193 files changed, 12880 insertions, 11723 deletions

diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 293f9c16e786..3d52538df6c4 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -150,9 +150,8 @@ static inline void b44_sync_dma_desc_for_device(struct ssb_device *sdev,
                                                 unsigned long offset,
                                                 enum dma_data_direction dir)
 {
-        ssb_dma_sync_single_range_for_device(sdev, dma_base,
-                                             offset & dma_desc_align_mask,
-                                             dma_desc_sync_size, dir);
+        dma_sync_single_for_device(sdev->dma_dev, dma_base + offset,
+                                   dma_desc_sync_size, dir);
 }
 
 static inline void b44_sync_dma_desc_for_cpu(struct ssb_device *sdev,
@@ -160,9 +159,8 @@ static inline void b44_sync_dma_desc_for_cpu(struct ssb_device *sdev,
                                              unsigned long offset,
                                              enum dma_data_direction dir)
 {
-        ssb_dma_sync_single_range_for_cpu(sdev, dma_base,
-                                          offset & dma_desc_align_mask,
-                                          dma_desc_sync_size, dir);
+        dma_sync_single_for_cpu(sdev->dma_dev, dma_base + offset,
+                                dma_desc_sync_size, dir);
 }
 
 static inline unsigned long br32(const struct b44 *bp, unsigned long reg)
@@ -608,10 +606,10 @@ static void b44_tx(struct b44 *bp)
 
                 BUG_ON(skb == NULL);
 
-                ssb_dma_unmap_single(bp->sdev,
-                                     rp->mapping,
-                                     skb->len,
-                                     DMA_TO_DEVICE);
+                dma_unmap_single(bp->sdev->dma_dev,
+                                 rp->mapping,
+                                 skb->len,
+                                 DMA_TO_DEVICE);
                 rp->skb = NULL;
                 dev_kfree_skb_irq(skb);
         }
@@ -648,29 +646,29 @@ static int b44_alloc_rx_skb(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
         if (skb == NULL)
                 return -ENOMEM;
 
-        mapping = ssb_dma_map_single(bp->sdev, skb->data,
-                                     RX_PKT_BUF_SZ,
-                                     DMA_FROM_DEVICE);
+        mapping = dma_map_single(bp->sdev->dma_dev, skb->data,
+                                 RX_PKT_BUF_SZ,
+                                 DMA_FROM_DEVICE);
 
         /* Hardware bug work-around, the chip is unable to do PCI DMA
            to/from anything above 1GB :-( */
-        if (ssb_dma_mapping_error(bp->sdev, mapping) ||
+        if (dma_mapping_error(bp->sdev->dma_dev, mapping) ||
                 mapping + RX_PKT_BUF_SZ > DMA_BIT_MASK(30)) {
                 /* Sigh... */
-                if (!ssb_dma_mapping_error(bp->sdev, mapping))
-                        ssb_dma_unmap_single(bp->sdev, mapping,
+                if (!dma_mapping_error(bp->sdev->dma_dev, mapping))
+                        dma_unmap_single(bp->sdev->dma_dev, mapping,
                                              RX_PKT_BUF_SZ, DMA_FROM_DEVICE);
                 dev_kfree_skb_any(skb);
                 skb = __netdev_alloc_skb(bp->dev, RX_PKT_BUF_SZ, GFP_ATOMIC|GFP_DMA);
                 if (skb == NULL)
                         return -ENOMEM;
-                mapping = ssb_dma_map_single(bp->sdev, skb->data,
-                                             RX_PKT_BUF_SZ,
-                                             DMA_FROM_DEVICE);
-                if (ssb_dma_mapping_error(bp->sdev, mapping) ||
-                        mapping + RX_PKT_BUF_SZ > DMA_BIT_MASK(30)) {
-                        if (!ssb_dma_mapping_error(bp->sdev, mapping))
-                                ssb_dma_unmap_single(bp->sdev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE);
+                mapping = dma_map_single(bp->sdev->dma_dev, skb->data,
+                                         RX_PKT_BUF_SZ,
+                                         DMA_FROM_DEVICE);
+                if (dma_mapping_error(bp->sdev->dma_dev, mapping) ||
+                    mapping + RX_PKT_BUF_SZ > DMA_BIT_MASK(30)) {
+                        if (!dma_mapping_error(bp->sdev->dma_dev, mapping))
+                                dma_unmap_single(bp->sdev->dma_dev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE);
                         dev_kfree_skb_any(skb);
                         return -ENOMEM;
                 }
@@ -745,9 +743,9 @@ static void b44_recycle_rx(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
                                              dest_idx * sizeof(*dest_desc),
                                              DMA_BIDIRECTIONAL);
 
-        ssb_dma_sync_single_for_device(bp->sdev, dest_map->mapping,
-                                       RX_PKT_BUF_SZ,
-                                       DMA_FROM_DEVICE);
+        dma_sync_single_for_device(bp->sdev->dma_dev, dest_map->mapping,
+                                   RX_PKT_BUF_SZ,
+                                   DMA_FROM_DEVICE);
 }
 
 static int b44_rx(struct b44 *bp, int budget)
@@ -767,9 +765,9 @@ static int b44_rx(struct b44 *bp, int budget)
                 struct rx_header *rh;
                 u16 len;
 
-                ssb_dma_sync_single_for_cpu(bp->sdev, map,
-                                            RX_PKT_BUF_SZ,
-                                            DMA_FROM_DEVICE);
+                dma_sync_single_for_cpu(bp->sdev->dma_dev, map,
+                                        RX_PKT_BUF_SZ,
+                                        DMA_FROM_DEVICE);
                 rh = (struct rx_header *) skb->data;
                 len = le16_to_cpu(rh->len);
                 if ((len > (RX_PKT_BUF_SZ - RX_PKT_OFFSET)) ||
@@ -801,8 +799,8 @@ static int b44_rx(struct b44 *bp, int budget)
                         skb_size = b44_alloc_rx_skb(bp, cons, bp->rx_prod);
                         if (skb_size < 0)
                                 goto drop_it;
-                        ssb_dma_unmap_single(bp->sdev, map,
-                                             skb_size, DMA_FROM_DEVICE);
+                        dma_unmap_single(bp->sdev->dma_dev, map,
+                                         skb_size, DMA_FROM_DEVICE);
                         /* Leave out rx_header */
                         skb_put(skb, len + RX_PKT_OFFSET);
                         skb_pull(skb, RX_PKT_OFFSET);
@@ -954,24 +952,24 @@ static netdev_tx_t b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto err_out;
         }
 
-        mapping = ssb_dma_map_single(bp->sdev, skb->data, len, DMA_TO_DEVICE);
-        if (ssb_dma_mapping_error(bp->sdev, mapping) || mapping + len > DMA_BIT_MASK(30)) {
+        mapping = dma_map_single(bp->sdev->dma_dev, skb->data, len, DMA_TO_DEVICE);
+        if (dma_mapping_error(bp->sdev->dma_dev, mapping) || mapping + len > DMA_BIT_MASK(30)) {
                 struct sk_buff *bounce_skb;
 
                 /* Chip can't handle DMA to/from >1GB, use bounce buffer */
-                if (!ssb_dma_mapping_error(bp->sdev, mapping))
-                        ssb_dma_unmap_single(bp->sdev, mapping, len,
+                if (!dma_mapping_error(bp->sdev->dma_dev, mapping))
+                        dma_unmap_single(bp->sdev->dma_dev, mapping, len,
                                              DMA_TO_DEVICE);
 
                 bounce_skb = __netdev_alloc_skb(dev, len, GFP_ATOMIC | GFP_DMA);
                 if (!bounce_skb)
                         goto err_out;
 
-                mapping = ssb_dma_map_single(bp->sdev, bounce_skb->data,
-                                             len, DMA_TO_DEVICE);
-                if (ssb_dma_mapping_error(bp->sdev, mapping) || mapping + len > DMA_BIT_MASK(30)) {
-                        if (!ssb_dma_mapping_error(bp->sdev, mapping))
-                                ssb_dma_unmap_single(bp->sdev, mapping,
+                mapping = dma_map_single(bp->sdev->dma_dev, bounce_skb->data,
+                                         len, DMA_TO_DEVICE);
+                if (dma_mapping_error(bp->sdev->dma_dev, mapping) || mapping + len > DMA_BIT_MASK(30)) {
+                        if (!dma_mapping_error(bp->sdev->dma_dev, mapping))
+                                dma_unmap_single(bp->sdev->dma_dev, mapping,
                                                      len, DMA_TO_DEVICE);
                         dev_kfree_skb_any(bounce_skb);
                         goto err_out;
@@ -1068,8 +1066,8 @@ static void b44_free_rings(struct b44 *bp)
 
                 if (rp->skb == NULL)
                         continue;
-                ssb_dma_unmap_single(bp->sdev, rp->mapping, RX_PKT_BUF_SZ,
-                                     DMA_FROM_DEVICE);
+                dma_unmap_single(bp->sdev->dma_dev, rp->mapping, RX_PKT_BUF_SZ,
+                                 DMA_FROM_DEVICE);
                 dev_kfree_skb_any(rp->skb);
                 rp->skb = NULL;
         }
@@ -1080,8 +1078,8 @@ static void b44_free_rings(struct b44 *bp)
 
                 if (rp->skb == NULL)
                         continue;
-                ssb_dma_unmap_single(bp->sdev, rp->mapping, rp->skb->len,
-                                     DMA_TO_DEVICE);
+                dma_unmap_single(bp->sdev->dma_dev, rp->mapping, rp->skb->len,
+                                 DMA_TO_DEVICE);
                 dev_kfree_skb_any(rp->skb);
                 rp->skb = NULL;
         }
@@ -1103,14 +1101,12 @@ static void b44_init_rings(struct b44 *bp)
         memset(bp->tx_ring, 0, B44_TX_RING_BYTES);
 
         if (bp->flags & B44_FLAG_RX_RING_HACK)
-                ssb_dma_sync_single_for_device(bp->sdev, bp->rx_ring_dma,
-                                               DMA_TABLE_BYTES,
-                                               DMA_BIDIRECTIONAL);
+                dma_sync_single_for_device(bp->sdev->dma_dev, bp->rx_ring_dma,
+                                           DMA_TABLE_BYTES, DMA_BIDIRECTIONAL);
 
         if (bp->flags & B44_FLAG_TX_RING_HACK)
-                ssb_dma_sync_single_for_device(bp->sdev, bp->tx_ring_dma,
-                                               DMA_TABLE_BYTES,
-                                               DMA_TO_DEVICE);
+                dma_sync_single_for_device(bp->sdev->dma_dev, bp->tx_ring_dma,
+                                           DMA_TABLE_BYTES, DMA_TO_DEVICE);
 
         for (i = 0; i < bp->rx_pending; i++) {
                 if (b44_alloc_rx_skb(bp, -1, i) < 0)
@@ -1130,27 +1126,23 @@ static void b44_free_consistent(struct b44 *bp)
         bp->tx_buffers = NULL;
         if (bp->rx_ring) {
                 if (bp->flags & B44_FLAG_RX_RING_HACK) {
-                        ssb_dma_unmap_single(bp->sdev, bp->rx_ring_dma,
-                                             DMA_TABLE_BYTES,
-                                             DMA_BIDIRECTIONAL);
+                        dma_unmap_single(bp->sdev->dma_dev, bp->rx_ring_dma,
+                                         DMA_TABLE_BYTES, DMA_BIDIRECTIONAL);
                         kfree(bp->rx_ring);
                 } else
-                        ssb_dma_free_consistent(bp->sdev, DMA_TABLE_BYTES,
-                                                bp->rx_ring, bp->rx_ring_dma,
-                                                GFP_KERNEL);
+                        dma_free_coherent(bp->sdev->dma_dev, DMA_TABLE_BYTES,
+                                          bp->rx_ring, bp->rx_ring_dma);
                 bp->rx_ring = NULL;
                 bp->flags &= ~B44_FLAG_RX_RING_HACK;
         }
         if (bp->tx_ring) {
                 if (bp->flags & B44_FLAG_TX_RING_HACK) {
-                        ssb_dma_unmap_single(bp->sdev, bp->tx_ring_dma,
-                                             DMA_TABLE_BYTES,
-                                             DMA_TO_DEVICE);
+                        dma_unmap_single(bp->sdev->dma_dev, bp->tx_ring_dma,
+                                         DMA_TABLE_BYTES, DMA_TO_DEVICE);
                         kfree(bp->tx_ring);
                 } else
-                        ssb_dma_free_consistent(bp->sdev, DMA_TABLE_BYTES,
-                                                bp->tx_ring, bp->tx_ring_dma,
-                                                GFP_KERNEL);
+                        dma_free_coherent(bp->sdev->dma_dev, DMA_TABLE_BYTES,
+                                          bp->tx_ring, bp->tx_ring_dma);
                 bp->tx_ring = NULL;
                 bp->flags &= ~B44_FLAG_TX_RING_HACK;
         }
@@ -1175,7 +1167,8 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp)
                 goto out_err;
 
         size = DMA_TABLE_BYTES;
-        bp->rx_ring = ssb_dma_alloc_consistent(bp->sdev, size, &bp->rx_ring_dma, gfp);
+        bp->rx_ring = dma_alloc_coherent(bp->sdev->dma_dev, size,
+                                         &bp->rx_ring_dma, gfp);
         if (!bp->rx_ring) {
                 /* Allocation may have failed due to pci_alloc_consistent
                    insisting on use of GFP_DMA, which is more restrictive
@@ -1187,11 +1180,11 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp)
                 if (!rx_ring)
                         goto out_err;
 
-                rx_ring_dma = ssb_dma_map_single(bp->sdev, rx_ring,
-                                                 DMA_TABLE_BYTES,
-                                                 DMA_BIDIRECTIONAL);
+                rx_ring_dma = dma_map_single(bp->sdev->dma_dev, rx_ring,
+                                             DMA_TABLE_BYTES,
+                                             DMA_BIDIRECTIONAL);
 
-                if (ssb_dma_mapping_error(bp->sdev, rx_ring_dma) ||
+                if (dma_mapping_error(bp->sdev->dma_dev, rx_ring_dma) ||
                         rx_ring_dma + size > DMA_BIT_MASK(30)) {
                         kfree(rx_ring);
                         goto out_err;
@@ -1202,7 +1195,8 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp)
                 bp->flags |= B44_FLAG_RX_RING_HACK;
         }
 
-        bp->tx_ring = ssb_dma_alloc_consistent(bp->sdev, size, &bp->tx_ring_dma, gfp);
+        bp->tx_ring = dma_alloc_coherent(bp->sdev->dma_dev, size,
+                                         &bp->tx_ring_dma, gfp);
         if (!bp->tx_ring) {
                 /* Allocation may have failed due to ssb_dma_alloc_consistent
                    insisting on use of GFP_DMA, which is more restrictive
@@ -1214,11 +1208,11 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp)
                 if (!tx_ring)
                         goto out_err;
 
-                tx_ring_dma = ssb_dma_map_single(bp->sdev, tx_ring,
-                                            DMA_TABLE_BYTES,
-                                            DMA_TO_DEVICE);
+                tx_ring_dma = dma_map_single(bp->sdev->dma_dev, tx_ring,
+                                             DMA_TABLE_BYTES,
+                                             DMA_TO_DEVICE);
 
-                if (ssb_dma_mapping_error(bp->sdev, tx_ring_dma) ||
+                if (dma_mapping_error(bp->sdev->dma_dev, tx_ring_dma) ||
                         tx_ring_dma + size > DMA_BIT_MASK(30)) {
                         kfree(tx_ring);
                         goto out_err;
@@ -2176,12 +2170,14 @@ static int __devinit b44_init_one(struct ssb_device *sdev,
                         "Failed to powerup the bus\n");
                 goto err_out_free_dev;
         }
-        err = ssb_dma_set_mask(sdev, DMA_BIT_MASK(30));
-        if (err) {
+
+        if (dma_set_mask(sdev->dma_dev, DMA_BIT_MASK(30)) ||
+            dma_set_coherent_mask(sdev->dma_dev, DMA_BIT_MASK(30))) {
                 dev_err(sdev->dev,
                         "Required 30BIT DMA mask unsupported by the system\n");
                 goto err_out_powerdown;
         }
+
         err = b44_get_invariants(bp);
         if (err) {
                 dev_err(sdev->dev,
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 8a2d4afc74f8..98328b7f8332 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -7,6 +7,7 @@
  * Copyright (c) 2004 Balint Seeber <n0_5p4m_p13453@hotmail.com>
  * Copyright (c) 2007 Guido Guenther <agx@sigxcpu.org>
  * Copyright (c) 2007 Kalle Valo <kalle.valo@iki.fi>
+ * Copyright (c) 2010 Sebastian Smolorz <sesmo@gmx.net>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
@@ -1649,6 +1650,58 @@ exit:
                 return NULL;
 }
 
+static int at76_join(struct at76_priv *priv)
+{
+        struct at76_req_join join;
+        int ret;
+
+        memset(&join, 0, sizeof(struct at76_req_join));
+        memcpy(join.essid, priv->essid, priv->essid_size);
+        join.essid_size = priv->essid_size;
+        memcpy(join.bssid, priv->bssid, ETH_ALEN);
+        join.bss_type = INFRASTRUCTURE_MODE;
+        join.channel = priv->channel;
+        join.timeout = cpu_to_le16(2000);
+
+        at76_dbg(DBG_MAC80211, "%s: sending CMD_JOIN", __func__);
+        ret = at76_set_card_command(priv->udev, CMD_JOIN, &join,
+                                    sizeof(struct at76_req_join));
+
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_set_card_command failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                return 0;
+        }
+
+        ret = at76_wait_completion(priv, CMD_JOIN);
+        at76_dbg(DBG_MAC80211, "%s: CMD_JOIN returned: 0x%02x", __func__, ret);
+        if (ret != CMD_STATUS_COMPLETE) {
+                printk(KERN_ERR "%s: at76_wait_completion failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                return 0;
+        }
+
+        at76_set_pm_mode(priv);
+
+        return 0;
+}
+
+static void at76_work_join_bssid(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              work_join_bssid);
+
+        if (priv->device_unplugged)
+                return;
+
+        mutex_lock(&priv->mtx);
+
+        if (is_valid_ether_addr(priv->bssid))
+                at76_join(priv);
+
+        mutex_unlock(&priv->mtx);
+}
+
 static void at76_mac80211_tx_callback(struct urb *urb)
 {
         struct at76_priv *priv = urb->context;
@@ -1686,6 +1739,7 @@ static int at76_mac80211_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct at76_priv *priv = hw->priv;
         struct at76_tx_buffer *tx_buffer = priv->bulk_out_buffer;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
         int padding, submit_len, ret;
 
         at76_dbg(DBG_MAC80211, "%s()", __func__);
@@ -1696,6 +1750,21 @@ static int at76_mac80211_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 return NETDEV_TX_BUSY;
         }
 
+        /* The following code lines are important when the device is going to
+         * authenticate with a new bssid. The driver must send CMD_JOIN before
+         * an authentication frame is transmitted. For this to succeed, the
+         * correct bssid of the AP must be known. As mac80211 does not inform
+         * drivers about the bssid prior to the authentication process the
+         * following workaround is necessary. If the TX frame is an
+         * authentication frame extract the bssid and send the CMD_JOIN. */
+        if (mgmt->frame_control & cpu_to_le16(IEEE80211_STYPE_AUTH)) {
+                if (compare_ether_addr(priv->bssid, mgmt->bssid)) {
+                        memcpy(priv->bssid, mgmt->bssid, ETH_ALEN);
+                        ieee80211_queue_work(hw, &priv->work_join_bssid);
+                        return NETDEV_TX_BUSY;
+                }
+        }
+
         ieee80211_stop_queues(hw);
 
         at76_ledtrig_tx_activity();     /* tell ledtrigger we send a packet */
@@ -1770,6 +1839,7 @@ static void at76_mac80211_stop(struct ieee80211_hw *hw)
         at76_dbg(DBG_MAC80211, "%s()", __func__);
 
         cancel_delayed_work(&priv->dwork_hw_scan);
+        cancel_work_sync(&priv->work_join_bssid);
         cancel_work_sync(&priv->work_set_promisc);
 
         mutex_lock(&priv->mtx);
@@ -1818,42 +1888,6 @@ static void at76_remove_interface(struct ieee80211_hw *hw,
         at76_dbg(DBG_MAC80211, "%s()", __func__);
 }
 
-static int at76_join(struct at76_priv *priv)
-{
-        struct at76_req_join join;
-        int ret;
-
-        memset(&join, 0, sizeof(struct at76_req_join));
-        memcpy(join.essid, priv->essid, priv->essid_size);
-        join.essid_size = priv->essid_size;
-        memcpy(join.bssid, priv->bssid, ETH_ALEN);
-        join.bss_type = INFRASTRUCTURE_MODE;
-        join.channel = priv->channel;
-        join.timeout = cpu_to_le16(2000);
-
-        at76_dbg(DBG_MAC80211, "%s: sending CMD_JOIN", __func__);
-        ret = at76_set_card_command(priv->udev, CMD_JOIN, &join,
-                                    sizeof(struct at76_req_join));
-
-        if (ret < 0) {
-                printk(KERN_ERR "%s: at76_set_card_command failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
-                return 0;
-        }
-
-        ret = at76_wait_completion(priv, CMD_JOIN);
-        at76_dbg(DBG_MAC80211, "%s: CMD_JOIN returned: 0x%02x", __func__, ret);
-        if (ret != CMD_STATUS_COMPLETE) {
-                printk(KERN_ERR "%s: at76_wait_completion failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
-                return 0;
-        }
-
-        at76_set_pm_mode(priv);
-
-        return 0;
-}
-
 static void at76_dwork_hw_scan(struct work_struct *work)
 {
         struct at76_priv *priv = container_of(work, struct at76_priv,
@@ -2107,6 +2141,7 @@ static struct at76_priv *at76_alloc_new_device(struct usb_device *udev)
         mutex_init(&priv->mtx);
         INIT_WORK(&priv->work_set_promisc, at76_work_set_promisc);
         INIT_WORK(&priv->work_submit_rx, at76_work_submit_rx);
+        INIT_WORK(&priv->work_join_bssid, at76_work_join_bssid);
         INIT_DELAYED_WORK(&priv->dwork_hw_scan, at76_dwork_hw_scan);
 
         tasklet_init(&priv->rx_tasklet, at76_rx_tasklet, 0);
@@ -2508,5 +2543,6 @@ MODULE_AUTHOR("Balint Seeber <n0_5p4m_p13453@hotmail.com>");
 MODULE_AUTHOR("Pavel Roskin <proski@gnu.org>");
 MODULE_AUTHOR("Guido Guenther <agx@sigxcpu.org>");
 MODULE_AUTHOR("Kalle Valo <kalle.valo@iki.fi>");
+MODULE_AUTHOR("Sebastian Smolorz <sesmo@gmx.net>");
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/at76c50x-usb.h b/drivers/net/wireless/at76c50x-usb.h
index 1ec5ccffdbc0..db89d72df4f3 100644
--- a/drivers/net/wireless/at76c50x-usb.h
+++ b/drivers/net/wireless/at76c50x-usb.h
@@ -387,6 +387,7 @@ struct at76_priv {
         /* work queues */
         struct work_struct work_set_promisc;
         struct work_struct work_submit_rx;
+        struct work_struct work_join_bssid;
         struct delayed_work dwork_hw_scan;
 
         struct tasklet_struct rx_tasklet;
diff --git a/drivers/net/wireless/ath/ath5k/Makefile b/drivers/net/wireless/ath/ath5k/Makefile
index cc09595b781a..2242a140e4fe 100644
--- a/drivers/net/wireless/ath/ath5k/Makefile
+++ b/drivers/net/wireless/ath/ath5k/Makefile
@@ -13,5 +13,6 @@ ath5k-y				+= base.o
 ath5k-y                         += led.o
 ath5k-y                         += rfkill.o
 ath5k-y                         += ani.o
+ath5k-y                         += sysfs.o
 ath5k-$(CONFIG_ATH5K_DEBUG)     += debug.o
 obj-$(CONFIG_ATH5K)             += ath5k.o
diff --git a/drivers/net/wireless/ath/ath5k/ani.c b/drivers/net/wireless/ath/ath5k/ani.c
index f2311ab35504..26dbe65fedb0 100644
--- a/drivers/net/wireless/ath/ath5k/ani.c
+++ b/drivers/net/wireless/ath/ath5k/ani.c
@@ -74,8 +74,8 @@ ath5k_ani_set_noise_immunity_level(struct ath5k_hw *ah, int level)
         const s8 fr[] = { -78, -80 };
 #endif
         if (level < 0 || level >= ARRAY_SIZE(sz)) {
-                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
-                        "level out of range %d", level);
+                ATH5K_ERR(ah->ah_sc, "noise immuniy level %d out of range",
+                          level);
                 return;
         }
 
@@ -106,8 +106,8 @@ ath5k_ani_set_spur_immunity_level(struct ath5k_hw *ah, int level)
 
         if (level < 0 || level >= ARRAY_SIZE(val) ||
             level > ah->ah_sc->ani_state.max_spur_level) {
-                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
-                        "level out of range %d", level);
+                ATH5K_ERR(ah->ah_sc, "spur immunity level %d out of range",
+                          level);
                 return;
         }
 
@@ -130,8 +130,7 @@ ath5k_ani_set_firstep_level(struct ath5k_hw *ah, int level)
         const int val[] = { 0, 4, 8 };
 
         if (level < 0 || level >= ARRAY_SIZE(val)) {
-                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
-                        "level out of range %d", level);
+                ATH5K_ERR(ah->ah_sc, "firstep level %d out of range", level);
                 return;
         }
 
@@ -481,14 +480,15 @@ ath5k_ani_calibration(struct ath5k_hw *ah)
         struct ath5k_ani_state *as = &ah->ah_sc->ani_state;
         int listen, ofdm_high, ofdm_low, cck_high, cck_low;
 
-        if (as->ani_mode != ATH5K_ANI_MODE_AUTO)
-                return;
-
         /* get listen time since last call and add it to the counter because we
-         * might not have restarted the "ani period" last time */
+         * might not have restarted the "ani period" last time.
+         * always do this to calculate the busy time also in manual mode */
         listen = ath5k_hw_ani_get_listen_time(ah, as);
         as->listen_time += listen;
 
+        if (as->ani_mode != ATH5K_ANI_MODE_AUTO)
+                return;
+
         ath5k_ani_save_and_clear_phy_errors(ah, as);
 
         ofdm_high = as->listen_time * ATH5K_ANI_OFDM_TRIG_HIGH / 1000;
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index 2785946f659a..ea6362a8988d 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -204,6 +204,7 @@
 #define AR5K_TUNE_TPC_TXPOWER                   false
 #define ATH5K_TUNE_CALIBRATION_INTERVAL_FULL    10000   /* 10 sec */
 #define ATH5K_TUNE_CALIBRATION_INTERVAL_ANI     1000    /* 1 sec */
+#define ATH5K_TUNE_CALIBRATION_INTERVAL_NF      60000   /* 60 sec */
 
 #define AR5K_INIT_CARR_SENSE_EN                 1
 
@@ -565,7 +566,7 @@ enum ath5k_pkt_type {
 )
 
 /*
- * DMA size definitions (2^n+2)
+ * DMA size definitions (2^(n+2))
  */
 enum ath5k_dmasize {
         AR5K_DMASIZE_4B = 0,
@@ -1118,6 +1119,7 @@ struct ath5k_hw {
         /* Calibration timestamp */
         unsigned long           ah_cal_next_full;
         unsigned long           ah_cal_next_ani;
+        unsigned long           ah_cal_next_nf;
 
         /* Calibration mask */
         u8                      ah_cal_mask;
@@ -1125,15 +1127,10 @@ struct ath5k_hw {
         /*
          * Function pointers
          */
-        int (*ah_setup_rx_desc)(struct ath5k_hw *ah, struct ath5k_desc *desc,
-                                u32 size, unsigned int flags);
         int (*ah_setup_tx_desc)(struct ath5k_hw *, struct ath5k_desc *,
                 unsigned int, unsigned int, int, enum ath5k_pkt_type,
                 unsigned int, unsigned int, unsigned int, unsigned int,
                 unsigned int, unsigned int, unsigned int, unsigned int);
-        int (*ah_setup_mrr_tx_desc)(struct ath5k_hw *, struct ath5k_desc *,
-                unsigned int, unsigned int, unsigned int, unsigned int,
-                unsigned int, unsigned int);
         int (*ah_proc_tx_desc)(struct ath5k_hw *, struct ath5k_desc *,
                 struct ath5k_tx_status *);
         int (*ah_proc_rx_desc)(struct ath5k_hw *, struct ath5k_desc *,
@@ -1148,6 +1145,9 @@ struct ath5k_hw {
 int ath5k_hw_attach(struct ath5k_softc *sc);
 void ath5k_hw_detach(struct ath5k_hw *ah);
 
+int ath5k_sysfs_register(struct ath5k_softc *sc);
+void ath5k_sysfs_unregister(struct ath5k_softc *sc);
+
 /* LED functions */
 int ath5k_init_leds(struct ath5k_softc *sc);
 void ath5k_led_enable(struct ath5k_softc *sc);
@@ -1231,6 +1231,11 @@ int ath5k_hw_set_slot_time(struct ath5k_hw *ah, unsigned int slot_time);
 
 /* Hardware Descriptor Functions */
 int ath5k_hw_init_desc_functions(struct ath5k_hw *ah);
+int ath5k_hw_setup_rx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
+                           u32 size, unsigned int flags);
+int ath5k_hw_setup_mrr_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
+        unsigned int tx_rate1, u_int tx_tries1, u_int tx_rate2,
+        u_int tx_tries2, unsigned int tx_rate3, u_int tx_tries3);
 
 /* GPIO Functions */
 void ath5k_hw_set_ledstate(struct ath5k_hw *ah, unsigned int state);
@@ -1270,6 +1275,7 @@ int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *channel);
 void ath5k_hw_init_nfcal_hist(struct ath5k_hw *ah);
 int ath5k_hw_phy_calibrate(struct ath5k_hw *ah,
                            struct ieee80211_channel *channel);
+void ath5k_hw_update_noise_floor(struct ath5k_hw *ah);
 /* Spur mitigation */
 bool ath5k_hw_chan_has_spur_noise(struct ath5k_hw *ah,
                                   struct ieee80211_channel *channel);
@@ -1280,6 +1286,7 @@ u16 ath5k_hw_radio_revision(struct ath5k_hw *ah, unsigned int chan);
 int ath5k_hw_phy_disable(struct ath5k_hw *ah);
 /* Antenna control */
 void ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode);
+void ath5k_hw_set_antenna_switch(struct ath5k_hw *ah, u8 ee_mode);
 /* TX power setup */
 int ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                      u8 ee_mode, u8 txpower);
diff --git a/drivers/net/wireless/ath/ath5k/attach.c b/drivers/net/wireless/ath/ath5k/attach.c
index 31c008042bfe..b32e28caeee2 100644
--- a/drivers/net/wireless/ath/ath5k/attach.c
+++ b/drivers/net/wireless/ath/ath5k/attach.c
@@ -352,8 +352,6 @@ err_free:
  */
 void ath5k_hw_detach(struct ath5k_hw *ah)
 {
-        ATH5K_TRACE(ah->ah_sc);
-
         __set_bit(ATH_STAT_INVALID, ah->ah_sc->status);
 
         if (ah->ah_rf_banks != NULL)
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 648972df369d..20328bdd138b 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -311,7 +311,8 @@ static int 	ath5k_rxbuf_setup(struct ath5k_softc *sc,
 static int      ath5k_txbuf_setup(struct ath5k_softc *sc,
                                 struct ath5k_buf *bf,
                                 struct ath5k_txq *txq, int padsize);
-static inline void ath5k_txbuf_free(struct ath5k_softc *sc,
+
+static inline void ath5k_txbuf_free_skb(struct ath5k_softc *sc,
                                 struct ath5k_buf *bf)
 {
         BUG_ON(!bf);
@@ -321,9 +322,11 @@ static inline void ath5k_txbuf_free(struct ath5k_softc *sc,
                         PCI_DMA_TODEVICE);
         dev_kfree_skb_any(bf->skb);
         bf->skb = NULL;
+        bf->skbaddr = 0;
+        bf->desc->ds_data = 0;
 }
 
-static inline void ath5k_rxbuf_free(struct ath5k_softc *sc,
+static inline void ath5k_rxbuf_free_skb(struct ath5k_softc *sc,
                                 struct ath5k_buf *bf)
 {
         struct ath5k_hw *ah = sc->ah;
@@ -336,6 +339,8 @@ static inline void ath5k_rxbuf_free(struct ath5k_softc *sc,
                         PCI_DMA_FROMDEVICE);
         dev_kfree_skb_any(bf->skb);
         bf->skb = NULL;
+        bf->skbaddr = 0;
+        bf->desc->ds_data = 0;
 }
 
 
@@ -352,7 +357,6 @@ static void 	ath5k_txq_release(struct ath5k_softc *sc);
 static int      ath5k_rx_start(struct ath5k_softc *sc);
 static void     ath5k_rx_stop(struct ath5k_softc *sc);
 static unsigned int ath5k_rx_decrypted(struct ath5k_softc *sc,
-                                        struct ath5k_desc *ds,
                                         struct sk_buff *skb,
                                         struct ath5k_rx_status *rs);
 static void     ath5k_tasklet_rx(unsigned long data);
@@ -578,7 +582,7 @@ ath5k_pci_probe(struct pci_dev *pdev,
         spin_lock_init(&sc->block);
 
         /* Set private data */
-        pci_set_drvdata(pdev, hw);
+        pci_set_drvdata(pdev, sc);
 
         /* Setup interrupt handler */
         ret = request_irq(pdev->irq, ath5k_intr, IRQF_SHARED, "ath", sc);
@@ -694,25 +698,23 @@ err:
 static void __devexit
 ath5k_pci_remove(struct pci_dev *pdev)
 {
-        struct ieee80211_hw *hw = pci_get_drvdata(pdev);
-        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_softc *sc = pci_get_drvdata(pdev);
 
         ath5k_debug_finish_device(sc);
-        ath5k_detach(pdev, hw);
+        ath5k_detach(pdev, sc->hw);
         ath5k_hw_detach(sc->ah);
         kfree(sc->ah);
         free_irq(pdev->irq, sc);
         pci_iounmap(pdev, sc->iobase);
         pci_release_region(pdev, 0);
         pci_disable_device(pdev);
-        ieee80211_free_hw(hw);
+        ieee80211_free_hw(sc->hw);
 }
 
 #ifdef CONFIG_PM_SLEEP
 static int ath5k_pci_suspend(struct device *dev)
 {
-        struct ieee80211_hw *hw = pci_get_drvdata(to_pci_dev(dev));
-        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_softc *sc = pci_get_drvdata(to_pci_dev(dev));
 
         ath5k_led_off(sc);
         return 0;
@@ -721,8 +723,7 @@ static int ath5k_pci_suspend(struct device *dev)
 static int ath5k_pci_resume(struct device *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
-        struct ieee80211_hw *hw = pci_get_drvdata(pdev);
-        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_softc *sc = pci_get_drvdata(pdev);
 
         /*
          * Suspend/Resume resets the PCI configuration space, so we have to
@@ -768,7 +769,8 @@ ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
          * return false w/o doing anything.  MAC's that do
          * support it will return true w/o doing anything.
          */
-        ret = ah->ah_setup_mrr_tx_desc(ah, NULL, 0, 0, 0, 0, 0, 0);
+        ret = ath5k_hw_setup_mrr_tx_desc(ah, NULL, 0, 0, 0, 0, 0, 0);
+
         if (ret < 0)
                 goto err;
         if (ret > 0)
@@ -864,6 +866,8 @@ ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
 
         ath5k_init_leds(sc);
 
+        ath5k_sysfs_register(sc);
+
         return 0;
 err_queues:
         ath5k_txq_release(sc);
@@ -899,6 +903,7 @@ ath5k_detach(struct pci_dev *pdev, struct ieee80211_hw *hw)
         ath5k_hw_release_tx_queue(sc->ah, sc->bhalq);
         ath5k_unregister_leds(sc);
 
+        ath5k_sysfs_unregister(sc);
         /*
          * NB: can't reclaim these until after ieee80211_ifdetach
          * returns because we'll get called back to reclaim node
@@ -1111,8 +1116,9 @@ ath5k_setup_bands(struct ieee80211_hw *hw)
 static int
 ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
 {
-        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "(%u MHz) -> (%u MHz)\n",
-                sc->curchan->center_freq, chan->center_freq);
+        ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
+                  "channel set, resetting (%u -> %u MHz)\n",
+                  sc->curchan->center_freq, chan->center_freq);
 
         /*
          * To switch channels clear any pending DMA operations;
@@ -1228,21 +1234,23 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
          * not get overrun under high load (as can happen with a
          * 5212 when ANI processing enables PHY error frames).
          *
-         * To insure the last descriptor is self-linked we create
+         * To ensure the last descriptor is self-linked we create
          * each descriptor as self-linked and add it to the end.  As
          * each additional descriptor is added the previous self-linked
-         * entry is ``fixed'' naturally.  This should be safe even
+         * entry is "fixed" naturally.  This should be safe even
          * if DMA is happening.  When processing RX interrupts we
          * never remove/process the last, self-linked, entry on the
-         * descriptor list.  This insures the hardware always has
+         * descriptor list.  This ensures the hardware always has
          * someplace to write a new frame.
          */
         ds = bf->desc;
         ds->ds_link = bf->daddr;        /* link to self */
         ds->ds_data = bf->skbaddr;
-        ret = ah->ah_setup_rx_desc(ah, ds, ah->common.rx_bufsize, 0);
-        if (ret)
+        ret = ath5k_hw_setup_rx_desc(ah, ds, ah->common.rx_bufsize, 0);
+        if (ret) {
+                ATH5K_ERR(sc, "%s: could not setup RX desc\n", __func__);
                 return ret;
+        }
 
         if (sc->rxlink != NULL)
                 *sc->rxlink = bf->daddr;
@@ -1347,7 +1355,7 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
                 mrr_tries[i] = info->control.rates[i + 1].count;
         }
 
-        ah->ah_setup_mrr_tx_desc(ah, ds,
+        ath5k_hw_setup_mrr_tx_desc(ah, ds,
                 mrr_rate[0], mrr_tries[0],
                 mrr_rate[1], mrr_tries[1],
                 mrr_rate[2], mrr_tries[2]);
@@ -1443,17 +1451,20 @@ ath5k_desc_free(struct ath5k_softc *sc, struct pci_dev *pdev)
 {
         struct ath5k_buf *bf;
 
-        ath5k_txbuf_free(sc, sc->bbuf);
+        ath5k_txbuf_free_skb(sc, sc->bbuf);
         list_for_each_entry(bf, &sc->txbuf, list)
-                ath5k_txbuf_free(sc, bf);
+                ath5k_txbuf_free_skb(sc, bf);
         list_for_each_entry(bf, &sc->rxbuf, list)
-                ath5k_rxbuf_free(sc, bf);
+                ath5k_rxbuf_free_skb(sc, bf);
 
         /* Free memory associated with all descriptors */
         pci_free_consistent(pdev, sc->desc_len, sc->desc, sc->desc_daddr);
+        sc->desc = NULL;
+        sc->desc_daddr = 0;
 
         kfree(sc->bufptr);
         sc->bufptr = NULL;
+        sc->bbuf = NULL;
 }
 
 
@@ -1602,7 +1613,7 @@ ath5k_txq_drainq(struct ath5k_softc *sc, struct ath5k_txq *txq)
         list_for_each_entry_safe(bf, bf0, &txq->q, list) {
                 ath5k_debug_printtxbuf(sc, bf);
 
-                ath5k_txbuf_free(sc, bf);
+                ath5k_txbuf_free_skb(sc, bf);
 
                 spin_lock_bh(&sc->txbuflock);
                 list_move_tail(&bf->list, &sc->txbuf);
@@ -1721,8 +1732,8 @@ ath5k_rx_stop(struct ath5k_softc *sc)
 }
 
 static unsigned int
-ath5k_rx_decrypted(struct ath5k_softc *sc, struct ath5k_desc *ds,
-                struct sk_buff *skb, struct ath5k_rx_status *rs)
+ath5k_rx_decrypted(struct ath5k_softc *sc, struct sk_buff *skb,
+                   struct ath5k_rx_status *rs)
 {
         struct ath5k_hw *ah = sc->ah;
         struct ath_common *common = ath5k_hw_common(ah);
@@ -1889,9 +1900,138 @@ static int ath5k_remove_padding(struct sk_buff *skb)
 }
 
 static void
-ath5k_tasklet_rx(unsigned long data)
+ath5k_receive_frame(struct ath5k_softc *sc, struct sk_buff *skb,
+                    struct ath5k_rx_status *rs)
 {
         struct ieee80211_rx_status *rxs;
+
+        /* The MAC header is padded to have 32-bit boundary if the
+         * packet payload is non-zero. The general calculation for
+         * padsize would take into account odd header lengths:
+         * padsize = (4 - hdrlen % 4) % 4; However, since only
+         * even-length headers are used, padding can only be 0 or 2
+         * bytes and we can optimize this a bit. In addition, we must
+         * not try to remove padding from short control frames that do
+         * not have payload. */
+        ath5k_remove_padding(skb);
+
+        rxs = IEEE80211_SKB_RXCB(skb);
+
+        rxs->flag = 0;
+        if (unlikely(rs->rs_status & AR5K_RXERR_MIC))
+                rxs->flag |= RX_FLAG_MMIC_ERROR;
+
+        /*
+         * always extend the mac timestamp, since this information is
+         * also needed for proper IBSS merging.
+         *
+         * XXX: it might be too late to do it here, since rs_tstamp is
+         * 15bit only. that means TSF extension has to be done within
+         * 32768usec (about 32ms). it might be necessary to move this to
+         * the interrupt handler, like it is done in madwifi.
+         *
+         * Unfortunately we don't know when the hardware takes the rx
+         * timestamp (beginning of phy frame, data frame, end of rx?).
+         * The only thing we know is that it is hardware specific...
+         * On AR5213 it seems the rx timestamp is at the end of the
+         * frame, but i'm not sure.
+         *
+         * NOTE: mac80211 defines mactime at the beginning of the first
+         * data symbol. Since we don't have any time references it's
+         * impossible to comply to that. This affects IBSS merge only
+         * right now, so it's not too bad...
+         */
+        rxs->mactime = ath5k_extend_tsf(sc->ah, rs->rs_tstamp);
+        rxs->flag |= RX_FLAG_TSFT;
+
+        rxs->freq = sc->curchan->center_freq;
+        rxs->band = sc->curband->band;
+
+        rxs->signal = sc->ah->ah_noise_floor + rs->rs_rssi;
+
+        rxs->antenna = rs->rs_antenna;
+
+        if (rs->rs_antenna > 0 && rs->rs_antenna < 5)
+                sc->stats.antenna_rx[rs->rs_antenna]++;
+        else
+                sc->stats.antenna_rx[0]++; /* invalid */
+
+        rxs->rate_idx = ath5k_hw_to_driver_rix(sc, rs->rs_rate);
+        rxs->flag |= ath5k_rx_decrypted(sc, skb, rs);
+
+        if (rxs->rate_idx >= 0 && rs->rs_rate ==
+            sc->curband->bitrates[rxs->rate_idx].hw_value_short)
+                rxs->flag |= RX_FLAG_SHORTPRE;
+
+        ath5k_debug_dump_skb(sc, skb, "RX  ", 0);
+
+        ath5k_update_beacon_rssi(sc, skb, rs->rs_rssi);
+
+        /* check beacons in IBSS mode */
+        if (sc->opmode == NL80211_IFTYPE_ADHOC)
+                ath5k_check_ibss_tsf(sc, skb, rxs);
+
+        ieee80211_rx(sc->hw, skb);
+}
+
+/** ath5k_frame_receive_ok() - Do we want to receive this frame or not?
+ *
+ * Check if we want to further process this frame or not. Also update
+ * statistics. Return true if we want this frame, false if not.
+ */
+static bool
+ath5k_receive_frame_ok(struct ath5k_softc *sc, struct ath5k_rx_status *rs)
+{
+        sc->stats.rx_all_count++;
+
+        if (unlikely(rs->rs_status)) {
+                if (rs->rs_status & AR5K_RXERR_CRC)
+                        sc->stats.rxerr_crc++;
+                if (rs->rs_status & AR5K_RXERR_FIFO)
+                        sc->stats.rxerr_fifo++;
+                if (rs->rs_status & AR5K_RXERR_PHY) {
+                        sc->stats.rxerr_phy++;
+                        if (rs->rs_phyerr > 0 && rs->rs_phyerr < 32)
+                                sc->stats.rxerr_phy_code[rs->rs_phyerr]++;
+                        return false;
+                }
+                if (rs->rs_status & AR5K_RXERR_DECRYPT) {
+                        /*
+                         * Decrypt error.  If the error occurred
+                         * because there was no hardware key, then
+                         * let the frame through so the upper layers
+                         * can process it.  This is necessary for 5210
+                         * parts which have no way to setup a ``clear''
+                         * key cache entry.
+                         *
+                         * XXX do key cache faulting
+                         */
+                        sc->stats.rxerr_decrypt++;
+                        if (rs->rs_keyix == AR5K_RXKEYIX_INVALID &&
+                            !(rs->rs_status & AR5K_RXERR_CRC))
+                                return true;
+                }
+                if (rs->rs_status & AR5K_RXERR_MIC) {
+                        sc->stats.rxerr_mic++;
+                        return true;
+                }
+
+                /* let crypto-error packets fall through in MNTR */
+                if ((rs->rs_status & ~(AR5K_RXERR_DECRYPT|AR5K_RXERR_MIC)) ||
+                    sc->opmode != NL80211_IFTYPE_MONITOR)
+                        return false;
+        }
+
+        if (unlikely(rs->rs_more)) {
+                sc->stats.rxerr_jumbo++;
+                return false;
+        }
+        return true;
+}
+
+static void
+ath5k_tasklet_rx(unsigned long data)
+{
         struct ath5k_rx_status rs = {};
         struct sk_buff *skb, *next_skb;
         dma_addr_t next_skb_addr;
@@ -1901,7 +2041,6 @@ ath5k_tasklet_rx(unsigned long data)
         struct ath5k_buf *bf;
         struct ath5k_desc *ds;
         int ret;
-        int rx_flag;
 
         spin_lock(&sc->rxbuflock);
         if (list_empty(&sc->rxbuf)) {
@@ -1909,8 +2048,6 @@ ath5k_tasklet_rx(unsigned long data)
                 goto unlock;
         }
         do {
-                rx_flag = 0;
-
                 bf = list_first_entry(&sc->rxbuf, struct ath5k_buf, list);
                 BUG_ON(bf->skb == NULL);
                 skb = bf->skb;
@@ -1926,137 +2063,30 @@ ath5k_tasklet_rx(unsigned long data)
                 else if (unlikely(ret)) {
                         ATH5K_ERR(sc, "error in processing rx descriptor\n");
                         sc->stats.rxerr_proc++;
-                        spin_unlock(&sc->rxbuflock);
-                        return;
+                        break;
                 }
 
-                sc->stats.rx_all_count++;
-
-                if (unlikely(rs.rs_status)) {
-                        if (rs.rs_status & AR5K_RXERR_CRC)
-                                sc->stats.rxerr_crc++;
-                        if (rs.rs_status & AR5K_RXERR_FIFO)
-                                sc->stats.rxerr_fifo++;
-                        if (rs.rs_status & AR5K_RXERR_PHY) {
-                                sc->stats.rxerr_phy++;
-                                if (rs.rs_phyerr > 0 && rs.rs_phyerr < 32)
-                                        sc->stats.rxerr_phy_code[rs.rs_phyerr]++;
-                                goto next;
-                        }
-                        if (rs.rs_status & AR5K_RXERR_DECRYPT) {
-                                /*
-                                 * Decrypt error.  If the error occurred
-                                 * because there was no hardware key, then
-                                 * let the frame through so the upper layers
-                                 * can process it.  This is necessary for 5210
-                                 * parts which have no way to setup a ``clear''
-                                 * key cache entry.
-                                 *
-                                 * XXX do key cache faulting
-                                 */
-                                sc->stats.rxerr_decrypt++;
-                                if (rs.rs_keyix == AR5K_RXKEYIX_INVALID &&
-                                    !(rs.rs_status & AR5K_RXERR_CRC))
-                                        goto accept;
-                        }
-                        if (rs.rs_status & AR5K_RXERR_MIC) {
-                                rx_flag |= RX_FLAG_MMIC_ERROR;
-                                sc->stats.rxerr_mic++;
-                                goto accept;
-                        }
+                if (ath5k_receive_frame_ok(sc, &rs)) {
+                        next_skb = ath5k_rx_skb_alloc(sc, &next_skb_addr);
 
