+int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
+                    size_t res_len)
 {
         struct wl1271_cmd_header *cmd;
         unsigned long timeout;
         u32 intr;
         int ret = 0;
+        u16 status;
 
         cmd = buf;
-        cmd->id = id;
+        cmd->id = cpu_to_le16(id);
         cmd->status = 0;
 
         WARN_ON(len % 4 != 0);
 
-        wl1271_spi_mem_write(wl, wl->cmd_box_addr, buf, len);
+        wl1271_write(wl, wl->cmd_box_addr, buf, len, false);
 
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_CMD);
+        wl1271_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_CMD);
 
         timeout = jiffies + msecs_to_jiffies(WL1271_COMMAND_TIMEOUT);
 
-        intr = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+        intr = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
         while (!(intr & WL1271_ACX_INTR_CMD_COMPLETE)) {
                 if (time_after(jiffies, timeout)) {
                         wl1271_error("command complete timeout");
@@ -71,17 +75,28 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len)
 
                 msleep(1);
 
-                intr = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+                intr = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
         }
 
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_ACK,
-                           WL1271_ACX_INTR_CMD_COMPLETE);
+        /* read back the status code of the command */
+        if (res_len == 0)
+                res_len = sizeof(struct wl1271_cmd_header);
+        wl1271_read(wl, wl->cmd_box_addr, cmd, res_len, false);
+
+        status = le16_to_cpu(cmd->status);
+        if (status != CMD_STATUS_SUCCESS) {
+                wl1271_error("command execute failure %d", status);
+                ret = -EIO;
+        }
+
+        wl1271_write32(wl, ACX_REG_INTERRUPT_ACK,
+                       WL1271_ACX_INTR_CMD_COMPLETE);
 
 out:
         return ret;
 }
 
-int wl1271_cmd_cal_channel_tune(struct wl1271 *wl)
+static int wl1271_cmd_cal_channel_tune(struct wl1271 *wl)
 {
         struct wl1271_cmd_cal_channel_tune *cmd;
         int ret = 0;
@@ -104,7 +119,7 @@ int wl1271_cmd_cal_channel_tune(struct wl1271 *wl)
         return ret;
 }
 
-int wl1271_cmd_cal_update_ref_point(struct wl1271 *wl)
+static int wl1271_cmd_cal_update_ref_point(struct wl1271 *wl)
 {
         struct wl1271_cmd_cal_update_ref_point *cmd;
         int ret = 0;
@@ -129,7 +144,7 @@ int wl1271_cmd_cal_update_ref_point(struct wl1271 *wl)
         return ret;
 }
 
-int wl1271_cmd_cal_p2g(struct wl1271 *wl)
+static int wl1271_cmd_cal_p2g(struct wl1271 *wl)
 {
         struct wl1271_cmd_cal_p2g *cmd;
         int ret = 0;
@@ -150,7 +165,7 @@ int wl1271_cmd_cal_p2g(struct wl1271 *wl)
         return ret;
 }
 
-int wl1271_cmd_cal(struct wl1271 *wl)
+static int wl1271_cmd_cal(struct wl1271 *wl)
 {
         /*
          * FIXME: we must make sure that we're not sleeping when calibration
@@ -175,11 +190,68 @@ int wl1271_cmd_cal(struct wl1271 *wl)
         return ret;
 }
 
-int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
-                    u16 beacon_interval, u8 wait)
+int wl1271_cmd_general_parms(struct wl1271 *wl)
+{
+        struct wl1271_general_parms_cmd *gen_parms;
+        int ret;
+
+        if (!wl->nvs)
+                return -ENODEV;
+
+        gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
+        if (!gen_parms)
+                return -ENOMEM;
+
+        gen_parms->test.id = TEST_CMD_INI_FILE_GENERAL_PARAM;
+
+        memcpy(gen_parms->params, wl->nvs->general_params,
+               WL1271_NVS_GENERAL_PARAMS_SIZE);
+
+        ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), 0);
+        if (ret < 0)
+                wl1271_warning("CMD_INI_FILE_GENERAL_PARAM failed");
+
+        kfree(gen_parms);
+        return ret;
+}
+
+int wl1271_cmd_radio_parms(struct wl1271 *wl)
+{
+        struct wl1271_radio_parms_cmd *radio_parms;
+        struct conf_radio_parms *rparam = &wl->conf.init.radioparam;
+        int ret;
+
+        if (!wl->nvs)
+                return -ENODEV;
+
+        radio_parms = kzalloc(sizeof(*radio_parms), GFP_KERNEL);
+        if (!radio_parms)
+                return -ENOMEM;
+
+        radio_parms->test.id = TEST_CMD_INI_FILE_RADIO_PARAM;
+
+        memcpy(radio_parms->stat_radio_params, wl->nvs->stat_radio_params,
+               WL1271_NVS_STAT_RADIO_PARAMS_SIZE);
+        memcpy(radio_parms->dyn_radio_params,
+               wl->nvs->dyn_radio_params[rparam->fem],
+               WL1271_NVS_DYN_RADIO_PARAMS_SIZE);
+
+        /* FIXME: current NVS is missing 5GHz parameters */
+
+        wl1271_dump(DEBUG_CMD, "TEST_CMD_INI_FILE_RADIO_PARAM: ",
+                    radio_parms, sizeof(*radio_parms));
+
+        ret = wl1271_cmd_test(wl, radio_parms, sizeof(*radio_parms), 0);
+        if (ret < 0)
+                wl1271_warning("CMD_INI_FILE_RADIO_PARAM failed");
+
+        kfree(radio_parms);
+        return ret;
+}
+
+int wl1271_cmd_join(struct wl1271 *wl)
 {
         static bool do_cal = true;
-        unsigned long timeout;
         struct wl1271_cmd_join *join;
         int ret, i;
         u8 *bssid;
@@ -193,7 +265,6 @@ int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
                         do_cal = false;
         }
 
-
         join = kzalloc(sizeof(*join), GFP_KERNEL);
         if (!join) {
                 ret = -ENOMEM;
@@ -207,15 +278,34 @@ int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
         for (i = 0; i < ETH_ALEN; i++)
                 bssid[i] = wl->bssid[ETH_ALEN - i - 1];
 
-        join->rx_config_options = wl->rx_config;
-        join->rx_filter_options = wl->rx_filter;
+        join->rx_config_options = cpu_to_le32(wl->rx_config);
+        join->rx_filter_options = cpu_to_le32(wl->rx_filter);
+        join->bss_type = wl->bss_type;
+
+        /*
+         * FIXME: disable temporarily all filters because after commit
+         * 9cef8737 "mac80211: fix managed mode BSSID handling" broke
+         * association. The filter logic needs to be implemented properly
+         * and once that is done, this hack can be removed.
+         */
+        join->rx_config_options = cpu_to_le32(0);
+        join->rx_filter_options = cpu_to_le32(WL1271_DEFAULT_RX_FILTER);
+
+        if (wl->band == IEEE80211_BAND_2GHZ)
+                join->basic_rate_set = cpu_to_le32(CONF_HW_BIT_RATE_1MBPS   |
+                                                   CONF_HW_BIT_RATE_2MBPS   |
+                                                   CONF_HW_BIT_RATE_5_5MBPS |
+                                                   CONF_HW_BIT_RATE_11MBPS);
+        else {
+                join->bss_type |= WL1271_JOIN_CMD_BSS_TYPE_5GHZ;
+                join->basic_rate_set = cpu_to_le32(CONF_HW_BIT_RATE_6MBPS  |
+                                                   CONF_HW_BIT_RATE_12MBPS |
+                                                   CONF_HW_BIT_RATE_24MBPS);
+        }
 
-        join->basic_rate_set = RATE_MASK_1MBPS | RATE_MASK_2MBPS |
-                RATE_MASK_5_5MBPS | RATE_MASK_11MBPS;
+        join->beacon_interval = cpu_to_le16(WL1271_DEFAULT_BEACON_INT);
+        join->dtim_interval = WL1271_DEFAULT_DTIM_PERIOD;
 
-        join->beacon_interval = beacon_interval;
-        join->dtim_interval = dtim_interval;
-        join->bss_type = bss_type;
         join->channel = wl->channel;
         join->ssid_len = wl->ssid_len;
         memcpy(join->ssid, wl->ssid, wl->ssid_len);
@@ -228,21 +318,22 @@ int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
 
         join->ctrl |= wl->session_counter << WL1271_JOIN_CMD_TX_SESSION_OFFSET;
 
+        /* reset TX security counters */
+        wl->tx_security_last_seq = 0;
+        wl->tx_security_seq_16 = 0;
+        wl->tx_security_seq_32 = 0;
 
-        ret = wl1271_cmd_send(wl, CMD_START_JOIN, join, sizeof(*join));
+        ret = wl1271_cmd_send(wl, CMD_START_JOIN, join, sizeof(*join), 0);
         if (ret < 0) {
                 wl1271_error("failed to initiate cmd join");
                 goto out_free;
         }
 
-        timeout = msecs_to_jiffies(JOIN_TIMEOUT);
-
         /*
          * ugly hack: we should wait for JOIN_EVENT_COMPLETE_ID but to
          * simplify locking we just sleep instead, for now
          */
-        if (wait)
-                msleep(10);
+        msleep(10);
 
 out_free:
         kfree(join);
@@ -262,34 +353,21 @@ out:
 int wl1271_cmd_test(struct wl1271 *wl, void *buf, size_t buf_len, u8 answer)
 {
         int ret;
+        size_t res_len = 0;
 
         wl1271_debug(DEBUG_CMD, "cmd test");
 
-        ret = wl1271_cmd_send(wl, CMD_TEST, buf, buf_len);
+        if (answer)
+                res_len = buf_len;
+
+        ret = wl1271_cmd_send(wl, CMD_TEST, buf, buf_len, res_len);
 
         if (ret < 0) {
                 wl1271_warning("TEST command failed");
                 return ret;
         }
 
-        if (answer) {
-                struct wl1271_command *cmd_answer;
-
-                /*
-                 * The test command got in, we can read the answer.
-                 * The answer would be a wl1271_command, where the
-                 * parameter array contains the actual answer.
-                 */
-                wl1271_spi_mem_read(wl, wl->cmd_box_addr, buf, buf_len);
-
-                cmd_answer = buf;
-
-                if (cmd_answer->header.status != CMD_STATUS_SUCCESS)
-                        wl1271_error("TEST command answer error: %d",
-                                     cmd_answer->header.status);
-        }
-
-        return 0;
+        return ret;
 }
 
 /**
@@ -307,26 +385,15 @@ int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len)
 
         wl1271_debug(DEBUG_CMD, "cmd interrogate");
 
-        acx->id = id;
+        acx->id = cpu_to_le16(id);
 
         /* payload length, does not include any headers */
-        acx->len = len - sizeof(*acx);
+        acx->len = cpu_to_le16(len - sizeof(*acx));
 
-        ret = wl1271_cmd_send(wl, CMD_INTERROGATE, acx, sizeof(*acx));
-        if (ret < 0) {
+        ret = wl1271_cmd_send(wl, CMD_INTERROGATE, acx, sizeof(*acx), len);
+        if (ret < 0)
                 wl1271_error("INTERROGATE command failed");
-                goto out;
-        }
-
-        /* the interrogate command got in, we can read the answer */
-        wl1271_spi_mem_read(wl, wl->cmd_box_addr, buf, len);
-
-        acx = buf;
-        if (acx->cmd.status != CMD_STATUS_SUCCESS)
-                wl1271_error("INTERROGATE command error: %d",
-                             acx->cmd.status);
 
-out:
         return ret;
 }
 
@@ -345,12 +412,12 @@ int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len)
 
         wl1271_debug(DEBUG_CMD, "cmd configure");
 
-        acx->id = id;
+        acx->id = cpu_to_le16(id);
 
         /* payload length, does not include any headers */
-        acx->len = len - sizeof(*acx);
+        acx->len = cpu_to_le16(len - sizeof(*acx));
 
-        ret = wl1271_cmd_send(wl, CMD_CONFIGURE, acx, len);
+        ret = wl1271_cmd_send(wl, CMD_CONFIGURE, acx, len, 0);
         if (ret < 0) {
                 wl1271_warning("CONFIGURE command NOK");
                 return ret;
@@ -359,7 +426,7 @@ int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len)
         return 0;
 }
 
-int wl1271_cmd_data_path(struct wl1271 *wl, u8 channel, bool enable)
+int wl1271_cmd_data_path(struct wl1271 *wl, bool enable)
 {
         struct cmd_enabledisable_path *cmd;
         int ret;
@@ -373,7 +440,8 @@ int wl1271_cmd_data_path(struct wl1271 *wl, u8 channel, bool enable)
                 goto out;
         }
 
-        cmd->channel = channel;
+        /* the channel here is only used for calibration, so hardcoded to 1 */
+        cmd->channel = 1;
 
         if (enable) {
                 cmd_rx = CMD_ENABLE_RX;
@@ -383,39 +451,38 @@ int wl1271_cmd_data_path(struct wl1271 *wl, u8 channel, bool enable)
                 cmd_tx = CMD_DISABLE_TX;
         }
 
-        ret = wl1271_cmd_send(wl, cmd_rx, cmd, sizeof(*cmd));
+        ret = wl1271_cmd_send(wl, cmd_rx, cmd, sizeof(*cmd), 0);
         if (ret < 0) {
                 wl1271_error("rx %s cmd for channel %d failed",
-                             enable ? "start" : "stop", channel);
+                             enable ? "start" : "stop", cmd->channel);
                 goto out;
         }
 
         wl1271_debug(DEBUG_BOOT, "rx %s cmd channel %d",
-                     enable ? "start" : "stop", channel);
+                     enable ? "start" : "stop", cmd->channel);
 
-        ret = wl1271_cmd_send(wl, cmd_tx, cmd, sizeof(*cmd));
+        ret = wl1271_cmd_send(wl, cmd_tx, cmd, sizeof(*cmd), 0);
         if (ret < 0) {
                 wl1271_error("tx %s cmd for channel %d failed",
-                             enable ? "start" : "stop", channel);
+                             enable ? "start" : "stop", cmd->channel);
                 return ret;
         }
 
         wl1271_debug(DEBUG_BOOT, "tx %s cmd channel %d",
-                     enable ? "start" : "stop", channel);
+                     enable ? "start" : "stop", cmd->channel);
 
 out:
         kfree(cmd);
         return ret;
 }
 
-int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode)
+int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, bool send)
 {
         struct wl1271_cmd_ps_params *ps_params = NULL;
         int ret = 0;
 
         /* FIXME: this should be in ps.c */
-        ret = wl1271_acx_wake_up_conditions(wl, WAKE_UP_EVENT_DTIM_BITMAP,
-                                            wl->listen_int);
+        ret = wl1271_acx_wake_up_conditions(wl);
         if (ret < 0) {
                 wl1271_error("couldn't set wake up conditions");
                 goto out;
@@ -430,13 +497,13 @@ int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode)
         }
 
         ps_params->ps_mode = ps_mode;
-        ps_params->send_null_data = 1;
+        ps_params->send_null_data = send;
         ps_params->retries = 5;
         ps_params->hang_over_period = 128;
-        ps_params->null_data_rate = 1; /* 1 Mbps */
+        ps_params->null_data_rate = cpu_to_le32(1); /* 1 Mbps */
 
         ret = wl1271_cmd_send(wl, CMD_SET_PS_MODE, ps_params,
-                              sizeof(*ps_params));
+                              sizeof(*ps_params), 0);
         if (ret < 0) {
                 wl1271_error("cmd set_ps_mode failed");
                 goto out;
@@ -464,22 +531,17 @@ int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
         WARN_ON(len > MAX_READ_SIZE);
         len = min_t(size_t, len, MAX_READ_SIZE);
 
-        cmd->addr = addr;
-        cmd->size = len;
+        cmd->addr = cpu_to_le32(addr);
+        cmd->size = cpu_to_le32(len);
 
-        ret = wl1271_cmd_send(wl, CMD_READ_MEMORY, cmd, sizeof(*cmd));
+        ret = wl1271_cmd_send(wl, CMD_READ_MEMORY, cmd, sizeof(*cmd),
+                              sizeof(*cmd));
         if (ret < 0) {
                 wl1271_error("read memory command failed: %d", ret);
                 goto out;
         }
 
-        /* the read command got in, we can now read the answer */
-        wl1271_spi_mem_read(wl, wl->cmd_box_addr, cmd, sizeof(*cmd));
-
-        if (cmd->header.status != CMD_STATUS_SUCCESS)
-                wl1271_error("error in read command result: %d",
-                             cmd->header.status);
-
+        /* the read command got in */
         memcpy(answer, cmd->value, len);
 
 out:
@@ -488,16 +550,33 @@ out:
 }
 
 int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
-                    u8 active_scan, u8 high_prio, u8 num_channels,
+                    u8 active_scan, u8 high_prio, u8 band,
                     u8 probe_requests)
 {
 
         struct wl1271_cmd_trigger_scan_to *trigger = NULL;
         struct wl1271_cmd_scan *params = NULL;
-        int i, ret;
+        struct ieee80211_channel *channels;
+        int i, j, n_ch, ret;
         u16 scan_options = 0;
+        u8 ieee_band;
+
+        if (band == WL1271_SCAN_BAND_2_4_GHZ)
+                ieee_band = IEEE80211_BAND_2GHZ;
+        else if (band == WL1271_SCAN_BAND_DUAL && wl1271_11a_enabled())
+                ieee_band = IEEE80211_BAND_2GHZ;
+        else if (band == WL1271_SCAN_BAND_5_GHZ && wl1271_11a_enabled())
+                ieee_band = IEEE80211_BAND_5GHZ;
+        else
+                return -EINVAL;
+
+        if (wl->hw->wiphy->bands[ieee_band]->channels == NULL)
+                return -EINVAL;
 
-        if (wl->scanning)
+        channels = wl->hw->wiphy->bands[ieee_band]->channels;
+        n_ch = wl->hw->wiphy->bands[ieee_band]->n_channels;
+
+        if (test_bit(WL1271_FLAG_SCANNING, &wl->flags))
                 return -EINVAL;
 
         params = kzalloc(sizeof(*params), GFP_KERNEL);
@@ -512,32 +591,43 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
                 scan_options |= WL1271_SCAN_OPT_PASSIVE;
         if (high_prio)
                 scan_options |= WL1271_SCAN_OPT_PRIORITY_HIGH;
-        params->params.scan_options = scan_options;
+        params->params.scan_options = cpu_to_le16(scan_options);
 
-        params->params.num_channels = num_channels;
         params->params.num_probe_requests = probe_requests;
-        params->params.tx_rate = cpu_to_le32(RATE_MASK_2MBPS);
+        /* Let the fw autodetect suitable tx_rate for probes */
+        params->params.tx_rate = 0;
         params->params.tid_trigger = 0;
         params->params.scan_tag = WL1271_SCAN_DEFAULT_TAG;
 
-        for (i = 0; i < num_channels; i++) {
-                params->channels[i].min_duration =
-                        cpu_to_le32(WL1271_SCAN_CHAN_MIN_DURATION);
-                params->channels[i].max_duration =
-                        cpu_to_le32(WL1271_SCAN_CHAN_MAX_DURATION);
-                memset(&params->channels[i].bssid_lsb, 0xff, 4);
-                memset(&params->channels[i].bssid_msb, 0xff, 2);
-                params->channels[i].early_termination = 0;
-                params->channels[i].tx_power_att = WL1271_SCAN_CURRENT_TX_PWR;
-                params->channels[i].channel = i + 1;
+        if (band == WL1271_SCAN_BAND_DUAL)
+                params->params.band = WL1271_SCAN_BAND_2_4_GHZ;
+        else
+                params->params.band = band;
+
+        for (i = 0, j = 0; i < n_ch && i < WL1271_SCAN_MAX_CHANNELS; i++) {
+                if (!(channels[i].flags & IEEE80211_CHAN_DISABLED)) {
+                        params->channels[j].min_duration =
+                                cpu_to_le32(WL1271_SCAN_CHAN_MIN_DURATION);
+                        params->channels[j].max_duration =
+                                cpu_to_le32(WL1271_SCAN_CHAN_MAX_DURATION);
+                        memset(&params->channels[j].bssid_lsb, 0xff, 4);
+                        memset(&params->channels[j].bssid_msb, 0xff, 2);
+                        params->channels[j].early_termination = 0;
+                        params->channels[j].tx_power_att =
+                                WL1271_SCAN_CURRENT_TX_PWR;
+                        params->channels[j].channel = channels[i].hw_value;
+                        j++;
+                }
         }
 
+        params->params.num_channels = j;
+
         if (len && ssid) {
                 params->params.ssid_len = len;
                 memcpy(params->params.ssid, ssid, len);
         }
 
-        ret = wl1271_cmd_build_probe_req(wl, ssid, len);
+        ret = wl1271_cmd_build_probe_req(wl, ssid, len, ieee_band);
         if (ret < 0) {
                 wl1271_error("PROBE request template failed");
                 goto out;
@@ -553,7 +643,7 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
         trigger->timeout = 0;
 
         ret = wl1271_cmd_send(wl, CMD_TRIGGER_SCAN_TO, trigger,
-                              sizeof(*trigger));
+                              sizeof(*trigger), 0);
         if (ret < 0) {
                 wl1271_error("trigger scan to failed for hw scan");
                 goto out;
@@ -561,21 +651,25 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
 
         wl1271_dump(DEBUG_SCAN, "SCAN: ", params, sizeof(*params));
 
-        wl->scanning = true;
+        set_bit(WL1271_FLAG_SCANNING, &wl->flags);
+        if (wl1271_11a_enabled()) {
+                wl->scan.state = band;
+                if (band == WL1271_SCAN_BAND_DUAL) {
+                        wl->scan.active = active_scan;
+                        wl->scan.high_prio = high_prio;
+                        wl->scan.probe_requests = probe_requests;
+                        if (len && ssid) {
+                                wl->scan.ssid_len = len;
+                                memcpy(wl->scan.ssid, ssid, len);
+                        } else
+                                wl->scan.ssid_len = 0;
+                }
+        }
 
-        ret = wl1271_cmd_send(wl, CMD_SCAN, params, sizeof(*params));
+        ret = wl1271_cmd_send(wl, CMD_SCAN, params, sizeof(*params), 0);
         if (ret < 0) {
                 wl1271_error("SCAN failed");
-                goto out;
-        }
-
-        wl1271_spi_mem_read(wl, wl->cmd_box_addr, params, sizeof(*params));
-
-        if (params->header.status != CMD_STATUS_SUCCESS) {
-                wl1271_error("Scan command error: %d",
-                             params->header.status);
-                wl->scanning = false;
-                ret = -EIO;
+                clear_bit(WL1271_FLAG_SCANNING, &wl->flags);
                 goto out;
         }
 
@@ -603,14 +697,14 @@ int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
 
         cmd->len = cpu_to_le16(buf_len);
         cmd->template_type = template_id;
-        cmd->enabled_rates = ACX_RATE_MASK_UNSPECIFIED;
-        cmd->short_retry_limit = ACX_RATE_RETRY_LIMIT;
-        cmd->long_retry_limit = ACX_RATE_RETRY_LIMIT;
+        cmd->enabled_rates = cpu_to_le32(wl->conf.tx.rc_conf.enabled_rates);
+        cmd->short_retry_limit = wl->conf.tx.rc_conf.short_retry_limit;
+        cmd->long_retry_limit = wl->conf.tx.rc_conf.long_retry_limit;
 
         if (buf)
                 memcpy(cmd->template_data, buf, buf_len);
 
-        ret = wl1271_cmd_send(wl, CMD_SET_TEMPLATE, cmd, sizeof(*cmd));
+        ret = wl1271_cmd_send(wl, CMD_SET_TEMPLATE, cmd, sizeof(*cmd), 0);
         if (ret < 0) {
                 wl1271_warning("cmd set_template failed: %d", ret);
                 goto out_free;
@@ -623,30 +717,62 @@ out:
         return ret;
 }
 
-static int wl1271_build_basic_rates(char *rates)
+static int wl1271_build_basic_rates(u8 *rates, u8 band)
 {
         u8 index = 0;
 
-        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
-        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
-        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
-        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
+        if (band == IEEE80211_BAND_2GHZ) {
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
+        } else if (band == IEEE80211_BAND_5GHZ) {
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_6MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_12MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
+        } else {
+                wl1271_error("build_basic_rates invalid band: %d", band);
+        }
 
         return index;
 }
 
-static int wl1271_build_extended_rates(char *rates)
+static int wl1271_build_extended_rates(u8 *rates, u8 band)
 {
         u8 index = 0;
 
-        rates[index++] = IEEE80211_OFDM_RATE_6MB;
-        rates[index++] = IEEE80211_OFDM_RATE_9MB;
-        rates[index++] = IEEE80211_OFDM_RATE_12MB;
-        rates[index++] = IEEE80211_OFDM_RATE_18MB;
-        rates[index++] = IEEE80211_OFDM_RATE_24MB;
-        rates[index++] = IEEE80211_OFDM_RATE_36MB;
-        rates[index++] = IEEE80211_OFDM_RATE_48MB;
-        rates[index++] = IEEE80211_OFDM_RATE_54MB;
+        if (band == IEEE80211_BAND_2GHZ) {
+                rates[index++] = IEEE80211_OFDM_RATE_6MB;
+                rates[index++] = IEEE80211_OFDM_RATE_9MB;
+                rates[index++] = IEEE80211_OFDM_RATE_12MB;
+                rates[index++] = IEEE80211_OFDM_RATE_18MB;
+                rates[index++] = IEEE80211_OFDM_RATE_24MB;
+                rates[index++] = IEEE80211_OFDM_RATE_36MB;
+                rates[index++] = IEEE80211_OFDM_RATE_48MB;
+                rates[index++] = IEEE80211_OFDM_RATE_54MB;
+        } else if (band == IEEE80211_BAND_5GHZ) {
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_9MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_18MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_36MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_48MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_54MB;
+        } else {
+                wl1271_error("build_basic_rates invalid band: %d", band);
+        }
 
         return index;
 }
@@ -665,7 +791,8 @@ int wl1271_cmd_build_null_data(struct wl1271 *wl)
 
         memcpy(template.header.sa, wl->mac_addr, ETH_ALEN);
         template.header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_DATA |
-                                                IEEE80211_STYPE_NULLFUNC);
+                                                IEEE80211_STYPE_NULLFUNC |
+                                                IEEE80211_FCTL_TODS);
 
         return wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, &template,
                                        sizeof(template));
@@ -678,7 +805,10 @@ int wl1271_cmd_build_ps_poll(struct wl1271 *wl, u16 aid)
 
         memcpy(template.bssid, wl->bssid, ETH_ALEN);
         memcpy(template.ta, wl->mac_addr, ETH_ALEN);
-        template.aid = aid;
+
+        /* aid in PS-Poll has its two MSBs each set to 1 */
+        template.aid = cpu_to_le16(1 << 15 | 1 << 14 | aid);
+
         template.fc = cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL);
 
         return wl1271_cmd_template_set(wl, CMD_TEMPL_PS_POLL, &template,
@@ -686,12 +816,14 @@ int wl1271_cmd_build_ps_poll(struct wl1271 *wl, u16 aid)
 
 }
 
-int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len)
+int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len,
+                               u8 band)
 {
         struct wl12xx_probe_req_template template;
         struct wl12xx_ie_rates *rates;
         char *ptr;
         u16 size;
+        int ret;
 
         ptr = (char *)&template;
         size = sizeof(struct ieee80211_header);
@@ -713,20 +845,25 @@ int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len)
         /* Basic Rates */
         rates = (struct wl12xx_ie_rates *)ptr;
         rates->header.id = WLAN_EID_SUPP_RATES;
-        rates->header.len = wl1271_build_basic_rates(rates->rates);
+        rates->header.len = wl1271_build_basic_rates(rates->rates, band);
         size += sizeof(struct wl12xx_ie_header) + rates->header.len;
         ptr += sizeof(struct wl12xx_ie_header) + rates->header.len;
 
         /* Extended rates */
         rates = (struct wl12xx_ie_rates *)ptr;
         rates->header.id = WLAN_EID_EXT_SUPP_RATES;
-        rates->header.len = wl1271_build_extended_rates(rates->rates);
+        rates->header.len = wl1271_build_extended_rates(rates->rates, band);
         size += sizeof(struct wl12xx_ie_header) + rates->header.len;
 
         wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", &template, size);
 
-        return wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4,
-                                       &template, size);
+        if (band == IEEE80211_BAND_2GHZ)
+                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4,
+                                              &template, size);
+        else
+                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_5,
+                                              &template, size);
+        return ret;
 }
 
 int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id)
@@ -743,10 +880,10 @@ int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id)
         }
 
         cmd->id = id;
-        cmd->key_action = KEY_SET_ID;
+        cmd->key_action = cpu_to_le16(KEY_SET_ID);
         cmd->key_type = KEY_WEP;
 
-        ret = wl1271_cmd_send(wl, CMD_SET_KEYS, cmd, sizeof(*cmd));
+        ret = wl1271_cmd_send(wl, CMD_SET_KEYS, cmd, sizeof(*cmd), 0);
         if (ret < 0) {
                 wl1271_warning("cmd set_default_wep_key failed: %d", ret);
                 goto out;
@@ -759,7 +896,8 @@ out:
 }
 
 int wl1271_cmd_set_key(struct wl1271 *wl, u16 action, u8 id, u8 key_type,
-                       u8 key_size, const u8 *key, const u8 *addr)
+                       u8 key_size, const u8 *key, const u8 *addr,
+                       u32 tx_seq_32, u16 tx_seq_16)
 {
         struct wl1271_cmd_set_keys *cmd;
         int ret = 0;
@@ -773,16 +911,18 @@ int wl1271_cmd_set_key(struct wl1271 *wl, u16 action, u8 id, u8 key_type,
         if (key_type != KEY_WEP)
                 memcpy(cmd->addr, addr, ETH_ALEN);
 
-        cmd->key_action = action;
+        cmd->key_action = cpu_to_le16(action);
         cmd->key_size = key_size;
         cmd->key_type = key_type;
 
+        cmd->ac_seq_num16[0] = cpu_to_le16(tx_seq_16);
+        cmd->ac_seq_num32[0] = cpu_to_le32(tx_seq_32);
+
         /* we have only one SSID profile */
         cmd->ssid_profile = 0;
 
         cmd->id = id;
 
-        /* FIXME: this is from wl1251, needs to be checked */
         if (key_type == KEY_TKIP) {
                 /*
                  * We get the key in the following form:
@@ -800,10 +940,10 @@ int wl1271_cmd_set_key(struct wl1271 *wl, u16 action, u8 id, u8 key_type,
 
         wl1271_dump(DEBUG_CRYPT, "TARGET KEY: ", cmd, sizeof(*cmd));
 
-        ret = wl1271_cmd_send(wl, CMD_SET_KEYS, cmd, sizeof(*cmd));
+        ret = wl1271_cmd_send(wl, CMD_SET_KEYS, cmd, sizeof(*cmd), 0);
         if (ret < 0) {
                 wl1271_warning("could not set keys");
-                goto out;
+        goto out;
         }
 
 out:
@@ -811,3 +951,34 @@ out:
 
         return ret;
 }
+
+int wl1271_cmd_disconnect(struct wl1271 *wl)
+{
+        struct wl1271_cmd_disconnect *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd disconnect");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        cmd->rx_config_options = cpu_to_le32(wl->rx_config);
+        cmd->rx_filter_options = cpu_to_le32(wl->rx_filter);
+        /* disconnect reason is not used in immediate disconnections */
+        cmd->type = DISCONNECT_IMMEDIATE;
+
+        ret = wl1271_cmd_send(wl, CMD_DISCONNECT, cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send disconnect command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(cmd);
+
+out:
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.h b/drivers/net/wireless/wl12xx/wl1271_cmd.h
index 951a8447a516..2dc06c73532b 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.h
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.h
@@ -29,27 +29,32 @@
 
 struct acx_header;
 
-int wl1271_cmd_send(struct wl1271 *wl, u16 type, void *buf, size_t buf_len);
-int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
-                    u16 beacon_interval, u8 wait);
+int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
+                    size_t res_len);
+int wl1271_cmd_general_parms(struct wl1271 *wl);
+int wl1271_cmd_radio_parms(struct wl1271 *wl);
+int wl1271_cmd_join(struct wl1271 *wl);
 int wl1271_cmd_test(struct wl1271 *wl, void *buf, size_t buf_len, u8 answer);
 int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len);
 int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len);
-int wl1271_cmd_data_path(struct wl1271 *wl, u8 channel, bool enable);
-int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode);
+int wl1271_cmd_data_path(struct wl1271 *wl, bool enable);
+int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, bool send);
 int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
                            size_t len);
 int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
-                    u8 active_scan, u8 high_prio, u8 num_channels,
+                    u8 active_scan, u8 high_prio, u8 band,
                     u8 probe_requests);
 int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
                             void *buf, size_t buf_len);
 int wl1271_cmd_build_null_data(struct wl1271 *wl);
 int wl1271_cmd_build_ps_poll(struct wl1271 *wl, u16 aid);
-int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len);
+int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len,
+                               u8 band);
 int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id);
 int wl1271_cmd_set_key(struct wl1271 *wl, u16 action, u8 id, u8 key_type,
-                       u8 key_size, const u8 *key, const u8 *addr);
+                       u8 key_size, const u8 *key, const u8 *addr,
+                       u32 tx_seq_32, u16 tx_seq_16);
+int wl1271_cmd_disconnect(struct wl1271 *wl);
 
 enum wl1271_commands {
         CMD_INTERROGATE     = 1,    /*use this to read information elements*/
@@ -118,8 +123,8 @@ enum cmd_templ {
 #define WL1271_CMD_TEMPL_MAX_SIZE  252
 
 struct wl1271_cmd_header {
-        u16 id;
-        u16 status;
+        __le16 id;
+        __le16 status;
         /* payload */
         u8 data[0];
 } __attribute__ ((packed));
@@ -172,17 +177,17 @@ struct cmd_read_write_memory {
         struct wl1271_cmd_header header;
 
         /* The address of the memory to read from or write to.*/
-        u32 addr;
+        __le32 addr;
 
         /* The amount of data in bytes to read from or write to the WiLink
          * device.*/
-        u32 size;
+        __le32 size;
 
         /* The actual value read from or written to the Wilink. The source
            of this field is the Host in WRITE command or the Wilink in READ
            command. */
         u8 value[MAX_READ_SIZE];
-};
+} __attribute__ ((packed));
 
 #define CMDMBOX_HEADER_LEN 4
 #define CMDMBOX_INFO_ELEM_HEADER_LEN 4
@@ -196,22 +201,23 @@ enum {
 
 #define WL1271_JOIN_CMD_CTRL_TX_FLUSH     0x80 /* Firmware flushes all Tx */
 #define WL1271_JOIN_CMD_TX_SESSION_OFFSET 1
+#define WL1271_JOIN_CMD_BSS_TYPE_5GHZ 0x10
 
 struct wl1271_cmd_join {
         struct wl1271_cmd_header header;
 
-        u32 bssid_lsb;
-        u16 bssid_msb;
-        u16 beacon_interval; /* in TBTTs */
-        u32 rx_config_options;
-        u32 rx_filter_options;
+        __le32 bssid_lsb;
+        __le16 bssid_msb;
+        __le16 beacon_interval; /* in TBTTs */
+        __le32 rx_config_options;
+        __le32 rx_filter_options;
 
