23 files changed, 367 insertions, 128 deletions

diff --git a/drivers/net/wireless/ath5k/ath5k.h b/drivers/net/wireless/ath5k/ath5k.h
index 7134c40d6a69..53ea439aff48 100644
--- a/drivers/net/wireless/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath5k/ath5k.h
@@ -431,7 +431,9 @@ struct ath5k_tx_status {
         u16     ts_seqnum;
         u16     ts_tstamp;
         u8      ts_status;
-        u8      ts_rate;
+        u8      ts_rate[4];
+        u8      ts_retry[4];
+        u8      ts_final_idx;
         s8      ts_rssi;
         u8      ts_shortretry;
         u8      ts_longretry;
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index c151588aa484..9b95c4049b31 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -541,6 +541,12 @@ ath5k_pci_probe(struct pci_dev *pdev,
                 goto err_irq;
         }
 
+        /* set up multi-rate retry capabilities */
+        if (sc->ah->ah_version == AR5K_AR5212) {
+                hw->max_altrates = 3;
+                hw->max_altrate_tries = 11;
+        }
+
         /* Finish private driver data initialization */
         ret = ath5k_attach(pdev, hw);
         if (ret)
@@ -1173,7 +1179,9 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
         struct sk_buff *skb = bf->skb;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         unsigned int pktlen, flags, keyidx = AR5K_TXKEYIX_INVALID;
-        int ret;
+        struct ieee80211_rate *rate;
+        unsigned int mrr_rate[3], mrr_tries[3];
+        int i, ret;
 
         flags = AR5K_TXDESC_INTREQ | AR5K_TXDESC_CLRDMASK;
 
@@ -1188,7 +1196,7 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
 
         if (info->control.hw_key) {
                 keyidx = info->control.hw_key->hw_key_idx;
-                pktlen += info->control.icv_len;
+                pktlen += info->control.hw_key->icv_len;
         }
         ret = ah->ah_setup_tx_desc(ah, ds, pktlen,
                 ieee80211_get_hdrlen_from_skb(skb), AR5K_PKT_TYPE_NORMAL,
@@ -1198,6 +1206,22 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
         if (ret)
                 goto err_unmap;
 
+        memset(mrr_rate, 0, sizeof(mrr_rate));
+        memset(mrr_tries, 0, sizeof(mrr_tries));
+        for (i = 0; i < 3; i++) {
+                rate = ieee80211_get_alt_retry_rate(sc->hw, info, i);
+                if (!rate)
+                        break;
+
+                mrr_rate[i] = rate->hw_value;
+                mrr_tries[i] = info->control.retries[i].limit;
+        }
+
+        ah->ah_setup_mrr_tx_desc(ah, ds,
+                mrr_rate[0], mrr_tries[0],
+                mrr_rate[1], mrr_tries[1],
+                mrr_rate[2], mrr_tries[2]);
+
         ds->ds_link = 0;
         ds->ds_data = bf->skbaddr;
 
@@ -1814,7 +1838,7 @@ ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
         struct ath5k_desc *ds;
         struct sk_buff *skb;
         struct ieee80211_tx_info *info;
-        int ret;
+        int i, ret;
 
         spin_lock(&txq->lock);
         list_for_each_entry_safe(bf, bf0, &txq->q, list) {
@@ -1836,7 +1860,25 @@ ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
                 pci_unmap_single(sc->pdev, bf->skbaddr, skb->len,
                                 PCI_DMA_TODEVICE);
 
-                info->status.retry_count = ts.ts_shortretry + ts.ts_longretry / 6;
+                memset(&info->status, 0, sizeof(info->status));
+                info->tx_rate_idx = ath5k_hw_to_driver_rix(sc,
+                                ts.ts_rate[ts.ts_final_idx]);
+                info->status.retry_count = ts.ts_longretry;
+
+                for (i = 0; i < 4; i++) {
+                        struct ieee80211_tx_altrate *r =
+                                &info->status.retries[i];
+
+                        if (ts.ts_rate[i]) {
+                                r->rate_idx = ath5k_hw_to_driver_rix(sc, ts.ts_rate[i]);
+                                r->limit = ts.ts_retry[i];
+                        } else {
+                                r->rate_idx = -1;
+                                r->limit = 0;
+                        }
+                }
+
+                info->status.excessive_retries = 0;
                 if (unlikely(ts.ts_status)) {
                         sc->ll_stats.dot11ACKFailureCount++;
                         if (ts.ts_status & AR5K_TXERR_XRETRY)
diff --git a/drivers/net/wireless/ath5k/desc.c b/drivers/net/wireless/ath5k/desc.c
index d45b90a6e06c..dd1374052ba9 100644
--- a/drivers/net/wireless/ath5k/desc.c
+++ b/drivers/net/wireless/ath5k/desc.c
@@ -318,6 +318,15 @@ ath5k_hw_setup_mrr_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         return 0;
 }
 
+/* no mrr support for cards older than 5212 */
+static int
+ath5k_hw_setup_no_mrr(struct ath5k_hw *ah, struct ath5k_desc *desc,
+        unsigned int tx_rate1, u_int tx_tries1, u_int tx_rate2,
+        u_int tx_tries2, unsigned int tx_rate3, u_int tx_tries3)
+{
+        return 0;
+}
+
 /*
  * Proccess the tx status descriptor on 5210/5211
  */
@@ -352,8 +361,10 @@ static int ath5k_hw_proc_2word_tx_status(struct ath5k_hw *ah,
                 AR5K_DESC_TX_STATUS1_ACK_SIG_STRENGTH);
         ts->ts_antenna = 1;
         ts->ts_status = 0;
-        ts->ts_rate = AR5K_REG_MS(tx_ctl->tx_control_0,
+        ts->ts_rate[0] = AR5K_REG_MS(tx_ctl->tx_control_0,
                 AR5K_2W_TX_DESC_CTL0_XMIT_RATE);
+        ts->ts_retry[0] = ts->ts_longretry;
+        ts->ts_final_idx = 0;
 
         if (!(tx_status->tx_status_0 & AR5K_DESC_TX_STATUS0_FRAME_XMIT_OK)) {
                 if (tx_status->tx_status_0 &
@@ -405,29 +416,43 @@ static int ath5k_hw_proc_4word_tx_status(struct ath5k_hw *ah,
                 AR5K_DESC_TX_STATUS1_XMIT_ANTENNA) ? 2 : 1;
         ts->ts_status = 0;
 
