109 files changed, 3199 insertions, 1892 deletions
diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index 39410016b4ff..e1f04bb437e3 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -1400,15 +1400,15 @@ static void adm8211_configure_filter(struct ieee80211_hw *dev,
 }
 static int adm8211_add_interface(struct ieee80211_hw *dev,
-                                 struct ieee80211_if_init_conf *conf)
+                                 struct ieee80211_vif *vif)
 {
        struct adm8211_priv *priv = dev->priv;
        if (priv->mode != NL80211_IFTYPE_MONITOR)
                return -EOPNOTSUPP;
-        switch (conf->type) {
+        switch (vif->type) {
        case NL80211_IFTYPE_STATION:
-                priv->mode = conf->type;
+                priv->mode = vif->type;
                break;
        default:
                return -EOPNOTSUPP;
@@ -1416,8 +1416,8 @@ static int adm8211_add_interface(struct ieee80211_hw *dev,
        ADM8211_IDLE();
-        ADM8211_CSR_WRITE(PAR0, le32_to_cpu(*(__le32 *)conf->mac_addr));
+        ADM8211_CSR_WRITE(PAR0, le32_to_cpu(*(__le32 *)vif->addr));
-        ADM8211_CSR_WRITE(PAR1, le16_to_cpu(*(__le16 *)(conf->mac_addr + 4)));
+        ADM8211_CSR_WRITE(PAR1, le16_to_cpu(*(__le16 *)(vif->addr + 4)));
        adm8211_update_mode(dev);
@@ -1427,7 +1427,7 @@ static int adm8211_add_interface(struct ieee80211_hw *dev,
 }
 static void adm8211_remove_interface(struct ieee80211_hw *dev,
-                                     struct ieee80211_if_init_conf *conf)
+                                     struct ieee80211_vif *vif)
 {
        struct adm8211_priv *priv = dev->priv;
        priv->mode = NL80211_IFTYPE_MONITOR;
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 2517364d3ebe..0fb419936dff 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -1789,7 +1789,7 @@ static void at76_mac80211_stop(struct ieee80211_hw *hw)
 }
 static int at76_add_interface(struct ieee80211_hw *hw,
-                              struct ieee80211_if_init_conf *conf)
+                              struct ieee80211_vif *vif)
 {
        struct at76_priv *priv = hw->priv;
        int ret = 0;
@@ -1798,7 +1798,7 @@ static int at76_add_interface(struct ieee80211_hw *hw,
        mutex_lock(&priv->mtx);
-        switch (conf->type) {
+        switch (vif->type) {
        case NL80211_IFTYPE_STATION:
                priv->iw_mode = IW_MODE_INFRA;
                break;
@@ -1814,7 +1814,7 @@ exit:
 }
 static void at76_remove_interface(struct ieee80211_hw *hw,
-                                  struct ieee80211_if_init_conf *conf)
+                                  struct ieee80211_vif *vif)
 {
        at76_dbg(DBG_MAC80211, "%s()", __func__);
 }
diff --git a/drivers/net/wireless/ath/ar9170/ar9170.h b/drivers/net/wireless/ath/ar9170/ar9170.h
index 9f9459860d82..b99a8c2053d8 100644
--- a/drivers/net/wireless/ath/ar9170/ar9170.h
+++ b/drivers/net/wireless/ath/ar9170/ar9170.h
@@ -109,7 +109,6 @@ struct ar9170_rxstream_mpdu_merge {
        bool has_plcp;
 };
-#define AR9170_NUM_MAX_BA_RETRY 5
 #define AR9170_NUM_TID  16
 #define WME_BA_BMP_SIZE         64
 #define AR9170_NUM_MAX_AGG_LEN  (2 * WME_BA_BMP_SIZE)
@@ -143,7 +142,6 @@ struct ar9170_sta_tid {
        u16 tid;
        enum ar9170_tid_state state;
        bool active;
-        u8 retry;
 };
 #define AR9170_QUEUE_TIMEOUT            64
@@ -154,6 +152,8 @@ struct ar9170_sta_tid {
 #define AR9170_NUM_TX_STATUS            128
 #define AR9170_NUM_TX_AGG_MAX           30
+#define AR9170_NUM_TX_LIMIT_HARD       AR9170_TXQ_DEPTH
+#define AR9170_NUM_TX_LIMIT_SOFT       (AR9170_TXQ_DEPTH - 10)
 struct ar9170 {
        struct ieee80211_hw *hw;
@@ -248,13 +248,8 @@ struct ar9170_sta_info {
        unsigned int ampdu_max_len;
 };
-#define AR9170_TX_FLAG_WAIT_FOR_ACK     BIT(0)
-#define AR9170_TX_FLAG_NO_ACK           BIT(1)
-#define AR9170_TX_FLAG_BLOCK_ACK        BIT(2)
 struct ar9170_tx_info {
        unsigned long timeout;
-        unsigned int flags;
 };
 #define IS_STARTED(a)           (((struct ar9170 *)a)->state >= AR9170_STARTED)
diff --git a/drivers/net/wireless/ath/ar9170/hw.h b/drivers/net/wireless/ath/ar9170/hw.h
index 701ddb7d8400..0a1d4c28e68a 100644
--- a/drivers/net/wireless/ath/ar9170/hw.h
+++ b/drivers/net/wireless/ath/ar9170/hw.h
@@ -276,6 +276,7 @@ struct ar9170_tx_control {
 #define AR9170_TX_MAC_RATE_PROBE                0x8000
 /* either-or */
+#define AR9170_TX_PHY_MOD_MASK                  0x00000003
 #define AR9170_TX_PHY_MOD_CCK                   0x00000000
 #define AR9170_TX_PHY_MOD_OFDM                  0x00000001
 #define AR9170_TX_PHY_MOD_HT                    0x00000002
diff --git a/drivers/net/wireless/ath/ar9170/mac.c b/drivers/net/wireless/ath/ar9170/mac.c
index ddc8c09dc79e..857e86104295 100644
--- a/drivers/net/wireless/ath/ar9170/mac.c
+++ b/drivers/net/wireless/ath/ar9170/mac.c
@@ -117,7 +117,7 @@ int ar9170_set_qos(struct ar9170 *ar)
        ar9170_regwrite(AR9170_MAC_REG_AC1_AC0_TXOP,
                        ar->edcf[0].txop | ar->edcf[1].txop << 16);
        ar9170_regwrite(AR9170_MAC_REG_AC3_AC2_TXOP,
-                        ar->edcf[1].txop | ar->edcf[3].txop << 16);
+                        ar->edcf[2].txop | ar->edcf[3].txop << 16);
        ar9170_regwrite_finish();
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index f9d6db8d013e..4d27f7f67c76 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -194,12 +194,15 @@ static inline u16 ar9170_get_seq(struct sk_buff *skb)
        return ar9170_get_seq_h((void *) txc->frame_data);
 }
+static inline u16 ar9170_get_tid_h(struct ieee80211_hdr *hdr)
+{
+        return (ieee80211_get_qos_ctl(hdr))[0] & IEEE80211_QOS_CTL_TID_MASK;
+}
 static inline u16 ar9170_get_tid(struct sk_buff *skb)
 {
        struct ar9170_tx_control *txc = (void *) skb->data;
-        struct ieee80211_hdr *hdr = (void *) txc->frame_data;
+        return ar9170_get_tid_h((struct ieee80211_hdr *) txc->frame_data);
-        return (ieee80211_get_qos_ctl(hdr))[0] & IEEE80211_QOS_CTL_TID_MASK;
 }
 #define GET_NEXT_SEQ(seq)       ((seq + 1) & 0x0fff)
@@ -213,10 +216,10 @@ static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
        struct ar9170_tx_info *arinfo = (void *) txinfo->rate_driver_data;
        struct ieee80211_hdr *hdr = (void *) txc->frame_data;
-        printk(KERN_DEBUG "%s: => FRAME [skb:%p, q:%d, DA:[%pM] flags:%x s:%d "
+        printk(KERN_DEBUG "%s: => FRAME [skb:%p, q:%d, DA:[%pM] s:%d "
                          "mac_ctrl:%04x, phy_ctrl:%08x, timeout:[%d ms]]\n",
               wiphy_name(ar->hw->wiphy), skb, skb_get_queue_mapping(skb),
-               ieee80211_get_DA(hdr), arinfo->flags, ar9170_get_seq_h(hdr),
+               ieee80211_get_DA(hdr), ar9170_get_seq_h(hdr),
               le16_to_cpu(txc->mac_control), le32_to_cpu(txc->phy_control),
               jiffies_to_msecs(arinfo->timeout - jiffies));
 }
@@ -430,7 +433,7 @@ void ar9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb)
        spin_lock_irqsave(&ar->tx_stats_lock, flags);
        ar->tx_stats[queue].len--;
-        if (skb_queue_empty(&ar->tx_pending[queue])) {
+        if (ar->tx_stats[queue].len < AR9170_NUM_TX_LIMIT_SOFT) {
 #ifdef AR9170_QUEUE_STOP_DEBUG
                printk(KERN_DEBUG "%s: wake queue %d\n",
                       wiphy_name(ar->hw->wiphy), queue);
@@ -440,22 +443,17 @@ void ar9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb)
        }
        spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
-        if (arinfo->flags & AR9170_TX_FLAG_BLOCK_ACK) {
+        if (info->flags & IEEE80211_TX_CTL_NO_ACK) {
-                ar9170_tx_ampdu_callback(ar, skb);
-        } else if (arinfo->flags & AR9170_TX_FLAG_WAIT_FOR_ACK) {
-                arinfo->timeout = jiffies +
-                                  msecs_to_jiffies(AR9170_TX_TIMEOUT);
-                skb_queue_tail(&ar->tx_status[queue], skb);
-        } else if (arinfo->flags & AR9170_TX_FLAG_NO_ACK) {
                ar9170_tx_status(ar, skb, AR9170_TX_STATUS_FAILED);
        } else {
-#ifdef AR9170_QUEUE_DEBUG
+                if (info->flags & IEEE80211_TX_CTL_AMPDU) {
-                printk(KERN_DEBUG "%s: unsupported frame flags!\n",
+                        ar9170_tx_ampdu_callback(ar, skb);
-                       wiphy_name(ar->hw->wiphy));
+                } else {
-                ar9170_print_txheader(ar, skb);
+                        arinfo->timeout = jiffies +
-#endif /* AR9170_QUEUE_DEBUG */
+                                  msecs_to_jiffies(AR9170_TX_TIMEOUT);
-                dev_kfree_skb_any(skb);
+                        skb_queue_tail(&ar->tx_status[queue], skb);
+                }
        }
        if (!ar->tx_stats[queue].len &&
@@ -1407,17 +1405,6 @@ static int ar9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
             (is_valid_ether_addr(ieee80211_get_DA(hdr)))) {
-                if (info->flags & IEEE80211_TX_CTL_AMPDU) {
-                        if (unlikely(!info->control.sta))
-                                goto err_out;
-                        txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
-                        arinfo->flags = AR9170_TX_FLAG_BLOCK_ACK;
-                        goto out;
-                }
-                txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
                /*
                 * WARNING:
                 * Putting the QoS queue bits into an unexplored territory is
@@ -1431,12 +1418,17 @@ static int ar9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
                txc->phy_control |=
                        cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
-                arinfo->flags = AR9170_TX_FLAG_WAIT_FOR_ACK;
-        } else {
+                if (info->flags & IEEE80211_TX_CTL_AMPDU) {
-                arinfo->flags = AR9170_TX_FLAG_NO_ACK;
+                        if (unlikely(!info->control.sta))
+                                goto err_out;
+                        txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
+                } else {
+                        txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
+                }
        }
-out:
        return 0;
 err_out:
@@ -1671,8 +1663,7 @@ static bool ar9170_tx_ampdu(struct ar9170 *ar)
                 * tell the FW/HW that this is the last frame,
                 * that way it will wait for the immediate block ack.
                 */
-                if (likely(skb_peek_tail(&agg)))
+                ar9170_tx_indicate_immba(ar, skb_peek_tail(&agg));
-                        ar9170_tx_indicate_immba(ar, skb_peek_tail(&agg));
 #ifdef AR9170_TXAGG_DEBUG
                printk(KERN_DEBUG "%s: generated A-MPDU looks like this:\n",
@@ -1716,6 +1707,21 @@ static void ar9170_tx(struct ar9170 *ar)
        for (i = 0; i < __AR9170_NUM_TXQ; i++) {
                spin_lock_irqsave(&ar->tx_stats_lock, flags);
+                frames = min(ar->tx_stats[i].limit - ar->tx_stats[i].len,
+                             skb_queue_len(&ar->tx_pending[i]));
+                if (remaining_space < frames) {
+#ifdef AR9170_QUEUE_DEBUG
+                        printk(KERN_DEBUG "%s: tx quota reached queue:%d, "
+                               "remaining slots:%d, needed:%d\n",
+                               wiphy_name(ar->hw->wiphy), i, remaining_space,
+                               frames);
+#endif /* AR9170_QUEUE_DEBUG */
+                        frames = remaining_space;
+                }
+                ar->tx_stats[i].len += frames;
+                ar->tx_stats[i].count += frames;
                if (ar->tx_stats[i].len >= ar->tx_stats[i].limit) {
 #ifdef AR9170_QUEUE_DEBUG
                        printk(KERN_DEBUG "%s: queue %d full\n",
@@ -1733,25 +1739,8 @@ static void ar9170_tx(struct ar9170 *ar)
                        __ar9170_dump_txstats(ar);
 #endif /* AR9170_QUEUE_STOP_DEBUG */
                        ieee80211_stop_queue(ar->hw, i);
-                        spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
-                        continue;
                }
-                frames = min(ar->tx_stats[i].limit - ar->tx_stats[i].len,
-                             skb_queue_len(&ar->tx_pending[i]));
-                if (remaining_space < frames) {
-#ifdef AR9170_QUEUE_DEBUG
-                        printk(KERN_DEBUG "%s: tx quota reached queue:%d, "
-                               "remaining slots:%d, needed:%d\n",
-                               wiphy_name(ar->hw->wiphy), i, remaining_space,
-                               frames);
-#endif /* AR9170_QUEUE_DEBUG */
-                        frames = remaining_space;
-                }
-                ar->tx_stats[i].len += frames;
-                ar->tx_stats[i].count += frames;
                spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
                if (!frames)
@@ -1773,7 +1762,7 @@ static void ar9170_tx(struct ar9170 *ar)
                        arinfo->timeout = jiffies +
                                          msecs_to_jiffies(AR9170_TX_TIMEOUT);
-                        if (arinfo->flags == AR9170_TX_FLAG_BLOCK_ACK)
+                        if (info->flags & IEEE80211_TX_CTL_AMPDU)
                                atomic_inc(&ar->tx_ampdu_pending);
 #ifdef AR9170_QUEUE_DEBUG
@@ -1784,7 +1773,7 @@ static void ar9170_tx(struct ar9170 *ar)
                        err = ar->tx(ar, skb);
                        if (unlikely(err)) {
-                                if (arinfo->flags == AR9170_TX_FLAG_BLOCK_ACK)
+                                if (info->flags & IEEE80211_TX_CTL_AMPDU)
                                        atomic_dec(&ar->tx_ampdu_pending);
                                frames_failed++;
@@ -1950,7 +1939,7 @@ err_free:
 }
 static int ar9170_op_add_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_if_init_conf *conf)
+                                   struct ieee80211_vif *vif)
 {
        struct ar9170 *ar = hw->priv;
        struct ath_common *common = &ar->common;
@@ -1963,8 +1952,8 @@ static int ar9170_op_add_interface(struct ieee80211_hw *hw,
                goto unlock;
        }
-        ar->vif = conf->vif;
+        ar->vif = vif;
-        memcpy(common->macaddr, conf->mac_addr, ETH_ALEN);
+        memcpy(common->macaddr, vif->addr, ETH_ALEN);
        if (modparam_nohwcrypt || (ar->vif->type != NL80211_IFTYPE_STATION)) {
                ar->rx_software_decryption = true;
@@ -1984,7 +1973,7 @@ unlock:
 }
 static void ar9170_op_remove_interface(struct ieee80211_hw *hw,
-                                       struct ieee80211_if_init_conf *conf)
+                                       struct ieee80211_vif *vif)
 {
        struct ar9170 *ar = hw->priv;
@@ -2366,7 +2355,6 @@ static void ar9170_sta_notify(struct ieee80211_hw *hw,
                        sta_info->agg[i].state = AR9170_TID_STATE_SHUTDOWN;
                        sta_info->agg[i].active = false;
                        sta_info->agg[i].ssn = 0;
-                        sta_info->agg[i].retry = 0;
                        sta_info->agg[i].tid = i;
                        INIT_LIST_HEAD(&sta_info->agg[i].list);
                        skb_queue_head_init(&sta_info->agg[i].queue);
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index e0799d924057..0f361186b78f 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -84,6 +84,8 @@ static struct usb_device_id ar9170_usb_ids[] = {
        { USB_DEVICE(0x0cde, 0x0023) },
        /* Z-Com UB82 ABG */
        { USB_DEVICE(0x0cde, 0x0026) },
+        /* Sphairon Homelink 1202 */
+        { USB_DEVICE(0x0cde, 0x0027) },
        /* Arcadyan WN7512 */
        { USB_DEVICE(0x083a, 0xf522) },
        /* Planex GWUS300 */
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index e63b7c40d0ee..fdfaf0f618f1 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -225,9 +225,9 @@ static int ath5k_reset_wake(struct ath5k_softc *sc);
 static int ath5k_start(struct ieee80211_hw *hw);
 static void ath5k_stop(struct ieee80211_hw *hw);
 static int ath5k_add_interface(struct ieee80211_hw *hw,
-                struct ieee80211_if_init_conf *conf);
+                struct ieee80211_vif *vif);
 static void ath5k_remove_interface(struct ieee80211_hw *hw,
-                struct ieee80211_if_init_conf *conf);
+                struct ieee80211_vif *vif);
 static int ath5k_config(struct ieee80211_hw *hw, u32 changed);
 static u64 ath5k_prepare_multicast(struct ieee80211_hw *hw,
                                   int mc_count, struct dev_addr_list *mc_list);
@@ -2773,7 +2773,7 @@ static void ath5k_stop(struct ieee80211_hw *hw)
 }
 static int ath5k_add_interface(struct ieee80211_hw *hw,
-                struct ieee80211_if_init_conf *conf)
+                struct ieee80211_vif *vif)
 {
        struct ath5k_softc *sc = hw->priv;
        int ret;
@@ -2784,22 +2784,22 @@ static int ath5k_add_interface(struct ieee80211_hw *hw,
                goto end;
        }
-        sc->vif = conf->vif;
+        sc->vif = vif;
-        switch (conf->type) {
+        switch (vif->type) {
        case NL80211_IFTYPE_AP:
        case NL80211_IFTYPE_STATION:
        case NL80211_IFTYPE_ADHOC:
        case NL80211_IFTYPE_MESH_POINT:
        case NL80211_IFTYPE_MONITOR:
-                sc->opmode = conf->type;
+                sc->opmode = vif->type;
                break;
        default:
                ret = -EOPNOTSUPP;
                goto end;
        }
-        ath5k_hw_set_lladdr(sc->ah, conf->mac_addr);
+        ath5k_hw_set_lladdr(sc->ah, vif->addr);
        ath5k_mode_setup(sc);
        ret = 0;
@@ -2810,13 +2810,13 @@ end:
 static void
 ath5k_remove_interface(struct ieee80211_hw *hw,
-                        struct ieee80211_if_init_conf *conf)
+                        struct ieee80211_vif *vif)
 {
        struct ath5k_softc *sc = hw->priv;
        u8 mac[ETH_ALEN] = {};
        mutex_lock(&sc->lock);
-        if (sc->vif != conf->vif)
+        if (sc->vif != vif)
                goto end;
        ath5k_hw_set_lladdr(sc->ah, mac);
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 1597a42731ed..9efebac5ed0e 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -453,7 +453,6 @@ struct ath_softc {
        int irq;
        spinlock_t sc_resetlock;
        spinlock_t sc_serial_rw;
-        spinlock_t ani_lock;
        spinlock_t sc_pm_lock;
        struct mutex mutex;
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index b66f72dbf7b9..592f1b70f55a 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -289,23 +289,49 @@ static ssize_t read_file_rcstat(struct file *file, char __user *user_buf,
        if (sc->cur_rate_table == NULL)
                return 0;
-        max = 80 + sc->cur_rate_table->rate_cnt * 64;
+        max = 80 + sc->cur_rate_table->rate_cnt * 1024;
        buf = kmalloc(max + 1, GFP_KERNEL);
        if (buf == NULL)
                return 0;
        buf[max] = 0;
-        len += sprintf(buf, "%5s %15s %8s %9s %3s\n\n", "Rate", "Success",
+        len += sprintf(buf, "%6s %6s %6s "
-                       "Retries", "XRetries", "PER");
+                       "%10s %10s %10s %10s\n",
+                       "HT", "MCS", "Rate",
+                       "Success", "Retries", "XRetries", "PER");
        for (i = 0; i < sc->cur_rate_table->rate_cnt; i++) {
                u32 ratekbps = sc->cur_rate_table->info[i].ratekbps;
                struct ath_rc_stats *stats = &sc->debug.stats.rcstats[i];
+                char mcs[5];
+                char htmode[5];
+                int used_mcs = 0, used_htmode = 0;
+                if (WLAN_RC_PHY_HT(sc->cur_rate_table->info[i].phy)) {
+                        used_mcs = snprintf(mcs, 5, "%d",
+                                sc->cur_rate_table->info[i].ratecode);
+                        if (WLAN_RC_PHY_40(sc->cur_rate_table->info[i].phy))
+                                used_htmode = snprintf(htmode, 5, "HT40");
+                        else if (WLAN_RC_PHY_20(sc->cur_rate_table->info[i].phy))
+                                used_htmode = snprintf(htmode, 5, "HT20");
+                        else
+                                used_htmode = snprintf(htmode, 5, "????");
+                }
+                mcs[used_mcs] = '\0';
+                htmode[used_htmode] = '\0';
                len += snprintf(buf + len, max - len,
-                        "%3u.%d: %8u %8u %8u %8u\n", ratekbps / 1000,
+                        "%6s %6s %3u.%d: "
-                        (ratekbps % 1000) / 100, stats->success,
+                        "%10u %10u %10u %10u\n",
-                        stats->retries, stats->xretries,
+                        htmode,
+                        mcs,
+                        ratekbps / 1000,
+                        (ratekbps % 1000) / 100,
+                        stats->success,
+                        stats->retries,
+                        stats->xretries,
                        stats->per);
        }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 2ec61f08cfdb..9474f9f6d400 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -343,30 +343,6 @@ static bool ath9k_hw_chip_test(struct ath_hw *ah)
        return true;
 }
-static const char *ath9k_hw_devname(u16 devid)
-{
-        switch (devid) {
-        case AR5416_DEVID_PCI:
-                return "Atheros 5416";
-        case AR5416_DEVID_PCIE:
-                return "Atheros 5418";
-        case AR9160_DEVID_PCI:
-                return "Atheros 9160";
-        case AR5416_AR9100_DEVID:
-                return "Atheros 9100";
-        case AR9280_DEVID_PCI:
-        case AR9280_DEVID_PCIE:
-                return "Atheros 9280";
-        case AR9285_DEVID_PCIE:
-                return "Atheros 9285";
-        case AR5416_DEVID_AR9287_PCI:
-        case AR5416_DEVID_AR9287_PCIE:
-                return "Atheros 9287";
-        }
-        return NULL;
-}
 static void ath9k_hw_init_config(struct ath_hw *ah)
 {
        int i;
@@ -392,7 +368,7 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
                ah->config.spurchans[i][1] = AR_NO_SPUR;
        }
-        ah->config.intr_mitigation = true;
+        ah->config.rx_intr_mitigation = true;
        /*
         * We need this for PCI devices only (Cardbus, PCI, miniPCI)
@@ -1184,7 +1160,7 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
                AR_IMR_RXORN |
                AR_IMR_BCNMISC;
-        if (ah->config.intr_mitigation)
+        if (ah->config.rx_intr_mitigation)
                ah->mask_reg |= AR_IMR_RXINTM | AR_IMR_RXMINTR;
        else
                ah->mask_reg |= AR_IMR_RXOK;
@@ -1266,12 +1242,6 @@ static void ath9k_hw_init_user_settings(struct ath_hw *ah)
                ath9k_hw_set_global_txtimeout(ah, ah->globaltxtimeout);
 }
-const char *ath9k_hw_probe(u16 vendorid, u16 devid)
-{
-        return vendorid == ATHEROS_VENDOR_ID ?
-                ath9k_hw_devname(devid) : NULL;
-}
 void ath9k_hw_detach(struct ath_hw *ah)
 {
        struct ath_common *common = ath9k_hw_common(ah);
@@ -2121,7 +2091,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
        REG_WRITE(ah, AR_OBS, 8);
-        if (ah->config.intr_mitigation) {
+        if (ah->config.rx_intr_mitigation) {
                REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_LAST, 500);
                REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_FIRST, 2000);
        }
@@ -2781,7 +2751,7 @@ bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked)
                *masked = isr & ATH9K_INT_COMMON;
-                if (ah->config.intr_mitigation) {
+                if (ah->config.rx_intr_mitigation) {
                        if (isr & (AR_ISR_RXMINTR | AR_ISR_RXINTM))
                                *masked |= ATH9K_INT_RX;
                }
@@ -2914,7 +2884,7 @@ enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
        }
        if (ints & ATH9K_INT_RX) {
                mask |= AR_IMR_RXERR;
-                if (ah->config.intr_mitigation)
+                if (ah->config.rx_intr_mitigation)
                        mask |= AR_IMR_RXMINTR | AR_IMR_RXINTM;
                else
                        mask |= AR_IMR_RXOK | AR_IMR_RXDESC;
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index e2b0c73a616f..8849450dc591 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -212,7 +212,7 @@ struct ath9k_ops_config {
        u32 cck_trig_low;
        u32 enable_ani;
        int serialize_regmode;
-        bool intr_mitigation;
+        bool rx_intr_mitigation;
 #define SPUR_DISABLE            0
 #define SPUR_ENABLE_IOCTL       1
 #define SPUR_ENABLE_EEPROM      2
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 996eb90263cc..79fbbda15493 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -363,14 +363,6 @@ static void ath_ani_calibrate(unsigned long data)
        short_cal_interval = (ah->opmode == NL80211_IFTYPE_AP) ?
                ATH_AP_SHORT_CALINTERVAL : ATH_STA_SHORT_CALINTERVAL;
-        /*
-        * don't calibrate when we're scanning.
-        * we are most likely not on our home channel.
-        */
-        spin_lock(&sc->ani_lock);
-        if (sc->sc_flags & SC_OP_SCANNING)
-                goto set_timer;
        /* Only calibrate if awake */
        if (sc->sc_ah->power_mode != ATH9K_PM_AWAKE)
                goto set_timer;
@@ -437,7 +429,6 @@ static void ath_ani_calibrate(unsigned long data)
        ath9k_ps_restore(sc);
 set_timer:
-        spin_unlock(&sc->ani_lock);
        /*
        * Set timer interval based on previous results.
        * The interval must be the shortest necessary to satisfy ANI,
@@ -1610,7 +1601,6 @@ static int ath_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
        spin_lock_init(&sc->wiphy_lock);
        spin_lock_init(&sc->sc_resetlock);
        spin_lock_init(&sc->sc_serial_rw);
-        spin_lock_init(&sc->ani_lock);
        spin_lock_init(&sc->sc_pm_lock);
        mutex_init(&sc->mutex);
        tasklet_init(&sc->intr_tq, ath9k_tasklet, (unsigned long)sc);
@@ -2550,12 +2540,12 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 }
 static int ath9k_add_interface(struct ieee80211_hw *hw,
-                               struct ieee80211_if_init_conf *conf)
+                               struct ieee80211_vif *vif)
 {
        struct ath_wiphy *aphy = hw->priv;
        struct ath_softc *sc = aphy->sc;
        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_vif *avp = (void *)conf->vif->drv_priv;
+        struct ath_vif *avp = (void *)vif->drv_priv;
        enum nl80211_iftype ic_opmode = NL80211_IFTYPE_UNSPECIFIED;
        int ret = 0;
@@ -2567,7 +2557,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                goto out;
        }
-        switch (conf->type) {
+        switch (vif->type) {
        case NL80211_IFTYPE_STATION:
                ic_opmode = NL80211_IFTYPE_STATION;
                break;
@@ -2578,11 +2568,11 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                        ret = -ENOBUFS;
                        goto out;
                }
-                ic_opmode = conf->type;
+                ic_opmode = vif->type;
                break;
        default:
                ath_print(common, ATH_DBG_FATAL,
-                        "Interface type %d not yet supported\n", conf->type);
+                        "Interface type %d not yet supported\n", vif->type);
                ret = -EOPNOTSUPP;
                goto out;
        }
@@ -2614,18 +2604,18 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         * Enable MIB interrupts when there are hardware phy counters.
         * Note we only do this (at the moment) for station mode.
         */
-        if ((conf->type == NL80211_IFTYPE_STATION) ||
+        if ((vif->type == NL80211_IFTYPE_STATION) ||
-            (conf->type == NL80211_IFTYPE_ADHOC) ||
+            (vif->type == NL80211_IFTYPE_ADHOC) ||
-            (conf->type == NL80211_IFTYPE_MESH_POINT)) {
+            (vif->type == NL80211_IFTYPE_MESH_POINT)) {
                sc->imask |= ATH9K_INT_MIB;
                sc->imask |= ATH9K_INT_TSFOOR;
        }
        ath9k_hw_set_interrupts(sc->sc_ah, sc->imask);
-        if (conf->type == NL80211_IFTYPE_AP    ||
+        if (vif->type == NL80211_IFTYPE_AP    ||
-            conf->type == NL80211_IFTYPE_ADHOC ||
+            vif->type == NL80211_IFTYPE_ADHOC ||
-            conf->type == NL80211_IFTYPE_MONITOR)
+            vif->type == NL80211_IFTYPE_MONITOR)
                ath_start_ani(common);
 out:
@@ -2634,12 +2624,12 @@ out:
 }
 static void ath9k_remove_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_if_init_conf *conf)
+                                   struct ieee80211_vif *vif)
 {
        struct ath_wiphy *aphy = hw->priv;
        struct ath_softc *sc = aphy->sc;
        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_vif *avp = (void *)conf->vif->drv_priv;
+        struct ath_vif *avp = (void *)vif->drv_priv;
        int i;
        ath_print(common, ATH_DBG_CONFIG, "Detach Interface\n");
@@ -2662,7 +2652,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
        sc->sc_flags &= ~SC_OP_BEACONS;
        for (i = 0; i < ARRAY_SIZE(sc->beacon.bslot); i++) {
-                if (sc->beacon.bslot[i] == conf->vif) {
+                if (sc->beacon.bslot[i] == vif) {
                        printk(KERN_DEBUG "%s: vif had allocated beacon "
                               "slot\n", __func__);
                        sc->beacon.bslot[i] = NULL;
@@ -3133,6 +3123,7 @@ static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
 {
        struct ath_wiphy *aphy = hw->priv;
        struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
        mutex_lock(&sc->mutex);
        if (ath9k_wiphy_scanning(sc)) {
@@ -3148,10 +3139,9 @@ static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
        aphy->state = ATH_WIPHY_SCAN;
        ath9k_wiphy_pause_all_forced(sc, aphy);
-        spin_lock_bh(&sc->ani_lock);
        sc->sc_flags |= SC_OP_SCANNING;
-        spin_unlock_bh(&sc->ani_lock);
+        del_timer_sync(&common->ani.timer);
+        cancel_delayed_work_sync(&sc->tx_complete_work);
        mutex_unlock(&sc->mutex);
 }
@@ -3159,13 +3149,14 @@ static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
 {
        struct ath_wiphy *aphy = hw->priv;
        struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
        mutex_lock(&sc->mutex);
-        spin_lock_bh(&sc->ani_lock);
        aphy->state = ATH_WIPHY_ACTIVE;
        sc->sc_flags &= ~SC_OP_SCANNING;
        sc->sc_flags |= SC_OP_FULL_RESET;
-        spin_unlock_bh(&sc->ani_lock);
+        ath_start_ani(common);
+        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
        ath_beacon_config(sc, NULL);
        mutex_unlock(&sc->mutex);
 }
diff --git a/drivers/net/wireless/ath/ath9k/rc.h b/drivers/net/wireless/ath/ath9k/rc.h
index 9eb96f506998..4f6d6fd442f4 100644
--- a/drivers/net/wireless/ath/ath9k/rc.h
+++ b/drivers/net/wireless/ath/ath9k/rc.h
@@ -57,6 +57,10 @@ enum {
                                || (_phy == WLAN_RC_PHY_HT_40_DS)       \
                                || (_phy == WLAN_RC_PHY_HT_20_DS_HGI)   \
                                || (_phy == WLAN_RC_PHY_HT_40_DS_HGI))
+#define WLAN_RC_PHY_20(_phy)   ((_phy == WLAN_RC_PHY_HT_20_SS)          \
+                                || (_phy == WLAN_RC_PHY_HT_20_DS)       \
+                                || (_phy == WLAN_RC_PHY_HT_20_SS_HGI)   \
+                                || (_phy == WLAN_RC_PHY_HT_20_DS_HGI))
 #define WLAN_RC_PHY_40(_phy)   ((_phy == WLAN_RC_PHY_HT_40_SS)          \
                                || (_phy == WLAN_RC_PHY_HT_40_DS)       \
                                || (_phy == WLAN_RC_PHY_HT_40_SS_HGI)   \
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 64c12e1bced3..073be566d05e 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -3,6 +3,7 @@ config B43
        depends on SSB_POSSIBLE && MAC80211 && HAS_DMA
        select SSB
        select FW_LOADER
+        select SSB_BLOCKIO
        ---help---
          b43 is a driver for the Broadcom 43xx series wireless devices.
@@ -78,14 +79,6 @@ config B43_SDIO
          If unsure, say N.
-# Data transfers to the device via PIO
-# This is only needed on PCMCIA and SDIO devices. All others can do DMA properly.
-config B43_PIO
-        bool
-        depends on B43 && (B43_SDIO || B43_PCMCIA || B43_FORCE_PIO)
-        select SSB_BLOCKIO
-        default y
 config B43_NPHY
        bool "Pre IEEE 802.11n support (BROKEN)"
        depends on B43 && EXPERIMENTAL && BROKEN
@@ -137,12 +130,4 @@ config B43_DEBUG
          for production use.
          Only say Y, if you are debugging a problem in the b43 driver sourcecode.
-config B43_FORCE_PIO
-        bool "Force usage of PIO instead of DMA"
-        depends on B43 && B43_DEBUG
-        ---help---
-          This will disable DMA and always enable PIO instead.
-          Say N!
-          This is only for debugging the PIO engine code. You do
-          _NOT_ want to enable this.
diff --git a/drivers/net/wireless/b43/Makefile b/drivers/net/wireless/b43/Makefile
index 84772a2542dc..5e83b6f0a3a0 100644
--- a/drivers/net/wireless/b43/Makefile
+++ b/drivers/net/wireless/b43/Makefile
@@ -12,7 +12,7 @@ b43-y				+= xmit.o
 b43-y                           += lo.o
 b43-y                           += wa.o
 b43-y                           += dma.o
-b43-$(CONFIG_B43_PIO)           += pio.o
+b43-y                           += pio.o
 b43-y                           += rfkill.o
 b43-$(CONFIG_B43_LEDS)          += leds.o
 b43-$(CONFIG_B43_PCMCIA)        += pcmcia.o
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index fe3bf9491997..2f12a750bc98 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -821,11 +821,9 @@ struct b43_wl {
        /* The device LEDs. */
        struct b43_leds leds;
-#ifdef CONFIG_B43_PIO
        /* Kmalloc'ed scratch space for PIO TX/RX. Protected by wl->mutex. */
        u8 pio_scratchspace[110] __attribute__((__aligned__(8)));
        u8 pio_tailspace[4] __attribute__((__aligned__(8)));
-#endif /* CONFIG_B43_PIO */
 };
 static inline struct b43_wl *hw_to_b43_wl(struct ieee80211_hw *hw)
@@ -876,20 +874,9 @@ static inline void b43_write32(struct b43_wldev *dev, u16 offset, u32 value)
 static inline bool b43_using_pio_transfers(struct b43_wldev *dev)
 {
-#ifdef CONFIG_B43_PIO
        return dev->__using_pio_transfers;
-#else
-        return 0;
-#endif
 }
-#ifdef CONFIG_B43_FORCE_PIO
-# define B43_FORCE_PIO  1
-#else
-# define B43_FORCE_PIO  0
-#endif
 /* Message printing */
 void b43info(struct b43_wl *wl, const char *fmt, ...)
    __attribute__ ((format(printf, 2, 3)));
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 88d1fd02d40a..615af22c49fd 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1653,7 +1653,6 @@ void b43_dma_tx_resume(struct b43_wldev *dev)
        b43_power_saving_ctl_bits(dev, 0);
 }
-#ifdef CONFIG_B43_PIO
 static void direct_fifo_rx(struct b43_wldev *dev, enum b43_dmatype type,
                           u16 mmio_base, bool enable)
 {
@@ -1687,4 +1686,3 @@ void b43_dma_direct_fifo_rx(struct b43_wldev *dev,
        mmio_base = b43_dmacontroller_base(type, engine_index);
        direct_fifo_rx(dev, type, mmio_base, enable);
 }
-#endif /* CONFIG_B43_PIO */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 19b4eae47b59..6634a77fc766 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -102,6 +102,9 @@ int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
+static int modparam_pio;
+module_param_named(pio, modparam_pio, int, 0444);
+MODULE_PARM_DESC(pio, "enable(1) / disable(0) PIO mode");
 static const struct ssb_device_id b43_ssb_tbl[] = {
        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
@@ -1786,8 +1789,8 @@ static void b43_do_interrupt_thread(struct b43_wldev *dev)
                               dma_reason[4], dma_reason[5]);
                        b43err(dev->wl, "This device does not support DMA "
                               "on your system. Please use PIO instead.\n");
-                        b43err(dev->wl, "CONFIG_B43_FORCE_PIO must be set in "
+                        b43err(dev->wl, "Unload the b43 module and reload "
-                               "your kernel configuration.\n");
+                               "with 'pio=1'\n");
                        return;
                }
                if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
@@ -4353,7 +4356,7 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
        if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) ||
            (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) ||
-            B43_FORCE_PIO) {
+            modparam_pio) {
                dev->__using_pio_transfers = 1;
                err = b43_pio_init(dev);
        } else {
@@ -4388,7 +4391,7 @@ err_busdown:
 }
 static int b43_op_add_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_if_init_conf *conf)
+                                struct ieee80211_vif *vif)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
        struct b43_wldev *dev;
@@ -4396,24 +4399,24 @@ static int b43_op_add_interface(struct ieee80211_hw *hw,
        /* TODO: allow WDS/AP devices to coexist */
-        if (conf->type != NL80211_IFTYPE_AP &&
+        if (vif->type != NL80211_IFTYPE_AP &&
-            conf->type != NL80211_IFTYPE_MESH_POINT &&
+            vif->type != NL80211_IFTYPE_MESH_POINT &&
-            conf->type != NL80211_IFTYPE_STATION &&
+            vif->type != NL80211_IFTYPE_STATION &&
-            conf->type != NL80211_IFTYPE_WDS &&
+            vif->type != NL80211_IFTYPE_WDS &&
-            conf->type != NL80211_IFTYPE_ADHOC)
+            vif->type != NL80211_IFTYPE_ADHOC)
                return -EOPNOTSUPP;
        mutex_lock(&wl->mutex);
        if (wl->operating)
                goto out_mutex_unlock;
-        b43dbg(wl, "Adding Interface type %d\n", conf->type);
+        b43dbg(wl, "Adding Interface type %d\n", vif->type);
        dev = wl->current_dev;
        wl->operating = 1;
-        wl->vif = conf->vif;
+        wl->vif = vif;
-        wl->if_type = conf->type;
+        wl->if_type = vif->type;
-        memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
+        memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
        b43_adjust_opmode(dev);
        b43_set_pretbtt(dev);
@@ -4428,17 +4431,17 @@ static int b43_op_add_interface(struct ieee80211_hw *hw,
 }
 static void b43_op_remove_interface(struct ieee80211_hw *hw,
-                                    struct ieee80211_if_init_conf *conf)
+                                    struct ieee80211_vif *vif)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
        struct b43_wldev *dev = wl->current_dev;
-        b43dbg(wl, "Removing Interface type %d\n", conf->type);
+        b43dbg(wl, "Removing Interface type %d\n", vif->type);
        mutex_lock(&wl->mutex);
        B43_WARN_ON(!wl->operating);
-        B43_WARN_ON(wl->vif != conf->vif);
+        B43_WARN_ON(wl->vif != vif);
        wl->vif = NULL;
        wl->operating = 0;
diff --git a/drivers/net/wireless/b43/pio.h b/drivers/net/wireless/b43/pio.h
index 7dd649c9ddad..7b3c42f93a16 100644
--- a/drivers/net/wireless/b43/pio.h
+++ b/drivers/net/wireless/b43/pio.h
@@ -55,8 +55,6 @@
 #define B43_PIO_MAX_NR_TXPACKETS        32
-#ifdef CONFIG_B43_PIO
 struct b43_pio_txpacket {
        /* Pointer to the TX queue we belong to. */
        struct b43_pio_txqueue *queue;
@@ -169,42 +167,4 @@ void b43_pio_rx(struct b43_pio_rxqueue *q);
 void b43_pio_tx_suspend(struct b43_wldev *dev);
 void b43_pio_tx_resume(struct b43_wldev *dev);
-#else /* CONFIG_B43_PIO */
-static inline int b43_pio_init(struct b43_wldev *dev)
-{
-        return 0;
-}
-static inline void b43_pio_free(struct b43_wldev *dev)
-{
-}
-static inline void b43_pio_stop(struct b43_wldev *dev)
-{
-}
-static inline int b43_pio_tx(struct b43_wldev *dev,
-                             struct sk_buff *skb)
-{
-        return 0;
-}
-static inline void b43_pio_handle_txstatus(struct b43_wldev *dev,
-                                           const struct b43_txstatus *status)
-{
-}
-static inline void b43_pio_get_tx_stats(struct b43_wldev *dev,
-                                        struct ieee80211_tx_queue_stats *stats)
-{
-}
-static inline void b43_pio_rx(struct b43_pio_rxqueue *q)
-{
-}
-static inline void b43_pio_tx_suspend(struct b43_wldev *dev)
-{
-}
-static inline void b43_pio_tx_resume(struct b43_wldev *dev)
-{
-}
-#endif /* CONFIG_B43_PIO */
 #endif /* B43_PIO_H_ */
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index ab6a18c2e9d9..494017e4fcc9 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3361,7 +3361,7 @@ err_kfree_lo_control:
 }
 static int b43legacy_op_add_interface(struct ieee80211_hw *hw,
-                                      struct ieee80211_if_init_conf *conf)
+                                      struct ieee80211_vif *vif)
 {
        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
        struct b43legacy_wldev *dev;
@@ -3370,23 +3370,23 @@ static int b43legacy_op_add_interface(struct ieee80211_hw *hw,
        /* TODO: allow WDS/AP devices to coexist */
-        if (conf->type != NL80211_IFTYPE_AP &&
+        if (vif->type != NL80211_IFTYPE_AP &&
-            conf->type != NL80211_IFTYPE_STATION &&
+            vif->type != NL80211_IFTYPE_STATION &&
-            conf->type != NL80211_IFTYPE_WDS &&
+            vif->type != NL80211_IFTYPE_WDS &&
-            conf->type != NL80211_IFTYPE_ADHOC)
+            vif->type != NL80211_IFTYPE_ADHOC)
                return -EOPNOTSUPP;
        mutex_lock(&wl->mutex);
        if (wl->operating)
                goto out_mutex_unlock;
-        b43legacydbg(wl, "Adding Interface type %d\n", conf->type);
+        b43legacydbg(wl, "Adding Interface type %d\n", vif->type);
        dev = wl->current_dev;
        wl->operating = 1;
-        wl->vif = conf->vif;
+        wl->vif = vif;
-        wl->if_type = conf->type;
+        wl->if_type = vif->type;
-        memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
+        memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
        spin_lock_irqsave(&wl->irq_lock, flags);
        b43legacy_adjust_opmode(dev);
@@ -3403,18 +3403,18 @@ static int b43legacy_op_add_interface(struct ieee80211_hw *hw,
 }
 static void b43legacy_op_remove_interface(struct ieee80211_hw *hw,
-                                          struct ieee80211_if_init_conf *conf)
+                                          struct ieee80211_vif *vif)
 {
        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
        struct b43legacy_wldev *dev = wl->current_dev;
        unsigned long flags;
-        b43legacydbg(wl, "Removing Interface type %d\n", conf->type);
+        b43legacydbg(wl, "Removing Interface type %d\n", vif->type);
        mutex_lock(&wl->mutex);
        B43legacy_WARN_ON(!wl->operating);
-        B43legacy_WARN_ON(wl->vif != conf->vif);
+        B43legacy_WARN_ON(wl->vif != vif);
        wl->vif = NULL;
        wl->operating = 0;
diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
index ff9b5c882184..d70732819423 100644
--- a/drivers/net/wireless/hostap/hostap_hw.c
+++ b/drivers/net/wireless/hostap/hostap_hw.c
@@ -2618,6 +2618,15 @@ static irqreturn_t prism2_interrupt(int irq, void *dev_id)
        int events = 0;
        u16 ev;
+        /* Detect early interrupt before driver is fully configued */
+        if (!dev->base_addr) {
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "%s: Interrupt, but dev not configured\n",
+                               dev->name);
+                }
+                return IRQ_HANDLED;
+        }
        iface = netdev_priv(dev);
        local = iface->local;
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 8414178bcff4..0db1fda94a65 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -105,6 +105,7 @@ static struct iwl_lib_ops iwl1000_lib = {
        .load_ucode = iwl5000_load_ucode,
        .dump_nic_event_log = iwl_dump_nic_event_log,
        .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
        .init_alive_start = iwl5000_init_alive_start,
        .alive_notify = iwl5000_alive_notify,
        .send_tx_power = iwl5000_send_tx_power,
@@ -140,7 +141,7 @@ static struct iwl_lib_ops iwl1000_lib = {
         },
 };
-static struct iwl_ops iwl1000_ops = {
+static const struct iwl_ops iwl1000_ops = {
        .ucode = &iwl5000_ucode,
        .lib = &iwl1000_lib,
        .hcmd = &iwl5000_hcmd,
@@ -173,7 +174,6 @@ struct iwl_cfg iwl1000_bgn_cfg = {
        .use_rts_for_ht = true, /* use rts/cts protection */
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .support_ct_kill_exit = true,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
 };
 struct iwl_cfg iwl1000_bg_cfg = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 234891d8cc10..28ffe4c826d8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -2804,7 +2804,7 @@ static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
        .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
 };
-static struct iwl_ops iwl3945_ops = {
+static const struct iwl_ops iwl3945_ops = {
        .ucode = &iwl3945_ucode,
        .lib = &iwl3945_lib,
        .hcmd = &iwl3945_hcmd,
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index 531fa125f5a6..3ec2fe370b58 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -226,7 +226,8 @@ extern void iwl3945_rx_replenish(void *data);
 extern void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
 extern unsigned int iwl3945_fill_beacon_frame(struct iwl_priv *priv,
                                        struct ieee80211_hdr *hdr,int left);
-extern void iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log);
+extern int iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
+                                       char **buf, bool display);
 extern void iwl3945_dump_nic_error_log(struct iwl_priv *priv);
 /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 761aab127e7c..cee368d4859f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2208,7 +2208,7 @@ static struct iwl_lib_ops iwl4965_lib = {
        },
 };
-static struct iwl_ops iwl4965_ops = {
+static const struct iwl_ops iwl4965_ops = {
        .ucode = &iwl4965_ucode,
        .lib = &iwl4965_lib,
        .hcmd = &iwl4965_hcmd,
@@ -2239,7 +2239,6 @@ struct iwl_cfg iwl4965_agn_cfg = {
        .broken_powersave = true,
        .led_compensation = 61,
        .chain_noise_num_beacons = IWL4965_CAL_NUM_BEACONS,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
 };
 /* Module firmware */
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 33a5866538e7..ec6b27689fa8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -1466,6 +1466,7 @@ struct iwl_lib_ops iwl5000_lib = {
        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
        .dump_nic_event_log = iwl_dump_nic_event_log,
        .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
        .load_ucode = iwl5000_load_ucode,
        .init_alive_start = iwl5000_init_alive_start,
        .alive_notify = iwl5000_alive_notify,
@@ -1518,6 +1519,7 @@ static struct iwl_lib_ops iwl5150_lib = {
        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
        .dump_nic_event_log = iwl_dump_nic_event_log,
        .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
        .load_ucode = iwl5000_load_ucode,
        .init_alive_start = iwl5000_init_alive_start,
        .alive_notify = iwl5000_alive_notify,
@@ -1555,7 +1557,7 @@ static struct iwl_lib_ops iwl5150_lib = {
         },
 };
-static struct iwl_ops iwl5000_ops = {
+static const struct iwl_ops iwl5000_ops = {
        .ucode = &iwl5000_ucode,
        .lib = &iwl5000_lib,
        .hcmd = &iwl5000_hcmd,
@@ -1563,7 +1565,7 @@ static struct iwl_ops iwl5000_ops = {
        .led = &iwlagn_led_ops,
 };
-static struct iwl_ops iwl5150_ops = {
+static const struct iwl_ops iwl5150_ops = {
        .ucode = &iwl5000_ucode,
        .lib = &iwl5150_lib,
        .hcmd = &iwl5000_hcmd,
@@ -1599,7 +1601,6 @@ struct iwl_cfg iwl5300_agn_cfg = {
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
 };
 struct iwl_cfg iwl5100_bgn_cfg = {
@@ -1668,7 +1669,6 @@ struct iwl_cfg iwl5100_agn_cfg = {
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
 };
 struct iwl_cfg iwl5350_agn_cfg = {
@@ -1692,7 +1692,6 @@ struct iwl_cfg iwl5350_agn_cfg = {
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
 };
 struct iwl_cfg iwl5150_agn_cfg = {
@@ -1716,7 +1715,6 @@ struct iwl_cfg iwl5150_agn_cfg = {
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
 };
 struct iwl_cfg iwl5150_abg_cfg = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 74e571049273..a5a0ed4817a4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -215,6 +215,7 @@ static struct iwl_lib_ops iwl6000_lib = {
        .load_ucode = iwl5000_load_ucode,
        .dump_nic_event_log = iwl_dump_nic_event_log,
        .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
        .init_alive_start = iwl5000_init_alive_start,
        .alive_notify = iwl5000_alive_notify,
        .send_tx_power = iwl5000_send_tx_power,
@@ -252,7 +253,7 @@ static struct iwl_lib_ops iwl6000_lib = {
         },
 };
-static struct iwl_ops iwl6000_ops = {
+static const struct iwl_ops iwl6000_ops = {
        .ucode = &iwl5000_ucode,
        .lib = &iwl6000_lib,
        .hcmd = &iwl5000_hcmd,
@@ -267,7 +268,7 @@ static struct iwl_hcmd_utils_ops iwl6050_hcmd_utils = {
        .calc_rssi = iwl5000_calc_rssi,
 };
-static struct iwl_ops iwl6050_ops = {
+static const struct iwl_ops iwl6050_ops = {
        .ucode = &iwl5000_ucode,
        .lib = &iwl6000_lib,
        .hcmd = &iwl5000_hcmd,
@@ -306,7 +307,6 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
        .supports_idle = true,
        .adv_thermal_throttle = true,
        .support_ct_kill_exit = true,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
 };
 struct iwl_cfg iwl6000i_2abg_cfg = {
@@ -395,7 +395,6 @@ struct iwl_cfg iwl6050_2agn_cfg = {
        .supports_idle = true,
        .adv_thermal_throttle = true,
        .support_ct_kill_exit = true,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DYNAMIC,
 };
 struct iwl_cfg iwl6050_2abg_cfg = {
@@ -455,7 +454,6 @@ struct iwl_cfg iwl6000_3agn_cfg = {
        .supports_idle = true,
        .adv_thermal_throttle = true,
        .support_ct_kill_exit = true,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
 };
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 1c9866daf815..771b03c1c7c5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -657,6 +657,131 @@ static void iwl_bg_statistics_periodic(unsigned long data)
        iwl_send_statistics_request(priv, CMD_ASYNC, false);
 }
+static void iwl_print_cont_event_trace(struct iwl_priv *priv, u32 base,
+                                        u32 start_idx, u32 num_events,
+                                        u32 mode)
+{
+        u32 i;
+        u32 ptr;        /* SRAM byte address of log data */
+        u32 ev, time, data; /* event log data */
+        unsigned long reg_flags;
+        if (mode == 0)
+                ptr = base + (4 * sizeof(u32)) + (start_idx * 2 * sizeof(u32));
+        else
+                ptr = base + (4 * sizeof(u32)) + (start_idx * 3 * sizeof(u32));
+        /* Make sure device is powered up for SRAM reads */
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        if (iwl_grab_nic_access(priv)) {
+                spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+                return;
+        }
+        /* Set starting address; reads will auto-increment */
+        _iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR, ptr);
+        rmb();
+        /*
+         * "time" is actually "data" for mode 0 (no timestamp).