         /*
          * The target uses this field to determine the rate at
          * which to transmit control frame responses (such as
          * ACK or CTS frames).
          */
-        u32 basic_rate_set;
+        __le32 basic_rate_set;
         u8 dtim_interval;
         /*
          * bits 0-2: This bitwise field specifies the type
@@ -240,10 +246,10 @@ struct cmd_enabledisable_path {
 struct wl1271_cmd_template_set {
         struct wl1271_cmd_header header;
 
-        u16 len;
+        __le16 len;
         u8 template_type;
         u8 index;  /* relevant only for KLV_TEMPLATE type */
-        u32 enabled_rates;
+        __le32 enabled_rates;
         u8 short_retry_limit;
         u8 long_retry_limit;
         u8 aflags;
@@ -280,18 +286,13 @@ struct wl1271_cmd_ps_params {
           * to power save mode.
           */
         u8 hang_over_period;
-        u32 null_data_rate;
+        __le32 null_data_rate;
 } __attribute__ ((packed));
 
 /* HW encryption keys */
 #define NUM_ACCESS_CATEGORIES_COPY 4
 #define MAX_KEY_SIZE 32
 
-/* When set, disable HW encryption */
-#define DF_ENCRYPTION_DISABLE      0x01
-/* When set, disable HW decryption */
-#define DF_SNIFF_MODE_ENABLE       0x80
-
 enum wl1271_cmd_key_action {
         KEY_ADD_OR_REPLACE = 1,
         KEY_REMOVE         = 2,
@@ -316,9 +317,9 @@ struct wl1271_cmd_set_keys {
         u8 addr[ETH_ALEN];
 
         /* key_action_e */
-        u16 key_action;
+        __le16 key_action;
 
-        u16 reserved_1;
+        __le16 reserved_1;
 
         /* key size in bytes */
         u8 key_size;
@@ -334,8 +335,8 @@ struct wl1271_cmd_set_keys {
         u8 id;
         u8 reserved_2[6];
         u8 key[MAX_KEY_SIZE];
-        u16 ac_seq_num16[NUM_ACCESS_CATEGORIES_COPY];
-        u32 ac_seq_num32[NUM_ACCESS_CATEGORIES_COPY];
+        __le16 ac_seq_num16[NUM_ACCESS_CATEGORIES_COPY];
+        __le32 ac_seq_num32[NUM_ACCESS_CATEGORIES_COPY];
 } __attribute__ ((packed));
 
 
@@ -347,19 +348,22 @@ struct wl1271_cmd_set_keys {
 #define WL1271_SCAN_OPT_PRIORITY_HIGH  4
 #define WL1271_SCAN_CHAN_MIN_DURATION  30000  /* TU */
 #define WL1271_SCAN_CHAN_MAX_DURATION  60000  /* TU */
+#define WL1271_SCAN_BAND_2_4_GHZ 0
+#define WL1271_SCAN_BAND_5_GHZ 1
+#define WL1271_SCAN_BAND_DUAL 2
 
 struct basic_scan_params {
-        u32 rx_config_options;
-        u32 rx_filter_options;
+        __le32 rx_config_options;
+        __le32 rx_filter_options;
         /* Scan option flags (WL1271_SCAN_OPT_*) */
-        u16 scan_options;
+        __le16 scan_options;
         /* Number of scan channels in the list (maximum 30) */
         u8 num_channels;
         /* This field indicates the number of probe requests to send
            per channel for an active scan */
         u8 num_probe_requests;
         /* Rate bit field for sending the probes */
-        u32 tx_rate;
+        __le32 tx_rate;
         u8 tid_trigger;
         u8 ssid_len;
         /* in order to align */
@@ -374,10 +378,10 @@ struct basic_scan_params {
 
 struct basic_scan_channel_params {
         /* Duration in TU to wait for frames on a channel for active scan */
-        u32 min_duration;
-        u32 max_duration;
-        u32 bssid_lsb;
-        u16 bssid_msb;
+        __le32 min_duration;
+        __le32 max_duration;
+        __le32 bssid_lsb;
+        __le16 bssid_msb;
         u8 early_termination;
         u8 tx_power_att;
         u8 channel;
@@ -397,13 +401,13 @@ struct wl1271_cmd_scan {
 struct wl1271_cmd_trigger_scan_to {
         struct wl1271_cmd_header header;
 
-        u32 timeout;
-};
+        __le32 timeout;
+} __attribute__ ((packed));
 
 struct wl1271_cmd_test_header {
         u8 id;
         u8 padding[3];
-};
+} __attribute__ ((packed));
 
 enum wl1271_channel_tune_bands {
         WL1271_CHANNEL_TUNE_BAND_2_4,
@@ -416,6 +420,33 @@ enum wl1271_channel_tune_bands {
 #define TEST_CMD_P2G_CAL                   0x02
 #define TEST_CMD_CHANNEL_TUNE              0x0d
 #define TEST_CMD_UPDATE_PD_REFERENCE_POINT 0x1d
+#define TEST_CMD_INI_FILE_RADIO_PARAM      0x19
+#define TEST_CMD_INI_FILE_GENERAL_PARAM    0x1E
+
+struct wl1271_general_parms_cmd {
+        struct wl1271_cmd_header header;
+
+        struct wl1271_cmd_test_header test;
+
+        u8 params[WL1271_NVS_GENERAL_PARAMS_SIZE];
+        s8 reserved[23];
+} __attribute__ ((packed));
+
+#define WL1271_STAT_RADIO_PARAMS_5_SIZE    29
+#define WL1271_DYN_RADIO_PARAMS_5_SIZE    104
+
+struct wl1271_radio_parms_cmd {
+        struct wl1271_cmd_header header;
+
+        struct wl1271_cmd_test_header test;
+
+        u8 stat_radio_params[WL1271_NVS_STAT_RADIO_PARAMS_SIZE];
+        u8 stat_radio_params_5[WL1271_STAT_RADIO_PARAMS_5_SIZE];
+
+        u8 dyn_radio_params[WL1271_NVS_DYN_RADIO_PARAMS_SIZE];
+        u8 reserved;
+        u8 dyn_radio_params_5[WL1271_DYN_RADIO_PARAMS_5_SIZE];
+} __attribute__ ((packed));
 
 struct wl1271_cmd_cal_channel_tune {
         struct wl1271_cmd_header header;
@@ -425,7 +456,7 @@ struct wl1271_cmd_cal_channel_tune {
         u8 band;
         u8 channel;
 
-        u16 radio_status;
+        __le16 radio_status;
 } __attribute__ ((packed));
 
 struct wl1271_cmd_cal_update_ref_point {
@@ -433,8 +464,8 @@ struct wl1271_cmd_cal_update_ref_point {
 
         struct wl1271_cmd_test_header test;
 
-        s32 ref_power;
-        s32 ref_detector;
+        __le32 ref_power;
+        __le32 ref_detector;
         u8  sub_band;
         u8  padding[3];
 } __attribute__ ((packed));
@@ -449,16 +480,42 @@ struct wl1271_cmd_cal_p2g {
 
         struct wl1271_cmd_test_header test;
 
-        u16 len;
+        __le16 len;
         u8  buf[MAX_TLV_LENGTH];
         u8  type;
         u8  padding;
 
-        s16 radio_status;
+        __le16 radio_status;
         u8  nvs_version[MAX_NVS_VERSION_LENGTH];
 
         u8  sub_band_mask;
         u8  padding2;
 } __attribute__ ((packed));
 
+
+/*
+ * There are three types of disconnections:
+ *
+ * DISCONNECT_IMMEDIATE: the fw doesn't send any frames
+ * DISCONNECT_DEAUTH:    the fw generates a DEAUTH request with the reason
+ *                       we have passed
+ * DISCONNECT_DISASSOC:  the fw generates a DESASSOC request with the reason
+ *                       we have passed
+ */
+enum wl1271_disconnect_type {
+        DISCONNECT_IMMEDIATE,
+        DISCONNECT_DEAUTH,
+        DISCONNECT_DISASSOC
+};
+
+struct wl1271_cmd_disconnect {
+        __le32 rx_config_options;
+        __le32 rx_filter_options;
+
+        __le16 reason;
+        u8  type;
+
+        u8  padding;
+} __attribute__ ((packed));
+
 #endif /* __WL1271_CMD_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_conf.h b/drivers/net/wireless/wl12xx/wl1271_conf.h
new file mode 100644
index 000000000000..6f9e75cc5640
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_conf.h
@@ -0,0 +1,795 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_CONF_H__
+#define __WL1271_CONF_H__
+
+enum {
+        CONF_HW_BIT_RATE_1MBPS   = BIT(0),
+        CONF_HW_BIT_RATE_2MBPS   = BIT(1),
+        CONF_HW_BIT_RATE_5_5MBPS = BIT(2),
+        CONF_HW_BIT_RATE_6MBPS   = BIT(3),
+        CONF_HW_BIT_RATE_9MBPS   = BIT(4),
+        CONF_HW_BIT_RATE_11MBPS  = BIT(5),
+        CONF_HW_BIT_RATE_12MBPS  = BIT(6),
+        CONF_HW_BIT_RATE_18MBPS  = BIT(7),
+        CONF_HW_BIT_RATE_22MBPS  = BIT(8),
+        CONF_HW_BIT_RATE_24MBPS  = BIT(9),
+        CONF_HW_BIT_RATE_36MBPS  = BIT(10),
+        CONF_HW_BIT_RATE_48MBPS  = BIT(11),
+        CONF_HW_BIT_RATE_54MBPS  = BIT(12),
+        CONF_HW_BIT_RATE_MCS_0   = BIT(13),
+        CONF_HW_BIT_RATE_MCS_1   = BIT(14),
+        CONF_HW_BIT_RATE_MCS_2   = BIT(15),
+        CONF_HW_BIT_RATE_MCS_3   = BIT(16),
+        CONF_HW_BIT_RATE_MCS_4   = BIT(17),
+        CONF_HW_BIT_RATE_MCS_5   = BIT(18),
+        CONF_HW_BIT_RATE_MCS_6   = BIT(19),
+        CONF_HW_BIT_RATE_MCS_7   = BIT(20)
+};
+
+enum {
+        CONF_HW_RATE_INDEX_1MBPS   = 0,
+        CONF_HW_RATE_INDEX_2MBPS   = 1,
+        CONF_HW_RATE_INDEX_5_5MBPS = 2,
+        CONF_HW_RATE_INDEX_6MBPS   = 3,
+        CONF_HW_RATE_INDEX_9MBPS   = 4,
+        CONF_HW_RATE_INDEX_11MBPS  = 5,
+        CONF_HW_RATE_INDEX_12MBPS  = 6,
+        CONF_HW_RATE_INDEX_18MBPS  = 7,
+        CONF_HW_RATE_INDEX_22MBPS  = 8,
+        CONF_HW_RATE_INDEX_24MBPS  = 9,
+        CONF_HW_RATE_INDEX_36MBPS  = 10,
+        CONF_HW_RATE_INDEX_48MBPS  = 11,
+        CONF_HW_RATE_INDEX_54MBPS  = 12,
+        CONF_HW_RATE_INDEX_MAX     = CONF_HW_RATE_INDEX_54MBPS,
+};
+
+struct conf_sg_settings {
+        /*
+         * Defines the PER threshold in PPM of the BT voice of which reaching
+         * this value will trigger raising the priority of the BT voice by
+         * the BT IP until next NFS sample interval time as defined in
+         * nfs_sample_interval.
+         *
+         * Unit: PER value in PPM (parts per million)
+         * #Error_packets / #Total_packets
+
+         * Range: u32
+         */
+        u32 per_threshold;
+
+        /*
+         * This value is an absolute time in micro-seconds to limit the
+         * maximum scan duration compensation while in SG
+         */
+        u32 max_scan_compensation_time;
+
+        /* Defines the PER threshold of the BT voice of which reaching this
+         * value will trigger raising the priority of the BT voice until next
+         * NFS sample interval time as defined in sample_interval.
+         *
+         * Unit: msec
+         * Range: 1-65000
+         */
+        u16 nfs_sample_interval;
+
+        /*
+         * Defines the load ratio for the BT.
+         * The WLAN ratio is: 100 - load_ratio
+         *
+         * Unit: Percent
+         * Range: 0-100
+         */
+        u8 load_ratio;
+
+        /*
+         * true - Co-ex is allowed to enter/exit P.S automatically and
+         *        transparently to the host
+         *
+         * false - Co-ex is disallowed to enter/exit P.S and will trigger an
+         *         event to the host to notify for the need to enter/exit P.S
+         *         due to BT change state
+         *
+         */
+        u8 auto_ps_mode;
+
+        /*
+         * This parameter defines the compensation percentage of num of probe
+         * requests in case scan is initiated during BT voice/BT ACL
+         * guaranteed link.
+         *
+         * Unit: Percent
+         * Range: 0-255 (0 - No compensation)
+         */
+        u8 probe_req_compensation;
+
+        /*
+         * This parameter defines the compensation percentage of scan window
+         * size in case scan is initiated during BT voice/BT ACL Guaranteed
+         * link.
+         *
+         * Unit: Percent
+         * Range: 0-255 (0 - No compensation)
+         */
+        u8 scan_window_compensation;
+
+        /*
+         * Defines the antenna configuration.
+         *
+         * Range: 0 - Single Antenna; 1 - Dual Antenna
+         */
+        u8 antenna_config;
+
+        /*
+         * The percent out of the Max consecutive beacon miss roaming trigger
+         * which is the threshold for raising the priority of beacon
+         * reception.
+         *
+         * Range: 1-100
+         * N = MaxConsecutiveBeaconMiss
+         * P = coexMaxConsecutiveBeaconMissPrecent
+         * Threshold = MIN( N-1, round(N * P / 100))
+         */
+        u8 beacon_miss_threshold;
+
+        /*
+         * The RX rate threshold below which rate adaptation is assumed to be
+         * occurring at the AP which will raise priority for ACTIVE_RX and RX
+         * SP.
+         *
+         * Range: HW_BIT_RATE_*
+         */
+        u32 rate_adaptation_threshold;
+
+        /*
+         * The SNR above which the RX rate threshold indicating AP rate
+         * adaptation is valid
+         *
+         * Range: -128 - 127
+         */
+        s8 rate_adaptation_snr;
+};
+
+enum conf_rx_queue_type {
+        CONF_RX_QUEUE_TYPE_LOW_PRIORITY,  /* All except the high priority */
+        CONF_RX_QUEUE_TYPE_HIGH_PRIORITY, /* Management and voice packets */
+};
+
+struct conf_rx_settings {
+        /*
+         * The maximum amount of time, in TU, before the
+         * firmware discards the MSDU.
+         *
+         * Range: 0 - 0xFFFFFFFF
+         */
+        u32 rx_msdu_life_time;
+
+        /*
+         * Packet detection threshold in the PHY.
+         *
+         * FIXME: details unknown.
+         */
+        u32 packet_detection_threshold;
+
+        /*
+         * The longest time the STA will wait to receive traffic from the AP
+         * after a PS-poll has been transmitted.
+         *
+         * Range: 0 - 200000
+         */
+        u16 ps_poll_timeout;
+        /*
+         * The longest time the STA will wait to receive traffic from the AP
+         * after a frame has been sent from an UPSD enabled queue.
+         *
+         * Range: 0 - 200000
+         */
+        u16 upsd_timeout;
+
+        /*
+         * The number of octets in an MPDU, below which an RTS/CTS
+         * handshake is not performed.
+         *
+         * Range: 0 - 4096
+         */
+        u16 rts_threshold;
+
+        /*
+         * The RX Clear Channel Assessment threshold in the PHY
+         * (the energy threshold).
+         *
+         * Range: ENABLE_ENERGY_D  == 0x140A
+         *        DISABLE_ENERGY_D == 0xFFEF
+         */
+        u16 rx_cca_threshold;
+
+        /*
+         * Occupied Rx mem-blocks number which requires interrupting the host
+         * (0 = no buffering, 0xffff = disabled).
+         *
+         * Range: u16
+         */
+        u16 irq_blk_threshold;
+
+        /*
+         * Rx packets number which requires interrupting the host
+         * (0 = no buffering).
+         *
+         * Range: u16
+         */
+        u16 irq_pkt_threshold;
+
+        /*
+         * Max time in msec the FW may delay RX-Complete interrupt.
+         *
+         * Range: 1 - 100
+         */
+        u16 irq_timeout;
+
+        /*
+         * The RX queue type.
+         *
+         * Range: RX_QUEUE_TYPE_RX_LOW_PRIORITY, RX_QUEUE_TYPE_RX_HIGH_PRIORITY,
+         */
+        u8 queue_type;
+};
+
+#define CONF_TX_MAX_RATE_CLASSES       8
+
+#define CONF_TX_RATE_MASK_UNSPECIFIED  0
+#define CONF_TX_RATE_MASK_BASIC        (CONF_HW_BIT_RATE_1MBPS | \
+                                        CONF_HW_BIT_RATE_2MBPS)
+#define CONF_TX_RATE_RETRY_LIMIT       10
+
+struct conf_tx_rate_class {
+
+        /*
+         * The rates enabled for this rate class.
+         *
+         * Range: CONF_HW_BIT_RATE_* bit mask
+         */
+        u32 enabled_rates;
+
+        /*
+         * The dot11 short retry limit used for TX retries.
+         *
+         * Range: u8
+         */
+        u8 short_retry_limit;
+
+        /*
+         * The dot11 long retry limit used for TX retries.
+         *
+         * Range: u8
+         */
+        u8 long_retry_limit;
+
+        /*
+         * Flags controlling the attributes of TX transmission.
+         *
+         * Range: bit 0: Truncate - when set, FW attempts to send a frame stop
+         *               when the total valid per-rate attempts have
+         *               been exhausted; otherwise transmissions
+         *               will continue at the lowest available rate
+         *               until the appropriate one of the
+         *               short_retry_limit, long_retry_limit,
+         *               dot11_max_transmit_msdu_life_time, or
+         *               max_tx_life_time, is exhausted.
+         *            1: Preamble Override - indicates if the preamble type
+         *               should be used in TX.
+         *            2: Preamble Type - the type of the preamble to be used by
+         *               the policy (0 - long preamble, 1 - short preamble.
+         */
+        u8 aflags;
+};
+
+#define CONF_TX_MAX_AC_COUNT 4
+
+/* Slot number setting to start transmission at PIFS interval */
+#define CONF_TX_AIFS_PIFS 1
+/* Slot number setting to start transmission at DIFS interval normal
+ * DCF access */
+#define CONF_TX_AIFS_DIFS 2
+
+
+enum conf_tx_ac {
+        CONF_TX_AC_BE = 0,         /* best effort / legacy */
+        CONF_TX_AC_BK = 1,         /* background */
+        CONF_TX_AC_VI = 2,         /* video */
+        CONF_TX_AC_VO = 3,         /* voice */
+        CONF_TX_AC_CTS2SELF = 4,   /* fictious AC, follows AC_VO */
+        CONF_TX_AC_ANY_TID = 0x1f
+};
+
+struct conf_tx_ac_category {
+        /*
+         * The AC class identifier.
+         *
+         * Range: enum conf_tx_ac
+         */
+        u8 ac;
+
+        /*
+         * The contention window minimum size (in slots) for the access
+         * class.
+         *
+         * Range: u8
+         */
+        u8 cw_min;
+
+        /*
+         * The contention window maximum size (in slots) for the access
+         * class.
+         *
+         * Range: u8
+         */
+        u16 cw_max;
+
+        /*
+         * The AIF value (in slots) for the access class.
+         *
+         * Range: u8
+         */
+        u8 aifsn;
+
+        /*
+         * The TX Op Limit (in microseconds) for the access class.
+         *
+         * Range: u16
+         */
+        u16 tx_op_limit;
+};
+
+#define CONF_TX_MAX_TID_COUNT 7
+
+enum {
+        CONF_CHANNEL_TYPE_DCF = 0,   /* DC/LEGACY*/
+        CONF_CHANNEL_TYPE_EDCF = 1,  /* EDCA*/
+        CONF_CHANNEL_TYPE_HCCA = 2,  /* HCCA*/
+};
+
+enum {
+        CONF_PS_SCHEME_LEGACY = 0,
+        CONF_PS_SCHEME_UPSD_TRIGGER = 1,
+        CONF_PS_SCHEME_LEGACY_PSPOLL = 2,
+        CONF_PS_SCHEME_SAPSD = 3,
+};
+
+enum {
+        CONF_ACK_POLICY_LEGACY = 0,
+        CONF_ACK_POLICY_NO_ACK = 1,
+        CONF_ACK_POLICY_BLOCK = 2,
+};
+
+
+struct conf_tx_tid {
+        u8 queue_id;
+        u8 channel_type;
+        u8 tsid;
+        u8 ps_scheme;
+        u8 ack_policy;
+        u32 apsd_conf[2];
+};
+
+struct conf_tx_settings {
+        /*
+         * The TX ED value for TELEC Enable/Disable.
+         *
+         * Range: 0, 1
+         */
+        u8 tx_energy_detection;
+
+        /*
+         * Configuration for rate classes for TX (currently only one
+         * rate class supported.)
+         */
+        struct conf_tx_rate_class rc_conf;
+
+        /*
+         * Configuration for access categories for TX rate control.
+         */
+        u8 ac_conf_count;
+        struct conf_tx_ac_category ac_conf[CONF_TX_MAX_AC_COUNT];
+
+        /*
+         * Configuration for TID parameters.
+         */
+        u8 tid_conf_count;
+        struct conf_tx_tid tid_conf[CONF_TX_MAX_TID_COUNT];
+
+        /*
+         * The TX fragmentation threshold.
+         *
+         * Range: u16
+         */
+        u16 frag_threshold;
+
+        /*
+         * Max time in msec the FW may delay frame TX-Complete interrupt.
+         *
+         * Range: u16
+         */
+        u16 tx_compl_timeout;
+
+        /*
+         * Completed TX packet count which requires to issue the TX-Complete
+         * interrupt.
+         *
+         * Range: u16
+         */
+        u16 tx_compl_threshold;
+
+};
+
+enum {
+        CONF_WAKE_UP_EVENT_BEACON    = 0x01, /* Wake on every Beacon*/
+        CONF_WAKE_UP_EVENT_DTIM      = 0x02, /* Wake on every DTIM*/
+        CONF_WAKE_UP_EVENT_N_DTIM    = 0x04, /* Wake every Nth DTIM */
+        CONF_WAKE_UP_EVENT_N_BEACONS = 0x08, /* Wake every Nth beacon */
+        CONF_WAKE_UP_EVENT_BITS_MASK = 0x0F
+};
+
+#define CONF_MAX_BCN_FILT_IE_COUNT 32
+
+#define CONF_BCN_RULE_PASS_ON_CHANGE         BIT(0)
+#define CONF_BCN_RULE_PASS_ON_APPEARANCE     BIT(1)
+
+#define CONF_BCN_IE_OUI_LEN    3
+#define CONF_BCN_IE_VER_LEN    2
+
+struct conf_bcn_filt_rule {
+        /*
+         * IE number to which to associate a rule.
+         *
+         * Range: u8
+         */
+        u8 ie;
+
+        /*
+         * Rule to associate with the specific ie.
+         *
+         * Range: CONF_BCN_RULE_PASS_ON_*
+         */
+        u8 rule;
+
+        /*
+         * OUI for the vendor specifie IE (221)
+         */
+        u8 oui[CONF_BCN_IE_OUI_LEN];
+
+        /*
+         * Type for the vendor specifie IE (221)
+         */
+        u8 type;
+
+        /*
+         * Version for the vendor specifie IE (221)
+         */
+        u8 version[CONF_BCN_IE_VER_LEN];
+};
+
+#define CONF_MAX_RSSI_SNR_TRIGGERS 8
+
+enum {
+        CONF_TRIG_METRIC_RSSI_BEACON = 0,
+        CONF_TRIG_METRIC_RSSI_DATA,
+        CONF_TRIG_METRIC_SNR_BEACON,
+        CONF_TRIG_METRIC_SNR_DATA
+};
+
+enum {
+        CONF_TRIG_EVENT_TYPE_LEVEL = 0,
+        CONF_TRIG_EVENT_TYPE_EDGE
+};
+
+enum {
+        CONF_TRIG_EVENT_DIR_LOW = 0,
+        CONF_TRIG_EVENT_DIR_HIGH,
+        CONF_TRIG_EVENT_DIR_BIDIR
+};
+
+
+struct conf_sig_trigger {
+        /*
+         * The RSSI / SNR threshold value.
+         *
+         * FIXME: what is the range?
+         */
+        s16 threshold;
+
+        /*
+         * Minimum delay between two trigger events for this trigger in ms.
+         *
+         * Range: 0 - 60000
+         */
+        u16 pacing;
+
+        /*
+         * The measurement data source for this trigger.
+         *
+         * Range: CONF_TRIG_METRIC_*
+         */
+        u8 metric;
+
+        /*
+         * The trigger type of this trigger.
+         *
+         * Range: CONF_TRIG_EVENT_TYPE_*
+         */
+        u8 type;
+
+        /*
+         * The direction of the trigger.
+         *
+         * Range: CONF_TRIG_EVENT_DIR_*
+         */
+        u8 direction;
+
+        /*
+         * Hysteresis range of the trigger around the threshold (in dB)
+         *
+         * Range: u8
+         */
+        u8 hysteresis;
+
+        /*
+         * Index of the trigger rule.
+         *
+         * Range: 0 - CONF_MAX_RSSI_SNR_TRIGGERS-1
+         */
+        u8 index;
+
+        /*
+         * Enable / disable this rule (to use for clearing rules.)
+         *
+         * Range: 1 - Enabled, 2 - Not enabled
+         */
+        u8 enable;
+};
+
+struct conf_sig_weights {
+
+        /*
+         * RSSI from beacons average weight.
+         *
+         * Range: u8
+         */
+        u8 rssi_bcn_avg_weight;
+
+        /*
+         * RSSI from data average weight.
+         *
+         * Range: u8
+         */
+        u8 rssi_pkt_avg_weight;
+
+        /*
+         * SNR from beacons average weight.
+         *
+         * Range: u8
+         */
+        u8 snr_bcn_avg_weight;
+
+        /*
+         * SNR from data average weight.
+         *
+         * Range: u8
+         */
+        u8 snr_pkt_avg_weight;
+};
+
+enum conf_bcn_filt_mode {
+        CONF_BCN_FILT_MODE_DISABLED = 0,
+        CONF_BCN_FILT_MODE_ENABLED = 1
+};
+
+enum conf_bet_mode {
+        CONF_BET_MODE_DISABLE = 0,
+        CONF_BET_MODE_ENABLE = 1,
+};
+
+struct conf_conn_settings {
+        /*
+         * Firmware wakeup conditions configuration. The host may set only
+         * one bit.
+         *
+         * Range: CONF_WAKE_UP_EVENT_*
+         */
+        u8 wake_up_event;
+
+        /*
+         * Listen interval for beacons or Dtims.
+         *
+         * Range: 0 for beacon and Dtim wakeup
+         *        1-10 for x Dtims
+         *        1-255 for x beacons
+         */
+        u8 listen_interval;
+
+        /*
+         * Enable or disable the beacon filtering.
+         *
+         * Range: CONF_BCN_FILT_MODE_*
+         */
+        enum conf_bcn_filt_mode bcn_filt_mode;
+
+        /*
+         * Configure Beacon filter pass-thru rules.
+         */
+        u8 bcn_filt_ie_count;
+        struct conf_bcn_filt_rule bcn_filt_ie[CONF_MAX_BCN_FILT_IE_COUNT];
+
+        /*
+         * The number of consequtive beacons to lose, before the firmware
+         * becomes out of synch.
+         *
+         * Range: u32
+         */
+        u32 synch_fail_thold;
+
+        /*
+         * After out-of-synch, the number of TU's to wait without a further
+         * received beacon (or probe response) before issuing the BSS_EVENT_LOSE
+         * event.
+         *
+         * Range: u32
+         */
+        u32 bss_lose_timeout;
+
+        /*
+         * Beacon receive timeout.
+         *
+         * Range: u32
+         */
+        u32 beacon_rx_timeout;
+
+        /*
+         * Broadcast receive timeout.
+         *
+         * Range: u32
+         */
+        u32 broadcast_timeout;
+
+        /*
+         * Enable/disable reception of broadcast packets in power save mode
+         *
+         * Range: 1 - enable, 0 - disable
+         */
+        u8 rx_broadcast_in_ps;
+
+        /*
+         * Consequtive PS Poll failures before sending event to driver
+         *
+         * Range: u8
+         */
+        u8 ps_poll_threshold;
+
+        /*
+         * Configuration of signal (rssi/snr) triggers.
+         */
+        u8 sig_trigger_count;
+        struct conf_sig_trigger sig_trigger[CONF_MAX_RSSI_SNR_TRIGGERS];
+
+        /*
+         * Configuration of signal average weights.
+         */
+        struct conf_sig_weights sig_weights;
+
+        /*
+         * Specifies if beacon early termination procedure is enabled or
+         * disabled.
+         *
+         * Range: CONF_BET_MODE_*
+         */
+        u8 bet_enable;
+
+        /*
+         * Specifies the maximum number of consecutive beacons that may be
+         * early terminated. After this number is reached at least one full
+         * beacon must be correctly received in FW before beacon ET
+         * resumes.
+         *
+         * Range 0 - 255
+         */
+        u8 bet_max_consecutive;
+
+        /*
+         * Specifies the maximum number of times to try PSM entry if it fails
+         * (if sending the appropriate null-func message fails.)
+         *
+         * Range 0 - 255
+         */
+        u8 psm_entry_retries;
+};
+
+enum {
+        CONF_REF_CLK_19_2_E,
+        CONF_REF_CLK_26_E,
+        CONF_REF_CLK_38_4_E,
+        CONF_REF_CLK_52_E
+};
+
+enum single_dual_band_enum {
+        CONF_SINGLE_BAND,
+        CONF_DUAL_BAND
+};
+
+#define CONF_RSSI_AND_PROCESS_COMPENSATION_SIZE 15
+#define CONF_NUMBER_OF_SUB_BANDS_5  7
+#define CONF_NUMBER_OF_RATE_GROUPS  6
+#define CONF_NUMBER_OF_CHANNELS_2_4 14
+#define CONF_NUMBER_OF_CHANNELS_5   35
+
+struct conf_radio_parms {
+        /*
+         * FEM parameter set to use
+         *
+         * Range: 0 or 1
+         */
+        u8 fem;
+};
+
+struct conf_init_settings {
+        /*
+         * Configure radio parameters.
+         */
+        struct conf_radio_parms radioparam;
+
+};
+
+struct conf_itrim_settings {
+        /* enable dco itrim */
+        u8 enable;
+
+        /* moderation timeout in microsecs from the last TX */
+        u32 timeout;
+};
+
+struct conf_pm_config_settings {
+        /*
+         * Host clock settling time
+         *
+         * Range: 0 - 30000 us
+         */
+        u32 host_clk_settling_time;
+
+        /*
+         * Host fast wakeup support
+         *
+         * Range: true, false
+         */
+        bool host_fast_wakeup_support;
+};
+
+struct conf_drv_settings {
+        struct conf_sg_settings sg;
+        struct conf_rx_settings rx;
+        struct conf_tx_settings tx;
+        struct conf_conn_settings conn;
+        struct conf_init_settings init;
+        struct conf_itrim_settings itrim;
+        struct conf_pm_config_settings pm_config;
+};
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_debugfs.c b/drivers/net/wireless/wl12xx/wl1271_debugfs.c
index c1805e5f8964..3f7ff8d0cf5a 100644
--- a/drivers/net/wireless/wl12xx/wl1271_debugfs.c
+++ b/drivers/net/wireless/wl12xx/wl1271_debugfs.c
@@ -24,6 +24,7 @@
 #include "wl1271_debugfs.h"
 
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 
 #include "wl1271.h"
 #include "wl1271_acx.h"
@@ -237,6 +238,64 @@ static const struct file_operations tx_queue_len_ops = {
         .open = wl1271_open_file_generic,
 };
 
+static ssize_t gpio_power_read(struct file *file, char __user *user_buf,
+                          size_t count, loff_t *ppos)
+{
+        struct wl1271 *wl = file->private_data;
+        bool state = test_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+
+        int res;
+        char buf[10];
+
+        res = scnprintf(buf, sizeof(buf), "%d\n", state);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, res);
+}
+
+static ssize_t gpio_power_write(struct file *file,
+                           const char __user *user_buf,
+                           size_t count, loff_t *ppos)
+{
+        struct wl1271 *wl = file->private_data;
+        char buf[10];
+        size_t len;
+        unsigned long value;
+        int ret;
+
+        mutex_lock(&wl->mutex);
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len)) {
+                ret = -EFAULT;
+                goto out;
+        }
+        buf[len] = '\0';
+
+        ret = strict_strtoul(buf, 0, &value);
+        if (ret < 0) {
+                wl1271_warning("illegal value in gpio_power");
+                goto out;
+        }
+
+        if (value) {
+                wl->set_power(true);
+                set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+        } else {
+                wl->set_power(false);
+                clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+        }
+
+out:
+        mutex_unlock(&wl->mutex);
+        return count;
+}
+
+static const struct file_operations gpio_power_ops = {
+        .read = gpio_power_read,
+        .write = gpio_power_write,
+        .open = wl1271_open_file_generic
+};
+
 static void wl1271_debugfs_delete_files(struct wl1271 *wl)
 {
         DEBUGFS_FWSTATS_DEL(tx, internal_desc_overflow);
@@ -333,6 +392,8 @@ static void wl1271_debugfs_delete_files(struct wl1271 *wl)
         DEBUGFS_DEL(tx_queue_len);
         DEBUGFS_DEL(retry_count);
         DEBUGFS_DEL(excessive_retries);
+
+        DEBUGFS_DEL(gpio_power);
 }
 
 static int wl1271_debugfs_add_files(struct wl1271 *wl)
@@ -434,6 +495,8 @@ static int wl1271_debugfs_add_files(struct wl1271 *wl)
         DEBUGFS_ADD(retry_count, wl->debugfs.rootdir);
         DEBUGFS_ADD(excessive_retries, wl->debugfs.rootdir);
 
+        DEBUGFS_ADD(gpio_power, wl->debugfs.rootdir);
+
 out:
         if (ret < 0)
                 wl1271_debugfs_delete_files(wl);
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.c b/drivers/net/wireless/wl12xx/wl1271_event.c
index f3afd4a6ff33..7468ef10194b 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.c
+++ b/drivers/net/wireless/wl12xx/wl1271_event.c
@@ -24,25 +24,125 @@
 #include "wl1271.h"
 #include "wl1271_reg.h"
 #include "wl1271_spi.h"
+#include "wl1271_io.h"
 #include "wl1271_event.h"
 #include "wl1271_ps.h"
+#include "wl12xx_80211.h"
 
 static int wl1271_event_scan_complete(struct wl1271 *wl,
                                       struct event_mailbox *mbox)
 {
+        int size = sizeof(struct wl12xx_probe_req_template);
         wl1271_debug(DEBUG_EVENT, "status: 0x%x",
                      mbox->scheduled_scan_status);
 
