66 files changed, 795 insertions, 410 deletions

diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 4a4f6b81e32d..70609eefc2de 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -490,13 +490,11 @@ static inline unsigned int cp_rx_csum_ok (u32 status)
 {
         unsigned int protocol = (status >> 16) & 0x3;
 
-        if (likely((protocol == RxProtoTCP) && (!(status & TCPFail))))
+        if (((protocol == RxProtoTCP) && !(status & TCPFail)) ||
+            ((protocol == RxProtoUDP) && !(status & UDPFail)))
                 return 1;
-        else if ((protocol == RxProtoUDP) && (!(status & UDPFail)))
-                return 1;
-        else if ((protocol == RxProtoIP) && (!(status & IPFail)))
-                return 1;
-        return 0;
+        else
+                return 0;
 }
 
 static int cp_rx_poll(struct napi_struct *napi, int budget)
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index c73be2848319..67f75c17919c 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -3503,6 +3503,8 @@ static int atl1_set_ringparam(struct net_device *netdev,
         struct atl1_rfd_ring rfd_old, rfd_new;
         struct atl1_rrd_ring rrd_old, rrd_new;
         struct atl1_ring_header rhdr_old, rhdr_new;
+        struct atl1_smb smb;
+        struct atl1_cmb cmb;
         int err;
 
         tpd_old = adapter->tpd_ring;
@@ -3543,11 +3545,19 @@ static int atl1_set_ringparam(struct net_device *netdev,
                 adapter->rrd_ring = rrd_old;
                 adapter->tpd_ring = tpd_old;
                 adapter->ring_header = rhdr_old;
+                /*
+                 * Save SMB and CMB, since atl1_free_ring_resources
+                 * will clear them.
+                 */
+                smb = adapter->smb;
+                cmb = adapter->cmb;
                 atl1_free_ring_resources(adapter);
                 adapter->rfd_ring = rfd_new;
                 adapter->rrd_ring = rrd_new;
                 adapter->tpd_ring = tpd_new;
                 adapter->ring_header = rhdr_new;
+                adapter->smb = smb;
+                adapter->cmb = cmb;
 
                 err = atl1_up(adapter);
                 if (err)
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 34abcc9403d6..dc913b986795 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -1179,7 +1179,7 @@ int be_cmd_multicast_set(struct be_adapter *adapter, u32 if_id,
 
                 i = 0;
                 netdev_for_each_mc_addr(ha, netdev)
-                        memcpy(req->mac[i].byte, ha->addr, ETH_ALEN);
+                        memcpy(req->mac[i++].byte, ha->addr, ETH_ALEN);
         } else {
                 req->promiscuous = 1;
         }
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index c6fdd851579a..c867cf901f9f 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -240,11 +240,11 @@ static inline struct slave *bond_get_slave_by_dev(struct bonding *bond, struct n
 
         bond_for_each_slave(bond, slave, i) {
                 if (slave->dev == slave_dev) {
-                        break;
+                        return slave;
                 }
         }
 
-        return slave;
+        return 0;
 }
 
 static inline struct bonding *bond_get_bond_by_slave(struct slave *slave)
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 5cc39ed289c6..71324286b1e7 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -31,7 +31,7 @@
 
 char e1000_driver_name[] = "e1000";
 static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
-#define DRV_VERSION "7.3.21-k6-NAPI"
+#define DRV_VERSION "7.3.21-k8-NAPI"
 const char e1000_driver_version[] = DRV_VERSION;
 static const char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
 
@@ -483,9 +483,6 @@ void e1000_down(struct e1000_adapter *adapter)
         struct net_device *netdev = adapter->netdev;
         u32 rctl, tctl;
 
-        /* signal that we're down so the interrupt handler does not
-         * reschedule our watchdog timer */
-        set_bit(__E1000_DOWN, &adapter->flags);
 
         /* disable receives in the hardware */
         rctl = er32(RCTL);
@@ -506,6 +503,13 @@ void e1000_down(struct e1000_adapter *adapter)
 
         e1000_irq_disable(adapter);
 
+        /*
+         * Setting DOWN must be after irq_disable to prevent
+         * a screaming interrupt.  Setting DOWN also prevents
+         * timers and tasks from rescheduling.
+         */
+        set_bit(__E1000_DOWN, &adapter->flags);
+
         del_timer_sync(&adapter->tx_fifo_stall_timer);
         del_timer_sync(&adapter->watchdog_timer);
         del_timer_sync(&adapter->phy_info_timer);
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index cce32d43175f..52e9ca8de4b2 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -651,8 +651,8 @@ static int fec_enet_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
         fep->mii_timeout = 0;
         init_completion(&fep->mdio_done);
 
-        /* start a read op */
-        writel(FEC_MMFR_ST | FEC_MMFR_OP_READ |
+        /* start a write op */
+        writel(FEC_MMFR_ST | FEC_MMFR_OP_WRITE |
                 FEC_MMFR_PA(mii_id) | FEC_MMFR_RA(regnum) |
                 FEC_MMFR_TA | FEC_MMFR_DATA(value),
                 fep->hwp + FEC_MII_DATA);
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index ab9f675c5b8b..fe337bd121aa 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -104,6 +104,8 @@ static void ri_tasklet(unsigned long dev)
                         rcu_read_unlock();
                         dev_kfree_skb(skb);
                         stats->tx_dropped++;
+                        if (skb_queue_len(&dp->tq) != 0)
+                                goto resched;
                         break;
                 }
                 rcu_read_unlock();
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index e32af434cc9d..0e7f086d28db 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -2651,9 +2651,16 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
         int rx_buf_len;
 
         /* Decide whether to use packet split mode or not */
+        /* On by default */
+        adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
+
         /* Do not use packet split if we're in SR-IOV Mode */
-        if (!adapter->num_vfs)
-                adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
+        if (adapter->num_vfs)
+                adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
+
+        /* Disable packet split due to 82599 erratum #45 */
+        if (hw->mac.type == ixgbe_mac_82599EB)
+                adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
 
         /* Set the RX buffer length according to the mode */
         if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
diff --git a/drivers/net/jme.c b/drivers/net/jme.c
index 99f24f5cac53..f0643ac4aff1 100644
--- a/drivers/net/jme.c
+++ b/drivers/net/jme.c
@@ -1575,6 +1575,16 @@ jme_free_irq(struct jme_adapter *jme)
         }
 }
 
+static inline void
+jme_phy_on(struct jme_adapter *jme)
+{
+        u32 bmcr;
+
+        bmcr = jme_mdio_read(jme->dev, jme->mii_if.phy_id, MII_BMCR);
+        bmcr &= ~BMCR_PDOWN;
+        jme_mdio_write(jme->dev, jme->mii_if.phy_id, MII_BMCR, bmcr);
+}
+
 static int
 jme_open(struct net_device *netdev)
 {
@@ -1595,10 +1605,12 @@ jme_open(struct net_device *netdev)
 
         jme_start_irq(jme);
 
-        if (test_bit(JME_FLAG_SSET, &jme->flags))
+        if (test_bit(JME_FLAG_SSET, &jme->flags)) {
+                jme_phy_on(jme);
                 jme_set_settings(netdev, &jme->old_ecmd);
-        else
+        } else {
                 jme_reset_phy_processor(jme);
+        }
 
         jme_reset_link(jme);
 
@@ -3006,10 +3018,12 @@ jme_resume(struct pci_dev *pdev)
         jme_clear_pm(jme);
         pci_restore_state(pdev);
 
-        if (test_bit(JME_FLAG_SSET, &jme->flags))
+        if (test_bit(JME_FLAG_SSET, &jme->flags)) {
+                jme_phy_on(jme);
                 jme_set_settings(netdev, &jme->old_ecmd);
-        else
+        } else {
                 jme_reset_phy_processor(jme);
+        }
 
         jme_start_irq(jme);
         netif_device_attach(netdev);
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index f9b509a6b09a..b12553bb5ecc 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1622,6 +1622,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("COMPU-SHACK", "FASTline PCMCIA 10/100 Fast-Ethernet", 0xfa2e424d, 0x3953d9b9),
         PCMCIA_DEVICE_PROD_ID12("CONTEC", "C-NET(PC)C-10L", 0x21cab552, 0xf6f90722),
         PCMCIA_DEVICE_PROD_ID12("corega", "FEther PCC-TXF", 0x0a21501a, 0xa51564a2),
+        PCMCIA_DEVICE_PROD_ID12("corega", "Ether CF-TD", 0x0a21501a, 0x6589340a),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega EtherII PCC-T", 0x5261440f, 0xfa9d85bd),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega EtherII PCC-TD", 0x5261440f, 0xc49bd73d),
         PCMCIA_DEVICE_PROD_ID12("Corega K.K.", "corega EtherII PCC-TD", 0xd4fdcbd8, 0xc49bd73d),
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 0101f2bdf400..c1ba49b772ff 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -196,20 +196,27 @@ static int m88e1121_config_aneg(struct phy_device *phydev)
                         MII_88E1121_PHY_MSCR_PAGE);
         if (err < 0)
                 return err;
-        mscr = phy_read(phydev, MII_88E1121_PHY_MSCR_REG) &
-                MII_88E1121_PHY_MSCR_DELAY_MASK;
 
-        if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID)
-                mscr |= (MII_88E1121_PHY_MSCR_RX_DELAY |
-                         MII_88E1121_PHY_MSCR_TX_DELAY);
-        else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID)
-                mscr |= MII_88E1121_PHY_MSCR_RX_DELAY;
-        else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
-                mscr |= MII_88E1121_PHY_MSCR_TX_DELAY;
+        if ((phydev->interface == PHY_INTERFACE_MODE_RGMII) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)) {
 
-        err = phy_write(phydev, MII_88E1121_PHY_MSCR_REG, mscr);
-        if (err < 0)
-                return err;
+                mscr = phy_read(phydev, MII_88E1121_PHY_MSCR_REG) &
+                        MII_88E1121_PHY_MSCR_DELAY_MASK;
+
+                if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID)
+                        mscr |= (MII_88E1121_PHY_MSCR_RX_DELAY |
+                                 MII_88E1121_PHY_MSCR_TX_DELAY);
+                else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID)
+                        mscr |= MII_88E1121_PHY_MSCR_RX_DELAY;
+                else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
+                        mscr |= MII_88E1121_PHY_MSCR_TX_DELAY;
+
+                err = phy_write(phydev, MII_88E1121_PHY_MSCR_REG, mscr);
+                if (err < 0)
+                        return err;
+        }
 
         phy_write(phydev, MII_88E1121_PHY_PAGE, oldpage);
 
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index c07de359dc07..6a3eae2407c1 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -948,7 +948,7 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
 
 abort:
         kfree_skb(skb);
-        return 0;
+        return 1;
 }
 
 /************************************************************************
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 142c381e1d73..80666f097ce6 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -893,16 +893,18 @@ static void r6040_multicast_list(struct net_device *dev)
         /* Multicast Address 1~4 case */
         i = 0;
         netdev_for_each_mc_addr(ha, dev) {
-                if (i < MCAST_MAX) {
-                        adrp = (u16 *) ha->addr;
-                        iowrite16(adrp[0], ioaddr + MID_1L + 8 * i);
-                        iowrite16(adrp[1], ioaddr + MID_1M + 8 * i);
-                        iowrite16(adrp[2], ioaddr + MID_1H + 8 * i);
-                } else {
-                        iowrite16(0xffff, ioaddr + MID_1L + 8 * i);
-                        iowrite16(0xffff, ioaddr + MID_1M + 8 * i);
-                        iowrite16(0xffff, ioaddr + MID_1H + 8 * i);
-                }
+                if (i >= MCAST_MAX)
+                        break;
+                adrp = (u16 *) ha->addr;
+                iowrite16(adrp[0], ioaddr + MID_1L + 8 * i);
+                iowrite16(adrp[1], ioaddr + MID_1M + 8 * i);
+                iowrite16(adrp[2], ioaddr + MID_1H + 8 * i);
+                i++;
+        }
+        while (i < MCAST_MAX) {
+                iowrite16(0xffff, ioaddr + MID_1L + 8 * i);
+                iowrite16(0xffff, ioaddr + MID_1M + 8 * i);
+                iowrite16(0xffff, ioaddr + MID_1H + 8 * i);
                 i++;
         }
 }
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 992db2fa136e..ed65e4a473ec 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -855,10 +855,10 @@ static int rtl8169_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         else
                 tp->features &= ~RTL_FEATURE_WOL;
         __rtl8169_set_wol(tp, wol->wolopts);
-        device_set_wakeup_enable(&tp->pci_dev->dev, wol->wolopts);
-
         spin_unlock_irq(&tp->lock);
 
+        device_set_wakeup_enable(&tp->pci_dev->dev, wol->wolopts);
+
         return 0;
 }
 
@@ -2936,7 +2936,7 @@ static const struct rtl_cfg_info {
                 .hw_start       = rtl_hw_start_8168,
                 .region         = 2,
                 .align          = 8,
-                .intr_event     = SYSErr | RxFIFOOver | LinkChg | RxOverflow |
+                .intr_event     = SYSErr | LinkChg | RxOverflow |
                                   TxErr | TxOK | RxOK | RxErr,
                 .napi_event     = TxErr | TxOK | RxOK | RxOverflow,
                 .features       = RTL_FEATURE_GMII | RTL_FEATURE_MSI,
@@ -4455,14 +4455,12 @@ static inline int rtl8169_fragmented_frame(u32 status)
         return (status & (FirstFrag | LastFrag)) != (FirstFrag | LastFrag);
 }
 
-static inline void rtl8169_rx_csum(struct sk_buff *skb, struct RxDesc *desc)
+static inline void rtl8169_rx_csum(struct sk_buff *skb, u32 opts1)
 {
-        u32 opts1 = le32_to_cpu(desc->opts1);
         u32 status = opts1 & RxProtoMask;
 
         if (((status == RxProtoTCP) && !(opts1 & TCPFail)) ||
-            ((status == RxProtoUDP) && !(opts1 & UDPFail)) ||
-            ((status == RxProtoIP) && !(opts1 & IPFail)))
+            ((status == RxProtoUDP) && !(opts1 & UDPFail)))
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         else
                 skb->ip_summed = CHECKSUM_NONE;
@@ -4551,8 +4549,6 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                                 continue;
                         }
 
-                        rtl8169_rx_csum(skb, desc);
-
                         if (rtl8169_try_rx_copy(&skb, tp, pkt_size, addr)) {
                                 dma_sync_single_for_device(&pdev->dev, addr,
                                         pkt_size, PCI_DMA_FROMDEVICE);
@@ -4563,6 +4559,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                                 tp->Rx_skbuff[entry] = NULL;
                         }
 
+                        rtl8169_rx_csum(skb, status);
                         skb_put(skb, pkt_size);
                         skb->protocol = eth_type_trans(skb, dev);
 