-        switch (AR5K_REG_MS(tx_status->tx_status_1,
-                        AR5K_DESC_TX_STATUS1_FINAL_TS_INDEX)) {
-        case 0:
-                ts->ts_rate = tx_ctl->tx_control_3 &
-                        AR5K_4W_TX_DESC_CTL3_XMIT_RATE0;
-                break;
+        ts->ts_final_idx = AR5K_REG_MS(tx_status->tx_status_1,
+                        AR5K_DESC_TX_STATUS1_FINAL_TS_INDEX);
+
+        /* The longretry counter has the number of un-acked retries
+         * for the final rate. To get the total number of retries
+         * we have to add the retry counters for the other rates
+         * as well
+         */
+        ts->ts_retry[ts->ts_final_idx] = ts->ts_longretry;
+        switch (ts->ts_final_idx) {
+        case 3:
+                ts->ts_rate[3] = AR5K_REG_MS(tx_ctl->tx_control_3,
+                        AR5K_4W_TX_DESC_CTL3_XMIT_RATE3);
+
+                ts->ts_retry[2] = AR5K_REG_MS(tx_ctl->tx_control_2,
+                        AR5K_4W_TX_DESC_CTL2_XMIT_TRIES2);
+                ts->ts_longretry += ts->ts_retry[2];
+                /* fall through */
+        case 2:
+                ts->ts_rate[2] = AR5K_REG_MS(tx_ctl->tx_control_3,
+                        AR5K_4W_TX_DESC_CTL3_XMIT_RATE2);
+
+                ts->ts_retry[1] = AR5K_REG_MS(tx_ctl->tx_control_2,
+                        AR5K_4W_TX_DESC_CTL2_XMIT_TRIES1);
+                ts->ts_longretry += ts->ts_retry[1];
+                /* fall through */
         case 1:
-                ts->ts_rate = AR5K_REG_MS(tx_ctl->tx_control_3,
+                ts->ts_rate[1] = AR5K_REG_MS(tx_ctl->tx_control_3,
                         AR5K_4W_TX_DESC_CTL3_XMIT_RATE1);
-                ts->ts_longretry += AR5K_REG_MS(tx_ctl->tx_control_2,
+
+                ts->ts_retry[0] = AR5K_REG_MS(tx_ctl->tx_control_2,
                         AR5K_4W_TX_DESC_CTL2_XMIT_TRIES1);
-                break;
-        case 2:
-                ts->ts_rate = AR5K_REG_MS(tx_ctl->tx_control_3,
-                        AR5K_4W_TX_DESC_CTL3_XMIT_RATE2);
-                ts->ts_longretry += AR5K_REG_MS(tx_ctl->tx_control_2,
-                        AR5K_4W_TX_DESC_CTL2_XMIT_TRIES2);
-                break;
-        case 3:
-                ts->ts_rate = AR5K_REG_MS(tx_ctl->tx_control_3,
-                        AR5K_4W_TX_DESC_CTL3_XMIT_RATE3);
-                ts->ts_longretry += AR5K_REG_MS(tx_ctl->tx_control_2,
-                        AR5K_4W_TX_DESC_CTL2_XMIT_TRIES3);
+                ts->ts_longretry += ts->ts_retry[0];
+                /* fall through */
+        case 0:
+                ts->ts_rate[0] = tx_ctl->tx_control_3 &
+                        AR5K_4W_TX_DESC_CTL3_XMIT_RATE0;
                 break;
         }
 
@@ -653,7 +678,7 @@ int ath5k_hw_init_desc_functions(struct ath5k_hw *ah)
         } else {
                 ah->ah_setup_rx_desc = ath5k_hw_setup_rx_desc;
                 ah->ah_setup_tx_desc = ath5k_hw_setup_2word_tx_desc;
-                ah->ah_setup_mrr_tx_desc = ath5k_hw_setup_mrr_tx_desc;
+                ah->ah_setup_mrr_tx_desc = ath5k_hw_setup_no_mrr;
                 ah->ah_proc_tx_desc = ath5k_hw_proc_2word_tx_status;
         }
 
diff --git a/drivers/net/wireless/ath9k/ath9k.h b/drivers/net/wireless/ath9k/ath9k.h
index 0e897c276858..accace5f7efb 100644
--- a/drivers/net/wireless/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath9k/ath9k.h
@@ -854,7 +854,7 @@ bool ath9k_hw_calibrate(struct ath_hal *ah,
                         u8 rxchainmask,
                         bool longcal,
                         bool *isCalDone);
-int16_t ath9k_hw_getchan_noise(struct ath_hal *ah,
+s16 ath9k_hw_getchan_noise(struct ath_hal *ah,
                                struct ath9k_channel *chan);
 void ath9k_hw_write_associd(struct ath_hal *ah, const u8 *bssid,
                             u16 assocId);
diff --git a/drivers/net/wireless/ath9k/beacon.c b/drivers/net/wireless/ath9k/beacon.c
index eedb465d25d3..9e15c30bbc06 100644
--- a/drivers/net/wireless/ath9k/beacon.c
+++ b/drivers/net/wireless/ath9k/beacon.c
@@ -129,7 +129,7 @@ static void ath_beacon_setup(struct ath_softc *sc,
                             ds                    /* first descriptor */
                 );
 
-        memzero(series, sizeof(struct ath9k_11n_rate_series) * 4);
+        memset(series, 0, sizeof(struct ath9k_11n_rate_series) * 4);
         series[0].Tries = 1;
         series[0].Rate = rate;
         series[0].ChSel = sc->sc_tx_chainmask;
@@ -282,7 +282,7 @@ int ath_beaconq_setup(struct ath_hal *ah)
 {
         struct ath9k_tx_queue_info qi;
 
-        memzero(&qi, sizeof(qi));
+        memset(&qi, 0, sizeof(qi));
         qi.tqi_aifs = 1;
         qi.tqi_cwmin = 0;
         qi.tqi_cwmax = 0;
@@ -662,7 +662,7 @@ void ath_beacon_config(struct ath_softc *sc, int if_id)
         else
                 av_opmode = sc->sc_ah->ah_opmode;
 