-                        /* let crypto-error packets fall through in MNTR */
-                        if ((rs.rs_status &
-                                ~(AR5K_RXERR_DECRYPT|AR5K_RXERR_MIC)) ||
-                                        sc->opmode != NL80211_IFTYPE_MONITOR)
+                        /*
+                         * If we can't replace bf->skb with a new skb under
+                         * memory pressure, just skip this packet
+                         */
+                        if (!next_skb)
                                 goto next;
-                }
-
-                if (unlikely(rs.rs_more)) {
-                        sc->stats.rxerr_jumbo++;
-                        goto next;
-
-                }
-accept:
-                next_skb = ath5k_rx_skb_alloc(sc, &next_skb_addr);
-
-                /*
-                 * If we can't replace bf->skb with a new skb under memory
-                 * pressure, just skip this packet
-                 */
-                if (!next_skb)
-                        goto next;
-
-                pci_unmap_single(sc->pdev, bf->skbaddr, common->rx_bufsize,
-                                PCI_DMA_FROMDEVICE);
-                skb_put(skb, rs.rs_datalen);
-
-                /* The MAC header is padded to have 32-bit boundary if the
-                 * packet payload is non-zero. The general calculation for
-                 * padsize would take into account odd header lengths:
-                 * padsize = (4 - hdrlen % 4) % 4; However, since only
-                 * even-length headers are used, padding can only be 0 or 2
-                 * bytes and we can optimize this a bit. In addition, we must
-                 * not try to remove padding from short control frames that do
-                 * not have payload. */
-                ath5k_remove_padding(skb);
-
-                rxs = IEEE80211_SKB_RXCB(skb);
-
-                /*
-                 * always extend the mac timestamp, since this information is
-                 * also needed for proper IBSS merging.
-                 *
-                 * XXX: it might be too late to do it here, since rs_tstamp is
-                 * 15bit only. that means TSF extension has to be done within
-                 * 32768usec (about 32ms). it might be necessary to move this to
-                 * the interrupt handler, like it is done in madwifi.
-                 *
-                 * Unfortunately we don't know when the hardware takes the rx
-                 * timestamp (beginning of phy frame, data frame, end of rx?).
-                 * The only thing we know is that it is hardware specific...
-                 * On AR5213 it seems the rx timestamp is at the end of the
-                 * frame, but i'm not sure.
-                 *
-                 * NOTE: mac80211 defines mactime at the beginning of the first
-                 * data symbol. Since we don't have any time references it's
-                 * impossible to comply to that. This affects IBSS merge only
-                 * right now, so it's not too bad...
-                 */
-                rxs->mactime = ath5k_extend_tsf(sc->ah, rs.rs_tstamp);
-                rxs->flag = rx_flag | RX_FLAG_TSFT;
-
-                rxs->freq = sc->curchan->center_freq;
-                rxs->band = sc->curband->band;
-
-                rxs->signal = sc->ah->ah_noise_floor + rs.rs_rssi;
-
-                rxs->antenna = rs.rs_antenna;
-
-                if (rs.rs_antenna > 0 && rs.rs_antenna < 5)
-                        sc->stats.antenna_rx[rs.rs_antenna]++;
-                else
-                        sc->stats.antenna_rx[0]++; /* invalid */
-
-                rxs->rate_idx = ath5k_hw_to_driver_rix(sc, rs.rs_rate);
-                rxs->flag |= ath5k_rx_decrypted(sc, ds, skb, &rs);
-
-                if (rxs->rate_idx >= 0 && rs.rs_rate ==
-                    sc->curband->bitrates[rxs->rate_idx].hw_value_short)
-                        rxs->flag |= RX_FLAG_SHORTPRE;
 
-                ath5k_debug_dump_skb(sc, skb, "RX  ", 0);
+                        pci_unmap_single(sc->pdev, bf->skbaddr,
+                                         common->rx_bufsize,
+                                         PCI_DMA_FROMDEVICE);
 
-                ath5k_update_beacon_rssi(sc, skb, rs.rs_rssi);
+                        skb_put(skb, rs.rs_datalen);
 
-                /* check beacons in IBSS mode */
-                if (sc->opmode == NL80211_IFTYPE_ADHOC)
-                        ath5k_check_ibss_tsf(sc, skb, rxs);
+                        ath5k_receive_frame(sc, skb, &rs);
 
-                ieee80211_rx(sc->hw, skb);
-
-                bf->skb = next_skb;
-                bf->skbaddr = next_skb_addr;
+                        bf->skb = next_skb;
+                        bf->skbaddr = next_skb_addr;
+                }
 next:
                 list_move_tail(&bf->list, &sc->rxbuf);
         } while (ath5k_rxbuf_setup(sc, bf) == 0);
@@ -2065,8 +2095,6 @@ unlock:
 }
 
 
-
-
 /*************\
 * TX Handling *
 \*************/
@@ -2298,6 +2326,8 @@ ath5k_beacon_send(struct ath5k_softc *sc)
                         ATH5K_DBG(sc, ATH5K_DEBUG_BEACON,
                                 "stuck beacon time (%u missed)\n",
                                 sc->bmisscount);
+                        ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
+                                  "stuck beacon, resetting\n");
                         tasklet_schedule(&sc->restq);
                 }
                 return;
@@ -2647,7 +2677,7 @@ ath5k_stop_hw(struct ath5k_softc *sc)
                 ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
                                 "putting device to sleep\n");
         }
-        ath5k_txbuf_free(sc, sc->bbuf);
+        ath5k_txbuf_free_skb(sc, sc->bbuf);
 
         mmiowb();
         mutex_unlock(&sc->lock);
@@ -2705,6 +2735,8 @@ ath5k_intr(int irq, void *dev_id)
                          * Fatal errors are unrecoverable.
                          * Typically these are caused by DMA errors.
                          */
+                        ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
+                                  "fatal int, resetting\n");
                         tasklet_schedule(&sc->restq);
                 } else if (unlikely(status & AR5K_INT_RXORN)) {
                         /*
@@ -2717,8 +2749,11 @@ ath5k_intr(int irq, void *dev_id)
                          * this guess is copied from the HAL.
                          */
                         sc->stats.rxorn_intr++;
-                        if (ah->ah_mac_srev < AR5K_SREV_AR5212)
+                        if (ah->ah_mac_srev < AR5K_SREV_AR5212) {
+                                ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
+                                          "rx overrun, resetting\n");
                                 tasklet_schedule(&sc->restq);
+                        }
                         else
                                 tasklet_schedule(&sc->rxtq);
                 } else {
@@ -2785,10 +2820,6 @@ ath5k_tasklet_calibrate(unsigned long data)
         /* Only full calibration for now */
         ah->ah_cal_mask |= AR5K_CALIBRATION_FULL;
 
-        /* Stop queues so that calibration
-         * doesn't interfere with tx */
-        ieee80211_stop_queues(sc->hw);
-
         ATH5K_DBG(sc, ATH5K_DEBUG_CALIBRATE, "channel %u/%x\n",
                 ieee80211_frequency_to_channel(sc->curchan->center_freq),
                 sc->curchan->hw_value);
@@ -2806,8 +2837,16 @@ ath5k_tasklet_calibrate(unsigned long data)
                         ieee80211_frequency_to_channel(
                                 sc->curchan->center_freq));
 
-        /* Wake queues */
-        ieee80211_wake_queues(sc->hw);
+        /* Noise floor calibration interrupts rx/tx path while I/Q calibration
+         * doesn't. We stop the queues so that calibration doesn't interfere
+         * with TX and don't run it as often */
+        if (time_is_before_eq_jiffies(ah->ah_cal_next_nf)) {
+                ah->ah_cal_next_nf = jiffies +
+                        msecs_to_jiffies(ATH5K_TUNE_CALIBRATION_INTERVAL_NF);
+                ieee80211_stop_queues(sc->hw);
+                ath5k_hw_update_noise_floor(ah);
+                ieee80211_wake_queues(sc->hw);
+        }
 
         ah->ah_cal_mask &= ~AR5K_CALIBRATION_FULL;
 }
@@ -2926,6 +2965,10 @@ ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan)
 
         ath5k_ani_init(ah, ah->ah_sc->ani_state.ani_mode);
 
+        ah->ah_cal_next_full = jiffies;
+        ah->ah_cal_next_ani = jiffies;
+        ah->ah_cal_next_nf = jiffies;
+
         /*
          * Change channels and update the h/w rate map if we're switching;
          * e.g. 11a to 11b/g.
@@ -3360,7 +3403,7 @@ ath5k_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 
         ath5k_debug_dump_skb(sc, skb, "BC  ", 1);
 
-        ath5k_txbuf_free(sc, sc->bbuf);
+        ath5k_txbuf_free_skb(sc, sc->bbuf);
         sc->bbuf->skb = skb;
         ret = ath5k_beacon_setup(sc, sc->bbuf);
         if (ret)
diff --git a/drivers/net/wireless/ath/ath5k/caps.c b/drivers/net/wireless/ath/ath5k/caps.c
index 74f007126f41..beae519aa735 100644
--- a/drivers/net/wireless/ath/ath5k/caps.c
+++ b/drivers/net/wireless/ath/ath5k/caps.c
@@ -34,7 +34,6 @@ int ath5k_hw_set_capabilities(struct ath5k_hw *ah)
 {
         u16 ee_header;
 
-        ATH5K_TRACE(ah->ah_sc);
         /* Capabilities stored in the EEPROM */
         ee_header = ah->ah_capabilities.cap_eeprom.ee_header;
 
@@ -123,8 +122,6 @@ int ath5k_hw_get_capability(struct ath5k_hw *ah,
                 enum ath5k_capability_type cap_type,
                 u32 capability, u32 *result)
 {
-        ATH5K_TRACE(ah->ah_sc);
-
         switch (cap_type) {
         case AR5K_CAP_NUM_TXQUEUES:
                 if (result) {
@@ -173,8 +170,6 @@ yes:
 int ath5k_hw_enable_pspoll(struct ath5k_hw *ah, u8 *bssid,
                 u16 assoc_id)
 {
-        ATH5K_TRACE(ah->ah_sc);
-
         if (ah->ah_version == AR5K_AR5210) {
                 AR5K_REG_DISABLE_BITS(ah, AR5K_STA_ID1,
                         AR5K_STA_ID1_NO_PSPOLL | AR5K_STA_ID1_DEFAULT_ANTENNA);
@@ -186,8 +181,6 @@ int ath5k_hw_enable_pspoll(struct ath5k_hw *ah, u8 *bssid,
 
 int ath5k_hw_disable_pspoll(struct ath5k_hw *ah)
 {
-        ATH5K_TRACE(ah->ah_sc);
-
         if (ah->ah_version == AR5K_AR5210) {
                 AR5K_REG_ENABLE_BITS(ah, AR5K_STA_ID1,
                         AR5K_STA_ID1_NO_PSPOLL | AR5K_STA_ID1_DEFAULT_ANTENNA);
diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
index 6fb5c5ffa5b1..8c638865c712 100644
--- a/drivers/net/wireless/ath/ath5k/debug.c
+++ b/drivers/net/wireless/ath/ath5k/debug.c
@@ -278,6 +278,7 @@ static ssize_t write_file_reset(struct file *file,
                                  size_t count, loff_t *ppos)
 {
         struct ath5k_softc *sc = file->private_data;
+        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "debug file triggered reset\n");
         tasklet_schedule(&sc->restq);
         return count;
 }
@@ -307,7 +308,6 @@ static const struct {
         { ATH5K_DEBUG_DUMP_RX,  "dumprx",       "print received skb content" },
         { ATH5K_DEBUG_DUMP_TX,  "dumptx",       "print transmit skb content" },
         { ATH5K_DEBUG_DUMPBANDS, "dumpbands",   "dump bands" },
-        { ATH5K_DEBUG_TRACE,    "trace",        "trace function calls" },
         { ATH5K_DEBUG_ANI,      "ani",          "adaptive noise immunity" },
         { ATH5K_DEBUG_ANY,      "all",          "show all debug levels" },
 };
@@ -426,6 +426,13 @@ static ssize_t read_file_antenna(struct file *file, char __user *user_buf,
                 "AR5K_PHY_FAST_ANT_DIV_EN\t%d\n",
                 (v & AR5K_PHY_FAST_ANT_DIV_EN) != 0);
 
+        v = ath5k_hw_reg_read(sc->ah, AR5K_PHY_ANT_SWITCH_TABLE_0);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "\nAR5K_PHY_ANT_SWITCH_TABLE_0\t0x%08x\n", v);
+        v = ath5k_hw_reg_read(sc->ah, AR5K_PHY_ANT_SWITCH_TABLE_1);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "AR5K_PHY_ANT_SWITCH_TABLE_1\t0x%08x\n", v);
+
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -729,6 +736,66 @@ static const struct file_operations fops_ani = {
 };
 
 
+/* debugfs: queues etc */
+
+static ssize_t read_file_queue(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath5k_softc *sc = file->private_data;
+        char buf[700];
+        unsigned int len = 0;
+
+        struct ath5k_txq *txq;
+        struct ath5k_buf *bf, *bf0;
+        int i, n = 0;
+
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "available txbuffers: %d\n", sc->txbuf_len);
+
+        for (i = 0; i < ARRAY_SIZE(sc->txqs); i++) {
+                txq = &sc->txqs[i];
+
+                len += snprintf(buf+len, sizeof(buf)-len,
+                        "%02d: %ssetup\n", i, txq->setup ? "" : "not ");
+
+                if (!txq->setup)
+                        continue;
+
+                list_for_each_entry_safe(bf, bf0, &txq->q, list)
+                        n++;
+                len += snprintf(buf+len, sizeof(buf)-len, "  len: %d\n", n);
+        }
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_queue(struct file *file,
+                                 const char __user *userbuf,
+                                 size_t count, loff_t *ppos)
+{
+        struct ath5k_softc *sc = file->private_data;
+        char buf[20];
+
+        if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))
+                return -EFAULT;
+
+        if (strncmp(buf, "start", 5) == 0)
+                ieee80211_wake_queues(sc->hw);
+        else if (strncmp(buf, "stop", 4) == 0)
+                ieee80211_stop_queues(sc->hw);
+
+        return count;
+}
+
+
+static const struct file_operations fops_queue = {
+        .read = read_file_queue,
+        .write = write_file_queue,
+        .open = ath5k_debugfs_open,
+        .owner = THIS_MODULE,
+};
+
+
 /* init */
 
 void
@@ -772,6 +839,11 @@ ath5k_debug_init_device(struct ath5k_softc *sc)
                                 S_IWUSR | S_IRUSR,
                                 sc->debug.debugfs_phydir, sc,
                                 &fops_ani);
+
+        sc->debug.debugfs_queue = debugfs_create_file("queue",
+                                S_IWUSR | S_IRUSR,
+                                sc->debug.debugfs_phydir, sc,
+                                &fops_queue);
 }
 
 void
@@ -790,6 +862,7 @@ ath5k_debug_finish_device(struct ath5k_softc *sc)
         debugfs_remove(sc->debug.debugfs_antenna);
         debugfs_remove(sc->debug.debugfs_frameerrors);
         debugfs_remove(sc->debug.debugfs_ani);
+        debugfs_remove(sc->debug.debugfs_queue);
         debugfs_remove(sc->debug.debugfs_phydir);
 }
 
@@ -852,7 +925,7 @@ ath5k_debug_printrxbuf(struct ath5k_buf *bf, int done,
                 ds, (unsigned long long)bf->daddr,
                 ds->ds_link, ds->ds_data,
                 rd->rx_ctl.rx_control_0, rd->rx_ctl.rx_control_1,
-                rd->u.rx_stat.rx_status_0, rd->u.rx_stat.rx_status_0,
+                rd->rx_stat.rx_status_0, rd->rx_stat.rx_status_1,
                 !done ? ' ' : (rs->rs_status == 0) ? '*' : '!');
 }
 
@@ -867,7 +940,7 @@ ath5k_debug_printrxbuffs(struct ath5k_softc *sc, struct ath5k_hw *ah)
         if (likely(!(sc->debug.level & ATH5K_DEBUG_RESET)))
                 return;
 
-        printk(KERN_DEBUG "rx queue %x, link %p\n",
+        printk(KERN_DEBUG "rxdp %x, rxlink %p\n",
                 ath5k_hw_get_rxdp(ah), sc->rxlink);
 
         spin_lock_bh(&sc->rxbuflock);
diff --git a/drivers/net/wireless/ath/ath5k/debug.h b/drivers/net/wireless/ath/ath5k/debug.h
index ddd5b3a99e8d..606ae94a9157 100644
--- a/drivers/net/wireless/ath/ath5k/debug.h
+++ b/drivers/net/wireless/ath/ath5k/debug.h
@@ -77,6 +77,7 @@ struct ath5k_dbg_info {
         struct dentry           *debugfs_antenna;
         struct dentry           *debugfs_frameerrors;
         struct dentry           *debugfs_ani;
+        struct dentry           *debugfs_queue;
 };
 
 /**
@@ -115,18 +116,12 @@ enum ath5k_debug_level {
         ATH5K_DEBUG_DUMP_RX     = 0x00000100,
         ATH5K_DEBUG_DUMP_TX     = 0x00000200,
         ATH5K_DEBUG_DUMPBANDS   = 0x00000400,
-        ATH5K_DEBUG_TRACE       = 0x00001000,
         ATH5K_DEBUG_ANI         = 0x00002000,
         ATH5K_DEBUG_ANY         = 0xffffffff
 };
 
 #ifdef CONFIG_ATH5K_DEBUG
 
-#define ATH5K_TRACE(_sc) do { \
-        if (unlikely((_sc)->debug.level & ATH5K_DEBUG_TRACE)) \
-                printk(KERN_DEBUG "ath5k trace %s:%d\n", __func__, __LINE__); \
-        } while (0)
-
 #define ATH5K_DBG(_sc, _m, _fmt, ...) do { \
         if (unlikely((_sc)->debug.level & (_m) && net_ratelimit())) \
                 ATH5K_PRINTK(_sc, KERN_DEBUG, "(%s:%d): " _fmt, \
@@ -168,8 +163,6 @@ ath5k_debug_printtxbuf(struct ath5k_softc *sc, struct ath5k_buf *bf);
 
 #include <linux/compiler.h>
 
-#define ATH5K_TRACE(_sc) typecheck(struct ath5k_softc *, (_sc))
-
 static inline void __attribute__ ((format (printf, 3, 4)))
 ATH5K_DBG(struct ath5k_softc *sc, unsigned int m, const char *fmt, ...) {}
 
diff --git a/drivers/net/wireless/ath/ath5k/desc.c b/drivers/net/wireless/ath/ath5k/desc.c
index 7d7b646ab65a..43244382f213 100644
--- a/drivers/net/wireless/ath/ath5k/desc.c
+++ b/drivers/net/wireless/ath/ath5k/desc.c
@@ -91,14 +91,13 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         tx_ctl->tx_control_1 = pkt_len & AR5K_2W_TX_DESC_CTL1_BUF_LEN;
 
         /*
-         * Verify and set header length
-         * XXX: I only found that on 5210 code, does it work on 5211 ?
+         * Verify and set header length (only 5210)
          */
         if (ah->ah_version == AR5K_AR5210) {
-                if (hdr_len & ~AR5K_2W_TX_DESC_CTL0_HEADER_LEN)
+                if (hdr_len & ~AR5K_2W_TX_DESC_CTL0_HEADER_LEN_5210)
                         return -EINVAL;
                 tx_ctl->tx_control_0 |=
-                        AR5K_REG_SM(hdr_len, AR5K_2W_TX_DESC_CTL0_HEADER_LEN);
+                        AR5K_REG_SM(hdr_len, AR5K_2W_TX_DESC_CTL0_HEADER_LEN_5210);
         }
 
         /*Differences between 5210-5211*/
@@ -110,11 +109,11 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
                 case AR5K_PKT_TYPE_PIFS:
                         frame_type = AR5K_AR5210_TX_DESC_FRAME_TYPE_PIFS;
                 default:
-                        frame_type = type /*<< 2 ?*/;
+                        frame_type = type;
                 }
 
                 tx_ctl->tx_control_0 |=
-                AR5K_REG_SM(frame_type, AR5K_2W_TX_DESC_CTL0_FRAME_TYPE) |
+                AR5K_REG_SM(frame_type, AR5K_2W_TX_DESC_CTL0_FRAME_TYPE_5210) |
                 AR5K_REG_SM(tx_rate0, AR5K_2W_TX_DESC_CTL0_XMIT_RATE);
 
         } else {
@@ -123,21 +122,30 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
                         AR5K_REG_SM(antenna_mode,
                                 AR5K_2W_TX_DESC_CTL0_ANT_MODE_XMIT);
                 tx_ctl->tx_control_1 |=
-                        AR5K_REG_SM(type, AR5K_2W_TX_DESC_CTL1_FRAME_TYPE);
+                        AR5K_REG_SM(type, AR5K_2W_TX_DESC_CTL1_FRAME_TYPE_5211);
         }
+
 #define _TX_FLAGS(_c, _flag)                                    \
         if (flags & AR5K_TXDESC_##_flag) {                      \
                 tx_ctl->tx_control_##_c |=                      \
                         AR5K_2W_TX_DESC_CTL##_c##_##_flag;      \
         }
-
+#define _TX_FLAGS_5211(_c, _flag)                                       \
+        if (flags & AR5K_TXDESC_##_flag) {                              \
+                tx_ctl->tx_control_##_c |=                              \
+                        AR5K_2W_TX_DESC_CTL##_c##_##_flag##_5211;       \
+        }
         _TX_FLAGS(0, CLRDMASK);
-        _TX_FLAGS(0, VEOL);
         _TX_FLAGS(0, INTREQ);
         _TX_FLAGS(0, RTSENA);
-        _TX_FLAGS(1, NOACK);
+
+        if (ah->ah_version == AR5K_AR5211) {
+                _TX_FLAGS_5211(0, VEOL);
+                _TX_FLAGS_5211(1, NOACK);
+        }
 
 #undef _TX_FLAGS
+#undef _TX_FLAGS_5211
 
         /*
          * WEP crap
@@ -147,7 +155,7 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
                         AR5K_2W_TX_DESC_CTL0_ENCRYPT_KEY_VALID;
                 tx_ctl->tx_control_1 |=
                         AR5K_REG_SM(key_index,
-                        AR5K_2W_TX_DESC_CTL1_ENCRYPT_KEY_INDEX);
+                        AR5K_2W_TX_DESC_CTL1_ENC_KEY_IDX);
         }
 
         /*
@@ -156,7 +164,7 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         if ((ah->ah_version == AR5K_AR5210) &&
                         (flags & (AR5K_TXDESC_RTSENA | AR5K_TXDESC_CTSENA)))
                 tx_ctl->tx_control_1 |= rtscts_duration &
-                                AR5K_2W_TX_DESC_CTL1_RTS_DURATION;
+                                AR5K_2W_TX_DESC_CTL1_RTS_DURATION_5210;
 
         return 0;
 }
@@ -176,7 +184,6 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
         struct ath5k_hw_4w_tx_ctl *tx_ctl;
         unsigned int frame_len;
 
-        ATH5K_TRACE(ah->ah_sc);
         tx_ctl = &desc->ud.ds_tx5212.tx_ctl;
 
         /*
@@ -256,7 +263,7 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
         if (key_index != AR5K_TXKEYIX_INVALID) {
                 tx_ctl->tx_control_0 |= AR5K_4W_TX_DESC_CTL0_ENCRYPT_KEY_VALID;
                 tx_ctl->tx_control_1 |= AR5K_REG_SM(key_index,
-                                AR5K_4W_TX_DESC_CTL1_ENCRYPT_KEY_INDEX);
+                                AR5K_4W_TX_DESC_CTL1_ENCRYPT_KEY_IDX);
         }
 
         /*
@@ -278,13 +285,17 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
 /*
  * Initialize a 4-word multi rate retry tx control descriptor on 5212
  */
-static int
+int
 ath5k_hw_setup_mrr_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         unsigned int tx_rate1, u_int tx_tries1, u_int tx_rate2,
         u_int tx_tries2, unsigned int tx_rate3, u_int tx_tries3)
 {
         struct ath5k_hw_4w_tx_ctl *tx_ctl;
 
+        /* no mrr support for cards older than 5212 */
+        if (ah->ah_version < AR5K_AR5212)
+                return 0;
+
         /*
          * Rates can be 0 as long as the retry count is 0 too.
          * A zero rate and nonzero retry count will put the HW into a mode where
@@ -324,15 +335,6 @@ ath5k_hw_setup_mrr_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         return 0;
 }
 
-/* no mrr support for cards older than 5212 */
-static int
-ath5k_hw_setup_no_mrr(struct ath5k_hw *ah, struct ath5k_desc *desc,
-        unsigned int tx_rate1, u_int tx_tries1, u_int tx_rate2,
-        u_int tx_tries2, unsigned int tx_rate3, u_int tx_tries3)
-{
-        return 0;
-}
-
 /*
  * Proccess the tx status descriptor on 5210/5211
  */
@@ -342,8 +344,6 @@ static int ath5k_hw_proc_2word_tx_status(struct ath5k_hw *ah,
         struct ath5k_hw_2w_tx_ctl *tx_ctl;
         struct ath5k_hw_tx_status *tx_status;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         tx_ctl = &desc->ud.ds_tx5210.tx_ctl;
         tx_status = &desc->ud.ds_tx5210.tx_stat;
 
@@ -396,8 +396,6 @@ static int ath5k_hw_proc_4word_tx_status(struct ath5k_hw *ah,
         struct ath5k_hw_4w_tx_ctl *tx_ctl;
         struct ath5k_hw_tx_status *tx_status;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         tx_ctl = &desc->ud.ds_tx5212.tx_ctl;
         tx_status = &desc->ud.ds_tx5212.tx_stat;
 
@@ -419,11 +417,11 @@ static int ath5k_hw_proc_4word_tx_status(struct ath5k_hw *ah,
         ts->ts_rssi = AR5K_REG_MS(tx_status->tx_status_1,
                 AR5K_DESC_TX_STATUS1_ACK_SIG_STRENGTH);
         ts->ts_antenna = (tx_status->tx_status_1 &
-                AR5K_DESC_TX_STATUS1_XMIT_ANTENNA) ? 2 : 1;
+                AR5K_DESC_TX_STATUS1_XMIT_ANTENNA_5212) ? 2 : 1;
         ts->ts_status = 0;
 
         ts->ts_final_idx = AR5K_REG_MS(tx_status->tx_status_1,
-                        AR5K_DESC_TX_STATUS1_FINAL_TS_INDEX);
+                        AR5K_DESC_TX_STATUS1_FINAL_TS_IX_5212);
 
         /* The longretry counter has the number of un-acked retries
          * for the final rate. To get the total number of retries
@@ -485,12 +483,11 @@ static int ath5k_hw_proc_4word_tx_status(struct ath5k_hw *ah,
 /*
  * Initialize an rx control descriptor
  */
-static int ath5k_hw_setup_rx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
-                        u32 size, unsigned int flags)
+int ath5k_hw_setup_rx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
+                           u32 size, unsigned int flags)
 {
         struct ath5k_hw_rx_ctl *rx_ctl;
 
-        ATH5K_TRACE(ah->ah_sc);
         rx_ctl = &desc->ud.ds_rx.rx_ctl;
 
         /*
@@ -502,10 +499,11 @@ static int ath5k_hw_setup_rx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         */
         memset(&desc->ud.ds_rx, 0, sizeof(struct ath5k_hw_all_rx_desc));
 
+        if (unlikely(size & ~AR5K_DESC_RX_CTL1_BUF_LEN))
+                return -EINVAL;
+
         /* Setup descriptor */
         rx_ctl->rx_control_1 = size & AR5K_DESC_RX_CTL1_BUF_LEN;
-        if (unlikely(rx_ctl->rx_control_1 != size))
-                return -EINVAL;
 
         if (flags & AR5K_RXDESC_INTREQ)
                 rx_ctl->rx_control_1 |= AR5K_DESC_RX_CTL1_INTREQ;
@@ -521,13 +519,15 @@ static int ath5k_hw_proc_5210_rx_status(struct ath5k_hw *ah,
 {
         struct ath5k_hw_rx_status *rx_status;
 
-        rx_status = &desc->ud.ds_rx.u.rx_stat;
+        rx_status = &desc->ud.ds_rx.rx_stat;
 
         /* No frame received / not ready */
         if (unlikely(!(rx_status->rx_status_1 &
-        AR5K_5210_RX_DESC_STATUS1_DONE)))
+                        AR5K_5210_RX_DESC_STATUS1_DONE)))
                 return -EINPROGRESS;
 
+        memset(rs, 0, sizeof(struct ath5k_rx_status));
+
         /*
          * Frame receive status
          */
@@ -537,15 +537,23 @@ static int ath5k_hw_proc_5210_rx_status(struct ath5k_hw *ah,
                 AR5K_5210_RX_DESC_STATUS0_RECEIVE_SIGNAL);
         rs->rs_rate = AR5K_REG_MS(rx_status->rx_status_0,
                 AR5K_5210_RX_DESC_STATUS0_RECEIVE_RATE);
-        rs->rs_antenna = AR5K_REG_MS(rx_status->rx_status_0,
-                AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANTENNA);
         rs->rs_more = !!(rx_status->rx_status_0 &
                 AR5K_5210_RX_DESC_STATUS0_MORE);
-        /* TODO: this timestamp is 13 bit, later on we assume 15 bit */
+        /* TODO: this timestamp is 13 bit, later on we assume 15 bit!
+         * also the HAL code for 5210 says the timestamp is bits [10..22] of the
+         * TSF, and extends the timestamp here to 15 bit.
+         * we need to check on 5210...
+         */
         rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
                 AR5K_5210_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
-        rs->rs_status = 0;
-        rs->rs_phyerr = 0;
+
+        if (ah->ah_version == AR5K_AR5211)
+                rs->rs_antenna = AR5K_REG_MS(rx_status->rx_status_0,
+                                AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANT_5211);
+        else
+                rs->rs_antenna = (rx_status->rx_status_0 &
+                                AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANT_5210)
+                                ? 2 : 1;
 
         /*
          * Key table status
@@ -560,19 +568,21 @@ static int ath5k_hw_proc_5210_rx_status(struct ath5k_hw *ah,
          * Receive/descriptor errors
          */
         if (!(rx_status->rx_status_1 &
-        AR5K_5210_RX_DESC_STATUS1_FRAME_RECEIVE_OK)) {
+                        AR5K_5210_RX_DESC_STATUS1_FRAME_RECEIVE_OK)) {
                 if (rx_status->rx_status_1 &
                                 AR5K_5210_RX_DESC_STATUS1_CRC_ERROR)
                         rs->rs_status |= AR5K_RXERR_CRC;
 
-                if (rx_status->rx_status_1 &
-                                AR5K_5210_RX_DESC_STATUS1_FIFO_OVERRUN)
+                /* only on 5210 */
+                if ((ah->ah_version == AR5K_AR5210) &&
+                    (rx_status->rx_status_1 &
+                                AR5K_5210_RX_DESC_STATUS1_FIFO_OVERRUN_5210))
                         rs->rs_status |= AR5K_RXERR_FIFO;
 
                 if (rx_status->rx_status_1 &
                                 AR5K_5210_RX_DESC_STATUS1_PHY_ERROR) {
                         rs->rs_status |= AR5K_RXERR_PHY;
-                        rs->rs_phyerr |= AR5K_REG_MS(rx_status->rx_status_1,
+                        rs->rs_phyerr = AR5K_REG_MS(rx_status->rx_status_1,
                                 AR5K_5210_RX_DESC_STATUS1_PHY_ERROR);
                 }
 
@@ -588,22 +598,20 @@ static int ath5k_hw_proc_5210_rx_status(struct ath5k_hw *ah,
  * Proccess the rx status descriptor on 5212
  */
 static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
-                struct ath5k_desc *desc, struct ath5k_rx_status *rs)
+                                        struct ath5k_desc *desc,
+                                        struct ath5k_rx_status *rs)
 {
         struct ath5k_hw_rx_status *rx_status;
-        struct ath5k_hw_rx_error *rx_err;
 
-        ATH5K_TRACE(ah->ah_sc);
-        rx_status = &desc->ud.ds_rx.u.rx_stat;
-
-        /* Overlay on error */
-        rx_err = &desc->ud.ds_rx.u.rx_err;
+        rx_status = &desc->ud.ds_rx.rx_stat;
 
         /* No frame received / not ready */
         if (unlikely(!(rx_status->rx_status_1 &
-        AR5K_5212_RX_DESC_STATUS1_DONE)))
+                                AR5K_5212_RX_DESC_STATUS1_DONE)))
                 return -EINPROGRESS;
 
+        memset(rs, 0, sizeof(struct ath5k_rx_status));
+
         /*
          * Frame receive status
          */
@@ -619,15 +627,13 @@ static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
                 AR5K_5212_RX_DESC_STATUS0_MORE);
         rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
                 AR5K_5212_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
-        rs->rs_status = 0;
-        rs->rs_phyerr = 0;
 
         /*
          * Key table status
          */
         if (rx_status->rx_status_1 & AR5K_5212_RX_DESC_STATUS1_KEY_INDEX_VALID)
                 rs->rs_keyix = AR5K_REG_MS(rx_status->rx_status_1,
-                                AR5K_5212_RX_DESC_STATUS1_KEY_INDEX);
+                                           AR5K_5212_RX_DESC_STATUS1_KEY_INDEX);
         else
                 rs->rs_keyix = AR5K_RXKEYIX_INVALID;
 
@@ -635,7 +641,7 @@ static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
          * Receive/descriptor errors
          */
         if (!(rx_status->rx_status_1 &
-        AR5K_5212_RX_DESC_STATUS1_FRAME_RECEIVE_OK)) {
+            AR5K_5212_RX_DESC_STATUS1_FRAME_RECEIVE_OK)) {
                 if (rx_status->rx_status_1 &
                                 AR5K_5212_RX_DESC_STATUS1_CRC_ERROR)
                         rs->rs_status |= AR5K_RXERR_CRC;
@@ -643,9 +649,10 @@ static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
                 if (rx_status->rx_status_1 &
                                 AR5K_5212_RX_DESC_STATUS1_PHY_ERROR) {
                         rs->rs_status |= AR5K_RXERR_PHY;
-                        rs->rs_phyerr |= AR5K_REG_MS(rx_err->rx_error_1,
-                                           AR5K_RX_DESC_ERROR1_PHY_ERROR_CODE);
-                        ath5k_ani_phy_error_report(ah, rs->rs_phyerr);
+                        rs->rs_phyerr = AR5K_REG_MS(rx_status->rx_status_1,
+                                AR5K_5212_RX_DESC_STATUS1_PHY_ERROR_CODE);
+                        if (!ah->ah_capabilities.cap_has_phyerr_counters)
+                                ath5k_ani_phy_error_report(ah, rs->rs_phyerr);
                 }
 
                 if (rx_status->rx_status_1 &
@@ -656,7 +663,6 @@ static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
                                 AR5K_5212_RX_DESC_STATUS1_MIC_ERROR)
                         rs->rs_status |= AR5K_RXERR_MIC;
         }
-
         return 0;
 }
 
@@ -665,29 +671,15 @@ static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
  */
 int ath5k_hw_init_desc_functions(struct ath5k_hw *ah)
 {
-
-        if (ah->ah_version != AR5K_AR5210 &&
-                ah->ah_version != AR5K_AR5211 &&
-                ah->ah_version != AR5K_AR5212)
-                        return -ENOTSUPP;
-
         if (ah->ah_version == AR5K_AR5212) {
-                ah->ah_setup_rx_desc = ath5k_hw_setup_rx_desc;
                 ah->ah_setup_tx_desc = ath5k_hw_setup_4word_tx_desc;
-                ah->ah_setup_mrr_tx_desc = ath5k_hw_setup_mrr_tx_desc;
                 ah->ah_proc_tx_desc = ath5k_hw_proc_4word_tx_status;
-        } else {
-                ah->ah_setup_rx_desc = ath5k_hw_setup_rx_desc;
+                ah->ah_proc_rx_desc = ath5k_hw_proc_5212_rx_status;
+        } else if (ah->ah_version <= AR5K_AR5211) {
                 ah->ah_setup_tx_desc = ath5k_hw_setup_2word_tx_desc;
-                ah->ah_setup_mrr_tx_desc = ath5k_hw_setup_no_mrr;
                 ah->ah_proc_tx_desc = ath5k_hw_proc_2word_tx_status;
-        }
-
-        if (ah->ah_version == AR5K_AR5212)
-                ah->ah_proc_rx_desc = ath5k_hw_proc_5212_rx_status;
-        else if (ah->ah_version <= AR5K_AR5211)
                 ah->ah_proc_rx_desc = ath5k_hw_proc_5210_rx_status;
-
+        } else
+                return -ENOTSUPP;
         return 0;
 }
-
diff --git a/drivers/net/wireless/ath/ath5k/desc.h b/drivers/net/wireless/ath/ath5k/desc.h
index 64538fbe4167..b2adb2a281c2 100644
--- a/drivers/net/wireless/ath/ath5k/desc.h
+++ b/drivers/net/wireless/ath/ath5k/desc.h
@@ -17,28 +17,24 @@
  */
 
 /*
- * Internal RX/TX descriptor structures
- * (rX: reserved fields possibily used by future versions of the ar5k chipset)
+ * RX/TX descriptor structures
  */
 
 /*
- * common hardware RX control descriptor
+ * Common hardware RX control descriptor
  */
 struct ath5k_hw_rx_ctl {
         u32     rx_control_0; /* RX control word 0 */
         u32     rx_control_1; /* RX control word 1 */
 } __packed;
 
-/* RX control word 0 field/sflags */
-#define AR5K_DESC_RX_CTL0                       0x00000000
-
 /* RX control word 1 fields/flags */
-#define AR5K_DESC_RX_CTL1_BUF_LEN               0x00000fff
-#define AR5K_DESC_RX_CTL1_INTREQ                0x00002000
+#define AR5K_DESC_RX_CTL1_BUF_LEN               0x00000fff /* data buffer length */
+#define AR5K_DESC_RX_CTL1_INTREQ                0x00002000 /* RX interrupt request */
 
 /*
- * common hardware RX status descriptor
- * 5210/11 and 5212 differ only in the flags defined below
+ * Common hardware RX status descriptor
+ * 5210, 5211 and 5212 differ only in the fields and flags defined below
  */
 struct ath5k_hw_rx_status {
         u32     rx_status_0; /* RX status word 0 */
@@ -47,81 +43,69 @@ struct ath5k_hw_rx_status {
 
 /* 5210/5211 */
 /* RX status word 0 fields/flags */
-#define AR5K_5210_RX_DESC_STATUS0_DATA_LEN              0x00000fff
-#define AR5K_5210_RX_DESC_STATUS0_MORE                  0x00001000
-#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_RATE          0x00078000
+#define AR5K_5210_RX_DESC_STATUS0_DATA_LEN              0x00000fff /* RX data length */
+#define AR5K_5210_RX_DESC_STATUS0_MORE                  0x00001000 /* more desc for this frame */
+#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANT_5210      0x00004000 /* [5210] receive on ant 1 */
+#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_RATE          0x00078000 /* reception rate */
 #define AR5K_5210_RX_DESC_STATUS0_RECEIVE_RATE_S        15
-#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_SIGNAL        0x07f80000
+#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_SIGNAL        0x07f80000 /* rssi */
 #define AR5K_5210_RX_DESC_STATUS0_RECEIVE_SIGNAL_S      19
-#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANTENNA       0x38000000
-#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANTENNA_S     27
+#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANT_5211      0x38000000 /* [5211] receive antenna */
+#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANT_5211_S    27
 
 /* RX status word 1 fields/flags */
-#define AR5K_5210_RX_DESC_STATUS1_DONE                  0x00000001
-#define AR5K_5210_RX_DESC_STATUS1_FRAME_RECEIVE_OK      0x00000002
-#define AR5K_5210_RX_DESC_STATUS1_CRC_ERROR             0x00000004
-#define AR5K_5210_RX_DESC_STATUS1_FIFO_OVERRUN          0x00000008
-#define AR5K_5210_RX_DESC_STATUS1_DECRYPT_CRC_ERROR     0x00000010
-#define AR5K_5210_RX_DESC_STATUS1_PHY_ERROR             0x000000e0
+#define AR5K_5210_RX_DESC_STATUS1_DONE                  0x00000001 /* descriptor complete */
+#define AR5K_5210_RX_DESC_STATUS1_FRAME_RECEIVE_OK      0x00000002 /* reception success */
+#define AR5K_5210_RX_DESC_STATUS1_CRC_ERROR             0x00000004 /* CRC error */
+#define AR5K_5210_RX_DESC_STATUS1_FIFO_OVERRUN_5210     0x00000008 /* [5210] FIFO overrun */
+#define AR5K_5210_RX_DESC_STATUS1_DECRYPT_CRC_ERROR     0x00000010 /* decyption CRC failure */
+#define AR5K_5210_RX_DESC_STATUS1_PHY_ERROR             0x000000e0 /* PHY error */
 #define AR5K_5210_RX_DESC_STATUS1_PHY_ERROR_S           5
-#define AR5K_5210_RX_DESC_STATUS1_KEY_INDEX_VALID       0x00000100
-#define AR5K_5210_RX_DESC_STATUS1_KEY_INDEX             0x00007e00
+#define AR5K_5210_RX_DESC_STATUS1_KEY_INDEX_VALID       0x00000100 /* key index valid */
+#define AR5K_5210_RX_DESC_STATUS1_KEY_INDEX             0x00007e00 /* decyption key index */
 #define AR5K_5210_RX_DESC_STATUS1_KEY_INDEX_S           9
-#define AR5K_5210_RX_DESC_STATUS1_RECEIVE_TIMESTAMP     0x0fff8000
+#define AR5K_5210_RX_DESC_STATUS1_RECEIVE_TIMESTAMP     0x0fff8000 /* 13 bit of TSF */
 #define AR5K_5210_RX_DESC_STATUS1_RECEIVE_TIMESTAMP_S   15
-#define AR5K_5210_RX_DESC_STATUS1_KEY_CACHE_MISS        0x10000000
+#define AR5K_5210_RX_DESC_STATUS1_KEY_CACHE_MISS        0x10000000 /* key cache miss */
 
 /* 5212 */
 /* RX status word 0 fields/flags */
-#define AR5K_5212_RX_DESC_STATUS0_DATA_LEN              0x00000fff
-#define AR5K_5212_RX_DESC_STATUS0_MORE                  0x00001000
-#define AR5K_5212_RX_DESC_STATUS0_DECOMP_CRC_ERROR      0x00002000
-#define AR5K_5212_RX_DESC_STATUS0_RECEIVE_RATE          0x000f8000
+#define AR5K_5212_RX_DESC_STATUS0_DATA_LEN              0x00000fff /* RX data length */
+#define AR5K_5212_RX_DESC_STATUS0_MORE                  0x00001000 /* more desc for this frame */
+#define AR5K_5212_RX_DESC_STATUS0_DECOMP_CRC_ERROR      0x00002000 /* decompression CRC error */
+#define AR5K_5212_RX_DESC_STATUS0_RECEIVE_RATE          0x000f8000 /* reception rate */
 #define AR5K_5212_RX_DESC_STATUS0_RECEIVE_RATE_S        15
-#define AR5K_5212_RX_DESC_STATUS0_RECEIVE_SIGNAL        0x0ff00000
+#define AR5K_5212_RX_DESC_STATUS0_RECEIVE_SIGNAL        0x0ff00000 /* rssi */
 #define AR5K_5212_RX_DESC_STATUS0_RECEIVE_SIGNAL_S      20
-#define AR5K_5212_RX_DESC_STATUS0_RECEIVE_ANTENNA       0xf0000000
+#define AR5K_5212_RX_DESC_STATUS0_RECEIVE_ANTENNA       0xf0000000 /* receive antenna */
 #define AR5K_5212_RX_DESC_STATUS0_RECEIVE_ANTENNA_S     28
 
 /* RX status word 1 fields/flags */
-#define AR5K_5212_RX_DESC_STATUS1_DONE                  0x00000001
-#define AR5K_5212_RX_DESC_STATUS1_FRAME_RECEIVE_OK      0x00000002
-#define AR5K_5212_RX_DESC_STATUS1_CRC_ERROR             0x00000004
-#define AR5K_5212_RX_DESC_STATUS1_DECRYPT_CRC_ERROR     0x00000008
-#define AR5K_5212_RX_DESC_STATUS1_PHY_ERROR             0x00000010
-#define AR5K_5212_RX_DESC_STATUS1_MIC_ERROR             0x00000020
-#define AR5K_5212_RX_DESC_STATUS1_KEY_INDEX_VALID       0x00000100
-#define AR5K_5212_RX_DESC_STATUS1_KEY_INDEX             0x0000fe00
+#define AR5K_5212_RX_DESC_STATUS1_DONE                  0x00000001 /* descriptor complete */
+#define AR5K_5212_RX_DESC_STATUS1_FRAME_RECEIVE_OK      0x00000002 /* frame reception success */
+#define AR5K_5212_RX_DESC_STATUS1_CRC_ERROR             0x00000004 /* CRC error */
+#define AR5K_5212_RX_DESC_STATUS1_DECRYPT_CRC_ERROR     0x00000008 /* decryption CRC failure */
+#define AR5K_5212_RX_DESC_STATUS1_PHY_ERROR             0x00000010 /* PHY error */
+#define AR5K_5212_RX_DESC_STATUS1_MIC_ERROR             0x00000020 /* MIC decrypt error */
+#define AR5K_5212_RX_DESC_STATUS1_KEY_INDEX_VALID       0x00000100 /* key index valid */
+#define AR5K_5212_RX_DESC_STATUS1_KEY_INDEX             0x0000fe00 /* decryption key index */
 #define AR5K_5212_RX_DESC_STATUS1_KEY_INDEX_S           9
-#define AR5K_5212_RX_DESC_STATUS1_RECEIVE_TIMESTAMP     0x7fff0000
+#define AR5K_5212_RX_DESC_STATUS1_RECEIVE_TIMESTAMP     0x7fff0000 /* first 15bit of the TSF */
 #define AR5K_5212_RX_DESC_STATUS1_RECEIVE_TIMESTAMP_S   16
-#define AR5K_5212_RX_DESC_STATUS1_KEY_CACHE_MISS        0x80000000
-
-/*
- * common hardware RX error descriptor
- */
-struct ath5k_hw_rx_error {
-        u32     rx_error_0; /* RX status word 0 */
-        u32     rx_error_1; /* RX status word 1 */
-} __packed;
-
-/* RX error word 0 fields/flags */
-#define AR5K_RX_DESC_ERROR0                     0x00000000
-
-/* RX error word 1 fields/flags */
-#define AR5K_RX_DESC_ERROR1_PHY_ERROR_CODE      0x0000ff00
-#define AR5K_RX_DESC_ERROR1_PHY_ERROR_CODE_S    8
+#define AR5K_5212_RX_DESC_STATUS1_KEY_CACHE_MISS        0x80000000 /* key cache miss */
+#define AR5K_5212_RX_DESC_STATUS1_PHY_ERROR_CODE        0x0000ff00 /* phy error code overlays key index and valid fields */
+#define AR5K_5212_RX_DESC_STATUS1_PHY_ERROR_CODE_S      8
 
 /**
  * enum ath5k_phy_error_code - PHY Error codes
  */
 enum ath5k_phy_error_code {
-        AR5K_RX_PHY_ERROR_UNDERRUN              = 0,    /* Transmit underrun */
+        AR5K_RX_PHY_ERROR_UNDERRUN              = 0,    /* Transmit underrun, [5210] No error */
         AR5K_RX_PHY_ERROR_TIMING                = 1,    /* Timing error */
         AR5K_RX_PHY_ERROR_PARITY                = 2,    /* Illegal parity */
         AR5K_RX_PHY_ERROR_RATE                  = 3,    /* Illegal rate */
         AR5K_RX_PHY_ERROR_LENGTH                = 4,    /* Illegal length */
-        AR5K_RX_PHY_ERROR_RADAR                 = 5,    /* Radar detect */
+        AR5K_RX_PHY_ERROR_RADAR                 = 5,    /* Radar detect, [5210] 64 QAM rate */
         AR5K_RX_PHY_ERROR_SERVICE               = 6,    /* Illegal service */
         AR5K_RX_PHY_ERROR_TOR                   = 7,    /* Transmit override receive */
         /* these are specific to the 5212 */
@@ -148,112 +132,111 @@ struct ath5k_hw_2w_tx_ctl {
 } __packed;
 