-        if (wl->scanning) {
-                mutex_unlock(&wl->mutex);
-                ieee80211_scan_completed(wl->hw, false);
-                mutex_lock(&wl->mutex);
-                wl->scanning = false;
+        if (test_bit(WL1271_FLAG_SCANNING, &wl->flags)) {
+                if (wl->scan.state == WL1271_SCAN_BAND_DUAL) {
+                        wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4,
+                                                NULL, size);
+                        /* 2.4 GHz band scanned, scan 5 GHz band, pretend
+                         * to the wl1271_cmd_scan function that we are not
+                         * scanning as it checks that.
+                         */
+                        clear_bit(WL1271_FLAG_SCANNING, &wl->flags);
+                        wl1271_cmd_scan(wl, wl->scan.ssid, wl->scan.ssid_len,
+                                                wl->scan.active,
+                                                wl->scan.high_prio,
+                                                WL1271_SCAN_BAND_5_GHZ,
+                                                wl->scan.probe_requests);
+                } else {
+                        if (wl->scan.state == WL1271_SCAN_BAND_2_4_GHZ)
+                                wl1271_cmd_template_set(wl,
+                                                CMD_TEMPL_CFG_PROBE_REQ_2_4,
+                                                NULL, size);
+                        else
+                                wl1271_cmd_template_set(wl,
+                                                CMD_TEMPL_CFG_PROBE_REQ_5,
+                                                NULL, size);
+
+                        mutex_unlock(&wl->mutex);
+                        ieee80211_scan_completed(wl->hw, false);
+                        mutex_lock(&wl->mutex);
+                        clear_bit(WL1271_FLAG_SCANNING, &wl->flags);
+                }
         }
-
         return 0;
 }
 
+static int wl1271_event_ps_report(struct wl1271 *wl,
+                                  struct event_mailbox *mbox,
+                                  bool *beacon_loss)
+{
+        int ret = 0;
+
+        wl1271_debug(DEBUG_EVENT, "ps_status: 0x%x", mbox->ps_status);
+
+        switch (mbox->ps_status) {
+        case EVENT_ENTER_POWER_SAVE_FAIL:
+                wl1271_debug(DEBUG_PSM, "PSM entry failed");
+
+                if (!test_bit(WL1271_FLAG_PSM, &wl->flags)) {
+                        /* remain in active mode */
+                        wl->psm_entry_retry = 0;
+                        break;
+                }
+
+                if (wl->psm_entry_retry < wl->conf.conn.psm_entry_retries) {
+                        wl->psm_entry_retry++;
+                        ret = wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE,
+                                                 true);
+                } else {
+                        wl1271_error("PSM entry failed, giving up.\n");
+                        /* FIXME: this may need to be reconsidered. for now it
+                           is not possible to indicate to the mac80211
+                           afterwards that PSM entry failed. To maximize
+                           functionality (receiving data and remaining
+                           associated) make sure that we are in sync with the
+                           AP in regard of PSM mode. */
+                        ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE,
+                                                 false);
+                        wl->psm_entry_retry = 0;
+                }
+                break;
+        case EVENT_ENTER_POWER_SAVE_SUCCESS:
+                wl->psm_entry_retry = 0;
+
+                /* enable beacon filtering */
+                ret = wl1271_acx_beacon_filter_opt(wl, true);
+                if (ret < 0)
+                        break;
+
+                /* enable beacon early termination */
+                ret = wl1271_acx_bet_enable(wl, true);
+                if (ret < 0)
+                        break;
+
+                /* go to extremely low power mode */
+                wl1271_ps_elp_sleep(wl);
+                if (ret < 0)
+                        break;
+                break;
+        case EVENT_EXIT_POWER_SAVE_FAIL:
+                wl1271_debug(DEBUG_PSM, "PSM exit failed");
+
+                if (test_bit(WL1271_FLAG_PSM, &wl->flags)) {
+                        wl->psm_entry_retry = 0;
+                        break;
+                }
+
+                /* make sure the firmware goes to active mode - the frame to
+                   be sent next will indicate to the AP, that we are active. */
+                ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE,
+                                         false);
+                break;
+        case EVENT_EXIT_POWER_SAVE_SUCCESS:
+        default:
+                break;
+        }
+
+        return ret;
+}
+
 static void wl1271_event_mbox_dump(struct event_mailbox *mbox)
 {
         wl1271_debug(DEBUG_EVENT, "MBOX DUMP:");
@@ -54,10 +154,12 @@ static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
 {
         int ret;
         u32 vector;
+        bool beacon_loss = false;
 
         wl1271_event_mbox_dump(mbox);
 
-        vector = mbox->events_vector & ~(mbox->events_mask);
+        vector = le32_to_cpu(mbox->events_vector);
+        vector &= ~(le32_to_cpu(mbox->events_mask));
         wl1271_debug(DEBUG_EVENT, "vector: 0x%x", vector);
 
         if (vector & SCAN_COMPLETE_EVENT_ID) {
@@ -66,14 +168,35 @@ static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
                         return ret;
         }
 
-        if (vector & BSS_LOSE_EVENT_ID) {
+        /*
+         * The BSS_LOSE_EVENT_ID is only needed while psm (and hence beacon
+         * filtering) is enabled. Without PSM, the stack will receive all
+         * beacons and can detect beacon loss by itself.
+         */
+        if (vector & BSS_LOSE_EVENT_ID &&
+            test_bit(WL1271_FLAG_PSM, &wl->flags)) {
                 wl1271_debug(DEBUG_EVENT, "BSS_LOSE_EVENT");
 
-                if (wl->psm_requested && wl->psm) {
-                        ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE);
-                        if (ret < 0)
-                                return ret;
-                }
+                /* indicate to the stack, that beacons have been lost */
+                beacon_loss = true;
+        }
+
+        if (vector & PS_REPORT_EVENT_ID) {
+                wl1271_debug(DEBUG_EVENT, "PS_REPORT_EVENT");
+                ret = wl1271_event_ps_report(wl, mbox, &beacon_loss);
+                if (ret < 0)
+                        return ret;
+        }
+
+        if (wl->vif && beacon_loss) {
+                /* Obviously, it's dangerous to release the mutex while
+                   we are holding many of the variables in the wl struct.
+                   That's why it's done last in the function, and care must
+                   be taken that nothing more is done after this function
+                   returns. */
+                mutex_unlock(&wl->mutex);
+                ieee80211_beacon_loss(wl->vif);
+                mutex_lock(&wl->mutex);
         }
 
         return 0;
@@ -92,7 +215,7 @@ int wl1271_event_unmask(struct wl1271 *wl)
 
 void wl1271_event_mbox_config(struct wl1271 *wl)
 {
-        wl->mbox_ptr[0] = wl1271_reg_read32(wl, REG_EVENT_MAILBOX_PTR);
+        wl->mbox_ptr[0] = wl1271_read32(wl, REG_EVENT_MAILBOX_PTR);
         wl->mbox_ptr[1] = wl->mbox_ptr[0] + sizeof(struct event_mailbox);
 
         wl1271_debug(DEBUG_EVENT, "MBOX ptrs: 0x%x 0x%x",
@@ -110,8 +233,8 @@ int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num)
                 return -EINVAL;
 
         /* first we read the mbox descriptor */
-        wl1271_spi_mem_read(wl, wl->mbox_ptr[mbox_num], &mbox,
-                            sizeof(struct event_mailbox));
+        wl1271_read(wl, wl->mbox_ptr[mbox_num], &mbox,
+                    sizeof(struct event_mailbox), false);
 
         /* process the descriptor */
         ret = wl1271_event_process(wl, &mbox);
@@ -119,7 +242,7 @@ int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num)
                 return ret;
 
         /* then we let the firmware know it can go on...*/
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_EVENT_ACK);
+        wl1271_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_EVENT_ACK);
 
         return 0;
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.h b/drivers/net/wireless/wl12xx/wl1271_event.h
index 2cdce7c34bf0..278f9206aa56 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.h
+++ b/drivers/net/wireless/wl12xx/wl1271_event.h
@@ -63,36 +63,43 @@ enum {
         EVENT_MBOX_ALL_EVENT_ID                  = 0x7fffffff,
 };
 
+enum {
+        EVENT_ENTER_POWER_SAVE_FAIL = 0,
+        EVENT_ENTER_POWER_SAVE_SUCCESS,
+        EVENT_EXIT_POWER_SAVE_FAIL,
+        EVENT_EXIT_POWER_SAVE_SUCCESS,
+};
+
 struct event_debug_report {
         u8 debug_event_id;
         u8 num_params;
-        u16 pad;
-        u32 report_1;
-        u32 report_2;
-        u32 report_3;
+        __le16 pad;
+        __le32 report_1;
+        __le32 report_2;
+        __le32 report_3;
 } __attribute__ ((packed));
 
 #define NUM_OF_RSSI_SNR_TRIGGERS 8
 
 struct event_mailbox {
-        u32 events_vector;
-        u32 events_mask;
-        u32 reserved_1;
-        u32 reserved_2;
+        __le32 events_vector;
+        __le32 events_mask;
+        __le32 reserved_1;
+        __le32 reserved_2;
 
         u8 dbg_event_id;
         u8 num_relevant_params;
-        u16 reserved_3;
-        u32 event_report_p1;
-        u32 event_report_p2;
-        u32 event_report_p3;
+        __le16 reserved_3;
+        __le32 event_report_p1;
+        __le32 event_report_p2;
+        __le32 event_report_p3;
 
         u8 number_of_scan_results;
         u8 scan_tag;
         u8 reserved_4[2];
-        u32 compl_scheduled_scan_status;
+        __le32 compl_scheduled_scan_status;
 
-        u16 scheduled_scan_attended_channels;
+        __le16 scheduled_scan_attended_channels;
         u8 soft_gemini_sense_info;
         u8 soft_gemini_protective_info;
         s8 rssi_snr_trigger_metric[NUM_OF_RSSI_SNR_TRIGGERS];
diff --git a/drivers/net/wireless/wl12xx/wl1271_init.c b/drivers/net/wireless/wl12xx/wl1271_init.c
index 490df217605a..d189e8fe05a6 100644
--- a/drivers/net/wireless/wl12xx/wl1271_init.c
+++ b/drivers/net/wireless/wl12xx/wl1271_init.c
@@ -23,6 +23,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 
 #include "wl1271_init.h"
 #include "wl12xx_80211.h"
@@ -49,7 +50,7 @@ static int wl1271_init_hwenc_config(struct wl1271 *wl)
         return 0;
 }
 
-static int wl1271_init_templates_config(struct wl1271 *wl)
+int wl1271_init_templates_config(struct wl1271 *wl)
 {
         int ret;
 
@@ -59,6 +60,14 @@ static int wl1271_init_templates_config(struct wl1271 *wl)
         if (ret < 0)
                 return ret;
 
+        if (wl1271_11a_enabled()) {
+                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_5,
+                                NULL,
+                                sizeof(struct wl12xx_probe_req_template));
+                if (ret < 0)
+                        return ret;
+        }
+
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, NULL,
                                       sizeof(struct wl12xx_null_data_template));
         if (ret < 0)
@@ -94,7 +103,7 @@ static int wl1271_init_rx_config(struct wl1271 *wl, u32 config, u32 filter)
 {
         int ret;
 
-        ret = wl1271_acx_rx_msdu_life_time(wl, RX_MSDU_LIFETIME_DEF);
+        ret = wl1271_acx_rx_msdu_life_time(wl);
         if (ret < 0)
                 return ret;
 
@@ -105,7 +114,7 @@ static int wl1271_init_rx_config(struct wl1271 *wl, u32 config, u32 filter)
         return 0;
 }
 
-static int wl1271_init_phy_config(struct wl1271 *wl)
+int wl1271_init_phy_config(struct wl1271 *wl)
 {
         int ret;
 
@@ -117,7 +126,7 @@ static int wl1271_init_phy_config(struct wl1271 *wl)
         if (ret < 0)
                 return ret;
 
-        ret = wl1271_acx_group_address_tbl(wl);
+        ret = wl1271_acx_group_address_tbl(wl, true, NULL, 0);
         if (ret < 0)
                 return ret;
 
@@ -125,7 +134,7 @@ static int wl1271_init_phy_config(struct wl1271 *wl)
         if (ret < 0)
                 return ret;
 
-        ret = wl1271_acx_rts_threshold(wl, RTS_THRESHOLD_DEF);
+        ret = wl1271_acx_rts_threshold(wl, wl->conf.rx.rts_threshold);
         if (ret < 0)
                 return ret;
 
@@ -136,7 +145,8 @@ static int wl1271_init_beacon_filter(struct wl1271 *wl)
 {
         int ret;
 
-        ret = wl1271_acx_beacon_filter_opt(wl);
+        /* disable beacon filtering at this stage */
+        ret = wl1271_acx_beacon_filter_opt(wl, false);
         if (ret < 0)
                 return ret;
 
@@ -147,7 +157,7 @@ static int wl1271_init_beacon_filter(struct wl1271 *wl)
         return 0;
 }
 
-static int wl1271_init_pta(struct wl1271 *wl)
+int wl1271_init_pta(struct wl1271 *wl)
 {
         int ret;
 
@@ -162,7 +172,7 @@ static int wl1271_init_pta(struct wl1271 *wl)
         return 0;
 }
 
-static int wl1271_init_energy_detection(struct wl1271 *wl)
+int wl1271_init_energy_detection(struct wl1271 *wl)
 {
         int ret;
 
@@ -184,118 +194,17 @@ static int wl1271_init_beacon_broadcast(struct wl1271 *wl)
         return 0;
 }
 
-static int wl1271_init_general_parms(struct wl1271 *wl)
-{
-        struct wl1271_general_parms *gen_parms;
-        int ret;
-
-        gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
-        if (!gen_parms)
-                return -ENOMEM;
-
-        gen_parms->id = TEST_CMD_INI_FILE_GENERAL_PARAM;
-
-        gen_parms->ref_clk = REF_CLK_38_4_E;
-        /* FIXME: magic numbers */
-        gen_parms->settling_time = 5;
-        gen_parms->clk_valid_on_wakeup = 0;
-        gen_parms->dc2dcmode = 0;
-        gen_parms->single_dual_band = 0;
-        gen_parms->tx_bip_fem_autodetect = 1;
-        gen_parms->tx_bip_fem_manufacturer = 1;
-        gen_parms->settings = 1;
-
-        ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), 0);
-        if (ret < 0) {
-                wl1271_warning("CMD_INI_FILE_GENERAL_PARAM failed");
-                return ret;
-        }
-
-        kfree(gen_parms);
-        return 0;
-}
-
-static int wl1271_init_radio_parms(struct wl1271 *wl)
-{
-        /*
-         * FIXME: All these magic numbers should be moved to some place where
-         * they can be configured (separate file?)
-         */
-
-        struct wl1271_radio_parms *radio_parms;
-        int ret;
-        u8 compensation[] = { 0xec, 0xf6, 0x00, 0x0c, 0x18, 0xf8, 0xfc, 0x00,
-                              0x08, 0x10, 0xf0, 0xf8, 0x00, 0x0a, 0x14 };
-
-        u8 tx_rate_limits_normal[]   = { 0x1e, 0x1f, 0x22, 0x24, 0x28, 0x29 };
-        u8 tx_rate_limits_degraded[] = { 0x1b, 0x1c, 0x1e, 0x20, 0x24, 0x25 };
-
-        u8 tx_channel_limits_11b[] = { 0x22, 0x50, 0x50, 0x50,
-                                       0x50, 0x50, 0x50, 0x50,
-                                       0x50, 0x50, 0x22, 0x50,
-                                       0x22, 0x50 };
-
-        u8 tx_channel_limits_ofdm[] = { 0x20, 0x50, 0x50, 0x50,
-                                        0x50, 0x50, 0x50, 0x50,
-                                        0x50, 0x50, 0x20, 0x50,
-                                        0x20, 0x50 };
-
-        u8 tx_pdv_rate_offsets[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
-
-        u8 tx_ibias[] = { 0x1a, 0x1a, 0x1a, 0x1a, 0x1a, 0x27 };
-
-        radio_parms = kzalloc(sizeof(*radio_parms), GFP_KERNEL);
-        if (!radio_parms)
-                return -ENOMEM;
-
-        radio_parms->id = TEST_CMD_INI_FILE_RADIO_PARAM;
-
-        /* Static radio parameters */
-        radio_parms->rx_trace_loss = 10;
-        radio_parms->tx_trace_loss = 10;
-        memcpy(radio_parms->rx_rssi_and_proc_compens, compensation,
-               sizeof(compensation));
-
-        /* We don't set the 5GHz -- N/A */
-
-        /* Dynamic radio parameters */
-        radio_parms->tx_ref_pd_voltage = cpu_to_le16(0x24e);
-        radio_parms->tx_ref_power = 0x78;
-        radio_parms->tx_offset_db = 0x0;
-
-        memcpy(radio_parms->tx_rate_limits_normal, tx_rate_limits_normal,
-               sizeof(tx_rate_limits_normal));
-        memcpy(radio_parms->tx_rate_limits_degraded, tx_rate_limits_degraded,
-               sizeof(tx_rate_limits_degraded));
-
-        memcpy(radio_parms->tx_channel_limits_11b, tx_channel_limits_11b,
-               sizeof(tx_channel_limits_11b));
-        memcpy(radio_parms->tx_channel_limits_ofdm, tx_channel_limits_ofdm,
-               sizeof(tx_channel_limits_ofdm));
-        memcpy(radio_parms->tx_pdv_rate_offsets, tx_pdv_rate_offsets,
-               sizeof(tx_pdv_rate_offsets));
-        memcpy(radio_parms->tx_ibias, tx_ibias,
-               sizeof(tx_ibias));
-
-        radio_parms->rx_fem_insertion_loss = 0x14;
-
-        ret = wl1271_cmd_test(wl, radio_parms, sizeof(*radio_parms), 0);
-        if (ret < 0)
-                wl1271_warning("CMD_INI_FILE_RADIO_PARAM failed");
-
-        kfree(radio_parms);
-        return ret;
-}
-
 int wl1271_hw_init(struct wl1271 *wl)
 {
-        int ret;
+        struct conf_tx_ac_category *conf_ac;
+        struct conf_tx_tid *conf_tid;
+        int ret, i;
 
-        ret = wl1271_init_general_parms(wl);
+        ret = wl1271_cmd_general_parms(wl);
         if (ret < 0)
                 return ret;
 
-        ret = wl1271_init_radio_parms(wl);
+        ret = wl1271_cmd_radio_parms(wl);
         if (ret < 0)
                 return ret;
 
@@ -311,8 +220,8 @@ int wl1271_hw_init(struct wl1271 *wl)
 
         /* RX config */
         ret = wl1271_init_rx_config(wl,
-                                       RX_CFG_PROMISCUOUS | RX_CFG_TSF,
-                                       RX_FILTER_OPTION_DEF);
+                                    RX_CFG_PROMISCUOUS | RX_CFG_TSF,
+                                    RX_FILTER_OPTION_DEF);
         /* RX_CONFIG_OPTION_ANY_DST_ANY_BSS,
            RX_FILTER_OPTION_FILTER_ALL); */
         if (ret < 0)
@@ -323,6 +232,15 @@ int wl1271_hw_init(struct wl1271 *wl)
         if (ret < 0)
                 goto out_free_memmap;
 
+        ret = wl1271_acx_dco_itrim_params(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Initialize connection monitoring thresholds */
+        ret = wl1271_acx_conn_monit_params(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
         /* Beacon filtering */
         ret = wl1271_init_beacon_filter(wl);
         if (ret < 0)
@@ -359,14 +277,28 @@ int wl1271_hw_init(struct wl1271 *wl)
                 goto out_free_memmap;
 
         /* Default TID configuration */
-        ret = wl1271_acx_tid_cfg(wl);
-        if (ret < 0)
-                goto out_free_memmap;
+        for (i = 0; i < wl->conf.tx.tid_conf_count; i++) {
+                conf_tid = &wl->conf.tx.tid_conf[i];
+                ret = wl1271_acx_tid_cfg(wl, conf_tid->queue_id,
+                                         conf_tid->channel_type,
+                                         conf_tid->tsid,
+                                         conf_tid->ps_scheme,
+                                         conf_tid->ack_policy,
+                                         conf_tid->apsd_conf[0],
+                                         conf_tid->apsd_conf[1]);
+                if (ret < 0)
+                        goto out_free_memmap;
+        }
 
         /* Default AC configuration */
-        ret = wl1271_acx_ac_cfg(wl);
-        if (ret < 0)
-                goto out_free_memmap;
+        for (i = 0; i < wl->conf.tx.ac_conf_count; i++) {
+                conf_ac = &wl->conf.tx.ac_conf[i];
+                ret = wl1271_acx_ac_cfg(wl, conf_ac->ac, conf_ac->cw_min,
+                                        conf_ac->cw_max, conf_ac->aifsn,
+                                        conf_ac->tx_op_limit);
+                if (ret < 0)
+                        goto out_free_memmap;
+        }
 
         /* Configure TX rate classes */
         ret = wl1271_acx_rate_policies(wl);
@@ -374,7 +306,7 @@ int wl1271_hw_init(struct wl1271 *wl)
                 goto out_free_memmap;
 
         /* Enable data path */
-        ret = wl1271_cmd_data_path(wl, wl->channel, 1);
+        ret = wl1271_cmd_data_path(wl, 1);
         if (ret < 0)
                 goto out_free_memmap;
 
@@ -388,10 +320,16 @@ int wl1271_hw_init(struct wl1271 *wl)
         if (ret < 0)
                 goto out_free_memmap;
 
+        /* configure PM */
+        ret = wl1271_acx_pm_config(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
         return 0;
 
  out_free_memmap:
         kfree(wl->target_mem_map);
+        wl->target_mem_map = NULL;
 
         return ret;
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_init.h b/drivers/net/wireless/wl12xx/wl1271_init.h
index bd8ff0fa2272..bc26f8c53b91 100644
--- a/drivers/net/wireless/wl12xx/wl1271_init.h
+++ b/drivers/net/wireless/wl12xx/wl1271_init.h
@@ -27,89 +27,10 @@
 #include "wl1271.h"
 
 int wl1271_hw_init_power_auth(struct wl1271 *wl);
+int wl1271_init_templates_config(struct wl1271 *wl);
+int wl1271_init_phy_config(struct wl1271 *wl);
+int wl1271_init_pta(struct wl1271 *wl);
+int wl1271_init_energy_detection(struct wl1271 *wl);
 int wl1271_hw_init(struct wl1271 *wl);
 
-/* These are not really a TEST_CMD, but the ref driver uses them as such */
-#define TEST_CMD_INI_FILE_RADIO_PARAM   0x19
-#define TEST_CMD_INI_FILE_GENERAL_PARAM 0x1E
-
-struct wl1271_general_parms {
-        u8 id;
-        u8 padding[3];
-
-        u8 ref_clk;
-        u8 settling_time;
-        u8 clk_valid_on_wakeup;
-        u8 dc2dcmode;
-        u8 single_dual_band;
-
-        u8 tx_bip_fem_autodetect;
-        u8 tx_bip_fem_manufacturer;
-        u8 settings;
-} __attribute__ ((packed));
-
-enum ref_clk_enum {
-        REF_CLK_19_2_E,
-        REF_CLK_26_E,
-        REF_CLK_38_4_E,
-        REF_CLK_52_E
-};
-
-#define RSSI_AND_PROCESS_COMPENSATION_SIZE 15
-#define NUMBER_OF_SUB_BANDS_5  7
-#define NUMBER_OF_RATE_GROUPS  6
-#define NUMBER_OF_CHANNELS_2_4 14
-#define NUMBER_OF_CHANNELS_5   35
-
-struct wl1271_radio_parms {
-        u8 id;
-        u8 padding[3];
-
-        /* Static radio parameters */
-        /* 2.4GHz */
-        u8 rx_trace_loss;
-        u8 tx_trace_loss;
-        s8 rx_rssi_and_proc_compens[RSSI_AND_PROCESS_COMPENSATION_SIZE];
-
-        /* 5GHz */
-        u8 rx_trace_loss_5[NUMBER_OF_SUB_BANDS_5];
-        u8 tx_trace_loss_5[NUMBER_OF_SUB_BANDS_5];
-        s8 rx_rssi_and_proc_compens_5[RSSI_AND_PROCESS_COMPENSATION_SIZE];
-
-        /* Dynamic radio parameters */
-        /* 2.4GHz */
-        s16 tx_ref_pd_voltage;
-        s8  tx_ref_power;
-        s8  tx_offset_db;
-
-        s8  tx_rate_limits_normal[NUMBER_OF_RATE_GROUPS];
-        s8  tx_rate_limits_degraded[NUMBER_OF_RATE_GROUPS];
-
-        s8  tx_channel_limits_11b[NUMBER_OF_CHANNELS_2_4];
-        s8  tx_channel_limits_ofdm[NUMBER_OF_CHANNELS_2_4];
-        s8  tx_pdv_rate_offsets[NUMBER_OF_RATE_GROUPS];
-
-        u8  tx_ibias[NUMBER_OF_RATE_GROUPS];
-        u8  rx_fem_insertion_loss;
-
-        u8 padding2;
-
-        /* 5GHz */
-        s16 tx_ref_pd_voltage_5[NUMBER_OF_SUB_BANDS_5];
-        s8  tx_ref_power_5[NUMBER_OF_SUB_BANDS_5];
-        s8  tx_offset_db_5[NUMBER_OF_SUB_BANDS_5];
-
-        s8  tx_rate_limits_normal_5[NUMBER_OF_RATE_GROUPS];
-        s8  tx_rate_limits_degraded_5[NUMBER_OF_RATE_GROUPS];
-
-        s8  tx_channel_limits_ofdm_5[NUMBER_OF_CHANNELS_5];
-        s8  tx_pdv_rate_offsets_5[NUMBER_OF_RATE_GROUPS];
-
-        /* FIXME: this is inconsistent with the types for 2.4GHz */
-        s8  tx_ibias_5[NUMBER_OF_RATE_GROUPS];
-        s8  rx_fem_insertion_loss_5[NUMBER_OF_SUB_BANDS_5];
-
-        u8 padding3[2];
-} __attribute__ ((packed));
-
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_io.c b/drivers/net/wireless/wl12xx/wl1271_io.c
new file mode 100644
index 000000000000..5cd94d5666c2
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_io.c
@@ -0,0 +1,213 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2008-2010 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/crc7.h>
+#include <linux/spi/spi.h>
+
+#include "wl1271.h"
+#include "wl12xx_80211.h"
+#include "wl1271_spi.h"
+#include "wl1271_io.h"
+
+static int wl1271_translate_addr(struct wl1271 *wl, int addr)
+{
+        /*
+         * To translate, first check to which window of addresses the
+         * particular address belongs. Then subtract the starting address
+         * of that window from the address. Then, add offset of the
+         * translated region.
+         *
+         * The translated regions occur next to each other in physical device
+         * memory, so just add the sizes of the preceeding address regions to
+         * get the offset to the new region.
+         *
+         * Currently, only the two first regions are addressed, and the
+         * assumption is that all addresses will fall into either of those
+         * two.
+         */
+        if ((addr >= wl->part.reg.start) &&
+            (addr < wl->part.reg.start + wl->part.reg.size))
+                return addr - wl->part.reg.start + wl->part.mem.size;
+        else
+                return addr - wl->part.mem.start;
+}
+
+/* Set the SPI partitions to access the chip addresses
+ *
+ * To simplify driver code, a fixed (virtual) memory map is defined for
+ * register and memory addresses. Because in the chipset, in different stages
+ * of operation, those addresses will move around, an address translation
+ * mechanism is required.
+ *
+ * There are four partitions (three memory and one register partition),
+ * which are mapped to two different areas of the hardware memory.
+ *
+ *                                Virtual address
+ *                                     space
+ *
+ *                                    |    |
+ *                                 ...+----+--> mem.start
+ *          Physical address    ...   |    |
+ *               space       ...      |    | [PART_0]
+ *                        ...         |    |
+ *  00000000  <--+----+...         ...+----+--> mem.start + mem.size
+ *               |    |         ...   |    |
+ *               |MEM |      ...      |    |
+ *               |    |   ...         |    |
+ *  mem.size  <--+----+...            |    | {unused area)
+ *               |    |   ...         |    |
+ *               |REG |      ...      |    |
+ *  mem.size     |    |         ...   |    |
+ *      +     <--+----+...         ...+----+--> reg.start
+ *  reg.size     |    |   ...         |    |
+ *               |MEM2|      ...      |    | [PART_1]
+ *               |    |         ...   |    |
+ *                                 ...+----+--> reg.start + reg.size
+ *                                    |    |
+ *
+ */
+int wl1271_set_partition(struct wl1271 *wl,
+                         struct wl1271_partition_set *p)
+{
+        /* copy partition info */
+        memcpy(&wl->part, p, sizeof(*p));
+
+        wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                     p->mem.start, p->mem.size);
+        wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                     p->reg.start, p->reg.size);
+        wl1271_debug(DEBUG_SPI, "mem2_start %08X mem2_size %08X",
+                     p->mem2.start, p->mem2.size);
+        wl1271_debug(DEBUG_SPI, "mem3_start %08X mem3_size %08X",
+                     p->mem3.start, p->mem3.size);
+
+        /* write partition info to the chipset */
+        wl1271_raw_write32(wl, HW_PART0_START_ADDR, p->mem.start);
+        wl1271_raw_write32(wl, HW_PART0_SIZE_ADDR, p->mem.size);
+        wl1271_raw_write32(wl, HW_PART1_START_ADDR, p->reg.start);
+        wl1271_raw_write32(wl, HW_PART1_SIZE_ADDR, p->reg.size);
+        wl1271_raw_write32(wl, HW_PART2_START_ADDR, p->mem2.start);
+        wl1271_raw_write32(wl, HW_PART2_SIZE_ADDR, p->mem2.size);
+        wl1271_raw_write32(wl, HW_PART3_START_ADDR, p->mem3.start);
+
+        return 0;
+}
+
+void wl1271_io_reset(struct wl1271 *wl)
+{
+        wl1271_spi_reset(wl);
+}
+
+void wl1271_io_init(struct wl1271 *wl)
+{
+        wl1271_spi_init(wl);
+}
+
+void wl1271_raw_write(struct wl1271 *wl, int addr, void *buf,
+                      size_t len, bool fixed)
+{
+        wl1271_spi_raw_write(wl, addr, buf, len, fixed);
+}
+
+void wl1271_raw_read(struct wl1271 *wl, int addr, void *buf,
+                     size_t len, bool fixed)
+{
+        wl1271_spi_raw_read(wl, addr, buf, len, fixed);
+}
+
+void wl1271_read(struct wl1271 *wl, int addr, void *buf, size_t len,
+                     bool fixed)
+{
+        int physical;
+
+        physical = wl1271_translate_addr(wl, addr);
+
+        wl1271_spi_raw_read(wl, physical, buf, len, fixed);
+}
+
+void wl1271_write(struct wl1271 *wl, int addr, void *buf, size_t len,
+                  bool fixed)
+{
+        int physical;
+
+        physical = wl1271_translate_addr(wl, addr);
+
+        wl1271_spi_raw_write(wl, physical, buf, len, fixed);
+}
+
+u32 wl1271_read32(struct wl1271 *wl, int addr)
+{
+        return wl1271_raw_read32(wl, wl1271_translate_addr(wl, addr));
+}
+
+void wl1271_write32(struct wl1271 *wl, int addr, u32 val)
+{
+        wl1271_raw_write32(wl, wl1271_translate_addr(wl, addr), val);
+}
+
+void wl1271_top_reg_write(struct wl1271 *wl, int addr, u16 val)
+{
+        /* write address >> 1 + 0x30000 to OCP_POR_CTR */
+        addr = (addr >> 1) + 0x30000;
+        wl1271_write32(wl, OCP_POR_CTR, addr);
+
+        /* write value to OCP_POR_WDATA */
+        wl1271_write32(wl, OCP_DATA_WRITE, val);
+
+        /* write 1 to OCP_CMD */
+        wl1271_write32(wl, OCP_CMD, OCP_CMD_WRITE);
+}
+
+u16 wl1271_top_reg_read(struct wl1271 *wl, int addr)
+{
+        u32 val;
+        int timeout = OCP_CMD_LOOP;
+
+        /* write address >> 1 + 0x30000 to OCP_POR_CTR */
+        addr = (addr >> 1) + 0x30000;
+        wl1271_write32(wl, OCP_POR_CTR, addr);
+
+        /* write 2 to OCP_CMD */
+        wl1271_write32(wl, OCP_CMD, OCP_CMD_READ);
+
+        /* poll for data ready */
+        do {
+                val = wl1271_read32(wl, OCP_DATA_READ);
+        } while (!(val & OCP_READY_MASK) && --timeout);
+
+        if (!timeout) {
+                wl1271_warning("Top register access timed out.");
+                return 0xffff;
+        }
+
+        /* check data status and return if OK */
+        if ((val & OCP_STATUS_MASK) == OCP_STATUS_OK)
+                return val & 0xffff;
+        else {
+                wl1271_warning("Top register access returned error.");
+                return 0xffff;
+        }
+}
+
diff --git a/drivers/net/wireless/wl12xx/wl1271_io.h b/drivers/net/wireless/wl12xx/wl1271_io.h
new file mode 100644
index 000000000000..fa9a0b35788f
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_io.h
@@ -0,0 +1,68 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
+ * Copyright (C) 2008-2010 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_IO_H__
+#define __WL1271_IO_H__
+
+struct wl1271;
+
+void wl1271_io_reset(struct wl1271 *wl);
+void wl1271_io_init(struct wl1271 *wl);
+
+/* Raw target IO, address is not translated */
+void wl1271_raw_write(struct wl1271 *wl, int addr, void *buf,
+                      size_t len, bool fixed);
+void wl1271_raw_read(struct wl1271 *wl, int addr, void *buf,
+                     size_t len, bool fixed);
+
+/* Translated target IO */
+void wl1271_read(struct wl1271 *wl, int addr, void *buf, size_t len,
+                     bool fixed);
+void wl1271_write(struct wl1271 *wl, int addr, void *buf, size_t len,
+                      bool fixed);
+u32 wl1271_read32(struct wl1271 *wl, int addr);
+void wl1271_write32(struct wl1271 *wl, int addr, u32 val);
+
+/* Top Register IO */
+void wl1271_top_reg_write(struct wl1271 *wl, int addr, u16 val);
+u16 wl1271_top_reg_read(struct wl1271 *wl, int addr);
+
+int wl1271_set_partition(struct wl1271 *wl,
+                         struct wl1271_partition_set *p);
+
+static inline u32 wl1271_raw_read32(struct wl1271 *wl, int addr)
+{
+        wl1271_raw_read(wl, addr, &wl->buffer_32,
+                            sizeof(wl->buffer_32), false);
+
+        return wl->buffer_32;
+}
+
+static inline void wl1271_raw_write32(struct wl1271 *wl, int addr, u32 val)
+{
+        wl->buffer_32 = val;
+        wl1271_raw_write(wl, addr, &wl->buffer_32,
+                             sizeof(wl->buffer_32), false);
+}
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/wl1271_main.c
index 27298b19d5bd..65a1aeba2419 100644
--- a/drivers/net/wireless/wl12xx/wl1271_main.c
+++ b/drivers/net/wireless/wl12xx/wl1271_main.c
@@ -1,7 +1,7 @@
 /*
  * This file is part of wl1271
  *
- * Copyright (C) 2008-2009 Nokia Corporation
+ * Copyright (C) 2008-2010 Nokia Corporation
  *
  * Contact: Luciano Coelho <luciano.coelho@nokia.com>
  *
@@ -30,12 +30,16 @@
 #include <linux/spi/spi.h>
 #include <linux/crc32.h>
 #include <linux/etherdevice.h>
+#include <linux/vmalloc.h>
 #include <linux/spi/wl12xx.h>
+#include <linux/inetdevice.h>
+#include <linux/slab.h>
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
 #include "wl1271_reg.h"
 #include "wl1271_spi.h"
+#include "wl1271_io.h"
 #include "wl1271_event.h"
 #include "wl1271_tx.h"
 #include "wl1271_rx.h"
@@ -44,20 +48,321 @@
 #include "wl1271_debugfs.h"
 #include "wl1271_cmd.h"
 #include "wl1271_boot.h"
+#include "wl1271_testmode.h"
+
+#define WL1271_BOOT_RETRIES 3
+
+static struct conf_drv_settings default_conf = {
+        .sg = {
+                .per_threshold               = 7500,
+                .max_scan_compensation_time  = 120000,
+                .nfs_sample_interval         = 400,
+                .load_ratio                  = 50,
+                .auto_ps_mode                = 0,
+                .probe_req_compensation      = 170,
+                .scan_window_compensation    = 50,
+                .antenna_config              = 0,
+                .beacon_miss_threshold       = 60,
+                .rate_adaptation_threshold   = CONF_HW_BIT_RATE_12MBPS,
+                .rate_adaptation_snr         = 0
+        },
+        .rx = {
+                .rx_msdu_life_time           = 512000,
+                .packet_detection_threshold  = 0,
+                .ps_poll_timeout             = 15,
+                .upsd_timeout                = 15,
+                .rts_threshold               = 2347,
+                .rx_cca_threshold            = 0,
+                .irq_blk_threshold           = 0xFFFF,
+                .irq_pkt_threshold           = 0,
+                .irq_timeout                 = 600,
+                .queue_type                  = CONF_RX_QUEUE_TYPE_LOW_PRIORITY,
+        },
+        .tx = {
+                .tx_energy_detection         = 0,
+                .rc_conf                     = {
+                        .enabled_rates       = CONF_HW_BIT_RATE_1MBPS |
+                                               CONF_HW_BIT_RATE_2MBPS,
+                        .short_retry_limit   = 10,
+                        .long_retry_limit    = 10,
+                        .aflags              = 0
+                },
+                .ac_conf_count               = 4,
+                .ac_conf                     = {
+                        [0] = {
+                                .ac          = CONF_TX_AC_BE,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = 3,
+                                .tx_op_limit = 0,
+                        },
+                        [1] = {
+                                .ac          = CONF_TX_AC_BK,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = 7,
+                                .tx_op_limit = 0,
+                        },
+                        [2] = {
+                                .ac          = CONF_TX_AC_VI,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = CONF_TX_AIFS_PIFS,
+                                .tx_op_limit = 3008,
+                        },
+                        [3] = {
+                                .ac          = CONF_TX_AC_VO,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = CONF_TX_AIFS_PIFS,
+                                .tx_op_limit = 1504,
+                        },
+                },
+                .tid_conf_count = 7,
+                .tid_conf = {
+                        [0] = {
+                                .queue_id    = 0,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [1] = {
+                                .queue_id    = 1,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [2] = {
+                                .queue_id    = 2,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [3] = {
+                                .queue_id    = 3,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [4] = {
+                                .queue_id    = 4,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [5] = {
+                                .queue_id    = 5,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [6] = {
+                                .queue_id    = 6,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        }
+                },
+                .frag_threshold              = IEEE80211_MAX_FRAG_THRESHOLD,
+                .tx_compl_timeout            = 700,
+                .tx_compl_threshold          = 4
+        },
+        .conn = {
+                .wake_up_event               = CONF_WAKE_UP_EVENT_DTIM,
+                .listen_interval             = 0,
+                .bcn_filt_mode               = CONF_BCN_FILT_MODE_ENABLED,
+                .bcn_filt_ie_count           = 1,
+                .bcn_filt_ie = {
+                        [0] = {
+                                .ie          = WLAN_EID_CHANNEL_SWITCH,
+                                .rule        = CONF_BCN_RULE_PASS_ON_APPEARANCE,
+                        }
+                },
+                .synch_fail_thold            = 10,
+                .bss_lose_timeout            = 100,
+                .beacon_rx_timeout           = 10000,
+                .broadcast_timeout           = 20000,
+                .rx_broadcast_in_ps          = 1,
+                .ps_poll_threshold           = 20,
+                .sig_trigger_count           = 2,
+                .sig_trigger = {
+                        [0] = {
+                                .threshold   = -75,
+                                .pacing      = 500,
+                                .metric      = CONF_TRIG_METRIC_RSSI_BEACON,
+                                .type        = CONF_TRIG_EVENT_TYPE_EDGE,
+                                .direction   = CONF_TRIG_EVENT_DIR_LOW,
+                                .hysteresis  = 2,
+                                .index       = 0,
+                                .enable      = 1
+                        },
+                        [1] = {
+                                .threshold   = -75,
+                                .pacing      = 500,
+                                .metric      = CONF_TRIG_METRIC_RSSI_BEACON,
+                                .type        = CONF_TRIG_EVENT_TYPE_EDGE,
+                                .direction   = CONF_TRIG_EVENT_DIR_HIGH,
+                                .hysteresis  = 2,
+                                .index       = 1,
+                                .enable      = 1
+                        }
+                },
+                .sig_weights = {
+                        .rssi_bcn_avg_weight = 10,
+                        .rssi_pkt_avg_weight = 10,
+                        .snr_bcn_avg_weight  = 10,
+                        .snr_pkt_avg_weight  = 10
+                },
+                .bet_enable                  = CONF_BET_MODE_ENABLE,
+                .bet_max_consecutive         = 10,
+                .psm_entry_retries           = 3
+        },
+        .init = {
+                .radioparam = {
+                        .fem                 = 1,
+                }
+        },
+        .itrim = {
+                .enable = false,
+                .timeout = 50000,
+        },
+        .pm_config = {
+                .host_clk_settling_time = 5000,
+                .host_fast_wakeup_support = false
+        }
+};
+
+static LIST_HEAD(wl_list);
+
+static void wl1271_conf_init(struct wl1271 *wl)
+{
+
+        /*
+         * This function applies the default configuration to the driver. This
+         * function is invoked upon driver load (spi probe.)
+         *
+         * The configuration is stored in a run-time structure in order to
+         * facilitate for run-time adjustment of any of the parameters. Making
+         * changes to the configuration structure will apply the new values on
+         * the next interface up (wl1271_op_start.)
+         */
+
+        /* apply driver default configuration */
+        memcpy(&wl->conf, &default_conf, sizeof(default_conf));
+}
+
 