-        memzero(&conf, sizeof(struct ath_beacon_config));
+        memset(&conf, 0, sizeof(struct ath_beacon_config));
 
         conf.beacon_interval = sc->hw->conf.beacon_int ?
                 sc->hw->conf.beacon_int : ATH_DEFAULT_BINTVAL;
@@ -738,7 +738,7 @@ void ath_beacon_config(struct ath_softc *sc, int if_id)
                         }
                 } while (nexttbtt < tsftu);
 #undef FUDGE
-                memzero(&bs, sizeof(bs));
+                memset(&bs, 0, sizeof(bs));
                 bs.bs_intval = intval;
                 bs.bs_nexttbtt = nexttbtt;
                 bs.bs_dtimperiod = dtimperiod*intval;
diff --git a/drivers/net/wireless/ath9k/core.c b/drivers/net/wireless/ath9k/core.c
index 6c433a4d003e..c5033f6f42ac 100644
--- a/drivers/net/wireless/ath9k/core.c
+++ b/drivers/net/wireless/ath9k/core.c
@@ -65,7 +65,7 @@ static void ath_setcurmode(struct ath_softc *sc, enum wireless_mode mode)
         for (i = 0; i < rt->rateCount; i++)
                 sc->sc_rixmap[rt->info[i].rateCode] = (u8) i;
 
-        memzero(sc->sc_hwmap, sizeof(sc->sc_hwmap));
+        memset(sc->sc_hwmap, 0, sizeof(sc->sc_hwmap));
         for (i = 0; i < 256; i++) {
                 u8 ix = rt->rateCodeToIndex[i];
 
@@ -288,8 +288,6 @@ static int ath_stop(struct ath_softc *sc)
          * hardware is gone (invalid).
          */
 
-        if (!(sc->sc_flags & SC_OP_INVALID))
-                ath9k_hw_set_interrupts(ah, 0);
         ath_draintxq(sc, false);
         if (!(sc->sc_flags & SC_OP_INVALID)) {
                 ath_stoprecv(sc);
@@ -419,7 +417,7 @@ static void ath_chainmask_sel_init(struct ath_softc *sc, struct ath_node *an)
 {
         struct ath_chainmask_sel *cm = &an->an_chainmask_sel;
 
-        memzero(cm, sizeof(struct ath_chainmask_sel));
+        memset(cm, 0, sizeof(struct ath_chainmask_sel));
 
         cm->cur_tx_mask = sc->sc_tx_chainmask;
         cm->cur_rx_mask = sc->sc_rx_chainmask;
@@ -492,6 +490,122 @@ void ath_update_chainmask(struct ath_softc *sc, int is_ht)
                 __func__, sc->sc_tx_chainmask, sc->sc_rx_chainmask);
 }
 
+/*******/
+/* ANI */
+/*******/
+
+/*
+ *  This routine performs the periodic noise floor calibration function
+ *  that is used to adjust and optimize the chip performance.  This
+ *  takes environmental changes (location, temperature) into account.
+ *  When the task is complete, it reschedules itself depending on the
+ *  appropriate interval that was calculated.
+ */
+
+static void ath_ani_calibrate(unsigned long data)
+{
+        struct ath_softc *sc;
+        struct ath_hal *ah;
+        bool longcal = false;
+        bool shortcal = false;
+        bool aniflag = false;
+        unsigned int timestamp = jiffies_to_msecs(jiffies);
+        u32 cal_interval;
+
+        sc = (struct ath_softc *)data;
+        ah = sc->sc_ah;
+
+        /*
+        * don't calibrate when we're scanning.
+        * we are most likely not on our home channel.
+        */
+        if (sc->rx_filter & FIF_BCN_PRBRESP_PROMISC)
+                return;
+
+        /* Long calibration runs independently of short calibration. */
+        if ((timestamp - sc->sc_ani.sc_longcal_timer) >= ATH_LONG_CALINTERVAL) {
+                longcal = true;
+                DPRINTF(sc, ATH_DBG_ANI, "%s: longcal @%lu\n",
+                        __func__, jiffies);
+                sc->sc_ani.sc_longcal_timer = timestamp;
+        }
+
+        /* Short calibration applies only while sc_caldone is false */
+        if (!sc->sc_ani.sc_caldone) {
+                if ((timestamp - sc->sc_ani.sc_shortcal_timer) >=
+                    ATH_SHORT_CALINTERVAL) {
+                        shortcal = true;
+                        DPRINTF(sc, ATH_DBG_ANI, "%s: shortcal @%lu\n",
+                               __func__, jiffies);
+                        sc->sc_ani.sc_shortcal_timer = timestamp;
+                        sc->sc_ani.sc_resetcal_timer = timestamp;
+                }
+        } else {
+                if ((timestamp - sc->sc_ani.sc_resetcal_timer) >=
+                    ATH_RESTART_CALINTERVAL) {
+                        ath9k_hw_reset_calvalid(ah, ah->ah_curchan,
+                                                &sc->sc_ani.sc_caldone);
+                        if (sc->sc_ani.sc_caldone)
+                                sc->sc_ani.sc_resetcal_timer = timestamp;
+                }
+        }
+
+        /* Verify whether we must check ANI */
+        if ((timestamp - sc->sc_ani.sc_checkani_timer) >=
+           ATH_ANI_POLLINTERVAL) {
+                aniflag = true;
+                sc->sc_ani.sc_checkani_timer = timestamp;
+        }
+
+        /* Skip all processing if there's nothing to do. */
+        if (longcal || shortcal || aniflag) {
+                /* Call ANI routine if necessary */
+                if (aniflag)
+                        ath9k_hw_ani_monitor(ah, &sc->sc_halstats,
+                                             ah->ah_curchan);
+
+                /* Perform calibration if necessary */
+                if (longcal || shortcal) {
+                        bool iscaldone = false;
+
+                        if (ath9k_hw_calibrate(ah, ah->ah_curchan,
+                                               sc->sc_rx_chainmask, longcal,
+                                               &iscaldone)) {
+                                if (longcal)
+                                        sc->sc_ani.sc_noise_floor =
+                                                ath9k_hw_getchan_noise(ah,
+                                                               ah->ah_curchan);
+
+                                DPRINTF(sc, ATH_DBG_ANI,
+                                        "%s: calibrate chan %u/%x nf: %d\n",
+                                         __func__,
+                                        ah->ah_curchan->channel,
+                                        ah->ah_curchan->channelFlags,
+                                        sc->sc_ani.sc_noise_floor);
+                        } else {
+                                DPRINTF(sc, ATH_DBG_ANY,
+                                        "%s: calibrate chan %u/%x failed\n",
+                                         __func__,
+                                        ah->ah_curchan->channel,
+                                        ah->ah_curchan->channelFlags);
+                        }
+                        sc->sc_ani.sc_caldone = iscaldone;
+                }
+        }
+
+        /*
+        * Set timer interval based on previous results.
+        * The interval must be the shortest necessary to satisfy ANI,
+        * short calibration and long calibration.
+        */
+
+        cal_interval = ATH_ANI_POLLINTERVAL;
+        if (!sc->sc_ani.sc_caldone)
+                cal_interval = min(cal_interval, (u32)ATH_SHORT_CALINTERVAL);
+
+        mod_timer(&sc->sc_ani.timer, jiffies + msecs_to_jiffies(cal_interval));
+}
+
 /******************/
 /* VAP management */
 /******************/
@@ -528,7 +642,7 @@ int ath_vap_attach(struct ath_softc *sc,
         if (avp == NULL)
                 return -ENOMEM;
 