@@ -4630,7 +4627,8 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
                 }
 
                 /* Work around for rx fifo overflow */
-                if (unlikely(status & RxFIFOOver)) {
+                if (unlikely(status & RxFIFOOver) &&
+                (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
                         netif_stop_queue(dev);
                         rtl8169_tx_timeout(dev);
                         break;
@@ -4891,6 +4889,9 @@ static int rtl8169_resume(struct device *device)
 {
         struct pci_dev *pdev = to_pci_dev(device);
         struct net_device *dev = pci_get_drvdata(pdev);
+        struct rtl8169_private *tp = netdev_priv(dev);
+
+        rtl8169_init_phy(dev, tp);
 
         if (netif_running(dev))
                 __rtl8169_resume(dev);
@@ -4931,6 +4932,8 @@ static int rtl8169_runtime_resume(struct device *device)
         tp->saved_wolopts = 0;
         spin_unlock_irq(&tp->lock);
 
+        rtl8169_init_phy(dev, tp);
+
         __rtl8169_resume(dev);
 
         return 0;
diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
index 737df6032bbc..2ce585a511d9 100644
--- a/drivers/net/tehuti.c
+++ b/drivers/net/tehuti.c
@@ -324,7 +324,7 @@ static int bdx_fw_load(struct bdx_priv *priv)
         ENTER;
         master = READ_REG(priv, regINIT_SEMAPHORE);
         if (!READ_REG(priv, regINIT_STATUS) && master) {
-                rc = request_firmware(&fw, "tehuti/firmware.bin", &priv->pdev->dev);
+                rc = request_firmware(&fw, "tehuti/bdx.bin", &priv->pdev->dev);
                 if (rc)
                         goto out;
                 bdx_tx_push_desc_safe(priv, (char *)fw->data, fw->size);
@@ -2516,4 +2516,4 @@ module_exit(bdx_module_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(BDX_DRV_DESC);
-MODULE_FIRMWARE("tehuti/firmware.bin");
+MODULE_FIRMWARE("tehuti/bdx.bin");
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index ca7fc9df1ccf..c04d49e31f81 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -45,6 +45,7 @@
 #include <linux/usb/usbnet.h>
 #include <linux/slab.h>
 #include <linux/kernel.h>
+#include <linux/pm_runtime.h>
 
 #define DRIVER_VERSION          "22-Aug-2005"
 
@@ -1273,6 +1274,16 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
         struct usb_device               *xdev;
         int                             status;
         const char                      *name;
+        struct usb_driver       *driver = to_usb_driver(udev->dev.driver);
+
+        /* usbnet already took usb runtime pm, so have to enable the feature
+         * for usb interface, otherwise usb_autopm_get_interface may return
+         * failure if USB_SUSPEND(RUNTIME_PM) is enabled.
+         */
+        if (!driver->supports_autosuspend) {
+                driver->supports_autosuspend = 1;
+                pm_runtime_enable(&udev->dev);
+        }
 
         name = udev->dev.driver->name;
         info = (struct driver_info *) prod->driver_info;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 4598e9d2608f..65d3d801a258 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -446,6 +446,20 @@ static void skb_recv_done(struct virtqueue *rvq)
         }
 }
 
+static void virtnet_napi_enable(struct virtnet_info *vi)
+{
+        napi_enable(&vi->napi);
+
+        /* If all buffers were filled by other side before we napi_enabled, we
+         * won't get another interrupt, so process any outstanding packets
+         * now.  virtnet_poll wants re-enable the queue, so we disable here.
+         * We synchronize against interrupts via NAPI_STATE_SCHED */
+        if (napi_schedule_prep(&vi->napi)) {
+                virtqueue_disable_cb(vi->rvq);
+                __napi_schedule(&vi->napi);
+        }
+}
+
 static void refill_work(struct work_struct *work)
 {
         struct virtnet_info *vi;
@@ -454,7 +468,7 @@ static void refill_work(struct work_struct *work)
         vi = container_of(work, struct virtnet_info, refill.work);
         napi_disable(&vi->napi);
         still_empty = !try_fill_recv(vi, GFP_KERNEL);
-        napi_enable(&vi->napi);
+        virtnet_napi_enable(vi);
 
         /* In theory, this can happen: if we don't get any buffers in
          * we will *never* try to fill again. */
@@ -638,16 +652,7 @@ static int virtnet_open(struct net_device *dev)
 {
         struct virtnet_info *vi = netdev_priv(dev);
 
-        napi_enable(&vi->napi);
-
-        /* If all buffers were filled by other side before we napi_enabled, we
-         * won't get another interrupt, so process any outstanding packets
-         * now.  virtnet_poll wants re-enable the queue, so we disable here.
-         * We synchronize against interrupts via NAPI_STATE_SCHED */
-        if (napi_schedule_prep(&vi->napi)) {
-                virtqueue_disable_cb(vi->rvq);
-                __napi_schedule(&vi->napi);
-        }
+        virtnet_napi_enable(vi);
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index d32f2828b098..a706202fa67c 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -119,6 +119,7 @@ struct ath_common {
 
         u32 keymax;
         DECLARE_BITMAP(keymap, ATH_KEYMAX);
+        DECLARE_BITMAP(tkip_keymap, ATH_KEYMAX);
         u8 splitmic;
 
         struct ath_regulatory regulatory;
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index fe7418aefc4a..d4ee07084c4d 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -710,10 +710,6 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
 
         /* Do NF cal only at longer intervals */
         if (longcal || nfcal_pending) {
-                /* Do periodic PAOffset Cal */
-                ar9002_hw_pa_cal(ah, false);
-                ar9002_hw_olc_temp_compensation(ah);
-
                 /*
                  * Get the value from the previous NF cal and update
                  * history buffer.
@@ -728,8 +724,12 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
                         ath9k_hw_loadnf(ah, ah->curchan);
                 }
 
-                if (longcal)
+                if (longcal) {
                         ath9k_hw_start_nfcal(ah, false);
+                        /* Do periodic PAOffset Cal */
+                        ar9002_hw_pa_cal(ah, false);
+                        ar9002_hw_olc_temp_compensation(ah);
+                }
         }
 
         return iscaldone;
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 303c63da5ea3..ab1c50b8326d 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -411,6 +411,9 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
                         val &= ~(AR_WA_BIT6 | AR_WA_BIT7);
                 }
 
+                if (AR_SREV_9280(ah))
+                        val |= AR_WA_BIT22;
+
                 if (AR_SREV_9285E_20(ah))
                         val |= AR_WA_BIT23;
 
@@ -442,9 +445,8 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
                 }
 
                 /* WAR for ASPM system hang */
-                if (AR_SREV_9280(ah) || AR_SREV_9285(ah) || AR_SREV_9287(ah)) {
+                if (AR_SREV_9285(ah) || AR_SREV_9287(ah))
                         val |= (AR_WA_BIT6 | AR_WA_BIT7);
-                }
 
                 if (AR_SREV_9285E_20(ah))
                         val |= AR_WA_BIT23;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index ec98ab50748a..a14a5e43cf56 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -34,6 +34,10 @@ static const u32 ar9300_2p2_radio_postamble[][5] = {
 
 static const u32 ar9300Modes_lowest_ob_db_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
@@ -99,6 +103,30 @@ static const u32 ar9300Modes_lowest_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a5f4, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
         {0x0000a5f8, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
         {0x0000a5fc, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x01404000, 0x01404000, 0x01404000, 0x01404000},
+        {0x0000a618, 0x01404501, 0x01404501, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x02008802, 0x02008802, 0x02008501, 0x02008501},
+        {0x0000a620, 0x0300cc03, 0x0300cc03, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x0300cc03, 0x0300cc03, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x03810c03, 0x03810c03, 0x04015005, 0x04015005},
+        {0x0000a630, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a634, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a638, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000c2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000c2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000c2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
         {0x00016048, 0x62480001, 0x62480001, 0x62480001, 0x62480001},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
@@ -118,7 +146,7 @@ static const u32 ar9300Modes_fast_clock_2p2[][3] = {
         {0x00008014, 0x044c044c, 0x08980898},
         {0x0000801c, 0x148ec02b, 0x148ec057},
         {0x00008318, 0x000044c0, 0x00008980},
-        {0x00009e00, 0x03721821, 0x03721821},
+        {0x00009e00, 0x0372131c, 0x0372131c},
         {0x0000a230, 0x0000000b, 0x00000016},
         {0x0000a254, 0x00000898, 0x00001130},
 };
@@ -595,15 +623,16 @@ static const u32 ar9300_2p2_baseband_postamble[][5] = {
         {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
         {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
         {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
-        {0x00009e00, 0x0372161e, 0x0372161e, 0x037216a0, 0x037216a0},
-        {0x00009e04, 0x00802020, 0x00802020, 0x00802020, 0x00802020},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
+        {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
         {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
         {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec84d2e},
-        {0x00009e14, 0x31395d5e, 0x3139605e, 0x3139605e, 0x31395d5e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3379605e, 0x33795d5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
         {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+        {0x00009e3c, 0xcf946220, 0xcf946220, 0xcf946222, 0xcf946222},
         {0x00009e44, 0x02321e27, 0x02321e27, 0x02291e27, 0x02291e27},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
@@ -624,16 +653,16 @@ static const u32 ar9300_2p2_baseband_postamble[][5] = {
         {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
         {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
         {0x0000a2d0, 0x00071981, 0x00071981, 0x00071981, 0x00071982},
-        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0xf999a83a, 0xf999a83a},
+        {0x0000a2d8, 0x7999a83a, 0x7999a83a, 0x7999a83a, 0x7999a83a},
         {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000ae04, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
         {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
         {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
         {0x0000b284, 0x00000000, 0x00000000, 0x00000150, 0x00000150},
         {0x0000b830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000be04, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000be04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
         {0x0000be18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000be1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
         {0x0000be20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
@@ -649,13 +678,13 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x00009814, 0x9280c00a},
         {0x00009818, 0x00000000},
         {0x0000981c, 0x00020028},
-        {0x00009834, 0x5f3ca3de},
+        {0x00009834, 0x6400a290},
         {0x00009838, 0x0108ecff},
         {0x0000983c, 0x14750600},
         {0x00009880, 0x201fff00},
         {0x00009884, 0x00001042},
         {0x000098a4, 0x00200400},
-        {0x000098b0, 0x52440bbe},
+        {0x000098b0, 0x32840bbe},
         {0x000098d0, 0x004b6a8e},
         {0x000098d4, 0x00000820},
         {0x000098dc, 0x00000000},
@@ -681,7 +710,6 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e3c, 0xcf946222},
         {0x00009e40, 0x0d261820},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
@@ -694,7 +722,7 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x0000a220, 0x00000000},
         {0x0000a224, 0x00000000},
         {0x0000a228, 0x10002310},
-        {0x0000a22c, 0x01036a1e},
+        {0x0000a22c, 0x01036a27},
         {0x0000a23c, 0x00000000},
         {0x0000a244, 0x0c000000},
         {0x0000a2a0, 0x00000001},
@@ -702,10 +730,6 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x0000a2c8, 0x00000000},
         {0x0000a2cc, 0x18c43433},
         {0x0000a2d4, 0x00000000},
-        {0x0000a2dc, 0x00000000},
-        {0x0000a2e0, 0x00000000},
-        {0x0000a2e4, 0x00000000},
-        {0x0000a2e8, 0x00000000},
         {0x0000a2ec, 0x00000000},
         {0x0000a2f0, 0x00000000},
         {0x0000a2f4, 0x00000000},
@@ -753,33 +777,17 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x0000a430, 0x1ce739ce},
         {0x0000a434, 0x00000000},
         {0x0000a438, 0x00001801},
-        {0x0000a43c, 0x00000000},
+        {0x0000a43c, 0x00100000},
         {0x0000a440, 0x00000000},
         {0x0000a444, 0x00000000},
         {0x0000a448, 0x06000080},
         {0x0000a44c, 0x00000001},
         {0x0000a450, 0x00010000},
         {0x0000a458, 0x00000000},
-        {0x0000a600, 0x00000000},
-        {0x0000a604, 0x00000000},
-        {0x0000a608, 0x00000000},
-        {0x0000a60c, 0x00000000},
-        {0x0000a610, 0x00000000},
-        {0x0000a614, 0x00000000},
-        {0x0000a618, 0x00000000},
-        {0x0000a61c, 0x00000000},
-        {0x0000a620, 0x00000000},
-        {0x0000a624, 0x00000000},
-        {0x0000a628, 0x00000000},
-        {0x0000a62c, 0x00000000},
-        {0x0000a630, 0x00000000},
-        {0x0000a634, 0x00000000},
-        {0x0000a638, 0x00000000},
-        {0x0000a63c, 0x00000000},
         {0x0000a640, 0x00000000},
         {0x0000a644, 0x3fad9d74},
         {0x0000a648, 0x0048060a},
-        {0x0000a64c, 0x00000637},
+        {0x0000a64c, 0x00003c37},
         {0x0000a670, 0x03020100},
         {0x0000a674, 0x09080504},
         {0x0000a678, 0x0d0c0b0a},
@@ -802,10 +810,6 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x0000a8f4, 0x00000000},
         {0x0000b2d0, 0x00000080},
         {0x0000b2d4, 0x00000000},
-        {0x0000b2dc, 0x00000000},
-        {0x0000b2e0, 0x00000000},
-        {0x0000b2e4, 0x00000000},
-        {0x0000b2e8, 0x00000000},
         {0x0000b2ec, 0x00000000},
         {0x0000b2f0, 0x00000000},
         {0x0000b2f4, 0x00000000},
@@ -820,10 +824,6 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x0000b8f4, 0x00000000},
         {0x0000c2d0, 0x00000080},
         {0x0000c2d4, 0x00000000},
-        {0x0000c2dc, 0x00000000},
-        {0x0000c2e0, 0x00000000},
-        {0x0000c2e4, 0x00000000},
-        {0x0000c2e8, 0x00000000},
         {0x0000c2ec, 0x00000000},
         {0x0000c2f0, 0x00000000},
         {0x0000c2f4, 0x00000000},
@@ -835,6 +835,10 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
 