 /* TX control word 0 fields/flags */
-#define AR5K_2W_TX_DESC_CTL0_FRAME_LEN          0x00000fff
-#define AR5K_2W_TX_DESC_CTL0_HEADER_LEN         0x0003f000 /*[5210 ?]*/
-#define AR5K_2W_TX_DESC_CTL0_HEADER_LEN_S       12
-#define AR5K_2W_TX_DESC_CTL0_XMIT_RATE          0x003c0000
+#define AR5K_2W_TX_DESC_CTL0_FRAME_LEN          0x00000fff /* frame length */
+#define AR5K_2W_TX_DESC_CTL0_HEADER_LEN_5210    0x0003f000 /* [5210] header length */
+#define AR5K_2W_TX_DESC_CTL0_HEADER_LEN_5210_S  12
+#define AR5K_2W_TX_DESC_CTL0_XMIT_RATE          0x003c0000 /* tx rate */
 #define AR5K_2W_TX_DESC_CTL0_XMIT_RATE_S        18
-#define AR5K_2W_TX_DESC_CTL0_RTSENA             0x00400000
-#define AR5K_2W_TX_DESC_CTL0_CLRDMASK           0x01000000
-#define AR5K_2W_TX_DESC_CTL0_LONG_PACKET        0x00800000 /*[5210]*/
-#define AR5K_2W_TX_DESC_CTL0_VEOL               0x00800000 /*[5211]*/
-#define AR5K_2W_TX_DESC_CTL0_FRAME_TYPE         0x1c000000 /*[5210]*/
-#define AR5K_2W_TX_DESC_CTL0_FRAME_TYPE_S       26
-#define AR5K_2W_TX_DESC_CTL0_ANT_MODE_XMIT_5210 0x02000000
-#define AR5K_2W_TX_DESC_CTL0_ANT_MODE_XMIT_5211 0x1e000000
-
+#define AR5K_2W_TX_DESC_CTL0_RTSENA             0x00400000 /* RTS/CTS enable */
+#define AR5K_2W_TX_DESC_CTL0_LONG_PACKET_5210   0x00800000 /* [5210] long packet */
+#define AR5K_2W_TX_DESC_CTL0_VEOL_5211          0x00800000 /* [5211] virtual end-of-list */
+#define AR5K_2W_TX_DESC_CTL0_CLRDMASK           0x01000000 /* clear destination mask */
+#define AR5K_2W_TX_DESC_CTL0_ANT_MODE_XMIT_5210 0x02000000 /* [5210] antenna selection */
+#define AR5K_2W_TX_DESC_CTL0_ANT_MODE_XMIT_5211 0x1e000000 /* [5211] antenna selection */
 #define AR5K_2W_TX_DESC_CTL0_ANT_MODE_XMIT                      \
                 (ah->ah_version == AR5K_AR5210 ?                \
                 AR5K_2W_TX_DESC_CTL0_ANT_MODE_XMIT_5210 :       \
                 AR5K_2W_TX_DESC_CTL0_ANT_MODE_XMIT_5211)
-
 #define AR5K_2W_TX_DESC_CTL0_ANT_MODE_XMIT_S    25
-#define AR5K_2W_TX_DESC_CTL0_INTREQ             0x20000000
-#define AR5K_2W_TX_DESC_CTL0_ENCRYPT_KEY_VALID  0x40000000
+#define AR5K_2W_TX_DESC_CTL0_FRAME_TYPE_5210    0x1c000000 /* [5210] frame type */
+#define AR5K_2W_TX_DESC_CTL0_FRAME_TYPE_5210_S  26
+#define AR5K_2W_TX_DESC_CTL0_INTREQ             0x20000000 /* TX interrupt request */
+#define AR5K_2W_TX_DESC_CTL0_ENCRYPT_KEY_VALID  0x40000000 /* key is valid */
 
 /* TX control word 1 fields/flags */
-#define AR5K_2W_TX_DESC_CTL1_BUF_LEN            0x00000fff
-#define AR5K_2W_TX_DESC_CTL1_MORE               0x00001000
-#define AR5K_2W_TX_DESC_CTL1_ENCRYPT_KEY_INDEX_5210     0x0007e000
-#define AR5K_2W_TX_DESC_CTL1_ENCRYPT_KEY_INDEX_5211     0x000fe000
-
-#define AR5K_2W_TX_DESC_CTL1_ENCRYPT_KEY_INDEX                          \
+#define AR5K_2W_TX_DESC_CTL1_BUF_LEN            0x00000fff /* data buffer length */
+#define AR5K_2W_TX_DESC_CTL1_MORE               0x00001000 /* more desc for this frame */
+#define AR5K_2W_TX_DESC_CTL1_ENC_KEY_IDX_5210   0x0007e000 /* [5210] key table index */
+#define AR5K_2W_TX_DESC_CTL1_ENC_KEY_IDX_5211   0x000fe000 /* [5211] key table index */
+#define AR5K_2W_TX_DESC_CTL1_ENC_KEY_IDX                                \
                         (ah->ah_version == AR5K_AR5210 ?                \
-                        AR5K_2W_TX_DESC_CTL1_ENCRYPT_KEY_INDEX_5210 :   \
-                        AR5K_2W_TX_DESC_CTL1_ENCRYPT_KEY_INDEX_5211)
-
-#define AR5K_2W_TX_DESC_CTL1_ENCRYPT_KEY_INDEX_S        13
-#define AR5K_2W_TX_DESC_CTL1_FRAME_TYPE         0x00700000 /*[5211]*/
-#define AR5K_2W_TX_DESC_CTL1_FRAME_TYPE_S       20
-#define AR5K_2W_TX_DESC_CTL1_NOACK              0x00800000 /*[5211]*/
-#define AR5K_2W_TX_DESC_CTL1_RTS_DURATION       0xfff80000 /*[5210 ?]*/
+                        AR5K_2W_TX_DESC_CTL1_ENC_KEY_IDX_5210 :         \
+                        AR5K_2W_TX_DESC_CTL1_ENC_KEY_IDX_5211)
+#define AR5K_2W_TX_DESC_CTL1_ENC_KEY_IDX_S      13
+#define AR5K_2W_TX_DESC_CTL1_FRAME_TYPE_5211    0x00700000 /* [5211] frame type */
+#define AR5K_2W_TX_DESC_CTL1_FRAME_TYPE_5211_S  20
+#define AR5K_2W_TX_DESC_CTL1_NOACK_5211         0x00800000 /* [5211] no ACK */
+#define AR5K_2W_TX_DESC_CTL1_RTS_DURATION_5210  0xfff80000 /* [5210] lower 13 bit of duration */
 
 /* Frame types */
-#define AR5K_AR5210_TX_DESC_FRAME_TYPE_NORMAL   0x00
-#define AR5K_AR5210_TX_DESC_FRAME_TYPE_ATIM     0x04
-#define AR5K_AR5210_TX_DESC_FRAME_TYPE_PSPOLL   0x08
-#define AR5K_AR5210_TX_DESC_FRAME_TYPE_NO_DELAY 0x0c
-#define AR5K_AR5210_TX_DESC_FRAME_TYPE_PIFS     0x10
+#define AR5K_AR5210_TX_DESC_FRAME_TYPE_NORMAL   0
+#define AR5K_AR5210_TX_DESC_FRAME_TYPE_ATIM     1
+#define AR5K_AR5210_TX_DESC_FRAME_TYPE_PSPOLL   2
+#define AR5K_AR5210_TX_DESC_FRAME_TYPE_NO_DELAY 3
+#define AR5K_AR5211_TX_DESC_FRAME_TYPE_BEACON   3
+#define AR5K_AR5210_TX_DESC_FRAME_TYPE_PIFS     4
+#define AR5K_AR5211_TX_DESC_FRAME_TYPE_PRESP    4
 
 /*
  * 5212 hardware 4-word TX control descriptor
  */
 struct ath5k_hw_4w_tx_ctl {
         u32     tx_control_0; /* TX control word 0 */
+        u32     tx_control_1; /* TX control word 1 */
+        u32     tx_control_2; /* TX control word 2 */
+        u32     tx_control_3; /* TX control word 3 */
+} __packed;
 
-#define AR5K_4W_TX_DESC_CTL0_FRAME_LEN          0x00000fff
-#define AR5K_4W_TX_DESC_CTL0_XMIT_POWER         0x003f0000
+/* TX control word 0 fields/flags */
+#define AR5K_4W_TX_DESC_CTL0_FRAME_LEN          0x00000fff /* frame length */
+#define AR5K_4W_TX_DESC_CTL0_XMIT_POWER         0x003f0000 /* transmit power */
 #define AR5K_4W_TX_DESC_CTL0_XMIT_POWER_S       16
-#define AR5K_4W_TX_DESC_CTL0_RTSENA             0x00400000
-#define AR5K_4W_TX_DESC_CTL0_VEOL               0x00800000
-#define AR5K_4W_TX_DESC_CTL0_CLRDMASK           0x01000000
-#define AR5K_4W_TX_DESC_CTL0_ANT_MODE_XMIT      0x1e000000
+#define AR5K_4W_TX_DESC_CTL0_RTSENA             0x00400000 /* RTS/CTS enable */
+#define AR5K_4W_TX_DESC_CTL0_VEOL               0x00800000 /* virtual end-of-list */
+#define AR5K_4W_TX_DESC_CTL0_CLRDMASK           0x01000000 /* clear destination mask */
+#define AR5K_4W_TX_DESC_CTL0_ANT_MODE_XMIT      0x1e000000 /* TX antenna selection */
 #define AR5K_4W_TX_DESC_CTL0_ANT_MODE_XMIT_S    25
-#define AR5K_4W_TX_DESC_CTL0_INTREQ             0x20000000
-#define AR5K_4W_TX_DESC_CTL0_ENCRYPT_KEY_VALID  0x40000000
-#define AR5K_4W_TX_DESC_CTL0_CTSENA             0x80000000
-
-        u32     tx_control_1; /* TX control word 1 */
+#define AR5K_4W_TX_DESC_CTL0_INTREQ             0x20000000 /* TX interrupt request */
+#define AR5K_4W_TX_DESC_CTL0_ENCRYPT_KEY_VALID  0x40000000 /* destination index valid */
+#define AR5K_4W_TX_DESC_CTL0_CTSENA             0x80000000 /* precede frame with CTS */
 
-#define AR5K_4W_TX_DESC_CTL1_BUF_LEN            0x00000fff
-#define AR5K_4W_TX_DESC_CTL1_MORE               0x00001000
-#define AR5K_4W_TX_DESC_CTL1_ENCRYPT_KEY_INDEX  0x000fe000
-#define AR5K_4W_TX_DESC_CTL1_ENCRYPT_KEY_INDEX_S        13
-#define AR5K_4W_TX_DESC_CTL1_FRAME_TYPE         0x00f00000
+/* TX control word 1 fields/flags */
+#define AR5K_4W_TX_DESC_CTL1_BUF_LEN            0x00000fff /* data buffer length */
+#define AR5K_4W_TX_DESC_CTL1_MORE               0x00001000 /* more desc for this frame */
+#define AR5K_4W_TX_DESC_CTL1_ENCRYPT_KEY_IDX    0x000fe000 /* destination table index */
+#define AR5K_4W_TX_DESC_CTL1_ENCRYPT_KEY_IDX_S  13
+#define AR5K_4W_TX_DESC_CTL1_FRAME_TYPE         0x00f00000 /* frame type */
 #define AR5K_4W_TX_DESC_CTL1_FRAME_TYPE_S       20
-#define AR5K_4W_TX_DESC_CTL1_NOACK              0x01000000
-#define AR5K_4W_TX_DESC_CTL1_COMP_PROC          0x06000000
+#define AR5K_4W_TX_DESC_CTL1_NOACK              0x01000000 /* no ACK */
+#define AR5K_4W_TX_DESC_CTL1_COMP_PROC          0x06000000 /* compression processing */
 #define AR5K_4W_TX_DESC_CTL1_COMP_PROC_S        25
-#define AR5K_4W_TX_DESC_CTL1_COMP_IV_LEN        0x18000000
+#define AR5K_4W_TX_DESC_CTL1_COMP_IV_LEN        0x18000000 /* length of frame IV */
 #define AR5K_4W_TX_DESC_CTL1_COMP_IV_LEN_S      27
-#define AR5K_4W_TX_DESC_CTL1_COMP_ICV_LEN       0x60000000
+#define AR5K_4W_TX_DESC_CTL1_COMP_ICV_LEN       0x60000000 /* length of frame ICV */
 #define AR5K_4W_TX_DESC_CTL1_COMP_ICV_LEN_S     29
 
-        u32     tx_control_2; /* TX control word 2 */
-
-#define AR5K_4W_TX_DESC_CTL2_RTS_DURATION               0x00007fff
-#define AR5K_4W_TX_DESC_CTL2_DURATION_UPDATE_ENABLE     0x00008000
-#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES0                0x000f0000
-#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES0_S              16
-#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES1                0x00f00000
-#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES1_S              20
-#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES2                0x0f000000
-#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES2_S              24
-#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES3                0xf0000000
-#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES3_S              28
-
-        u32     tx_control_3; /* TX control word 3 */
-
-#define AR5K_4W_TX_DESC_CTL3_XMIT_RATE0         0x0000001f
-#define AR5K_4W_TX_DESC_CTL3_XMIT_RATE1         0x000003e0
+/* TX control word 2 fields/flags */
+#define AR5K_4W_TX_DESC_CTL2_RTS_DURATION       0x00007fff /* RTS/CTS duration */
+#define AR5K_4W_TX_DESC_CTL2_DURATION_UPD_EN    0x00008000 /* frame duration update */
+#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES0        0x000f0000 /* series 0 max attempts */
+#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES0_S      16
+#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES1        0x00f00000 /* series 1 max attempts */
+#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES1_S      20
+#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES2        0x0f000000 /* series 2 max attempts */
+#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES2_S      24
+#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES3        0xf0000000 /* series 3 max attempts */
+#define AR5K_4W_TX_DESC_CTL2_XMIT_TRIES3_S      28
+
+/* TX control word 3 fields/flags */
+#define AR5K_4W_TX_DESC_CTL3_XMIT_RATE0         0x0000001f /* series 0 tx rate */
+#define AR5K_4W_TX_DESC_CTL3_XMIT_RATE1         0x000003e0 /* series 1 tx rate */
 #define AR5K_4W_TX_DESC_CTL3_XMIT_RATE1_S       5
-#define AR5K_4W_TX_DESC_CTL3_XMIT_RATE2         0x00007c00
+#define AR5K_4W_TX_DESC_CTL3_XMIT_RATE2         0x00007c00 /* series 2 tx rate */
 #define AR5K_4W_TX_DESC_CTL3_XMIT_RATE2_S       10
-#define AR5K_4W_TX_DESC_CTL3_XMIT_RATE3         0x000f8000
+#define AR5K_4W_TX_DESC_CTL3_XMIT_RATE3         0x000f8000 /* series 3 tx rate */
 #define AR5K_4W_TX_DESC_CTL3_XMIT_RATE3_S       15
-#define AR5K_4W_TX_DESC_CTL3_RTS_CTS_RATE       0x01f00000
+#define AR5K_4W_TX_DESC_CTL3_RTS_CTS_RATE       0x01f00000 /* RTS or CTS rate */
 #define AR5K_4W_TX_DESC_CTL3_RTS_CTS_RATE_S     20
-} __packed;
 
 /*
  * Common TX status descriptor
@@ -264,37 +247,34 @@ struct ath5k_hw_tx_status {
 } __packed;
 
 /* TX status word 0 fields/flags */
-#define AR5K_DESC_TX_STATUS0_FRAME_XMIT_OK      0x00000001
-#define AR5K_DESC_TX_STATUS0_EXCESSIVE_RETRIES  0x00000002
-#define AR5K_DESC_TX_STATUS0_FIFO_UNDERRUN      0x00000004
-#define AR5K_DESC_TX_STATUS0_FILTERED           0x00000008
-/*???
-#define AR5K_DESC_TX_STATUS0_RTS_FAIL_COUNT     0x000000f0
-#define AR5K_DESC_TX_STATUS0_RTS_FAIL_COUNT_S   4
-*/
-#define AR5K_DESC_TX_STATUS0_SHORT_RETRY_COUNT  0x000000f0
+#define AR5K_DESC_TX_STATUS0_FRAME_XMIT_OK      0x00000001 /* TX success */
+#define AR5K_DESC_TX_STATUS0_EXCESSIVE_RETRIES  0x00000002 /* excessive retries */
+#define AR5K_DESC_TX_STATUS0_FIFO_UNDERRUN      0x00000004 /* FIFO underrun */
+#define AR5K_DESC_TX_STATUS0_FILTERED           0x00000008 /* TX filter indication */
+/* according to the HAL sources the spec has short/long retry counts reversed.
+ * we have it reversed to the HAL sources as well, for 5210 and 5211.
+ * For 5212 these fields are defined as RTS_FAIL_COUNT and DATA_FAIL_COUNT,
+ * but used respectively as SHORT and LONG retry count in the code later. This
+ * is consistent with the definitions here... TODO: check */
+#define AR5K_DESC_TX_STATUS0_SHORT_RETRY_COUNT  0x000000f0 /* short retry count */
 #define AR5K_DESC_TX_STATUS0_SHORT_RETRY_COUNT_S        4
-/*???
-#define AR5K_DESC_TX_STATUS0_DATA_FAIL_COUNT    0x00000f00
-#define AR5K_DESC_TX_STATUS0_DATA_FAIL_COUNT_S  8
-*/
-#define AR5K_DESC_TX_STATUS0_LONG_RETRY_COUNT   0x00000f00
+#define AR5K_DESC_TX_STATUS0_LONG_RETRY_COUNT   0x00000f00 /* long retry count */
 #define AR5K_DESC_TX_STATUS0_LONG_RETRY_COUNT_S 8
-#define AR5K_DESC_TX_STATUS0_VIRT_COLL_COUNT    0x0000f000
-#define AR5K_DESC_TX_STATUS0_VIRT_COLL_COUNT_S  12
-#define AR5K_DESC_TX_STATUS0_SEND_TIMESTAMP     0xffff0000
+#define AR5K_DESC_TX_STATUS0_VIRTCOLL_CT_5211   0x0000f000 /* [5211+] virtual collision count */
+#define AR5K_DESC_TX_STATUS0_VIRTCOLL_CT_5212_S 12
+#define AR5K_DESC_TX_STATUS0_SEND_TIMESTAMP     0xffff0000 /* TX timestamp */
 #define AR5K_DESC_TX_STATUS0_SEND_TIMESTAMP_S   16
 
 /* TX status word 1 fields/flags */
-#define AR5K_DESC_TX_STATUS1_DONE               0x00000001
-#define AR5K_DESC_TX_STATUS1_SEQ_NUM            0x00001ffe
+#define AR5K_DESC_TX_STATUS1_DONE               0x00000001 /* descriptor complete */
+#define AR5K_DESC_TX_STATUS1_SEQ_NUM            0x00001ffe /* TX sequence number */
 #define AR5K_DESC_TX_STATUS1_SEQ_NUM_S          1
-#define AR5K_DESC_TX_STATUS1_ACK_SIG_STRENGTH   0x001fe000
+#define AR5K_DESC_TX_STATUS1_ACK_SIG_STRENGTH   0x001fe000 /* signal strength of ACK */
 #define AR5K_DESC_TX_STATUS1_ACK_SIG_STRENGTH_S 13
-#define AR5K_DESC_TX_STATUS1_FINAL_TS_INDEX     0x00600000
-#define AR5K_DESC_TX_STATUS1_FINAL_TS_INDEX_S   21
-#define AR5K_DESC_TX_STATUS1_COMP_SUCCESS       0x00800000
-#define AR5K_DESC_TX_STATUS1_XMIT_ANTENNA       0x01000000
+#define AR5K_DESC_TX_STATUS1_FINAL_TS_IX_5212   0x00600000 /* [5212] final TX attempt series ix */
+#define AR5K_DESC_TX_STATUS1_FINAL_TS_IX_5212_S 21
+#define AR5K_DESC_TX_STATUS1_COMP_SUCCESS_5212  0x00800000 /* [5212] compression status */
+#define AR5K_DESC_TX_STATUS1_XMIT_ANTENNA_5212  0x01000000 /* [5212] transmit antenna */
 
 /*
  * 5210/5211 hardware TX descriptor
@@ -313,18 +293,15 @@ struct ath5k_hw_5212_tx_desc {
 } __packed;
 
 /*
- * common hardware RX descriptor
+ * Common hardware RX descriptor
  */
 struct ath5k_hw_all_rx_desc {
-        struct ath5k_hw_rx_ctl                  rx_ctl;
-        union {
-                struct ath5k_hw_rx_status       rx_stat;
-                struct ath5k_hw_rx_error        rx_err;
-        } u;
+        struct ath5k_hw_rx_ctl          rx_ctl;
+        struct ath5k_hw_rx_status       rx_stat;
 } __packed;
 
 /*
- * Atheros hardware descriptor
+ * Atheros hardware DMA descriptor
  * This is read and written to by the hardware
  */
 struct ath5k_desc {
@@ -346,4 +323,3 @@ struct ath5k_desc {
 #define AR5K_TXDESC_CTSENA      0x0008
 #define AR5K_TXDESC_INTREQ      0x0010
 #define AR5K_TXDESC_VEOL        0x0020  /*[5211+]*/
-
diff --git a/drivers/net/wireless/ath/ath5k/dma.c b/drivers/net/wireless/ath/ath5k/dma.c
index 941b51130a6f..484f31870ba8 100644
--- a/drivers/net/wireless/ath/ath5k/dma.c
+++ b/drivers/net/wireless/ath/ath5k/dma.c
@@ -48,7 +48,6 @@
  */
 void ath5k_hw_start_rx_dma(struct ath5k_hw *ah)
 {
-        ATH5K_TRACE(ah->ah_sc);
         ath5k_hw_reg_write(ah, AR5K_CR_RXE, AR5K_CR);
         ath5k_hw_reg_read(ah, AR5K_CR);
 }
@@ -62,7 +61,6 @@ int ath5k_hw_stop_rx_dma(struct ath5k_hw *ah)
 {
         unsigned int i;
 
-        ATH5K_TRACE(ah->ah_sc);
         ath5k_hw_reg_write(ah, AR5K_CR_RXD, AR5K_CR);
 
         /*
@@ -96,8 +94,6 @@ u32 ath5k_hw_get_rxdp(struct ath5k_hw *ah)
  */
 void ath5k_hw_set_rxdp(struct ath5k_hw *ah, u32 phys_addr)
 {
-        ATH5K_TRACE(ah->ah_sc);
-
         ath5k_hw_reg_write(ah, phys_addr, AR5K_RXDP);
 }
 
@@ -125,7 +121,6 @@ int ath5k_hw_start_tx_dma(struct ath5k_hw *ah, unsigned int queue)
 {
         u32 tx_queue;
 
-        ATH5K_TRACE(ah->ah_sc);
         AR5K_ASSERT_ENTRY(queue, ah->ah_capabilities.cap_queues.q_tx_num);
 
         /* Return if queue is declared inactive */
@@ -186,7 +181,6 @@ int ath5k_hw_stop_tx_dma(struct ath5k_hw *ah, unsigned int queue)
         unsigned int i = 40;
         u32 tx_queue, pending;
 
-        ATH5K_TRACE(ah->ah_sc);
         AR5K_ASSERT_ENTRY(queue, ah->ah_capabilities.cap_queues.q_tx_num);
 
         /* Return if queue is declared inactive */
@@ -297,7 +291,6 @@ u32 ath5k_hw_get_txdp(struct ath5k_hw *ah, unsigned int queue)
 {
         u16 tx_reg;
 
-        ATH5K_TRACE(ah->ah_sc);
         AR5K_ASSERT_ENTRY(queue, ah->ah_capabilities.cap_queues.q_tx_num);
 
         /*
@@ -340,7 +333,6 @@ int ath5k_hw_set_txdp(struct ath5k_hw *ah, unsigned int queue, u32 phys_addr)
 {
         u16 tx_reg;
 
-        ATH5K_TRACE(ah->ah_sc);
         AR5K_ASSERT_ENTRY(queue, ah->ah_capabilities.cap_queues.q_tx_num);
 
         /*
@@ -400,8 +392,6 @@ int ath5k_hw_update_tx_triglevel(struct ath5k_hw *ah, bool increase)
         u32 trigger_level, imr;
         int ret = -EIO;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         /*
          * Disable interrupts by setting the mask
          */
@@ -451,7 +441,6 @@ done:
  */
 bool ath5k_hw_is_intr_pending(struct ath5k_hw *ah)
 {
-        ATH5K_TRACE(ah->ah_sc);
         return ath5k_hw_reg_read(ah, AR5K_INTPEND) == 1 ? 1 : 0;
 }
 
@@ -475,8 +464,6 @@ int ath5k_hw_get_isr(struct ath5k_hw *ah, enum ath5k_int *interrupt_mask)
 {
         u32 data;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         /*
          * Read interrupt status from the Interrupt Status register
          * on 5210
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index ed0263672d6d..ae316fec4a6a 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -35,7 +35,6 @@ static int ath5k_hw_eeprom_read(struct ath5k_hw *ah, u32 offset, u16 *data)
 {
         u32 status, timeout;
 
-        ATH5K_TRACE(ah->ah_sc);
         /*
          * Initialize EEPROM access
          */
@@ -715,7 +714,7 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode,
 
                 /* Only one curve for RF5111
                  * find out which one and place
-                 * in in pd_curves.
+                 * in pd_curves.
                  * Note: ee_x_gain is reversed here */
                 for (idx = 0; idx < AR5K_EEPROM_N_PD_CURVES; idx++) {
 
diff --git a/drivers/net/wireless/ath/ath5k/gpio.c b/drivers/net/wireless/ath/ath5k/gpio.c
index 64a27e73d02e..bc90503f4b7a 100644
--- a/drivers/net/wireless/ath/ath5k/gpio.c
+++ b/drivers/net/wireless/ath/ath5k/gpio.c
@@ -34,8 +34,6 @@ void ath5k_hw_set_ledstate(struct ath5k_hw *ah, unsigned int state)
         /*5210 has different led mode handling*/
         u32 led_5210;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         /*Reset led status*/
         if (ah->ah_version != AR5K_AR5210)
                 AR5K_REG_DISABLE_BITS(ah, AR5K_PCICFG,
@@ -82,7 +80,6 @@ void ath5k_hw_set_ledstate(struct ath5k_hw *ah, unsigned int state)
  */
 int ath5k_hw_set_gpio_input(struct ath5k_hw *ah, u32 gpio)
 {
-        ATH5K_TRACE(ah->ah_sc);
         if (gpio >= AR5K_NUM_GPIO)
                 return -EINVAL;
 
@@ -98,7 +95,6 @@ int ath5k_hw_set_gpio_input(struct ath5k_hw *ah, u32 gpio)
  */
 int ath5k_hw_set_gpio_output(struct ath5k_hw *ah, u32 gpio)
 {
-        ATH5K_TRACE(ah->ah_sc);
         if (gpio >= AR5K_NUM_GPIO)
                 return -EINVAL;
 
@@ -114,7 +110,6 @@ int ath5k_hw_set_gpio_output(struct ath5k_hw *ah, u32 gpio)
  */
 u32 ath5k_hw_get_gpio(struct ath5k_hw *ah, u32 gpio)
 {
-        ATH5K_TRACE(ah->ah_sc);
         if (gpio >= AR5K_NUM_GPIO)
                 return 0xffffffff;
 
@@ -129,7 +124,6 @@ u32 ath5k_hw_get_gpio(struct ath5k_hw *ah, u32 gpio)
 int ath5k_hw_set_gpio(struct ath5k_hw *ah, u32 gpio, u32 val)
 {
         u32 data;
-        ATH5K_TRACE(ah->ah_sc);
 
         if (gpio >= AR5K_NUM_GPIO)
                 return -EINVAL;
@@ -153,7 +147,6 @@ void ath5k_hw_set_gpio_intr(struct ath5k_hw *ah, unsigned int gpio,
 {
         u32 data;
 
-        ATH5K_TRACE(ah->ah_sc);
         if (gpio >= AR5K_NUM_GPIO)
                 return;
 
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index 5212e275f1c7..86fdb6ddfaaa 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -59,8 +59,6 @@ int ath5k_hw_set_opmode(struct ath5k_hw *ah, enum nl80211_iftype op_mode)
 
         beacon_reg = 0;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         switch (op_mode) {
         case NL80211_IFTYPE_ADHOC:
                 pcu_reg |= AR5K_STA_ID1_ADHOC | AR5K_STA_ID1_KEYSRCH_MODE;
@@ -173,7 +171,6 @@ void ath5k_hw_set_ack_bitrate_high(struct ath5k_hw *ah, bool high)
  */
 static int ath5k_hw_set_ack_timeout(struct ath5k_hw *ah, unsigned int timeout)
 {
-        ATH5K_TRACE(ah->ah_sc);
         if (ath5k_hw_clocktoh(ah, AR5K_REG_MS(0xffffffff, AR5K_TIME_OUT_ACK))
                         <= timeout)
                 return -EINVAL;
@@ -192,7 +189,6 @@ static int ath5k_hw_set_ack_timeout(struct ath5k_hw *ah, unsigned int timeout)
  */
 static int ath5k_hw_set_cts_timeout(struct ath5k_hw *ah, unsigned int timeout)
 {
-        ATH5K_TRACE(ah->ah_sc);
         if (ath5k_hw_clocktoh(ah, AR5K_REG_MS(0xffffffff, AR5K_TIME_OUT_CTS))
                         <= timeout)
                 return -EINVAL;
@@ -297,7 +293,6 @@ int ath5k_hw_set_lladdr(struct ath5k_hw *ah, const u8 *mac)
         u32 low_id, high_id;
         u32 pcu_reg;
 
-        ATH5K_TRACE(ah->ah_sc);
         /* Set new station ID */
         memcpy(common->macaddr, mac, ETH_ALEN);
 
@@ -357,7 +352,6 @@ void ath5k_hw_set_associd(struct ath5k_hw *ah)
 void ath5k_hw_set_bssid_mask(struct ath5k_hw *ah, const u8 *mask)
 {
         struct ath_common *common = ath5k_hw_common(ah);
-        ATH5K_TRACE(ah->ah_sc);
 
         /* Cache bssid mask so that we can restore it
          * on reset */
@@ -382,7 +376,6 @@ void ath5k_hw_set_bssid_mask(struct ath5k_hw *ah, const u8 *mask)
  */
 void ath5k_hw_start_rx_pcu(struct ath5k_hw *ah)
 {
-        ATH5K_TRACE(ah->ah_sc);
         AR5K_REG_DISABLE_BITS(ah, AR5K_DIAG_SW, AR5K_DIAG_SW_DIS_RX);
 }
 
@@ -397,7 +390,6 @@ void ath5k_hw_start_rx_pcu(struct ath5k_hw *ah)
  */
 void ath5k_hw_stop_rx_pcu(struct ath5k_hw *ah)
 {
-        ATH5K_TRACE(ah->ah_sc);
         AR5K_REG_ENABLE_BITS(ah, AR5K_DIAG_SW, AR5K_DIAG_SW_DIS_RX);
 }
 
@@ -406,8 +398,6 @@ void ath5k_hw_stop_rx_pcu(struct ath5k_hw *ah)
  */
 void ath5k_hw_set_mcast_filter(struct ath5k_hw *ah, u32 filter0, u32 filter1)
 {
-        ATH5K_TRACE(ah->ah_sc);
-        /* Set the multicat filter */
         ath5k_hw_reg_write(ah, filter0, AR5K_MCAST_FILTER0);
         ath5k_hw_reg_write(ah, filter1, AR5K_MCAST_FILTER1);
 }
@@ -427,7 +417,6 @@ u32 ath5k_hw_get_rx_filter(struct ath5k_hw *ah)
 {
         u32 data, filter = 0;
 
-        ATH5K_TRACE(ah->ah_sc);
         filter = ath5k_hw_reg_read(ah, AR5K_RX_FILTER);
 
         /*Radar detection for 5212*/
@@ -457,8 +446,6 @@ void ath5k_hw_set_rx_filter(struct ath5k_hw *ah, u32 filter)
 {
         u32 data = 0;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         /* Set PHY error filter register on 5212*/
         if (ah->ah_version == AR5K_AR5212) {
                 if (filter & AR5K_RX_FILTER_RADARERR)
@@ -533,8 +520,6 @@ u64 ath5k_hw_get_tsf64(struct ath5k_hw *ah)
 
         WARN_ON( i == ATH5K_MAX_TSF_READ );
 
-        ATH5K_TRACE(ah->ah_sc);
-
         return (((u64)tsf_upper1 << 32) | tsf_lower);
 }
 
@@ -548,8 +533,6 @@ u64 ath5k_hw_get_tsf64(struct ath5k_hw *ah)
  */
 void ath5k_hw_set_tsf64(struct ath5k_hw *ah, u64 tsf64)
 {
-        ATH5K_TRACE(ah->ah_sc);
-
         ath5k_hw_reg_write(ah, tsf64 & 0xffffffff, AR5K_TSF_L32);
         ath5k_hw_reg_write(ah, (tsf64 >> 32) & 0xffffffff, AR5K_TSF_U32);
 }
@@ -565,8 +548,6 @@ void ath5k_hw_reset_tsf(struct ath5k_hw *ah)
 {
         u32 val;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         val = ath5k_hw_reg_read(ah, AR5K_BEACON) | AR5K_BEACON_RESET_TSF;
 
         /*
@@ -586,7 +567,6 @@ void ath5k_hw_init_beacon(struct ath5k_hw *ah, u32 next_beacon, u32 interval)
 {
         u32 timer1, timer2, timer3;
 
-        ATH5K_TRACE(ah->ah_sc);
         /*
          * Set the additional timers by mode
          */
@@ -674,7 +654,6 @@ int ath5k_hw_reset_key(struct ath5k_hw *ah, u16 entry)
         unsigned int i, type;
         u16 micentry = entry + AR5K_KEYTABLE_MIC_OFFSET;
 
-        ATH5K_TRACE(ah->ah_sc);
         AR5K_ASSERT_ENTRY(entry, AR5K_KEYTABLE_SIZE);
 
         type = ath5k_hw_reg_read(ah, AR5K_KEYTABLE_TYPE(entry));
@@ -749,8 +728,6 @@ int ath5k_hw_set_key(struct ath5k_hw *ah, u16 entry,
         bool is_tkip;
         const u8 *key_ptr;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         is_tkip = (key->alg == ALG_TKIP);
 
         /*
@@ -836,7 +813,6 @@ int ath5k_hw_set_key_lladdr(struct ath5k_hw *ah, u16 entry, const u8 *mac)
 {
         u32 low_id, high_id;
 
-        ATH5K_TRACE(ah->ah_sc);
          /* Invalid entry (key table overflow) */
         AR5K_ASSERT_ENTRY(entry, AR5K_KEYTABLE_SIZE);
 
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 492cbb15720d..73c4fcd142bb 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -378,8 +378,6 @@ enum ath5k_rfgain ath5k_hw_gainf_calibrate(struct ath5k_hw *ah)
         u32 data, type;
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         if (ah->ah_rf_banks == NULL ||
         ah->ah_gain.g_state == AR5K_RFGAIN_INACTIVE)
                 return AR5K_RFGAIN_INACTIVE;
@@ -1167,7 +1165,7 @@ static s16 ath5k_hw_get_median_noise_floor(struct ath5k_hw *ah)
  * The median of the values in the history is then loaded into the
  * hardware for its own use for RSSI and CCA measurements.
  */
-static void ath5k_hw_update_noise_floor(struct ath5k_hw *ah)
+void ath5k_hw_update_noise_floor(struct ath5k_hw *ah)
 {
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
         u32 val;
@@ -1248,7 +1246,6 @@ static void ath5k_hw_update_noise_floor(struct ath5k_hw *ah)
 /*
  * Perform a PHY calibration on RF5110
  * -Fix BPSK/QAM Constellation (I/Q correction)
- * -Calculate Noise Floor
  */
 static int ath5k_hw_rf5110_calibrate(struct ath5k_hw *ah,
                 struct ieee80211_channel *channel)
@@ -1335,8 +1332,6 @@ static int ath5k_hw_rf5110_calibrate(struct ath5k_hw *ah,
                 return ret;
         }
 
-        ath5k_hw_update_noise_floor(ah);
-
         /*
          * Re-enable RX/TX and beacons
          */
@@ -1348,22 +1343,20 @@ static int ath5k_hw_rf5110_calibrate(struct ath5k_hw *ah,
 }
 
 /*
- * Perform a PHY calibration on RF5111/5112 and newer chips
+ * Perform I/Q calibration on RF5111/5112 and newer chips
  */
-static int ath5k_hw_rf511x_calibrate(struct ath5k_hw *ah,
-                struct ieee80211_channel *channel)
+static int
+ath5k_hw_rf511x_iq_calibrate(struct ath5k_hw *ah)
 {
         u32 i_pwr, q_pwr;
         s32 iq_corr, i_coff, i_coffd, q_coff, q_coffd;
         int i;
-        ATH5K_TRACE(ah->ah_sc);
 
         if (!ah->ah_calibration ||
                 ath5k_hw_reg_read(ah, AR5K_PHY_IQ) & AR5K_PHY_IQ_RUN)
-                goto done;
+                return 0;
 
         /* Calibration has finished, get the results and re-run */
-
         /* work around empty results which can apparently happen on 5212 */
         for (i = 0; i <= 10; i++) {
                 iq_corr = ath5k_hw_reg_read(ah, AR5K_PHY_IQRES_CAL_CORR);
@@ -1384,7 +1377,7 @@ static int ath5k_hw_rf511x_calibrate(struct ath5k_hw *ah,
 
         /* protect against divide by 0 and loss of sign bits */
         if (i_coffd == 0 || q_coffd < 2)
-                goto done;
+                return -1;
 
         i_coff = (-iq_corr) / i_coffd;
         i_coff = clamp(i_coff, -32, 31); /* signed 6 bit */
@@ -1410,17 +1403,6 @@ static int ath5k_hw_rf511x_calibrate(struct ath5k_hw *ah,
                         AR5K_PHY_IQ_CAL_NUM_LOG_MAX, 15);
         AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_RUN);
 
-done:
-
-        /* TODO: Separate noise floor calibration from I/Q calibration
-         * since noise floor calibration interrupts rx path while I/Q
-         * calibration doesn't. We don't need to run noise floor calibration
-         * as often as I/Q calibration.*/
-        ath5k_hw_update_noise_floor(ah);
-
-        /* Initiate a gain_F calibration */
-        ath5k_hw_request_rfgain_probe(ah);
-
         return 0;
 }
 
@@ -1434,8 +1416,10 @@ int ath5k_hw_phy_calibrate(struct ath5k_hw *ah,
 
         if (ah->ah_radio == AR5K_RF5110)
                 ret = ath5k_hw_rf5110_calibrate(ah, channel);
-        else
-                ret = ath5k_hw_rf511x_calibrate(ah, channel);
+        else {
+                ret = ath5k_hw_rf511x_iq_calibrate(ah);
+                ath5k_hw_request_rfgain_probe(ah);
+        }
 
         return ret;
 }
@@ -1693,7 +1677,6 @@ ath5k_hw_set_spur_mitigation_filter(struct ath5k_hw *ah,
 
 int ath5k_hw_phy_disable(struct ath5k_hw *ah)
 {
-        ATH5K_TRACE(ah->ah_sc);
         /*Just a try M.F.*/
         ath5k_hw_reg_write(ah, AR5K_PHY_ACT_DISABLE, AR5K_PHY_ACT);
 
@@ -1709,8 +1692,6 @@ u16 ath5k_hw_radio_revision(struct ath5k_hw *ah, unsigned int chan)
         u32 srev;
         u16 ret;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         /*
          * Set the radio chip access register
          */
@@ -1755,8 +1736,6 @@ u16 ath5k_hw_radio_revision(struct ath5k_hw *ah, unsigned int chan)
 static void /*TODO:Boundary check*/
 ath5k_hw_set_def_antenna(struct ath5k_hw *ah, u8 ant)
 {
-        ATH5K_TRACE(ah->ah_sc);
-
         if (ah->ah_version != AR5K_AR5210)
                 ath5k_hw_reg_write(ah, ant & 0x7, AR5K_DEFAULT_ANTENNA);
 }
@@ -1789,19 +1768,50 @@ ath5k_hw_set_fast_div(struct ath5k_hw *ah, u8 ee_mode, bool enable)
 
         if (enable) {
                 AR5K_REG_WRITE_BITS(ah, AR5K_PHY_RESTART,
-                                AR5K_PHY_RESTART_DIV_GC, 0xc);
+                                AR5K_PHY_RESTART_DIV_GC, 1);
 
                 AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_FAST_ANT_DIV,
                                         AR5K_PHY_FAST_ANT_DIV_EN);
         } else {
                 AR5K_REG_WRITE_BITS(ah, AR5K_PHY_RESTART,
-                                AR5K_PHY_RESTART_DIV_GC, 0x8);
+                                AR5K_PHY_RESTART_DIV_GC, 0);
 
                 AR5K_REG_DISABLE_BITS(ah, AR5K_PHY_FAST_ANT_DIV,
                                         AR5K_PHY_FAST_ANT_DIV_EN);
         }
 }
 
+void
+ath5k_hw_set_antenna_switch(struct ath5k_hw *ah, u8 ee_mode)
+{
+        u8 ant0, ant1;
+
+        /*
+         * In case a fixed antenna was set as default
+         * use the same switch table twice.
+         */
+        if (ah->ah_ant_mode == AR5K_ANTMODE_FIXED_A)
+                ant0 = ant1 = AR5K_ANT_SWTABLE_A;
+        else if (ah->ah_ant_mode == AR5K_ANTMODE_FIXED_B)
+                ant0 = ant1 = AR5K_ANT_SWTABLE_B;
+        else {
+                ant0 = AR5K_ANT_SWTABLE_A;
+                ant1 = AR5K_ANT_SWTABLE_B;
+        }
+
+        /* Set antenna idle switch table */
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_ANT_CTL,
+                        AR5K_PHY_ANT_CTL_SWTABLE_IDLE,
+                        (ah->ah_ant_ctl[ee_mode][AR5K_ANT_CTL] |
+                        AR5K_PHY_ANT_CTL_TXRX_EN));
+
+        /* Set antenna switch tables */
+        ath5k_hw_reg_write(ah, ah->ah_ant_ctl[ee_mode][ant0],
+                AR5K_PHY_ANT_SWITCH_TABLE_0);
+        ath5k_hw_reg_write(ah, ah->ah_ant_ctl[ee_mode][ant1],
+                AR5K_PHY_ANT_SWITCH_TABLE_1);
+}
+
 /*
  * Set antenna operating mode
  */
@@ -1823,8 +1833,6 @@ ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
 
         def_ant = ah->ah_def_ant;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         switch (channel->hw_value & CHANNEL_MODES) {
         case CHANNEL_A:
         case CHANNEL_T:
@@ -1923,6 +1931,7 @@ ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
         if (sta_id1)
                 AR5K_REG_ENABLE_BITS(ah, AR5K_STA_ID1, sta_id1);
 
+        ath5k_hw_set_antenna_switch(ah, ee_mode);
         /* Note: set diversity before default antenna
          * because it won't work correctly */
         ath5k_hw_set_fast_div(ah, ee_mode, fast_div);
@@ -2988,7 +2997,6 @@ ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
         u8 type;
         int ret;
 
-        ATH5K_TRACE(ah->ah_sc);
         if (txpower > AR5K_TUNE_MAX_TXPOWER) {
                 ATH5K_ERR(ah->ah_sc, "invalid tx power: %u\n", txpower);
                 return -EINVAL;
@@ -3084,8 +3092,6 @@ int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, u8 txpower)
         struct ieee80211_channel *channel = ah->ah_current_channel;
         u8 ee_mode;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         switch (channel->hw_value & CHANNEL_MODES) {
         case CHANNEL_A:
         case CHANNEL_T:
diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
index f5831da33f7b..4186ff4c6e9c 100644
--- a/drivers/net/wireless/ath/ath5k/qcu.c
+++ b/drivers/net/wireless/ath/ath5k/qcu.c
@@ -31,7 +31,6 @@ Queue Control Unit, DFS Control Unit Functions
 int ath5k_hw_get_tx_queueprops(struct ath5k_hw *ah, int queue,
                 struct ath5k_txq_info *queue_info)
 {
-        ATH5K_TRACE(ah->ah_sc);
         memcpy(queue_info, &ah->ah_txq[queue], sizeof(struct ath5k_txq_info));
         return 0;
 }
@@ -42,7 +41,6 @@ int ath5k_hw_get_tx_queueprops(struct ath5k_hw *ah, int queue,
 int ath5k_hw_set_tx_queueprops(struct ath5k_hw *ah, int queue,
                                 const struct ath5k_txq_info *queue_info)
 {
-        ATH5K_TRACE(ah->ah_sc);
         AR5K_ASSERT_ENTRY(queue, ah->ah_capabilities.cap_queues.q_tx_num);
 
         if (ah->ah_txq[queue].tqi_type == AR5K_TX_QUEUE_INACTIVE)
@@ -69,8 +67,6 @@ int ath5k_hw_setup_tx_queue(struct ath5k_hw *ah, enum ath5k_tx_queue queue_type,
         unsigned int queue;
         int ret;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         /*
          * Get queue by type
          */
@@ -149,7 +145,6 @@ int ath5k_hw_setup_tx_queue(struct ath5k_hw *ah, enum ath5k_tx_queue queue_type,
 u32 ath5k_hw_num_tx_pending(struct ath5k_hw *ah, unsigned int queue)
 {
         u32 pending;
-        ATH5K_TRACE(ah->ah_sc);
         AR5K_ASSERT_ENTRY(queue, ah->ah_capabilities.cap_queues.q_tx_num);
 
         /* Return if queue is declared inactive */
@@ -177,7 +172,6 @@ u32 ath5k_hw_num_tx_pending(struct ath5k_hw *ah, unsigned int queue)
  */
 void ath5k_hw_release_tx_queue(struct ath5k_hw *ah, unsigned int queue)
 {
-        ATH5K_TRACE(ah->ah_sc);
         if (WARN_ON(queue >= ah->ah_capabilities.cap_queues.q_tx_num))
                 return;
 
@@ -195,7 +189,6 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
         u32 cw_min, cw_max, retry_lg, retry_sh;
         struct ath5k_txq_info *tq = &ah->ah_txq[queue];
 
-        ATH5K_TRACE(ah->ah_sc);
         AR5K_ASSERT_ENTRY(queue, ah->ah_capabilities.cap_queues.q_tx_num);
 
         tq = &ah->ah_txq[queue];
@@ -523,8 +516,6 @@ int ath5k_hw_set_slot_time(struct ath5k_hw *ah, unsigned int slot_time)
 {
         u32 slot_time_clock = ath5k_hw_htoclock(ah, slot_time);
 
-        ATH5K_TRACE(ah->ah_sc);
-
         if (slot_time < 6 || slot_time_clock > AR5K_SLOT_TIME_MAX)
                 return -EINVAL;
 
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index 307f80e83f94..498aa28ea9e6 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -201,8 +201,6 @@ static int ath5k_hw_nic_reset(struct ath5k_hw *ah, u32 val)
         int ret;
         u32 mask = val ? val : ~0U;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         /* Read-and-clear RX Descriptor Pointer*/
         ath5k_hw_reg_read(ah, AR5K_RXDP);
 
@@ -246,7 +244,6 @@ static int ath5k_hw_set_power(struct ath5k_hw *ah, enum ath5k_power_mode mode,
         unsigned int i;
         u32 staid, data;
 
-        ATH5K_TRACE(ah->ah_sc);
         staid = ath5k_hw_reg_read(ah, AR5K_STA_ID1);
 
         switch (mode) {
@@ -393,8 +390,6 @@ int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial)
         mode = 0;
         clock = 0;
 
-        ATH5K_TRACE(ah->ah_sc);
-
         /* Wakeup the device */
         ret = ath5k_hw_set_power(ah, AR5K_PM_AWAKE, true, 0);
         if (ret) {
@@ -734,7 +729,7 @@ static void ath5k_hw_tweak_initval_settings(struct ath5k_hw *ah,
 }
 
 static void ath5k_hw_commit_eeprom_settings(struct ath5k_hw *ah,
-                struct ieee80211_channel *channel, u8 *ant, u8 ee_mode)
+                struct ieee80211_channel *channel, u8 ee_mode)
 {
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
         s16 cck_ofdm_pwr_delta;
@@ -768,17 +763,9 @@ static void ath5k_hw_commit_eeprom_settings(struct ath5k_hw *ah,
                                                 ee->ee_cck_ofdm_gain_delta;
         }
 
-        /* Set antenna idle switch table */
-        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_ANT_CTL,
-                        AR5K_PHY_ANT_CTL_SWTABLE_IDLE,
-                        (ah->ah_ant_ctl[ee_mode][0] |
-                        AR5K_PHY_ANT_CTL_TXRX_EN));
-
-        /* Set antenna switch tables */
-        ath5k_hw_reg_write(ah, ah->ah_ant_ctl[ee_mode][ant[0]],
-                AR5K_PHY_ANT_SWITCH_TABLE_0);
-        ath5k_hw_reg_write(ah, ah->ah_ant_ctl[ee_mode][ant[1]],
-                AR5K_PHY_ANT_SWITCH_TABLE_1);
+        /* XXX: necessary here? is called from ath5k_hw_set_antenna_mode()
+         * too */
+        ath5k_hw_set_antenna_switch(ah, ee_mode);
 
