81 files changed, 941 insertions, 1438 deletions

diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 2fbe9b4506c0..174e3442d519 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -5,6 +5,7 @@
 menuconfig WLAN
         bool "Wireless LAN"
         depends on !S390
+        depends on NET
         select WIRELESS
         default y
         ---help---
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 7a626d4e100f..8a2d4afc74f8 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -1223,7 +1223,6 @@ static void at76_rx_callback(struct urb *urb)
 
         priv->rx_tasklet.data = (unsigned long)urb;
         tasklet_schedule(&priv->rx_tasklet);
-        return;
 }
 
 static int at76_submit_rx_urb(struct at76_priv *priv)
diff --git a/drivers/net/wireless/ath/ar9170/ar9170.h b/drivers/net/wireless/ath/ar9170/ar9170.h
index dc662b76a1c8..4f845f80c098 100644
--- a/drivers/net/wireless/ath/ar9170/ar9170.h
+++ b/drivers/net/wireless/ath/ar9170/ar9170.h
@@ -109,41 +109,6 @@ struct ar9170_rxstream_mpdu_merge {
         bool has_plcp;
 };
 
-#define AR9170_NUM_TID  16
-#define WME_BA_BMP_SIZE         64
-#define AR9170_NUM_MAX_AGG_LEN  (2 * WME_BA_BMP_SIZE)
-
-#define WME_AC_BE   2
-#define WME_AC_BK   3
-#define WME_AC_VI   1
-#define WME_AC_VO   0
-
-#define TID_TO_WME_AC(_tid)                             \
-        ((((_tid) == 0) || ((_tid) == 3)) ? WME_AC_BE : \
-         (((_tid) == 1) || ((_tid) == 2)) ? WME_AC_BK : \
-         (((_tid) == 4) || ((_tid) == 5)) ? WME_AC_VI : \
-         WME_AC_VO)
-
-#define BAW_WITHIN(_start, _bawsz, _seqno) \
-        ((((_seqno) - (_start)) & 0xfff) < (_bawsz))
-
-enum ar9170_tid_state {
-        AR9170_TID_STATE_INVALID,
-        AR9170_TID_STATE_SHUTDOWN,
-        AR9170_TID_STATE_PROGRESS,
-        AR9170_TID_STATE_COMPLETE,
-};
-
-struct ar9170_sta_tid {
-        struct list_head list;
-        struct sk_buff_head queue;
-        u8 addr[ETH_ALEN];
-        u16 ssn;
-        u16 tid;
-        enum ar9170_tid_state state;
-        bool active;
-};
-
 struct ar9170_tx_queue_stats {
         unsigned int len;
         unsigned int limit;
@@ -152,14 +117,11 @@ struct ar9170_tx_queue_stats {
 
 #define AR9170_QUEUE_TIMEOUT            64
 #define AR9170_TX_TIMEOUT               8
-#define AR9170_BA_TIMEOUT               4
 #define AR9170_JANITOR_DELAY            128
 #define AR9170_TX_INVALID_RATE          0xffffffff
 
-#define AR9170_NUM_TX_STATUS            128
-#define AR9170_NUM_TX_AGG_MAX           30
-#define AR9170_NUM_TX_LIMIT_HARD       AR9170_TXQ_DEPTH
-#define AR9170_NUM_TX_LIMIT_SOFT       (AR9170_TXQ_DEPTH - 10)
+#define AR9170_NUM_TX_LIMIT_HARD        AR9170_TXQ_DEPTH
+#define AR9170_NUM_TX_LIMIT_SOFT        (AR9170_TXQ_DEPTH - 10)
 
 struct ar9170 {
         struct ieee80211_hw *hw;
@@ -234,11 +196,6 @@ struct ar9170 {
         struct sk_buff_head tx_pending[__AR9170_NUM_TXQ];
         struct sk_buff_head tx_status[__AR9170_NUM_TXQ];
         struct delayed_work tx_janitor;
-        /* tx ampdu */
-        struct sk_buff_head tx_status_ampdu;
-        spinlock_t tx_ampdu_list_lock;
-        struct list_head tx_ampdu_list;
-        atomic_t tx_ampdu_pending;
 
         /* rxstream mpdu merge */
         struct ar9170_rxstream_mpdu_merge rx_mpdu;
@@ -250,11 +207,6 @@ struct ar9170 {
         u8 global_ampdu_factor;
 };
 
-struct ar9170_sta_info {
-        struct ar9170_sta_tid agg[AR9170_NUM_TID];
-        unsigned int ampdu_max_len;
-};
-
 struct ar9170_tx_info {
         unsigned long timeout;
 };
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index 2e9b330f6413..2abc87578994 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -50,10 +50,6 @@ static int modparam_nohwcrypt;
 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
 
-static int modparam_ht;
-module_param_named(ht, modparam_ht, bool, S_IRUGO);
-MODULE_PARM_DESC(ht, "enable MPDU aggregation.");
-
 #define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
         .bitrate        = (_bitrate),                   \
         .flags          = (_flags),                     \
@@ -182,7 +178,6 @@ static struct ieee80211_supported_band ar9170_band_5GHz = {
 };
 
 static void ar9170_tx(struct ar9170 *ar);
-static bool ar9170_tx_ampdu(struct ar9170 *ar);
 
 static inline u16 ar9170_get_seq_h(struct ieee80211_hdr *hdr)
 {
@@ -195,21 +190,7 @@ static inline u16 ar9170_get_seq(struct sk_buff *skb)
         return ar9170_get_seq_h((void *) txc->frame_data);
 }
 
-static inline u16 ar9170_get_tid_h(struct ieee80211_hdr *hdr)
-{
-        return (ieee80211_get_qos_ctl(hdr))[0] & IEEE80211_QOS_CTL_TID_MASK;
-}
-
-static inline u16 ar9170_get_tid(struct sk_buff *skb)
-{
-        struct ar9170_tx_control *txc = (void *) skb->data;
-        return ar9170_get_tid_h((struct ieee80211_hdr *) txc->frame_data);
-}
-
-#define GET_NEXT_SEQ(seq)       ((seq + 1) & 0x0fff)
-#define GET_NEXT_SEQ_FROM_SKB(skb)      (GET_NEXT_SEQ(ar9170_get_seq(skb)))
-
-#if (defined AR9170_QUEUE_DEBUG) || (defined AR9170_TXAGG_DEBUG)
+#ifdef AR9170_QUEUE_DEBUG
 static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
 {
         struct ar9170_tx_control *txc = (void *) skb->data;
@@ -244,7 +225,7 @@ static void __ar9170_dump_txqueue(struct ar9170 *ar,
                        "mismatch %d != %d\n", skb_queue_len(queue), i);
         printk(KERN_DEBUG "---[ end ]---\n");
 }
-#endif /* AR9170_QUEUE_DEBUG || AR9170_TXAGG_DEBUG */
+#endif /* AR9170_QUEUE_DEBUG */
 
 #ifdef AR9170_QUEUE_DEBUG
 static void ar9170_dump_txqueue(struct ar9170 *ar,
@@ -275,20 +256,6 @@ static void __ar9170_dump_txstats(struct ar9170 *ar)
 }
 #endif /* AR9170_QUEUE_STOP_DEBUG */
 
-#ifdef AR9170_TXAGG_DEBUG
-static void ar9170_dump_tx_status_ampdu(struct ar9170 *ar)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&ar->tx_status_ampdu.lock, flags);
-        printk(KERN_DEBUG "%s: A-MPDU tx_status queue =>\n",
-               wiphy_name(ar->hw->wiphy));
-        __ar9170_dump_txqueue(ar, &ar->tx_status_ampdu);
-        spin_unlock_irqrestore(&ar->tx_status_ampdu.lock, flags);
-}
-
-#endif /* AR9170_TXAGG_DEBUG */
-
 /* caller must guarantee exclusive access for _bin_ queue. */
 static void ar9170_recycle_expired(struct ar9170 *ar,
                                    struct sk_buff_head *queue,
@@ -360,70 +327,6 @@ static void ar9170_tx_status(struct ar9170 *ar, struct sk_buff *skb,
         ieee80211_tx_status_irqsafe(ar->hw, skb);
 }
 
-static void ar9170_tx_fake_ampdu_status(struct ar9170 *ar)
-{
-        struct sk_buff_head success;
-        struct sk_buff *skb;
-        unsigned int i;
-        unsigned long queue_bitmap = 0;
-
-        skb_queue_head_init(&success);
-
-        while (skb_queue_len(&ar->tx_status_ampdu) > AR9170_NUM_TX_STATUS)
-                __skb_queue_tail(&success, skb_dequeue(&ar->tx_status_ampdu));
-
-        ar9170_recycle_expired(ar, &ar->tx_status_ampdu, &success);
-
-#ifdef AR9170_TXAGG_DEBUG
-        printk(KERN_DEBUG "%s: collected %d A-MPDU frames.\n",
-               wiphy_name(ar->hw->wiphy), skb_queue_len(&success));
-        __ar9170_dump_txqueue(ar, &success);
-#endif /* AR9170_TXAGG_DEBUG */
-
-        while ((skb = __skb_dequeue(&success))) {
-                struct ieee80211_tx_info *txinfo;
-
-                queue_bitmap |= BIT(skb_get_queue_mapping(skb));
-
-                txinfo = IEEE80211_SKB_CB(skb);
-                ieee80211_tx_info_clear_status(txinfo);
-
-                txinfo->flags |= IEEE80211_TX_STAT_ACK;
-                txinfo->status.rates[0].count = 1;
-
-                skb_pull(skb, sizeof(struct ar9170_tx_control));
-                ieee80211_tx_status_irqsafe(ar->hw, skb);
-        }
-
-        for_each_set_bit(i, &queue_bitmap, BITS_PER_BYTE) {
-#ifdef AR9170_QUEUE_STOP_DEBUG
-                printk(KERN_DEBUG "%s: wake queue %d\n",
-                       wiphy_name(ar->hw->wiphy), i);
-                __ar9170_dump_txstats(ar);
-#endif /* AR9170_QUEUE_STOP_DEBUG */
-                ieee80211_wake_queue(ar->hw, i);
-        }
-
-        if (queue_bitmap)
-                ar9170_tx(ar);
-}
-
-static void ar9170_tx_ampdu_callback(struct ar9170 *ar, struct sk_buff *skb)
-{
-        struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
-        struct ar9170_tx_info *arinfo = (void *) txinfo->rate_driver_data;
-
-        arinfo->timeout = jiffies +
-                          msecs_to_jiffies(AR9170_BA_TIMEOUT);
-
-        skb_queue_tail(&ar->tx_status_ampdu, skb);
-        ar9170_tx_fake_ampdu_status(ar);
-
-        if (atomic_dec_and_test(&ar->tx_ampdu_pending) &&
-            !list_empty(&ar->tx_ampdu_list))
-                ar9170_tx_ampdu(ar);
-}
-
 void ar9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -447,14 +350,10 @@ void ar9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb)
         if (info->flags & IEEE80211_TX_CTL_NO_ACK) {
                 ar9170_tx_status(ar, skb, AR9170_TX_STATUS_FAILED);
         } else {
-                if (info->flags & IEEE80211_TX_CTL_AMPDU) {
-                        ar9170_tx_ampdu_callback(ar, skb);
-                } else {
-                        arinfo->timeout = jiffies +
-                                  msecs_to_jiffies(AR9170_TX_TIMEOUT);
+                arinfo->timeout = jiffies +
+                          msecs_to_jiffies(AR9170_TX_TIMEOUT);
 
-                        skb_queue_tail(&ar->tx_status[queue], skb);
-                }
+                skb_queue_tail(&ar->tx_status[queue], skb);
         }
 
         if (!ar->tx_stats[queue].len &&
@@ -524,38 +423,6 @@ static struct sk_buff *ar9170_get_queued_skb(struct ar9170 *ar,
         return NULL;
 }
 
-static void ar9170_handle_block_ack(struct ar9170 *ar, u16 count, u16 r)
-{
-        struct sk_buff *skb;
-        struct ieee80211_tx_info *txinfo;
-
-        while (count) {
-                skb = ar9170_get_queued_skb(ar, NULL, &ar->tx_status_ampdu, r);
-                if (!skb)
-                        break;
-
-                txinfo = IEEE80211_SKB_CB(skb);
-                ieee80211_tx_info_clear_status(txinfo);
-
-                /* FIXME: maybe more ? */
-                txinfo->status.rates[0].count = 1;
-
-                skb_pull(skb, sizeof(struct ar9170_tx_control));
-                ieee80211_tx_status_irqsafe(ar->hw, skb);
-                count--;
-        }
-
-#ifdef AR9170_TXAGG_DEBUG
-        if (count) {
-                printk(KERN_DEBUG "%s: got %d more failed mpdus, but no more "
-                       "suitable frames left in tx_status queue.\n",
-                       wiphy_name(ar->hw->wiphy), count);
-
-                ar9170_dump_tx_status_ampdu(ar);
-        }
-#endif /* AR9170_TXAGG_DEBUG */
-}
-
 /*
  * This worker tries to keeps an maintain tx_status queues.
  * So we can guarantee that incoming tx_status reports are
@@ -592,8 +459,6 @@ static void ar9170_tx_janitor(struct work_struct *work)
                         resched = true;
         }
 
-        ar9170_tx_fake_ampdu_status(ar);
-
         if (!resched)
                 return;
 
@@ -673,10 +538,6 @@ void ar9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len)
 
         case 0xc5:
                 /* BlockACK events */
-                ar9170_handle_block_ack(ar,
-                                        le16_to_cpu(cmd->ba_fail_cnt.failed),
-                                        le16_to_cpu(cmd->ba_fail_cnt.rate));
-                ar9170_tx_fake_ampdu_status(ar);
                 break;
 
         case 0xc6:
@@ -1247,7 +1108,6 @@ static int ar9170_op_start(struct ieee80211_hw *hw)
         ar->global_ampdu_density = 6;
         ar->global_ampdu_factor = 3;
 
-        atomic_set(&ar->tx_ampdu_pending, 0);
         ar->bad_hw_nagger = jiffies;
 
         err = ar->open(ar);
@@ -1310,40 +1170,10 @@ static void ar9170_op_stop(struct ieee80211_hw *hw)
                 skb_queue_purge(&ar->tx_pending[i]);
                 skb_queue_purge(&ar->tx_status[i]);
         }
-        skb_queue_purge(&ar->tx_status_ampdu);
 
         mutex_unlock(&ar->mutex);
 }
 
-static void ar9170_tx_indicate_immba(struct ar9170 *ar, struct sk_buff *skb)
-{
-        struct ar9170_tx_control *txc = (void *) skb->data;
-
-        txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_IMM_AMPDU);
-}
-
-static void ar9170_tx_copy_phy(struct ar9170 *ar, struct sk_buff *dst,
-                               struct sk_buff *src)
-{
-        struct ar9170_tx_control *dst_txc, *src_txc;
-        struct ieee80211_tx_info *dst_info, *src_info;
-        struct ar9170_tx_info *dst_arinfo, *src_arinfo;
-
-        src_txc = (void *) src->data;
-        src_info = IEEE80211_SKB_CB(src);
-        src_arinfo = (void *) src_info->rate_driver_data;
-
-        dst_txc = (void *) dst->data;
-        dst_info = IEEE80211_SKB_CB(dst);
-        dst_arinfo = (void *) dst_info->rate_driver_data;
-
-        dst_txc->phy_control = src_txc->phy_control;
-
-        /* same MCS for the whole aggregate */
-        memcpy(dst_info->driver_rates, src_info->driver_rates,
-               sizeof(dst_info->driver_rates));
-}
-
 static int ar9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr;
@@ -1420,14 +1250,7 @@ static int ar9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
                 txc->phy_control |=
                         cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
 
-                if (info->flags & IEEE80211_TX_CTL_AMPDU) {
-                        if (unlikely(!info->control.sta))
-                                goto err_out;
-
-                        txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
-                } else {
-                        txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
-                }
+                txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
         }
 
         return 0;
@@ -1537,158 +1360,6 @@ static void ar9170_tx_prepare_phy(struct ar9170 *ar, struct sk_buff *skb)
         txc->phy_control |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_SHIFT);
 }
 
-static bool ar9170_tx_ampdu(struct ar9170 *ar)
-{
-        struct sk_buff_head agg;
-        struct ar9170_sta_tid *tid_info = NULL, *tmp;
-        struct sk_buff *skb, *first = NULL;
-        unsigned long flags, f2;
-        unsigned int i = 0;
-        u16 seq, queue, tmpssn;
-        bool run = false;
-
-        skb_queue_head_init(&agg);
-
-        spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
-        if (list_empty(&ar->tx_ampdu_list)) {
-#ifdef AR9170_TXAGG_DEBUG
-                printk(KERN_DEBUG "%s: aggregation list is empty.\n",
-                       wiphy_name(ar->hw->wiphy));
-#endif /* AR9170_TXAGG_DEBUG */
-                goto out_unlock;
-        }
-
-        list_for_each_entry_safe(tid_info, tmp, &ar->tx_ampdu_list, list) {
-                if (tid_info->state != AR9170_TID_STATE_COMPLETE) {
-#ifdef AR9170_TXAGG_DEBUG
-                        printk(KERN_DEBUG "%s: dangling aggregation entry!\n",
-                               wiphy_name(ar->hw->wiphy));
-#endif /* AR9170_TXAGG_DEBUG */
-                        continue;
-                }
-
-                if (++i > 64) {
-#ifdef AR9170_TXAGG_DEBUG
-                        printk(KERN_DEBUG "%s: enough frames aggregated.\n",
-                               wiphy_name(ar->hw->wiphy));
-#endif /* AR9170_TXAGG_DEBUG */
-                        break;
-                }
-
-                queue = TID_TO_WME_AC(tid_info->tid);
-
-                if (skb_queue_len(&ar->tx_pending[queue]) >=
-                    AR9170_NUM_TX_AGG_MAX) {
-#ifdef AR9170_TXAGG_DEBUG
-                        printk(KERN_DEBUG "%s: queue %d full.\n",
-                               wiphy_name(ar->hw->wiphy), queue);
-#endif /* AR9170_TXAGG_DEBUG */
-                        continue;
-                }
-
-                list_del_init(&tid_info->list);
-
-                spin_lock_irqsave(&tid_info->queue.lock, f2);
-                tmpssn = seq = tid_info->ssn;
-                first = skb_peek(&tid_info->queue);
-
-                if (likely(first))
-                        tmpssn = ar9170_get_seq(first);
-
-                if (unlikely(tmpssn != seq)) {
-#ifdef AR9170_TXAGG_DEBUG
-                        printk(KERN_DEBUG "%s: ssn mismatch [%d != %d]\n.",
-                               wiphy_name(ar->hw->wiphy), seq, tmpssn);
-#endif /* AR9170_TXAGG_DEBUG */
-                        tid_info->ssn = tmpssn;
-                }
-
-#ifdef AR9170_TXAGG_DEBUG
-                printk(KERN_DEBUG "%s: generate A-MPDU for tid:%d ssn:%d with "
-                       "%d queued frames.\n", wiphy_name(ar->hw->wiphy),
-                       tid_info->tid, tid_info->ssn,
-                       skb_queue_len(&tid_info->queue));
-                __ar9170_dump_txqueue(ar, &tid_info->queue);
-#endif /* AR9170_TXAGG_DEBUG */
-
-                while ((skb = skb_peek(&tid_info->queue))) {
-                        if (unlikely(ar9170_get_seq(skb) != seq))
-                                break;
-
-                        __skb_unlink(skb, &tid_info->queue);
-                        tid_info->ssn = seq = GET_NEXT_SEQ(seq);
-
-                        if (unlikely(skb_get_queue_mapping(skb) != queue)) {
-#ifdef AR9170_TXAGG_DEBUG
-                                printk(KERN_DEBUG "%s: tid:%d(q:%d) queue:%d "
-                                       "!match.\n", wiphy_name(ar->hw->wiphy),
-                                       tid_info->tid,
-                                       TID_TO_WME_AC(tid_info->tid),
-                                       skb_get_queue_mapping(skb));
-#endif /* AR9170_TXAGG_DEBUG */
-                                        dev_kfree_skb_any(skb);
-                                        continue;
-                        }
-
-                        if (unlikely(first == skb)) {
-                                ar9170_tx_prepare_phy(ar, skb);
-                                __skb_queue_tail(&agg, skb);
-                                first = skb;
-                        } else {
-                                ar9170_tx_copy_phy(ar, skb, first);
-                                __skb_queue_tail(&agg, skb);
-                        }
-
-                        if (unlikely(skb_queue_len(&agg) ==
-                            AR9170_NUM_TX_AGG_MAX))
-                                break;
-                }
-
-                if (skb_queue_empty(&tid_info->queue))
-                        tid_info->active = false;
-                else
-                        list_add_tail(&tid_info->list,
-                                      &ar->tx_ampdu_list);
-
-                spin_unlock_irqrestore(&tid_info->queue.lock, f2);
-
-                if (unlikely(skb_queue_empty(&agg))) {
-#ifdef AR9170_TXAGG_DEBUG
-                        printk(KERN_DEBUG "%s: queued empty list!\n",
-                               wiphy_name(ar->hw->wiphy));
-#endif /* AR9170_TXAGG_DEBUG */
-                        continue;
-                }
-
-                /*
-                 * tell the FW/HW that this is the last frame,
-                 * that way it will wait for the immediate block ack.
-                 */
-                ar9170_tx_indicate_immba(ar, skb_peek_tail(&agg));
-
-#ifdef AR9170_TXAGG_DEBUG
-                printk(KERN_DEBUG "%s: generated A-MPDU looks like this:\n",
-                       wiphy_name(ar->hw->wiphy));
-                __ar9170_dump_txqueue(ar, &agg);
-#endif /* AR9170_TXAGG_DEBUG */
-
-                spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
-
-                spin_lock_irqsave(&ar->tx_pending[queue].lock, flags);
-                skb_queue_splice_tail_init(&agg, &ar->tx_pending[queue]);
-                spin_unlock_irqrestore(&ar->tx_pending[queue].lock, flags);
-                run = true;
-
-                spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
-        }
-
-out_unlock:
-        spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
-        __skb_queue_purge(&agg);
-
-        return run;
-}
-
 static void ar9170_tx(struct ar9170 *ar)
 {
         struct sk_buff *skb;
@@ -1763,9 +1434,6 @@ static void ar9170_tx(struct ar9170 *ar)
                         arinfo->timeout = jiffies +
                                           msecs_to_jiffies(AR9170_TX_TIMEOUT);
 
-                        if (info->flags & IEEE80211_TX_CTL_AMPDU)
-                                atomic_inc(&ar->tx_ampdu_pending);
-
 #ifdef AR9170_QUEUE_DEBUG
                         printk(KERN_DEBUG "%s: send frame q:%d =>\n",
                                wiphy_name(ar->hw->wiphy), i);
@@ -1774,9 +1442,6 @@ static void ar9170_tx(struct ar9170 *ar)
 