+         * place event id # at far right for easier visual parsing.
+         */
+        for (i = 0; i < num_events; i++) {
+                ev = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                time = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                if (mode == 0) {
+                        trace_iwlwifi_dev_ucode_cont_event(priv,
+                                                        0, time, ev);
+                } else {
+                        data = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                        trace_iwlwifi_dev_ucode_cont_event(priv,
+                                                time, data, ev);
+                }
+        }
+        /* Allow device to power down */
+        iwl_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+}
+void iwl_continuous_event_trace(struct iwl_priv *priv)
+{
+        u32 capacity;   /* event log capacity in # entries */
+        u32 base;       /* SRAM byte address of event log header */
+        u32 mode;       /* 0 - no timestamp, 1 - timestamp recorded */
+        u32 num_wraps;  /* # times uCode wrapped to top of log */
+        u32 next_entry; /* index of next entry to be written by uCode */
+        if (priv->ucode_type == UCODE_INIT)
+                base = le32_to_cpu(priv->card_alive_init.error_event_table_ptr);
+        else
+                base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
+        if (priv->cfg->ops->lib->is_valid_rtc_data_addr(base)) {
+                capacity = iwl_read_targ_mem(priv, base);
+                num_wraps = iwl_read_targ_mem(priv, base + (2 * sizeof(u32)));
+                mode = iwl_read_targ_mem(priv, base + (1 * sizeof(u32)));
+                next_entry = iwl_read_targ_mem(priv, base + (3 * sizeof(u32)));
+        } else
+                return;
+        if (num_wraps == priv->event_log.num_wraps) {
+                iwl_print_cont_event_trace(priv,
+                                       base, priv->event_log.next_entry,
+                                       next_entry - priv->event_log.next_entry,
+                                       mode);
+                priv->event_log.non_wraps_count++;
+        } else {
+                if ((num_wraps - priv->event_log.num_wraps) > 1)
+                        priv->event_log.wraps_more_count++;
+                else
+                        priv->event_log.wraps_once_count++;
+                trace_iwlwifi_dev_ucode_wrap_event(priv,
+                                num_wraps - priv->event_log.num_wraps,
+                                next_entry, priv->event_log.next_entry);
+                if (next_entry < priv->event_log.next_entry) {
+                        iwl_print_cont_event_trace(priv, base,
+                               priv->event_log.next_entry,
+                               capacity - priv->event_log.next_entry,
+                               mode);
+                        iwl_print_cont_event_trace(priv, base, 0,
+                                next_entry, mode);
+                } else {
+                        iwl_print_cont_event_trace(priv, base,
+                               next_entry, capacity - next_entry,
+                               mode);
+                        iwl_print_cont_event_trace(priv, base, 0,
+                                next_entry, mode);
+                }
+        }
+        priv->event_log.num_wraps = num_wraps;
+        priv->event_log.next_entry = next_entry;
+}
+/**
+ * iwl_bg_ucode_trace - Timer callback to log ucode event
+ *
+ * The timer is continually set to execute every
+ * UCODE_TRACE_PERIOD milliseconds after the last timer expired
+ * this function is to perform continuous uCode event logging operation
+ * if enabled
+ */
+static void iwl_bg_ucode_trace(unsigned long data)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)data;
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+        if (priv->event_log.ucode_trace) {
+                iwl_continuous_event_trace(priv);
+                /* Reschedule the timer to occur in UCODE_TRACE_PERIOD */
+                mod_timer(&priv->ucode_trace,
+                         jiffies + msecs_to_jiffies(UCODE_TRACE_PERIOD));
+        }
+}
 static void iwl_rx_beacon_notif(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb)
 {
@@ -689,12 +814,14 @@ static void iwl_rx_card_state_notif(struct iwl_priv *priv,
        u32 flags = le32_to_cpu(pkt->u.card_state_notif.flags);
        unsigned long status = priv->status;
-        IWL_DEBUG_RF_KILL(priv, "Card state received: HW:%s SW:%s\n",
+        IWL_DEBUG_RF_KILL(priv, "Card state received: HW:%s SW:%s CT:%s\n",
                          (flags & HW_CARD_DISABLED) ? "Kill" : "On",
-                          (flags & SW_CARD_DISABLED) ? "Kill" : "On");
+                          (flags & SW_CARD_DISABLED) ? "Kill" : "On",
+                          (flags & CT_CARD_DISABLED) ?
+                          "Reached" : "Not reached");
        if (flags & (SW_CARD_DISABLED | HW_CARD_DISABLED |
-                     RF_CARD_DISABLED)) {
+                     CT_CARD_DISABLED)) {
                iwl_write32(priv, CSR_UCODE_DRV_GP1_SET,
                            CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
@@ -708,10 +835,10 @@ static void iwl_rx_card_state_notif(struct iwl_priv *priv,
                        iwl_write_direct32(priv, HBUS_TARG_MBX_C,
                                        HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED);
                }
-                if (flags & RF_CARD_DISABLED)
+                if (flags & CT_CARD_DISABLED)
                        iwl_tt_enter_ct_kill(priv);
        }
-        if (!(flags & RF_CARD_DISABLED))
+        if (!(flags & CT_CARD_DISABLED))
                iwl_tt_exit_ct_kill(priv);
        if (flags & HW_CARD_DISABLED)
@@ -1705,8 +1832,9 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
 * iwl_print_event_log - Dump error event log to syslog
 *
 */
-static void iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
+static int iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
-                                u32 num_events, u32 mode)
+                               u32 num_events, u32 mode,
+                               int pos, char **buf, size_t bufsz)
 {
        u32 i;
        u32 base;       /* SRAM byte address of event log header */
@@ -1716,7 +1844,7 @@ static void iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
        unsigned long reg_flags;
        if (num_events == 0)
-                return;
+                return pos;
        if (priv->ucode_type == UCODE_INIT)
                base = le32_to_cpu(priv->card_alive_init.log_event_table_ptr);
        else
@@ -1744,27 +1872,44 @@ static void iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
                time = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
                if (mode == 0) {
                        /* data, ev */
-                        trace_iwlwifi_dev_ucode_event(priv, 0, time, ev);
+                        if (bufsz) {
-                        IWL_ERR(priv, "EVT_LOG:0x%08x:%04u\n", time, ev);
+                                pos += scnprintf(*buf + pos, bufsz - pos,
+                                                "EVT_LOG:0x%08x:%04u\n",
+                                                time, ev);
+                        } else {
+                                trace_iwlwifi_dev_ucode_event(priv, 0,
+                                        time, ev);
+                                IWL_ERR(priv, "EVT_LOG:0x%08x:%04u\n",
+                                        time, ev);
+                        }
                } else {
                        data = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
-                        IWL_ERR(priv, "EVT_LOGT:%010u:0x%08x:%04u\n",
+                        if (bufsz) {
+                                pos += scnprintf(*buf + pos, bufsz - pos,
+                                                "EVT_LOGT:%010u:0x%08x:%04u\n",
+                                                 time, data, ev);
+                        } else {
+                                IWL_ERR(priv, "EVT_LOGT:%010u:0x%08x:%04u\n",
                                        time, data, ev);
-                        trace_iwlwifi_dev_ucode_event(priv, time, data, ev);
+                                trace_iwlwifi_dev_ucode_event(priv, time,
+                                        data, ev);
+                        }
                }
        }
        /* Allow device to power down */
        iwl_release_nic_access(priv);
        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+        return pos;
 }
 /**
 * iwl_print_last_event_logs - Dump the newest # of event log to syslog
 */
-static void iwl_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
+static int iwl_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
-                                      u32 num_wraps, u32 next_entry,
+                                    u32 num_wraps, u32 next_entry,
-                                      u32 size, u32 mode)
+                                    u32 size, u32 mode,
+                                    int pos, char **buf, size_t bufsz)
 {
        /*
         * display the newest DEFAULT_LOG_ENTRIES entries
@@ -1772,21 +1917,26 @@ static void iwl_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
         */
        if (num_wraps) {
                if (next_entry < size) {
-                        iwl_print_event_log(priv,
+                        pos = iwl_print_event_log(priv,
-                                        capacity - (size - next_entry),
+                                                capacity - (size - next_entry),
-                                        size - next_entry, mode);
+                                                size - next_entry, mode,
-                        iwl_print_event_log(priv, 0,
+                                                pos, buf, bufsz);
-                                    next_entry, mode);
+                        pos = iwl_print_event_log(priv, 0,
+                                                  next_entry, mode,
+                                                  pos, buf, bufsz);
                } else
-                        iwl_print_event_log(priv, next_entry - size,
+                        pos = iwl_print_event_log(priv, next_entry - size,
-                                    size, mode);
+                                                  size, mode, pos, buf, bufsz);
        } else {
-                if (next_entry < size)
+                if (next_entry < size) {
-                        iwl_print_event_log(priv, 0, next_entry, mode);
+                        pos = iwl_print_event_log(priv, 0, next_entry,
-                else
+                                                  mode, pos, buf, bufsz);
-                        iwl_print_event_log(priv, next_entry - size,
+                } else {
-                                            size, mode);
+                        pos = iwl_print_event_log(priv, next_entry - size,
+                                                  size, mode, pos, buf, bufsz);
+                }
        }
+        return pos;
 }
 /* For sanity check only.  Actual size is determined by uCode, typ. 512 */
@@ -1794,7 +1944,8 @@ static void iwl_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
 #define DEFAULT_DUMP_EVENT_LOG_ENTRIES (20)
-void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
+int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
+                            char **buf, bool display)
 {
        u32 base;       /* SRAM byte address of event log header */
        u32 capacity;   /* event log capacity in # entries */
@@ -1802,6 +1953,8 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
        u32 num_wraps;  /* # times uCode wrapped to top of log */
        u32 next_entry; /* index of next entry to be written by uCode */
        u32 size;       /* # entries that we'll print */
+        int pos = 0;
+        size_t bufsz = 0;
        if (priv->ucode_type == UCODE_INIT)
                base = le32_to_cpu(priv->card_alive_init.log_event_table_ptr);
@@ -1812,7 +1965,7 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
                IWL_ERR(priv,
                        "Invalid event log pointer 0x%08X for %s uCode\n",
                        base, (priv->ucode_type == UCODE_INIT) ? "Init" : "RT");
-                return;
+                return pos;
        }
        /* event log header */
@@ -1838,7 +1991,7 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
        /* bail out if nothing in log */
        if (size == 0) {
                IWL_ERR(priv, "Start IWL Event Log Dump: nothing in log\n");
-                return;
+                return pos;
        }
 #ifdef CONFIG_IWLWIFI_DEBUG
@@ -1853,6 +2006,15 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
                size);
 #ifdef CONFIG_IWLWIFI_DEBUG
+        if (display) {
+                if (full_log)
+                        bufsz = capacity * 48;
+                else
+                        bufsz = size * 48;
+                *buf = kmalloc(bufsz, GFP_KERNEL);
+                if (!*buf)
+                        return pos;
+        }
        if ((iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) || full_log) {
                /*
                 * if uCode has wrapped back to top of log,
@@ -1860,17 +2022,22 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
                 * i.e the next one that uCode would fill.
                 */
                if (num_wraps)
-                        iwl_print_event_log(priv, next_entry,
+                        pos = iwl_print_event_log(priv, next_entry,
-                                            capacity - next_entry, mode);
+                                                capacity - next_entry, mode,
+                                                pos, buf, bufsz);
                /* (then/else) start at top of log */
-                iwl_print_event_log(priv, 0, next_entry, mode);
+                pos = iwl_print_event_log(priv, 0,
+                                          next_entry, mode, pos, buf, bufsz);
        } else
-                iwl_print_last_event_logs(priv, capacity, num_wraps,
+                pos = iwl_print_last_event_logs(priv, capacity, num_wraps,
-                                        next_entry, size, mode);
+                                                next_entry, size, mode,
+                                                pos, buf, bufsz);
 #else
-        iwl_print_last_event_logs(priv, capacity, num_wraps,
+        pos = iwl_print_last_event_logs(priv, capacity, num_wraps,
-                                next_entry, size, mode);
+                                        next_entry, size, mode,
+                                        pos, buf, bufsz);
 #endif
+        return pos;
 }
 /**
@@ -2456,6 +2623,10 @@ static int iwl_setup_mac(struct iwl_priv *priv)
                hw->flags |= IEEE80211_HW_SUPPORTS_PS |
                             IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
+        if (priv->cfg->sku & IWL_SKU_N)
+                hw->flags |= IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
+                             IEEE80211_HW_SUPPORTS_STATIC_SMPS;
        hw->sta_data_size = sizeof(struct iwl_station_priv);
        hw->wiphy->interface_modes =
                BIT(NL80211_IFTYPE_STATION) |
@@ -3126,6 +3297,10 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
        priv->statistics_periodic.data = (unsigned long)priv;
        priv->statistics_periodic.function = iwl_bg_statistics_periodic;
+        init_timer(&priv->ucode_trace);
+        priv->ucode_trace.data = (unsigned long)priv;
+        priv->ucode_trace.function = iwl_bg_ucode_trace;
        if (!priv->cfg->use_isr_legacy)
                tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
                        iwl_irq_tasklet, (unsigned long)priv);
@@ -3144,6 +3319,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
        cancel_delayed_work(&priv->alive_start);
        cancel_work_sync(&priv->beacon_update);
        del_timer_sync(&priv->statistics_periodic);
+        del_timer_sync(&priv->ucode_trace);
 }
 static void iwl_init_hw_rates(struct iwl_priv *priv,
@@ -3188,6 +3364,7 @@ static int iwl_init_drv(struct iwl_priv *priv)
        priv->band = IEEE80211_BAND_2GHZ;
        priv->iw_mode = NL80211_IFTYPE_STATION;
+        priv->current_ht_config.smps = IEEE80211_SMPS_STATIC;
        /* Choose which receivers/antennas to use */
        if (priv->cfg->ops->hcmd->set_rxon_chain)
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index 95a57b36a7ea..dc61906290e8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -414,7 +414,6 @@ static int iwl_sens_auto_corr_ofdm(struct iwl_priv *priv,
 /* Prepare a SENSITIVITY_CMD, send to uCode if values have changed */
 static int iwl_sensitivity_write(struct iwl_priv *priv)
 {
-        int ret = 0;
        struct iwl_sensitivity_cmd cmd ;
        struct iwl_sensitivity_data *data = NULL;
        struct iwl_host_cmd cmd_out = {
@@ -477,11 +476,7 @@ static int iwl_sensitivity_write(struct iwl_priv *priv)
        memcpy(&(priv->sensitivity_tbl[0]), &(cmd.table[0]),
               sizeof(u16)*HD_TABLE_SIZE);
-        ret = iwl_send_cmd(priv, &cmd_out);
+        return iwl_send_cmd(priv, &cmd_out);
-        if (ret)
-                IWL_ERR(priv, "SENSITIVITY_CMD failed\n");
-        return ret;
 }
 void iwl_init_sensitivity(struct iwl_priv *priv)
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index e91507531923..28f3800c560e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -2510,7 +2510,7 @@ struct iwl_card_state_notif {
 #define HW_CARD_DISABLED   0x01
 #define SW_CARD_DISABLED   0x02
-#define RF_CARD_DISABLED   0x04
+#define CT_CARD_DISABLED   0x04
 #define RXON_CARD_DISABLED 0x10
 struct iwl_ct_kill_config {
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 574d36658702..14f482960d7f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -450,8 +450,6 @@ static void iwlcore_init_ht_hw_capab(const struct iwl_priv *priv,
        if (priv->cfg->ht_greenfield_support)
                ht_info->cap |= IEEE80211_HT_CAP_GRN_FLD;
        ht_info->cap |= IEEE80211_HT_CAP_SGI_20;
-        ht_info->cap |= (IEEE80211_HT_CAP_SM_PS &
-                             (priv->cfg->sm_ps_mode << 2));
        max_bit_rate = MAX_BIT_RATE_20_MHZ;
        if (priv->hw_params.ht40_channel & BIT(band)) {
                ht_info->cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
@@ -636,7 +634,7 @@ EXPORT_SYMBOL(iwlcore_rts_tx_cmd_flag);
 static bool is_single_rx_stream(struct iwl_priv *priv)
 {
-        return !priv->current_ht_config.is_ht ||
+        return priv->current_ht_config.smps == IEEE80211_SMPS_STATIC ||
               priv->current_ht_config.single_chain_sufficient;
 }
@@ -1003,28 +1001,18 @@ static int iwl_get_active_rx_chain_count(struct iwl_priv *priv)
 */
 static int iwl_get_idle_rx_chain_count(struct iwl_priv *priv, int active_cnt)
 {
-        int idle_cnt = active_cnt;
+        /* # Rx chains when idling, depending on SMPS mode */
-        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
+        switch (priv->current_ht_config.smps) {
+        case IEEE80211_SMPS_STATIC:
-        /* # Rx chains when idling and maybe trying to save power */
+        case IEEE80211_SMPS_DYNAMIC:
-        switch (priv->cfg->sm_ps_mode) {
+                return IWL_NUM_IDLE_CHAINS_SINGLE;
-        case WLAN_HT_CAP_SM_PS_STATIC:
+        case IEEE80211_SMPS_OFF:
-                idle_cnt = (is_cam) ? active_cnt : IWL_NUM_IDLE_CHAINS_SINGLE;
+                return active_cnt;
-                break;
-        case WLAN_HT_CAP_SM_PS_DYNAMIC:
-                idle_cnt = (is_cam) ? IWL_NUM_IDLE_CHAINS_DUAL :
-                        IWL_NUM_IDLE_CHAINS_SINGLE;
-                break;
-        case WLAN_HT_CAP_SM_PS_DISABLED:
-                break;
-        case WLAN_HT_CAP_SM_PS_INVALID:
        default:
-                IWL_ERR(priv, "invalid sm_ps mode %u\n",
+                WARN(1, "invalid SMPS mode %d",
-                        priv->cfg->sm_ps_mode);
+                     priv->current_ht_config.smps);
-                WARN_ON(1);
+                return active_cnt;
-                break;
        }
-        return idle_cnt;
 }
 /* up to 4 chains */
@@ -1363,7 +1351,9 @@ void iwl_irq_handle_error(struct iwl_priv *priv)
        clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
        priv->cfg->ops->lib->dump_nic_error_log(priv);
-        priv->cfg->ops->lib->dump_nic_event_log(priv, false);
+        if (priv->cfg->ops->lib->dump_csr)
+                priv->cfg->ops->lib->dump_csr(priv);
+        priv->cfg->ops->lib->dump_nic_event_log(priv, false, NULL, false);
 #ifdef CONFIG_IWLWIFI_DEBUG
        if (iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS)
                iwl_print_rx_config_cmd(priv);
@@ -2594,12 +2584,12 @@ int iwl_set_mode(struct iwl_priv *priv, int mode)
 EXPORT_SYMBOL(iwl_set_mode);
 int iwl_mac_add_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_if_init_conf *conf)
+                                 struct ieee80211_vif *vif)
 {
        struct iwl_priv *priv = hw->priv;
        unsigned long flags;
-        IWL_DEBUG_MAC80211(priv, "enter: type %d\n", conf->type);
+        IWL_DEBUG_MAC80211(priv, "enter: type %d\n", vif->type);
        if (priv->vif) {
                IWL_DEBUG_MAC80211(priv, "leave - vif != NULL\n");
@@ -2607,19 +2597,19 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw,
        }
        spin_lock_irqsave(&priv->lock, flags);
-        priv->vif = conf->vif;
+        priv->vif = vif;
-        priv->iw_mode = conf->type;
+        priv->iw_mode = vif->type;
        spin_unlock_irqrestore(&priv->lock, flags);
        mutex_lock(&priv->mutex);
-        if (conf->mac_addr) {
+        if (vif->addr) {
-                IWL_DEBUG_MAC80211(priv, "Set %pM\n", conf->mac_addr);
+                IWL_DEBUG_MAC80211(priv, "Set %pM\n", vif->addr);
-                memcpy(priv->mac_addr, conf->mac_addr, ETH_ALEN);
+                memcpy(priv->mac_addr, vif->addr, ETH_ALEN);
        }
-        if (iwl_set_mode(priv, conf->type) == -EAGAIN)
+        if (iwl_set_mode(priv, vif->type) == -EAGAIN)
                /* we are not ready, will run again when ready */
                set_bit(STATUS_MODE_PENDING, &priv->status);
@@ -2631,7 +2621,7 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw,
 EXPORT_SYMBOL(iwl_mac_add_interface);
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
-                                     struct ieee80211_if_init_conf *conf)
+                                     struct ieee80211_vif *vif)
 {
        struct iwl_priv *priv = hw->priv;
@@ -2644,7 +2634,7 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
                iwlcore_commit_rxon(priv);
        }
-        if (priv->vif == conf->vif) {
+        if (priv->vif == vif) {
                priv->vif = NULL;
                memset(priv->bssid, 0, ETH_ALEN);
        }
@@ -2684,6 +2674,21 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
        }
+        if (changed & (IEEE80211_CONF_CHANGE_SMPS |
+                       IEEE80211_CONF_CHANGE_CHANNEL)) {
+                /* mac80211 uses static for non-HT which is what we want */
+                priv->current_ht_config.smps = conf->smps_mode;
+                /*
+                 * Recalculate chain counts.
+                 *
+                 * If monitor mode is enabled then mac80211 will
+                 * set up the SM PS mode to OFF if an HT channel is
+                 * configured.
+                 */
+                if (priv->cfg->ops->hcmd->set_rxon_chain)
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv);
+        }
        /* during scanning mac80211 will delay channel setting until
         * scan finish with changed = 0
@@ -2780,10 +2785,6 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                iwl_set_tx_power(priv, conf->power_level, false);
        }
-        /* call to ensure that 4965 rx_chain is set properly in monitor mode */
-        if (priv->cfg->ops->hcmd->set_rxon_chain)
-                priv->cfg->ops->hcmd->set_rxon_chain(priv);
        if (!iwl_is_ready(priv)) {
                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
                goto out;
@@ -3191,6 +3192,77 @@ void iwl_update_stats(struct iwl_priv *priv, bool is_tx, __le16 fc, u16 len)
 EXPORT_SYMBOL(iwl_update_stats);
 #endif
+const static char *get_csr_string(int cmd)
+{
+        switch (cmd) {
+                IWL_CMD(CSR_HW_IF_CONFIG_REG);
+                IWL_CMD(CSR_INT_COALESCING);
+                IWL_CMD(CSR_INT);
+                IWL_CMD(CSR_INT_MASK);
+                IWL_CMD(CSR_FH_INT_STATUS);
+                IWL_CMD(CSR_GPIO_IN);
+                IWL_CMD(CSR_RESET);
+                IWL_CMD(CSR_GP_CNTRL);
+                IWL_CMD(CSR_HW_REV);
+                IWL_CMD(CSR_EEPROM_REG);
+                IWL_CMD(CSR_EEPROM_GP);
+                IWL_CMD(CSR_OTP_GP_REG);
+                IWL_CMD(CSR_GIO_REG);
+                IWL_CMD(CSR_GP_UCODE_REG);
+                IWL_CMD(CSR_GP_DRIVER_REG);
+                IWL_CMD(CSR_UCODE_DRV_GP1);
+                IWL_CMD(CSR_UCODE_DRV_GP2);
+                IWL_CMD(CSR_LED_REG);
+                IWL_CMD(CSR_DRAM_INT_TBL_REG);
+                IWL_CMD(CSR_GIO_CHICKEN_BITS);
+                IWL_CMD(CSR_ANA_PLL_CFG);
+                IWL_CMD(CSR_HW_REV_WA_REG);
+                IWL_CMD(CSR_DBG_HPET_MEM_REG);
+        default:
+                return "UNKNOWN";
+        }
+}
+void iwl_dump_csr(struct iwl_priv *priv)
+{
+        int i;
+        u32 csr_tbl[] = {
+                CSR_HW_IF_CONFIG_REG,
+                CSR_INT_COALESCING,
+                CSR_INT,
+                CSR_INT_MASK,
+                CSR_FH_INT_STATUS,
+                CSR_GPIO_IN,
+                CSR_RESET,
+                CSR_GP_CNTRL,
+                CSR_HW_REV,
+                CSR_EEPROM_REG,
+                CSR_EEPROM_GP,
+                CSR_OTP_GP_REG,
+                CSR_GIO_REG,
+                CSR_GP_UCODE_REG,
+                CSR_GP_DRIVER_REG,
+                CSR_UCODE_DRV_GP1,
+                CSR_UCODE_DRV_GP2,
+                CSR_LED_REG,
+                CSR_DRAM_INT_TBL_REG,
+                CSR_GIO_CHICKEN_BITS,
+                CSR_ANA_PLL_CFG,
+                CSR_HW_REV_WA_REG,
+                CSR_DBG_HPET_MEM_REG
+        };
+        IWL_ERR(priv, "CSR values:\n");
+        IWL_ERR(priv, "(2nd byte of CSR_INT_COALESCING is "
+                "CSR_INT_PERIODIC_REG)\n");
+        for (i = 0; i <  ARRAY_SIZE(csr_tbl); i++) {
+                IWL_ERR(priv, "  %25s: 0X%08x\n",
+                        get_csr_string(csr_tbl[i]),
+                        iwl_read32(priv, csr_tbl[i]));
+        }
+}
+EXPORT_SYMBOL(iwl_dump_csr);
 #ifdef CONFIG_PM
 int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 675b7df632fc..8deb83bfe182 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -63,8 +63,6 @@
 #ifndef __iwl_core_h__
 #define __iwl_core_h__
-#include <linux/utsrelease.h>
 /************************
 * forward declarations *
 ************************/
@@ -72,7 +70,7 @@ struct iwl_host_cmd;
 struct iwl_cmd;
-#define IWLWIFI_VERSION UTS_RELEASE "-k"
+#define IWLWIFI_VERSION "in-tree:"
 #define DRV_COPYRIGHT   "Copyright(c) 2003-2009 Intel Corporation"
 #define DRV_AUTHOR     "<ilw@linux.intel.com>"
@@ -169,8 +167,10 @@ struct iwl_lib_ops {
        int (*is_valid_rtc_data_addr)(u32 addr);
        /* 1st ucode load */
        int (*load_ucode)(struct iwl_priv *priv);
-        void (*dump_nic_event_log)(struct iwl_priv *priv, bool full_log);
+        int (*dump_nic_event_log)(struct iwl_priv *priv,
+                                  bool full_log, char **buf, bool display);
        void (*dump_nic_error_log)(struct iwl_priv *priv);
+        void (*dump_csr)(struct iwl_priv *priv);
        int (*set_channel_switch)(struct iwl_priv *priv, u16 channel);
        /* power management */
        struct iwl_apm_ops apm_ops;
@@ -230,7 +230,6 @@ struct iwl_mod_params {
 * @chain_noise_num_beacons: number of beacons used to compute chain noise
 * @adv_thermal_throttle: support advance thermal throttle
 * @support_ct_kill_exit: support ct kill exit condition
- * @sm_ps_mode: spatial multiplexing power save mode
 * @support_wimax_coexist: support wimax/wifi co-exist
 *
 * We enable the driver to be backward compatible wrt API version. The
@@ -287,7 +286,6 @@ struct iwl_cfg {
        const bool supports_idle;
        bool adv_thermal_throttle;
        bool support_ct_kill_exit;
-        u8 sm_ps_mode;
        const bool support_wimax_coexist;
 };
@@ -332,9 +330,9 @@ int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb);
 int iwl_commit_rxon(struct iwl_priv *priv);
 int iwl_set_mode(struct iwl_priv *priv, int mode);
 int iwl_mac_add_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_if_init_conf *conf);
+                          struct ieee80211_vif *vif);
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_if_init_conf *conf);
+                              struct ieee80211_vif *vif);
 int iwl_mac_config(struct ieee80211_hw *hw, u32 changed);
 void iwl_config_ap(struct iwl_priv *priv);
 int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
@@ -581,7 +579,9 @@ int iwl_pci_resume(struct pci_dev *pdev);
 *  Error Handling Debugging
 ******************************************************/
 void iwl_dump_nic_error_log(struct iwl_priv *priv);
-void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log);
+int iwl_dump_nic_event_log(struct iwl_priv *priv,
+                           bool full_log, char **buf, bool display);
+void iwl_dump_csr(struct iwl_priv *priv);
 #ifdef CONFIG_IWLWIFI_DEBUG
 void iwl_print_rx_config_cmd(struct iwl_priv *priv);
 #else
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index d61293ab67c9..58e0462cafa3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -109,6 +109,8 @@ struct iwl_debugfs {
                struct dentry *file_power_save_status;
                struct dentry *file_clear_ucode_statistics;
                struct dentry *file_clear_traffic_statistics;
+                struct dentry *file_csr;
+                struct dentry *file_ucode_tracing;
        } dbgfs_debug_files;
        u32 sram_offset;
        u32 sram_len;
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 21e0f6699daf..ee5aed12a4b1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -420,6 +420,23 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
        return ret;
 }
+static ssize_t iwl_dbgfs_log_event_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char *buf;
+        int pos = 0;
+        ssize_t ret = -ENOMEM;
+        pos = priv->cfg->ops->lib->dump_nic_event_log(priv, true, &buf, true);
+        if (pos && buf) {
+                ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+                kfree(buf);
+        }
+        return ret;
+}
 static ssize_t iwl_dbgfs_log_event_write(struct file *file,
                                        const char __user *user_buf,
                                        size_t count, loff_t *ppos)
@@ -436,7 +453,8 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
        if (sscanf(buf, "%d", &event_log_flag) != 1)
                return -EFAULT;
        if (event_log_flag == 1)
-                priv->cfg->ops->lib->dump_nic_event_log(priv, true);
+                priv->cfg->ops->lib->dump_nic_event_log(priv, true,
+                                                        NULL, false);
        return count;
 }
@@ -859,7 +877,7 @@ static ssize_t iwl_dbgfs_current_sleep_command_read(struct file *file,
 }
 DEBUGFS_READ_WRITE_FILE_OPS(sram);
-DEBUGFS_WRITE_FILE_OPS(log_event);
+DEBUGFS_READ_WRITE_FILE_OPS(log_event);
 DEBUGFS_READ_FILE_OPS(nvm);
 DEBUGFS_READ_FILE_OPS(stations);
 DEBUGFS_READ_FILE_OPS(channels);
@@ -1845,6 +1863,80 @@ static ssize_t iwl_dbgfs_clear_ucode_statistics_write(struct file *file,
        return count;
 }
+static ssize_t iwl_dbgfs_csr_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int csr;
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &csr) != 1)
+                return -EFAULT;
+        if (priv->cfg->ops->lib->dump_csr)
+                priv->cfg->ops->lib->dump_csr(priv);
+        return count;
+}
+static ssize_t iwl_dbgfs_ucode_tracing_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        char buf[128];
+        const size_t bufsz = sizeof(buf);
+        ssize_t ret;
+        pos += scnprintf(buf + pos, bufsz - pos, "ucode trace timer is %s\n",
+                        priv->event_log.ucode_trace ? "On" : "Off");
+        pos += scnprintf(buf + pos, bufsz - pos, "non_wraps_count:\t\t %u\n",
+                        priv->event_log.non_wraps_count);
+        pos += scnprintf(buf + pos, bufsz - pos, "wraps_once_count:\t\t %u\n",
+                        priv->event_log.wraps_once_count);
+        pos += scnprintf(buf + pos, bufsz - pos, "wraps_more_count:\t\t %u\n",
+                        priv->event_log.wraps_more_count);
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        return ret;
+}
+static ssize_t iwl_dbgfs_ucode_tracing_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int trace;
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &trace) != 1)
+                return -EFAULT;
+        if (trace) {
+                priv->event_log.ucode_trace = true;
+                /* schedule the ucode timer to occur in UCODE_TRACE_PERIOD */
+                mod_timer(&priv->ucode_trace,
+                        jiffies + msecs_to_jiffies(UCODE_TRACE_PERIOD));
+        } else {
+                priv->event_log.ucode_trace = false;
+                del_timer_sync(&priv->ucode_trace);
+        }
+        return count;
+}
 DEBUGFS_READ_FILE_OPS(rx_statistics);
 DEBUGFS_READ_FILE_OPS(tx_statistics);
 DEBUGFS_READ_WRITE_FILE_OPS(traffic_log);
@@ -1859,6 +1951,8 @@ DEBUGFS_READ_FILE_OPS(tx_power);
 DEBUGFS_READ_FILE_OPS(power_save_status);
 DEBUGFS_WRITE_FILE_OPS(clear_ucode_statistics);
 DEBUGFS_WRITE_FILE_OPS(clear_traffic_statistics);
+DEBUGFS_WRITE_FILE_OPS(csr);
+DEBUGFS_READ_WRITE_FILE_OPS(ucode_tracing);
 /*
 * Create the debugfs files and directories
@@ -1889,7 +1983,7 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
        DEBUGFS_ADD_DIR(debug, dbgfs->dir_drv);
        DEBUGFS_ADD_FILE(nvm, data, S_IRUSR);
        DEBUGFS_ADD_FILE(sram, data, S_IWUSR | S_IRUSR);
-        DEBUGFS_ADD_FILE(log_event, data, S_IWUSR);
+        DEBUGFS_ADD_FILE(log_event, data, S_IWUSR | S_IRUSR);
        DEBUGFS_ADD_FILE(stations, data, S_IRUSR);
        DEBUGFS_ADD_FILE(channels, data, S_IRUSR);
        DEBUGFS_ADD_FILE(status, data, S_IRUSR);
@@ -1909,12 +2003,14 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
        DEBUGFS_ADD_FILE(power_save_status, debug, S_IRUSR);
        DEBUGFS_ADD_FILE(clear_ucode_statistics, debug, S_IWUSR);
        DEBUGFS_ADD_FILE(clear_traffic_statistics, debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(csr, debug, S_IWUSR);
        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
                DEBUGFS_ADD_FILE(ucode_rx_stats, debug, S_IRUSR);
                DEBUGFS_ADD_FILE(ucode_tx_stats, debug, S_IRUSR);
                DEBUGFS_ADD_FILE(ucode_general_stats, debug, S_IRUSR);
                DEBUGFS_ADD_FILE(sensitivity, debug, S_IRUSR);
                DEBUGFS_ADD_FILE(chain_noise, debug, S_IRUSR);
+                DEBUGFS_ADD_FILE(ucode_tracing, debug, S_IWUSR | S_IRUSR);
        }
        DEBUGFS_ADD_BOOL(disable_sensitivity, rf, &priv->disable_sens_cal);
        DEBUGFS_ADD_BOOL(disable_chain_noise, rf,
@@ -1966,6 +2062,7 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv)
                        file_clear_ucode_statistics);
        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
                        file_clear_traffic_statistics);
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_csr);
        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
                        file_ucode_rx_stats);
@@ -1977,6 +2074,8 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv)
                        file_sensitivity);
                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
                        file_chain_noise);
+                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
+                        file_ucode_tracing);
        }
        DEBUGFS_REMOVE(priv->dbgfs->dir_debug);
        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_sensitivity);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 165d1f6e2dd9..42f9b17327c3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -512,6 +512,7 @@ struct iwl_ht_config {
        bool is_ht;
        bool is_40mhz;
        bool single_chain_sufficient;
+        enum ieee80211_smps_mode smps; /* current smps mode */
        /* BSS related data */
        u8 extension_chan_offset;
        u8 ht_protection;
@@ -984,6 +985,32 @@ struct iwl_switch_rxon {
        __le16 channel;
 };
+/*
+ * schedule the timer to wake up every UCODE_TRACE_PERIOD milliseconds
+ * to perform continuous uCode event logging operation if enabled
+ */
+#define UCODE_TRACE_PERIOD (100)
+/*
+ * iwl_event_log: current uCode event log position
+ *
+ * @ucode_trace: enable/disable ucode continuous trace timer
+ * @num_wraps: how many times the event buffer wraps
+ * @next_entry:  the entry just before the next one that uCode would fill
+ * @non_wraps_count: counter for no wrap detected when dump ucode events
+ * @wraps_once_count: counter for wrap once detected when dump ucode events
+ * @wraps_more_count: counter for wrap more than once detected
+ *                    when dump ucode events
+ */
+struct iwl_event_log {
+        bool ucode_trace;
+        u32 num_wraps;
+        u32 next_entry;
+        int non_wraps_count;
+        int wraps_once_count;
+        int wraps_more_count;
+};
 struct iwl_priv {
        /* ieee device used by generic ieee processing code */
@@ -1261,6 +1288,7 @@ struct iwl_priv {
        u32 disable_tx_power_cal;
        struct work_struct run_time_calib_work;
        struct timer_list statistics_periodic;
+        struct timer_list ucode_trace;
        bool hw_ready;
        /*For 3945*/
 #define IWL_DEFAULT_TX_POWER 0x0F
@@ -1268,6 +1296,8 @@ struct iwl_priv {
        struct iwl3945_notif_statistics statistics_39;
        u32 sta_supp_rates;
+        struct iwl_event_log event_log;
 }; /*iwl_priv */
 static inline void iwl_txq_ctx_activate(struct iwl_priv *priv, int txq_id)
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.c b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
index e7d88d1da15d..bf46308b17fa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.c
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
@@ -11,4 +11,6 @@ EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_iowrite32);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_rx);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_event);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_error);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_cont_event);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_wrap_event);
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
index 21361968ab7e..0819f990be6c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -65,6 +65,50 @@ TRACE_EVENT(iwlwifi_dev_iowrite32,
 );
 #undef TRACE_SYSTEM
+#define TRACE_SYSTEM iwlwifi_ucode
+TRACE_EVENT(iwlwifi_dev_ucode_cont_event,
+        TP_PROTO(struct iwl_priv *priv, u32 time, u32 data, u32 ev),
+        TP_ARGS(priv, time, data, ev),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+                __field(u32, time)
+                __field(u32, data)
+                __field(u32, ev)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                __entry->time = time;
+                __entry->data = data;
+                __entry->ev = ev;
+        ),
+        TP_printk("[%p] EVT_LOGT:%010u:0x%08x:%04u",
+                  __entry->priv, __entry->time, __entry->data, __entry->ev)
+);
+TRACE_EVENT(iwlwifi_dev_ucode_wrap_event,
+        TP_PROTO(struct iwl_priv *priv, u32 wraps, u32 n_entry, u32 p_entry),
+        TP_ARGS(priv, wraps, n_entry, p_entry),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+                __field(u32, wraps)
+                __field(u32, n_entry)
+                __field(u32, p_entry)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                __entry->wraps = wraps;
+                __entry->n_entry = n_entry;
+                __entry->p_entry = p_entry;
+        ),
+        TP_printk("[%p] wraps=#%02d n=0x%X p=0x%X",
+                  __entry->priv, __entry->wraps, __entry->n_entry,
+                  __entry->p_entry)
+);
+#undef TRACE_SYSTEM
 #define TRACE_SYSTEM iwlwifi
 TRACE_EVENT(iwlwifi_dev_hcmd,
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index f8e4e4b18d02..10b0aa8024c4 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -1518,8 +1518,9 @@ void iwl3945_dump_nic_error_log(struct iwl_priv *priv)
 * iwl3945_print_event_log - Dump error event log to syslog
 *
 */
-static void iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
+static int iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
-                                u32 num_events, u32 mode)
+                                  u32 num_events, u32 mode,
+                                  int pos, char **buf, size_t bufsz)
 {
        u32 i;
        u32 base;       /* SRAM byte address of event log header */
@@ -1529,7 +1530,7 @@ static void iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
        unsigned long reg_flags;
        if (num_events == 0)
-                return;
+                return pos;
        base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
@@ -1555,26 +1556,43 @@ static void iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
                time = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
                if (mode == 0) {
                        /* data, ev */
-                        IWL_ERR(priv, "0x%08x\t%04u\n", time, ev);
+                        if (bufsz) {
-                        trace_iwlwifi_dev_ucode_event(priv, 0, time, ev);
+                                pos += scnprintf(*buf + pos, bufsz - pos,
+                                                "0x%08x:%04u\n",
+                                                time, ev);
+                        } else {
+                                IWL_ERR(priv, "0x%08x\t%04u\n", time, ev);
+                                trace_iwlwifi_dev_ucode_event(priv, 0,
+                                                              time, ev);
+                        }
                } else {
                        data = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
-                        IWL_ERR(priv, "%010u\t0x%08x\t%04u\n", time, data, ev);
+                        if (bufsz) {
-                        trace_iwlwifi_dev_ucode_event(priv, time, data, ev);
+                                pos += scnprintf(*buf + pos, bufsz - pos,
+                                                "%010u:0x%08x:%04u\n",
+                                                 time, data, ev);
+                        } else {
+                                IWL_ERR(priv, "%010u\t0x%08x\t%04u\n",
+                                        time, data, ev);
+                                trace_iwlwifi_dev_ucode_event(priv, time,
+                                                              data, ev);
+                        }
                }
        }
        /* Allow device to power down */
        iwl_release_nic_access(priv);
        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+        return pos;
 }
 /**
 * iwl3945_print_last_event_logs - Dump the newest # of event log to syslog
 */
-static void iwl3945_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
+static int iwl3945_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
                                      u32 num_wraps, u32 next_entry,
-                                      u32 size, u32 mode)
+                                      u32 size, u32 mode,
+                                      int pos, char **buf, size_t bufsz)
 {
        /*
         * display the newest DEFAULT_LOG_ENTRIES entries
@@ -1582,21 +1600,28 @@ static void iwl3945_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
         */
        if (num_wraps) {
                if (next_entry < size) {
-                        iwl3945_print_event_log(priv,
+                        pos = iwl3945_print_event_log(priv,
-                                        capacity - (size - next_entry),
+                                             capacity - (size - next_entry),
-                                        size - next_entry, mode);
+                                             size - next_entry, mode,
-                        iwl3945_print_event_log(priv, 0,
+                                             pos, buf, bufsz);
-                                    next_entry, mode);
+                        pos = iwl3945_print_event_log(priv, 0,
+                                                      next_entry, mode,
+                                                      pos, buf, bufsz);
                } else
-                        iwl3945_print_event_log(priv, next_entry - size,
+                        pos = iwl3945_print_event_log(priv, next_entry - size,
-                                    size, mode);
+                                                      size, mode,
+                                                      pos, buf, bufsz);
        } else {
                if (next_entry < size)
-                        iwl3945_print_event_log(priv, 0, next_entry, mode);
+                        pos = iwl3945_print_event_log(priv, 0,
+                                                      next_entry, mode,
+                                                      pos, buf, bufsz);
                else
-                        iwl3945_print_event_log(priv, next_entry - size,
+                        pos = iwl3945_print_event_log(priv, next_entry - size,
-                                            size, mode);
+                                                      size, mode,
+                                                      pos, buf, bufsz);
        }
+        return pos;
 }
 /* For sanity check only.  Actual size is determined by uCode, typ. 512 */
@@ -1604,7 +1629,8 @@ static void iwl3945_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
 #define DEFAULT_IWL3945_DUMP_EVENT_LOG_ENTRIES (20)
-void iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
+int iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
+                            char **buf, bool display)
 {
        u32 base;       /* SRAM byte address of event log header */
        u32 capacity;   /* event log capacity in # entries */
@@ -1612,11 +1638,13 @@ void iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
        u32 num_wraps;  /* # times uCode wrapped to top of log */
        u32 next_entry; /* index of next entry to be written by uCode */
        u32 size;       /* # entries that we'll print */
+        int pos = 0;
+        size_t bufsz = 0;
        base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
        if (!iwl3945_hw_valid_rtc_data_addr(base)) {
                IWL_ERR(priv, "Invalid event log pointer 0x%08X\n", base);
-                return;
+                return pos;
        }
        /* event log header */
@@ -1642,7 +1670,7 @@ void iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
        /* bail out if nothing in log */
        if (size == 0) {
                IWL_ERR(priv, "Start IWL Event Log Dump: nothing in log\n");
-                return;
+                return pos;
        }
 #ifdef CONFIG_IWLWIFI_DEBUG
@@ -1658,25 +1686,38 @@ void iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
                  size);
 #ifdef CONFIG_IWLWIFI_DEBUG
+        if (display) {
+                if (full_log)
+                        bufsz = capacity * 48;
+                else
+                        bufsz = size * 48;
+                *buf = kmalloc(bufsz, GFP_KERNEL);
+                if (!*buf)
+                        return pos;
+        }
        if ((iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) || full_log) {
                /* if uCode has wrapped back to top of log,
                 * start at the oldest entry,
                 * i.e the next one that uCode would fill.