         /* Noise floor threshold */
         ath5k_hw_reg_write(ah,
@@ -855,7 +842,6 @@ static void ath5k_hw_commit_eeprom_settings(struct ath5k_hw *ah,
                         AR5K_PHY_NF_THRESH62,
                         ee->ee_thr_62[ee_mode]);
 
-
         /* False detect backoff for channels
          * that have spur noise. Write the new
          * cyclic power RSSI threshold. */
@@ -891,14 +877,11 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
         struct ieee80211_channel *channel, bool change_channel)
 {
         struct ath_common *common = ath5k_hw_common(ah);
-        u32 s_seq[10], s_ant, s_led[3], staid1_flags, tsf_up, tsf_lo;
+        u32 s_seq[10], s_led[3], staid1_flags, tsf_up, tsf_lo;
         u32 phy_tst1;
-        u8 mode, freq, ee_mode, ant[2];
+        u8 mode, freq, ee_mode;
         int i, ret;
 
-        ATH5K_TRACE(ah->ah_sc);
-
-        s_ant = 0;
         ee_mode = 0;
         staid1_flags = 0;
         tsf_up = 0;
@@ -995,9 +978,6 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                         }
                 }
 
-                /* Save default antenna */
-                s_ant = ath5k_hw_reg_read(ah, AR5K_DEFAULT_ANTENNA);
-
                 if (ah->ah_version == AR5K_AR5212) {
                         /* Restore normal 32/40MHz clock operation
                          * to avoid register access delay on certain
@@ -1094,22 +1074,17 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                 /* Write OFDM timings on 5212*/
                 if (ah->ah_version == AR5K_AR5212 &&
                         channel->hw_value & CHANNEL_OFDM) {
-                        struct ath5k_eeprom_info *ee =
-                                        &ah->ah_capabilities.cap_eeprom;
 
                         ret = ath5k_hw_write_ofdm_timings(ah, channel);
                         if (ret)
                                 return ret;
 
-                        /* Note: According to docs we can have a newer
-                         * EEPROM on old hardware, so we need to verify
-                         * that our hardware is new enough to have spur
-                         * mitigation registers (delta phase etc) */
-                        if (ah->ah_mac_srev >= AR5K_SREV_AR5424 ||
-                        (ah->ah_mac_srev >= AR5K_SREV_AR5424 &&
-                        ee->ee_version >= AR5K_EEPROM_VERSION_5_3))
+                        /* Spur info is available only from EEPROM versions
+                         * bigger than 5.3 but but the EEPOM routines will use
+                         * static values for older versions */
+                        if (ah->ah_mac_srev >= AR5K_SREV_AR5424)
                                 ath5k_hw_set_spur_mitigation_filter(ah,
-                                                                channel);
+                                                                    channel);
                 }
 
                 /*Enable/disable 802.11b mode on 5111
@@ -1123,21 +1098,8 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                                     AR5K_TXCFG_B_MODE);
                 }
 
-                /*
-                 * In case a fixed antenna was set as default
-                 * use the same switch table twice.
-                 */
-                if (ah->ah_ant_mode == AR5K_ANTMODE_FIXED_A)
-                                ant[0] = ant[1] = AR5K_ANT_SWTABLE_A;
-                else if (ah->ah_ant_mode == AR5K_ANTMODE_FIXED_B)
-                                ant[0] = ant[1] = AR5K_ANT_SWTABLE_B;
-                else {
-                        ant[0] = AR5K_ANT_SWTABLE_A;
-                        ant[1] = AR5K_ANT_SWTABLE_B;
-                }
-
                 /* Commit values from EEPROM */
-                ath5k_hw_commit_eeprom_settings(ah, channel, ant, ee_mode);
+                ath5k_hw_commit_eeprom_settings(ah, channel, ee_mode);
 
         } else {
                 /*
@@ -1175,8 +1137,6 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                                 ath5k_hw_reg_write(ah, tsf_lo, AR5K_TSF_L32);
                         }
                 }
-
-                ath5k_hw_reg_write(ah, s_ant, AR5K_DEFAULT_ANTENNA);
         }
 
         /* Ledstate */
diff --git a/drivers/net/wireless/ath/ath5k/sysfs.c b/drivers/net/wireless/ath/ath5k/sysfs.c
new file mode 100644
index 000000000000..90757de7bf59
--- /dev/null
+++ b/drivers/net/wireless/ath/ath5k/sysfs.c
@@ -0,0 +1,116 @@
+#include <linux/device.h>
+#include <linux/pci.h>
+
+#include "base.h"
+#include "ath5k.h"
+#include "reg.h"
+
+#define SIMPLE_SHOW_STORE(name, get, set)                               \
+static ssize_t ath5k_attr_show_##name(struct device *dev,               \
+                        struct device_attribute *attr,                  \
+                        char *buf)                                      \
+{                                                                       \
+        struct ath5k_softc *sc = dev_get_drvdata(dev);                  \
+        return snprintf(buf, PAGE_SIZE, "%d\n", get);                   \
+}                                                                       \
+                                                                        \
+static ssize_t ath5k_attr_store_##name(struct device *dev,              \
+                        struct device_attribute *attr,                  \
+                        const char *buf, size_t count)                  \
+{                                                                       \
+        struct ath5k_softc *sc = dev_get_drvdata(dev);                  \
+        int val;                                                        \
+                                                                        \
+        val = (int)simple_strtoul(buf, NULL, 10);                       \
+        set(sc->ah, val);                                               \
+        return count;                                                   \
+}                                                                       \
+static DEVICE_ATTR(name, S_IRUGO | S_IWUSR,                             \
+                   ath5k_attr_show_##name, ath5k_attr_store_##name)
+
+#define SIMPLE_SHOW(name, get)                                          \
+static ssize_t ath5k_attr_show_##name(struct device *dev,               \
+                        struct device_attribute *attr,                  \
+                        char *buf)                                      \
+{                                                                       \
+        struct ath5k_softc *sc = dev_get_drvdata(dev);                  \
+        return snprintf(buf, PAGE_SIZE, "%d\n", get);                   \
+}                                                                       \
+static DEVICE_ATTR(name, S_IRUGO, ath5k_attr_show_##name, NULL)
+
+/*** ANI ***/
+
+SIMPLE_SHOW_STORE(ani_mode, sc->ani_state.ani_mode, ath5k_ani_init);
+SIMPLE_SHOW_STORE(noise_immunity_level, sc->ani_state.noise_imm_level,
+                        ath5k_ani_set_noise_immunity_level);
+SIMPLE_SHOW_STORE(spur_level, sc->ani_state.spur_level,
+                        ath5k_ani_set_spur_immunity_level);
+SIMPLE_SHOW_STORE(firstep_level, sc->ani_state.firstep_level,
+                        ath5k_ani_set_firstep_level);
+SIMPLE_SHOW_STORE(ofdm_weak_signal_detection, sc->ani_state.ofdm_weak_sig,
+                        ath5k_ani_set_ofdm_weak_signal_detection);
+SIMPLE_SHOW_STORE(cck_weak_signal_detection, sc->ani_state.cck_weak_sig,
+                        ath5k_ani_set_cck_weak_signal_detection);
+SIMPLE_SHOW(spur_level_max, sc->ani_state.max_spur_level);
+
+static ssize_t ath5k_attr_show_noise_immunity_level_max(struct device *dev,
+                        struct device_attribute *attr,
+                        char *buf)
+{
+        return snprintf(buf, PAGE_SIZE, "%d\n", ATH5K_ANI_MAX_NOISE_IMM_LVL);
+}
+static DEVICE_ATTR(noise_immunity_level_max, S_IRUGO,
+                   ath5k_attr_show_noise_immunity_level_max, NULL);
+
+static ssize_t ath5k_attr_show_firstep_level_max(struct device *dev,
+                        struct device_attribute *attr,
+                        char *buf)
+{
+        return snprintf(buf, PAGE_SIZE, "%d\n", ATH5K_ANI_MAX_FIRSTEP_LVL);
+}
+static DEVICE_ATTR(firstep_level_max, S_IRUGO,
+                   ath5k_attr_show_firstep_level_max, NULL);
+
+static struct attribute *ath5k_sysfs_entries_ani[] = {
+        &dev_attr_ani_mode.attr,
+        &dev_attr_noise_immunity_level.attr,
+        &dev_attr_spur_level.attr,
+        &dev_attr_firstep_level.attr,
+        &dev_attr_ofdm_weak_signal_detection.attr,
+        &dev_attr_cck_weak_signal_detection.attr,
+        &dev_attr_noise_immunity_level_max.attr,
+        &dev_attr_spur_level_max.attr,
+        &dev_attr_firstep_level_max.attr,
+        NULL
+};
+
+static struct attribute_group ath5k_attribute_group_ani = {
+        .name = "ani",
+        .attrs = ath5k_sysfs_entries_ani,
+};
+
+
+/*** register / unregister ***/
+
+int
+ath5k_sysfs_register(struct ath5k_softc *sc)
+{
+        struct device *dev = &sc->pdev->dev;
+        int err;
+
+        err = sysfs_create_group(&dev->kobj, &ath5k_attribute_group_ani);
+        if (err) {
+                ATH5K_ERR(sc, "failed to create sysfs group\n");
+                return err;
+        }
+
+        return 0;
+}
+
+void
+ath5k_sysfs_unregister(struct ath5k_softc *sc)
+{
+        struct device *dev = &sc->pdev->dev;
+
+        sysfs_remove_group(&dev->kobj, &ath5k_attribute_group_ani);
+}
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index dd112be218ab..973ae4f49f35 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -32,7 +32,8 @@ ath9k_hw-y:=	\
                 mac.o \
                 ar9002_mac.o \
                 ar9003_mac.o \
-                ar9003_eeprom.o
+                ar9003_eeprom.o \
+                ar9003_paprd.o
 
 obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o
 
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index ba8b20f01594..cc648b6ae31c 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008-2009 Atheros Communications Inc.
+ * Copyright (c) 2008-2010 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -17,8 +17,99 @@
 #include "hw.h"
 #include "hw-ops.h"
 
-static int ath9k_hw_get_ani_channel_idx(struct ath_hw *ah,
-                                        struct ath9k_channel *chan)
+struct ani_ofdm_level_entry {
+        int spur_immunity_level;
+        int fir_step_level;
+        int ofdm_weak_signal_on;
+};
+
+/* values here are relative to the INI */
+
+/*
+ * Legend:
+ *
+ * SI: Spur immunity
+ * FS: FIR Step
+ * WS: OFDM / CCK Weak Signal detection
+ * MRC-CCK: Maximal Ratio Combining for CCK
+ */
+
+static const struct ani_ofdm_level_entry ofdm_level_table[] = {
+        /* SI  FS  WS */
+        {  0,  0,  1  }, /* lvl 0 */
+        {  1,  1,  1  }, /* lvl 1 */
+        {  2,  2,  1  }, /* lvl 2 */
+        {  3,  2,  1  }, /* lvl 3  (default) */
+        {  4,  3,  1  }, /* lvl 4 */
+        {  5,  4,  1  }, /* lvl 5 */
+        {  6,  5,  1  }, /* lvl 6 */
+        {  7,  6,  1  }, /* lvl 7 */
+        {  7,  7,  1  }, /* lvl 8 */
+        {  7,  8,  0  }  /* lvl 9 */
+};
+#define ATH9K_ANI_OFDM_NUM_LEVEL \
+        (sizeof(ofdm_level_table)/sizeof(ofdm_level_table[0]))
+#define ATH9K_ANI_OFDM_MAX_LEVEL \
+        (ATH9K_ANI_OFDM_NUM_LEVEL-1)
+#define ATH9K_ANI_OFDM_DEF_LEVEL \
+        3 /* default level - matches the INI settings */
+
+/*
+ * MRC (Maximal Ratio Combining) has always been used with multi-antenna ofdm.
+ * With OFDM for single stream you just add up all antenna inputs, you're
+ * only interested in what you get after FFT. Signal aligment is also not
+ * required for OFDM because any phase difference adds up in the frequency
+ * domain.
+ *
+ * MRC requires extra work for use with CCK. You need to align the antenna
+ * signals from the different antenna before you can add the signals together.
+ * You need aligment of signals as CCK is in time domain, so addition can cancel
+ * your signal completely if phase is 180 degrees (think of adding sine waves).
+ * You also need to remove noise before the addition and this is where ANI
+ * MRC CCK comes into play. One of the antenna inputs may be stronger but
+ * lower SNR, so just adding after alignment can be dangerous.
+ *
+ * Regardless of alignment in time, the antenna signals add constructively after
+ * FFT and improve your reception. For more information:
+ *
+ * http://en.wikipedia.org/wiki/Maximal-ratio_combining
+ */
+
+struct ani_cck_level_entry {
+        int fir_step_level;
+        int mrc_cck_on;
+};
+
+static const struct ani_cck_level_entry cck_level_table[] = {
+        /* FS  MRC-CCK  */
+        {  0,  1  }, /* lvl 0 */
+        {  1,  1  }, /* lvl 1 */
+        {  2,  1  }, /* lvl 2  (default) */
+        {  3,  1  }, /* lvl 3 */
+        {  4,  0  }, /* lvl 4 */
+        {  5,  0  }, /* lvl 5 */
+        {  6,  0  }, /* lvl 6 */
+        {  7,  0  }, /* lvl 7 (only for high rssi) */
+        {  8,  0  }  /* lvl 8 (only for high rssi) */
+};
+
+#define ATH9K_ANI_CCK_NUM_LEVEL \
+        (sizeof(cck_level_table)/sizeof(cck_level_table[0]))
+#define ATH9K_ANI_CCK_MAX_LEVEL \
+        (ATH9K_ANI_CCK_NUM_LEVEL-1)
+#define ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI \
+        (ATH9K_ANI_CCK_NUM_LEVEL-3)
+#define ATH9K_ANI_CCK_DEF_LEVEL \
+        2 /* default level - matches the INI settings */
+
+/* Private to ani.c */
+static void ath9k_hw_ani_lower_immunity(struct ath_hw *ah)
+{
+        ath9k_hw_private_ops(ah)->ani_lower_immunity(ah);
+}
+
+int ath9k_hw_get_ani_channel_idx(struct ath_hw *ah,
+                                 struct ath9k_channel *chan)
 {
         int i;
 
@@ -48,7 +139,7 @@ static void ath9k_hw_update_mibstats(struct ath_hw *ah,
         stats->beacons += REG_READ(ah, AR_BEACON_CNT);
 }
 
-static void ath9k_ani_restart(struct ath_hw *ah)
+static void ath9k_ani_restart_old(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -96,7 +187,42 @@ static void ath9k_ani_restart(struct ath_hw *ah)
         aniState->cckPhyErrCount = 0;
 }
 
-static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)
+static void ath9k_ani_restart_new(struct ath_hw *ah)
+{
+        struct ar5416AniState *aniState;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (!DO_ANI(ah))
+                return;
+
+        aniState = ah->curani;
+        aniState->listenTime = 0;
+
+        aniState->ofdmPhyErrBase = 0;
+        aniState->cckPhyErrBase = 0;
+
+        ath_print(common, ATH_DBG_ANI,
+                  "Writing ofdmbase=%08x   cckbase=%08x\n",
+                  aniState->ofdmPhyErrBase,
+                  aniState->cckPhyErrBase);
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        REG_WRITE(ah, AR_PHY_ERR_1, aniState->ofdmPhyErrBase);
+        REG_WRITE(ah, AR_PHY_ERR_2, aniState->cckPhyErrBase);
+        REG_WRITE(ah, AR_PHY_ERR_MASK_1, AR_PHY_ERR_OFDM_TIMING);
+        REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
+        ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
+
+        aniState->ofdmPhyErrCount = 0;
+        aniState->cckPhyErrCount = 0;
+}
+
+static void ath9k_hw_ani_ofdm_err_trigger_old(struct ath_hw *ah)
 {
         struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
         struct ar5416AniState *aniState;
@@ -168,7 +294,7 @@ static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)
         }
 }
 
-static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)
+static void ath9k_hw_ani_cck_err_trigger_old(struct ath_hw *ah)
 {
         struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
         struct ar5416AniState *aniState;
@@ -206,7 +332,125 @@ static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)
         }
 }
 
-static void ath9k_hw_ani_lower_immunity(struct ath_hw *ah)
+/* Adjust the OFDM Noise Immunity Level */
+static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel)
+{
+        struct ar5416AniState *aniState = ah->curani;
+        struct ath_common *common = ath9k_hw_common(ah);
+        const struct ani_ofdm_level_entry *entry_ofdm;
+        const struct ani_cck_level_entry *entry_cck;
+
+        aniState->noiseFloor = BEACON_RSSI(ah);
+
+        ath_print(common, ATH_DBG_ANI,
+                  "**** ofdmlevel %d=>%d, rssi=%d[lo=%d hi=%d]\n",
+                  aniState->ofdmNoiseImmunityLevel,
+                  immunityLevel, aniState->noiseFloor,
+                  aniState->rssiThrLow, aniState->rssiThrHigh);
+
+        aniState->ofdmNoiseImmunityLevel = immunityLevel;
+
+        entry_ofdm = &ofdm_level_table[aniState->ofdmNoiseImmunityLevel];
+        entry_cck = &cck_level_table[aniState->cckNoiseImmunityLevel];
+
+        if (aniState->spurImmunityLevel != entry_ofdm->spur_immunity_level)
+                ath9k_hw_ani_control(ah,
+                                     ATH9K_ANI_SPUR_IMMUNITY_LEVEL,
+                                     entry_ofdm->spur_immunity_level);
+
+        if (aniState->firstepLevel != entry_ofdm->fir_step_level &&
+            entry_ofdm->fir_step_level >= entry_cck->fir_step_level)
+                ath9k_hw_ani_control(ah,
+                                     ATH9K_ANI_FIRSTEP_LEVEL,
+                                     entry_ofdm->fir_step_level);
+
+        if ((ah->opmode != NL80211_IFTYPE_STATION &&
+             ah->opmode != NL80211_IFTYPE_ADHOC) ||
+            aniState->noiseFloor <= aniState->rssiThrHigh) {
+                if (aniState->ofdmWeakSigDetectOff)
+                        /* force on ofdm weak sig detect */
+                        ath9k_hw_ani_control(ah,
+                                ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION,
+                                             true);
+                else if (aniState->ofdmWeakSigDetectOff ==
+                         entry_ofdm->ofdm_weak_signal_on)
+                        ath9k_hw_ani_control(ah,
+                                ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION,
+                                entry_ofdm->ofdm_weak_signal_on);
+        }
+}
+
+static void ath9k_hw_ani_ofdm_err_trigger_new(struct ath_hw *ah)
+{
+        struct ar5416AniState *aniState;
+
+        if (!DO_ANI(ah))
+                return;
+
+        aniState = ah->curani;
+
+        if (aniState->ofdmNoiseImmunityLevel < ATH9K_ANI_OFDM_MAX_LEVEL)
+                ath9k_hw_set_ofdm_nil(ah, aniState->ofdmNoiseImmunityLevel + 1);
+}
+
+/*
+ * Set the ANI settings to match an CCK level.
+ */
+static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel)
+{
+        struct ar5416AniState *aniState = ah->curani;
+        struct ath_common *common = ath9k_hw_common(ah);
+        const struct ani_ofdm_level_entry *entry_ofdm;
+        const struct ani_cck_level_entry *entry_cck;
+
+        aniState->noiseFloor = BEACON_RSSI(ah);
+        ath_print(common, ATH_DBG_ANI,
+                  "**** ccklevel %d=>%d, rssi=%d[lo=%d hi=%d]\n",
+                  aniState->cckNoiseImmunityLevel, immunityLevel,
+                  aniState->noiseFloor, aniState->rssiThrLow,
+                  aniState->rssiThrHigh);
+
+        if ((ah->opmode == NL80211_IFTYPE_STATION ||
+             ah->opmode == NL80211_IFTYPE_ADHOC) &&
+            aniState->noiseFloor <= aniState->rssiThrLow &&
+            immunityLevel > ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI)
+                immunityLevel = ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI;
+
+        aniState->cckNoiseImmunityLevel = immunityLevel;
+
+        entry_ofdm = &ofdm_level_table[aniState->ofdmNoiseImmunityLevel];
+        entry_cck = &cck_level_table[aniState->cckNoiseImmunityLevel];
+
+        if (aniState->firstepLevel != entry_cck->fir_step_level &&
+            entry_cck->fir_step_level >= entry_ofdm->fir_step_level)
+                ath9k_hw_ani_control(ah,
+                                     ATH9K_ANI_FIRSTEP_LEVEL,
+                                     entry_cck->fir_step_level);
+
+        /* Skip MRC CCK for pre AR9003 families */
+        if (!AR_SREV_9300_20_OR_LATER(ah))
+                return;
+
+        if (aniState->mrcCCKOff == entry_cck->mrc_cck_on)
+                ath9k_hw_ani_control(ah,
+                                     ATH9K_ANI_MRC_CCK,
+                                     entry_cck->mrc_cck_on);
+}
+
+static void ath9k_hw_ani_cck_err_trigger_new(struct ath_hw *ah)
+{
+        struct ar5416AniState *aniState;
+
+        if (!DO_ANI(ah))
+                return;
+
+        aniState = ah->curani;
+
+        if (aniState->cckNoiseImmunityLevel < ATH9K_ANI_CCK_MAX_LEVEL)
+                ath9k_hw_set_cck_nil(ah, aniState->cckNoiseImmunityLevel + 1);
+}
+
+static void ath9k_hw_ani_lower_immunity_old(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
         int32_t rssi;
@@ -259,9 +503,53 @@ static void ath9k_hw_ani_lower_immunity(struct ath_hw *ah)
         }
 }
 
+/*
+ * only lower either OFDM or CCK errors per turn
+ * we lower the other one next time
+ */
+static void ath9k_hw_ani_lower_immunity_new(struct ath_hw *ah)
+{
+        struct ar5416AniState *aniState;
+
+        aniState = ah->curani;
+
+        /* lower OFDM noise immunity */
+        if (aniState->ofdmNoiseImmunityLevel > 0 &&
+            (aniState->ofdmsTurn || aniState->cckNoiseImmunityLevel == 0)) {
+                ath9k_hw_set_ofdm_nil(ah, aniState->ofdmNoiseImmunityLevel - 1);
+                return;
+        }
+
+        /* lower CCK noise immunity */
+        if (aniState->cckNoiseImmunityLevel > 0)
+                ath9k_hw_set_cck_nil(ah, aniState->cckNoiseImmunityLevel - 1);
+}
+
+static u8 ath9k_hw_chan_2_clockrate_mhz(struct ath_hw *ah)
+{
+        struct ath9k_channel *chan = ah->curchan;
+        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
+        u8 clockrate; /* in MHz */
+
+        if (!ah->curchan) /* should really check for CCK instead */
+                clockrate = ATH9K_CLOCK_RATE_CCK;
+        else if (conf->channel->band == IEEE80211_BAND_2GHZ)
+                clockrate = ATH9K_CLOCK_RATE_2GHZ_OFDM;
+        else if (IS_CHAN_A_FAST_CLOCK(ah, chan))
+                clockrate = ATH9K_CLOCK_FAST_RATE_5GHZ_OFDM;
+        else
+                clockrate = ATH9K_CLOCK_RATE_5GHZ_OFDM;
+
+        if (conf_is_ht40(conf))
+                return clockrate * 2;
+
+        return clockrate * 2;
+}
+
 static int32_t ath9k_hw_ani_get_listen_time(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
+        struct ath_common *common = ath9k_hw_common(ah);
         u32 txFrameCount, rxFrameCount, cycleCount;
         int32_t listenTime;
 
@@ -271,15 +559,31 @@ static int32_t ath9k_hw_ani_get_listen_time(struct ath_hw *ah)
 
         aniState = ah->curani;
         if (aniState->cycleCount == 0 || aniState->cycleCount > cycleCount) {
-
                 listenTime = 0;
                 ah->stats.ast_ani_lzero++;
+                ath_print(common, ATH_DBG_ANI,
+                          "1st call: aniState->cycleCount=%d\n",
+                          aniState->cycleCount);
         } else {
                 int32_t ccdelta = cycleCount - aniState->cycleCount;
                 int32_t rfdelta = rxFrameCount - aniState->rxFrameCount;
                 int32_t tfdelta = txFrameCount - aniState->txFrameCount;
-                listenTime = (ccdelta - rfdelta - tfdelta) / 44000;
+                int32_t clock_rate;
+
+                /*
+                 * convert HW counter values to ms using mode
+                 * specifix clock rate
+                 */
+                clock_rate = ath9k_hw_chan_2_clockrate_mhz(ah) * 1000;;
+
+                listenTime = (ccdelta - rfdelta - tfdelta) / clock_rate;
+
+                ath_print(common, ATH_DBG_ANI,
+                          "cyclecount=%d, rfcount=%d, "
+                          "tfcount=%d, listenTime=%d CLOCK_RATE=%d\n",
+                          ccdelta, rfdelta, tfdelta, listenTime, clock_rate);
         }
+
         aniState->cycleCount = cycleCount;
         aniState->txFrameCount = txFrameCount;
         aniState->rxFrameCount = rxFrameCount;
@@ -287,7 +591,7 @@ static int32_t ath9k_hw_ani_get_listen_time(struct ath_hw *ah)
         return listenTime;
 }
 
-void ath9k_ani_reset(struct ath_hw *ah)
+static void ath9k_ani_reset_old(struct ath_hw *ah, bool is_scanning)
 {
         struct ar5416AniState *aniState;
         struct ath9k_channel *chan = ah->curchan;
@@ -340,7 +644,7 @@ void ath9k_ani_reset(struct ath_hw *ah)
                         ah->curani->cckTrigLow =
                                 ah->config.cck_trig_low;
                 }
-                ath9k_ani_restart(ah);
+                ath9k_ani_restart_old(ah);
                 return;
         }
 
@@ -362,7 +666,7 @@ void ath9k_ani_reset(struct ath_hw *ah)
 
         ath9k_hw_setrxfilter(ah, ath9k_hw_getrxfilter(ah) &
                              ~ATH9K_RX_FILTER_PHYERR);
-        ath9k_ani_restart(ah);
+        ath9k_ani_restart_old(ah);
 
         ENABLE_REGWRITE_BUFFER(ah);
 
@@ -373,8 +677,102 @@ void ath9k_ani_reset(struct ath_hw *ah)
         DISABLE_REGWRITE_BUFFER(ah);
 }
 
-void ath9k_hw_ani_monitor(struct ath_hw *ah,
-                          struct ath9k_channel *chan)
+/*
+ * Restore the ANI parameters in the HAL and reset the statistics.
+ * This routine should be called for every hardware reset and for
+ * every channel change.
+ */
+static void ath9k_ani_reset_new(struct ath_hw *ah, bool is_scanning)
+{
+        struct ar5416AniState *aniState = ah->curani;
+        struct ath9k_channel *chan = ah->curchan;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (!DO_ANI(ah))
+                return;
+
+        BUG_ON(aniState == NULL);
+        ah->stats.ast_ani_reset++;
+
+        /* only allow a subset of functions in AP mode */
+        if (ah->opmode == NL80211_IFTYPE_AP) {
+                if (IS_CHAN_2GHZ(chan)) {
+                        ah->ani_function = (ATH9K_ANI_SPUR_IMMUNITY_LEVEL |
+                                            ATH9K_ANI_FIRSTEP_LEVEL);
+                        if (AR_SREV_9300_20_OR_LATER(ah))
+                                ah->ani_function |= ATH9K_ANI_MRC_CCK;
+                } else
+                        ah->ani_function = 0;
+        }
+
+        /* always allow mode (on/off) to be controlled */
+        ah->ani_function |= ATH9K_ANI_MODE;
+
+        if (is_scanning ||
+            (ah->opmode != NL80211_IFTYPE_STATION &&
+             ah->opmode != NL80211_IFTYPE_ADHOC)) {
+                /*
+                 * If we're scanning or in AP mode, the defaults (ini)
+                 * should be in place. For an AP we assume the historical
+                 * levels for this channel are probably outdated so start
+                 * from defaults instead.
+                 */
+                if (aniState->ofdmNoiseImmunityLevel !=
+                    ATH9K_ANI_OFDM_DEF_LEVEL ||
+                    aniState->cckNoiseImmunityLevel !=
+                    ATH9K_ANI_CCK_DEF_LEVEL) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "Restore defaults: opmode %u "
+                                  "chan %d Mhz/0x%x is_scanning=%d "
+                                  "ofdm:%d cck:%d\n",
+                                  ah->opmode,
+                                  chan->channel,
+                                  chan->channelFlags,
+                                  is_scanning,
+                                  aniState->ofdmNoiseImmunityLevel,
+                                  aniState->cckNoiseImmunityLevel);
+
+                        ath9k_hw_set_ofdm_nil(ah, ATH9K_ANI_OFDM_DEF_LEVEL);
+                        ath9k_hw_set_cck_nil(ah, ATH9K_ANI_CCK_DEF_LEVEL);
+                }
+        } else {
+                /*
+                 * restore historical levels for this channel
+                 */
+                ath_print(common, ATH_DBG_ANI,
+                          "Restore history: opmode %u "
+                          "chan %d Mhz/0x%x is_scanning=%d "
+                          "ofdm:%d cck:%d\n",
+                          ah->opmode,
+                          chan->channel,
+                          chan->channelFlags,
+                          is_scanning,
+                          aniState->ofdmNoiseImmunityLevel,
+                          aniState->cckNoiseImmunityLevel);
+
+                        ath9k_hw_set_ofdm_nil(ah,
+                                              aniState->ofdmNoiseImmunityLevel);
+                        ath9k_hw_set_cck_nil(ah,
+                                             aniState->cckNoiseImmunityLevel);
+        }
+
+        /*
+         * enable phy counters if hw supports or if not, enable phy
+         * interrupts (so we can count each one)
+         */
+        ath9k_ani_restart_new(ah);
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        REG_WRITE(ah, AR_PHY_ERR_MASK_1, AR_PHY_ERR_OFDM_TIMING);
+        REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+}
+
+static void ath9k_hw_ani_monitor_old(struct ath_hw *ah,
+                                     struct ath9k_channel *chan)
 {
         struct ar5416AniState *aniState;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -390,7 +788,7 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah,
         listenTime = ath9k_hw_ani_get_listen_time(ah);
         if (listenTime < 0) {
                 ah->stats.ast_ani_lneg++;
-                ath9k_ani_restart(ah);
+                ath9k_ani_restart_old(ah);
                 return;
         }
 
@@ -444,21 +842,166 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah,
                     aniState->cckPhyErrCount <= aniState->listenTime *
                     aniState->cckTrigLow / 1000)
                         ath9k_hw_ani_lower_immunity(ah);
-                ath9k_ani_restart(ah);
+                ath9k_ani_restart_old(ah);
         } else if (aniState->listenTime > ah->aniperiod) {
                 if (aniState->ofdmPhyErrCount > aniState->listenTime *
                     aniState->ofdmTrigHigh / 1000) {
-                        ath9k_hw_ani_ofdm_err_trigger(ah);
-                        ath9k_ani_restart(ah);
+                        ath9k_hw_ani_ofdm_err_trigger_old(ah);
+                        ath9k_ani_restart_old(ah);
                 } else if (aniState->cckPhyErrCount >
                            aniState->listenTime * aniState->cckTrigHigh /
                            1000) {
-                        ath9k_hw_ani_cck_err_trigger(ah);
-                        ath9k_ani_restart(ah);
+                        ath9k_hw_ani_cck_err_trigger_old(ah);
+                        ath9k_ani_restart_old(ah);
+                }
+        }
+}
+
+static void ath9k_hw_ani_monitor_new(struct ath_hw *ah,
+                                     struct ath9k_channel *chan)
+{
+        struct ar5416AniState *aniState;
+        struct ath_common *common = ath9k_hw_common(ah);
+        int32_t listenTime;
+        u32 phyCnt1, phyCnt2;
+        u32 ofdmPhyErrCnt, cckPhyErrCnt;
+        u32 ofdmPhyErrRate, cckPhyErrRate;
+
+        if (!DO_ANI(ah))
+                return;
+
+        aniState = ah->curani;
+        if (WARN_ON(!aniState))
+                return;
+
+        listenTime = ath9k_hw_ani_get_listen_time(ah);
+        if (listenTime <= 0) {
+                ah->stats.ast_ani_lneg++;
+                /* restart ANI period if listenTime is invalid */
+                ath_print(common, ATH_DBG_ANI,
+                          "listenTime=%d - on new ani monitor\n",
+                          listenTime);
+                ath9k_ani_restart_new(ah);
+                return;
+        }
+
+        aniState->listenTime += listenTime;
+
+        ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
+
+        phyCnt1 = REG_READ(ah, AR_PHY_ERR_1);
+        phyCnt2 = REG_READ(ah, AR_PHY_ERR_2);
+
+        if (phyCnt1 < aniState->ofdmPhyErrBase ||
+            phyCnt2 < aniState->cckPhyErrBase) {
+                if (phyCnt1 < aniState->ofdmPhyErrBase) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "phyCnt1 0x%x, resetting "
+                                  "counter value to 0x%x\n",
+                                  phyCnt1,
+                                  aniState->ofdmPhyErrBase);
+                        REG_WRITE(ah, AR_PHY_ERR_1,
+                                  aniState->ofdmPhyErrBase);
+                        REG_WRITE(ah, AR_PHY_ERR_MASK_1,
+                                  AR_PHY_ERR_OFDM_TIMING);
+                }
+                if (phyCnt2 < aniState->cckPhyErrBase) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "phyCnt2 0x%x, resetting "
+                                  "counter value to 0x%x\n",
+                                  phyCnt2,
+                                  aniState->cckPhyErrBase);
+                        REG_WRITE(ah, AR_PHY_ERR_2,
+                                  aniState->cckPhyErrBase);
+                        REG_WRITE(ah, AR_PHY_ERR_MASK_2,
+                                  AR_PHY_ERR_CCK_TIMING);
+                }
+                return;
+        }
+
+        ofdmPhyErrCnt = phyCnt1 - aniState->ofdmPhyErrBase;
+        ah->stats.ast_ani_ofdmerrs +=
+                ofdmPhyErrCnt - aniState->ofdmPhyErrCount;
+        aniState->ofdmPhyErrCount = ofdmPhyErrCnt;
+
+        cckPhyErrCnt = phyCnt2 - aniState->cckPhyErrBase;
+        ah->stats.ast_ani_cckerrs +=
+                cckPhyErrCnt - aniState->cckPhyErrCount;
+        aniState->cckPhyErrCount = cckPhyErrCnt;
+
+        ath_print(common, ATH_DBG_ANI,
+                  "Errors: OFDM=0x%08x-0x%08x=%d   "
+                  "CCK=0x%08x-0x%08x=%d\n",
+                  phyCnt1,
+                  aniState->ofdmPhyErrBase,
+                  ofdmPhyErrCnt,
+                  phyCnt2,
+                  aniState->cckPhyErrBase,
+                  cckPhyErrCnt);
+
+        ofdmPhyErrRate = aniState->ofdmPhyErrCount * 1000 /
+                         aniState->listenTime;
+        cckPhyErrRate =  aniState->cckPhyErrCount * 1000 /
+                         aniState->listenTime;
+
+        ath_print(common, ATH_DBG_ANI,
+                  "listenTime=%d OFDM:%d errs=%d/s CCK:%d "
+                  "errs=%d/s ofdm_turn=%d\n",
+                  listenTime, aniState->ofdmNoiseImmunityLevel,
+                  ofdmPhyErrRate, aniState->cckNoiseImmunityLevel,
+                  cckPhyErrRate, aniState->ofdmsTurn);
+
+        if (aniState->listenTime > 5 * ah->aniperiod) {
+                if (ofdmPhyErrRate <= aniState->ofdmTrigLow &&
+                    cckPhyErrRate <= aniState->cckTrigLow) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "1. listenTime=%d OFDM:%d errs=%d/s(<%d)  "
+                                  "CCK:%d errs=%d/s(<%d) -> "
+                                  "ath9k_hw_ani_lower_immunity()\n",
+                                  aniState->listenTime,
+                                  aniState->ofdmNoiseImmunityLevel,
+                                  ofdmPhyErrRate,
+                                  aniState->ofdmTrigLow,
+                                  aniState->cckNoiseImmunityLevel,
+                                  cckPhyErrRate,
+                                  aniState->cckTrigLow);
+                        ath9k_hw_ani_lower_immunity(ah);
+                        aniState->ofdmsTurn = !aniState->ofdmsTurn;
+                }
+                ath_print(common, ATH_DBG_ANI,
+                          "1 listenTime=%d ofdm=%d/s cck=%d/s - "
+                          "calling ath9k_ani_restart_new()\n",
+                          aniState->listenTime, ofdmPhyErrRate, cckPhyErrRate);
+                ath9k_ani_restart_new(ah);
+        } else if (aniState->listenTime > ah->aniperiod) {
+                /* check to see if need to raise immunity */
+                if (ofdmPhyErrRate > aniState->ofdmTrigHigh &&
+                    (cckPhyErrRate <= aniState->cckTrigHigh ||
+                     aniState->ofdmsTurn)) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "2 listenTime=%d OFDM:%d errs=%d/s(>%d) -> "
+                                  "ath9k_hw_ani_ofdm_err_trigger_new()\n",
+                                  aniState->listenTime,
+                                  aniState->ofdmNoiseImmunityLevel,
+                                  ofdmPhyErrRate,
+                                  aniState->ofdmTrigHigh);
+                        ath9k_hw_ani_ofdm_err_trigger_new(ah);
+                        ath9k_ani_restart_new(ah);
+                        aniState->ofdmsTurn = false;
+                } else if (cckPhyErrRate > aniState->cckTrigHigh) {
+                        ath_print(common, ATH_DBG_ANI,
+                                 "3 listenTime=%d CCK:%d errs=%d/s(>%d) -> "
+                                 "ath9k_hw_ani_cck_err_trigger_new()\n",
+                                 aniState->listenTime,
+                                 aniState->cckNoiseImmunityLevel,
+                                 cckPhyErrRate,
+                                 aniState->cckTrigHigh);
+                        ath9k_hw_ani_cck_err_trigger_new(ah);
+                        ath9k_ani_restart_new(ah);
+                        aniState->ofdmsTurn = true;
                 }
         }
 }
-EXPORT_SYMBOL(ath9k_hw_ani_monitor);
 
 void ath9k_enable_mib_counters(struct ath_hw *ah)
 {
@@ -495,6 +1038,7 @@ void ath9k_hw_disable_mib_counters(struct ath_hw *ah)
         REG_WRITE(ah, AR_FILT_OFDM, 0);
         REG_WRITE(ah, AR_FILT_CCK, 0);
 }
+EXPORT_SYMBOL(ath9k_hw_disable_mib_counters);
 
 u32 ath9k_hw_GetMibCycleCountsPct(struct ath_hw *ah,
                                   u32 *rxc_pcnt,
@@ -542,7 +1086,7 @@ u32 ath9k_hw_GetMibCycleCountsPct(struct ath_hw *ah,
  * any of the MIB counters overflow/trigger so don't assume we're
  * here because a PHY error counter triggered.
  */
-void ath9k_hw_procmibevent(struct ath_hw *ah)
+static void ath9k_hw_proc_mib_event_old(struct ath_hw *ah)
 {
         u32 phyCnt1, phyCnt2;
 
@@ -555,8 +1099,15 @@ void ath9k_hw_procmibevent(struct ath_hw *ah)
         /* Clear the mib counters and save them in the stats */
         ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
 
-        if (!DO_ANI(ah))
+        if (!DO_ANI(ah)) {
+                /*
+                 * We must always clear the interrupt cause by
+                 * resetting the phy error regs.
+                 */
+                REG_WRITE(ah, AR_PHY_ERR_1, 0);
+                REG_WRITE(ah, AR_PHY_ERR_2, 0);
                 return;
+        }
 
         /* NB: these are not reset-on-read */
         phyCnt1 = REG_READ(ah, AR_PHY_ERR_1);
@@ -584,14 +1135,51 @@ void ath9k_hw_procmibevent(struct ath_hw *ah)
                  * check will never be true.
                  */
                 if (aniState->ofdmPhyErrCount > aniState->ofdmTrigHigh)
-                        ath9k_hw_ani_ofdm_err_trigger(ah);
+                        ath9k_hw_ani_ofdm_err_trigger_new(ah);
                 if (aniState->cckPhyErrCount > aniState->cckTrigHigh)
-                        ath9k_hw_ani_cck_err_trigger(ah);
+                        ath9k_hw_ani_cck_err_trigger_old(ah);
                 /* NB: always restart to insure the h/w counters are reset */
-                ath9k_ani_restart(ah);
+                ath9k_ani_restart_old(ah);
         }
 }
-EXPORT_SYMBOL(ath9k_hw_procmibevent);
+
+/*
+ * Process a MIB interrupt.  We may potentially be invoked because
+ * any of the MIB counters overflow/trigger so don't assume we're
+ * here because a PHY error counter triggered.
+ */
+static void ath9k_hw_proc_mib_event_new(struct ath_hw *ah)
+{
+        u32 phyCnt1, phyCnt2;
+
+        /* Reset these counters regardless */
+        REG_WRITE(ah, AR_FILT_OFDM, 0);
+        REG_WRITE(ah, AR_FILT_CCK, 0);
+        if (!(REG_READ(ah, AR_SLP_MIB_CTRL) & AR_SLP_MIB_PENDING))
+                REG_WRITE(ah, AR_SLP_MIB_CTRL, AR_SLP_MIB_CLEAR);
+
+        /* Clear the mib counters and save them in the stats */
+        ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
+
+        if (!DO_ANI(ah)) {
+                /*
+                 * We must always clear the interrupt cause by
+                 * resetting the phy error regs.
+                 */
+                REG_WRITE(ah, AR_PHY_ERR_1, 0);
+                REG_WRITE(ah, AR_PHY_ERR_2, 0);
+                return;
+        }
+
+        /* NB: these are not reset-on-read */
+        phyCnt1 = REG_READ(ah, AR_PHY_ERR_1);
+        phyCnt2 = REG_READ(ah, AR_PHY_ERR_2);
+
+        /* NB: always restart to insure the h/w counters are reset */
+        if (((phyCnt1 & AR_MIBCNT_INTRMASK) == AR_MIBCNT_INTRMASK) ||
+            ((phyCnt2 & AR_MIBCNT_INTRMASK) == AR_MIBCNT_INTRMASK))
+                ath9k_ani_restart_new(ah);
+}
 
 void ath9k_hw_ani_setup(struct ath_hw *ah)
 {
@@ -619,22 +1207,70 @@ void ath9k_hw_ani_init(struct ath_hw *ah)
 
         memset(ah->ani, 0, sizeof(ah->ani));
         for (i = 0; i < ARRAY_SIZE(ah->ani); i++) {
-                ah->ani[i].ofdmTrigHigh = ATH9K_ANI_OFDM_TRIG_HIGH;
-                ah->ani[i].ofdmTrigLow = ATH9K_ANI_OFDM_TRIG_LOW;
-                ah->ani[i].cckTrigHigh = ATH9K_ANI_CCK_TRIG_HIGH;
-                ah->ani[i].cckTrigLow = ATH9K_ANI_CCK_TRIG_LOW;
+                if (AR_SREV_9300_20_OR_LATER(ah) || modparam_force_new_ani) {
+                        ah->ani[i].ofdmTrigHigh = ATH9K_ANI_OFDM_TRIG_HIGH_NEW;
+                        ah->ani[i].ofdmTrigLow = ATH9K_ANI_OFDM_TRIG_LOW_NEW;
+
+                        ah->ani[i].cckTrigHigh = ATH9K_ANI_CCK_TRIG_HIGH_NEW;
+                        ah->ani[i].cckTrigLow = ATH9K_ANI_CCK_TRIG_LOW_NEW;
+
+                        ah->ani[i].spurImmunityLevel =
+                                ATH9K_ANI_SPUR_IMMUNE_LVL_NEW;
+
+                        ah->ani[i].firstepLevel = ATH9K_ANI_FIRSTEP_LVL_NEW;
+
+                        ah->ani[i].ofdmPhyErrBase = 0;
+                        ah->ani[i].cckPhyErrBase = 0;
+
+                        if (AR_SREV_9300_20_OR_LATER(ah))
+                                ah->ani[i].mrcCCKOff =
+                                        !ATH9K_ANI_ENABLE_MRC_CCK;
+                        else
+                                ah->ani[i].mrcCCKOff = true;
+
+                        ah->ani[i].ofdmsTurn = true;
+                } else {
+                        ah->ani[i].ofdmTrigHigh = ATH9K_ANI_OFDM_TRIG_HIGH_OLD;
+                        ah->ani[i].ofdmTrigLow = ATH9K_ANI_OFDM_TRIG_LOW_OLD;
+
+                        ah->ani[i].cckTrigHigh = ATH9K_ANI_CCK_TRIG_HIGH_OLD;
+                        ah->ani[i].cckTrigLow = ATH9K_ANI_CCK_TRIG_LOW_OLD;
+
+                        ah->ani[i].spurImmunityLevel =
+                                ATH9K_ANI_SPUR_IMMUNE_LVL_OLD;
+                        ah->ani[i].firstepLevel = ATH9K_ANI_FIRSTEP_LVL_OLD;
+
+                        ah->ani[i].ofdmPhyErrBase =
+                                AR_PHY_COUNTMAX - ATH9K_ANI_OFDM_TRIG_HIGH_OLD;
+                        ah->ani[i].cckPhyErrBase =
+                                AR_PHY_COUNTMAX - ATH9K_ANI_CCK_TRIG_HIGH_OLD;
+                        ah->ani[i].cckWeakSigThreshold =
+                                ATH9K_ANI_CCK_WEAK_SIG_THR;
+                }
+
                 ah->ani[i].rssiThrHigh = ATH9K_ANI_RSSI_THR_HIGH;
                 ah->ani[i].rssiThrLow = ATH9K_ANI_RSSI_THR_LOW;
                 ah->ani[i].ofdmWeakSigDetectOff =
                         !ATH9K_ANI_USE_OFDM_WEAK_SIG;
-                ah->ani[i].cckWeakSigThreshold =
-                        ATH9K_ANI_CCK_WEAK_SIG_THR;
-                ah->ani[i].spurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL;
-                ah->ani[i].firstepLevel = ATH9K_ANI_FIRSTEP_LVL;
-                ah->ani[i].ofdmPhyErrBase =
-                        AR_PHY_COUNTMAX - ATH9K_ANI_OFDM_TRIG_HIGH;
-                ah->ani[i].cckPhyErrBase =
-                        AR_PHY_COUNTMAX - ATH9K_ANI_CCK_TRIG_HIGH;
+                ah->ani[i].cckNoiseImmunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;
+        }
+
+        /*
+         * since we expect some ongoing maintenance on the tables, let's sanity
+         * check here default level should not modify INI setting.
+         */
+        if (AR_SREV_9300_20_OR_LATER(ah) || modparam_force_new_ani) {
+                const struct ani_ofdm_level_entry *entry_ofdm;
+                const struct ani_cck_level_entry *entry_cck;
+
+                entry_ofdm = &ofdm_level_table[ATH9K_ANI_OFDM_DEF_LEVEL];
+                entry_cck = &cck_level_table[ATH9K_ANI_CCK_DEF_LEVEL];
+
+                ah->aniperiod = ATH9K_ANI_PERIOD_NEW;
+                ah->config.ani_poll_interval = ATH9K_ANI_POLLINTERVAL_NEW;
+        } else {
+                ah->aniperiod = ATH9K_ANI_PERIOD_OLD;
+                ah->config.ani_poll_interval = ATH9K_ANI_POLLINTERVAL_OLD;
         }
 
         ath_print(common, ATH_DBG_ANI,
@@ -653,7 +1289,34 @@ void ath9k_hw_ani_init(struct ath_hw *ah)
 
         ath9k_enable_mib_counters(ah);
 
-        ah->aniperiod = ATH9K_ANI_PERIOD;
         if (ah->config.enable_ani)
                 ah->proc_phyerr |= HAL_PROCESS_ANI;
 }
+
+void ath9k_hw_attach_ani_ops_old(struct ath_hw *ah)
+{
+        struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
+        struct ath_hw_ops *ops = ath9k_hw_ops(ah);
+
+        priv_ops->ani_reset = ath9k_ani_reset_old;
+        priv_ops->ani_lower_immunity = ath9k_hw_ani_lower_immunity_old;
+
+        ops->ani_proc_mib_event = ath9k_hw_proc_mib_event_old;
+        ops->ani_monitor = ath9k_hw_ani_monitor_old;
+
+        ath_print(ath9k_hw_common(ah), ATH_DBG_ANY, "Using ANI v1\n");
+}
+
+void ath9k_hw_attach_ani_ops_new(struct ath_hw *ah)
+{
+        struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
+        struct ath_hw_ops *ops = ath9k_hw_ops(ah);
+
+        priv_ops->ani_reset = ath9k_ani_reset_new;
+        priv_ops->ani_lower_immunity = ath9k_hw_ani_lower_immunity_new;
+
+        ops->ani_proc_mib_event = ath9k_hw_proc_mib_event_new;
+        ops->ani_monitor = ath9k_hw_ani_monitor_new;
+
+        ath_print(ath9k_hw_common(ah), ATH_DBG_ANY, "Using ANI v2\n");
+}
diff --git a/drivers/net/wireless/ath/ath9k/ani.h b/drivers/net/wireless/ath/ath9k/ani.h
index 3356762ea384..f4d0a4d48b37 100644
--- a/drivers/net/wireless/ath/ath9k/ani.h
+++ b/drivers/net/wireless/ath/ath9k/ani.h
@@ -23,23 +23,55 @@
 