 static int wl1271_plt_init(struct wl1271 *wl)
 {
-        int ret;
+        struct conf_tx_ac_category *conf_ac;
+        struct conf_tx_tid *conf_tid;
+        int ret, i;
 
-        ret = wl1271_acx_init_mem_config(wl);
+        ret = wl1271_cmd_general_parms(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_cmd_radio_parms(wl);
         if (ret < 0)
                 return ret;
 
-        ret = wl1271_cmd_data_path(wl, wl->channel, 1);
+        ret = wl1271_init_templates_config(wl);
         if (ret < 0)
                 return ret;
 
+        ret = wl1271_acx_init_mem_config(wl);
+        if (ret < 0)
+                return ret;
+
+        /* PHY layer config */
+        ret = wl1271_init_phy_config(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        ret = wl1271_acx_dco_itrim_params(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Initialize connection monitoring thresholds */
+        ret = wl1271_acx_conn_monit_params(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Bluetooth WLAN coexistence */
+        ret = wl1271_init_pta(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Energy detection */
+        ret = wl1271_init_energy_detection(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Default fragmentation threshold */
+        ret = wl1271_acx_frag_threshold(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Default TID configuration */
+        for (i = 0; i < wl->conf.tx.tid_conf_count; i++) {
+                conf_tid = &wl->conf.tx.tid_conf[i];
+                ret = wl1271_acx_tid_cfg(wl, conf_tid->queue_id,
+                                         conf_tid->channel_type,
+                                         conf_tid->tsid,
+                                         conf_tid->ps_scheme,
+                                         conf_tid->ack_policy,
+                                         conf_tid->apsd_conf[0],
+                                         conf_tid->apsd_conf[1]);
+                if (ret < 0)
+                        goto out_free_memmap;
+        }
+
+        /* Default AC configuration */
+        for (i = 0; i < wl->conf.tx.ac_conf_count; i++) {
+                conf_ac = &wl->conf.tx.ac_conf[i];
+                ret = wl1271_acx_ac_cfg(wl, conf_ac->ac, conf_ac->cw_min,
+                                        conf_ac->cw_max, conf_ac->aifsn,
+                                        conf_ac->tx_op_limit);
+                if (ret < 0)
+                        goto out_free_memmap;
+        }
+
+        /* Enable data path */
+        ret = wl1271_cmd_data_path(wl, 1);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Configure for CAM power saving (ie. always active) */
+        ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_CAM);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* configure PM */
+        ret = wl1271_acx_pm_config(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
         return 0;
+
+ out_free_memmap:
+        kfree(wl->target_mem_map);
+        wl->target_mem_map = NULL;
+
+        return ret;
 }
 
 static void wl1271_disable_interrupts(struct wl1271 *wl)
@@ -68,27 +373,22 @@ static void wl1271_disable_interrupts(struct wl1271 *wl)
 static void wl1271_power_off(struct wl1271 *wl)
 {
         wl->set_power(false);
+        clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
 }
 
 static void wl1271_power_on(struct wl1271 *wl)
 {
         wl->set_power(true);
+        set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
 }
 
-static void wl1271_fw_status(struct wl1271 *wl, struct wl1271_fw_status *status)
+static void wl1271_fw_status(struct wl1271 *wl,
+                             struct wl1271_fw_status *status)
 {
         u32 total = 0;
         int i;
 
-        /*
-         * FIXME: Reading the FW status directly from the registers seems to
-         * be the right thing to do, but it doesn't work.  And in the
-         * reference driver, there is a workaround called
-         * USE_SDIO_24M_WORKAROUND, which reads the status from memory
-         * instead, so we do the same here.
-         */
-
-        wl1271_spi_mem_read(wl, STATUS_MEM_ADDRESS, status, sizeof(*status));
+        wl1271_read(wl, FW_STATUS_ADDR, status, sizeof(*status), false);
 
         wl1271_debug(DEBUG_IRQ, "intr: 0x%x (fw_rx_counter = %d, "
                      "drv_rx_counter = %d, tx_results_counter = %d)",
@@ -99,25 +399,28 @@ static void wl1271_fw_status(struct wl1271 *wl, struct wl1271_fw_status *status)
 
         /* update number of available TX blocks */
         for (i = 0; i < NUM_TX_QUEUES; i++) {
-                u32 cnt = status->tx_released_blks[i] - wl->tx_blocks_freed[i];
-                wl->tx_blocks_freed[i] = status->tx_released_blks[i];
+                u32 cnt = le32_to_cpu(status->tx_released_blks[i]) -
+                        wl->tx_blocks_freed[i];
+
+                wl->tx_blocks_freed[i] =
+                        le32_to_cpu(status->tx_released_blks[i]);
                 wl->tx_blocks_available += cnt;
                 total += cnt;
         }
 
         /* if more blocks are available now, schedule some tx work */
         if (total && !skb_queue_empty(&wl->tx_queue))
-                schedule_work(&wl->tx_work);
+                ieee80211_queue_work(wl->hw, &wl->tx_work);
 
         /* update the host-chipset time offset */
-        wl->time_offset = jiffies_to_usecs(jiffies) - status->fw_localtime;
+        wl->time_offset = jiffies_to_usecs(jiffies) -
+                le32_to_cpu(status->fw_localtime);
 }
 
-#define WL1271_IRQ_MAX_LOOPS 10
 static void wl1271_irq_work(struct work_struct *work)
 {
-        u32 intr, ctr = WL1271_IRQ_MAX_LOOPS;
         int ret;
+        u32 intr;
         struct wl1271 *wl =
                 container_of(work, struct wl1271, irq_work);
 
@@ -132,9 +435,10 @@ static void wl1271_irq_work(struct work_struct *work)
         if (ret < 0)
                 goto out;
 
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
+        wl1271_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
 
-        intr = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_CLEAR);
+        wl1271_fw_status(wl, wl->fw_status);
+        intr = le32_to_cpu(wl->fw_status->intr);
         if (!intr) {
                 wl1271_debug(DEBUG_IRQ, "Zero interrupt received.");
                 goto out_sleep;
@@ -142,47 +446,39 @@ static void wl1271_irq_work(struct work_struct *work)
 
         intr &= WL1271_INTR_MASK;
 
-        do {
-                wl1271_fw_status(wl, wl->fw_status);
-
+        if (intr & WL1271_ACX_INTR_EVENT_A) {
+                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_A");
+                wl1271_event_handle(wl, 0);
+        }
 
-                if (intr & (WL1271_ACX_INTR_EVENT_A |
-                            WL1271_ACX_INTR_EVENT_B)) {
-                        wl1271_debug(DEBUG_IRQ,
-                                     "WL1271_ACX_INTR_EVENT (0x%x)", intr);
-                        if (intr & WL1271_ACX_INTR_EVENT_A)
-                                wl1271_event_handle(wl, 0);
-                        else
-                                wl1271_event_handle(wl, 1);
-                }
+        if (intr & WL1271_ACX_INTR_EVENT_B) {
+                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_B");
+                wl1271_event_handle(wl, 1);
+        }
 
-                if (intr & WL1271_ACX_INTR_INIT_COMPLETE)
-                        wl1271_debug(DEBUG_IRQ,
-                                     "WL1271_ACX_INTR_INIT_COMPLETE");
+        if (intr & WL1271_ACX_INTR_INIT_COMPLETE)
+                wl1271_debug(DEBUG_IRQ,
+                             "WL1271_ACX_INTR_INIT_COMPLETE");
 
-                if (intr & WL1271_ACX_INTR_HW_AVAILABLE)
-                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_HW_AVAILABLE");
+        if (intr & WL1271_ACX_INTR_HW_AVAILABLE)
+                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_HW_AVAILABLE");
 
-                if (intr & WL1271_ACX_INTR_DATA) {
-                        u8 tx_res_cnt = wl->fw_status->tx_results_counter -
-                                wl->tx_results_count;
+        if (intr & WL1271_ACX_INTR_DATA) {
+                u8 tx_res_cnt = wl->fw_status->tx_results_counter -
+                        wl->tx_results_count;
 
-                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_DATA");
+                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_DATA");
 
-                        /* check for tx results */
-                        if (tx_res_cnt)
-                                wl1271_tx_complete(wl, tx_res_cnt);
+                /* check for tx results */
+                if (tx_res_cnt)
+                        wl1271_tx_complete(wl, tx_res_cnt);
 
-                        wl1271_rx(wl, wl->fw_status);
-                }
-
-                intr = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_CLEAR);
-                intr &= WL1271_INTR_MASK;
-        } while (intr && --ctr);
+                wl1271_rx(wl, wl->fw_status);
+        }
 
 out_sleep:
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
-                           WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
+        wl1271_write32(wl, ACX_REG_INTERRUPT_MASK,
+                       WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
         wl1271_ps_elp_sleep(wl);
 
 out:
@@ -205,7 +501,7 @@ static irqreturn_t wl1271_irq(int irq, void *cookie)
                 wl->elp_compl = NULL;
         }
 
-        schedule_work(&wl->irq_work);
+        ieee80211_queue_work(wl->hw, &wl->irq_work);
         spin_unlock_irqrestore(&wl->wl_lock, flags);
 
         return IRQ_HANDLED;
@@ -231,7 +527,7 @@ static int wl1271_fetch_firmware(struct wl1271 *wl)
         }
 
         wl->fw_len = fw->size;
-        wl->fw = kmalloc(wl->fw_len, GFP_KERNEL);
+        wl->fw = vmalloc(wl->fw_len);
 
         if (!wl->fw) {
                 wl1271_error("could not allocate memory for the firmware");
@@ -249,6 +545,40 @@ out:
         return ret;
 }
 
+static int wl1271_update_mac_addr(struct wl1271 *wl)
+{
+        int ret = 0;
+        u8 *nvs_ptr = (u8 *)wl->nvs->nvs;
+
+        /* get mac address from the NVS */
+        wl->mac_addr[0] = nvs_ptr[11];
+        wl->mac_addr[1] = nvs_ptr[10];
+        wl->mac_addr[2] = nvs_ptr[6];
+        wl->mac_addr[3] = nvs_ptr[5];
+        wl->mac_addr[4] = nvs_ptr[4];
+        wl->mac_addr[5] = nvs_ptr[3];
+
+        /* FIXME: if it is a zero-address, we should bail out. Now, instead,
+           we randomize an address */
+        if (is_zero_ether_addr(wl->mac_addr)) {
+                static const u8 nokia_oui[3] = {0x00, 0x1f, 0xdf};
+                memcpy(wl->mac_addr, nokia_oui, 3);
+                get_random_bytes(wl->mac_addr + 3, 3);
+
+                /* update this address to the NVS */
+                nvs_ptr[11] = wl->mac_addr[0];
+                nvs_ptr[10] = wl->mac_addr[1];
+                nvs_ptr[6] = wl->mac_addr[2];
+                nvs_ptr[5] = wl->mac_addr[3];
+                nvs_ptr[4] = wl->mac_addr[4];
+                nvs_ptr[3] = wl->mac_addr[5];
+        }
+
+        SET_IEEE80211_PERM_ADDR(wl->hw, wl->mac_addr);
+
+        return ret;
+}
+
 static int wl1271_fetch_nvs(struct wl1271 *wl)
 {
         const struct firmware *fw;
@@ -261,15 +591,14 @@ static int wl1271_fetch_nvs(struct wl1271 *wl)
                 return ret;
         }
 
-        if (fw->size % 4) {
-                wl1271_error("nvs size is not multiple of 32 bits: %zu",
-                             fw->size);
+        if (fw->size != sizeof(struct wl1271_nvs_file)) {
+                wl1271_error("nvs size is not as expected: %zu != %zu",
+                             fw->size, sizeof(struct wl1271_nvs_file));
                 ret = -EILSEQ;
                 goto out;
         }
 
-        wl->nvs_len = fw->size;
-        wl->nvs = kmalloc(wl->nvs_len, GFP_KERNEL);
+        wl->nvs = kmalloc(sizeof(struct wl1271_nvs_file), GFP_KERNEL);
 
         if (!wl->nvs) {
                 wl1271_error("could not allocate memory for the nvs file");
@@ -277,9 +606,9 @@ static int wl1271_fetch_nvs(struct wl1271 *wl)
                 goto out;
         }
 
-        memcpy(wl->nvs, fw->data, wl->nvs_len);
+        memcpy(wl->nvs, fw->data, sizeof(struct wl1271_nvs_file));
 
-        ret = 0;
+        ret = wl1271_update_mac_addr(wl);
 
 out:
         release_firmware(fw);
@@ -292,7 +621,7 @@ static void wl1271_fw_wakeup(struct wl1271 *wl)
         u32 elp_reg;
 
         elp_reg = ELPCTRL_WAKE_UP;
-        wl1271_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, elp_reg);
+        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, elp_reg);
 }
 
 static int wl1271_setup(struct wl1271 *wl)
@@ -314,20 +643,21 @@ static int wl1271_setup(struct wl1271 *wl)
 
 static int wl1271_chip_wakeup(struct wl1271 *wl)
 {
+        struct wl1271_partition_set partition;
         int ret = 0;
 
+        msleep(WL1271_PRE_POWER_ON_SLEEP);
         wl1271_power_on(wl);
         msleep(WL1271_POWER_ON_SLEEP);
-        wl1271_spi_reset(wl);
-        wl1271_spi_init(wl);
+        wl1271_io_reset(wl);
+        wl1271_io_init(wl);
 
         /* We don't need a real memory partition here, because we only want
          * to use the registers at this point. */
-        wl1271_set_partition(wl,
-                             0x00000000,
-                             0x00000000,
-                             REGISTERS_BASE,
-                             REGISTERS_DOWN_SIZE);
+        memset(&partition, 0, sizeof(partition));
+        partition.reg.start = REGISTERS_BASE;
+        partition.reg.size = REGISTERS_DOWN_SIZE;
+        wl1271_set_partition(wl, &partition);
 
         /* ELP module wake up */
         wl1271_fw_wakeup(wl);
@@ -335,7 +665,7 @@ static int wl1271_chip_wakeup(struct wl1271 *wl)
         /* whal_FwCtrl_BootSm() */
 
         /* 0. read chip id from CHIP_ID */
-        wl->chip.id = wl1271_reg_read32(wl, CHIP_ID_B);
+        wl->chip.id = wl1271_read32(wl, CHIP_ID_B);
 
         /* 1. check if chip id is valid */
 
@@ -357,7 +687,7 @@ static int wl1271_chip_wakeup(struct wl1271 *wl)
                         goto out;
                 break;
         default:
-                wl1271_error("unsupported chip id: 0x%x", wl->chip.id);
+                wl1271_warning("unsupported chip id: 0x%x", wl->chip.id);
                 ret = -ENODEV;
                 goto out;
         }
@@ -379,35 +709,9 @@ out:
         return ret;
 }
 
-static void wl1271_filter_work(struct work_struct *work)
-{
-        struct wl1271 *wl =
-                container_of(work, struct wl1271, filter_work);
-        int ret;
-
-        mutex_lock(&wl->mutex);
-
-        if (wl->state == WL1271_STATE_OFF)
-                goto out;
-
-        ret = wl1271_ps_elp_wakeup(wl, false);
-        if (ret < 0)
-                goto out;
-
-        /* FIXME: replace the magic numbers with proper definitions */
-        ret = wl1271_cmd_join(wl, wl->bss_type, 1, 100, 0);
-        if (ret < 0)
-                goto out_sleep;
-
-out_sleep:
-        wl1271_ps_elp_sleep(wl);
-
-out:
-        mutex_unlock(&wl->mutex);
-}
-
 int wl1271_plt_start(struct wl1271 *wl)
 {
+        int retries = WL1271_BOOT_RETRIES;
         int ret;
 
         mutex_lock(&wl->mutex);
@@ -421,22 +725,43 @@ int wl1271_plt_start(struct wl1271 *wl)
                 goto out;
         }
 
-        wl->state = WL1271_STATE_PLT;
-
-        ret = wl1271_chip_wakeup(wl);
-        if (ret < 0)
-                goto out;
+        while (retries) {
+                retries--;
+                ret = wl1271_chip_wakeup(wl);
+                if (ret < 0)
+                        goto power_off;
 
-        ret = wl1271_boot(wl);
-        if (ret < 0)
-                goto out;
+                ret = wl1271_boot(wl);
+                if (ret < 0)
+                        goto power_off;
 
-        wl1271_notice("firmware booted in PLT mode (%s)", wl->chip.fw_ver);
+                ret = wl1271_plt_init(wl);
+                if (ret < 0)
+                        goto irq_disable;
 
-        ret = wl1271_plt_init(wl);
-        if (ret < 0)
+                wl->state = WL1271_STATE_PLT;
+                wl1271_notice("firmware booted in PLT mode (%s)",
+                              wl->chip.fw_ver);
                 goto out;
 
+irq_disable:
+                wl1271_disable_interrupts(wl);
+                mutex_unlock(&wl->mutex);
+                /* Unlocking the mutex in the middle of handling is
+                   inherently unsafe. In this case we deem it safe to do,
+                   because we need to let any possibly pending IRQ out of
+                   the system (and while we are WL1271_STATE_OFF the IRQ
+                   work function will not do anything.) Also, any other
+                   possible concurrent operations will fail due to the
+                   current state, hence the wl1271 struct should be safe. */
+                cancel_work_sync(&wl->irq_work);
+                mutex_lock(&wl->mutex);
+power_off:
+                wl1271_power_off(wl);
+        }
+
+        wl1271_error("firmware boot in PLT mode failed despite %d retries",
+                     WL1271_BOOT_RETRIES);
 out:
         mutex_unlock(&wl->mutex);
 
@@ -462,6 +787,7 @@ int wl1271_plt_stop(struct wl1271 *wl)
         wl1271_power_off(wl);
 
         wl->state = WL1271_STATE_OFF;
+        wl->rx_counter = 0;
 
 out:
         mutex_unlock(&wl->mutex);
@@ -473,7 +799,20 @@ out:
 static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct wl1271 *wl = hw->priv;
+        struct ieee80211_conf *conf = &hw->conf;
+        struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
+        struct ieee80211_sta *sta = txinfo->control.sta;
+        unsigned long flags;
 
+        /* peek into the rates configured in the STA entry */
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        if (sta && sta->supp_rates[conf->channel->band] != wl->sta_rate_set) {
+                wl->sta_rate_set = sta->supp_rates[conf->channel->band];
+                set_bit(WL1271_FLAG_STA_RATES_CHANGED, &wl->flags);
+        }
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+
+        /* queue the packet */
         skb_queue_tail(&wl->tx_queue, skb);
 
         /*
@@ -481,7 +820,7 @@ static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          * before that, the tx_work will not be initialized!
          */
 
-        schedule_work(&wl->tx_work);
+        ieee80211_queue_work(wl->hw, &wl->tx_work);
 
         /*
          * The workqueue is slow to process the tx_queue and we need stop
@@ -495,15 +834,103 @@ static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                  * protected. Maybe fix this by removing the stupid
                  * variable altogether and checking the real queue state?
                  */
-                wl->tx_queue_stopped = true;
+                set_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags);
         }
 
         return NETDEV_TX_OK;
 }
 
+static int wl1271_dev_notify(struct notifier_block *me, unsigned long what,
+                             void *arg)
+{
+        struct net_device *dev;
+        struct wireless_dev *wdev;
+        struct wiphy *wiphy;
+        struct ieee80211_hw *hw;
+        struct wl1271 *wl;
+        struct wl1271 *wl_temp;
+        struct in_device *idev;
+        struct in_ifaddr *ifa = arg;
+        int ret = 0;
+
+        /* FIXME: this ugly function should probably be implemented in the
+         * mac80211, and here should only be a simple callback handling actual
+         * setting of the filters. Now we need to dig up references to
+         * various structures to gain access to what we need.
+         * Also, because of this, there is no "initial" setting of the filter
+         * in "op_start", because we don't want to dig up struct net_device
+         * there - the filter will be set upon first change of the interface
+         * IP address. */
+
+        dev = ifa->ifa_dev->dev;
+
+        wdev = dev->ieee80211_ptr;
+        if (wdev == NULL)
+                return NOTIFY_DONE;
+
+        wiphy = wdev->wiphy;
+        if (wiphy == NULL)
+                return NOTIFY_DONE;
+
+        hw = wiphy_priv(wiphy);
+        if (hw == NULL)
+                return NOTIFY_DONE;
+
+        /* Check that the interface is one supported by this driver. */
+        wl_temp = hw->priv;
+        list_for_each_entry(wl, &wl_list, list) {
+                if (wl == wl_temp)
+                        break;
+        }
+        if (wl == NULL)
+                return NOTIFY_DONE;
+
+        /* Get the interface IP address for the device. "ifa" will become
+           NULL if:
+             - there is no IPV4 protocol address configured
+             - there are multiple (virtual) IPV4 addresses configured
+           When "ifa" is NULL, filtering will be disabled.
+        */
+        ifa = NULL;
+        idev = dev->ip_ptr;
+        if (idev)
+                ifa = idev->ifa_list;
+
+        if (ifa && ifa->ifa_next)
+                ifa = NULL;
+
+        mutex_lock(&wl->mutex);
+
+        if (wl->state == WL1271_STATE_OFF)
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+        if (ifa)
+                ret = wl1271_acx_arp_ip_filter(wl, true,
+                                               (u8 *)&ifa->ifa_address,
+                                               ACX_IPV4_VERSION);
+        else
+                ret = wl1271_acx_arp_ip_filter(wl, false, NULL,
+                                               ACX_IPV4_VERSION);
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block wl1271_dev_notifier = {
+        .notifier_call = wl1271_dev_notify,
+};
+
+
 static int wl1271_op_start(struct ieee80211_hw *hw)
 {
         struct wl1271 *wl = hw->priv;
+        int retries = WL1271_BOOT_RETRIES;
         int ret = 0;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 start");
@@ -517,28 +944,50 @@ static int wl1271_op_start(struct ieee80211_hw *hw)
                 goto out;
         }
 
-        ret = wl1271_chip_wakeup(wl);
-        if (ret < 0)
-                goto out;
-
-        ret = wl1271_boot(wl);
-        if (ret < 0)
-                goto out;
+        while (retries) {
+                retries--;
+                ret = wl1271_chip_wakeup(wl);
+                if (ret < 0)
+                        goto power_off;
 
-        ret = wl1271_hw_init(wl);
-        if (ret < 0)
-                goto out;
+                ret = wl1271_boot(wl);
+                if (ret < 0)
+                        goto power_off;
 
-        wl->state = WL1271_STATE_ON;
+                ret = wl1271_hw_init(wl);
+                if (ret < 0)
+                        goto irq_disable;
 
-        wl1271_info("firmware booted (%s)", wl->chip.fw_ver);
+                wl->state = WL1271_STATE_ON;
+                wl1271_info("firmware booted (%s)", wl->chip.fw_ver);
+                goto out;
 
-out:
-        if (ret < 0)
+irq_disable:
+                wl1271_disable_interrupts(wl);
+                mutex_unlock(&wl->mutex);
+                /* Unlocking the mutex in the middle of handling is
+                   inherently unsafe. In this case we deem it safe to do,
+                   because we need to let any possibly pending IRQ out of
+                   the system (and while we are WL1271_STATE_OFF the IRQ
+                   work function will not do anything.) Also, any other
+                   possible concurrent operations will fail due to the
+                   current state, hence the wl1271 struct should be safe. */
+                cancel_work_sync(&wl->irq_work);
+                mutex_lock(&wl->mutex);
+power_off:
                 wl1271_power_off(wl);
+        }
 
+        wl1271_error("firmware boot failed despite %d retries",
+                     WL1271_BOOT_RETRIES);
+out:
         mutex_unlock(&wl->mutex);
 
+        if (!ret) {
+                list_add(&wl->list, &wl_list);
+                register_inetaddr_notifier(&wl1271_dev_notifier);
+        }
+
         return ret;
 }
 
@@ -551,15 +1000,17 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 stop");
 
+        unregister_inetaddr_notifier(&wl1271_dev_notifier);
+        list_del(&wl->list);
+
         mutex_lock(&wl->mutex);
 
         WARN_ON(wl->state != WL1271_STATE_ON);
 
-        if (wl->scanning) {
+        if (test_and_clear_bit(WL1271_FLAG_SCANNING, &wl->flags)) {
                 mutex_unlock(&wl->mutex);
                 ieee80211_scan_completed(wl->hw, true);
                 mutex_lock(&wl->mutex);
-                wl->scanning = false;
         }
 
         wl->state = WL1271_STATE_OFF;
@@ -570,7 +1021,6 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
 
         cancel_work_sync(&wl->irq_work);
         cancel_work_sync(&wl->tx_work);
-        cancel_work_sync(&wl->filter_work);
 
         mutex_lock(&wl->mutex);
 
@@ -581,19 +1031,24 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
         memset(wl->bssid, 0, ETH_ALEN);
         memset(wl->ssid, 0, IW_ESSID_MAX_SIZE + 1);
         wl->ssid_len = 0;
-        wl->listen_int = 1;
         wl->bss_type = MAX_BSS_TYPE;
+        wl->band = IEEE80211_BAND_2GHZ;
 
         wl->rx_counter = 0;
-        wl->elp = false;
-        wl->psm = 0;
-        wl->tx_queue_stopped = false;
+        wl->psm_entry_retry = 0;
         wl->power_level = WL1271_DEFAULT_POWER_LEVEL;
         wl->tx_blocks_available = 0;
         wl->tx_results_count = 0;
         wl->tx_packets_count = 0;
+        wl->tx_security_last_seq = 0;
+        wl->tx_security_seq_16 = 0;
+        wl->tx_security_seq_32 = 0;
         wl->time_offset = 0;
         wl->session_counter = 0;
+        wl->rate_set = CONF_TX_RATE_MASK_BASIC;
+        wl->sta_rate_set = 0;
+        wl->flags = 0;
+
         for (i = 0; i < NUM_TX_QUEUES; i++)
                 wl->tx_blocks_freed[i] = 0;
 
@@ -602,17 +1057,23 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
 }
 
 static int wl1271_op_add_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_if_init_conf *conf)
+                                   struct ieee80211_vif *vif)
 {
         struct wl1271 *wl = hw->priv;
         int ret = 0;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
-                     conf->type, conf->mac_addr);
+                     vif->type, vif->addr);
 
         mutex_lock(&wl->mutex);
+        if (wl->vif) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        wl->vif = vif;
 
-        switch (conf->type) {
+        switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 wl->bss_type = BSS_TYPE_STA_BSS;
                 break;
@@ -632,9 +1093,14 @@ out:
 }
 
 static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
-                                         struct ieee80211_if_init_conf *conf)
+                                         struct ieee80211_vif *vif)
 {
+        struct wl1271 *wl = hw->priv;
+
+        mutex_lock(&wl->mutex);
         wl1271_debug(DEBUG_MAC80211, "mac80211 remove interface");
+        wl->vif = NULL;
+        mutex_unlock(&wl->mutex);
 }
 
 #if 0
@@ -657,23 +1123,24 @@ static int wl1271_op_config_interface(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
-        memcpy(wl->bssid, conf->bssid, ETH_ALEN);
+        if (memcmp(wl->bssid, conf->bssid, ETH_ALEN)) {
+                wl1271_debug(DEBUG_MAC80211, "bssid changed");
 
-        ret = wl1271_cmd_build_null_data(wl);
-        if (ret < 0)
-                goto out_sleep;
+                memcpy(wl->bssid, conf->bssid, ETH_ALEN);
 
-        wl->ssid_len = conf->ssid_len;
-        if (wl->ssid_len)
-                memcpy(wl->ssid, conf->ssid, wl->ssid_len);
+                ret = wl1271_cmd_join(wl);
+                if (ret < 0)
+                        goto out_sleep;
 
-        if (wl->bss_type != BSS_TYPE_IBSS) {
-                /* FIXME: replace the magic numbers with proper definitions */
-                ret = wl1271_cmd_join(wl, wl->bss_type, 5, 100, 1);
+                ret = wl1271_cmd_build_null_data(wl);
                 if (ret < 0)
                         goto out_sleep;
         }
 