                 */
                if (num_wraps)
-                        iwl3945_print_event_log(priv, next_entry,
+                        pos = iwl3945_print_event_log(priv, next_entry,
-                                    capacity - next_entry, mode);
+                                                capacity - next_entry, mode,
+                                                pos, buf, bufsz);
                /* (then/else) start at top of log */
-                iwl3945_print_event_log(priv, 0, next_entry, mode);
+                pos = iwl3945_print_event_log(priv, 0, next_entry, mode,
+                                              pos, buf, bufsz);
        } else
-                iwl3945_print_last_event_logs(priv, capacity, num_wraps,
+                pos = iwl3945_print_last_event_logs(priv, capacity, num_wraps,
-                                        next_entry, size, mode);
+                                                    next_entry, size, mode,
+                                                    pos, buf, bufsz);
 #else
-        iwl3945_print_last_event_logs(priv, capacity, num_wraps,
+        pos = iwl3945_print_last_event_logs(priv, capacity, num_wraps,
-                                next_entry, size, mode);
+                                            next_entry, size, mode,
+                                            pos, buf, bufsz);
 #endif
+        return pos;
 }
 static void iwl3945_irq_tasklet(struct iwl_priv *priv)
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 3db3d8b07491..fd399e6b1930 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -868,36 +868,35 @@ static int iwm_mlme_mgt_frame(struct iwm_priv *iwm, u8 *buf,
        struct iwm_umac_notif_mgt_frame *mgt_frame =
                        (struct iwm_umac_notif_mgt_frame *)buf;
        struct ieee80211_mgmt *mgt = (struct ieee80211_mgmt *)mgt_frame->frame;
-        u8 *ie;
        IWM_HEXDUMP(iwm, DBG, MLME, "MGT: ", mgt_frame->frame,
                    le16_to_cpu(mgt_frame->len));
        if (ieee80211_is_assoc_req(mgt->frame_control)) {
-                ie = mgt->u.assoc_req.variable;;
+                iwm->req_ie_len = le16_to_cpu(mgt_frame->len)
-                iwm->req_ie_len =
+                                  - offsetof(struct ieee80211_mgmt,
-                                le16_to_cpu(mgt_frame->len) - (ie - (u8 *)mgt);
+                                             u.assoc_req.variable);
                kfree(iwm->req_ie);
                iwm->req_ie = kmemdup(mgt->u.assoc_req.variable,
                                      iwm->req_ie_len, GFP_KERNEL);
        } else if (ieee80211_is_reassoc_req(mgt->frame_control)) {
-                ie = mgt->u.reassoc_req.variable;;
+                iwm->req_ie_len = le16_to_cpu(mgt_frame->len)
-                iwm->req_ie_len =
+                                  - offsetof(struct ieee80211_mgmt,
-                                le16_to_cpu(mgt_frame->len) - (ie - (u8 *)mgt);
+                                             u.reassoc_req.variable);
                kfree(iwm->req_ie);
                iwm->req_ie = kmemdup(mgt->u.reassoc_req.variable,
                                      iwm->req_ie_len, GFP_KERNEL);
        } else if (ieee80211_is_assoc_resp(mgt->frame_control)) {
-                ie = mgt->u.assoc_resp.variable;;
+                iwm->resp_ie_len = le16_to_cpu(mgt_frame->len)
-                iwm->resp_ie_len =
+                                   - offsetof(struct ieee80211_mgmt,
-                                le16_to_cpu(mgt_frame->len) - (ie - (u8 *)mgt);
+                                              u.assoc_resp.variable);
                kfree(iwm->resp_ie);
                iwm->resp_ie = kmemdup(mgt->u.assoc_resp.variable,
                                       iwm->resp_ie_len, GFP_KERNEL);
        } else if (ieee80211_is_reassoc_resp(mgt->frame_control)) {
-                ie = mgt->u.reassoc_resp.variable;;
+                iwm->resp_ie_len = le16_to_cpu(mgt_frame->len)
-                iwm->resp_ie_len =
+                                   - offsetof(struct ieee80211_mgmt,
-                                le16_to_cpu(mgt_frame->len) - (ie - (u8 *)mgt);
+                                              u.reassoc_resp.variable);
                kfree(iwm->resp_ie);
                iwm->resp_ie = kmemdup(mgt->u.reassoc_resp.variable,
                                       iwm->resp_ie_len, GFP_KERNEL);
@@ -1534,6 +1533,33 @@ static void classify8023(struct sk_buff *skb)
        }
 }
+static void iwm_rx_process_amsdu(struct iwm_priv *iwm, struct sk_buff *skb)
+{
+        struct wireless_dev *wdev = iwm_to_wdev(iwm);
+        struct net_device *ndev = iwm_to_ndev(iwm);
+        struct sk_buff_head list;
+        struct sk_buff *frame;
+        IWM_HEXDUMP(iwm, DBG, RX, "A-MSDU: ", skb->data, skb->len);
+        __skb_queue_head_init(&list);
+        ieee80211_amsdu_to_8023s(skb, &list, ndev->dev_addr, wdev->iftype, 0);
+        while ((frame = __skb_dequeue(&list))) {
+                ndev->stats.rx_packets++;
+                ndev->stats.rx_bytes += frame->len;
+                frame->protocol = eth_type_trans(frame, ndev);
+                frame->ip_summed = CHECKSUM_NONE;
+                memset(frame->cb, 0, sizeof(frame->cb));
+                if (netif_rx_ni(frame) == NET_RX_DROP) {
+                        IWM_ERR(iwm, "Packet dropped\n");
+                        ndev->stats.rx_dropped++;
+                }
+        }
+}
 static void iwm_rx_process_packet(struct iwm_priv *iwm,
                                  struct iwm_rx_packet *packet,
                                  struct iwm_rx_ticket_node *ticket_node)
@@ -1548,25 +1574,34 @@ static void iwm_rx_process_packet(struct iwm_priv *iwm,
        switch (le16_to_cpu(ticket_node->ticket->action)) {
        case IWM_RX_TICKET_RELEASE:
                IWM_DBG_RX(iwm, DBG, "RELEASE packet\n");
-                classify8023(skb);
                iwm_rx_adjust_packet(iwm, packet, ticket_node);
+                skb->dev = iwm_to_ndev(iwm);
+                classify8023(skb);
+                if (le16_to_cpu(ticket_node->ticket->flags) &
+                    IWM_RX_TICKET_AMSDU_MSK) {
+                        iwm_rx_process_amsdu(iwm, skb);
+                        break;
+                }
                ret = ieee80211_data_to_8023(skb, ndev->dev_addr, wdev->iftype);
                if (ret < 0) {
                        IWM_DBG_RX(iwm, DBG, "Couldn't convert 802.11 header - "
                                   "%d\n", ret);
+                        kfree_skb(packet->skb);
                        break;
                }
                IWM_HEXDUMP(iwm, DBG, RX, "802.3: ", skb->data, skb->len);
-                skb->dev = iwm_to_ndev(iwm);
+                ndev->stats.rx_packets++;
+                ndev->stats.rx_bytes += skb->len;
                skb->protocol = eth_type_trans(skb, ndev);
                skb->ip_summed = CHECKSUM_NONE;
                memset(skb->cb, 0, sizeof(skb->cb));
-                ndev->stats.rx_packets++;
-                ndev->stats.rx_bytes += skb->len;
                if (netif_rx_ni(skb) == NET_RX_DROP) {
                        IWM_ERR(iwm, "Packet dropped\n");
                        ndev->stats.rx_dropped++;
diff --git a/drivers/net/wireless/libertas/Kconfig b/drivers/net/wireless/libertas/Kconfig
index 30aa9d48d67e..0485c9957575 100644
--- a/drivers/net/wireless/libertas/Kconfig
+++ b/drivers/net/wireless/libertas/Kconfig
@@ -37,3 +37,9 @@ config LIBERTAS_DEBUG
        depends on LIBERTAS
        ---help---
          Debugging support.
+config LIBERTAS_MESH
+        bool "Enable mesh support"
+        depends on LIBERTAS
+        help
+          This enables Libertas' MESH support, used by e.g. the OLPC people.
diff --git a/drivers/net/wireless/libertas/Makefile b/drivers/net/wireless/libertas/Makefile
index b188cd97a053..45e870e33117 100644
--- a/drivers/net/wireless/libertas/Makefile
+++ b/drivers/net/wireless/libertas/Makefile
@@ -5,11 +5,11 @@ libertas-y += cmdresp.o
 libertas-y += debugfs.o
 libertas-y += ethtool.o
 libertas-y += main.o
-libertas-y += mesh.o
 libertas-y += rx.o
 libertas-y += scan.o
 libertas-y += tx.o
 libertas-y += wext.o
+libertas-$(CONFIG_LIBERTAS_MESH) += mesh.o
 usb8xxx-objs += if_usb.o
 libertas_cs-objs += if_cs.o
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index 751067369ba8..5e650f358415 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -390,10 +390,8 @@ int lbs_cmd_802_11_rate_adapt_rateset(struct lbs_private *priv,
        cmd.enablehwauto = cpu_to_le16(priv->enablehwauto);
        cmd.bitmap = lbs_rate_to_fw_bitmap(priv->cur_rate, priv->enablehwauto);
        ret = lbs_cmd_with_response(priv, CMD_802_11_RATE_ADAPT_RATESET, &cmd);
-        if (!ret && cmd_action == CMD_ACT_GET) {
+        if (!ret && cmd_action == CMD_ACT_GET)
-                priv->ratebitmap = le16_to_cpu(cmd.bitmap);
                priv->enablehwauto = le16_to_cpu(cmd.enablehwauto);
-        }
        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
        return ret;
@@ -807,8 +805,7 @@ static int lbs_try_associate(struct lbs_private *priv,
        }
        /* Use short preamble only when both the BSS and firmware support it */
-        if ((priv->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
+        if (assoc_req->bss.capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
-            (assoc_req->bss.capability & WLAN_CAPABILITY_SHORT_PREAMBLE))
                preamble = RADIO_PREAMBLE_SHORT;
        ret = lbs_set_radio(priv, preamble, 1);
@@ -939,8 +936,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
        }
        /* Use short preamble only when both the BSS and firmware support it */
-        if ((priv->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
+        if (bss->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) {
-            (bss->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)) {
                lbs_deb_join("AdhocJoin: Short preamble\n");
                preamble = RADIO_PREAMBLE_SHORT;
        }
@@ -1049,7 +1045,7 @@ static int lbs_adhoc_start(struct lbs_private *priv,
        struct assoc_request *assoc_req)
 {
        struct cmd_ds_802_11_ad_hoc_start cmd;
-        u8 preamble = RADIO_PREAMBLE_LONG;
+        u8 preamble = RADIO_PREAMBLE_SHORT;
        size_t ratesize = 0;
        u16 tmpcap = 0;
        int ret = 0;
@@ -1057,11 +1053,6 @@ static int lbs_adhoc_start(struct lbs_private *priv,
        lbs_deb_enter(LBS_DEB_ASSOC);
-        if (priv->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) {
-                lbs_deb_join("ADHOC_START: Will use short preamble\n");
-                preamble = RADIO_PREAMBLE_SHORT;
-        }
        ret = lbs_set_radio(priv, preamble, 1);
        if (ret)
                goto out;
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index b9b371bfa30f..42051f7cad6d 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -143,19 +143,6 @@ int lbs_update_hw_spec(struct lbs_private *priv)
        lbs_deb_cmd("GET_HW_SPEC: hardware interface 0x%x, hardware spec 0x%04x\n",
                    cmd.hwifversion, cmd.version);
-        /* Determine mesh_fw_ver from fwrelease and fwcapinfo */
-        /* 5.0.16p0 9.0.0.p0 is known to NOT support any mesh */
-        /* 5.110.22 have mesh command with 0xa3 command id */
-        /* 10.0.0.p0 FW brings in mesh config command with different id */
-        /* Check FW version MSB and initialize mesh_fw_ver */
-        if (MRVL_FW_MAJOR_REV(priv->fwrelease) == MRVL_FW_V5)
-                priv->mesh_fw_ver = MESH_FW_OLD;
-        else if ((MRVL_FW_MAJOR_REV(priv->fwrelease) >= MRVL_FW_V10) &&
-                (priv->fwcapinfo & MESH_CAPINFO_ENABLE_MASK))
-                priv->mesh_fw_ver = MESH_FW_NEW;
-        else
-                priv->mesh_fw_ver = MESH_NONE;
        /* Clamp region code to 8-bit since FW spec indicates that it should
         * only ever be 8-bit, even though the field size is 16-bit.  Some firmware
         * returns non-zero high 8 bits here.
@@ -855,9 +842,6 @@ int lbs_set_radio(struct lbs_private *priv, u8 preamble, u8 radio_on)
        if (priv->fwrelease < 0x09000000) {
                switch (preamble) {
                case RADIO_PREAMBLE_SHORT:
-                        if (!(priv->capability & WLAN_CAPABILITY_SHORT_PREAMBLE))
-                                goto out;
-                        /* Fall through */
                case RADIO_PREAMBLE_AUTO:
                case RADIO_PREAMBLE_LONG:
                        cmd.control = cpu_to_le16(preamble);
@@ -1011,6 +995,8 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
                ret = 0;
                break;
+#ifdef CONFIG_LIBERTAS_MESH
        case CMD_BT_ACCESS:
                ret = lbs_cmd_bt_access(cmdptr, cmd_action, pdata_buf);
                break;
@@ -1019,6 +1005,8 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
                ret = lbs_cmd_fwt_access(cmdptr, cmd_action, pdata_buf);
                break;
+#endif
        case CMD_802_11_BEACON_CTRL:
                ret = lbs_cmd_bcn_ctrl(priv, cmdptr, cmd_action);
                break;
@@ -1317,7 +1305,7 @@ int lbs_execute_next_command(struct lbs_private *priv)
                if ((priv->psmode != LBS802_11POWERMODECAM) &&
                    (priv->psstate == PS_STATE_FULL_POWER) &&
                    ((priv->connect_status == LBS_CONNECTED) ||
-                    (priv->mesh_connect_status == LBS_CONNECTED))) {
+                    lbs_mesh_connected(priv))) {
                        if (priv->secinfo.WPAenabled ||
                            priv->secinfo.WPA2enabled) {
                                /* check for valid WPA group keys */
diff --git a/drivers/net/wireless/libertas/cmd.h b/drivers/net/wireless/libertas/cmd.h
index 2862748aef70..cb4138a55fdf 100644
--- a/drivers/net/wireless/libertas/cmd.h
+++ b/drivers/net/wireless/libertas/cmd.h
@@ -110,18 +110,6 @@ int lbs_set_snmp_mib(struct lbs_private *priv, u32 oid, u16 val);
 int lbs_get_snmp_mib(struct lbs_private *priv, u32 oid, u16 *out_val);
-/* Mesh related */
-int lbs_mesh_access(struct lbs_private *priv, uint16_t cmd_action,
-                    struct cmd_ds_mesh_access *cmd);
-int lbs_mesh_config_send(struct lbs_private *priv,
-                         struct cmd_ds_mesh_config *cmd,
-                         uint16_t action, uint16_t type);
-int lbs_mesh_config(struct lbs_private *priv, uint16_t enable, uint16_t chan);
 /* Commands only used in wext.c, assoc. and scan.c */
 int lbs_set_power_adapt_cfg(struct lbs_private *priv, int enable, int8_t p0,
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index 21d57690c20a..0334a58820ee 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -485,20 +485,8 @@ int lbs_process_event(struct lbs_private *priv, u32 event)
                break;
        case MACREG_INT_CODE_MESH_AUTO_STARTED:
-                /* Ignore spurious autostart events if autostart is disabled */
+                /* Ignore spurious autostart events */
-                if (!priv->mesh_autostart_enabled) {
+                lbs_pr_info("EVENT: MESH_AUTO_STARTED (ignoring)\n");
-                        lbs_pr_info("EVENT: MESH_AUTO_STARTED (ignoring)\n");
-                        break;
-                }
-                lbs_pr_info("EVENT: MESH_AUTO_STARTED\n");
-                priv->mesh_connect_status = LBS_CONNECTED;
-                if (priv->mesh_open) {
-                        netif_carrier_on(priv->mesh_dev);
-                        if (!priv->tx_pending_len)
-                                netif_wake_queue(priv->mesh_dev);
-                }
-                priv->mode = IW_MODE_ADHOC;
-                schedule_work(&priv->sync_channel);
                break;
        default:
diff --git a/drivers/net/wireless/libertas/defs.h b/drivers/net/wireless/libertas/defs.h
index 6b6ea9f7bf5b..ea3f10ef4e00 100644
--- a/drivers/net/wireless/libertas/defs.h
+++ b/drivers/net/wireless/libertas/defs.h
@@ -397,13 +397,6 @@ enum KEY_INFO_WPA {
        KEY_INFO_WPA_ENABLED = 0x04
 };
-/** mesh_fw_ver */
-enum _mesh_fw_ver {
-        MESH_NONE = 0, /* MESH is not supported */
-        MESH_FW_OLD,   /* MESH is supported in FW V5 */
-        MESH_FW_NEW,   /* MESH is supported in FW V10 and newer */
-};
 /* Default values for fwt commands. */
 #define FWT_DEFAULT_METRIC 0
 #define FWT_DEFAULT_DIR 1
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index 6a8d2b291d8c..d5a9dcae4059 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -39,15 +39,14 @@ struct lbs_private {
        /* Mesh */
        struct net_device *mesh_dev; /* Virtual device */
+#ifdef CONFIG_LIBERTAS_MESH
        u32 mesh_connect_status;
        struct lbs_mesh_stats mstats;
        int mesh_open;
-        int mesh_fw_ver;
-        int mesh_autostart_enabled;
        uint16_t mesh_tlv;
        u8 mesh_ssid[IEEE80211_MAX_SSID_LEN + 1];
        u8 mesh_ssid_len;
-        struct work_struct sync_channel;
+#endif
        /* Monitor mode */
        struct net_device *rtap_net_dev;
@@ -176,9 +175,7 @@ struct lbs_private {
        struct bss_descriptor *networks;
        struct assoc_request * pending_assoc_req;
        struct assoc_request * in_progress_assoc_req;
-        u16 capability;
        uint16_t enablehwauto;
-        uint16_t ratebitmap;
        /* ADHOC */
        u16 beacon_period;
diff --git a/drivers/net/wireless/libertas/ethtool.c b/drivers/net/wireless/libertas/ethtool.c
index 63d020374c2b..3804a58d7f4e 100644
--- a/drivers/net/wireless/libertas/ethtool.c
+++ b/drivers/net/wireless/libertas/ethtool.c
@@ -114,9 +114,11 @@ const struct ethtool_ops lbs_ethtool_ops = {
        .get_drvinfo = lbs_ethtool_get_drvinfo,
        .get_eeprom =  lbs_ethtool_get_eeprom,
        .get_eeprom_len = lbs_ethtool_get_eeprom_len,
+#ifdef CONFIG_LIBERTAS_MESH
        .get_sset_count = lbs_mesh_ethtool_get_sset_count,
        .get_ethtool_stats = lbs_mesh_ethtool_get_stats,
        .get_strings = lbs_mesh_ethtool_get_strings,
+#endif
        .get_wol = lbs_ethtool_get_wol,
        .set_wol = lbs_ethtool_set_wol,
 };
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index db38a5a719fa..f9f195f7b17c 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -123,7 +123,7 @@ static ssize_t lbs_rtap_set(struct device *dev,
                if (priv->monitormode == monitor_mode)
                        return strlen(buf);
                if (!priv->monitormode) {
-                        if (priv->infra_open || priv->mesh_open)
+                        if (priv->infra_open || lbs_mesh_open(priv))
                                return -EBUSY;
                        if (priv->mode == IW_MODE_INFRA)
                                lbs_cmd_80211_deauthenticate(priv,
@@ -619,7 +619,7 @@ static int lbs_thread(void *data)
                                if (priv->connect_status == LBS_CONNECTED)
                                        netif_wake_queue(priv->dev);
                                if (priv->mesh_dev &&
-                                    priv->mesh_connect_status == LBS_CONNECTED)
+                                    lbs_mesh_connected(priv))
                                        netif_wake_queue(priv->mesh_dev);
                        }
                }
@@ -806,18 +806,6 @@ int lbs_exit_auto_deep_sleep(struct lbs_private *priv)
        return 0;
 }
-static void lbs_sync_channel_worker(struct work_struct *work)
-{
-        struct lbs_private *priv = container_of(work, struct lbs_private,
-                sync_channel);
-        lbs_deb_enter(LBS_DEB_MAIN);
-        if (lbs_update_channel(priv))
-                lbs_pr_info("Channel synchronization failed.");
-        lbs_deb_leave(LBS_DEB_MAIN);
-}
 static int lbs_init_adapter(struct lbs_private *priv)
 {
        size_t bufsize;
@@ -845,14 +833,12 @@ static int lbs_init_adapter(struct lbs_private *priv)
        memset(priv->current_addr, 0xff, ETH_ALEN);
        priv->connect_status = LBS_DISCONNECTED;
-        priv->mesh_connect_status = LBS_DISCONNECTED;
        priv->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
        priv->mode = IW_MODE_INFRA;
        priv->channel = DEFAULT_AD_HOC_CHANNEL;
        priv->mac_control = CMD_ACT_MAC_RX_ON | CMD_ACT_MAC_TX_ON;
        priv->radio_on = 1;
        priv->enablehwauto = 1;
-        priv->capability = WLAN_CAPABILITY_SHORT_PREAMBLE;
        priv->psmode = LBS802_11POWERMODECAM;
        priv->psstate = PS_STATE_FULL_POWER;
        priv->is_deep_sleep = 0;
@@ -997,11 +983,6 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
        INIT_DELAYED_WORK(&priv->assoc_work, lbs_association_worker);
        INIT_DELAYED_WORK(&priv->scan_work, lbs_scan_worker);
        INIT_WORK(&priv->mcast_work, lbs_set_mcast_worker);
-        INIT_WORK(&priv->sync_channel, lbs_sync_channel_worker);
-        priv->mesh_open = 0;
-        sprintf(priv->mesh_ssid, "mesh");
-        priv->mesh_ssid_len = 4;
        priv->wol_criteria = 0xffffffff;
        priv->wol_gpio = 0xff;
@@ -1075,6 +1056,17 @@ void lbs_remove_card(struct lbs_private *priv)
 EXPORT_SYMBOL_GPL(lbs_remove_card);
+static int lbs_rtap_supported(struct lbs_private *priv)
+{
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) == MRVL_FW_V5)
+                return 1;
+        /* newer firmware use a capability mask */
+        return ((MRVL_FW_MAJOR_REV(priv->fwrelease) >= MRVL_FW_V10) &&
+                (priv->fwcapinfo & MESH_CAPINFO_ENABLE_MASK));
+}
 int lbs_start_card(struct lbs_private *priv)
 {
        struct net_device *dev = priv->dev;
@@ -1094,12 +1086,14 @@ int lbs_start_card(struct lbs_private *priv)
        lbs_update_channel(priv);
+        lbs_init_mesh(priv);
        /*
         * While rtap isn't related to mesh, only mesh-enabled
         * firmware implements the rtap functionality via
         * CMD_802_11_MONITOR_MODE.
         */
-        if (lbs_init_mesh(priv)) {
+        if (lbs_rtap_supported(priv)) {
                if (device_create_file(&dev->dev, &dev_attr_lbs_rtap))
                        lbs_pr_err("cannot register lbs_rtap attribute\n");
        }
@@ -1133,7 +1127,9 @@ void lbs_stop_card(struct lbs_private *priv)
        netif_carrier_off(dev);
        lbs_debugfs_remove_one(priv);
-        if (lbs_deinit_mesh(priv))
+        lbs_deinit_mesh(priv);
+        if (lbs_rtap_supported(priv))
                device_remove_file(&dev->dev, &dev_attr_lbs_rtap);
        /* Delete the timeout of the currently processing command */
diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c
index 2f91c9b808af..954cd00f7452 100644
--- a/drivers/net/wireless/libertas/mesh.c
+++ b/drivers/net/wireless/libertas/mesh.c
@@ -1,4 +1,3 @@
-#include <linux/moduleparam.h>
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
 #include <linux/netdevice.h>
@@ -196,7 +195,14 @@ int lbs_init_mesh(struct lbs_private *priv)
        lbs_deb_enter(LBS_DEB_MESH);
-        if (priv->mesh_fw_ver == MESH_FW_OLD) {
+        priv->mesh_connect_status = LBS_DISCONNECTED;
+        /* Determine mesh_fw_ver from fwrelease and fwcapinfo */
+        /* 5.0.16p0 9.0.0.p0 is known to NOT support any mesh */
+        /* 5.110.22 have mesh command with 0xa3 command id */
+        /* 10.0.0.p0 FW brings in mesh config command with different id */
+        /* Check FW version MSB and initialize mesh_fw_ver */
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) == MRVL_FW_V5) {
                /* Enable mesh, if supported, and work out which TLV it uses.
                   0x100 + 291 is an unofficial value used in 5.110.20.pXX
                   0x100 + 37 is the official value used in 5.110.21.pXX
@@ -218,7 +224,9 @@ int lbs_init_mesh(struct lbs_private *priv)
                                            priv->channel))
                                priv->mesh_tlv = 0;
                }
-        } else if (priv->mesh_fw_ver == MESH_FW_NEW) {
+        } else
+        if ((MRVL_FW_MAJOR_REV(priv->fwrelease) >= MRVL_FW_V10) &&
+                (priv->fwcapinfo & MESH_CAPINFO_ENABLE_MASK)) {
                /* 10.0.0.pXX new firmwares should succeed with TLV
                 * 0x100+37; Do not invoke command with old TLV.
                 */
@@ -227,7 +235,12 @@ int lbs_init_mesh(struct lbs_private *priv)
                                    priv->channel))
                        priv->mesh_tlv = 0;
        }
        if (priv->mesh_tlv) {
+                sprintf(priv->mesh_ssid, "mesh");
+                priv->mesh_ssid_len = 4;
                lbs_add_mesh(priv);
                if (device_create_file(&dev->dev, &dev_attr_lbs_mesh))
@@ -416,10 +429,10 @@ struct net_device *lbs_mesh_set_dev(struct lbs_private *priv,
        struct net_device *dev, struct rxpd *rxpd)
 {
        if (priv->mesh_dev) {
-                if (priv->mesh_fw_ver == MESH_FW_OLD) {
+                if (priv->mesh_tlv == TLV_TYPE_OLD_MESH_ID) {
                        if (rxpd->rx_control & RxPD_MESH_FRAME)
                                dev = priv->mesh_dev;
-                } else if (priv->mesh_fw_ver == MESH_FW_NEW) {
+                } else if (priv->mesh_tlv == TLV_TYPE_MESH_ID) {
                        if (rxpd->u.bss.bss_num == MESH_IFACE_ID)
                                dev = priv->mesh_dev;
                }
@@ -432,9 +445,9 @@ void lbs_mesh_set_txpd(struct lbs_private *priv,
        struct net_device *dev, struct txpd *txpd)
 {
        if (dev == priv->mesh_dev) {
-                if (priv->mesh_fw_ver == MESH_FW_OLD)
+                if (priv->mesh_tlv == TLV_TYPE_OLD_MESH_ID)
                        txpd->tx_control |= cpu_to_le32(TxPD_MESH_FRAME);
-                else if (priv->mesh_fw_ver == MESH_FW_NEW)
+                else if (priv->mesh_tlv == TLV_TYPE_MESH_ID)
                        txpd->u.bss.bss_num = MESH_IFACE_ID;
        }
 }
@@ -538,7 +551,7 @@ static int __lbs_mesh_config_send(struct lbs_private *priv,
         * Command id is 0xac for v10 FW along with mesh interface
         * id in bits 14-13-12.
         */
-        if (priv->mesh_fw_ver == MESH_FW_NEW)
+        if (priv->mesh_tlv == TLV_TYPE_MESH_ID)
                command = CMD_MESH_CONFIG |
                          (MESH_IFACE_ID << MESH_IFACE_BIT_OFFSET);
diff --git a/drivers/net/wireless/libertas/mesh.h b/drivers/net/wireless/libertas/mesh.h
index fea9b5d005fc..e2573303a328 100644
--- a/drivers/net/wireless/libertas/mesh.h
+++ b/drivers/net/wireless/libertas/mesh.h
@@ -9,6 +9,8 @@
 #include <net/lib80211.h>
+#ifdef CONFIG_LIBERTAS_MESH
 /* Mesh statistics */
 struct lbs_mesh_stats {
        u32     fwd_bcast_cnt;          /* Fwd: Broadcast counter */
@@ -46,11 +48,20 @@ void lbs_mesh_set_txpd(struct lbs_private *priv,
 /* Command handling */
 struct cmd_ds_command;
+struct cmd_ds_mesh_access;
+struct cmd_ds_mesh_config;
 int lbs_cmd_bt_access(struct cmd_ds_command *cmd,
        u16 cmd_action, void *pdata_buf);
 int lbs_cmd_fwt_access(struct cmd_ds_command *cmd,
        u16 cmd_action, void *pdata_buf);
+int lbs_mesh_access(struct lbs_private *priv, uint16_t cmd_action,
+                    struct cmd_ds_mesh_access *cmd);
+int lbs_mesh_config_send(struct lbs_private *priv,
+                         struct cmd_ds_mesh_config *cmd,
+                         uint16_t action, uint16_t type);
+int lbs_mesh_config(struct lbs_private *priv, uint16_t enable, uint16_t chan);
 /* Persistent configuration */
@@ -75,4 +86,25 @@ void lbs_mesh_ethtool_get_strings(struct net_device *dev,
        uint32_t stringset, uint8_t *s);
+/* Accessors */
+#define lbs_mesh_open(priv) (priv->mesh_open)
+#define lbs_mesh_connected(priv) (priv->mesh_connect_status == LBS_CONNECTED)
+#else
+#define lbs_init_mesh(priv)
+#define lbs_deinit_mesh(priv)
+#define lbs_add_mesh(priv)
+#define lbs_remove_mesh(priv)
+#define lbs_mesh_set_dev(priv, dev, rxpd) (dev)
+#define lbs_mesh_set_txpd(priv, dev, txpd)
+#define lbs_mesh_config(priv, enable, chan)
+#define lbs_mesh_open(priv) (0)
+#define lbs_mesh_connected(priv) (0)
+#endif
 #endif
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index b0b1c7841500..220361e69cd3 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -635,7 +635,7 @@ out:
        if (priv->connect_status == LBS_CONNECTED && !priv->tx_pending_len)
                netif_wake_queue(priv->dev);
-        if (priv->mesh_dev && (priv->mesh_connect_status == LBS_CONNECTED) &&
+        if (priv->mesh_dev && lbs_mesh_connected(priv) &&
            !priv->tx_pending_len)
                netif_wake_queue(priv->mesh_dev);
diff --git a/drivers/net/wireless/libertas/tx.c b/drivers/net/wireless/libertas/tx.c
index 315d1ce286ca..52d244ea3d97 100644
--- a/drivers/net/wireless/libertas/tx.c
+++ b/drivers/net/wireless/libertas/tx.c
@@ -198,7 +198,7 @@ void lbs_send_tx_feedback(struct lbs_private *priv, u32 try_count)
        if (priv->connect_status == LBS_CONNECTED)
                netif_wake_queue(priv->dev);
-        if (priv->mesh_dev && (priv->mesh_connect_status == LBS_CONNECTED))
+        if (priv->mesh_dev && lbs_mesh_connected(priv))
                netif_wake_queue(priv->mesh_dev);
 }
 EXPORT_SYMBOL_GPL(lbs_send_tx_feedback);
diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
index 4b1aab593a84..71f88a08e090 100644
--- a/drivers/net/wireless/libertas/wext.c
+++ b/drivers/net/wireless/libertas/wext.c
@@ -192,7 +192,7 @@ static void copy_active_data_rates(struct lbs_private *priv, u8 *rates)
        lbs_deb_enter(LBS_DEB_WEXT);
        if ((priv->connect_status != LBS_CONNECTED) &&
-                (priv->mesh_connect_status != LBS_CONNECTED))
+                !lbs_mesh_connected(priv))
                memcpy(rates, lbs_bg_rates, MAX_RATES);
        else
                memcpy(rates, priv->curbssparams.rates, MAX_RATES);
@@ -298,6 +298,7 @@ static int lbs_get_nick(struct net_device *dev, struct iw_request_info *info,
        return 0;
 }
+#ifdef CONFIG_LIBERTAS_MESH
 static int mesh_get_nick(struct net_device *dev, struct iw_request_info *info,
                         struct iw_point *dwrq, char *extra)
 {
@@ -307,7 +308,7 @@ static int mesh_get_nick(struct net_device *dev, struct iw_request_info *info,
        /* Use nickname to indicate that mesh is on */
-        if (priv->mesh_connect_status == LBS_CONNECTED) {
+        if (lbs_mesh_connected(priv)) {
                strncpy(extra, "Mesh", 12);
                extra[12] = '\0';
                dwrq->length = strlen(extra);
@@ -321,6 +322,7 @@ static int mesh_get_nick(struct net_device *dev, struct iw_request_info *info,
        lbs_deb_leave(LBS_DEB_WEXT);
        return 0;
 }
+#endif
 static int lbs_set_rts(struct net_device *dev, struct iw_request_info *info,
                        struct iw_param *vwrq, char *extra)
@@ -422,6 +424,7 @@ static int lbs_get_mode(struct net_device *dev,
        return 0;
 }
+#ifdef CONFIG_LIBERTAS_MESH
 static int mesh_wlan_get_mode(struct net_device *dev,
                              struct iw_request_info *info, u32 * uwrq,
                              char *extra)
@@ -433,6 +436,7 @@ static int mesh_wlan_get_mode(struct net_device *dev,
        lbs_deb_leave(LBS_DEB_WEXT);
        return 0;
 }
+#endif
 static int lbs_get_txpow(struct net_device *dev,
                          struct iw_request_info *info,
@@ -863,7 +867,7 @@ static struct iw_statistics *lbs_get_wireless_stats(struct net_device *dev)
        /* If we're not associated, all quality values are meaningless */
        if ((priv->connect_status != LBS_CONNECTED) &&
-            (priv->mesh_connect_status != LBS_CONNECTED))
+            !lbs_mesh_connected(priv))
                goto out;
        /* Quality by RSSI */
@@ -1010,6 +1014,7 @@ out:
        return ret;
 }
+#ifdef CONFIG_LIBERTAS_MESH
 static int lbs_mesh_set_freq(struct net_device *dev,
                             struct iw_request_info *info,
                             struct iw_freq *fwrq, char *extra)
@@ -1061,6 +1066,7 @@ out:
        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
        return ret;
 }
+#endif
 static int lbs_set_rate(struct net_device *dev, struct iw_request_info *info,
                  struct iw_param *vwrq, char *extra)
@@ -2108,6 +2114,7 @@ out:
        return ret;
 }
+#ifdef CONFIG_LIBERTAS_MESH
 static int lbs_mesh_get_essid(struct net_device *dev,
                              struct iw_request_info *info,
                              struct iw_point *dwrq, char *extra)
@@ -2161,6 +2168,7 @@ static int lbs_mesh_set_essid(struct net_device *dev,
        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
        return ret;
 }
+#endif
 /**
 *  @brief Connect to the AP or Ad-hoc Network with specific bssid
@@ -2267,7 +2275,13 @@ static const iw_handler lbs_handler[] = {
        (iw_handler) lbs_get_encodeext,/* SIOCGIWENCODEEXT */
        (iw_handler) NULL,              /* SIOCSIWPMKSA */
 };
+struct iw_handler_def lbs_handler_def = {
+        .num_standard   = ARRAY_SIZE(lbs_handler),
+        .standard       = (iw_handler *) lbs_handler,
+        .get_wireless_stats = lbs_get_wireless_stats,
+};
+#ifdef CONFIG_LIBERTAS_MESH
 static const iw_handler mesh_wlan_handler[] = {
        (iw_handler) NULL,      /* SIOCSIWCOMMIT */
        (iw_handler) lbs_get_name,      /* SIOCGIWNAME */
@@ -2325,14 +2339,10 @@ static const iw_handler mesh_wlan_handler[] = {
        (iw_handler) lbs_get_encodeext,/* SIOCGIWENCODEEXT */
        (iw_handler) NULL,              /* SIOCSIWPMKSA */
 };
-struct iw_handler_def lbs_handler_def = {
-        .num_standard   = ARRAY_SIZE(lbs_handler),
-        .standard       = (iw_handler *) lbs_handler,
-        .get_wireless_stats = lbs_get_wireless_stats,
-};
 struct iw_handler_def mesh_handler_def = {
        .num_standard   = ARRAY_SIZE(mesh_wlan_handler),
        .standard       = (iw_handler *) mesh_wlan_handler,
        .get_wireless_stats = lbs_get_wireless_stats,
 };
+#endif
diff --git a/drivers/net/wireless/libertas_tf/main.c b/drivers/net/wireless/libertas_tf/main.c
index 26a1abd5bb03..ba3eb0101d55 100644
--- a/drivers/net/wireless/libertas_tf/main.c
+++ b/drivers/net/wireless/libertas_tf/main.c
@@ -318,14 +318,14 @@ static void lbtf_op_stop(struct ieee80211_hw *hw)
 }
 static int lbtf_op_add_interface(struct ieee80211_hw *hw,
-                        struct ieee80211_if_init_conf *conf)
+                        struct ieee80211_vif *vif)
 {
        struct lbtf_private *priv = hw->priv;
        if (priv->vif != NULL)
                return -EOPNOTSUPP;
-        priv->vif = conf->vif;
+        priv->vif = vif;
-        switch (conf->type) {
+        switch (vif->type) {
        case NL80211_IFTYPE_MESH_POINT:
        case NL80211_IFTYPE_AP:
                lbtf_set_mode(priv, LBTF_AP_MODE);
@@ -337,12 +337,12 @@ static int lbtf_op_add_interface(struct ieee80211_hw *hw,
                priv->vif = NULL;
                return -EOPNOTSUPP;
        }
-        lbtf_set_mac_address(priv, (u8 *) conf->mac_addr);
+        lbtf_set_mac_address(priv, (u8 *) vif->addr);
        return 0;
 }
 static void lbtf_op_remove_interface(struct ieee80211_hw *hw,
-                        struct ieee80211_if_init_conf *conf)
+                        struct ieee80211_vif *vif)
 {
        struct lbtf_private *priv = hw->priv;
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 88e41176e7fd..84df3fcf37b3 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -436,6 +436,38 @@ static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
 }
+struct mac80211_hwsim_addr_match_data {
+        bool ret;
+        const u8 *addr;
+};
+static void mac80211_hwsim_addr_iter(void *data, u8 *mac,
+                                     struct ieee80211_vif *vif)
+{
+        struct mac80211_hwsim_addr_match_data *md = data;
+        if (memcmp(mac, md->addr, ETH_ALEN) == 0)
+                md->ret = true;
+}
+static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
+                                      const u8 *addr)
+{
+        struct mac80211_hwsim_addr_match_data md;
+        if (memcmp(addr, data->hw->wiphy->perm_addr, ETH_ALEN) == 0)
+                return true;
+        md.ret = false;
+        md.addr = addr;
+        ieee80211_iterate_active_interfaces_atomic(data->hw,
+                                                   mac80211_hwsim_addr_iter,
+                                                   &md);
+        return md.ret;
+}
 static bool mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
                                    struct sk_buff *skb)
 {
@@ -488,8 +520,7 @@ static bool mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
                if (nskb == NULL)
                        continue;
-                if (memcmp(hdr->addr1, data2->hw->wiphy->perm_addr,
+                if (mac80211_hwsim_addr_match(data2, hdr->addr1))
-                           ETH_ALEN) == 0)
                        ack = true;
                memcpy(IEEE80211_SKB_RXCB(nskb), &rx_status, sizeof(rx_status));
                ieee80211_rx_irqsafe(data2->hw, nskb);
@@ -553,24 +584,24 @@ static void mac80211_hwsim_stop(struct ieee80211_hw *hw)
 static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
-                                        struct ieee80211_if_init_conf *conf)
+                                        struct ieee80211_vif *vif)
 {
        printk(KERN_DEBUG "%s:%s (type=%d mac_addr=%pM)\n",
-               wiphy_name(hw->wiphy), __func__, conf->type,
+               wiphy_name(hw->wiphy), __func__, vif->type,
-               conf->mac_addr);
+               vif->addr);
-        hwsim_set_magic(conf->vif);
+        hwsim_set_magic(vif);
        return 0;
 }
 static void mac80211_hwsim_remove_interface(
-        struct ieee80211_hw *hw, struct ieee80211_if_init_conf *conf)
+        struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
        printk(KERN_DEBUG "%s:%s (type=%d mac_addr=%pM)\n",
-               wiphy_name(hw->wiphy), __func__, conf->type,
+               wiphy_name(hw->wiphy), __func__, vif->type,
-               conf->mac_addr);
+               vif->addr);
-        hwsim_check_magic(conf->vif);
+        hwsim_check_magic(vif);
-        hwsim_clear_magic(conf->vif);
+        hwsim_clear_magic(vif);
 }
@@ -618,12 +649,26 @@ static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
 {
        struct mac80211_hwsim_data *data = hw->priv;
        struct ieee80211_conf *conf = &hw->conf;
+        static const char *chantypes[4] = {
-        printk(KERN_DEBUG "%s:%s (freq=%d idle=%d ps=%d)\n",
+                [NL80211_CHAN_NO_HT] = "noht",
+                [NL80211_CHAN_HT20] = "ht20",
+                [NL80211_CHAN_HT40MINUS] = "ht40-",
+                [NL80211_CHAN_HT40PLUS] = "ht40+",
+        };
+        static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
+                [IEEE80211_SMPS_AUTOMATIC] = "auto",
+                [IEEE80211_SMPS_OFF] = "off",
+                [IEEE80211_SMPS_STATIC] = "static",
+                [IEEE80211_SMPS_DYNAMIC] = "dynamic",
+        };
+        printk(KERN_DEBUG "%s:%s (freq=%d/%s idle=%d ps=%d smps=%s)\n",
               wiphy_name(hw->wiphy), __func__,
               conf->channel->center_freq,
+               chantypes[conf->channel_type],
               !!(conf->flags & IEEE80211_CONF_IDLE),
-               !!(conf->flags & IEEE80211_CONF_PS));
+               !!(conf->flags & IEEE80211_CONF_PS),
+               smps_modes[conf->smps_mode]);
        data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
@@ -827,6 +872,41 @@ static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
 }
 #endif
+static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       enum ieee80211_ampdu_mlme_action action,
+                                       struct ieee80211_sta *sta, u16 tid, u16 *ssn)
+{
+        switch (action) {
+        case IEEE80211_AMPDU_TX_START:
+                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+        case IEEE80211_AMPDU_TX_STOP:
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
+                break;
+        case IEEE80211_AMPDU_RX_START:
+        case IEEE80211_AMPDU_RX_STOP:
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+        return 0;
+}
+static void mac80211_hwsim_flush(struct ieee80211_hw *hw, bool drop)
+{
+        /*
+         * In this special case, there's nothing we need to
+         * do because hwsim does transmission synchronously.
+         * In the future, when it does transmissions via
+         * userspace, we may need to do something.
+         */
+}
 static const struct ieee80211_ops mac80211_hwsim_ops =
 {
        .tx = mac80211_hwsim_tx,
@@ -841,6 +921,8 @@ static const struct ieee80211_ops mac80211_hwsim_ops =
        .set_tim = mac80211_hwsim_set_tim,
        .conf_tx = mac80211_hwsim_conf_tx,
        CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)
+        .ampdu_action = mac80211_hwsim_ampdu_action,
+        .flush = mac80211_hwsim_flush,
 };
@@ -1082,7 +1164,9 @@ static int __init init_mac80211_hwsim(void)
                        BIT(NL80211_IFTYPE_MESH_POINT);
                hw->flags = IEEE80211_HW_MFP_CAPABLE |
-                            IEEE80211_HW_SIGNAL_DBM;
+                            IEEE80211_HW_SIGNAL_DBM |
+                            IEEE80211_HW_SUPPORTS_STATIC_SMPS |
+                            IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS;
                /* ask mac80211 to reserve space for magic */
                hw->vif_data_size = sizeof(struct hwsim_vif_priv);
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 59f92105b0c2..a04863633d1a 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -26,7 +26,7 @@
 #define MWL8K_DESC      "Marvell TOPDOG(R) 802.11 Wireless Network Driver"
 #define MWL8K_NAME      KBUILD_MODNAME
-#define MWL8K_VERSION   "0.10"
+#define MWL8K_VERSION   "0.11"
 /* Register definitions */
 #define MWL8K_HIU_GEN_PTR                       0x00000c10
@@ -92,8 +92,7 @@ struct mwl8k_device_info {
        char *part_name;
        char *helper_image;
        char *fw_image;
-        struct rxd_ops *rxd_ops;
+        struct rxd_ops *ap_rxd_ops;
-        u16 modes;
 };
 struct mwl8k_rx_queue {
@@ -126,29 +125,23 @@ struct mwl8k_tx_queue {
        struct sk_buff **skb;
 };
-/* Pointers to the firmware data and meta information about it.  */
+struct mwl8k_priv {
-struct mwl8k_firmware {
+        struct ieee80211_hw *hw;
-        /* Boot helper code */
+        struct pci_dev *pdev;
-        struct firmware *helper;
-        /* Microcode */
+        struct mwl8k_device_info *device_info;
-        struct firmware *ucode;
-};
-struct mwl8k_priv {
        void __iomem *sram;
        void __iomem *regs;
-        struct ieee80211_hw *hw;
-        struct pci_dev *pdev;
+        /* firmware */
+        struct firmware *fw_helper;
+        struct firmware *fw_ucode;
-        struct mwl8k_device_info *device_info;
+        /* hardware/firmware parameters */
        bool ap_fw;
        struct rxd_ops *rxd_ops;
-        /* firmware files and meta data */
-        struct mwl8k_firmware fw;
        /* firmware access */
        struct mutex fw_mutex;
        struct task_struct *fw_mutex_owner;
@@ -192,6 +185,10 @@ struct mwl8k_priv {
        bool sniffer_enabled;
        bool wmm_enabled;
+        struct work_struct sta_notify_worker;
+        spinlock_t sta_notify_list_lock;
+        struct list_head sta_notify_list;
        /* XXX need to convert this to handle multiple interfaces */
        bool capture_beacon;
        u8 capture_bssid[ETH_ALEN];
@@ -211,25 +208,20 @@ struct mwl8k_priv {
 /* Per interface specific private data */
 struct mwl8k_vif {
-        /* backpointer to parent config block */
+        /* Local MAC address.  */
-        struct mwl8k_priv *priv;
+        u8 mac_addr[ETH_ALEN];
-        /* BSS config of AP or IBSS from mac80211*/
-        struct ieee80211_bss_conf bss_info;
-        /* BSSID of AP or IBSS */
-        u8      bssid[ETH_ALEN];
-        u8      mac_addr[ETH_ALEN];
-         /* Index into station database.Returned by update_sta_db call */
-        u8      peer_id;
        /* Non AMPDU sequence number assigned by driver */
-        u16     seqno;
+        u16 seqno;
 };
 #define MWL8K_VIF(_vif) ((struct mwl8k_vif *)&((_vif)->drv_priv))
+struct mwl8k_sta {
+        /* Index into station database. Returned by UPDATE_STADB.  */
+        u8 peer_id;
+};
+#define MWL8K_STA(_sta) ((struct mwl8k_sta *)&((_sta)->drv_priv))
 static const struct ieee80211_channel mwl8k_channels[] = {
        { .center_freq = 2412, .hw_value = 1, },
        { .center_freq = 2417, .hw_value = 2, },
@@ -242,6 +234,9 @@ static const struct ieee80211_channel mwl8k_channels[] = {
        { .center_freq = 2452, .hw_value = 9, },
        { .center_freq = 2457, .hw_value = 10, },
        { .center_freq = 2462, .hw_value = 11, },
+        { .center_freq = 2467, .hw_value = 12, },
+        { .center_freq = 2472, .hw_value = 13, },
+        { .center_freq = 2484, .hw_value = 14, },
 };
 static const struct ieee80211_rate mwl8k_rates[] = {
@@ -261,10 +256,6 @@ static const struct ieee80211_rate mwl8k_rates[] = {
        { .bitrate = 720, .hw_value = 144, },
 };
-static const u8 mwl8k_rateids[12] = {
-        2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108,
-};
 /* Set or get info from Firmware */
 #define MWL8K_CMD_SET                   0x0001
 #define MWL8K_CMD_GET                   0x0000
@@ -355,8 +346,8 @@ static void mwl8k_release_fw(struct firmware **fw)
 static void mwl8k_release_firmware(struct mwl8k_priv *priv)
 {
-        mwl8k_release_fw(&priv->fw.ucode);
+        mwl8k_release_fw(&priv->fw_ucode);
-        mwl8k_release_fw(&priv->fw.helper);
+        mwl8k_release_fw(&priv->fw_helper);
 }
 /* Request fw image */
@@ -377,7 +368,7 @@ static int mwl8k_request_firmware(struct mwl8k_priv *priv)
        int rc;
        if (di->helper_image != NULL) {
-                rc = mwl8k_request_fw(priv, di->helper_image, &priv->fw.helper);
+                rc = mwl8k_request_fw(priv, di->helper_image, &priv->fw_helper);
                if (rc) {
                        printk(KERN_ERR "%s: Error requesting helper "
                               "firmware file %s\n", pci_name(priv->pdev),
@@ -386,11 +377,11 @@ static int mwl8k_request_firmware(struct mwl8k_priv *priv)
                }
        }
-        rc = mwl8k_request_fw(priv, di->fw_image, &priv->fw.ucode);
+        rc = mwl8k_request_fw(priv, di->fw_image, &priv->fw_ucode);
        if (rc) {
                printk(KERN_ERR "%s: Error requesting firmware file %s\n",
                       pci_name(priv->pdev), di->fw_image);
-                mwl8k_release_fw(&priv->fw.helper);
+                mwl8k_release_fw(&priv->fw_helper);
                return rc;
        }
@@ -551,13 +542,12 @@ static int mwl8k_feed_fw_image(struct mwl8k_priv *priv,
 static int mwl8k_load_firmware(struct ieee80211_hw *hw)
 {
        struct mwl8k_priv *priv = hw->priv;
-        struct firmware *fw = priv->fw.ucode;
+        struct firmware *fw = priv->fw_ucode;
-        struct mwl8k_device_info *di = priv->device_info;
        int rc;
        int loops;
        if (!memcmp(fw->data, "\x01\x00\x00\x00", 4)) {
-                struct firmware *helper = priv->fw.helper;
+                struct firmware *helper = priv->fw_helper;
                if (helper == NULL) {
                        printk(KERN_ERR "%s: helper image needed but none "
@@ -584,10 +574,7 @@ static int mwl8k_load_firmware(struct ieee80211_hw *hw)
                return rc;
        }
-        if (di->modes & BIT(NL80211_IFTYPE_AP))
+        iowrite32(MWL8K_MODE_STA, priv->regs + MWL8K_HIU_GEN_PTR);
-                iowrite32(MWL8K_MODE_AP, priv->regs + MWL8K_HIU_GEN_PTR);
-        else
-                iowrite32(MWL8K_MODE_STA, priv->regs + MWL8K_HIU_GEN_PTR);
        loops = 500000;
        do {
@@ -610,91 +597,6 @@ static int mwl8k_load_firmware(struct ieee80211_hw *hw)
 }
-/*
- * Defines shared between transmission and reception.
- */
-/* HT control fields for firmware */
-struct ewc_ht_info {
-        __le16  control1;
-        __le16  control2;
-        __le16  control3;
-} __attribute__((packed));
-/* Firmware Station database operations */
-#define MWL8K_STA_DB_ADD_ENTRY          0
-#define MWL8K_STA_DB_MODIFY_ENTRY       1
-#define MWL8K_STA_DB_DEL_ENTRY          2
-#define MWL8K_STA_DB_FLUSH              3
-/* Peer Entry flags - used to define the type of the peer node */
-#define MWL8K_PEER_TYPE_ACCESSPOINT     2
-struct peer_capability_info {
-        /* Peer type - AP vs. STA.  */
-        __u8    peer_type;
-        /* Basic 802.11 capabilities from assoc resp.  */
-        __le16  basic_caps;
-        /* Set if peer supports 802.11n high throughput (HT).  */
-        __u8    ht_support;
-        /* Valid if HT is supported.  */
-        __le16  ht_caps;
-        __u8    extended_ht_caps;
-        struct ewc_ht_info      ewc_info;
-        /* Legacy rate table. Intersection of our rates and peer rates.  */
-        __u8    legacy_rates[12];
-        /* HT rate table. Intersection of our rates and peer rates.  */
-        __u8    ht_rates[16];
-        __u8    pad[16];
-        /* If set, interoperability mode, no proprietary extensions.  */
-        __u8    interop;
-        __u8    pad2;
-        __u8    station_id;
-        __le16  amsdu_enabled;
-} __attribute__((packed));
-/* Inline functions to manipulate QoS field in data descriptor.  */
-static inline u16 mwl8k_qos_setbit_eosp(u16 qos)
-{
-        u16 val_mask = 1 << 4;
-        /* End of Service Period Bit 4 */
-        return qos | val_mask;
-}
-static inline u16 mwl8k_qos_setbit_ack(u16 qos, u8 ack_policy)
-{
-        u16 val_mask = 0x3;
-        u8      shift = 5;
-        u16 qos_mask = ~(val_mask << shift);
-        /* Ack Policy Bit 5-6 */
-        return (qos & qos_mask) | ((ack_policy & val_mask) << shift);
-}
-static inline u16 mwl8k_qos_setbit_amsdu(u16 qos)
-{
-        u16 val_mask = 1 << 7;
-        /* AMSDU present Bit 7 */
-        return qos | val_mask;
-}
-static inline u16 mwl8k_qos_setbit_qlen(u16 qos, u8 len)
-{
-        u16 val_mask = 0xff;
-        u8      shift = 8;
-        u16 qos_mask = ~(val_mask << shift);
-        /* Queue Length Bits 8-15 */
-        return (qos & qos_mask) | ((len & val_mask) << shift);
-}
 /* DMA header used by firmware and hardware.  */
 struct mwl8k_dma_data {
        __le16 fwlen;
@@ -761,9 +663,9 @@ static inline void mwl8k_add_dma_header(struct sk_buff *skb)
 /*
- * Packet reception for 88w8366.
+ * Packet reception for 88w8366 AP firmware.