 #define BEACON_RSSI(ahp) (ahp->stats.avgbrssi)
 
-#define ATH9K_ANI_OFDM_TRIG_HIGH          500
-#define ATH9K_ANI_OFDM_TRIG_LOW           200
-#define ATH9K_ANI_CCK_TRIG_HIGH           200
-#define ATH9K_ANI_CCK_TRIG_LOW            100
+/* units are errors per second */
+#define ATH9K_ANI_OFDM_TRIG_HIGH_OLD      500
+#define ATH9K_ANI_OFDM_TRIG_HIGH_NEW      1000
+
+/* units are errors per second */
+#define ATH9K_ANI_OFDM_TRIG_LOW_OLD       200
+#define ATH9K_ANI_OFDM_TRIG_LOW_NEW       400
+
+/* units are errors per second */
+#define ATH9K_ANI_CCK_TRIG_HIGH_OLD       200
+#define ATH9K_ANI_CCK_TRIG_HIGH_NEW       600
+
+/* units are errors per second */
+#define ATH9K_ANI_CCK_TRIG_LOW_OLD        100
+#define ATH9K_ANI_CCK_TRIG_LOW_NEW        300
+
 #define ATH9K_ANI_NOISE_IMMUNE_LVL        4
 #define ATH9K_ANI_USE_OFDM_WEAK_SIG       true
 #define ATH9K_ANI_CCK_WEAK_SIG_THR        false
-#define ATH9K_ANI_SPUR_IMMUNE_LVL         7
-#define ATH9K_ANI_FIRSTEP_LVL             0
+
+#define ATH9K_ANI_SPUR_IMMUNE_LVL_OLD     7
+#define ATH9K_ANI_SPUR_IMMUNE_LVL_NEW     3
+
+#define ATH9K_ANI_FIRSTEP_LVL_OLD         0
+#define ATH9K_ANI_FIRSTEP_LVL_NEW         2
+
 #define ATH9K_ANI_RSSI_THR_HIGH           40
 #define ATH9K_ANI_RSSI_THR_LOW            7
-#define ATH9K_ANI_PERIOD                  100
+
+#define ATH9K_ANI_PERIOD_OLD              100
+#define ATH9K_ANI_PERIOD_NEW              1000
+
+/* in ms */
+#define ATH9K_ANI_POLLINTERVAL_OLD        100
+#define ATH9K_ANI_POLLINTERVAL_NEW        1000
 
 #define HAL_NOISE_IMMUNE_MAX              4
 #define HAL_SPUR_IMMUNE_MAX               7
 #define HAL_FIRST_STEP_MAX                2
 
+#define ATH9K_SIG_FIRSTEP_SETTING_MIN     0
+#define ATH9K_SIG_FIRSTEP_SETTING_MAX     20
+#define ATH9K_SIG_SPUR_IMM_SETTING_MIN    0
+#define ATH9K_SIG_SPUR_IMM_SETTING_MAX    22
+
+#define ATH9K_ANI_ENABLE_MRC_CCK          true
+
+/* values here are relative to the INI */
+
 enum ath9k_ani_cmd {
         ATH9K_ANI_PRESENT = 0x1,
         ATH9K_ANI_NOISE_IMMUNITY_LEVEL = 0x2,
@@ -49,7 +81,8 @@ enum ath9k_ani_cmd {
         ATH9K_ANI_SPUR_IMMUNITY_LEVEL = 0x20,
         ATH9K_ANI_MODE = 0x40,
         ATH9K_ANI_PHYERR_RESET = 0x80,
-        ATH9K_ANI_ALL = 0xff
+        ATH9K_ANI_MRC_CCK = 0x100,
+        ATH9K_ANI_ALL = 0xfff
 };
 
 struct ath9k_mib_stats {
@@ -60,9 +93,31 @@ struct ath9k_mib_stats {
         u32 beacons;
 };
 
+/* INI default values for ANI registers */
+struct ath9k_ani_default {
+        u16 m1ThreshLow;
+        u16 m2ThreshLow;
+        u16 m1Thresh;
+        u16 m2Thresh;
+        u16 m2CountThr;
+        u16 m2CountThrLow;
+        u16 m1ThreshLowExt;
+        u16 m2ThreshLowExt;
+        u16 m1ThreshExt;
+        u16 m2ThreshExt;
+        u16 firstep;
+        u16 firstepLow;
+        u16 cycpwrThr1;
+        u16 cycpwrThr1Ext;
+};
+
 struct ar5416AniState {
         struct ath9k_channel *c;
         u8 noiseImmunityLevel;
+        u8 ofdmNoiseImmunityLevel;
+        u8 cckNoiseImmunityLevel;
+        bool ofdmsTurn;
+        u8 mrcCCKOff;
         u8 spurImmunityLevel;
         u8 firstepLevel;
         u8 ofdmWeakSigDetectOff;
@@ -85,6 +140,7 @@ struct ar5416AniState {
         int16_t pktRssi[2];
         int16_t ofdmErrRssi[2];
         int16_t cckErrRssi[2];
+        struct ath9k_ani_default iniDef;
 };
 
 struct ar5416Stats {
@@ -108,15 +164,13 @@ struct ar5416Stats {
 };
 #define ah_mibStats stats.ast_mibstats
 
-void ath9k_ani_reset(struct ath_hw *ah);
-void ath9k_hw_ani_monitor(struct ath_hw *ah,
-                          struct ath9k_channel *chan);
 void ath9k_enable_mib_counters(struct ath_hw *ah);
 void ath9k_hw_disable_mib_counters(struct ath_hw *ah);
 u32 ath9k_hw_GetMibCycleCountsPct(struct ath_hw *ah, u32 *rxc_pcnt,
                                   u32 *rxf_pcnt, u32 *txf_pcnt);
-void ath9k_hw_procmibevent(struct ath_hw *ah);
 void ath9k_hw_ani_setup(struct ath_hw *ah);
 void ath9k_hw_ani_init(struct ath_hw *ah);
+int ath9k_hw_get_ani_channel_idx(struct ath_hw *ah,
+                                 struct ath9k_channel *chan);
 
 #endif /* ANI_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index b2c17c98bb38..ee34a495b0be 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -19,7 +19,30 @@
 #include "../regd.h"
 #include "ar9002_phy.h"
 
-/* All code below is for non single-chip solutions */
+/* All code below is for AR5008, AR9001, AR9002 */
+
+static const int firstep_table[] =
+/* level:  0   1   2   3   4   5   6   7   8  */
+        { -4, -2,  0,  2,  4,  6,  8, 10, 12 }; /* lvl 0-8, default 2 */
+
+static const int cycpwrThr1_table[] =
+/* level:  0   1   2   3   4   5   6   7   8  */
+        { -6, -4, -2,  0,  2,  4,  6,  8 };     /* lvl 0-7, default 3 */
+
+/*
+ * register values to turn OFDM weak signal detection OFF
+ */
+static const int m1ThreshLow_off = 127;
+static const int m2ThreshLow_off = 127;
+static const int m1Thresh_off = 127;
+static const int m2Thresh_off = 127;
+static const int m2CountThr_off =  31;
+static const int m2CountThrLow_off =  63;
+static const int m1ThreshLowExt_off = 127;
+static const int m2ThreshLowExt_off = 127;
+static const int m1ThreshExt_off = 127;
+static const int m2ThreshExt_off = 127;
+
 
 /**
  * ar5008_hw_phy_modify_rx_buffer() - perform analog swizzling of parameters
@@ -742,17 +765,6 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
                 return -EINVAL;
         }
 
-        if (AR_SREV_9287_12_OR_LATER(ah)) {
-                /* Enable ASYNC FIFO */
-                REG_SET_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
-                                AR_MAC_PCU_ASYNC_FIFO_REG3_DATAPATH_SEL);
-                REG_SET_BIT(ah, AR_PHY_MODE, AR_PHY_MODE_ASYNCFIFO);
-                REG_CLR_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
-                                AR_MAC_PCU_ASYNC_FIFO_REG3_SOFT_RESET);
-                REG_SET_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
-                                AR_MAC_PCU_ASYNC_FIFO_REG3_SOFT_RESET);
-        }
-
         /*
          * Set correct baseband to analog shift setting to
          * access analog chips.
@@ -1037,8 +1049,9 @@ static u32 ar5008_hw_compute_pll_control(struct ath_hw *ah,
         return pll;
 }
 
-static bool ar5008_hw_ani_control(struct ath_hw *ah,
-                                  enum ath9k_ani_cmd cmd, int param)
+static bool ar5008_hw_ani_control_old(struct ath_hw *ah,
+                                      enum ath9k_ani_cmd cmd,
+                                      int param)
 {
         struct ar5416AniState *aniState = ah->curani;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -1220,6 +1233,265 @@ static bool ar5008_hw_ani_control(struct ath_hw *ah,
         return true;
 }
 
+static bool ar5008_hw_ani_control_new(struct ath_hw *ah,
+                                      enum ath9k_ani_cmd cmd,
+                                      int param)
+{
+        struct ar5416AniState *aniState = ah->curani;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_channel *chan = ah->curchan;
+        s32 value, value2;
+
+        switch (cmd & ah->ani_function) {
+        case ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION:{
+                /*
+                 * on == 1 means ofdm weak signal detection is ON
+                 * on == 1 is the default, for less noise immunity
+                 *
+                 * on == 0 means ofdm weak signal detection is OFF
+                 * on == 0 means more noise imm
+                 */
+                u32 on = param ? 1 : 0;
+                /*
+                 * make register setting for default
+                 * (weak sig detect ON) come from INI file
+                 */
+                int m1ThreshLow = on ?
+                        aniState->iniDef.m1ThreshLow : m1ThreshLow_off;
+                int m2ThreshLow = on ?
+                        aniState->iniDef.m2ThreshLow : m2ThreshLow_off;
+                int m1Thresh = on ?
+                        aniState->iniDef.m1Thresh : m1Thresh_off;
+                int m2Thresh = on ?
+                        aniState->iniDef.m2Thresh : m2Thresh_off;
+                int m2CountThr = on ?
+                        aniState->iniDef.m2CountThr : m2CountThr_off;
+                int m2CountThrLow = on ?
+                        aniState->iniDef.m2CountThrLow : m2CountThrLow_off;
+                int m1ThreshLowExt = on ?
+                        aniState->iniDef.m1ThreshLowExt : m1ThreshLowExt_off;
+                int m2ThreshLowExt = on ?
+                        aniState->iniDef.m2ThreshLowExt : m2ThreshLowExt_off;
+                int m1ThreshExt = on ?
+                        aniState->iniDef.m1ThreshExt : m1ThreshExt_off;
+                int m2ThreshExt = on ?
+                        aniState->iniDef.m2ThreshExt : m2ThreshExt_off;
+
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
+                              AR_PHY_SFCORR_LOW_M1_THRESH_LOW,
+                              m1ThreshLow);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
+                              AR_PHY_SFCORR_LOW_M2_THRESH_LOW,
+                              m2ThreshLow);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR,
+                              AR_PHY_SFCORR_M1_THRESH, m1Thresh);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR,
+                              AR_PHY_SFCORR_M2_THRESH, m2Thresh);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR,
+                              AR_PHY_SFCORR_M2COUNT_THR, m2CountThr);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
+                              AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW,
+                              m2CountThrLow);
+
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                              AR_PHY_SFCORR_EXT_M1_THRESH_LOW, m1ThreshLowExt);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                              AR_PHY_SFCORR_EXT_M2_THRESH_LOW, m2ThreshLowExt);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                              AR_PHY_SFCORR_EXT_M1_THRESH, m1ThreshExt);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                              AR_PHY_SFCORR_EXT_M2_THRESH, m2ThreshExt);
+
+                if (on)
+                        REG_SET_BIT(ah, AR_PHY_SFCORR_LOW,
+                                    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
+                else
+                        REG_CLR_BIT(ah, AR_PHY_SFCORR_LOW,
+                                    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
+
+                if (!on != aniState->ofdmWeakSigDetectOff) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "** ch %d: ofdm weak signal: %s=>%s\n",
+                                  chan->channel,
+                                  !aniState->ofdmWeakSigDetectOff ?
+                                        "on" : "off",
+                                  on ? "on" : "off");
+                        if (on)
+                                ah->stats.ast_ani_ofdmon++;
+                        else
+                                ah->stats.ast_ani_ofdmoff++;
+                        aniState->ofdmWeakSigDetectOff = !on;
+                }
+                break;
+        }
+        case ATH9K_ANI_FIRSTEP_LEVEL:{
+                u32 level = param;
+
+                if (level >= ARRAY_SIZE(firstep_table)) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "ATH9K_ANI_FIRSTEP_LEVEL: level "
+                                  "out of range (%u > %u)\n",
+                                  level,
+                                  (unsigned) ARRAY_SIZE(firstep_table));
+                        return false;
+                }
+
+                /*
+                 * make register setting relative to default
+                 * from INI file & cap value
+                 */
+                value = firstep_table[level] -
+                        firstep_table[ATH9K_ANI_FIRSTEP_LVL_NEW] +
+                        aniState->iniDef.firstep;
+                if (value < ATH9K_SIG_FIRSTEP_SETTING_MIN)
+                        value = ATH9K_SIG_FIRSTEP_SETTING_MIN;
+                if (value > ATH9K_SIG_FIRSTEP_SETTING_MAX)
+                        value = ATH9K_SIG_FIRSTEP_SETTING_MAX;
+                REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
+                              AR_PHY_FIND_SIG_FIRSTEP,
+                              value);
+                /*
+                 * we need to set first step low register too
+                 * make register setting relative to default
+                 * from INI file & cap value
+                 */
+                value2 = firstep_table[level] -
+                         firstep_table[ATH9K_ANI_FIRSTEP_LVL_NEW] +
+                         aniState->iniDef.firstepLow;
+                if (value2 < ATH9K_SIG_FIRSTEP_SETTING_MIN)
+                        value2 = ATH9K_SIG_FIRSTEP_SETTING_MIN;
+                if (value2 > ATH9K_SIG_FIRSTEP_SETTING_MAX)
+                        value2 = ATH9K_SIG_FIRSTEP_SETTING_MAX;
+
+                REG_RMW_FIELD(ah, AR_PHY_FIND_SIG_LOW,
+                              AR_PHY_FIND_SIG_FIRSTEP_LOW, value2);
+
+                if (level != aniState->firstepLevel) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "** ch %d: level %d=>%d[def:%d] "
+                                  "firstep[level]=%d ini=%d\n",
+                                  chan->channel,
+                                  aniState->firstepLevel,
+                                  level,
+                                  ATH9K_ANI_FIRSTEP_LVL_NEW,
+                                  value,
+                                  aniState->iniDef.firstep);
+                        ath_print(common, ATH_DBG_ANI,
+                                  "** ch %d: level %d=>%d[def:%d] "
+                                  "firstep_low[level]=%d ini=%d\n",
+                                  chan->channel,
+                                  aniState->firstepLevel,
+                                  level,
+                                  ATH9K_ANI_FIRSTEP_LVL_NEW,
+                                  value2,
+                                  aniState->iniDef.firstepLow);
+                        if (level > aniState->firstepLevel)
+                                ah->stats.ast_ani_stepup++;
+                        else if (level < aniState->firstepLevel)
+                                ah->stats.ast_ani_stepdown++;
+                        aniState->firstepLevel = level;
+                }
+                break;
+        }
+        case ATH9K_ANI_SPUR_IMMUNITY_LEVEL:{
+                u32 level = param;
+
+                if (level >= ARRAY_SIZE(cycpwrThr1_table)) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "ATH9K_ANI_SPUR_IMMUNITY_LEVEL: level "
+                                  "out of range (%u > %u)\n",
+                                  level,
+                                  (unsigned) ARRAY_SIZE(cycpwrThr1_table));
+                        return false;
+                }
+                /*
+                 * make register setting relative to default
+                 * from INI file & cap value
+                 */
+                value = cycpwrThr1_table[level] -
+                        cycpwrThr1_table[ATH9K_ANI_SPUR_IMMUNE_LVL_NEW] +
+                        aniState->iniDef.cycpwrThr1;
+                if (value < ATH9K_SIG_SPUR_IMM_SETTING_MIN)
+                        value = ATH9K_SIG_SPUR_IMM_SETTING_MIN;
+                if (value > ATH9K_SIG_SPUR_IMM_SETTING_MAX)
+                        value = ATH9K_SIG_SPUR_IMM_SETTING_MAX;
+                REG_RMW_FIELD(ah, AR_PHY_TIMING5,
+                              AR_PHY_TIMING5_CYCPWR_THR1,
+                              value);
+
+                /*
+                 * set AR_PHY_EXT_CCA for extension channel
+                 * make register setting relative to default
+                 * from INI file & cap value
+                 */
+                value2 = cycpwrThr1_table[level] -
+                         cycpwrThr1_table[ATH9K_ANI_SPUR_IMMUNE_LVL_NEW] +
+                         aniState->iniDef.cycpwrThr1Ext;
+                if (value2 < ATH9K_SIG_SPUR_IMM_SETTING_MIN)
+                        value2 = ATH9K_SIG_SPUR_IMM_SETTING_MIN;
+                if (value2 > ATH9K_SIG_SPUR_IMM_SETTING_MAX)
+                        value2 = ATH9K_SIG_SPUR_IMM_SETTING_MAX;
+                REG_RMW_FIELD(ah, AR_PHY_EXT_CCA,
+                              AR_PHY_EXT_TIMING5_CYCPWR_THR1, value2);
+
+                if (level != aniState->spurImmunityLevel) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "** ch %d: level %d=>%d[def:%d] "
+                                  "cycpwrThr1[level]=%d ini=%d\n",
+                                  chan->channel,
+                                  aniState->spurImmunityLevel,
+                                  level,
+                                  ATH9K_ANI_SPUR_IMMUNE_LVL_NEW,
+                                  value,
+                                  aniState->iniDef.cycpwrThr1);
+                        ath_print(common, ATH_DBG_ANI,
+                                  "** ch %d: level %d=>%d[def:%d] "
+                                  "cycpwrThr1Ext[level]=%d ini=%d\n",
+                                  chan->channel,
+                                  aniState->spurImmunityLevel,
+                                  level,
+                                  ATH9K_ANI_SPUR_IMMUNE_LVL_NEW,
+                                  value2,
+                                  aniState->iniDef.cycpwrThr1Ext);
+                        if (level > aniState->spurImmunityLevel)
+                                ah->stats.ast_ani_spurup++;
+                        else if (level < aniState->spurImmunityLevel)
+                                ah->stats.ast_ani_spurdown++;
+                        aniState->spurImmunityLevel = level;
+                }
+                break;
+        }
+        case ATH9K_ANI_MRC_CCK:
+                /*
+                 * You should not see this as AR5008, AR9001, AR9002
+                 * does not have hardware support for MRC CCK.
+                 */
+                WARN_ON(1);
+                break;
+        case ATH9K_ANI_PRESENT:
+                break;
+        default:
+                ath_print(common, ATH_DBG_ANI,
+                          "invalid cmd %u\n", cmd);
+                return false;
+        }
+
+        ath_print(common, ATH_DBG_ANI,
+                  "ANI parameters: SI=%d, ofdmWS=%s FS=%d "
+                  "MRCcck=%s listenTime=%d CC=%d listen=%d "
+                  "ofdmErrs=%d cckErrs=%d\n",
+                  aniState->spurImmunityLevel,
+                  !aniState->ofdmWeakSigDetectOff ? "on" : "off",
+                  aniState->firstepLevel,
+                  !aniState->mrcCCKOff ? "on" : "off",
+                  aniState->listenTime,
+                  aniState->cycleCount,
+                  aniState->listenTime,
+                  aniState->ofdmPhyErrCount,
+                  aniState->cckPhyErrCount);
+        return true;
+}
+
 static void ar5008_hw_do_getnf(struct ath_hw *ah,
                               int16_t nfarray[NUM_NF_READINGS])
 {
@@ -1340,6 +1612,71 @@ static void ar5008_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
         DISABLE_REGWRITE_BUFFER(ah);
 }
 
+/*
+ * Initialize the ANI register values with default (ini) values.
+ * This routine is called during a (full) hardware reset after
+ * all the registers are initialised from the INI.
+ */
+static void ar5008_hw_ani_cache_ini_regs(struct ath_hw *ah)
+{
+        struct ar5416AniState *aniState;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_channel *chan = ah->curchan;
+        struct ath9k_ani_default *iniDef;
+        int index;
+        u32 val;
+
+        index = ath9k_hw_get_ani_channel_idx(ah, chan);
+        aniState = &ah->ani[index];
+        ah->curani = aniState;
+        iniDef = &aniState->iniDef;
+
+        ath_print(common, ATH_DBG_ANI,
+                  "ver %d.%d opmode %u chan %d Mhz/0x%x\n",
+                  ah->hw_version.macVersion,
+                  ah->hw_version.macRev,
+                  ah->opmode,
+                  chan->channel,
+                  chan->channelFlags);
+
+        val = REG_READ(ah, AR_PHY_SFCORR);
+        iniDef->m1Thresh = MS(val, AR_PHY_SFCORR_M1_THRESH);
+        iniDef->m2Thresh = MS(val, AR_PHY_SFCORR_M2_THRESH);
+        iniDef->m2CountThr = MS(val, AR_PHY_SFCORR_M2COUNT_THR);
+
+        val = REG_READ(ah, AR_PHY_SFCORR_LOW);
+        iniDef->m1ThreshLow = MS(val, AR_PHY_SFCORR_LOW_M1_THRESH_LOW);
+        iniDef->m2ThreshLow = MS(val, AR_PHY_SFCORR_LOW_M2_THRESH_LOW);
+        iniDef->m2CountThrLow = MS(val, AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW);
+
+        val = REG_READ(ah, AR_PHY_SFCORR_EXT);
+        iniDef->m1ThreshExt = MS(val, AR_PHY_SFCORR_EXT_M1_THRESH);
+        iniDef->m2ThreshExt = MS(val, AR_PHY_SFCORR_EXT_M2_THRESH);
+        iniDef->m1ThreshLowExt = MS(val, AR_PHY_SFCORR_EXT_M1_THRESH_LOW);
+        iniDef->m2ThreshLowExt = MS(val, AR_PHY_SFCORR_EXT_M2_THRESH_LOW);
+        iniDef->firstep = REG_READ_FIELD(ah,
+                                         AR_PHY_FIND_SIG,
+                                         AR_PHY_FIND_SIG_FIRSTEP);
+        iniDef->firstepLow = REG_READ_FIELD(ah,
+                                            AR_PHY_FIND_SIG_LOW,
+                                            AR_PHY_FIND_SIG_FIRSTEP_LOW);
+        iniDef->cycpwrThr1 = REG_READ_FIELD(ah,
+                                            AR_PHY_TIMING5,
+                                            AR_PHY_TIMING5_CYCPWR_THR1);
+        iniDef->cycpwrThr1Ext = REG_READ_FIELD(ah,
+                                               AR_PHY_EXT_CCA,
+                                               AR_PHY_EXT_TIMING5_CYCPWR_THR1);
+
+        /* these levels just got reset to defaults by the INI */
+        aniState->spurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL_NEW;
+        aniState->firstepLevel = ATH9K_ANI_FIRSTEP_LVL_NEW;
+        aniState->ofdmWeakSigDetectOff = !ATH9K_ANI_USE_OFDM_WEAK_SIG;
+        aniState->mrcCCKOff = true; /* not available on pre AR9003 */
+
+        aniState->cycleCount = 0;
+}
+
+
 void ar5008_hw_attach_phy_ops(struct ath_hw *ah)
 {
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
@@ -1361,10 +1698,15 @@ void ar5008_hw_attach_phy_ops(struct ath_hw *ah)
         priv_ops->enable_rfkill = ar5008_hw_enable_rfkill;
         priv_ops->restore_chainmask = ar5008_restore_chainmask;
         priv_ops->set_diversity = ar5008_set_diversity;
-        priv_ops->ani_control = ar5008_hw_ani_control;
         priv_ops->do_getnf = ar5008_hw_do_getnf;
         priv_ops->loadnf = ar5008_hw_loadnf;
 
+        if (modparam_force_new_ani) {
+                priv_ops->ani_control = ar5008_hw_ani_control_new;
+                priv_ops->ani_cache_ini_regs = ar5008_hw_ani_cache_ini_regs;
+        } else
+                priv_ops->ani_control = ar5008_hw_ani_control_old;
+
         if (AR_SREV_9100(ah))
                 priv_ops->compute_pll_control = ar9100_hw_compute_pll_control;
         else if (AR_SREV_9160_10_OR_LATER(ah))
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index a8a8cdc04afa..0317ac9fc1b7 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -18,6 +18,11 @@
 #include "ar5008_initvals.h"
 #include "ar9001_initvals.h"
 #include "ar9002_initvals.h"
+#include "ar9002_phy.h"
+
+int modparam_force_new_ani;
+module_param_named(force_new_ani, modparam_force_new_ani, int, 0444);
+MODULE_PARM_DESC(nohwcrypt, "Force new ANI for AR5008, AR9001, AR9002");
 
 /* General hardware code for the A5008/AR9001/AR9002 hadware families */
 
@@ -436,55 +441,84 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
                 }
 
                 udelay(1000);
+        }
 
-                /* set bit 19 to allow forcing of pcie core into L1 state */
-                REG_SET_BIT(ah, AR_PCIE_PM_CTRL, AR_PCIE_PM_CTRL_ENA);
+        if (power_off) {
+                /* clear bit 19 to disable L1 */
+                REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, AR_PCIE_PM_CTRL_ENA);
+
+                val = REG_READ(ah, AR_WA);
+
+                /*
+                 * Set PCIe workaround bits
+                 * In AR9280 and AR9285, bit 14 in WA register (disable L1)
+                 * should only  be set when device enters D3 and be
+                 * cleared when device comes back to D0.
+                 */
+                if (ah->config.pcie_waen) {
+                        if (ah->config.pcie_waen & AR_WA_D3_L1_DISABLE)
+                                val |= AR_WA_D3_L1_DISABLE;
+                } else {
+                        if (((AR_SREV_9285(ah) ||
+                              AR_SREV_9271(ah) ||
+                              AR_SREV_9287(ah)) &&
+                             (AR9285_WA_DEFAULT & AR_WA_D3_L1_DISABLE)) ||
+                            (AR_SREV_9280(ah) &&
+                             (AR9280_WA_DEFAULT & AR_WA_D3_L1_DISABLE))) {
+                                val |= AR_WA_D3_L1_DISABLE;
+                        }
+                }
+
+                if (AR_SREV_9280(ah) || AR_SREV_9285(ah) || AR_SREV_9287(ah)) {
+                        /*
+                         * Disable bit 6 and 7 before entering D3 to
+                         * prevent system hang.
+                         */
+                        val &= ~(AR_WA_BIT6 | AR_WA_BIT7);
+                }
 
-                /* Several PCIe massages to ensure proper behaviour */
+                if (AR_SREV_9285E_20(ah))
+                        val |= AR_WA_BIT23;
+
+                REG_WRITE(ah, AR_WA, val);
+        } else {
                 if (ah->config.pcie_waen) {
                         val = ah->config.pcie_waen;
                         if (!power_off)
                                 val &= (~AR_WA_D3_L1_DISABLE);
                 } else {
-                        if (AR_SREV_9285(ah) || AR_SREV_9271(ah) ||
+                        if (AR_SREV_9285(ah) ||
+                            AR_SREV_9271(ah) ||
                             AR_SREV_9287(ah)) {
                                 val = AR9285_WA_DEFAULT;
                                 if (!power_off)
                                         val &= (~AR_WA_D3_L1_DISABLE);
-                        } else if (AR_SREV_9280(ah)) {
+                        }
+                        else if (AR_SREV_9280(ah)) {
                                 /*
-                                 * On AR9280 chips bit 22 of 0x4004 needs to be
-                                 * set otherwise card may disappear.
+                                 * For AR9280 chips, bit 22 of 0x4004
+                                 * needs to be set.
                                  */
                                 val = AR9280_WA_DEFAULT;
                                 if (!power_off)
                                         val &= (~AR_WA_D3_L1_DISABLE);
-                        } else
+                        } else {
                                 val = AR_WA_DEFAULT;
+                        }
+                }
+
+                /* WAR for ASPM system hang */
+                if (AR_SREV_9280(ah) || AR_SREV_9285(ah) || AR_SREV_9287(ah)) {
+                        val |= (AR_WA_BIT6 | AR_WA_BIT7);
                 }
 
+                if (AR_SREV_9285E_20(ah))
+                        val |= AR_WA_BIT23;
+
                 REG_WRITE(ah, AR_WA, val);
-        }
 
-        if (power_off) {
-                /*
-                 * Set PCIe workaround bits
-                 * bit 14 in WA register (disable L1) should only
-                 * be set when device enters D3 and be cleared
-                 * when device comes back to D0.
-                 */
-                if (ah->config.pcie_waen) {
-                        if (ah->config.pcie_waen & AR_WA_D3_L1_DISABLE)
-                                REG_SET_BIT(ah, AR_WA, AR_WA_D3_L1_DISABLE);
-                } else {
-                        if (((AR_SREV_9285(ah) || AR_SREV_9271(ah) ||
-                              AR_SREV_9287(ah)) &&
-                             (AR9285_WA_DEFAULT & AR_WA_D3_L1_DISABLE)) ||
-                            (AR_SREV_9280(ah) &&
-                             (AR9280_WA_DEFAULT & AR_WA_D3_L1_DISABLE))) {
-                                REG_SET_BIT(ah, AR_WA, AR_WA_D3_L1_DISABLE);
-                        }
-                }
+                /* set bit 19 to allow forcing of pcie core into L1 state */
+                REG_SET_BIT(ah, AR_PCIE_PM_CTRL, AR_PCIE_PM_CTRL_ENA);
         }
 }
 
@@ -536,18 +570,29 @@ int ar9002_hw_rf_claim(struct ath_hw *ah)
         return 0;
 }
 
+void ar9002_hw_enable_async_fifo(struct ath_hw *ah)
+{
+        if (AR_SREV_9287_13_OR_LATER(ah)) {
+                REG_SET_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
+                                AR_MAC_PCU_ASYNC_FIFO_REG3_DATAPATH_SEL);
+                REG_SET_BIT(ah, AR_PHY_MODE, AR_PHY_MODE_ASYNCFIFO);
+                REG_CLR_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
+                                AR_MAC_PCU_ASYNC_FIFO_REG3_SOFT_RESET);
+                REG_SET_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
+                                AR_MAC_PCU_ASYNC_FIFO_REG3_SOFT_RESET);
+        }
+}
+
 /*
- * Enable ASYNC FIFO
- *
  * If Async FIFO is enabled, the following counters change as MAC now runs
  * at 117 Mhz instead of 88/44MHz when async FIFO is disabled.
  *
  * The values below tested for ht40 2 chain.
  * Overwrite the delay/timeouts initialized in process ini.
  */
-void ar9002_hw_enable_async_fifo(struct ath_hw *ah)
+void ar9002_hw_update_async_fifo(struct ath_hw *ah)
 {
-        if (AR_SREV_9287_12_OR_LATER(ah)) {
+        if (AR_SREV_9287_13_OR_LATER(ah)) {
                 REG_WRITE(ah, AR_D_GBL_IFS_SIFS,
                           AR_D_GBL_IFS_SIFS_ASYNC_FIFO_DUR);
                 REG_WRITE(ah, AR_D_GBL_IFS_SLOT,
@@ -571,9 +616,9 @@ void ar9002_hw_enable_async_fifo(struct ath_hw *ah)
  */
 void ar9002_hw_enable_wep_aggregation(struct ath_hw *ah)
 {
-        if (AR_SREV_9287_12_OR_LATER(ah)) {
+        if (AR_SREV_9287_13_OR_LATER(ah)) {
                 REG_SET_BIT(ah, AR_PCU_MISC_MODE2,
-                                AR_PCU_MISC_MODE2_ENABLE_AGGWEP);
+                            AR_PCU_MISC_MODE2_ENABLE_AGGWEP);
         }
 }
 
@@ -595,4 +640,9 @@ void ar9002_hw_attach_ops(struct ath_hw *ah)
 
         ar9002_hw_attach_calib_ops(ah);
         ar9002_hw_attach_mac_ops(ah);
+
+        if (modparam_force_new_ani)
+                ath9k_hw_attach_ani_ops_new(ah);
+        else
+                ath9k_hw_attach_ani_ops_old(ah);
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_initvals.h b/drivers/net/wireless/ath/ath9k/ar9002_initvals.h
index dae7f3304eb8..8ab24ee8564b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9002_initvals.h
@@ -4492,7 +4492,7 @@ static const u32 ar9287PciePhy_clkreq_off_L1_9287_1_1[][2] = {
 };
 
 
-/* AR9271 initialization values automaticaly created: 06/04/09 */
+/* AR9271 initialization values automaticaly created: 03/31/10 */
 static const u32 ar9271Modes_9271[][6] = {
     { 0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0 },
     { 0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c, 0x000001e0 },
@@ -5011,7 +5011,7 @@ static const u32 ar9271Common_9271[][2] = {
     { 0x0000783c, 0x72ee0a72 },
     { 0x00007840, 0xbbfffffc },
     { 0x00007844, 0x000c0db6 },
-    { 0x00007848, 0x6db61b6f },
+    { 0x00007848, 0x6db6246f },
     { 0x0000784c, 0x6d9b66db },
     { 0x00007850, 0x6d8c6dba },
     { 0x00007854, 0x00040000 },
@@ -5218,7 +5218,7 @@ static const u32 ar9271Modes_high_power_tx_gain_9271[][6] = {
     { 0x00007824, 0x00d8a7ff, 0x00d8a7ff, 0x00d8a7ff, 0x00d8a7ff, 0x00d8a7ff },
     { 0x0000786c, 0x08609eb6, 0x08609eb6, 0x08609eba, 0x08609eba, 0x08609eb6 },
     { 0x00007820, 0x00000c00, 0x00000c00, 0x00000c00, 0x00000c00, 0x00000c00 },
-    { 0x0000a274, 0x0a22a652, 0x0a22a652, 0x0a212652, 0x0a212652, 0x0a22a652 },
+    { 0x0000a274, 0x0a22a652, 0x0a22a652, 0x0a214652, 0x0a214652, 0x0a22a652 },
     { 0x0000a278, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7 },
     { 0x0000a27c, 0x05018063, 0x05038063, 0x05018063, 0x05018063, 0x05018063 },
     { 0x0000a394, 0x06318c63, 0x06318c63, 0x06318c63, 0x06318c63, 0x06318c63 },
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.h b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
index 81bf6e5840e1..ce8bb001c6d1 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
@@ -114,6 +114,10 @@
 #define AR_PHY_FIND_SIG_FIRPWR    0x03FC0000
 #define AR_PHY_FIND_SIG_FIRPWR_S  18
 
+#define AR_PHY_FIND_SIG_LOW           0x9840
+#define AR_PHY_FIND_SIG_FIRSTEP_LOW   0x00000FC0L
+#define AR_PHY_FIND_SIG_FIRSTEP_LOW_S 6
+
 #define AR_PHY_AGC_CTL1                  0x985C
 #define AR_PHY_AGC_CTL1_COARSE_LOW       0x00007F80
 #define AR_PHY_AGC_CTL1_COARSE_LOW_S     7
@@ -325,6 +329,9 @@
 #define AR_PHY_EXT_CCA_CYCPWR_THR1_S    9
 #define AR_PHY_EXT_CCA_THRESH62         0x007F0000
 #define AR_PHY_EXT_CCA_THRESH62_S       16
+#define AR_PHY_EXT_TIMING5_CYCPWR_THR1   0x0000FE00L
+#define AR_PHY_EXT_TIMING5_CYCPWR_THR1_S 9
+
 #define AR_PHY_EXT_MINCCA_PWR           0xFF800000
 #define AR_PHY_EXT_MINCCA_PWR_S         23
 #define AR9280_PHY_EXT_MINCCA_PWR       0x01FF0000
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p0_initvals.h
index db019dd220b7..d3375fc4ce8b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p0_initvals.h
@@ -14,8 +14,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef INITVALS_9003_H
-#define INITVALS_9003_H
+#ifndef INITVALS_9003_2P0_H
+#define INITVALS_9003_2P0_H
 
 /* AR9003 2.0 */
 
@@ -835,71 +835,71 @@ static const u32 ar9300_2p0_baseband_core[][2] = {
 
 static const u32 ar9300Modes_high_power_tx_gain_table_2p0[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
-        {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
-        {0x0000a508, 0x0a022220, 0x0a022220, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x0f022223, 0x0f022223, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x14022620, 0x14022620, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x18022622, 0x18022622, 0x11000400, 0x11000400},
-        {0x0000a518, 0x1b022822, 0x1b022822, 0x15000402, 0x15000402},
-        {0x0000a51c, 0x20022842, 0x20022842, 0x19000404, 0x19000404},
-        {0x0000a520, 0x22022c41, 0x22022c41, 0x1b000603, 0x1b000603},
-        {0x0000a524, 0x28023042, 0x28023042, 0x1f000a02, 0x1f000a02},
-        {0x0000a528, 0x2c023044, 0x2c023044, 0x23000a04, 0x23000a04},
-        {0x0000a52c, 0x2f023644, 0x2f023644, 0x26000a20, 0x26000a20},
-        {0x0000a530, 0x34025643, 0x34025643, 0x2a000e20, 0x2a000e20},
-        {0x0000a534, 0x38025a44, 0x38025a44, 0x2e000e22, 0x2e000e22},
-        {0x0000a538, 0x3b025e45, 0x3b025e45, 0x31000e24, 0x31000e24},
-        {0x0000a53c, 0x41025e4a, 0x41025e4a, 0x34001640, 0x34001640},
-        {0x0000a540, 0x48025e6c, 0x48025e6c, 0x38001660, 0x38001660},
-        {0x0000a544, 0x4e025e8e, 0x4e025e8e, 0x3b001861, 0x3b001861},
-        {0x0000a548, 0x53025eb2, 0x53025eb2, 0x3e001a81, 0x3e001a81},
+        {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
+        {0x0000a508, 0x09002421, 0x09002421, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x0d002621, 0x0d002621, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x13004620, 0x13004620, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x19004a20, 0x19004a20, 0x11000400, 0x11000400},
+        {0x0000a518, 0x1d004e20, 0x1d004e20, 0x15000402, 0x15000402},
+        {0x0000a51c, 0x21005420, 0x21005420, 0x19000404, 0x19000404},
+        {0x0000a520, 0x26005e20, 0x26005e20, 0x1b000603, 0x1b000603},
+        {0x0000a524, 0x2b005e40, 0x2b005e40, 0x1f000a02, 0x1f000a02},
+        {0x0000a528, 0x2f005e42, 0x2f005e42, 0x23000a04, 0x23000a04},
+        {0x0000a52c, 0x33005e44, 0x33005e44, 0x26000a20, 0x26000a20},
+        {0x0000a530, 0x38005e65, 0x38005e65, 0x2a000e20, 0x2a000e20},
+        {0x0000a534, 0x3c005e69, 0x3c005e69, 0x2e000e22, 0x2e000e22},
+        {0x0000a538, 0x40005e6b, 0x40005e6b, 0x31000e24, 0x31000e24},
+        {0x0000a53c, 0x44005e6d, 0x44005e6d, 0x34001640, 0x34001640},
+        {0x0000a540, 0x49005e72, 0x49005e72, 0x38001660, 0x38001660},
+        {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x3b001861, 0x3b001861},
+        {0x0000a548, 0x53005f12, 0x53005f12, 0x3e001a81, 0x3e001a81},
         {0x0000a54c, 0x59025eb5, 0x59025eb5, 0x42001a83, 0x42001a83},
-        {0x0000a550, 0x5f025ef6, 0x5f025ef6, 0x44001c84, 0x44001c84},
-        {0x0000a554, 0x62025f56, 0x62025f56, 0x48001ce3, 0x48001ce3},
-        {0x0000a558, 0x66027f56, 0x66027f56, 0x4c001ce5, 0x4c001ce5},
-        {0x0000a55c, 0x6a029f56, 0x6a029f56, 0x50001ce9, 0x50001ce9},
-        {0x0000a560, 0x70049f56, 0x70049f56, 0x54001ceb, 0x54001ceb},
-        {0x0000a564, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a568, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a56c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a570, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a574, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a578, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a57c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a550, 0x5e025f12, 0x5e025f12, 0x44001c84, 0x44001c84},
+        {0x0000a554, 0x61027f12, 0x61027f12, 0x48001ce3, 0x48001ce3},
+        {0x0000a558, 0x6702bf12, 0x6702bf12, 0x4c001ce5, 0x4c001ce5},
+        {0x0000a55c, 0x6b02bf14, 0x6b02bf14, 0x50001ce9, 0x50001ce9},
+        {0x0000a560, 0x6f02bf16, 0x6f02bf16, 0x54001ceb, 0x54001ceb},
+        {0x0000a564, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a56c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a570, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a574, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a578, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a57c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
         {0x0000a580, 0x00802220, 0x00802220, 0x00800000, 0x00800000},
-        {0x0000a584, 0x06802223, 0x06802223, 0x04800002, 0x04800002},
-        {0x0000a588, 0x0a822220, 0x0a822220, 0x08800004, 0x08800004},
-        {0x0000a58c, 0x0f822223, 0x0f822223, 0x0b800200, 0x0b800200},
-        {0x0000a590, 0x14822620, 0x14822620, 0x0f800202, 0x0f800202},
-        {0x0000a594, 0x18822622, 0x18822622, 0x11800400, 0x11800400},
-        {0x0000a598, 0x1b822822, 0x1b822822, 0x15800402, 0x15800402},
-        {0x0000a59c, 0x20822842, 0x20822842, 0x19800404, 0x19800404},
-        {0x0000a5a0, 0x22822c41, 0x22822c41, 0x1b800603, 0x1b800603},
-        {0x0000a5a4, 0x28823042, 0x28823042, 0x1f800a02, 0x1f800a02},
-        {0x0000a5a8, 0x2c823044, 0x2c823044, 0x23800a04, 0x23800a04},
-        {0x0000a5ac, 0x2f823644, 0x2f823644, 0x26800a20, 0x26800a20},
-        {0x0000a5b0, 0x34825643, 0x34825643, 0x2a800e20, 0x2a800e20},
-        {0x0000a5b4, 0x38825a44, 0x38825a44, 0x2e800e22, 0x2e800e22},
-        {0x0000a5b8, 0x3b825e45, 0x3b825e45, 0x31800e24, 0x31800e24},
-        {0x0000a5bc, 0x41825e4a, 0x41825e4a, 0x34801640, 0x34801640},
-        {0x0000a5c0, 0x48825e6c, 0x48825e6c, 0x38801660, 0x38801660},
-        {0x0000a5c4, 0x4e825e8e, 0x4e825e8e, 0x3b801861, 0x3b801861},
-        {0x0000a5c8, 0x53825eb2, 0x53825eb2, 0x3e801a81, 0x3e801a81},
-        {0x0000a5cc, 0x59825eb5, 0x59825eb5, 0x42801a83, 0x42801a83},
-        {0x0000a5d0, 0x5f825ef6, 0x5f825ef6, 0x44801c84, 0x44801c84},
-        {0x0000a5d4, 0x62825f56, 0x62825f56, 0x48801ce3, 0x48801ce3},
-        {0x0000a5d8, 0x66827f56, 0x66827f56, 0x4c801ce5, 0x4c801ce5},
-        {0x0000a5dc, 0x6a829f56, 0x6a829f56, 0x50801ce9, 0x50801ce9},
-        {0x0000a5e0, 0x70849f56, 0x70849f56, 0x54801ceb, 0x54801ceb},
-        {0x0000a5e4, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
-        {0x0000a5e8, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
-        {0x0000a5ec, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
-        {0x0000a5f0, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
-        {0x0000a5f4, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
-        {0x0000a5f8, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
-        {0x0000a5fc, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a584, 0x04802222, 0x04802222, 0x04800002, 0x04800002},
+        {0x0000a588, 0x09802421, 0x09802421, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x0d802621, 0x0d802621, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x13804620, 0x13804620, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x19804a20, 0x19804a20, 0x11800400, 0x11800400},
+        {0x0000a598, 0x1d804e20, 0x1d804e20, 0x15800402, 0x15800402},
+        {0x0000a59c, 0x21805420, 0x21805420, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x26805e20, 0x26805e20, 0x1b800603, 0x1b800603},
+        {0x0000a5a4, 0x2b805e40, 0x2b805e40, 0x1f800a02, 0x1f800a02},
+        {0x0000a5a8, 0x2f805e42, 0x2f805e42, 0x23800a04, 0x23800a04},
+        {0x0000a5ac, 0x33805e44, 0x33805e44, 0x26800a20, 0x26800a20},
+        {0x0000a5b0, 0x38805e65, 0x38805e65, 0x2a800e20, 0x2a800e20},
+        {0x0000a5b4, 0x3c805e69, 0x3c805e69, 0x2e800e22, 0x2e800e22},
+        {0x0000a5b8, 0x40805e6b, 0x40805e6b, 0x31800e24, 0x31800e24},
+        {0x0000a5bc, 0x44805e6d, 0x44805e6d, 0x34801640, 0x34801640},
+        {0x0000a5c0, 0x49805e72, 0x49805e72, 0x38801660, 0x38801660},
+        {0x0000a5c4, 0x4e805eb2, 0x4e805eb2, 0x3b801861, 0x3b801861},
+        {0x0000a5c8, 0x53805f12, 0x53805f12, 0x3e801a81, 0x3e801a81},
+        {0x0000a5cc, 0x59825eb2, 0x59825eb2, 0x42801a83, 0x42801a83},
+        {0x0000a5d0, 0x5e825f12, 0x5e825f12, 0x44801c84, 0x44801c84},
+        {0x0000a5d4, 0x61827f12, 0x61827f12, 0x48801ce3, 0x48801ce3},
+        {0x0000a5d8, 0x6782bf12, 0x6782bf12, 0x4c801ce5, 0x4c801ce5},
+        {0x0000a5dc, 0x6b82bf14, 0x6b82bf14, 0x50801ce9, 0x50801ce9},
+        {0x0000a5e0, 0x6f82bf16, 0x6f82bf16, 0x54801ceb, 0x54801ceb},
+        {0x0000a5e4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5e8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5ec, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f0, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5fc, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
         {0x00016044, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
         {0x00016048, 0xae480001, 0xae480001, 0xae480001, 0xae480001},
         {0x00016068, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
@@ -913,71 +913,71 @@ static const u32 ar9300Modes_high_power_tx_gain_table_2p0[][5] = {
 