+        wl->ssid_len = conf->ssid_len;
+        if (wl->ssid_len)
+                memcpy(wl->ssid, conf->ssid, wl->ssid_len);
+
         if (conf->changed & IEEE80211_IFCC_BEACON) {
                 beacon = ieee80211_beacon_get(hw, vif);
                 ret = wl1271_cmd_template_set(wl, CMD_TEMPL_BEACON,
@@ -691,12 +1158,6 @@ static int wl1271_op_config_interface(struct ieee80211_hw *hw,
 
                 if (ret < 0)
                         goto out_sleep;
-
-                /* FIXME: replace the magic numbers with proper definitions */
-                ret = wl1271_cmd_join(wl, wl->bss_type, 1, 100, 0);
-
-                if (ret < 0)
-                        goto out_sleep;
         }
 
 out_sleep:
@@ -709,6 +1170,51 @@ out:
 }
 #endif
 
+static int wl1271_join_channel(struct wl1271 *wl, int channel)
+{
+        int ret = 0;
+        /* we need to use a dummy BSSID for now */
+        static const u8 dummy_bssid[ETH_ALEN] = { 0x0b, 0xad, 0xde,
+                                                  0xad, 0xbe, 0xef };
+
+        /* the dummy join is not required for ad-hoc */
+        if (wl->bss_type == BSS_TYPE_IBSS)
+                goto out;
+
+        /* disable mac filter, so we hear everything */
+        wl->rx_config &= ~CFG_BSSID_FILTER_EN;
+
+        wl->channel = channel;
+        memcpy(wl->bssid, dummy_bssid, ETH_ALEN);
+
+        ret = wl1271_cmd_join(wl);
+        if (ret < 0)
+                goto out;
+
+        set_bit(WL1271_FLAG_JOINED, &wl->flags);
+
+out:
+        return ret;
+}
+
+static int wl1271_unjoin_channel(struct wl1271 *wl)
+{
+        int ret;
+
+        /* to stop listening to a channel, we disconnect */
+        ret = wl1271_cmd_disconnect(wl);
+        if (ret < 0)
+                goto out;
+
+        clear_bit(WL1271_FLAG_JOINED, &wl->flags);
+        wl->channel = 0;
+        memset(wl->bssid, 0, ETH_ALEN);
+        wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
+
+out:
+        return ret;
+}
+
 static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct wl1271 *wl = hw->priv;
@@ -717,58 +1223,75 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
 
         channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
 
-        wl1271_debug(DEBUG_MAC80211, "mac80211 config ch %d psm %s power %d",
+        wl1271_debug(DEBUG_MAC80211, "mac80211 config ch %d psm %s power %d %s",
                      channel,
                      conf->flags & IEEE80211_CONF_PS ? "on" : "off",
-                     conf->power_level);
+                     conf->power_level,
+                     conf->flags & IEEE80211_CONF_IDLE ? "idle" : "in use");
 
         mutex_lock(&wl->mutex);
 
+        wl->band = conf->channel->band;
+
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
                 goto out;
 
-        if (channel != wl->channel) {
-                u8 old_channel = wl->channel;
-                wl->channel = channel;
-
-                /* FIXME: use beacon interval provided by mac80211 */
-                ret = wl1271_cmd_join(wl, wl->bss_type, 1, 100, 0);
-                if (ret < 0) {
-                        wl->channel = old_channel;
-                        goto out_sleep;
+        if (changed & IEEE80211_CONF_CHANGE_IDLE) {
+                if (conf->flags & IEEE80211_CONF_IDLE &&
+                    test_bit(WL1271_FLAG_JOINED, &wl->flags))
+                        wl1271_unjoin_channel(wl);
+                else if (!(conf->flags & IEEE80211_CONF_IDLE))
+                        wl1271_join_channel(wl, channel);
+
+                if (conf->flags & IEEE80211_CONF_IDLE) {
+                        wl->rate_set = CONF_TX_RATE_MASK_BASIC;
+                        wl->sta_rate_set = 0;
+                        wl1271_acx_rate_policies(wl);
                 }
         }
 
-        ret = wl1271_cmd_build_null_data(wl);
-        if (ret < 0)
-                goto out_sleep;
-
-        if (conf->flags & IEEE80211_CONF_PS && !wl->psm_requested) {
-                wl1271_info("psm enabled");
+        /* if the channel changes while joined, join again */
+        if (channel != wl->channel &&
+            test_bit(WL1271_FLAG_JOINED, &wl->flags)) {
+                wl->channel = channel;
+                /* FIXME: maybe use CMD_CHANNEL_SWITCH for this? */
+                ret = wl1271_cmd_join(wl);
+                if (ret < 0)
+                        wl1271_warning("cmd join to update channel failed %d",
+                                       ret);
+        } else
+                wl->channel = channel;
 
-                wl->psm_requested = true;
+        if (conf->flags & IEEE80211_CONF_PS &&
+            !test_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags)) {
+                set_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags);
 
                 /*
                  * We enter PSM only if we're already associated.
                  * If we're not, we'll enter it when joining an SSID,
                  * through the bss_info_changed() hook.
                  */
-                ret = wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE);
+                if (test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags)) {
+                        wl1271_info("psm enabled");
+                        ret = wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE,
+                                                 true);
+                }
         } else if (!(conf->flags & IEEE80211_CONF_PS) &&
-                   wl->psm_requested) {
+                   test_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags)) {
                 wl1271_info("psm disabled");
 
-                wl->psm_requested = false;
+                clear_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags);
 
-                if (wl->psm)
-                        ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE);
+                if (test_bit(WL1271_FLAG_PSM, &wl->flags))
+                        ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE,
+                                                 true);
         }
 
         if (conf->power_level != wl->power_level) {
                 ret = wl1271_acx_tx_power(wl, conf->power_level);
                 if (ret < 0)
-                        goto out;
+                        goto out_sleep;
 
                 wl->power_level = conf->power_level;
         }
@@ -782,6 +1305,45 @@ out:
         return ret;
 }
 
+struct wl1271_filter_params {
+        bool enabled;
+        int mc_list_length;
+        u8 mc_list[ACX_MC_ADDRESS_GROUP_MAX][ETH_ALEN];
+};
+
+static u64 wl1271_op_prepare_multicast(struct ieee80211_hw *hw, int mc_count,
+                                       struct dev_addr_list *mc_list)
+{
+        struct wl1271_filter_params *fp;
+        int i;
+
+        fp = kzalloc(sizeof(*fp), GFP_ATOMIC);
+        if (!fp) {
+                wl1271_error("Out of memory setting filters.");
+                return 0;
+        }
+
+        /* update multicast filtering parameters */
+        fp->enabled = true;
+        if (mc_count > ACX_MC_ADDRESS_GROUP_MAX) {
+                mc_count = 0;
+                fp->enabled = false;
+        }
+
+        fp->mc_list_length = 0;
+        for (i = 0; i < mc_count; i++) {
+                if (mc_list->da_addrlen == ETH_ALEN) {
+                        memcpy(fp->mc_list[fp->mc_list_length],
+                               mc_list->da_addr, ETH_ALEN);
+                        fp->mc_list_length++;
+                } else
+                        wl1271_warning("Unknown mc address length.");
+                mc_list = mc_list->next;
+        }
+
+        return (u64)(unsigned long)fp;
+}
+
 #define WL1271_SUPPORTED_FILTERS (FIF_PROMISC_IN_BSS | \
                                   FIF_ALLMULTI | \
                                   FIF_FCSFAIL | \
@@ -791,28 +1353,53 @@ out:
 
 static void wl1271_op_configure_filter(struct ieee80211_hw *hw,
                                        unsigned int changed,
-                                       unsigned int *total,u64 multicast)
+                                       unsigned int *total, u64 multicast)
 {
+        struct wl1271_filter_params *fp = (void *)(unsigned long)multicast;
         struct wl1271 *wl = hw->priv;
+        int ret;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 configure filter");
 
+        mutex_lock(&wl->mutex);
+
+        if (wl->state == WL1271_STATE_OFF)
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
         *total &= WL1271_SUPPORTED_FILTERS;
         changed &= WL1271_SUPPORTED_FILTERS;
 
+        if (*total & FIF_ALLMULTI)
+                ret = wl1271_acx_group_address_tbl(wl, false, NULL, 0);
+        else if (fp)
+                ret = wl1271_acx_group_address_tbl(wl, fp->enabled,
+                                                   fp->mc_list,
+                                                   fp->mc_list_length);
+        if (ret < 0)
+                goto out_sleep;
+
+        kfree(fp);
+
+        /* FIXME: We still need to set our filters properly */
+
+        /* determine, whether supported filter values have changed */
         if (changed == 0)
-                return;
+                goto out_sleep;
 
-        /* FIXME: wl->rx_config and wl->rx_filter are not protected */
-        wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
-        wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
+        /* apply configured filters */
+        ret = wl1271_acx_rx_config(wl, wl->rx_config, wl->rx_filter);
+        if (ret < 0)
+                goto out_sleep;
 
-        /*
-         * FIXME: workqueues need to be properly cancelled on stop(), for
-         * now let's just disable changing the filter settings. They will
-         * be updated any on config().
-         */
-        /* schedule_work(&wl->filter_work); */
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
 }
 
 static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -823,6 +1410,8 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         struct wl1271 *wl = hw->priv;
         const u8 *addr;
         int ret;
+        u32 tx_seq_32 = 0;
+        u16 tx_seq_16 = 0;
         u8 key_type;
 
         static const u8 bcast_addr[ETH_ALEN] =
@@ -861,11 +1450,15 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 key_type = KEY_TKIP;
 
                 key_conf->hw_key_idx = key_conf->keyidx;
+                tx_seq_32 = wl->tx_security_seq_32;
+                tx_seq_16 = wl->tx_security_seq_16;
                 break;
         case ALG_CCMP:
                 key_type = KEY_AES;
 
                 key_conf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+                tx_seq_32 = wl->tx_security_seq_32;
+                tx_seq_16 = wl->tx_security_seq_16;
                 break;
         default:
                 wl1271_error("Unknown key algo 0x%x", key_conf->alg);
@@ -879,18 +1472,33 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 ret = wl1271_cmd_set_key(wl, KEY_ADD_OR_REPLACE,
                                          key_conf->keyidx, key_type,
                                          key_conf->keylen, key_conf->key,
-                                         addr);
+                                         addr, tx_seq_32, tx_seq_16);
                 if (ret < 0) {
                         wl1271_error("Could not add or replace key");
                         goto out_sleep;
                 }
+
+                /* the default WEP key needs to be configured at least once */
+                if (key_type == KEY_WEP) {
+                        ret = wl1271_cmd_set_default_wep_key(wl,
+                                                             wl->default_key);
+                        if (ret < 0)
+                                goto out_sleep;
+                }
                 break;
 
         case DISABLE_KEY:
+                /* The wl1271 does not allow to remove unicast keys - they
+                   will be cleared automatically on next CMD_JOIN. Ignore the
+                   request silently, as we dont want the mac80211 to emit
+                   an error message. */
+                if (!is_broadcast_ether_addr(addr))
+                        break;
+
                 ret = wl1271_cmd_set_key(wl, KEY_REMOVE,
                                          key_conf->keyidx, key_type,
                                          key_conf->keylen, key_conf->key,
-                                         addr);
+                                         addr, 0, 0);
                 if (ret < 0) {
                         wl1271_error("Could not remove key");
                         goto out_sleep;
@@ -921,13 +1529,13 @@ static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
         struct wl1271 *wl = hw->priv;
         int ret;
         u8 *ssid = NULL;
-        size_t ssid_len = 0;
+        size_t len = 0;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 hw scan");
 
         if (req->n_ssids) {
                 ssid = req->ssids[0].ssid;
-                ssid_len = req->ssids[0].ssid_len;
+                len = req->ssids[0].ssid_len;
         }
 
         mutex_lock(&wl->mutex);
@@ -936,7 +1544,12 @@ static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
-        ret = wl1271_cmd_scan(hw->priv, ssid, ssid_len, 1, 0, 13, 3);
+        if (wl1271_11a_enabled())
+                ret = wl1271_cmd_scan(hw->priv, ssid, len, 1, 0,
+                                      WL1271_SCAN_BAND_DUAL, 3);
+        else
+                ret = wl1271_cmd_scan(hw->priv, ssid, len, 1, 0,
+                                      WL1271_SCAN_BAND_2_4_GHZ, 3);
 
         wl1271_ps_elp_sleep(wl);
 
@@ -969,6 +1582,23 @@ out:
         return ret;
 }
 
+static void wl1271_ssid_set(struct wl1271 *wl, struct sk_buff *beacon)
+{
+        u8 *ptr = beacon->data +
+                offsetof(struct ieee80211_mgmt, u.beacon.variable);
+
+        /* find the location of the ssid in the beacon */
+        while (ptr < beacon->data + beacon->len) {
+                if (ptr[0] == WLAN_EID_SSID) {
+                        wl->ssid_len = ptr[1];
+                        memcpy(wl->ssid, ptr+2, wl->ssid_len);
+                        return;
+                }
+                ptr += ptr[1];
+        }
+        wl1271_error("ad-hoc beacon template has no SSID!\n");
+}
+
 static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                                        struct ieee80211_vif *vif,
                                        struct ieee80211_bss_conf *bss_conf,
@@ -976,6 +1606,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
 {
         enum wl1271_cmd_ps_mode mode;
         struct wl1271 *wl = hw->priv;
+        bool do_join = false;
         int ret;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 bss info changed");
@@ -986,10 +1617,74 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
+        if (wl->bss_type == BSS_TYPE_IBSS) {
+                /* FIXME: This implements rudimentary ad-hoc support -
+                   proper templates are on the wish list and notification
+                   on when they change. This patch will update the templates
+                   on every call to this function. */
+                struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
+
+                if (beacon) {
+                        struct ieee80211_hdr *hdr;
+
+                        wl1271_ssid_set(wl, beacon);
+                        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_BEACON,
+                                                      beacon->data,
+                                                      beacon->len);
+
+                        if (ret < 0) {
+                                dev_kfree_skb(beacon);
+                                goto out_sleep;
+                        }
+
+                        hdr = (struct ieee80211_hdr *) beacon->data;
+                        hdr->frame_control = cpu_to_le16(
+                                IEEE80211_FTYPE_MGMT |
+                                IEEE80211_STYPE_PROBE_RESP);
+
+                        ret = wl1271_cmd_template_set(wl,
+                                                      CMD_TEMPL_PROBE_RESPONSE,
+                                                      beacon->data,
+                                                      beacon->len);
+                        dev_kfree_skb(beacon);
+                        if (ret < 0)
+                                goto out_sleep;
+
+                        /* Need to update the SSID (for filtering etc) */
+                        do_join = true;
+                }
+        }
+
+        if ((changed & BSS_CHANGED_BSSID) &&
+            /*
+             * Now we know the correct bssid, so we send a new join command
+             * and enable the BSSID filter
+             */
+            memcmp(wl->bssid, bss_conf->bssid, ETH_ALEN)) {
+                        wl->rx_config |= CFG_BSSID_FILTER_EN;
+                        memcpy(wl->bssid, bss_conf->bssid, ETH_ALEN);
+                        ret = wl1271_cmd_build_null_data(wl);
+                        if (ret < 0) {
+                                wl1271_warning("cmd buld null data failed %d",
+                                               ret);
+                                goto out_sleep;
+                        }
+
+                        /* Need to update the BSSID (for filtering etc) */
+                        do_join = true;
+        }
+
         if (changed & BSS_CHANGED_ASSOC) {
                 if (bss_conf->assoc) {
                         wl->aid = bss_conf->aid;
-
+                        set_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags);
+
+                        /*
+                         * with wl1271, we don't need to update the
+                         * beacon_int and dtim_period, because the firmware
+                         * updates it by itself when the first beacon is
+                         * received after a join.
+                         */
                         ret = wl1271_cmd_build_ps_poll(wl, wl->aid);
                         if (ret < 0)
                                 goto out_sleep;
@@ -999,14 +1694,21 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                                 goto out_sleep;
 
                         /* If we want to go in PSM but we're not there yet */
-                        if (wl->psm_requested && !wl->psm) {
+                        if (test_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags) &&
+                            !test_bit(WL1271_FLAG_PSM, &wl->flags)) {
                                 mode = STATION_POWER_SAVE_MODE;
-                                ret = wl1271_ps_set_mode(wl, mode);
+                                ret = wl1271_ps_set_mode(wl, mode, true);
                                 if (ret < 0)
                                         goto out_sleep;
                         }
+                } else {
+                        /* use defaults when not associated */
+                        clear_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags);
+                        wl->aid = 0;
                 }
+
         }
+
         if (changed & BSS_CHANGED_ERP_SLOT) {
                 if (bss_conf->use_short_slot)
                         ret = wl1271_acx_slot(wl, SLOT_TIME_SHORT);
@@ -1036,72 +1738,118 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
+        if (do_join) {
+                ret = wl1271_cmd_join(wl);
+                if (ret < 0) {
+                        wl1271_warning("cmd join failed %d", ret);
+                        goto out_sleep;
+                }
+                set_bit(WL1271_FLAG_JOINED, &wl->flags);
+        }
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+static int wl1271_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
+                             const struct ieee80211_tx_queue_params *params)
+{
+        struct wl1271 *wl = hw->priv;
+        int ret;
+
+        mutex_lock(&wl->mutex);
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 conf tx %d", queue);
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
+        ret = wl1271_acx_ac_cfg(wl, wl1271_tx_get_queue(queue),
+                                params->cw_min, params->cw_max,
+                                params->aifs, params->txop);
+        if (ret < 0)
+                goto out_sleep;
+
+        ret = wl1271_acx_tid_cfg(wl, wl1271_tx_get_queue(queue),
+                                 CONF_CHANNEL_TYPE_EDCF,
+                                 wl1271_tx_get_queue(queue),
+                                 CONF_PS_SCHEME_LEGACY_PSPOLL,
+                                 CONF_ACK_POLICY_LEGACY, 0, 0);
+        if (ret < 0)
+                goto out_sleep;
+
 out_sleep:
         wl1271_ps_elp_sleep(wl);
 
 out:
         mutex_unlock(&wl->mutex);
+
+        return ret;
 }
 
 
 /* can't be const, mac80211 writes to this */
 static struct ieee80211_rate wl1271_rates[] = {
         { .bitrate = 10,
-          .hw_value = 0x1,
-          .hw_value_short = 0x1, },
+          .hw_value = CONF_HW_BIT_RATE_1MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_1MBPS, },
         { .bitrate = 20,
-          .hw_value = 0x2,
-          .hw_value_short = 0x2,
+          .hw_value = CONF_HW_BIT_RATE_2MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_2MBPS,
           .flags = IEEE80211_RATE_SHORT_PREAMBLE },
         { .bitrate = 55,
-          .hw_value = 0x4,
-          .hw_value_short = 0x4,
+          .hw_value = CONF_HW_BIT_RATE_5_5MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_5_5MBPS,
           .flags = IEEE80211_RATE_SHORT_PREAMBLE },
         { .bitrate = 110,
-          .hw_value = 0x20,
-          .hw_value_short = 0x20,
+          .hw_value = CONF_HW_BIT_RATE_11MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_11MBPS,
           .flags = IEEE80211_RATE_SHORT_PREAMBLE },
         { .bitrate = 60,
-          .hw_value = 0x8,
-          .hw_value_short = 0x8, },
+          .hw_value = CONF_HW_BIT_RATE_6MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_6MBPS, },
         { .bitrate = 90,
-          .hw_value = 0x10,
-          .hw_value_short = 0x10, },
+          .hw_value = CONF_HW_BIT_RATE_9MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_9MBPS, },
         { .bitrate = 120,
-          .hw_value = 0x40,
-          .hw_value_short = 0x40, },
+          .hw_value = CONF_HW_BIT_RATE_12MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_12MBPS, },
         { .bitrate = 180,
-          .hw_value = 0x80,
-          .hw_value_short = 0x80, },
+          .hw_value = CONF_HW_BIT_RATE_18MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_18MBPS, },
         { .bitrate = 240,
-          .hw_value = 0x200,
-          .hw_value_short = 0x200, },
+          .hw_value = CONF_HW_BIT_RATE_24MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_24MBPS, },
         { .bitrate = 360,
-         .hw_value = 0x400,
-         .hw_value_short = 0x400, },
+         .hw_value = CONF_HW_BIT_RATE_36MBPS,
+         .hw_value_short = CONF_HW_BIT_RATE_36MBPS, },
         { .bitrate = 480,
-          .hw_value = 0x800,
-          .hw_value_short = 0x800, },
+          .hw_value = CONF_HW_BIT_RATE_48MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_48MBPS, },
         { .bitrate = 540,
-          .hw_value = 0x1000,
-          .hw_value_short = 0x1000, },
+          .hw_value = CONF_HW_BIT_RATE_54MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_54MBPS, },
 };
 
 /* can't be const, mac80211 writes to this */
 static struct ieee80211_channel wl1271_channels[] = {
-        { .hw_value = 1, .center_freq = 2412},
-        { .hw_value = 2, .center_freq = 2417},
-        { .hw_value = 3, .center_freq = 2422},
-        { .hw_value = 4, .center_freq = 2427},
-        { .hw_value = 5, .center_freq = 2432},
-        { .hw_value = 6, .center_freq = 2437},
-        { .hw_value = 7, .center_freq = 2442},
-        { .hw_value = 8, .center_freq = 2447},
-        { .hw_value = 9, .center_freq = 2452},
-        { .hw_value = 10, .center_freq = 2457},
-        { .hw_value = 11, .center_freq = 2462},
-        { .hw_value = 12, .center_freq = 2467},
-        { .hw_value = 13, .center_freq = 2472},
+        { .hw_value = 1, .center_freq = 2412, .max_power = 25 },
+        { .hw_value = 2, .center_freq = 2417, .max_power = 25 },
+        { .hw_value = 3, .center_freq = 2422, .max_power = 25 },
+        { .hw_value = 4, .center_freq = 2427, .max_power = 25 },
+        { .hw_value = 5, .center_freq = 2432, .max_power = 25 },
+        { .hw_value = 6, .center_freq = 2437, .max_power = 25 },
+        { .hw_value = 7, .center_freq = 2442, .max_power = 25 },
+        { .hw_value = 8, .center_freq = 2447, .max_power = 25 },
+        { .hw_value = 9, .center_freq = 2452, .max_power = 25 },
+        { .hw_value = 10, .center_freq = 2457, .max_power = 25 },
+        { .hw_value = 11, .center_freq = 2462, .max_power = 25 },
+        { .hw_value = 12, .center_freq = 2467, .max_power = 25 },
+        { .hw_value = 13, .center_freq = 2472, .max_power = 25 },
 };
 
 /* can't be const, mac80211 writes to this */
@@ -1112,6 +1860,88 @@ static struct ieee80211_supported_band wl1271_band_2ghz = {
         .n_bitrates = ARRAY_SIZE(wl1271_rates),
 };
 
+/* 5 GHz data rates for WL1273 */
+static struct ieee80211_rate wl1271_rates_5ghz[] = {
+        { .bitrate = 60,
+          .hw_value = CONF_HW_BIT_RATE_6MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_6MBPS, },
+        { .bitrate = 90,
+          .hw_value = CONF_HW_BIT_RATE_9MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_9MBPS, },
+        { .bitrate = 120,
+          .hw_value = CONF_HW_BIT_RATE_12MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_12MBPS, },
+        { .bitrate = 180,
+          .hw_value = CONF_HW_BIT_RATE_18MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_18MBPS, },
+        { .bitrate = 240,
+          .hw_value = CONF_HW_BIT_RATE_24MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_24MBPS, },
+        { .bitrate = 360,
+         .hw_value = CONF_HW_BIT_RATE_36MBPS,
+         .hw_value_short = CONF_HW_BIT_RATE_36MBPS, },
+        { .bitrate = 480,
+          .hw_value = CONF_HW_BIT_RATE_48MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_48MBPS, },
+        { .bitrate = 540,
+          .hw_value = CONF_HW_BIT_RATE_54MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_54MBPS, },
+};
+
+/* 5 GHz band channels for WL1273 */
+static struct ieee80211_channel wl1271_channels_5ghz[] = {
+        { .hw_value = 183, .center_freq = 4915},
+        { .hw_value = 184, .center_freq = 4920},
+        { .hw_value = 185, .center_freq = 4925},
+        { .hw_value = 187, .center_freq = 4935},
+        { .hw_value = 188, .center_freq = 4940},
+        { .hw_value = 189, .center_freq = 4945},
+        { .hw_value = 192, .center_freq = 4960},
+        { .hw_value = 196, .center_freq = 4980},
+        { .hw_value = 7, .center_freq = 5035},
+        { .hw_value = 8, .center_freq = 5040},
+        { .hw_value = 9, .center_freq = 5045},
+        { .hw_value = 11, .center_freq = 5055},
+        { .hw_value = 12, .center_freq = 5060},
+        { .hw_value = 16, .center_freq = 5080},
+        { .hw_value = 34, .center_freq = 5170},
+        { .hw_value = 36, .center_freq = 5180},
+        { .hw_value = 38, .center_freq = 5190},
+        { .hw_value = 40, .center_freq = 5200},
+        { .hw_value = 42, .center_freq = 5210},
+        { .hw_value = 44, .center_freq = 5220},
+        { .hw_value = 46, .center_freq = 5230},
+        { .hw_value = 48, .center_freq = 5240},
+        { .hw_value = 52, .center_freq = 5260},
+        { .hw_value = 56, .center_freq = 5280},
+        { .hw_value = 60, .center_freq = 5300},
+        { .hw_value = 64, .center_freq = 5320},
+        { .hw_value = 100, .center_freq = 5500},
+        { .hw_value = 104, .center_freq = 5520},
+        { .hw_value = 108, .center_freq = 5540},
+        { .hw_value = 112, .center_freq = 5560},
+        { .hw_value = 116, .center_freq = 5580},
+        { .hw_value = 120, .center_freq = 5600},
+        { .hw_value = 124, .center_freq = 5620},
+        { .hw_value = 128, .center_freq = 5640},
+        { .hw_value = 132, .center_freq = 5660},
+        { .hw_value = 136, .center_freq = 5680},
+        { .hw_value = 140, .center_freq = 5700},
+        { .hw_value = 149, .center_freq = 5745},
+        { .hw_value = 153, .center_freq = 5765},
+        { .hw_value = 157, .center_freq = 5785},
+        { .hw_value = 161, .center_freq = 5805},
+        { .hw_value = 165, .center_freq = 5825},
+};
+
+
+static struct ieee80211_supported_band wl1271_band_5ghz = {
+        .channels = wl1271_channels_5ghz,
+        .n_channels = ARRAY_SIZE(wl1271_channels_5ghz),
+        .bitrates = wl1271_rates_5ghz,
+        .n_bitrates = ARRAY_SIZE(wl1271_rates_5ghz),
+};
+
 static const struct ieee80211_ops wl1271_ops = {
         .start = wl1271_op_start,
         .stop = wl1271_op_stop,
@@ -1119,12 +1949,15 @@ static const struct ieee80211_ops wl1271_ops = {
         .remove_interface = wl1271_op_remove_interface,
         .config = wl1271_op_config,
 /*      .config_interface = wl1271_op_config_interface, */
+        .prepare_multicast = wl1271_op_prepare_multicast,
         .configure_filter = wl1271_op_configure_filter,
         .tx = wl1271_op_tx,
         .set_key = wl1271_op_set_key,
         .hw_scan = wl1271_op_hw_scan,
         .bss_info_changed = wl1271_op_bss_info_changed,
         .set_rts_threshold = wl1271_op_set_rts_threshold,
+        .conf_tx = wl1271_op_conf_tx,
+        CFG80211_TESTMODE_CMD(wl1271_tm_cmd)
 };
 
 static int wl1271_register_hw(struct wl1271 *wl)
@@ -1151,24 +1984,27 @@ static int wl1271_register_hw(struct wl1271 *wl)
 
 static int wl1271_init_ieee80211(struct wl1271 *wl)
 {
-        /*
-         * The tx descriptor buffer and the TKIP space.
-         *
-         * FIXME: add correct 1271 descriptor size
-         */
-        wl->hw->extra_tx_headroom = WL1271_TKIP_IV_SPACE;
+        /* The tx descriptor buffer and the TKIP space. */
+        wl->hw->extra_tx_headroom = WL1271_TKIP_IV_SPACE +
+                sizeof(struct wl1271_tx_hw_descr);
 
         /* unit us */
         /* FIXME: find a proper value */
         wl->hw->channel_change_time = 10000;
 
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_NOISE_DBM;
+                IEEE80211_HW_NOISE_DBM |
+                IEEE80211_HW_BEACON_FILTER |
+                IEEE80211_HW_SUPPORTS_PS;
 
-        wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+        wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_ADHOC);
         wl->hw->wiphy->max_scan_ssids = 1;
         wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wl1271_band_2ghz;
 
+        if (wl1271_11a_enabled())
+                wl->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &wl1271_band_5ghz;
+
         SET_IEEE80211_DEV(wl->hw, &wl->spi->dev);
 
         return 0;
@@ -1190,73 +2026,99 @@ static struct platform_device wl1271_device = {
 };
 
 #define WL1271_DEFAULT_CHANNEL 0
-static int __devinit wl1271_probe(struct spi_device *spi)
+
+static struct ieee80211_hw *wl1271_alloc_hw(void)
 {
-        struct wl12xx_platform_data *pdata;
         struct ieee80211_hw *hw;
         struct wl1271 *wl;
-        int ret, i;
-        static const u8 nokia_oui[3] = {0x00, 0x1f, 0xdf};
-
-        pdata = spi->dev.platform_data;
-        if (!pdata) {
-                wl1271_error("no platform data");
-                return -ENODEV;
-        }
+        int i;
 
         hw = ieee80211_alloc_hw(sizeof(*wl), &wl1271_ops);
         if (!hw) {
                 wl1271_error("could not alloc ieee80211_hw");
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
         }
 
         wl = hw->priv;
         memset(wl, 0, sizeof(*wl));
 
+        INIT_LIST_HEAD(&wl->list);
+
         wl->hw = hw;
-        dev_set_drvdata(&spi->dev, wl);
-        wl->spi = spi;
 
         skb_queue_head_init(&wl->tx_queue);
 
-        INIT_WORK(&wl->filter_work, wl1271_filter_work);
+        INIT_DELAYED_WORK(&wl->elp_work, wl1271_elp_work);
         wl->channel = WL1271_DEFAULT_CHANNEL;
-        wl->scanning = false;
         wl->default_key = 0;
-        wl->listen_int = 1;
         wl->rx_counter = 0;
         wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
         wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
-        wl->elp = false;
-        wl->psm = 0;
-        wl->psm_requested = false;
-        wl->tx_queue_stopped = false;
+        wl->psm_entry_retry = 0;
         wl->power_level = WL1271_DEFAULT_POWER_LEVEL;
-
-        /* We use the default power on sleep time until we know which chip
-         * we're using */
-        for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
+        wl->basic_rate_set = CONF_TX_RATE_MASK_BASIC;
+        wl->rate_set = CONF_TX_RATE_MASK_BASIC;
+        wl->sta_rate_set = 0;
+        wl->band = IEEE80211_BAND_2GHZ;
+        wl->vif = NULL;
+        wl->flags = 0;
+
+        for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 wl->tx_frames[i] = NULL;
 
         spin_lock_init(&wl->wl_lock);
 
-        /*
-         * In case our MAC address is not correctly set,
-         * we use a random but Nokia MAC.
-         */
-        memcpy(wl->mac_addr, nokia_oui, 3);
-        get_random_bytes(wl->mac_addr + 3, 3);
-
         wl->state = WL1271_STATE_OFF;
         mutex_init(&wl->mutex);
 
-        wl->rx_descriptor = kmalloc(sizeof(*wl->rx_descriptor), GFP_KERNEL);
-        if (!wl->rx_descriptor) {
-                wl1271_error("could not allocate memory for rx descriptor");
-                ret = -ENOMEM;
-                goto out_free;
+        /* Apply default driver configuration. */
+        wl1271_conf_init(wl);
+
+        return hw;
+}
+
+int wl1271_free_hw(struct wl1271 *wl)
+{
+        ieee80211_unregister_hw(wl->hw);
+
+        wl1271_debugfs_exit(wl);
+
+        kfree(wl->target_mem_map);
+        vfree(wl->fw);
+        wl->fw = NULL;
+        kfree(wl->nvs);
+        wl->nvs = NULL;
+
+        kfree(wl->fw_status);
+        kfree(wl->tx_res_if);
+
+        ieee80211_free_hw(wl->hw);
+
+        return 0;
+}
+
+static int __devinit wl1271_probe(struct spi_device *spi)
+{
+        struct wl12xx_platform_data *pdata;
+        struct ieee80211_hw *hw;
+        struct wl1271 *wl;
+        int ret;
+
+        pdata = spi->dev.platform_data;
+        if (!pdata) {
+                wl1271_error("no platform data");
+                return -ENODEV;
         }
 
+        hw = wl1271_alloc_hw();
+        if (IS_ERR(hw))
+                return PTR_ERR(hw);
+
+        wl = hw->priv;
+
+        dev_set_drvdata(&spi->dev, wl);
+        wl->spi = spi;
+
         /* This is the only SPI value that we need to set here, the rest
          * comes from the board-peripherals file */
         spi->bits_per_word = 32;
@@ -1319,9 +2181,6 @@ static int __devinit wl1271_probe(struct spi_device *spi)
         free_irq(wl->irq, wl);
 
  out_free:
-        kfree(wl->rx_descriptor);
-        wl->rx_descriptor = NULL;
-
         ieee80211_free_hw(hw);
 
         return ret;
@@ -1331,24 +2190,10 @@ static int __devexit wl1271_remove(struct spi_device *spi)
 {
         struct wl1271 *wl = dev_get_drvdata(&spi->dev);
 
-        ieee80211_unregister_hw(wl->hw);
-
-        wl1271_debugfs_exit(wl);
         platform_device_unregister(&wl1271_device);
         free_irq(wl->irq, wl);
-        kfree(wl->target_mem_map);
-        kfree(wl->fw);
-        wl->fw = NULL;
-        kfree(wl->nvs);
-        wl->nvs = NULL;
-
-        kfree(wl->rx_descriptor);
-        wl->rx_descriptor = NULL;
-
-        kfree(wl->fw_status);
-        kfree(wl->tx_res_if);
 
-        ieee80211_free_hw(wl->hw);
+        wl1271_free_hw(wl);
 
         return 0;
 }
@@ -1391,3 +2236,5 @@ module_exit(wl1271_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
+MODULE_FIRMWARE(WL1271_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.c b/drivers/net/wireless/wl12xx/wl1271_ps.c
index 1dc74b0c7736..e2b1ebf096e8 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1271_ps.c
@@ -24,28 +24,43 @@
 #include "wl1271_reg.h"
 #include "wl1271_ps.h"
 #include "wl1271_spi.h"
+#include "wl1271_io.h"
 