 */
-struct mwl8k_rxd_8366 {
+struct mwl8k_rxd_8366_ap {
        __le16 pkt_len;
        __u8 sq2;
        __u8 rate;
@@ -781,23 +683,23 @@ struct mwl8k_rxd_8366 {
        __u8 rx_ctrl;
 } __attribute__((packed));
-#define MWL8K_8366_RATE_INFO_MCS_FORMAT         0x80
+#define MWL8K_8366_AP_RATE_INFO_MCS_FORMAT      0x80
-#define MWL8K_8366_RATE_INFO_40MHZ              0x40
+#define MWL8K_8366_AP_RATE_INFO_40MHZ           0x40
-#define MWL8K_8366_RATE_INFO_RATEID(x)          ((x) & 0x3f)
+#define MWL8K_8366_AP_RATE_INFO_RATEID(x)       ((x) & 0x3f)
-#define MWL8K_8366_RX_CTRL_OWNED_BY_HOST        0x80
+#define MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST     0x80
-static void mwl8k_rxd_8366_init(void *_rxd, dma_addr_t next_dma_addr)
+static void mwl8k_rxd_8366_ap_init(void *_rxd, dma_addr_t next_dma_addr)
 {
-        struct mwl8k_rxd_8366 *rxd = _rxd;
+        struct mwl8k_rxd_8366_ap *rxd = _rxd;
        rxd->next_rxd_phys_addr = cpu_to_le32(next_dma_addr);
-        rxd->rx_ctrl = MWL8K_8366_RX_CTRL_OWNED_BY_HOST;
+        rxd->rx_ctrl = MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST;
 }
-static void mwl8k_rxd_8366_refill(void *_rxd, dma_addr_t addr, int len)
+static void mwl8k_rxd_8366_ap_refill(void *_rxd, dma_addr_t addr, int len)
 {
-        struct mwl8k_rxd_8366 *rxd = _rxd;
+        struct mwl8k_rxd_8366_ap *rxd = _rxd;
        rxd->pkt_len = cpu_to_le16(len);
        rxd->pkt_phys_addr = cpu_to_le32(addr);
@@ -806,12 +708,12 @@ static void mwl8k_rxd_8366_refill(void *_rxd, dma_addr_t addr, int len)
 }
 static int
-mwl8k_rxd_8366_process(void *_rxd, struct ieee80211_rx_status *status,
+mwl8k_rxd_8366_ap_process(void *_rxd, struct ieee80211_rx_status *status,
-                       __le16 *qos)
+                          __le16 *qos)
 {
-        struct mwl8k_rxd_8366 *rxd = _rxd;
+        struct mwl8k_rxd_8366_ap *rxd = _rxd;
-        if (!(rxd->rx_ctrl & MWL8K_8366_RX_CTRL_OWNED_BY_HOST))
+        if (!(rxd->rx_ctrl & MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST))
                return -1;
        rmb();
@@ -820,11 +722,11 @@ mwl8k_rxd_8366_process(void *_rxd, struct ieee80211_rx_status *status,
        status->signal = -rxd->rssi;
        status->noise = -rxd->noise_floor;
-        if (rxd->rate & MWL8K_8366_RATE_INFO_MCS_FORMAT) {
+        if (rxd->rate & MWL8K_8366_AP_RATE_INFO_MCS_FORMAT) {
                status->flag |= RX_FLAG_HT;
-                if (rxd->rate & MWL8K_8366_RATE_INFO_40MHZ)
+                if (rxd->rate & MWL8K_8366_AP_RATE_INFO_40MHZ)
                        status->flag |= RX_FLAG_40MHZ;
-                status->rate_idx = MWL8K_8366_RATE_INFO_RATEID(rxd->rate);
+                status->rate_idx = MWL8K_8366_AP_RATE_INFO_RATEID(rxd->rate);
        } else {
                int i;
@@ -844,17 +746,17 @@ mwl8k_rxd_8366_process(void *_rxd, struct ieee80211_rx_status *status,
        return le16_to_cpu(rxd->pkt_len);
 }
-static struct rxd_ops rxd_8366_ops = {
+static struct rxd_ops rxd_8366_ap_ops = {
-        .rxd_size       = sizeof(struct mwl8k_rxd_8366),
+        .rxd_size       = sizeof(struct mwl8k_rxd_8366_ap),
-        .rxd_init       = mwl8k_rxd_8366_init,
+        .rxd_init       = mwl8k_rxd_8366_ap_init,
-        .rxd_refill     = mwl8k_rxd_8366_refill,
+        .rxd_refill     = mwl8k_rxd_8366_ap_refill,
-        .rxd_process    = mwl8k_rxd_8366_process,
+        .rxd_process    = mwl8k_rxd_8366_ap_process,
 };
 /*
- * Packet reception for 88w8687.
+ * Packet reception for STA firmware.
 */
-struct mwl8k_rxd_8687 {
+struct mwl8k_rxd_sta {
        __le16 pkt_len;
        __u8 link_quality;
        __u8 noise_level;
@@ -871,26 +773,26 @@ struct mwl8k_rxd_8687 {
        __u8 pad2[2];
 } __attribute__((packed));
-#define MWL8K_8687_RATE_INFO_SHORTPRE           0x8000
+#define MWL8K_STA_RATE_INFO_SHORTPRE            0x8000
-#define MWL8K_8687_RATE_INFO_ANTSELECT(x)       (((x) >> 11) & 0x3)
+#define MWL8K_STA_RATE_INFO_ANTSELECT(x)        (((x) >> 11) & 0x3)
-#define MWL8K_8687_RATE_INFO_RATEID(x)          (((x) >> 3) & 0x3f)
+#define MWL8K_STA_RATE_INFO_RATEID(x)           (((x) >> 3) & 0x3f)
-#define MWL8K_8687_RATE_INFO_40MHZ              0x0004
+#define MWL8K_STA_RATE_INFO_40MHZ               0x0004
-#define MWL8K_8687_RATE_INFO_SHORTGI            0x0002
+#define MWL8K_STA_RATE_INFO_SHORTGI             0x0002
-#define MWL8K_8687_RATE_INFO_MCS_FORMAT         0x0001
+#define MWL8K_STA_RATE_INFO_MCS_FORMAT          0x0001
-#define MWL8K_8687_RX_CTRL_OWNED_BY_HOST        0x02
+#define MWL8K_STA_RX_CTRL_OWNED_BY_HOST         0x02
-static void mwl8k_rxd_8687_init(void *_rxd, dma_addr_t next_dma_addr)
+static void mwl8k_rxd_sta_init(void *_rxd, dma_addr_t next_dma_addr)
 {
-        struct mwl8k_rxd_8687 *rxd = _rxd;
+        struct mwl8k_rxd_sta *rxd = _rxd;
        rxd->next_rxd_phys_addr = cpu_to_le32(next_dma_addr);
-        rxd->rx_ctrl = MWL8K_8687_RX_CTRL_OWNED_BY_HOST;
+        rxd->rx_ctrl = MWL8K_STA_RX_CTRL_OWNED_BY_HOST;
 }
-static void mwl8k_rxd_8687_refill(void *_rxd, dma_addr_t addr, int len)
+static void mwl8k_rxd_sta_refill(void *_rxd, dma_addr_t addr, int len)
 {
-        struct mwl8k_rxd_8687 *rxd = _rxd;
+        struct mwl8k_rxd_sta *rxd = _rxd;
        rxd->pkt_len = cpu_to_le16(len);
        rxd->pkt_phys_addr = cpu_to_le32(addr);
@@ -899,13 +801,13 @@ static void mwl8k_rxd_8687_refill(void *_rxd, dma_addr_t addr, int len)
 }
 static int
-mwl8k_rxd_8687_process(void *_rxd, struct ieee80211_rx_status *status,
+mwl8k_rxd_sta_process(void *_rxd, struct ieee80211_rx_status *status,
                       __le16 *qos)
 {
-        struct mwl8k_rxd_8687 *rxd = _rxd;
+        struct mwl8k_rxd_sta *rxd = _rxd;
        u16 rate_info;
-        if (!(rxd->rx_ctrl & MWL8K_8687_RX_CTRL_OWNED_BY_HOST))
+        if (!(rxd->rx_ctrl & MWL8K_STA_RX_CTRL_OWNED_BY_HOST))
                return -1;
        rmb();
@@ -915,16 +817,16 @@ mwl8k_rxd_8687_process(void *_rxd, struct ieee80211_rx_status *status,
        status->signal = -rxd->rssi;
        status->noise = -rxd->noise_level;
-        status->antenna = MWL8K_8687_RATE_INFO_ANTSELECT(rate_info);
+        status->antenna = MWL8K_STA_RATE_INFO_ANTSELECT(rate_info);
-        status->rate_idx = MWL8K_8687_RATE_INFO_RATEID(rate_info);
+        status->rate_idx = MWL8K_STA_RATE_INFO_RATEID(rate_info);
-        if (rate_info & MWL8K_8687_RATE_INFO_SHORTPRE)
+        if (rate_info & MWL8K_STA_RATE_INFO_SHORTPRE)
                status->flag |= RX_FLAG_SHORTPRE;
-        if (rate_info & MWL8K_8687_RATE_INFO_40MHZ)
+        if (rate_info & MWL8K_STA_RATE_INFO_40MHZ)
                status->flag |= RX_FLAG_40MHZ;
-        if (rate_info & MWL8K_8687_RATE_INFO_SHORTGI)
+        if (rate_info & MWL8K_STA_RATE_INFO_SHORTGI)
                status->flag |= RX_FLAG_SHORT_GI;
-        if (rate_info & MWL8K_8687_RATE_INFO_MCS_FORMAT)
+        if (rate_info & MWL8K_STA_RATE_INFO_MCS_FORMAT)
                status->flag |= RX_FLAG_HT;
        status->band = IEEE80211_BAND_2GHZ;
@@ -935,11 +837,11 @@ mwl8k_rxd_8687_process(void *_rxd, struct ieee80211_rx_status *status,
        return le16_to_cpu(rxd->pkt_len);
 }
-static struct rxd_ops rxd_8687_ops = {
+static struct rxd_ops rxd_sta_ops = {
-        .rxd_size       = sizeof(struct mwl8k_rxd_8687),
+        .rxd_size       = sizeof(struct mwl8k_rxd_sta),
-        .rxd_init       = mwl8k_rxd_8687_init,
+        .rxd_init       = mwl8k_rxd_sta_init,
-        .rxd_refill     = mwl8k_rxd_8687_refill,
+        .rxd_refill     = mwl8k_rxd_sta_refill,
-        .rxd_process    = mwl8k_rxd_8687_process,
+        .rxd_process    = mwl8k_rxd_sta_process,
 };
@@ -1153,16 +1055,18 @@ static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
 * Packet transmission.
 */
-/* Transmit packet ACK policy */
-#define MWL8K_TXD_ACK_POLICY_NORMAL             0
-#define MWL8K_TXD_ACK_POLICY_BLOCKACK           3
 #define MWL8K_TXD_STATUS_OK                     0x00000001
 #define MWL8K_TXD_STATUS_OK_RETRY               0x00000002
 #define MWL8K_TXD_STATUS_OK_MORE_RETRY          0x00000004
 #define MWL8K_TXD_STATUS_MULTICAST_TX           0x00000008
 #define MWL8K_TXD_STATUS_FW_OWNED               0x80000000
+#define MWL8K_QOS_QLEN_UNSPEC                   0xff00
+#define MWL8K_QOS_ACK_POLICY_MASK               0x0060
+#define MWL8K_QOS_ACK_POLICY_NORMAL             0x0000
+#define MWL8K_QOS_ACK_POLICY_BLOCKACK           0x0060
+#define MWL8K_QOS_EOSP                          0x0010
 struct mwl8k_tx_desc {
        __le32 status;
        __u8 data_rate;
@@ -1316,8 +1220,8 @@ static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
                }
                if (priv->pending_tx_pkts < oldcount) {
-                        printk(KERN_NOTICE "%s: timeout waiting for tx "
+                        printk(KERN_NOTICE "%s: waiting for tx rings "
-                               "rings to drain (%d -> %d pkts), retrying\n",
+                               "to drain (%d -> %d pkts)\n",
                               wiphy_name(hw->wiphy), oldcount,
                               priv->pending_tx_pkts);
                        retry = 1;
@@ -1459,24 +1363,17 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
        if (ieee80211_is_mgmt(wh->frame_control) ||
            ieee80211_is_ctl(wh->frame_control)) {
                txdatarate = 0;
-                qos = mwl8k_qos_setbit_eosp(qos);
+                qos |= MWL8K_QOS_QLEN_UNSPEC | MWL8K_QOS_EOSP;
-                /* Set Queue size to unspecified */
-                qos = mwl8k_qos_setbit_qlen(qos, 0xff);
        } else if (ieee80211_is_data(wh->frame_control)) {
                txdatarate = 1;
                if (is_multicast_ether_addr(wh->addr1))
                        txstatus |= MWL8K_TXD_STATUS_MULTICAST_TX;
-                /* Send pkt in an aggregate if AMPDU frame.  */
+                qos &= ~MWL8K_QOS_ACK_POLICY_MASK;
                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
-                        qos = mwl8k_qos_setbit_ack(qos,
+                        qos |= MWL8K_QOS_ACK_POLICY_BLOCKACK;
-                                MWL8K_TXD_ACK_POLICY_BLOCKACK);
                else
-                        qos = mwl8k_qos_setbit_ack(qos,
+                        qos |= MWL8K_QOS_ACK_POLICY_NORMAL;
-                                MWL8K_TXD_ACK_POLICY_NORMAL);
-                if (qos & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
-                        qos = mwl8k_qos_setbit_amsdu(qos);
        }
        dma = pci_map_single(priv->pdev, skb->data,
@@ -1503,7 +1400,10 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
        tx->pkt_phys_addr = cpu_to_le32(dma);
        tx->pkt_len = cpu_to_le16(skb->len);
        tx->rate_info = 0;
-        tx->peer_id = mwl8k_vif->peer_id;
+        if (!priv->ap_fw && tx_info->control.sta != NULL)
+                tx->peer_id = MWL8K_STA(tx_info->control.sta)->peer_id;
+        else
+                tx->peer_id = 0;
        wmb();
        tx->status = cpu_to_le32(MWL8K_TXD_STATUS_FW_OWNED | txstatus);
@@ -1678,6 +1578,68 @@ struct mwl8k_cmd_get_hw_spec_sta {
        __le32 total_rxd;
 } __attribute__((packed));
+#define MWL8K_CAP_MAX_AMSDU             0x20000000
+#define MWL8K_CAP_GREENFIELD            0x08000000
+#define MWL8K_CAP_AMPDU                 0x04000000
+#define MWL8K_CAP_RX_STBC               0x01000000
+#define MWL8K_CAP_TX_STBC               0x00800000
+#define MWL8K_CAP_SHORTGI_40MHZ         0x00400000
+#define MWL8K_CAP_SHORTGI_20MHZ         0x00200000
+#define MWL8K_CAP_RX_ANTENNA_MASK       0x000e0000
+#define MWL8K_CAP_TX_ANTENNA_MASK       0x0001c000
+#define MWL8K_CAP_DELAY_BA              0x00003000
+#define MWL8K_CAP_MIMO                  0x00000200
+#define MWL8K_CAP_40MHZ                 0x00000100
+static void mwl8k_set_ht_caps(struct ieee80211_hw *hw, u32 cap)
+{
+        struct mwl8k_priv *priv = hw->priv;
+        int rx_streams;
+        int tx_streams;
+        priv->band.ht_cap.ht_supported = 1;
+        if (cap & MWL8K_CAP_MAX_AMSDU)
+                priv->band.ht_cap.cap |= IEEE80211_HT_CAP_MAX_AMSDU;
+        if (cap & MWL8K_CAP_GREENFIELD)
+                priv->band.ht_cap.cap |= IEEE80211_HT_CAP_GRN_FLD;
+        if (cap & MWL8K_CAP_AMPDU) {
+                hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+                priv->band.ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+                priv->band.ht_cap.ampdu_density =
+                                IEEE80211_HT_MPDU_DENSITY_NONE;
+        }
+        if (cap & MWL8K_CAP_RX_STBC)
+                priv->band.ht_cap.cap |= IEEE80211_HT_CAP_RX_STBC;
+        if (cap & MWL8K_CAP_TX_STBC)
+                priv->band.ht_cap.cap |= IEEE80211_HT_CAP_TX_STBC;
+        if (cap & MWL8K_CAP_SHORTGI_40MHZ)
+                priv->band.ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+        if (cap & MWL8K_CAP_SHORTGI_20MHZ)
+                priv->band.ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
+        if (cap & MWL8K_CAP_DELAY_BA)
+                priv->band.ht_cap.cap |= IEEE80211_HT_CAP_DELAY_BA;
+        if (cap & MWL8K_CAP_40MHZ)
+                priv->band.ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+        rx_streams = hweight32(cap & MWL8K_CAP_RX_ANTENNA_MASK);
+        tx_streams = hweight32(cap & MWL8K_CAP_TX_ANTENNA_MASK);
+        priv->band.ht_cap.mcs.rx_mask[0] = 0xff;
+        if (rx_streams >= 2)
+                priv->band.ht_cap.mcs.rx_mask[1] = 0xff;
+        if (rx_streams >= 3)
+                priv->band.ht_cap.mcs.rx_mask[2] = 0xff;
+        priv->band.ht_cap.mcs.rx_mask[4] = 0x01;
+        priv->band.ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+        if (rx_streams != tx_streams) {
+                priv->band.ht_cap.mcs.tx_params |= IEEE80211_HT_MCS_TX_RX_DIFF;
+                priv->band.ht_cap.mcs.tx_params |= (tx_streams - 1) <<
+                                IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
+        }
+}
 static int mwl8k_cmd_get_hw_spec_sta(struct ieee80211_hw *hw)
 {
        struct mwl8k_priv *priv = hw->priv;
@@ -1708,6 +1670,8 @@ static int mwl8k_cmd_get_hw_spec_sta(struct ieee80211_hw *hw)
                priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
                priv->fw_rev = le32_to_cpu(cmd->fw_rev);
                priv->hw_rev = cmd->hw_rev;
+                if (cmd->caps & cpu_to_le32(MWL8K_CAP_MIMO))
+                        mwl8k_set_ht_caps(hw, le32_to_cpu(cmd->caps));
        }
        kfree(cmd);
@@ -1897,9 +1861,9 @@ __mwl8k_cmd_mac_multicast_adr(struct ieee80211_hw *hw, int allmulti,
 }
 /*
- * CMD_802_11_GET_STAT.
+ * CMD_GET_STAT.
 */
-struct mwl8k_cmd_802_11_get_stat {
+struct mwl8k_cmd_get_stat {
        struct mwl8k_cmd_pkt header;
        __le32 stats[64];
 } __attribute__((packed));
@@ -1909,10 +1873,10 @@ struct mwl8k_cmd_802_11_get_stat {
 #define MWL8K_STAT_FCS_ERROR    24
 #define MWL8K_STAT_RTS_SUCCESS  11
-static int mwl8k_cmd_802_11_get_stat(struct ieee80211_hw *hw,
+static int mwl8k_cmd_get_stat(struct ieee80211_hw *hw,
-                                struct ieee80211_low_level_stats *stats)
+                              struct ieee80211_low_level_stats *stats)
 {
-        struct mwl8k_cmd_802_11_get_stat *cmd;
+        struct mwl8k_cmd_get_stat *cmd;
        int rc;
        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
@@ -1939,9 +1903,9 @@ static int mwl8k_cmd_802_11_get_stat(struct ieee80211_hw *hw,
 }
 /*
- * CMD_802_11_RADIO_CONTROL.
+ * CMD_RADIO_CONTROL.
 */
-struct mwl8k_cmd_802_11_radio_control {
+struct mwl8k_cmd_radio_control {
        struct mwl8k_cmd_pkt header;
        __le16 action;
        __le16 control;
@@ -1949,10 +1913,10 @@ struct mwl8k_cmd_802_11_radio_control {
 } __attribute__((packed));
 static int
-mwl8k_cmd_802_11_radio_control(struct ieee80211_hw *hw, bool enable, bool force)
+mwl8k_cmd_radio_control(struct ieee80211_hw *hw, bool enable, bool force)
 {
        struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_cmd_802_11_radio_control *cmd;
+        struct mwl8k_cmd_radio_control *cmd;
        int rc;
        if (enable == priv->radio_on && !force)
@@ -1977,36 +1941,32 @@ mwl8k_cmd_802_11_radio_control(struct ieee80211_hw *hw, bool enable, bool force)
        return rc;
 }
-static int mwl8k_cmd_802_11_radio_disable(struct ieee80211_hw *hw)
+static int mwl8k_cmd_radio_disable(struct ieee80211_hw *hw)
 {
-        return mwl8k_cmd_802_11_radio_control(hw, 0, 0);
+        return mwl8k_cmd_radio_control(hw, 0, 0);
 }
-static int mwl8k_cmd_802_11_radio_enable(struct ieee80211_hw *hw)
+static int mwl8k_cmd_radio_enable(struct ieee80211_hw *hw)
 {
-        return mwl8k_cmd_802_11_radio_control(hw, 1, 0);
+        return mwl8k_cmd_radio_control(hw, 1, 0);
 }
 static int
 mwl8k_set_radio_preamble(struct ieee80211_hw *hw, bool short_preamble)
 {
-        struct mwl8k_priv *priv;
+        struct mwl8k_priv *priv = hw->priv;
-        if (hw == NULL || hw->priv == NULL)
-                return -EINVAL;
-        priv = hw->priv;
        priv->radio_short_preamble = short_preamble;
-        return mwl8k_cmd_802_11_radio_control(hw, 1, 1);
+        return mwl8k_cmd_radio_control(hw, 1, 1);
 }
 /*
- * CMD_802_11_RF_TX_POWER.
+ * CMD_RF_TX_POWER.
 */
 #define MWL8K_TX_POWER_LEVEL_TOTAL      8
-struct mwl8k_cmd_802_11_rf_tx_power {
+struct mwl8k_cmd_rf_tx_power {
        struct mwl8k_cmd_pkt header;
        __le16 action;
        __le16 support_level;
@@ -2015,9 +1975,9 @@ struct mwl8k_cmd_802_11_rf_tx_power {
        __le16 power_level_list[MWL8K_TX_POWER_LEVEL_TOTAL];
 } __attribute__((packed));
-static int mwl8k_cmd_802_11_rf_tx_power(struct ieee80211_hw *hw, int dBm)
+static int mwl8k_cmd_rf_tx_power(struct ieee80211_hw *hw, int dBm)
 {
-        struct mwl8k_cmd_802_11_rf_tx_power *cmd;
+        struct mwl8k_cmd_rf_tx_power *cmd;
        int rc;
        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
@@ -2103,7 +2063,7 @@ struct mwl8k_cmd_set_post_scan {
 } __attribute__((packed));
 static int
-mwl8k_cmd_set_post_scan(struct ieee80211_hw *hw, __u8 *mac)
+mwl8k_cmd_set_post_scan(struct ieee80211_hw *hw, const __u8 *mac)
 {
        struct mwl8k_cmd_set_post_scan *cmd;
        int rc;
@@ -2134,8 +2094,9 @@ struct mwl8k_cmd_set_rf_channel {
 } __attribute__((packed));
 static int mwl8k_cmd_set_rf_channel(struct ieee80211_hw *hw,
-                                    struct ieee80211_channel *channel)
+                                    struct ieee80211_conf *conf)
 {
+        struct ieee80211_channel *channel = conf->channel;
        struct mwl8k_cmd_set_rf_channel *cmd;
        int rc;
@@ -2147,10 +2108,17 @@ static int mwl8k_cmd_set_rf_channel(struct ieee80211_hw *hw,
        cmd->header.length = cpu_to_le16(sizeof(*cmd));
        cmd->action = cpu_to_le16(MWL8K_CMD_SET);
        cmd->current_channel = channel->hw_value;
        if (channel->band == IEEE80211_BAND_2GHZ)
-                cmd->channel_flags = cpu_to_le32(0x00000081);
+                cmd->channel_flags |= cpu_to_le32(0x00000001);
-        else
-                cmd->channel_flags = cpu_to_le32(0x00000000);
+        if (conf->channel_type == NL80211_CHAN_NO_HT ||
+            conf->channel_type == NL80211_CHAN_HT20)
+                cmd->channel_flags |= cpu_to_le32(0x00000080);
+        else if (conf->channel_type == NL80211_CHAN_HT40MINUS)
+                cmd->channel_flags |= cpu_to_le32(0x000001900);
+        else if (conf->channel_type == NL80211_CHAN_HT40PLUS)
+                cmd->channel_flags |= cpu_to_le32(0x000000900);
        rc = mwl8k_post_cmd(hw, &cmd->header);
        kfree(cmd);
@@ -2159,85 +2127,75 @@ static int mwl8k_cmd_set_rf_channel(struct ieee80211_hw *hw,
 }
 /*
- * CMD_SET_SLOT.
+ * CMD_SET_AID.
 */
-struct mwl8k_cmd_set_slot {
+#define MWL8K_FRAME_PROT_DISABLED                       0x00
-        struct mwl8k_cmd_pkt header;
+#define MWL8K_FRAME_PROT_11G                            0x07
-        __le16 action;
+#define MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY              0x02
-        __u8 short_slot;
+#define MWL8K_FRAME_PROT_11N_HT_ALL                     0x06
-} __attribute__((packed));
-static int mwl8k_cmd_set_slot(struct ieee80211_hw *hw, bool short_slot_time)
-{
-        struct mwl8k_cmd_set_slot *cmd;
-        int rc;
-        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
-        if (cmd == NULL)
-                return -ENOMEM;
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_SLOT);
-        cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le16(MWL8K_CMD_SET);
-        cmd->short_slot = short_slot_time;
-        rc = mwl8k_post_cmd(hw, &cmd->header);
-        kfree(cmd);
-        return rc;
+struct mwl8k_cmd_update_set_aid {
-}
+        struct  mwl8k_cmd_pkt header;
+        __le16  aid;
-/*
+         /* AP's MAC address (BSSID) */
- * CMD_MIMO_CONFIG.
+        __u8    bssid[ETH_ALEN];
- */
+        __le16  protection_mode;
-struct mwl8k_cmd_mimo_config {
+        __u8    supp_rates[14];
-        struct mwl8k_cmd_pkt header;
-        __le32 action;
-        __u8 rx_antenna_map;
-        __u8 tx_antenna_map;
 } __attribute__((packed));
-static int mwl8k_cmd_mimo_config(struct ieee80211_hw *hw, __u8 rx, __u8 tx)
+static void legacy_rate_mask_to_array(u8 *rates, u32 mask)
 {
-        struct mwl8k_cmd_mimo_config *cmd;
+        int i;
-        int rc;
+        int j;
-        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
-        if (cmd == NULL)
-                return -ENOMEM;
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_MIMO_CONFIG);
-        cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le32((u32)MWL8K_CMD_SET);
-        cmd->rx_antenna_map = rx;
-        cmd->tx_antenna_map = tx;
-        rc = mwl8k_post_cmd(hw, &cmd->header);
+        /*
-        kfree(cmd);
+         * Clear nonstandard rates 4 and 13.
+         */
+        mask &= 0x1fef;
-        return rc;
+        for (i = 0, j = 0; i < 14; i++) {
+                if (mask & (1 << i))
+                        rates[j++] = mwl8k_rates[i].hw_value;
+        }
 }
-/*
+static int
- * CMD_ENABLE_SNIFFER.
+mwl8k_cmd_set_aid(struct ieee80211_hw *hw,
- */
+                  struct ieee80211_vif *vif, u32 legacy_rate_mask)
-struct mwl8k_cmd_enable_sniffer {
-        struct mwl8k_cmd_pkt header;
-        __le32 action;
-} __attribute__((packed));
-static int mwl8k_enable_sniffer(struct ieee80211_hw *hw, bool enable)
 {
-        struct mwl8k_cmd_enable_sniffer *cmd;
+        struct mwl8k_cmd_update_set_aid *cmd;
+        u16 prot_mode;
        int rc;
        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
        if (cmd == NULL)
                return -ENOMEM;
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_ENABLE_SNIFFER);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_AID);
        cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le32(!!enable);
+        cmd->aid = cpu_to_le16(vif->bss_conf.aid);
+        memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
+        if (vif->bss_conf.use_cts_prot) {
+                prot_mode = MWL8K_FRAME_PROT_11G;
+        } else {
+                switch (vif->bss_conf.ht_operation_mode &
+                        IEEE80211_HT_OP_MODE_PROTECTION) {
+                case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
+                        prot_mode = MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY;
+                        break;
+                case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
+                        prot_mode = MWL8K_FRAME_PROT_11N_HT_ALL;
+                        break;
+                default:
+                        prot_mode = MWL8K_FRAME_PROT_DISABLED;
+                        break;
+                }
+        }
+        cmd->protection_mode = cpu_to_le16(prot_mode);
+        legacy_rate_mask_to_array(cmd->supp_rates, legacy_rate_mask);
        rc = mwl8k_post_cmd(hw, &cmd->header);
        kfree(cmd);
@@ -2246,37 +2204,32 @@ static int mwl8k_enable_sniffer(struct ieee80211_hw *hw, bool enable)
 }
 /*
- * CMD_SET_MAC_ADDR.
+ * CMD_SET_RATE.
 */
-struct mwl8k_cmd_set_mac_addr {
+struct mwl8k_cmd_set_rate {
-        struct mwl8k_cmd_pkt header;
+        struct  mwl8k_cmd_pkt header;
-        union {
+        __u8    legacy_rates[14];
-                struct {
-                        __le16 mac_type;
+        /* Bitmap for supported MCS codes.  */
-                        __u8 mac_addr[ETH_ALEN];
+        __u8    mcs_set[16];
-                } mbss;
+        __u8    reserved[16];
-                __u8 mac_addr[ETH_ALEN];
-        };
 } __attribute__((packed));
-static int mwl8k_set_mac_addr(struct ieee80211_hw *hw, u8 *mac)
+static int
+mwl8k_cmd_set_rate(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                   u32 legacy_rate_mask, u8 *mcs_rates)
 {
-        struct mwl8k_priv *priv = hw->priv;
+        struct mwl8k_cmd_set_rate *cmd;
-        struct mwl8k_cmd_set_mac_addr *cmd;
        int rc;
        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
        if (cmd == NULL)
                return -ENOMEM;
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_MAC_ADDR);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATE);
        cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        if (priv->ap_fw) {
+        legacy_rate_mask_to_array(cmd->legacy_rates, legacy_rate_mask);
-                cmd->mbss.mac_type = 0;
+        memcpy(cmd->mcs_set, mcs_rates, 16);
-                memcpy(cmd->mbss.mac_addr, mac, ETH_ALEN);
-        } else {
-                memcpy(cmd->mac_addr, mac, ETH_ALEN);
-        }
        rc = mwl8k_post_cmd(hw, &cmd->header);
        kfree(cmd);
@@ -2284,29 +2237,40 @@ static int mwl8k_set_mac_addr(struct ieee80211_hw *hw, u8 *mac)
        return rc;
 }
 /*
- * CMD_SET_RATEADAPT_MODE.
+ * CMD_FINALIZE_JOIN.
 */
-struct mwl8k_cmd_set_rate_adapt_mode {
+#define MWL8K_FJ_BEACON_MAXLEN  128
+struct mwl8k_cmd_finalize_join {
        struct mwl8k_cmd_pkt header;
-        __le16 action;
+        __le32 sleep_interval;  /* Number of beacon periods to sleep */
-        __le16 mode;
+        __u8 beacon_data[MWL8K_FJ_BEACON_MAXLEN];
 } __attribute__((packed));
-static int mwl8k_cmd_setrateadaptmode(struct ieee80211_hw *hw, __u16 mode)
+static int mwl8k_cmd_finalize_join(struct ieee80211_hw *hw, void *frame,
+                                   int framelen, int dtim)
 {
-        struct mwl8k_cmd_set_rate_adapt_mode *cmd;
+        struct mwl8k_cmd_finalize_join *cmd;
+        struct ieee80211_mgmt *payload = frame;
+        int payload_len;
        int rc;
        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
        if (cmd == NULL)
                return -ENOMEM;
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATEADAPT_MODE);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_FINALIZE_JOIN);
        cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le16(MWL8K_CMD_SET);
+        cmd->sleep_interval = cpu_to_le32(dtim ? dtim : 1);
-        cmd->mode = cpu_to_le16(mode);
+        payload_len = framelen - ieee80211_hdrlen(payload->frame_control);
+        if (payload_len < 0)
+                payload_len = 0;
+        else if (payload_len > MWL8K_FJ_BEACON_MAXLEN)
+                payload_len = MWL8K_FJ_BEACON_MAXLEN;
+        memcpy(cmd->beacon_data, &payload->u.beacon, payload_len);
        rc = mwl8k_post_cmd(hw, &cmd->header);
        kfree(cmd);
@@ -2315,59 +2279,57 @@ static int mwl8k_cmd_setrateadaptmode(struct ieee80211_hw *hw, __u16 mode)
 }
 /*
- * CMD_SET_WMM_MODE.
+ * CMD_SET_RTS_THRESHOLD.
 */
-struct mwl8k_cmd_set_wmm {
+struct mwl8k_cmd_set_rts_threshold {
        struct mwl8k_cmd_pkt header;
        __le16 action;
+        __le16 threshold;
 } __attribute__((packed));
-static int mwl8k_set_wmm(struct ieee80211_hw *hw, bool enable)
+static int mwl8k_cmd_set_rts_threshold(struct ieee80211_hw *hw,
+                                       u16 action, u16 threshold)
 {
-        struct mwl8k_priv *priv = hw->priv;
+        struct mwl8k_cmd_set_rts_threshold *cmd;
-        struct mwl8k_cmd_set_wmm *cmd;
        int rc;
        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
        if (cmd == NULL)
                return -ENOMEM;
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_WMM_MODE);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_RTS_THRESHOLD);
        cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le16(!!enable);
+        cmd->action = cpu_to_le16(action);
+        cmd->threshold = cpu_to_le16(threshold);
        rc = mwl8k_post_cmd(hw, &cmd->header);
        kfree(cmd);
-        if (!rc)
-                priv->wmm_enabled = enable;
        return rc;
 }
 /*
- * CMD_SET_RTS_THRESHOLD.
+ * CMD_SET_SLOT.
 */
-struct mwl8k_cmd_rts_threshold {
+struct mwl8k_cmd_set_slot {
        struct mwl8k_cmd_pkt header;
        __le16 action;
-        __le16 threshold;
+        __u8 short_slot;
 } __attribute__((packed));
-static int mwl8k_rts_threshold(struct ieee80211_hw *hw,
+static int mwl8k_cmd_set_slot(struct ieee80211_hw *hw, bool short_slot_time)
-                               u16 action, u16 threshold)
 {
-        struct mwl8k_cmd_rts_threshold *cmd;
+        struct mwl8k_cmd_set_slot *cmd;
        int rc;
        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
        if (cmd == NULL)
                return -ENOMEM;
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_RTS_THRESHOLD);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_SLOT);
        cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le16(action);
+        cmd->action = cpu_to_le16(MWL8K_CMD_SET);
-        cmd->threshold = cpu_to_le16(threshold);
+        cmd->short_slot = short_slot_time;
        rc = mwl8k_post_cmd(hw, &cmd->header);
        kfree(cmd);
@@ -2426,9 +2388,9 @@ struct mwl8k_cmd_set_edca_params {
                                 MWL8K_SET_EDCA_AIFS)
 static int
-mwl8k_set_edca_params(struct ieee80211_hw *hw, __u8 qnum,
+mwl8k_cmd_set_edca_params(struct ieee80211_hw *hw, __u8 qnum,
-                __u16 cw_min, __u16 cw_max,
+                          __u16 cw_min, __u16 cw_max,
-                __u8 aifs, __u16 txop)
+                          __u8 aifs, __u16 txop)
 {
        struct mwl8k_priv *priv = hw->priv;
        struct mwl8k_cmd_set_edca_params *cmd;
@@ -2467,202 +2429,60 @@ mwl8k_set_edca_params(struct ieee80211_hw *hw, __u8 qnum,
 }
 /*
- * CMD_FINALIZE_JOIN.
+ * CMD_SET_WMM_MODE.
 */
-#define MWL8K_FJ_BEACON_MAXLEN  128
+struct mwl8k_cmd_set_wmm_mode {
-struct mwl8k_cmd_finalize_join {
        struct mwl8k_cmd_pkt header;
-        __le32 sleep_interval;  /* Number of beacon periods to sleep */
+        __le16 action;
-        __u8 beacon_data[MWL8K_FJ_BEACON_MAXLEN];
 } __attribute__((packed));
-static int mwl8k_finalize_join(struct ieee80211_hw *hw, void *frame,
+static int mwl8k_cmd_set_wmm_mode(struct ieee80211_hw *hw, bool enable)
-                               int framelen, int dtim)
 {
-        struct mwl8k_cmd_finalize_join *cmd;
+        struct mwl8k_priv *priv = hw->priv;
-        struct ieee80211_mgmt *payload = frame;
+        struct mwl8k_cmd_set_wmm_mode *cmd;
-        int payload_len;
        int rc;
        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
        if (cmd == NULL)
                return -ENOMEM;
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_FINALIZE_JOIN);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_WMM_MODE);
        cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->sleep_interval = cpu_to_le32(dtim ? dtim : 1);
+        cmd->action = cpu_to_le16(!!enable);
-        payload_len = framelen - ieee80211_hdrlen(payload->frame_control);
-        if (payload_len < 0)
-                payload_len = 0;
-        else if (payload_len > MWL8K_FJ_BEACON_MAXLEN)
-                payload_len = MWL8K_FJ_BEACON_MAXLEN;
-        memcpy(cmd->beacon_data, &payload->u.beacon, payload_len);
        rc = mwl8k_post_cmd(hw, &cmd->header);
        kfree(cmd);
-        return rc;
+        if (!rc)
-}
+                priv->wmm_enabled = enable;
-/*
- * CMD_UPDATE_STADB.
- */
-struct mwl8k_cmd_update_sta_db {
-        struct mwl8k_cmd_pkt header;
-        /* See STADB_ACTION_TYPE */
-        __le32  action;
-        /* Peer MAC address */
-        __u8    peer_addr[ETH_ALEN];
-        __le32  reserved;
-        /* Peer info - valid during add/update.  */
-        struct peer_capability_info     peer_info;
-} __attribute__((packed));
-static int mwl8k_cmd_update_sta_db(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif, __u32 action)
-{
-        struct mwl8k_vif *mv_vif = MWL8K_VIF(vif);
-        struct ieee80211_bss_conf *info = &mv_vif->bss_info;
-        struct mwl8k_cmd_update_sta_db *cmd;
-        struct peer_capability_info *peer_info;
-        int rc;
-        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
-        if (cmd == NULL)
-                return -ENOMEM;
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_STADB);
-        cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->action = cpu_to_le32(action);
-        peer_info = &cmd->peer_info;
-        memcpy(cmd->peer_addr, mv_vif->bssid, ETH_ALEN);
-        switch (action) {
-        case MWL8K_STA_DB_ADD_ENTRY:
-        case MWL8K_STA_DB_MODIFY_ENTRY:
-                /* Build peer_info block */
-                peer_info->peer_type = MWL8K_PEER_TYPE_ACCESSPOINT;
-                peer_info->basic_caps = cpu_to_le16(info->assoc_capability);
-                memcpy(peer_info->legacy_rates, mwl8k_rateids,
-                       sizeof(mwl8k_rateids));
-                peer_info->interop = 1;
-                peer_info->amsdu_enabled = 0;
-                rc = mwl8k_post_cmd(hw, &cmd->header);
-                if (rc == 0)
-                        mv_vif->peer_id = peer_info->station_id;
-                break;
-        case MWL8K_STA_DB_DEL_ENTRY:
-        case MWL8K_STA_DB_FLUSH:
-        default:
-                rc = mwl8k_post_cmd(hw, &cmd->header);
-                if (rc == 0)
-                        mv_vif->peer_id = 0;
-                break;
-        }
-        kfree(cmd);
-        return rc;
-}
-/*
- * CMD_SET_AID.
- */
-#define MWL8K_FRAME_PROT_DISABLED                       0x00
-#define MWL8K_FRAME_PROT_11G                            0x07
-#define MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY              0x02
-#define MWL8K_FRAME_PROT_11N_HT_ALL                     0x06
-struct mwl8k_cmd_update_set_aid {
-        struct  mwl8k_cmd_pkt header;
-        __le16  aid;
-         /* AP's MAC address (BSSID) */
-        __u8    bssid[ETH_ALEN];
-        __le16  protection_mode;
-        __u8    supp_rates[14];
-} __attribute__((packed));
-static int mwl8k_cmd_set_aid(struct ieee80211_hw *hw,
-                                        struct ieee80211_vif *vif)
-{
-        struct mwl8k_vif *mv_vif = MWL8K_VIF(vif);
-        struct ieee80211_bss_conf *info = &mv_vif->bss_info;
-        struct mwl8k_cmd_update_set_aid *cmd;
-        u16 prot_mode;
-        int rc;
-        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
-        if (cmd == NULL)
-                return -ENOMEM;
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_AID);
-        cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        cmd->aid = cpu_to_le16(info->aid);
-        memcpy(cmd->bssid, mv_vif->bssid, ETH_ALEN);
-        if (info->use_cts_prot) {
-                prot_mode = MWL8K_FRAME_PROT_11G;
-        } else {
-                switch (info->ht_operation_mode &
-                        IEEE80211_HT_OP_MODE_PROTECTION) {
-                case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
-                        prot_mode = MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY;
-                        break;
-                case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
-                        prot_mode = MWL8K_FRAME_PROT_11N_HT_ALL;
-                        break;
-                default:
-                        prot_mode = MWL8K_FRAME_PROT_DISABLED;
-                        break;
-                }
-        }
-        cmd->protection_mode = cpu_to_le16(prot_mode);
-        memcpy(cmd->supp_rates, mwl8k_rateids, sizeof(mwl8k_rateids));
-        rc = mwl8k_post_cmd(hw, &cmd->header);
-        kfree(cmd);
        return rc;
 }
 /*
- * CMD_SET_RATE.
+ * CMD_MIMO_CONFIG.
 */
-struct mwl8k_cmd_update_rateset {
+struct mwl8k_cmd_mimo_config {
-        struct  mwl8k_cmd_pkt header;
+        struct mwl8k_cmd_pkt header;
-        __u8    legacy_rates[14];
+        __le32 action;
+        __u8 rx_antenna_map;
-        /* Bitmap for supported MCS codes.  */
+        __u8 tx_antenna_map;
-        __u8    mcs_set[16];
-        __u8    reserved[16];
 } __attribute__((packed));
-static int mwl8k_update_rateset(struct ieee80211_hw *hw,
+static int mwl8k_cmd_mimo_config(struct ieee80211_hw *hw, __u8 rx, __u8 tx)
-                struct ieee80211_vif *vif)
 {
-        struct mwl8k_cmd_update_rateset *cmd;
+        struct mwl8k_cmd_mimo_config *cmd;
        int rc;
        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
        if (cmd == NULL)
                return -ENOMEM;
-        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATE);
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_MIMO_CONFIG);
        cmd->header.length = cpu_to_le16(sizeof(*cmd));
-        memcpy(cmd->legacy_rates, mwl8k_rateids, sizeof(mwl8k_rateids));
+        cmd->action = cpu_to_le32((u32)MWL8K_CMD_SET);
+        cmd->rx_antenna_map = rx;
+        cmd->tx_antenna_map = tx;
        rc = mwl8k_post_cmd(hw, &cmd->header);
        kfree(cmd);
@@ -2755,6 +2575,217 @@ static int mwl8k_cmd_use_fixed_rate(struct ieee80211_hw *hw,
        return rc;
 }
+/*
+ * CMD_ENABLE_SNIFFER.
+ */
+struct mwl8k_cmd_enable_sniffer {
+        struct mwl8k_cmd_pkt header;
+        __le32 action;
+} __attribute__((packed));
+static int mwl8k_cmd_enable_sniffer(struct ieee80211_hw *hw, bool enable)
+{
+        struct mwl8k_cmd_enable_sniffer *cmd;
+        int rc;
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_ENABLE_SNIFFER);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->action = cpu_to_le32(!!enable);
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
+        return rc;
+}
+/*
+ * CMD_SET_MAC_ADDR.
+ */
+struct mwl8k_cmd_set_mac_addr {
+        struct mwl8k_cmd_pkt header;
+        union {
+                struct {
+                        __le16 mac_type;
+                        __u8 mac_addr[ETH_ALEN];
+                } mbss;
+                __u8 mac_addr[ETH_ALEN];
+        };
+} __attribute__((packed));
+static int mwl8k_cmd_set_mac_addr(struct ieee80211_hw *hw, u8 *mac)
+{
+        struct mwl8k_priv *priv = hw->priv;
+        struct mwl8k_cmd_set_mac_addr *cmd;
+        int rc;
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_MAC_ADDR);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        if (priv->ap_fw) {
+                cmd->mbss.mac_type = 0;
+                memcpy(cmd->mbss.mac_addr, mac, ETH_ALEN);
+        } else {
+                memcpy(cmd->mac_addr, mac, ETH_ALEN);
+        }
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
+        return rc;
+}
+/*
+ * CMD_SET_RATEADAPT_MODE.
+ */
+struct mwl8k_cmd_set_rate_adapt_mode {
+        struct mwl8k_cmd_pkt header;
+        __le16 action;
+        __le16 mode;
+} __attribute__((packed));
+static int mwl8k_cmd_set_rateadapt_mode(struct ieee80211_hw *hw, __u16 mode)
+{
+        struct mwl8k_cmd_set_rate_adapt_mode *cmd;
+        int rc;
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATEADAPT_MODE);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->action = cpu_to_le16(MWL8K_CMD_SET);
+        cmd->mode = cpu_to_le16(mode);
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
+        return rc;
+}
+/*
+ * CMD_UPDATE_STADB.
+ */
+struct ewc_ht_info {
+        __le16  control1;
+        __le16  control2;
+        __le16  control3;
+} __attribute__((packed));
+struct peer_capability_info {
+        /* Peer type - AP vs. STA.  */
+        __u8    peer_type;
+        /* Basic 802.11 capabilities from assoc resp.  */
+        __le16  basic_caps;
+        /* Set if peer supports 802.11n high throughput (HT).  */
+        __u8    ht_support;
+        /* Valid if HT is supported.  */
+        __le16  ht_caps;
+        __u8    extended_ht_caps;
+        struct ewc_ht_info      ewc_info;
+        /* Legacy rate table. Intersection of our rates and peer rates.  */
+        __u8    legacy_rates[12];
+        /* HT rate table. Intersection of our rates and peer rates.  */
+        __u8    ht_rates[16];
+        __u8    pad[16];
+        /* If set, interoperability mode, no proprietary extensions.  */
+        __u8    interop;
+        __u8    pad2;
+        __u8    station_id;
+        __le16  amsdu_enabled;
+} __attribute__((packed));
+struct mwl8k_cmd_update_stadb {
+        struct mwl8k_cmd_pkt header;
+        /* See STADB_ACTION_TYPE */
+        __le32  action;
+        /* Peer MAC address */
+        __u8    peer_addr[ETH_ALEN];
+        __le32  reserved;
+        /* Peer info - valid during add/update.  */
+        struct peer_capability_info     peer_info;
+} __attribute__((packed));
+#define MWL8K_STA_DB_MODIFY_ENTRY       1
+#define MWL8K_STA_DB_DEL_ENTRY          2
+/* Peer Entry flags - used to define the type of the peer node */
+#define MWL8K_PEER_TYPE_ACCESSPOINT     2
+static int mwl8k_cmd_update_stadb_add(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
+                                      struct ieee80211_sta *sta)
+{
+        struct mwl8k_cmd_update_stadb *cmd;
+        struct peer_capability_info *p;
+        int rc;
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_STADB);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->action = cpu_to_le32(MWL8K_STA_DB_MODIFY_ENTRY);
+        memcpy(cmd->peer_addr, sta->addr, ETH_ALEN);
+        p = &cmd->peer_info;
+        p->peer_type = MWL8K_PEER_TYPE_ACCESSPOINT;
+        p->basic_caps = cpu_to_le16(vif->bss_conf.assoc_capability);
+        p->ht_support = sta->ht_cap.ht_supported;
+        p->ht_caps = sta->ht_cap.cap;
+        p->extended_ht_caps = (sta->ht_cap.ampdu_factor & 3) |
+                ((sta->ht_cap.ampdu_density & 7) << 2);
+        legacy_rate_mask_to_array(p->legacy_rates,
+                                  sta->supp_rates[IEEE80211_BAND_2GHZ]);
+        memcpy(p->ht_rates, sta->ht_cap.mcs.rx_mask, 16);
+        p->interop = 1;
+        p->amsdu_enabled = 0;
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
+        return rc ? rc : p->station_id;
+}
+static int mwl8k_cmd_update_stadb_del(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif, u8 *addr)
+{
+        struct mwl8k_cmd_update_stadb *cmd;
+        int rc;
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_STADB);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->action = cpu_to_le32(MWL8K_STA_DB_DEL_ENTRY);
+        memcpy(cmd->peer_addr, addr, ETH_ALEN);
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
+        return rc;
+}
 /*
 * Interrupt handling.
@@ -2836,11 +2867,11 @@ static int mwl8k_start(struct ieee80211_hw *hw)
        rc = mwl8k_fw_lock(hw);
        if (!rc) {
-                rc = mwl8k_cmd_802_11_radio_enable(hw);
+                rc = mwl8k_cmd_radio_enable(hw);
                if (!priv->ap_fw) {
                        if (!rc)
-                                rc = mwl8k_enable_sniffer(hw, 0);
+                                rc = mwl8k_cmd_enable_sniffer(hw, 0);
                        if (!rc)
                                rc = mwl8k_cmd_set_pre_scan(hw);
@@ -2851,10 +2882,10 @@ static int mwl8k_start(struct ieee80211_hw *hw)
                }
                if (!rc)
-                        rc = mwl8k_cmd_setrateadaptmode(hw, 0);
+                        rc = mwl8k_cmd_set_rateadapt_mode(hw, 0);
                if (!rc)
-                        rc = mwl8k_set_wmm(hw, 0);
+                        rc = mwl8k_cmd_set_wmm_mode(hw, 0);
                mwl8k_fw_unlock(hw);
        }
@@ -2873,7 +2904,7 @@ static void mwl8k_stop(struct ieee80211_hw *hw)
        struct mwl8k_priv *priv = hw->priv;
        int i;
-        mwl8k_cmd_802_11_radio_disable(hw);
+        mwl8k_cmd_radio_disable(hw);
        ieee80211_stop_queues(hw);
@@ -2895,7 +2926,7 @@ static void mwl8k_stop(struct ieee80211_hw *hw)
 }
 static int mwl8k_add_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_if_init_conf *conf)
+                                struct ieee80211_vif *vif)
 {
        struct mwl8k_priv *priv = hw->priv;
        struct mwl8k_vif *mwl8k_vif;
@@ -2909,7 +2940,7 @@ static int mwl8k_add_interface(struct ieee80211_hw *hw,
        /*
         * We only support managed interfaces for now.