                         err = ar->tx(ar, skb);
                         if (unlikely(err)) {
-                                if (info->flags & IEEE80211_TX_CTL_AMPDU)
-                                        atomic_dec(&ar->tx_ampdu_pending);
-
                                 frames_failed++;
                                 dev_kfree_skb_any(skb);
                         } else {
@@ -1823,94 +1488,11 @@ static void ar9170_tx(struct ar9170 *ar)
                                      msecs_to_jiffies(AR9170_JANITOR_DELAY));
 }
 
-static bool ar9170_tx_ampdu_queue(struct ar9170 *ar, struct sk_buff *skb)
-{
-        struct ieee80211_tx_info *txinfo;
-        struct ar9170_sta_info *sta_info;
-        struct ar9170_sta_tid *agg;
-        struct sk_buff *iter;
-        unsigned long flags, f2;
-        unsigned int max;
-        u16 tid, seq, qseq;
-        bool run = false, queue = false;
-
-        tid = ar9170_get_tid(skb);
-        seq = ar9170_get_seq(skb);
-        txinfo = IEEE80211_SKB_CB(skb);
-        sta_info = (void *) txinfo->control.sta->drv_priv;
-        agg = &sta_info->agg[tid];
-        max = sta_info->ampdu_max_len;
-
-        spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
-
-        if (unlikely(agg->state != AR9170_TID_STATE_COMPLETE)) {
-#ifdef AR9170_TXAGG_DEBUG
-                printk(KERN_DEBUG "%s: BlockACK session not fully initialized "
-                       "for ESS:%pM tid:%d state:%d.\n",
-                       wiphy_name(ar->hw->wiphy), agg->addr, agg->tid,
-                       agg->state);
-#endif /* AR9170_TXAGG_DEBUG */
-                goto err_unlock;
-        }
-
-        if (!agg->active) {
-                agg->active = true;
-                agg->ssn = seq;
-                queue = true;
-        }
-
-        /* check if seq is within the BA window */
-        if (unlikely(!BAW_WITHIN(agg->ssn, max, seq))) {
-#ifdef AR9170_TXAGG_DEBUG
-                printk(KERN_DEBUG "%s: frame with tid:%d seq:%d does not "
-                       "fit into BA window (%d - %d)\n",
-                       wiphy_name(ar->hw->wiphy), tid, seq, agg->ssn,
-                       (agg->ssn + max) & 0xfff);
-#endif /* AR9170_TXAGG_DEBUG */
-                goto err_unlock;
-        }
-
-        spin_lock_irqsave(&agg->queue.lock, f2);
-
-        skb_queue_reverse_walk(&agg->queue, iter) {
-                qseq = ar9170_get_seq(iter);
-
-                if (GET_NEXT_SEQ(qseq) == seq) {
-                        __skb_queue_after(&agg->queue, iter, skb);
-                        goto queued;
-                }
-        }
-
-        __skb_queue_head(&agg->queue, skb);
-
-queued:
-        spin_unlock_irqrestore(&agg->queue.lock, f2);
-
-#ifdef AR9170_TXAGG_DEBUG
-        printk(KERN_DEBUG "%s: new aggregate %p queued.\n",
-               wiphy_name(ar->hw->wiphy), skb);
-        __ar9170_dump_txqueue(ar, &agg->queue);
-#endif /* AR9170_TXAGG_DEBUG */
-
-        if (skb_queue_len(&agg->queue) >= AR9170_NUM_TX_AGG_MAX)
-                run = true;
-
-        if (queue)
-                list_add_tail(&agg->list, &ar->tx_ampdu_list);
-
-        spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
-        return run;
-
-err_unlock:
-        spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
-        dev_kfree_skb_irq(skb);
-        return false;
-}
-
 int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct ar9170 *ar = hw->priv;
         struct ieee80211_tx_info *info;
+        unsigned int queue;
 
         if (unlikely(!IS_STARTED(ar)))
                 goto err_free;
@@ -1918,18 +1500,10 @@ int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         if (unlikely(ar9170_tx_prepare(ar, skb)))
                 goto err_free;
 
+        queue = skb_get_queue_mapping(skb);
         info = IEEE80211_SKB_CB(skb);
-        if (info->flags & IEEE80211_TX_CTL_AMPDU) {
-                bool run = ar9170_tx_ampdu_queue(ar, skb);
-
-                if (run || !atomic_read(&ar->tx_ampdu_pending))
-                        ar9170_tx_ampdu(ar);
-        } else {
-                unsigned int queue = skb_get_queue_mapping(skb);
-
-                ar9170_tx_prepare_phy(ar, skb);
-                skb_queue_tail(&ar->tx_pending[queue], skb);
-        }
+        ar9170_tx_prepare_phy(ar, skb);
+        skb_queue_tail(&ar->tx_pending[queue], skb);
 
         ar9170_tx(ar);
         return NETDEV_TX_OK;
@@ -2326,57 +1900,6 @@ out:
         return err;
 }
 
-static int ar9170_sta_add(struct ieee80211_hw *hw,
-                          struct ieee80211_vif *vif,
-                          struct ieee80211_sta *sta)
-{
-        struct ar9170 *ar = hw->priv;
-        struct ar9170_sta_info *sta_info = (void *) sta->drv_priv;
-        unsigned int i;
-
-        memset(sta_info, 0, sizeof(*sta_info));
-
-        if (!sta->ht_cap.ht_supported)
-                return 0;
-
-        if (sta->ht_cap.ampdu_density > ar->global_ampdu_density)
-                ar->global_ampdu_density = sta->ht_cap.ampdu_density;
-
-        if (sta->ht_cap.ampdu_factor < ar->global_ampdu_factor)
-                ar->global_ampdu_factor = sta->ht_cap.ampdu_factor;
-
-        for (i = 0; i < AR9170_NUM_TID; i++) {
-                sta_info->agg[i].state = AR9170_TID_STATE_SHUTDOWN;
-                sta_info->agg[i].active = false;
-                sta_info->agg[i].ssn = 0;
-                sta_info->agg[i].tid = i;
-                INIT_LIST_HEAD(&sta_info->agg[i].list);
-                skb_queue_head_init(&sta_info->agg[i].queue);
-        }
-
-        sta_info->ampdu_max_len = 1 << (3 + sta->ht_cap.ampdu_factor);
-
-        return 0;
-}
-
-static int ar9170_sta_remove(struct ieee80211_hw *hw,
-                             struct ieee80211_vif *vif,
-                             struct ieee80211_sta *sta)
-{
-        struct ar9170_sta_info *sta_info = (void *) sta->drv_priv;
-        unsigned int i;
-
-        if (!sta->ht_cap.ht_supported)
-                return 0;
-
-        for (i = 0; i < AR9170_NUM_TID; i++) {
-                sta_info->agg[i].state = AR9170_TID_STATE_INVALID;
-                skb_queue_purge(&sta_info->agg[i].queue);
-        }
-
-        return 0;
-}
-
 static int ar9170_get_stats(struct ieee80211_hw *hw,
                             struct ieee80211_low_level_stats *stats)
 {
@@ -2419,55 +1942,7 @@ static int ar9170_ampdu_action(struct ieee80211_hw *hw,
                                enum ieee80211_ampdu_mlme_action action,
                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
 {
-        struct ar9170 *ar = hw->priv;
-        struct ar9170_sta_info *sta_info = (void *) sta->drv_priv;
-        struct ar9170_sta_tid *tid_info = &sta_info->agg[tid];
-        unsigned long flags;
-
-        if (!modparam_ht)
-                return -EOPNOTSUPP;
-
         switch (action) {
-        case IEEE80211_AMPDU_TX_START:
-                spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
-                if (tid_info->state != AR9170_TID_STATE_SHUTDOWN ||
-                    !list_empty(&tid_info->list)) {
-                        spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
-#ifdef AR9170_TXAGG_DEBUG
-                        printk(KERN_INFO "%s: A-MPDU [ESS:[%pM] tid:[%d]] "
-                               "is in a very bad state!\n",
-                               wiphy_name(hw->wiphy), sta->addr, tid);
-#endif /* AR9170_TXAGG_DEBUG */
-                        return -EBUSY;
-                }
-
-                *ssn = tid_info->ssn;
-                tid_info->state = AR9170_TID_STATE_PROGRESS;
-                tid_info->active = false;
-                spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
-                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
-                break;
-
-        case IEEE80211_AMPDU_TX_STOP:
-                spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
-                tid_info->state = AR9170_TID_STATE_SHUTDOWN;
-                list_del_init(&tid_info->list);
-                tid_info->active = false;
-                skb_queue_purge(&tid_info->queue);
-                spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
-                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
-                break;
-
-        case IEEE80211_AMPDU_TX_OPERATIONAL:
-#ifdef AR9170_TXAGG_DEBUG
-                printk(KERN_INFO "%s: A-MPDU for %pM [tid:%d] Operational.\n",
-                       wiphy_name(hw->wiphy), sta->addr, tid);
-#endif /* AR9170_TXAGG_DEBUG */
-                spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
-                sta_info->agg[tid].state = AR9170_TID_STATE_COMPLETE;
-                spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
-                break;
-
         case IEEE80211_AMPDU_RX_START:
         case IEEE80211_AMPDU_RX_STOP:
                 /* Handled by firmware */
@@ -2493,8 +1968,6 @@ static const struct ieee80211_ops ar9170_ops = {
         .bss_info_changed       = ar9170_op_bss_info_changed,
         .get_tsf                = ar9170_op_get_tsf,
         .set_key                = ar9170_set_key,
-        .sta_add                = ar9170_sta_add,
-        .sta_remove             = ar9170_sta_remove,
         .get_stats              = ar9170_get_stats,
         .ampdu_action           = ar9170_ampdu_action,
 };
@@ -2527,8 +2000,6 @@ void *ar9170_alloc(size_t priv_size)
         mutex_init(&ar->mutex);
         spin_lock_init(&ar->cmdlock);
         spin_lock_init(&ar->tx_stats_lock);
-        spin_lock_init(&ar->tx_ampdu_list_lock);
-        skb_queue_head_init(&ar->tx_status_ampdu);
         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
                 skb_queue_head_init(&ar->tx_status[i]);
                 skb_queue_head_init(&ar->tx_pending[i]);
@@ -2536,7 +2007,6 @@ void *ar9170_alloc(size_t priv_size)
         ar9170_rx_reset_rx_mpdu(ar);
         INIT_WORK(&ar->beacon_work, ar9170_new_beacon);
         INIT_DELAYED_WORK(&ar->tx_janitor, ar9170_tx_janitor);
-        INIT_LIST_HEAD(&ar->tx_ampdu_list);
 
         /* all hw supports 2.4 GHz, so set channel to 1 by default */
         ar->channel = &ar9170_2ghz_chantable[0];
@@ -2549,16 +2019,8 @@ void *ar9170_alloc(size_t priv_size)
                          IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
                          IEEE80211_HW_SIGNAL_DBM;
 
-        if (modparam_ht) {
-                ar->hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
-        } else {
-                ar9170_band_2GHz.ht_cap.ht_supported = false;
-                ar9170_band_5GHz.ht_cap.ht_supported = false;
-        }
-
         ar->hw->queues = __AR9170_NUM_TXQ;
         ar->hw->extra_tx_headroom = 8;
-        ar->hw->sta_data_size = sizeof(struct ar9170_sta_info);
 
         ar->hw->max_rates = 1;
         ar->hw->max_rate_tries = 3;
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index c1c7c427501c..8663660ea4c6 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -42,6 +42,7 @@
 #include <linux/usb.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
+#include <linux/device.h>
 #include <net/mac80211.h>
 #include "ar9170.h"
 #include "cmd.h"
@@ -737,12 +738,16 @@ static void ar9170_usb_firmware_failed(struct ar9170_usb *aru)
 {
         struct device *parent = aru->udev->dev.parent;
 
+        complete(&aru->firmware_loading_complete);
+
         /* unbind anything failed */
         if (parent)
-                down(&parent->sem);
+                device_lock(parent);
         device_release_driver(&aru->udev->dev);
         if (parent)
-                up(&parent->sem);
+                device_unlock(parent);
+
+        usb_put_dev(aru->udev);
 }
 
 static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
@@ -771,6 +776,8 @@ static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
         if (err)
                 goto err_unrx;
 
+        complete(&aru->firmware_loading_complete);
+        usb_put_dev(aru->udev);
         return;
 
  err_unrx:
@@ -868,6 +875,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         init_usb_anchor(&aru->tx_pending);
         init_usb_anchor(&aru->tx_submitted);
         init_completion(&aru->cmd_wait);
+        init_completion(&aru->firmware_loading_complete);
         spin_lock_init(&aru->tx_urb_lock);
 
         aru->tx_pending_urbs = 0;
@@ -887,6 +895,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         if (err)
                 goto err_freehw;
 
+        usb_get_dev(aru->udev);
         return request_firmware_nowait(THIS_MODULE, 1, "ar9170.fw",
                                        &aru->udev->dev, GFP_KERNEL, aru,
                                        ar9170_usb_firmware_step2);
@@ -906,6 +915,9 @@ static void ar9170_usb_disconnect(struct usb_interface *intf)
                 return;
 
         aru->common.state = AR9170_IDLE;
+
+        wait_for_completion(&aru->firmware_loading_complete);
+
         ar9170_unregister(&aru->common);
         ar9170_usb_cancel_urbs(aru);
 
diff --git a/drivers/net/wireless/ath/ar9170/usb.h b/drivers/net/wireless/ath/ar9170/usb.h
index a2ce3b169ceb..919b06046eb3 100644
--- a/drivers/net/wireless/ath/ar9170/usb.h
+++ b/drivers/net/wireless/ath/ar9170/usb.h
@@ -71,6 +71,7 @@ struct ar9170_usb {
         unsigned int tx_pending_urbs;
 
         struct completion cmd_wait;
+        struct completion firmware_loading_complete;
         int readlen;
         u8 *readbuf;
 
diff --git a/drivers/net/wireless/ath/ath5k/ani.c b/drivers/net/wireless/ath/ath5k/ani.c
index 584a32859bdb..f2311ab35504 100644
--- a/drivers/net/wireless/ath/ath5k/ani.c
+++ b/drivers/net/wireless/ath/ath5k/ani.c
@@ -73,7 +73,7 @@ ath5k_ani_set_noise_immunity_level(struct ath5k_hw *ah, int level)
         const s8 hi[] = { -14, -12 };
         const s8 fr[] = { -78, -80 };
 #endif
-        if (level < 0 || level > ARRAY_SIZE(sz)) {
+        if (level < 0 || level >= ARRAY_SIZE(sz)) {
                 ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
                         "level out of range %d", level);
                 return;
@@ -104,7 +104,7 @@ ath5k_ani_set_spur_immunity_level(struct ath5k_hw *ah, int level)
 {
         const int val[] = { 2, 4, 6, 8, 10, 12, 14, 16 };
 
-        if (level < 0 || level > ARRAY_SIZE(val) ||
+        if (level < 0 || level >= ARRAY_SIZE(val) ||
             level > ah->ah_sc->ani_state.max_spur_level) {
                 ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
                         "level out of range %d", level);
@@ -129,7 +129,7 @@ ath5k_ani_set_firstep_level(struct ath5k_hw *ah, int level)
 {
         const int val[] = { 0, 4, 8 };
 
-        if (level < 0 || level > ARRAY_SIZE(val)) {
+        if (level < 0 || level >= ARRAY_SIZE(val)) {
                 ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
                         "level out of range %d", level);
                 return;
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 3ce9afba1d88..1b81c4778800 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -2145,8 +2145,6 @@ ath5k_get_chan_pcal_surrounding_piers(struct ath5k_hw *ah,
 done:
         *pcinfo_l = &pcinfo[idx_l];
         *pcinfo_r = &pcinfo[idx_r];
-
-        return;
 }
 
 /*
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index 44bbbf2a6edd..307f80e83f94 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -627,7 +627,6 @@ static void ath5k_hw_set_sleep_clock(struct ath5k_hw *ah, bool enable)
 
                 AR5K_REG_WRITE_BITS(ah, AR5K_TSF_PARM, AR5K_TSF_PARM_INC, 1);
         }
-        return;
 }
 
 /* TODO: Half/Quarter rate */
@@ -883,8 +882,6 @@ static void ath5k_hw_commit_eeprom_settings(struct ath5k_hw *ah,
         /* Heavy clipping -disable for now */
         if (ah->ah_ee_version >= AR5K_EEPROM_VERSION_5_1)
                 ath5k_hw_reg_write(ah, 0, AR5K_PHY_HEAVY_CLIP_ENABLE);
-
-        return;
 }
 
 /*
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 5fcafb460877..56a9e5fa6d66 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -726,7 +726,6 @@ static void ar9003_hw_tx_iq_cal(struct ath_hw *ah)
 
 TX_IQ_CAL_FAILED:
         ath_print(common, ATH_DBG_CALIBRATE, "Tx IQ Cal failed\n");
-        return;
 }
 
 static bool ar9003_hw_init_cal(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_initvals.h
index a131cd10ef29..ef6116e13033 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_initvals.h
@@ -541,7 +541,7 @@ static const u32 ar9300_2p0_mac_postamble[][5] = {
 
 static const u32 ar9300_2p0_soc_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00007010, 0x00000023, 0x00000023, 0x00000022, 0x00000022},
+        {0x00007010, 0x00000023, 0x00000023, 0x00000023, 0x00000023},
 };
 
 static const u32 ar9200_merlin_2p0_radio_core[][2] = {
@@ -588,12 +588,12 @@ static const u32 ar9200_merlin_2p0_radio_core[][2] = {
 
 static const u32 ar9300_2p0_baseband_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8005, 0xd00a8005},
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8005, 0xd00a800b},
         {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a012e},
         {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0},
         {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x06903881},
         {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
-        {0x00009830, 0x0000059c, 0x0000059c, 0x0000059c, 0x0000059c},
+        {0x00009830, 0x0000059c, 0x0000059c, 0x0000059c, 0x00000b9c},
         {0x00009c00, 0x00000044, 0x000000c4, 0x000000c4, 0x00000044},
         {0x00009e00, 0x0372161e, 0x0372161e, 0x037216a0, 0x037216a0},
         {0x00009e04, 0x00802020, 0x00802020, 0x00802020, 0x00802020},
@@ -744,7 +744,7 @@ static const u32 ar9300_2p0_baseband_core[][2] = {
         {0x0000a408, 0x0e79e5c6},
         {0x0000a40c, 0x00820820},
         {0x0000a414, 0x1ce739ce},
-        {0x0000a418, 0x7d001dce},
+        {0x0000a418, 0x2d001dce},
         {0x0000a41c, 0x1ce739ce},
         {0x0000a420, 0x000001ce},
         {0x0000a424, 0x1ce739ce},
@@ -756,7 +756,7 @@ static const u32 ar9300_2p0_baseband_core[][2] = {
         {0x0000a43c, 0x00000000},
         {0x0000a440, 0x00000000},
         {0x0000a444, 0x00000000},
-        {0x0000a448, 0x07000080},
+        {0x0000a448, 0x04000080},
         {0x0000a44c, 0x00000001},
         {0x0000a450, 0x00010000},
         {0x0000a458, 0x00000000},
@@ -777,7 +777,7 @@ static const u32 ar9300_2p0_baseband_core[][2] = {
         {0x0000a638, 0x00000000},
         {0x0000a63c, 0x00000000},
         {0x0000a640, 0x00000000},
-        {0x0000a644, 0x3ffd9d74},
+        {0x0000a644, 0x3fad9d74},
         {0x0000a648, 0x0048060a},
         {0x0000a64c, 0x00000637},
         {0x0000a670, 0x03020100},
@@ -835,9 +835,9 @@ static const u32 ar9300_2p0_baseband_core[][2] = {
 