 #define WL1271_WAKEUP_TIMEOUT 500
 
+void wl1271_elp_work(struct work_struct *work)
+{
+        struct delayed_work *dwork;
+        struct wl1271 *wl;
+
+        dwork = container_of(work, struct delayed_work, work);
+        wl = container_of(dwork, struct wl1271, elp_work);
+
+        wl1271_debug(DEBUG_PSM, "elp work");
+
+        mutex_lock(&wl->mutex);
+
+        if (test_bit(WL1271_FLAG_IN_ELP, &wl->flags) ||
+            !test_bit(WL1271_FLAG_PSM, &wl->flags))
+                goto out;
+
+        wl1271_debug(DEBUG_PSM, "chip to elp");
+        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
+        set_bit(WL1271_FLAG_IN_ELP, &wl->flags);
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+#define ELP_ENTRY_DELAY  5
+
 /* Routines to toggle sleep mode while in ELP */
 void wl1271_ps_elp_sleep(struct wl1271 *wl)
 {
-        /*
-         * FIXME: due to a problem in the firmware (causing a firmware
-         * crash), ELP entry is prevented below. Remove the "true" to
-         * re-enable ELP entry.
-         */
-        if (true || wl->elp || !wl->psm)
-                return;
-
-        /*
-         * Go to ELP unless there is work already pending - pending work
-         * will immediately wakeup the chipset anyway.
-         */
-        if (!work_pending(&wl->irq_work) && !work_pending(&wl->tx_work)) {
-                wl1271_debug(DEBUG_PSM, "chip to elp");
-                wl1271_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
-                wl->elp = true;
+        if (test_bit(WL1271_FLAG_PSM, &wl->flags)) {
+                cancel_delayed_work(&wl->elp_work);
+                ieee80211_queue_delayed_work(wl->hw, &wl->elp_work,
+                                        msecs_to_jiffies(ELP_ENTRY_DELAY));
         }
 }
 
@@ -57,7 +72,7 @@ int wl1271_ps_elp_wakeup(struct wl1271 *wl, bool chip_awake)
         u32 start_time = jiffies;
         bool pending = false;
 
-        if (!wl->elp)
+        if (!test_bit(WL1271_FLAG_IN_ELP, &wl->flags))
                 return 0;
 
         wl1271_debug(DEBUG_PSM, "waking up chip from elp");
@@ -73,7 +88,7 @@ int wl1271_ps_elp_wakeup(struct wl1271 *wl, bool chip_awake)
                 wl->elp_compl = &compl;
         spin_unlock_irqrestore(&wl->wl_lock, flags);
 
-        wl1271_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
+        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
 
         if (!pending) {
                 ret = wait_for_completion_timeout(
@@ -88,7 +103,7 @@ int wl1271_ps_elp_wakeup(struct wl1271 *wl, bool chip_awake)
                 }
         }
 
-        wl->elp = false;
+        clear_bit(WL1271_FLAG_IN_ELP, &wl->flags);
 
         wl1271_debug(DEBUG_PSM, "wakeup time: %u ms",
                      jiffies_to_msecs(jiffies - start_time));
@@ -104,22 +119,20 @@ out:
         return 0;
 }
 
-int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode)
+int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode,
+                       bool send)
 {
         int ret;
 
         switch (mode) {
         case STATION_POWER_SAVE_MODE:
                 wl1271_debug(DEBUG_PSM, "entering psm");
-                ret = wl1271_cmd_ps_mode(wl, STATION_POWER_SAVE_MODE);
-                if (ret < 0)
-                        return ret;
 
-                wl1271_ps_elp_sleep(wl);
+                ret = wl1271_cmd_ps_mode(wl, STATION_POWER_SAVE_MODE, send);
                 if (ret < 0)
                         return ret;
 
-                wl->psm = 1;
+                set_bit(WL1271_FLAG_PSM, &wl->flags);
                 break;
         case STATION_ACTIVE_MODE:
         default:
@@ -128,11 +141,21 @@ int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode)
                 if (ret < 0)
                         return ret;
 
-                ret = wl1271_cmd_ps_mode(wl, STATION_ACTIVE_MODE);
+                /* disable beacon early termination */
+                ret = wl1271_acx_bet_enable(wl, false);
+                if (ret < 0)
+                        return ret;
+
+                /* disable beacon filtering */
+                ret = wl1271_acx_beacon_filter_opt(wl, false);
+                if (ret < 0)
+                        return ret;
+
+                ret = wl1271_cmd_ps_mode(wl, STATION_ACTIVE_MODE, send);
                 if (ret < 0)
                         return ret;
 
-                wl->psm = 0;
+                clear_bit(WL1271_FLAG_PSM, &wl->flags);
                 break;
         }
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.h b/drivers/net/wireless/wl12xx/wl1271_ps.h
index de2bd3c7dc9c..940276f517a4 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ps.h
+++ b/drivers/net/wireless/wl12xx/wl1271_ps.h
@@ -27,9 +27,10 @@
 #include "wl1271.h"
 #include "wl1271_acx.h"
 
-int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode);
+int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode,
+                       bool send);
 void wl1271_ps_elp_sleep(struct wl1271 *wl);
 int wl1271_ps_elp_wakeup(struct wl1271 *wl, bool chip_awake);
-
+void wl1271_elp_work(struct work_struct *work);
 
 #endif /* __WL1271_PS_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_reg.h b/drivers/net/wireless/wl12xx/wl1271_reg.h
index f8ed4a4fc691..990960771528 100644
--- a/drivers/net/wireless/wl12xx/wl1271_reg.h
+++ b/drivers/net/wireless/wl12xx/wl1271_reg.h
@@ -34,7 +34,7 @@
 #define REGISTERS_WORK_SIZE 0x0000b000
 
 #define HW_ACCESS_ELP_CTRL_REG_ADDR         0x1FFFC
-#define STATUS_MEM_ADDRESS                  0x40400
+#define FW_STATUS_ADDR                      (0x14FC0 + 0xA000)
 
 /* ELP register commands */
 #define ELPCTRL_WAKE_UP             0x1
@@ -62,73 +62,10 @@
 #define WL1271_SLV_REG_DATA            (REGISTERS_BASE + 0x0008)
 #define WL1271_SLV_REG_ADATA           (REGISTERS_BASE + 0x000c)
 #define WL1271_SLV_MEM_DATA            (REGISTERS_BASE + 0x0018)
-/*
- * Interrupt registers.
- * 64 bit interrupt sources registers ws ced.
- * sme interupts were removed and new ones were added.
- * Order was changed.
- */
-#define FIQ_MASK                       (REGISTERS_BASE + 0x0400)
-#define FIQ_MASK_L                     (REGISTERS_BASE + 0x0400)
-#define FIQ_MASK_H                     (REGISTERS_BASE + 0x0404)
-#define FIQ_MASK_SET                   (REGISTERS_BASE + 0x0408)
-#define FIQ_MASK_SET_L                 (REGISTERS_BASE + 0x0408)
-#define FIQ_MASK_SET_H                 (REGISTERS_BASE + 0x040C)
-#define FIQ_MASK_CLR                   (REGISTERS_BASE + 0x0410)
-#define FIQ_MASK_CLR_L                 (REGISTERS_BASE + 0x0410)
-#define FIQ_MASK_CLR_H                 (REGISTERS_BASE + 0x0414)
-#define IRQ_MASK                       (REGISTERS_BASE + 0x0418)
-#define IRQ_MASK_L                     (REGISTERS_BASE + 0x0418)
-#define IRQ_MASK_H                     (REGISTERS_BASE + 0x041C)
-#define IRQ_MASK_SET                   (REGISTERS_BASE + 0x0420)
-#define IRQ_MASK_SET_L                 (REGISTERS_BASE + 0x0420)
-#define IRQ_MASK_SET_H                 (REGISTERS_BASE + 0x0424)
-#define IRQ_MASK_CLR                   (REGISTERS_BASE + 0x0428)
-#define IRQ_MASK_CLR_L                 (REGISTERS_BASE + 0x0428)
-#define IRQ_MASK_CLR_H                 (REGISTERS_BASE + 0x042C)
-#define ECPU_MASK                      (REGISTERS_BASE + 0x0448)
-#define FIQ_STS_L                      (REGISTERS_BASE + 0x044C)
-#define FIQ_STS_H                      (REGISTERS_BASE + 0x0450)
-#define IRQ_STS_L                      (REGISTERS_BASE + 0x0454)
-#define IRQ_STS_H                      (REGISTERS_BASE + 0x0458)
-#define INT_STS_ND                     (REGISTERS_BASE + 0x0464)
-#define INT_STS_RAW_L                  (REGISTERS_BASE + 0x0464)
-#define INT_STS_RAW_H                  (REGISTERS_BASE + 0x0468)
-#define INT_STS_CLR                    (REGISTERS_BASE + 0x04B4)
-#define INT_STS_CLR_L                  (REGISTERS_BASE + 0x04B4)
-#define INT_STS_CLR_H                  (REGISTERS_BASE + 0x04B8)
-#define INT_ACK                        (REGISTERS_BASE + 0x046C)
-#define INT_ACK_L                      (REGISTERS_BASE + 0x046C)
-#define INT_ACK_H                      (REGISTERS_BASE + 0x0470)
-#define INT_TRIG                       (REGISTERS_BASE + 0x0474)
-#define INT_TRIG_L                     (REGISTERS_BASE + 0x0474)
-#define INT_TRIG_H                     (REGISTERS_BASE + 0x0478)
-#define HOST_STS_L                     (REGISTERS_BASE + 0x045C)
-#define HOST_STS_H                     (REGISTERS_BASE + 0x0460)
-#define HOST_MASK                      (REGISTERS_BASE + 0x0430)
-#define HOST_MASK_L                    (REGISTERS_BASE + 0x0430)
-#define HOST_MASK_H                    (REGISTERS_BASE + 0x0434)
-#define HOST_MASK_SET                  (REGISTERS_BASE + 0x0438)
-#define HOST_MASK_SET_L                (REGISTERS_BASE + 0x0438)
-#define HOST_MASK_SET_H                (REGISTERS_BASE + 0x043C)
-#define HOST_MASK_CLR                  (REGISTERS_BASE + 0x0440)
-#define HOST_MASK_CLR_L                (REGISTERS_BASE + 0x0440)
-#define HOST_MASK_CLR_H                (REGISTERS_BASE + 0x0444)
 
 #define ACX_REG_INTERRUPT_TRIG         (REGISTERS_BASE + 0x0474)
 #define ACX_REG_INTERRUPT_TRIG_H       (REGISTERS_BASE + 0x0478)
 
-/* Host Interrupts*/
-#define HINT_MASK                      (REGISTERS_BASE + 0x0494)
-#define HINT_MASK_SET                  (REGISTERS_BASE + 0x0498)
-#define HINT_MASK_CLR                  (REGISTERS_BASE + 0x049C)
-#define HINT_STS_ND_MASKED             (REGISTERS_BASE + 0x04A0)
-/*1150 spec calls this HINT_STS_RAW*/
-#define HINT_STS_ND                    (REGISTERS_BASE + 0x04B0)
-#define HINT_STS_CLR                   (REGISTERS_BASE + 0x04A4)
-#define HINT_ACK                       (REGISTERS_BASE + 0x04A8)
-#define HINT_TRIG                      (REGISTERS_BASE + 0x04AC)
-
 /*=============================================
   Host Interrupt Mask Register - 32bit (RW)
   ------------------------------------------
@@ -213,7 +150,6 @@
 ==============================================*/
 #define ACX_REG_INTERRUPT_ACK          (REGISTERS_BASE + 0x04F0)
 
-#define RX_DRIVER_DUMMY_WRITE_ADDRESS  (REGISTERS_BASE + 0x0534)
 #define RX_DRIVER_COUNTER_ADDRESS      (REGISTERS_BASE + 0x0538)
 
 /* Device Configuration registers*/
@@ -434,16 +370,6 @@
 
 
 /*===============================================
-  Phy regs
- ===============================================*/
-#define ACX_PHY_ADDR_REG                SBB_ADDR
-#define ACX_PHY_DATA_REG                SBB_DATA
-#define ACX_PHY_CTRL_REG                SBB_CTL
-#define ACX_PHY_REG_WR_MASK             0x00000001ul
-#define ACX_PHY_REG_RD_MASK             0x00000002ul
-
-
-/*===============================================
  EEPROM Read/Write Request 32bit RW
  ------------------------------------------
  1 EE_READ - EEPROM Read Request 1 - Setting this bit
@@ -512,28 +438,6 @@
 #define ACX_CONT_WIND_MIN_MASK   0x0000007f
 #define ACX_CONT_WIND_MAX        0x03ff0000
 
-/*
- * Indirect slave register/memory registers
- * ----------------------------------------
- */
-#define HW_SLAVE_REG_ADDR_REG           0x00000004
-#define HW_SLAVE_REG_DATA_REG           0x00000008
-#define HW_SLAVE_REG_CTRL_REG           0x0000000c
-
-#define SLAVE_AUTO_INC                          0x00010000
-#define SLAVE_NO_AUTO_INC                       0x00000000
-#define SLAVE_HOST_LITTLE_ENDIAN        0x00000000
-
-#define HW_SLAVE_MEM_ADDR_REG           SLV_MEM_ADDR
-#define HW_SLAVE_MEM_DATA_REG           SLV_MEM_DATA
-#define HW_SLAVE_MEM_CTRL_REG           SLV_MEM_CTL
-#define HW_SLAVE_MEM_ENDIAN_REG         SLV_END_CTL
-
-#define HW_FUNC_EVENT_INT_EN            0x8000
-#define HW_FUNC_EVENT_MASK_REG          0x00000034
-
-#define ACX_MAC_TIMESTAMP_REG   (MAC_TIMESTAMP)
-
 /*===============================================
   HI_CFG Interface Configuration Register Values
   ------------------------------------------
@@ -614,50 +518,6 @@ enum {
         MAX_RADIO_BANDS = 0xFF
 };
 
-enum {
-        NO_RATE      = 0,
-        RATE_1MBPS   = 0x0A,
-        RATE_2MBPS   = 0x14,
-        RATE_5_5MBPS = 0x37,
-        RATE_6MBPS   = 0x0B,
-        RATE_9MBPS   = 0x0F,
-        RATE_11MBPS  = 0x6E,
-        RATE_12MBPS  = 0x0A,
-        RATE_18MBPS  = 0x0E,
-        RATE_22MBPS  = 0xDC,
-        RATE_24MBPS  = 0x09,
-        RATE_36MBPS  = 0x0D,
-        RATE_48MBPS  = 0x08,
-        RATE_54MBPS  = 0x0C
-};
-
-enum {
-        RATE_INDEX_1MBPS   =  0,
-        RATE_INDEX_2MBPS   =  1,
-        RATE_INDEX_5_5MBPS =  2,
-        RATE_INDEX_6MBPS   =  3,
-        RATE_INDEX_9MBPS   =  4,
-        RATE_INDEX_11MBPS  =  5,
-        RATE_INDEX_12MBPS  =  6,
-        RATE_INDEX_18MBPS  =  7,
-        RATE_INDEX_22MBPS  =  8,
-        RATE_INDEX_24MBPS  =  9,
-        RATE_INDEX_36MBPS  =  10,
-        RATE_INDEX_48MBPS  =  11,
-        RATE_INDEX_54MBPS  =  12,
-        RATE_INDEX_MAX     =  RATE_INDEX_54MBPS,
-        MAX_RATE_INDEX,
-        INVALID_RATE_INDEX = MAX_RATE_INDEX,
-        RATE_INDEX_ENUM_MAX_SIZE = 0x7FFFFFFF
-};
-
-enum {
-        RATE_MASK_1MBPS = 0x1,
-        RATE_MASK_2MBPS = 0x2,
-        RATE_MASK_5_5MBPS = 0x4,
-        RATE_MASK_11MBPS = 0x20,
-};
-
 #define SHORT_PREAMBLE_BIT   BIT(0) /* CCK or Barker depending on the rate */
 #define OFDM_RATE_BIT        BIT(6)
 #define PBCC_RATE_BIT        BIT(7)
@@ -692,10 +552,6 @@ b12-b0 - Supported Rate indicator bits as defined below.
 ******************************************************************************/
 
 
-#define TNETW1251_CHIP_ID_PG1_0         0x07010101
-#define TNETW1251_CHIP_ID_PG1_1         0x07020101
-#define TNETW1251_CHIP_ID_PG1_2         0x07030101
-
 /*************************************************************************
 
     Interrupt Trigger Register (Host -> WiLink)
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.c b/drivers/net/wireless/wl12xx/wl1271_rx.c
index ad8b6904c5eb..c723d9c7e131 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.c
@@ -21,23 +21,27 @@
  *
  */
 
+#include <linux/gfp.h>
+
 #include "wl1271.h"
 #include "wl1271_acx.h"
 #include "wl1271_reg.h"
 #include "wl1271_rx.h"
 #include "wl1271_spi.h"
+#include "wl1271_io.h"
 
 static u8 wl1271_rx_get_mem_block(struct wl1271_fw_status *status,
                                   u32 drv_rx_counter)
 {
-        return status->rx_pkt_descs[drv_rx_counter] & RX_MEM_BLOCK_MASK;
+        return le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]) &
+                RX_MEM_BLOCK_MASK;
 }
 
 static u32 wl1271_rx_get_buf_size(struct wl1271_fw_status *status,
                                  u32 drv_rx_counter)
 {
-        return (status->rx_pkt_descs[drv_rx_counter] & RX_BUF_SIZE_MASK) >>
-                RX_BUF_SIZE_SHIFT_DIV;
+        return (le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]) &
+                RX_BUF_SIZE_MASK) >> RX_BUF_SIZE_SHIFT_DIV;
 }
 
 /* The values of this table must match the wl1271_rates[] array */
@@ -70,6 +74,36 @@ static u8 wl1271_rx_rate_to_idx[] = {
         0                           /* WL1271_RATE_1    */
 };
 
+/* The values of this table must match the wl1271_rates[] array */
+static u8 wl1271_5_ghz_rx_rate_to_idx[] = {
+        /* MCS rates are used only with 11n */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS7 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS6 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS5 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS4 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS3 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS2 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS1 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS0 */
+
+        7,                          /* WL1271_RATE_54   */
+        6,                          /* WL1271_RATE_48   */
+        5,                          /* WL1271_RATE_36   */
+        4,                          /* WL1271_RATE_24   */
+
+        /* TI-specific rate */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_22   */
+
+        3,                          /* WL1271_RATE_18   */
+        2,                          /* WL1271_RATE_12   */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_11   */
+        1,                          /* WL1271_RATE_9    */
+        0,                          /* WL1271_RATE_6    */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_5_5  */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_2    */
+        WL1271_RX_RATE_UNSUPPORTED  /* WL1271_RATE_1    */
+};
+
 static void wl1271_rx_status(struct wl1271 *wl,
                              struct wl1271_rx_descriptor *desc,
                              struct ieee80211_rx_status *status,
@@ -77,12 +111,21 @@ static void wl1271_rx_status(struct wl1271 *wl,
 {
         memset(status, 0, sizeof(struct ieee80211_rx_status));
 
-        if ((desc->flags & WL1271_RX_DESC_BAND_MASK) == WL1271_RX_DESC_BAND_BG)
+        if ((desc->flags & WL1271_RX_DESC_BAND_MASK) ==
+            WL1271_RX_DESC_BAND_BG) {
                 status->band = IEEE80211_BAND_2GHZ;
-        else
+                status->rate_idx = wl1271_rx_rate_to_idx[desc->rate];
+        } else if ((desc->flags & WL1271_RX_DESC_BAND_MASK) ==
+                 WL1271_RX_DESC_BAND_A) {
+                status->band = IEEE80211_BAND_5GHZ;
+                status->rate_idx = wl1271_5_ghz_rx_rate_to_idx[desc->rate];
+        } else
                 wl1271_warning("unsupported band 0x%x",
                                desc->flags & WL1271_RX_DESC_BAND_MASK);
 
+        if (unlikely(status->rate_idx == WL1271_RX_RATE_UNSUPPORTED))
+                wl1271_warning("unsupported rate");
+
         /*
          * FIXME: Add mactime handling.  For IBSS (ad-hoc) we need to get the
          * timestamp from the beacon (acx_tsf_info).  In BSS mode (infra) we
@@ -91,12 +134,6 @@ static void wl1271_rx_status(struct wl1271 *wl,
          */
         status->signal = desc->rssi;
 
-        /* FIXME: Should this be optimized? */
-        status->qual = (desc->rssi - WL1271_RX_MIN_RSSI) * 100 /
-                (WL1271_RX_MAX_RSSI - WL1271_RX_MIN_RSSI);
-        status->qual = min(status->qual, 100);
-        status->qual = max(status->qual, 0);
-
         /*
          * FIXME: In wl1251, the SNR should be divided by two.  In wl1271 we
          * need to divide by two for now, but TI has been discussing about
@@ -109,17 +146,11 @@ static void wl1271_rx_status(struct wl1271 *wl,
         if (desc->flags & WL1271_RX_DESC_ENCRYPT_MASK) {
                 status->flag |= RX_FLAG_IV_STRIPPED | RX_FLAG_MMIC_STRIPPED;
 
-                if (likely(!(desc->flags & WL1271_RX_DESC_DECRYPT_FAIL)))
+                if (likely(!(desc->status & WL1271_RX_DESC_DECRYPT_FAIL)))
                         status->flag |= RX_FLAG_DECRYPTED;
-
-                if (unlikely(desc->flags & WL1271_RX_DESC_MIC_FAIL))
+                if (unlikely(desc->status & WL1271_RX_DESC_MIC_FAIL))
                         status->flag |= RX_FLAG_MMIC_ERROR;
         }
-
-        status->rate_idx = wl1271_rx_rate_to_idx[desc->rate];
-
-        if (status->rate_idx == WL1271_RX_RATE_UNSUPPORTED)
-                wl1271_warning("unsupported rate");
 }
 
 static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
@@ -131,14 +162,14 @@ static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
         u8 *buf;
         u8 beacon = 0;
 
-        skb = dev_alloc_skb(length);
+        skb = __dev_alloc_skb(length, GFP_KERNEL);
         if (!skb) {
                 wl1271_error("Couldn't allocate RX frame");
                 return;
         }
 
         buf = skb_put(skb, length);
-        wl1271_spi_reg_read(wl, WL1271_SLV_MEM_DATA, buf, length, true);
+        wl1271_read(wl, WL1271_SLV_MEM_DATA, buf, length, true);
 
         /* the data read starts with the descriptor */
         desc = (struct wl1271_rx_descriptor *) buf;
@@ -156,7 +187,7 @@ static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
                      beacon ? "beacon" : "");
 
         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
-        ieee80211_rx(wl->hw, skb);
+        ieee80211_rx_ni(wl->hw, skb);
 }
 
 void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status)
@@ -176,25 +207,19 @@ void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status)
                         break;
                 }
 
-                wl->rx_mem_pool_addr.addr =
-                        (mem_block << 8) + wl_mem_map->packet_memory_pool_start;
+                wl->rx_mem_pool_addr.addr = (mem_block << 8) +
+                        le32_to_cpu(wl_mem_map->packet_memory_pool_start);
                 wl->rx_mem_pool_addr.addr_extra =
                         wl->rx_mem_pool_addr.addr + 4;
 
                 /* Choose the block we want to read */
-                wl1271_spi_reg_write(wl, WL1271_SLV_REG_DATA,
-                                     &wl->rx_mem_pool_addr,
-                                     sizeof(wl->rx_mem_pool_addr), false);
+                wl1271_write(wl, WL1271_SLV_REG_DATA, &wl->rx_mem_pool_addr,
+                             sizeof(wl->rx_mem_pool_addr), false);
 
                 wl1271_rx_handle_data(wl, buf_size);
 
                 wl->rx_counter++;
                 drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
+                wl1271_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
         }
-
-        wl1271_reg_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
-
-        /* This is a workaround for some problems in the chip */
-        wl1271_reg_write32(wl, RX_DRIVER_DUMMY_WRITE_ADDRESS, 0x1);
-
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.h b/drivers/net/wireless/wl12xx/wl1271_rx.h
index d1ca60e43a25..1ae6d1783ed4 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.h
@@ -102,14 +102,14 @@
 #define RX_BUF_SIZE_SHIFT_DIV 6
 
 struct wl1271_rx_descriptor {
-        u16 length;
+        __le16 length;
         u8  status;
         u8  flags;
         u8  rate;
         u8  channel;
         s8  rssi;
         u8  snr;
-        u32 timestamp;
+        __le32 timestamp;
         u8  packet_class;
         u8  process_id;
         u8  pad_len;
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.c b/drivers/net/wireless/wl12xx/wl1271_spi.c
index 4a12880c16a8..053c84aceb49 100644
--- a/drivers/net/wireless/wl12xx/wl1271_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1271_spi.c
@@ -25,21 +25,12 @@
 #include <linux/platform_device.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
+#include <linux/slab.h>
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
 #include "wl1271_spi.h"
 
-static int wl1271_translate_reg_addr(struct wl1271 *wl, int addr)
-{
-        return addr - wl->physical_reg_addr + wl->virtual_reg_addr;
-}
-
-static int wl1271_translate_mem_addr(struct wl1271 *wl, int addr)
-{
-        return addr - wl->physical_mem_addr + wl->virtual_mem_addr;
-}
-
 
 void wl1271_spi_reset(struct wl1271 *wl)
 {
@@ -121,135 +112,78 @@ void wl1271_spi_init(struct wl1271 *wl)
         wl1271_dump(DEBUG_SPI, "spi init -> ", cmd, WSPI_INIT_CMD_LEN);
 }
 
-/* Set the SPI partitions to access the chip addresses
- *
- * There are two VIRTUAL (SPI) partitions (the memory partition and the
- * registers partition), which are mapped to two different areas of the
- * PHYSICAL (hardware) memory.  This function also makes other checks to
- * ensure that the partitions are not overlapping.  In the diagram below, the
- * memory partition comes before the register partition, but the opposite is
- * also supported.
- *
- *                               PHYSICAL address
- *                                     space
- *
- *                                    |    |
- *                                 ...+----+--> mem_start
- *          VIRTUAL address     ...   |    |
- *               space       ...      |    | [PART_0]
- *                        ...         |    |
- * 0x00000000 <--+----+...         ...+----+--> mem_start + mem_size
- *               |    |         ...   |    |
- *               |MEM |      ...      |    |
- *               |    |   ...         |    |
- *  part_size <--+----+...            |    | {unused area)
- *               |    |   ...         |    |
- *               |REG |      ...      |    |
- *  part_size    |    |         ...   |    |
- *      +     <--+----+...         ...+----+--> reg_start
- *  reg_size              ...         |    |
- *                           ...      |    | [PART_1]
- *                              ...   |    |
- *                                 ...+----+--> reg_start + reg_size
- *                                    |    |
- *
- */
-int wl1271_set_partition(struct wl1271 *wl,
-                          u32 mem_start, u32 mem_size,
-                          u32 reg_start, u32 reg_size)
+#define WL1271_BUSY_WORD_TIMEOUT 1000
+
+/* FIXME: Check busy words, removed due to SPI bug */
+#if 0
+static void wl1271_spi_read_busy(struct wl1271 *wl, void *buf, size_t len)
 {
-        struct wl1271_partition *partition;
-        struct spi_transfer t;
+        struct spi_transfer t[1];
         struct spi_message m;
-        size_t len, cmd_len;
-        u32 *cmd;
-        int addr;
-
-        cmd_len = sizeof(u32) + 2 * sizeof(struct wl1271_partition);
-        cmd = kzalloc(cmd_len, GFP_KERNEL);
-        if (!cmd)
-                return -ENOMEM;
-
-        spi_message_init(&m);
-        memset(&t, 0, sizeof(t));
+        u32 *busy_buf;
+        int num_busy_bytes = 0;
 
-        partition = (struct wl1271_partition *) (cmd + 1);
-        addr = HW_ACCESS_PART0_SIZE_ADDR;
-        len = 2 * sizeof(struct wl1271_partition);
+        wl1271_info("spi read BUSY!");
 
-        *cmd |= WSPI_CMD_WRITE;
-        *cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
-        *cmd |= addr & WSPI_CMD_BYTE_ADDR;
-
-        wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
-                     mem_start, mem_size);
-        wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
-                     reg_start, reg_size);
-
-        /* Make sure that the two partitions together don't exceed the
-         * address range */
-        if ((mem_size + reg_size) > HW_ACCESS_MEMORY_MAX_RANGE) {
-                wl1271_debug(DEBUG_SPI, "Total size exceeds maximum virtual"
-                             " address range.  Truncating partition[0].");
-                mem_size = HW_ACCESS_MEMORY_MAX_RANGE - reg_size;
-                wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
-                             mem_start, mem_size);
-                wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
-                             reg_start, reg_size);
-        }
-
-        if ((mem_start < reg_start) &&
-            ((mem_start + mem_size) > reg_start)) {
-                /* Guarantee that the memory partition doesn't overlap the
-                 * registers partition */
-                wl1271_debug(DEBUG_SPI, "End of partition[0] is "
-                             "overlapping partition[1].  Adjusted.");
-                mem_size = reg_start - mem_start;
-                wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
-                             mem_start, mem_size);
-                wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
-                             reg_start, reg_size);
-        } else if ((reg_start < mem_start) &&
-                   ((reg_start + reg_size) > mem_start)) {
-                /* Guarantee that the register partition doesn't overlap the
-                 * memory partition */
-                wl1271_debug(DEBUG_SPI, "End of partition[1] is"
-                             " overlapping partition[0].  Adjusted.");
-                reg_size = mem_start - reg_start;
-                wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
-                             mem_start, mem_size);
-                wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
-                             reg_start, reg_size);
+        /*
+         * Look for the non-busy word in the read buffer, and if found,
+         * read in the remaining data into the buffer.
+         */
+        busy_buf = (u32 *)buf;
+        for (; (u32)busy_buf < (u32)buf + len; busy_buf++) {
+                num_busy_bytes += sizeof(u32);
+                if (*busy_buf & 0x1) {
+                        spi_message_init(&m);
+                        memset(t, 0, sizeof(t));
+                        memmove(buf, busy_buf, len - num_busy_bytes);
+                        t[0].rx_buf = buf + (len - num_busy_bytes);
+                        t[0].len = num_busy_bytes;
+                        spi_message_add_tail(&t[0], &m);
+                        spi_sync(wl->spi, &m);
+                        return;
+                }
         }
 
-        partition[0].start = mem_start;
-        partition[0].size  = mem_size;
-        partition[1].start = reg_start;
-        partition[1].size  = reg_size;
-
-        wl->physical_mem_addr = mem_start;
-        wl->physical_reg_addr = reg_start;
-
-        wl->virtual_mem_addr = 0;
-        wl->virtual_reg_addr = mem_size;
-
-        t.tx_buf = cmd;
-        t.len = cmd_len;
-        spi_message_add_tail(&t, &m);
-
-        spi_sync(wl->spi, &m);
+        /*
+         * Read further busy words from SPI until a non-busy word is
+         * encountered, then read the data itself into the buffer.
+         */
+        wl1271_info("spi read BUSY-polling needed!");
 
-        kfree(cmd);
+        num_busy_bytes = WL1271_BUSY_WORD_TIMEOUT;
+        busy_buf = wl->buffer_busyword;
+        while (num_busy_bytes) {
+                num_busy_bytes--;
+                spi_message_init(&m);
+                memset(t, 0, sizeof(t));
+                t[0].rx_buf = busy_buf;
+                t[0].len = sizeof(u32);
+                spi_message_add_tail(&t[0], &m);
+                spi_sync(wl->spi, &m);
+
+                if (*busy_buf & 0x1) {
+                        spi_message_init(&m);
+                        memset(t, 0, sizeof(t));
+                        t[0].rx_buf = buf;
+                        t[0].len = len;
+                        spi_message_add_tail(&t[0], &m);
+                        spi_sync(wl->spi, &m);
+                        return;
+                }
+        }
 
-        return 0;
+        /* The SPI bus is unresponsive, the read failed. */
+        memset(buf, 0, len);
+        wl1271_error("SPI read busy-word timeout!\n");
 }
+#endif
 
-void wl1271_spi_read(struct wl1271 *wl, int addr, void *buf,
-                     size_t len, bool fixed)
+void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
+                         size_t len, bool fixed)
 {
         struct spi_transfer t[3];
         struct spi_message m;
-        u8 *busy_buf;
+        u32 *busy_buf;
         u32 *cmd;
 
         cmd = &wl->buffer_cmd;
@@ -281,14 +215,16 @@ void wl1271_spi_read(struct wl1271 *wl, int addr, void *buf,
 
         spi_sync(wl->spi, &m);
 
-        /* FIXME: check busy words */
+        /* FIXME: Check busy words, removed due to SPI bug */
+        /* if (!(busy_buf[WL1271_BUSY_WORD_CNT - 1] & 0x1))
+           wl1271_spi_read_busy(wl, buf, len); */
 
         wl1271_dump(DEBUG_SPI, "spi_read cmd -> ", cmd, sizeof(*cmd));
         wl1271_dump(DEBUG_SPI, "spi_read buf <- ", buf, len);
 }
 
-void wl1271_spi_write(struct wl1271 *wl, int addr, void *buf,
-                      size_t len, bool fixed)
+void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
+                          size_t len, bool fixed)
 {
         struct spi_transfer t[2];
         struct spi_message m;
@@ -320,63 +256,3 @@ void wl1271_spi_write(struct wl1271 *wl, int addr, void *buf,
         wl1271_dump(DEBUG_SPI, "spi_write cmd -> ", cmd, sizeof(*cmd));
         wl1271_dump(DEBUG_SPI, "spi_write buf -> ", buf, len);
 }
-
-void wl1271_spi_mem_read(struct wl1271 *wl, int addr, void *buf,
-                         size_t len)
-{
-        int physical;
-
-        physical = wl1271_translate_mem_addr(wl, addr);
-
-        wl1271_spi_read(wl, physical, buf, len, false);
-}
-
-void wl1271_spi_mem_write(struct wl1271 *wl, int addr, void *buf,
-                          size_t len)
-{
-        int physical;
-
-        physical = wl1271_translate_mem_addr(wl, addr);
-
-        wl1271_spi_write(wl, physical, buf, len, false);
-}
-
-void wl1271_spi_reg_read(struct wl1271 *wl, int addr, void *buf, size_t len,
-                         bool fixed)
-{
-        int physical;
-
-        physical = wl1271_translate_reg_addr(wl, addr);
-
-        wl1271_spi_read(wl, physical, buf, len, fixed);
-}
-
-void wl1271_spi_reg_write(struct wl1271 *wl, int addr, void *buf, size_t len,
-                          bool fixed)
-{
-        int physical;
-
-        physical = wl1271_translate_reg_addr(wl, addr);
-
-        wl1271_spi_write(wl, physical, buf, len, fixed);
-}
-
-u32 wl1271_mem_read32(struct wl1271 *wl, int addr)
-{
-        return wl1271_read32(wl, wl1271_translate_mem_addr(wl, addr));
-}
-
-void wl1271_mem_write32(struct wl1271 *wl, int addr, u32 val)
-{
-        wl1271_write32(wl, wl1271_translate_mem_addr(wl, addr), val);
-}
-
-u32 wl1271_reg_read32(struct wl1271 *wl, int addr)
-{
-        return wl1271_read32(wl, wl1271_translate_reg_addr(wl, addr));
-}
-
-void wl1271_reg_write32(struct wl1271 *wl, int addr, u32 val)
-{
-        wl1271_write32(wl, wl1271_translate_reg_addr(wl, addr), val);
-}
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.h b/drivers/net/wireless/wl12xx/wl1271_spi.h
index 2c9968458646..a803596dad4a 100644
--- a/drivers/net/wireless/wl12xx/wl1271_spi.h
+++ b/drivers/net/wireless/wl12xx/wl1271_spi.h
@@ -29,10 +29,14 @@
 