         */
-        if (conf->type != NL80211_IFTYPE_STATION)
+        if (vif->type != NL80211_IFTYPE_STATION)
                return -EINVAL;
        /*
@@ -2925,34 +2956,31 @@ static int mwl8k_add_interface(struct ieee80211_hw *hw,
        }
        /* Clean out driver private area */
-        mwl8k_vif = MWL8K_VIF(conf->vif);
+        mwl8k_vif = MWL8K_VIF(vif);
        memset(mwl8k_vif, 0, sizeof(*mwl8k_vif));
        /* Set and save the mac address */
-        mwl8k_set_mac_addr(hw, conf->mac_addr);
+        mwl8k_cmd_set_mac_addr(hw, vif->addr);
-        memcpy(mwl8k_vif->mac_addr, conf->mac_addr, ETH_ALEN);
+        memcpy(mwl8k_vif->mac_addr, vif->addr, ETH_ALEN);
-        /* Back pointer to parent config block */
-        mwl8k_vif->priv = priv;
        /* Set Initial sequence number to zero */
        mwl8k_vif->seqno = 0;
-        priv->vif = conf->vif;
+        priv->vif = vif;
        priv->current_channel = NULL;
        return 0;
 }
 static void mwl8k_remove_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_if_init_conf *conf)
+                                   struct ieee80211_vif *vif)
 {
        struct mwl8k_priv *priv = hw->priv;
        if (priv->vif == NULL)
                return;
-        mwl8k_set_mac_addr(hw, "\x00\x00\x00\x00\x00\x00");
+        mwl8k_cmd_set_mac_addr(hw, "\x00\x00\x00\x00\x00\x00");
        priv->vif = NULL;
 }
@@ -2964,7 +2992,7 @@ static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
        int rc;
        if (conf->flags & IEEE80211_CONF_IDLE) {
-                mwl8k_cmd_802_11_radio_disable(hw);
+                mwl8k_cmd_radio_disable(hw);
                priv->current_channel = NULL;
                return 0;
        }
@@ -2973,11 +3001,11 @@ static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
        if (rc)
                return rc;
-        rc = mwl8k_cmd_802_11_radio_enable(hw);
+        rc = mwl8k_cmd_radio_enable(hw);
        if (rc)
                goto out;
-        rc = mwl8k_cmd_set_rf_channel(hw, conf->channel);
+        rc = mwl8k_cmd_set_rf_channel(hw, conf);
        if (rc)
                goto out;
@@ -2985,7 +3013,7 @@ static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
        if (conf->power_level > 18)
                conf->power_level = 18;
-        rc = mwl8k_cmd_802_11_rf_tx_power(hw, conf->power_level);
+        rc = mwl8k_cmd_rf_tx_power(hw, conf->power_level);
        if (rc)
                goto out;
@@ -3009,67 +3037,78 @@ static void mwl8k_bss_info_changed(struct ieee80211_hw *hw,
                                   u32 changed)
 {
        struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
+        u32 ap_legacy_rates;
+        u8 ap_mcs_rates[16];
        int rc;
-        if ((changed & BSS_CHANGED_ASSOC) == 0)
+        if (mwl8k_fw_lock(hw))
                return;
-        priv->capture_beacon = false;
+        /*
+         * No need to capture a beacon if we're no longer associated.
+         */
+        if ((changed & BSS_CHANGED_ASSOC) && !vif->bss_conf.assoc)
+                priv->capture_beacon = false;
-        rc = mwl8k_fw_lock(hw);
+        /*
-        if (rc)
+         * Get the AP's legacy and MCS rates.
-                return;
+         */
+        ap_legacy_rates = 0;
+        if (vif->bss_conf.assoc) {
+                struct ieee80211_sta *ap;
+                rcu_read_lock();
+                ap = ieee80211_find_sta(vif, vif->bss_conf.bssid);
+                if (ap == NULL) {
+                        rcu_read_unlock();
+                        goto out;
+                }
-        if (info->assoc) {
+                ap_legacy_rates = ap->supp_rates[IEEE80211_BAND_2GHZ];
-                memcpy(&mwl8k_vif->bss_info, info,
+                memcpy(ap_mcs_rates, ap->ht_cap.mcs.rx_mask, 16);
-                        sizeof(struct ieee80211_bss_conf));
-                memcpy(mwl8k_vif->bssid, info->bssid, ETH_ALEN);
+                rcu_read_unlock();
+        }
-                /* Install rates */
+        if ((changed & BSS_CHANGED_ASSOC) && vif->bss_conf.assoc) {
-                rc = mwl8k_update_rateset(hw, vif);
+                rc = mwl8k_cmd_set_rate(hw, vif, ap_legacy_rates, ap_mcs_rates);
                if (rc)
                        goto out;
-                /* Turn on rate adaptation */
                rc = mwl8k_cmd_use_fixed_rate(hw, MWL8K_USE_AUTO_RATE,
                        MWL8K_UCAST_RATE, NULL);
                if (rc)
                        goto out;
+        }
-                /* Set radio preamble */
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
-                rc = mwl8k_set_radio_preamble(hw, info->use_short_preamble);
+                rc = mwl8k_set_radio_preamble(hw,
-                if (rc)
+                                vif->bss_conf.use_short_preamble);
-                        goto out;
-                /* Set slot time */
-                rc = mwl8k_cmd_set_slot(hw, info->use_short_slot);
                if (rc)
                        goto out;
+        }
-                /* Update peer rate info */
+        if (changed & BSS_CHANGED_ERP_SLOT) {
-                rc = mwl8k_cmd_update_sta_db(hw, vif,
+                rc = mwl8k_cmd_set_slot(hw, vif->bss_conf.use_short_slot);
-                                MWL8K_STA_DB_MODIFY_ENTRY);
                if (rc)
                        goto out;
+        }
-                /* Set AID */
+        if (((changed & BSS_CHANGED_ASSOC) && vif->bss_conf.assoc) ||
-                rc = mwl8k_cmd_set_aid(hw, vif);
+            (changed & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT))) {
+                rc = mwl8k_cmd_set_aid(hw, vif, ap_legacy_rates);
                if (rc)
                        goto out;
+        }
+        if (vif->bss_conf.assoc &&
+            (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_BEACON_INT))) {
                /*
                 * Finalize the join.  Tell rx handler to process
                 * next beacon from our BSSID.
                 */
-                memcpy(priv->capture_bssid, mwl8k_vif->bssid, ETH_ALEN);
+                memcpy(priv->capture_bssid, vif->bss_conf.bssid, ETH_ALEN);
                priv->capture_beacon = true;
-        } else {
-                rc = mwl8k_cmd_update_sta_db(hw, vif, MWL8K_STA_DB_DEL_ENTRY);
-                memset(&mwl8k_vif->bss_info, 0,
-                        sizeof(struct ieee80211_bss_conf));
-                memset(mwl8k_vif->bssid, 0, ETH_ALEN);
        }
 out:
@@ -3114,7 +3153,7 @@ mwl8k_configure_filter_sniffer(struct ieee80211_hw *hw,
        }
        if (!priv->sniffer_enabled) {
-                if (mwl8k_enable_sniffer(hw, 1))
+                if (mwl8k_cmd_enable_sniffer(hw, 1))
                        return 0;
                priv->sniffer_enabled = true;
        }
@@ -3163,7 +3202,7 @@ static void mwl8k_configure_filter(struct ieee80211_hw *hw,
        }
        if (priv->sniffer_enabled) {
-                mwl8k_enable_sniffer(hw, 0);
+                mwl8k_cmd_enable_sniffer(hw, 0);
                priv->sniffer_enabled = false;
        }
@@ -3174,7 +3213,7 @@ static void mwl8k_configure_filter(struct ieee80211_hw *hw,
                         */
                        mwl8k_cmd_set_pre_scan(hw);
                } else {
-                        u8 *bssid;
+                        const u8 *bssid;
                        /*
                         * Enable the BSS filter.
@@ -3186,7 +3225,7 @@ static void mwl8k_configure_filter(struct ieee80211_hw *hw,
                         */
                        bssid = "\x01\x00\x00\x00\x00\x00";
                        if (priv->vif != NULL)
-                                bssid = MWL8K_VIF(priv->vif)->bssid;
+                                bssid = priv->vif->bss_conf.bssid;
                        mwl8k_cmd_set_post_scan(hw, bssid);
                }
@@ -3213,7 +3252,79 @@ static void mwl8k_configure_filter(struct ieee80211_hw *hw,
 static int mwl8k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
 {
-        return mwl8k_rts_threshold(hw, MWL8K_CMD_SET, value);
+        return mwl8k_cmd_set_rts_threshold(hw, MWL8K_CMD_SET, value);
+}
+struct mwl8k_sta_notify_item
+{
+        struct list_head list;
+        struct ieee80211_vif *vif;
+        enum sta_notify_cmd cmd;
+        struct ieee80211_sta sta;
+};
+static void mwl8k_sta_notify_worker(struct work_struct *work)
+{
+        struct mwl8k_priv *priv =
+                container_of(work, struct mwl8k_priv, sta_notify_worker);
+        struct ieee80211_hw *hw = priv->hw;
+        spin_lock_bh(&priv->sta_notify_list_lock);
+        while (!list_empty(&priv->sta_notify_list)) {
+                struct mwl8k_sta_notify_item *s;
+                s = list_entry(priv->sta_notify_list.next,
+                               struct mwl8k_sta_notify_item, list);
+                list_del(&s->list);
+                spin_unlock_bh(&priv->sta_notify_list_lock);
+                if (s->cmd == STA_NOTIFY_ADD) {
+                        int rc;
+                        rc = mwl8k_cmd_update_stadb_add(hw, s->vif, &s->sta);
+                        if (rc >= 0) {
+                                struct ieee80211_sta *sta;
+                                rcu_read_lock();
+                                sta = ieee80211_find_sta(s->vif, s->sta.addr);
+                                if (sta != NULL)
+                                        MWL8K_STA(sta)->peer_id = rc;
+                                rcu_read_unlock();
+                        }
+                } else {
+                        mwl8k_cmd_update_stadb_del(hw, s->vif, s->sta.addr);
+                }
+                kfree(s);
+                spin_lock_bh(&priv->sta_notify_list_lock);
+        }
+        spin_unlock_bh(&priv->sta_notify_list_lock);
+}
+static void
+mwl8k_sta_notify(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                 enum sta_notify_cmd cmd, struct ieee80211_sta *sta)
+{
+        struct mwl8k_priv *priv = hw->priv;
+        struct mwl8k_sta_notify_item *s;
+        if (cmd != STA_NOTIFY_ADD && cmd != STA_NOTIFY_REMOVE)
+                return;
+        s = kmalloc(sizeof(*s), GFP_ATOMIC);
+        if (s != NULL) {
+                s->vif = vif;
+                s->cmd = cmd;
+                s->sta = *sta;
+                spin_lock(&priv->sta_notify_list_lock);
+                list_add_tail(&s->list, &priv->sta_notify_list);
+                spin_unlock(&priv->sta_notify_list_lock);
+                ieee80211_queue_work(hw, &priv->sta_notify_worker);
+        }
 }
 static int mwl8k_conf_tx(struct ieee80211_hw *hw, u16 queue,
@@ -3225,14 +3336,14 @@ static int mwl8k_conf_tx(struct ieee80211_hw *hw, u16 queue,
        rc = mwl8k_fw_lock(hw);
        if (!rc) {
                if (!priv->wmm_enabled)
-                        rc = mwl8k_set_wmm(hw, 1);
+                        rc = mwl8k_cmd_set_wmm_mode(hw, 1);
                if (!rc)
-                        rc = mwl8k_set_edca_params(hw, queue,
+                        rc = mwl8k_cmd_set_edca_params(hw, queue,
-                                                   params->cw_min,
+                                                       params->cw_min,
-                                                   params->cw_max,
+                                                       params->cw_max,
-                                                   params->aifs,
+                                                       params->aifs,
-                                                   params->txop);
+                                                       params->txop);
                mwl8k_fw_unlock(hw);
        }
@@ -3261,7 +3372,23 @@ static int mwl8k_get_tx_stats(struct ieee80211_hw *hw,
 static int mwl8k_get_stats(struct ieee80211_hw *hw,
                           struct ieee80211_low_level_stats *stats)
 {
-        return mwl8k_cmd_802_11_get_stat(hw, stats);
+        return mwl8k_cmd_get_stat(hw, stats);
+}
+static int
+mwl8k_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                   enum ieee80211_ampdu_mlme_action action,
+                   struct ieee80211_sta *sta, u16 tid, u16 *ssn)
+{
+        switch (action) {
+        case IEEE80211_AMPDU_RX_START:
+        case IEEE80211_AMPDU_RX_STOP:
+                if (!(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
+                        return -ENOTSUPP;
+                return 0;
+        default:
+                return -ENOTSUPP;
+        }
 }
 static const struct ieee80211_ops mwl8k_ops = {
@@ -3275,9 +3402,11 @@ static const struct ieee80211_ops mwl8k_ops = {
        .prepare_multicast      = mwl8k_prepare_multicast,
        .configure_filter       = mwl8k_configure_filter,
        .set_rts_threshold      = mwl8k_set_rts_threshold,
+        .sta_notify             = mwl8k_sta_notify,
        .conf_tx                = mwl8k_conf_tx,
        .get_tx_stats           = mwl8k_get_tx_stats,
        .get_stats              = mwl8k_get_stats,
+        .ampdu_action           = mwl8k_ampdu_action,
 };
 static void mwl8k_tx_reclaim_handler(unsigned long data)
@@ -3302,37 +3431,42 @@ static void mwl8k_finalize_join_worker(struct work_struct *work)
        struct mwl8k_priv *priv =
                container_of(work, struct mwl8k_priv, finalize_join_worker);
        struct sk_buff *skb = priv->beacon_skb;
-        u8 dtim = MWL8K_VIF(priv->vif)->bss_info.dtim_period;
-        mwl8k_finalize_join(priv->hw, skb->data, skb->len, dtim);
+        mwl8k_cmd_finalize_join(priv->hw, skb->data, skb->len,
+                                priv->vif->bss_conf.dtim_period);
        dev_kfree_skb(skb);
        priv->beacon_skb = NULL;
 }
 enum {
-        MWL8687 = 0,
+        MWL8363 = 0,
+        MWL8687,
        MWL8366,
 };
 static struct mwl8k_device_info mwl8k_info_tbl[] __devinitdata = {
-        {
+        [MWL8363] = {
+                .part_name      = "88w8363",
+                .helper_image   = "mwl8k/helper_8363.fw",
+                .fw_image       = "mwl8k/fmimage_8363.fw",
+        },
+        [MWL8687] = {
                .part_name      = "88w8687",
                .helper_image   = "mwl8k/helper_8687.fw",
                .fw_image       = "mwl8k/fmimage_8687.fw",
-                .rxd_ops        = &rxd_8687_ops,
-                .modes          = BIT(NL80211_IFTYPE_STATION),
        },
-        {
+        [MWL8366] = {
                .part_name      = "88w8366",
                .helper_image   = "mwl8k/helper_8366.fw",
                .fw_image       = "mwl8k/fmimage_8366.fw",
-                .rxd_ops        = &rxd_8366_ops,
+                .ap_rxd_ops     = &rxd_8366_ap_ops,
-                .modes          = 0,
        },
 };
 static DEFINE_PCI_DEVICE_TABLE(mwl8k_pci_id_table) = {
+        { PCI_VDEVICE(MARVELL, 0x2a0c), .driver_data = MWL8363, },
+        { PCI_VDEVICE(MARVELL, 0x2a24), .driver_data = MWL8363, },
        { PCI_VDEVICE(MARVELL, 0x2a2b), .driver_data = MWL8687, },
        { PCI_VDEVICE(MARVELL, 0x2a30), .driver_data = MWL8687, },
        { PCI_VDEVICE(MARVELL, 0x2a40), .driver_data = MWL8366, },
@@ -3354,6 +3488,7 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
                printed_version = 1;
        }
        rc = pci_enable_device(pdev);
        if (rc) {
                printk(KERN_ERR "%s: Cannot enable new PCI device\n",
@@ -3370,6 +3505,7 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
        pci_set_master(pdev);
        hw = ieee80211_alloc_hw(sizeof(*priv), &mwl8k_ops);
        if (hw == NULL) {
                printk(KERN_ERR "%s: ieee80211 alloc failed\n", MWL8K_NAME);
@@ -3377,17 +3513,14 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
                goto err_free_reg;
        }
+        SET_IEEE80211_DEV(hw, &pdev->dev);
+        pci_set_drvdata(pdev, hw);
        priv = hw->priv;
        priv->hw = hw;
        priv->pdev = pdev;
        priv->device_info = &mwl8k_info_tbl[id->driver_data];
-        priv->rxd_ops = priv->device_info->rxd_ops;
-        priv->sniffer_enabled = false;
-        priv->wmm_enabled = false;
-        priv->pending_tx_pkts = 0;
-        SET_IEEE80211_DEV(hw, &pdev->dev);
-        pci_set_drvdata(pdev, hw);
        priv->sram = pci_iomap(pdev, 0, 0x10000);
        if (priv->sram == NULL) {
@@ -3410,6 +3543,47 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
                }
        }
+        /* Reset firmware and hardware */
+        mwl8k_hw_reset(priv);
+        /* Ask userland hotplug daemon for the device firmware */
+        rc = mwl8k_request_firmware(priv);
+        if (rc) {
+                printk(KERN_ERR "%s: Firmware files not found\n",
+                       wiphy_name(hw->wiphy));
+                goto err_stop_firmware;
+        }
+        /* Load firmware into hardware */
+        rc = mwl8k_load_firmware(hw);
+        if (rc) {
+                printk(KERN_ERR "%s: Cannot start firmware\n",
+                       wiphy_name(hw->wiphy));
+                goto err_stop_firmware;
+        }
+        /* Reclaim memory once firmware is successfully loaded */
+        mwl8k_release_firmware(priv);
+        if (priv->ap_fw) {
+                priv->rxd_ops = priv->device_info->ap_rxd_ops;
+                if (priv->rxd_ops == NULL) {
+                        printk(KERN_ERR "%s: Driver does not have AP "
+                               "firmware image support for this hardware\n",
+                               wiphy_name(hw->wiphy));
+                        goto err_stop_firmware;
+                }
+        } else {
+                priv->rxd_ops = &rxd_sta_ops;
+        }
+        priv->sniffer_enabled = false;
+        priv->wmm_enabled = false;
+        priv->pending_tx_pkts = 0;
        memcpy(priv->channels, mwl8k_channels, sizeof(mwl8k_channels));
        priv->band.band = IEEE80211_BAND_2GHZ;
        priv->band.channels = priv->channels;
@@ -3432,17 +3606,21 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
        hw->queues = MWL8K_TX_QUEUES;
-        hw->wiphy->interface_modes = priv->device_info->modes;
        /* Set rssi and noise values to dBm */
        hw->flags |= IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_NOISE_DBM;
        hw->vif_data_size = sizeof(struct mwl8k_vif);
+        hw->sta_data_size = sizeof(struct mwl8k_sta);
        priv->vif = NULL;
        /* Set default radio state and preamble */
        priv->radio_on = 0;
        priv->radio_short_preamble = 0;
+        /* Station database handling */
+        INIT_WORK(&priv->sta_notify_worker, mwl8k_sta_notify_worker);
+        spin_lock_init(&priv->sta_notify_list_lock);
+        INIT_LIST_HEAD(&priv->sta_notify_list);
        /* Finalize join worker */
        INIT_WORK(&priv->finalize_join_worker, mwl8k_finalize_join_worker);
@@ -3454,11 +3632,11 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
        /* Power management cookie */
        priv->cookie = pci_alloc_consistent(priv->pdev, 4, &priv->cookie_dma);
        if (priv->cookie == NULL)
-                goto err_iounmap;
+                goto err_stop_firmware;
        rc = mwl8k_rxq_init(hw, 0);
        if (rc)
-                goto err_iounmap;
+                goto err_free_cookie;
        rxq_refill(hw, 0, INT_MAX);
        mutex_init(&priv->fw_mutex);
@@ -3489,28 +3667,6 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
                goto err_free_queues;
        }
-        /* Reset firmware and hardware */
-        mwl8k_hw_reset(priv);
-        /* Ask userland hotplug daemon for the device firmware */
-        rc = mwl8k_request_firmware(priv);
-        if (rc) {
-                printk(KERN_ERR "%s: Firmware files not found\n",
-                       wiphy_name(hw->wiphy));
-                goto err_free_irq;
-        }
-        /* Load firmware into hardware */
-        rc = mwl8k_load_firmware(hw);
-        if (rc) {
-                printk(KERN_ERR "%s: Cannot start firmware\n",
-                       wiphy_name(hw->wiphy));
-                goto err_stop_firmware;
-        }
-        /* Reclaim memory once firmware is successfully loaded */
-        mwl8k_release_firmware(priv);
        /*
         * Temporarily enable interrupts.  Initial firmware host
         * commands use interrupts and avoids polling.  Disable
@@ -3525,26 +3681,28 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
                        rc = mwl8k_cmd_set_hw_spec(hw);
        } else {
                rc = mwl8k_cmd_get_hw_spec_sta(hw);
+                hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
        }
        if (rc) {
                printk(KERN_ERR "%s: Cannot initialise firmware\n",
                       wiphy_name(hw->wiphy));
-                goto err_stop_firmware;
+                goto err_free_irq;
        }
        /* Turn radio off */
-        rc = mwl8k_cmd_802_11_radio_disable(hw);
+        rc = mwl8k_cmd_radio_disable(hw);
        if (rc) {
                printk(KERN_ERR "%s: Cannot disable\n", wiphy_name(hw->wiphy));
-                goto err_stop_firmware;
+                goto err_free_irq;
        }
        /* Clear MAC address */
-        rc = mwl8k_set_mac_addr(hw, "\x00\x00\x00\x00\x00\x00");
+        rc = mwl8k_cmd_set_mac_addr(hw, "\x00\x00\x00\x00\x00\x00");
        if (rc) {
                printk(KERN_ERR "%s: Cannot clear MAC address\n",
                       wiphy_name(hw->wiphy));
-                goto err_stop_firmware;
+                goto err_free_irq;
        }
        /* Disable interrupts */
@@ -3555,7 +3713,7 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
        if (rc) {
                printk(KERN_ERR "%s: Cannot register device\n",
                       wiphy_name(hw->wiphy));
-                goto err_stop_firmware;
+                goto err_free_queues;
        }
        printk(KERN_INFO "%s: %s v%d, %pM, %s firmware %u.%u.%u.%u\n",
@@ -3567,10 +3725,6 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
        return 0;
-err_stop_firmware:
-        mwl8k_hw_reset(priv);
-        mwl8k_release_firmware(priv);
 err_free_irq:
        iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
        free_irq(priv->pdev->irq, hw);
@@ -3580,11 +3734,16 @@ err_free_queues:
                mwl8k_txq_deinit(hw, i);
        mwl8k_rxq_deinit(hw, 0);
-err_iounmap:
+err_free_cookie:
        if (priv->cookie != NULL)
                pci_free_consistent(priv->pdev, 4,
                                priv->cookie, priv->cookie_dma);
+err_stop_firmware:
+        mwl8k_hw_reset(priv);
+        mwl8k_release_firmware(priv);
+err_iounmap:
        if (priv->regs != NULL)
                pci_iounmap(pdev, priv->regs);
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 18012dbfb45d..26428e4c9c60 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -216,7 +216,7 @@ static void p54_stop(struct ieee80211_hw *dev)
 }
 static int p54_add_interface(struct ieee80211_hw *dev,
-                             struct ieee80211_if_init_conf *conf)
+                             struct ieee80211_vif *vif)
 {
        struct p54_common *priv = dev->priv;
@@ -226,28 +226,28 @@ static int p54_add_interface(struct ieee80211_hw *dev,
                return -EOPNOTSUPP;
        }
-        priv->vif = conf->vif;
+        priv->vif = vif;
-        switch (conf->type) {
+        switch (vif->type) {
        case NL80211_IFTYPE_STATION:
        case NL80211_IFTYPE_ADHOC:
        case NL80211_IFTYPE_AP:
        case NL80211_IFTYPE_MESH_POINT:
-                priv->mode = conf->type;
+                priv->mode = vif->type;
                break;
        default:
                mutex_unlock(&priv->conf_mutex);
                return -EOPNOTSUPP;
        }
-        memcpy(priv->mac_addr, conf->mac_addr, ETH_ALEN);
+        memcpy(priv->mac_addr, vif->addr, ETH_ALEN);
        p54_setup_mac(priv);
        mutex_unlock(&priv->conf_mutex);
        return 0;
 }
 static void p54_remove_interface(struct ieee80211_hw *dev,
-                                 struct ieee80211_if_init_conf *conf)
+                                 struct ieee80211_vif *vif)
 {
        struct p54_common *priv = dev->priv;
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 2ecbedb26e15..305c106fdc1c 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2594,23 +2594,9 @@ end:
 /*
 * driver/device initialization
 */
-static int bcm4320a_early_init(struct usbnet *usbdev)
+static void rndis_copy_module_params(struct usbnet *usbdev)
-{
-        /* bcm4320a doesn't handle configuration parameters well. Try
-         * set any and you get partially zeroed mac and broken device.
-         */
-        return 0;
-}
-static int bcm4320b_early_init(struct usbnet *usbdev)
 {
        struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
-        char buf[8];
-        /* Early initialization settings, setting these won't have effect
-         * if called after generic_rndis_bind().
-         */
        priv->param_country[0] = modparam_country[0];
        priv->param_country[1] = modparam_country[1];
@@ -2652,6 +2638,32 @@ static int bcm4320b_early_init(struct usbnet *usbdev)
                priv->param_workaround_interval = 500;
        else
                priv->param_workaround_interval = modparam_workaround_interval;
+}
+static int bcm4320a_early_init(struct usbnet *usbdev)
+{
+        /* copy module parameters for bcm4320a so that iwconfig reports txpower
+         * and workaround parameter is copied to private structure correctly.
+         */
+        rndis_copy_module_params(usbdev);
+        /* bcm4320a doesn't handle configuration parameters well. Try
+         * set any and you get partially zeroed mac and broken device.
+         */
+        return 0;
+}
+static int bcm4320b_early_init(struct usbnet *usbdev)
+{
+        struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
+        char buf[8];
+        rndis_copy_module_params(usbdev);
+        /* Early initialization settings, setting these won't have effect
+         * if called after generic_rndis_bind().
+         */
        rndis_set_config_parameter_str(usbdev, "Country", priv->param_country);
        rndis_set_config_parameter_str(usbdev, "FrameBursting",
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index bf60689aaabb..3ca824a91ad9 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -54,12 +54,12 @@ config RT61PCI
          When compiled as a module, this driver will be called rt61pci.
 config RT2800PCI_PCI
-        tristate
+        boolean
        depends on PCI
        default y
 config RT2800PCI_SOC
-        tristate
+        boolean
        depends on RALINK_RT288X || RALINK_RT305X
        default y
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index e7f46405a418..d86d233c6810 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -451,7 +451,7 @@ static void rt2400pci_config_channel(struct rt2x00_dev *rt2x00dev,
        /*
         * RF2420 chipset don't need any additional actions.
         */
-        if (rt2x00_rf(&rt2x00dev->chip, RF2420))
+        if (rt2x00_rf(rt2x00dev, RF2420))
                return;
        /*
@@ -1343,8 +1343,7 @@ static int rt2400pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
        rt2x00_set_chip_rf(rt2x00dev, value, reg);
        rt2x00_print_chip(rt2x00dev);
-        if (!rt2x00_rf(&rt2x00dev->chip, RF2420) &&
+        if (!rt2x00_rf(rt2x00dev, RF2420) && !rt2x00_rf(rt2x00dev, RF2421)) {
-            !rt2x00_rf(&rt2x00dev->chip, RF2421)) {
                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
                return -ENODEV;
        }
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 408fcfc120f5..46cbc6ef66ab 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -440,8 +440,7 @@ static void rt2500pci_config_ant(struct rt2x00_dev *rt2x00dev,
        /*
         * RT2525E and RT5222 need to flip TX I/Q
         */
-        if (rt2x00_rf(&rt2x00dev->chip, RF2525E) ||
+        if (rt2x00_rf(rt2x00dev, RF2525E) || rt2x00_rf(rt2x00dev, RF5222)) {
-            rt2x00_rf(&rt2x00dev->chip, RF5222)) {
                rt2x00_set_field8(&r2, BBP_R2_TX_IQ_FLIP, 1);
                rt2x00_set_field32(&reg, BBPCSR1_CCK_FLIP, 1);
                rt2x00_set_field32(&reg, BBPCSR1_OFDM_FLIP, 1);
@@ -449,7 +448,7 @@ static void rt2500pci_config_ant(struct rt2x00_dev *rt2x00dev,
                /*
                 * RT2525E does not need RX I/Q Flip.
                 */
-                if (rt2x00_rf(&rt2x00dev->chip, RF2525E))
+                if (rt2x00_rf(rt2x00dev, RF2525E))
                        rt2x00_set_field8(&r14, BBP_R14_RX_IQ_FLIP, 0);
        } else {
                rt2x00_set_field32(&reg, BBPCSR1_CCK_FLIP, 0);
@@ -475,14 +474,14 @@ static void rt2500pci_config_channel(struct rt2x00_dev *rt2x00dev,
         * Switch on tuning bits.
         * For RT2523 devices we do not need to update the R1 register.
         */
-        if (!rt2x00_rf(&rt2x00dev->chip, RF2523))
+        if (!rt2x00_rf(rt2x00dev, RF2523))
                rt2x00_set_field32(&rf->rf1, RF1_TUNER, 1);
        rt2x00_set_field32(&rf->rf3, RF3_TUNER, 1);
        /*
         * For RT2525 we should first set the channel to half band higher.
         */
-        if (rt2x00_rf(&rt2x00dev->chip, RF2525)) {
+        if (rt2x00_rf(rt2x00dev, RF2525)) {
                static const u32 vals[] = {
                        0x00080cbe, 0x00080d02, 0x00080d06, 0x00080d0a,
                        0x00080d0e, 0x00080d12, 0x00080d16, 0x00080d1a,
@@ -516,7 +515,7 @@ static void rt2500pci_config_channel(struct rt2x00_dev *rt2x00dev,
         * Switch off tuning bits.
         * For RT2523 devices we do not need to update the R1 register.
         */
-        if (!rt2x00_rf(&rt2x00dev->chip, RF2523)) {
+        if (!rt2x00_rf(rt2x00dev, RF2523)) {
                rt2x00_set_field32(&rf->rf1, RF1_TUNER, 0);
                rt2500pci_rf_write(rt2x00dev, 1, rf->rf1);
        }
@@ -640,7 +639,7 @@ static void rt2500pci_link_tuner(struct rt2x00_dev *rt2x00dev,
         * up to version C the link tuning should halt after 20
         * seconds while being associated.
         */
-        if (rt2x00_rev(&rt2x00dev->chip) < RT2560_VERSION_D &&
+        if (rt2x00_rev(rt2x00dev) < RT2560_VERSION_D &&
            rt2x00dev->intf_associated && count > 20)
                return;
@@ -650,7 +649,7 @@ static void rt2500pci_link_tuner(struct rt2x00_dev *rt2x00dev,
         * should go straight to dynamic CCA tuning when they
         * are not associated.
         */
-        if (rt2x00_rev(&rt2x00dev->chip) < RT2560_VERSION_D ||
+        if (rt2x00_rev(rt2x00dev) < RT2560_VERSION_D ||
            !rt2x00dev->intf_associated)
                goto dynamic_cca_tune;
@@ -1507,12 +1506,12 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
        rt2x00_set_chip_rf(rt2x00dev, value, reg);
        rt2x00_print_chip(rt2x00dev);
-        if (!rt2x00_rf(&rt2x00dev->chip, RF2522) &&
+        if (!rt2x00_rf(rt2x00dev, RF2522) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2523) &&
+            !rt2x00_rf(rt2x00dev, RF2523) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2524) &&
+            !rt2x00_rf(rt2x00dev, RF2524) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2525) &&
+            !rt2x00_rf(rt2x00dev, RF2525) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2525E) &&
+            !rt2x00_rf(rt2x00dev, RF2525E) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF5222)) {
+            !rt2x00_rf(rt2x00dev, RF5222)) {
                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
                return -ENODEV;
        }
@@ -1744,22 +1743,22 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
        spec->supported_bands = SUPPORT_BAND_2GHZ;
        spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
-        if (rt2x00_rf(&rt2x00dev->chip, RF2522)) {
+        if (rt2x00_rf(rt2x00dev, RF2522)) {
                spec->num_channels = ARRAY_SIZE(rf_vals_bg_2522);
                spec->channels = rf_vals_bg_2522;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2523)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2523)) {
                spec->num_channels = ARRAY_SIZE(rf_vals_bg_2523);
                spec->channels = rf_vals_bg_2523;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2524)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2524)) {
                spec->num_channels = ARRAY_SIZE(rf_vals_bg_2524);
                spec->channels = rf_vals_bg_2524;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2525)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2525)) {
                spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525);
                spec->channels = rf_vals_bg_2525;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2525E)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2525E)) {
                spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525e);
                spec->channels = rf_vals_bg_2525e;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF5222)) {
+        } else if (rt2x00_rf(rt2x00dev, RF5222)) {
                spec->supported_bands |= SUPPORT_BAND_5GHZ;
                spec->num_channels = ARRAY_SIZE(rf_vals_5222);
                spec->channels = rf_vals_5222;
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 83f2592c59de..9e6f865c57f2 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -565,8 +565,7 @@ static void rt2500usb_config_ant(struct rt2x00_dev *rt2x00dev,
        /*
         * RT2525E and RT5222 need to flip TX I/Q
         */
-        if (rt2x00_rf(&rt2x00dev->chip, RF2525E) ||
+        if (rt2x00_rf(rt2x00dev, RF2525E) || rt2x00_rf(rt2x00dev, RF5222)) {
-            rt2x00_rf(&rt2x00dev->chip, RF5222)) {
                rt2x00_set_field8(&r2, BBP_R2_TX_IQ_FLIP, 1);
                rt2x00_set_field16(&csr5, PHY_CSR5_CCK_FLIP, 1);
                rt2x00_set_field16(&csr6, PHY_CSR6_OFDM_FLIP, 1);
@@ -574,7 +573,7 @@ static void rt2500usb_config_ant(struct rt2x00_dev *rt2x00dev,
                /*
                 * RT2525E does not need RX I/Q Flip.
                 */
-                if (rt2x00_rf(&rt2x00dev->chip, RF2525E))
+                if (rt2x00_rf(rt2x00dev, RF2525E))
                        rt2x00_set_field8(&r14, BBP_R14_RX_IQ_FLIP, 0);
        } else {
                rt2x00_set_field16(&csr5, PHY_CSR5_CCK_FLIP, 0);
@@ -598,7 +597,7 @@ static void rt2500usb_config_channel(struct rt2x00_dev *rt2x00dev,
        /*
         * For RT2525E we should first set the channel to half band higher.
         */
-        if (rt2x00_rf(&rt2x00dev->chip, RF2525E)) {
+        if (rt2x00_rf(rt2x00dev, RF2525E)) {
                static const u32 vals[] = {
                        0x000008aa, 0x000008ae, 0x000008ae, 0x000008b2,
                        0x000008b2, 0x000008b6, 0x000008b6, 0x000008ba,
@@ -793,7 +792,7 @@ static int rt2500usb_init_registers(struct rt2x00_dev *rt2x00dev)
        rt2x00_set_field16(&reg, MAC_CSR1_HOST_READY, 1);
        rt2500usb_register_write(rt2x00dev, MAC_CSR1, reg);
-        if (rt2x00_rev(&rt2x00dev->chip) >= RT2570_VERSION_C) {
+        if (rt2x00_rev(rt2x00dev) >= RT2570_VERSION_C) {
                rt2500usb_register_read(rt2x00dev, PHY_CSR2, &reg);
                rt2x00_set_field16(&reg, PHY_CSR2_LNA, 0);
        } else {
@@ -1411,19 +1410,18 @@ static int rt2500usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
        rt2x00_set_chip(rt2x00dev, RT2570, value, reg);
        rt2x00_print_chip(rt2x00dev);
-        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0) ||
+        if (!rt2x00_check_rev(rt2x00dev, 0x000ffff0, 0) ||
-            rt2x00_check_rev(&rt2x00dev->chip, 0x0000000f, 0)) {
+            rt2x00_check_rev(rt2x00dev, 0x0000000f, 0)) {
                ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
                return -ENODEV;
        }
-        if (!rt2x00_rf(&rt2x00dev->chip, RF2522) &&
+        if (!rt2x00_rf(rt2x00dev, RF2522) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2523) &&
+            !rt2x00_rf(rt2x00dev, RF2523) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2524) &&
+            !rt2x00_rf(rt2x00dev, RF2524) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2525) &&
+            !rt2x00_rf(rt2x00dev, RF2525) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2525E) &&
+            !rt2x00_rf(rt2x00dev, RF2525E) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF5222)) {
+            !rt2x00_rf(rt2x00dev, RF5222)) {
                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
                return -ENODEV;
        }
@@ -1667,22 +1665,22 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
        spec->supported_bands = SUPPORT_BAND_2GHZ;
        spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
-        if (rt2x00_rf(&rt2x00dev->chip, RF2522)) {
+        if (rt2x00_rf(rt2x00dev, RF2522)) {
                spec->num_channels = ARRAY_SIZE(rf_vals_bg_2522);
                spec->channels = rf_vals_bg_2522;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2523)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2523)) {
                spec->num_channels = ARRAY_SIZE(rf_vals_bg_2523);
                spec->channels = rf_vals_bg_2523;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2524)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2524)) {
                spec->num_channels = ARRAY_SIZE(rf_vals_bg_2524);
                spec->channels = rf_vals_bg_2524;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2525)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2525)) {
                spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525);
                spec->channels = rf_vals_bg_2525;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2525E)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2525E)) {
                spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525e);
                spec->channels = rf_vals_bg_2525e;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF5222)) {
+        } else if (rt2x00_rf(rt2x00dev, RF5222)) {
                spec->supported_bands |= SUPPORT_BAND_5GHZ;
                spec->num_channels = ARRAY_SIZE(rf_vals_5222);
                spec->channels = rf_vals_5222;
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 9deae41cb784..126899091707 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -37,7 +37,7 @@
 #include <linux/module.h>
 #include "rt2x00.h"
-#if defined(CONFIG_RT2800USB) || defined(CONFIG_RT2800USB_MODULE)
+#if defined(CONFIG_RT2X00_LIB_USB) || defined(CONFIG_RT2X00_LIB_USB_MODULE)
 #include "rt2x00usb.h"
 #endif
 #include "rt2800lib.h"
@@ -220,8 +220,7 @@ void rt2800_mcu_request(struct rt2x00_dev *rt2x00dev,
        /*
         * RT2880 and RT3052 don't support MCU requests.
         */
-        if (rt2x00_rt(&rt2x00dev->chip, RT2880) ||
+        if (rt2x00_rt(rt2x00dev, RT2880) || rt2x00_rt(rt2x00dev, RT3052))
-            rt2x00_rt(&rt2x00dev->chip, RT3052))
                return;
        mutex_lock(&rt2x00dev->csr_mutex);
@@ -806,12 +805,12 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
        unsigned int tx_pin;
        u8 bbp;
-        if ((rt2x00_rt(&rt2x00dev->chip, RT3070) ||
+        if ((rt2x00_rt(rt2x00dev, RT3070) ||
-             rt2x00_rt(&rt2x00dev->chip, RT3090)) &&
+             rt2x00_rt(rt2x00dev, RT3090)) &&
-            (rt2x00_rf(&rt2x00dev->chip, RF2020) ||
+            (rt2x00_rf(rt2x00dev, RF2020) ||
-             rt2x00_rf(&rt2x00dev->chip, RF3020) ||
+             rt2x00_rf(rt2x00dev, RF3020) ||
-             rt2x00_rf(&rt2x00dev->chip, RF3021) ||
+             rt2x00_rf(rt2x00dev, RF3021) ||
-             rt2x00_rf(&rt2x00dev->chip, RF3022)))
+             rt2x00_rf(rt2x00dev, RF3022)))
                rt2800_config_channel_rt3x(rt2x00dev, conf, rf, info);
        else
                rt2800_config_channel_rt2x(rt2x00dev, conf, rf, info);
@@ -878,7 +877,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
        rt2x00_set_field8(&bbp, BBP3_HT40_PLUS, conf_is_ht40_plus(conf));
        rt2800_bbp_write(rt2x00dev, 3, bbp);
-        if (rt2x00_rev(&rt2x00dev->chip) == RT2860C_VERSION) {
+        if (rt2x00_rev(rt2x00dev) == RT2860C_VERSION) {
                if (conf_is_ht40(conf)) {
                        rt2800_bbp_write(rt2x00dev, 69, 0x1a);
                        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
@@ -1041,7 +1040,7 @@ static u8 rt2800_get_default_vgc(struct rt2x00_dev *rt2x00dev)
 {
        if (rt2x00dev->curr_band == IEEE80211_BAND_2GHZ) {
                if (rt2x00_intf_is_usb(rt2x00dev) &&
-                    rt2x00_rev(&rt2x00dev->chip) == RT3070_VERSION)
+                    rt2x00_rev(rt2x00dev) == RT3070_VERSION)
                        return 0x1c + (2 * rt2x00dev->lna_gain);
                else
                        return 0x2e + rt2x00dev->lna_gain;
@@ -1072,7 +1071,7 @@ EXPORT_SYMBOL_GPL(rt2800_reset_tuner);
 void rt2800_link_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual,
                       const u32 count)
 {
-        if (rt2x00_rev(&rt2x00dev->chip) == RT2860C_VERSION)
+        if (rt2x00_rev(rt2x00dev) == RT2860C_VERSION)
                return;
        /*
@@ -1121,7 +1120,7 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
        if (rt2x00_intf_is_usb(rt2x00dev)) {
                rt2800_register_write(rt2x00dev, USB_DMA_CFG, 0x00000000);
-#if defined(CONFIG_RT2800USB) || defined(CONFIG_RT2800USB_MODULE)
+#if defined(CONFIG_RT2X00_LIB_USB) || defined(CONFIG_RT2X00_LIB_USB_MODULE)
                rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0,
                                            USB_MODE_RESET, REGISTER_TIMEOUT);
 #endif
@@ -1158,7 +1157,7 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
        if (rt2x00_intf_is_usb(rt2x00dev) &&
-            rt2x00_rev(&rt2x00dev->chip) == RT3070_VERSION) {
+            rt2x00_rev(rt2x00dev) == RT3070_VERSION) {
                rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000400);
                rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00000000);
                rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
@@ -1185,8 +1184,8 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
        rt2800_register_read(rt2x00dev, MAX_LEN_CFG, &reg);
        rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_MPDU, AGGREGATION_SIZE);
-        if (rt2x00_rev(&rt2x00dev->chip) >= RT2880E_VERSION &&
+        if (rt2x00_rev(rt2x00dev) >= RT2880E_VERSION &&
-            rt2x00_rev(&rt2x00dev->chip) < RT3070_VERSION)
+            rt2x00_rev(rt2x00dev) < RT3070_VERSION)
                rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 2);
        else
                rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 1);
@@ -1465,22 +1464,22 @@ int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
        rt2800_bbp_write(rt2x00dev, 103, 0x00);
        rt2800_bbp_write(rt2x00dev, 105, 0x05);
-        if (rt2x00_rev(&rt2x00dev->chip) == RT2860C_VERSION) {
+        if (rt2x00_rev(rt2x00dev) == RT2860C_VERSION) {
                rt2800_bbp_write(rt2x00dev, 69, 0x16);
                rt2800_bbp_write(rt2x00dev, 73, 0x12);
        }
-        if (rt2x00_rev(&rt2x00dev->chip) > RT2860D_VERSION)
+        if (rt2x00_rev(rt2x00dev) > RT2860D_VERSION)
                rt2800_bbp_write(rt2x00dev, 84, 0x19);
        if (rt2x00_intf_is_usb(rt2x00dev) &&
-            rt2x00_rev(&rt2x00dev->chip) == RT3070_VERSION) {
+            rt2x00_rev(rt2x00dev) == RT3070_VERSION) {
                rt2800_bbp_write(rt2x00dev, 70, 0x0a);
                rt2800_bbp_write(rt2x00dev, 84, 0x99);
                rt2800_bbp_write(rt2x00dev, 105, 0x05);
        }
-        if (rt2x00_rt(&rt2x00dev->chip, RT3052)) {
+        if (rt2x00_rt(rt2x00dev, RT3052)) {
                rt2800_bbp_write(rt2x00dev, 31, 0x08);
                rt2800_bbp_write(rt2x00dev, 78, 0x0e);
                rt2800_bbp_write(rt2x00dev, 80, 0x08);
@@ -1566,13 +1565,13 @@ int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
        u8 bbp;
        if (rt2x00_intf_is_usb(rt2x00dev) &&
-            rt2x00_rev(&rt2x00dev->chip) != RT3070_VERSION)
+            rt2x00_rev(rt2x00dev) != RT3070_VERSION)
                return 0;
        if (rt2x00_intf_is_pci(rt2x00dev)) {
-                if (!rt2x00_rf(&rt2x00dev->chip, RF3020) &&
+                if (!rt2x00_rf(rt2x00dev, RF3020) &&
-                    !rt2x00_rf(&rt2x00dev->chip, RF3021) &&
+                    !rt2x00_rf(rt2x00dev, RF3021) &&
-                    !rt2x00_rf(&rt2x00dev->chip, RF3022))
+                    !rt2x00_rf(rt2x00dev, RF3022))
                        return 0;
        }
@@ -1737,7 +1736,7 @@ int rt2800_validate_eeprom(struct rt2x00_dev *rt2x00dev)
                rt2x00_set_field16(&word, EEPROM_ANTENNA_RF_TYPE, RF2820);
                rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
                EEPROM(rt2x00dev, "Antenna: 0x%04x\n", word);
-        } else if (rt2x00_rev(&rt2x00dev->chip) < RT2883_VERSION) {
+        } else if (rt2x00_rev(rt2x00dev) < RT2883_VERSION) {
                /*
                 * There is a max of 2 RX streams for RT28x0 series
                 */
@@ -1839,17 +1838,15 @@ int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
        rt2x00_set_chip_rf(rt2x00dev, value, reg);
        if (rt2x00_intf_is_usb(rt2x00dev)) {
-                struct rt2x00_chip *chip = &rt2x00dev->chip;
                /*
                 * The check for rt2860 is not a typo, some rt2870 hardware
                 * identifies itself as rt2860 in the CSR register.
                 */
-                if (rt2x00_check_rev(chip, 0xfff00000, 0x28600000) ||
+                if (rt2x00_check_rev(rt2x00dev, 0xfff00000, 0x28600000) ||
-                    rt2x00_check_rev(chip, 0xfff00000, 0x28700000) ||
+                    rt2x00_check_rev(rt2x00dev, 0xfff00000, 0x28700000) ||
-                    rt2x00_check_rev(chip, 0xfff00000, 0x28800000)) {
+                    rt2x00_check_rev(rt2x00dev, 0xfff00000, 0x28800000)) {
                        rt2x00_set_chip_rt(rt2x00dev, RT2870);
-                } else if (rt2x00_check_rev(chip, 0xffff0000, 0x30700000)) {
+                } else if (rt2x00_check_rev(rt2x00dev, 0xffff0000, 0x30700000)) {
                        rt2x00_set_chip_rt(rt2x00dev, RT3070);
                } else {
                        ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
@@ -1858,14 +1855,14 @@ int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
        }
        rt2x00_print_chip(rt2x00dev);
-        if (!rt2x00_rf(&rt2x00dev->chip, RF2820) &&
+        if (!rt2x00_rf(rt2x00dev, RF2820) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2850) &&
+            !rt2x00_rf(rt2x00dev, RF2850) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2720) &&
+            !rt2x00_rf(rt2x00dev, RF2720) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2750) &&
+            !rt2x00_rf(rt2x00dev, RF2750) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF3020) &&
+            !rt2x00_rf(rt2x00dev, RF3020) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2020) &&
+            !rt2x00_rf(rt2x00dev, RF2020) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF3021) &&
+            !rt2x00_rf(rt2x00dev, RF3021) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF3022)) {
+            !rt2x00_rf(rt2x00dev, RF3022)) {
                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
                return -ENODEV;
        }
@@ -2013,7 +2010,6 @@ static const struct rf_channel rf_vals_302x[] = {
 int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 {
-        struct rt2x00_chip *chip = &rt2x00dev->chip;
        struct hw_mode_spec *spec = &rt2x00dev->spec;
        struct channel_info *info;
        char *tx_power1;
@@ -2049,19 +2045,19 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
        spec->supported_bands = SUPPORT_BAND_2GHZ;
        spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
-        if (rt2x00_rf(chip, RF2820) ||
+        if (rt2x00_rf(rt2x00dev, RF2820) ||
-            rt2x00_rf(chip, RF2720) ||
+            rt2x00_rf(rt2x00dev, RF2720) ||
-            (rt2x00_intf_is_pci(rt2x00dev) && rt2x00_rf(chip, RF3052))) {
+            (rt2x00_intf_is_pci(rt2x00dev) && rt2x00_rf(rt2x00dev, RF3052))) {
                spec->num_channels = 14;
                spec->channels = rf_vals;
-        } else if (rt2x00_rf(chip, RF2850) || rt2x00_rf(chip, RF2750)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2850) || rt2x00_rf(rt2x00dev, RF2750)) {
                spec->supported_bands |= SUPPORT_BAND_5GHZ;
                spec->num_channels = ARRAY_SIZE(rf_vals);
                spec->channels = rf_vals;
-        } else if (rt2x00_rf(chip, RF3020) ||
+        } else if (rt2x00_rf(rt2x00dev, RF3020) ||
-                   rt2x00_rf(chip, RF2020) ||
+                   rt2x00_rf(rt2x00dev, RF2020) ||
-                   rt2x00_rf(chip, RF3021) ||
+                   rt2x00_rf(rt2x00dev, RF3021) ||
-                   rt2x00_rf(chip, RF3022)) {
+                   rt2x00_rf(rt2x00dev, RF3022)) {
                spec->num_channels = ARRAY_SIZE(rf_vals_302x);
                spec->channels = rf_vals_302x;
        }
@@ -2069,7 +2065,7 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
        /*
         * Initialize HT information.