 static const u32 ar9300Modes_high_power_tx_gain_table_2p0[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a410, 0x000050db, 0x000050db, 0x000050d9, 0x000050d9},
-        {0x0000a500, 0x00020220, 0x00020220, 0x00000000, 0x00000000},
-        {0x0000a504, 0x06020223, 0x06020223, 0x04000002, 0x04000002},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
         {0x0000a508, 0x0a022220, 0x0a022220, 0x08000004, 0x08000004},
         {0x0000a50c, 0x0f022223, 0x0f022223, 0x0b000200, 0x0b000200},
         {0x0000a510, 0x14022620, 0x14022620, 0x0f000202, 0x0f000202},
@@ -848,28 +848,28 @@ static const u32 ar9300Modes_high_power_tx_gain_table_2p0[][5] = {
         {0x0000a524, 0x28023042, 0x28023042, 0x1f000a02, 0x1f000a02},
         {0x0000a528, 0x2c023044, 0x2c023044, 0x23000a04, 0x23000a04},
         {0x0000a52c, 0x2f023644, 0x2f023644, 0x26000a20, 0x26000a20},
-        {0x0000a530, 0x34043643, 0x34043643, 0x2a000e20, 0x2a000e20},
-        {0x0000a534, 0x38043a44, 0x38043a44, 0x2e000e22, 0x2e000e22},
-        {0x0000a538, 0x3b043e45, 0x3b043e45, 0x31000e24, 0x31000e24},
-        {0x0000a53c, 0x40063e46, 0x40063e46, 0x34001640, 0x34001640},
-        {0x0000a540, 0x44083e46, 0x44083e46, 0x38001660, 0x38001660},
-        {0x0000a544, 0x46083e66, 0x46083e66, 0x3b001861, 0x3b001861},
-        {0x0000a548, 0x4b0a3e69, 0x4b0a3e69, 0x3e001a81, 0x3e001a81},
-        {0x0000a54c, 0x4f0a5e66, 0x4f0a5e66, 0x42001a83, 0x42001a83},
-        {0x0000a550, 0x540a7e66, 0x540a7e66, 0x44001c84, 0x44001c84},
-        {0x0000a554, 0x570a7e89, 0x570a7e89, 0x48001ce3, 0x48001ce3},
-        {0x0000a558, 0x5c0e7e8a, 0x5c0e7e8a, 0x4c001ce5, 0x4c001ce5},
-        {0x0000a55c, 0x60127e8b, 0x60127e8b, 0x50001ce9, 0x50001ce9},
-        {0x0000a560, 0x65127ecc, 0x65127ecc, 0x54001ceb, 0x54001ceb},
-        {0x0000a564, 0x6b169ecd, 0x6b169ecd, 0x56001eec, 0x56001eec},
-        {0x0000a568, 0x70169f0e, 0x70169f0e, 0x56001eec, 0x56001eec},
-        {0x0000a56c, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
-        {0x0000a570, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
-        {0x0000a574, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
-        {0x0000a578, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
-        {0x0000a57c, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
-        {0x0000a580, 0x00820220, 0x00820220, 0x00800000, 0x00800000},
-        {0x0000a584, 0x06820223, 0x06820223, 0x04800002, 0x04800002},
+        {0x0000a530, 0x34025643, 0x34025643, 0x2a000e20, 0x2a000e20},
+        {0x0000a534, 0x38025a44, 0x38025a44, 0x2e000e22, 0x2e000e22},
+        {0x0000a538, 0x3b025e45, 0x3b025e45, 0x31000e24, 0x31000e24},
+        {0x0000a53c, 0x41025e4a, 0x41025e4a, 0x34001640, 0x34001640},
+        {0x0000a540, 0x48025e6c, 0x48025e6c, 0x38001660, 0x38001660},
+        {0x0000a544, 0x4e025e8e, 0x4e025e8e, 0x3b001861, 0x3b001861},
+        {0x0000a548, 0x53025eb2, 0x53025eb2, 0x3e001a81, 0x3e001a81},
+        {0x0000a54c, 0x59025eb5, 0x59025eb5, 0x42001a83, 0x42001a83},
+        {0x0000a550, 0x5f025ef6, 0x5f025ef6, 0x44001c84, 0x44001c84},
+        {0x0000a554, 0x62025f56, 0x62025f56, 0x48001ce3, 0x48001ce3},
+        {0x0000a558, 0x66027f56, 0x66027f56, 0x4c001ce5, 0x4c001ce5},
+        {0x0000a55c, 0x6a029f56, 0x6a029f56, 0x50001ce9, 0x50001ce9},
+        {0x0000a560, 0x70049f56, 0x70049f56, 0x54001ceb, 0x54001ceb},
+        {0x0000a564, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a56c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a570, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a574, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a578, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a57c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a580, 0x00802220, 0x00802220, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06802223, 0x06802223, 0x04800002, 0x04800002},
         {0x0000a588, 0x0a822220, 0x0a822220, 0x08800004, 0x08800004},
         {0x0000a58c, 0x0f822223, 0x0f822223, 0x0b800200, 0x0b800200},
         {0x0000a590, 0x14822620, 0x14822620, 0x0f800202, 0x0f800202},
@@ -880,42 +880,42 @@ static const u32 ar9300Modes_high_power_tx_gain_table_2p0[][5] = {
         {0x0000a5a4, 0x28823042, 0x28823042, 0x1f800a02, 0x1f800a02},
         {0x0000a5a8, 0x2c823044, 0x2c823044, 0x23800a04, 0x23800a04},
         {0x0000a5ac, 0x2f823644, 0x2f823644, 0x26800a20, 0x26800a20},
-        {0x0000a5b0, 0x34843643, 0x34843643, 0x2a800e20, 0x2a800e20},
-        {0x0000a5b4, 0x38843a44, 0x38843a44, 0x2e800e22, 0x2e800e22},
-        {0x0000a5b8, 0x3b843e45, 0x3b843e45, 0x31800e24, 0x31800e24},
-        {0x0000a5bc, 0x40863e46, 0x40863e46, 0x34801640, 0x34801640},
-        {0x0000a5c0, 0x4c8a3065, 0x44883e46, 0x44883e46, 0x38801660},
-        {0x0000a5c4, 0x46883e66, 0x46883e66, 0x3b801861, 0x3b801861},
-        {0x0000a5c8, 0x4b8a3e69, 0x4b8a3e69, 0x3e801a81, 0x3e801a81},
-        {0x0000a5cc, 0x4f8a5e66, 0x4f8a5e66, 0x42801a83, 0x42801a83},
-        {0x0000a5d0, 0x548a7e66, 0x548a7e66, 0x44801c84, 0x44801c84},
-        {0x0000a5d4, 0x578a7e89, 0x578a7e89, 0x48801ce3, 0x48801ce3},
-        {0x0000a5d8, 0x5c8e7e8a, 0x5c8e7e8a, 0x4c801ce5, 0x4c801ce5},
-        {0x0000a5dc, 0x60927e8b, 0x60927e8b, 0x50801ce9, 0x50801ce9},
-        {0x0000a5e0, 0x65927ecc, 0x65927ecc, 0x54801ceb, 0x54801ceb},
-        {0x0000a5e4, 0x6b969ecd, 0x6b969ecd, 0x56801eec, 0x56801eec},
-        {0x0000a5e8, 0x70969f0e, 0x70969f0e, 0x56801eec, 0x56801eec},
-        {0x0000a5ec, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
-        {0x0000a5f0, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
-        {0x0000a5f4, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
-        {0x0000a5f8, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
-        {0x0000a5fc, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
+        {0x0000a5b0, 0x34825643, 0x34825643, 0x2a800e20, 0x2a800e20},
+        {0x0000a5b4, 0x38825a44, 0x38825a44, 0x2e800e22, 0x2e800e22},
+        {0x0000a5b8, 0x3b825e45, 0x3b825e45, 0x31800e24, 0x31800e24},
+        {0x0000a5bc, 0x41825e4a, 0x41825e4a, 0x34801640, 0x34801640},
+        {0x0000a5c0, 0x48825e6c, 0x48825e6c, 0x38801660, 0x38801660},
+        {0x0000a5c4, 0x4e825e8e, 0x4e825e8e, 0x3b801861, 0x3b801861},
+        {0x0000a5c8, 0x53825eb2, 0x53825eb2, 0x3e801a81, 0x3e801a81},
+        {0x0000a5cc, 0x59825eb5, 0x59825eb5, 0x42801a83, 0x42801a83},
+        {0x0000a5d0, 0x5f825ef6, 0x5f825ef6, 0x44801c84, 0x44801c84},
+        {0x0000a5d4, 0x62825f56, 0x62825f56, 0x48801ce3, 0x48801ce3},
+        {0x0000a5d8, 0x66827f56, 0x66827f56, 0x4c801ce5, 0x4c801ce5},
+        {0x0000a5dc, 0x6a829f56, 0x6a829f56, 0x50801ce9, 0x50801ce9},
+        {0x0000a5e0, 0x70849f56, 0x70849f56, 0x54801ceb, 0x54801ceb},
+        {0x0000a5e4, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a5e8, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a5ec, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a5f0, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a5f4, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a5f8, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a5fc, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
         {0x00016044, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
-        {0x00016048, 0xad241a61, 0xad241a61, 0xad241a61, 0xad241a61},
+        {0x00016048, 0xae481a61, 0xae481a61, 0xae481a61, 0xae481a61},
         {0x00016068, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
         {0x00016444, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
-        {0x00016448, 0xad241a61, 0xad241a61, 0xad241a61, 0xad241a61},
+        {0x00016448, 0xae481a61, 0xae481a61, 0xae481a61, 0xae481a61},
         {0x00016468, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
         {0x00016844, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
-        {0x00016848, 0xad241a61, 0xad241a61, 0xad241a61, 0xad241a61},
+        {0x00016848, 0xae481a61, 0xae481a61, 0xae481a61, 0xae481a61},
         {0x00016868, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
 };
 
 static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p0[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a410, 0x000050db, 0x000050db, 0x000050d9, 0x000050d9},
-        {0x0000a500, 0x00020220, 0x00020220, 0x00000000, 0x00000000},
-        {0x0000a504, 0x06020223, 0x06020223, 0x04000002, 0x04000002},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
         {0x0000a508, 0x0a022220, 0x0a022220, 0x08000004, 0x08000004},
         {0x0000a50c, 0x0f022223, 0x0f022223, 0x0b000200, 0x0b000200},
         {0x0000a510, 0x14022620, 0x14022620, 0x0f000202, 0x0f000202},
@@ -926,28 +926,28 @@ static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p0[][5] = {
         {0x0000a524, 0x28023042, 0x28023042, 0x1f000a02, 0x1f000a02},
         {0x0000a528, 0x2c023044, 0x2c023044, 0x23000a04, 0x23000a04},
         {0x0000a52c, 0x2f023644, 0x2f023644, 0x26000a20, 0x26000a20},
-        {0x0000a530, 0x34043643, 0x34043643, 0x2a000e20, 0x2a000e20},
-        {0x0000a534, 0x38043a44, 0x38043a44, 0x2e000e22, 0x2e000e22},
-        {0x0000a538, 0x3b043e45, 0x3b043e45, 0x31000e24, 0x31000e24},
-        {0x0000a53c, 0x40063e46, 0x40063e46, 0x34001640, 0x34001640},
-        {0x0000a540, 0x44083e46, 0x44083e46, 0x38001660, 0x38001660},
-        {0x0000a544, 0x46083e66, 0x46083e66, 0x3b001861, 0x3b001861},
-        {0x0000a548, 0x4b0a3e69, 0x4b0a3e69, 0x3e001a81, 0x3e001a81},
-        {0x0000a54c, 0x4f0a5e66, 0x4f0a5e66, 0x42001a83, 0x42001a83},
-        {0x0000a550, 0x540a7e66, 0x540a7e66, 0x44001c84, 0x44001c84},
-        {0x0000a554, 0x570a7e89, 0x570a7e89, 0x48001ce3, 0x48001ce3},
-        {0x0000a558, 0x5c0e7e8a, 0x5c0e7e8a, 0x4c001ce5, 0x4c001ce5},
-        {0x0000a55c, 0x60127e8b, 0x60127e8b, 0x50001ce9, 0x50001ce9},
-        {0x0000a560, 0x65127ecc, 0x65127ecc, 0x54001ceb, 0x54001ceb},
-        {0x0000a564, 0x6b169ecd, 0x6b169ecd, 0x56001eec, 0x56001eec},
-        {0x0000a568, 0x70169f0e, 0x70169f0e, 0x56001eec, 0x56001eec},
-        {0x0000a56c, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
-        {0x0000a570, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
-        {0x0000a574, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
-        {0x0000a578, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
-        {0x0000a57c, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
-        {0x0000a580, 0x00820220, 0x00820220, 0x00800000, 0x00800000},
-        {0x0000a584, 0x06820223, 0x06820223, 0x04800002, 0x04800002},
+        {0x0000a530, 0x34025643, 0x34025643, 0x2a000e20, 0x2a000e20},
+        {0x0000a534, 0x38025a44, 0x38025a44, 0x2e000e22, 0x2e000e22},
+        {0x0000a538, 0x3b025e45, 0x3b025e45, 0x31000e24, 0x31000e24},
+        {0x0000a53c, 0x41025e4a, 0x41025e4a, 0x34001640, 0x34001640},
+        {0x0000a540, 0x48025e6c, 0x48025e6c, 0x38001660, 0x38001660},
+        {0x0000a544, 0x4e025e8e, 0x4e025e8e, 0x3b001861, 0x3b001861},
+        {0x0000a548, 0x53025eb2, 0x53025eb2, 0x3e001a81, 0x3e001a81},
+        {0x0000a54c, 0x59025eb5, 0x59025eb5, 0x42001a83, 0x42001a83},
+        {0x0000a550, 0x5f025ef6, 0x5f025ef6, 0x44001c84, 0x44001c84},
+        {0x0000a554, 0x62025f56, 0x62025f56, 0x48001ce3, 0x48001ce3},
+        {0x0000a558, 0x66027f56, 0x66027f56, 0x4c001ce5, 0x4c001ce5},
+        {0x0000a55c, 0x6a029f56, 0x6a029f56, 0x50001ce9, 0x50001ce9},
+        {0x0000a560, 0x70049f56, 0x70049f56, 0x54001ceb, 0x54001ceb},
+        {0x0000a564, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a56c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a570, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a574, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a578, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a57c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a580, 0x00802220, 0x00802220, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06802223, 0x06802223, 0x04800002, 0x04800002},
         {0x0000a588, 0x0a822220, 0x0a822220, 0x08800004, 0x08800004},
         {0x0000a58c, 0x0f822223, 0x0f822223, 0x0b800200, 0x0b800200},
         {0x0000a590, 0x14822620, 0x14822620, 0x0f800202, 0x0f800202},
@@ -958,34 +958,34 @@ static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p0[][5] = {
         {0x0000a5a4, 0x28823042, 0x28823042, 0x1f800a02, 0x1f800a02},
         {0x0000a5a8, 0x2c823044, 0x2c823044, 0x23800a04, 0x23800a04},
         {0x0000a5ac, 0x2f823644, 0x2f823644, 0x26800a20, 0x26800a20},
-        {0x0000a5b0, 0x34843643, 0x34843643, 0x2a800e20, 0x2a800e20},
-        {0x0000a5b4, 0x38843a44, 0x38843a44, 0x2e800e22, 0x2e800e22},
-        {0x0000a5b8, 0x3b843e45, 0x3b843e45, 0x31800e24, 0x31800e24},
-        {0x0000a5bc, 0x40863e46, 0x40863e46, 0x34801640, 0x34801640},
-        {0x0000a5c0, 0x44883e46, 0x44883e46, 0x38801660, 0x38801660},
-        {0x0000a5c4, 0x46883e66, 0x46883e66, 0x3b801861, 0x3b801861},
-        {0x0000a5c8, 0x4b8a3e69, 0x4b8a3e69, 0x3e801a81, 0x3e801a81},
-        {0x0000a5cc, 0x4f8a5e66, 0x4f8a5e66, 0x42801a83, 0x42801a83},
-        {0x0000a5d0, 0x548a7e66, 0x548a7e66, 0x44801c84, 0x44801c84},
-        {0x0000a5d4, 0x578a7e89, 0x578a7e89, 0x48801ce3, 0x48801ce3},
-        {0x0000a5d8, 0x5c8e7e8a, 0x5c8e7e8a, 0x4c801ce5, 0x4c801ce5},
-        {0x0000a5dc, 0x60927e8b, 0x60927e8b, 0x50801ce9, 0x50801ce9},
-        {0x0000a5e0, 0x65927ecc, 0x65927ecc, 0x54801ceb, 0x54801ceb},
-        {0x0000a5e4, 0x6b969ecd, 0x6b969ecd, 0x56801eec, 0x56801eec},
-        {0x0000a5e8, 0x70969f0e, 0x70969f0e, 0x56801eec, 0x56801eec},
-        {0x0000a5ec, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
-        {0x0000a5f0, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
-        {0x0000a5f4, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
-        {0x0000a5f8, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
-        {0x0000a5fc, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
+        {0x0000a5b0, 0x34825643, 0x34825643, 0x2a800e20, 0x2a800e20},
+        {0x0000a5b4, 0x38825a44, 0x38825a44, 0x2e800e22, 0x2e800e22},
+        {0x0000a5b8, 0x3b825e45, 0x3b825e45, 0x31800e24, 0x31800e24},
+        {0x0000a5bc, 0x41825e4a, 0x41825e4a, 0x34801640, 0x34801640},
+        {0x0000a5c0, 0x48825e6c, 0x48825e6c, 0x38801660, 0x38801660},
+        {0x0000a5c4, 0x4e825e8e, 0x4e825e8e, 0x3b801861, 0x3b801861},
+        {0x0000a5c8, 0x53825eb2, 0x53825eb2, 0x3e801a81, 0x3e801a81},
+        {0x0000a5cc, 0x59825eb5, 0x59825eb5, 0x42801a83, 0x42801a83},
+        {0x0000a5d0, 0x5f825ef6, 0x5f825ef6, 0x44801c84, 0x44801c84},
+        {0x0000a5d4, 0x62825f56, 0x62825f56, 0x48801ce3, 0x48801ce3},
+        {0x0000a5d8, 0x66827f56, 0x66827f56, 0x4c801ce5, 0x4c801ce5},
+        {0x0000a5dc, 0x6a829f56, 0x6a829f56, 0x50801ce9, 0x50801ce9},
+        {0x0000a5e0, 0x70849f56, 0x70849f56, 0x54801ceb, 0x54801ceb},
+        {0x0000a5e4, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a5e8, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a5ec, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a5f0, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a5f4, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a5f8, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a5fc, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
         {0x00016044, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
-        {0x00016048, 0x8c001a61, 0x8c001a61, 0x8c001a61, 0x8c001a61},
+        {0x00016048, 0x8e481a61, 0x8e481a61, 0x8e481a61, 0x8e481a61},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
         {0x00016444, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
-        {0x00016448, 0x8c001a61, 0x8c001a61, 0x8c001a61, 0x8c001a61},
+        {0x00016448, 0x8e481a61, 0x8e481a61, 0x8e481a61, 0x8e481a61},
         {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
         {0x00016844, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
-        {0x00016848, 0x8c001a61, 0x8c001a61, 0x8c001a61, 0x8c001a61},
+        {0x00016848, 0x8e481a61, 0x8e481a61, 0x8e481a61, 0x8e481a61},
         {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 6982577043b8..07b8fa6fb62f 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -86,7 +86,6 @@ static void ath9k_hw_update_nfcal_hist_buffer(struct ath9k_nfcal_hist *h,
                                 ath9k_hw_get_nf_hist_mid(h[i].nfCalBuffer);
                 }
         }
-        return;
 }
 
 static bool ath9k_hw_get_nf_thresh(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index b4424a623cf5..7707341cd0d3 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -57,13 +57,19 @@ static bool ath9k_rx_accept(struct ath_common *common,
          * rs_more indicates chained descriptors which can be used
          * to link buffers together for a sort of scatter-gather
          * operation.
-         *
+         * reject the frame, we don't support scatter-gather yet and
+         * the frame is probably corrupt anyway
+         */
+        if (rx_stats->rs_more)
+                return false;
+
+        /*
          * The rx_stats->rs_status will not be set until the end of the
          * chained descriptors so it can be ignored if rs_more is set. The
          * rs_more will be false at the last element of the chained
          * descriptors.
          */
-        if (!rx_stats->rs_more && rx_stats->rs_status != 0) {
+        if (rx_stats->rs_status != 0) {
                 if (rx_stats->rs_status & ATH9K_RXERR_CRC)
                         rxs->flag |= RX_FLAG_FAILED_FCS_CRC;
                 if (rx_stats->rs_status & ATH9K_RXERR_PHY)
@@ -102,11 +108,11 @@ static bool ath9k_rx_accept(struct ath_common *common,
         return true;
 }
 
-static u8 ath9k_process_rate(struct ath_common *common,
-                             struct ieee80211_hw *hw,
-                             struct ath_rx_status *rx_stats,
-                             struct ieee80211_rx_status *rxs,
-                             struct sk_buff *skb)
+static int ath9k_process_rate(struct ath_common *common,
+                              struct ieee80211_hw *hw,
+                              struct ath_rx_status *rx_stats,
+                              struct ieee80211_rx_status *rxs,
+                              struct sk_buff *skb)
 {
         struct ieee80211_supported_band *sband;
         enum ieee80211_band band;
@@ -122,25 +128,32 @@ static u8 ath9k_process_rate(struct ath_common *common,
                         rxs->flag |= RX_FLAG_40MHZ;
                 if (rx_stats->rs_flags & ATH9K_RX_GI)
                         rxs->flag |= RX_FLAG_SHORT_GI;
-                return rx_stats->rs_rate & 0x7f;
+                rxs->rate_idx = rx_stats->rs_rate & 0x7f;
+                return 0;
         }
 
         for (i = 0; i < sband->n_bitrates; i++) {
-                if (sband->bitrates[i].hw_value == rx_stats->rs_rate)
-                        return i;
+                if (sband->bitrates[i].hw_value == rx_stats->rs_rate) {
+                        rxs->rate_idx = i;
+                        return 0;
+                }
                 if (sband->bitrates[i].hw_value_short == rx_stats->rs_rate) {
                         rxs->flag |= RX_FLAG_SHORTPRE;
-                        return i;
+                        rxs->rate_idx = i;
+                        return 0;
                 }
         }
 
-        /* No valid hardware bitrate found -- we should not get here */
+        /*
+         * No valid hardware bitrate found -- we should not get here
+         * because hardware has already validated this frame as OK.
+         */
         ath_print(common, ATH_DBG_XMIT, "unsupported hw bitrate detected "
                   "0x%02x using 1 Mbit\n", rx_stats->rs_rate);
         if ((common->debug_mask & ATH_DBG_XMIT))
                 print_hex_dump_bytes("", DUMP_PREFIX_NONE, skb->data, skb->len);
 
-        return 0;
+        return -EINVAL;
 }
 
 static void ath9k_process_rssi(struct ath_common *common,
@@ -202,13 +215,19 @@ int ath9k_cmn_rx_skb_preprocess(struct ath_common *common,
         struct ath_hw *ah = common->ah;
 
         memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
+
+        /*
+         * everything but the rate is checked here, the rate check is done
+         * separately to avoid doing two lookups for a rate for each frame.
+         */
         if (!ath9k_rx_accept(common, skb, rx_status, rx_stats, decrypt_error))
                 return -EINVAL;
 
         ath9k_process_rssi(common, hw, skb, rx_stats);
 
-        rx_status->rate_idx = ath9k_process_rate(common, hw,
-                                                 rx_stats, rx_status, skb);
+        if (ath9k_process_rate(common, hw, rx_stats, rx_status, skb))
+                return -EINVAL;
+
         rx_status->mactime = ath9k_hw_extend_tsf(ah, rx_stats->rs_tstamp);
         rx_status->band = hw->conf.channel->band;
         rx_status->freq = hw->conf.channel->center_freq;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index bd9dff3293dc..ca8704a9d7ac 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -36,8 +36,6 @@ void ath9k_hw_analog_shift_rmw(struct ath_hw *ah, u32 reg, u32 mask,
 
         if (ah->config.analog_shiftreg)
                 udelay(100);
-
-        return;
 }
 
 int16_t ath9k_hw_interpolate(u16 target, u16 srcLeft, u16 srcRight,
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index e591ad6016e5..7e1ed78d0e64 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -50,7 +50,6 @@ static void ath9k_get_txgain_index(struct ath_hw *ah,
                 i++;
 
         *pcdacIdx = i;
-        return;
 }
 
 static void ath9k_olc_get_pdadcs(struct ath_hw *ah,
@@ -751,8 +750,6 @@ static void ath9k_hw_get_def_gain_boundaries_pdadcs(struct ath_hw *ah,
                 pPDADCValues[k] = pPDADCValues[k - 1];
                 k++;
         }
-
-        return;
 }
 
 static int16_t ath9k_change_gain_boundary_setting(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 1ae18bbc4d9e..ad556aa8da39 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -356,7 +356,6 @@ struct ath9k_htc_priv {
         u16 seq_no;
         u32 bmiss_cnt;
 
-        struct sk_buff *beacon;
         spinlock_t beacon_lock;
 
         bool tx_queues_stop;
@@ -408,13 +407,13 @@ static inline void ath_read_cachesize(struct ath_common *common, int *csz)
 void ath9k_htc_beacon_config(struct ath9k_htc_priv *priv,
                              struct ieee80211_vif *vif);
 void ath9k_htc_swba(struct ath9k_htc_priv *priv, u8 beacon_pending);
-void ath9k_htc_beacon_update(struct ath9k_htc_priv *priv,
-                             struct ieee80211_vif *vif);
 
 void ath9k_htc_rxep(void *priv, struct sk_buff *skb,
                     enum htc_endpoint_id ep_id);
 void ath9k_htc_txep(void *priv, struct sk_buff *skb, enum htc_endpoint_id ep_id,
                     bool txok);
+void ath9k_htc_beaconep(void *drv_priv, struct sk_buff *skb,
+                        enum htc_endpoint_id ep_id, bool txok);
 
 void ath9k_htc_station_work(struct work_struct *work);
 void ath9k_htc_aggr_work(struct work_struct *work);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
index 7cb55f5b071c..c10c7d002eb7 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
@@ -165,22 +165,10 @@ static void ath9k_htc_beacon_config_adhoc(struct ath9k_htc_priv *priv,
         WMI_CMD_BUF(WMI_ENABLE_INTR_CMDID, &htc_imask);
 }
 