 static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
         {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
@@ -855,7 +859,7 @@ static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
         {0x0000a540, 0x49005e72, 0x49005e72, 0x38001660, 0x38001660},
         {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x3b001861, 0x3b001861},
         {0x0000a548, 0x53005f12, 0x53005f12, 0x3e001a81, 0x3e001a81},
-        {0x0000a54c, 0x59025eb5, 0x59025eb5, 0x42001a83, 0x42001a83},
+        {0x0000a54c, 0x59025eb2, 0x59025eb2, 0x42001a83, 0x42001a83},
         {0x0000a550, 0x5e025f12, 0x5e025f12, 0x44001c84, 0x44001c84},
         {0x0000a554, 0x61027f12, 0x61027f12, 0x48001ce3, 0x48001ce3},
         {0x0000a558, 0x6702bf12, 0x6702bf12, 0x4c001ce5, 0x4c001ce5},
@@ -900,6 +904,30 @@ static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
         {0x0000a5f4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
         {0x0000a5f8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
         {0x0000a5fc, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x00804201, 0x00804201, 0x01404000, 0x01404000},
+        {0x0000a618, 0x0280c802, 0x0280c802, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x0280ca03, 0x0280ca03, 0x02008501, 0x02008501},
+        {0x0000a620, 0x04c15104, 0x04c15104, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x04c15305, 0x04c15305, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x04c15305, 0x04c15305, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a630, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000c2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000c2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000c2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00016044, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
         {0x00016048, 0xae480001, 0xae480001, 0xae480001, 0xae480001},
         {0x00016068, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
@@ -913,6 +941,10 @@ static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
 
 static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x01feee00, 0x01feee00, 0x00637800, 0x00637800},
+        {0x0000a2e0, 0x0000f000, 0x0000f000, 0x03838000, 0x03838000},
+        {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
         {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
@@ -933,7 +965,7 @@ static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a540, 0x49005e72, 0x49005e72, 0x38001660, 0x38001660},
         {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x3b001861, 0x3b001861},
         {0x0000a548, 0x53005f12, 0x53005f12, 0x3e001a81, 0x3e001a81},
-        {0x0000a54c, 0x59025eb5, 0x59025eb5, 0x42001a83, 0x42001a83},
+        {0x0000a54c, 0x59025eb2, 0x59025eb2, 0x42001a83, 0x42001a83},
         {0x0000a550, 0x5e025f12, 0x5e025f12, 0x44001c84, 0x44001c84},
         {0x0000a554, 0x61027f12, 0x61027f12, 0x48001ce3, 0x48001ce3},
         {0x0000a558, 0x6702bf12, 0x6702bf12, 0x4c001ce5, 0x4c001ce5},
@@ -978,6 +1010,30 @@ static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a5f4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
         {0x0000a5f8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
         {0x0000a5fc, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x00804201, 0x00804201, 0x01404000, 0x01404000},
+        {0x0000a618, 0x0280c802, 0x0280c802, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x0280ca03, 0x0280ca03, 0x02008501, 0x02008501},
+        {0x0000a620, 0x04c15104, 0x04c15104, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x04c15305, 0x04c15305, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x04c15305, 0x04c15305, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a630, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x01feee00, 0x01feee00, 0x00637800, 0x00637800},
+        {0x0000b2e0, 0x0000f000, 0x0000f000, 0x03838000, 0x03838000},
+        {0x0000b2e4, 0x01ff0000, 0x01ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000c2dc, 0x01feee00, 0x01feee00, 0x00637800, 0x00637800},
+        {0x0000c2e0, 0x0000f000, 0x0000f000, 0x03838000, 0x03838000},
+        {0x0000c2e4, 0x01ff0000, 0x01ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00016044, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
         {0x00016048, 0x8e480001, 0x8e480001, 0x8e480001, 0x8e480001},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
@@ -1151,14 +1207,14 @@ static const u32 ar9300Common_rx_gain_table_2p2[][2] = {
         {0x0000b074, 0x00000000},
         {0x0000b078, 0x00000000},
         {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x32323232},
-        {0x0000b084, 0x2f2f3232},
-        {0x0000b088, 0x23282a2d},
-        {0x0000b08c, 0x1c1e2123},
-        {0x0000b090, 0x14171919},
-        {0x0000b094, 0x0e0e1214},
-        {0x0000b098, 0x03050707},
-        {0x0000b09c, 0x00030303},
+        {0x0000b080, 0x2a2d2f32},
+        {0x0000b084, 0x21232328},
+        {0x0000b088, 0x19191c1e},
+        {0x0000b08c, 0x12141417},
+        {0x0000b090, 0x07070e0e},
+        {0x0000b094, 0x03030305},
+        {0x0000b098, 0x00000003},
+        {0x0000b09c, 0x00000000},
         {0x0000b0a0, 0x00000000},
         {0x0000b0a4, 0x00000000},
         {0x0000b0a8, 0x00000000},
@@ -1251,6 +1307,10 @@ static const u32 ar9300Common_rx_gain_table_2p2[][2] = {
 
 static const u32 ar9300Modes_low_ob_db_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
@@ -1316,6 +1376,30 @@ static const u32 ar9300Modes_low_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a5f4, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
         {0x0000a5f8, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
         {0x0000a5fc, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x01404000, 0x01404000, 0x01404000, 0x01404000},
+        {0x0000a618, 0x01404501, 0x01404501, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x02008802, 0x02008802, 0x02008501, 0x02008501},
+        {0x0000a620, 0x0300cc03, 0x0300cc03, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x0300cc03, 0x0300cc03, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x03810c03, 0x03810c03, 0x04015005, 0x04015005},
+        {0x0000a630, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a634, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a638, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000c2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000c2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000c2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
         {0x00016048, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
@@ -1414,15 +1498,10 @@ static const u32 ar9300_2p2_mac_core[][2] = {
         {0x00008144, 0xffffffff},
         {0x00008168, 0x00000000},
         {0x0000816c, 0x00000000},
-        {0x00008170, 0x18486200},
-        {0x00008174, 0x33332210},
-        {0x00008178, 0x00000000},
-        {0x0000817c, 0x00020000},
         {0x000081c0, 0x00000000},
         {0x000081c4, 0x33332210},
         {0x000081c8, 0x00000000},
         {0x000081cc, 0x00000000},
-        {0x000081d4, 0x00000000},
         {0x000081ec, 0x00000000},
         {0x000081f0, 0x00000000},
         {0x000081f4, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 057fb69ddf7f..5f03c534af6e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -22,12 +22,14 @@
 #define COMP_CKSUM_LEN 2
 
 #define AR_CH0_TOP (0x00016288)
-#define AR_CH0_TOP_XPABIASLVL (0x3)
+#define AR_CH0_TOP_XPABIASLVL (0x300)
 #define AR_CH0_TOP_XPABIASLVL_S (8)
 
 #define AR_CH0_THERM (0x00016290)
-#define AR_CH0_THERM_SPARE (0x3f)
-#define AR_CH0_THERM_SPARE_S (0)
+#define AR_CH0_THERM_XPABIASLVL_MSB 0x3
+#define AR_CH0_THERM_XPABIASLVL_MSB_S 0
+#define AR_CH0_THERM_XPASHORT2GND 0x4
+#define AR_CH0_THERM_XPASHORT2GND_S 2
 
 #define AR_SWITCH_TABLE_COM_ALL (0xffff)
 #define AR_SWITCH_TABLE_COM_ALL_S (0)
@@ -55,6 +57,8 @@
 #define SUB_NUM_CTL_MODES_AT_5G_40 2    /* excluding HT40, EXT-OFDM */
 #define SUB_NUM_CTL_MODES_AT_2G_40 3    /* excluding HT40, EXT-OFDM, EXT-CCK */
 
+#define CTL(_tpower, _flag) ((_tpower) | ((_flag) << 6))
+
 static const struct ar9300_eeprom ar9300_default = {
         .eepromVersion = 2,
         .templateVersion = 2,
@@ -290,20 +294,21 @@ static const struct ar9300_eeprom ar9300_default = {
                 }
          },
         .ctlPowerData_2G = {
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 1}, {60, 0}, {60, 0}, {60, 1} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                 { { {60, 1}, {60, 0}, {0, 0}, {0, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
          },
         .modalHeader5G = {
                 /* 4 idle,t1,t2,b (4 bits per setting) */
@@ -568,56 +573,56 @@ static const struct ar9300_eeprom ar9300_default = {
         .ctlPowerData_5G = {
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 0}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 0}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
+                                CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
                         }
                 },
          }
@@ -992,9 +997,9 @@ static s32 ar9003_hw_xpa_bias_level_get(struct ath_hw *ah, bool is2ghz)
 static void ar9003_hw_xpa_bias_level_apply(struct ath_hw *ah, bool is2ghz)
 {
         int bias = ar9003_hw_xpa_bias_level_get(ah, is2ghz);
-        REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, (bias & 0x3));
-        REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_SPARE,
-                      ((bias >> 2) & 0x3));
+        REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
+        REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPABIASLVL_MSB, bias >> 2);
+        REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPASHORT2GND, 1);
 }
 
 static u32 ar9003_hw_ant_ctrl_common_get(struct ath_hw *ah, bool is2ghz)
@@ -1827,9 +1832,9 @@ static u16 ar9003_hw_get_direct_edge_power(struct ar9300_eeprom *eep,
         struct cal_ctl_data_5g *ctl_5g = eep->ctlPowerData_5G;
 
         if (is2GHz)
-                return ctl_2g[idx].ctlEdges[edge].tPower;
+                return CTL_EDGE_TPOWER(ctl_2g[idx].ctlEdges[edge]);
         else
-                return ctl_5g[idx].ctlEdges[edge].tPower;
+                return CTL_EDGE_TPOWER(ctl_5g[idx].ctlEdges[edge]);
 }
 
 static u16 ar9003_hw_get_indirect_edge_power(struct ar9300_eeprom *eep,
@@ -1847,12 +1852,12 @@ static u16 ar9003_hw_get_indirect_edge_power(struct ar9300_eeprom *eep,
 
         if (is2GHz) {
                 if (ath9k_hw_fbin2freq(ctl_freqbin[edge - 1], 1) < freq &&
-                    ctl_2g[idx].ctlEdges[edge - 1].flag)
-                        return ctl_2g[idx].ctlEdges[edge - 1].tPower;
+                    CTL_EDGE_FLAGS(ctl_2g[idx].ctlEdges[edge - 1]))
+                        return CTL_EDGE_TPOWER(ctl_2g[idx].ctlEdges[edge - 1]);
         } else {
                 if (ath9k_hw_fbin2freq(ctl_freqbin[edge - 1], 0) < freq &&
-                    ctl_5g[idx].ctlEdges[edge - 1].flag)
-                        return ctl_5g[idx].ctlEdges[edge - 1].tPower;
+                    CTL_EDGE_FLAGS(ctl_5g[idx].ctlEdges[edge - 1]))
+                        return CTL_EDGE_TPOWER(ctl_5g[idx].ctlEdges[edge - 1]);
         }
 
         return AR9300_MAX_RATE_POWER;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
index 3c533bb983c7..655b3033396c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -261,17 +261,12 @@ struct cal_tgt_pow_ht {
         u8 tPow2x[14];
 } __packed;
 
-struct cal_ctl_edge_pwr {
-        u8 tPower:6,
-           flag:2;
-} __packed;
-
 struct cal_ctl_data_2g {
-        struct cal_ctl_edge_pwr ctlEdges[AR9300_NUM_BAND_EDGES_2G];
+        u8 ctlEdges[AR9300_NUM_BAND_EDGES_2G];
 } __packed;
 
 struct cal_ctl_data_5g {
-        struct cal_ctl_edge_pwr ctlEdges[AR9300_NUM_BAND_EDGES_5G];
+        u8 ctlEdges[AR9300_NUM_BAND_EDGES_5G];
 } __packed;
 
 struct ar9300_eeprom {
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index 5b995bee70ae..1a0ab706a18f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -616,7 +616,8 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
                         rxs->rs_status |= ATH9K_RXERR_DECRYPT;
                 } else if (rxsp->status11 & AR_MichaelErr) {
                         rxs->rs_status |= ATH9K_RXERR_MIC;
-                }
+                } else if (rxsp->status11 & AR_KeyMiss)
+                        rxs->rs_status |= ATH9K_RXERR_DECRYPT;
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 7c38229ba670..716db414c258 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -347,6 +347,10 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
             (((Y[6] - Y[3]) * 1 << scale_factor) +
              (x_est[6] - x_est[3])) / (x_est[6] - x_est[3]);
 
+        /* prevent division by zero */
+        if (G_fxp == 0)
+                return false;
+
         Y_intercept =
             (G_fxp * (x_est[0] - x_est[3]) +
              (1 << scale_factor)) / (1 << scale_factor) + Y[3];
@@ -356,14 +360,12 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
 
         for (i = 0; i <= 3; i++) {
                 y_est[i] = i * 32;
-
-                /* prevent division by zero */
-                if (G_fxp == 0)
-                        return false;
-
                 x_est[i] = ((y_est[i] * 1 << scale_factor) + G_fxp) / G_fxp;
         }
 
+        if (y_est[max_index] == 0)
+                return false;
+
         x_est_fxp1_nonlin =
             x_est[max_index] - ((1 << scale_factor) * y_est[max_index] +
                                 G_fxp) / G_fxp;
@@ -457,6 +459,8 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
 
         Q_scale_B = find_proper_scale(find_expn(abs(scale_B)), 10);
         scale_B = scale_B / (1 << Q_scale_B);
+        if (scale_B == 0)
+                return false;
         Q_beta = find_proper_scale(find_expn(abs(beta_raw)), 10);
         Q_alpha = find_proper_scale(find_expn(abs(alpha_raw)), 10);
         beta_raw = beta_raw / (1 << Q_beta);
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 07f26ee7a723..852745c2b752 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -177,8 +177,8 @@ void ath_descdma_cleanup(struct ath_softc *sc, struct ath_descdma *dd,
 
 /* returns delimiter padding required given the packet length */
 #define ATH_AGGR_GET_NDELIM(_len)                                       \
-        (((((_len) + ATH_AGGR_DELIM_SZ) < ATH_AGGR_MINPLEN) ?           \
-          (ATH_AGGR_MINPLEN - (_len) - ATH_AGGR_DELIM_SZ) : 0) >> 2)
+       (((_len) >= ATH_AGGR_MINPLEN) ? 0 :                             \
+        DIV_ROUND_UP(ATH_AGGR_MINPLEN - (_len), ATH_AGGR_DELIM_SZ))
 