 #define HW_ACCESS_MEMORY_MAX_RANGE              0x1FFC0
 
-#define HW_ACCESS_PART0_SIZE_ADDR           0x1FFC0
-#define HW_ACCESS_PART0_START_ADDR          0x1FFC4
-#define HW_ACCESS_PART1_SIZE_ADDR           0x1FFC8
-#define HW_ACCESS_PART1_START_ADDR          0x1FFCC
+#define HW_PARTITION_REGISTERS_ADDR         0x1ffc0
+#define HW_PART0_SIZE_ADDR                  (HW_PARTITION_REGISTERS_ADDR)
+#define HW_PART0_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 4)
+#define HW_PART1_SIZE_ADDR                  (HW_PARTITION_REGISTERS_ADDR + 8)
+#define HW_PART1_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 12)
+#define HW_PART2_SIZE_ADDR                  (HW_PARTITION_REGISTERS_ADDR + 16)
+#define HW_PART2_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 20)
+#define HW_PART3_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 24)
 
 #define HW_ACCESS_REGISTER_SIZE             4
 
@@ -67,47 +71,26 @@
                 ((WL1271_BUSY_WORD_LEN - 4) / sizeof(u32))
 #define HW_ACCESS_WSPI_INIT_CMD_MASK  0
 
+#define OCP_CMD_LOOP  32
+
+#define OCP_CMD_WRITE 0x1
+#define OCP_CMD_READ  0x2
+
+#define OCP_READY_MASK  BIT(18)
+#define OCP_STATUS_MASK (BIT(16) | BIT(17))
+
+#define OCP_STATUS_NO_RESP    0x00000
+#define OCP_STATUS_OK         0x10000
+#define OCP_STATUS_REQ_FAILED 0x20000
+#define OCP_STATUS_RESP_ERROR 0x30000
 
 /* Raw target IO, address is not translated */
-void wl1271_spi_write(struct wl1271 *wl, int addr, void *buf,
+void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
                       size_t len, bool fixed);
-void wl1271_spi_read(struct wl1271 *wl, int addr, void *buf,
+void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
                      size_t len, bool fixed);
 
-/* Memory target IO, address is tranlated to partition 0 */
-void wl1271_spi_mem_read(struct wl1271 *wl, int addr, void *buf, size_t len);
-void wl1271_spi_mem_write(struct wl1271 *wl, int addr, void *buf, size_t len);
-u32 wl1271_mem_read32(struct wl1271 *wl, int addr);
-void wl1271_mem_write32(struct wl1271 *wl, int addr, u32 val);
-
-/* Registers IO */
-void wl1271_spi_reg_read(struct wl1271 *wl, int addr, void *buf, size_t len,
-                         bool fixed);
-void wl1271_spi_reg_write(struct wl1271 *wl, int addr, void *buf, size_t len,
-                          bool fixed);
-u32 wl1271_reg_read32(struct wl1271 *wl, int addr);
-void wl1271_reg_write32(struct wl1271 *wl, int addr, u32 val);
-
 /* INIT and RESET words */
 void wl1271_spi_reset(struct wl1271 *wl);
 void wl1271_spi_init(struct wl1271 *wl);
-int wl1271_set_partition(struct wl1271 *wl,
-                         u32 part_start, u32 part_size,
-                         u32 reg_start,  u32 reg_size);
-
-static inline u32 wl1271_read32(struct wl1271 *wl, int addr)
-{
-        wl1271_spi_read(wl, addr, &wl->buffer_32,
-                        sizeof(wl->buffer_32), false);
-
-        return wl->buffer_32;
-}
-
-static inline void wl1271_write32(struct wl1271 *wl, int addr, u32 val)
-{
-        wl->buffer_32 = val;
-        wl1271_spi_write(wl, addr, &wl->buffer_32,
-                         sizeof(wl->buffer_32), false);
-}
-
 #endif /* __WL1271_SPI_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_testmode.c b/drivers/net/wireless/wl12xx/wl1271_testmode.c
new file mode 100644
index 000000000000..5c1c4f565fd8
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_testmode.c
@@ -0,0 +1,284 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2010 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+#include "wl1271_testmode.h"
+
+#include <linux/slab.h>
+#include <net/genetlink.h>
+
+#include "wl1271.h"
+#include "wl1271_spi.h"
+#include "wl1271_acx.h"
+
+#define WL1271_TM_MAX_DATA_LENGTH 1024
+
+enum wl1271_tm_commands {
+        WL1271_TM_CMD_UNSPEC,
+        WL1271_TM_CMD_TEST,
+        WL1271_TM_CMD_INTERROGATE,
+        WL1271_TM_CMD_CONFIGURE,
+        WL1271_TM_CMD_NVS_PUSH,
+        WL1271_TM_CMD_SET_PLT_MODE,
+
+        __WL1271_TM_CMD_AFTER_LAST
+};
+#define WL1271_TM_CMD_MAX (__WL1271_TM_CMD_AFTER_LAST - 1)
+
+enum wl1271_tm_attrs {
+        WL1271_TM_ATTR_UNSPEC,
+        WL1271_TM_ATTR_CMD_ID,
+        WL1271_TM_ATTR_ANSWER,
+        WL1271_TM_ATTR_DATA,
+        WL1271_TM_ATTR_IE_ID,
+        WL1271_TM_ATTR_PLT_MODE,
+
+        __WL1271_TM_ATTR_AFTER_LAST
+};
+#define WL1271_TM_ATTR_MAX (__WL1271_TM_ATTR_AFTER_LAST - 1)
+
+static struct nla_policy wl1271_tm_policy[WL1271_TM_ATTR_MAX + 1] = {
+        [WL1271_TM_ATTR_CMD_ID] =       { .type = NLA_U32 },
+        [WL1271_TM_ATTR_ANSWER] =       { .type = NLA_U8 },
+        [WL1271_TM_ATTR_DATA] =         { .type = NLA_BINARY,
+                                          .len = WL1271_TM_MAX_DATA_LENGTH },
+        [WL1271_TM_ATTR_IE_ID] =        { .type = NLA_U32 },
+        [WL1271_TM_ATTR_PLT_MODE] =     { .type = NLA_U32 },
+};
+
+
+static int wl1271_tm_cmd_test(struct wl1271 *wl, struct nlattr *tb[])
+{
+        int buf_len, ret, len;
+        struct sk_buff *skb;
+        void *buf;
+        u8 answer = 0;
+
+        wl1271_debug(DEBUG_TESTMODE, "testmode cmd test");
+
+        if (!tb[WL1271_TM_ATTR_DATA])
+                return -EINVAL;
+
+        buf = nla_data(tb[WL1271_TM_ATTR_DATA]);
+        buf_len = nla_len(tb[WL1271_TM_ATTR_DATA]);
+
+        if (tb[WL1271_TM_ATTR_ANSWER])
+                answer = nla_get_u8(tb[WL1271_TM_ATTR_ANSWER]);
+
+        if (buf_len > sizeof(struct wl1271_command))
+                return -EMSGSIZE;
+
+        mutex_lock(&wl->mutex);
+        ret = wl1271_cmd_test(wl, buf, buf_len, answer);
+        mutex_unlock(&wl->mutex);
+
+        if (ret < 0) {
+                wl1271_warning("testmode cmd test failed: %d", ret);
+                return ret;
+        }
+
+        if (answer) {
+                len = nla_total_size(buf_len);
+                skb = cfg80211_testmode_alloc_reply_skb(wl->hw->wiphy, len);
+                if (!skb)
+                        return -ENOMEM;
+
+                NLA_PUT(skb, WL1271_TM_ATTR_DATA, buf_len, buf);
+                ret = cfg80211_testmode_reply(skb);
+                if (ret < 0)
+                        return ret;
+        }
+
+        return 0;
+
+nla_put_failure:
+        kfree_skb(skb);
+        return -EMSGSIZE;
+}
+
+static int wl1271_tm_cmd_interrogate(struct wl1271 *wl, struct nlattr *tb[])
+{
+        int ret;
+        struct wl1271_command *cmd;
+        struct sk_buff *skb;
+        u8 ie_id;
+
+        wl1271_debug(DEBUG_TESTMODE, "testmode cmd interrogate");
+
+        if (!tb[WL1271_TM_ATTR_IE_ID])
+                return -EINVAL;
+
+        ie_id = nla_get_u8(tb[WL1271_TM_ATTR_IE_ID]);
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        mutex_lock(&wl->mutex);
+        ret = wl1271_cmd_interrogate(wl, ie_id, cmd, sizeof(*cmd));
+        mutex_unlock(&wl->mutex);
+
+        if (ret < 0) {
+                wl1271_warning("testmode cmd interrogate failed: %d", ret);
+                return ret;
+        }
+
+        skb = cfg80211_testmode_alloc_reply_skb(wl->hw->wiphy, sizeof(*cmd));
+        if (!skb)
+                return -ENOMEM;
+
+        NLA_PUT(skb, WL1271_TM_ATTR_DATA, sizeof(*cmd), cmd);
+
+        return 0;
+
+nla_put_failure:
+        kfree_skb(skb);
+        return -EMSGSIZE;
+}
+
+static int wl1271_tm_cmd_configure(struct wl1271 *wl, struct nlattr *tb[])
+{
+        int buf_len, ret;
+        void *buf;
+        u8 ie_id;
+
+        wl1271_debug(DEBUG_TESTMODE, "testmode cmd configure");
+
+        if (!tb[WL1271_TM_ATTR_DATA])
+                return -EINVAL;
+        if (!tb[WL1271_TM_ATTR_IE_ID])
+                return -EINVAL;
+
+        ie_id = nla_get_u8(tb[WL1271_TM_ATTR_IE_ID]);
+        buf = nla_data(tb[WL1271_TM_ATTR_DATA]);
+        buf_len = nla_len(tb[WL1271_TM_ATTR_DATA]);
+
+        if (buf_len > sizeof(struct wl1271_command))
+                return -EMSGSIZE;
+
+        mutex_lock(&wl->mutex);
+        ret = wl1271_cmd_configure(wl, ie_id, buf, buf_len);
+        mutex_unlock(&wl->mutex);
+
+        if (ret < 0) {
+                wl1271_warning("testmode cmd configure failed: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[])
+{
+        int ret = 0;
+        size_t len;
+        void *buf;
+
+        wl1271_debug(DEBUG_TESTMODE, "testmode cmd nvs push");
+
+        if (!tb[WL1271_TM_ATTR_DATA])
+                return -EINVAL;
+
+        buf = nla_data(tb[WL1271_TM_ATTR_DATA]);
+        len = nla_len(tb[WL1271_TM_ATTR_DATA]);
+
+        if (len != sizeof(struct wl1271_nvs_file)) {
+                wl1271_error("nvs size is not as expected: %zu != %zu",
+                             len, sizeof(struct wl1271_nvs_file));
+                return -EMSGSIZE;
+        }
+
+        mutex_lock(&wl->mutex);
+
+        kfree(wl->nvs);
+
+        wl->nvs = kmalloc(sizeof(struct wl1271_nvs_file), GFP_KERNEL);
+        if (!wl->nvs) {
+                wl1271_error("could not allocate memory for the nvs file");
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        memcpy(wl->nvs, buf, len);
+
+        wl1271_debug(DEBUG_TESTMODE, "testmode pushed nvs");
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
+static int wl1271_tm_cmd_set_plt_mode(struct wl1271 *wl, struct nlattr *tb[])
+{
+        u32 val;
+        int ret;
+
+        wl1271_debug(DEBUG_TESTMODE, "testmode cmd set plt mode");
+
+        if (!tb[WL1271_TM_ATTR_PLT_MODE])
+                return -EINVAL;
+
+        val = nla_get_u32(tb[WL1271_TM_ATTR_PLT_MODE]);
+
+        switch (val) {
+        case 0:
+                ret = wl1271_plt_stop(wl);
+                break;
+        case 1:
+                ret = wl1271_plt_start(wl);
+                break;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+
+        return ret;
+}
+
+int wl1271_tm_cmd(struct ieee80211_hw *hw, void *data, int len)
+{
+        struct wl1271 *wl = hw->priv;
+        struct nlattr *tb[WL1271_TM_ATTR_MAX + 1];
+        int err;
+
+        err = nla_parse(tb, WL1271_TM_ATTR_MAX, data, len, wl1271_tm_policy);
+        if (err)
+                return err;
+
+        if (!tb[WL1271_TM_ATTR_CMD_ID])
+                return -EINVAL;
+
+        switch (nla_get_u32(tb[WL1271_TM_ATTR_CMD_ID])) {
+        case WL1271_TM_CMD_TEST:
+                return wl1271_tm_cmd_test(wl, tb);
+        case WL1271_TM_CMD_INTERROGATE:
+                return wl1271_tm_cmd_interrogate(wl, tb);
+        case WL1271_TM_CMD_CONFIGURE:
+                return wl1271_tm_cmd_configure(wl, tb);
+        case WL1271_TM_CMD_NVS_PUSH:
+                return wl1271_tm_cmd_nvs_push(wl, tb);
+        case WL1271_TM_CMD_SET_PLT_MODE:
+                return wl1271_tm_cmd_set_plt_mode(wl, tb);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
diff --git a/drivers/net/wireless/wl12xx/wl1251_netlink.h b/drivers/net/wireless/wl12xx/wl1271_testmode.h
index ee36695e134e..c196d28f9d9d 100644
--- a/drivers/net/wireless/wl12xx/wl1251_netlink.h
+++ b/drivers/net/wireless/wl12xx/wl1271_testmode.h
@@ -1,9 +1,9 @@
 /*
- * This file is part of wl1251
+ * This file is part of wl1271
  *
- * Copyright (C) 2009 Nokia Corporation
+ * Copyright (C) 2010 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -21,10 +21,11 @@
  *
  */
 
-#ifndef __WL1251_NETLINK_H__
-#define __WL1251_NETLINK_H__
+#ifndef __WL1271_TESTMODE_H__
+#define __WL1271_TESTMODE_H__
 
-int wl1251_nl_register(void);
-void wl1251_nl_unregister(void);
+#include <net/mac80211.h>
 
-#endif /* __WL1251_NETLINK_H__ */
+int wl1271_tm_cmd(struct ieee80211_hw *hw, void *data, int len);
+
+#endif /* __WL1271_TESTMODE_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.c b/drivers/net/wireless/wl12xx/wl1271_tx.c
index ff221258b941..811e739d05bf 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.c
@@ -26,6 +26,7 @@
 
 #include "wl1271.h"
 #include "wl1271_spi.h"
+#include "wl1271_io.h"
 #include "wl1271_reg.h"
 #include "wl1271_ps.h"
 #include "wl1271_tx.h"
@@ -33,8 +34,7 @@
 static int wl1271_tx_id(struct wl1271 *wl, struct sk_buff *skb)
 {
         int i;
-
-        for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
+        for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 if (wl->tx_frames[i] == NULL) {
                         wl->tx_frames[i] = skb;
                         return i;
@@ -58,8 +58,8 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra)
         /* approximate the number of blocks required for this packet
            in the firmware */
         /* FIXME: try to figure out what is done here and make it cleaner */
-        total_blocks = (skb->len) >> TX_HW_BLOCK_SHIFT_DIV;
-        excluded = (total_blocks << 2) + (skb->len & 0xff) + 34;
+        total_blocks = (total_len + 20) >> TX_HW_BLOCK_SHIFT_DIV;
+        excluded = (total_blocks << 2) + ((total_len + 20) & 0xff) + 34;
         total_blocks += (excluded > 252) ? 2 : 1;
         total_blocks += TX_HW_BLOCK_SPARE;
 
@@ -88,29 +88,48 @@ static int wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
                               u32 extra, struct ieee80211_tx_info *control)
 {
         struct wl1271_tx_hw_descr *desc;
-        int pad;
+        int pad, ac;
+        u16 tx_attr;
 
         desc = (struct wl1271_tx_hw_descr *) skb->data;
 
+        /* relocate space for security header */
+        if (extra) {
+                void *framestart = skb->data + sizeof(*desc);
+                u16 fc = *(u16 *)(framestart + extra);
+                int hdrlen = ieee80211_hdrlen(cpu_to_le16(fc));
+                memmove(framestart, framestart + extra, hdrlen);
+        }
+
         /* configure packet life time */
-        desc->start_time = jiffies_to_usecs(jiffies) - wl->time_offset;
-        desc->life_time = TX_HW_MGMT_PKT_LIFETIME_TU;
+        desc->start_time = cpu_to_le32(jiffies_to_usecs(jiffies) -
+                                       wl->time_offset);
+        desc->life_time = cpu_to_le16(TX_HW_MGMT_PKT_LIFETIME_TU);
 
         /* configure the tx attributes */
-        desc->tx_attr = wl->session_counter << TX_HW_ATTR_OFST_SESSION_COUNTER;
-        /* FIXME: do we know the packet priority? can we identify mgmt
-           packets, and use max prio for them at least? */
-        desc->tid = 0;
+        tx_attr = wl->session_counter << TX_HW_ATTR_OFST_SESSION_COUNTER;
+
+        /* queue */
+        ac = wl1271_tx_get_queue(skb_get_queue_mapping(skb));
+        desc->tid = wl1271_tx_ac_to_tid(ac);
+
         desc->aid = TX_HW_DEFAULT_AID;
         desc->reserved = 0;
 
         /* align the length (and store in terms of words) */
         pad = WL1271_TX_ALIGN(skb->len);
-        desc->length = pad >> 2;
+        desc->length = cpu_to_le16(pad >> 2);
 
         /* calculate number of padding bytes */
         pad = pad - skb->len;
-        desc->tx_attr |= pad << TX_HW_ATTR_OFST_LAST_WORD_PAD;
+        tx_attr |= pad << TX_HW_ATTR_OFST_LAST_WORD_PAD;
+
+        /* if the packets are destined for AP (have a STA entry) send them
+           with AP rate policies, otherwise use default basic rates */
+        if (control->control.sta)
+                tx_attr |= ACX_TX_AP_FULL_RATE << TX_HW_ATTR_OFST_RATE_POLICY;
+
+        desc->tx_attr = cpu_to_le16(tx_attr);
 
         wl1271_debug(DEBUG_TX, "tx_fill_hdr: pad: %d", pad);
         return 0;
@@ -147,11 +166,11 @@ static int wl1271_tx_send_packet(struct wl1271 *wl, struct sk_buff *skb,
         len = WL1271_TX_ALIGN(skb->len);
 
         /* perform a fixed address block write with the packet */
-        wl1271_spi_reg_write(wl, WL1271_SLV_MEM_DATA, skb->data, len, true);
+        wl1271_write(wl, WL1271_SLV_MEM_DATA, skb->data, len, true);
 
         /* write packet new counter into the write access register */
         wl->tx_packets_count++;
-        wl1271_reg_write32(wl, WL1271_HOST_WR_ACCESS, wl->tx_packets_count);
+        wl1271_write32(wl, WL1271_HOST_WR_ACCESS, wl->tx_packets_count);
 
         desc = (struct wl1271_tx_hw_descr *) skb->data;
         wl1271_debug(DEBUG_TX, "tx id %u skb 0x%p payload %u (%u words)",
@@ -185,6 +204,7 @@ static int wl1271_tx_frame(struct wl1271 *wl, struct sk_buff *skb)
                         ret = wl1271_cmd_set_default_wep_key(wl, idx);
                         if (ret < 0)
                                 return ret;
+                        wl->default_key = idx;
                 }
         }
 
@@ -203,18 +223,50 @@ static int wl1271_tx_frame(struct wl1271 *wl, struct sk_buff *skb)
         return ret;
 }
 
+static u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set)
+{
+        struct ieee80211_supported_band *band;
+        u32 enabled_rates = 0;
+        int bit;
+
+        band = wl->hw->wiphy->bands[wl->band];
+        for (bit = 0; bit < band->n_bitrates; bit++) {
+                if (rate_set & 0x1)
+                        enabled_rates |= band->bitrates[bit].hw_value;
+                rate_set >>= 1;
+        }
+
+        return enabled_rates;
+}
+
 void wl1271_tx_work(struct work_struct *work)
 {
         struct wl1271 *wl = container_of(work, struct wl1271, tx_work);
         struct sk_buff *skb;
         bool woken_up = false;
+        u32 sta_rates = 0;
         int ret;
 
+        /* check if the rates supported by the AP have changed */
+        if (unlikely(test_and_clear_bit(WL1271_FLAG_STA_RATES_CHANGED,
+                                        &wl->flags))) {
+                unsigned long flags;
+                spin_lock_irqsave(&wl->wl_lock, flags);
+                sta_rates = wl->sta_rate_set;
+                spin_unlock_irqrestore(&wl->wl_lock, flags);
+        }
+
         mutex_lock(&wl->mutex);
 
         if (unlikely(wl->state == WL1271_STATE_OFF))
                 goto out;
 
+        /* if rates have changed, re-configure the rate policy */
+        if (unlikely(sta_rates)) {
+                wl->rate_set = wl1271_tx_enabled_rates_get(wl, sta_rates);
+                wl1271_acx_rate_policies(wl);
+        }
+
         while ((skb = skb_dequeue(&wl->tx_queue))) {
                 if (!woken_up) {
                         ret = wl1271_ps_elp_wakeup(wl, false);
@@ -229,18 +281,18 @@ void wl1271_tx_work(struct work_struct *work)
                         wl1271_debug(DEBUG_TX, "tx_work: fw buffer full, "
                                      "stop queues");
                         ieee80211_stop_queues(wl->hw);
-                        wl->tx_queue_stopped = true;
+                        set_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags);
                         skb_queue_head(&wl->tx_queue, skb);
                         goto out;
                 } else if (ret < 0) {
                         dev_kfree_skb(skb);
                         goto out;
-                } else if (wl->tx_queue_stopped) {
+                } else if (test_and_clear_bit(WL1271_FLAG_TX_QUEUE_STOPPED,
+                                              &wl->flags)) {
                         /* firmware buffer has space, restart queues */
                         wl1271_debug(DEBUG_TX,
                                      "complete_packet: waking queues");
                         ieee80211_wake_queues(wl->hw);
-                        wl->tx_queue_stopped = false;
                 }
         }
 
@@ -254,14 +306,13 @@ out:
 static void wl1271_tx_complete_packet(struct wl1271 *wl,
                                       struct wl1271_tx_hw_res_descr *result)
 {
-
         struct ieee80211_tx_info *info;
         struct sk_buff *skb;
-        u32 header_len;
+        u16 seq;
         int id = result->id;
 
         /* check for id legality */
-        if (id >= TX_HW_RESULT_QUEUE_LEN || wl->tx_frames[id] == NULL) {
+        if (id >= ACX_TX_DESCRIPTORS || wl->tx_frames[id] == NULL) {
                 wl1271_warning("TX result illegal id: %d", id);
                 return;
         }
@@ -284,22 +335,32 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
         /* info->status.retry_count = result->ack_failures; */
         wl->stats.retry_count += result->ack_failures;
 
-        /* get header len */
+        /* update security sequence number */
+        seq = wl->tx_security_seq_16 +
+                (result->lsb_security_sequence_number -
+                 wl->tx_security_last_seq);
+        wl->tx_security_last_seq = result->lsb_security_sequence_number;
+
+        if (seq < wl->tx_security_seq_16)
+                wl->tx_security_seq_32++;
+        wl->tx_security_seq_16 = seq;
+
+        /* remove private header from packet */
+        skb_pull(skb, sizeof(struct wl1271_tx_hw_descr));
+
+        /* remove TKIP header space if present */
         if (info->control.hw_key &&
-            info->control.hw_key->alg == ALG_TKIP)
-                header_len = WL1271_TKIP_IV_SPACE +
-                        sizeof(struct wl1271_tx_hw_descr);
-        else
-                header_len = sizeof(struct wl1271_tx_hw_descr);
+            info->control.hw_key->alg == ALG_TKIP) {
+                int hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+                memmove(skb->data + WL1271_TKIP_IV_SPACE, skb->data, hdrlen);
+                skb_pull(skb, WL1271_TKIP_IV_SPACE);
+        }
 
         wl1271_debug(DEBUG_TX, "tx status id %u skb 0x%p failures %u rate 0x%x"
                      " status 0x%x",
                      result->id, skb, result->ack_failures,
                      result->rate_class_index, result->status);
 
-        /* remove private header from packet */
-        skb_pull(skb, header_len);
-
         /* return the packet to the stack */
         ieee80211_tx_status(wl->hw, skb);
         wl->tx_frames[result->id] = NULL;
@@ -315,8 +376,8 @@ void wl1271_tx_complete(struct wl1271 *wl, u32 count)
         wl1271_debug(DEBUG_TX, "tx_complete received, packets: %d", count);
 
         /* read the tx results from the chipset */
-        wl1271_spi_mem_read(wl, memmap->tx_result,
-                            wl->tx_res_if, sizeof(*wl->tx_res_if));
+        wl1271_read(wl, le32_to_cpu(memmap->tx_result),
+                    wl->tx_res_if, sizeof(*wl->tx_res_if), false);
 
         /* verify that the result buffer is not getting overrun */
         if (count > TX_HW_RESULT_QUEUE_LEN) {
@@ -337,10 +398,10 @@ void wl1271_tx_complete(struct wl1271 *wl, u32 count)
         }
 
         /* write host counter to chipset (to ack) */
-        wl1271_mem_write32(wl, memmap->tx_result +
-                           offsetof(struct wl1271_tx_hw_res_if,
-                                    tx_result_host_counter),
-                           wl->tx_res_if->tx_result_fw_counter);
+        wl1271_write32(wl, le32_to_cpu(memmap->tx_result) +
+                       offsetof(struct wl1271_tx_hw_res_if,
+                       tx_result_host_counter),
+                       le32_to_cpu(wl->tx_res_if->tx_result_fw_counter));
 }
 
 /* caller must hold wl->mutex */
@@ -364,7 +425,7 @@ void wl1271_tx_flush(struct wl1271 *wl)
                 ieee80211_tx_status(wl->hw, skb);
         }
 
-        for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
+        for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 if (wl->tx_frames[i] != NULL) {
                         skb = wl->tx_frames[i];
                         info = IEEE80211_SKB_CB(skb);
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.h b/drivers/net/wireless/wl12xx/wl1271_tx.h
index 4a614067ddba..17e405a09caa 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.h
@@ -58,7 +58,7 @@
 
 struct wl1271_tx_hw_descr {
         /* Length of packet in words, including descriptor+header+data */
-        u16 length;
+        __le16 length;
         /* Number of extra memory blocks to allocate for this packet in
            addition to the number of blocks derived from the packet length */
         u8 extra_mem_blocks;
@@ -67,12 +67,12 @@ struct wl1271_tx_hw_descr {
            HW!! */
         u8 total_mem_blocks;
         /* Device time (in us) when the packet arrived to the driver */
-        u32 start_time;
+        __le32 start_time;
         /* Max delay in TUs until transmission. The last device time the
            packet can be transmitted is: startTime+(1024*LifeTime) */
-        u16 life_time;
+        __le16 life_time;
         /* Bitwise fields - see TX_ATTR... definitions above. */
-        u16 tx_attr;
+        __le16 tx_attr;
         /* Packet identifier used also in the Tx-Result. */
         u8 id;
         /* The packet TID value (as User-Priority) */
@@ -100,12 +100,12 @@ struct wl1271_tx_hw_res_descr {
            several possible reasons for failure. */
         u8 status;
         /* Total air access duration including all retrys and overheads.*/
-        u16 medium_usage;
+        __le16 medium_usage;
         /* The time passed from host xfer to Tx-complete.*/
-        u32 fw_handling_time;
+        __le32 fw_handling_time;
         /* Total media delay
            (from 1st EDCA AIFS counter until TX Complete). */
-        u32 medium_delay;
+        __le32 medium_delay;
         /* LS-byte of last TKIP seq-num (saved per AC for recovery). */
         u8 lsb_security_sequence_number;
         /* Retry count - number of transmissions without successful ACK.*/
@@ -118,11 +118,47 @@ struct wl1271_tx_hw_res_descr {
 } __attribute__ ((packed));
 
 struct wl1271_tx_hw_res_if {
-        u32 tx_result_fw_counter;
-        u32 tx_result_host_counter;
+        __le32 tx_result_fw_counter;
+        __le32 tx_result_host_counter;
         struct wl1271_tx_hw_res_descr tx_results_queue[TX_HW_RESULT_QUEUE_LEN];
 } __attribute__ ((packed));
 
+static inline int wl1271_tx_get_queue(int queue)
+{
+        /* FIXME: use best effort until WMM is enabled */
+        return CONF_TX_AC_BE;
+
+        switch (queue) {
+        case 0:
+                return CONF_TX_AC_VO;
+        case 1:
+                return CONF_TX_AC_VI;
+        case 2:
+                return CONF_TX_AC_BE;
+        case 3:
+                return CONF_TX_AC_BK;
+        default:
+                return CONF_TX_AC_BE;
+        }
+}
+
+/* wl1271 tx descriptor needs the tid and we need to convert it from ac */
+static inline int wl1271_tx_ac_to_tid(int ac)
+{
+        switch (ac) {
+        case 0:
+                return 0;
+        case 1:
+                return 2;
+        case 2:
+                return 4;
+        case 3:
+                return 6;
+        default:
+                return 0;
+        }
+}
+
 void wl1271_tx_work(struct work_struct *work);
 void wl1271_tx_complete(struct wl1271 *wl, u32 count);
 void wl1271_tx_flush(struct wl1271 *wl);
diff --git a/drivers/net/wireless/wl12xx/wl12xx_80211.h b/drivers/net/wireless/wl12xx/wl12xx_80211.h
index 657c2dbcb7d3..055d7bc6f592 100644
--- a/drivers/net/wireless/wl12xx/wl12xx_80211.h
+++ b/drivers/net/wireless/wl12xx/wl12xx_80211.h
@@ -122,8 +122,8 @@ struct wl12xx_null_data_template {
 } __attribute__ ((packed));
 
 struct wl12xx_ps_poll_template {
-        u16 fc;
-        u16 aid;
+        __le16 fc;
+        __le16 aid;
         u8 bssid[ETH_ALEN];
         u8 ta[ETH_ALEN];
 } __attribute__ ((packed));
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 4f1e0cfe609b..7b9621de239f 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -67,23 +67,7 @@
 /* For rough constant delay */
 #define WL3501_NOPLOOP(n) { int x = 0; while (x++ < n) slow_down_io(); }
 
-/*
- * All the PCMCIA modules use PCMCIA_DEBUG to control debugging.  If you do not
- * define PCMCIA_DEBUG at all, all the debug code will be left out.  If you
- * compile with PCMCIA_DEBUG=0, the debug code will be present but disabled --
- * but it can then be enabled for specific modules at load time with a
- * 'pc_debug=#' option to insmod.
- */
-#define PCMCIA_DEBUG 0
-#ifdef PCMCIA_DEBUG
-static int pc_debug = PCMCIA_DEBUG;
-module_param(pc_debug, int, 0);
-#define dprintk(n, format, args...) \
-        { if (pc_debug > (n)) \
-                printk(KERN_INFO "%s: " format "\n", __func__ , ##args); }
-#else
-#define dprintk(n, format, args...)
-#endif
+
 
 #define wl3501_outb(a, b) { outb(a, b); slow_down_io(); }
 #define wl3501_outb_p(a, b) { outb_p(a, b); slow_down_io(); }
@@ -381,7 +365,7 @@ static void wl3501_free_tx_buffer(struct wl3501_card *this, u16 ptr)
 
 static int wl3501_esbq_req_test(struct wl3501_card *this)
 {
-        u8 tmp;
+        u8 tmp = 0;
 
         wl3501_get_from_wla(this, this->esbq_req_head + 3, &tmp, sizeof(tmp));
         return tmp & 0x80;
@@ -684,10 +668,10 @@ static void wl3501_mgmt_scan_confirm(struct wl3501_card *this, u16 addr)
         int matchflag = 0;
         struct wl3501_scan_confirm sig;
 
-        dprintk(3, "entry");
+        pr_debug("entry");
         wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
         if (sig.status == WL3501_STATUS_SUCCESS) {
-                dprintk(3, "success");
+                pr_debug("success");
                 if ((this->net_type == IW_MODE_INFRA &&
                      (sig.cap_info & WL3501_MGMT_CAPABILITY_ESS)) ||
                     (this->net_type == IW_MODE_ADHOC &&
@@ -722,7 +706,7 @@ static void wl3501_mgmt_scan_confirm(struct wl3501_card *this, u16 addr)
                         }
                 }
         } else if (sig.status == WL3501_STATUS_TIMEOUT) {
-                dprintk(3, "timeout");
+                pr_debug("timeout");
                 this->join_sta_bss = 0;
                 for (i = this->join_sta_bss; i < this->bss_cnt; i++)
                         if (!wl3501_mgmt_join(this, i))
@@ -879,7 +863,7 @@ static int wl3501_mgmt_auth(struct wl3501_card *this)
                 .timeout = 1000,
         };
 
-        dprintk(3, "entry");
+        pr_debug("entry");
         memcpy(sig.mac_addr, this->bssid, ETH_ALEN);
         return wl3501_esbq_exec(this, &sig, sizeof(sig));
 }
@@ -893,7 +877,7 @@ static int wl3501_mgmt_association(struct wl3501_card *this)
                 .cap_info        = this->cap_info,
         };
 
-        dprintk(3, "entry");
+        pr_debug("entry");
         memcpy(sig.mac_addr, this->bssid, ETH_ALEN);
         return wl3501_esbq_exec(this, &sig, sizeof(sig));
 }
@@ -903,7 +887,7 @@ static void wl3501_mgmt_join_confirm(struct net_device *dev, u16 addr)
         struct wl3501_card *this = netdev_priv(dev);
         struct wl3501_join_confirm sig;
 
-        dprintk(3, "entry");
+        pr_debug("entry");
         wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
         if (sig.status == WL3501_STATUS_SUCCESS) {
                 if (this->net_type == IW_MODE_INFRA) {
@@ -962,7 +946,7 @@ static inline void wl3501_md_confirm_interrupt(struct net_device *dev,
 {
         struct wl3501_md_confirm sig;
 
-        dprintk(3, "entry");
+        pr_debug("entry");
         wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
         wl3501_free_tx_buffer(this, sig.data);
         if (netif_queue_stopped(dev))
@@ -1017,7 +1001,7 @@ static inline void wl3501_md_ind_interrupt(struct net_device *dev,
 static inline void wl3501_get_confirm_interrupt(struct wl3501_card *this,
                                                 u16 addr, void *sig, int size)
 {
-        dprintk(3, "entry");
+        pr_debug("entry");
         wl3501_get_from_wla(this, addr, &this->sig_get_confirm,
                             sizeof(this->sig_get_confirm));
         wake_up(&this->wait);
@@ -1029,7 +1013,7 @@ static inline void wl3501_start_confirm_interrupt(struct net_device *dev,
 {
         struct wl3501_start_confirm sig;
 
-        dprintk(3, "entry");
+        pr_debug("entry");
         wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
         if (sig.status == WL3501_STATUS_SUCCESS)
                 netif_wake_queue(dev);
@@ -1041,7 +1025,7 @@ static inline void wl3501_assoc_confirm_interrupt(struct net_device *dev,
         struct wl3501_card *this = netdev_priv(dev);
         struct wl3501_assoc_confirm sig;
 