-void ath9k_htc_beacon_update(struct ath9k_htc_priv *priv,
-                             struct ieee80211_vif *vif)
+void ath9k_htc_beaconep(void *drv_priv, struct sk_buff *skb,
+                        enum htc_endpoint_id ep_id, bool txok)
 {
-        struct ath_common *common = ath9k_hw_common(priv->ah);
-
-        spin_lock_bh(&priv->beacon_lock);
-
-        if (priv->beacon)
-                dev_kfree_skb_any(priv->beacon);
-
-        priv->beacon = ieee80211_beacon_get(priv->hw, vif);
-        if (!priv->beacon)
-                ath_print(common, ATH_DBG_BEACON,
-                          "Unable to allocate beacon\n");
-
-        spin_unlock_bh(&priv->beacon_lock);
+        dev_kfree_skb_any(skb);
 }
 
 void ath9k_htc_swba(struct ath9k_htc_priv *priv, u8 beacon_pending)
@@ -189,6 +177,7 @@ void ath9k_htc_swba(struct ath9k_htc_priv *priv, u8 beacon_pending)
         struct tx_beacon_header beacon_hdr;
         struct ath9k_htc_tx_ctl tx_ctl;
         struct ieee80211_tx_info *info;
+        struct sk_buff *beacon;
         u8 *tx_fhdr;
 
         memset(&beacon_hdr, 0, sizeof(struct tx_beacon_header));
@@ -207,25 +196,17 @@ void ath9k_htc_swba(struct ath9k_htc_priv *priv, u8 beacon_pending)
                 return;
         }
 
-        if (unlikely(priv->beacon == NULL)) {
-                spin_unlock_bh(&priv->beacon_lock);
-                return;
-        }
-
-        /* Free the old SKB first */
-        dev_kfree_skb_any(priv->beacon);
-
         /* Get a new beacon */
-        priv->beacon = ieee80211_beacon_get(priv->hw, priv->vif);
-        if (!priv->beacon) {
+        beacon = ieee80211_beacon_get(priv->hw, priv->vif);
+        if (!beacon) {
                 spin_unlock_bh(&priv->beacon_lock);
                 return;
         }
 
-        info = IEEE80211_SKB_CB(priv->beacon);
+        info = IEEE80211_SKB_CB(beacon);
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
                 struct ieee80211_hdr *hdr =
-                        (struct ieee80211_hdr *) priv->beacon->data;
+                        (struct ieee80211_hdr *) beacon->data;
                 priv->seq_no += 0x10;
                 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
                 hdr->seq_ctrl |= cpu_to_le16(priv->seq_no);
@@ -233,10 +214,10 @@ void ath9k_htc_swba(struct ath9k_htc_priv *priv, u8 beacon_pending)
 
         tx_ctl.type = ATH9K_HTC_NORMAL;
         beacon_hdr.vif_index = avp->index;
-        tx_fhdr = skb_push(priv->beacon, sizeof(beacon_hdr));
+        tx_fhdr = skb_push(beacon, sizeof(beacon_hdr));
         memcpy(tx_fhdr, (u8 *) &beacon_hdr, sizeof(beacon_hdr));
 
-        htc_send(priv->htc, priv->beacon, priv->beacon_ep, &tx_ctl);
+        htc_send(priv->htc, beacon, priv->beacon_ep, &tx_ctl);
 
         spin_unlock_bh(&priv->beacon_lock);
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 701f2ef5a440..17111fc1d2cc 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -144,7 +144,7 @@ static int ath9k_init_htc_services(struct ath9k_htc_priv *priv)
                 goto err;
 
         /* Beacon */
-        ret = ath9k_htc_connect_svc(priv, WMI_BEACON_SVC, NULL,
+        ret = ath9k_htc_connect_svc(priv, WMI_BEACON_SVC, ath9k_htc_beaconep,
                                     &priv->beacon_ep);
         if (ret)
                 goto err;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index ca7f3a78eb11..6c386dad1d40 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -461,11 +461,11 @@ static int ath9k_htc_aggr_oper(struct ath9k_htc_priv *priv,
         struct ath_common *common = ath9k_hw_common(priv->ah);
         struct ath9k_htc_target_aggr aggr;
         struct ieee80211_sta *sta = NULL;
-        struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
+        struct ath9k_htc_sta *ista;
         int ret = 0;
         u8 cmd_rsp;
 
-        if (tid > ATH9K_HTC_MAX_TID)
+        if (tid >= ATH9K_HTC_MAX_TID)
                 return -EINVAL;
 
         memset(&aggr, 0, sizeof(struct ath9k_htc_target_aggr));
@@ -1099,7 +1099,7 @@ fail_tx:
         return 0;
 }
 
-static int ath9k_htc_radio_enable(struct ieee80211_hw *hw)
+static int ath9k_htc_radio_enable(struct ieee80211_hw *hw, bool led)
 {
         struct ath9k_htc_priv *priv = hw->priv;
         struct ath_hw *ah = priv->ah;
@@ -1147,6 +1147,13 @@ static int ath9k_htc_radio_enable(struct ieee80211_hw *hw)
         priv->tx_queues_stop = false;
         spin_unlock_bh(&priv->tx_lock);
 
+        if (led) {
+                /* Enable LED */
+                ath9k_hw_cfg_output(ah, ah->led_pin,
+                                    AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+                ath9k_hw_set_gpio(ah, ah->led_pin, 0);
+        }
+
         ieee80211_wake_queues(hw);
 
         return ret;
@@ -1158,13 +1165,13 @@ static int ath9k_htc_start(struct ieee80211_hw *hw)
         int ret = 0;
 
         mutex_lock(&priv->mutex);
-        ret = ath9k_htc_radio_enable(hw);
+        ret = ath9k_htc_radio_enable(hw, false);
         mutex_unlock(&priv->mutex);
 
         return ret;
 }
 
-static void ath9k_htc_radio_disable(struct ieee80211_hw *hw)
+static void ath9k_htc_radio_disable(struct ieee80211_hw *hw, bool led)
 {
         struct ath9k_htc_priv *priv = hw->priv;
         struct ath_hw *ah = priv->ah;
@@ -1177,6 +1184,12 @@ static void ath9k_htc_radio_disable(struct ieee80211_hw *hw)
                 return;
         }
 
+        if (led) {
+                /* Disable LED */
+                ath9k_hw_set_gpio(ah, ah->led_pin, 1);
+                ath9k_hw_cfg_gpio_input(ah, ah->led_pin);
+        }
+
         /* Cancel all the running timers/work .. */
         cancel_work_sync(&priv->ps_work);
         cancel_delayed_work_sync(&priv->ath9k_ani_work);
@@ -1217,7 +1230,7 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
         struct ath9k_htc_priv *priv = hw->priv;
 
         mutex_lock(&priv->mutex);
-        ath9k_htc_radio_disable(hw);
+        ath9k_htc_radio_disable(hw, false);
         mutex_unlock(&priv->mutex);
 }
 
@@ -1313,15 +1326,6 @@ static void ath9k_htc_remove_interface(struct ieee80211_hw *hw,
         priv->nvifs--;
 
         ath9k_htc_remove_station(priv, vif, NULL);
-
-        if (vif->type == NL80211_IFTYPE_ADHOC) {
-                spin_lock_bh(&priv->beacon_lock);
-                if (priv->beacon)
-                        dev_kfree_skb_any(priv->beacon);
-                priv->beacon = NULL;
-                spin_unlock_bh(&priv->beacon_lock);
-        }
-
         priv->vif = NULL;
 
         mutex_unlock(&priv->mutex);
@@ -1346,7 +1350,7 @@ static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
 
                 if (enable_radio) {
                         ath9k_htc_setpower(priv, ATH9K_PM_AWAKE);
-                        ath9k_htc_radio_enable(hw);
+                        ath9k_htc_radio_enable(hw, true);
                         ath_print(common, ATH_DBG_CONFIG,
                                   "not-idle: enabling radio\n");
                 }
@@ -1398,10 +1402,9 @@ static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
         if (priv->ps_idle) {
                 ath_print(common, ATH_DBG_CONFIG,
                           "idle: disabling radio\n");
-                ath9k_htc_radio_disable(hw);
+                ath9k_htc_radio_disable(hw, true);
         }
 
-
         mutex_unlock(&priv->mutex);
 
         return 0;
@@ -1590,9 +1593,6 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
                 ath9k_htc_beacon_config(priv, vif);
         }
 
-        if (changed & BSS_CHANGED_BEACON)
-                ath9k_htc_beacon_update(priv, vif);
-
         if ((changed & BSS_CHANGED_BEACON_ENABLED) &&
             !bss_conf->enable_beacon) {
                 priv->op_flags &= ~OP_ENABLE_BEACON;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 28abc7d5e909..2571b443ac82 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -663,7 +663,6 @@ void ath9k_htc_rxep(void *drv_priv, struct sk_buff *skb,
         return;
 err:
         dev_kfree_skb_any(skb);
-        return;
 }
 
 /* FIXME: Locking for cleanup/init */
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 559019262d30..c33f17dbe6f1 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -574,6 +574,26 @@ static int __ath9k_hw_init(struct ath_hw *ah)
 
         ath9k_hw_init_mode_regs(ah);
 
+        /*
+         * Configire PCIE after Ini init. SERDES values now come from ini file
+         * This enables PCIe low power mode.
+         */
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                u32 regval;
+                unsigned int i;
+
+                /* Set Bits 16 and 17 in the AR_WA register. */
+                regval = REG_READ(ah, AR_WA);
+                regval |= 0x00030000;
+                REG_WRITE(ah, AR_WA, regval);
+
+                for (i = 0; i < ah->iniPcieSerdesLowPower.ia_rows; i++) {
+                        REG_WRITE(ah,
+                                  INI_RA(&ah->iniPcieSerdesLowPower, i, 0),
+                                  INI_RA(&ah->iniPcieSerdesLowPower, i, 1));
+                }
+        }
+
         if (ah->is_pciexpress)
                 ath9k_hw_configpcipowersave(ah, 0, 0);
         else
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index 24d59883d944..3f4244f56ce5 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -333,7 +333,6 @@ static void ath_reg_apply_world_flags(struct wiphy *wiphy,
                 ath_reg_apply_active_scan_flags(wiphy, initiator);
                 break;
         }
-        return;
 }
 
 int ath_reg_notifier_apply(struct wiphy *wiphy,
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 3edbbcf0f548..c8f7090b27d3 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -865,7 +865,6 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
 
         /* low bit of first byte of destination tells us if broadcast */
         tx_update_descriptor(priv, *(skb->data) & 0x01, len + 18, buff, TX_PACKET_TYPE_DATA);
-        dev->trans_start = jiffies;
         dev->stats.tx_bytes += len;
 
         spin_unlock_irqrestore(&priv->irqlock, flags);
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 2088ac029b35..a59ceb26cd83 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -3239,7 +3239,6 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv)
                                IPW_MEM_HOST_SHARED_TX_QUEUE_WRITE_INDEX,
                                txq->next);
         }
-        return;
 }
 
 static void ipw2100_irq_tasklet(struct ipw2100_priv *priv)
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 82de71a3aea7..3aa3bb18f615 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -2607,8 +2607,6 @@ static inline void eeprom_write_reg(struct ipw_priv *p, u32 data)
 
         /* the eeprom requires some time to complete the operation */
         udelay(p->eeprom_delay);
-
-        return;
 }
 
 /* perform a chip select operation */
diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
index 39a34da52d52..0de1b1893220 100644
--- a/drivers/net/wireless/ipw2x00/libipw_rx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
@@ -918,7 +918,6 @@ void libipw_rx_any(struct libipw_device *ieee,
 drop_free:
         dev_kfree_skb_irq(skb);
         ieee->dev->stats.rx_dropped++;
-        return;
 }
 
 #define MGMT_FRAME_FIXED_PART_LENGTH            0x24
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index 32eb4709acac..8e84a08ff951 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -545,8 +545,6 @@ static void rs_tx_status(void *priv_rate, struct ieee80211_supported_band *sband
         spin_unlock_irqrestore(&rs_sta->lock, flags);
 
         IWL_DEBUG_RATE(priv, "leave\n");
-
-        return;
 }
 
 static u16 iwl3945_get_adjacent_rate(struct iwl3945_rs_sta *rs_sta,
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 17197a78d894..99b876a2feb9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -2483,7 +2483,6 @@ int iwl3945_hw_set_hw_params(struct iwl_priv *priv)
                                    &priv->_3945.shared_phys, GFP_KERNEL);
         if (!priv->_3945.shared_virt) {
                 IWL_ERR(priv, "failed to allocate pci memory\n");
-                mutex_unlock(&priv->mutex);
                 return -ENOMEM;
         }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index bfcac5608d87..cf4a95bae4ff 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -2337,8 +2337,6 @@ out:
         tbl->current_rate = rate_n_flags_from_tbl(priv, tbl, index, is_green);
         i = index;
         lq_sta->last_txrate_idx = i;
-
-        return;
 }
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index a672d3379cfd..cc15e929a987 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2494,7 +2494,6 @@ static void iwl_bg_run_time_calib_work(struct work_struct *work)
         }
 
         mutex_unlock(&priv->mutex);
-        return;
 }
 
 static void iwl_bg_restart(struct work_struct *data)
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index f1fd00b1a65d..7e8227773213 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -638,8 +638,6 @@ void iwl_sensitivity_calibration(struct iwl_priv *priv,
         iwl_sens_auto_corr_ofdm(priv, norm_fa_ofdm, rx_enable_time);
         iwl_sens_energy_cck(priv, norm_fa_cck, rx_enable_time, &statis);
         iwl_sensitivity_write(priv);
-
-        return;
 }
 EXPORT_SYMBOL(iwl_sensitivity_calibration);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 4cdf4d3a9ddb..87eb89f000f5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -769,7 +769,6 @@ void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf)
                         "extension channel offset 0x%x\n",
                         le32_to_cpu(rxon->flags), ht_conf->ht_protection,
                         ht_conf->extension_chan_offset);
-        return;
 }
 EXPORT_SYMBOL(iwl_set_rxon_ht);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index c7e1d7d09e02..1beb81c0be68 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -848,7 +848,6 @@ static void iwl3945_rx_reply_add_sta(struct iwl_priv *priv,
 #endif
 
         IWL_DEBUG_RX(priv, "Received REPLY_ADD_STA: 0x%02X\n", pkt->u.status);
-        return;
 }
 
 static void iwl3945_bg_beacon_update(struct work_struct *work)
diff --git a/drivers/net/wireless/iwmc3200wifi/sdio.c b/drivers/net/wireless/iwmc3200wifi/sdio.c
index 1acea37f39f8..edcb52330cf5 100644
--- a/drivers/net/wireless/iwmc3200wifi/sdio.c
+++ b/drivers/net/wireless/iwmc3200wifi/sdio.c
@@ -479,8 +479,6 @@ static void iwm_sdio_remove(struct sdio_func *func)
         sdio_set_drvdata(func, NULL);
 
         dev_info(dev, "IWM SDIO remove\n");
-
-        return;
 }
 
 static const struct sdio_device_id iwm_sdio_ids[] = {
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index ce7bec402a33..9d5d3ccf08c8 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -79,6 +79,7 @@ static const u32 cipher_suites[] = {
 
 
 static int lbs_cfg_set_channel(struct wiphy *wiphy,
+        struct net_device *netdev,
         struct ieee80211_channel *chan,
         enum nl80211_channel_type channel_type)
 {
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index 6f5b843c1f44..de2caac11dd6 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -757,15 +757,12 @@ void lbs_debugfs_init(void)
 {
         if (!lbs_dir)
                 lbs_dir = debugfs_create_dir("lbs_wireless", NULL);
-
-        return;
 }
 
 void lbs_debugfs_remove(void)
 {
         if (lbs_dir)
                  debugfs_remove(lbs_dir);
-        return;
 }
 
 void lbs_debugfs_init_one(struct lbs_private *priv, struct net_device *dev)
diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
index fcea5741ba62..f41594c7ac16 100644
--- a/drivers/net/wireless/libertas/if_usb.c
+++ b/drivers/net/wireless/libertas/if_usb.c
@@ -133,8 +133,6 @@ static void if_usb_write_bulk_callback(struct urb *urb)
                 /* print the failure status number for debug */
                 lbs_pr_info("URB in failure status: %d\n", urb->status);
         }
-
-        return;
 }
 
 /**
@@ -651,8 +649,6 @@ static void if_usb_receive_fwload(struct urb *urb)
         if_usb_submit_rx_urb_fwload(cardp);
 
         kfree(syncfwheader);
-
-        return;
 }
 
 #define MRVDRV_MIN_PKT_LEN      30
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 38edad6f24b8..d9b8ee130c45 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -229,7 +229,7 @@ static void lbs_tx_timeout(struct net_device *dev)
 
         lbs_pr_err("tx watch dog timeout\n");
 
-        dev->trans_start = jiffies;
+        dev->trans_start = jiffies; /* prevent tx timeout */
 
         if (priv->currenttxskb)
                 lbs_send_tx_feedback(priv, 0);
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index e2b8d886b091..a115bfa9513a 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -90,7 +90,6 @@ static void lbs_save_rawSNRNF(struct lbs_private *priv, struct rxpd *p_rx_pd)
         priv->nextSNRNF++;
         if (priv->nextSNRNF >= DEFAULT_DATA_AVG_FACTOR)
                 priv->nextSNRNF = 0;
-        return;
 }
 
 /**
diff --git a/drivers/net/wireless/libertas/tx.c b/drivers/net/wireless/libertas/tx.c
index 52d244ea3d97..a9bf658659eb 100644
--- a/drivers/net/wireless/libertas/tx.c
+++ b/drivers/net/wireless/libertas/tx.c
@@ -147,8 +147,6 @@ netdev_tx_t lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         dev->stats.tx_packets++;
         dev->stats.tx_bytes += skb->len;
 
-        dev->trans_start = jiffies;
-
         if (priv->monitormode) {
                 /* Keep the skb to echo it back once Tx feedback is
                    received from FW */
diff --git a/drivers/net/wireless/libertas_tf/if_usb.c b/drivers/net/wireless/libertas_tf/if_usb.c
index 4412c279ca94..c445500ffc61 100644
--- a/drivers/net/wireless/libertas_tf/if_usb.c
+++ b/drivers/net/wireless/libertas_tf/if_usb.c
@@ -576,7 +576,6 @@ static void if_usb_receive_fwload(struct urb *urb)
         kfree(syncfwheader);
 
         lbtf_deb_leave(LBTF_DEB_USB);
-        return;
 }
 
 #define MRVDRV_MIN_PKT_LEN      30
diff --git a/drivers/net/wireless/libertas_tf/main.c b/drivers/net/wireless/libertas_tf/main.c
index 60787de56f3a..6a04c2157f73 100644
--- a/drivers/net/wireless/libertas_tf/main.c
+++ b/drivers/net/wireless/libertas_tf/main.c
@@ -360,7 +360,6 @@ static void lbtf_op_stop(struct ieee80211_hw *hw)
         lbtf_set_radio_control(priv);
 
         lbtf_deb_leave(LBTF_DEB_MACOPS);
-        return;
 }
 
 static int lbtf_op_add_interface(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 9fd2beadb6f5..6f8cb3ee6fed 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -652,17 +652,17 @@ static void mac80211_hwsim_beacon(unsigned long arg)
         add_timer(&data->beacon_timer);
 }
 
+static const char *hwsim_chantypes[] = {
+        [NL80211_CHAN_NO_HT] = "noht",
+        [NL80211_CHAN_HT20] = "ht20",
+        [NL80211_CHAN_HT40MINUS] = "ht40-",
+        [NL80211_CHAN_HT40PLUS] = "ht40+",
+};
 
 static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct mac80211_hwsim_data *data = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
-        static const char *chantypes[4] = {
-                [NL80211_CHAN_NO_HT] = "noht",
-                [NL80211_CHAN_HT20] = "ht20",
-                [NL80211_CHAN_HT40MINUS] = "ht40-",
-                [NL80211_CHAN_HT40PLUS] = "ht40+",
-        };
         static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
                 [IEEE80211_SMPS_AUTOMATIC] = "auto",
                 [IEEE80211_SMPS_OFF] = "off",
@@ -673,7 +673,7 @@ static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
         printk(KERN_DEBUG "%s:%s (freq=%d/%s idle=%d ps=%d smps=%s)\n",
                wiphy_name(hw->wiphy), __func__,
                conf->channel->center_freq,
-               chantypes[conf->channel_type],
+               hwsim_chantypes[conf->channel_type],
                !!(conf->flags & IEEE80211_CONF_IDLE),
                !!(conf->flags & IEEE80211_CONF_PS),
                smps_modes[conf->smps_mode]);
@@ -761,9 +761,10 @@ static void mac80211_hwsim_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (changed & BSS_CHANGED_HT) {
-                printk(KERN_DEBUG "  %s: HT: op_mode=0x%x\n",
+                printk(KERN_DEBUG "  %s: HT: op_mode=0x%x, chantype=%s\n",
                        wiphy_name(hw->wiphy),
-                       info->ht_operation_mode);
+                       info->ht_operation_mode,
+                       hwsim_chantypes[info->channel_type]);
         }
 
         if (changed & BSS_CHANGED_BASIC_RATES) {
diff --git a/drivers/net/wireless/orinoco/cfg.c b/drivers/net/wireless/orinoco/cfg.c
index 81d228de9e5d..8c4169c227ae 100644
--- a/drivers/net/wireless/orinoco/cfg.c
+++ b/drivers/net/wireless/orinoco/cfg.c
@@ -159,6 +159,7 @@ static int orinoco_scan(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int orinoco_set_channel(struct wiphy *wiphy,
+                        struct net_device *netdev,
                         struct ieee80211_channel *chan,
                         enum nl80211_channel_type channel_type)
 {
diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c
index 1d60c7e4392a..ca71f08709bc 100644
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -340,18 +340,109 @@ EXPORT_SYMBOL(orinoco_change_mtu);
 /* Tx path                                                          */
 /********************************************************************/
 