 #define BAW_WITHIN(_start, _bawsz, _seqno) \
         ((((_seqno) - (_start)) & 4095) < (_bawsz))
@@ -312,7 +312,6 @@ struct ath_rx {
         u8 rxotherant;
         u32 *rxlink;
         unsigned int rxfilter;
-        spinlock_t rxflushlock;
         spinlock_t rxbuflock;
         struct list_head rxbuf;
         struct ath_descdma rxdma;
@@ -346,8 +345,8 @@ void ath_tx_tasklet(struct ath_softc *sc);
 void ath_tx_edma_tasklet(struct ath_softc *sc);
 void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb);
 bool ath_tx_aggr_check(struct ath_softc *sc, struct ath_node *an, u8 tidno);
-void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
-                       u16 tid, u16 *ssn);
+int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
+                      u16 tid, u16 *ssn);
 void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
 void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
 void ath9k_enable_ps(struct ath_softc *sc);
@@ -516,7 +515,6 @@ void ath_deinit_leds(struct ath_softc *sc);
 #define SC_OP_RXFLUSH                BIT(7)
 #define SC_OP_LED_ASSOCIATED         BIT(8)
 #define SC_OP_LED_ON                 BIT(9)
-#define SC_OP_SCANNING               BIT(10)
 #define SC_OP_TSF_RESET              BIT(11)
 #define SC_OP_BT_PRIORITY_DETECTED   BIT(12)
 #define SC_OP_BT_SCAN                BIT(13)
@@ -558,9 +556,9 @@ struct ath_softc {
         struct ath_hw *sc_ah;
         void __iomem *mem;
         int irq;
-        spinlock_t sc_resetlock;
         spinlock_t sc_serial_rw;
         spinlock_t sc_pm_lock;
+        spinlock_t sc_pcu_lock;
         struct mutex mutex;
         struct work_struct paprd_work;
         struct work_struct hw_check_work;
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 4d4b22d52dfd..20cf2d4e58b9 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -366,7 +366,7 @@ void ath_beacon_tasklet(unsigned long data)
                         ath_print(common, ATH_DBG_BEACON,
                                   "beacon is officially stuck\n");
                         sc->sc_flags |= SC_OP_TSF_RESET;
-                        ath_reset(sc, false);
+                        ath_reset(sc, true);
                 }
 
                 return;
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index c86f7d3593ab..108b43369f7c 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -366,9 +366,13 @@ int ath9k_cmn_key_config(struct ath_common *common,
         set_bit(idx, common->keymap);
         if (key->alg == ALG_TKIP) {
                 set_bit(idx + 64, common->keymap);
+                set_bit(idx, common->tkip_keymap);
+                set_bit(idx + 64, common->tkip_keymap);
                 if (common->splitmic) {
                         set_bit(idx + 32, common->keymap);
                         set_bit(idx + 64 + 32, common->keymap);
+                        set_bit(idx + 32, common->tkip_keymap);
+                        set_bit(idx + 64 + 32, common->tkip_keymap);
                 }
         }
 
@@ -393,10 +397,17 @@ void ath9k_cmn_key_delete(struct ath_common *common,
                 return;
 
         clear_bit(key->hw_key_idx + 64, common->keymap);
+
+        clear_bit(key->hw_key_idx, common->tkip_keymap);
+        clear_bit(key->hw_key_idx + 64, common->tkip_keymap);
+
         if (common->splitmic) {
                 ath9k_hw_keyreset(ah, key->hw_key_idx + 32);
                 clear_bit(key->hw_key_idx + 32, common->keymap);
                 clear_bit(key->hw_key_idx + 64 + 32, common->keymap);
+
+                clear_bit(key->hw_key_idx + 32, common->tkip_keymap);
+                clear_bit(key->hw_key_idx + 64 + 32, common->tkip_keymap);
         }
 }
 EXPORT_SYMBOL(ath9k_cmn_key_delete);
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index 1266333f586d..2bbf94d0191e 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -240,16 +240,16 @@ u16 ath9k_hw_get_max_edge_power(u16 freq, struct cal_ctl_edges *pRdEdgesPower,
         for (i = 0; (i < num_band_edges) &&
                      (pRdEdgesPower[i].bChannel != AR5416_BCHAN_UNUSED); i++) {
                 if (freq == ath9k_hw_fbin2freq(pRdEdgesPower[i].bChannel, is2GHz)) {
-                        twiceMaxEdgePower = pRdEdgesPower[i].tPower;
+                        twiceMaxEdgePower = CTL_EDGE_TPOWER(pRdEdgesPower[i].ctl);
                         break;
                 } else if ((i > 0) &&
                            (freq < ath9k_hw_fbin2freq(pRdEdgesPower[i].bChannel,
                                                       is2GHz))) {
                         if (ath9k_hw_fbin2freq(pRdEdgesPower[i - 1].bChannel,
                                                is2GHz) < freq &&
-                            pRdEdgesPower[i - 1].flag) {
+                            CTL_EDGE_FLAGS(pRdEdgesPower[i - 1].ctl)) {
                                 twiceMaxEdgePower =
-                                        pRdEdgesPower[i - 1].tPower;
+                                        CTL_EDGE_TPOWER(pRdEdgesPower[i - 1].ctl);
                         }
                         break;
                 }
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index 0b09db0f8e7d..17068f9c026e 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -233,6 +233,9 @@
 
 #define AR9287_CHECKSUM_LOCATION (AR9287_EEP_START_LOC + 1)
 
+#define CTL_EDGE_TPOWER(_ctl) ((_ctl) & 0x3f)
+#define CTL_EDGE_FLAGS(_ctl) (((_ctl) >> 6) & 0x03)
+
 enum eeprom_param {
         EEP_NFTHRESH_5,
         EEP_NFTHRESH_2,
@@ -533,18 +536,10 @@ struct cal_target_power_ht {
         u8 tPow2x[8];
 } __packed;
 
-
-#ifdef __BIG_ENDIAN_BITFIELD
-struct cal_ctl_edges {
-        u8 bChannel;
-        u8 flag:2, tPower:6;
-} __packed;
-#else
 struct cal_ctl_edges {
         u8 bChannel;
-        u8 tPower:6, flag:2;
+        u8 ctl;
 } __packed;
-#endif
 
 struct cal_data_op_loop_ar9287 {
         u8 pwrPdg[2][5];
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index dff2da777312..7cb356e8a531 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -37,7 +37,7 @@ static bool ath9k_hw_ar9287_fill_eeprom(struct ath_hw *ah)
         int addr, eep_start_loc;
         eep_data = (u16 *)eep;
 
-        if (ah->hw_version.devid == 0x7015)
+        if (AR9287_HTC_DEVID(ah))
                 eep_start_loc = AR9287_HTC_EEP_START_LOC;
         else
                 eep_start_loc = AR9287_EEP_START_LOC;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index afa2b73ddbdd..a48eb570a47c 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -1062,15 +1062,19 @@ static void ath9k_hw_set_def_power_per_rate_table(struct ath_hw *ah,
         case 1:
                 break;
         case 2:
-                scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
+                        scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                else
+                        scaledPower = 0;
                 break;
         case 3:
-                scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
+                        scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                else
+                        scaledPower = 0;
                 break;
         }
 
-        scaledPower = max((u16)0, scaledPower);
-
         if (IS_CHAN_2GHZ(chan)) {
                 numCtlModes = ARRAY_SIZE(ctlModesFor11g) -
                         SUB_NUM_CTL_MODES_AT_2G_40;
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 17e7a9a367e7..0e9bbb13ba66 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -35,8 +35,14 @@ static struct usb_device_id ath9k_hif_usb_ids[] = {
         { USB_DEVICE(0x07D1, 0x3A10) }, /* Dlink Wireless 150 */
         { USB_DEVICE(0x13D3, 0x3327) }, /* Azurewave */
         { USB_DEVICE(0x13D3, 0x3328) }, /* Azurewave */
+        { USB_DEVICE(0x13D3, 0x3346) }, /* IMC Networks */
+        { USB_DEVICE(0x13D3, 0x3348) }, /* Azurewave */
+        { USB_DEVICE(0x13D3, 0x3349) }, /* Azurewave */
+        { USB_DEVICE(0x13D3, 0x3350) }, /* Azurewave */
         { USB_DEVICE(0x04CA, 0x4605) }, /* Liteon */
         { USB_DEVICE(0x083A, 0xA704) }, /* SMC Networks */
+        { USB_DEVICE(0x040D, 0x3801) }, /* VIA */
+        { USB_DEVICE(0x1668, 0x1200) }, /* Verizon */
         { },
 };
 
@@ -138,16 +144,36 @@ static void hif_usb_tx_cb(struct urb *urb)
         case -ENODEV:
         case -ESHUTDOWN:
                 /*
-                 * The URB has been killed, free the SKBs
-                 * and return.
+                 * The URB has been killed, free the SKBs.
                  */
                 ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
-                return;
+
+                /*
+                 * If the URBs are being flushed, no need to add this
+                 * URB to the free list.
+                 */
+                spin_lock(&hif_dev->tx.tx_lock);
+                if (hif_dev->tx.flags & HIF_USB_TX_FLUSH) {
+                        spin_unlock(&hif_dev->tx.tx_lock);
+                        return;
+                }
+                spin_unlock(&hif_dev->tx.tx_lock);
+
+                /*
+                 * In the stop() case, this URB has to be added to
+                 * the free list.
+                 */
+                goto add_free;
         default:
                 break;
         }
 
-        /* Check if TX has been stopped */
+        /*
+         * Check if TX has been stopped, this is needed because
+         * this CB could have been invoked just after the TX lock
+         * was released in hif_stop() and kill_urb() hasn't been
+         * called yet.
+         */
         spin_lock(&hif_dev->tx.tx_lock);
         if (hif_dev->tx.flags & HIF_USB_TX_STOP) {
                 spin_unlock(&hif_dev->tx.tx_lock);
@@ -299,6 +325,7 @@ static void hif_usb_start(void *hif_handle, u8 pipe_id)
 static void hif_usb_stop(void *hif_handle, u8 pipe_id)
 {
         struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle;
+        struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
         unsigned long flags;
 
         spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
@@ -306,6 +333,12 @@ static void hif_usb_stop(void *hif_handle, u8 pipe_id)
         hif_dev->tx.tx_skb_cnt = 0;
         hif_dev->tx.flags |= HIF_USB_TX_STOP;
         spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
+        /* The pending URBs have to be canceled. */
+        list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+                                 &hif_dev->tx.tx_pending, list) {
+                usb_kill_urb(tx_buf->urb);
+        }
 }
 
 static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb,
@@ -571,6 +604,7 @@ free:
 static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
 {
         struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
+        unsigned long flags;
 
         list_for_each_entry_safe(tx_buf, tx_buf_tmp,
                                  &hif_dev->tx.tx_buf, list) {
@@ -581,6 +615,10 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
                 kfree(tx_buf);
         }
 
+        spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+        hif_dev->tx.flags |= HIF_USB_TX_FLUSH;
+        spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
         list_for_each_entry_safe(tx_buf, tx_buf_tmp,
                                  &hif_dev->tx.tx_pending, list) {
                 usb_kill_urb(tx_buf->urb);
@@ -799,10 +837,18 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
         }
         kfree(buf);
 
-        if ((hif_dev->device_id == 0x7010) || (hif_dev->device_id == 0x7015))
+        switch (hif_dev->device_id) {
+        case 0x7010:
+        case 0x7015:
+        case 0x9018:
+        case 0xA704:
+        case 0x1200:
                 firm_offset = AR7010_FIRMWARE_TEXT;
-        else
+                break;
+        default:
                 firm_offset = AR9271_FIRMWARE_TEXT;
+                break;
+        }
 
         /*
          * Issue FW download complete command to firmware.
@@ -903,6 +949,8 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
         case 0x7010:
         case 0x7015:
         case 0x9018:
+        case 0xA704:
+        case 0x1200:
                 if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x0202)
                         hif_dev->fw_name = FIRMWARE_AR7010_1_1;
                 else
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
index 2daf97b11c08..30d09389d437 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
@@ -62,6 +62,7 @@ struct tx_buf {
 };
 
 #define HIF_USB_TX_STOP  BIT(0)
+#define HIF_USB_TX_FLUSH BIT(1)
 
 struct hif_usb_tx {
         u8 flags;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 2d4279191d7a..e5a0122fc341 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -247,6 +247,8 @@ static int ath9k_init_htc_services(struct ath9k_htc_priv *priv, u16 devid)
         case 0x7010:
         case 0x7015:
         case 0x9018:
+        case 0xA704:
+        case 0x1200:
                 priv->htc->credits = 45;
                 break;
         default:
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 2a6e45a293a9..f06eeab2a572 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -121,7 +121,7 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
                         tx_hdr.data_type = ATH9K_HTC_NORMAL;
                 }
 
-                if (ieee80211_is_data(fc)) {
+                if (ieee80211_is_data_qos(fc)) {
                         qc = ieee80211_get_qos_ctl(hdr);
                         tx_hdr.tidno = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
                 }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 3384ca164562..5250c8dc83e1 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -387,6 +387,9 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         else
                 ah->config.ht_enable = 0;
 
+        /* PAPRD needs some more work to be enabled */
+        ah->config.paprd_disable = 1;
+
         ah->config.rx_intr_mitigation = true;
         ah->config.pcieSerDesWrite = true;
 
@@ -486,6 +489,7 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
                 ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
                           "Failed allocating banks for "
                           "external radio\n");
+                ath9k_hw_rf_free_ext_banks(ah);
                 return ecode;
         }
 
@@ -2263,7 +2267,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->rx_status_len = sizeof(struct ar9003_rxs);
                 pCap->tx_desc_len = sizeof(struct ar9003_txc);
                 pCap->txs_len = sizeof(struct ar9003_txs);
-                if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+                if (!ah->config.paprd_disable &&
+                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
                         pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
         } else {
                 pCap->tx_desc_len = sizeof(struct ath_desc);
@@ -2350,7 +2355,8 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio)
                 val = REG_READ(ah, AR7010_GPIO_IN);
                 return (MS(val, AR7010_GPIO_IN_VAL) & AR_GPIO_BIT(gpio)) == 0;
         } else if (AR_SREV_9300_20_OR_LATER(ah))
-                return MS_REG_READ(AR9300, gpio) != 0;
+                return (MS(REG_READ(ah, AR_GPIO_IN), AR9300_GPIO_IN_VAL) &
+                        AR_GPIO_BIT(gpio)) != 0;
         else if (AR_SREV_9271(ah))
                 return MS_REG_READ(AR9271, gpio) != 0;
         else if (AR_SREV_9287_10_OR_LATER(ah))
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 399f7c1283cd..e58ff11cb85c 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -240,6 +240,7 @@ struct ath9k_ops_config {
         u32 pcie_waen;
         u8 analog_shiftreg;
         u8 ht_enable;
+        u8 paprd_disable;
         u32 ofdm_trig_low;
         u32 ofdm_trig_high;
         u32 cck_trig_high;
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 243c1775f343..2e4724f1c662 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -56,7 +56,7 @@ MODULE_PARM_DESC(blink, "Enable LED blink on activity");
  * on 5 MHz steps, we support the channels which we know
  * we have calibration data for all cards though to make
  * this static */
-static struct ieee80211_channel ath9k_2ghz_chantable[] = {
+static const struct ieee80211_channel ath9k_2ghz_chantable[] = {
         CHAN2G(2412, 0), /* Channel 1 */
         CHAN2G(2417, 1), /* Channel 2 */
         CHAN2G(2422, 2), /* Channel 3 */
@@ -77,7 +77,7 @@ static struct ieee80211_channel ath9k_2ghz_chantable[] = {
  * on 5 MHz steps, we support the channels which we know
  * we have calibration data for all cards though to make
  * this static */
-static struct ieee80211_channel ath9k_5ghz_chantable[] = {
+static const struct ieee80211_channel ath9k_5ghz_chantable[] = {
         /* _We_ call this UNII 1 */
         CHAN5G(5180, 14), /* Channel 36 */
         CHAN5G(5200, 15), /* Channel 40 */
@@ -477,10 +477,17 @@ err:
         return -EIO;
 }
 