         */
-        if (!rt2x00_rf(chip, RF2020))
+        if (!rt2x00_rf(rt2x00dev, RF2020))
                spec->ht.ht_supported = true;
        else
                spec->ht.ht_supported = false;
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index dfc886fcb44d..b93eabb4fbe1 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -48,14 +48,6 @@
 #include "rt2800.h"
 #include "rt2800pci.h"
-#ifdef CONFIG_RT2800PCI_PCI_MODULE
-#define CONFIG_RT2800PCI_PCI
-#endif
-#ifdef CONFIG_RT2800PCI_WISOC_MODULE
-#define CONFIG_RT2800PCI_WISOC
-#endif
 /*
 * Allow hardware encryption to be disabled.
 */
@@ -87,7 +79,7 @@ static void rt2800pci_mcu_status(struct rt2x00_dev *rt2x00dev, const u8 token)
        rt2800_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
 }
-#ifdef CONFIG_RT2800PCI_WISOC
+#ifdef CONFIG_RT2800PCI_SOC
 static void rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
        u32 *base_addr = (u32 *) KSEG1ADDR(0x1F040000); /* XXX for RT3052 */
@@ -98,7 +90,7 @@ static void rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 static inline void rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
 }
-#endif /* CONFIG_RT2800PCI_WISOC */
+#endif /* CONFIG_RT2800PCI_SOC */
 #ifdef CONFIG_RT2800PCI_PCI
 static void rt2800pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
@@ -835,7 +827,6 @@ static void rt2800pci_fill_rxdone(struct queue_entry *entry,
                                  struct rxdone_entry_desc *rxdesc)
 {
        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
        __le32 *rxd = entry_priv->desc;
        __le32 *rxwi = (__le32 *)entry->skb->data;
@@ -883,10 +874,8 @@ static void rt2800pci_fill_rxdone(struct queue_entry *entry,
        if (rt2x00_get_field32(rxd3, RXD_W3_MY_BSS))
                rxdesc->dev_flags |= RXDONE_MY_BSS;
-        if (rt2x00_get_field32(rxd3, RXD_W3_L2PAD)) {
+        if (rt2x00_get_field32(rxd3, RXD_W3_L2PAD))
                rxdesc->dev_flags |= RXDONE_L2PAD;
-                skbdesc->flags |= SKBDESC_L2_PADDED;
-        }
        if (rt2x00_get_field32(rxwi1, RXWI_W1_SHORT_GI))
                rxdesc->flags |= RX_FLAG_SHORT_GI;
@@ -927,7 +916,6 @@ static void rt2800pci_fill_rxdone(struct queue_entry *entry,
         * Remove TXWI descriptor from start of buffer.
         */
        skb_pull(entry->skb, RXWI_DESC_SIZE);
-        skb_trim(entry->skb, rxdesc->size);
 }
 /*
@@ -1133,8 +1121,7 @@ static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
        /*
         * This device requires firmware.
         */
-        if (!rt2x00_rt(&rt2x00dev->chip, RT2880) &&
+        if (!rt2x00_rt(rt2x00dev, RT2880) && !rt2x00_rt(rt2x00dev, RT3052))
-            !rt2x00_rt(&rt2x00dev->chip, RT3052))
                __set_bit(DRIVER_REQUIRE_FIRMWARE, &rt2x00dev->flags);
        __set_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags);
        __set_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags);
@@ -1255,7 +1242,7 @@ MODULE_DEVICE_TABLE(pci, rt2800pci_device_table);
 #endif /* CONFIG_RT2800PCI_PCI */
 MODULE_LICENSE("GPL");
-#ifdef CONFIG_RT2800PCI_WISOC
+#ifdef CONFIG_RT2800PCI_SOC
 #if defined(CONFIG_RALINK_RT288X)
 __rt2x00soc_probe(RT2880, &rt2800pci_ops);
 #elif defined(CONFIG_RALINK_RT305X)
@@ -1273,7 +1260,7 @@ static struct platform_driver rt2800soc_driver = {
        .suspend        = rt2x00soc_suspend,
        .resume         = rt2x00soc_resume,
 };
-#endif /* CONFIG_RT2800PCI_WISOC */
+#endif /* CONFIG_RT2800PCI_SOC */
 #ifdef CONFIG_RT2800PCI_PCI
 static struct pci_driver rt2800pci_driver = {
@@ -1290,7 +1277,7 @@ static int __init rt2800pci_init(void)
 {
        int ret = 0;
-#ifdef CONFIG_RT2800PCI_WISOC
+#ifdef CONFIG_RT2800PCI_SOC
        ret = platform_driver_register(&rt2800soc_driver);
        if (ret)
                return ret;
@@ -1298,7 +1285,7 @@ static int __init rt2800pci_init(void)
 #ifdef CONFIG_RT2800PCI_PCI
        ret = pci_register_driver(&rt2800pci_driver);
        if (ret) {
-#ifdef CONFIG_RT2800PCI_WISOC
+#ifdef CONFIG_RT2800PCI_SOC
                platform_driver_unregister(&rt2800soc_driver);
 #endif
                return ret;
@@ -1313,7 +1300,7 @@ static void __exit rt2800pci_exit(void)
 #ifdef CONFIG_RT2800PCI_PCI
        pci_unregister_driver(&rt2800pci_driver);
 #endif
-#ifdef CONFIG_RT2800PCI_WISOC
+#ifdef CONFIG_RT2800PCI_SOC
        platform_driver_unregister(&rt2800soc_driver);
 #endif
 }
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index ab95346cf6a3..0510f020dcf5 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -92,7 +92,7 @@ static bool rt2800usb_check_crc(const u8 *data, const size_t len)
 static int rt2800usb_check_firmware(struct rt2x00_dev *rt2x00dev,
                                    const u8 *data, const size_t len)
 {
-        u16 chipset = (rt2x00_rev(&rt2x00dev->chip) >> 16) & 0xffff;
+        u16 chipset = (rt2x00_rev(rt2x00dev) >> 16) & 0xffff;
        size_t offset = 0;
        /*
@@ -138,7 +138,7 @@ static int rt2800usb_load_firmware(struct rt2x00_dev *rt2x00dev,
        u32 reg;
        u32 offset;
        u32 length;
-        u16 chipset = (rt2x00_rev(&rt2x00dev->chip) >> 16) & 0xffff;
+        u16 chipset = (rt2x00_rev(rt2x00dev) >> 16) & 0xffff;
        /*
         * Check which section of the firmware we need.
@@ -295,9 +295,7 @@ static int rt2800usb_enable_radio(struct rt2x00_dev *rt2x00dev)
        rt2800_register_read(rt2x00dev, USB_DMA_CFG, &reg);
        rt2x00_set_field32(&reg, USB_DMA_CFG_PHY_CLEAR, 0);
-        /* Don't use bulk in aggregation when working with USB 1.1 */
+        rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_AGG_EN, 0);
-        rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_AGG_EN,
-                           (rt2x00dev->rx->usb_maxpacket == 512));
        rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_AGG_TIMEOUT, 128);
        /*
         * Total room for RX frames in kilobytes, PBF might still exceed
@@ -573,41 +571,57 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
 {
        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
-        __le32 *rxd = (__le32 *)entry->skb->data;
+        __le32 *rxi = (__le32 *)entry->skb->data;
        __le32 *rxwi;
-        u32 rxd0;
+        __le32 *rxd;
+        u32 rxi0;
        u32 rxwi0;
        u32 rxwi1;
        u32 rxwi2;
        u32 rxwi3;
+        u32 rxd0;
+        int rx_pkt_len;
+        /*
+         * RX frame format is :
+         * | RXINFO | RXWI | header | L2 pad | payload | pad | RXD | USB pad |
+         *          |<------------ rx_pkt_len -------------->|
+         */
+        rt2x00_desc_read(rxi, 0, &rxi0);
+        rx_pkt_len = rt2x00_get_field32(rxi0, RXINFO_W0_USB_DMA_RX_PKT_LEN);
+        rxwi = (__le32 *)(entry->skb->data + RXINFO_DESC_SIZE);
+        /*
+         * FIXME : we need to check for rx_pkt_len validity
+         */
+        rxd = (__le32 *)(entry->skb->data + RXINFO_DESC_SIZE + rx_pkt_len);
        /*
         * Copy descriptor to the skbdesc->desc buffer, making it safe from
         * moving of frame data in rt2x00usb.
         */
-        memcpy(skbdesc->desc, rxd, skbdesc->desc_len);
+        memcpy(skbdesc->desc, rxi, skbdesc->desc_len);
-        rxd = (__le32 *)skbdesc->desc;
-        rxwi = &rxd[RXINFO_DESC_SIZE / sizeof(__le32)];
        /*
         * It is now safe to read the descriptor on all architectures.
         */
-        rt2x00_desc_read(rxd, 0, &rxd0);
        rt2x00_desc_read(rxwi, 0, &rxwi0);
        rt2x00_desc_read(rxwi, 1, &rxwi1);
        rt2x00_desc_read(rxwi, 2, &rxwi2);
        rt2x00_desc_read(rxwi, 3, &rxwi3);
+        rt2x00_desc_read(rxd, 0, &rxd0);
-        if (rt2x00_get_field32(rxd0, RXINFO_W0_CRC_ERROR))
+        if (rt2x00_get_field32(rxd0, RXD_W0_CRC_ERROR))
                rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
        if (test_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags)) {
                rxdesc->cipher = rt2x00_get_field32(rxwi0, RXWI_W0_UDF);
                rxdesc->cipher_status =
-                    rt2x00_get_field32(rxd0, RXINFO_W0_CIPHER_ERROR);
+                    rt2x00_get_field32(rxd0, RXD_W0_CIPHER_ERROR);
        }
-        if (rt2x00_get_field32(rxd0, RXINFO_W0_DECRYPTED)) {
+        if (rt2x00_get_field32(rxd0, RXD_W0_DECRYPTED)) {
                /*
                 * Hardware has stripped IV/EIV data from 802.11 frame during
                 * decryption. Unfortunately the descriptor doesn't contain
@@ -622,13 +636,11 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
                        rxdesc->flags |= RX_FLAG_MMIC_ERROR;
        }
-        if (rt2x00_get_field32(rxd0, RXINFO_W0_MY_BSS))
+        if (rt2x00_get_field32(rxd0, RXD_W0_MY_BSS))
                rxdesc->dev_flags |= RXDONE_MY_BSS;
-        if (rt2x00_get_field32(rxd0, RXINFO_W0_L2PAD)) {
+        if (rt2x00_get_field32(rxd0, RXD_W0_L2PAD))
                rxdesc->dev_flags |= RXDONE_L2PAD;
-                skbdesc->flags |= SKBDESC_L2_PADDED;
-        }
        if (rt2x00_get_field32(rxwi1, RXWI_W1_SHORT_GI))
                rxdesc->flags |= RX_FLAG_SHORT_GI;
@@ -663,7 +675,6 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
         * Remove RXWI descriptor from start of buffer.
         */
        skb_pull(entry->skb, skbdesc->desc_len);
-        skb_trim(entry->skb, rxdesc->size);
 }
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.h b/drivers/net/wireless/rt2x00/rt2800usb.h
index 1e4340a182ef..d1d8ae94b4d4 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.h
+++ b/drivers/net/wireless/rt2x00/rt2800usb.h
@@ -79,6 +79,8 @@
 */
 #define TXINFO_DESC_SIZE                ( 1 * sizeof(__le32) )
 #define RXINFO_DESC_SIZE                ( 1 * sizeof(__le32) )
+#define RXWI_DESC_SIZE                  ( 4 * sizeof(__le32) )
+#define RXD_DESC_SIZE                   ( 1 * sizeof(__le32) )
 /*
 * TX Info structure
@@ -101,6 +103,54 @@
 #define TXINFO_W0_USB_DMA_TX_BURST      FIELD32(0x80000000)
 /*
+ * RX Info structure
+ */
+/*
+ * Word 0
+ */
+#define RXINFO_W0_USB_DMA_RX_PKT_LEN    FIELD32(0x0000ffff)
+/*
+ * RX WI structure
+ */
+/*
+ * Word0
+ */
+#define RXWI_W0_WIRELESS_CLI_ID         FIELD32(0x000000ff)
+#define RXWI_W0_KEY_INDEX               FIELD32(0x00000300)
+#define RXWI_W0_BSSID                   FIELD32(0x00001c00)
+#define RXWI_W0_UDF                     FIELD32(0x0000e000)
+#define RXWI_W0_MPDU_TOTAL_BYTE_COUNT   FIELD32(0x0fff0000)
+#define RXWI_W0_TID                     FIELD32(0xf0000000)
+/*
+ * Word1
+ */
+#define RXWI_W1_FRAG                    FIELD32(0x0000000f)
+#define RXWI_W1_SEQUENCE                FIELD32(0x0000fff0)
+#define RXWI_W1_MCS                     FIELD32(0x007f0000)
+#define RXWI_W1_BW                      FIELD32(0x00800000)
+#define RXWI_W1_SHORT_GI                FIELD32(0x01000000)
+#define RXWI_W1_STBC                    FIELD32(0x06000000)
+#define RXWI_W1_PHYMODE                 FIELD32(0xc0000000)
+/*
+ * Word2
+ */
+#define RXWI_W2_RSSI0                   FIELD32(0x000000ff)
+#define RXWI_W2_RSSI1                   FIELD32(0x0000ff00)
+#define RXWI_W2_RSSI2                   FIELD32(0x00ff0000)
+/*
+ * Word3
+ */
+#define RXWI_W3_SNR0                    FIELD32(0x000000ff)
+#define RXWI_W3_SNR1                    FIELD32(0x0000ff00)
+/*
 * RX descriptor format for RX Ring.
 */
@@ -115,25 +165,25 @@
 * AMSDU: rx with 802.3 header, not 802.11 header.
 */
-#define RXINFO_W0_BA                    FIELD32(0x00000001)
+#define RXD_W0_BA                       FIELD32(0x00000001)
-#define RXINFO_W0_DATA                  FIELD32(0x00000002)
+#define RXD_W0_DATA                     FIELD32(0x00000002)
-#define RXINFO_W0_NULLDATA              FIELD32(0x00000004)
+#define RXD_W0_NULLDATA                 FIELD32(0x00000004)
-#define RXINFO_W0_FRAG                  FIELD32(0x00000008)
+#define RXD_W0_FRAG                     FIELD32(0x00000008)
-#define RXINFO_W0_UNICAST_TO_ME         FIELD32(0x00000010)
+#define RXD_W0_UNICAST_TO_ME            FIELD32(0x00000010)
-#define RXINFO_W0_MULTICAST             FIELD32(0x00000020)
+#define RXD_W0_MULTICAST                FIELD32(0x00000020)
-#define RXINFO_W0_BROADCAST             FIELD32(0x00000040)
+#define RXD_W0_BROADCAST                FIELD32(0x00000040)
-#define RXINFO_W0_MY_BSS                FIELD32(0x00000080)
+#define RXD_W0_MY_BSS                   FIELD32(0x00000080)
-#define RXINFO_W0_CRC_ERROR             FIELD32(0x00000100)
+#define RXD_W0_CRC_ERROR                FIELD32(0x00000100)
-#define RXINFO_W0_CIPHER_ERROR          FIELD32(0x00000600)
+#define RXD_W0_CIPHER_ERROR             FIELD32(0x00000600)
-#define RXINFO_W0_AMSDU                 FIELD32(0x00000800)
+#define RXD_W0_AMSDU                    FIELD32(0x00000800)
-#define RXINFO_W0_HTC                   FIELD32(0x00001000)
+#define RXD_W0_HTC                      FIELD32(0x00001000)
-#define RXINFO_W0_RSSI                  FIELD32(0x00002000)
+#define RXD_W0_RSSI                     FIELD32(0x00002000)
-#define RXINFO_W0_L2PAD                 FIELD32(0x00004000)
+#define RXD_W0_L2PAD                    FIELD32(0x00004000)
-#define RXINFO_W0_AMPDU                 FIELD32(0x00008000)
+#define RXD_W0_AMPDU                    FIELD32(0x00008000)
-#define RXINFO_W0_DECRYPTED             FIELD32(0x00010000)
+#define RXD_W0_DECRYPTED                FIELD32(0x00010000)
-#define RXINFO_W0_PLCP_RSSI             FIELD32(0x00020000)
+#define RXD_W0_PLCP_RSSI                FIELD32(0x00020000)
-#define RXINFO_W0_CIPHER_ALG            FIELD32(0x00040000)
+#define RXD_W0_CIPHER_ALG               FIELD32(0x00040000)
-#define RXINFO_W0_LAST_AMSDU            FIELD32(0x00080000)
+#define RXD_W0_LAST_AMSDU               FIELD32(0x00080000)
-#define RXINFO_W0_PLCP_SIGNAL           FIELD32(0xfff00000)
+#define RXD_W0_PLCP_SIGNAL              FIELD32(0xfff00000)
 #endif /* RT2800USB_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index dcfc8c25d1a7..096da85a66fa 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -104,6 +104,12 @@
 #define GET_DURATION_RES(__size, __rate)(((__size) * 8 * 10) % (__rate))
 /*
+ * Determine the number of L2 padding bytes required between the header and
+ * the payload.
+ */
+#define L2PAD_SIZE(__hdrlen)    (-(__hdrlen) & 3)
+/*
 * Determine the alignment requirement,
 * to make sure the 802.11 payload is padded to a 4-byte boundrary
 * we must determine the address of the payload and calculate the
@@ -937,25 +943,25 @@ static inline void rt2x00_print_chip(struct rt2x00_dev *rt2x00dev)
             rt2x00dev->chip.rt, rt2x00dev->chip.rf, rt2x00dev->chip.rev);
 }
-static inline char rt2x00_rt(const struct rt2x00_chip *chipset, const u16 chip)
+static inline char rt2x00_rt(struct rt2x00_dev *rt2x00dev, const u16 rt)
 {
-        return (chipset->rt == chip);
+        return (rt2x00dev->chip.rt == rt);
 }
-static inline char rt2x00_rf(const struct rt2x00_chip *chipset, const u16 chip)
+static inline char rt2x00_rf(struct rt2x00_dev *rt2x00dev, const u16 rf)
 {
-        return (chipset->rf == chip);
+        return (rt2x00dev->chip.rf == rf);
 }
-static inline u32 rt2x00_rev(const struct rt2x00_chip *chipset)
+static inline u32 rt2x00_rev(struct rt2x00_dev *rt2x00dev)
 {
-        return chipset->rev;
+        return rt2x00dev->chip.rev;
 }
-static inline bool rt2x00_check_rev(const struct rt2x00_chip *chipset,
+static inline bool rt2x00_check_rev(struct rt2x00_dev *rt2x00dev,
                                    const u32 mask, const u32 rev)
 {
-        return ((chipset->rev & mask) == rev);
+        return ((rt2x00dev->chip.rev & mask) == rev);
 }
 static inline void rt2x00_set_chip_intf(struct rt2x00_dev *rt2x00dev,
@@ -964,20 +970,20 @@ static inline void rt2x00_set_chip_intf(struct rt2x00_dev *rt2x00dev,
        rt2x00dev->chip.intf = intf;
 }
-static inline bool rt2x00_intf(const struct rt2x00_chip *chipset,
+static inline bool rt2x00_intf(struct rt2x00_dev *rt2x00dev,
                               enum rt2x00_chip_intf intf)
 {
-        return (chipset->intf == intf);
+        return (rt2x00dev->chip.intf == intf);
 }
 static inline bool rt2x00_intf_is_pci(struct rt2x00_dev *rt2x00dev)
 {
-        return rt2x00_intf(&rt2x00dev->chip, RT2X00_CHIP_INTF_PCI);
+        return rt2x00_intf(rt2x00dev, RT2X00_CHIP_INTF_PCI);
 }
 static inline bool rt2x00_intf_is_usb(struct rt2x00_dev *rt2x00dev)
 {
-        return rt2x00_intf(&rt2x00dev->chip, RT2X00_CHIP_INTF_USB);
+        return rt2x00_intf(rt2x00dev, RT2X00_CHIP_INTF_USB);
 }
 /**
@@ -1019,9 +1025,9 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
 int rt2x00mac_start(struct ieee80211_hw *hw);
 void rt2x00mac_stop(struct ieee80211_hw *hw);
 int rt2x00mac_add_interface(struct ieee80211_hw *hw,
-                            struct ieee80211_if_init_conf *conf);
+                            struct ieee80211_vif *vif);
 void rt2x00mac_remove_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_if_init_conf *conf);
+                                struct ieee80211_vif *vif);
 int rt2x00mac_config(struct ieee80211_hw *hw, u32 changed);
 void rt2x00mac_configure_filter(struct ieee80211_hw *hw,
                                unsigned int changed_flags,
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 265e66dba552..b93731b79903 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -385,9 +385,6 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
        memset(&rxdesc, 0, sizeof(rxdesc));
        rt2x00dev->ops->lib->fill_rxdone(entry, &rxdesc);
-        /* Trim buffer to correct size */
-        skb_trim(entry->skb, rxdesc.size);
        /*
         * The data behind the ieee80211 header must be
         * aligned on a 4 byte boundary.
@@ -404,11 +401,16 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
            (rxdesc.flags & RX_FLAG_IV_STRIPPED))
                rt2x00crypto_rx_insert_iv(entry->skb, header_length,
                                          &rxdesc);
-        else if (rxdesc.dev_flags & RXDONE_L2PAD)
+        else if (header_length &&
+                 (rxdesc.size > header_length) &&
+                 (rxdesc.dev_flags & RXDONE_L2PAD))
                rt2x00queue_remove_l2pad(entry->skb, header_length);
        else
                rt2x00queue_align_payload(entry->skb, header_length);
+        /* Trim buffer to correct size */
+        skb_trim(entry->skb, rxdesc.size);
        /*
         * Check if the frame was received using HT. In that case,
         * the rate is the MCS index and should be passed to mac80211
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index de549c244ed8..00f1f939f1bb 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -187,10 +187,10 @@ void rt2x00mac_stop(struct ieee80211_hw *hw)
 EXPORT_SYMBOL_GPL(rt2x00mac_stop);
 int rt2x00mac_add_interface(struct ieee80211_hw *hw,
-                            struct ieee80211_if_init_conf *conf)
+                            struct ieee80211_vif *vif)
 {
        struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct rt2x00_intf *intf = vif_to_intf(conf->vif);
+        struct rt2x00_intf *intf = vif_to_intf(vif);
        struct data_queue *queue = rt2x00queue_get_queue(rt2x00dev, QID_BEACON);
        struct queue_entry *entry = NULL;
        unsigned int i;
@@ -203,7 +203,7 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
            !test_bit(DEVICE_STATE_STARTED, &rt2x00dev->flags))
                return -ENODEV;
-        switch (conf->type) {
+        switch (vif->type) {
        case NL80211_IFTYPE_AP:
                /*
                 * We don't support mixed combinations of
@@ -263,7 +263,7 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
         * increase interface count and start initialization.
         */
-        if (conf->type == NL80211_IFTYPE_AP)
+        if (vif->type == NL80211_IFTYPE_AP)
                rt2x00dev->intf_ap_count++;
        else
                rt2x00dev->intf_sta_count++;
@@ -273,16 +273,16 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
        mutex_init(&intf->beacon_skb_mutex);
        intf->beacon = entry;
-        if (conf->type == NL80211_IFTYPE_AP)
+        if (vif->type == NL80211_IFTYPE_AP)
-                memcpy(&intf->bssid, conf->mac_addr, ETH_ALEN);
+                memcpy(&intf->bssid, vif->addr, ETH_ALEN);
-        memcpy(&intf->mac, conf->mac_addr, ETH_ALEN);
+        memcpy(&intf->mac, vif->addr, ETH_ALEN);
        /*
         * The MAC adddress must be configured after the device
         * has been initialized. Otherwise the device can reset
         * the MAC registers.
         */
-        rt2x00lib_config_intf(rt2x00dev, intf, conf->type, intf->mac, NULL);
+        rt2x00lib_config_intf(rt2x00dev, intf, vif->type, intf->mac, NULL);
        /*
         * Some filters depend on the current working mode. We can force
@@ -296,10 +296,10 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
 EXPORT_SYMBOL_GPL(rt2x00mac_add_interface);
 void rt2x00mac_remove_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_if_init_conf *conf)
+                                struct ieee80211_vif *vif)
 {
        struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct rt2x00_intf *intf = vif_to_intf(conf->vif);
+        struct rt2x00_intf *intf = vif_to_intf(vif);
        /*
         * Don't allow interfaces to be remove while
@@ -307,11 +307,11 @@ void rt2x00mac_remove_interface(struct ieee80211_hw *hw,
         * no interface is present.
         */
        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) ||
-            (conf->type == NL80211_IFTYPE_AP && !rt2x00dev->intf_ap_count) ||
+            (vif->type == NL80211_IFTYPE_AP && !rt2x00dev->intf_ap_count) ||
-            (conf->type != NL80211_IFTYPE_AP && !rt2x00dev->intf_sta_count))
+            (vif->type != NL80211_IFTYPE_AP && !rt2x00dev->intf_sta_count))
                return;
-        if (conf->type == NL80211_IFTYPE_AP)
+        if (vif->type == NL80211_IFTYPE_AP)
                rt2x00dev->intf_ap_count--;
        else
                rt2x00dev->intf_sta_count--;
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 0feb4d0e4668..801be436cf1d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -41,6 +41,9 @@ int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
 {
        unsigned int i;
+        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+                return 0;
        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
                rt2x00pci_register_read(rt2x00dev, offset, reg);
                if (!rt2x00_get_field32(*reg, field))
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 9915a09141ef..0b4801a14601 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -177,55 +177,45 @@ void rt2x00queue_align_payload(struct sk_buff *skb, unsigned int header_length)
 void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
+        unsigned int payload_length = skb->len - header_length;
-        unsigned int frame_length = skb->len;
        unsigned int header_align = ALIGN_SIZE(skb, 0);
        unsigned int payload_align = ALIGN_SIZE(skb, header_length);
-        unsigned int l2pad = 4 - (payload_align - header_align);
+        unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0;
-        if (header_align == payload_align) {
+        /*
-                /*
+         * Adjust the header alignment if the payload needs to be moved more
-                 * Both header and payload must be moved the same
+         * than the header.
-                 * amount of bytes to align them properly. This means
+         */
-                 * we don't use the L2 padding but just move the entire
+        if (payload_align > header_align)
-                 * frame.
+                header_align += 4;
-                 */
-                rt2x00queue_align_frame(skb);
+        /* There is nothing to do if no alignment is needed */
-        } else if (!payload_align) {
+        if (!header_align)
-                /*
+                return;
-                 * Simple L2 padding, only the header needs to be moved,
-                 * the payload is already properly aligned.
+        /* Reserve the amount of space needed in front of the frame */
-                 */
+        skb_push(skb, header_align);
-                skb_push(skb, header_align);
-                memmove(skb->data, skb->data + header_align, frame_length);
+        /*
-                skbdesc->flags |= SKBDESC_L2_PADDED;
+         * Move the header.
-        } else {
+         */
-                /*
+        memmove(skb->data, skb->data + header_align, header_length);
-                 *
-                 * Complicated L2 padding, both header and payload need
-                 * to be moved. By default we only move to the start
-                 * of the buffer, so our header alignment needs to be
-                 * increased if there is not enough room for the header
-                 * to be moved.
-                 */
-                if (payload_align > header_align)
-                        header_align += 4;
-                skb_push(skb, header_align);
+        /* Move the payload, if present and if required */
-                memmove(skb->data, skb->data + header_align, header_length);
+        if (payload_length && payload_align)
                memmove(skb->data + header_length + l2pad,
                        skb->data + header_length + l2pad + payload_align,
-                        frame_length - header_length);
+                        payload_length);
-                skbdesc->flags |= SKBDESC_L2_PADDED;
-        }
+        /* Trim the skb to the correct size */
+        skb_trim(skb, header_length + l2pad + payload_length);
 }
 void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
+        unsigned int l2pad = L2PAD_SIZE(header_length);
-        unsigned int l2pad = 4 - (header_length & 3);
-        if (!l2pad || (skbdesc->flags & SKBDESC_L2_PADDED))
+        if (!l2pad)
                return;
        memmove(skb->data + l2pad, skb->data, header_length);
@@ -346,7 +336,9 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
         * Header and alignment information.
         */
        txdesc->header_length = ieee80211_get_hdrlen_from_skb(entry->skb);
-        txdesc->l2pad = ALIGN_SIZE(entry->skb, txdesc->header_length);
+        if (test_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags) &&
+            (entry->skb->len > txdesc->header_length))
+                txdesc->l2pad = L2PAD_SIZE(txdesc->header_length);
        /*
         * Check whether this frame is to be acked.
@@ -387,10 +379,13 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
        /*
         * Beacons and probe responses require the tsf timestamp
-         * to be inserted into the frame.
+         * to be inserted into the frame, except for a frame that has been injected
+         * through a monitor interface. This latter is needed for testing a
+         * monitor interface.
         */
-        if (ieee80211_is_beacon(hdr->frame_control) ||
+        if ((ieee80211_is_beacon(hdr->frame_control) ||
-            ieee80211_is_probe_resp(hdr->frame_control))
+            ieee80211_is_probe_resp(hdr->frame_control)) &&
+            (!(tx_info->flags & IEEE80211_TX_CTL_INJECTED)))
                __set_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags);
        /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index 70775e5ba1ac..c1e482bb37b3 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -92,8 +92,6 @@ enum data_queue_qid {
 * @SKBDESC_DMA_MAPPED_TX: &skb_dma field has been mapped for TX
 * @SKBDESC_IV_STRIPPED: Frame contained a IV/EIV provided by
 *      mac80211 but was stripped for processing by the driver.
- * @SKBDESC_L2_PADDED: Payload has been padded for 4-byte alignment,
- *      the padded bytes are located between header and payload.
 * @SKBDESC_NOT_MAC80211: Frame didn't originate from mac80211,
 *      don't try to pass it back.
 */
@@ -101,8 +99,7 @@ enum skb_frame_desc_flags {
        SKBDESC_DMA_MAPPED_RX = 1 << 0,
        SKBDESC_DMA_MAPPED_TX = 1 << 1,
        SKBDESC_IV_STRIPPED = 1 << 2,
-        SKBDESC_L2_PADDED = 1 << 3,
+        SKBDESC_NOT_MAC80211 = 1 << 3,
-        SKBDESC_NOT_MAC80211 = 1 << 4,
 };
 /**
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 0ca589306d71..c353b497a65d 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -637,8 +637,7 @@ static void rt61pci_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
        rt61pci_bbp_read(rt2x00dev, 4, &r4);
        rt61pci_bbp_read(rt2x00dev, 77, &r77);
-        rt2x00_set_field8(&r3, BBP_R3_SMART_MODE,
+        rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, rt2x00_rf(rt2x00dev, RF5325));
-                          rt2x00_rf(&rt2x00dev->chip, RF5325));
        /*
         * Configure the RX antenna.
@@ -684,8 +683,7 @@ static void rt61pci_config_antenna_2x(struct rt2x00_dev *rt2x00dev,
        rt61pci_bbp_read(rt2x00dev, 4, &r4);
        rt61pci_bbp_read(rt2x00dev, 77, &r77);
-        rt2x00_set_field8(&r3, BBP_R3_SMART_MODE,
+        rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, rt2x00_rf(rt2x00dev, RF2529));
-                          rt2x00_rf(&rt2x00dev->chip, RF2529));
        rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END,
                          !test_bit(CONFIG_FRAME_TYPE, &rt2x00dev->flags));
@@ -833,12 +831,11 @@ static void rt61pci_config_ant(struct rt2x00_dev *rt2x00dev,
        rt2x00pci_register_write(rt2x00dev, PHY_CSR0, reg);
-        if (rt2x00_rf(&rt2x00dev->chip, RF5225) ||
+        if (rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF5325))
-            rt2x00_rf(&rt2x00dev->chip, RF5325))
                rt61pci_config_antenna_5x(rt2x00dev, ant);
-        else if (rt2x00_rf(&rt2x00dev->chip, RF2527))
+        else if (rt2x00_rf(rt2x00dev, RF2527))
                rt61pci_config_antenna_2x(rt2x00dev, ant);
-        else if (rt2x00_rf(&rt2x00dev->chip, RF2529)) {
+        else if (rt2x00_rf(rt2x00dev, RF2529)) {
                if (test_bit(CONFIG_DOUBLE_ANTENNA, &rt2x00dev->flags))
                        rt61pci_config_antenna_2x(rt2x00dev, ant);
                else
@@ -879,8 +876,7 @@ static void rt61pci_config_channel(struct rt2x00_dev *rt2x00dev,
        rt2x00_set_field32(&rf->rf3, RF3_TXPOWER, TXPOWER_TO_DEV(txpower));
        rt2x00_set_field32(&rf->rf4, RF4_FREQ_OFFSET, rt2x00dev->freq_offset);
-        smart = !(rt2x00_rf(&rt2x00dev->chip, RF5225) ||
+        smart = !(rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF2527));
-                  rt2x00_rf(&rt2x00dev->chip, RF2527));
        rt61pci_bbp_read(rt2x00dev, 3, &r3);
        rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, smart);
@@ -2302,10 +2298,10 @@ static int rt61pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
        rt2x00_set_chip_rf(rt2x00dev, value, reg);
        rt2x00_print_chip(rt2x00dev);
-        if (!rt2x00_rf(&rt2x00dev->chip, RF5225) &&
+        if (!rt2x00_rf(rt2x00dev, RF5225) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF5325) &&
+            !rt2x00_rf(rt2x00dev, RF5325) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2527) &&
+            !rt2x00_rf(rt2x00dev, RF2527) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2529)) {
+            !rt2x00_rf(rt2x00dev, RF2529)) {
                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
                return -ENODEV;
        }
@@ -2360,7 +2356,7 @@ static int rt61pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
         * the antenna settings should be gathered from the NIC
         * eeprom word.
         */
-        if (rt2x00_rf(&rt2x00dev->chip, RF2529) &&
+        if (rt2x00_rf(rt2x00dev, RF2529) &&
            !test_bit(CONFIG_DOUBLE_ANTENNA, &rt2x00dev->flags)) {
                rt2x00dev->default_ant.rx =
                    ANTENNA_A + rt2x00_get_field16(eeprom, EEPROM_NIC_RX_FIXED);
@@ -2571,8 +2567,7 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                spec->channels = rf_vals_seq;
        }
-        if (rt2x00_rf(&rt2x00dev->chip, RF5225) ||
+        if (rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF5325)) {
-            rt2x00_rf(&rt2x00dev->chip, RF5325)) {
                spec->supported_bands |= SUPPORT_BAND_5GHZ;
                spec->num_channels = ARRAY_SIZE(rf_vals_seq);
        }
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index ced3b6ab5e16..a02691294395 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -136,8 +136,8 @@ static void rt73usb_rf_write(struct rt2x00_dev *rt2x00dev,
                 * all others contain 20 bits.
                 */
                rt2x00_set_field32(&reg, PHY_CSR4_NUMBER_OF_BITS,
-                                   20 + (rt2x00_rf(&rt2x00dev->chip, RF5225) ||
+                                   20 + (rt2x00_rf(rt2x00dev, RF5225) ||
-                                         rt2x00_rf(&rt2x00dev->chip, RF2527)));
+                                         rt2x00_rf(rt2x00dev, RF2527)));
                rt2x00_set_field32(&reg, PHY_CSR4_IF_SELECT, 0);
                rt2x00_set_field32(&reg, PHY_CSR4_BUSY, 1);
@@ -741,11 +741,9 @@ static void rt73usb_config_ant(struct rt2x00_dev *rt2x00dev,
        rt2x00usb_register_write(rt2x00dev, PHY_CSR0, reg);
-        if (rt2x00_rf(&rt2x00dev->chip, RF5226) ||
+        if (rt2x00_rf(rt2x00dev, RF5226) || rt2x00_rf(rt2x00dev, RF5225))
-            rt2x00_rf(&rt2x00dev->chip, RF5225))
                rt73usb_config_antenna_5x(rt2x00dev, ant);
-        else if (rt2x00_rf(&rt2x00dev->chip, RF2528) ||
+        else if (rt2x00_rf(rt2x00dev, RF2528) || rt2x00_rf(rt2x00dev, RF2527))
-                 rt2x00_rf(&rt2x00dev->chip, RF2527))
                rt73usb_config_antenna_2x(rt2x00dev, ant);
 }
@@ -779,8 +777,7 @@ static void rt73usb_config_channel(struct rt2x00_dev *rt2x00dev,
        rt2x00_set_field32(&rf->rf3, RF3_TXPOWER, TXPOWER_TO_DEV(txpower));
        rt2x00_set_field32(&rf->rf4, RF4_FREQ_OFFSET, rt2x00dev->freq_offset);
-        smart = !(rt2x00_rf(&rt2x00dev->chip, RF5225) ||
+        smart = !(rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF2527));
-                  rt2x00_rf(&rt2x00dev->chip, RF2527));
        rt73usb_bbp_read(rt2x00dev, 3, &r3);
        rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, smart);
@@ -1210,8 +1207,7 @@ static int rt73usb_init_registers(struct rt2x00_dev *rt2x00dev)
        rt2x00usb_register_write(rt2x00dev, SEC_CSR5, 0x00000000);
        reg = 0x000023b0;
-        if (rt2x00_rf(&rt2x00dev->chip, RF5225) ||
+        if (rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF2527))
-            rt2x00_rf(&rt2x00dev->chip, RF2527))
                rt2x00_set_field32(&reg, PHY_CSR1_RF_RPI, 1);
        rt2x00usb_register_write(rt2x00dev, PHY_CSR1, reg);
@@ -1827,16 +1823,16 @@ static int rt73usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
        rt2x00_set_chip(rt2x00dev, RT2571, value, reg);
        rt2x00_print_chip(rt2x00dev);
-        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0x25730) ||
+        if (!rt2x00_check_rev(rt2x00dev, 0x000ffff0, 0x25730) ||
-            rt2x00_check_rev(&rt2x00dev->chip, 0x0000000f, 0)) {
+            rt2x00_check_rev(rt2x00dev, 0x0000000f, 0)) {
                ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
                return -ENODEV;
        }
-        if (!rt2x00_rf(&rt2x00dev->chip, RF5226) &&
+        if (!rt2x00_rf(rt2x00dev, RF5226) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2528) &&
+            !rt2x00_rf(rt2x00dev, RF2528) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF5225) &&
+            !rt2x00_rf(rt2x00dev, RF5225) &&
-            !rt2x00_rf(&rt2x00dev->chip, RF2527)) {
+            !rt2x00_rf(rt2x00dev, RF2527)) {
                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
                return -ENODEV;
        }
@@ -2081,17 +2077,17 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
        spec->supported_bands = SUPPORT_BAND_2GHZ;
        spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
-        if (rt2x00_rf(&rt2x00dev->chip, RF2528)) {
+        if (rt2x00_rf(rt2x00dev, RF2528)) {
                spec->num_channels = ARRAY_SIZE(rf_vals_bg_2528);
                spec->channels = rf_vals_bg_2528;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF5226)) {
+        } else if (rt2x00_rf(rt2x00dev, RF5226)) {
                spec->supported_bands |= SUPPORT_BAND_5GHZ;
                spec->num_channels = ARRAY_SIZE(rf_vals_5226);
                spec->channels = rf_vals_5226;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF2527)) {
+        } else if (rt2x00_rf(rt2x00dev, RF2527)) {
                spec->num_channels = 14;
                spec->channels = rf_vals_5225_2527;
-        } else if (rt2x00_rf(&rt2x00dev->chip, RF5225)) {
+        } else if (rt2x00_rf(rt2x00dev, RF5225)) {
                spec->supported_bands |= SUPPORT_BAND_5GHZ;
                spec->num_channels = ARRAY_SIZE(rf_vals_5225_2527);
                spec->channels = rf_vals_5225_2527;
@@ -2354,6 +2350,7 @@ static struct usb_device_id rt73usb_device_table[] = {
        { USB_DEVICE(0x08dd, 0x0120), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Buffalo */
        { USB_DEVICE(0x0411, 0x00d8), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0411, 0x00d9), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0411, 0x00f4), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0411, 0x0116), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0411, 0x0119), USB_DEVICE_DATA(&rt73usb_ops) },
diff --git a/drivers/net/wireless/rtl818x/rtl8180.h b/drivers/net/wireless/rtl818x/rtl8180.h
index 8721282a8185..de3844fe06d8 100644
--- a/drivers/net/wireless/rtl818x/rtl8180.h
+++ b/drivers/net/wireless/rtl818x/rtl8180.h
@@ -60,7 +60,6 @@ struct rtl8180_priv {
        struct rtl818x_csr __iomem *map;
        const struct rtl818x_rf_ops *rf;
        struct ieee80211_vif *vif;
-        int mode;
        /* rtl8180 driver specific */
        spinlock_t lock;
diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
index 8a40a1439984..5a2b7199f5d5 100644
--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
@@ -82,8 +82,6 @@ static const struct ieee80211_channel rtl818x_channels[] = {
 };
 void rtl8180_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data)
 {
        struct rtl8180_priv *priv = dev->priv;
@@ -615,7 +613,6 @@ static int rtl8180_start(struct ieee80211_hw *dev)
        reg |= RTL818X_CMD_TX_ENABLE;
        rtl818x_iowrite8(priv, &priv->map->CMD, reg);
-        priv->mode = NL80211_IFTYPE_MONITOR;
        return 0;
 err_free_rings:
@@ -633,8 +630,6 @@ static void rtl8180_stop(struct ieee80211_hw *dev)
        u8 reg;
        int i;
-        priv->mode = NL80211_IFTYPE_UNSPECIFIED;
        rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0);
        reg = rtl818x_ioread8(priv, &priv->map->CMD);
@@ -657,38 +652,39 @@ static void rtl8180_stop(struct ieee80211_hw *dev)
 }
 static int rtl8180_add_interface(struct ieee80211_hw *dev,
-                                 struct ieee80211_if_init_conf *conf)
+                                 struct ieee80211_vif *vif)
 {
        struct rtl8180_priv *priv = dev->priv;
-        if (priv->mode != NL80211_IFTYPE_MONITOR)
+        /*
-                return -EOPNOTSUPP;
+         * We only support one active interface at a time.
+         */
+        if (priv->vif)
+                return -EBUSY;
-        switch (conf->type) {
+        switch (vif->type) {
        case NL80211_IFTYPE_STATION:
-                priv->mode = conf->type;
                break;
        default:
                return -EOPNOTSUPP;
        }
-        priv->vif = conf->vif;
+        priv->vif = vif;
        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
        rtl818x_iowrite32(priv, (__le32 __iomem *)&priv->map->MAC[0],
-                          le32_to_cpu(*(__le32 *)conf->mac_addr));
+                          le32_to_cpu(*(__le32 *)vif->addr));
        rtl818x_iowrite16(priv, (__le16 __iomem *)&priv->map->MAC[4],
-                          le16_to_cpu(*(__le16 *)(conf->mac_addr + 4)));
+                          le16_to_cpu(*(__le16 *)(vif->addr + 4)));
        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
        return 0;
 }
 static void rtl8180_remove_interface(struct ieee80211_hw *dev,
-                                     struct ieee80211_if_init_conf *conf)
+                                     struct ieee80211_vif *vif)
 {
        struct rtl8180_priv *priv = dev->priv;
-        priv->mode = NL80211_IFTYPE_MONITOR;
        priv->vif = NULL;
 }
diff --git a/drivers/net/wireless/rtl818x/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187.h
index 6af0f3f71f3a..6bb32112e65c 100644
--- a/drivers/net/wireless/rtl818x/rtl8187.h
+++ b/drivers/net/wireless/rtl818x/rtl8187.h
@@ -92,7 +92,7 @@ struct rtl8187_priv {
        struct rtl818x_csr *map;
        const struct rtl818x_rf_ops *rf;
        struct ieee80211_vif *vif;
-        int mode;
        /* The mutex protects the TX loopback state.
         * Any attempt to set channels concurrently locks the device.
         */
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index bc5726dd5fe4..f336c63053c1 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -1018,31 +1018,30 @@ static void rtl8187_stop(struct ieee80211_hw *dev)
 }
 static int rtl8187_add_interface(struct ieee80211_hw *dev,
-                                 struct ieee80211_if_init_conf *conf)
+                                 struct ieee80211_vif *vif)
 {
        struct rtl8187_priv *priv = dev->priv;
        int i;
        int ret = -EOPNOTSUPP;
        mutex_lock(&priv->conf_mutex);
-        if (priv->mode != NL80211_IFTYPE_MONITOR)
+        if (priv->vif)
                goto exit;
-        switch (conf->type) {
+        switch (vif->type) {
        case NL80211_IFTYPE_STATION:
-                priv->mode = conf->type;
                break;
        default:
                goto exit;
        }
        ret = 0;
-        priv->vif = conf->vif;
+        priv->vif = vif;
        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
        for (i = 0; i < ETH_ALEN; i++)
                rtl818x_iowrite8(priv, &priv->map->MAC[i],
-                                 ((u8 *)conf->mac_addr)[i]);
+                                 ((u8 *)vif->addr)[i]);
        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
 exit:
@@ -1051,11 +1050,10 @@ exit:
 }
 static void rtl8187_remove_interface(struct ieee80211_hw *dev,
-                                     struct ieee80211_if_init_conf *conf)
+                                     struct ieee80211_vif *vif)
 {
        struct rtl8187_priv *priv = dev->priv;
        mutex_lock(&priv->conf_mutex);
-        priv->mode = NL80211_IFTYPE_MONITOR;
        priv->vif = NULL;
        mutex_unlock(&priv->conf_mutex);
 }
@@ -1365,7 +1363,6 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
        dev->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band;
-        priv->mode = NL80211_IFTYPE_MONITOR;
        dev->flags = IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
                     IEEE80211_HW_SIGNAL_DBM |
                     IEEE80211_HW_RX_INCLUDES_FCS;
diff --git a/drivers/net/wireless/rtl818x/rtl8187_leds.c b/drivers/net/wireless/rtl818x/rtl8187_leds.c
index ded44c045eb2..f82aa8b4bdde 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_leds.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_leds.c
@@ -33,7 +33,7 @@ static void led_turn_on(struct work_struct *work)
        struct rtl8187_led *led = &priv->led_tx;
        /* Don't change the LED, when the device is down. */
-        if (priv->mode == NL80211_IFTYPE_UNSPECIFIED)
+        if (!priv->vif || priv->vif->type == NL80211_IFTYPE_UNSPECIFIED)
                return ;
        /* Skip if the LED is not registered. */
@@ -71,7 +71,7 @@ static void led_turn_off(struct work_struct *work)
        struct rtl8187_led *led = &priv->led_tx;
        /* Don't change the LED, when the device is down. */
-        if (priv->mode == NL80211_IFTYPE_UNSPECIFIED)
+        if (!priv->vif || priv->vif->type == NL80211_IFTYPE_UNSPECIFIED)
                return ;
        /* Skip if the LED is not registered. */
diff --git a/drivers/net/wireless/wl12xx/wl1251.h b/drivers/net/wireless/wl12xx/wl1251.h
index 054533f7a124..6301578d1565 100644
--- a/drivers/net/wireless/wl12xx/wl1251.h
+++ b/drivers/net/wireless/wl12xx/wl1251.h
@@ -247,6 +247,7 @@ struct wl1251_debugfs {
        struct dentry *rxpipe_tx_xfr_host_int_trig_rx_data;
        struct dentry *tx_queue_len;
+        struct dentry *tx_queue_status;
        struct dentry *retry_count;
        struct dentry *excessive_retries;
diff --git a/drivers/net/wireless/wl12xx/wl1251_acx.c b/drivers/net/wireless/wl12xx/wl1251_acx.c
index acfa086dbfc5..beff084040b5 100644
--- a/drivers/net/wireless/wl12xx/wl1251_acx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_acx.c
@@ -976,3 +976,72 @@ out:
        kfree(acx);
        return ret;
 }
+int wl1251_acx_ac_cfg(struct wl1251 *wl, u8 ac, u8 cw_min, u16 cw_max,
+                      u8 aifs, u16 txop)
+{
+        struct wl1251_acx_ac_cfg *acx;
+        int ret = 0;
+        wl1251_debug(DEBUG_ACX, "acx ac cfg %d cw_ming %d cw_max %d "
+                     "aifs %d txop %d", ac, cw_min, cw_max, aifs, txop);
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        acx->ac = ac;
+        acx->cw_min = cw_min;
+        acx->cw_max = cw_max;
+        acx->aifsn = aifs;
+        acx->txop_limit = txop;
+        ret = wl1251_cmd_configure(wl, ACX_AC_CFG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1251_warning("acx ac cfg failed: %d", ret);
+                goto out;
+        }
+out:
+        kfree(acx);
+        return ret;
+}
+int wl1251_acx_tid_cfg(struct wl1251 *wl, u8 queue,
+                       enum wl1251_acx_channel_type type,
+                       u8 tsid, enum wl1251_acx_ps_scheme ps_scheme,
+                       enum wl1251_acx_ack_policy ack_policy)
+{
+        struct wl1251_acx_tid_cfg *acx;
+        int ret = 0;
+        wl1251_debug(DEBUG_ACX, "acx tid cfg %d type %d tsid %d "
+                     "ps_scheme %d ack_policy %d", queue, type, tsid,
+                     ps_scheme, ack_policy);
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        acx->queue = queue;
+        acx->type = type;
+        acx->tsid = tsid;
+        acx->ps_scheme = ps_scheme;
+        acx->ack_policy = ack_policy;
+        ret = wl1251_cmd_configure(wl, ACX_TID_CFG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1251_warning("acx tid cfg failed: %d", ret);
+                goto out;
+        }
+out:
+        kfree(acx);
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1251_acx.h b/drivers/net/wireless/wl12xx/wl1251_acx.h
index 652371432cd8..26160c45784c 100644
--- a/drivers/net/wireless/wl12xx/wl1251_acx.h
+++ b/drivers/net/wireless/wl12xx/wl1251_acx.h
@@ -1166,6 +1166,87 @@ struct wl1251_acx_wr_tbtt_and_dtim {
        u8  padding;
 } __attribute__ ((packed));
+struct wl1251_acx_ac_cfg {
+        struct acx_header header;
+        /*
+         * Access Category - The TX queue's access category
+         * (refer to AccessCategory_enum)
+         */
+        u8 ac;
+        /*
+         * The contention window minimum size (in slots) for
+         * the access class.
+         */
+        u8 cw_min;
+        /*
+         * The contention window maximum size (in slots) for
+         * the access class.