+/* Add encapsulation and MIC to the existing SKB.
+ * The main xmit routine will then send the whole lot to the card.
+ * Need 8 bytes headroom
+ * Need 8 bytes tailroom
+ *
+ *                          With encapsulated ethernet II frame
+ *                          --------
+ *                          803.3 header (14 bytes)
+ *                           dst[6]
+ * --------                  src[6]
+ * 803.3 header (14 bytes)   len[2]
+ *  dst[6]                  803.2 header (8 bytes)
+ *  src[6]                   encaps[6]
+ *  len[2] <- leave alone -> len[2]
+ * --------                 -------- <-- 0
+ * Payload                  Payload
+ * ...                      ...
+ *
+ * --------                 --------
+ *                          MIC (8 bytes)
+ *                          --------
+ *
+ * returns 0 on success, -ENOMEM on error.
+ */
+int orinoco_process_xmit_skb(struct sk_buff *skb,
+                             struct net_device *dev,
+                             struct orinoco_private *priv,
+                             int *tx_control,
+                             u8 *mic_buf)
+{
+        struct orinoco_tkip_key *key;
+        struct ethhdr *eh;
+        int do_mic;
+
+        key = (struct orinoco_tkip_key *) priv->keys[priv->tx_key].key;
+
+        do_mic = ((priv->encode_alg == ORINOCO_ALG_TKIP) &&
+                  (key != NULL));
+
+        if (do_mic)
+                *tx_control |= (priv->tx_key << HERMES_MIC_KEY_ID_SHIFT) |
+                        HERMES_TXCTRL_MIC;
+
+        eh = (struct ethhdr *)skb->data;
+
+        /* Encapsulate Ethernet-II frames */
+        if (ntohs(eh->h_proto) > ETH_DATA_LEN) { /* Ethernet-II frame */
+                struct header_struct {
+                        struct ethhdr eth;      /* 802.3 header */
+                        u8 encap[6];            /* 802.2 header */
+                } __attribute__ ((packed)) hdr;
+                int len = skb->len + sizeof(encaps_hdr) - (2 * ETH_ALEN);
+
+                if (skb_headroom(skb) < ENCAPS_OVERHEAD) {
+                        if (net_ratelimit())
+                                printk(KERN_ERR
+                                       "%s: Not enough headroom for 802.2 headers %d\n",
+                                       dev->name, skb_headroom(skb));
+                        return -ENOMEM;
+                }
+
+                /* Fill in new header */
+                memcpy(&hdr.eth, eh, 2 * ETH_ALEN);
+                hdr.eth.h_proto = htons(len);
+                memcpy(hdr.encap, encaps_hdr, sizeof(encaps_hdr));
+
+                /* Make room for the new header, and copy it in */
+                eh = (struct ethhdr *) skb_push(skb, ENCAPS_OVERHEAD);
+                memcpy(eh, &hdr, sizeof(hdr));
+        }
+
+        /* Calculate Michael MIC */
+        if (do_mic) {
+                size_t len = skb->len - ETH_HLEN;
+                u8 *mic = &mic_buf[0];
+
+                /* Have to write to an even address, so copy the spare
+                 * byte across */
+                if (skb->len % 2) {
+                        *mic = skb->data[skb->len - 1];
+                        mic++;
+                }
+
+                orinoco_mic(priv->tx_tfm_mic, key->tx_mic,
+                            eh->h_dest, eh->h_source, 0 /* priority */,
+                            skb->data + ETH_HLEN,
+                            len, mic);
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(orinoco_process_xmit_skb);
+
 static netdev_tx_t orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct orinoco_private *priv = ndev_priv(dev);
         struct net_device_stats *stats = &priv->stats;
-        struct orinoco_tkip_key *key;
         hermes_t *hw = &priv->hw;
         int err = 0;
         u16 txfid = priv->txfid;
-        struct ethhdr *eh;
         int tx_control;
         unsigned long flags;
-        int do_mic;
+        u8 mic_buf[MICHAEL_MIC_LEN+1];
 
         if (!netif_running(dev)) {
                 printk(KERN_ERR "%s: Tx on stopped device!\n",
@@ -383,16 +474,12 @@ static netdev_tx_t orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
         if (skb->len < ETH_HLEN)
                 goto drop;
 
-        key = (struct orinoco_tkip_key *) priv->keys[priv->tx_key].key;
-
-        do_mic = ((priv->encode_alg == ORINOCO_ALG_TKIP) &&
-                  (key != NULL));
-
         tx_control = HERMES_TXCTRL_TX_OK | HERMES_TXCTRL_TX_EX;
 
-        if (do_mic)
-                tx_control |= (priv->tx_key << HERMES_MIC_KEY_ID_SHIFT) |
-                        HERMES_TXCTRL_MIC;
+        err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
+                                       &mic_buf[0]);
+        if (err)
+                goto drop;
 
         if (priv->has_alt_txcntl) {
                 /* WPA enabled firmwares have tx_cntl at the end of
@@ -435,34 +522,6 @@ static netdev_tx_t orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
                                    HERMES_802_3_OFFSET - HERMES_802_11_OFFSET);
         }
 
-        eh = (struct ethhdr *)skb->data;
-
-        /* Encapsulate Ethernet-II frames */
-        if (ntohs(eh->h_proto) > ETH_DATA_LEN) { /* Ethernet-II frame */
-                struct header_struct {
-                        struct ethhdr eth;      /* 802.3 header */
-                        u8 encap[6];            /* 802.2 header */
-                } __attribute__ ((packed)) hdr;
-
-                /* Strip destination and source from the data */
-                skb_pull(skb, 2 * ETH_ALEN);
-
-                /* And move them to a separate header */
-                memcpy(&hdr.eth, eh, 2 * ETH_ALEN);
-                hdr.eth.h_proto = htons(sizeof(encaps_hdr) + skb->len);
-                memcpy(hdr.encap, encaps_hdr, sizeof(encaps_hdr));
-
-                /* Insert the SNAP header */
-                if (skb_headroom(skb) < sizeof(hdr)) {
-                        printk(KERN_ERR
-                               "%s: Not enough headroom for 802.2 headers %d\n",
-                               dev->name, skb_headroom(skb));
-                        goto drop;
-                }
-                eh = (struct ethhdr *) skb_push(skb, sizeof(hdr));
-                memcpy(eh, &hdr, sizeof(hdr));
-        }
-
         err = hw->ops->bap_pwrite(hw, USER_BAP, skb->data, skb->len,
                                   txfid, HERMES_802_3_OFFSET);
         if (err) {
@@ -471,32 +530,16 @@ static netdev_tx_t orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto busy;
         }
 
-        /* Calculate Michael MIC */
-        if (do_mic) {
-                u8 mic_buf[MICHAEL_MIC_LEN + 1];
-                u8 *mic;
-                size_t offset;
-                size_t len;
+        if (tx_control & HERMES_TXCTRL_MIC) {
+                size_t offset = HERMES_802_3_OFFSET + skb->len;
+                size_t len = MICHAEL_MIC_LEN;
 
-                if (skb->len % 2) {
-                        /* MIC start is on an odd boundary */
-                        mic_buf[0] = skb->data[skb->len - 1];
-                        mic = &mic_buf[1];
-                        offset = skb->len - 1;
-                        len = MICHAEL_MIC_LEN + 1;
-                } else {
-                        mic = &mic_buf[0];
-                        offset = skb->len;
-                        len = MICHAEL_MIC_LEN;
+                if (offset % 2) {
+                        offset--;
+                        len++;
                 }
-
-                orinoco_mic(priv->tx_tfm_mic, key->tx_mic,
-                            eh->h_dest, eh->h_source, 0 /* priority */,
-                            skb->data + ETH_HLEN, skb->len - ETH_HLEN, mic);
-
-                /* Write the MIC */
                 err = hw->ops->bap_pwrite(hw, USER_BAP, &mic_buf[0], len,
-                                          txfid, HERMES_802_3_OFFSET + offset);
+                                          txfid, offset);
                 if (err) {
                         printk(KERN_ERR "%s: Error %d writing MIC to BAP\n",
                                dev->name, err);
@@ -517,7 +560,6 @@ static netdev_tx_t orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto busy;
         }
 
-        dev->trans_start = jiffies;
         stats->tx_bytes += HERMES_802_3_OFFSET + skb->len;
         goto ok;
 
@@ -1576,8 +1618,6 @@ void __orinoco_ev_info(struct net_device *dev, hermes_t *hw)
                 /* We don't actually do anything about it */
                 break;
         }
-
-        return;
 }
 EXPORT_SYMBOL(__orinoco_ev_info);
 
@@ -2235,7 +2275,7 @@ int orinoco_if_add(struct orinoco_private *priv,
         /* we use the default eth_mac_addr for setting the MAC addr */
 
         /* Reserve space in skb for the SNAP header */
-        dev->hard_header_len += ENCAPS_OVERHEAD;
+        dev->needed_headroom = ENCAPS_OVERHEAD;
 
         netif_carrier_off(dev);
 
diff --git a/drivers/net/wireless/orinoco/orinoco.h b/drivers/net/wireless/orinoco/orinoco.h
index e9f415a56d4d..a6da86e0a70f 100644
--- a/drivers/net/wireless/orinoco/orinoco.h
+++ b/drivers/net/wireless/orinoco/orinoco.h
@@ -200,6 +200,12 @@ extern irqreturn_t orinoco_interrupt(int irq, void *dev_id);
 extern void __orinoco_ev_info(struct net_device *dev, hermes_t *hw);
 extern void __orinoco_ev_rx(struct net_device *dev, hermes_t *hw);
 
+int orinoco_process_xmit_skb(struct sk_buff *skb,
+                             struct net_device *dev,
+                             struct orinoco_private *priv,
+                             int *tx_control,
+                             u8 *mic);
+
 /* Common ndo functions exported for reuse by orinoco_usb */
 int orinoco_open(struct net_device *dev);
 int orinoco_stop(struct net_device *dev);
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index e22093359f3e..78f089baa8c9 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -67,6 +67,7 @@
 #include <linux/wireless.h>
 #include <linux/firmware.h>
 
+#include "mic.h"
 #include "orinoco.h"
 
 #ifndef URB_ASYNC_UNLINK
@@ -1198,11 +1199,9 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
         struct orinoco_private *priv = ndev_priv(dev);
         struct net_device_stats *stats = &priv->stats;
         struct ezusb_priv *upriv = priv->card;
+        u8 mic[MICHAEL_MIC_LEN+1];
         int err = 0;
-        char *p;
-        struct ethhdr *eh;
-        int len, data_len, data_off;
-        __le16 tx_control;
+        int tx_control;
         unsigned long flags;
         struct request_context *ctx;
         u8 *buf;
@@ -1222,7 +1221,7 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (orinoco_lock(priv, &flags) != 0) {
                 printk(KERN_ERR
-                       "%s: orinoco_xmit() called while hw_unavailable\n",
+                       "%s: ezusb_xmit() called while hw_unavailable\n",
                        dev->name);
                 return NETDEV_TX_BUSY;
         }
@@ -1232,53 +1231,46 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
                 /* Oops, the firmware hasn't established a connection,
                    silently drop the packet (this seems to be the
                    safest approach). */
-                stats->tx_errors++;
-                orinoco_unlock(priv, &flags);
-                dev_kfree_skb(skb);
-                return NETDEV_TX_OK;
+                goto drop;
         }
 
+        /* Check packet length */
+        if (skb->len < ETH_HLEN)
+                goto drop;
+
         ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
         if (!ctx)
-                goto fail;
+                goto busy;
 
         memset(ctx->buf, 0, BULK_BUF_SIZE);
         buf = ctx->buf->data;
 
-        /* Length of the packet body */
-        /* FIXME: what if the skb is smaller than this? */
-        len = max_t(int, skb->len - ETH_HLEN, ETH_ZLEN - ETH_HLEN);
-
-        eh = (struct ethhdr *) skb->data;
-
-        tx_control = cpu_to_le16(0);
-        memcpy(buf, &tx_control, sizeof(tx_control));
-        buf += sizeof(tx_control);
-        /* Encapsulate Ethernet-II frames */
-        if (ntohs(eh->h_proto) > ETH_DATA_LEN) {        /* Ethernet-II frame */
-                struct header_struct *hdr = (void *) buf;
-                buf += sizeof(*hdr);
-                data_len = len;
-                data_off = sizeof(tx_control) + sizeof(*hdr);
-                p = skb->data + ETH_HLEN;
-
-                /* 802.3 header */
-                memcpy(hdr->dest, eh->h_dest, ETH_ALEN);
-                memcpy(hdr->src, eh->h_source, ETH_ALEN);
-                hdr->len = htons(data_len + ENCAPS_OVERHEAD);
-
-                /* 802.2 header */
-                memcpy(&hdr->dsap, &encaps_hdr, sizeof(encaps_hdr));
-
-                hdr->ethertype = eh->h_proto;
-        } else {                /* IEEE 802.3 frame */
-                data_len = len + ETH_HLEN;
-                data_off = sizeof(tx_control);
-                p = skb->data;
+        tx_control = 0;
+
+        err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
+                                       &mic[0]);
+        if (err)
+                goto drop;
+
+        {
+                __le16 *tx_cntl = (__le16 *)buf;
+                *tx_cntl = cpu_to_le16(tx_control);
+                buf += sizeof(*tx_cntl);
         }
 
-        memcpy(buf, p, data_len);
-        buf += data_len;
+        memcpy(buf, skb->data, skb->len);
+        buf += skb->len;
+
+        if (tx_control & HERMES_TXCTRL_MIC) {
+                u8 *m = mic;
+                /* Mic has been offset so it can be copied to an even
+                 * address. We're copying eveything anyway, so we
+                 * don't need to copy that first byte. */
+                if (skb->len % 2)
+                        m++;
+                memcpy(buf, m, MICHAEL_MIC_LEN);
+                buf += MICHAEL_MIC_LEN;
+        }
 
         /* Finally, we actually initiate the send */
         netif_stop_queue(dev);
@@ -1294,20 +1286,23 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
                 if (net_ratelimit())
                         printk(KERN_ERR "%s: Error %d transmitting packet\n",
                                 dev->name, err);
-                stats->tx_errors++;
-                goto fail;
+                goto busy;
         }
 
         dev->trans_start = jiffies;
-        stats->tx_bytes += data_off + data_len;
+        stats->tx_bytes += skb->len;
+        goto ok;
 
-        orinoco_unlock(priv, &flags);
+ drop:
+        stats->tx_errors++;
+        stats->tx_dropped++;
 
+ ok:
+        orinoco_unlock(priv, &flags);
         dev_kfree_skb(skb);
-
         return NETDEV_TX_OK;
 
- fail:
+ busy:
         orinoco_unlock(priv, &flags);
         return NETDEV_TX_BUSY;
 }
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 743a6c68b29d..d5b197b4d5bb 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -875,7 +875,6 @@ static void p54u_stop(struct ieee80211_hw *dev)
            the hardware is still usable next time we want to start it.
            until then, we just stop listening to the hardware.. */
         p54u_free_urbs(dev);
-        return;
 }
 
 static int __devinit p54u_probe(struct usb_interface *intf,
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index a45818ebfdfb..8d1190c0f062 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -210,8 +210,6 @@ prism54_update_stats(struct work_struct *work)
         priv->local_iwstatistics.discard.retries = r.u;
 
         mutex_unlock(&priv->stats_lock);
-
-        return;
 }
 
 struct iw_statistics *
diff --git a/drivers/net/wireless/prism54/islpci_eth.c b/drivers/net/wireless/prism54/islpci_eth.c
index 64585da8a96c..2fc52bc2d7dd 100644
--- a/drivers/net/wireless/prism54/islpci_eth.c
+++ b/drivers/net/wireless/prism54/islpci_eth.c
@@ -224,8 +224,6 @@ islpci_eth_transmit(struct sk_buff *skb, struct net_device *ndev)
                 priv->data_low_tx_full = 1;
         }
 
-        /* set the transmission time */
-        ndev->trans_start = jiffies;
         ndev->stats.tx_packets++;
         ndev->stats.tx_bytes += skb->len;
 
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index d9c45bfcee61..3886b21becd9 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -735,8 +735,6 @@ static void verify_dl_startup(u_long data)
                 start_net((u_long) local);
         else
                 join_net((u_long) local);
-
-        return;
 } /* end verify_dl_startup */
 
 /*===========================================================================*/
@@ -764,7 +762,6 @@ static void start_net(u_long data)
                 return;
         }
         local->card_status = CARD_DOING_ACQ;
-        return;
 } /* end start_net */
 
 /*===========================================================================*/
@@ -795,7 +792,6 @@ static void join_net(u_long data)
                 return;
         }
         local->card_status = CARD_DOING_ACQ;
-        return;
 }
 
 /*============================================================================
@@ -941,7 +937,6 @@ static netdev_tx_t ray_dev_start_xmit(struct sk_buff *skb,
         case XMIT_MSG_BAD:
         case XMIT_OK:
         default:
-                dev->trans_start = jiffies;
                 dev_kfree_skb(skb);
         }
 
@@ -1627,7 +1622,6 @@ static int ray_dev_close(struct net_device *dev)
 static void ray_reset(struct net_device *dev)
 {
         pr_debug("ray_reset entered\n");
-        return;
 }
 
 /*===========================================================================*/
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index babdcdf6d71d..2d2890878dea 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -535,7 +535,7 @@ static int rndis_join_ibss(struct wiphy *wiphy, struct net_device *dev,
 
 static int rndis_leave_ibss(struct wiphy *wiphy, struct net_device *dev);
 
-static int rndis_set_channel(struct wiphy *wiphy,
+static int rndis_set_channel(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_channel *chan, enum nl80211_channel_type channel_type);
 
 static int rndis_add_key(struct wiphy *wiphy, struct net_device *netdev,
@@ -2291,7 +2291,7 @@ static int rndis_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
         return deauthenticate(usbdev);
 }
 
-static int rndis_set_channel(struct wiphy *wiphy,
+static int rndis_set_channel(struct wiphy *wiphy, struct net_device *netdev,
         struct ieee80211_channel *chan, enum nl80211_channel_type channel_type)
 {
         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 06b92f8b7a55..6126c0ab5880 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1060,7 +1060,8 @@ static void rt2400pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 /*
  * TX data initialization
  */
-static void rt2400pci_write_beacon(struct queue_entry *entry)
+static void rt2400pci_write_beacon(struct queue_entry *entry,
+                                   struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct queue_entry_priv_pci *entry_priv = entry->priv_data;
@@ -1090,6 +1091,14 @@ static void rt2400pci_write_beacon(struct queue_entry *entry)
         rt2x00_desc_read(entry_priv->desc, 1, &word);
         rt2x00_set_field32(&word, TXD_W1_BUFFER_ADDRESS, skbdesc->skb_dma);
         rt2x00_desc_write(entry_priv->desc, 1, word);
+
+        /*
+         * Enable beaconing again.
+         */
+        rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 1);
+        rt2x00_set_field32(&reg, CSR14_TBCN, 1);
+        rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 1);
+        rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 }
 
 static void rt2400pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
@@ -1097,17 +1106,6 @@ static void rt2400pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        if (queue == QID_BEACON) {
-                rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
-                if (!rt2x00_get_field32(reg, CSR14_BEACON_GEN)) {
-                        rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 1);
-                        rt2x00_set_field32(&reg, CSR14_TBCN, 1);
-                        rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 1);
-                        rt2x00pci_register_write(rt2x00dev, CSR14, reg);
-                }
-                return;
-        }
-
         rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
         rt2x00_set_field32(&reg, TXCSR0_KICK_PRIO, (queue == QID_AC_BE));
         rt2x00_set_field32(&reg, TXCSR0_KICK_TX, (queue == QID_AC_BK));
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index ae8e205df269..2e4f461406ae 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1217,7 +1217,8 @@ static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 /*
  * TX data initialization
  */
-static void rt2500pci_write_beacon(struct queue_entry *entry)
+static void rt2500pci_write_beacon(struct queue_entry *entry,
+                                   struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct queue_entry_priv_pci *entry_priv = entry->priv_data;
@@ -1247,6 +1248,14 @@ static void rt2500pci_write_beacon(struct queue_entry *entry)
         rt2x00_desc_read(entry_priv->desc, 1, &word);
         rt2x00_set_field32(&word, TXD_W1_BUFFER_ADDRESS, skbdesc->skb_dma);
         rt2x00_desc_write(entry_priv->desc, 1, word);
+
+        /*
+         * Enable beaconing again.
+         */
+        rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 1);
+        rt2x00_set_field32(&reg, CSR14_TBCN, 1);
+        rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 1);
+        rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 }
 
 static void rt2500pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
@@ -1254,17 +1263,6 @@ static void rt2500pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        if (queue == QID_BEACON) {
-                rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
-                if (!rt2x00_get_field32(reg, CSR14_BEACON_GEN)) {
-                        rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 1);
-                        rt2x00_set_field32(&reg, CSR14_TBCN, 1);
-                        rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 1);
-                        rt2x00pci_register_write(rt2x00dev, CSR14, reg);
-                }
-                return;
-        }
-
         rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
         rt2x00_set_field32(&reg, TXCSR0_KICK_PRIO, (queue == QID_AC_BE));
         rt2x00_set_field32(&reg, TXCSR0_KICK_TX, (queue == QID_AC_BK));
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 41d9996c80e6..e88d7033fbc9 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1083,7 +1083,8 @@ static void rt2500usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
  */
 static void rt2500usb_beacondone(struct urb *urb);
 
-static void rt2500usb_write_beacon(struct queue_entry *entry)
+static void rt2500usb_write_beacon(struct queue_entry *entry,
+                                   struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
@@ -1091,7 +1092,7 @@ static void rt2500usb_write_beacon(struct queue_entry *entry)
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         int pipe = usb_sndbulkpipe(usb_dev, entry->queue->usb_endpoint);
         int length;
-        u16 reg;
+        u16 reg, reg0;
 
         /*
          * Add the descriptor in front of the skb.
@@ -1133,6 +1134,26 @@ static void rt2500usb_write_beacon(struct queue_entry *entry)
          * Send out the guardian byte.
          */
         usb_submit_urb(bcn_priv->guardian_urb, GFP_ATOMIC);
+
+        /*
+         * Enable beaconing again.
+         */
+        rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 1);
+        rt2x00_set_field16(&reg, TXRX_CSR19_TBCN, 1);
+        reg0 = reg;
+        rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 1);
+        /*
+         * Beacon generation will fail initially.
+         * To prevent this we need to change the TXRX_CSR19
+         * register several times (reg0 is the same as reg
+         * except for TXRX_CSR19_BEACON_GEN, which is 0 in reg0
+         * and 1 in reg).
+         */
+        rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
+        rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg0);
+        rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
+        rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg0);
+        rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
 }
 
 static int rt2500usb_get_tx_data_len(struct queue_entry *entry)
@@ -1149,37 +1170,6 @@ static int rt2500usb_get_tx_data_len(struct queue_entry *entry)
         return length;
 }
 
-static void rt2500usb_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                    const enum data_queue_qid queue)
-{
-        u16 reg, reg0;
-
-        if (queue != QID_BEACON) {
-                rt2x00usb_kick_tx_queue(rt2x00dev, queue);
-                return;
-        }
-
-        rt2500usb_register_read(rt2x00dev, TXRX_CSR19, &reg);
-        if (!rt2x00_get_field16(reg, TXRX_CSR19_BEACON_GEN)) {
-                rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 1);
-                rt2x00_set_field16(&reg, TXRX_CSR19_TBCN, 1);
-                reg0 = reg;
-                rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 1);
-                /*
-                 * Beacon generation will fail initially.
-                 * To prevent this we need to change the TXRX_CSR19
-                 * register several times (reg0 is the same as reg
-                 * except for TXRX_CSR19_BEACON_GEN, which is 0 in reg0
-                 * and 1 in reg).
-                 */
-                rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
-                rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg0);
-                rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
-                rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg0);
-                rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
-        }
-}
-
 /*
  * RX control handlers
  */
@@ -1214,11 +1204,9 @@ static void rt2500usb_fill_rxdone(struct queue_entry *entry,
         if (rt2x00_get_field32(word0, RXD_W0_PHYSICAL_ERROR))
                 rxdesc->flags |= RX_FLAG_FAILED_PLCP_CRC;
 