-static void ath9k_init_channels_rates(struct ath_softc *sc)
+static int ath9k_init_channels_rates(struct ath_softc *sc)
 {
+        void *channels;
+
         if (test_bit(ATH9K_MODE_11G, sc->sc_ah->caps.wireless_modes)) {
-                sc->sbands[IEEE80211_BAND_2GHZ].channels = ath9k_2ghz_chantable;
+                channels = kmemdup(ath9k_2ghz_chantable,
+                        sizeof(ath9k_2ghz_chantable), GFP_KERNEL);
+                if (!channels)
+                    return -ENOMEM;
+
+                sc->sbands[IEEE80211_BAND_2GHZ].channels = channels;
                 sc->sbands[IEEE80211_BAND_2GHZ].band = IEEE80211_BAND_2GHZ;
                 sc->sbands[IEEE80211_BAND_2GHZ].n_channels =
                         ARRAY_SIZE(ath9k_2ghz_chantable);
@@ -490,7 +497,15 @@ static void ath9k_init_channels_rates(struct ath_softc *sc)
         }
 
         if (test_bit(ATH9K_MODE_11A, sc->sc_ah->caps.wireless_modes)) {
-                sc->sbands[IEEE80211_BAND_5GHZ].channels = ath9k_5ghz_chantable;
+                channels = kmemdup(ath9k_5ghz_chantable,
+                        sizeof(ath9k_5ghz_chantable), GFP_KERNEL);
+                if (!channels) {
+                        if (sc->sbands[IEEE80211_BAND_2GHZ].channels)
+                                kfree(sc->sbands[IEEE80211_BAND_2GHZ].channels);
+                        return -ENOMEM;
+                }
+
+                sc->sbands[IEEE80211_BAND_5GHZ].channels = channels;
                 sc->sbands[IEEE80211_BAND_5GHZ].band = IEEE80211_BAND_5GHZ;
                 sc->sbands[IEEE80211_BAND_5GHZ].n_channels =
                         ARRAY_SIZE(ath9k_5ghz_chantable);
@@ -499,6 +514,7 @@ static void ath9k_init_channels_rates(struct ath_softc *sc)
                 sc->sbands[IEEE80211_BAND_5GHZ].n_bitrates =
                         ARRAY_SIZE(ath9k_legacy_rates) - 4;
         }
+        return 0;
 }
 
 static void ath9k_init_misc(struct ath_softc *sc)
@@ -558,7 +574,6 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
         common->debug_mask = ath9k_debug;
 
         spin_lock_init(&sc->wiphy_lock);
-        spin_lock_init(&sc->sc_resetlock);
         spin_lock_init(&sc->sc_serial_rw);
         spin_lock_init(&sc->sc_pm_lock);
         mutex_init(&sc->mutex);
@@ -593,8 +608,11 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
         if (ret)
                 goto err_btcoex;
 
+        ret = ath9k_init_channels_rates(sc);
+        if (ret)
+                goto err_btcoex;
+
         ath9k_init_crypto(sc);
-        ath9k_init_channels_rates(sc);
         ath9k_init_misc(sc);
 
         return 0;
@@ -641,7 +659,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 BIT(NL80211_IFTYPE_ADHOC) |
                 BIT(NL80211_IFTYPE_MESH_POINT);
 
-        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+        if (AR_SREV_5416(sc->sc_ah))
+                hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
         hw->queues = 4;
         hw->max_rates = 4;
@@ -751,6 +770,12 @@ static void ath9k_deinit_softc(struct ath_softc *sc)
 {
         int i = 0;
 
+        if (sc->sbands[IEEE80211_BAND_2GHZ].channels)
+                kfree(sc->sbands[IEEE80211_BAND_2GHZ].channels);
+
+        if (sc->sbands[IEEE80211_BAND_5GHZ].channels)
+                kfree(sc->sbands[IEEE80211_BAND_5GHZ].channels);
+
         if ((sc->btcoex.no_stomp_timer) &&
             sc->sc_ah->btcoex_hw.scheme == ATH_BTCOEX_CFG_3WIRE)
                 ath_gen_timer_free(sc->sc_ah, sc->btcoex.no_stomp_timer);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index e955bb9d98cb..79302b1e0910 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -713,6 +713,8 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
                         rs->rs_status |= ATH9K_RXERR_DECRYPT;
                 else if (ads.ds_rxstatus8 & AR_MichaelErr)
                         rs->rs_status |= ATH9K_RXERR_MIC;
+                else if (ads.ds_rxstatus8 & AR_KeyMiss)
+                        rs->rs_status |= ATH9K_RXERR_DECRYPT;
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 3caa32316e7b..9790d3a86535 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -213,6 +213,9 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
          */
         ath9k_hw_set_interrupts(ah, 0);
         ath_drain_all_txq(sc, false);
+
+        spin_lock_bh(&sc->sc_pcu_lock);
+
         stopped = ath_stoprecv(sc);
 
         /* XXX: do not flush receive queue here. We don't want
@@ -230,34 +233,35 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
                   sc->sc_ah->curchan->channel,
                   channel->center_freq, conf_is_ht40(conf));
 
-        spin_lock_bh(&sc->sc_resetlock);
-
         r = ath9k_hw_reset(ah, hchan, caldata, fastcc);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset channel (%u MHz), "
                           "reset status %d\n",
                           channel->center_freq, r);
-                spin_unlock_bh(&sc->sc_resetlock);
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 goto ps_restore;
         }
-        spin_unlock_bh(&sc->sc_resetlock);
 
         if (ath_startrecv(sc) != 0) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to restart recv logic\n");
                 r = -EIO;
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 goto ps_restore;
         }
 
+        spin_unlock_bh(&sc->sc_pcu_lock);
+
         ath_cache_conf_rate(sc, &hw->conf);
         ath_update_txpow(sc);
         ath9k_hw_set_interrupts(ah, ah->imask);
 
-        if (!(sc->sc_flags & (SC_OP_OFFCHANNEL | SC_OP_SCANNING))) {
-                ath_start_ani(common);
+        if (!(sc->sc_flags & (SC_OP_OFFCHANNEL))) {
+                if (sc->sc_flags & SC_OP_BEACONS)
+                        ath_beacon_config(sc, NULL);
                 ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
-                ath_beacon_config(sc, NULL);
+                ath_start_ani(common);
         }
 
  ps_restore:
@@ -269,6 +273,7 @@ static void ath_paprd_activate(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath9k_hw_cal_data *caldata = ah->caldata;
+        struct ath_common *common = ath9k_hw_common(ah);
         int chain;
 
         if (!caldata || !caldata->paprd_done)
@@ -277,7 +282,7 @@ static void ath_paprd_activate(struct ath_softc *sc)
         ath9k_ps_wakeup(sc);
         ar9003_paprd_enable(ah, false);
         for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
-                if (!(ah->caps.tx_chainmask & BIT(chain)))
+                if (!(common->tx_chainmask & BIT(chain)))
                         continue;
 
                 ar9003_paprd_populate_single_table(ah, caldata, chain);
@@ -299,6 +304,7 @@ void ath_paprd_calibrate(struct work_struct *work)
         struct ieee80211_supported_band *sband = &sc->sbands[band];
         struct ath_tx_control txctl;
         struct ath9k_hw_cal_data *caldata = ah->caldata;
+        struct ath_common *common = ath9k_hw_common(ah);
         int qnum, ftype;
         int chain_ok = 0;
         int chain;
@@ -332,7 +338,7 @@ void ath_paprd_calibrate(struct work_struct *work)
         ath9k_ps_wakeup(sc);
         ar9003_paprd_init_table(ah);
         for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
-                if (!(ah->caps.tx_chainmask & BIT(chain)))
+                if (!(common->tx_chainmask & BIT(chain)))
                         continue;
 
                 chain_ok = 0;
@@ -550,7 +556,7 @@ void ath_hw_check(struct work_struct *work)
 
                 msleep(1);
         }
-        ath_reset(sc, false);
+        ath_reset(sc, true);
 
 out:
         ath9k_ps_restore(sc);
@@ -568,7 +574,7 @@ void ath9k_tasklet(unsigned long data)
         ath9k_ps_wakeup(sc);
 
         if (status & ATH9K_INT_FATAL) {
-                ath_reset(sc, false);
+                ath_reset(sc, true);
                 ath9k_ps_restore(sc);
                 return;
         }
@@ -583,7 +589,7 @@ void ath9k_tasklet(unsigned long data)
                 rxmask = (ATH9K_INT_RX | ATH9K_INT_RXEOL | ATH9K_INT_RXORN);
 
         if (status & rxmask) {
-                spin_lock_bh(&sc->rx.rxflushlock);
+                spin_lock_bh(&sc->sc_pcu_lock);
 
                 /* Check for high priority Rx first */
                 if ((ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
@@ -591,7 +597,7 @@ void ath9k_tasklet(unsigned long data)
                         ath_rx_tasklet(sc, 0, true);
 
                 ath_rx_tasklet(sc, 0, false);
-                spin_unlock_bh(&sc->rx.rxflushlock);
+                spin_unlock_bh(&sc->sc_pcu_lock);
         }
 
         if (status & ATH9K_INT_TX) {
@@ -838,7 +844,7 @@ void ath_radio_enable(struct ath_softc *sc, struct ieee80211_hw *hw)
         if (!ah->curchan)
                 ah->curchan = ath_get_curchannel(sc, sc->hw);
 
-        spin_lock_bh(&sc->sc_resetlock);
+        spin_lock_bh(&sc->sc_pcu_lock);
         r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
@@ -846,14 +852,15 @@ void ath_radio_enable(struct ath_softc *sc, struct ieee80211_hw *hw)
                           "reset status %d\n",
                           channel->center_freq, r);
         }
-        spin_unlock_bh(&sc->sc_resetlock);
 
         ath_update_txpow(sc);
         if (ath_startrecv(sc) != 0) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to restart recv logic\n");
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 return;
         }
+        spin_unlock_bh(&sc->sc_pcu_lock);
 
         if (sc->sc_flags & SC_OP_BEACONS)
                 ath_beacon_config(sc, NULL);    /* restart beacons */
@@ -892,13 +899,15 @@ void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
         ath9k_hw_set_interrupts(ah, 0);
 
         ath_drain_all_txq(sc, false);   /* clear pending tx frames */
+
+        spin_lock_bh(&sc->sc_pcu_lock);
+
         ath_stoprecv(sc);               /* turn off frame recv */
         ath_flushrecv(sc);              /* flush recv queue */
 
         if (!ah->curchan)
                 ah->curchan = ath_get_curchannel(sc, hw);
 
-        spin_lock_bh(&sc->sc_resetlock);
         r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         if (r) {
                 ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
@@ -906,9 +915,11 @@ void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
                           "reset status %d\n",
                           channel->center_freq, r);
         }
-        spin_unlock_bh(&sc->sc_resetlock);
 
         ath9k_hw_phy_disable(ah);
+
+        spin_unlock_bh(&sc->sc_pcu_lock);
+
         ath9k_hw_configpcipowersave(ah, 1, 1);
         ath9k_ps_restore(sc);
         ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
@@ -928,20 +939,23 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
 
         ath9k_hw_set_interrupts(ah, 0);
         ath_drain_all_txq(sc, retry_tx);
+
+        spin_lock_bh(&sc->sc_pcu_lock);
+
         ath_stoprecv(sc);
         ath_flushrecv(sc);
 
-        spin_lock_bh(&sc->sc_resetlock);
         r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
         if (r)
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d\n", r);
-        spin_unlock_bh(&sc->sc_resetlock);
 
         if (ath_startrecv(sc) != 0)
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to start recv logic\n");
 
+        spin_unlock_bh(&sc->sc_pcu_lock);
+
         /*
          * We may be doing a reset in response to a request
          * that changes the channel so update any state that
@@ -951,7 +965,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
 
         ath_update_txpow(sc);
 
-        if (sc->sc_flags & SC_OP_BEACONS)
+        if ((sc->sc_flags & SC_OP_BEACONS) || !(sc->sc_flags & (SC_OP_OFFCHANNEL)))
                 ath_beacon_config(sc, NULL);    /* restart beacons */
 
         ath9k_hw_set_interrupts(ah, ah->imask);
@@ -1106,17 +1120,16 @@ static int ath9k_start(struct ieee80211_hw *hw)
          * be followed by initialization of the appropriate bits
          * and then setup of the interrupt mask.
          */
-        spin_lock_bh(&sc->sc_resetlock);
+        spin_lock_bh(&sc->sc_pcu_lock);
         r = ath9k_hw_reset(ah, init_channel, ah->caldata, false);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d "
                           "(freq %u MHz)\n", r,
                           curchan->center_freq);
-                spin_unlock_bh(&sc->sc_resetlock);
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 goto mutex_unlock;
         }
-        spin_unlock_bh(&sc->sc_resetlock);
 
         /*
          * This is needed only to setup initial state
@@ -1135,8 +1148,10 @@ static int ath9k_start(struct ieee80211_hw *hw)
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to start recv logic\n");
                 r = -EIO;
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 goto mutex_unlock;
         }
+        spin_unlock_bh(&sc->sc_pcu_lock);
 
         /* Setup our intr mask. */
         ah->imask = ATH9K_INT_TX | ATH9K_INT_RXEOL |
@@ -1340,18 +1355,24 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         if (!(sc->sc_flags & SC_OP_INVALID)) {
                 ath_drain_all_txq(sc, false);
+                spin_lock_bh(&sc->sc_pcu_lock);
                 ath_stoprecv(sc);
                 ath9k_hw_phy_disable(ah);
-        } else
+                spin_unlock_bh(&sc->sc_pcu_lock);
+        } else {
+                spin_lock_bh(&sc->sc_pcu_lock);
                 sc->rx.rxlink = NULL;
+                spin_unlock_bh(&sc->sc_pcu_lock);
+        }
 
         /* disable HAL and put h/w to sleep */
         ath9k_hw_disable(ah);
         ath9k_hw_configpcipowersave(ah, 1, 1);
         ath9k_ps_restore(sc);
 
-        /* Finally, put the chip in FULL SLEEP mode */
-        ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
+        sc->ps_idle = true;
+        ath9k_set_wiphy_idle(aphy, true);
+        ath_radio_disable(sc, hw);
 
         sc->sc_flags |= SC_OP_INVALID;
 