-        dprintk(3, "entry");
+        pr_debug("entry");
         wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
 
         if (sig.status == WL3501_STATUS_SUCCESS)
@@ -1053,7 +1037,7 @@ static inline void wl3501_auth_confirm_interrupt(struct wl3501_card *this,
 {
         struct wl3501_auth_confirm sig;
 
-        dprintk(3, "entry");
+        pr_debug("entry");
         wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
 
         if (sig.status == WL3501_STATUS_SUCCESS)
@@ -1069,7 +1053,7 @@ static inline void wl3501_rx_interrupt(struct net_device *dev)
         u8 sig_id;
         struct wl3501_card *this = netdev_priv(dev);
 
-        dprintk(3, "entry");
+        pr_debug("entry");
 loop:
         morepkts = 0;
         if (!wl3501_esbq_confirm(this))
@@ -1302,7 +1286,7 @@ static int wl3501_reset(struct net_device *dev)
         wl3501_ack_interrupt(this);
         wl3501_unblock_interrupt(this);
         wl3501_mgmt_scan(this, 100);
-        dprintk(1, "%s: device reset", dev->name);
+        pr_debug("%s: device reset", dev->name);
         rc = 0;
 out:
         return rc;
@@ -1376,7 +1360,7 @@ static int wl3501_open(struct net_device *dev)
         link->open++;
 
         /* Initial WL3501 firmware */
-        dprintk(1, "%s: Initialize WL3501 firmware...", dev->name);
+        pr_debug("%s: Initialize WL3501 firmware...", dev->name);
         if (wl3501_init_firmware(this))
                 goto fail;
         /* Initial device variables */
@@ -1388,7 +1372,7 @@ static int wl3501_open(struct net_device *dev)
         wl3501_unblock_interrupt(this);
         wl3501_mgmt_scan(this, 100);
         rc = 0;
-        dprintk(1, "%s: WL3501 opened", dev->name);
+        pr_debug("%s: WL3501 opened", dev->name);
         printk(KERN_INFO "%s: Card Name: %s\n"
                          "%s: Firmware Date: %s\n",
                          dev->name, this->card_name,
@@ -1914,8 +1898,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
         p_dev->io.IOAddrLines   = 5;
 
         /* Interrupt setup */
-        p_dev->irq.Attributes   = IRQ_TYPE_DYNAMIC_SHARING | IRQ_HANDLE_PRESENT;
-        p_dev->irq.IRQInfo1     = IRQ_LEVEL_ID;
+        p_dev->irq.Attributes   = IRQ_TYPE_DYNAMIC_SHARING;
         p_dev->irq.Handler = wl3501_interrupt;
 
         /* General socket configuration */
@@ -1938,16 +1921,13 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
         dev->wireless_handlers  = &wl3501_handler_def;
         SET_ETHTOOL_OPS(dev, &ops);
         netif_stop_queue(dev);
-        p_dev->priv = p_dev->irq.Instance = dev;
+        p_dev->priv = dev;
 
         return wl3501_config(p_dev);
 out_link:
         return -ENOMEM;
 }
 
-#define CS_CHECK(fn, ret) \
-do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
-
 /**
  * wl3501_config - configure the PCMCIA socket and make eth device available
  * @link - FILL_IN
@@ -1959,7 +1939,7 @@ do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 static int wl3501_config(struct pcmcia_device *link)
 {
         struct net_device *dev = link->priv;
-        int i = 0, j, last_fn, last_ret;
+        int i = 0, j, ret;
         struct wl3501_card *this;
 
         /* Try allocating IO ports.  This tries a few fixed addresses.  If you
@@ -1975,24 +1955,26 @@ static int wl3501_config(struct pcmcia_device *link)
                 if (i == 0)
                         break;
         }
-        if (i != 0) {
-                cs_error(link, RequestIO, i);
+        if (i != 0)
                 goto failed;
-        }
 
         /* Now allocate an interrupt line. Note that this does not actually
          * assign a handler to the interrupt. */
 
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+        ret = pcmcia_request_irq(link, &link->irq);
+        if (ret)
+                goto failed;
 
         /* This actually configures the PCMCIA socket -- setting up the I/O
          * windows and the interrupt mapping.  */
 
-        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
+        ret = pcmcia_request_configuration(link, &link->conf);
+        if (ret)
+                goto failed;
 
         dev->irq = link->irq.AssignedIRQ;
         dev->base_addr = link->io.BasePort1;
-        SET_NETDEV_DEV(dev, &handle_to_dev(link));
+        SET_NETDEV_DEV(dev, &link->dev);
         if (register_netdev(dev)) {
                 printk(KERN_NOTICE "wl3501_cs: register_netdev() failed\n");
                 goto failed;
@@ -2041,8 +2023,6 @@ static int wl3501_config(struct pcmcia_device *link)
         netif_start_queue(dev);
         return 0;
 
-cs_failed:
-        cs_error(link, last_fn, last_ret);
 failed:
         wl3501_release(link);
         return -ENODEV;
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index bc81974a2bc7..9d1277874645 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -14,6 +14,7 @@
 
 #include <linux/module.h>
 #include <linux/usb.h>
+#include <linux/slab.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/wireless.h>
@@ -112,6 +113,9 @@ exit:
         return err;
 }
 
+MODULE_FIRMWARE("zd1201-ap.fw");
+MODULE_FIRMWARE("zd1201.fw");
+
 static void zd1201_usbfree(struct urb *urb)
 {
         struct zd1201 *zd = urb->context;
@@ -872,20 +876,18 @@ static struct iw_statistics *zd1201_get_wireless_stats(struct net_device *dev)
 static void zd1201_set_multicast(struct net_device *dev)
 {
         struct zd1201 *zd = netdev_priv(dev);
-        struct dev_mc_list *mc = dev->mc_list;
+        struct dev_mc_list *mc;
         unsigned char reqbuf[ETH_ALEN*ZD1201_MAXMULTI];
         int i;
 
-        if (dev->mc_count > ZD1201_MAXMULTI)
+        if (netdev_mc_count(dev) > ZD1201_MAXMULTI)
                 return;
 
-        for (i=0; i<dev->mc_count; i++) {
-                memcpy(reqbuf+i*ETH_ALEN, mc->dmi_addr, ETH_ALEN);
-                mc = mc->next;
-        }
+        i = 0;
+        netdev_for_each_mc_addr(mc, dev)
+                memcpy(reqbuf + i++ * ETH_ALEN, mc->dmi_addr, ETH_ALEN);
         zd1201_setconfig(zd, ZD1201_RID_CNFGROUPADDRESS, reqbuf,
-            dev->mc_count*ETH_ALEN, 0);
-        
+                         netdev_mc_count(dev) * ETH_ALEN, 0);
 }
 
 static int zd1201_config_commit(struct net_device *dev, 
diff --git a/drivers/net/wireless/zd1211rw/Kconfig b/drivers/net/wireless/zd1211rw/Kconfig
index 74b31eafe72d..5f809695f71a 100644
--- a/drivers/net/wireless/zd1211rw/Kconfig
+++ b/drivers/net/wireless/zd1211rw/Kconfig
@@ -1,6 +1,6 @@
 config ZD1211RW
         tristate "ZyDAS ZD1211/ZD1211B USB-wireless support"
-        depends on USB && MAC80211 && WLAN_80211 && EXPERIMENTAL
+        depends on USB && MAC80211 && EXPERIMENTAL
         select FW_LOADER
         ---help---
           This is an experimental driver for the ZyDAS ZD1211/ZD1211B wireless
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index 4e79a9800134..b2af3c549bb3 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -25,6 +25,7 @@
 
 #include <linux/kernel.h>
 #include <linux/errno.h>
+#include <linux/slab.h>
 
 #include "zd_def.h"
 #include "zd_chip.h"
@@ -755,7 +756,7 @@ static int hw_reset_phy(struct zd_chip *chip)
 static int zd1211_hw_init_hmac(struct zd_chip *chip)
 {
         static const struct zd_ioreq32 ioreqs[] = {
-                { CR_ZD1211_RETRY_MAX,          0x2 },
+                { CR_ZD1211_RETRY_MAX,          ZD1211_RETRY_COUNT },
                 { CR_RX_THRESHOLD,              0x000c0640 },
         };
 
@@ -767,7 +768,7 @@ static int zd1211_hw_init_hmac(struct zd_chip *chip)
 static int zd1211b_hw_init_hmac(struct zd_chip *chip)
 {
         static const struct zd_ioreq32 ioreqs[] = {
-                { CR_ZD1211B_RETRY_MAX,         0x02020202 },
+                { CR_ZD1211B_RETRY_MAX,         ZD1211B_RETRY_COUNT },
                 { CR_ZD1211B_CWIN_MAX_MIN_AC0,  0x007f003f },
                 { CR_ZD1211B_CWIN_MAX_MIN_AC1,  0x007f003f },
                 { CR_ZD1211B_CWIN_MAX_MIN_AC2,  0x003f001f },
@@ -1325,151 +1326,11 @@ int zd_chip_set_basic_rates(struct zd_chip *chip, u16 cr_rates)
         return r;
 }
 
-static int ofdm_qual_db(u8 status_quality, u8 zd_rate, unsigned int size)
-{
-        static const u16 constants[] = {
-                715, 655, 585, 540, 470, 410, 360, 315,
-                270, 235, 205, 175, 150, 125, 105,  85,
-                 65,  50,  40,  25,  15
-        };
-
-        int i;
-        u32 x;
-
-        /* It seems that their quality parameter is somehow per signal
-         * and is now transferred per bit.
-         */
-        switch (zd_rate) {
-        case ZD_OFDM_RATE_6M:
-        case ZD_OFDM_RATE_12M:
-        case ZD_OFDM_RATE_24M:
-                size *= 2;
-                break;
-        case ZD_OFDM_RATE_9M:
-        case ZD_OFDM_RATE_18M:
-        case ZD_OFDM_RATE_36M:
-        case ZD_OFDM_RATE_54M:
-                size *= 4;
-                size /= 3;
-                break;
-        case ZD_OFDM_RATE_48M:
-                size *= 3;
-                size /= 2;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        x = (10000 * status_quality)/size;
-        for (i = 0; i < ARRAY_SIZE(constants); i++) {
-                if (x > constants[i])
-                        break;
-        }
-
-        switch (zd_rate) {
-        case ZD_OFDM_RATE_6M:
-        case ZD_OFDM_RATE_9M:
-                i += 3;
-                break;
-        case ZD_OFDM_RATE_12M:
-        case ZD_OFDM_RATE_18M:
-                i += 5;
-                break;
-        case ZD_OFDM_RATE_24M:
-        case ZD_OFDM_RATE_36M:
-                i += 9;
-                break;
-        case ZD_OFDM_RATE_48M:
-        case ZD_OFDM_RATE_54M:
-                i += 15;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        return i;
-}
-
-static int ofdm_qual_percent(u8 status_quality, u8 zd_rate, unsigned int size)
-{
-        int r;
-
-        r = ofdm_qual_db(status_quality, zd_rate, size);
-        ZD_ASSERT(r >= 0);
-        if (r < 0)
-                r = 0;
-
-        r = (r * 100)/29;
-        return r <= 100 ? r : 100;
-}
-
-static unsigned int log10times100(unsigned int x)
-{
-        static const u8 log10[] = {
-                  0,
-                  0,   30,   47,   60,   69,   77,   84,   90,   95,  100,
-                104,  107,  111,  114,  117,  120,  123,  125,  127,  130,
-                132,  134,  136,  138,  139,  141,  143,  144,  146,  147,
-                149,  150,  151,  153,  154,  155,  156,  157,  159,  160,
-                161,  162,  163,  164,  165,  166,  167,  168,  169,  169,
-                170,  171,  172,  173,  174,  174,  175,  176,  177,  177,
-                178,  179,  179,  180,  181,  181,  182,  183,  183,  184,
-                185,  185,  186,  186,  187,  188,  188,  189,  189,  190,
-                190,  191,  191,  192,  192,  193,  193,  194,  194,  195,
-                195,  196,  196,  197,  197,  198,  198,  199,  199,  200,
-                200,  200,  201,  201,  202,  202,  202,  203,  203,  204,
-                204,  204,  205,  205,  206,  206,  206,  207,  207,  207,
-                208,  208,  208,  209,  209,  210,  210,  210,  211,  211,
-                211,  212,  212,  212,  213,  213,  213,  213,  214,  214,
-                214,  215,  215,  215,  216,  216,  216,  217,  217,  217,
-                217,  218,  218,  218,  219,  219,  219,  219,  220,  220,
-                220,  220,  221,  221,  221,  222,  222,  222,  222,  223,
-                223,  223,  223,  224,  224,  224,  224,
-        };
-
-        return x < ARRAY_SIZE(log10) ? log10[x] : 225;
-}
-
-enum {
-        MAX_CCK_EVM_DB = 45,
-};
-
-static int cck_evm_db(u8 status_quality)
-{
-        return (20 * log10times100(status_quality)) / 100;
-}
-
-static int cck_snr_db(u8 status_quality)
-{
-        int r = MAX_CCK_EVM_DB - cck_evm_db(status_quality);
-        ZD_ASSERT(r >= 0);
-        return r;
-}
-
-static int cck_qual_percent(u8 status_quality)
-{
-        int r;
-
-        r = cck_snr_db(status_quality);
-        r = (100*r)/17;
-        return r <= 100 ? r : 100;
-}
-
 static inline u8 zd_rate_from_ofdm_plcp_header(const void *rx_frame)
 {
         return ZD_OFDM | zd_ofdm_plcp_header_rate(rx_frame);
 }
 
-u8 zd_rx_qual_percent(const void *rx_frame, unsigned int size,
-                      const struct rx_status *status)
-{
-        return (status->frame_status&ZD_RX_OFDM) ?
-                ofdm_qual_percent(status->signal_quality_ofdm,
-                                  zd_rate_from_ofdm_plcp_header(rx_frame),
-                                  size) :
-                cck_qual_percent(status->signal_quality_cck);
-}
-
 /**
  * zd_rx_rate - report zd-rate
  * @rx_frame - received frame
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.h b/drivers/net/wireless/zd1211rw/zd_chip.h
index 678c139a840c..f8bbf7d302ae 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.h
+++ b/drivers/net/wireless/zd1211rw/zd_chip.h
@@ -642,13 +642,29 @@ enum {
 #define CR_ZD1211B_TXOP                 CTL_REG(0x0b20)
 #define CR_ZD1211B_RETRY_MAX            CTL_REG(0x0b28)
 
+/* Value for CR_ZD1211_RETRY_MAX & CR_ZD1211B_RETRY_MAX. Vendor driver uses 2,
+ * we use 0. The first rate is tried (count+2), then all next rates are tried
+ * twice, until 1 Mbits is tried. */
+#define ZD1211_RETRY_COUNT              0
+#define ZD1211B_RETRY_COUNT     \
+        (ZD1211_RETRY_COUNT <<  0)|     \
+        (ZD1211_RETRY_COUNT <<  8)|     \
+        (ZD1211_RETRY_COUNT << 16)|     \
+        (ZD1211_RETRY_COUNT << 24)
+
 /* Used to detect PLL lock */
 #define UW2453_INTR_REG                 ((zd_addr_t)0x85c1)
 
 #define CWIN_SIZE                       0x007f043f
 
 
-#define HWINT_ENABLED                   0x004f0000
+#define HWINT_ENABLED                   \
+        (INT_TX_COMPLETE_EN|            \
+         INT_RX_COMPLETE_EN|            \
+         INT_RETRY_FAIL_EN|             \
+         INT_WAKEUP_EN|                 \
+         INT_CFG_NEXT_BCN_EN)
+
 #define HWINT_DISABLED                  0
 
 #define E2P_PWR_INT_GUARD               8
@@ -913,9 +929,6 @@ static inline int zd_get_beacon_interval(struct zd_chip *chip, u32 *interval)
 
 struct rx_status;
 
-u8 zd_rx_qual_percent(const void *rx_frame, unsigned int size,
-                       const struct rx_status *status);
-
 u8 zd_rx_rate(const void *rx_frame, const struct rx_status *status);
 
 struct zd_mc_hash {
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 6d666359a42f..16fa289ad77b 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -22,6 +22,7 @@
 
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 #include <linux/jiffies.h>
 #include <net/ieee80211_radiotap.h>
@@ -88,6 +89,34 @@ static const struct ieee80211_rate zd_rates[] = {
           .flags = 0 },
 };
 
+/*
+ * Zydas retry rates table. Each line is listed in the same order as
+ * in zd_rates[] and contains all the rate used when a packet is sent
+ * starting with a given rates. Let's consider an example :
+ *
+ * "11 Mbits : 4, 3, 2, 1, 0" means :
+ * - packet is sent using 4 different rates
+ * - 1st rate is index 3 (ie 11 Mbits)
+ * - 2nd rate is index 2 (ie 5.5 Mbits)
+ * - 3rd rate is index 1 (ie 2 Mbits)
+ * - 4th rate is index 0 (ie 1 Mbits)
+ */
+
+static const struct tx_retry_rate zd_retry_rates[] = {
+        { /*  1 Mbits */        1, { 0 }},
+        { /*  2 Mbits */        2, { 1,  0 }},
+        { /*  5.5 Mbits */      3, { 2,  1, 0 }},
+        { /* 11 Mbits */        4, { 3,  2, 1, 0 }},
+        { /*  6 Mbits */        5, { 4,  3, 2, 1, 0 }},
+        { /*  9 Mbits */        6, { 5,  4, 3, 2, 1, 0}},
+        { /* 12 Mbits */        5, { 6,  3, 2, 1, 0 }},
+        { /* 18 Mbits */        6, { 7,  6, 3, 2, 1, 0 }},
+        { /* 24 Mbits */        6, { 8,  6, 3, 2, 1, 0 }},
+        { /* 36 Mbits */        7, { 9,  8, 6, 3, 2, 1, 0 }},
+        { /* 48 Mbits */        8, {10,  9, 8, 6, 3, 2, 1, 0 }},
+        { /* 54 Mbits */        9, {11, 10, 9, 8, 6, 3, 2, 1, 0 }}
+};
+
 static const struct ieee80211_channel zd_channels[] = {
         { .center_freq = 2412, .hw_value = 1 },
         { .center_freq = 2417, .hw_value = 2 },
@@ -282,7 +311,7 @@ static void zd_op_stop(struct ieee80211_hw *hw)
 }
 
 /**
- * tx_status - reports tx status of a packet if required
+ * zd_mac_tx_status - reports tx status of a packet if required
  * @hw - a &struct ieee80211_hw pointer
  * @skb - a sk-buffer
  * @flags: extra flags to set in the TX status info
@@ -295,15 +324,49 @@ static void zd_op_stop(struct ieee80211_hw *hw)
  *
  * If no status information has been requested, the skb is freed.
  */
-static void tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
-                      int ackssi, bool success)
+static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
+                      int ackssi, struct tx_status *tx_status)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int i;
+        int success = 1, retry = 1;
+        int first_idx;
+        const struct tx_retry_rate *retries;
 
         ieee80211_tx_info_clear_status(info);
 
-        if (success)
+        if (tx_status) {
+                success = !tx_status->failure;
+                retry = tx_status->retry + success;
+        }
+
+        if (success) {
+                /* success */
                 info->flags |= IEEE80211_TX_STAT_ACK;
+        } else {
+                /* failure */
+                info->flags &= ~IEEE80211_TX_STAT_ACK;
+        }
+
+        first_idx = info->status.rates[0].idx;
+        ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
+        retries = &zd_retry_rates[first_idx];
+        ZD_ASSERT(1 <= retry && retry <= retries->count);
+
+        info->status.rates[0].idx = retries->rate[0];
+        info->status.rates[0].count = 1; // (retry > 1 ? 2 : 1);
+
+        for (i=1; i<IEEE80211_TX_MAX_RATES-1 && i<retry; i++) {
+                info->status.rates[i].idx = retries->rate[i];
+                info->status.rates[i].count = 1; // ((i==retry-1) && success ? 1:2);
+        }
+        for (; i<IEEE80211_TX_MAX_RATES && i<retry; i++) {
+                info->status.rates[i].idx = retries->rate[retry - 1];
+                info->status.rates[i].count = 1; // (success ? 1:2);
+        }
+        if (i<IEEE80211_TX_MAX_RATES)
+                info->status.rates[i].idx = -1; /* terminate */
+
         info->status.ack_signal = ackssi;
         ieee80211_tx_status_irqsafe(hw, skb);
 }
@@ -312,20 +375,81 @@ static void tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
  * zd_mac_tx_failed - callback for failed frames
  * @dev: the mac80211 wireless device
  *
- * This function is called if a frame couldn't be succesfully be
+ * This function is called if a frame couldn't be successfully
  * transferred. The first frame from the tx queue, will be selected and
  * reported as error to the upper layers.
  */
-void zd_mac_tx_failed(struct ieee80211_hw *hw)
+void zd_mac_tx_failed(struct urb *urb)
 {
-        struct sk_buff_head *q = &zd_hw_mac(hw)->ack_wait_queue;
+        struct ieee80211_hw * hw = zd_usb_to_hw(urb->context);
+        struct zd_mac *mac = zd_hw_mac(hw);
+        struct sk_buff_head *q = &mac->ack_wait_queue;
         struct sk_buff *skb;
+        struct tx_status *tx_status = (struct tx_status *)urb->transfer_buffer;
+        unsigned long flags;
+        int success = !tx_status->failure;
+        int retry = tx_status->retry + success;
+        int found = 0;
+        int i, position = 0;
 
-        skb = skb_dequeue(q);
-        if (skb == NULL)
-                return;
+        q = &mac->ack_wait_queue;
+        spin_lock_irqsave(&q->lock, flags);
+
+        skb_queue_walk(q, skb) {
+                struct ieee80211_hdr *tx_hdr;
+                struct ieee80211_tx_info *info;
+                int first_idx, final_idx;
+                const struct tx_retry_rate *retries;
+                u8 final_rate;
+
+                position ++;
+
+                /* if the hardware reports a failure and we had a 802.11 ACK
+                 * pending, then we skip the first skb when searching for a
+                 * matching frame */
+                if (tx_status->failure && mac->ack_pending &&
+                    skb_queue_is_first(q, skb)) {
+                        continue;
+                }
+
+                tx_hdr = (struct ieee80211_hdr *)skb->data;
+
+                /* we skip all frames not matching the reported destination */
+                if (unlikely(memcmp(tx_hdr->addr1, tx_status->mac, ETH_ALEN))) {
+                        continue;
+                }
+
+                /* we skip all frames not matching the reported final rate */
+
+                info = IEEE80211_SKB_CB(skb);
+                first_idx = info->status.rates[0].idx;
+                ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
+                retries = &zd_retry_rates[first_idx];
+                if (retry <= 0 || retry > retries->count)
+                        continue;
+
+                final_idx = retries->rate[retry - 1];
+                final_rate = zd_rates[final_idx].hw_value;
 
-        tx_status(hw, skb, 0, 0);
+                if (final_rate != tx_status->rate) {
+                        continue;
+                }
+
+                found = 1;
+                break;
+        }
+
+        if (found) {
+                for (i=1; i<=position; i++) {
+                        skb = __skb_dequeue(q);
+                        zd_mac_tx_status(hw, skb,
+                                         mac->ack_pending ? mac->ack_signal : 0,
+                                         i == position ? tx_status : NULL);
+                        mac->ack_pending = 0;
+                }
+        }
+
+        spin_unlock_irqrestore(&q->lock, flags);
 }
 
 /**
@@ -342,18 +466,27 @@ void zd_mac_tx_to_dev(struct sk_buff *skb, int error)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hw *hw = info->rate_driver_data[0];
+        struct zd_mac *mac = zd_hw_mac(hw);
+
+        ieee80211_tx_info_clear_status(info);
 
         skb_pull(skb, sizeof(struct zd_ctrlset));
         if (unlikely(error ||
             (info->flags & IEEE80211_TX_CTL_NO_ACK))) {
-                tx_status(hw, skb, 0, !error);
+                /*
+                 * FIXME : do we need to fill in anything ?
+                 */
+                ieee80211_tx_status_irqsafe(hw, skb);
         } else {
-                struct sk_buff_head *q =
-                        &zd_hw_mac(hw)->ack_wait_queue;
+                struct sk_buff_head *q = &mac->ack_wait_queue;
 
                 skb_queue_tail(q, skb);
-                while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS)
-                        zd_mac_tx_failed(hw);
+                while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS) {
+                        zd_mac_tx_status(hw, skb_dequeue(q),
+                                         mac->ack_pending ? mac->ack_signal : 0,
+                                         NULL);
+                        mac->ack_pending = 0;
+                }
         }
 }
 
@@ -606,27 +739,47 @@ fail:
 static int filter_ack(struct ieee80211_hw *hw, struct ieee80211_hdr *rx_hdr,
                       struct ieee80211_rx_status *stats)
 {
+        struct zd_mac *mac = zd_hw_mac(hw);
         struct sk_buff *skb;
         struct sk_buff_head *q;
         unsigned long flags;
+        int found = 0;
+        int i, position = 0;
 
         if (!ieee80211_is_ack(rx_hdr->frame_control))
                 return 0;
 
-        q = &zd_hw_mac(hw)->ack_wait_queue;
+        q = &mac->ack_wait_queue;
         spin_lock_irqsave(&q->lock, flags);
         skb_queue_walk(q, skb) {
                 struct ieee80211_hdr *tx_hdr;
 
+                position ++;
+
+                if (mac->ack_pending && skb_queue_is_first(q, skb))
+                    continue;
+
                 tx_hdr = (struct ieee80211_hdr *)skb->data;
                 if (likely(!memcmp(tx_hdr->addr2, rx_hdr->addr1, ETH_ALEN)))
                 {
-                        __skb_unlink(skb, q);
-                        tx_status(hw, skb, stats->signal, 1);
-                        goto out;
+                        found = 1;
+                        break;
                 }
         }
-out:
+
+        if (found) {
+                for (i=1; i<position; i++) {
+                        skb = __skb_dequeue(q);
+                        zd_mac_tx_status(hw, skb,
+                                         mac->ack_pending ? mac->ack_signal : 0,
+                                         NULL);
+                        mac->ack_pending = 0;
+                }
+
+                mac->ack_pending = 1;
+                mac->ack_signal = stats->signal;
+        }
+
         spin_unlock_irqrestore(&q->lock, flags);
         return 1;
 }
@@ -674,9 +827,6 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
         stats.freq = zd_channels[_zd_chip_get_channel(&mac->chip) - 1].center_freq;
         stats.band = IEEE80211_BAND_2GHZ;
         stats.signal = status->signal_strength;
-        stats.qual = zd_rx_qual_percent(buffer,
-                                          length - sizeof(struct rx_status),
-                                          status);
 
         rate = zd_rx_rate(buffer, status);
 
@@ -709,6 +859,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
                 skb_reserve(skb, 2);
         }
 
+        /* FIXME : could we avoid this big memcpy ? */
         memcpy(skb_put(skb, length), buffer, length);
 
         memcpy(IEEE80211_SKB_RXCB(skb), &stats, sizeof(stats));
@@ -717,7 +868,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
 }
 
 static int zd_op_add_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_if_init_conf *conf)
+                                struct ieee80211_vif *vif)
 {
         struct zd_mac *mac = zd_hw_mac(hw);
 
@@ -725,22 +876,22 @@ static int zd_op_add_interface(struct ieee80211_hw *hw,
         if (mac->type != NL80211_IFTYPE_UNSPECIFIED)
                 return -EOPNOTSUPP;
 
-        switch (conf->type) {
+        switch (vif->type) {
         case NL80211_IFTYPE_MONITOR:
         case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
-                mac->type = conf->type;
+                mac->type = vif->type;
                 break;
         default:
                 return -EOPNOTSUPP;
         }
 
-        return zd_write_mac_addr(&mac->chip, conf->mac_addr);
+        return zd_write_mac_addr(&mac->chip, vif->addr);
 }
 
 static void zd_op_remove_interface(struct ieee80211_hw *hw,
-                                    struct ieee80211_if_init_conf *conf)
+                                    struct ieee80211_vif *vif)
 {
         struct zd_mac *mac = zd_hw_mac(hw);
         mac->type = NL80211_IFTYPE_UNSPECIFIED;
@@ -835,12 +986,13 @@ static void zd_op_configure_filter(struct ieee80211_hw *hw,
         changed_flags &= SUPPORTED_FIF_FLAGS;
         *new_flags &= SUPPORTED_FIF_FLAGS;
 
-        /* changed_flags is always populated but this driver
-         * doesn't support all FIF flags so its possible we don't
-         * need to do anything */
-        if (!changed_flags)
-                return;
-
+        /*
+         * If multicast parameter (as returned by zd_op_prepare_multicast)
+         * has changed, no bit in changed_flags is set. To handle this
+         * situation, we do not return if changed_flags is 0. If we do so,
+         * we will have some issue with IPv6 which uses multicast for link
+         * layer address resolution.
+         */
         if (*new_flags & (FIF_PROMISC_IN_BSS | FIF_ALLMULTI))
                 zd_mc_add_all(&hash);
 
@@ -999,7 +1151,14 @@ struct ieee80211_hw *zd_mac_alloc_hw(struct usb_interface *intf)
         hw->queues = 1;
         hw->extra_tx_headroom = sizeof(struct zd_ctrlset);
 
+        /*
+         * Tell mac80211 that we support multi rate retries
+         */
+        hw->max_rates = IEEE80211_TX_MAX_RATES;
+        hw->max_rate_tries = 18;        /* 9 rates * 2 retries/rate */
+
         skb_queue_head_init(&mac->ack_wait_queue);
+        mac->ack_pending = 0;
 
         zd_chip_init(&mac->chip, hw, intf);
         housekeeping_init(mac);
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.h b/drivers/net/wireless/zd1211rw/zd_mac.h
index 7c2759118d13..630c298a730e 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.h
+++ b/drivers/net/wireless/zd1211rw/zd_mac.h
@@ -140,6 +140,21 @@ struct rx_status {
 #define ZD_RX_CRC16_ERROR               0x40
 #define ZD_RX_ERROR                     0x80
 
+struct tx_retry_rate {
+        int count;      /* number of valid element in rate[] array */
+        int rate[10];   /* retry rates, described by an index in zd_rates[] */
+};
+
+struct tx_status {
+        u8 type;        /* must always be 0x01 : USB_INT_TYPE */
+        u8 id;          /* must always be 0xa0 : USB_INT_ID_RETRY_FAILED */
+        u8 rate;
+        u8 pad;
+        u8 mac[ETH_ALEN];
+        u8 retry;
+        u8 failure;
+} __attribute__((packed));
+
 enum mac_flags {
         MAC_FIXED_CHANNEL = 0x01,
 };
@@ -150,7 +165,7 @@ struct housekeeping {
 
 #define ZD_MAC_STATS_BUFFER_SIZE 16
 
-#define ZD_MAC_MAX_ACK_WAITERS 10
+#define ZD_MAC_MAX_ACK_WAITERS 50
 
 struct zd_mac {
         struct zd_chip chip;
@@ -184,6 +199,12 @@ struct zd_mac {
 
         /* whether to pass control frames to stack */
         unsigned int pass_ctrl:1;
+
+        /* whether we have received a 802.11 ACK that is pending */
+        unsigned int ack_pending:1;
+
+        /* signal strength of the last 802.11 ACK received */
+        int ack_signal;
 };
 
 #define ZD_REGDOMAIN_FCC        0x10
@@ -279,7 +300,7 @@ int zd_mac_preinit_hw(struct ieee80211_hw *hw);
 int zd_mac_init_hw(struct ieee80211_hw *hw);
 
 int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length);
-void zd_mac_tx_failed(struct ieee80211_hw *hw);
+void zd_mac_tx_failed(struct urb *urb);
 void zd_mac_tx_to_dev(struct sk_buff *skb, int error);
 
 #ifdef DEBUG
diff --git a/drivers/net/wireless/zd1211rw/zd_rf_uw2453.c b/drivers/net/wireless/zd1211rw/zd_rf_uw2453.c
index 439799b84876..9e74eb1b67d5 100644
--- a/drivers/net/wireless/zd1211rw/zd_rf_uw2453.c
+++ b/drivers/net/wireless/zd1211rw/zd_rf_uw2453.c
@@ -19,6 +19,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 
 #include "zd_rf.h"
 #include "zd_usb.h"
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 23a6a6d4863b..d91ad1a612af 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -24,6 +24,7 @@
 #include <linux/firmware.h>
 #include <linux/device.h>
 #include <linux/errno.h>
+#include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/usb.h>
 #include <linux/workqueue.h>
@@ -62,6 +63,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x6891, 0xa727), .driver_info = DEVICE_ZD1211 },
         /* ZD1211B */
         { USB_DEVICE(0x0053, 0x5301), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x0409, 0x0248), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0411, 0x00da), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0471, 0x1236), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0471, 0x1237), .driver_info = DEVICE_ZD1211B },
@@ -318,6 +320,13 @@ error:
         return r;
 }
 
+MODULE_FIRMWARE(FW_ZD1211B_PREFIX "ur");
+MODULE_FIRMWARE(FW_ZD1211_PREFIX "ur");
+MODULE_FIRMWARE(FW_ZD1211B_PREFIX "ub");
+MODULE_FIRMWARE(FW_ZD1211_PREFIX "ub");
+MODULE_FIRMWARE(FW_ZD1211B_PREFIX "uphr");
+MODULE_FIRMWARE(FW_ZD1211_PREFIX "uphr");
+
 /* Read data from device address space using "firmware interface" which does
  * not require firmware to be loaded. */
 int zd_usb_read_fw(struct zd_usb *usb, zd_addr_t addr, u8 *data, u16 len)
@@ -419,7 +428,7 @@ static void int_urb_complete(struct urb *urb)
                 handle_regs_int(urb);
                 break;
         case USB_INT_ID_RETRY_FAILED:
-                zd_mac_tx_failed(zd_usb_to_hw(urb->context));
+                zd_mac_tx_failed(urb);
                 break;
         default:
                 dev_dbg_f(urb_dev(urb), "error: urb %p unknown id %x\n", urb,
@@ -553,6 +562,8 @@ static void handle_rx_packet(struct zd_usb *usb, const u8 *buffer,
 
         if (length < sizeof(struct rx_length_info)) {
                 /* It's not a complete packet anyhow. */
+                printk("%s: invalid, small RX packet : %d\n",
+                       __func__, length);
                 return;
         }
         length_info = (struct rx_length_info *)
@@ -1069,11 +1080,15 @@ static int eject_installer(struct usb_interface *intf)
         int r;
 
         /* Find bulk out endpoint */
-        endpoint = &iface_desc->endpoint[1].desc;
-        if (usb_endpoint_dir_out(endpoint) &&
-            usb_endpoint_xfer_bulk(endpoint)) {
-                bulk_out_ep = endpoint->bEndpointAddress;
-        } else {
+        for (r = 1; r >= 0; r--) {
+                endpoint = &iface_desc->endpoint[r].desc;
+                if (usb_endpoint_dir_out(endpoint) &&
+                    usb_endpoint_xfer_bulk(endpoint)) {
+                        bulk_out_ep = endpoint->bEndpointAddress;
+                        break;
+                }
+        }
+        if (r == -1) {
                 dev_err(&udev->dev,
                         "zd1211rw: Could not find bulk out endpoint\n");
                 return -ENODEV;