-        if (test_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags)) {
-                rxdesc->cipher = rt2x00_get_field32(word0, RXD_W0_CIPHER);
-                if (rt2x00_get_field32(word0, RXD_W0_CIPHER_ERROR))
-                        rxdesc->cipher_status = RX_CRYPTO_FAIL_KEY;
-        }
+        rxdesc->cipher = rt2x00_get_field32(word0, RXD_W0_CIPHER);
+        if (rt2x00_get_field32(word0, RXD_W0_CIPHER_ERROR))
+                rxdesc->cipher_status = RX_CRYPTO_FAIL_KEY;
 
         if (rxdesc->cipher != CIPHER_NONE) {
                 _rt2x00_desc_read(rxd, 2, &rxdesc->iv[0]);
@@ -1780,7 +1768,7 @@ static const struct rt2x00lib_ops rt2500usb_rt2x00_ops = {
         .write_tx_data          = rt2x00usb_write_tx_data,
         .write_beacon           = rt2500usb_write_beacon,
         .get_tx_data_len        = rt2500usb_get_tx_data_len,
-        .kick_tx_queue          = rt2500usb_kick_tx_queue,
+        .kick_tx_queue          = rt2x00usb_kick_tx_queue,
         .kill_tx_queue          = rt2x00usb_kill_tx_queue,
         .fill_rxdone            = rt2500usb_fill_rxdone,
         .config_shared_key      = rt2500usb_config_key,
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index e37bbeab9233..db4250d1c8b3 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -282,6 +282,104 @@ int rt2800_wait_wpdma_ready(struct rt2x00_dev *rt2x00dev)
 }
 EXPORT_SYMBOL_GPL(rt2800_wait_wpdma_ready);
 
+void rt2800_write_txwi(struct sk_buff *skb, struct txentry_desc *txdesc)
+{
+        __le32 *txwi = (__le32 *)(skb->data - TXWI_DESC_SIZE);
+        u32 word;
+
+        /*
+         * Initialize TX Info descriptor
+         */
+        rt2x00_desc_read(txwi, 0, &word);
+        rt2x00_set_field32(&word, TXWI_W0_FRAG,
+                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_MIMO_PS, 0);
+        rt2x00_set_field32(&word, TXWI_W0_CF_ACK, 0);
+        rt2x00_set_field32(&word, TXWI_W0_TS,
+                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_AMPDU,
+                           test_bit(ENTRY_TXD_HT_AMPDU, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_MPDU_DENSITY, txdesc->mpdu_density);
+        rt2x00_set_field32(&word, TXWI_W0_TX_OP, txdesc->txop);
+        rt2x00_set_field32(&word, TXWI_W0_MCS, txdesc->mcs);
+        rt2x00_set_field32(&word, TXWI_W0_BW,
+                           test_bit(ENTRY_TXD_HT_BW_40, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_SHORT_GI,
+                           test_bit(ENTRY_TXD_HT_SHORT_GI, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_STBC, txdesc->stbc);
+        rt2x00_set_field32(&word, TXWI_W0_PHYMODE, txdesc->rate_mode);
+        rt2x00_desc_write(txwi, 0, word);
+
+        rt2x00_desc_read(txwi, 1, &word);
+        rt2x00_set_field32(&word, TXWI_W1_ACK,
+                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W1_NSEQ,
+                           test_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W1_BW_WIN_SIZE, txdesc->ba_size);
+        rt2x00_set_field32(&word, TXWI_W1_WIRELESS_CLI_ID,
+                           test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags) ?
+                           txdesc->key_idx : 0xff);
+        rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
+                           txdesc->length);
+        rt2x00_set_field32(&word, TXWI_W1_PACKETID, txdesc->queue + 1);
+        rt2x00_desc_write(txwi, 1, word);
+
+        /*
+         * Always write 0 to IV/EIV fields, hardware will insert the IV
+         * from the IVEIV register when TXD_W3_WIV is set to 0.
+         * When TXD_W3_WIV is set to 1 it will use the IV data
+         * from the descriptor. The TXWI_W1_WIRELESS_CLI_ID indicates which
+         * crypto entry in the registers should be used to encrypt the frame.
+         */
+        _rt2x00_desc_write(txwi, 2, 0 /* skbdesc->iv[0] */);
+        _rt2x00_desc_write(txwi, 3, 0 /* skbdesc->iv[1] */);
+}
+EXPORT_SYMBOL_GPL(rt2800_write_txwi);
+
+void rt2800_process_rxwi(struct sk_buff *skb, struct rxdone_entry_desc *rxdesc)
+{
+        __le32 *rxwi = (__le32 *) skb->data;
+        u32 word;
+
+        rt2x00_desc_read(rxwi, 0, &word);
+
+        rxdesc->cipher = rt2x00_get_field32(word, RXWI_W0_UDF);
+        rxdesc->size = rt2x00_get_field32(word, RXWI_W0_MPDU_TOTAL_BYTE_COUNT);
+
+        rt2x00_desc_read(rxwi, 1, &word);
+
+        if (rt2x00_get_field32(word, RXWI_W1_SHORT_GI))
+                rxdesc->flags |= RX_FLAG_SHORT_GI;
+
+        if (rt2x00_get_field32(word, RXWI_W1_BW))
+                rxdesc->flags |= RX_FLAG_40MHZ;
+
+        /*
+         * Detect RX rate, always use MCS as signal type.
+         */
+        rxdesc->dev_flags |= RXDONE_SIGNAL_MCS;
+        rxdesc->signal = rt2x00_get_field32(word, RXWI_W1_MCS);
+        rxdesc->rate_mode = rt2x00_get_field32(word, RXWI_W1_PHYMODE);
+
+        /*
+         * Mask of 0x8 bit to remove the short preamble flag.
+         */
+        if (rxdesc->rate_mode == RATE_MODE_CCK)
+                rxdesc->signal &= ~0x8;
+
+        rt2x00_desc_read(rxwi, 2, &word);
+
+        rxdesc->rssi =
+            (rt2x00_get_field32(word, RXWI_W2_RSSI0) +
+             rt2x00_get_field32(word, RXWI_W2_RSSI1)) / 2;
+
+        /*
+         * Remove RXWI descriptor from start of buffer.
+         */
+        skb_pull(skb, RXWI_DESC_SIZE);
+}
+EXPORT_SYMBOL_GPL(rt2800_process_rxwi);
+
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
 const struct rt2x00debug rt2800_rt2x00debug = {
         .owner  = THIS_MODULE,
@@ -640,8 +738,6 @@ void rt2800_config_erp(struct rt2x00_dev *rt2x00dev, struct rt2x00lib_erp *erp)
         rt2800_register_write(rt2x00dev, BKOFF_SLOT_CFG, reg);
 
         rt2800_register_read(rt2x00dev, XIFS_TIME_CFG, &reg);
-        rt2x00_set_field32(&reg, XIFS_TIME_CFG_CCKM_SIFS_TIME, erp->sifs);
-        rt2x00_set_field32(&reg, XIFS_TIME_CFG_OFDM_SIFS_TIME, erp->sifs);
         rt2x00_set_field32(&reg, XIFS_TIME_CFG_EIFS, erp->eifs);
         rt2800_register_write(rt2x00dev, XIFS_TIME_CFG, reg);
 
@@ -1415,9 +1511,16 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
 
         rt2800_register_write(rt2x00dev, EXP_ACK_TIME, 0x002400ca);
 
+        /*
+         * Usually the CCK SIFS time should be set to 10 and the OFDM SIFS
+         * time should be set to 16. However, the original Ralink driver uses
+         * 16 for both and indeed using a value of 10 for CCK SIFS results in
+         * connection problems with 11g + CTS protection. Hence, use the same
+         * defaults as the Ralink driver: 16 for both, CCK and OFDM SIFS.
+         */
         rt2800_register_read(rt2x00dev, XIFS_TIME_CFG, &reg);
-        rt2x00_set_field32(&reg, XIFS_TIME_CFG_CCKM_SIFS_TIME, 32);
-        rt2x00_set_field32(&reg, XIFS_TIME_CFG_OFDM_SIFS_TIME, 32);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_CCKM_SIFS_TIME, 16);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_OFDM_SIFS_TIME, 16);
         rt2x00_set_field32(&reg, XIFS_TIME_CFG_OFDM_XIFS_TIME, 4);
         rt2x00_set_field32(&reg, XIFS_TIME_CFG_EIFS, 314);
         rt2x00_set_field32(&reg, XIFS_TIME_CFG_BB_RXEND_ENABLE, 1);
@@ -2219,7 +2322,7 @@ int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
 EXPORT_SYMBOL_GPL(rt2800_init_eeprom);
 
 /*
- * RF value list for rt28x0
+ * RF value list for rt28xx
  * Supports: 2.4 GHz (all) & 5.2 GHz (RF2850 & RF2750)
  */
 static const struct rf_channel rf_vals[] = {
@@ -2294,10 +2397,10 @@ static const struct rf_channel rf_vals[] = {
 };
 
 /*
- * RF value list for rt3070
- * Supports: 2.4 GHz
+ * RF value list for rt3xxx
+ * Supports: 2.4 GHz (all) & 5.2 GHz (RF3052)
  */
-static const struct rf_channel rf_vals_302x[] = {
+static const struct rf_channel rf_vals_3x[] = {
         {1,  241, 2, 2 },
         {2,  241, 2, 7 },
         {3,  242, 2, 2 },
@@ -2312,6 +2415,51 @@ static const struct rf_channel rf_vals_302x[] = {
         {12, 246, 2, 7 },
         {13, 247, 2, 2 },
         {14, 248, 2, 4 },
+
+        /* 802.11 UNI / HyperLan 2 */
+        {36, 0x56, 0, 4},
+        {38, 0x56, 0, 6},
+        {40, 0x56, 0, 8},
+        {44, 0x57, 0, 0},
+        {46, 0x57, 0, 2},
+        {48, 0x57, 0, 4},
+        {52, 0x57, 0, 8},
+        {54, 0x57, 0, 10},
+        {56, 0x58, 0, 0},
+        {60, 0x58, 0, 4},
+        {62, 0x58, 0, 6},
+        {64, 0x58, 0, 8},
+
+        /* 802.11 HyperLan 2 */
+        {100, 0x5b, 0, 8},
+        {102, 0x5b, 0, 10},
+        {104, 0x5c, 0, 0},
+        {108, 0x5c, 0, 4},
+        {110, 0x5c, 0, 6},
+        {112, 0x5c, 0, 8},
+        {116, 0x5d, 0, 0},
+        {118, 0x5d, 0, 2},
+        {120, 0x5d, 0, 4},
+        {124, 0x5d, 0, 8},
+        {126, 0x5d, 0, 10},
+        {128, 0x5e, 0, 0},
+        {132, 0x5e, 0, 4},
+        {134, 0x5e, 0, 6},
+        {136, 0x5e, 0, 8},
+        {140, 0x5f, 0, 0},
+
+        /* 802.11 UNII */
+        {149, 0x5f, 0, 9},
+        {151, 0x5f, 0, 11},
+        {153, 0x60, 0, 1},
+        {157, 0x60, 0, 5},
+        {159, 0x60, 0, 7},
+        {161, 0x60, 0, 9},
+        {165, 0x61, 0, 1},
+        {167, 0x61, 0, 3},
+        {169, 0x61, 0, 5},
+        {171, 0x61, 0, 7},
+        {173, 0x61, 0, 9},
 };
 
 int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
@@ -2352,11 +2500,11 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
 
         if (rt2x00_rf(rt2x00dev, RF2820) ||
-            rt2x00_rf(rt2x00dev, RF2720) ||
-            rt2x00_rf(rt2x00dev, RF3052)) {
+            rt2x00_rf(rt2x00dev, RF2720)) {
                 spec->num_channels = 14;
                 spec->channels = rf_vals;
-        } else if (rt2x00_rf(rt2x00dev, RF2850) || rt2x00_rf(rt2x00dev, RF2750)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2850) ||
+                   rt2x00_rf(rt2x00dev, RF2750)) {
                 spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals);
                 spec->channels = rf_vals;
@@ -2364,8 +2512,12 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                    rt2x00_rf(rt2x00dev, RF2020) ||
                    rt2x00_rf(rt2x00dev, RF3021) ||
                    rt2x00_rf(rt2x00dev, RF3022)) {
-                spec->num_channels = ARRAY_SIZE(rf_vals_302x);
-                spec->channels = rf_vals_302x;
+                spec->num_channels = 14;
+                spec->channels = rf_vals_3x;
+        } else if (rt2x00_rf(rt2x00dev, RF3052)) {
+                spec->supported_bands |= SUPPORT_BAND_5GHZ;
+                spec->num_channels = ARRAY_SIZE(rf_vals_3x);
+                spec->channels = rf_vals_3x;
         }
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.h b/drivers/net/wireless/rt2x00/rt2800lib.h
index ebabeae62d1b..94de999e2290 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.h
+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
@@ -111,6 +111,9 @@ void rt2800_mcu_request(struct rt2x00_dev *rt2x00dev,
                         const u8 command, const u8 token,
                         const u8 arg0, const u8 arg1);
 
+void rt2800_write_txwi(struct sk_buff *skb, struct txentry_desc *txdesc);
+void rt2800_process_rxwi(struct sk_buff *skb, struct rxdone_entry_desc *txdesc);
+
 extern const struct rt2x00debug rt2800_rt2x00debug;
 
 int rt2800_rfkill_poll(struct rt2x00_dev *rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index f08b6a37bf2d..7d4778d66e77 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -616,67 +616,13 @@ static int rt2800pci_set_device_state(struct rt2x00_dev *rt2x00dev,
 static int rt2800pci_write_tx_data(struct queue_entry* entry,
                                    struct txentry_desc *txdesc)
 {
-        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct sk_buff *skb = entry->skb;
-        struct skb_frame_desc *skbdesc;
         int ret;
-        __le32 *txwi;
-        u32 word;
 
         ret = rt2x00pci_write_tx_data(entry, txdesc);
         if (ret)
                 return ret;
 
-        skbdesc = get_skb_frame_desc(skb);
-        txwi = (__le32 *)(skb->data - rt2x00dev->ops->extra_tx_headroom);
-
-        /*
-         * Initialize TX Info descriptor
-         */
-        rt2x00_desc_read(txwi, 0, &word);
-        rt2x00_set_field32(&word, TXWI_W0_FRAG,
-                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W0_MIMO_PS, 0);
-        rt2x00_set_field32(&word, TXWI_W0_CF_ACK, 0);
-        rt2x00_set_field32(&word, TXWI_W0_TS,
-                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W0_AMPDU,
-                           test_bit(ENTRY_TXD_HT_AMPDU, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W0_MPDU_DENSITY, txdesc->mpdu_density);
-        rt2x00_set_field32(&word, TXWI_W0_TX_OP, txdesc->ifs);
-        rt2x00_set_field32(&word, TXWI_W0_MCS, txdesc->mcs);
-        rt2x00_set_field32(&word, TXWI_W0_BW,
-                           test_bit(ENTRY_TXD_HT_BW_40, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W0_SHORT_GI,
-                           test_bit(ENTRY_TXD_HT_SHORT_GI, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W0_STBC, txdesc->stbc);
-        rt2x00_set_field32(&word, TXWI_W0_PHYMODE, txdesc->rate_mode);
-        rt2x00_desc_write(txwi, 0, word);
-
-        rt2x00_desc_read(txwi, 1, &word);
-        rt2x00_set_field32(&word, TXWI_W1_ACK,
-                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W1_NSEQ,
-                           test_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W1_BW_WIN_SIZE, txdesc->ba_size);
-        rt2x00_set_field32(&word, TXWI_W1_WIRELESS_CLI_ID,
-                           test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags) ?
-                           txdesc->key_idx : 0xff);
-        rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
-                           txdesc->length);
-        rt2x00_set_field32(&word, TXWI_W1_PACKETID,
-                           skbdesc->entry->queue->qid + 1);
-        rt2x00_desc_write(txwi, 1, word);
-
-        /*
-         * Always write 0 to IV/EIV fields, hardware will insert the IV
-         * from the IVEIV register when TXD_W3_WIV is set to 0.
-         * When TXD_W3_WIV is set to 1 it will use the IV data
-         * from the descriptor. The TXWI_W1_WIRELESS_CLI_ID indicates which
-         * crypto entry in the registers should be used to encrypt the frame.
-         */
-        _rt2x00_desc_write(txwi, 2, 0 /* skbdesc->iv[0] */);
-        _rt2x00_desc_write(txwi, 3, 0 /* skbdesc->iv[1] */);
+        rt2800_write_txwi(entry->skb, txdesc);
 
         return 0;
 }
@@ -732,10 +678,10 @@ static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 /*
  * TX data initialization
  */
-static void rt2800pci_write_beacon(struct queue_entry *entry)
+static void rt2800pci_write_beacon(struct queue_entry *entry,
+                                   struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         unsigned int beacon_base;
         u32 reg;
 
@@ -748,15 +694,25 @@ static void rt2800pci_write_beacon(struct queue_entry *entry)
         rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
 
         /*
-         * Write entire beacon with descriptor to register.
+         * Add the TXWI for the beacon to the skb.
+         */
+        rt2800_write_txwi(entry->skb, txdesc);
+        skb_push(entry->skb, TXWI_DESC_SIZE);
+
+        /*
+         * Write entire beacon with TXWI to register.
          */
         beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
-        rt2800_register_multiwrite(rt2x00dev,
-                                      beacon_base,
-                                      skbdesc->desc, skbdesc->desc_len);
-        rt2800_register_multiwrite(rt2x00dev,
-                                      beacon_base + skbdesc->desc_len,
-                                      entry->skb->data, entry->skb->len);
+        rt2800_register_multiwrite(rt2x00dev, beacon_base,
+                                   entry->skb->data, entry->skb->len);
+
+        /*
+         * Enable beaconing again.
+         */
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
+        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
 
         /*
          * Clean up beacon skb.
@@ -770,18 +726,6 @@ static void rt2800pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
 {
         struct data_queue *queue;
         unsigned int idx, qidx = 0;
-        u32 reg;
-
-        if (queue_idx == QID_BEACON) {
-                rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
-                if (!rt2x00_get_field32(reg, BCN_TIME_CFG_BEACON_GEN)) {
-                        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
-                        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
-                        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
-                        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
-                }
-                return;
-        }
 
         if (queue_idx > QID_HCCA && queue_idx != QID_MGMT)
                 return;
@@ -824,34 +768,21 @@ static void rt2800pci_fill_rxdone(struct queue_entry *entry,
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct queue_entry_priv_pci *entry_priv = entry->priv_data;
         __le32 *rxd = entry_priv->desc;
-        __le32 *rxwi = (__le32 *)entry->skb->data;
-        u32 rxd3;
-        u32 rxwi0;
-        u32 rxwi1;
-        u32 rxwi2;
-        u32 rxwi3;
-
-        rt2x00_desc_read(rxd, 3, &rxd3);
-        rt2x00_desc_read(rxwi, 0, &rxwi0);
-        rt2x00_desc_read(rxwi, 1, &rxwi1);
-        rt2x00_desc_read(rxwi, 2, &rxwi2);
-        rt2x00_desc_read(rxwi, 3, &rxwi3);
-
-        if (rt2x00_get_field32(rxd3, RXD_W3_CRC_ERROR))
+        u32 word;
+
+        rt2x00_desc_read(rxd, 3, &word);
+
+        if (rt2x00_get_field32(word, RXD_W3_CRC_ERROR))
                 rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
 
-        if (test_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags)) {
-                /*
-                 * Unfortunately we don't know the cipher type used during
-                 * decryption. This prevents us from correct providing
-                 * correct statistics through debugfs.
-                 */
-                rxdesc->cipher = rt2x00_get_field32(rxwi0, RXWI_W0_UDF);
-                rxdesc->cipher_status =
-                    rt2x00_get_field32(rxd3, RXD_W3_CIPHER_ERROR);
-        }
+        /*
+         * Unfortunately we don't know the cipher type used during
+         * decryption. This prevents us from correct providing
+         * correct statistics through debugfs.
+         */
+        rxdesc->cipher_status = rt2x00_get_field32(word, RXD_W3_CIPHER_ERROR);
 
-        if (rt2x00_get_field32(rxd3, RXD_W3_DECRYPTED)) {
+        if (rt2x00_get_field32(word, RXD_W3_DECRYPTED)) {
                 /*
                  * Hardware has stripped IV/EIV data from 802.11 frame during
                  * decryption. Unfortunately the descriptor doesn't contain
@@ -866,47 +797,22 @@ static void rt2800pci_fill_rxdone(struct queue_entry *entry,
                         rxdesc->flags |= RX_FLAG_MMIC_ERROR;
         }
 
-        if (rt2x00_get_field32(rxd3, RXD_W3_MY_BSS))
+        if (rt2x00_get_field32(word, RXD_W3_MY_BSS))
                 rxdesc->dev_flags |= RXDONE_MY_BSS;
 
-        if (rt2x00_get_field32(rxd3, RXD_W3_L2PAD))
+        if (rt2x00_get_field32(word, RXD_W3_L2PAD))
                 rxdesc->dev_flags |= RXDONE_L2PAD;
 
-        if (rt2x00_get_field32(rxwi1, RXWI_W1_SHORT_GI))
-                rxdesc->flags |= RX_FLAG_SHORT_GI;
-
-        if (rt2x00_get_field32(rxwi1, RXWI_W1_BW))
-                rxdesc->flags |= RX_FLAG_40MHZ;
-
-        /*
-         * Detect RX rate, always use MCS as signal type.
-         */
-        rxdesc->dev_flags |= RXDONE_SIGNAL_MCS;
-        rxdesc->rate_mode = rt2x00_get_field32(rxwi1, RXWI_W1_PHYMODE);
-        rxdesc->signal = rt2x00_get_field32(rxwi1, RXWI_W1_MCS);
-
         /*
-         * Mask of 0x8 bit to remove the short preamble flag.
+         * Process the RXWI structure that is at the start of the buffer.
          */
-        if (rxdesc->rate_mode == RATE_MODE_CCK)
-                rxdesc->signal &= ~0x8;
-
-        rxdesc->rssi =
-            (rt2x00_get_field32(rxwi2, RXWI_W2_RSSI0) +
-             rt2x00_get_field32(rxwi2, RXWI_W2_RSSI1)) / 2;
-
-        rxdesc->size = rt2x00_get_field32(rxwi0, RXWI_W0_MPDU_TOTAL_BYTE_COUNT);
+        rt2800_process_rxwi(entry->skb, rxdesc);
 
         /*
          * Set RX IDX in register to inform hardware that we have handled
          * this entry and it is available for reuse again.
          */
         rt2800_register_write(rt2x00dev, RX_CRX_IDX, entry->entry_idx);
-
-        /*
-         * Remove TXWI descriptor from start of buffer.
-         */
-        skb_pull(entry->skb, RXWI_DESC_SIZE);
 }
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index e3f3a97db807..8ad0669a1b99 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -401,59 +401,15 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
         __le32 *txi = skbdesc->desc;
-        __le32 *txwi = &txi[TXINFO_DESC_SIZE / sizeof(__le32)];
         u32 word;
 