 static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p0[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
-        {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
-        {0x0000a508, 0x0a022220, 0x0a022220, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x0f022223, 0x0f022223, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x14022620, 0x14022620, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x18022622, 0x18022622, 0x11000400, 0x11000400},
-        {0x0000a518, 0x1b022822, 0x1b022822, 0x15000402, 0x15000402},
-        {0x0000a51c, 0x20022842, 0x20022842, 0x19000404, 0x19000404},
-        {0x0000a520, 0x22022c41, 0x22022c41, 0x1b000603, 0x1b000603},
-        {0x0000a524, 0x28023042, 0x28023042, 0x1f000a02, 0x1f000a02},
-        {0x0000a528, 0x2c023044, 0x2c023044, 0x23000a04, 0x23000a04},
-        {0x0000a52c, 0x2f023644, 0x2f023644, 0x26000a20, 0x26000a20},
-        {0x0000a530, 0x34025643, 0x34025643, 0x2a000e20, 0x2a000e20},
-        {0x0000a534, 0x38025a44, 0x38025a44, 0x2e000e22, 0x2e000e22},
-        {0x0000a538, 0x3b025e45, 0x3b025e45, 0x31000e24, 0x31000e24},
-        {0x0000a53c, 0x41025e4a, 0x41025e4a, 0x34001640, 0x34001640},
-        {0x0000a540, 0x48025e6c, 0x48025e6c, 0x38001660, 0x38001660},
-        {0x0000a544, 0x4e025e8e, 0x4e025e8e, 0x3b001861, 0x3b001861},
-        {0x0000a548, 0x53025eb2, 0x53025eb2, 0x3e001a81, 0x3e001a81},
+        {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
+        {0x0000a508, 0x09002421, 0x09002421, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x0d002621, 0x0d002621, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x13004620, 0x13004620, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x19004a20, 0x19004a20, 0x11000400, 0x11000400},
+        {0x0000a518, 0x1d004e20, 0x1d004e20, 0x15000402, 0x15000402},
+        {0x0000a51c, 0x21005420, 0x21005420, 0x19000404, 0x19000404},
+        {0x0000a520, 0x26005e20, 0x26005e20, 0x1b000603, 0x1b000603},
+        {0x0000a524, 0x2b005e40, 0x2b005e40, 0x1f000a02, 0x1f000a02},
+        {0x0000a528, 0x2f005e42, 0x2f005e42, 0x23000a04, 0x23000a04},
+        {0x0000a52c, 0x33005e44, 0x33005e44, 0x26000a20, 0x26000a20},
+        {0x0000a530, 0x38005e65, 0x38005e65, 0x2a000e20, 0x2a000e20},
+        {0x0000a534, 0x3c005e69, 0x3c005e69, 0x2e000e22, 0x2e000e22},
+        {0x0000a538, 0x40005e6b, 0x40005e6b, 0x31000e24, 0x31000e24},
+        {0x0000a53c, 0x44005e6d, 0x44005e6d, 0x34001640, 0x34001640},
+        {0x0000a540, 0x49005e72, 0x49005e72, 0x38001660, 0x38001660},
+        {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x3b001861, 0x3b001861},
+        {0x0000a548, 0x53005f12, 0x53005f12, 0x3e001a81, 0x3e001a81},
         {0x0000a54c, 0x59025eb5, 0x59025eb5, 0x42001a83, 0x42001a83},
-        {0x0000a550, 0x5f025ef6, 0x5f025ef6, 0x44001c84, 0x44001c84},
-        {0x0000a554, 0x62025f56, 0x62025f56, 0x48001ce3, 0x48001ce3},
-        {0x0000a558, 0x66027f56, 0x66027f56, 0x4c001ce5, 0x4c001ce5},
-        {0x0000a55c, 0x6a029f56, 0x6a029f56, 0x50001ce9, 0x50001ce9},
-        {0x0000a560, 0x70049f56, 0x70049f56, 0x54001ceb, 0x54001ceb},
-        {0x0000a564, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a568, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a56c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a570, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a574, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a578, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a57c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a550, 0x5e025f12, 0x5e025f12, 0x44001c84, 0x44001c84},
+        {0x0000a554, 0x61027f12, 0x61027f12, 0x48001ce3, 0x48001ce3},
+        {0x0000a558, 0x6702bf12, 0x6702bf12, 0x4c001ce5, 0x4c001ce5},
+        {0x0000a55c, 0x6b02bf14, 0x6b02bf14, 0x50001ce9, 0x50001ce9},
+        {0x0000a560, 0x6f02bf16, 0x6f02bf16, 0x54001ceb, 0x54001ceb},
+        {0x0000a564, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a56c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a570, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a574, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a578, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a57c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
         {0x0000a580, 0x00802220, 0x00802220, 0x00800000, 0x00800000},
-        {0x0000a584, 0x06802223, 0x06802223, 0x04800002, 0x04800002},
-        {0x0000a588, 0x0a822220, 0x0a822220, 0x08800004, 0x08800004},
-        {0x0000a58c, 0x0f822223, 0x0f822223, 0x0b800200, 0x0b800200},
-        {0x0000a590, 0x14822620, 0x14822620, 0x0f800202, 0x0f800202},
-        {0x0000a594, 0x18822622, 0x18822622, 0x11800400, 0x11800400},
-        {0x0000a598, 0x1b822822, 0x1b822822, 0x15800402, 0x15800402},
-        {0x0000a59c, 0x20822842, 0x20822842, 0x19800404, 0x19800404},
-        {0x0000a5a0, 0x22822c41, 0x22822c41, 0x1b800603, 0x1b800603},
-        {0x0000a5a4, 0x28823042, 0x28823042, 0x1f800a02, 0x1f800a02},
-        {0x0000a5a8, 0x2c823044, 0x2c823044, 0x23800a04, 0x23800a04},
-        {0x0000a5ac, 0x2f823644, 0x2f823644, 0x26800a20, 0x26800a20},
-        {0x0000a5b0, 0x34825643, 0x34825643, 0x2a800e20, 0x2a800e20},
-        {0x0000a5b4, 0x38825a44, 0x38825a44, 0x2e800e22, 0x2e800e22},
-        {0x0000a5b8, 0x3b825e45, 0x3b825e45, 0x31800e24, 0x31800e24},
-        {0x0000a5bc, 0x41825e4a, 0x41825e4a, 0x34801640, 0x34801640},
-        {0x0000a5c0, 0x48825e6c, 0x48825e6c, 0x38801660, 0x38801660},
-        {0x0000a5c4, 0x4e825e8e, 0x4e825e8e, 0x3b801861, 0x3b801861},
-        {0x0000a5c8, 0x53825eb2, 0x53825eb2, 0x3e801a81, 0x3e801a81},
-        {0x0000a5cc, 0x59825eb5, 0x59825eb5, 0x42801a83, 0x42801a83},
-        {0x0000a5d0, 0x5f825ef6, 0x5f825ef6, 0x44801c84, 0x44801c84},
-        {0x0000a5d4, 0x62825f56, 0x62825f56, 0x48801ce3, 0x48801ce3},
-        {0x0000a5d8, 0x66827f56, 0x66827f56, 0x4c801ce5, 0x4c801ce5},
-        {0x0000a5dc, 0x6a829f56, 0x6a829f56, 0x50801ce9, 0x50801ce9},
-        {0x0000a5e0, 0x70849f56, 0x70849f56, 0x54801ceb, 0x54801ceb},
-        {0x0000a5e4, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
-        {0x0000a5e8, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
-        {0x0000a5ec, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
-        {0x0000a5f0, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
-        {0x0000a5f4, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
-        {0x0000a5f8, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
-        {0x0000a5fc, 0x7584ff56, 0x7584ff56, 0x56801eec, 0x56801eec},
+        {0x0000a584, 0x04802222, 0x04802222, 0x04800002, 0x04800002},
+        {0x0000a588, 0x09802421, 0x09802421, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x0d802621, 0x0d802621, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x13804620, 0x13804620, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x19804a20, 0x19804a20, 0x11800400, 0x11800400},
+        {0x0000a598, 0x1d804e20, 0x1d804e20, 0x15800402, 0x15800402},
+        {0x0000a59c, 0x21805420, 0x21805420, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x26805e20, 0x26805e20, 0x1b800603, 0x1b800603},
+        {0x0000a5a4, 0x2b805e40, 0x2b805e40, 0x1f800a02, 0x1f800a02},
+        {0x0000a5a8, 0x2f805e42, 0x2f805e42, 0x23800a04, 0x23800a04},
+        {0x0000a5ac, 0x33805e44, 0x33805e44, 0x26800a20, 0x26800a20},
+        {0x0000a5b0, 0x38805e65, 0x38805e65, 0x2a800e20, 0x2a800e20},
+        {0x0000a5b4, 0x3c805e69, 0x3c805e69, 0x2e800e22, 0x2e800e22},
+        {0x0000a5b8, 0x40805e6b, 0x40805e6b, 0x31800e24, 0x31800e24},
+        {0x0000a5bc, 0x44805e6d, 0x44805e6d, 0x34801640, 0x34801640},
+        {0x0000a5c0, 0x49805e72, 0x49805e72, 0x38801660, 0x38801660},
+        {0x0000a5c4, 0x4e805eb2, 0x4e805eb2, 0x3b801861, 0x3b801861},
+        {0x0000a5c8, 0x53805f12, 0x53805f12, 0x3e801a81, 0x3e801a81},
+        {0x0000a5cc, 0x59825eb2, 0x59825eb2, 0x42801a83, 0x42801a83},
+        {0x0000a5d0, 0x5e825f12, 0x5e825f12, 0x44801c84, 0x44801c84},
+        {0x0000a5d4, 0x61827f12, 0x61827f12, 0x48801ce3, 0x48801ce3},
+        {0x0000a5d8, 0x6782bf12, 0x6782bf12, 0x4c801ce5, 0x4c801ce5},
+        {0x0000a5dc, 0x6b82bf14, 0x6b82bf14, 0x50801ce9, 0x50801ce9},
+        {0x0000a5e0, 0x6f82bf16, 0x6f82bf16, 0x54801ceb, 0x54801ceb},
+        {0x0000a5e4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5e8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5ec, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f0, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5fc, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
         {0x00016044, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
         {0x00016048, 0x8e480001, 0x8e480001, 0x8e480001, 0x8e480001},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
@@ -1781,4 +1781,4 @@ static const u32 ar9300PciePhy_clkreq_disable_L1_2p0[][2] = {
         {0x00004044, 0x00000000},
 };
 
-#endif /* INITVALS_9003_H */
+#endif /* INITVALS_9003_2P0_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
new file mode 100644
index 000000000000..ec98ab50748a
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -0,0 +1,1785 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef INITVALS_9003_2P2_H
+#define INITVALS_9003_2P2_H
+
+/* AR9003 2.2 */
+
+static const u32 ar9300_2p2_radio_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0001609c, 0x0dd08f29, 0x0dd08f29, 0x0b283f31, 0x0b283f31},
+        {0x000160ac, 0xa4653c00, 0xa4653c00, 0x24652800, 0x24652800},
+        {0x000160b0, 0x03284f3e, 0x03284f3e, 0x05d08f20, 0x05d08f20},
+        {0x0001610c, 0x08000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00016140, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
+        {0x0001650c, 0x08000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00016540, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
+        {0x0001690c, 0x08000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00016940, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
+};
+
+static const u32 ar9300Modes_lowest_ob_db_tx_gain_table_2p2[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
+        {0x0000a518, 0x21002220, 0x21002220, 0x16000402, 0x16000402},
+        {0x0000a51c, 0x27002223, 0x27002223, 0x19000404, 0x19000404},
+        {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
+        {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
+        {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
+        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
+        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
+        {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
+        {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
+        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
+        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
+        {0x0000a544, 0x5302266c, 0x5302266c, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x5702286c, 0x5702286c, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x5c02486b, 0x5c02486b, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x61024a6c, 0x61024a6c, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x66026a6c, 0x66026a6c, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x6b026e6c, 0x6b026e6c, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x7002708c, 0x7002708c, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x7302b08a, 0x7302b08a, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
+        {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x1c800223, 0x1c800223, 0x12800400, 0x12800400},
+        {0x0000a598, 0x21802220, 0x21802220, 0x16800402, 0x16800402},
+        {0x0000a59c, 0x27802223, 0x27802223, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1c800603, 0x1c800603},
+        {0x0000a5a4, 0x2f822222, 0x2f822222, 0x21800a02, 0x21800a02},
+        {0x0000a5a8, 0x34822225, 0x34822225, 0x25800a04, 0x25800a04},
+        {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x28800a20, 0x28800a20},
+        {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2c800e20, 0x2c800e20},
+        {0x0000a5b4, 0x4282242a, 0x4282242a, 0x30800e22, 0x30800e22},
+        {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24},
+        {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640},
+        {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660},
+        {0x0000a5c4, 0x5382266c, 0x5382266c, 0x3f801861, 0x3f801861},
+        {0x0000a5c8, 0x5782286c, 0x5782286c, 0x43801a81, 0x43801a81},
+        {0x0000a5cc, 0x5c82486b, 0x5c82486b, 0x47801a83, 0x47801a83},
+        {0x0000a5d0, 0x61824a6c, 0x61824a6c, 0x4a801c84, 0x4a801c84},
+        {0x0000a5d4, 0x66826a6c, 0x66826a6c, 0x4e801ce3, 0x4e801ce3},
+        {0x0000a5d8, 0x6b826e6c, 0x6b826e6c, 0x52801ce5, 0x52801ce5},
+        {0x0000a5dc, 0x7082708c, 0x7082708c, 0x56801ce9, 0x56801ce9},
+        {0x0000a5e0, 0x7382b08a, 0x7382b08a, 0x5a801ceb, 0x5a801ceb},
+        {0x0000a5e4, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5e8, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5ec, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f0, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f4, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f8, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5fc, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016048, 0x62480001, 0x62480001, 0x62480001, 0x62480001},
+        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016448, 0x62480001, 0x62480001, 0x62480001, 0x62480001},
+        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016848, 0x62480001, 0x62480001, 0x62480001, 0x62480001},
+        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+};
+
+static const u32 ar9300Modes_fast_clock_2p2[][3] = {
+        /* Addr      5G_HT20     5G_HT40   */
+        {0x00001030, 0x00000268, 0x000004d0},
+        {0x00001070, 0x0000018c, 0x00000318},
+        {0x000010b0, 0x00000fd0, 0x00001fa0},
+        {0x00008014, 0x044c044c, 0x08980898},
+        {0x0000801c, 0x148ec02b, 0x148ec057},
+        {0x00008318, 0x000044c0, 0x00008980},
+        {0x00009e00, 0x03721821, 0x03721821},
+        {0x0000a230, 0x0000000b, 0x00000016},
+        {0x0000a254, 0x00000898, 0x00001130},
+};
+
+static const u32 ar9300_2p2_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00016000, 0x36db6db6},
+        {0x00016004, 0x6db6db40},
+        {0x00016008, 0x73f00000},
+        {0x0001600c, 0x00000000},
+        {0x00016040, 0x7f80fff8},
+        {0x0001604c, 0x76d005b5},
+        {0x00016050, 0x556cf031},
+        {0x00016054, 0x13449440},
+        {0x00016058, 0x0c51c92c},
+        {0x0001605c, 0x3db7fffc},
+        {0x00016060, 0xfffffffc},
+        {0x00016064, 0x000f0278},
+        {0x0001606c, 0x6db60000},
+        {0x00016080, 0x00000000},
+        {0x00016084, 0x0e48048c},
+        {0x00016088, 0x54214514},
+        {0x0001608c, 0x119f481e},
+        {0x00016090, 0x24926490},
+        {0x00016098, 0xd2888888},
+        {0x000160a0, 0x0a108ffe},
+        {0x000160a4, 0x812fc370},
+        {0x000160a8, 0x423c8000},
+        {0x000160b4, 0x92480080},
+        {0x000160c0, 0x00adb6d0},
+        {0x000160c4, 0x6db6db60},
+        {0x000160c8, 0x6db6db6c},
+        {0x000160cc, 0x01e6c000},
+        {0x00016100, 0x3fffbe01},
+        {0x00016104, 0xfff80000},
+        {0x00016108, 0x00080010},
+        {0x00016144, 0x02084080},
+        {0x00016148, 0x00000000},
+        {0x00016280, 0x058a0001},
+        {0x00016284, 0x3d840208},
+        {0x00016288, 0x05a20408},
+        {0x0001628c, 0x00038c07},
+        {0x00016290, 0x00000004},
+        {0x00016294, 0x458aa14f},
+        {0x00016380, 0x00000000},
+        {0x00016384, 0x00000000},
+        {0x00016388, 0x00800700},
+        {0x0001638c, 0x00800700},
+        {0x00016390, 0x00800700},
+        {0x00016394, 0x00000000},
+        {0x00016398, 0x00000000},
+        {0x0001639c, 0x00000000},
+        {0x000163a0, 0x00000001},
+        {0x000163a4, 0x00000001},
+        {0x000163a8, 0x00000000},
+        {0x000163ac, 0x00000000},
+        {0x000163b0, 0x00000000},
+        {0x000163b4, 0x00000000},
+        {0x000163b8, 0x00000000},
+        {0x000163bc, 0x00000000},
+        {0x000163c0, 0x000000a0},
+        {0x000163c4, 0x000c0000},
+        {0x000163c8, 0x14021402},
+        {0x000163cc, 0x00001402},
+        {0x000163d0, 0x00000000},
+        {0x000163d4, 0x00000000},
+        {0x00016400, 0x36db6db6},
+        {0x00016404, 0x6db6db40},
+        {0x00016408, 0x73f00000},
+        {0x0001640c, 0x00000000},
+        {0x00016440, 0x7f80fff8},
+        {0x0001644c, 0x76d005b5},
+        {0x00016450, 0x556cf031},
+        {0x00016454, 0x13449440},
+        {0x00016458, 0x0c51c92c},
+        {0x0001645c, 0x3db7fffc},
+        {0x00016460, 0xfffffffc},
+        {0x00016464, 0x000f0278},
+        {0x0001646c, 0x6db60000},
+        {0x00016500, 0x3fffbe01},
+        {0x00016504, 0xfff80000},
+        {0x00016508, 0x00080010},
+        {0x00016544, 0x02084080},
+        {0x00016548, 0x00000000},
+        {0x00016780, 0x00000000},
+        {0x00016784, 0x00000000},
+        {0x00016788, 0x00800700},
+        {0x0001678c, 0x00800700},
+        {0x00016790, 0x00800700},
+        {0x00016794, 0x00000000},
+        {0x00016798, 0x00000000},
+        {0x0001679c, 0x00000000},
+        {0x000167a0, 0x00000001},
+        {0x000167a4, 0x00000001},
+        {0x000167a8, 0x00000000},
+        {0x000167ac, 0x00000000},
+        {0x000167b0, 0x00000000},
+        {0x000167b4, 0x00000000},
+        {0x000167b8, 0x00000000},
+        {0x000167bc, 0x00000000},
+        {0x000167c0, 0x000000a0},
+        {0x000167c4, 0x000c0000},
+        {0x000167c8, 0x14021402},
+        {0x000167cc, 0x00001402},
+        {0x000167d0, 0x00000000},
+        {0x000167d4, 0x00000000},
+        {0x00016800, 0x36db6db6},
+        {0x00016804, 0x6db6db40},
+        {0x00016808, 0x73f00000},
+        {0x0001680c, 0x00000000},
+        {0x00016840, 0x7f80fff8},
+        {0x0001684c, 0x76d005b5},
+        {0x00016850, 0x556cf031},
+        {0x00016854, 0x13449440},
+        {0x00016858, 0x0c51c92c},
+        {0x0001685c, 0x3db7fffc},
+        {0x00016860, 0xfffffffc},
+        {0x00016864, 0x000f0278},
+        {0x0001686c, 0x6db60000},
+        {0x00016900, 0x3fffbe01},
+        {0x00016904, 0xfff80000},
+        {0x00016908, 0x00080010},
+        {0x00016944, 0x02084080},
+        {0x00016948, 0x00000000},
+        {0x00016b80, 0x00000000},
+        {0x00016b84, 0x00000000},
+        {0x00016b88, 0x00800700},
+        {0x00016b8c, 0x00800700},
+        {0x00016b90, 0x00800700},
+        {0x00016b94, 0x00000000},
+        {0x00016b98, 0x00000000},
+        {0x00016b9c, 0x00000000},
+        {0x00016ba0, 0x00000001},
+        {0x00016ba4, 0x00000001},
+        {0x00016ba8, 0x00000000},
+        {0x00016bac, 0x00000000},
+        {0x00016bb0, 0x00000000},
+        {0x00016bb4, 0x00000000},
+        {0x00016bb8, 0x00000000},
+        {0x00016bbc, 0x00000000},
+        {0x00016bc0, 0x000000a0},
+        {0x00016bc4, 0x000c0000},
+        {0x00016bc8, 0x14021402},
+        {0x00016bcc, 0x00001402},
+        {0x00016bd0, 0x00000000},
+        {0x00016bd4, 0x00000000},
+};
+
+static const u32 ar9300Common_rx_gain_table_merlin_2p2[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x02000101},
+        {0x0000a004, 0x02000102},
+        {0x0000a008, 0x02000103},
+        {0x0000a00c, 0x02000104},
+        {0x0000a010, 0x02000200},
+        {0x0000a014, 0x02000201},
+        {0x0000a018, 0x02000202},
+        {0x0000a01c, 0x02000203},
+        {0x0000a020, 0x02000204},
+        {0x0000a024, 0x02000205},
+        {0x0000a028, 0x02000208},
+        {0x0000a02c, 0x02000302},
+        {0x0000a030, 0x02000303},
+        {0x0000a034, 0x02000304},
+        {0x0000a038, 0x02000400},
+        {0x0000a03c, 0x02010300},
+        {0x0000a040, 0x02010301},
+        {0x0000a044, 0x02010302},
+        {0x0000a048, 0x02000500},
+        {0x0000a04c, 0x02010400},
+        {0x0000a050, 0x02020300},
+        {0x0000a054, 0x02020301},
+        {0x0000a058, 0x02020302},
+        {0x0000a05c, 0x02020303},
+        {0x0000a060, 0x02020400},
+        {0x0000a064, 0x02030300},
+        {0x0000a068, 0x02030301},
+        {0x0000a06c, 0x02030302},
+        {0x0000a070, 0x02030303},
+        {0x0000a074, 0x02030400},
+        {0x0000a078, 0x02040300},
+        {0x0000a07c, 0x02040301},
+        {0x0000a080, 0x02040302},
+        {0x0000a084, 0x02040303},
+        {0x0000a088, 0x02030500},
+        {0x0000a08c, 0x02040400},
+        {0x0000a090, 0x02050203},
+        {0x0000a094, 0x02050204},
+        {0x0000a098, 0x02050205},
+        {0x0000a09c, 0x02040500},
+        {0x0000a0a0, 0x02050301},
+        {0x0000a0a4, 0x02050302},
+        {0x0000a0a8, 0x02050303},
+        {0x0000a0ac, 0x02050400},
+        {0x0000a0b0, 0x02050401},
+        {0x0000a0b4, 0x02050402},
+        {0x0000a0b8, 0x02050403},
+        {0x0000a0bc, 0x02050500},
+        {0x0000a0c0, 0x02050501},
+        {0x0000a0c4, 0x02050502},
+        {0x0000a0c8, 0x02050503},
+        {0x0000a0cc, 0x02050504},
+        {0x0000a0d0, 0x02050600},
+        {0x0000a0d4, 0x02050601},
+        {0x0000a0d8, 0x02050602},
+        {0x0000a0dc, 0x02050603},
+        {0x0000a0e0, 0x02050604},
+        {0x0000a0e4, 0x02050700},
+        {0x0000a0e8, 0x02050701},
+        {0x0000a0ec, 0x02050702},
+        {0x0000a0f0, 0x02050703},
+        {0x0000a0f4, 0x02050704},
+        {0x0000a0f8, 0x02050705},
+        {0x0000a0fc, 0x02050708},
+        {0x0000a100, 0x02050709},
+        {0x0000a104, 0x0205070a},
+        {0x0000a108, 0x0205070b},
+        {0x0000a10c, 0x0205070c},
+        {0x0000a110, 0x0205070d},
+        {0x0000a114, 0x02050710},
+        {0x0000a118, 0x02050711},
+        {0x0000a11c, 0x02050712},
+        {0x0000a120, 0x02050713},
+        {0x0000a124, 0x02050714},
+        {0x0000a128, 0x02050715},
+        {0x0000a12c, 0x02050730},
+        {0x0000a130, 0x02050731},
+        {0x0000a134, 0x02050732},
+        {0x0000a138, 0x02050733},
+        {0x0000a13c, 0x02050734},
+        {0x0000a140, 0x02050735},
+        {0x0000a144, 0x02050750},
+        {0x0000a148, 0x02050751},
+        {0x0000a14c, 0x02050752},
+        {0x0000a150, 0x02050753},
+        {0x0000a154, 0x02050754},
+        {0x0000a158, 0x02050755},
+        {0x0000a15c, 0x02050770},
+        {0x0000a160, 0x02050771},
+        {0x0000a164, 0x02050772},
+        {0x0000a168, 0x02050773},
+        {0x0000a16c, 0x02050774},
+        {0x0000a170, 0x02050775},
+        {0x0000a174, 0x00000776},
+        {0x0000a178, 0x00000776},
+        {0x0000a17c, 0x00000776},
+        {0x0000a180, 0x00000776},
+        {0x0000a184, 0x00000776},
+        {0x0000a188, 0x00000776},
+        {0x0000a18c, 0x00000776},
+        {0x0000a190, 0x00000776},
+        {0x0000a194, 0x00000776},
+        {0x0000a198, 0x00000776},
+        {0x0000a19c, 0x00000776},
+        {0x0000a1a0, 0x00000776},
+        {0x0000a1a4, 0x00000776},
+        {0x0000a1a8, 0x00000776},
+        {0x0000a1ac, 0x00000776},
+        {0x0000a1b0, 0x00000776},
+        {0x0000a1b4, 0x00000776},
+        {0x0000a1b8, 0x00000776},
+        {0x0000a1bc, 0x00000776},
+        {0x0000a1c0, 0x00000776},
+        {0x0000a1c4, 0x00000776},
+        {0x0000a1c8, 0x00000776},
+        {0x0000a1cc, 0x00000776},
+        {0x0000a1d0, 0x00000776},
+        {0x0000a1d4, 0x00000776},
+        {0x0000a1d8, 0x00000776},
+        {0x0000a1dc, 0x00000776},
+        {0x0000a1e0, 0x00000776},
+        {0x0000a1e4, 0x00000776},
+        {0x0000a1e8, 0x00000776},
+        {0x0000a1ec, 0x00000776},
+        {0x0000a1f0, 0x00000776},
+        {0x0000a1f4, 0x00000776},
+        {0x0000a1f8, 0x00000776},
+        {0x0000a1fc, 0x00000776},
+        {0x0000b000, 0x02000101},
+        {0x0000b004, 0x02000102},
+        {0x0000b008, 0x02000103},
+        {0x0000b00c, 0x02000104},
+        {0x0000b010, 0x02000200},
+        {0x0000b014, 0x02000201},
+        {0x0000b018, 0x02000202},
+        {0x0000b01c, 0x02000203},
+        {0x0000b020, 0x02000204},
+        {0x0000b024, 0x02000205},
+        {0x0000b028, 0x02000208},
+        {0x0000b02c, 0x02000302},
+        {0x0000b030, 0x02000303},
+        {0x0000b034, 0x02000304},
+        {0x0000b038, 0x02000400},
+        {0x0000b03c, 0x02010300},
+        {0x0000b040, 0x02010301},
+        {0x0000b044, 0x02010302},
+        {0x0000b048, 0x02000500},
+        {0x0000b04c, 0x02010400},
+        {0x0000b050, 0x02020300},
+        {0x0000b054, 0x02020301},
+        {0x0000b058, 0x02020302},
+        {0x0000b05c, 0x02020303},
+        {0x0000b060, 0x02020400},
+        {0x0000b064, 0x02030300},
+        {0x0000b068, 0x02030301},
+        {0x0000b06c, 0x02030302},
+        {0x0000b070, 0x02030303},
+        {0x0000b074, 0x02030400},
+        {0x0000b078, 0x02040300},
+        {0x0000b07c, 0x02040301},
+        {0x0000b080, 0x02040302},
+        {0x0000b084, 0x02040303},
+        {0x0000b088, 0x02030500},
+        {0x0000b08c, 0x02040400},
+        {0x0000b090, 0x02050203},
+        {0x0000b094, 0x02050204},
+        {0x0000b098, 0x02050205},
+        {0x0000b09c, 0x02040500},
+        {0x0000b0a0, 0x02050301},
+        {0x0000b0a4, 0x02050302},
+        {0x0000b0a8, 0x02050303},
+        {0x0000b0ac, 0x02050400},
+        {0x0000b0b0, 0x02050401},
+        {0x0000b0b4, 0x02050402},
+        {0x0000b0b8, 0x02050403},
+        {0x0000b0bc, 0x02050500},
+        {0x0000b0c0, 0x02050501},
+        {0x0000b0c4, 0x02050502},
+        {0x0000b0c8, 0x02050503},
+        {0x0000b0cc, 0x02050504},
+        {0x0000b0d0, 0x02050600},
+        {0x0000b0d4, 0x02050601},
+        {0x0000b0d8, 0x02050602},
+        {0x0000b0dc, 0x02050603},
+        {0x0000b0e0, 0x02050604},
+        {0x0000b0e4, 0x02050700},
+        {0x0000b0e8, 0x02050701},
+        {0x0000b0ec, 0x02050702},
+        {0x0000b0f0, 0x02050703},
+        {0x0000b0f4, 0x02050704},
+        {0x0000b0f8, 0x02050705},
+        {0x0000b0fc, 0x02050708},
+        {0x0000b100, 0x02050709},
+        {0x0000b104, 0x0205070a},
+        {0x0000b108, 0x0205070b},
+        {0x0000b10c, 0x0205070c},
+        {0x0000b110, 0x0205070d},
+        {0x0000b114, 0x02050710},
+        {0x0000b118, 0x02050711},
+        {0x0000b11c, 0x02050712},
+        {0x0000b120, 0x02050713},
+        {0x0000b124, 0x02050714},
+        {0x0000b128, 0x02050715},
+        {0x0000b12c, 0x02050730},
+        {0x0000b130, 0x02050731},
+        {0x0000b134, 0x02050732},
+        {0x0000b138, 0x02050733},
+        {0x0000b13c, 0x02050734},
+        {0x0000b140, 0x02050735},
+        {0x0000b144, 0x02050750},
+        {0x0000b148, 0x02050751},
+        {0x0000b14c, 0x02050752},
+        {0x0000b150, 0x02050753},
+        {0x0000b154, 0x02050754},
+        {0x0000b158, 0x02050755},
+        {0x0000b15c, 0x02050770},
+        {0x0000b160, 0x02050771},
+        {0x0000b164, 0x02050772},
+        {0x0000b168, 0x02050773},
+        {0x0000b16c, 0x02050774},
+        {0x0000b170, 0x02050775},
+        {0x0000b174, 0x00000776},
+        {0x0000b178, 0x00000776},
+        {0x0000b17c, 0x00000776},
+        {0x0000b180, 0x00000776},
+        {0x0000b184, 0x00000776},
+        {0x0000b188, 0x00000776},
+        {0x0000b18c, 0x00000776},
+        {0x0000b190, 0x00000776},
+        {0x0000b194, 0x00000776},
+        {0x0000b198, 0x00000776},
+        {0x0000b19c, 0x00000776},
+        {0x0000b1a0, 0x00000776},
+        {0x0000b1a4, 0x00000776},
+        {0x0000b1a8, 0x00000776},
+        {0x0000b1ac, 0x00000776},
+        {0x0000b1b0, 0x00000776},
+        {0x0000b1b4, 0x00000776},
+        {0x0000b1b8, 0x00000776},
+        {0x0000b1bc, 0x00000776},
+        {0x0000b1c0, 0x00000776},
+        {0x0000b1c4, 0x00000776},
+        {0x0000b1c8, 0x00000776},
+        {0x0000b1cc, 0x00000776},
+        {0x0000b1d0, 0x00000776},
+        {0x0000b1d4, 0x00000776},
+        {0x0000b1d8, 0x00000776},
+        {0x0000b1dc, 0x00000776},
+        {0x0000b1e0, 0x00000776},
+        {0x0000b1e4, 0x00000776},
+        {0x0000b1e8, 0x00000776},
+        {0x0000b1ec, 0x00000776},
+        {0x0000b1f0, 0x00000776},
+        {0x0000b1f4, 0x00000776},
+        {0x0000b1f8, 0x00000776},
+        {0x0000b1fc, 0x00000776},
+};
+
+static const u32 ar9300_2p2_mac_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
+        {0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c},
+        {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
+        {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
+        {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
+        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
+        {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
+        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
+};
+
+static const u32 ar9300_2p2_soc_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00007010, 0x00000023, 0x00000023, 0x00000023, 0x00000023},
+};
+
+static const u32 ar9200_merlin_2p2_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00007800, 0x00040000},
+        {0x00007804, 0xdb005012},
+        {0x00007808, 0x04924914},
+        {0x0000780c, 0x21084210},
+        {0x00007810, 0x6d801300},
+        {0x00007814, 0x0019beff},
+        {0x00007818, 0x07e41000},
+        {0x0000781c, 0x00392000},
+        {0x00007820, 0x92592480},
+        {0x00007824, 0x00040000},
+        {0x00007828, 0xdb005012},
+        {0x0000782c, 0x04924914},
+        {0x00007830, 0x21084210},
+        {0x00007834, 0x6d801300},
+        {0x00007838, 0x0019beff},
+        {0x0000783c, 0x07e40000},
+        {0x00007840, 0x00392000},
+        {0x00007844, 0x92592480},
+        {0x00007848, 0x00100000},
+        {0x0000784c, 0x773f0567},
+        {0x00007850, 0x54214514},
+        {0x00007854, 0x12035828},
+        {0x00007858, 0x92592692},
+        {0x0000785c, 0x00000000},
+        {0x00007860, 0x56400000},
+        {0x00007864, 0x0a8e370e},
+        {0x00007868, 0xc0102850},
+        {0x0000786c, 0x812d4000},
+        {0x00007870, 0x807ec400},
+        {0x00007874, 0x001b6db0},
+        {0x00007878, 0x00376b63},
+        {0x0000787c, 0x06db6db6},
+        {0x00007880, 0x006d8000},
+        {0x00007884, 0xffeffffe},
+        {0x00007888, 0xffeffffe},
+        {0x0000788c, 0x00010000},
+        {0x00007890, 0x02060aeb},
+        {0x00007894, 0x5a108000},
+};
+
+static const u32 ar9300_2p2_baseband_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a012e},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0},
+        {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x06903881},
+        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
+        {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
+        {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
+        {0x00009e00, 0x0372161e, 0x0372161e, 0x037216a0, 0x037216a0},
+        {0x00009e04, 0x00802020, 0x00802020, 0x00802020, 0x00802020},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec84d2e},
+        {0x00009e14, 0x31395d5e, 0x3139605e, 0x3139605e, 0x31395d5e},
+        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+        {0x00009e44, 0x02321e27, 0x02321e27, 0x02291e27, 0x02291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
+        {0x0000a204, 0x000037c0, 0x000037c4, 0x000037c4, 0x000037c0},
+        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
+        {0x0000a230, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b},
+        {0x0000a234, 0x00000fff, 0x10000fff, 0x10000fff, 0x00000fff},
+        {0x0000a238, 0xffb81018, 0xffb81018, 0xffb81018, 0xffb81018},
+        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
+        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
+        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
+        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01000e0e, 0x01000e0e},
+        {0x0000a260, 0x0a021501, 0x0a021501, 0x3a021501, 0x3a021501},
+        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e},
+        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
+        {0x0000a284, 0x00000000, 0x00000000, 0x00000150, 0x00000150},
+        {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
+        {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2d0, 0x00071981, 0x00071981, 0x00071981, 0x00071982},
+        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0xf999a83a, 0xf999a83a},
+        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae04, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000b284, 0x00000000, 0x00000000, 0x00000150, 0x00000150},
+        {0x0000b830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000be04, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000be18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000be1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000be20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000c284, 0x00000000, 0x00000000, 0x00000150, 0x00000150},
+};
+
+static const u32 ar9300_2p2_baseband_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00009800, 0xafe68e30},
+        {0x00009804, 0xfd14e000},
+        {0x00009808, 0x9c0a9f6b},
+        {0x0000980c, 0x04900000},
+        {0x00009814, 0x9280c00a},
+        {0x00009818, 0x00000000},
+        {0x0000981c, 0x00020028},
+        {0x00009834, 0x5f3ca3de},
+        {0x00009838, 0x0108ecff},
+        {0x0000983c, 0x14750600},
+        {0x00009880, 0x201fff00},
+        {0x00009884, 0x00001042},
+        {0x000098a4, 0x00200400},
+        {0x000098b0, 0x52440bbe},
+        {0x000098d0, 0x004b6a8e},
+        {0x000098d4, 0x00000820},
+        {0x000098dc, 0x00000000},
+        {0x000098f0, 0x00000000},
+        {0x000098f4, 0x00000000},
+        {0x00009c04, 0xff55ff55},
+        {0x00009c08, 0x0320ff55},
+        {0x00009c0c, 0x00000000},
+        {0x00009c10, 0x00000000},
+        {0x00009c14, 0x00046384},
+        {0x00009c18, 0x05b6b440},
+        {0x00009c1c, 0x00b6b440},
+        {0x00009d00, 0xc080a333},
+        {0x00009d04, 0x40206c10},
+        {0x00009d08, 0x009c4060},
+        {0x00009d0c, 0x9883800a},
+        {0x00009d10, 0x01834061},
+        {0x00009d14, 0x00c0040b},
+        {0x00009d18, 0x00000000},
+        {0x00009e08, 0x0038230c},
+        {0x00009e24, 0x990bb515},
+        {0x00009e28, 0x0c6f0000},
+        {0x00009e30, 0x06336f77},
+        {0x00009e34, 0x6af6532f},
+        {0x00009e38, 0x0cc80c00},
+        {0x00009e3c, 0xcf946222},
+        {0x00009e40, 0x0d261820},
+        {0x00009e4c, 0x00001004},
+        {0x00009e50, 0x00ff03f1},
+        {0x00009e54, 0x00000000},
+        {0x00009fc0, 0x803e4788},
+        {0x00009fc4, 0x0001efb5},
+        {0x00009fcc, 0x40000014},
+        {0x00009fd0, 0x01193b93},
+        {0x0000a20c, 0x00000000},
+        {0x0000a220, 0x00000000},
+        {0x0000a224, 0x00000000},
+        {0x0000a228, 0x10002310},
+        {0x0000a22c, 0x01036a1e},
+        {0x0000a23c, 0x00000000},
+        {0x0000a244, 0x0c000000},
+        {0x0000a2a0, 0x00000001},
+        {0x0000a2c0, 0x00000001},
+        {0x0000a2c8, 0x00000000},
+        {0x0000a2cc, 0x18c43433},
+        {0x0000a2d4, 0x00000000},
+        {0x0000a2dc, 0x00000000},
+        {0x0000a2e0, 0x00000000},
+        {0x0000a2e4, 0x00000000},
+        {0x0000a2e8, 0x00000000},
+        {0x0000a2ec, 0x00000000},
+        {0x0000a2f0, 0x00000000},
+        {0x0000a2f4, 0x00000000},
+        {0x0000a2f8, 0x00000000},
+        {0x0000a344, 0x00000000},
+        {0x0000a34c, 0x00000000},
+        {0x0000a350, 0x0000a000},
+        {0x0000a364, 0x00000000},
+        {0x0000a370, 0x00000000},
+        {0x0000a390, 0x00000001},
+        {0x0000a394, 0x00000444},
+        {0x0000a398, 0x001f0e0f},
+        {0x0000a39c, 0x0075393f},
+        {0x0000a3a0, 0xb79f6427},
+        {0x0000a3a4, 0x00000000},
+        {0x0000a3a8, 0xaaaaaaaa},
+        {0x0000a3ac, 0x3c466478},
+        {0x0000a3c0, 0x20202020},
+        {0x0000a3c4, 0x22222220},
+        {0x0000a3c8, 0x20200020},
+        {0x0000a3cc, 0x20202020},
+        {0x0000a3d0, 0x20202020},
+        {0x0000a3d4, 0x20202020},
+        {0x0000a3d8, 0x20202020},
+        {0x0000a3dc, 0x20202020},
+        {0x0000a3e0, 0x20202020},
+        {0x0000a3e4, 0x20202020},
+        {0x0000a3e8, 0x20202020},
+        {0x0000a3ec, 0x20202020},
+        {0x0000a3f0, 0x00000000},
+        {0x0000a3f4, 0x00000246},
+        {0x0000a3f8, 0x0cdbd380},
+        {0x0000a3fc, 0x000f0f01},
+        {0x0000a400, 0x8fa91f01},
+        {0x0000a404, 0x00000000},
+        {0x0000a408, 0x0e79e5c6},
+        {0x0000a40c, 0x00820820},
+        {0x0000a414, 0x1ce739ce},
+        {0x0000a418, 0x2d001dce},
+        {0x0000a41c, 0x1ce739ce},
+        {0x0000a420, 0x000001ce},
+        {0x0000a424, 0x1ce739ce},
+        {0x0000a428, 0x000001ce},
+        {0x0000a42c, 0x1ce739ce},
+        {0x0000a430, 0x1ce739ce},
+        {0x0000a434, 0x00000000},
+        {0x0000a438, 0x00001801},
+        {0x0000a43c, 0x00000000},
+        {0x0000a440, 0x00000000},
+        {0x0000a444, 0x00000000},
+        {0x0000a448, 0x06000080},
+        {0x0000a44c, 0x00000001},
+        {0x0000a450, 0x00010000},
+        {0x0000a458, 0x00000000},
+        {0x0000a600, 0x00000000},
+        {0x0000a604, 0x00000000},
+        {0x0000a608, 0x00000000},
+        {0x0000a60c, 0x00000000},
+        {0x0000a610, 0x00000000},
+        {0x0000a614, 0x00000000},
+        {0x0000a618, 0x00000000},
+        {0x0000a61c, 0x00000000},
+        {0x0000a620, 0x00000000},
+        {0x0000a624, 0x00000000},
+        {0x0000a628, 0x00000000},
+        {0x0000a62c, 0x00000000},
+        {0x0000a630, 0x00000000},
+        {0x0000a634, 0x00000000},
+        {0x0000a638, 0x00000000},
+        {0x0000a63c, 0x00000000},
+        {0x0000a640, 0x00000000},
+        {0x0000a644, 0x3fad9d74},
+        {0x0000a648, 0x0048060a},
+        {0x0000a64c, 0x00000637},
+        {0x0000a670, 0x03020100},
+        {0x0000a674, 0x09080504},
+        {0x0000a678, 0x0d0c0b0a},
+        {0x0000a67c, 0x13121110},
+        {0x0000a680, 0x31301514},
+        {0x0000a684, 0x35343332},
+        {0x0000a688, 0x00000036},
+        {0x0000a690, 0x00000838},
+        {0x0000a7c0, 0x00000000},
+        {0x0000a7c4, 0xfffffffc},
+        {0x0000a7c8, 0x00000000},
+        {0x0000a7cc, 0x00000000},
+        {0x0000a7d0, 0x00000000},
+        {0x0000a7d4, 0x00000004},
+        {0x0000a7dc, 0x00000001},
+        {0x0000a8d0, 0x004b6a8e},
+        {0x0000a8d4, 0x00000820},
+        {0x0000a8dc, 0x00000000},
+        {0x0000a8f0, 0x00000000},
+        {0x0000a8f4, 0x00000000},
+        {0x0000b2d0, 0x00000080},
+        {0x0000b2d4, 0x00000000},
+        {0x0000b2dc, 0x00000000},
+        {0x0000b2e0, 0x00000000},
+        {0x0000b2e4, 0x00000000},
+        {0x0000b2e8, 0x00000000},
+        {0x0000b2ec, 0x00000000},
+        {0x0000b2f0, 0x00000000},
+        {0x0000b2f4, 0x00000000},
+        {0x0000b2f8, 0x00000000},
+        {0x0000b408, 0x0e79e5c0},
+        {0x0000b40c, 0x00820820},
+        {0x0000b420, 0x00000000},
+        {0x0000b8d0, 0x004b6a8e},
+        {0x0000b8d4, 0x00000820},
+        {0x0000b8dc, 0x00000000},
+        {0x0000b8f0, 0x00000000},
+        {0x0000b8f4, 0x00000000},
+        {0x0000c2d0, 0x00000080},
+        {0x0000c2d4, 0x00000000},
+        {0x0000c2dc, 0x00000000},
+        {0x0000c2e0, 0x00000000},
+        {0x0000c2e4, 0x00000000},
+        {0x0000c2e8, 0x00000000},
+        {0x0000c2ec, 0x00000000},
+        {0x0000c2f0, 0x00000000},
+        {0x0000c2f4, 0x00000000},
+        {0x0000c2f8, 0x00000000},
+        {0x0000c408, 0x0e79e5c0},
+        {0x0000c40c, 0x00820820},
+        {0x0000c420, 0x00000000},
+};
+
+static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
+        {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
+        {0x0000a508, 0x09002421, 0x09002421, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x0d002621, 0x0d002621, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x13004620, 0x13004620, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x19004a20, 0x19004a20, 0x11000400, 0x11000400},
+        {0x0000a518, 0x1d004e20, 0x1d004e20, 0x15000402, 0x15000402},
+        {0x0000a51c, 0x21005420, 0x21005420, 0x19000404, 0x19000404},
+        {0x0000a520, 0x26005e20, 0x26005e20, 0x1b000603, 0x1b000603},
+        {0x0000a524, 0x2b005e40, 0x2b005e40, 0x1f000a02, 0x1f000a02},
+        {0x0000a528, 0x2f005e42, 0x2f005e42, 0x23000a04, 0x23000a04},
+        {0x0000a52c, 0x33005e44, 0x33005e44, 0x26000a20, 0x26000a20},
+        {0x0000a530, 0x38005e65, 0x38005e65, 0x2a000e20, 0x2a000e20},
+        {0x0000a534, 0x3c005e69, 0x3c005e69, 0x2e000e22, 0x2e000e22},
+        {0x0000a538, 0x40005e6b, 0x40005e6b, 0x31000e24, 0x31000e24},
+        {0x0000a53c, 0x44005e6d, 0x44005e6d, 0x34001640, 0x34001640},
+        {0x0000a540, 0x49005e72, 0x49005e72, 0x38001660, 0x38001660},
+        {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x3b001861, 0x3b001861},
+        {0x0000a548, 0x53005f12, 0x53005f12, 0x3e001a81, 0x3e001a81},
+        {0x0000a54c, 0x59025eb5, 0x59025eb5, 0x42001a83, 0x42001a83},
+        {0x0000a550, 0x5e025f12, 0x5e025f12, 0x44001c84, 0x44001c84},
+        {0x0000a554, 0x61027f12, 0x61027f12, 0x48001ce3, 0x48001ce3},
+        {0x0000a558, 0x6702bf12, 0x6702bf12, 0x4c001ce5, 0x4c001ce5},
+        {0x0000a55c, 0x6b02bf14, 0x6b02bf14, 0x50001ce9, 0x50001ce9},
+        {0x0000a560, 0x6f02bf16, 0x6f02bf16, 0x54001ceb, 0x54001ceb},
+        {0x0000a564, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a56c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a570, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a574, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a578, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a57c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a580, 0x00802220, 0x00802220, 0x00800000, 0x00800000},
+        {0x0000a584, 0x04802222, 0x04802222, 0x04800002, 0x04800002},
+        {0x0000a588, 0x09802421, 0x09802421, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x0d802621, 0x0d802621, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x13804620, 0x13804620, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x19804a20, 0x19804a20, 0x11800400, 0x11800400},
+        {0x0000a598, 0x1d804e20, 0x1d804e20, 0x15800402, 0x15800402},
+        {0x0000a59c, 0x21805420, 0x21805420, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x26805e20, 0x26805e20, 0x1b800603, 0x1b800603},
+        {0x0000a5a4, 0x2b805e40, 0x2b805e40, 0x1f800a02, 0x1f800a02},
+        {0x0000a5a8, 0x2f805e42, 0x2f805e42, 0x23800a04, 0x23800a04},
+        {0x0000a5ac, 0x33805e44, 0x33805e44, 0x26800a20, 0x26800a20},
+        {0x0000a5b0, 0x38805e65, 0x38805e65, 0x2a800e20, 0x2a800e20},
+        {0x0000a5b4, 0x3c805e69, 0x3c805e69, 0x2e800e22, 0x2e800e22},
+        {0x0000a5b8, 0x40805e6b, 0x40805e6b, 0x31800e24, 0x31800e24},
+        {0x0000a5bc, 0x44805e6d, 0x44805e6d, 0x34801640, 0x34801640},
+        {0x0000a5c0, 0x49805e72, 0x49805e72, 0x38801660, 0x38801660},
+        {0x0000a5c4, 0x4e805eb2, 0x4e805eb2, 0x3b801861, 0x3b801861},
+        {0x0000a5c8, 0x53805f12, 0x53805f12, 0x3e801a81, 0x3e801a81},
+        {0x0000a5cc, 0x59825eb2, 0x59825eb2, 0x42801a83, 0x42801a83},
+        {0x0000a5d0, 0x5e825f12, 0x5e825f12, 0x44801c84, 0x44801c84},
+        {0x0000a5d4, 0x61827f12, 0x61827f12, 0x48801ce3, 0x48801ce3},
+        {0x0000a5d8, 0x6782bf12, 0x6782bf12, 0x4c801ce5, 0x4c801ce5},
+        {0x0000a5dc, 0x6b82bf14, 0x6b82bf14, 0x50801ce9, 0x50801ce9},
+        {0x0000a5e0, 0x6f82bf16, 0x6f82bf16, 0x54801ceb, 0x54801ceb},
+        {0x0000a5e4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5e8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5ec, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f0, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5fc, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x00016044, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
+        {0x00016048, 0xae480001, 0xae480001, 0xae480001, 0xae480001},
+        {0x00016068, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
+        {0x00016444, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
+        {0x00016448, 0xae480001, 0xae480001, 0xae480001, 0xae480001},
+        {0x00016468, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
+        {0x00016844, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
+        {0x00016848, 0xae480001, 0xae480001, 0xae480001, 0xae480001},
+        {0x00016868, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
+};
+
+static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p2[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
+        {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
+        {0x0000a508, 0x09002421, 0x09002421, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x0d002621, 0x0d002621, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x13004620, 0x13004620, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x19004a20, 0x19004a20, 0x11000400, 0x11000400},
+        {0x0000a518, 0x1d004e20, 0x1d004e20, 0x15000402, 0x15000402},
+        {0x0000a51c, 0x21005420, 0x21005420, 0x19000404, 0x19000404},
+        {0x0000a520, 0x26005e20, 0x26005e20, 0x1b000603, 0x1b000603},
+        {0x0000a524, 0x2b005e40, 0x2b005e40, 0x1f000a02, 0x1f000a02},
+        {0x0000a528, 0x2f005e42, 0x2f005e42, 0x23000a04, 0x23000a04},
+        {0x0000a52c, 0x33005e44, 0x33005e44, 0x26000a20, 0x26000a20},
+        {0x0000a530, 0x38005e65, 0x38005e65, 0x2a000e20, 0x2a000e20},
+        {0x0000a534, 0x3c005e69, 0x3c005e69, 0x2e000e22, 0x2e000e22},
+        {0x0000a538, 0x40005e6b, 0x40005e6b, 0x31000e24, 0x31000e24},
+        {0x0000a53c, 0x44005e6d, 0x44005e6d, 0x34001640, 0x34001640},
+        {0x0000a540, 0x49005e72, 0x49005e72, 0x38001660, 0x38001660},
+        {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x3b001861, 0x3b001861},
+        {0x0000a548, 0x53005f12, 0x53005f12, 0x3e001a81, 0x3e001a81},
+        {0x0000a54c, 0x59025eb5, 0x59025eb5, 0x42001a83, 0x42001a83},
+        {0x0000a550, 0x5e025f12, 0x5e025f12, 0x44001c84, 0x44001c84},
+        {0x0000a554, 0x61027f12, 0x61027f12, 0x48001ce3, 0x48001ce3},
+        {0x0000a558, 0x6702bf12, 0x6702bf12, 0x4c001ce5, 0x4c001ce5},
+        {0x0000a55c, 0x6b02bf14, 0x6b02bf14, 0x50001ce9, 0x50001ce9},
+        {0x0000a560, 0x6f02bf16, 0x6f02bf16, 0x54001ceb, 0x54001ceb},
+        {0x0000a564, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a56c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a570, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a574, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a578, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a57c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a580, 0x00802220, 0x00802220, 0x00800000, 0x00800000},
+        {0x0000a584, 0x04802222, 0x04802222, 0x04800002, 0x04800002},
+        {0x0000a588, 0x09802421, 0x09802421, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x0d802621, 0x0d802621, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x13804620, 0x13804620, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x19804a20, 0x19804a20, 0x11800400, 0x11800400},
+        {0x0000a598, 0x1d804e20, 0x1d804e20, 0x15800402, 0x15800402},
+        {0x0000a59c, 0x21805420, 0x21805420, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x26805e20, 0x26805e20, 0x1b800603, 0x1b800603},
+        {0x0000a5a4, 0x2b805e40, 0x2b805e40, 0x1f800a02, 0x1f800a02},
+        {0x0000a5a8, 0x2f805e42, 0x2f805e42, 0x23800a04, 0x23800a04},
+        {0x0000a5ac, 0x33805e44, 0x33805e44, 0x26800a20, 0x26800a20},
+        {0x0000a5b0, 0x38805e65, 0x38805e65, 0x2a800e20, 0x2a800e20},
+        {0x0000a5b4, 0x3c805e69, 0x3c805e69, 0x2e800e22, 0x2e800e22},
+        {0x0000a5b8, 0x40805e6b, 0x40805e6b, 0x31800e24, 0x31800e24},
+        {0x0000a5bc, 0x44805e6d, 0x44805e6d, 0x34801640, 0x34801640},
+        {0x0000a5c0, 0x49805e72, 0x49805e72, 0x38801660, 0x38801660},
+        {0x0000a5c4, 0x4e805eb2, 0x4e805eb2, 0x3b801861, 0x3b801861},
+        {0x0000a5c8, 0x53805f12, 0x53805f12, 0x3e801a81, 0x3e801a81},
+        {0x0000a5cc, 0x59825eb2, 0x59825eb2, 0x42801a83, 0x42801a83},
+        {0x0000a5d0, 0x5e825f12, 0x5e825f12, 0x44801c84, 0x44801c84},
+        {0x0000a5d4, 0x61827f12, 0x61827f12, 0x48801ce3, 0x48801ce3},
+        {0x0000a5d8, 0x6782bf12, 0x6782bf12, 0x4c801ce5, 0x4c801ce5},
+        {0x0000a5dc, 0x6b82bf14, 0x6b82bf14, 0x50801ce9, 0x50801ce9},
+        {0x0000a5e0, 0x6f82bf16, 0x6f82bf16, 0x54801ceb, 0x54801ceb},
+        {0x0000a5e4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5e8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5ec, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f0, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5fc, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x00016044, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
+        {0x00016048, 0x8e480001, 0x8e480001, 0x8e480001, 0x8e480001},
+        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016444, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
+        {0x00016448, 0x8e480001, 0x8e480001, 0x8e480001, 0x8e480001},
+        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016844, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
+        {0x00016848, 0x8e480001, 0x8e480001, 0x8e480001, 0x8e480001},
+        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+};
+
+static const u32 ar9300Common_rx_gain_table_2p2[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x01910190},
+        {0x0000a030, 0x01930192},
+        {0x0000a034, 0x01950194},
+        {0x0000a038, 0x038a0196},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x22222229},
+        {0x0000a084, 0x1d1d1d1d},
+        {0x0000a088, 0x1d1d1d1d},
+        {0x0000a08c, 0x1d1d1d1d},
+        {0x0000a090, 0x171d1d1d},
+        {0x0000a094, 0x11111717},
+        {0x0000a098, 0x00030311},
+        {0x0000a09c, 0x00000000},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x32323232},
+        {0x0000b084, 0x2f2f3232},
+        {0x0000b088, 0x23282a2d},
+        {0x0000b08c, 0x1c1e2123},
+        {0x0000b090, 0x14171919},
+        {0x0000b094, 0x0e0e1214},
+        {0x0000b098, 0x03050707},
+        {0x0000b09c, 0x00030303},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+
+static const u32 ar9300Modes_low_ob_db_tx_gain_table_2p2[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
+        {0x0000a518, 0x21002220, 0x21002220, 0x16000402, 0x16000402},
+        {0x0000a51c, 0x27002223, 0x27002223, 0x19000404, 0x19000404},
+        {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
+        {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
+        {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
+        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
+        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
+        {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
+        {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
+        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
+        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
+        {0x0000a544, 0x5302266c, 0x5302266c, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x5702286c, 0x5702286c, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x5c02486b, 0x5c02486b, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x61024a6c, 0x61024a6c, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x66026a6c, 0x66026a6c, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x6b026e6c, 0x6b026e6c, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x7002708c, 0x7002708c, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x7302b08a, 0x7302b08a, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
+        {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x1c800223, 0x1c800223, 0x12800400, 0x12800400},
+        {0x0000a598, 0x21802220, 0x21802220, 0x16800402, 0x16800402},
+        {0x0000a59c, 0x27802223, 0x27802223, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1c800603, 0x1c800603},
+        {0x0000a5a4, 0x2f822222, 0x2f822222, 0x21800a02, 0x21800a02},
+        {0x0000a5a8, 0x34822225, 0x34822225, 0x25800a04, 0x25800a04},
+        {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x28800a20, 0x28800a20},
+        {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2c800e20, 0x2c800e20},
+        {0x0000a5b4, 0x4282242a, 0x4282242a, 0x30800e22, 0x30800e22},
+        {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24},
+        {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640},
+        {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660},
+        {0x0000a5c4, 0x5382266c, 0x5382266c, 0x3f801861, 0x3f801861},
+        {0x0000a5c8, 0x5782286c, 0x5782286c, 0x43801a81, 0x43801a81},
+        {0x0000a5cc, 0x5c82486b, 0x5c82486b, 0x47801a83, 0x47801a83},
+        {0x0000a5d0, 0x61824a6c, 0x61824a6c, 0x4a801c84, 0x4a801c84},
+        {0x0000a5d4, 0x66826a6c, 0x66826a6c, 0x4e801ce3, 0x4e801ce3},
+        {0x0000a5d8, 0x6b826e6c, 0x6b826e6c, 0x52801ce5, 0x52801ce5},
+        {0x0000a5dc, 0x7082708c, 0x7082708c, 0x56801ce9, 0x56801ce9},
+        {0x0000a5e0, 0x7382b08a, 0x7382b08a, 0x5a801ceb, 0x5a801ceb},
+        {0x0000a5e4, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5e8, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5ec, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f0, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f4, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f8, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5fc, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016048, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
+        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016448, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
+        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016848, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
+        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+};
+
+static const u32 ar9300_2p2_mac_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00000008, 0x00000000},
+        {0x00000030, 0x00020085},
+        {0x00000034, 0x00000005},
+        {0x00000040, 0x00000000},
+        {0x00000044, 0x00000000},
+        {0x00000048, 0x00000008},
+        {0x0000004c, 0x00000010},
+        {0x00000050, 0x00000000},
+        {0x00001040, 0x002ffc0f},
+        {0x00001044, 0x002ffc0f},
+        {0x00001048, 0x002ffc0f},
+        {0x0000104c, 0x002ffc0f},
+        {0x00001050, 0x002ffc0f},
+        {0x00001054, 0x002ffc0f},
+        {0x00001058, 0x002ffc0f},
+        {0x0000105c, 0x002ffc0f},
+        {0x00001060, 0x002ffc0f},
+        {0x00001064, 0x002ffc0f},
+        {0x000010f0, 0x00000100},
+        {0x00001270, 0x00000000},
+        {0x000012b0, 0x00000000},
+        {0x000012f0, 0x00000000},
+        {0x0000143c, 0x00000000},
+        {0x0000147c, 0x00000000},
+        {0x00008000, 0x00000000},
+        {0x00008004, 0x00000000},
+        {0x00008008, 0x00000000},
+        {0x0000800c, 0x00000000},
+        {0x00008018, 0x00000000},
+        {0x00008020, 0x00000000},
+        {0x00008038, 0x00000000},
+        {0x0000803c, 0x00000000},
+        {0x00008040, 0x00000000},
+        {0x00008044, 0x00000000},
+        {0x00008048, 0x00000000},
+        {0x0000804c, 0xffffffff},
+        {0x00008054, 0x00000000},
+        {0x00008058, 0x00000000},
+        {0x0000805c, 0x000fc78f},
+        {0x00008060, 0x0000000f},
+        {0x00008064, 0x00000000},
+        {0x00008070, 0x00000310},
+        {0x00008074, 0x00000020},
+        {0x00008078, 0x00000000},
+        {0x0000809c, 0x0000000f},
+        {0x000080a0, 0x00000000},
+        {0x000080a4, 0x02ff0000},
+        {0x000080a8, 0x0e070605},
+        {0x000080ac, 0x0000000d},
+        {0x000080b0, 0x00000000},
+        {0x000080b4, 0x00000000},
+        {0x000080b8, 0x00000000},
+        {0x000080bc, 0x00000000},
+        {0x000080c0, 0x2a800000},
+        {0x000080c4, 0x06900168},
+        {0x000080c8, 0x13881c20},
+        {0x000080cc, 0x01f40000},
+        {0x000080d0, 0x00252500},
+        {0x000080d4, 0x00a00000},
+        {0x000080d8, 0x00400000},
+        {0x000080dc, 0x00000000},
+        {0x000080e0, 0xffffffff},
+        {0x000080e4, 0x0000ffff},
+        {0x000080e8, 0x3f3f3f3f},
+        {0x000080ec, 0x00000000},
+        {0x000080f0, 0x00000000},
+        {0x000080f4, 0x00000000},
+        {0x000080fc, 0x00020000},
+        {0x00008100, 0x00000000},
+        {0x00008108, 0x00000052},
+        {0x0000810c, 0x00000000},
+        {0x00008110, 0x00000000},
+        {0x00008114, 0x000007ff},
+        {0x00008118, 0x000000aa},
+        {0x0000811c, 0x00003210},
+        {0x00008124, 0x00000000},
+        {0x00008128, 0x00000000},
+        {0x0000812c, 0x00000000},
+        {0x00008130, 0x00000000},
+        {0x00008134, 0x00000000},
+        {0x00008138, 0x00000000},
+        {0x0000813c, 0x0000ffff},
+        {0x00008144, 0xffffffff},
+        {0x00008168, 0x00000000},
+        {0x0000816c, 0x00000000},
+        {0x00008170, 0x18486200},
+        {0x00008174, 0x33332210},
+        {0x00008178, 0x00000000},
+        {0x0000817c, 0x00020000},
+        {0x000081c0, 0x00000000},
+        {0x000081c4, 0x33332210},
+        {0x000081c8, 0x00000000},
+        {0x000081cc, 0x00000000},
+        {0x000081d4, 0x00000000},
+        {0x000081ec, 0x00000000},
+        {0x000081f0, 0x00000000},
+        {0x000081f4, 0x00000000},
+        {0x000081f8, 0x00000000},
+        {0x000081fc, 0x00000000},
+        {0x00008240, 0x00100000},
+        {0x00008244, 0x0010f424},
+        {0x00008248, 0x00000800},
+        {0x0000824c, 0x0001e848},
+        {0x00008250, 0x00000000},
+        {0x00008254, 0x00000000},
+        {0x00008258, 0x00000000},
+        {0x0000825c, 0x40000000},
+        {0x00008260, 0x00080922},
+        {0x00008264, 0x9bc00010},
+        {0x00008268, 0xffffffff},
+        {0x0000826c, 0x0000ffff},
+        {0x00008270, 0x00000000},
+        {0x00008274, 0x40000000},
+        {0x00008278, 0x003e4180},
+        {0x0000827c, 0x00000004},
+        {0x00008284, 0x0000002c},
+        {0x00008288, 0x0000002c},
+        {0x0000828c, 0x000000ff},
+        {0x00008294, 0x00000000},
+        {0x00008298, 0x00000000},
+        {0x0000829c, 0x00000000},
+        {0x00008300, 0x00000140},
+        {0x00008314, 0x00000000},
+        {0x0000831c, 0x0000010d},
+        {0x00008328, 0x00000000},
+        {0x0000832c, 0x00000007},
+        {0x00008330, 0x00000302},
+        {0x00008334, 0x00000700},
+        {0x00008338, 0x00ff0000},
+        {0x0000833c, 0x02400000},
+        {0x00008340, 0x000107ff},
+        {0x00008344, 0xaa48105b},
+        {0x00008348, 0x008f0000},
+        {0x0000835c, 0x00000000},
+        {0x00008360, 0xffffffff},
+        {0x00008364, 0xffffffff},
+        {0x00008368, 0x00000000},
+        {0x00008370, 0x00000000},
+        {0x00008374, 0x000000ff},
+        {0x00008378, 0x00000000},
+        {0x0000837c, 0x00000000},
+        {0x00008380, 0xffffffff},
+        {0x00008384, 0xffffffff},
+        {0x00008390, 0xffffffff},
+        {0x00008394, 0xffffffff},
+        {0x00008398, 0x00000000},
+        {0x0000839c, 0x00000000},
+        {0x000083a0, 0x00000000},
+        {0x000083a4, 0x0000fa14},
+        {0x000083a8, 0x000f0c00},
+        {0x000083ac, 0x33332210},
+        {0x000083b0, 0x33332210},
+        {0x000083b4, 0x33332210},
+        {0x000083b8, 0x33332210},
+        {0x000083bc, 0x00000000},
+        {0x000083c0, 0x00000000},
+        {0x000083c4, 0x00000000},
+        {0x000083c8, 0x00000000},
+        {0x000083cc, 0x00000200},
+        {0x000083d0, 0x000301ff},
+};
+
+static const u32 ar9300Common_wo_xlna_rx_gain_table_2p2[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x03820190},
+        {0x0000a030, 0x03840383},
+        {0x0000a034, 0x03880385},
+        {0x0000a038, 0x038a0389},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x29292929},
+        {0x0000a084, 0x29292929},
+        {0x0000a088, 0x29292929},
+        {0x0000a08c, 0x29292929},
+        {0x0000a090, 0x22292929},
+        {0x0000a094, 0x1d1d2222},
+        {0x0000a098, 0x0c111117},
+        {0x0000a09c, 0x00030303},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x32323232},
+        {0x0000b084, 0x2f2f3232},
+        {0x0000b088, 0x23282a2d},
+        {0x0000b08c, 0x1c1e2123},
+        {0x0000b090, 0x14171919},
+        {0x0000b094, 0x0e0e1214},
+        {0x0000b098, 0x03050707},
+        {0x0000b09c, 0x00030303},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+
+static const u32 ar9300_2p2_soc_preamble[][2] = {
+        /* Addr      allmodes  */
+        {0x000040a4, 0x00a0c1c9},
+        {0x00007008, 0x00000000},
+        {0x00007020, 0x00000000},
+        {0x00007034, 0x00000002},
+        {0x00007038, 0x000004c2},
+        {0x00007048, 0x00000008},
+};
+
+static const u32 ar9300PciePhy_pll_on_clkreq_disable_L1_2p2[][2] = {
+        /* Addr      allmodes  */
+        {0x00004040, 0x08212e5e},
+        {0x00004040, 0x0008003b},
+        {0x00004044, 0x00000000},
+};
+
+static const u32 ar9300PciePhy_clkreq_enable_L1_2p2[][2] = {
+        /* Addr      allmodes  */
+        {0x00004040, 0x08253e5e},
+        {0x00004040, 0x0008003b},
+        {0x00004044, 0x00000000},
+};
+
+static const u32 ar9300PciePhy_clkreq_disable_L1_2p2[][2] = {
+        /* Addr      allmodes  */
+        {0x00004040, 0x08213e5e},
+        {0x00004040, 0x0008003b},
+        {0x00004044, 0x00000000},
+};
+
+#endif /* INITVALS_9003_2P2_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 56a9e5fa6d66..5a0650399136 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -739,6 +739,12 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
          */
         ar9003_hw_set_chain_masks(ah, 0x7, 0x7);
 