@@ -1455,6 +1476,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
         struct ath_softc *sc = aphy->sc;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_vif *avp = (void *)vif->drv_priv;
+        bool bs_valid = false;
         int i;
 
         ath_print(common, ATH_DBG_CONFIG, "Detach Interface\n");
@@ -1483,7 +1505,15 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
                                "slot\n", __func__);
                         sc->beacon.bslot[i] = NULL;
                         sc->beacon.bslot_aphy[i] = NULL;
-                }
+                } else if (sc->beacon.bslot[i])
+                        bs_valid = true;
+        }
+        if (!bs_valid && (sc->sc_ah->imask & ATH9K_INT_SWBA)) {
+                /* Disable SWBA interrupt */
+                sc->sc_ah->imask &= ~ATH9K_INT_SWBA;
+                ath9k_ps_wakeup(sc);
+                ath9k_hw_set_interrupts(sc->sc_ah, sc->sc_ah->imask);
+                ath9k_ps_restore(sc);
         }
 
         sc->nvifs--;
@@ -1556,6 +1586,8 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
          * IEEE80211_CONF_CHANGE_PS is only passed by mac80211 for STA mode.
          */
         if (changed & IEEE80211_CONF_CHANGE_PS) {
+                unsigned long flags;
+                spin_lock_irqsave(&sc->sc_pm_lock, flags);
                 if (conf->flags & IEEE80211_CONF_PS) {
                         sc->ps_flags |= PS_ENABLED;
                         /*
@@ -1570,7 +1602,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                         sc->ps_enabled = false;
                         sc->ps_flags &= ~(PS_ENABLED |
                                           PS_NULLFUNC_COMPLETED);
-                        ath9k_setpower(sc, ATH9K_PM_AWAKE);
+                        ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
                         if (!(ah->caps.hw_caps &
                               ATH9K_HW_CAP_AUTOSLEEP)) {
                                 ath9k_hw_setrxabort(sc->sc_ah, 0);
@@ -1585,6 +1617,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                                 }
                         }
                 }
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
         }
 
         if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
@@ -1968,8 +2001,9 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
                 break;
         case IEEE80211_AMPDU_TX_START:
                 ath9k_ps_wakeup(sc);
-                ath_tx_aggr_start(sc, sta, tid, ssn);
-                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                ret = ath_tx_aggr_start(sc, sta, tid, ssn);
+                if (!ret)
+                        ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 ath9k_ps_restore(sc);
                 break;
         case IEEE80211_AMPDU_TX_STOP:
@@ -2032,7 +2066,6 @@ static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
 
         aphy->state = ATH_WIPHY_SCAN;
         ath9k_wiphy_pause_all_forced(sc, aphy);
-        sc->sc_flags |= SC_OP_SCANNING;
         mutex_unlock(&sc->mutex);
 }
 
@@ -2047,7 +2080,6 @@ static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
 
         mutex_lock(&sc->mutex);
         aphy->state = ATH_WIPHY_ACTIVE;
-        sc->sc_flags &= ~SC_OP_SCANNING;
         mutex_unlock(&sc->mutex);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index b5b651413e77..894ebadbb1d3 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -290,6 +290,10 @@ static int ath_pci_resume(struct pci_dev *pdev)
                             AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
         ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
 
+        sc->ps_idle = true;
+        ath9k_set_wiphy_idle(aphy, true);
+        ath_radio_disable(sc, hw);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index e49be733d546..5f825cec5b4d 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -538,7 +538,7 @@ static u8 ath_rc_setvalid_rates(struct ath_rate_priv *ath_rc_priv,
         for (i = 0; i < rateset->rs_nrates; i++) {
                 for (j = 0; j < rate_table->rate_cnt; j++) {
                         u32 phy = rate_table->info[j].phy;
-                        u16 rate_flags = rate_table->info[i].rate_flags;
+                        u16 rate_flags = rate_table->info[j].rate_flags;
                         u8 rate = rateset->rs_rates[i];
                         u8 dot11rate = rate_table->info[j].dot11rate;
 
@@ -1359,6 +1359,12 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
         if (tx_info->flags & IEEE80211_TX_STAT_TX_FILTERED)
                 return;
 
+        if (!(tx_info->flags & IEEE80211_TX_STAT_AMPDU)) {
+                tx_info->status.ampdu_ack_len =
+                        (tx_info->flags & IEEE80211_TX_STAT_ACK ? 1 : 0);
+                tx_info->status.ampdu_len = 1;
+        }
+
         /*
          * If an underrun error is seen assume it as an excessive retry only
          * if max frame trigger level has been reached (2 KB for singel stream,
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index a3fc987ebab0..912f747593cd 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -288,19 +288,17 @@ static void ath_edma_start_recv(struct ath_softc *sc)
         ath_rx_addbuffer_edma(sc, ATH9K_RX_QUEUE_LP,
                               sc->rx.rx_edma[ATH9K_RX_QUEUE_LP].rx_fifo_hwsize);
 
-        spin_unlock_bh(&sc->rx.rxbuflock);
-
         ath_opmode_init(sc);
 
-        ath9k_hw_startpcureceive(sc->sc_ah, (sc->sc_flags & SC_OP_SCANNING));
+        ath9k_hw_startpcureceive(sc->sc_ah, (sc->sc_flags & SC_OP_OFFCHANNEL));
+
+        spin_unlock_bh(&sc->rx.rxbuflock);
 }
 
 static void ath_edma_stop_recv(struct ath_softc *sc)
 {
-        spin_lock_bh(&sc->rx.rxbuflock);
         ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_HP);
         ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_LP);
-        spin_unlock_bh(&sc->rx.rxbuflock);
 }
 
 int ath_rx_init(struct ath_softc *sc, int nbufs)
@@ -310,7 +308,7 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
         struct ath_buf *bf;
         int error = 0;
 
-        spin_lock_init(&sc->rx.rxflushlock);
+        spin_lock_init(&sc->sc_pcu_lock);
         sc->sc_flags &= ~SC_OP_RXFLUSH;
         spin_lock_init(&sc->rx.rxbuflock);
 
@@ -496,9 +494,10 @@ int ath_startrecv(struct ath_softc *sc)
         ath9k_hw_rxena(ah);
 
 start_recv:
-        spin_unlock_bh(&sc->rx.rxbuflock);
         ath_opmode_init(sc);
-        ath9k_hw_startpcureceive(ah, (sc->sc_flags & SC_OP_SCANNING));
+        ath9k_hw_startpcureceive(ah, (sc->sc_flags & SC_OP_OFFCHANNEL));
+
+        spin_unlock_bh(&sc->rx.rxbuflock);
 
         return 0;
 }
@@ -508,7 +507,8 @@ bool ath_stoprecv(struct ath_softc *sc)
         struct ath_hw *ah = sc->sc_ah;
         bool stopped;
 
-        ath9k_hw_stoppcurecv(ah);
+        spin_lock_bh(&sc->rx.rxbuflock);
+        ath9k_hw_abortpcurecv(ah);
         ath9k_hw_setrxfilter(ah, 0);
         stopped = ath9k_hw_stopdmarecv(ah);
 
@@ -516,19 +516,18 @@ bool ath_stoprecv(struct ath_softc *sc)
                 ath_edma_stop_recv(sc);
         else
                 sc->rx.rxlink = NULL;
+        spin_unlock_bh(&sc->rx.rxbuflock);
 
         return stopped;
 }
 
 void ath_flushrecv(struct ath_softc *sc)
 {
-        spin_lock_bh(&sc->rx.rxflushlock);
         sc->sc_flags |= SC_OP_RXFLUSH;
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
                 ath_rx_tasklet(sc, 1, true);
         ath_rx_tasklet(sc, 1, false);
         sc->sc_flags &= ~SC_OP_RXFLUSH;
-        spin_unlock_bh(&sc->rx.rxflushlock);
 }
 
 static bool ath_beacon_dtim_pending_cab(struct sk_buff *skb)
@@ -631,7 +630,7 @@ static void ath_rx_ps(struct ath_softc *sc, struct sk_buff *skb)
                  * No more broadcast/multicast frames to be received at this
                  * point.
                  */
-                sc->ps_flags &= ~PS_WAIT_FOR_CAB;
+                sc->ps_flags &= ~(PS_WAIT_FOR_CAB | PS_WAIT_FOR_BEACON);
                 ath_print(common, ATH_DBG_PS,
                           "All PS CAB frames received, back to sleep\n");
         } else if ((sc->ps_flags & PS_WAIT_FOR_PSPOLL_DATA) &&
@@ -870,15 +869,18 @@ static bool ath9k_rx_accept(struct ath_common *common,
                 if (rx_stats->rs_status & ATH9K_RXERR_DECRYPT) {
                         *decrypt_error = true;
                 } else if (rx_stats->rs_status & ATH9K_RXERR_MIC) {
-                        if (ieee80211_is_ctl(fc))
-                                /*
-                                 * Sometimes, we get invalid
-                                 * MIC failures on valid control frames.
-                                 * Remove these mic errors.
-                                 */
-                                rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
-                        else
+                        /*
+                         * The MIC error bit is only valid if the frame
+                         * is not a control frame or fragment, and it was
+                         * decrypted using a valid TKIP key.
+                         */
+                        if (!ieee80211_is_ctl(fc) &&
+                            !ieee80211_has_morefrags(fc) &&
+                            !(le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG) &&
+                            test_bit(rx_stats->rs_keyix, common->tkip_keymap))
                                 rxs->flag |= RX_FLAG_MMIC_ERROR;
+                        else
+                                rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
                 }
                 /*
                  * Reject error frames with the exception of
@@ -1033,9 +1035,11 @@ static void ath9k_rx_skb_postprocess(struct ath_common *common,
         int hdrlen, padpos, padsize;
         u8 keyix;
         __le16 fc;
+        bool is_mc;
 
         /* see if any padding is done by the hw and remove it */
         hdr = (struct ieee80211_hdr *) skb->data;
+        is_mc = !!is_multicast_ether_addr(hdr->addr1);
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
         fc = hdr->frame_control;
         padpos = ath9k_cmn_padpos(hdr->frame_control);
@@ -1056,7 +1060,7 @@ static void ath9k_rx_skb_postprocess(struct ath_common *common,
 
         keyix = rx_stats->rs_keyix;
 
-        if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error &&
+        if ((is_mc || !(keyix == ATH9K_RXKEYIX_INVALID)) && !decrypt_error &&
             ieee80211_has_protected(fc)) {
                 rxs->flag |= RX_FLAG_DECRYPTED;
         } else if (ieee80211_has_protected(fc)
@@ -1096,6 +1100,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
         u8 rx_status_len = ah->caps.rx_status_len;
         u64 tsf = 0;
         u32 tsf_lower = 0;
+        unsigned long flags;
 
         if (edma)
                 dma_type = DMA_BIDIRECTIONAL;
@@ -1204,11 +1209,13 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         sc->rx.rxotherant = 0;
                 }
 
+                spin_lock_irqsave(&sc->sc_pm_lock, flags);
                 if (unlikely(ath9k_check_auto_sleep(sc) ||
                              (sc->ps_flags & (PS_WAIT_FOR_BEACON |
                                               PS_WAIT_FOR_CAB |
                                               PS_WAIT_FOR_PSPOLL_DATA))))
                         ath_rx_ps(sc, skb);
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 
                 ath_rx_send_to_mac80211(hw, sc, skb, rxs);
 
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index d01c4adab8d6..86b0a4b1a72f 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -709,6 +709,7 @@
 #define AR_WA_RESET_EN                  (1 << 18) /* Sw Control to enable PCI-Reset to POR (bit 15) */
 #define AR_WA_ANALOG_SHIFT              (1 << 20)
 #define AR_WA_POR_SHORT                 (1 << 21) /* PCI-E Phy reset control */
+#define AR_WA_BIT22                     (1 << 22)
 #define AR9285_WA_DEFAULT               0x004a050b
 #define AR9280_WA_DEFAULT               0x0040073b
 #define AR_WA_DEFAULT                   0x0000073f
@@ -900,7 +901,13 @@
 #define AR_DEVID_7010(_ah) \
         (((_ah)->hw_version.devid == 0x7010) || \
          ((_ah)->hw_version.devid == 0x7015) || \
-         ((_ah)->hw_version.devid == 0x9018))
+         ((_ah)->hw_version.devid == 0x9018) || \
+         ((_ah)->hw_version.devid == 0xA704) || \
+         ((_ah)->hw_version.devid == 0x1200))
+
+#define AR9287_HTC_DEVID(_ah) \
+        (((_ah)->hw_version.devid == 0x7015) || \
+         ((_ah)->hw_version.devid == 0x1200))
 
 #define AR_RADIO_SREV_MAJOR                   0xf0
 #define AR_RAD5133_SREV_MAJOR                 0xc0
@@ -1012,11 +1019,13 @@ enum {
 #define AR9287_GPIO_IN_VAL_S                     11
 #define AR9271_GPIO_IN_VAL                       0xFFFF0000
 #define AR9271_GPIO_IN_VAL_S                     16
-#define AR9300_GPIO_IN_VAL                       0x0001FFFF
-#define AR9300_GPIO_IN_VAL_S                     0
 #define AR7010_GPIO_IN_VAL                       0x0000FFFF
 #define AR7010_GPIO_IN_VAL_S                     0
 
+#define AR_GPIO_IN                               0x404c
+#define AR9300_GPIO_IN_VAL                       0x0001FFFF
+#define AR9300_GPIO_IN_VAL_S                     0
+
 #define AR_GPIO_OE_OUT                           (AR_SREV_9300_20_OR_LATER(ah) ? 0x4050 : 0x404c)
 #define AR_GPIO_OE_OUT_DRV                       0x3
 #define AR_GPIO_OE_OUT_DRV_NO                    0x0
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 4dda14e36227..8f00c6c13979 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -61,6 +61,8 @@ static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
                               struct ath_tx_status *ts, int txok);
 static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
                              int nbad, int txok, bool update_rc);
+static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
+                              int seqno);
 
 enum {
         MCS_HT20,
@@ -143,18 +145,23 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
         struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
         struct ath_buf *bf;
         struct list_head bf_head;
-        INIT_LIST_HEAD(&bf_head);
+        struct ath_tx_status ts;
 
-        WARN_ON(!tid->paused);
+        INIT_LIST_HEAD(&bf_head);
 
+        memset(&ts, 0, sizeof(ts));
         spin_lock_bh(&txq->axq_lock);
-        tid->paused = false;
 
         while (!list_empty(&tid->buf_q)) {
                 bf = list_first_entry(&tid->buf_q, struct ath_buf, list);
-                BUG_ON(bf_isretried(bf));
                 list_move_tail(&bf->list, &bf_head);
-                ath_tx_send_ht_normal(sc, txq, tid, &bf_head);
+
+                if (bf_isretried(bf)) {
+                        ath_tx_update_baw(sc, tid, bf->bf_seqno);
+                        ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
+                } else {
+                        ath_tx_send_ht_normal(sc, txq, tid, &bf_head);
+                }
         }
 
         spin_unlock_bh(&txq->axq_lock);
@@ -312,6 +319,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
         bool rc_update = true;
         struct ieee80211_tx_rate rates[4];
+        int nframes;
 
         skb = bf->bf_mpdu;
         hdr = (struct ieee80211_hdr *)skb->data;
@@ -320,6 +328,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         hw = bf->aphy->hw;
 
         memcpy(rates, tx_info->control.rates, sizeof(rates));
+        nframes = bf->bf_nframes;
 
         rcu_read_lock();
 