-        memzero(avp, sizeof(struct ath_vap));
+        memset(avp, 0, sizeof(struct ath_vap));
         avp->av_if_data = if_data;
         /* Set the VAP opmode */
         avp->av_opmode = opmode;
@@ -678,12 +792,6 @@ int ath_open(struct ath_softc *sc, struct ath9k_channel *initial_chan)
         if (ah->ah_caps.hw_caps & ATH9K_HW_CAP_HT)
                 sc->sc_imask |= ATH9K_INT_CST;
 
-        /* Note: We disable MIB interrupts for now as we don't yet
-         * handle processing ANI, otherwise you will get an interrupt
-         * storm after about 7 hours of usage making the system unusable
-         * with huge latency. Once we do have ANI processing included
-         * we can re-enable this interrupt. */
-#if 0
         /*
          * Enable MIB interrupts when there are hardware phy counters.
          * Note we only do this (at the moment) for station mode.
@@ -692,7 +800,6 @@ int ath_open(struct ath_softc *sc, struct ath9k_channel *initial_chan)
             ((sc->sc_ah->ah_opmode == ATH9K_M_STA) ||
              (sc->sc_ah->ah_opmode == ATH9K_M_IBSS)))
                 sc->sc_imask |= ATH9K_INT_MIB;
-#endif
         /*
          * Some hardware processes the TIM IE and fires an
          * interrupt when the TIM bit is set.  For hardware
@@ -993,6 +1100,10 @@ int ath_init(u16 devid, struct ath_softc *sc)
         }
         sc->sc_ah = ah;
 
+        /* Initializes the noise floor to a reasonable default value.
+         * Later on this will be updated during ANI processing. */
+        sc->sc_ani.sc_noise_floor = ATH_DEFAULT_NOISE_FLOOR;
+
         /* Get the hardware key cache size. */
         sc->sc_keymax = ah->ah_caps.keycache_size;
         if (sc->sc_keymax > ATH_KEYMAX) {
@@ -1100,6 +1211,8 @@ int ath_init(u16 devid, struct ath_softc *sc)
                 goto bad2;
         }
 
+        setup_timer(&sc->sc_ani.timer, ath_ani_calibrate, (unsigned long)sc);
+
         sc->sc_rc = ath_rate_attach(ah);
         if (sc->sc_rc == NULL) {
                 error = -EIO;
@@ -1221,7 +1334,7 @@ struct ath_node *ath_node_attach(struct ath_softc *sc, u8 *addr, int if_id)
         an = kmalloc(sizeof(struct ath_node), GFP_ATOMIC);
         if (an == NULL)
                 return NULL;
-        memzero(an, sizeof(*an));
+        memset(an, 0, sizeof(*an));
 
         an->an_sc = sc;
         memcpy(an->an_addr, addr, ETH_ALEN);
@@ -1608,7 +1721,7 @@ int ath_descdma_setup(struct ath_softc *sc,
                 error = -ENOMEM;
                 goto fail2;
         }
-        memzero(bf, bsize);
+        memset(bf, 0, bsize);
         dd->dd_bufptr = bf;
 
         INIT_LIST_HEAD(head);
@@ -1640,7 +1753,7 @@ fail2:
         pci_free_consistent(sc->pdev,
                 dd->dd_desc_len, dd->dd_desc, dd->dd_desc_paddr);
 fail:
-        memzero(dd, sizeof(*dd));
+        memset(dd, 0, sizeof(*dd));
         return error;
 #undef ATH_DESC_4KB_BOUND_CHECK
 #undef ATH_DESC_4KB_BOUND_NUM_SKIPPED
@@ -1665,7 +1778,7 @@ void ath_descdma_cleanup(struct ath_softc *sc,
 
         INIT_LIST_HEAD(head);
         kfree(dd->dd_bufptr);
-        memzero(dd, sizeof(*dd));
+        memset(dd, 0, sizeof(*dd));
 }
 
 /*************/
diff --git a/drivers/net/wireless/ath9k/core.h b/drivers/net/wireless/ath9k/core.h
index 872f0c5a0b0e..cb3e61e57c4d 100644
--- a/drivers/net/wireless/ath9k/core.h
+++ b/drivers/net/wireless/ath9k/core.h
@@ -84,9 +84,6 @@ struct ath_node;
 #define TSF_TO_TU(_h,_l) \
         ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
 
-/* XXX: remove */
-#define memzero(_buf, _len) memset(_buf, 0, _len)
-
 #define ATH9K_BH_STATUS_INTACT          0
 #define ATH9K_BH_STATUS_CHANGE          1
 
@@ -184,7 +181,7 @@ void ath_update_chainmask(struct ath_softc *sc, int is_ht);
                 (_bf)->bf_lastbf = NULL;                        \
                 (_bf)->bf_lastfrm = NULL;                       \
                 (_bf)->bf_next = NULL;                          \
-                memzero(&((_bf)->bf_state),                     \
+                memset(&((_bf)->bf_state), 0,                   \
                             sizeof(struct ath_buf_state));      \
         } while (0)
 
@@ -312,7 +309,7 @@ void ath_descdma_cleanup(struct ath_softc *sc,
 #define ATH_RX_TIMEOUT           40      /* 40 milliseconds */
 #define WME_NUM_TID              16
 #define IEEE80211_BAR_CTL_TID_M  0xF000  /* tid mask */
-#define IEEE80211_BAR_CTL_TID_S  2       /* tid shift */
+#define IEEE80211_BAR_CTL_TID_S  12      /* tid shift */
 
 enum ATH_RX_TYPE {
         ATH_RX_NON_CONSUMED = 0,
@@ -803,6 +800,28 @@ void ath_slow_ant_div(struct ath_antdiv *antdiv,
                       struct ath_rx_status *rx_stats);
 void ath_setdefantenna(void *sc, u32 antenna);
 