+        /* Do Tx IQ Calibration */
+        ar9003_hw_tx_iq_cal(ah);
+        REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
+        udelay(5);
+        REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+
         /* Calibrate the AGC */
         REG_WRITE(ah, AR_PHY_AGC_CONTROL,
                   REG_READ(ah, AR_PHY_AGC_CONTROL) |
@@ -753,10 +759,6 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                 return false;
         }
 
-        /* Do Tx IQ Calibration */
-        if (ah->config.tx_iq_calibration)
-                ar9003_hw_tx_iq_cal(ah);
-
         /* Revert chainmasks to their original values before NF cal */
         ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 23eb60ea5455..343c9a427acb 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -67,6 +67,7 @@ static const struct ar9300_eeprom ar9300_default = {
                   * bit2 - enable fastClock - enabled
                   * bit3 - enable doubling - enabled
                   * bit4 - enable internal regulator - disabled
+                  * bit5 - enable pa predistortion - disabled
                   */
                 .miscConfiguration = 0, /* bit0 - turn down drivestrength */
                 .eepromWriteEnableGpio = 3,
@@ -129,9 +130,11 @@ static const struct ar9300_eeprom ar9300_default = {
                 .txEndToRxOn = 0x2,
                 .txFrameToXpaOn = 0xe,
                 .thresh62 = 28,
-                .futureModal = { /* [32] */
+                .papdRateMaskHt20 = LE32(0x80c080),
+                .papdRateMaskHt40 = LE32(0x80c080),
+                .futureModal = {
                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+                        0, 0, 0, 0, 0, 0, 0, 0
                 },
          },
         .calFreqPier2G = {
@@ -326,9 +329,11 @@ static const struct ar9300_eeprom ar9300_default = {
                 .txEndToRxOn = 0x2,
                 .txFrameToXpaOn = 0xe,
                 .thresh62 = 28,
+                .papdRateMaskHt20 = LE32(0xf0e0e0),
+                .papdRateMaskHt40 = LE32(0xf0e0e0),
                 .futureModal = {
                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+                        0, 0, 0, 0, 0, 0, 0, 0
                 },
          },
         .calFreqPier5G = {
@@ -644,6 +649,8 @@ static u32 ath9k_hw_ar9300_get_eeprom(struct ath_hw *ah,
                 return (pBase->featureEnable & 0x10) >> 4;
         case EEP_SWREG:
                 return le32_to_cpu(pBase->swreg);
+        case EEP_PAPRD:
+                return !!(pBase->featureEnable & BIT(5));
         default:
                 return 0;
         }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
index 23fb353c3bba..3c533bb983c7 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -234,7 +234,9 @@ struct ar9300_modal_eep_header {
         u8 txEndToRxOn;
         u8 txFrameToXpaOn;
         u8 thresh62;
-        u8 futureModal[32];
+        __le32 papdRateMaskHt20;
+        __le32 papdRateMaskHt40;
+        u8 futureModal[24];
 } __packed;
 
 struct ar9300_cal_data_per_freq_op_loop {
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index b15309caf1da..064168909108 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -16,7 +16,8 @@
 
 #include "hw.h"
 #include "ar9003_mac.h"
-#include "ar9003_initvals.h"
+#include "ar9003_2p0_initvals.h"
+#include "ar9003_2p2_initvals.h"
 
 /* General hardware code for the AR9003 hadware family */
 
@@ -31,12 +32,8 @@ static bool ar9003_hw_macversion_supported(u32 macversion)
         return false;
 }
 
-/* AR9003 2.0 - new INI format (pre, core, post arrays per subsystem) */
-/*
- * XXX: move TX/RX gain INI to its own init_mode_gain_regs after
- * ensuring it does not affect hardware bring up
- */
-static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
+/* AR9003 2.0 */
+static void ar9003_2p0_hw_init_mode_regs(struct ath_hw *ah)
 {
         /* mac */
         INIT_INI_ARRAY(&ah->iniMac[ATH_INI_PRE], NULL, 0, 0);
@@ -106,27 +103,128 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                        3);
 }
 
+/* AR9003 2.2 */
+static void ar9003_2p2_hw_init_mode_regs(struct ath_hw *ah)
+{
+        /* mac */
+        INIT_INI_ARRAY(&ah->iniMac[ATH_INI_PRE], NULL, 0, 0);
+        INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
+                       ar9300_2p2_mac_core,
+                       ARRAY_SIZE(ar9300_2p2_mac_core), 2);
+        INIT_INI_ARRAY(&ah->iniMac[ATH_INI_POST],
+                       ar9300_2p2_mac_postamble,
+                       ARRAY_SIZE(ar9300_2p2_mac_postamble), 5);
+
+        /* bb */
+        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_PRE], NULL, 0, 0);
+        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
+                       ar9300_2p2_baseband_core,
+                       ARRAY_SIZE(ar9300_2p2_baseband_core), 2);
+        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
+                       ar9300_2p2_baseband_postamble,
+                       ARRAY_SIZE(ar9300_2p2_baseband_postamble), 5);
+
+        /* radio */
+        INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_PRE], NULL, 0, 0);
+        INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_CORE],
+                       ar9300_2p2_radio_core,
+                       ARRAY_SIZE(ar9300_2p2_radio_core), 2);
+        INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_POST],
+                       ar9300_2p2_radio_postamble,
+                       ARRAY_SIZE(ar9300_2p2_radio_postamble), 5);
+
+        /* soc */
+        INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_PRE],
+                       ar9300_2p2_soc_preamble,
+                       ARRAY_SIZE(ar9300_2p2_soc_preamble), 2);
+        INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_CORE], NULL, 0, 0);
+        INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_POST],
+                       ar9300_2p2_soc_postamble,
+                       ARRAY_SIZE(ar9300_2p2_soc_postamble), 5);
+
+        /* rx/tx gain */
+        INIT_INI_ARRAY(&ah->iniModesRxGain,
+                       ar9300Common_rx_gain_table_2p2,
+                       ARRAY_SIZE(ar9300Common_rx_gain_table_2p2), 2);
+        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                       ar9300Modes_lowest_ob_db_tx_gain_table_2p2,
+                       ARRAY_SIZE(ar9300Modes_lowest_ob_db_tx_gain_table_2p2),
+                       5);
+
+        /* Load PCIE SERDES settings from INI */
+
+        /* Awake Setting */
+
+        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                       ar9300PciePhy_pll_on_clkreq_disable_L1_2p2,
+                       ARRAY_SIZE(ar9300PciePhy_pll_on_clkreq_disable_L1_2p2),
+                       2);
+
+        /* Sleep Setting */
+
+        INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
+                       ar9300PciePhy_clkreq_enable_L1_2p2,
+                       ARRAY_SIZE(ar9300PciePhy_clkreq_enable_L1_2p2),
+                       2);
+
+        /* Fast clock modal settings */
+        INIT_INI_ARRAY(&ah->iniModesAdditional,
+                       ar9300Modes_fast_clock_2p2,
+                       ARRAY_SIZE(ar9300Modes_fast_clock_2p2),
+                       3);
+}
+
+/*
+ * The AR9003 family uses a new INI format (pre, core, post
+ * arrays per subsystem).
+ */
+static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
+{
+        if (AR_SREV_9300_20(ah))
+                ar9003_2p0_hw_init_mode_regs(ah);
+        else
+                ar9003_2p2_hw_init_mode_regs(ah);
+}
+
 static void ar9003_tx_gain_table_apply(struct ath_hw *ah)
 {
         switch (ar9003_hw_get_tx_gain_idx(ah)) {
         case 0:
         default:
-                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                               ar9300Modes_lowest_ob_db_tx_gain_table_2p0,
-                               ARRAY_SIZE(ar9300Modes_lowest_ob_db_tx_gain_table_2p0),
-                               5);
+                if (AR_SREV_9300_20(ah))
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       ar9300Modes_lowest_ob_db_tx_gain_table_2p0,
+                                       ARRAY_SIZE(ar9300Modes_lowest_ob_db_tx_gain_table_2p0),
+                                       5);
+                else
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       ar9300Modes_lowest_ob_db_tx_gain_table_2p2,
+                                       ARRAY_SIZE(ar9300Modes_lowest_ob_db_tx_gain_table_2p2),
+                                       5);
                 break;
         case 1:
-                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                               ar9300Modes_high_ob_db_tx_gain_table_2p0,
-                               ARRAY_SIZE(ar9300Modes_high_ob_db_tx_gain_table_2p0),
-                               5);
+                if (AR_SREV_9300_20(ah))
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       ar9300Modes_high_ob_db_tx_gain_table_2p0,
+                                       ARRAY_SIZE(ar9300Modes_high_ob_db_tx_gain_table_2p0),
+                                       5);
+                else
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       ar9300Modes_high_ob_db_tx_gain_table_2p2,
+                                       ARRAY_SIZE(ar9300Modes_high_ob_db_tx_gain_table_2p2),
+                                       5);
                 break;
         case 2:
-                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                               ar9300Modes_low_ob_db_tx_gain_table_2p0,
-                               ARRAY_SIZE(ar9300Modes_low_ob_db_tx_gain_table_2p0),
-                               5);
+                if (AR_SREV_9300_20(ah))
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       ar9300Modes_low_ob_db_tx_gain_table_2p0,
+                                       ARRAY_SIZE(ar9300Modes_low_ob_db_tx_gain_table_2p0),
+                                       5);
+                else
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       ar9300Modes_low_ob_db_tx_gain_table_2p2,
+                                       ARRAY_SIZE(ar9300Modes_low_ob_db_tx_gain_table_2p2),
+                                       5);
                 break;
         }
 }
@@ -136,15 +234,28 @@ static void ar9003_rx_gain_table_apply(struct ath_hw *ah)
         switch (ar9003_hw_get_rx_gain_idx(ah)) {
         case 0:
         default:
-                INIT_INI_ARRAY(&ah->iniModesRxGain, ar9300Common_rx_gain_table_2p0,
-                               ARRAY_SIZE(ar9300Common_rx_gain_table_2p0),
-                               2);
+                if (AR_SREV_9300_20(ah))
+                        INIT_INI_ARRAY(&ah->iniModesRxGain,
+                                       ar9300Common_rx_gain_table_2p0,
+                                       ARRAY_SIZE(ar9300Common_rx_gain_table_2p0),
+                                       2);
+                else
+                        INIT_INI_ARRAY(&ah->iniModesRxGain,
+                                       ar9300Common_rx_gain_table_2p2,
+                                       ARRAY_SIZE(ar9300Common_rx_gain_table_2p2),
+                                       2);
                 break;
         case 1:
-                INIT_INI_ARRAY(&ah->iniModesRxGain,
-                               ar9300Common_wo_xlna_rx_gain_table_2p0,
-                               ARRAY_SIZE(ar9300Common_wo_xlna_rx_gain_table_2p0),
-                               2);
+                if (AR_SREV_9300_20(ah))
+                        INIT_INI_ARRAY(&ah->iniModesRxGain,
+                                       ar9300Common_wo_xlna_rx_gain_table_2p0,
+                                       ARRAY_SIZE(ar9300Common_wo_xlna_rx_gain_table_2p0),
+                                       2);
+                else
+                        INIT_INI_ARRAY(&ah->iniModesRxGain,
+                                       ar9300Common_wo_xlna_rx_gain_table_2p2,
+                                       ARRAY_SIZE(ar9300Common_wo_xlna_rx_gain_table_2p2),
+                                       2);
                 break;
         }
 }
@@ -184,6 +295,26 @@ static void ar9003_hw_configpcipowersave(struct ath_hw *ah,
                 /* Several PCIe massages to ensure proper behaviour */
                 if (ah->config.pcie_waen)
                         REG_WRITE(ah, AR_WA, ah->config.pcie_waen);
+                else
+                        REG_WRITE(ah, AR_WA, ah->WARegVal);
+        }
+
+        /*
+         * Configire PCIE after Ini init. SERDES values now come from ini file
+         * This enables PCIe low power mode.
+         */
+        if (ah->config.pcieSerDesWrite) {
+                unsigned int i;
+                struct ar5416IniArray *array;
+
+                array = power_off ? &ah->iniPcieSerdes :
+                                    &ah->iniPcieSerdesLowPower;
+
+                for (i = 0; i < array->ia_rows; i++) {
+                        REG_WRITE(ah,
+                                  INI_RA(array, i, 0),
+                                  INI_RA(array, i, 1));
+                }
         }
 }
 
@@ -202,4 +333,6 @@ void ar9003_hw_attach_ops(struct ath_hw *ah)
         ar9003_hw_attach_phy_ops(ah);
         ar9003_hw_attach_calib_ops(ah);
         ar9003_hw_attach_mac_ops(ah);
+
+        ath9k_hw_attach_ani_ops_new(ah);
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index 37ba37481a47..06ef71019c12 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -90,6 +90,8 @@ static bool ar9003_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                                   MAP_ISR_S2_CST);
                         mask2 |= ((isr2 & AR_ISR_S2_TSFOOR) >>
                                   MAP_ISR_S2_TSFOOR);
+                        mask2 |= ((isr2 & AR_ISR_S2_BB_WATCHDOG) >>
+                                  MAP_ISR_S2_BB_WATCHDOG);
 
                         if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
                                 REG_WRITE(ah, AR_ISR_S2, isr2);
@@ -167,6 +169,9 @@ static bool ar9003_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
 
                         (void) REG_READ(ah, AR_ISR);
                 }
+
+                if (*masked & ATH9K_INT_BB_WATCHDOG)
+                        ar9003_hw_bb_watchdog_read(ah);
         }
 
         if (sync_cause) {
@@ -465,6 +470,14 @@ static void ar9003_hw_set11n_virtualmorefrag(struct ath_hw *ah, void *ds,
                 ads->ctl11 &= ~AR_VirtMoreFrag;
 }
 
+void ar9003_hw_set_paprd_txdesc(struct ath_hw *ah, void *ds, u8 chains)
+{
+        struct ar9003_txc *ads = ds;
+
+        ads->ctl12 |= SM(chains, AR_PAPRDChainMask);
+}
+EXPORT_SYMBOL(ar9003_hw_set_paprd_txdesc);
+
 void ar9003_hw_attach_mac_ops(struct ath_hw *hw)
 {
         struct ath_hw_ops *ops = ath9k_hw_ops(hw);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.h b/drivers/net/wireless/ath/ath9k/ar9003_mac.h
index f17558b14539..f76f27d16f77 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.h
@@ -40,6 +40,10 @@
 
 #define AR_Not_Sounding 0x20000000
 
+/* ctl 12 */
+#define AR_PAPRDChainMask       0x00000e00
+#define AR_PAPRDChainMask_S     9
+
 #define MAP_ISR_S2_CST          6
 #define MAP_ISR_S2_GTT          6
 #define MAP_ISR_S2_TIM          3
@@ -47,6 +51,7 @@
 #define MAP_ISR_S2_DTIMSYNC     7
 #define MAP_ISR_S2_DTIM         7
 #define MAP_ISR_S2_TSFOOR       4
+#define MAP_ISR_S2_BB_WATCHDOG  6
 
 #define AR9003TXC_CONST(_ds) ((const struct ar9003_txc *) _ds)
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
new file mode 100644
index 000000000000..49e0c865ce5c
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -0,0 +1,714 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "hw.h"
+#include "ar9003_phy.h"
+
+void ar9003_paprd_enable(struct ath_hw *ah, bool val)
+{
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_CTRL0_B0,
+                      AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE, !!val);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_CTRL0_B1,
+                      AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE, !!val);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_CTRL0_B2,
+                      AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE, !!val);
+}
+EXPORT_SYMBOL(ar9003_paprd_enable);
+
+static void ar9003_paprd_setup_single_table(struct ath_hw *ah)
+{
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+        struct ar9300_modal_eep_header *hdr;
+        const u32 ctrl0[3] = {
+                AR_PHY_PAPRD_CTRL0_B0,
+                AR_PHY_PAPRD_CTRL0_B1,
+                AR_PHY_PAPRD_CTRL0_B2
+        };
+        const u32 ctrl1[3] = {
+                AR_PHY_PAPRD_CTRL1_B0,
+                AR_PHY_PAPRD_CTRL1_B1,
+                AR_PHY_PAPRD_CTRL1_B2
+        };
+        u32 am_mask, ht40_mask;
+        int i;
+
+        if (ah->curchan && IS_CHAN_5GHZ(ah->curchan))
+                hdr = &eep->modalHeader5G;
+        else
+                hdr = &eep->modalHeader2G;
+
+        am_mask = le32_to_cpu(hdr->papdRateMaskHt20);
+        ht40_mask = le32_to_cpu(hdr->papdRateMaskHt40);
+
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_AM2AM, AR_PHY_PAPRD_AM2AM_MASK, am_mask);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_AM2PM, AR_PHY_PAPRD_AM2PM_MASK, am_mask);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_HT40, AR_PHY_PAPRD_HT40_MASK, ht40_mask);
+
+        for (i = 0; i < 3; i++) {
+                REG_RMW_FIELD(ah, ctrl0[i],
+                              AR_PHY_PAPRD_CTRL0_USE_SINGLE_TABLE_MASK, 1);
+                REG_RMW_FIELD(ah, ctrl1[i],
+                              AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2PM_ENABLE, 1);
+                REG_RMW_FIELD(ah, ctrl1[i],
+                              AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2AM_ENABLE, 1);
+                REG_RMW_FIELD(ah, ctrl1[i],
+                              AR_PHY_PAPRD_CTRL1_ADAPTIVE_SCALING_ENA, 0);
+                REG_RMW_FIELD(ah, ctrl1[i],
+                              AR_PHY_PAPRD_CTRL1_PA_GAIN_SCALE_FACT_MASK, 181);
+                REG_RMW_FIELD(ah, ctrl1[i],
+                              AR_PHY_PAPRD_CTRL1_PAPRD_MAG_SCALE_FACT, 361);
+                REG_RMW_FIELD(ah, ctrl1[i],
+                              AR_PHY_PAPRD_CTRL1_ADAPTIVE_SCALING_ENA, 0);
+                REG_RMW_FIELD(ah, ctrl0[i],
+                              AR_PHY_PAPRD_CTRL0_PAPRD_MAG_THRSH, 3);
+        }
+
+        ar9003_paprd_enable(ah, false);
+
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL1,
+                      AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_LB_SKIP, 0x30);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL1,
+                      AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_LB_ENABLE, 1);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL1,
+                      AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_TX_GAIN_FORCE, 1);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL1,
+                      AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_RX_BB_GAIN_FORCE, 0);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL1,
+                      AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_IQCORR_ENABLE, 0);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL1,
+                      AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_AGC2_SETTLING, 28);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL1,
+                      AR_PHY_PAPRD_TRAINER_CNTL1_CF_CF_PAPRD_TRAIN_ENABLE, 1);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL2,
+                      AR_PHY_PAPRD_TRAINER_CNTL2_CF_PAPRD_INIT_RX_BB_GAIN, 147);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_FINE_CORR_LEN, 4);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_COARSE_CORR_LEN, 4);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_NUM_CORR_STAGES, 7);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_MIN_LOOPBACK_DEL, 1);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_QUICK_DROP, -6);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_ADC_DESIRED_SIZE,
+                      -15);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_BBTXMIX_DISABLE, 1);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL4,
+                      AR_PHY_PAPRD_TRAINER_CNTL4_CF_PAPRD_SAFETY_DELTA, 0);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL4,
+                      AR_PHY_PAPRD_TRAINER_CNTL4_CF_PAPRD_MIN_CORR, 400);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL4,
+                      AR_PHY_PAPRD_TRAINER_CNTL4_CF_PAPRD_NUM_TRAIN_SAMPLES,
+                      100);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_PRE_POST_SCALE_0_B0,
+                      AR_PHY_PAPRD_PRE_POST_SCALING, 261376);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_PRE_POST_SCALE_1_B0,
+                      AR_PHY_PAPRD_PRE_POST_SCALING, 248079);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_PRE_POST_SCALE_2_B0,
+                      AR_PHY_PAPRD_PRE_POST_SCALING, 233759);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_PRE_POST_SCALE_3_B0,
+                      AR_PHY_PAPRD_PRE_POST_SCALING, 220464);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_PRE_POST_SCALE_4_B0,
+                      AR_PHY_PAPRD_PRE_POST_SCALING, 208194);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_PRE_POST_SCALE_5_B0,
+                      AR_PHY_PAPRD_PRE_POST_SCALING, 196949);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_PRE_POST_SCALE_6_B0,
+                      AR_PHY_PAPRD_PRE_POST_SCALING, 185706);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_PRE_POST_SCALE_7_B0,
+                      AR_PHY_PAPRD_PRE_POST_SCALING, 175487);
+}
+
+static void ar9003_paprd_get_gain_table(struct ath_hw *ah)
+{
+        u32 *entry = ah->paprd_gain_table_entries;
+        u8 *index = ah->paprd_gain_table_index;
+        u32 reg = AR_PHY_TXGAIN_TABLE;
+        int i;
+
+        memset(entry, 0, sizeof(ah->paprd_gain_table_entries));
+        memset(index, 0, sizeof(ah->paprd_gain_table_index));
+
+        for (i = 0; i < 32; i++) {
+                entry[i] = REG_READ(ah, reg);
+                index[i] = (entry[i] >> 24) & 0xff;
+                reg += 4;
+        }
+}
+
+static unsigned int ar9003_get_desired_gain(struct ath_hw *ah, int chain,
+                                            int target_power)
+{
+        int olpc_gain_delta = 0;
+        int alpha_therm, alpha_volt;
+        int therm_cal_value, volt_cal_value;
+        int therm_value, volt_value;
+        int thermal_gain_corr, voltage_gain_corr;
+        int desired_scale, desired_gain = 0;
+        u32 reg;
+
+        REG_CLR_BIT(ah, AR_PHY_PAPRD_TRAINER_STAT1,
+                    AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_DONE);
+        desired_scale = REG_READ_FIELD(ah, AR_PHY_TPC_12,
+                                       AR_PHY_TPC_12_DESIRED_SCALE_HT40_5);
+        alpha_therm = REG_READ_FIELD(ah, AR_PHY_TPC_19,
+                                     AR_PHY_TPC_19_ALPHA_THERM);
+        alpha_volt = REG_READ_FIELD(ah, AR_PHY_TPC_19,
+                                    AR_PHY_TPC_19_ALPHA_VOLT);
+        therm_cal_value = REG_READ_FIELD(ah, AR_PHY_TPC_18,
+                                         AR_PHY_TPC_18_THERM_CAL_VALUE);
+        volt_cal_value = REG_READ_FIELD(ah, AR_PHY_TPC_18,
+                                        AR_PHY_TPC_18_VOLT_CAL_VALUE);
+        therm_value = REG_READ_FIELD(ah, AR_PHY_BB_THERM_ADC_4,
+                                     AR_PHY_BB_THERM_ADC_4_LATEST_THERM_VALUE);
+        volt_value = REG_READ_FIELD(ah, AR_PHY_BB_THERM_ADC_4,
+                                    AR_PHY_BB_THERM_ADC_4_LATEST_VOLT_VALUE);
+
+        if (chain == 0)
+                reg = AR_PHY_TPC_11_B0;
+        else if (chain == 1)
+                reg = AR_PHY_TPC_11_B1;
+        else
+                reg = AR_PHY_TPC_11_B2;
+
+        olpc_gain_delta = REG_READ_FIELD(ah, reg,
+                                         AR_PHY_TPC_11_OLPC_GAIN_DELTA);
+
+        if (olpc_gain_delta >= 128)
+                olpc_gain_delta = olpc_gain_delta - 256;
+
+        thermal_gain_corr = (alpha_therm * (therm_value - therm_cal_value) +
+                             (256 / 2)) / 256;
+        voltage_gain_corr = (alpha_volt * (volt_value - volt_cal_value) +
+                             (128 / 2)) / 128;
+        desired_gain = target_power - olpc_gain_delta - thermal_gain_corr -
+            voltage_gain_corr + desired_scale;
+
+        return desired_gain;
+}
+
+static void ar9003_tx_force_gain(struct ath_hw *ah, unsigned int gain_index)
+{
+        int selected_gain_entry, txbb1dbgain, txbb6dbgain, txmxrgain;
+        int padrvgnA, padrvgnB, padrvgnC, padrvgnD;
+        u32 *gain_table_entries = ah->paprd_gain_table_entries;
+
+        selected_gain_entry = gain_table_entries[gain_index];
+        txbb1dbgain = selected_gain_entry & 0x7;
+        txbb6dbgain = (selected_gain_entry >> 3) & 0x3;
+        txmxrgain = (selected_gain_entry >> 5) & 0xf;
+        padrvgnA = (selected_gain_entry >> 9) & 0xf;
+        padrvgnB = (selected_gain_entry >> 13) & 0xf;
+        padrvgnC = (selected_gain_entry >> 17) & 0xf;
+        padrvgnD = (selected_gain_entry >> 21) & 0x3;
+
+        REG_RMW_FIELD(ah, AR_PHY_TX_FORCED_GAIN,
+                      AR_PHY_TX_FORCED_GAIN_FORCED_TXBB1DBGAIN, txbb1dbgain);
+        REG_RMW_FIELD(ah, AR_PHY_TX_FORCED_GAIN,
+                      AR_PHY_TX_FORCED_GAIN_FORCED_TXBB6DBGAIN, txbb6dbgain);
+        REG_RMW_FIELD(ah, AR_PHY_TX_FORCED_GAIN,
+                      AR_PHY_TX_FORCED_GAIN_FORCED_TXMXRGAIN, txmxrgain);
+        REG_RMW_FIELD(ah, AR_PHY_TX_FORCED_GAIN,
+                      AR_PHY_TX_FORCED_GAIN_FORCED_PADRVGNA, padrvgnA);
+        REG_RMW_FIELD(ah, AR_PHY_TX_FORCED_GAIN,
+                      AR_PHY_TX_FORCED_GAIN_FORCED_PADRVGNB, padrvgnB);
+        REG_RMW_FIELD(ah, AR_PHY_TX_FORCED_GAIN,
+                      AR_PHY_TX_FORCED_GAIN_FORCED_PADRVGNC, padrvgnC);
+        REG_RMW_FIELD(ah, AR_PHY_TX_FORCED_GAIN,
+                      AR_PHY_TX_FORCED_GAIN_FORCED_PADRVGND, padrvgnD);
+        REG_RMW_FIELD(ah, AR_PHY_TX_FORCED_GAIN,
+                      AR_PHY_TX_FORCED_GAIN_FORCED_ENABLE_PAL, 0);
+        REG_RMW_FIELD(ah, AR_PHY_TX_FORCED_GAIN,
+                      AR_PHY_TX_FORCED_GAIN_FORCE_TX_GAIN, 0);
+        REG_RMW_FIELD(ah, AR_PHY_TPC_1, AR_PHY_TPC_1_FORCED_DAC_GAIN, 0);
+        REG_RMW_FIELD(ah, AR_PHY_TPC_1, AR_PHY_TPC_1_FORCE_DAC_GAIN, 0);
+}
+
+static inline int find_expn(int num)
+{
+        return fls(num) - 1;
+}
+
+static inline int find_proper_scale(int expn, int N)
+{
+        return (expn > N) ? expn - 10 : 0;
+}
+
+#define NUM_BIN 23
+
+static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
+{
+        unsigned int thresh_accum_cnt;
+        int x_est[NUM_BIN + 1], Y[NUM_BIN + 1], theta[NUM_BIN + 1];
+        int PA_in[NUM_BIN + 1];
+        int B1_tmp[NUM_BIN + 1], B2_tmp[NUM_BIN + 1];
+        unsigned int B1_abs_max, B2_abs_max;
+        int max_index, scale_factor;
+        int y_est[NUM_BIN + 1];
+        int x_est_fxp1_nonlin, x_tilde[NUM_BIN + 1];
+        unsigned int x_tilde_abs;
+        int G_fxp, Y_intercept, order_x_by_y, M, I, L, sum_y_sqr, sum_y_quad;
+        int Q_x, Q_B1, Q_B2, beta_raw, alpha_raw, scale_B;
+        int Q_scale_B, Q_beta, Q_alpha, alpha, beta, order_1, order_2;
+        int order1_5x, order2_3x, order1_5x_rem, order2_3x_rem;
+        int y5, y3, tmp;
+        int theta_low_bin = 0;
+        int i;
+
+        /* disregard any bin that contains <= 16 samples */
+        thresh_accum_cnt = 16;
+        scale_factor = 5;
+        max_index = 0;
+        memset(theta, 0, sizeof(theta));
+        memset(x_est, 0, sizeof(x_est));
+        memset(Y, 0, sizeof(Y));
+        memset(y_est, 0, sizeof(y_est));
+        memset(x_tilde, 0, sizeof(x_tilde));
+
+        for (i = 0; i < NUM_BIN; i++) {
+                s32 accum_cnt, accum_tx, accum_rx, accum_ang;
+
+                /* number of samples */
+                accum_cnt = data_L[i] & 0xffff;
+
+                if (accum_cnt <= thresh_accum_cnt)
+                        continue;
+
+                /* sum(tx amplitude) */
+                accum_tx = ((data_L[i] >> 16) & 0xffff) |
+                    ((data_U[i] & 0x7ff) << 16);
+
+                /* sum(rx amplitude distance to lower bin edge) */
+                accum_rx = ((data_U[i] >> 11) & 0x1f) |
+                    ((data_L[i + 23] & 0xffff) << 5);
+
+                /* sum(angles) */
+                accum_ang = ((data_L[i + 23] >> 16) & 0xffff) |
+                    ((data_U[i + 23] & 0x7ff) << 16);
+
+                accum_tx <<= scale_factor;
+                accum_rx <<= scale_factor;
+                x_est[i + 1] = (((accum_tx + accum_cnt) / accum_cnt) + 32) >>
+                    scale_factor;
+
+                Y[i + 1] = ((((accum_rx + accum_cnt) / accum_cnt) + 32) >>
+                            scale_factor) +
+                            (1 << scale_factor) * max_index + 16;
+
+                if (accum_ang >= (1 << 26))
+                        accum_ang -= 1 << 27;
+
+                theta[i + 1] = ((accum_ang * (1 << scale_factor)) + accum_cnt) /
+                    accum_cnt;
+
+                max_index++;
+        }
+
+        /*
+         * Find average theta of first 5 bin and all of those to same value.
+         * Curve is linear at that range.
+         */
+        for (i = 1; i < 6; i++)
+                theta_low_bin += theta[i];
+
+        theta_low_bin = theta_low_bin / 5;
+        for (i = 1; i < 6; i++)
+                theta[i] = theta_low_bin;
+
+        /* Set values at origin */
+        theta[0] = theta_low_bin;
+        for (i = 0; i <= max_index; i++)
+                theta[i] -= theta_low_bin;
+
+        x_est[0] = 0;
+        Y[0] = 0;
+        scale_factor = 8;
+
+        /* low signal gain */
+        if (x_est[6] == x_est[3])
+                return false;
+
+        G_fxp =
+            (((Y[6] - Y[3]) * 1 << scale_factor) +
+             (x_est[6] - x_est[3])) / (x_est[6] - x_est[3]);
+
+        Y_intercept =
+            (G_fxp * (x_est[0] - x_est[3]) +
+             (1 << scale_factor)) / (1 << scale_factor) + Y[3];
+
+        for (i = 0; i <= max_index; i++)
+                y_est[i] = Y[i] - Y_intercept;
+
+        for (i = 0; i <= 3; i++) {
+                y_est[i] = i * 32;
+
+                /* prevent division by zero */
+                if (G_fxp == 0)
+                        return false;
+
+                x_est[i] = ((y_est[i] * 1 << scale_factor) + G_fxp) / G_fxp;
+        }
+
+        x_est_fxp1_nonlin =
+            x_est[max_index] - ((1 << scale_factor) * y_est[max_index] +
+                                G_fxp) / G_fxp;
+
+        order_x_by_y =
+            (x_est_fxp1_nonlin + y_est[max_index]) / y_est[max_index];
+
+        if (order_x_by_y == 0)
+                M = 10;
+        else if (order_x_by_y == 1)
+                M = 9;
+        else
+                M = 8;
+
+        I = (max_index > 15) ? 7 : max_index >> 1;
+        L = max_index - I;
+        scale_factor = 8;
+        sum_y_sqr = 0;
+        sum_y_quad = 0;
+        x_tilde_abs = 0;
+
+        for (i = 0; i <= L; i++) {
+                unsigned int y_sqr;
+                unsigned int y_quad;
+                unsigned int tmp_abs;
+
+                /* prevent division by zero */
+                if (y_est[i + I] == 0)
+                        return false;
+
+                x_est_fxp1_nonlin =
+                    x_est[i + I] - ((1 << scale_factor) * y_est[i + I] +
+                                    G_fxp) / G_fxp;
+
+                x_tilde[i] =
+                    (x_est_fxp1_nonlin * (1 << M) + y_est[i + I]) / y_est[i +
+                                                                          I];
+                x_tilde[i] =
+                    (x_tilde[i] * (1 << M) + y_est[i + I]) / y_est[i + I];
+                x_tilde[i] =
+                    (x_tilde[i] * (1 << M) + y_est[i + I]) / y_est[i + I];
+                y_sqr =
+                    (y_est[i + I] * y_est[i + I] +
+                     (scale_factor * scale_factor)) / (scale_factor *
+                                                       scale_factor);
+                tmp_abs = abs(x_tilde[i]);
+                if (tmp_abs > x_tilde_abs)
+                        x_tilde_abs = tmp_abs;
+
+                y_quad = y_sqr * y_sqr;
+                sum_y_sqr = sum_y_sqr + y_sqr;
+                sum_y_quad = sum_y_quad + y_quad;
+                B1_tmp[i] = y_sqr * (L + 1);
+                B2_tmp[i] = y_sqr;
+        }
+
+        B1_abs_max = 0;
+        B2_abs_max = 0;
+        for (i = 0; i <= L; i++) {
+                int abs_val;
+
+                B1_tmp[i] -= sum_y_sqr;
+                B2_tmp[i] = sum_y_quad - sum_y_sqr * B2_tmp[i];
+
+                abs_val = abs(B1_tmp[i]);
+                if (abs_val > B1_abs_max)
+                        B1_abs_max = abs_val;
+
+                abs_val = abs(B2_tmp[i]);
+                if (abs_val > B2_abs_max)
+                        B2_abs_max = abs_val;
+        }
+
+        Q_x = find_proper_scale(find_expn(x_tilde_abs), 10);
+        Q_B1 = find_proper_scale(find_expn(B1_abs_max), 10);
+        Q_B2 = find_proper_scale(find_expn(B2_abs_max), 10);
+
+        beta_raw = 0;
+        alpha_raw = 0;
+        for (i = 0; i <= L; i++) {
+                x_tilde[i] = x_tilde[i] / (1 << Q_x);
+                B1_tmp[i] = B1_tmp[i] / (1 << Q_B1);
+                B2_tmp[i] = B2_tmp[i] / (1 << Q_B2);
+                beta_raw = beta_raw + B1_tmp[i] * x_tilde[i];
+                alpha_raw = alpha_raw + B2_tmp[i] * x_tilde[i];
+        }
+
+        scale_B =
+            ((sum_y_quad / scale_factor) * (L + 1) -
+             (sum_y_sqr / scale_factor) * sum_y_sqr) * scale_factor;
+
+        Q_scale_B = find_proper_scale(find_expn(abs(scale_B)), 10);
+        scale_B = scale_B / (1 << Q_scale_B);
+        Q_beta = find_proper_scale(find_expn(abs(beta_raw)), 10);
+        Q_alpha = find_proper_scale(find_expn(abs(alpha_raw)), 10);
+        beta_raw = beta_raw / (1 << Q_beta);
+        alpha_raw = alpha_raw / (1 << Q_alpha);
+        alpha = (alpha_raw << 10) / scale_B;
+        beta = (beta_raw << 10) / scale_B;
+        order_1 = 3 * M - Q_x - Q_B1 - Q_beta + 10 + Q_scale_B;
+        order_2 = 3 * M - Q_x - Q_B2 - Q_alpha + 10 + Q_scale_B;
+        order1_5x = order_1 / 5;
+        order2_3x = order_2 / 3;
+        order1_5x_rem = order_1 - 5 * order1_5x;
+        order2_3x_rem = order_2 - 3 * order2_3x;
+
+        for (i = 0; i < PAPRD_TABLE_SZ; i++) {
+                tmp = i * 32;
+                y5 = ((beta * tmp) >> 6) >> order1_5x;
+                y5 = (y5 * tmp) >> order1_5x;
+                y5 = (y5 * tmp) >> order1_5x;
+                y5 = (y5 * tmp) >> order1_5x;
+                y5 = (y5 * tmp) >> order1_5x;
+                y5 = y5 >> order1_5x_rem;
+                y3 = (alpha * tmp) >> order2_3x;
+                y3 = (y3 * tmp) >> order2_3x;
+                y3 = (y3 * tmp) >> order2_3x;
+                y3 = y3 >> order2_3x_rem;
+                PA_in[i] = y5 + y3 + (256 * tmp) / G_fxp;
+
+                if (i >= 2) {
+                        tmp = PA_in[i] - PA_in[i - 1];
+                        if (tmp < 0)
+                                PA_in[i] =
+                                    PA_in[i - 1] + (PA_in[i - 1] -
+                                                    PA_in[i - 2]);
+                }
+
+                PA_in[i] = (PA_in[i] < 1400) ? PA_in[i] : 1400;
+        }
+
+        beta_raw = 0;
+        alpha_raw = 0;
+
+        for (i = 0; i <= L; i++) {
+                int theta_tilde =
+                    ((theta[i + I] << M) + y_est[i + I]) / y_est[i + I];
+                theta_tilde =
+                    ((theta_tilde << M) + y_est[i + I]) / y_est[i + I];
+                theta_tilde =
+                    ((theta_tilde << M) + y_est[i + I]) / y_est[i + I];
+                beta_raw = beta_raw + B1_tmp[i] * theta_tilde;
+                alpha_raw = alpha_raw + B2_tmp[i] * theta_tilde;
+        }
+
+        Q_beta = find_proper_scale(find_expn(abs(beta_raw)), 10);
+        Q_alpha = find_proper_scale(find_expn(abs(alpha_raw)), 10);
+        beta_raw = beta_raw / (1 << Q_beta);
+        alpha_raw = alpha_raw / (1 << Q_alpha);
+
+        alpha = (alpha_raw << 10) / scale_B;
+        beta = (beta_raw << 10) / scale_B;
+        order_1 = 3 * M - Q_x - Q_B1 - Q_beta + 10 + Q_scale_B + 5;
+        order_2 = 3 * M - Q_x - Q_B2 - Q_alpha + 10 + Q_scale_B + 5;
+        order1_5x = order_1 / 5;
+        order2_3x = order_2 / 3;
+        order1_5x_rem = order_1 - 5 * order1_5x;
+        order2_3x_rem = order_2 - 3 * order2_3x;
+
+        for (i = 0; i < PAPRD_TABLE_SZ; i++) {
+                int PA_angle;
+
+                /* pa_table[4] is calculated from PA_angle for i=5 */
+                if (i == 4)
+                        continue;
+
+                tmp = i * 32;
+                if (beta > 0)
+                        y5 = (((beta * tmp - 64) >> 6) -
+                              (1 << order1_5x)) / (1 << order1_5x);
+                else
+                        y5 = ((((beta * tmp - 64) >> 6) +
+                               (1 << order1_5x)) / (1 << order1_5x));
+
+                y5 = (y5 * tmp) / (1 << order1_5x);
+                y5 = (y5 * tmp) / (1 << order1_5x);
+                y5 = (y5 * tmp) / (1 << order1_5x);
+                y5 = (y5 * tmp) / (1 << order1_5x);
+                y5 = y5 / (1 << order1_5x_rem);
+
+                if (beta > 0)
+                        y3 = (alpha * tmp -
+                              (1 << order2_3x)) / (1 << order2_3x);
+                else
+                        y3 = (alpha * tmp +
+                              (1 << order2_3x)) / (1 << order2_3x);
+                y3 = (y3 * tmp) / (1 << order2_3x);
+                y3 = (y3 * tmp) / (1 << order2_3x);
+                y3 = y3 / (1 << order2_3x_rem);
+
+                if (i < 4) {
+                        PA_angle = 0;
+                } else {
+                        PA_angle = y5 + y3;
+                        if (PA_angle < -150)
+                                PA_angle = -150;
+                        else if (PA_angle > 150)
+                                PA_angle = 150;
+                }
+
+                pa_table[i] = ((PA_in[i] & 0x7ff) << 11) + (PA_angle & 0x7ff);
+                if (i == 5) {
+                        PA_angle = (PA_angle + 2) >> 1;
+                        pa_table[i - 1] = ((PA_in[i - 1] & 0x7ff) << 11) +
+                            (PA_angle & 0x7ff);
+                }
+        }
+
+        *gain = G_fxp;
+        return true;
+}
+
+void ar9003_paprd_populate_single_table(struct ath_hw *ah,
+                                        struct ath9k_channel *chan, int chain)
+{
+        u32 *paprd_table_val = chan->pa_table[chain];
+        u32 small_signal_gain = chan->small_signal_gain[chain];
+        u32 training_power;
+        u32 reg = 0;
+        int i;
+
+        training_power =
+            REG_READ_FIELD(ah, AR_PHY_POWERTX_RATE5,
+                           AR_PHY_POWERTX_RATE5_POWERTXHT20_0);
+        training_power -= 4;
+
+        if (chain == 0)
+                reg = AR_PHY_PAPRD_MEM_TAB_B0;
+        else if (chain == 1)
+                reg = AR_PHY_PAPRD_MEM_TAB_B1;
+        else if (chain == 2)
+                reg = AR_PHY_PAPRD_MEM_TAB_B2;
+
+        for (i = 0; i < PAPRD_TABLE_SZ; i++) {
+                REG_WRITE(ah, reg, paprd_table_val[i]);
+                reg = reg + 4;
+        }
+
+        if (chain == 0)
+                reg = AR_PHY_PA_GAIN123_B0;
+        else if (chain == 1)
+                reg = AR_PHY_PA_GAIN123_B1;
+        else
+                reg = AR_PHY_PA_GAIN123_B2;
+
+        REG_RMW_FIELD(ah, reg, AR_PHY_PA_GAIN123_PA_GAIN1, small_signal_gain);
+
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_CTRL1_B0,
+                      AR_PHY_PAPRD_CTRL1_PAPRD_POWER_AT_AM2AM_CAL,
+                      training_power);
+
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_CTRL1_B1,
+                      AR_PHY_PAPRD_CTRL1_PAPRD_POWER_AT_AM2AM_CAL,
+                      training_power);
+
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_CTRL1_B2,
+                      AR_PHY_PAPRD_CTRL1_PAPRD_POWER_AT_AM2AM_CAL,
+                      training_power);
+}
+EXPORT_SYMBOL(ar9003_paprd_populate_single_table);
+
+int ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain)
+{
+
+        unsigned int i, desired_gain, gain_index;
+        unsigned int train_power;
+
+        train_power = REG_READ_FIELD(ah, AR_PHY_POWERTX_RATE5,
+                                     AR_PHY_POWERTX_RATE5_POWERTXHT20_0);
+
+        train_power = train_power - 4;
+
+        desired_gain = ar9003_get_desired_gain(ah, chain, train_power);
+
+        gain_index = 0;
+        for (i = 0; i < 32; i++) {
+                if (ah->paprd_gain_table_index[i] >= desired_gain)
+                        break;
+                gain_index++;
+        }
+
+        ar9003_tx_force_gain(ah, gain_index);
+
+        REG_CLR_BIT(ah, AR_PHY_PAPRD_TRAINER_STAT1,
+                        AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_DONE);
+
+        return 0;
+}
+EXPORT_SYMBOL(ar9003_paprd_setup_gain_table);
+
+int ar9003_paprd_create_curve(struct ath_hw *ah, struct ath9k_channel *chan,
+                              int chain)
+{
+        u16 *small_signal_gain = &chan->small_signal_gain[chain];
+        u32 *pa_table = chan->pa_table[chain];
+        u32 *data_L, *data_U;
+        int i, status = 0;
+        u32 *buf;
+        u32 reg;
+
+        memset(chan->pa_table[chain], 0, sizeof(chan->pa_table[chain]));
+
+        buf = kmalloc(2 * 48 * sizeof(u32), GFP_ATOMIC);
+        if (!buf)
+                return -ENOMEM;
+
+        data_L = &buf[0];
+        data_U = &buf[48];
+
+        REG_CLR_BIT(ah, AR_PHY_CHAN_INFO_MEMORY,
+                    AR_PHY_CHAN_INFO_MEMORY_CHANINFOMEM_S2_READ);
+
+        reg = AR_PHY_CHAN_INFO_TAB_0;
+        for (i = 0; i < 48; i++)
+                data_L[i] = REG_READ(ah, reg + (i << 2));
+
+        REG_SET_BIT(ah, AR_PHY_CHAN_INFO_MEMORY,
+                    AR_PHY_CHAN_INFO_MEMORY_CHANINFOMEM_S2_READ);
+
+        for (i = 0; i < 48; i++)
+                data_U[i] = REG_READ(ah, reg + (i << 2));
+
+        if (!create_pa_curve(data_L, data_U, pa_table, small_signal_gain))
+                status = -2;
+
+        REG_CLR_BIT(ah, AR_PHY_PAPRD_TRAINER_STAT1,
+                    AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_DONE);
+
+        kfree(buf);
+
+        return status;
+}
+EXPORT_SYMBOL(ar9003_paprd_create_curve);
+
+int ar9003_paprd_init_table(struct ath_hw *ah)
+{
+        ar9003_paprd_setup_single_table(ah);
+        ar9003_paprd_get_gain_table(ah);
+        return 0;
+}
+EXPORT_SYMBOL(ar9003_paprd_init_table);
+
+bool ar9003_paprd_is_done(struct ath_hw *ah)
+{
+        return !!REG_READ_FIELD(ah, AR_PHY_PAPRD_TRAINER_STAT1,
+                                AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_DONE);
+}
+EXPORT_SYMBOL(ar9003_paprd_is_done);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 80431a2f6dc1..19bc05c41136 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -17,6 +17,28 @@
 #include "hw.h"
 #include "ar9003_phy.h"
 