+         */
+        u16 cw_max;
+        /* The AIF value (in slots) for the access class. */
+        u8 aifsn;
+        u8 reserved;
+        /* The TX Op Limit (in microseconds) for the access class. */
+        u16 txop_limit;
+} __attribute__ ((packed));
+enum wl1251_acx_channel_type {
+        CHANNEL_TYPE_DCF        = 0,
+        CHANNEL_TYPE_EDCF       = 1,
+        CHANNEL_TYPE_HCCA       = 2,
+};
+enum wl1251_acx_ps_scheme {
+        /* regular ps: simple sending of packets */
+        WL1251_ACX_PS_SCHEME_LEGACY     = 0,
+        /* sending a packet triggers a unscheduled apsd downstream */
+        WL1251_ACX_PS_SCHEME_UPSD_TRIGGER       = 1,
+        /* a pspoll packet will be sent before every data packet */
+        WL1251_ACX_PS_SCHEME_LEGACY_PSPOLL      = 2,
+        /* scheduled apsd mode */
+        WL1251_ACX_PS_SCHEME_SAPSD              = 3,
+};
+enum wl1251_acx_ack_policy {
+        WL1251_ACX_ACK_POLICY_LEGACY    = 0,
+        WL1251_ACX_ACK_POLICY_NO_ACK    = 1,
+        WL1251_ACX_ACK_POLICY_BLOCK     = 2,
+};
+struct wl1251_acx_tid_cfg {
+        struct acx_header header;
+        /* tx queue id number (0-7) */
+        u8 queue;
+        /* channel access type for the queue, enum wl1251_acx_channel_type */
+        u8 type;
+        /* EDCA: ac index (0-3), HCCA: traffic stream id (8-15) */
+        u8 tsid;
+        /* ps scheme of the specified queue, enum wl1251_acx_ps_scheme */
+        u8 ps_scheme;
+        /* the tx queue ack policy, enum wl1251_acx_ack_policy */
+        u8 ack_policy;
+        u8 padding[3];
+        /* not supported */
+        u32 apsdconf[2];
+} __attribute__ ((packed));
 /*************************************************************************
    Host Interrupt Register (WiLink -> Host)
@@ -1322,5 +1403,11 @@ int wl1251_acx_tsf_info(struct wl1251 *wl, u64 *mactime);
 int wl1251_acx_rate_policies(struct wl1251 *wl);
 int wl1251_acx_mem_cfg(struct wl1251 *wl);
 int wl1251_acx_wr_tbtt_and_dtim(struct wl1251 *wl, u16 tbtt, u8 dtim);
+int wl1251_acx_ac_cfg(struct wl1251 *wl, u8 ac, u8 cw_min, u16 cw_max,
+                      u8 aifs, u16 txop);
+int wl1251_acx_tid_cfg(struct wl1251 *wl, u8 queue,
+                       enum wl1251_acx_channel_type type,
+                       u8 tsid, enum wl1251_acx_ps_scheme ps_scheme,
+                       enum wl1251_acx_ack_policy ack_policy);
 #endif /* __WL1251_ACX_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1251_debugfs.c b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
index a00723059f83..0ccba57fb9fb 100644
--- a/drivers/net/wireless/wl12xx/wl1251_debugfs.c
+++ b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
@@ -237,6 +237,27 @@ static const struct file_operations tx_queue_len_ops = {
        .open = wl1251_open_file_generic,
 };
+static ssize_t tx_queue_status_read(struct file *file, char __user *userbuf,
+                                    size_t count, loff_t *ppos)
+{
+        struct wl1251 *wl = file->private_data;
+        char buf[3], status;
+        int len;
+        if (wl->tx_queue_stopped)
+                status = 's';
+        else
+                status = 'r';
+        len = scnprintf(buf, sizeof(buf), "%c\n", status);
+        return simple_read_from_buffer(userbuf, count, ppos, buf, len);
+}
+static const struct file_operations tx_queue_status_ops = {
+        .read = tx_queue_status_read,
+        .open = wl1251_open_file_generic,
+};
 static void wl1251_debugfs_delete_files(struct wl1251 *wl)
 {
        DEBUGFS_FWSTATS_DEL(tx, internal_desc_overflow);
@@ -331,6 +352,7 @@ static void wl1251_debugfs_delete_files(struct wl1251 *wl)
        DEBUGFS_FWSTATS_DEL(rxpipe, tx_xfr_host_int_trig_rx_data);
        DEBUGFS_DEL(tx_queue_len);
+        DEBUGFS_DEL(tx_queue_status);
        DEBUGFS_DEL(retry_count);
        DEBUGFS_DEL(excessive_retries);
 }
@@ -431,6 +453,7 @@ static int wl1251_debugfs_add_files(struct wl1251 *wl)
        DEBUGFS_FWSTATS_ADD(rxpipe, tx_xfr_host_int_trig_rx_data);
        DEBUGFS_ADD(tx_queue_len, wl->debugfs.rootdir);
+        DEBUGFS_ADD(tx_queue_status, wl->debugfs.rootdir);
        DEBUGFS_ADD(retry_count, wl->debugfs.rootdir);
        DEBUGFS_ADD(excessive_retries, wl->debugfs.rootdir);
diff --git a/drivers/net/wireless/wl12xx/wl1251_init.c b/drivers/net/wireless/wl12xx/wl1251_init.c
index 5cb573383eeb..5aad56ea7153 100644
--- a/drivers/net/wireless/wl12xx/wl1251_init.c
+++ b/drivers/net/wireless/wl12xx/wl1251_init.c
@@ -294,6 +294,11 @@ static int wl1251_hw_init_tx_queue_config(struct wl1251 *wl)
                        goto out;
        }
+        wl1251_acx_ac_cfg(wl, AC_BE, CWMIN_BE, CWMAX_BE, AIFS_DIFS, TXOP_BE);
+        wl1251_acx_ac_cfg(wl, AC_BK, CWMIN_BK, CWMAX_BK, AIFS_DIFS, TXOP_BK);
+        wl1251_acx_ac_cfg(wl, AC_VI, CWMIN_VI, CWMAX_VI, AIFS_DIFS, TXOP_VI);
+        wl1251_acx_ac_cfg(wl, AC_VO, CWMIN_VO, CWMAX_VO, AIFS_DIFS, TXOP_VO);
 out:
        kfree(config);
        return ret;
diff --git a/drivers/net/wireless/wl12xx/wl1251_init.h b/drivers/net/wireless/wl12xx/wl1251_init.h
index b3b25ec885ea..269cefb3e7d4 100644
--- a/drivers/net/wireless/wl12xx/wl1251_init.h
+++ b/drivers/net/wireless/wl12xx/wl1251_init.h
@@ -26,6 +26,53 @@
 #include "wl1251.h"
+enum {
+        /* best effort/legacy */
+        AC_BE = 0,
+        /* background */
+        AC_BK = 1,
+        /* video */
+        AC_VI = 2,
+        /* voice */
+        AC_VO = 3,
+        /* broadcast dummy access category */
+        AC_BCAST = 4,
+        NUM_ACCESS_CATEGORIES = 4
+};
+/* following are defult values for the IE fields*/
+#define CWMIN_BK  15
+#define CWMIN_BE  15
+#define CWMIN_VI  7
+#define CWMIN_VO  3
+#define CWMAX_BK  1023
+#define CWMAX_BE  63
+#define CWMAX_VI  15
+#define CWMAX_VO  7
+/* slot number setting to start transmission at PIFS interval */
+#define AIFS_PIFS 1
+/*
+ * slot number setting to start transmission at DIFS interval - normal DCF
+ * access
+ */
+#define AIFS_DIFS 2
+#define AIFSN_BK  7
+#define AIFSN_BE  3
+#define AIFSN_VI  AIFS_PIFS
+#define AIFSN_VO  AIFS_PIFS
+#define TXOP_BK   0
+#define TXOP_BE   0
+#define TXOP_VI   3008
+#define TXOP_VO   1504
 int wl1251_hw_init_hwenc_config(struct wl1251 *wl);
 int wl1251_hw_init_templates_config(struct wl1251 *wl);
 int wl1251_hw_init_rx_config(struct wl1251 *wl, u32 config, u32 filter);
diff --git a/drivers/net/wireless/wl12xx/wl1251_main.c b/drivers/net/wireless/wl12xx/wl1251_main.c
index 2f50a256efa5..4e373f3dbc43 100644
--- a/drivers/net/wireless/wl12xx/wl1251_main.c
+++ b/drivers/net/wireless/wl12xx/wl1251_main.c
@@ -395,6 +395,7 @@ static int wl1251_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         * the queue here, otherwise the queue will get too long.
         */
        if (skb_queue_len(&wl->tx_queue) >= WL1251_TX_QUEUE_MAX_LENGTH) {
+                wl1251_debug(DEBUG_TX, "op_tx: tx_queue full, stop queues");
                ieee80211_stop_queues(wl->hw);
                /*
@@ -510,13 +511,13 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
 }
 static int wl1251_op_add_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_if_init_conf *conf)
+                                   struct ieee80211_vif *vif)
 {
        struct wl1251 *wl = hw->priv;
        int ret = 0;
        wl1251_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
-                     conf->type, conf->mac_addr);
+                     vif->type, vif->addr);
        mutex_lock(&wl->mutex);
        if (wl->vif) {
@@ -524,9 +525,9 @@ static int wl1251_op_add_interface(struct ieee80211_hw *hw,
                goto out;
        }
-        wl->vif = conf->vif;
+        wl->vif = vif;
-        switch (conf->type) {
+        switch (vif->type) {
        case NL80211_IFTYPE_STATION:
                wl->bss_type = BSS_TYPE_STA_BSS;
                break;
@@ -538,8 +539,8 @@ static int wl1251_op_add_interface(struct ieee80211_hw *hw,
                goto out;
        }
-        if (memcmp(wl->mac_addr, conf->mac_addr, ETH_ALEN)) {
+        if (memcmp(wl->mac_addr, vif->addr, ETH_ALEN)) {
-                memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
+                memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
                SET_IEEE80211_PERM_ADDR(wl->hw, wl->mac_addr);
                ret = wl1251_acx_station_id(wl);
                if (ret < 0)
@@ -552,7 +553,7 @@ out:
 }
 static void wl1251_op_remove_interface(struct ieee80211_hw *hw,
-                                         struct ieee80211_if_init_conf *conf)
+                                         struct ieee80211_vif *vif)
 {
        struct wl1251 *wl = hw->priv;
@@ -640,20 +641,25 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                 * through the bss_info_changed() hook.
                 */
                ret = wl1251_ps_set_mode(wl, STATION_POWER_SAVE_MODE);
+                if (ret < 0)
+                        goto out_sleep;
        } else if (!(conf->flags & IEEE80211_CONF_PS) &&
                   wl->psm_requested) {
                wl1251_debug(DEBUG_PSM, "psm disabled");
                wl->psm_requested = false;
-                if (wl->psm)
+                if (wl->psm) {
                        ret = wl1251_ps_set_mode(wl, STATION_ACTIVE_MODE);
+                        if (ret < 0)
+                                goto out_sleep;
+                }
        }
        if (conf->power_level != wl->power_level) {
                ret = wl1251_acx_tx_power(wl, conf->power_level);
                if (ret < 0)
-                        goto out;
+                        goto out_sleep;
                wl->power_level = conf->power_level;
        }
@@ -1273,6 +1279,43 @@ static struct ieee80211_channel wl1251_channels[] = {
        { .hw_value = 13, .center_freq = 2472},
 };
+static int wl1251_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
+                             const struct ieee80211_tx_queue_params *params)
+{
+        struct wl1251 *wl = hw->priv;
+        int ret;
+        mutex_lock(&wl->mutex);
+        wl1251_debug(DEBUG_MAC80211, "mac80211 conf tx %d", queue);
+        ret = wl1251_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+        ret = wl1251_acx_ac_cfg(wl, wl1251_tx_get_queue(queue),
+                                params->cw_min, params->cw_max,
+                                params->aifs, params->txop);
+        if (ret < 0)
+                goto out_sleep;
+        ret = wl1251_acx_tid_cfg(wl, wl1251_tx_get_queue(queue),
+                                 CHANNEL_TYPE_EDCF,
+                                 wl1251_tx_get_queue(queue),
+                                 WL1251_ACX_PS_SCHEME_LEGACY,
+                                 WL1251_ACX_ACK_POLICY_LEGACY);
+        if (ret < 0)
+                goto out_sleep;
+out_sleep:
+        wl1251_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+        return ret;
+}
 /* can't be const, mac80211 writes to this */
 static struct ieee80211_supported_band wl1251_band_2ghz = {
        .channels = wl1251_channels,
@@ -1293,6 +1336,7 @@ static const struct ieee80211_ops wl1251_ops = {
        .hw_scan = wl1251_op_hw_scan,
        .bss_info_changed = wl1251_op_bss_info_changed,
        .set_rts_threshold = wl1251_op_set_rts_threshold,
+        .conf_tx = wl1251_op_conf_tx,
 };
 static int wl1251_register_hw(struct wl1251 *wl)
@@ -1338,6 +1382,8 @@ int wl1251_init_ieee80211(struct wl1251 *wl)
        wl->hw->wiphy->max_scan_ssids = 1;
        wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wl1251_band_2ghz;
+        wl->hw->queues = 4;
        ret = wl1251_register_hw(wl);
        if (ret)
                goto out;
diff --git a/drivers/net/wireless/wl12xx/wl1251_ps.c b/drivers/net/wireless/wl12xx/wl1251_ps.c
index 9931b197ff77..851dfb65e474 100644
--- a/drivers/net/wireless/wl12xx/wl1251_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1251_ps.c
@@ -26,7 +26,8 @@
 #include "wl1251_cmd.h"
 #include "wl1251_io.h"
-#define WL1251_WAKEUP_TIMEOUT 2000
+/* in ms */
+#define WL1251_WAKEUP_TIMEOUT 100
 void wl1251_elp_work(struct work_struct *work)
 {
@@ -67,7 +68,7 @@ void wl1251_ps_elp_sleep(struct wl1251 *wl)
 int wl1251_ps_elp_wakeup(struct wl1251 *wl)
 {
-        unsigned long timeout;
+        unsigned long timeout, start;
        u32 elp_reg;
        if (!wl->elp)
@@ -75,6 +76,7 @@ int wl1251_ps_elp_wakeup(struct wl1251 *wl)
        wl1251_debug(DEBUG_PSM, "waking up chip from elp");
+        start = jiffies;
        timeout = jiffies + msecs_to_jiffies(WL1251_WAKEUP_TIMEOUT);
        wl1251_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
@@ -95,8 +97,7 @@ int wl1251_ps_elp_wakeup(struct wl1251 *wl)
        }
        wl1251_debug(DEBUG_PSM, "wakeup time: %u ms",
-                     jiffies_to_msecs(jiffies) -
+                     jiffies_to_msecs(jiffies - start));
-                     (jiffies_to_msecs(timeout) - WL1251_WAKEUP_TIMEOUT));
        wl->elp = false;
diff --git a/drivers/net/wireless/wl12xx/wl1251_rx.c b/drivers/net/wireless/wl12xx/wl1251_rx.c
index f84cc89cbffc..b56732226cc0 100644
--- a/drivers/net/wireless/wl12xx/wl1251_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_rx.c
@@ -126,7 +126,7 @@ static void wl1251_rx_body(struct wl1251 *wl,
        if (wl->rx_current_buffer)
                rx_packet_ring_addr += wl->data_path->rx_packet_ring_chunk_size;
-        skb = dev_alloc_skb(length);
+        skb = __dev_alloc_skb(length, GFP_KERNEL);
        if (!skb) {
                wl1251_error("Couldn't allocate RX frame");
                return;
diff --git a/drivers/net/wireless/wl12xx/wl1251_tx.c b/drivers/net/wireless/wl12xx/wl1251_tx.c
index f85970615849..c8223185efd2 100644
--- a/drivers/net/wireless/wl12xx/wl1251_tx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_tx.c
@@ -167,8 +167,7 @@ static int wl1251_tx_fill_hdr(struct wl1251 *wl, struct sk_buff *skb,
        tx_hdr->expiry_time = cpu_to_le32(1 << 16);
        tx_hdr->id = id;
-        /* FIXME: how to get the correct queue id? */
+        tx_hdr->xmit_queue = wl1251_tx_get_queue(skb_get_queue_mapping(skb));
-        tx_hdr->xmit_queue = 0;
        wl1251_tx_control(tx_hdr, control, fc);
        wl1251_tx_frag_block_num(tx_hdr);
@@ -220,6 +219,7 @@ static int wl1251_tx_send_packet(struct wl1251 *wl, struct sk_buff *skb,
                        /* align the buffer on a 4-byte boundary */
                        skb_reserve(skb, offset);
                        memmove(skb->data, src, skb->len);
+                        tx_hdr = (struct tx_double_buffer_desc *) skb->data;
                } else {
                        wl1251_info("No handler, fixme!");
                        return -EINVAL;
@@ -237,8 +237,9 @@ static int wl1251_tx_send_packet(struct wl1251 *wl, struct sk_buff *skb,
        wl1251_mem_write(wl, addr, skb->data, len);
-        wl1251_debug(DEBUG_TX, "tx id %u skb 0x%p payload %u rate 0x%x",
+        wl1251_debug(DEBUG_TX, "tx id %u skb 0x%p payload %u rate 0x%x "
-                     tx_hdr->id, skb, tx_hdr->length, tx_hdr->rate);
+                     "queue %d", tx_hdr->id, skb, tx_hdr->length,
+                     tx_hdr->rate, tx_hdr->xmit_queue);
        return 0;
 }
diff --git a/drivers/net/wireless/wl12xx/wl1251_tx.h b/drivers/net/wireless/wl12xx/wl1251_tx.h
index 7c1c1665c810..55856c6bb97a 100644
--- a/drivers/net/wireless/wl12xx/wl1251_tx.h
+++ b/drivers/net/wireless/wl12xx/wl1251_tx.h
@@ -26,6 +26,7 @@
 #define __WL1251_TX_H__
 #include <linux/bitops.h>
+#include "wl1251_acx.h"
 /*
 *
@@ -209,6 +210,22 @@ struct tx_result {
        u8 done_2;
 } __attribute__ ((packed));
+static inline int wl1251_tx_get_queue(int queue)
+{
+        switch (queue) {
+        case 0:
+                return QOS_AC_VO;
+        case 1:
+                return QOS_AC_VI;
+        case 2:
+                return QOS_AC_BE;
+        case 3:
+                return QOS_AC_BK;
+        default:
+                return QOS_AC_BE;
+        }
+}
 void wl1251_tx_work(struct work_struct *work);
 void wl1251_tx_complete(struct wl1251 *wl);
 void wl1251_tx_flush(struct wl1251 *wl);
diff --git a/drivers/net/wireless/wl12xx/wl1271.h b/drivers/net/wireless/wl12xx/wl1271.h
index 94359b1a861f..d0938db043b3 100644
--- a/drivers/net/wireless/wl12xx/wl1271.h
+++ b/drivers/net/wireless/wl12xx/wl1271.h
@@ -107,10 +107,9 @@ enum {
                                  CFG_RX_CTL_EN | CFG_RX_BCN_EN |     \
                                  CFG_RX_AUTH_EN | CFG_RX_ASSOC_EN)
-#define WL1271_DEFAULT_BASIC_RATE_SET (CONF_TX_RATE_MASK_ALL)
 #define WL1271_FW_NAME "wl1271-fw.bin"
 #define WL1271_NVS_NAME "wl1271-nvs.bin"
+#define WL1271_NVS_LEN  468
 /*
 * Enable/disable 802.11a support for WL1273
@@ -276,6 +275,7 @@ struct wl1271_debugfs {
        struct dentry *retry_count;
        struct dentry *excessive_retries;
+        struct dentry *gpio_power;
 };
 #define NUM_TX_QUEUES              4
@@ -322,6 +322,17 @@ struct wl1271 {
        enum wl1271_state state;
        struct mutex mutex;
+#define WL1271_FLAG_STA_RATES_CHANGED  (0)
+#define WL1271_FLAG_STA_ASSOCIATED     (1)
+#define WL1271_FLAG_JOINED             (2)
+#define WL1271_FLAG_GPIO_POWER         (3)
+#define WL1271_FLAG_TX_QUEUE_STOPPED   (4)
+#define WL1271_FLAG_SCANNING           (5)
+#define WL1271_FLAG_IN_ELP             (6)
+#define WL1271_FLAG_PSM                (7)
+#define WL1271_FLAG_PSM_REQUESTED      (8)
+        unsigned long flags;
        struct wl1271_partition_set part;
        struct wl1271_chip chip;
@@ -359,7 +370,6 @@ struct wl1271 {
        /* Frames scheduled for transmission, not handled yet */
        struct sk_buff_head tx_queue;
-        bool tx_queue_stopped;
        struct work_struct tx_work;
@@ -387,14 +397,15 @@ struct wl1271 {
        u32 mbox_ptr[2];
        /* Are we currently scanning */
-        bool scanning;
        struct wl1271_scan scan;
        /* Our association ID */
        u16 aid;
        /* currently configured rate set */
+        u32 sta_rate_set;
        u32 basic_rate_set;
+        u32 rate_set;
        /* The current band */
        enum ieee80211_band band;
@@ -405,18 +416,9 @@ struct wl1271 {
        unsigned int rx_config;
        unsigned int rx_filter;
-        /* is firmware in elp mode */
-        bool elp;
        struct completion *elp_compl;
        struct delayed_work elp_work;
-        /* we can be in psm, but not in elp, we have to differentiate */
-        bool psm;
-        /* PSM mode requested */
-        bool psm_requested;
        /* retry counter for PSM entries */
        u8 psm_entry_retry;
@@ -435,9 +437,6 @@ struct wl1271 {
        struct ieee80211_vif *vif;
-        /* Used for a workaround to send disconnect before rejoining */
-        bool joined;
        /* Current chipset configuration */
        struct conf_drv_settings conf;
@@ -455,7 +454,9 @@ int wl1271_plt_stop(struct wl1271 *wl);
 #define WL1271_TX_QUEUE_MAX_LENGTH 20
-/* WL1271 needs a 200ms sleep after power on */
+/* WL1271 needs a 200ms sleep after power on, and a 20ms sleep before power
+   on in case is has been shut down shortly before */
+#define WL1271_PRE_POWER_ON_SLEEP 20 /* in miliseconds */
 #define WL1271_POWER_ON_SLEEP 200 /* in miliseconds */
 static inline bool wl1271_11a_enabled(void)
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.c b/drivers/net/wireless/wl12xx/wl1271_acx.c
index 5cc89bbdac7a..0b3434843476 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.c
@@ -390,6 +390,35 @@ out:
        return ret;
 }
+int wl1271_acx_dco_itrim_params(struct wl1271 *wl)
+{
+        struct acx_dco_itrim_params *dco;
+        struct conf_itrim_settings *c = &wl->conf.itrim;
+        int ret;
+        wl1271_debug(DEBUG_ACX, "acx dco itrim parameters");
+        dco = kzalloc(sizeof(*dco), GFP_KERNEL);
+        if (!dco) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        dco->enable = c->enable;
+        dco->timeout = cpu_to_le32(c->timeout);
+        ret = wl1271_cmd_configure(wl, ACX_SET_DCO_ITRIM_PARAMS,
+                                   dco, sizeof(*dco));
+        if (ret < 0) {
+                wl1271_warning("failed to set dco itrim parameters: %d", ret);
+                goto out;
+        }
+out:
+        kfree(dco);
+        return ret;
+}
 int wl1271_acx_beacon_filter_opt(struct wl1271 *wl, bool enable_filter)
 {
        struct acx_beacon_filter_option *beacon_filter = NULL;
@@ -758,10 +787,11 @@ int wl1271_acx_statistics(struct wl1271 *wl, struct acx_statistics *stats)
        return 0;
 }
-int wl1271_acx_rate_policies(struct wl1271 *wl, u32 enabled_rates)
+int wl1271_acx_rate_policies(struct wl1271 *wl)
 {
        struct acx_rate_policy *acx;
        struct conf_tx_rate_class *c = &wl->conf.tx.rc_conf;
+        int idx = 0;
        int ret = 0;
        wl1271_debug(DEBUG_ACX, "acx rate policies");
@@ -773,12 +803,21 @@ int wl1271_acx_rate_policies(struct wl1271 *wl, u32 enabled_rates)
                goto out;
        }
-        /* configure one default (one-size-fits-all) rate class */
+        /* configure one basic rate class */
-        acx->rate_class_cnt = cpu_to_le32(1);
+        idx = ACX_TX_BASIC_RATE;
-        acx->rate_class[0].enabled_rates = cpu_to_le32(enabled_rates);
+        acx->rate_class[idx].enabled_rates = cpu_to_le32(wl->basic_rate_set);
-        acx->rate_class[0].short_retry_limit = c->short_retry_limit;
+        acx->rate_class[idx].short_retry_limit = c->short_retry_limit;
-        acx->rate_class[0].long_retry_limit = c->long_retry_limit;
+        acx->rate_class[idx].long_retry_limit = c->long_retry_limit;
-        acx->rate_class[0].aflags = c->aflags;
+        acx->rate_class[idx].aflags = c->aflags;
+        /* configure one AP supported rate class */
+        idx = ACX_TX_AP_FULL_RATE;
+        acx->rate_class[idx].enabled_rates = cpu_to_le32(wl->rate_set);
+        acx->rate_class[idx].short_retry_limit = c->short_retry_limit;
+        acx->rate_class[idx].long_retry_limit = c->long_retry_limit;
+        acx->rate_class[idx].aflags = c->aflags;
+        acx->rate_class_cnt = cpu_to_le32(ACX_TX_RATE_POLICY_CNT);
        ret = wl1271_cmd_configure(wl, ACX_RATE_POLICY, acx, sizeof(*acx));
        if (ret < 0) {
@@ -1012,59 +1051,6 @@ out:
        return ret;
 }
-int wl1271_acx_smart_reflex(struct wl1271 *wl)
-{
-        struct acx_smart_reflex_state *sr_state = NULL;
-        struct acx_smart_reflex_config_params *sr_param = NULL;
-        int i, ret;
-        wl1271_debug(DEBUG_ACX, "acx smart reflex");
-        sr_param = kzalloc(sizeof(*sr_param), GFP_KERNEL);
-        if (!sr_param) {
-                ret = -ENOMEM;
-                goto out;
-        }
-        for (i = 0; i < CONF_SR_ERR_TBL_COUNT; i++) {
-                struct conf_mart_reflex_err_table *e =
-                        &(wl->conf.init.sr_err_tbl[i]);
-                sr_param->error_table[i].len = e->len;
-                sr_param->error_table[i].upper_limit = e->upper_limit;
-                memcpy(sr_param->error_table[i].values, e->values, e->len);
-        }
-        ret = wl1271_cmd_configure(wl, ACX_SET_SMART_REFLEX_PARAMS,
-                                   sr_param, sizeof(*sr_param));
-        if (ret < 0) {
-                wl1271_warning("failed to set smart reflex params: %d", ret);
-                goto out;
-        }
-        sr_state = kzalloc(sizeof(*sr_state), GFP_KERNEL);
-        if (!sr_state) {
-                ret = -ENOMEM;
-                goto out;
-        }
-        /* enable smart reflex */
-        sr_state->enable = wl->conf.init.sr_enable;
-        ret = wl1271_cmd_configure(wl, ACX_SET_SMART_REFLEX_STATE,
-                                   sr_state, sizeof(*sr_state));
-        if (ret < 0) {
-                wl1271_warning("failed to set smart reflex params: %d", ret);
-                goto out;
-        }
-out:
-        kfree(sr_state);
-        kfree(sr_param);
-        return ret;
-}
 int wl1271_acx_bet_enable(struct wl1271 *wl, bool enable)
 {
        struct wl1271_acx_bet_enable *acx = NULL;
@@ -1132,3 +1118,31 @@ out:
        kfree(acx);
        return ret;
 }
+int wl1271_acx_pm_config(struct wl1271 *wl)
+{
+        struct wl1271_acx_pm_config *acx = NULL;
+        struct  conf_pm_config_settings *c = &wl->conf.pm_config;
+        int ret = 0;
+        wl1271_debug(DEBUG_ACX, "acx pm config");
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        acx->host_clk_settling_time = cpu_to_le32(c->host_clk_settling_time);
+        acx->host_fast_wakeup_support = c->host_fast_wakeup_support;
+        ret = wl1271_cmd_configure(wl, ACX_PM_CONFIG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx pm config failed: %d", ret);
+                goto out;
+        }
+out:
+        kfree(acx);
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.h b/drivers/net/wireless/wl12xx/wl1271_acx.h
index 2ce0a8128542..1bb63af64f0e 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.h
@@ -415,23 +415,12 @@ struct acx_bt_wlan_coex {
        u8 pad[3];
 } __attribute__ ((packed));
-struct acx_smart_reflex_state {
+struct acx_dco_itrim_params {
        struct acx_header header;
        u8 enable;
        u8 padding[3];
-} __attribute__ ((packed));
+        __le32 timeout;
-struct smart_reflex_err_table {
-        u8 len;
-        s8 upper_limit;
-        s8 values[14];
-} __attribute__ ((packed));
-struct acx_smart_reflex_config_params {
-        struct acx_header header;
-        struct smart_reflex_err_table error_table[3];
 } __attribute__ ((packed));
 #define PTA_ANTENNA_TYPE_DEF              (0)
@@ -837,6 +826,9 @@ struct acx_rate_class {
        u8 reserved;
 };
+#define ACX_TX_BASIC_RATE      0
+#define ACX_TX_AP_FULL_RATE    1
+#define ACX_TX_RATE_POLICY_CNT 2
 struct acx_rate_policy {
        struct acx_header header;
@@ -877,8 +869,8 @@ struct acx_tx_config_options {
        __le16 tx_compl_threshold;   /* number of packets */
 } __attribute__ ((packed));
-#define ACX_RX_MEM_BLOCKS     64
+#define ACX_RX_MEM_BLOCKS     70
-#define ACX_TX_MIN_MEM_BLOCKS 64
+#define ACX_TX_MIN_MEM_BLOCKS 40
 #define ACX_TX_DESCRIPTORS    32
 #define ACX_NUM_SSID_PROFILES 1
@@ -969,6 +961,13 @@ struct wl1271_acx_arp_filter {
                               used. */
 } __attribute__((packed));
+struct wl1271_acx_pm_config {
+        struct acx_header header;
+        __le32 host_clk_settling_time;
+        u8 host_fast_wakeup_support;
+        u8 padding[3];
+} __attribute__ ((packed));
 enum {
        ACX_WAKE_UP_CONDITIONS      = 0x0002,
@@ -1027,13 +1026,13 @@ enum {
        ACX_HT_BSS_OPERATION        = 0x0058,
        ACX_COEX_ACTIVITY           = 0x0059,
        ACX_SET_SMART_REFLEX_DEBUG  = 0x005A,
-        ACX_SET_SMART_REFLEX_STATE  = 0x005B,
+        ACX_SET_DCO_ITRIM_PARAMS    = 0x0061,
-        ACX_SET_SMART_REFLEX_PARAMS = 0x005F,
        DOT11_RX_MSDU_LIFE_TIME     = 0x1004,
        DOT11_CUR_TX_PWR            = 0x100D,
        DOT11_RX_DOT11_MODE         = 0x1012,
        DOT11_RTS_THRESHOLD         = 0x1013,
        DOT11_GROUP_ADDRESS_TBL     = 0x1014,
+        ACX_PM_CONFIG               = 0x1016,
        MAX_DOT11_IE = DOT11_GROUP_ADDRESS_TBL,
@@ -1056,6 +1055,7 @@ int wl1271_acx_group_address_tbl(struct wl1271 *wl, bool enable,
                                 void *mc_list, u32 mc_list_len);
 int wl1271_acx_service_period_timeout(struct wl1271 *wl);
 int wl1271_acx_rts_threshold(struct wl1271 *wl, u16 rts_threshold);
+int wl1271_acx_dco_itrim_params(struct wl1271 *wl);
 int wl1271_acx_beacon_filter_opt(struct wl1271 *wl, bool enable_filter);
 int wl1271_acx_beacon_filter_table(struct wl1271 *wl);
 int wl1271_acx_conn_monit_params(struct wl1271 *wl);
@@ -1069,7 +1069,7 @@ int wl1271_acx_set_preamble(struct wl1271 *wl, enum acx_preamble_type preamble);
 int wl1271_acx_cts_protect(struct wl1271 *wl,
                           enum acx_ctsprotect_type ctsprotect);
 int wl1271_acx_statistics(struct wl1271 *wl, struct acx_statistics *stats);
-int wl1271_acx_rate_policies(struct wl1271 *wl, u32 enabled_rates);
+int wl1271_acx_rate_policies(struct wl1271 *wl);
 int wl1271_acx_ac_cfg(struct wl1271 *wl);
 int wl1271_acx_tid_cfg(struct wl1271 *wl);
 int wl1271_acx_frag_threshold(struct wl1271 *wl);
@@ -1081,5 +1081,6 @@ int wl1271_acx_smart_reflex(struct wl1271 *wl);
 int wl1271_acx_bet_enable(struct wl1271 *wl, bool enable);
 int wl1271_acx_arp_ip_filter(struct wl1271 *wl, bool enable, u8 *address,
                             u8 version);
+int wl1271_acx_pm_config(struct wl1271 *wl);
 #endif /* __WL1271_ACX_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.c b/drivers/net/wireless/wl12xx/wl1271_boot.c
index b7c96454cca3..e803b876f3f0 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.c
@@ -225,9 +225,15 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
        if (nvs == NULL)
                return -ENODEV;
+        if (wl->nvs_len < WL1271_NVS_LEN)
+                return -EINVAL;
        nvs_ptr = nvs;
-        nvs_len = wl->nvs_len;
+        /* only the first part of the NVS needs to be uploaded */
+        nvs_len = WL1271_NVS_LEN;
+        /* FIXME: read init settings from the remaining part of the NVS */
        /* Update the device MAC address into the nvs */
        nvs[11] = wl->mac_addr[0];
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.c b/drivers/net/wireless/wl12xx/wl1271_cmd.c
index c3385b3d246c..a74259bb596b 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.c
@@ -209,6 +209,26 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
        gen_parms->tx_bip_fem_manufacturer = g->tx_bip_fem_manufacturer;
        gen_parms->settings = g->settings;
+        gen_parms->sr_state = g->sr_state;
+        memcpy(gen_parms->srf1,
+               g->srf1,
+               CONF_MAX_SMART_REFLEX_PARAMS);
+        memcpy(gen_parms->srf2,
+               g->srf2,
+               CONF_MAX_SMART_REFLEX_PARAMS);
+        memcpy(gen_parms->srf3,
+               g->srf3,
+               CONF_MAX_SMART_REFLEX_PARAMS);
+        memcpy(gen_parms->sr_debug_table,
+               g->sr_debug_table,
+               CONF_MAX_SMART_REFLEX_PARAMS);
+        gen_parms->sr_sen_n_p = g->sr_sen_n_p;
+        gen_parms->sr_sen_n_p_gain = g->sr_sen_n_p_gain;
+        gen_parms->sr_sen_nrn = g->sr_sen_nrn;
+        gen_parms->sr_sen_prn = g->sr_sen_prn;
        ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), 0);
        if (ret < 0)
                wl1271_warning("CMD_INI_FILE_GENERAL_PARAM failed");
@@ -253,6 +273,8 @@ int wl1271_cmd_radio_parms(struct wl1271 *wl)
               CONF_NUMBER_OF_RATE_GROUPS);
        memcpy(radio_parms->tx_rate_limits_degraded, r->tx_rate_limits_degraded,
               CONF_NUMBER_OF_RATE_GROUPS);
+        memcpy(radio_parms->tx_rate_limits_extreme, r->tx_rate_limits_extreme,
+               CONF_NUMBER_OF_RATE_GROUPS);
        memcpy(radio_parms->tx_channel_limits_11b, r->tx_channel_limits_11b,
               CONF_NUMBER_OF_CHANNELS_2_4);
@@ -263,6 +285,11 @@ int wl1271_cmd_radio_parms(struct wl1271 *wl)
        memcpy(radio_parms->tx_ibias, r->tx_ibias, CONF_NUMBER_OF_RATE_GROUPS);
        radio_parms->rx_fem_insertion_loss = r->rx_fem_insertion_loss;
+        radio_parms->degraded_low_to_normal_threshold =
+                r->degraded_low_to_normal_threshold;
+        radio_parms->degraded_normal_to_high_threshold =
+                r->degraded_normal_to_high_threshold;
        for (i = 0; i < CONF_NUMBER_OF_SUB_BANDS_5; i++)
                radio_parms->tx_ref_pd_voltage_5[i] =
@@ -275,6 +302,8 @@ int wl1271_cmd_radio_parms(struct wl1271 *wl)
               r->tx_rate_limits_normal_5, CONF_NUMBER_OF_RATE_GROUPS);
        memcpy(radio_parms->tx_rate_limits_degraded_5,
               r->tx_rate_limits_degraded_5, CONF_NUMBER_OF_RATE_GROUPS);
+        memcpy(radio_parms->tx_rate_limits_extreme_5,
+               r->tx_rate_limits_extreme_5, CONF_NUMBER_OF_RATE_GROUPS);
        memcpy(radio_parms->tx_channel_limits_ofdm_5,
               r->tx_channel_limits_ofdm_5, CONF_NUMBER_OF_CHANNELS_5);
        memcpy(radio_parms->tx_pdv_rate_offsets_5, r->tx_pdv_rate_offsets_5,
@@ -283,6 +312,10 @@ int wl1271_cmd_radio_parms(struct wl1271 *wl)
               CONF_NUMBER_OF_RATE_GROUPS);
        memcpy(radio_parms->rx_fem_insertion_loss_5,
               r->rx_fem_insertion_loss_5, CONF_NUMBER_OF_SUB_BANDS_5);
+        radio_parms->degraded_low_to_normal_threshold_5 =
+                r->degraded_low_to_normal_threshold_5;
+        radio_parms->degraded_normal_to_high_threshold_5 =
+                r->degraded_normal_to_high_threshold_5;
        wl1271_dump(DEBUG_CMD, "TEST_CMD_INI_FILE_RADIO_PARAM: ",
                    radio_parms, sizeof(*radio_parms));
@@ -311,19 +344,6 @@ int wl1271_cmd_join(struct wl1271 *wl)
                        do_cal = false;
        }
-        /* FIXME: This is a workaround, because with the current stack, we
-         * cannot know when we have disassociated.  So, if we have already
-         * joined, we disconnect before joining again. */
-        if (wl->joined) {
-                ret = wl1271_cmd_disconnect(wl);
-                if (ret < 0) {
-                        wl1271_error("failed to disconnect before rejoining");
-                        goto out;
-                }
-                wl->joined = false;
-        }
        join = kzalloc(sizeof(*join), GFP_KERNEL);
        if (!join) {
                ret = -ENOMEM;
@@ -388,8 +408,6 @@ int wl1271_cmd_join(struct wl1271 *wl)
                goto out_free;
        }
-        wl->joined = true;
        /*
         * ugly hack: we should wait for JOIN_EVENT_COMPLETE_ID but to
         * simplify locking we just sleep instead, for now
@@ -487,7 +505,7 @@ int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len)
        return 0;
 }
-int wl1271_cmd_data_path(struct wl1271 *wl, u8 channel, bool enable)
+int wl1271_cmd_data_path(struct wl1271 *wl, bool enable)
 {
        struct cmd_enabledisable_path *cmd;
        int ret;
@@ -501,7 +519,8 @@ int wl1271_cmd_data_path(struct wl1271 *wl, u8 channel, bool enable)
                goto out;
        }
-        cmd->channel = channel;
+        /* the channel here is only used for calibration, so hardcoded to 1 */
+        cmd->channel = 1;
        if (enable) {
                cmd_rx = CMD_ENABLE_RX;
@@ -514,22 +533,22 @@ int wl1271_cmd_data_path(struct wl1271 *wl, u8 channel, bool enable)
        ret = wl1271_cmd_send(wl, cmd_rx, cmd, sizeof(*cmd), 0);
        if (ret < 0) {
                wl1271_error("rx %s cmd for channel %d failed",
-                             enable ? "start" : "stop", channel);
+                             enable ? "start" : "stop", cmd->channel);
                goto out;
        }
        wl1271_debug(DEBUG_BOOT, "rx %s cmd channel %d",
-                     enable ? "start" : "stop", channel);
+                     enable ? "start" : "stop", cmd->channel);
        ret = wl1271_cmd_send(wl, cmd_tx, cmd, sizeof(*cmd), 0);
        if (ret < 0) {
                wl1271_error("tx %s cmd for channel %d failed",
-                             enable ? "start" : "stop", channel);
+                             enable ? "start" : "stop", cmd->channel);
                return ret;
        }
        wl1271_debug(DEBUG_BOOT, "tx %s cmd channel %d",
-                     enable ? "start" : "stop", channel);
+                     enable ? "start" : "stop", cmd->channel);
 out:
        kfree(cmd);
@@ -636,7 +655,7 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
        channels = wl->hw->wiphy->bands[ieee_band]->channels;
        n_ch = wl->hw->wiphy->bands[ieee_band]->n_channels;
-        if (wl->scanning)
+        if (test_bit(WL1271_FLAG_SCANNING, &wl->flags))
                return -EINVAL;
        params = kzalloc(sizeof(*params), GFP_KERNEL);
@@ -711,7 +730,7 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
        wl1271_dump(DEBUG_SCAN, "SCAN: ", params, sizeof(*params));
-        wl->scanning = true;
+        set_bit(WL1271_FLAG_SCANNING, &wl->flags);
        if (wl1271_11a_enabled()) {
                wl->scan.state = band;
                if (band == WL1271_SCAN_BAND_DUAL) {
@@ -729,7 +748,7 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
        ret = wl1271_cmd_send(wl, CMD_SCAN, params, sizeof(*params), 0);
        if (ret < 0) {
                wl1271_error("SCAN failed");
-                wl->scanning = false;
+                clear_bit(WL1271_FLAG_SCANNING, &wl->flags);
                goto out;
        }
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.h b/drivers/net/wireless/wl12xx/wl1271_cmd.h
index b4fa4acb9229..09fe91297acf 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.h
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.h
@@ -37,7 +37,7 @@ int wl1271_cmd_join(struct wl1271 *wl);
 int wl1271_cmd_test(struct wl1271 *wl, void *buf, size_t buf_len, u8 answer);
 int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len);
 int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len);
-int wl1271_cmd_data_path(struct wl1271 *wl, u8 channel, bool enable);
+int wl1271_cmd_data_path(struct wl1271 *wl, bool enable);
 int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode);
 int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
                           size_t len);
@@ -437,6 +437,21 @@ struct wl1271_general_parms_cmd {
        u8 tx_bip_fem_autodetect;
        u8 tx_bip_fem_manufacturer;
        u8 settings;
+        u8 sr_state;
+        s8 srf1[CONF_MAX_SMART_REFLEX_PARAMS];
+        s8 srf2[CONF_MAX_SMART_REFLEX_PARAMS];
+        s8 srf3[CONF_MAX_SMART_REFLEX_PARAMS];
+        s8 sr_debug_table[CONF_MAX_SMART_REFLEX_PARAMS];
+        u8 sr_sen_n_p;
+        u8 sr_sen_n_p_gain;
+        u8 sr_sen_nrn;
+        u8 sr_sen_prn;
+        u8 padding[3];
 } __attribute__ ((packed));
 struct wl1271_radio_parms_cmd {
@@ -458,11 +473,12 @@ struct wl1271_radio_parms_cmd {
        /* Dynamic radio parameters */
        /* 2.4GHz */
        __le16 tx_ref_pd_voltage;
-        s8  tx_ref_power;
+        u8  tx_ref_power;
        s8  tx_offset_db;
        s8  tx_rate_limits_normal[CONF_NUMBER_OF_RATE_GROUPS];
        s8  tx_rate_limits_degraded[CONF_NUMBER_OF_RATE_GROUPS];
+        s8  tx_rate_limits_extreme[CONF_NUMBER_OF_RATE_GROUPS];
        s8  tx_channel_limits_11b[CONF_NUMBER_OF_CHANNELS_2_4];
        s8  tx_channel_limits_ofdm[CONF_NUMBER_OF_CHANNELS_2_4];
@@ -471,15 +487,19 @@ struct wl1271_radio_parms_cmd {
        u8  tx_ibias[CONF_NUMBER_OF_RATE_GROUPS];
        u8  rx_fem_insertion_loss;
-        u8 padding2;
+        u8  degraded_low_to_normal_threshold;
+        u8  degraded_normal_to_high_threshold;
+        u8  padding1; /* our own padding, not in ref driver */
        /* 5GHz */
        __le16 tx_ref_pd_voltage_5[CONF_NUMBER_OF_SUB_BANDS_5];
-        s8  tx_ref_power_5[CONF_NUMBER_OF_SUB_BANDS_5];
+        u8  tx_ref_power_5[CONF_NUMBER_OF_SUB_BANDS_5];
        s8  tx_offset_db_5[CONF_NUMBER_OF_SUB_BANDS_5];
        s8  tx_rate_limits_normal_5[CONF_NUMBER_OF_RATE_GROUPS];
        s8  tx_rate_limits_degraded_5[CONF_NUMBER_OF_RATE_GROUPS];
+        s8  tx_rate_limits_extreme_5[CONF_NUMBER_OF_RATE_GROUPS];
        s8  tx_channel_limits_ofdm_5[CONF_NUMBER_OF_CHANNELS_5];
        s8  tx_pdv_rate_offsets_5[CONF_NUMBER_OF_RATE_GROUPS];
@@ -488,7 +508,10 @@ struct wl1271_radio_parms_cmd {
        s8  tx_ibias_5[CONF_NUMBER_OF_RATE_GROUPS];
        s8  rx_fem_insertion_loss_5[CONF_NUMBER_OF_SUB_BANDS_5];
-        u8 padding3[2];
+        u8  degraded_low_to_normal_threshold_5;
+        u8  degraded_normal_to_high_threshold_5;
+        u8 padding2[2];
 } __attribute__ ((packed));
 struct wl1271_cmd_cal_channel_tune {
diff --git a/drivers/net/wireless/wl12xx/wl1271_conf.h b/drivers/net/wireless/wl12xx/wl1271_conf.h
index 565373ede265..1993d63c214e 100644
--- a/drivers/net/wireless/wl12xx/wl1271_conf.h
+++ b/drivers/net/wireless/wl12xx/wl1271_conf.h
@@ -258,7 +258,8 @@ struct conf_rx_settings {
 #define CONF_TX_MAX_RATE_CLASSES       8
 #define CONF_TX_RATE_MASK_UNSPECIFIED  0
-#define CONF_TX_RATE_MASK_ALL          0x1eff
+#define CONF_TX_RATE_MASK_BASIC        (CONF_HW_BIT_RATE_1MBPS | \
+                                        CONF_HW_BIT_RATE_2MBPS)
 #define CONF_TX_RATE_RETRY_LIMIT       10
 struct conf_tx_rate_class {
@@ -722,31 +723,6 @@ struct conf_conn_settings {
        u8 psm_entry_retries;
 };
-#define CONF_SR_ERR_TBL_MAX_VALUES   14
-struct conf_mart_reflex_err_table {
-        /*
-         * Length of the error table values table.
-         *
-         * Range: 0 - CONF_SR_ERR_TBL_MAX_VALUES
-         */
-        u8 len;
-        /*
-         * Smart Reflex error table upper limit.
-         *
-         * Range: s8
-         */
-        s8 upper_limit;
-        /*
-         * Smart Reflex error table values.
-         *
-         * Range: s8
-         */
-        s8 values[CONF_SR_ERR_TBL_MAX_VALUES];
-};
 enum {
        CONF_REF_CLK_19_2_E,
        CONF_REF_CLK_26_E,
@@ -759,6 +735,9 @@ enum single_dual_band_enum {
        CONF_DUAL_BAND
 };
+#define CONF_MAX_SMART_REFLEX_PARAMS 16
 struct conf_general_parms {
        /*
         * RF Reference Clock type / speed
@@ -815,6 +794,20 @@ struct conf_general_parms {
         * Range: Unknown
         */
        u8 settings;
+        /* Smart reflex settings */
+        u8 sr_state;
+        s8 srf1[CONF_MAX_SMART_REFLEX_PARAMS];
+        s8 srf2[CONF_MAX_SMART_REFLEX_PARAMS];
+        s8 srf3[CONF_MAX_SMART_REFLEX_PARAMS];
+        s8 sr_debug_table[CONF_MAX_SMART_REFLEX_PARAMS];
+        u8 sr_sen_n_p;
+        u8 sr_sen_n_p_gain;
+        u8 sr_sen_nrn;
+        u8 sr_sen_prn;
 };
 #define CONF_RSSI_AND_PROCESS_COMPENSATION_SIZE 15
@@ -847,12 +840,13 @@ struct conf_radio_parms {
         *
         * Range: unknown
         */
-        s16 tx_ref_pd_voltage;
+        u16 tx_ref_pd_voltage;
-        s8  tx_ref_power;
+        u8  tx_ref_power;
        s8  tx_offset_db;
        s8  tx_rate_limits_normal[CONF_NUMBER_OF_RATE_GROUPS];
        s8  tx_rate_limits_degraded[CONF_NUMBER_OF_RATE_GROUPS];
+        s8  tx_rate_limits_extreme[CONF_NUMBER_OF_RATE_GROUPS];
        s8  tx_channel_limits_11b[CONF_NUMBER_OF_CHANNELS_2_4];
        s8  tx_channel_limits_ofdm[CONF_NUMBER_OF_CHANNELS_2_4];
@@ -861,17 +855,22 @@ struct conf_radio_parms {
        u8  tx_ibias[CONF_NUMBER_OF_RATE_GROUPS];
        u8  rx_fem_insertion_loss;
+        u8  degraded_low_to_normal_threshold;
+        u8  degraded_normal_to_high_threshold;
        /*
         * Dynamic radio parameters for 5GHz
         *
         * Range: unknown
         */
-        s16 tx_ref_pd_voltage_5[CONF_NUMBER_OF_SUB_BANDS_5];
+        u16 tx_ref_pd_voltage_5[CONF_NUMBER_OF_SUB_BANDS_5];
-        s8  tx_ref_power_5[CONF_NUMBER_OF_SUB_BANDS_5];
+        u8  tx_ref_power_5[CONF_NUMBER_OF_SUB_BANDS_5];
        s8  tx_offset_db_5[CONF_NUMBER_OF_SUB_BANDS_5];
        s8  tx_rate_limits_normal_5[CONF_NUMBER_OF_RATE_GROUPS];
        s8  tx_rate_limits_degraded_5[CONF_NUMBER_OF_RATE_GROUPS];
+        s8  tx_rate_limits_extreme_5[CONF_NUMBER_OF_RATE_GROUPS];
        s8  tx_channel_limits_ofdm_5[CONF_NUMBER_OF_CHANNELS_5];
        s8  tx_pdv_rate_offsets_5[CONF_NUMBER_OF_RATE_GROUPS];
@@ -879,33 +878,46 @@ struct conf_radio_parms {
        /* FIXME: this is inconsistent with the types for 2.4GHz */
        s8  tx_ibias_5[CONF_NUMBER_OF_RATE_GROUPS];
        s8  rx_fem_insertion_loss_5[CONF_NUMBER_OF_SUB_BANDS_5];
-};
-#define CONF_SR_ERR_TBL_COUNT        3
+        u8  degraded_low_to_normal_threshold_5;
+        u8  degraded_normal_to_high_threshold_5;
+};
 struct conf_init_settings {
        /*
-         * Configure Smart Reflex error table values.