         /*
-         * Initialize TX Info descriptor
+         * Initialize TXWI descriptor
          */
-        rt2x00_desc_read(txwi, 0, &word);
-        rt2x00_set_field32(&word, TXWI_W0_FRAG,
-                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W0_MIMO_PS, 0);
-        rt2x00_set_field32(&word, TXWI_W0_CF_ACK, 0);
-        rt2x00_set_field32(&word, TXWI_W0_TS,
-                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W0_AMPDU,
-                           test_bit(ENTRY_TXD_HT_AMPDU, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W0_MPDU_DENSITY, txdesc->mpdu_density);
-        rt2x00_set_field32(&word, TXWI_W0_TX_OP, txdesc->ifs);
-        rt2x00_set_field32(&word, TXWI_W0_MCS, txdesc->mcs);
-        rt2x00_set_field32(&word, TXWI_W0_BW,
-                           test_bit(ENTRY_TXD_HT_BW_40, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W0_SHORT_GI,
-                           test_bit(ENTRY_TXD_HT_SHORT_GI, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W0_STBC, txdesc->stbc);
-        rt2x00_set_field32(&word, TXWI_W0_PHYMODE, txdesc->rate_mode);
-        rt2x00_desc_write(txwi, 0, word);
-
-        rt2x00_desc_read(txwi, 1, &word);
-        rt2x00_set_field32(&word, TXWI_W1_ACK,
-                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W1_NSEQ,
-                           test_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W1_BW_WIN_SIZE, txdesc->ba_size);
-        rt2x00_set_field32(&word, TXWI_W1_WIRELESS_CLI_ID,
-                           test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags) ?
-                           txdesc->key_idx : 0xff);
-        rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
-                           txdesc->length);
-        rt2x00_set_field32(&word, TXWI_W1_PACKETID,
-                           skbdesc->entry->queue->qid + 1);
-        rt2x00_desc_write(txwi, 1, word);
+        rt2800_write_txwi(skb, txdesc);
 
         /*
-         * Always write 0 to IV/EIV fields, hardware will insert the IV
-         * from the IVEIV register when TXINFO_W0_WIV is set to 0.
-         * When TXINFO_W0_WIV is set to 1 it will use the IV data
-         * from the descriptor. The TXWI_W1_WIRELESS_CLI_ID indicates which
-         * crypto entry in the registers should be used to encrypt the frame.
-         */
-        _rt2x00_desc_write(txwi, 2, 0 /* skbdesc->iv[0] */);
-        _rt2x00_desc_write(txwi, 3, 0 /* skbdesc->iv[1] */);
-
-        /*
-         * Initialize TX descriptor
+         * Initialize TXINFO descriptor
          */
         rt2x00_desc_read(txi, 0, &word);
         rt2x00_set_field32(&word, TXINFO_W0_USB_DMA_TX_PKT_LEN,
@@ -471,21 +427,14 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 /*
  * TX data initialization
  */
-static void rt2800usb_write_beacon(struct queue_entry *entry)
+static void rt2800usb_write_beacon(struct queue_entry *entry,
+                                   struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         unsigned int beacon_base;
         u32 reg;
 
         /*
-         * Add the descriptor in front of the skb.
-         */
-        skb_push(entry->skb, entry->queue->desc_size);
-        memcpy(entry->skb->data, skbdesc->desc, skbdesc->desc_len);
-        skbdesc->desc = entry->skb->data;
-
-        /*
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
@@ -494,6 +443,12 @@ static void rt2800usb_write_beacon(struct queue_entry *entry)
         rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
 
         /*
+         * Add the TXWI for the beacon to the skb.
+         */
+        rt2800_write_txwi(entry->skb, txdesc);
+        skb_push(entry->skb, TXWI_DESC_SIZE);
+
+        /*
          * Write entire beacon with descriptor to register.
          */
         beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
@@ -503,6 +458,14 @@ static void rt2800usb_write_beacon(struct queue_entry *entry)
                                             REGISTER_TIMEOUT32(entry->skb->len));
 
         /*
+         * Enable beaconing again.
+         */
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
+        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+
+        /*
          * Clean up the beacon skb.
          */
         dev_kfree_skb(entry->skb);
@@ -524,84 +487,53 @@ static int rt2800usb_get_tx_data_len(struct queue_entry *entry)
         return length;
 }
 
-static void rt2800usb_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                    const enum data_queue_qid queue)
-{
-        u32 reg;
-
-        if (queue != QID_BEACON) {
-                rt2x00usb_kick_tx_queue(rt2x00dev, queue);
-                return;
-        }
-
-        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
-        if (!rt2x00_get_field32(reg, BCN_TIME_CFG_BEACON_GEN)) {
-                rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
-                rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
-                rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
-                rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
-        }
-}
-
 /*
  * RX control handlers
  */
 static void rt2800usb_fill_rxdone(struct queue_entry *entry,
                                   struct rxdone_entry_desc *rxdesc)
 {
-        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         __le32 *rxi = (__le32 *)entry->skb->data;
-        __le32 *rxwi;
         __le32 *rxd;
-        u32 rxi0;
-        u32 rxwi0;
-        u32 rxwi1;
-        u32 rxwi2;
-        u32 rxwi3;
-        u32 rxd0;
+        u32 word;
         int rx_pkt_len;
 
         /*
+         * Copy descriptor to the skbdesc->desc buffer, making it safe from
+         * moving of frame data in rt2x00usb.
+         */
+        memcpy(skbdesc->desc, rxi, skbdesc->desc_len);
+
+        /*
          * RX frame format is :
          * | RXINFO | RXWI | header | L2 pad | payload | pad | RXD | USB pad |
          *          |<------------ rx_pkt_len -------------->|
          */
-        rt2x00_desc_read(rxi, 0, &rxi0);
-        rx_pkt_len = rt2x00_get_field32(rxi0, RXINFO_W0_USB_DMA_RX_PKT_LEN);
-
-        rxwi = (__le32 *)(entry->skb->data + RXINFO_DESC_SIZE);
+        rt2x00_desc_read(rxi, 0, &word);
+        rx_pkt_len = rt2x00_get_field32(word, RXINFO_W0_USB_DMA_RX_PKT_LEN);
 
         /*
-         * FIXME : we need to check for rx_pkt_len validity
+         * Remove the RXINFO structure from the sbk.
          */
-        rxd = (__le32 *)(entry->skb->data + RXINFO_DESC_SIZE + rx_pkt_len);
+        skb_pull(entry->skb, RXINFO_DESC_SIZE);
 
         /*
-         * Copy descriptor to the skbdesc->desc buffer, making it safe from
-         * moving of frame data in rt2x00usb.
+         * FIXME: we need to check for rx_pkt_len validity
          */
-        memcpy(skbdesc->desc, rxi, skbdesc->desc_len);
+        rxd = (__le32 *)(entry->skb->data + rx_pkt_len);
 
         /*
          * It is now safe to read the descriptor on all architectures.
          */
-        rt2x00_desc_read(rxwi, 0, &rxwi0);
-        rt2x00_desc_read(rxwi, 1, &rxwi1);
-        rt2x00_desc_read(rxwi, 2, &rxwi2);
-        rt2x00_desc_read(rxwi, 3, &rxwi3);
-        rt2x00_desc_read(rxd, 0, &rxd0);
+        rt2x00_desc_read(rxd, 0, &word);
 
-        if (rt2x00_get_field32(rxd0, RXD_W0_CRC_ERROR))
+        if (rt2x00_get_field32(word, RXD_W0_CRC_ERROR))
                 rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
 
-        if (test_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags)) {
-                rxdesc->cipher = rt2x00_get_field32(rxwi0, RXWI_W0_UDF);
-                rxdesc->cipher_status =
-                    rt2x00_get_field32(rxd0, RXD_W0_CIPHER_ERROR);
-        }
+        rxdesc->cipher_status = rt2x00_get_field32(word, RXD_W0_CIPHER_ERROR);
 
-        if (rt2x00_get_field32(rxd0, RXD_W0_DECRYPTED)) {
+        if (rt2x00_get_field32(word, RXD_W0_DECRYPTED)) {
                 /*
                  * Hardware has stripped IV/EIV data from 802.11 frame during
                  * decryption. Unfortunately the descriptor doesn't contain
@@ -616,41 +548,21 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
                         rxdesc->flags |= RX_FLAG_MMIC_ERROR;
         }
 
-        if (rt2x00_get_field32(rxd0, RXD_W0_MY_BSS))
+        if (rt2x00_get_field32(word, RXD_W0_MY_BSS))
                 rxdesc->dev_flags |= RXDONE_MY_BSS;
 
-        if (rt2x00_get_field32(rxd0, RXD_W0_L2PAD))
+        if (rt2x00_get_field32(word, RXD_W0_L2PAD))
                 rxdesc->dev_flags |= RXDONE_L2PAD;
 
-        if (rt2x00_get_field32(rxwi1, RXWI_W1_SHORT_GI))
-                rxdesc->flags |= RX_FLAG_SHORT_GI;
-
-        if (rt2x00_get_field32(rxwi1, RXWI_W1_BW))
-                rxdesc->flags |= RX_FLAG_40MHZ;
-
         /*
-         * Detect RX rate, always use MCS as signal type.
+         * Remove RXD descriptor from end of buffer.
          */
-        rxdesc->dev_flags |= RXDONE_SIGNAL_MCS;
-        rxdesc->rate_mode = rt2x00_get_field32(rxwi1, RXWI_W1_PHYMODE);
-        rxdesc->signal = rt2x00_get_field32(rxwi1, RXWI_W1_MCS);
-
-        /*
-         * Mask of 0x8 bit to remove the short preamble flag.
-         */
-        if (rxdesc->rate_mode == RATE_MODE_CCK)
-                rxdesc->signal &= ~0x8;
-
-        rxdesc->rssi =
-            (rt2x00_get_field32(rxwi2, RXWI_W2_RSSI0) +
-             rt2x00_get_field32(rxwi2, RXWI_W2_RSSI1)) / 2;
-
-        rxdesc->size = rt2x00_get_field32(rxwi0, RXWI_W0_MPDU_TOTAL_BYTE_COUNT);
+        skb_trim(entry->skb, rx_pkt_len);
 
         /*
-         * Remove RXWI descriptor from start of buffer.
+         * Process the RXWI structure.
          */
-        skb_pull(entry->skb, skbdesc->desc_len);
+        rt2800_process_rxwi(entry->skb, rxdesc);
 }
 
 /*
@@ -743,7 +655,7 @@ static const struct rt2x00lib_ops rt2800usb_rt2x00_ops = {
         .write_tx_data          = rt2x00usb_write_tx_data,
         .write_beacon           = rt2800usb_write_beacon,
         .get_tx_data_len        = rt2800usb_get_tx_data_len,
-        .kick_tx_queue          = rt2800usb_kick_tx_queue,
+        .kick_tx_queue          = rt2x00usb_kick_tx_queue,
         .kill_tx_queue          = rt2x00usb_kill_tx_queue,
         .fill_rxdone            = rt2800usb_fill_rxdone,
         .config_shared_key      = rt2800_config_shared_key,
@@ -841,7 +753,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x7392, 0x7717), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x7392, 0x7718), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* EnGenius */
-        { USB_DEVICE(0X1740, 0x9701), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9701), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1740, 0x9702), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Gigabyte */
         { USB_DEVICE(0x1044, 0x800b), USB_DEVICE_DATA(&rt2800usb_ops) },
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.h b/drivers/net/wireless/rt2x00/rt2800usb.h
index d1d8ae94b4d4..2bca6a71a7f5 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.h
+++ b/drivers/net/wireless/rt2x00/rt2800usb.h
@@ -79,8 +79,6 @@
  */
 #define TXINFO_DESC_SIZE                ( 1 * sizeof(__le32) )
 #define RXINFO_DESC_SIZE                ( 1 * sizeof(__le32) )
-#define RXWI_DESC_SIZE                  ( 4 * sizeof(__le32) )
-#define RXD_DESC_SIZE                   ( 1 * sizeof(__le32) )
 
 /*
  * TX Info structure
@@ -113,44 +111,6 @@
 #define RXINFO_W0_USB_DMA_RX_PKT_LEN    FIELD32(0x0000ffff)
 
 /*
- * RX WI structure
- */
-
-/*
- * Word0
- */
-#define RXWI_W0_WIRELESS_CLI_ID         FIELD32(0x000000ff)
-#define RXWI_W0_KEY_INDEX               FIELD32(0x00000300)
-#define RXWI_W0_BSSID                   FIELD32(0x00001c00)
-#define RXWI_W0_UDF                     FIELD32(0x0000e000)
-#define RXWI_W0_MPDU_TOTAL_BYTE_COUNT   FIELD32(0x0fff0000)
-#define RXWI_W0_TID                     FIELD32(0xf0000000)
-
-/*
- * Word1
- */
-#define RXWI_W1_FRAG                    FIELD32(0x0000000f)
-#define RXWI_W1_SEQUENCE                FIELD32(0x0000fff0)
-#define RXWI_W1_MCS                     FIELD32(0x007f0000)
-#define RXWI_W1_BW                      FIELD32(0x00800000)
-#define RXWI_W1_SHORT_GI                FIELD32(0x01000000)
-#define RXWI_W1_STBC                    FIELD32(0x06000000)
-#define RXWI_W1_PHYMODE                 FIELD32(0xc0000000)
-
-/*
- * Word2
- */
-#define RXWI_W2_RSSI0                   FIELD32(0x000000ff)
-#define RXWI_W2_RSSI1                   FIELD32(0x0000ff00)
-#define RXWI_W2_RSSI2                   FIELD32(0x00ff0000)
-
-/*
- * Word3
- */
-#define RXWI_W3_SNR0                    FIELD32(0x000000ff)
-#define RXWI_W3_SNR1                    FIELD32(0x0000ff00)
-
-/*
  * RX descriptor format for RX Ring.
  */
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 4f9b666f7a7f..6c1ff4c15c84 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -551,7 +551,8 @@ struct rt2x00lib_ops {
                                struct txentry_desc *txdesc);
         int (*write_tx_data) (struct queue_entry *entry,
                               struct txentry_desc *txdesc);
-        void (*write_beacon) (struct queue_entry *entry);
+        void (*write_beacon) (struct queue_entry *entry,
+                              struct txentry_desc *txdesc);
         int (*get_tx_data_len) (struct queue_entry *entry);
         void (*kick_tx_queue) (struct rt2x00_dev *rt2x00dev,
                                const enum data_queue_qid queue);
diff --git a/drivers/net/wireless/rt2x00/rt2x00crypto.c b/drivers/net/wireless/rt2x00/rt2x00crypto.c
index d291c7862e10..583dacd8d241 100644
--- a/drivers/net/wireless/rt2x00/rt2x00crypto.c
+++ b/drivers/net/wireless/rt2x00/rt2x00crypto.c
@@ -128,6 +128,7 @@ void rt2x00crypto_tx_remove_iv(struct sk_buff *skb, struct txentry_desc *txdesc)
 
         /* Pull buffer to correct size */
         skb_pull(skb, txdesc->iv_len);
+        txdesc->length -= txdesc->iv_len;
 
         /* IV/EIV data has officially been stripped */
         skbdesc->flags |= SKBDESC_IV_STRIPPED;
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index 9569fb4e5bc5..e2497f820d75 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -700,8 +700,6 @@ void rt2x00debug_register(struct rt2x00_dev *rt2x00dev)
 exit:
         rt2x00debug_deregister(rt2x00dev);
         ERROR(rt2x00dev, "Failed to register debug handler.\n");
-
-        return;
 }
 
 void rt2x00debug_deregister(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/wireless/rt2x00/rt2x00ht.c b/drivers/net/wireless/rt2x00/rt2x00ht.c
index 1056c92143a8..5a407602ce3e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00ht.c
+++ b/drivers/net/wireless/rt2x00/rt2x00ht.c
@@ -35,6 +35,7 @@ void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
 {
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(entry->skb);
         struct ieee80211_tx_rate *txrate = &tx_info->control.rates[0];
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)entry->skb->data;
 
         if (tx_info->control.sta)
                 txdesc->mpdu_density =
@@ -66,4 +67,20 @@ void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
                 __set_bit(ENTRY_TXD_HT_BW_40, &txdesc->flags);
         if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
                 __set_bit(ENTRY_TXD_HT_SHORT_GI, &txdesc->flags);
+
+        /*
+         * Determine IFS values
+         * - Use TXOP_BACKOFF for management frames
+         * - Use TXOP_SIFS for fragment bursts
+         * - Use TXOP_HTTXOP for everything else
+         *
+         * Note: rt2800 devices won't use CTS protection (if used)
+         * for frames not transmitted with TXOP_HTTXOP
+         */
+        if (ieee80211_is_mgmt(hdr->frame_control))
+                txdesc->txop = TXOP_BACKOFF;
+        else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT))
+                txdesc->txop = TXOP_SIFS;
+        else
+                txdesc->txop = TXOP_HTTXOP;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index e22029fcf411..089a12c7b90f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -429,20 +429,23 @@ static void rt2x00queue_write_tx_descriptor(struct queue_entry *entry,
          * it is now ready to be dumped to userspace through debugfs.
          */
         rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_TX, entry->skb);
+}
+
+static void rt2x00queue_kick_tx_queue(struct queue_entry *entry,
+                                      struct txentry_desc *txdesc)
+{
+        struct data_queue *queue = entry->queue;
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
 
         /*
          * Check if we need to kick the queue, there are however a few rules
-         *      1) Don't kick beacon queue
-         *      2) Don't kick unless this is the last in frame in a burst.
+         *      1) Don't kick unless this is the last in frame in a burst.
          *         When the burst flag is set, this frame is always followed
          *         by another frame which in some way are related to eachother.
          *         This is true for fragments, RTS or CTS-to-self frames.
-         *      3) Rule 2 can be broken when the available entries
+         *      2) Rule 1 can be broken when the available entries
          *         in the queue are less then a certain threshold.
          */
-        if (entry->queue->qid == QID_BEACON)
-                return;
-
         if (rt2x00queue_threshold(queue) ||
             !test_bit(ENTRY_TXD_BURST, &txdesc->flags))
                 rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, queue->qid);
@@ -538,6 +541,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
 
         rt2x00queue_index_inc(queue, Q_INDEX);
         rt2x00queue_write_tx_descriptor(entry, &txdesc);
+        rt2x00queue_kick_tx_queue(entry, &txdesc);
 
         return 0;
 }
@@ -603,12 +607,9 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
         rt2x00queue_write_tx_descriptor(intf->beacon, &txdesc);
 
         /*
-         * Send beacon to hardware.
-         * Also enable beacon generation, which might have been disabled
-         * by the driver during the config_beacon() callback function.
+         * Send beacon to hardware and enable beacon genaration..
          */
-        rt2x00dev->ops->lib->write_beacon(intf->beacon);
-        rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, QID_BEACON);
+        rt2x00dev->ops->lib->write_beacon(intf->beacon, &txdesc);
 
         mutex_unlock(&intf->beacon_skb_mutex);
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index 94a48c174d67..36a957adc1f9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -299,6 +299,7 @@ enum txentry_desc_flags {
  * @retry_limit: Max number of retries.
  * @aifs: AIFS value.
  * @ifs: IFS value.
+ * @txop: IFS value for 11n capable chips.
  * @cw_min: cwmin value.
  * @cw_max: cwmax value.
  * @cipher: Cipher type used for encryption.
@@ -328,6 +329,7 @@ struct txentry_desc {
         short retry_limit;
         short aifs;
         short ifs;
+        short txop;
         short cw_min;
         short cw_max;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00reg.h b/drivers/net/wireless/rt2x00/rt2x00reg.h
index 603bfc0adaa3..b9fe94873ee0 100644
--- a/drivers/net/wireless/rt2x00/rt2x00reg.h
+++ b/drivers/net/wireless/rt2x00/rt2x00reg.h
@@ -101,6 +101,16 @@ enum ifs {
 };
 
 /*
+ * IFS backoff values for HT devices
+ */
+enum txop {
+        TXOP_HTTXOP = 0,
+        TXOP_PIFS = 1,
+        TXOP_SIFS = 2,
+        TXOP_BACKOFF = 3,
+};
+
+/*
  * Cipher types for hardware encryption
  */
 enum cipher {
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 26ee7911fba9..86c75b9c3f25 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1843,7 +1843,8 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 /*
  * TX data initialization
  */
-static void rt61pci_write_beacon(struct queue_entry *entry)
+static void rt61pci_write_beacon(struct queue_entry *entry,
+                                 struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
@@ -1870,6 +1871,19 @@ static void rt61pci_write_beacon(struct queue_entry *entry)
                                       entry->skb->data, entry->skb->len);
 
         /*
+         * Enable beaconing again.
+         *
+         * For Wi-Fi faily generated beacons between participating
+         * stations. Set TBTT phase adaptive adjustment step to 8us.
+         */
+        rt2x00pci_register_write(rt2x00dev, TXRX_CSR10, 0x00001008);
+
+        rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 1);
+        rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE, 1);
+        rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 1);
+        rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+
+        /*
          * Clean up beacon skb.
          */
         dev_kfree_skb_any(entry->skb);
@@ -1881,23 +1895,6 @@ static void rt61pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        if (queue == QID_BEACON) {
-                /*
-                 * For Wi-Fi faily generated beacons between participating
-                 * stations. Set TBTT phase adaptive adjustment step to 8us.
-                 */
-                rt2x00pci_register_write(rt2x00dev, TXRX_CSR10, 0x00001008);
-
-                rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
-                if (!rt2x00_get_field32(reg, TXRX_CSR9_BEACON_GEN)) {
-                        rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 1);
-                        rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE, 1);
-                        rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 1);
-                        rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
-                }
-                return;
-        }
-
         rt2x00pci_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
         rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC0, (queue == QID_AC_BE));
         rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC1, (queue == QID_AC_BK));
@@ -1969,12 +1966,8 @@ static void rt61pci_fill_rxdone(struct queue_entry *entry,
         if (rt2x00_get_field32(word0, RXD_W0_CRC_ERROR))
                 rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
 
-        if (test_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags)) {
-                rxdesc->cipher =
-                    rt2x00_get_field32(word0, RXD_W0_CIPHER_ALG);
-                rxdesc->cipher_status =
-                    rt2x00_get_field32(word0, RXD_W0_CIPHER_ERROR);
-        }
+        rxdesc->cipher = rt2x00_get_field32(word0, RXD_W0_CIPHER_ALG);
+        rxdesc->cipher_status = rt2x00_get_field32(word0, RXD_W0_CIPHER_ERROR);
 
         if (rxdesc->cipher != CIPHER_NONE) {
                 _rt2x00_desc_read(entry_priv->desc, 2, &rxdesc->iv[0]);
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 39b3c6d04af4..11c130748206 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -1505,7 +1505,8 @@ static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 /*
  * TX data initialization
  */
-static void rt73usb_write_beacon(struct queue_entry *entry)
+static void rt73usb_write_beacon(struct queue_entry *entry,
+                                 struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
@@ -1537,6 +1538,19 @@ static void rt73usb_write_beacon(struct queue_entry *entry)
                                             REGISTER_TIMEOUT32(entry->skb->len));
 
         /*
+         * Enable beaconing again.
+         *
+         * For Wi-Fi faily generated beacons between participating stations.
+         * Set TBTT phase adaptive adjustment step to 8us (default 16us)
+         */
+        rt2x00usb_register_write(rt2x00dev, TXRX_CSR10, 0x00001008);
+
+        rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 1);
+        rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE, 1);
+        rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 1);
+        rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
+
+        /*
          * Clean up the beacon skb.
          */
         dev_kfree_skb(entry->skb);
@@ -1557,31 +1571,6 @@ static int rt73usb_get_tx_data_len(struct queue_entry *entry)
         return length;
 }
 