+/*******/
+/* ANI */
+/*******/
+
+/* ANI values for STA only.
+   FIXME: Add appropriate values for AP later */
+
+#define ATH_ANI_POLLINTERVAL    100     /* 100 milliseconds between ANI poll */
+#define ATH_SHORT_CALINTERVAL   1000    /* 1 second between calibrations */
+#define ATH_LONG_CALINTERVAL    30000   /* 30 seconds between calibrations */
+#define ATH_RESTART_CALINTERVAL 1200000 /* 20 minutes between calibrations */
+
+struct ath_ani {
+        bool sc_caldone;
+        int16_t sc_noise_floor;
+        unsigned int sc_longcal_timer;
+        unsigned int sc_shortcal_timer;
+        unsigned int sc_resetcal_timer;
+        unsigned int sc_checkani_timer;
+        struct timer_list timer;
+};
+
 /********************/
 /*   LED Control    */
 /********************/
@@ -1031,6 +1050,9 @@ struct ath_softc {
 
         /* Rfkill */
         struct ath_rfkill rf_kill;
+
+        /* ANI */
+        struct ath_ani sc_ani;
 };
 
 int ath_init(u16 devid, struct ath_softc *sc);
diff --git a/drivers/net/wireless/ath9k/hw.c b/drivers/net/wireless/ath9k/hw.c
index 272c75816609..62e44a0ef996 100644
--- a/drivers/net/wireless/ath9k/hw.c
+++ b/drivers/net/wireless/ath9k/hw.c
@@ -329,7 +329,7 @@ static void ath9k_hw_set_defaults(struct ath_hal *ah)
         ah->ah_config.ofdm_trig_high = 500;
         ah->ah_config.cck_trig_high = 200;
         ah->ah_config.cck_trig_low = 100;
-        ah->ah_config.enable_ani = 0;
+        ah->ah_config.enable_ani = 1;
         ah->ah_config.noise_immunity_level = 4;
         ah->ah_config.ofdm_weaksignal_det = 1;
         ah->ah_config.cck_weaksignal_thr = 0;
@@ -8405,23 +8405,48 @@ u32 ath9k_hw_mhz2ieee(struct ath_hal *ah, u32 freq, u32 flags)
         }
 }
 
-int16_t
+/* We can tune this as we go by monitoring really low values */
+#define ATH9K_NF_TOO_LOW        -60
+
+/* AR5416 may return very high value (like -31 dBm), in those cases the nf
+ * is incorrect and we should use the static NF value. Later we can try to
+ * find out why they are reporting these values */
+static bool ath9k_hw_nf_in_range(struct ath_hal *ah, s16 nf)
+{
+        if (nf > ATH9K_NF_TOO_LOW) {
+                DPRINTF(ah->ah_sc, ATH_DBG_NF_CAL,
+                         "%s: noise floor value detected (%d) is "
+                        "lower than what we think is a "
+                        "reasonable value (%d)\n",
+                         __func__, nf, ATH9K_NF_TOO_LOW);
+                return false;
+        }
+        return true;
+}
+
+s16
 ath9k_hw_getchan_noise(struct ath_hal *ah, struct ath9k_channel *chan)
 {
         struct ath9k_channel *ichan;
+        s16 nf;
 
         ichan = ath9k_regd_check_channel(ah, chan);
         if (ichan == NULL) {
                 DPRINTF(ah->ah_sc, ATH_DBG_NF_CAL,
                          "%s: invalid channel %u/0x%x; no mapping\n",
                          __func__, chan->channel, chan->channelFlags);
-                return 0;
+                return ATH_DEFAULT_NOISE_FLOOR;
         }
         if (ichan->rawNoiseFloor == 0) {
                 enum wireless_mode mode = ath9k_hw_chan2wmode(ah, chan);
-                return NOISE_FLOOR[mode];
+                nf = NOISE_FLOOR[mode];
         } else
-                return ichan->rawNoiseFloor;
+                nf = ichan->rawNoiseFloor;
+
+        if (!ath9k_hw_nf_in_range(ah, nf))
+                nf = ATH_DEFAULT_NOISE_FLOOR;
+
+        return nf;
 }
 
 bool ath9k_hw_set_tsfadjust(struct ath_hal *ah, u32 setting)
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index 2caba4403167..74726990d59e 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -274,10 +274,12 @@ static void ath9k_rx_prepare(struct ath_softc *sc,
         rx_status->mactime = status->tsf;
         rx_status->band = curchan->band;
         rx_status->freq =  curchan->center_freq;
-        rx_status->noise = ATH_DEFAULT_NOISE_FLOOR;
+        rx_status->noise = sc->sc_ani.sc_noise_floor;
         rx_status->signal = rx_status->noise + status->rssi;
         rx_status->rate_idx = ath_rate2idx(sc, (status->rateKbps / 100));
         rx_status->antenna = status->antenna;
+
+        /* XXX Fix me, 64 cannot be the max rssi value, rigure it out */
         rx_status->qual = status->rssi * 100 / 64;
 
         if (status->flags & ATH_RX_MIC_ERROR)
@@ -427,6 +429,11 @@ static void ath9k_bss_assoc_info(struct ath_softc *sc,
                 ath_rate_newstate(sc, avp);
                 /* Update ratectrl about the new state */
                 ath_rc_node_update(hw, avp->rc_node);
+
+                /* Start ANI */
+                mod_timer(&sc->sc_ani.timer,
+                        jiffies + msecs_to_jiffies(ATH_ANI_POLLINTERVAL));
+
         } else {
                 DPRINTF(sc, ATH_DBG_CONFIG,
                 "%s: Bss Info DISSOC\n", __func__);
@@ -1173,6 +1180,13 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                 return error;
         }
 
+        if (conf->type == NL80211_IFTYPE_AP) {
+                /* TODO: is this a suitable place to start ANI for AP mode? */
+                /* Start ANI */
+                mod_timer(&sc->sc_ani.timer,
+                          jiffies + msecs_to_jiffies(ATH_ANI_POLLINTERVAL));
+        }
+
         return 0;
 }
 
@@ -1195,6 +1209,8 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
 #ifdef CONFIG_SLOW_ANT_DIV
         ath_slow_ant_div_stop(&sc->sc_antdiv);
 #endif
+        /* Stop ANI */
+        del_timer_sync(&sc->sc_ani.timer);
 