@@ -337,7 +346,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                             !bf->bf_stale || bf_next != NULL)
                                 list_move_tail(&bf->list, &bf_head);
 
-                        ath_tx_rc_status(bf, ts, 0, 0, false);
+                        ath_tx_rc_status(bf, ts, 1, 0, false);
                         ath_tx_complete_buf(sc, bf, txq, &bf_head, ts,
                                 0, 0);
 
@@ -431,7 +440,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                         list_move_tail(&bf->list, &bf_head);
                 }
 
-                if (!txpending) {
+                if (!txpending || (tid->state & AGGR_CLEANUP)) {
                         /*
                          * complete the acked-ones/xretried ones; update
                          * block-ack window
@@ -442,6 +451,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
 
                         if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) {
                                 memcpy(tx_info->control.rates, rates, sizeof(rates));
+                                bf->bf_nframes = nframes;
                                 ath_tx_rc_status(bf, ts, nbad, txok, true);
                                 rc_update = false;
                         } else {
@@ -510,15 +520,12 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         }
 
         if (tid->state & AGGR_CLEANUP) {
+                ath_tx_flush_tid(sc, tid);
+
                 if (tid->baw_head == tid->baw_tail) {
                         tid->state &= ~AGGR_ADDBA_COMPLETE;
                         tid->state &= ~AGGR_CLEANUP;
-
-                        /* send buffered frames as singles */
-                        ath_tx_flush_tid(sc, tid);
                 }
-                rcu_read_unlock();
-                return;
         }
 
         rcu_read_unlock();
@@ -785,17 +792,23 @@ static void ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
                  status != ATH_AGGR_BAW_CLOSED);
 }
 
-void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
-                       u16 tid, u16 *ssn)
+int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
+                      u16 tid, u16 *ssn)
 {
         struct ath_atx_tid *txtid;
         struct ath_node *an;
 
         an = (struct ath_node *)sta->drv_priv;
         txtid = ATH_AN_2_TID(an, tid);
+
+        if (txtid->state & (AGGR_CLEANUP | AGGR_ADDBA_COMPLETE))
+                return -EAGAIN;
+
         txtid->state |= AGGR_ADDBA_PROGRESS;
         txtid->paused = true;
         *ssn = txtid->seq_start;
+
+        return 0;
 }
 
 void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
@@ -803,12 +816,6 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
         struct ath_node *an = (struct ath_node *)sta->drv_priv;
         struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
         struct ath_txq *txq = &sc->tx.txq[txtid->ac->qnum];
-        struct ath_tx_status ts;
-        struct ath_buf *bf;
-        struct list_head bf_head;
-
-        memset(&ts, 0, sizeof(ts));
-        INIT_LIST_HEAD(&bf_head);
 
         if (txtid->state & AGGR_CLEANUP)
                 return;
@@ -818,31 +825,22 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
                 return;
         }
 
-        /* drop all software retried frames and mark this TID */
         spin_lock_bh(&txq->axq_lock);
         txtid->paused = true;
-        while (!list_empty(&txtid->buf_q)) {
-                bf = list_first_entry(&txtid->buf_q, struct ath_buf, list);
-                if (!bf_isretried(bf)) {
-                        /*
-                         * NB: it's based on the assumption that
-                         * software retried frame will always stay
-                         * at the head of software queue.
-                         */
-                        break;
-                }
-                list_move_tail(&bf->list, &bf_head);
-                ath_tx_update_baw(sc, txtid, bf->bf_seqno);
-                ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
-        }
-        spin_unlock_bh(&txq->axq_lock);
 
-        if (txtid->baw_head != txtid->baw_tail) {
+        /*
+         * If frames are still being transmitted for this TID, they will be
+         * cleaned up during tx completion. To prevent race conditions, this
+         * TID can only be reused after all in-progress subframes have been
+         * completed.
+         */
+        if (txtid->baw_head != txtid->baw_tail)
                 txtid->state |= AGGR_CLEANUP;
-        } else {
+        else
                 txtid->state &= ~AGGR_ADDBA_COMPLETE;
-                ath_tx_flush_tid(sc, txtid);
-        }
+        spin_unlock_bh(&txq->axq_lock);
+
+        ath_tx_flush_tid(sc, txtid);
 }
 
 void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
@@ -1103,15 +1101,6 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
         txq->axq_tx_inprogress = false;
         spin_unlock_bh(&txq->axq_lock);
 
-        /* flush any pending frames if aggregation is enabled */
-        if (sc->sc_flags & SC_OP_TXAGGR) {
-                if (!retry_tx) {
-                        spin_lock_bh(&txq->axq_lock);
-                        ath_txq_drain_pending_buffers(sc, txq);
-                        spin_unlock_bh(&txq->axq_lock);
-                }
-        }
-
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
                 spin_lock_bh(&txq->axq_lock);
                 while (!list_empty(&txq->txq_fifo_pending)) {
@@ -1132,6 +1121,15 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
                 }
                 spin_unlock_bh(&txq->axq_lock);
         }
+
+        /* flush any pending frames if aggregation is enabled */
+        if (sc->sc_flags & SC_OP_TXAGGR) {
+                if (!retry_tx) {
+                        spin_lock_bh(&txq->axq_lock);
+                        ath_txq_drain_pending_buffers(sc, txq);
+                        spin_unlock_bh(&txq->axq_lock);
+                }
+        }
 }
 
 void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
@@ -1162,13 +1160,13 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
                 ath_print(common, ATH_DBG_FATAL,
                           "Failed to stop TX DMA. Resetting hardware!\n");
 
-                spin_lock_bh(&sc->sc_resetlock);
+                spin_lock_bh(&sc->sc_pcu_lock);
                 r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
                 if (r)
                         ath_print(common, ATH_DBG_FATAL,
                                   "Unable to reset hardware; reset status %d\n",
                                   r);
-                spin_unlock_bh(&sc->sc_resetlock);
+                spin_unlock_bh(&sc->sc_pcu_lock);
         }
 
         for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
@@ -2024,9 +2022,15 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
 
         if (ts->ts_status & ATH9K_TXERR_FILT)
                 tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
-        if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && update_rc)
+        if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && update_rc) {
                 tx_info->flags |= IEEE80211_TX_STAT_AMPDU;
 
+                BUG_ON(nbad > bf->bf_nframes);
+
+                tx_info->status.ampdu_len = bf->bf_nframes;
+                tx_info->status.ampdu_ack_len = bf->bf_nframes - nbad;
+        }
+
         if ((ts->ts_status & ATH9K_TXERR_FILT) == 0 &&
             (bf->bf_flags & ATH9K_TXDESC_NOACK) == 0 && update_rc) {
                 if (ieee80211_is_data(hdr->frame_control)) {
@@ -2036,8 +2040,6 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
                         if ((ts->ts_status & ATH9K_TXERR_XRETRY) ||
                             (ts->ts_status & ATH9K_TXERR_FIFO))
                                 tx_info->pad[0] |= ATH_TX_INFO_XRETRY;
-                        tx_info->status.ampdu_len = bf->bf_nframes;
-                        tx_info->status.ampdu_ack_len = bf->bf_nframes - nbad;
                 }
         }
 
@@ -2159,7 +2161,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                          */
                         if (ts.ts_status & ATH9K_TXERR_XRETRY)
                                 bf->bf_state.bf_type |= BUF_XRETRY;
-                        ath_tx_rc_status(bf, &ts, 0, txok, true);
+                        ath_tx_rc_status(bf, &ts, txok ? 0 : 1, txok, true);
                 }
 
                 if (bf_isampdu(bf))
@@ -2204,7 +2206,7 @@ static void ath_tx_complete_poll_work(struct work_struct *work)
                 ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_RESET,
                           "tx hung, resetting the chip\n");
                 ath9k_ps_wakeup(sc);
-                ath_reset(sc, false);
+                ath_reset(sc, true);
                 ath9k_ps_restore(sc);
         }
 
@@ -2288,7 +2290,7 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
                 if (!bf_isampdu(bf)) {
                         if (txs.ts_status & ATH9K_TXERR_XRETRY)
                                 bf->bf_state.bf_type |= BUF_XRETRY;
-                        ath_tx_rc_status(bf, &txs, 0, txok, true);
+                        ath_tx_rc_status(bf, &txs, txok ? 0 : 1, txok, true);
                 }
 
                 if (bf_isampdu(bf))
diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c
index 45933cf8e8c2..09e2dfd7b175 100644
--- a/drivers/net/wireless/b43/sdio.c
+++ b/drivers/net/wireless/b43/sdio.c
@@ -163,6 +163,7 @@ static int b43_sdio_probe(struct sdio_func *func,
 err_free_ssb:
         kfree(sdio);
 err_disable_func:
+        sdio_claim_host(func);
         sdio_disable_func(func);
 err_release_host:
         sdio_release_host(func);
@@ -175,7 +176,9 @@ static void b43_sdio_remove(struct sdio_func *func)
         struct b43_sdio *sdio = sdio_get_drvdata(func);
 
         ssb_bus_unregister(&sdio->ssb);
+        sdio_claim_host(func);
         sdio_disable_func(func);
+        sdio_release_host(func);
         kfree(sdio);
         sdio_set_drvdata(func, NULL);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 10d7b9b7f064..f735117d8fc2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1234,6 +1234,9 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
         /* only Re-enable if diabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_enable_interrupts(priv);
+        /* Re-enable RF_KILL if it occurred */
+        else if (handled & CSR_INT_BIT_RF_KILL)
+                iwl_enable_rfkill_int(priv);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
@@ -1449,6 +1452,9 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         /* only Re-enable if diabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_enable_interrupts(priv);
+        /* Re-enable RF_KILL if it occurred */
+        else if (handled & CSR_INT_BIT_RF_KILL)
+                iwl_enable_rfkill_int(priv);
 }
 
 /* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
@@ -3260,9 +3266,10 @@ static void iwl_mac_stop(struct ieee80211_hw *hw)
 
         flush_workqueue(priv->workqueue);
 
-        /* enable interrupts again in order to receive rfkill changes */
+        /* User space software may expect getting rfkill changes
+         * even if interface is down */
         iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
-        iwl_enable_interrupts(priv);
+        iwl_enable_rfkill_int(priv);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
@@ -4103,14 +4110,14 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * 8. Enable interrupts and read RFKILL state
          *********************************************/
 
-        /* enable interrupts if needed: hw bug w/a */
+        /* enable rfkill interrupt: hw bug w/a */
         pci_read_config_word(priv->pci_dev, PCI_COMMAND, &pci_cmd);
         if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
                 pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
                 pci_write_config_word(priv->pci_dev, PCI_COMMAND, pci_cmd);
         }
 
-        iwl_enable_interrupts(priv);
+        iwl_enable_rfkill_int(priv);
 
         /* If platform's RF_KILL switch is NOT set to KILL */
         if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
index 621abe3c5afc..1c6add90b5b4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
+++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
@@ -168,6 +168,12 @@ static inline void iwl_disable_interrupts(struct iwl_priv *priv)
         IWL_DEBUG_ISR(priv, "Disabled interrupts\n");
 }
 
+static inline void iwl_enable_rfkill_int(struct iwl_priv *priv)
+{
+        IWL_DEBUG_ISR(priv, "Enabling rfkill interrupt\n");
+        iwl_write32(priv, CSR_INT_MASK, CSR_INT_BIT_RF_KILL);
+}
+
 static inline void iwl_enable_interrupts(struct iwl_priv *priv)
 {
         IWL_DEBUG_ISR(priv, "Enabling interrupts\n");
diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c
index e8e2d0f4763d..f800ef4e6554 100644
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -1813,6 +1813,12 @@ static int __orinoco_commit(struct orinoco_private *priv)
         struct net_device *dev = priv->ndev;
         int err = 0;
 
+        /* If we've called commit, we are reconfiguring or bringing the
+         * interface up. Maintaining countermeasures across this would
+         * be confusing, so note that we've disabled them. The port will
+         * be enabled later in orinoco_commit or __orinoco_up. */
+        priv->tkip_cm_active = 0;
+
         err = orinoco_hw_program_rids(priv);
 
         /* FIXME: what about netif_tx_lock */
diff --git a/drivers/net/wireless/orinoco/orinoco_cs.c b/drivers/net/wireless/orinoco/orinoco_cs.c
index ef46a2d88539..083999faaa98 100644
--- a/drivers/net/wireless/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco/orinoco_cs.c
@@ -248,20 +248,20 @@ orinoco_cs_config(struct pcmcia_device *link)
                 goto failed;
         }
 
-        ret = pcmcia_request_irq(link, orinoco_interrupt);
-        if (ret)
-                goto failed;
-
-        /* We initialize the hermes structure before completing PCMCIA
-         * configuration just in case the interrupt handler gets
-         * called. */
         mem = ioport_map(link->resource[0]->start,
                         resource_size(link->resource[0]));
         if (!mem)
                 goto failed;
 
+        /* We initialize the hermes structure before completing PCMCIA
+         * configuration just in case the interrupt handler gets
+         * called. */
         hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
 
+        ret = pcmcia_request_irq(link, orinoco_interrupt);
+        if (ret)
+                goto failed;
+
         /*
          * This actually configures the PCMCIA socket -- setting up
          * the I/O windows and the interrupt mapping, and putting the
diff --git a/drivers/net/wireless/orinoco/spectrum_cs.c b/drivers/net/wireless/orinoco/spectrum_cs.c
index 873877e17e1b..93070a3a5233 100644
--- a/drivers/net/wireless/orinoco/spectrum_cs.c
+++ b/drivers/net/wireless/orinoco/spectrum_cs.c
@@ -310,21 +310,21 @@ spectrum_cs_config(struct pcmcia_device *link)
                 goto failed;
         }
 
-        ret = pcmcia_request_irq(link, orinoco_interrupt);
-        if (ret)
-                goto failed;
-
-        /* We initialize the hermes structure before completing PCMCIA
-         * configuration just in case the interrupt handler gets
-         * called. */
         mem = ioport_map(link->resource[0]->start,
                         resource_size(link->resource[0]));
         if (!mem)
                 goto failed;
 
+        /* We initialize the hermes structure before completing PCMCIA
+         * configuration just in case the interrupt handler gets
+         * called. */
         hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
         hw->eeprom_pda = true;
 