+         * Configure general parameters.
         */
-        struct conf_mart_reflex_err_table sr_err_tbl[CONF_SR_ERR_TBL_COUNT];
+        struct conf_general_parms genparam;
        /*
-         * Smart Reflex enable flag.
+         * Configure radio parameters.
-         *
-         * Range: 1 - Smart Reflex enabled, 0 - Smart Reflex disabled
         */
-        u8 sr_enable;
+        struct conf_radio_parms radioparam;
+};
+struct conf_itrim_settings {
+        /* enable dco itrim */
+        u8 enable;
+        /* moderation timeout in microsecs from the last TX */
+        u32 timeout;
+};
+struct conf_pm_config_settings {
        /*
-         * Configure general parameters.
+         * Host clock settling time
+         *
+         * Range: 0 - 30000 us
         */
-        struct conf_general_parms genparam;
+        u32 host_clk_settling_time;
        /*
-         * Configure radio parameters.
+         * Host fast wakeup support
+         *
+         * Range: true, false
         */
-        struct conf_radio_parms radioparam;
+        bool host_fast_wakeup_support;
 };
 struct conf_drv_settings {
@@ -914,6 +926,8 @@ struct conf_drv_settings {
        struct conf_tx_settings tx;
        struct conf_conn_settings conn;
        struct conf_init_settings init;
+        struct conf_itrim_settings itrim;
+        struct conf_pm_config_settings pm_config;
 };
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_debugfs.c b/drivers/net/wireless/wl12xx/wl1271_debugfs.c
index c1805e5f8964..8d7588ca68fd 100644
--- a/drivers/net/wireless/wl12xx/wl1271_debugfs.c
+++ b/drivers/net/wireless/wl12xx/wl1271_debugfs.c
@@ -237,6 +237,64 @@ static const struct file_operations tx_queue_len_ops = {
        .open = wl1271_open_file_generic,
 };
+static ssize_t gpio_power_read(struct file *file, char __user *user_buf,
+                          size_t count, loff_t *ppos)
+{
+        struct wl1271 *wl = file->private_data;
+        bool state = test_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+        int res;
+        char buf[10];
+        res = scnprintf(buf, sizeof(buf), "%d\n", state);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, res);
+}
+static ssize_t gpio_power_write(struct file *file,
+                           const char __user *user_buf,
+                           size_t count, loff_t *ppos)
+{
+        struct wl1271 *wl = file->private_data;
+        char buf[10];
+        size_t len;
+        unsigned long value;
+        int ret;
+        mutex_lock(&wl->mutex);
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len)) {
+                ret = -EFAULT;
+                goto out;
+        }
+        buf[len] = '\0';
+        ret = strict_strtoul(buf, 0, &value);
+        if (ret < 0) {
+                wl1271_warning("illegal value in gpio_power");
+                goto out;
+        }
+        if (value) {
+                wl->set_power(true);
+                set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+        } else {
+                wl->set_power(false);
+                clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+        }
+out:
+        mutex_unlock(&wl->mutex);
+        return count;
+}
+static const struct file_operations gpio_power_ops = {
+        .read = gpio_power_read,
+        .write = gpio_power_write,
+        .open = wl1271_open_file_generic
+};
 static void wl1271_debugfs_delete_files(struct wl1271 *wl)
 {
        DEBUGFS_FWSTATS_DEL(tx, internal_desc_overflow);
@@ -333,6 +391,8 @@ static void wl1271_debugfs_delete_files(struct wl1271 *wl)
        DEBUGFS_DEL(tx_queue_len);
        DEBUGFS_DEL(retry_count);
        DEBUGFS_DEL(excessive_retries);
+        DEBUGFS_DEL(gpio_power);
 }
 static int wl1271_debugfs_add_files(struct wl1271 *wl)
@@ -434,6 +494,8 @@ static int wl1271_debugfs_add_files(struct wl1271 *wl)
        DEBUGFS_ADD(retry_count, wl->debugfs.rootdir);
        DEBUGFS_ADD(excessive_retries, wl->debugfs.rootdir);
+        DEBUGFS_ADD(gpio_power, wl->debugfs.rootdir);
 out:
        if (ret < 0)
                wl1271_debugfs_delete_files(wl);
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.c b/drivers/net/wireless/wl12xx/wl1271_event.c
index d13fdd99c85c..0a145afc9905 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.c
+++ b/drivers/net/wireless/wl12xx/wl1271_event.c
@@ -35,7 +35,7 @@ static int wl1271_event_scan_complete(struct wl1271 *wl,
        wl1271_debug(DEBUG_EVENT, "status: 0x%x",
                     mbox->scheduled_scan_status);
-        if (wl->scanning) {
+        if (test_bit(WL1271_FLAG_SCANNING, &wl->flags)) {
                if (wl->scan.state == WL1271_SCAN_BAND_DUAL) {
                        wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4,
                                                NULL, size);
@@ -43,7 +43,7 @@ static int wl1271_event_scan_complete(struct wl1271 *wl,
                         * to the wl1271_cmd_scan function that we are not
                         * scanning as it checks that.
                         */
-                        wl->scanning = false;
+                        clear_bit(WL1271_FLAG_SCANNING, &wl->flags);
                        wl1271_cmd_scan(wl, wl->scan.ssid, wl->scan.ssid_len,
                                                wl->scan.active,
                                                wl->scan.high_prio,
@@ -62,7 +62,7 @@ static int wl1271_event_scan_complete(struct wl1271 *wl,
                        mutex_unlock(&wl->mutex);
                        ieee80211_scan_completed(wl->hw, false);
                        mutex_lock(&wl->mutex);
-                        wl->scanning = false;
+                        clear_bit(WL1271_FLAG_SCANNING, &wl->flags);
                }
        }
        return 0;
@@ -78,7 +78,7 @@ static int wl1271_event_ps_report(struct wl1271 *wl,
        switch (mbox->ps_status) {
        case EVENT_ENTER_POWER_SAVE_FAIL:
-                if (!wl->psm) {
+                if (!test_bit(WL1271_FLAG_PSM, &wl->flags)) {
                        wl->psm_entry_retry = 0;
                        break;
                }
@@ -89,7 +89,6 @@ static int wl1271_event_ps_report(struct wl1271 *wl,
                } else {
                        wl1271_error("PSM entry failed, giving up.\n");
                        wl->psm_entry_retry = 0;
-                        *beacon_loss = true;
                }
                break;
        case EVENT_ENTER_POWER_SAVE_SUCCESS:
@@ -136,7 +135,8 @@ static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
         * filtering) is enabled. Without PSM, the stack will receive all
         * beacons and can detect beacon loss by itself.
         */
-        if (vector & BSS_LOSE_EVENT_ID && wl->psm) {
+        if (vector & BSS_LOSE_EVENT_ID &&
+            test_bit(WL1271_FLAG_PSM, &wl->flags)) {
                wl1271_debug(DEBUG_EVENT, "BSS_LOSE_EVENT");
                /* indicate to the stack, that beacons have been lost */
@@ -150,7 +150,7 @@ static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
                        return ret;
        }
-        if (beacon_loss) {
+        if (wl->vif && beacon_loss) {
                /* Obviously, it's dangerous to release the mutex while
                   we are holding many of the variables in the wl struct.
                   That's why it's done last in the function, and care must
@@ -184,7 +184,7 @@ void wl1271_event_mbox_config(struct wl1271 *wl)
                     wl->mbox_ptr[0], wl->mbox_ptr[1]);
 }
-int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num, bool do_ack)
+int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num)
 {
        struct event_mailbox mbox;
        int ret;
@@ -204,9 +204,7 @@ int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num, bool do_ack)
                return ret;
        /* then we let the firmware know it can go on...*/
-        if (do_ack)
+        wl1271_spi_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_EVENT_ACK);
-                wl1271_spi_write32(wl, ACX_REG_INTERRUPT_TRIG,
-                                   INTR_TRIG_EVENT_ACK);
        return 0;
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.h b/drivers/net/wireless/wl12xx/wl1271_event.h
index 4e3f55ebb1a8..278f9206aa56 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.h
+++ b/drivers/net/wireless/wl12xx/wl1271_event.h
@@ -112,6 +112,6 @@ struct event_mailbox {
 int wl1271_event_unmask(struct wl1271 *wl);
 void wl1271_event_mbox_config(struct wl1271 *wl);
-int wl1271_event_handle(struct wl1271 *wl, u8 mbox, bool do_ack);
+int wl1271_event_handle(struct wl1271 *wl, u8 mbox);
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_init.c b/drivers/net/wireless/wl12xx/wl1271_init.c
index 11249b436cf1..c9848eecb767 100644
--- a/drivers/net/wireless/wl12xx/wl1271_init.c
+++ b/drivers/net/wireless/wl12xx/wl1271_init.c
@@ -229,6 +229,10 @@ int wl1271_hw_init(struct wl1271 *wl)
        if (ret < 0)
                goto out_free_memmap;
+        ret = wl1271_acx_dco_itrim_params(wl);
+        if (ret < 0)
+                goto out_free_memmap;
        /* Initialize connection monitoring thresholds */
        ret = wl1271_acx_conn_monit_params(wl);
        if (ret < 0)
@@ -280,12 +284,12 @@ int wl1271_hw_init(struct wl1271 *wl)
                goto out_free_memmap;
        /* Configure TX rate classes */
-        ret = wl1271_acx_rate_policies(wl, CONF_TX_RATE_MASK_ALL);
+        ret = wl1271_acx_rate_policies(wl);
        if (ret < 0)
                goto out_free_memmap;
        /* Enable data path */
-        ret = wl1271_cmd_data_path(wl, wl->channel, 1);
+        ret = wl1271_cmd_data_path(wl, 1);
        if (ret < 0)
                goto out_free_memmap;
@@ -299,8 +303,8 @@ int wl1271_hw_init(struct wl1271 *wl)
        if (ret < 0)
                goto out_free_memmap;
-        /* Configure smart reflex */
+        /* configure PM */
-        ret = wl1271_acx_smart_reflex(wl);
+        ret = wl1271_acx_pm_config(wl);
        if (ret < 0)
                goto out_free_memmap;
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/wl1271_main.c
index b62c00ff42fe..e4867b895c43 100644
--- a/drivers/net/wireless/wl12xx/wl1271_main.c
+++ b/drivers/net/wireless/wl12xx/wl1271_main.c
@@ -47,6 +47,8 @@
 #include "wl1271_cmd.h"
 #include "wl1271_boot.h"
+#define WL1271_BOOT_RETRIES 3
 static struct conf_drv_settings default_conf = {
        .sg = {
                .per_threshold               = 7500,
@@ -67,16 +69,17 @@ static struct conf_drv_settings default_conf = {
                .ps_poll_timeout             = 15,
                .upsd_timeout                = 15,
                .rts_threshold               = 2347,
-                .rx_cca_threshold            = 0xFFEF,
+                .rx_cca_threshold            = 0,
-                .irq_blk_threshold           = 0,
+                .irq_blk_threshold           = 0xFFFF,
-                .irq_pkt_threshold           = USHORT_MAX,
+                .irq_pkt_threshold           = 0,
-                .irq_timeout                 = 5,
+                .irq_timeout                 = 600,
                .queue_type                  = CONF_RX_QUEUE_TYPE_LOW_PRIORITY,
        },
        .tx = {
                .tx_energy_detection         = 0,
                .rc_conf                     = {
-                        .enabled_rates       = CONF_TX_RATE_MASK_UNSPECIFIED,
+                        .enabled_rates       = CONF_HW_BIT_RATE_1MBPS |
+                                               CONF_HW_BIT_RATE_2MBPS,
                        .short_retry_limit   = 10,
                        .long_retry_limit    = 10,
                        .aflags              = 0
@@ -172,8 +175,8 @@ static struct conf_drv_settings default_conf = {
                        }
                },
                .frag_threshold              = IEEE80211_MAX_FRAG_THRESHOLD,
-                .tx_compl_timeout            = 5,
+                .tx_compl_timeout            = 700,
-                .tx_compl_threshold          = 5
+                .tx_compl_threshold          = 4
        },
        .conn = {
                .wake_up_event               = CONF_WAKE_UP_EVENT_DTIM,
@@ -186,12 +189,12 @@ static struct conf_drv_settings default_conf = {
                                .rule        = CONF_BCN_RULE_PASS_ON_APPEARANCE,
                        }
                },
-                .synch_fail_thold            = 5,
+                .synch_fail_thold            = 10,
                .bss_lose_timeout            = 100,
                .beacon_rx_timeout           = 10000,
                .broadcast_timeout           = 20000,
                .rx_broadcast_in_ps          = 1,
-                .ps_poll_threshold           = 4,
+                .ps_poll_threshold           = 20,
                .sig_trigger_count           = 2,
                .sig_trigger = {
                        [0] = {
@@ -226,46 +229,35 @@ static struct conf_drv_settings default_conf = {
                .psm_entry_retries           = 3
        },
        .init = {
-                .sr_err_tbl = {
-                        [0] = {
-                                .len         = 7,
-                                .upper_limit = 0x03,
-                                .values      = {
-                                        0x18, 0x10, 0x05, 0xfb, 0xf0, 0xe8,
-                                        0x00 }
-                        },
-                        [1] = {
-                                .len         = 7,
-                                .upper_limit = 0x03,
-                                .values      = {
-                                        0x18, 0x10, 0x05, 0xf6, 0xf0, 0xe8,
-                                        0x00 }
-                        },
-                        [2] = {
-                                .len         = 7,
-                                .upper_limit = 0x03,
-                                .values      = {
-                                        0x18, 0x10, 0x05, 0xfb, 0xf0, 0xe8,
-                                        0x00 }
-                        }
-                },
-                .sr_enable                   = 1,
                .genparam                    = {
                        .ref_clk             = CONF_REF_CLK_38_4_E,
                        .settling_time       = 5,
                        .clk_valid_on_wakeup = 0,
                        .dc2dcmode           = 0,
                        .single_dual_band    = CONF_SINGLE_BAND,
-                        .tx_bip_fem_autodetect = 0,
+                        .tx_bip_fem_autodetect = 1,
                        .tx_bip_fem_manufacturer = 1,
                        .settings = 1,
+                        .sr_state = 1,
+                        .srf1 = { 0x07, 0x03, 0x18, 0x10, 0x05, 0xfb, 0xf0,
+                                  0xe8, 0, 0, 0, 0, 0, 0, 0, 0 },
+                        .srf2 = { 0x07, 0x03, 0x18, 0x10, 0x05, 0xfb, 0xf0,
+                                  0xe8, 0, 0, 0, 0, 0, 0, 0, 0 },
+                        .srf3 = { 0x07, 0x03, 0x18, 0x10, 0x05, 0xfb, 0xf0,
+                                  0xe8, 0, 0, 0, 0, 0, 0, 0, 0 },
+                        .sr_debug_table = { 0, 0, 0, 0, 0, 0, 0, 0,
+                                            0, 0, 0, 0, 0, 0, 0, 0 },
+                        .sr_sen_n_p = 0,
+                        .sr_sen_n_p_gain = 0,
+                        .sr_sen_nrn = 0,
+                        .sr_sen_prn = 0,
                },
                .radioparam = {
-                        .rx_trace_loss       = 10,
+                        .rx_trace_loss       = 0x24,
-                        .tx_trace_loss       = 10,
+                        .tx_trace_loss       = 0x0,
                        .rx_rssi_and_proc_compens = {
                                0xec, 0xf6, 0x00, 0x0c, 0x18, 0xf8,
-                                0xfc, 0x00, 0x08, 0x10, 0xf0, 0xf8,
+                                0xfc, 0x00, 0x80, 0x10, 0xf0, 0xf8,
                                0x00, 0x0a, 0x14 },
                        .rx_trace_loss_5     = { 0, 0, 0, 0, 0, 0, 0 },
                        .tx_trace_loss_5     = { 0, 0, 0, 0, 0, 0, 0 },
@@ -273,13 +265,15 @@ static struct conf_drv_settings default_conf = {
                                0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                                0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                                0x00, 0x00, 0x00 },
-                        .tx_ref_pd_voltage   = 0x24e,
+                        .tx_ref_pd_voltage   = 0x1a9,
-                        .tx_ref_power        = 0x78,
+                        .tx_ref_power        = 0x80,
                        .tx_offset_db        = 0x0,
                        .tx_rate_limits_normal = {
-                                0x1e, 0x1f, 0x22, 0x24, 0x28, 0x29 },
+                                0x1d, 0x1f, 0x24, 0x28, 0x28, 0x29 },
                        .tx_rate_limits_degraded = {
-                                0x1b, 0x1c, 0x1e, 0x20, 0x24, 0x25 },
+                                0x19, 0x1f, 0x22, 0x23, 0x27, 0x28 },
+                        .tx_rate_limits_extreme = {
+                                0x19, 0x1c, 0x1e, 0x20, 0x24, 0x25 },
                        .tx_channel_limits_11b = {
                                0x22, 0x50, 0x50, 0x50, 0x50, 0x50,
                                0x50, 0x50, 0x50, 0x50, 0x22, 0x50,
@@ -289,10 +283,12 @@ static struct conf_drv_settings default_conf = {
                                0x50, 0x50, 0x50, 0x50, 0x20, 0x50,
                                0x20, 0x50 },
                        .tx_pdv_rate_offsets = {
-                                0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
+                                0x07, 0x08, 0x04, 0x02, 0x02, 0x00 },
                        .tx_ibias            = {
-                                0x1a, 0x1a, 0x1a, 0x1a, 0x1a, 0x27 },
+                                0x11, 0x11, 0x15, 0x11, 0x15, 0x0f },
-                        .rx_fem_insertion_loss = 0x14,
+                        .rx_fem_insertion_loss = 0x0e,
+                        .degraded_low_to_normal_threshold = 0x1e,
+                        .degraded_normal_to_high_threshold = 0x2d,
                        .tx_ref_pd_voltage_5 = {
                                0x0190, 0x01a4, 0x01c3, 0x01d8,
                                0x020a, 0x021c },
@@ -304,6 +300,8 @@ static struct conf_drv_settings default_conf = {
                                0x1b, 0x1e, 0x21, 0x23, 0x27, 0x00 },
                        .tx_rate_limits_degraded_5 = {
                                0x1b, 0x1e, 0x21, 0x23, 0x27, 0x00 },
+                        .tx_rate_limits_extreme_5 = {
+                                0x1b, 0x1e, 0x21, 0x23, 0x27, 0x00 },
                        .tx_channel_limits_ofdm_5 = {
                                0x50, 0x50, 0x50, 0x50, 0x50, 0x50, 0x50, 0x50,
                                0x50, 0x50, 0x50, 0x50, 0x50, 0x50, 0x50, 0x50,
@@ -315,8 +313,18 @@ static struct conf_drv_settings default_conf = {
                        .tx_ibias_5          = {
                                0x10, 0x10, 0x10, 0x10, 0x10, 0x10 },
                        .rx_fem_insertion_loss_5 = {
-                                0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10 }
+                                0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10 },
+                        .degraded_low_to_normal_threshold_5 = 0x00,
+                        .degraded_normal_to_high_threshold_5 = 0x00
                }
+        },
+        .itrim = {
+                .enable = false,
+                .timeout = 50000,
+        },
+        .pm_config = {
+                .host_clk_settling_time = 5000,
+                .host_fast_wakeup_support = false
        }
 };
@@ -359,7 +367,7 @@ static int wl1271_plt_init(struct wl1271 *wl)
        if (ret < 0)
                return ret;
-        ret = wl1271_cmd_data_path(wl, wl->channel, 1);
+        ret = wl1271_cmd_data_path(wl, 1);
        if (ret < 0)
                return ret;
@@ -374,11 +382,13 @@ static void wl1271_disable_interrupts(struct wl1271 *wl)
 static void wl1271_power_off(struct wl1271 *wl)
 {
        wl->set_power(false);
+        clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
 }
 static void wl1271_power_on(struct wl1271 *wl)
 {
        wl->set_power(true);
+        set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
 }
 static void wl1271_fw_status(struct wl1271 *wl,
@@ -447,14 +457,13 @@ static void wl1271_irq_work(struct work_struct *work)
        intr &= WL1271_INTR_MASK;
        if (intr & WL1271_ACX_INTR_EVENT_A) {
-                bool do_ack = (intr & WL1271_ACX_INTR_EVENT_B) ? false : true;
                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_A");
-                wl1271_event_handle(wl, 0, do_ack);
+                wl1271_event_handle(wl, 0);
        }
        if (intr & WL1271_ACX_INTR_EVENT_B) {
                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_B");
-                wl1271_event_handle(wl, 1, true);
+                wl1271_event_handle(wl, 1);
        }
        if (intr & WL1271_ACX_INTR_INIT_COMPLETE)
@@ -614,6 +623,7 @@ static int wl1271_chip_wakeup(struct wl1271 *wl)
        struct wl1271_partition_set partition;
        int ret = 0;
+        msleep(WL1271_PRE_POWER_ON_SLEEP);
        wl1271_power_on(wl);
        msleep(WL1271_POWER_ON_SLEEP);
        wl1271_spi_reset(wl);
@@ -643,7 +653,7 @@ static int wl1271_chip_wakeup(struct wl1271 *wl)
                ret = wl1271_setup(wl);
                if (ret < 0)
-                        goto out_power_off;
+                        goto out;
                break;
        case CHIP_ID_1271_PG20:
                wl1271_debug(DEBUG_BOOT, "chip id 0x%x (1271 PG20)",
@@ -651,38 +661,34 @@ static int wl1271_chip_wakeup(struct wl1271 *wl)
                ret = wl1271_setup(wl);
                if (ret < 0)
-                        goto out_power_off;
+                        goto out;
                break;
        default:
-                wl1271_error("unsupported chip id: 0x%x", wl->chip.id);
+                wl1271_warning("unsupported chip id: 0x%x", wl->chip.id);
                ret = -ENODEV;
-                goto out_power_off;
+                goto out;
        }
        if (wl->fw == NULL) {
                ret = wl1271_fetch_firmware(wl);
                if (ret < 0)
-                        goto out_power_off;
+                        goto out;
        }
        /* No NVS from netlink, try to get it from the filesystem */
        if (wl->nvs == NULL) {
                ret = wl1271_fetch_nvs(wl);
                if (ret < 0)
-                        goto out_power_off;
+                        goto out;
        }
-        goto out;
-out_power_off:
-        wl1271_power_off(wl);
 out:
        return ret;
 }
 int wl1271_plt_start(struct wl1271 *wl)
 {
+        int retries = WL1271_BOOT_RETRIES;
        int ret;
        mutex_lock(&wl->mutex);
@@ -696,35 +702,48 @@ int wl1271_plt_start(struct wl1271 *wl)
                goto out;
        }
-        wl->state = WL1271_STATE_PLT;
+        while (retries) {
+                retries--;
-        ret = wl1271_chip_wakeup(wl);
+                ret = wl1271_chip_wakeup(wl);
-        if (ret < 0)
+                if (ret < 0)
-                goto out;
+                        goto power_off;
-        ret = wl1271_boot(wl);
-        if (ret < 0)
-                goto out_power_off;
-        wl1271_notice("firmware booted in PLT mode (%s)", wl->chip.fw_ver);
-        ret = wl1271_plt_init(wl);
+                ret = wl1271_boot(wl);
-        if (ret < 0)
+                if (ret < 0)
-                goto out_irq_disable;
+                        goto power_off;
-        /* Make sure power saving is disabled */
+                ret = wl1271_plt_init(wl);
-        ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_CAM);
+                if (ret < 0)
-        if (ret < 0)
+                        goto irq_disable;
-                goto out_irq_disable;
-        goto out;
+                /* Make sure power saving is disabled */
+                ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_CAM);
+                if (ret < 0)
+                        goto irq_disable;
-out_irq_disable:
+                wl->state = WL1271_STATE_PLT;
-        wl1271_disable_interrupts(wl);
+                wl1271_notice("firmware booted in PLT mode (%s)",
+                              wl->chip.fw_ver);
+                goto out;
-out_power_off:
+irq_disable:
-        wl1271_power_off(wl);
+                wl1271_disable_interrupts(wl);
+                mutex_unlock(&wl->mutex);
+                /* Unlocking the mutex in the middle of handling is
+                   inherently unsafe. In this case we deem it safe to do,
+                   because we need to let any possibly pending IRQ out of
+                   the system (and while we are WL1271_STATE_OFF the IRQ
+                   work function will not do anything.) Also, any other
+                   possible concurrent operations will fail due to the
+                   current state, hence the wl1271 struct should be safe. */
+                cancel_work_sync(&wl->irq_work);
+                mutex_lock(&wl->mutex);
+power_off:
+                wl1271_power_off(wl);
+        }
+        wl1271_error("firmware boot in PLT mode failed despite %d retries",
+                     WL1271_BOOT_RETRIES);
 out:
        mutex_unlock(&wl->mutex);
@@ -762,7 +781,20 @@ out:
 static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
        struct wl1271 *wl = hw->priv;
+        struct ieee80211_conf *conf = &hw->conf;
+        struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
+        struct ieee80211_sta *sta = txinfo->control.sta;
+        unsigned long flags;
+        /* peek into the rates configured in the STA entry */
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        if (sta && sta->supp_rates[conf->channel->band] != wl->sta_rate_set) {
+                wl->sta_rate_set = sta->supp_rates[conf->channel->band];
+                set_bit(WL1271_FLAG_STA_RATES_CHANGED, &wl->flags);
+        }
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+        /* queue the packet */
        skb_queue_tail(&wl->tx_queue, skb);
        /*
@@ -784,7 +816,7 @@ static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 * protected. Maybe fix this by removing the stupid
                 * variable altogether and checking the real queue state?
                 */
-                wl->tx_queue_stopped = true;
+                set_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags);
        }
        return NETDEV_TX_OK;
@@ -880,6 +912,7 @@ static struct notifier_block wl1271_dev_notifier = {
 static int wl1271_op_start(struct ieee80211_hw *hw)
 {
        struct wl1271 *wl = hw->priv;
+        int retries = WL1271_BOOT_RETRIES;
        int ret = 0;
        wl1271_debug(DEBUG_MAC80211, "mac80211 start");
@@ -893,30 +926,42 @@ static int wl1271_op_start(struct ieee80211_hw *hw)
                goto out;
        }
-        ret = wl1271_chip_wakeup(wl);
+        while (retries) {
-        if (ret < 0)
+                retries--;
-                goto out;
+                ret = wl1271_chip_wakeup(wl);
+                if (ret < 0)
-        ret = wl1271_boot(wl);
+                        goto power_off;
-        if (ret < 0)
-                goto out_power_off;
-        ret = wl1271_hw_init(wl);
-        if (ret < 0)
-                goto out_irq_disable;
-        wl->state = WL1271_STATE_ON;
-        wl1271_info("firmware booted (%s)", wl->chip.fw_ver);
+                ret = wl1271_boot(wl);
+                if (ret < 0)
+                        goto power_off;
-        goto out;
+                ret = wl1271_hw_init(wl);
+                if (ret < 0)
+                        goto irq_disable;
-out_irq_disable:
+                wl->state = WL1271_STATE_ON;
-        wl1271_disable_interrupts(wl);
+                wl1271_info("firmware booted (%s)", wl->chip.fw_ver);
+                goto out;
-out_power_off:
+irq_disable:
-        wl1271_power_off(wl);
+                wl1271_disable_interrupts(wl);
+                mutex_unlock(&wl->mutex);
+                /* Unlocking the mutex in the middle of handling is
+                   inherently unsafe. In this case we deem it safe to do,
+                   because we need to let any possibly pending IRQ out of
+                   the system (and while we are WL1271_STATE_OFF the IRQ
+                   work function will not do anything.) Also, any other
+                   possible concurrent operations will fail due to the
+                   current state, hence the wl1271 struct should be safe. */
+                cancel_work_sync(&wl->irq_work);
+                mutex_lock(&wl->mutex);
+power_off:
+                wl1271_power_off(wl);
+        }
+        wl1271_error("firmware boot failed despite %d retries",
+                     WL1271_BOOT_RETRIES);
 out:
        mutex_unlock(&wl->mutex);
@@ -944,11 +989,10 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
        WARN_ON(wl->state != WL1271_STATE_ON);
-        if (wl->scanning) {
+        if (test_and_clear_bit(WL1271_FLAG_SCANNING, &wl->flags)) {
                mutex_unlock(&wl->mutex);
                ieee80211_scan_completed(wl->hw, true);
                mutex_lock(&wl->mutex);
-                wl->scanning = false;
        }
        wl->state = WL1271_STATE_OFF;
@@ -973,10 +1017,7 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
        wl->band = IEEE80211_BAND_2GHZ;
        wl->rx_counter = 0;
-        wl->elp = false;
-        wl->psm = 0;
        wl->psm_entry_retry = 0;
-        wl->tx_queue_stopped = false;
        wl->power_level = WL1271_DEFAULT_POWER_LEVEL;
        wl->tx_blocks_available = 0;
        wl->tx_results_count = 0;
@@ -986,7 +1027,9 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
        wl->tx_security_seq_32 = 0;
        wl->time_offset = 0;
        wl->session_counter = 0;
-        wl->joined = false;
+        wl->rate_set = CONF_TX_RATE_MASK_BASIC;
+        wl->sta_rate_set = 0;
+        wl->flags = 0;
        for (i = 0; i < NUM_TX_QUEUES; i++)
                wl->tx_blocks_freed[i] = 0;
@@ -996,13 +1039,13 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
 }
 static int wl1271_op_add_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_if_init_conf *conf)
+                                   struct ieee80211_vif *vif)
 {
        struct wl1271 *wl = hw->priv;
        int ret = 0;
        wl1271_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
-                     conf->type, conf->mac_addr);
+                     vif->type, vif->addr);
        mutex_lock(&wl->mutex);
        if (wl->vif) {
@@ -1010,9 +1053,9 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
                goto out;
        }
-        wl->vif = conf->vif;
+        wl->vif = vif;
-        switch (conf->type) {
+        switch (vif->type) {
        case NL80211_IFTYPE_STATION:
                wl->bss_type = BSS_TYPE_STA_BSS;
                break;
@@ -1032,7 +1075,7 @@ out:
 }
 static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
-                                         struct ieee80211_if_init_conf *conf)
+                                         struct ieee80211_vif *vif)
 {
        struct wl1271 *wl = hw->priv;
@@ -1109,6 +1152,51 @@ out:
 }
 #endif
+static int wl1271_join_channel(struct wl1271 *wl, int channel)
+{
+        int ret = 0;
+        /* we need to use a dummy BSSID for now */
+        static const u8 dummy_bssid[ETH_ALEN] = { 0x0b, 0xad, 0xde,
+                                                  0xad, 0xbe, 0xef };
+        /* the dummy join is not required for ad-hoc */
+        if (wl->bss_type == BSS_TYPE_IBSS)
+                goto out;
+        /* disable mac filter, so we hear everything */
+        wl->rx_config &= ~CFG_BSSID_FILTER_EN;
+        wl->channel = channel;
+        memcpy(wl->bssid, dummy_bssid, ETH_ALEN);
+        ret = wl1271_cmd_join(wl);
+        if (ret < 0)
+                goto out;
+        set_bit(WL1271_FLAG_JOINED, &wl->flags);
+out:
+        return ret;
+}
+static int wl1271_unjoin_channel(struct wl1271 *wl)
+{
+        int ret;
+        /* to stop listening to a channel, we disconnect */
+        ret = wl1271_cmd_disconnect(wl);
+        if (ret < 0)
+                goto out;
+        clear_bit(WL1271_FLAG_JOINED, &wl->flags);
+        wl->channel = 0;
+        memset(wl->bssid, 0, ETH_ALEN);
+        wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
+out:
+        return ret;
+}
 static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
 {
        struct wl1271 *wl = hw->priv;
@@ -1117,10 +1205,11 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
        channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
-        wl1271_debug(DEBUG_MAC80211, "mac80211 config ch %d psm %s power %d",
+        wl1271_debug(DEBUG_MAC80211, "mac80211 config ch %d psm %s power %d %s",
                     channel,
                     conf->flags & IEEE80211_CONF_PS ? "on" : "off",
-                     conf->power_level);
+                     conf->power_level,
+                     conf->flags & IEEE80211_CONF_IDLE ? "idle" : "in use");
        mutex_lock(&wl->mutex);
@@ -1130,34 +1219,44 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
        if (ret < 0)
                goto out;
-        if (channel != wl->channel) {
+        if (changed & IEEE80211_CONF_CHANGE_IDLE) {
-                /*
+                if (conf->flags & IEEE80211_CONF_IDLE &&
-                 * We assume that the stack will configure the right channel
+                    test_bit(WL1271_FLAG_JOINED, &wl->flags))
-                 * before associating, so we don't need to send a join
+                        wl1271_unjoin_channel(wl);
-                 * command here.  We will join the right channel when the
+                else if (!(conf->flags & IEEE80211_CONF_IDLE))
-                 * BSSID changes
+                        wl1271_join_channel(wl, channel);
-                 */
-                wl->channel = channel;
+                if (conf->flags & IEEE80211_CONF_IDLE) {
+                        wl->rate_set = CONF_TX_RATE_MASK_BASIC;
+                        wl->sta_rate_set = 0;
+                        wl1271_acx_rate_policies(wl);
+                }
        }
-        if (conf->flags & IEEE80211_CONF_PS && !wl->psm_requested) {
+        /* if the channel changes while joined, join again */
-                wl1271_info("psm enabled");
+        if (channel != wl->channel && test_bit(WL1271_FLAG_JOINED, &wl->flags))
+                wl1271_join_channel(wl, channel);
-                wl->psm_requested = true;
+        if (conf->flags & IEEE80211_CONF_PS &&
+            !test_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags)) {
+                set_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags);
                /*
                 * We enter PSM only if we're already associated.
                 * If we're not, we'll enter it when joining an SSID,
                 * through the bss_info_changed() hook.
                 */
-                ret = wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE);
+                if (test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags)) {
+                        wl1271_info("psm enabled");
+                        ret = wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE);
+                }
        } else if (!(conf->flags & IEEE80211_CONF_PS) &&
-                   wl->psm_requested) {
+                   test_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags)) {
                wl1271_info("psm disabled");
-                wl->psm_requested = false;
+                clear_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags);
-                if (wl->psm)
+                if (test_bit(WL1271_FLAG_PSM, &wl->flags))
                        ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE);
        }
@@ -1440,22 +1539,6 @@ out:
        return ret;
 }
-static u32 wl1271_enabled_rates_get(struct wl1271 *wl, u64 basic_rate_set)
-{
-        struct ieee80211_supported_band *band;
-        u32 enabled_rates = 0;
-        int bit;
-        band = wl->hw->wiphy->bands[wl->band];
-        for (bit = 0; bit < band->n_bitrates; bit++) {
-                if (basic_rate_set & 0x1)
-                        enabled_rates |= band->bitrates[bit].hw_value;
-                basic_rate_set >>= 1;
-        }
-        return enabled_rates;
-}
 static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                                       struct ieee80211_vif *vif,
                                       struct ieee80211_bss_conf *bss_conf,
@@ -1473,9 +1556,68 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
        if (ret < 0)
                goto out;
+        if ((changed & BSS_CHANGED_BSSID) &&
+            /*
+             * Now we know the correct bssid, so we send a new join command
+             * and enable the BSSID filter
+             */
+            memcmp(wl->bssid, bss_conf->bssid, ETH_ALEN)) {
+                        wl->rx_config |= CFG_BSSID_FILTER_EN;
+                        memcpy(wl->bssid, bss_conf->bssid, ETH_ALEN);
+                        ret = wl1271_cmd_build_null_data(wl);
+                        if (ret < 0) {
+                                wl1271_warning("cmd buld null data failed %d",
+                                               ret);
+                                goto out_sleep;
+                        }
+                        ret = wl1271_cmd_join(wl);
+                        if (ret < 0) {
+                                wl1271_warning("cmd join failed %d", ret);
+                                goto out_sleep;
+                        }
+                        set_bit(WL1271_FLAG_JOINED, &wl->flags);
+        }
+        if (wl->bss_type == BSS_TYPE_IBSS) {
+                /* FIXME: This implements rudimentary ad-hoc support -
+                   proper templates are on the wish list and notification
+                   on when they change. This patch will update the templates
+                   on every call to this function. Also, the firmware will not
+                   answer to probe-requests as it does not have the proper
+                   SSID set in the JOIN command. The probe-response template
+                   is set nevertheless, as the FW will ASSERT without it */
+                struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
+                if (beacon) {
+                        struct ieee80211_hdr *hdr;
+                        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_BEACON,
+                                                      beacon->data,
+                                                      beacon->len);
+                        if (ret < 0) {
+                                dev_kfree_skb(beacon);
+                                goto out_sleep;
+                        }
+                        hdr = (struct ieee80211_hdr *) beacon->data;
+                        hdr->frame_control = cpu_to_le16(
+                                IEEE80211_FTYPE_MGMT |
+                                IEEE80211_STYPE_PROBE_RESP);
+                        ret = wl1271_cmd_template_set(wl,
+                                                      CMD_TEMPL_PROBE_RESPONSE,
+                                                      beacon->data,
+                                                      beacon->len);
+                        dev_kfree_skb(beacon);
+                        if (ret < 0)
+                                goto out_sleep;
+                }
+        }
        if (changed & BSS_CHANGED_ASSOC) {
                if (bss_conf->assoc) {
                        wl->aid = bss_conf->aid;
+                        set_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags);
                        /*
                         * with wl1271, we don't need to update the
@@ -1492,7 +1634,8 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                                goto out_sleep;
                        /* If we want to go in PSM but we're not there yet */
-                        if (wl->psm_requested && !wl->psm) {
+                        if (test_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags) &&
+                            !test_bit(WL1271_FLAG_PSM, &wl->flags)) {
                                mode = STATION_POWER_SAVE_MODE;
                                ret = wl1271_ps_set_mode(wl, mode);
                                if (ret < 0)
@@ -1500,7 +1643,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                        }
                } else {
                        /* use defaults when not associated */
-                        wl->basic_rate_set = WL1271_DEFAULT_BASIC_RATE_SET;
+                        clear_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags);
                        wl->aid = 0;
                }
@@ -1535,17 +1678,6 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                }
        }
-        if (changed & BSS_CHANGED_BASIC_RATES) {
-                wl->basic_rate_set = wl1271_enabled_rates_get(
-                        wl, bss_conf->basic_rates);
-                ret = wl1271_acx_rate_policies(wl, wl->basic_rate_set);
-                if (ret < 0) {
-                        wl1271_warning("Set rate policies failed %d", ret);
-                        goto out_sleep;
-                }
-        }
 out_sleep:
        wl1271_ps_elp_sleep(wl);
@@ -1599,19 +1731,19 @@ static struct ieee80211_rate wl1271_rates[] = {
 /* can't be const, mac80211 writes to this */
 static struct ieee80211_channel wl1271_channels[] = {
-        { .hw_value = 1, .center_freq = 2412},
+        { .hw_value = 1, .center_freq = 2412, .max_power = 25 },
-        { .hw_value = 2, .center_freq = 2417},
+        { .hw_value = 2, .center_freq = 2417, .max_power = 25 },
-        { .hw_value = 3, .center_freq = 2422},
+        { .hw_value = 3, .center_freq = 2422, .max_power = 25 },
-        { .hw_value = 4, .center_freq = 2427},
+        { .hw_value = 4, .center_freq = 2427, .max_power = 25 },
-        { .hw_value = 5, .center_freq = 2432},
+        { .hw_value = 5, .center_freq = 2432, .max_power = 25 },
-        { .hw_value = 6, .center_freq = 2437},
+        { .hw_value = 6, .center_freq = 2437, .max_power = 25 },
-        { .hw_value = 7, .center_freq = 2442},
+        { .hw_value = 7, .center_freq = 2442, .max_power = 25 },
-        { .hw_value = 8, .center_freq = 2447},
+        { .hw_value = 8, .center_freq = 2447, .max_power = 25 },
-        { .hw_value = 9, .center_freq = 2452},
+        { .hw_value = 9, .center_freq = 2452, .max_power = 25 },
-        { .hw_value = 10, .center_freq = 2457},
+        { .hw_value = 10, .center_freq = 2457, .max_power = 25 },
-        { .hw_value = 11, .center_freq = 2462},
+        { .hw_value = 11, .center_freq = 2462, .max_power = 25 },
-        { .hw_value = 12, .center_freq = 2467},
+        { .hw_value = 12, .center_freq = 2467, .max_power = 25 },
-        { .hw_value = 13, .center_freq = 2472},
+        { .hw_value = 13, .center_freq = 2472, .max_power = 25 },
 };
 /* can't be const, mac80211 writes to this */
@@ -1757,7 +1889,8 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
                IEEE80211_HW_BEACON_FILTER |
                IEEE80211_HW_SUPPORTS_PS;
-        wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+        wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_ADHOC);
        wl->hw->wiphy->max_scan_ssids = 1;
        wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wl1271_band_2ghz;
@@ -1818,21 +1951,18 @@ static int __devinit wl1271_probe(struct spi_device *spi)
        INIT_DELAYED_WORK(&wl->elp_work, wl1271_elp_work);
        wl->channel = WL1271_DEFAULT_CHANNEL;
-        wl->scanning = false;
        wl->default_key = 0;
        wl->rx_counter = 0;
        wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
        wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
-        wl->elp = false;
-        wl->psm = 0;
-        wl->psm_requested = false;
        wl->psm_entry_retry = 0;
-        wl->tx_queue_stopped = false;
        wl->power_level = WL1271_DEFAULT_POWER_LEVEL;
-        wl->basic_rate_set = WL1271_DEFAULT_BASIC_RATE_SET;
+        wl->basic_rate_set = CONF_TX_RATE_MASK_BASIC;
+        wl->rate_set = CONF_TX_RATE_MASK_BASIC;
+        wl->sta_rate_set = 0;
        wl->band = IEEE80211_BAND_2GHZ;
        wl->vif = NULL;
-        wl->joined = false;
+        wl->flags = 0;
        for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                wl->tx_frames[i] = NULL;
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.c b/drivers/net/wireless/wl12xx/wl1271_ps.c
index 507cd91d7eed..e407790f6771 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1271_ps.c
@@ -39,12 +39,13 @@ void wl1271_elp_work(struct work_struct *work)
        mutex_lock(&wl->mutex);
-        if (wl->elp || !wl->psm)
+        if (test_bit(WL1271_FLAG_IN_ELP, &wl->flags) ||
+            !test_bit(WL1271_FLAG_PSM, &wl->flags))
                goto out;
        wl1271_debug(DEBUG_PSM, "chip to elp");
        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
-        wl->elp = true;
+        set_bit(WL1271_FLAG_IN_ELP, &wl->flags);
 out:
        mutex_unlock(&wl->mutex);
@@ -55,7 +56,7 @@ out:
 /* Routines to toggle sleep mode while in ELP */
 void wl1271_ps_elp_sleep(struct wl1271 *wl)
 {
-        if (wl->psm) {
+        if (test_bit(WL1271_FLAG_PSM, &wl->flags)) {
                cancel_delayed_work(&wl->elp_work);
                ieee80211_queue_delayed_work(wl->hw, &wl->elp_work,
                                        msecs_to_jiffies(ELP_ENTRY_DELAY));
@@ -70,7 +71,7 @@ int wl1271_ps_elp_wakeup(struct wl1271 *wl, bool chip_awake)
        u32 start_time = jiffies;
        bool pending = false;
-        if (!wl->elp)
+        if (!test_bit(WL1271_FLAG_IN_ELP, &wl->flags))
                return 0;
        wl1271_debug(DEBUG_PSM, "waking up chip from elp");
@@ -101,7 +102,7 @@ int wl1271_ps_elp_wakeup(struct wl1271 *wl, bool chip_awake)
                }
        }
-        wl->elp = false;
+        clear_bit(WL1271_FLAG_IN_ELP, &wl->flags);
        wl1271_debug(DEBUG_PSM, "wakeup time: %u ms",
                     jiffies_to_msecs(jiffies - start_time));
@@ -143,7 +144,7 @@ int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode)
                if (ret < 0)
                        return ret;
-                wl->psm = 1;
+                set_bit(WL1271_FLAG_PSM, &wl->flags);
                break;
        case STATION_ACTIVE_MODE:
        default:
@@ -166,7 +167,7 @@ int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode)
                if (ret < 0)
                        return ret;
-                wl->psm = 0;
+                clear_bit(WL1271_FLAG_PSM, &wl->flags);
                break;
        }
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.c b/drivers/net/wireless/wl12xx/wl1271_spi.c
index 02978a16e732..ee9564aa6ecc 100644
--- a/drivers/net/wireless/wl12xx/wl1271_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1271_spi.c
@@ -397,8 +397,7 @@ u16 wl1271_top_reg_read(struct wl1271 *wl, int addr)
        /* poll for data ready */
        do {
                val = wl1271_spi_read32(wl, OCP_DATA_READ);
-                timeout--;
+        } while (!(val & OCP_READY_MASK) && --timeout);
-        } while (!(val & OCP_READY_MASK) && timeout);
        if (!timeout) {
                wl1271_warning("Top register access timed out.");
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.c b/drivers/net/wireless/wl12xx/wl1271_tx.c
index 00af065c77c2..a288cc317d7b 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.c
@@ -121,6 +121,11 @@ static int wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
        pad = pad - skb->len;
        tx_attr |= pad << TX_HW_ATTR_OFST_LAST_WORD_PAD;
+        /* if the packets are destined for AP (have a STA entry) send them
+           with AP rate policies, otherwise use default basic rates */
+        if (control->control.sta)
+                tx_attr |= ACX_TX_AP_FULL_RATE << TX_HW_ATTR_OFST_RATE_POLICY;
        desc->tx_attr = cpu_to_le16(tx_attr);
        wl1271_debug(DEBUG_TX, "tx_fill_hdr: pad: %d", pad);
@@ -214,18 +219,50 @@ static int wl1271_tx_frame(struct wl1271 *wl, struct sk_buff *skb)
        return ret;
 }
+static u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set)
+{
+        struct ieee80211_supported_band *band;
+        u32 enabled_rates = 0;
+        int bit;
+        band = wl->hw->wiphy->bands[wl->band];
+        for (bit = 0; bit < band->n_bitrates; bit++) {
+                if (rate_set & 0x1)
+                        enabled_rates |= band->bitrates[bit].hw_value;
+                rate_set >>= 1;
+        }
+        return enabled_rates;
+}
 void wl1271_tx_work(struct work_struct *work)
 {
        struct wl1271 *wl = container_of(work, struct wl1271, tx_work);
        struct sk_buff *skb;
        bool woken_up = false;
+        u32 sta_rates = 0;
        int ret;
+        /* check if the rates supported by the AP have changed */
+        if (unlikely(test_and_clear_bit(WL1271_FLAG_STA_RATES_CHANGED,
+                                        &wl->flags))) {
+                unsigned long flags;
+                spin_lock_irqsave(&wl->wl_lock, flags);
+                sta_rates = wl->sta_rate_set;
+                spin_unlock_irqrestore(&wl->wl_lock, flags);
+        }
        mutex_lock(&wl->mutex);
        if (unlikely(wl->state == WL1271_STATE_OFF))
                goto out;
+        /* if rates have changed, re-configure the rate policy */
+        if (unlikely(sta_rates)) {
+                wl->rate_set = wl1271_tx_enabled_rates_get(wl, sta_rates);
+                wl1271_acx_rate_policies(wl);
+        }
        while ((skb = skb_dequeue(&wl->tx_queue))) {
                if (!woken_up) {
                        ret = wl1271_ps_elp_wakeup(wl, false);
@@ -240,18 +277,18 @@ void wl1271_tx_work(struct work_struct *work)
                        wl1271_debug(DEBUG_TX, "tx_work: fw buffer full, "
                                     "stop queues");
                        ieee80211_stop_queues(wl->hw);
-                        wl->tx_queue_stopped = true;
+                        set_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags);
                        skb_queue_head(&wl->tx_queue, skb);
                        goto out;
                } else if (ret < 0) {
                        dev_kfree_skb(skb);
                        goto out;
-                } else if (wl->tx_queue_stopped) {
+                } else if (test_and_clear_bit(WL1271_FLAG_TX_QUEUE_STOPPED,
+                                              &wl->flags)) {
                        /* firmware buffer has space, restart queues */
                        wl1271_debug(DEBUG_TX,
                                     "complete_packet: waking queues");
                        ieee80211_wake_queues(wl->hw);
-                        wl->tx_queue_stopped = false;
                }
        }
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 9d9b263733e6..d90f0a25b9cf 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -869,7 +869,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
 }
 static int zd_op_add_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_if_init_conf *conf)
+                                struct ieee80211_vif *vif)
 {
        struct zd_mac *mac = zd_hw_mac(hw);
@@ -877,22 +877,22 @@ static int zd_op_add_interface(struct ieee80211_hw *hw,
        if (mac->type != NL80211_IFTYPE_UNSPECIFIED)
                return -EOPNOTSUPP;
-        switch (conf->type) {
+        switch (vif->type) {
        case NL80211_IFTYPE_MONITOR:
        case NL80211_IFTYPE_MESH_POINT:
        case NL80211_IFTYPE_STATION:
        case NL80211_IFTYPE_ADHOC:
-                mac->type = conf->type;
+                mac->type = vif->type;
                break;
        default:
                return -EOPNOTSUPP;
        }
-        return zd_write_mac_addr(&mac->chip, conf->mac_addr);
+        return zd_write_mac_addr(&mac->chip, vif->addr);
 }
 static void zd_op_remove_interface(struct ieee80211_hw *hw,
-                                    struct ieee80211_if_init_conf *conf)
+                                    struct ieee80211_vif *vif)
 {
        struct zd_mac *mac = zd_hw_mac(hw);
        mac->type = NL80211_IFTYPE_UNSPECIFIED;
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index ac19ecd19cfe..4daf1c94ec04 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -1078,11 +1078,15 @@ static int eject_installer(struct usb_interface *intf)
        int r;
        /* Find bulk out endpoint */
-        endpoint = &iface_desc->endpoint[1].desc;
+        for (r = 1; r >= 0; r--) {
-        if (usb_endpoint_dir_out(endpoint) &&
+                endpoint = &iface_desc->endpoint[r].desc;
-            usb_endpoint_xfer_bulk(endpoint)) {
+                if (usb_endpoint_dir_out(endpoint) &&
-                bulk_out_ep = endpoint->bEndpointAddress;
+                    usb_endpoint_xfer_bulk(endpoint)) {
-        } else {
+                        bulk_out_ep = endpoint->bEndpointAddress;
+                        break;
+                }
+        }
+        if (r == -1) {
                dev_err(&udev->dev,
                        "zd1211rw: Could not find bulk out endpoint\n");
                return -ENODEV;