         /* Update ratectrl */
         ath_rate_newstate(sc, avp);
diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c
index 498256309ab7..4983402af559 100644
--- a/drivers/net/wireless/ath9k/recv.c
+++ b/drivers/net/wireless/ath9k/recv.c
@@ -892,7 +892,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
 
                 hdr = (struct ieee80211_hdr *)skb->data;
                 fc = hdr->frame_control;
-                memzero(&rx_status, sizeof(struct ath_recv_status));
+                memset(&rx_status, 0, sizeof(struct ath_recv_status));
 
                 if (ds->ds_rxstat.rs_more) {
                         /*
@@ -999,20 +999,11 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                                 rx_status.flags |= ATH_RX_SHORT_GI;
                 }
 
-                /* sc->sc_noise_floor is only available when the station
+                /* sc_noise_floor is only available when the station
                    attaches to an AP, so we use a default value
                    if we are not yet attached. */
-
-                /* XXX we should use either sc->sc_noise_floor or
-                 * ath_hal_getChanNoise(ah, &sc->sc_curchan)
-                 * to calculate the noise floor.
-                 * However, the value returned by ath_hal_getChanNoise
-                 * seems to be incorrect (-31dBm on the last test),
-                 * so we will use a hard-coded value until we
-                 * figure out what is going on.
-                 */
                 rx_status.abs_rssi =
-                        ds->ds_rxstat.rs_rssi + ATH_DEFAULT_NOISE_FLOOR;
+                        ds->ds_rxstat.rs_rssi + sc->sc_ani.sc_noise_floor;
 
                 pci_dma_sync_single_for_cpu(sc->pdev,
                                             bf->bf_buf_addr,
@@ -1166,7 +1157,7 @@ int ath_rx_aggr_start(struct ath_softc *sc,
                 } else {
                         /* Ensure the memory is zeroed out (all internal
                          * pointers are null) */
-                        memzero(rxtid->rxbuf, ATH_TID_MAX_BUFS *
+                        memset(rxtid->rxbuf, 0, ATH_TID_MAX_BUFS *
                                 sizeof(struct ath_rxbuf));
                         DPRINTF(sc, ATH_DBG_AGGR,
                                 "%s: Allocated @%p\n", __func__, rxtid->rxbuf);
diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
index 25929059c7dc..3a4757942b3f 100644
--- a/drivers/net/wireless/ath9k/xmit.c
+++ b/drivers/net/wireless/ath9k/xmit.c
@@ -237,7 +237,7 @@ static int ath_tx_prepare(struct ath_softc *sc,
 
         if (tx_info->control.hw_key) {
                 txctl->keyix = tx_info->control.hw_key->hw_key_idx;
-                txctl->frmlen += tx_info->control.icv_len;
+                txctl->frmlen += tx_info->control.hw_key->icv_len;
 
                 if (tx_info->control.hw_key->alg == ALG_WEP)
                         txctl->keytype = ATH9K_KEY_TYPE_WEP;
@@ -729,7 +729,7 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf)
         /*
          * Setup HAL rate series
          */
-        memzero(series, sizeof(struct ath9k_11n_rate_series) * 4);
+        memset(series, 0, sizeof(struct ath9k_11n_rate_series) * 4);
 
         for (i = 0; i < 4; i++) {
                 if (!bf->bf_rcs[i].tries)
@@ -817,7 +817,7 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf)
                  * Disable multi-rate retry when using RTS/CTS by clearing
                  * series 1, 2 and 3.
                  */
-                memzero(&series[1], sizeof(struct ath9k_11n_rate_series) * 3);
+                memset(&series[1], 0, sizeof(struct ath9k_11n_rate_series) * 3);
         }
 
         /*
@@ -930,7 +930,7 @@ static void ath_tx_complete_aggr_rifs(struct ath_softc *sc,
                                         ATH_DS_BA_BITMAP(ds),
                                         WME_BA_BMP_SIZE >> 3);
                         } else {
-                                memzero(ba, WME_BA_BMP_SIZE >> 3);
+                                memset(ba, 0, WME_BA_BMP_SIZE >> 3);
 
                                 /*
                                  * AR5416 can become deaf/mute when BA
@@ -943,7 +943,7 @@ static void ath_tx_complete_aggr_rifs(struct ath_softc *sc,
                                         needreset = 1;
                         }
                 } else {
-                        memzero(ba, WME_BA_BMP_SIZE >> 3);
+                        memset(ba, 0, WME_BA_BMP_SIZE >> 3);
                 }
         }
 
@@ -2098,7 +2098,7 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
         struct ath9k_tx_queue_info qi;
         int qnum;
 
-        memzero(&qi, sizeof(qi));
+        memset(&qi, 0, sizeof(qi));
         qi.tqi_subtype = subtype;
         qi.tqi_aifs = ATH9K_TXQ_USEDEFAULT;
         qi.tqi_cwmin = ATH9K_TXQ_USEDEFAULT;
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 3bf74e236abc..14c44df584d0 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -4588,6 +4588,7 @@ static int b43_wireless_init(struct ssb_device *dev)
                 BIT(NL80211_IFTYPE_ADHOC);
 
         hw->queues = b43_modparam_qos ? 4 : 1;
+        hw->max_altrates = 1;
         SET_IEEE80211_DEV(hw, dev->dev);
         if (is_valid_ether_addr(sprom->et1mac))
                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 5e0b71c3ad02..2fabcf8f0474 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -208,7 +208,7 @@ int b43_generate_txhdr(struct b43_wldev *dev,
         txrate = ieee80211_get_tx_rate(dev->wl->hw, info);
         rate = txrate ? txrate->hw_value : B43_CCK_RATE_1MB;
         rate_ofdm = b43_is_ofdm_rate(rate);
-        fbrate = ieee80211_get_alt_retry_rate(dev->wl->hw, info) ? : txrate;
+        fbrate = ieee80211_get_alt_retry_rate(dev->wl->hw, info, 0) ? : txrate;
         rate_fb = fbrate->hw_value;
         rate_fb_ofdm = b43_is_ofdm_rate(rate_fb);
 
@@ -252,7 +252,7 @@ int b43_generate_txhdr(struct b43_wldev *dev,
                 }
 