+        ret = pcmcia_request_irq(link, orinoco_interrupt);
+        if (ret)
+                goto failed;
+
         /*
          * This actually configures the PCMCIA socket -- setting up
          * the I/O windows and the interrupt mapping, and putting the
diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
index cf7be1eb6124..56aab61fd4cb 100644
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -904,10 +904,10 @@ static int orinoco_ioctl_set_auth(struct net_device *dev,
                  */
                 if (param->value) {
                         priv->tkip_cm_active = 1;
-                        ret = hermes_enable_port(hw, 0);
+                        ret = hermes_disable_port(hw, 0);
                 } else {
                         priv->tkip_cm_active = 0;
-                        ret = hermes_disable_port(hw, 0);
+                        ret = hermes_enable_port(hw, 0);
                 }
                 break;
 
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
index 78347041ec40..0a7ce37aa628 100644
--- a/drivers/net/wireless/p54/eeprom.c
+++ b/drivers/net/wireless/p54/eeprom.c
@@ -260,8 +260,10 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
         list->max_entries = max_channel_num;
         list->channels = kzalloc(sizeof(struct p54_channel_entry) *
                                  max_channel_num, GFP_KERNEL);
-        if (!list->channels)
+        if (!list->channels) {
+                ret = -ENOMEM;
                 goto free;
+        }
 
         for (i = 0; i < max_channel_num; i++) {
                 if (i < priv->iq_autocal_len) {
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index ad595958b7df..2325e56a9b0b 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -33,8 +33,18 @@ MODULE_ALIAS("prism54usb");
 MODULE_FIRMWARE("isl3886usb");
 MODULE_FIRMWARE("isl3887usb");
 
+/*
+ * Note:
+ *
+ * Always update our wiki's device list (located at:
+ * http://wireless.kernel.org/en/users/Drivers/p54/devices ),
+ * whenever you add a new device.
+ */
+
 static struct usb_device_id p54u_table[] __devinitdata = {
         /* Version 1 devices (pci chip + net2280) */
+        {USB_DEVICE(0x0411, 0x0050)},   /* Buffalo WLI2-USB2-G54 */
+        {USB_DEVICE(0x045e, 0x00c2)},   /* Microsoft MN-710 */
         {USB_DEVICE(0x0506, 0x0a11)},   /* 3COM 3CRWE254G72 */
         {USB_DEVICE(0x06b9, 0x0120)},   /* Thomson SpeedTouch 120g */
         {USB_DEVICE(0x0707, 0xee06)},   /* SMC 2862W-G */
@@ -47,7 +57,13 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x0846, 0x4220)},   /* Netgear WG111 */
         {USB_DEVICE(0x09aa, 0x1000)},   /* Spinnaker Proto board */
         {USB_DEVICE(0x0cde, 0x0006)},   /* Medion 40900, Roper Europe */
+        {USB_DEVICE(0x0db0, 0x6826)},   /* MSI UB54G (MS-6826) */
+        {USB_DEVICE(0x107b, 0x55f2)},   /* Gateway WGU-210 (Gemtek) */
         {USB_DEVICE(0x124a, 0x4023)},   /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */
+        {USB_DEVICE(0x1435, 0x0210)},   /* Inventel UR054G */
+        {USB_DEVICE(0x15a9, 0x0002)},   /* Gemtek WUBI-100GW 802.11g */
+        {USB_DEVICE(0x1630, 0x0005)},   /* 2Wire 802.11g USB (v1) / Z-Com */
+        {USB_DEVICE(0x182d, 0x096b)},   /* Sitecom WL-107 */
         {USB_DEVICE(0x1915, 0x2234)},   /* Linksys WUSB54G OEM */
         {USB_DEVICE(0x1915, 0x2235)},   /* Linksys WUSB54G Portable OEM */
         {USB_DEVICE(0x2001, 0x3701)},   /* DLink DWL-G120 Spinnaker */
@@ -60,6 +76,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x050d, 0x7050)},   /* Belkin F5D7050 ver 1000 */
         {USB_DEVICE(0x0572, 0x2000)},   /* Cohiba Proto board */
         {USB_DEVICE(0x0572, 0x2002)},   /* Cohiba Proto board */
+        {USB_DEVICE(0x06a9, 0x000e)},   /* Westell 802.11g USB (A90-211WG-01) */
         {USB_DEVICE(0x06b9, 0x0121)},   /* Thomson SpeedTouch 121g */
         {USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
         {USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
@@ -80,7 +97,9 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x13B1, 0x000C)},   /* Linksys WUSB54AG */
         {USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
         {USB_DEVICE(0x1435, 0x0427)},   /* Inventel UR054G */
+        {USB_DEVICE(0x1668, 0x1050)},   /* Actiontec 802UIG-1 */
         {USB_DEVICE(0x2001, 0x3704)},   /* DLink DWL-G122 rev A2 */
+        {USB_DEVICE(0x2001, 0x3705)},   /* D-Link DWL-G120 rev C1 */
         {USB_DEVICE(0x413c, 0x5513)},   /* Dell WLA3310 USB Wireless Adapter */
         {USB_DEVICE(0x413c, 0x8102)},   /* Spinnaker DUT */
         {USB_DEVICE(0x413c, 0x8104)},   /* Cohiba Proto board */
@@ -930,8 +949,8 @@ static int __devinit p54u_probe(struct usb_interface *intf,
 #ifdef CONFIG_PM
                 /* ISL3887 needs a full reset on resume */
                 udev->reset_resume = 1;
+#endif /* CONFIG_PM */
                 err = p54u_device_reset(dev);
-#endif
 
                 priv->hw_type = P54U_3887;
                 dev->extra_tx_headroom += sizeof(struct lm87_tx_hdr);
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 0e937dc0c9c4..3d5311330b4a 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -618,7 +618,7 @@ static void p54_tx_80211_header(struct p54_common *priv, struct sk_buff *skb,
         else
                 *burst_possible = false;
 
-        if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)
+        if (!(info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
                 *flags |= P54_HDR_FLAG_DATA_OUT_SEQNR;
 
         if (info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE)
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 5063e01410e5..6a6cd7142e31 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1488,8 +1488,10 @@ static int rt2400pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = TXPOWER_FROM_DEV(MAX_TXPOWER);
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         return 0;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index c2a555d5376b..ec3e8b329a67 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1802,12 +1802,16 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = MAX_TXPOWER;
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         if (spec->num_channels > 14) {
-                for (i = 14; i < spec->num_channels; i++)
-                        info[i].tx_power1 = DEFAULT_TXPOWER;
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].max_power = MAX_TXPOWER;
+                        info[i].default_power1 = DEFAULT_TXPOWER;
+                }
         }
 
         return 0;
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index cdaf93f48263..ed4de3f02d40 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1705,12 +1705,16 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = MAX_TXPOWER;
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         if (spec->num_channels > 14) {
-                for (i = 14; i < spec->num_channels; i++)
-                        info[i].tx_power1 = DEFAULT_TXPOWER;
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].max_power = MAX_TXPOWER;
+                        info[i].default_power1 = DEFAULT_TXPOWER;
+                }
         }
 
         return 0;
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index ed4ebcdde7c9..616b71a4ad1f 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -1841,6 +1841,13 @@ struct mac_iveiv_entry {
 #define EEPROM_RSSI_A2_LNA_A2           FIELD16(0xff00)
 
 /*
+ * EEPROM Maximum TX power values
+ */
+#define EEPROM_MAX_TX_POWER             0x0027
+#define EEPROM_MAX_TX_POWER_24GHZ       FIELD16(0x00ff)
+#define EEPROM_MAX_TX_POWER_5GHZ        FIELD16(0xff00)
+
+/*
  * EEPROM TXpower delta: 20MHZ AND 40 MHZ use different power.
  *      This is delta in 40MHZ.
  * VALUE: Tx Power dalta value (MAX=4)
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index b66e0fd8f0fa..60039d3fe0a0 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -1120,27 +1120,27 @@ static void rt2800_config_channel_rf2xxx(struct rt2x00_dev *rt2x00dev,
                  * double meaning, and we should set a 7DBm boost flag.
                  */
                 rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A_7DBM_BOOST,
-                                   (info->tx_power1 >= 0));
+                                   (info->default_power1 >= 0));
 
-                if (info->tx_power1 < 0)
-                        info->tx_power1 += 7;
+                if (info->default_power1 < 0)
+                        info->default_power1 += 7;
 
                 rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A,
-                                   TXPOWER_A_TO_DEV(info->tx_power1));
+                                   TXPOWER_A_TO_DEV(info->default_power1));
 
                 rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A_7DBM_BOOST,
-                                   (info->tx_power2 >= 0));
+                                   (info->default_power2 >= 0));
 
-                if (info->tx_power2 < 0)
-                        info->tx_power2 += 7;
+                if (info->default_power2 < 0)
+                        info->default_power2 += 7;
 
                 rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A,
-                                   TXPOWER_A_TO_DEV(info->tx_power2));
+                                   TXPOWER_A_TO_DEV(info->default_power2));
         } else {
                 rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_G,
-                                   TXPOWER_G_TO_DEV(info->tx_power1));
+                                   TXPOWER_G_TO_DEV(info->default_power1));
                 rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_G,
-                                   TXPOWER_G_TO_DEV(info->tx_power2));
+                                   TXPOWER_G_TO_DEV(info->default_power2));
         }
 
         rt2x00_set_field32(&rf->rf4, RF4_HT40, conf_is_ht40(conf));
@@ -1180,13 +1180,11 @@ static void rt2800_config_channel_rf3xxx(struct rt2x00_dev *rt2x00dev,
         rt2800_rfcsr_write(rt2x00dev, 6, rfcsr);
 
         rt2800_rfcsr_read(rt2x00dev, 12, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR12_TX_POWER,
-                          TXPOWER_G_TO_DEV(info->tx_power1));
+        rt2x00_set_field8(&rfcsr, RFCSR12_TX_POWER, info->default_power1);
         rt2800_rfcsr_write(rt2x00dev, 12, rfcsr);
 
         rt2800_rfcsr_read(rt2x00dev, 13, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR13_TX_POWER,
-                          TXPOWER_G_TO_DEV(info->tx_power2));
+        rt2x00_set_field8(&rfcsr, RFCSR13_TX_POWER, info->default_power2);
         rt2800_rfcsr_write(rt2x00dev, 13, rfcsr);
 
         rt2800_rfcsr_read(rt2x00dev, 23, &rfcsr);
@@ -2516,6 +2514,13 @@ int rt2800_validate_eeprom(struct rt2x00_dev *rt2x00dev)
                                    default_lna_gain);
         rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
 
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_MAX_TX_POWER, &word);
+        if (rt2x00_get_field16(word, EEPROM_MAX_TX_POWER_24GHZ) == 0xff)
+                rt2x00_set_field16(&word, EEPROM_MAX_TX_POWER_24GHZ, MAX_G_TXPOWER);
+        if (rt2x00_get_field16(word, EEPROM_MAX_TX_POWER_5GHZ) == 0xff)
+                rt2x00_set_field16(&word, EEPROM_MAX_TX_POWER_5GHZ, MAX_A_TXPOWER);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_MAX_TX_POWER, word);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(rt2800_validate_eeprom);
@@ -2755,9 +2760,10 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 {
         struct hw_mode_spec *spec = &rt2x00dev->spec;
         struct channel_info *info;
-        char *tx_power1;
-        char *tx_power2;
+        char *default_power1;
+        char *default_power2;
         unsigned int i;
+        unsigned short max_power;
         u16 eeprom;
 
         /*
@@ -2871,21 +2877,26 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 
         spec->channels_info = info;
 
-        tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
-        tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_MAX_TX_POWER, &eeprom);
+        max_power = rt2x00_get_field16(eeprom, EEPROM_MAX_TX_POWER_24GHZ);
+        default_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
+        default_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
 
         for (i = 0; i < 14; i++) {
-                info[i].tx_power1 = TXPOWER_G_FROM_DEV(tx_power1[i]);
-                info[i].tx_power2 = TXPOWER_G_FROM_DEV(tx_power2[i]);
+                info[i].max_power = max_power;
+                info[i].default_power1 = TXPOWER_G_FROM_DEV(default_power1[i]);
+                info[i].default_power2 = TXPOWER_G_FROM_DEV(default_power2[i]);
         }
 
         if (spec->num_channels > 14) {
-                tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A1);
-                tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
+                max_power = rt2x00_get_field16(eeprom, EEPROM_MAX_TX_POWER_5GHZ);
+                default_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A1);
+                default_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
 
                 for (i = 14; i < spec->num_channels; i++) {
-                        info[i].tx_power1 = TXPOWER_A_FROM_DEV(tx_power1[i]);
-                        info[i].tx_power2 = TXPOWER_A_FROM_DEV(tx_power2[i]);
+                        info[i].max_power = max_power;
+                        info[i].default_power1 = TXPOWER_A_FROM_DEV(default_power1[i]);
+                        info[i].default_power2 = TXPOWER_A_FROM_DEV(default_power2[i]);
                 }
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index c21af38cc5af..6b2b92bfbc6b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -212,8 +212,9 @@ struct channel_info {
         unsigned int flags;
 #define GEOGRAPHY_ALLOWED       0x00000001
 
-        short tx_power1;
-        short tx_power2;
+        short max_power;
+        short default_power1;
+        short default_power2;
 };
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 585e8166f22a..19f86ce13df5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -710,7 +710,7 @@ static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
         for (i = 0; i < spec->num_channels; i++) {
                 rt2x00lib_channel(&channels[i],
                                   spec->channels[i].channel,
-                                  spec->channels_info[i].tx_power1, i);
+                                  spec->channels_info[i].max_power, i);
         }
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index e539c6cb636f..73d6382663b4 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2661,13 +2661,17 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_G_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = MAX_TXPOWER;
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         if (spec->num_channels > 14) {
                 tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
-                for (i = 14; i < spec->num_channels; i++)
-                        info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].max_power = MAX_TXPOWER;
+                        info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                }
         }
 
         return 0;
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index aa9de18fd410..c457d65f81a7 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2091,13 +2091,17 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_G_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = MAX_TXPOWER;
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         if (spec->num_channels > 14) {
                 tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
-                for (i = 14; i < spec->num_channels; i++)
-                        info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].max_power = MAX_TXPOWER;
+                        info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                }
         }
 
         return 0;
@@ -2391,6 +2395,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0812, 0x3101), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Qcom */
         { USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index b50fedcef8ac..42dad59cadb0 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -66,8 +66,8 @@ struct netfront_cb {
 
 #define GRANT_INVALID_REF       0
 
-#define NET_TX_RING_SIZE __RING_SIZE((struct xen_netif_tx_sring *)0, PAGE_SIZE)
-#define NET_RX_RING_SIZE __RING_SIZE((struct xen_netif_rx_sring *)0, PAGE_SIZE)
+#define NET_TX_RING_SIZE __CONST_RING_SIZE(xen_netif_tx, PAGE_SIZE)
+#define NET_RX_RING_SIZE __CONST_RING_SIZE(xen_netif_rx, PAGE_SIZE)
 #define TX_MAX_TARGET min_t(int, NET_RX_RING_SIZE, 256)
 
 struct netfront_info {