-static void rt73usb_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                  const enum data_queue_qid queue)
-{
-        u32 reg;
-
-        if (queue != QID_BEACON) {
-                rt2x00usb_kick_tx_queue(rt2x00dev, queue);
-                return;
-        }
-
-        /*
-         * For Wi-Fi faily generated beacons between participating stations.
-         * Set TBTT phase adaptive adjustment step to 8us (default 16us)
-         */
-        rt2x00usb_register_write(rt2x00dev, TXRX_CSR10, 0x00001008);
-
-        rt2x00usb_register_read(rt2x00dev, TXRX_CSR9, &reg);
-        if (!rt2x00_get_field32(reg, TXRX_CSR9_BEACON_GEN)) {
-                rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 1);
-                rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE, 1);
-                rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 1);
-                rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
-        }
-}
-
 /*
  * RX control handlers
  */
@@ -1645,12 +1634,8 @@ static void rt73usb_fill_rxdone(struct queue_entry *entry,
         if (rt2x00_get_field32(word0, RXD_W0_CRC_ERROR))
                 rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
 
-        if (test_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags)) {
-                rxdesc->cipher =
-                    rt2x00_get_field32(word0, RXD_W0_CIPHER_ALG);
-                rxdesc->cipher_status =
-                    rt2x00_get_field32(word0, RXD_W0_CIPHER_ERROR);
-        }
+        rxdesc->cipher = rt2x00_get_field32(word0, RXD_W0_CIPHER_ALG);
+        rxdesc->cipher_status = rt2x00_get_field32(word0, RXD_W0_CIPHER_ERROR);
 
         if (rxdesc->cipher != CIPHER_NONE) {
                 _rt2x00_desc_read(rxd, 2, &rxdesc->iv[0]);
@@ -2266,7 +2251,7 @@ static const struct rt2x00lib_ops rt73usb_rt2x00_ops = {
         .write_tx_data          = rt2x00usb_write_tx_data,
         .write_beacon           = rt73usb_write_beacon,
         .get_tx_data_len        = rt73usb_get_tx_data_len,
-        .kick_tx_queue          = rt73usb_kick_tx_queue,
+        .kick_tx_queue          = rt2x00usb_kick_tx_queue,
         .kill_tx_queue          = rt2x00usb_kill_tx_queue,
         .fill_rxdone            = rt73usb_fill_rxdone,
         .config_shared_key      = rt73usb_config_shared_key,
diff --git a/drivers/net/wireless/rtl818x/rtl8180.h b/drivers/net/wireless/rtl818x/rtl8180.h
index de3844fe06d8..4baf0cf0826f 100644
--- a/drivers/net/wireless/rtl818x/rtl8180.h
+++ b/drivers/net/wireless/rtl818x/rtl8180.h
@@ -55,6 +55,14 @@ struct rtl8180_tx_ring {
         struct sk_buff_head queue;
 };
 
+struct rtl8180_vif {
+        struct ieee80211_hw *dev;
+
+        /* beaconing */
+        struct delayed_work beacon_work;
+        bool enable_beacon;
+};
+
 struct rtl8180_priv {
         /* common between rtl818x drivers */
         struct rtl818x_csr __iomem *map;
@@ -78,6 +86,9 @@ struct rtl8180_priv {
         u32 anaparam;
         u16 rfparam;
         u8 csthreshold;
+
+        /* sequence # */
+        u16 seqno;
 };
 
 void rtl8180_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data);
diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
index 21307f2412b8..515817de2905 100644
--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
@@ -234,6 +234,7 @@ static irqreturn_t rtl8180_interrupt(int irq, void *dev_id)
 static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct rtl8180_priv *priv = dev->priv;
         struct rtl8180_tx_ring *ring;
         struct rtl8180_tx_desc *entry;
@@ -285,6 +286,14 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         }
 
         spin_lock_irqsave(&priv->lock, flags);
+
+        if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
+                if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
+                        priv->seqno += 0x10;
+                hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
+                hdr->seq_ctrl |= cpu_to_le16(priv->seqno);
+        }
+
         idx = (ring->idx + skb_queue_len(&ring->queue)) % ring->entries;
         entry = &ring->desc[idx];
 
@@ -299,6 +308,7 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         __skb_queue_tail(&ring->queue, skb);
         if (ring->entries - skb_queue_len(&ring->queue) < 2)
                 ieee80211_stop_queue(dev, prio);
+
         spin_unlock_irqrestore(&priv->lock, flags);
 
         rtl818x_iowrite8(priv, &priv->map->TX_DMA_POLLING, (1 << (prio + 4)));
@@ -653,10 +663,59 @@ static void rtl8180_stop(struct ieee80211_hw *dev)
                 rtl8180_free_tx_ring(dev, i);
 }
 
+static u64 rtl8180_get_tsf(struct ieee80211_hw *dev)
+{
+        struct rtl8180_priv *priv = dev->priv;
+
+        return rtl818x_ioread32(priv, &priv->map->TSFT[0]) |
+               (u64)(rtl818x_ioread32(priv, &priv->map->TSFT[1])) << 32;
+}
+
+void rtl8180_beacon_work(struct work_struct *work)
+{
+        struct rtl8180_vif *vif_priv =
+                container_of(work, struct rtl8180_vif, beacon_work.work);
+        struct ieee80211_vif *vif =
+                container_of((void *)vif_priv, struct ieee80211_vif, drv_priv);
+        struct ieee80211_hw *dev = vif_priv->dev;
+        struct ieee80211_mgmt *mgmt;
+        struct sk_buff *skb;
+        int err = 0;
+
+        /* don't overflow the tx ring */
+        if (ieee80211_queue_stopped(dev, 0))
+                goto resched;
+
+        /* grab a fresh beacon */
+        skb = ieee80211_beacon_get(dev, vif);
+
+        /*
+         * update beacon timestamp w/ TSF value
+         * TODO: make hardware update beacon timestamp
+         */
+        mgmt = (struct ieee80211_mgmt *)skb->data;
+        mgmt->u.beacon.timestamp = cpu_to_le64(rtl8180_get_tsf(dev));
+
+        /* TODO: use actual beacon queue */
+        skb_set_queue_mapping(skb, 0);
+
+        err = rtl8180_tx(dev, skb);
+        WARN_ON(err);
+
+resched:
+        /*
+         * schedule next beacon
+         * TODO: use hardware support for beacon timing
+         */
+        schedule_delayed_work(&vif_priv->beacon_work,
+                        usecs_to_jiffies(1024 * vif->bss_conf.beacon_int));
+}
+
 static int rtl8180_add_interface(struct ieee80211_hw *dev,
                                  struct ieee80211_vif *vif)
 {
         struct rtl8180_priv *priv = dev->priv;
+        struct rtl8180_vif *vif_priv;
 
         /*
          * We only support one active interface at a time.
@@ -666,6 +725,7 @@ static int rtl8180_add_interface(struct ieee80211_hw *dev,
 
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
                 break;
         default:
                 return -EOPNOTSUPP;
@@ -673,6 +733,12 @@ static int rtl8180_add_interface(struct ieee80211_hw *dev,
 
         priv->vif = vif;
 
+        /* Initialize driver private area */
+        vif_priv = (struct rtl8180_vif *)&vif->drv_priv;
+        vif_priv->dev = dev;
+        INIT_DELAYED_WORK(&vif_priv->beacon_work, rtl8180_beacon_work);
+        vif_priv->enable_beacon = false;
+
         rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
         rtl818x_iowrite32(priv, (__le32 __iomem *)&priv->map->MAC[0],
                           le32_to_cpu(*(__le32 *)vif->addr));
@@ -706,8 +772,11 @@ static void rtl8180_bss_info_changed(struct ieee80211_hw *dev,
                                      u32 changed)
 {
         struct rtl8180_priv *priv = dev->priv;
+        struct rtl8180_vif *vif_priv;
         int i;
 
+        vif_priv = (struct rtl8180_vif *)&vif->drv_priv;
+
         if (changed & BSS_CHANGED_BSSID) {
                 for (i = 0; i < ETH_ALEN; i++)
                         rtl818x_iowrite8(priv, &priv->map->BSSID[i],
@@ -722,7 +791,16 @@ static void rtl8180_bss_info_changed(struct ieee80211_hw *dev,
         }
 
         if (changed & BSS_CHANGED_ERP_SLOT && priv->rf->conf_erp)
-                priv->rf->conf_erp(dev, info);
+                priv->rf->conf_erp(dev, info);
+
+        if (changed & BSS_CHANGED_BEACON_ENABLED)
+                vif_priv->enable_beacon = info->enable_beacon;
+
+        if (changed & (BSS_CHANGED_BEACON_ENABLED | BSS_CHANGED_BEACON)) {
+                cancel_delayed_work_sync(&vif_priv->beacon_work);
+                if (vif_priv->enable_beacon)
+                        schedule_work(&vif_priv->beacon_work.work);
+        }
 }
 
 static u64 rtl8180_prepare_multicast(struct ieee80211_hw *dev,
@@ -763,14 +841,6 @@ static void rtl8180_configure_filter(struct ieee80211_hw *dev,
         rtl818x_iowrite32(priv, &priv->map->RX_CONF, priv->rx_conf);
 }
 
-static u64 rtl8180_get_tsf(struct ieee80211_hw *dev)
-{
-        struct rtl8180_priv *priv = dev->priv;
-
-        return rtl818x_ioread32(priv, &priv->map->TSFT[0]) |
-               (u64)(rtl818x_ioread32(priv, &priv->map->TSFT[1])) << 32;
-}
-
 static const struct ieee80211_ops rtl8180_ops = {
         .tx                     = rtl8180_tx,
         .start                  = rtl8180_start,
@@ -857,8 +927,8 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
                 goto err_free_reg;
         }
 
-        if ((err = pci_set_dma_mask(pdev, 0xFFFFFF00ULL)) ||
-            (err = pci_set_consistent_dma_mask(pdev, 0xFFFFFF00ULL))) {
+        if ((err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32))) ||
+            (err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)))) {
                 printk(KERN_ERR "%s (rtl8180): No suitable DMA available\n",
                        pci_name(pdev));
                 goto err_free_reg;
@@ -907,7 +977,9 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
         dev->flags = IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
                      IEEE80211_HW_RX_INCLUDES_FCS |
                      IEEE80211_HW_SIGNAL_UNSPEC;
-        dev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+        dev->vif_data_size = sizeof(struct rtl8180_vif);
+        dev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                        BIT(NL80211_IFTYPE_ADHOC);
         dev->queues = 1;
         dev->max_signal = 65;
 
diff --git a/drivers/net/wireless/wl12xx/wl1251_rx.c b/drivers/net/wireless/wl12xx/wl1251_rx.c
index af5c67b4da95..851515836a7f 100644
--- a/drivers/net/wireless/wl12xx/wl1251_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_rx.c
@@ -183,6 +183,4 @@ void wl1251_rx(struct wl1251 *wl)
 
         /* Finally, we need to ACK the RX */
         wl1251_rx_ack(wl);
-
-        return;
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271.h b/drivers/net/wireless/wl12xx/wl1271.h
index 75887e74205b..6f1b6b5640c0 100644
--- a/drivers/net/wireless/wl12xx/wl1271.h
+++ b/drivers/net/wireless/wl12xx/wl1271.h
@@ -388,6 +388,8 @@ struct wl1271 {
         size_t fw_len;
         struct wl1271_nvs_file *nvs;
 
+        s8 hw_pg_ver;
+
         u8 bssid[ETH_ALEN];
         u8 mac_addr[ETH_ALEN];
         u8 bss_type;
@@ -479,7 +481,7 @@ struct wl1271 {
         struct wl1271_stats stats;
         struct wl1271_debugfs debugfs;
 
-        u32 buffer_32;
+        __le32 buffer_32;
         u32 buffer_cmd;
         u32 buffer_busyword[WL1271_BUSY_WORD_CNT];
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.c b/drivers/net/wireless/wl12xx/wl1271_boot.c
index acb1d9e6b7d2..1a36d8a2196e 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.c
@@ -441,11 +441,23 @@ static int wl1271_boot_write_irq_polarity(struct wl1271 *wl)
         return 0;
 }
 
+static void wl1271_boot_hw_version(struct wl1271 *wl)
+{
+        u32 fuse;
+
+        fuse = wl1271_top_reg_read(wl, REG_FUSE_DATA_2_1);
+        fuse = (fuse & PG_VER_MASK) >> PG_VER_OFFSET;
+
+        wl->hw_pg_ver = (s8)fuse;
+}
+
 int wl1271_boot(struct wl1271 *wl)
 {
         int ret = 0;
         u32 tmp, clk, pause;
 
+        wl1271_boot_hw_version(wl);
+
         if (REF_CLOCK == 0 || REF_CLOCK == 2 || REF_CLOCK == 4)
                 /* ref clk: 19.2/38.4/38.4-XTAL */
                 clk = 0x3;
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.h b/drivers/net/wireless/wl12xx/wl1271_boot.h
index 95ecc5241959..f829699d597e 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.h
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.h
@@ -55,6 +55,9 @@ struct wl1271_static_data {
 #define OCP_REG_CLK_POLARITY 0x0cb2
 #define OCP_REG_CLK_PULL     0x0cb4
 
+#define REG_FUSE_DATA_2_1    0x050a
+#define PG_VER_MASK          0x3c
+#define PG_VER_OFFSET        2
 
 #define CMD_MBOX_ADDRESS     0x407B4
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.c b/drivers/net/wireless/wl12xx/wl1271_cmd.c
index 62c11af1d8e2..19393e236e2c 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.c
@@ -516,7 +516,7 @@ int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, bool send)
         ps_params->ps_mode = ps_mode;
         ps_params->send_null_data = send;
         ps_params->retries = 5;
-        ps_params->hang_over_period = 128;
+        ps_params->hang_over_period = 1;
         ps_params->null_data_rate = cpu_to_le32(1); /* 1 Mbps */
 
         ret = wl1271_cmd_send(wl, CMD_SET_PS_MODE, ps_params,
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.h b/drivers/net/wireless/wl12xx/wl1271_cmd.h
index 00f78b7aa384..f2820b42a943 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.h
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.h
@@ -129,7 +129,7 @@ enum cmd_templ {
 /* unit ms */
 #define WL1271_COMMAND_TIMEOUT     2000
 #define WL1271_CMD_TEMPL_MAX_SIZE  252
-#define WL1271_EVENT_TIMEOUT       100
+#define WL1271_EVENT_TIMEOUT       750
 
 struct wl1271_cmd_header {
         __le16 id;
diff --git a/drivers/net/wireless/wl12xx/wl1271_io.h b/drivers/net/wireless/wl12xx/wl1271_io.h
index d8837ef0bb40..bc806c74c63a 100644
--- a/drivers/net/wireless/wl12xx/wl1271_io.h
+++ b/drivers/net/wireless/wl12xx/wl1271_io.h
@@ -74,12 +74,12 @@ static inline u32 wl1271_raw_read32(struct wl1271 *wl, int addr)
         wl1271_raw_read(wl, addr, &wl->buffer_32,
                             sizeof(wl->buffer_32), false);
 
-        return wl->buffer_32;
+        return le32_to_cpu(wl->buffer_32);
 }
 
 static inline void wl1271_raw_write32(struct wl1271 *wl, int addr, u32 val)
 {
-        wl->buffer_32 = val;
+        wl->buffer_32 = cpu_to_le32(val);
         wl1271_raw_write(wl, addr, &wl->buffer_32,
                              sizeof(wl->buffer_32), false);
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/wl1271_main.c
index 62e544041d0d..5bb9e3fff961 100644
--- a/drivers/net/wireless/wl12xx/wl1271_main.c
+++ b/drivers/net/wireless/wl12xx/wl1271_main.c
@@ -1140,10 +1140,25 @@ out:
         return ret;
 }
 
-static int wl1271_join(struct wl1271 *wl)
+static int wl1271_join(struct wl1271 *wl, bool set_assoc)
 {
         int ret;
 
+        /*
+         * One of the side effects of the JOIN command is that is clears
+         * WPA/WPA2 keys from the chipset. Performing a JOIN while associated
+         * to a WPA/WPA2 access point will therefore kill the data-path.
+         * Currently there is no supported scenario for JOIN during
+         * association - if it becomes a supported scenario, the WPA/WPA2 keys
+         * must be handled somehow.
+         *
+         */
+        if (test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags))
+                wl1271_info("JOIN while associated.");
+
+        if (set_assoc)
+                set_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags);
+
         ret = wl1271_cmd_join(wl, wl->set_bss_type);
         if (ret < 0)
                 goto out;
@@ -1190,7 +1205,6 @@ static int wl1271_unjoin(struct wl1271 *wl)
                 goto out;
 
         clear_bit(WL1271_FLAG_JOINED, &wl->flags);
-        wl->channel = 0;
         memset(wl->bssid, 0, ETH_ALEN);
 
         /* stop filterting packets based on bssid */
@@ -1250,7 +1264,9 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
                 goto out;
 
         /* if the channel changes while joined, join again */
-        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL &&
+            ((wl->band != conf->channel->band) ||
+             (wl->channel != channel))) {
                 wl->band = conf->channel->band;
                 wl->channel = channel;
 
@@ -1270,7 +1286,7 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
                                        "failed %d", ret);
 
                 if (test_bit(WL1271_FLAG_JOINED, &wl->flags)) {
-                        ret = wl1271_join(wl);
+                        ret = wl1271_join(wl, false);
                         if (ret < 0)
                                 wl1271_warning("cmd join to update channel "
                                                "failed %d", ret);
@@ -1647,6 +1663,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         enum wl1271_cmd_ps_mode mode;
         struct wl1271 *wl = hw->priv;
         bool do_join = false;
+        bool set_assoc = false;
         int ret;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 bss info changed");
@@ -1756,7 +1773,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                 if (bss_conf->assoc) {
                         u32 rates;
                         wl->aid = bss_conf->aid;
-                        set_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags);
+                        set_assoc = true;
 
                         /*
                          * use basic rates from AP, and determine lowest rate
@@ -1856,7 +1873,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (do_join) {
-                ret = wl1271_join(wl);
+                ret = wl1271_join(wl, set_assoc);
                 if (ret < 0) {
                         wl1271_warning("cmd join failed %d", ret);
                         goto out_sleep;
@@ -2228,6 +2245,29 @@ static DEVICE_ATTR(bt_coex_state, S_IRUGO | S_IWUSR,
                    wl1271_sysfs_show_bt_coex_state,
                    wl1271_sysfs_store_bt_coex_state);
 
+static ssize_t wl1271_sysfs_show_hw_pg_ver(struct device *dev,
+                                           struct device_attribute *attr,
+                                           char *buf)
+{
+        struct wl1271 *wl = dev_get_drvdata(dev);
+        ssize_t len;
+
+        /* FIXME: what's the maximum length of buf? page size?*/
+        len = 500;
+
+        mutex_lock(&wl->mutex);
+        if (wl->hw_pg_ver >= 0)
+                len = snprintf(buf, len, "%d\n", wl->hw_pg_ver);
+        else
+                len = snprintf(buf, len, "n/a\n");
+        mutex_unlock(&wl->mutex);
+
+        return len;
+}
+
+static DEVICE_ATTR(hw_pg_ver, S_IRUGO | S_IWUSR,
+                   wl1271_sysfs_show_hw_pg_ver, NULL);
+
 int wl1271_register_hw(struct wl1271 *wl)
 {
         int ret;
@@ -2347,6 +2387,7 @@ struct ieee80211_hw *wl1271_alloc_hw(void)
         wl->vif = NULL;
         wl->flags = 0;
         wl->sg_enabled = true;
+        wl->hw_pg_ver = -1;
 
         for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 wl->tx_frames[i] = NULL;
@@ -2376,8 +2417,18 @@ struct ieee80211_hw *wl1271_alloc_hw(void)
                 goto err_platform;
         }
 
+        /* Create sysfs file to get HW PG version */
+        ret = device_create_file(&wl->plat_dev->dev, &dev_attr_hw_pg_ver);
+        if (ret < 0) {
+                wl1271_error("failed to create sysfs file hw_pg_ver");
+                goto err_bt_coex_state;
+        }
+
         return hw;
 
+err_bt_coex_state:
+        device_remove_file(&wl->plat_dev->dev, &dev_attr_bt_coex_state);
+
 err_platform:
         platform_device_unregister(wl->plat_dev);
 
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 65dd502eab0d..6449fe3d128f 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -1307,7 +1307,7 @@ static void wl3501_tx_timeout(struct net_device *dev)
                 printk(KERN_ERR "%s: Error %d resetting card on Tx timeout!\n",
                        dev->name, rc);
         else {
-                dev->trans_start = jiffies;
+                dev->trans_start = jiffies; /* prevent tx timeout */
                 netif_wake_queue(dev);
         }
 }
@@ -1326,7 +1326,6 @@ static netdev_tx_t wl3501_hard_start_xmit(struct sk_buff *skb,
 
         spin_lock_irqsave(&this->lock, flags);
         enabled = wl3501_block_interrupt(this);
-        dev->trans_start = jiffies;
         rc = wl3501_send_pkt(this, skb->data, skb->len);
         if (enabled)
                 wl3501_unblock_interrupt(this);
@@ -1453,8 +1452,6 @@ static void wl3501_detach(struct pcmcia_device *link)
 
         if (link->priv)
                 free_netdev(link->priv);
-
-        return;
 }
 
 static int wl3501_get_name(struct net_device *dev, struct iw_request_info *info,
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index 1e2b684f8ed4..390d77f762c4 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -134,7 +134,6 @@ static void zd1201_usbfree(struct urb *urb)
 
         kfree(urb->transfer_buffer);
         usb_free_urb(urb);
-        return;
 }
 
 /* cmdreq message: 
@@ -185,7 +184,6 @@ static void zd1201_usbtx(struct urb *urb)
 {
         struct zd1201 *zd = urb->context;
         netif_wake_queue(zd->dev);
-        return;
 }
 
 /* Incoming data */
@@ -407,7 +405,6 @@ exit:
                 wake_up(&zd->rxdataq);
                 kfree(urb->transfer_buffer);
         }
-        return;
 }
 
 static int zd1201_getconfig(struct zd1201 *zd, int rid, void *riddata,
@@ -827,7 +824,6 @@ static netdev_tx_t zd1201_hard_start_xmit(struct sk_buff *skb,
         } else {
                 dev->stats.tx_packets++;
                 dev->stats.tx_bytes += skb->len;
-                dev->trans_start = jiffies;
         }
         kfree_skb(skb);
 
@@ -845,7 +841,7 @@ static void zd1201_tx_timeout(struct net_device *dev)
         usb_unlink_urb(zd->tx_urb);
         dev->stats.tx_errors++;
         /* Restart the timeout to quiet the watchdog: */
-        dev->trans_start = jiffies;
+        dev->trans_start = jiffies; /* prevent tx timeout */
 }
 
 static int zd1201_set_mac_address(struct net_device *dev, void *p)