                 /* Hardware appends ICV. */
-                plcp_fragment_len += info->control.icv_len;
+                plcp_fragment_len += info->control.hw_key->icv_len;
 
                 key_idx = b43_kidx_to_fw(dev, key_idx);
                 mac_ctl |= (key_idx << B43_TXH_MAC_KEYIDX_SHIFT) &
@@ -260,7 +260,7 @@ int b43_generate_txhdr(struct b43_wldev *dev,
                 mac_ctl |= (key->algorithm << B43_TXH_MAC_KEYALG_SHIFT) &
                            B43_TXH_MAC_KEYALG;
                 wlhdr_len = ieee80211_hdrlen(fctl);
-                iv_len = min((size_t) info->control.iv_len,
+                iv_len = min((size_t) info->control.hw_key->iv_len,
                              ARRAY_SIZE(txhdr->iv));
                 memcpy(txhdr->iv, ((u8 *) wlhdr) + wlhdr_len, iv_len);
         }
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 9fb1421cbec2..c66d57560e7c 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3710,6 +3710,7 @@ static int b43legacy_wireless_init(struct ssb_device *dev)
                 BIT(NL80211_IFTYPE_WDS) |
                 BIT(NL80211_IFTYPE_ADHOC);
         hw->queues = 1; /* FIXME: hardware has more queues */
+        hw->max_altrates = 1;
         SET_IEEE80211_DEV(hw, dev->dev);
         if (is_valid_ether_addr(sprom->et1mac))
                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
diff --git a/drivers/net/wireless/b43legacy/xmit.c b/drivers/net/wireless/b43legacy/xmit.c
index 6835064758fb..65e833781608 100644
--- a/drivers/net/wireless/b43legacy/xmit.c
+++ b/drivers/net/wireless/b43legacy/xmit.c
@@ -210,7 +210,7 @@ static int generate_txhdr_fw3(struct b43legacy_wldev *dev,
 
         rate = tx_rate->hw_value;
         rate_ofdm = b43legacy_is_ofdm_rate(rate);
-        rate_fb = ieee80211_get_alt_retry_rate(dev->wl->hw, info) ? : tx_rate;
+        rate_fb = ieee80211_get_alt_retry_rate(dev->wl->hw, info, 0) ? : tx_rate;
         rate_fb_ofdm = b43legacy_is_ofdm_rate(rate_fb->hw_value);
 
         txhdr->mac_frame_ctl = wlhdr->frame_control;
@@ -243,7 +243,7 @@ static int generate_txhdr_fw3(struct b43legacy_wldev *dev,
 
                 if (key->enabled) {
                         /* Hardware appends ICV. */
-                        plcp_fragment_len += info->control.icv_len;
+                        plcp_fragment_len += info->control.hw_key->icv_len;
 
                         key_idx = b43legacy_kidx_to_fw(dev, key_idx);
                         mac_ctl |= (key_idx << B43legacy_TX4_MAC_KEYIDX_SHIFT) &
@@ -252,7 +252,7 @@ static int generate_txhdr_fw3(struct b43legacy_wldev *dev,
                                    B43legacy_TX4_MAC_KEYALG_SHIFT) &
                                    B43legacy_TX4_MAC_KEYALG;
                         wlhdr_len = ieee80211_hdrlen(wlhdr->frame_control);
-                        iv_len = min((size_t)info->control.iv_len,
+                        iv_len = min((size_t)info->control.hw_key->iv_len,
                                      ARRAY_SIZE(txhdr->iv));
                         memcpy(txhdr->iv, ((u8 *)wlhdr) + wlhdr_len, iv_len);
                 } else {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 204abab76449..24a1aeb6448f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2569,30 +2569,6 @@ static void iwl4965_post_associate(struct iwl_priv *priv)
 
 }
 
-static int iwl4965_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf);
-
-static void iwl_bg_scan_completed(struct work_struct *work)
-{
-        struct iwl_priv *priv =
-            container_of(work, struct iwl_priv, scan_completed);
-
-        IWL_DEBUG_SCAN("SCAN complete scan\n");
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        if (test_bit(STATUS_CONF_PENDING, &priv->status))
-                iwl4965_mac_config(priv->hw, ieee80211_get_hw_conf(priv->hw));
-
-        ieee80211_scan_completed(priv->hw);
-
-        /* Since setting the TXPOWER may have been deferred while
-         * performing the scan, fire one off */
-        mutex_lock(&priv->mutex);
-        iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
-        mutex_unlock(&priv->mutex);
-}
-
 /*****************************************************************************
  *
  * mac80211 entry point functions
@@ -2812,7 +2788,6 @@ static int iwl4965_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *co
         if (unlikely(!priv->cfg->mod_params->disable_hw_scan &&
                      test_bit(STATUS_SCANNING, &priv->status))) {
                 IWL_DEBUG_MAC80211("leave - scanning\n");
-                set_bit(STATUS_CONF_PENDING, &priv->status);
                 mutex_unlock(&priv->mutex);
                 return 0;
         }
@@ -2898,7 +2873,6 @@ static int iwl4965_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *co
         IWL_DEBUG_MAC80211("leave\n");
 
 out:
-        clear_bit(STATUS_CONF_PENDING, &priv->status);
         mutex_unlock(&priv->mutex);
         return ret;
 }
@@ -4117,8 +4091,6 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
         INIT_DELAYED_WORK(&priv->init_alive_start, iwl_bg_init_alive_start);
         INIT_DELAYED_WORK(&priv->alive_start, iwl_bg_alive_start);
 
-        /* FIXME : remove when resolved PENDING */
-        INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
         iwl_setup_scan_deferred_work(priv);
         iwl_setup_power_deferred_work(priv);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 55a4b584ce07..288b6a800e03 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -333,8 +333,7 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv);
 #define STATUS_SCAN_HW          15
 #define STATUS_POWER_PMI        16
 #define STATUS_FW_ERROR         17
-#define STATUS_CONF_PENDING     18
-#define STATUS_MODE_PENDING     19
+#define STATUS_MODE_PENDING     18
 
 
 static inline int iwl_is_ready(struct iwl_priv *priv)
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index bf855c35b0c1..3b0bee331a33 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -703,7 +703,7 @@ static void iwl_bg_request_scan(struct work_struct *data)
         u16 cmd_len;
         enum ieee80211_band band;
         u8 n_probes = 2;
-        u8 rx_chain = 0x7; /* bitmap: ABC chains */
+        u8 rx_chain = priv->hw_params.valid_rx_ant;
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
@@ -843,7 +843,7 @@ static void iwl_bg_request_scan(struct work_struct *data)
 
                 /* Force use of chains B and C (0x6) for scan Rx for 4965
                  * Avoid A (0x1) because of its off-channel reception on A-band.
-                 * MIMO is not used here, but value is required */
+                 */
                 if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
                         rx_chain = 0x6;
         } else {
@@ -851,6 +851,7 @@ static void iwl_bg_request_scan(struct work_struct *data)
                 goto done;
         }
 
+        /* MIMO is not used here, but value is required */
         scan->rx_chain = RXON_RX_CHAIN_DRIVER_FORCE_MSK |
                                 cpu_to_le16((0x7 << RXON_RX_CHAIN_VALID_POS) |
                                 (rx_chain << RXON_RX_CHAIN_FORCE_SEL_POS) |
@@ -915,10 +916,29 @@ static void iwl_bg_abort_scan(struct work_struct *work)
         mutex_unlock(&priv->mutex);
 }
 
+static void iwl_bg_scan_completed(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+            container_of(work, struct iwl_priv, scan_completed);
+
+        IWL_DEBUG_SCAN("SCAN complete scan\n");
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        ieee80211_scan_completed(priv->hw);
+
+        /* Since setting the TXPOWER may have been deferred while
+         * performing the scan, fire one off */
+        mutex_lock(&priv->mutex);
+        iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
+        mutex_unlock(&priv->mutex);
+}
+
+
 void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
 {
-        /*  FIXME: move here when resolved PENDING
-         *  INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed); */
+        INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
         INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
         INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index de5e8f44b202..1994aa199d37 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -507,9 +507,10 @@ static int p54_rx_data(struct ieee80211_hw *dev, struct sk_buff *skb)
         rx_status.noise = priv->noise;
         /* XX correct? */
         rx_status.qual = (100 * hdr->rssi) / 127;
-        rx_status.rate_idx = hdr->rate & 0xf;
+        rx_status.rate_idx = (dev->conf.channel->band == IEEE80211_BAND_2GHZ ?
+                        hdr->rate : (hdr->rate - 4)) & 0xf;
         rx_status.freq = freq;
-        rx_status.band = IEEE80211_BAND_2GHZ;
+        rx_status.band =  dev->conf.channel->band;
         rx_status.antenna = hdr->antenna;
 
         tsf32 = le32_to_cpu(hdr->tsf32);
diff --git a/drivers/net/wireless/rt2x00/rt2x00crypto.c b/drivers/net/wireless/rt2x00/rt2x00crypto.c
index e1448cfa9444..5a858e5106c4 100644
--- a/drivers/net/wireless/rt2x00/rt2x00crypto.c
+++ b/drivers/net/wireless/rt2x00/rt2x00crypto.c
@@ -56,10 +56,10 @@ unsigned int rt2x00crypto_tx_overhead(struct ieee80211_tx_info *tx_info)
          * note that these lengths should only be added when
          * mac80211 does not generate it.
          */
-        overhead += tx_info->control.icv_len;
+        overhead += key->icv_len;
 
         if (!(key->flags & IEEE80211_KEY_FLAG_GENERATE_IV))
-                overhead += tx_info->control.iv_len;
+                overhead += key->iv_len;
 
         if (!(key->flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) {
                 if (key->alg == ALG_TKIP)
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index b7f4fe8fba6e..1676ac484790 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -374,7 +374,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb)
         struct queue_entry *entry = rt2x00queue_get_entry(queue, Q_INDEX);
         struct txentry_desc txdesc;
         struct skb_frame_desc *skbdesc;
-        unsigned int iv_len = IEEE80211_SKB_CB(skb)->control.iv_len;
+        unsigned int iv_len;
 
         if (unlikely(rt2x00queue_full(queue)))
                 return -EINVAL;
@@ -410,8 +410,11 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb)
          * the frame so we can provide it to the driver seperately.
          */
         if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc.flags) &&
-            !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags))
+            !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags) &&
+                (IEEE80211_SKB_CB(skb)->control.hw_key != NULL)) {
+                iv_len = IEEE80211_SKB_CB(skb)->control.hw_key->iv_len;
                 rt2x00crypto_tx_remove_iv(skb, iv_len);
+        }
 
         /*
          * It could be possible that the queue was corrupted and this
diff --git a/drivers/net/wireless/rt2x00/rt2x00rfkill.c b/drivers/net/wireless/rt2x00/rt2x00rfkill.c
index 55eff58f1889..c3f53a92180a 100644
--- a/drivers/net/wireless/rt2x00/rt2x00rfkill.c
+++ b/drivers/net/wireless/rt2x00/rt2x00rfkill.c
@@ -145,10 +145,15 @@ void rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev)
 
         rt2x00dev->rfkill->name = rt2x00dev->ops->name;
         rt2x00dev->rfkill->data = rt2x00dev;
-        rt2x00dev->rfkill->state = -1;
         rt2x00dev->rfkill->toggle_radio = rt2x00rfkill_toggle_radio;
-        if (test_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags))
+        if (test_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags)) {
                 rt2x00dev->rfkill->get_state = rt2x00rfkill_get_state;
+                rt2x00dev->rfkill->state =
+                        rt2x00dev->ops->lib->rfkill_poll(rt2x00dev) ?
+                            RFKILL_STATE_SOFT_BLOCKED : RFKILL_STATE_UNBLOCKED;
+        } else {
+                rt2x00dev->rfkill->state = RFKILL_STATE_UNBLOCKED;
+        }
 
         INIT_DELAYED_WORK(&rt2x00dev->rfkill_work, rt2x00rfkill_poll);
 
diff --git a/drivers/net/wireless/rtl8180_dev.c b/drivers/net/wireless/rtl8180_dev.c
index abcd641c54be..df7e78ee8a88 100644
--- a/drivers/net/wireless/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl8180_dev.c
@@ -292,8 +292,8 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         entry->plcp_len = cpu_to_le16(plcp_len);
         entry->tx_buf = cpu_to_le32(mapping);
         entry->frame_len = cpu_to_le32(skb->len);
-        entry->flags2 = info->control.alt_retry_rate_idx >= 0 ?
-                ieee80211_get_alt_retry_rate(dev, info)->bitrate << 4 : 0;
+        entry->flags2 = info->control.retries[0].rate_idx >= 0 ?
+                ieee80211_get_alt_retry_rate(dev, info, 0)->bitrate << 4 : 0;
         entry->retry_limit = info->control.retry_limit;
         entry->flags = cpu_to_le32(tx_flags);
         __skb_queue_tail(&ring->queue, skb);
@@ -855,6 +855,7 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
         priv = dev->priv;
         priv->pdev = pdev;
 
+        dev->max_altrates = 1;
         SET_IEEE80211_DEV(dev, &pdev->dev);
         pci_set_drvdata(pdev, dev);