+static const int firstep_table[] =
+/* level:  0   1   2   3   4   5   6   7   8  */
+        { -4, -2,  0,  2,  4,  6,  8, 10, 12 }; /* lvl 0-8, default 2 */
+
+static const int cycpwrThr1_table[] =
+/* level:  0   1   2   3   4   5   6   7   8  */
+        { -6, -4, -2,  0,  2,  4,  6,  8 };     /* lvl 0-7, default 3 */
+
+/*
+ * register values to turn OFDM weak signal detection OFF
+ */
+static const int m1ThreshLow_off = 127;
+static const int m2ThreshLow_off = 127;
+static const int m1Thresh_off = 127;
+static const int m2Thresh_off = 127;
+static const int m2CountThr_off =  31;
+static const int m2CountThrLow_off =  63;
+static const int m1ThreshLowExt_off = 127;
+static const int m2ThreshLowExt_off = 127;
+static const int m1ThreshExt_off = 127;
+static const int m2ThreshExt_off = 127;
+
 /**
  * ar9003_hw_set_channel - set channel on single-chip device
  * @ah: atheros hardware structure
@@ -94,7 +116,7 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
 }
 
 /**
- * ar9003_hw_spur_mitigate - convert baseband spur frequency
+ * ar9003_hw_spur_mitigate_mrc_cck - convert baseband spur frequency
  * @ah: atheros hardware structure
  * @chan:
  *
@@ -521,15 +543,6 @@ static void ar9003_hw_prog_ini(struct ath_hw *ah,
                 u32 val = INI_RA(iniArr, i, column);
 
                 REG_WRITE(ah, reg, val);
-
-                /*
-                 * Determine if this is a shift register value, and insert the
-                 * configured delay if so.
-                 */
-                if (reg >= 0x16000 && reg < 0x17000
-                    && ah->config.analog_shiftreg)
-                        udelay(100);
-
                 DO_DELAY(regWrites);
         }
 }
@@ -732,71 +745,68 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
 {
         struct ar5416AniState *aniState = ah->curani;
         struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_channel *chan = ah->curchan;
+        s32 value, value2;
 
         switch (cmd & ah->ani_function) {
-        case ATH9K_ANI_NOISE_IMMUNITY_LEVEL:{
-                u32 level = param;
-
-                if (level >= ARRAY_SIZE(ah->totalSizeDesired)) {
-                        ath_print(common, ATH_DBG_ANI,
-                                  "level out of range (%u > %u)\n",
-                                  level,
-                                  (unsigned)ARRAY_SIZE(ah->totalSizeDesired));
-                        return false;
-                }
-
-                REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ,
-                              AR_PHY_DESIRED_SZ_TOT_DES,
-                              ah->totalSizeDesired[level]);
-                REG_RMW_FIELD(ah, AR_PHY_AGC,
-                              AR_PHY_AGC_COARSE_LOW,
-                              ah->coarse_low[level]);
-                REG_RMW_FIELD(ah, AR_PHY_AGC,
-                              AR_PHY_AGC_COARSE_HIGH,
-                              ah->coarse_high[level]);
-                REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
-                              AR_PHY_FIND_SIG_FIRPWR, ah->firpwr[level]);
-
-                if (level > aniState->noiseImmunityLevel)
-                        ah->stats.ast_ani_niup++;
-                else if (level < aniState->noiseImmunityLevel)
-                        ah->stats.ast_ani_nidown++;
-                aniState->noiseImmunityLevel = level;
-                break;
-        }
         case ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION:{
-                const int m1ThreshLow[] = { 127, 50 };
-                const int m2ThreshLow[] = { 127, 40 };
-                const int m1Thresh[] = { 127, 0x4d };
-                const int m2Thresh[] = { 127, 0x40 };
-                const int m2CountThr[] = { 31, 16 };
-                const int m2CountThrLow[] = { 63, 48 };
+                /*
+                 * on == 1 means ofdm weak signal detection is ON
+                 * on == 1 is the default, for less noise immunity
+                 *
+                 * on == 0 means ofdm weak signal detection is OFF
+                 * on == 0 means more noise imm
+                 */
                 u32 on = param ? 1 : 0;
+                /*
+                 * make register setting for default
+                 * (weak sig detect ON) come from INI file
+                 */
+                int m1ThreshLow = on ?
+                        aniState->iniDef.m1ThreshLow : m1ThreshLow_off;
+                int m2ThreshLow = on ?
+                        aniState->iniDef.m2ThreshLow : m2ThreshLow_off;
+                int m1Thresh = on ?
+                        aniState->iniDef.m1Thresh : m1Thresh_off;
+                int m2Thresh = on ?
+                        aniState->iniDef.m2Thresh : m2Thresh_off;
+                int m2CountThr = on ?
+                        aniState->iniDef.m2CountThr : m2CountThr_off;
+                int m2CountThrLow = on ?
+                        aniState->iniDef.m2CountThrLow : m2CountThrLow_off;
+                int m1ThreshLowExt = on ?
+                        aniState->iniDef.m1ThreshLowExt : m1ThreshLowExt_off;
+                int m2ThreshLowExt = on ?
+                        aniState->iniDef.m2ThreshLowExt : m2ThreshLowExt_off;
+                int m1ThreshExt = on ?
+                        aniState->iniDef.m1ThreshExt : m1ThreshExt_off;
+                int m2ThreshExt = on ?
+                        aniState->iniDef.m2ThreshExt : m2ThreshExt_off;
 
                 REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
                               AR_PHY_SFCORR_LOW_M1_THRESH_LOW,
-                              m1ThreshLow[on]);
+                              m1ThreshLow);
                 REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
                               AR_PHY_SFCORR_LOW_M2_THRESH_LOW,
-                              m2ThreshLow[on]);
+                              m2ThreshLow);
                 REG_RMW_FIELD(ah, AR_PHY_SFCORR,
-                              AR_PHY_SFCORR_M1_THRESH, m1Thresh[on]);
+                              AR_PHY_SFCORR_M1_THRESH, m1Thresh);
                 REG_RMW_FIELD(ah, AR_PHY_SFCORR,
-                              AR_PHY_SFCORR_M2_THRESH, m2Thresh[on]);
+                              AR_PHY_SFCORR_M2_THRESH, m2Thresh);
                 REG_RMW_FIELD(ah, AR_PHY_SFCORR,
-                              AR_PHY_SFCORR_M2COUNT_THR, m2CountThr[on]);
+                              AR_PHY_SFCORR_M2COUNT_THR, m2CountThr);
                 REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
                               AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW,
-                              m2CountThrLow[on]);
+                              m2CountThrLow);
 
                 REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
-                              AR_PHY_SFCORR_EXT_M1_THRESH_LOW, m1ThreshLow[on]);
+                              AR_PHY_SFCORR_EXT_M1_THRESH_LOW, m1ThreshLowExt);
                 REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
-                              AR_PHY_SFCORR_EXT_M2_THRESH_LOW, m2ThreshLow[on]);
+                              AR_PHY_SFCORR_EXT_M2_THRESH_LOW, m2ThreshLowExt);
                 REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
-                              AR_PHY_SFCORR_EXT_M1_THRESH, m1Thresh[on]);
+                              AR_PHY_SFCORR_EXT_M1_THRESH, m1ThreshExt);
                 REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
-                              AR_PHY_SFCORR_EXT_M2_THRESH, m2Thresh[on]);
+                              AR_PHY_SFCORR_EXT_M2_THRESH, m2ThreshExt);
 
                 if (on)
                         REG_SET_BIT(ah, AR_PHY_SFCORR_LOW,
@@ -806,6 +816,12 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
                                     AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
 
                 if (!on != aniState->ofdmWeakSigDetectOff) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "** ch %d: ofdm weak signal: %s=>%s\n",
+                                  chan->channel,
+                                  !aniState->ofdmWeakSigDetectOff ?
+                                        "on" : "off",
+                                  on ? "on" : "off");
                         if (on)
                                 ah->stats.ast_ani_ofdmon++;
                         else
@@ -814,64 +830,167 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
                 }
                 break;
         }
-        case ATH9K_ANI_CCK_WEAK_SIGNAL_THR:{
-                const int weakSigThrCck[] = { 8, 6 };
-                u32 high = param ? 1 : 0;
-
-                REG_RMW_FIELD(ah, AR_PHY_CCK_DETECT,
-                              AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK,
-                              weakSigThrCck[high]);
-                if (high != aniState->cckWeakSigThreshold) {
-                        if (high)
-                                ah->stats.ast_ani_cckhigh++;
-                        else
-                                ah->stats.ast_ani_ccklow++;
-                        aniState->cckWeakSigThreshold = high;
-                }
-                break;
-        }
         case ATH9K_ANI_FIRSTEP_LEVEL:{
-                const int firstep[] = { 0, 4, 8 };
                 u32 level = param;
 
-                if (level >= ARRAY_SIZE(firstep)) {
+                if (level >= ARRAY_SIZE(firstep_table)) {
                         ath_print(common, ATH_DBG_ANI,
-                                  "level out of range (%u > %u)\n",
+                                  "ATH9K_ANI_FIRSTEP_LEVEL: level "
+                                  "out of range (%u > %u)\n",
                                   level,
-                                  (unsigned) ARRAY_SIZE(firstep));
+                                  (unsigned) ARRAY_SIZE(firstep_table));
                         return false;
                 }
+
+                /*
+                 * make register setting relative to default
+                 * from INI file & cap value
+                 */
+                value = firstep_table[level] -
+                        firstep_table[ATH9K_ANI_FIRSTEP_LVL_NEW] +
+                        aniState->iniDef.firstep;
+                if (value < ATH9K_SIG_FIRSTEP_SETTING_MIN)
+                        value = ATH9K_SIG_FIRSTEP_SETTING_MIN;
+                if (value > ATH9K_SIG_FIRSTEP_SETTING_MAX)
+                        value = ATH9K_SIG_FIRSTEP_SETTING_MAX;
                 REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
                               AR_PHY_FIND_SIG_FIRSTEP,
-                              firstep[level]);
-                if (level > aniState->firstepLevel)
-                        ah->stats.ast_ani_stepup++;
-                else if (level < aniState->firstepLevel)
-                        ah->stats.ast_ani_stepdown++;
-                aniState->firstepLevel = level;
+                              value);
+                /*
+                 * we need to set first step low register too
+                 * make register setting relative to default
+                 * from INI file & cap value
+                 */
+                value2 = firstep_table[level] -
+                         firstep_table[ATH9K_ANI_FIRSTEP_LVL_NEW] +
+                         aniState->iniDef.firstepLow;
+                if (value2 < ATH9K_SIG_FIRSTEP_SETTING_MIN)
+                        value2 = ATH9K_SIG_FIRSTEP_SETTING_MIN;
+                if (value2 > ATH9K_SIG_FIRSTEP_SETTING_MAX)
+                        value2 = ATH9K_SIG_FIRSTEP_SETTING_MAX;
+
+                REG_RMW_FIELD(ah, AR_PHY_FIND_SIG_LOW,
+                              AR_PHY_FIND_SIG_LOW_FIRSTEP_LOW, value2);
+
+                if (level != aniState->firstepLevel) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "** ch %d: level %d=>%d[def:%d] "
+                                  "firstep[level]=%d ini=%d\n",
+                                  chan->channel,
+                                  aniState->firstepLevel,
+                                  level,
+                                  ATH9K_ANI_FIRSTEP_LVL_NEW,
+                                  value,
+                                  aniState->iniDef.firstep);
+                        ath_print(common, ATH_DBG_ANI,
+                                  "** ch %d: level %d=>%d[def:%d] "
+                                  "firstep_low[level]=%d ini=%d\n",
+                                  chan->channel,
+                                  aniState->firstepLevel,
+                                  level,
+                                  ATH9K_ANI_FIRSTEP_LVL_NEW,
+                                  value2,
+                                  aniState->iniDef.firstepLow);
+                        if (level > aniState->firstepLevel)
+                                ah->stats.ast_ani_stepup++;
+                        else if (level < aniState->firstepLevel)
+                                ah->stats.ast_ani_stepdown++;
+                        aniState->firstepLevel = level;
+                }
                 break;
         }
         case ATH9K_ANI_SPUR_IMMUNITY_LEVEL:{
-                const int cycpwrThr1[] = { 2, 4, 6, 8, 10, 12, 14, 16 };
                 u32 level = param;
 
-                if (level >= ARRAY_SIZE(cycpwrThr1)) {
+                if (level >= ARRAY_SIZE(cycpwrThr1_table)) {
                         ath_print(common, ATH_DBG_ANI,
-                                  "level out of range (%u > %u)\n",
+                                  "ATH9K_ANI_SPUR_IMMUNITY_LEVEL: level "
+                                  "out of range (%u > %u)\n",
                                   level,
-                                  (unsigned) ARRAY_SIZE(cycpwrThr1));
+                                  (unsigned) ARRAY_SIZE(cycpwrThr1_table));
                         return false;
                 }
+                /*
+                 * make register setting relative to default
+                 * from INI file & cap value
+                 */
+                value = cycpwrThr1_table[level] -
+                        cycpwrThr1_table[ATH9K_ANI_SPUR_IMMUNE_LVL_NEW] +
+                        aniState->iniDef.cycpwrThr1;
+                if (value < ATH9K_SIG_SPUR_IMM_SETTING_MIN)
+                        value = ATH9K_SIG_SPUR_IMM_SETTING_MIN;
+                if (value > ATH9K_SIG_SPUR_IMM_SETTING_MAX)
+                        value = ATH9K_SIG_SPUR_IMM_SETTING_MAX;
                 REG_RMW_FIELD(ah, AR_PHY_TIMING5,
                               AR_PHY_TIMING5_CYCPWR_THR1,
-                              cycpwrThr1[level]);
-                if (level > aniState->spurImmunityLevel)
-                        ah->stats.ast_ani_spurup++;
-                else if (level < aniState->spurImmunityLevel)
-                        ah->stats.ast_ani_spurdown++;
-                aniState->spurImmunityLevel = level;
+                              value);
+
+                /*
+                 * set AR_PHY_EXT_CCA for extension channel
+                 * make register setting relative to default
+                 * from INI file & cap value
+                 */
+                value2 = cycpwrThr1_table[level] -
+                         cycpwrThr1_table[ATH9K_ANI_SPUR_IMMUNE_LVL_NEW] +
+                         aniState->iniDef.cycpwrThr1Ext;
+                if (value2 < ATH9K_SIG_SPUR_IMM_SETTING_MIN)
+                        value2 = ATH9K_SIG_SPUR_IMM_SETTING_MIN;
+                if (value2 > ATH9K_SIG_SPUR_IMM_SETTING_MAX)
+                        value2 = ATH9K_SIG_SPUR_IMM_SETTING_MAX;
+                REG_RMW_FIELD(ah, AR_PHY_EXT_CCA,
+                              AR_PHY_EXT_CYCPWR_THR1, value2);
+
+                if (level != aniState->spurImmunityLevel) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "** ch %d: level %d=>%d[def:%d] "
+                                  "cycpwrThr1[level]=%d ini=%d\n",
+                                  chan->channel,
+                                  aniState->spurImmunityLevel,
+                                  level,
+                                  ATH9K_ANI_SPUR_IMMUNE_LVL_NEW,
+                                  value,
+                                  aniState->iniDef.cycpwrThr1);
+                        ath_print(common, ATH_DBG_ANI,
+                                  "** ch %d: level %d=>%d[def:%d] "
+                                  "cycpwrThr1Ext[level]=%d ini=%d\n",
+                                  chan->channel,
+                                  aniState->spurImmunityLevel,
+                                  level,
+                                  ATH9K_ANI_SPUR_IMMUNE_LVL_NEW,
+                                  value2,
+                                  aniState->iniDef.cycpwrThr1Ext);
+                        if (level > aniState->spurImmunityLevel)
+                                ah->stats.ast_ani_spurup++;
+                        else if (level < aniState->spurImmunityLevel)
+                                ah->stats.ast_ani_spurdown++;
+                        aniState->spurImmunityLevel = level;
+                }
                 break;
         }
+        case ATH9K_ANI_MRC_CCK:{
+                /*
+                 * is_on == 1 means MRC CCK ON (default, less noise imm)
+                 * is_on == 0 means MRC CCK is OFF (more noise imm)
+                 */
+                bool is_on = param ? 1 : 0;
+                REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+                              AR_PHY_MRC_CCK_ENABLE, is_on);
+                REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+                              AR_PHY_MRC_CCK_MUX_REG, is_on);
+                if (!is_on != aniState->mrcCCKOff) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "** ch %d: MRC CCK: %s=>%s\n",
+                                  chan->channel,
+                                  !aniState->mrcCCKOff ? "on" : "off",
+                                  is_on ? "on" : "off");
+                if (is_on)
+                        ah->stats.ast_ani_ccklow++;
+                else
+                        ah->stats.ast_ani_cckhigh++;
+                aniState->mrcCCKOff = !is_on;
+                }
+        break;
+        }
         case ATH9K_ANI_PRESENT:
                 break;
         default:
@@ -880,25 +999,19 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
                 return false;
         }
 
-        ath_print(common, ATH_DBG_ANI, "ANI parameters:\n");
         ath_print(common, ATH_DBG_ANI,
-                  "noiseImmunityLevel=%d, spurImmunityLevel=%d, "
-                  "ofdmWeakSigDetectOff=%d\n",
-                  aniState->noiseImmunityLevel,
+                  "ANI parameters: SI=%d, ofdmWS=%s FS=%d "
+                  "MRCcck=%s listenTime=%d CC=%d listen=%d "
+                  "ofdmErrs=%d cckErrs=%d\n",
                   aniState->spurImmunityLevel,
-                  !aniState->ofdmWeakSigDetectOff);
-        ath_print(common, ATH_DBG_ANI,
-                  "cckWeakSigThreshold=%d, "
-                  "firstepLevel=%d, listenTime=%d\n",
-                  aniState->cckWeakSigThreshold,
+                  !aniState->ofdmWeakSigDetectOff ? "on" : "off",
                   aniState->firstepLevel,
-                  aniState->listenTime);
-        ath_print(common, ATH_DBG_ANI,
-                "cycleCount=%d, ofdmPhyErrCount=%d, cckPhyErrCount=%d\n\n",
-                aniState->cycleCount,
-                aniState->ofdmPhyErrCount,
-                aniState->cckPhyErrCount);
-
+                  !aniState->mrcCCKOff ? "on" : "off",
+                  aniState->listenTime,
+                  aniState->cycleCount,
+                  aniState->listenTime,
+                  aniState->ofdmPhyErrCount,
+                  aniState->cckPhyErrCount);
         return true;
 }
 
@@ -1111,6 +1224,70 @@ static void ar9003_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
         }
 }
 
+/*
+ * Initialize the ANI register values with default (ini) values.
+ * This routine is called during a (full) hardware reset after
+ * all the registers are initialised from the INI.
+ */
+static void ar9003_hw_ani_cache_ini_regs(struct ath_hw *ah)
+{
+        struct ar5416AniState *aniState;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_channel *chan = ah->curchan;
+        struct ath9k_ani_default *iniDef;
+        int index;
+        u32 val;
+
+        index = ath9k_hw_get_ani_channel_idx(ah, chan);
+        aniState = &ah->ani[index];
+        ah->curani = aniState;
+        iniDef = &aniState->iniDef;
+
+        ath_print(common, ATH_DBG_ANI,
+                  "ver %d.%d opmode %u chan %d Mhz/0x%x\n",
+                  ah->hw_version.macVersion,
+                  ah->hw_version.macRev,
+                  ah->opmode,
+                  chan->channel,
+                  chan->channelFlags);
+
+        val = REG_READ(ah, AR_PHY_SFCORR);
+        iniDef->m1Thresh = MS(val, AR_PHY_SFCORR_M1_THRESH);
+        iniDef->m2Thresh = MS(val, AR_PHY_SFCORR_M2_THRESH);
+        iniDef->m2CountThr = MS(val, AR_PHY_SFCORR_M2COUNT_THR);
+
+        val = REG_READ(ah, AR_PHY_SFCORR_LOW);
+        iniDef->m1ThreshLow = MS(val, AR_PHY_SFCORR_LOW_M1_THRESH_LOW);
+        iniDef->m2ThreshLow = MS(val, AR_PHY_SFCORR_LOW_M2_THRESH_LOW);
+        iniDef->m2CountThrLow = MS(val, AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW);
+
+        val = REG_READ(ah, AR_PHY_SFCORR_EXT);
+        iniDef->m1ThreshExt = MS(val, AR_PHY_SFCORR_EXT_M1_THRESH);
+        iniDef->m2ThreshExt = MS(val, AR_PHY_SFCORR_EXT_M2_THRESH);
+        iniDef->m1ThreshLowExt = MS(val, AR_PHY_SFCORR_EXT_M1_THRESH_LOW);
+        iniDef->m2ThreshLowExt = MS(val, AR_PHY_SFCORR_EXT_M2_THRESH_LOW);
+        iniDef->firstep = REG_READ_FIELD(ah,
+                                         AR_PHY_FIND_SIG,
+                                         AR_PHY_FIND_SIG_FIRSTEP);
+        iniDef->firstepLow = REG_READ_FIELD(ah,
+                                            AR_PHY_FIND_SIG_LOW,
+                                            AR_PHY_FIND_SIG_LOW_FIRSTEP_LOW);
+        iniDef->cycpwrThr1 = REG_READ_FIELD(ah,
+                                            AR_PHY_TIMING5,
+                                            AR_PHY_TIMING5_CYCPWR_THR1);
+        iniDef->cycpwrThr1Ext = REG_READ_FIELD(ah,
+                                               AR_PHY_EXT_CCA,
+                                               AR_PHY_EXT_CYCPWR_THR1);
+
+        /* these levels just got reset to defaults by the INI */
+        aniState->spurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL_NEW;
+        aniState->firstepLevel = ATH9K_ANI_FIRSTEP_LVL_NEW;
+        aniState->ofdmWeakSigDetectOff = !ATH9K_ANI_USE_OFDM_WEAK_SIG;
+        aniState->mrcCCKOff = !ATH9K_ANI_ENABLE_MRC_CCK;
+
+        aniState->cycleCount = 0;
+}
+
 void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
 {
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
@@ -1131,4 +1308,124 @@ void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
         priv_ops->ani_control = ar9003_hw_ani_control;
         priv_ops->do_getnf = ar9003_hw_do_getnf;
         priv_ops->loadnf = ar9003_hw_loadnf;
+        priv_ops->ani_cache_ini_regs = ar9003_hw_ani_cache_ini_regs;
+}
+
+void ar9003_hw_bb_watchdog_config(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 idle_tmo_ms = ah->bb_watchdog_timeout_ms;
+        u32 val, idle_count;
+
+        if (!idle_tmo_ms) {
+                /* disable IRQ, disable chip-reset for BB panic */
+                REG_WRITE(ah, AR_PHY_WATCHDOG_CTL_2,
+                          REG_READ(ah, AR_PHY_WATCHDOG_CTL_2) &
+                          ~(AR_PHY_WATCHDOG_RST_ENABLE |
+                            AR_PHY_WATCHDOG_IRQ_ENABLE));
+
+                /* disable watchdog in non-IDLE mode, disable in IDLE mode */
+                REG_WRITE(ah, AR_PHY_WATCHDOG_CTL_1,
+                          REG_READ(ah, AR_PHY_WATCHDOG_CTL_1) &
+                          ~(AR_PHY_WATCHDOG_NON_IDLE_ENABLE |
+                            AR_PHY_WATCHDOG_IDLE_ENABLE));
+
+                ath_print(common, ATH_DBG_RESET, "Disabled BB Watchdog\n");
+                return;
+        }
+
+        /* enable IRQ, disable chip-reset for BB watchdog */
+        val = REG_READ(ah, AR_PHY_WATCHDOG_CTL_2) & AR_PHY_WATCHDOG_CNTL2_MASK;
+        REG_WRITE(ah, AR_PHY_WATCHDOG_CTL_2,
+                  (val | AR_PHY_WATCHDOG_IRQ_ENABLE) &
+                  ~AR_PHY_WATCHDOG_RST_ENABLE);
+
+        /* bound limit to 10 secs */
+        if (idle_tmo_ms > 10000)
+                idle_tmo_ms = 10000;
+
+        /*
+         * The time unit for watchdog event is 2^15 44/88MHz cycles.
+         *
+         * For HT20 we have a time unit of 2^15/44 MHz = .74 ms per tick
+         * For HT40 we have a time unit of 2^15/88 MHz = .37 ms per tick
+         *
+         * Given we use fast clock now in 5 GHz, these time units should
+         * be common for both 2 GHz and 5 GHz.
+         */
+        idle_count = (100 * idle_tmo_ms) / 74;
+        if (ah->curchan && IS_CHAN_HT40(ah->curchan))
+                idle_count = (100 * idle_tmo_ms) / 37;
+
+        /*
+         * enable watchdog in non-IDLE mode, disable in IDLE mode,
+         * set idle time-out.
+         */
+        REG_WRITE(ah, AR_PHY_WATCHDOG_CTL_1,
+                  AR_PHY_WATCHDOG_NON_IDLE_ENABLE |
+                  AR_PHY_WATCHDOG_IDLE_MASK |
+                  (AR_PHY_WATCHDOG_NON_IDLE_MASK & (idle_count << 2)));
+
+        ath_print(common, ATH_DBG_RESET,
+                  "Enabled BB Watchdog timeout (%u ms)\n",
+                  idle_tmo_ms);
+}
+
+void ar9003_hw_bb_watchdog_read(struct ath_hw *ah)
+{
+        /*
+         * we want to avoid printing in ISR context so we save the
+         * watchdog status to be printed later in bottom half context.
+         */
+        ah->bb_watchdog_last_status = REG_READ(ah, AR_PHY_WATCHDOG_STATUS);
+
+        /*
+         * the watchdog timer should reset on status read but to be sure
+         * sure we write 0 to the watchdog status bit.
+         */
+        REG_WRITE(ah, AR_PHY_WATCHDOG_STATUS,
+                  ah->bb_watchdog_last_status & ~AR_PHY_WATCHDOG_STATUS_CLR);
+}
+
+void ar9003_hw_bb_watchdog_dbg_info(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 rxc_pcnt = 0, rxf_pcnt = 0, txf_pcnt = 0, status;
+
+        if (likely(!(common->debug_mask & ATH_DBG_RESET)))
+                return;
+
+        status = ah->bb_watchdog_last_status;
+        ath_print(common, ATH_DBG_RESET,
+                  "\n==== BB update: BB status=0x%08x ====\n", status);
+        ath_print(common, ATH_DBG_RESET,
+                  "** BB state: wd=%u det=%u rdar=%u rOFDM=%d "
+                  "rCCK=%u tOFDM=%u tCCK=%u agc=%u src=%u **\n",
+                  MS(status, AR_PHY_WATCHDOG_INFO),
+                  MS(status, AR_PHY_WATCHDOG_DET_HANG),
+                  MS(status, AR_PHY_WATCHDOG_RADAR_SM),
+                  MS(status, AR_PHY_WATCHDOG_RX_OFDM_SM),
+                  MS(status, AR_PHY_WATCHDOG_RX_CCK_SM),
+                  MS(status, AR_PHY_WATCHDOG_TX_OFDM_SM),
+                  MS(status, AR_PHY_WATCHDOG_TX_CCK_SM),
+                  MS(status, AR_PHY_WATCHDOG_AGC_SM),
+                  MS(status,AR_PHY_WATCHDOG_SRCH_SM));
+
+        ath_print(common, ATH_DBG_RESET,
+                  "** BB WD cntl: cntl1=0x%08x cntl2=0x%08x **\n",
+                  REG_READ(ah, AR_PHY_WATCHDOG_CTL_1),
+                  REG_READ(ah, AR_PHY_WATCHDOG_CTL_2));
+        ath_print(common, ATH_DBG_RESET,
+                  "** BB mode: BB_gen_controls=0x%08x **\n",
+                  REG_READ(ah, AR_PHY_GEN_CTRL));
+
+        if (ath9k_hw_GetMibCycleCountsPct(ah, &rxc_pcnt, &rxf_pcnt, &txf_pcnt))
+                ath_print(common, ATH_DBG_RESET,
+                          "** BB busy times: rx_clear=%d%%, "
+                          "rx_frame=%d%%, tx_frame=%d%% **\n",
+                          rxc_pcnt, rxf_pcnt, txf_pcnt);
+
+        ath_print(common, ATH_DBG_RESET,
+                  "==== BB update: done ====\n\n");
 }
+EXPORT_SYMBOL(ar9003_hw_bb_watchdog_dbg_info);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index f08cc8bda005..3394dfe52b42 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -149,6 +149,8 @@
 #define AR_PHY_EXT_CCA_THRESH62_S       16
 #define AR_PHY_EXT_MINCCA_PWR   0x01FF0000
 #define AR_PHY_EXT_MINCCA_PWR_S 16
+#define AR_PHY_EXT_CYCPWR_THR1 0x0000FE00L
+#define AR_PHY_EXT_CYCPWR_THR1_S 9
 #define AR_PHY_TIMING5_CYCPWR_THR1  0x000000FE
 #define AR_PHY_TIMING5_CYCPWR_THR1_S    1
 #define AR_PHY_TIMING5_CYCPWR_THR1_ENABLE  0x00000001
@@ -283,6 +285,12 @@
 #define AR_PHY_CCK_SPUR_MIT_CCK_SPUR_FREQ                           0x1ffffe00
 #define AR_PHY_CCK_SPUR_MIT_CCK_SPUR_FREQ_S                                  9
 
+#define AR_PHY_MRC_CCK_CTRL         (AR_AGC_BASE + 0x1d0)
+#define AR_PHY_MRC_CCK_ENABLE       0x00000001
+#define AR_PHY_MRC_CCK_ENABLE_S              0
+#define AR_PHY_MRC_CCK_MUX_REG      0x00000002
+#define AR_PHY_MRC_CCK_MUX_REG_S             1
+
 #define AR_PHY_RX_OCGAIN        (AR_AGC_BASE + 0x200)
 
 #define AR_PHY_CCA_NOM_VAL_9300_2GHZ          -110
@@ -451,7 +459,11 @@
 #define AR_PHY_TSTDAC            (AR_SM_BASE + 0x168)
 
 #define AR_PHY_CHAN_STATUS       (AR_SM_BASE + 0x16c)
-#define AR_PHY_CHAN_INFO_MEMORY  (AR_SM_BASE + 0x170)
+
+#define AR_PHY_CHAN_INFO_MEMORY                         (AR_SM_BASE + 0x170)
+#define AR_PHY_CHAN_INFO_MEMORY_CHANINFOMEM_S2_READ     0x00000008
+#define AR_PHY_CHAN_INFO_MEMORY_CHANINFOMEM_S2_READ_S   3
+
 #define AR_PHY_CHNINFO_NOISEPWR  (AR_SM_BASE + 0x174)
 #define AR_PHY_CHNINFO_GAINDIFF  (AR_SM_BASE + 0x178)
 #define AR_PHY_CHNINFO_FINETIM   (AR_SM_BASE + 0x17c)
@@ -467,30 +479,86 @@
 #define AR_PHY_PWRTX_MAX         (AR_SM_BASE + 0x1f0)
 #define AR_PHY_POWER_TX_SUB      (AR_SM_BASE + 0x1f4)
 
-#define AR_PHY_TPC_4_B0          (AR_SM_BASE + 0x204)
-#define AR_PHY_TPC_5_B0          (AR_SM_BASE + 0x208)
-#define AR_PHY_TPC_6_B0          (AR_SM_BASE + 0x20c)
-#define AR_PHY_TPC_11_B0         (AR_SM_BASE + 0x220)
-#define AR_PHY_TPC_18            (AR_SM_BASE + 0x23c)
-#define AR_PHY_TPC_19            (AR_SM_BASE + 0x240)
+#define AR_PHY_TPC_1                            (AR_SM_BASE + 0x1f8)
+#define AR_PHY_TPC_1_FORCED_DAC_GAIN            0x0000003e
+#define AR_PHY_TPC_1_FORCED_DAC_GAIN_S          1
+#define AR_PHY_TPC_1_FORCE_DAC_GAIN             0x00000001
+#define AR_PHY_TPC_1_FORCE_DAC_GAIN_S           0
+
+#define AR_PHY_TPC_4_B0                         (AR_SM_BASE + 0x204)
+#define AR_PHY_TPC_5_B0                         (AR_SM_BASE + 0x208)
+#define AR_PHY_TPC_6_B0                         (AR_SM_BASE + 0x20c)
+
+#define AR_PHY_TPC_11_B0                        (AR_SM_BASE + 0x220)
+#define AR_PHY_TPC_11_B1                        (AR_SM1_BASE + 0x220)
+#define AR_PHY_TPC_11_B2                        (AR_SM2_BASE + 0x220)
+#define AR_PHY_TPC_11_OLPC_GAIN_DELTA           0x00ff0000
+#define AR_PHY_TPC_11_OLPC_GAIN_DELTA_S         16
+
+#define AR_PHY_TPC_12                           (AR_SM_BASE + 0x224)
+#define AR_PHY_TPC_12_DESIRED_SCALE_HT40_5      0x3e000000
+#define AR_PHY_TPC_12_DESIRED_SCALE_HT40_5_S    25
+
+#define AR_PHY_TPC_18                           (AR_SM_BASE + 0x23c)
+#define AR_PHY_TPC_18_THERM_CAL_VALUE           0x000000ff
+#define AR_PHY_TPC_18_THERM_CAL_VALUE_S         0
+#define AR_PHY_TPC_18_VOLT_CAL_VALUE            0x0000ff00
+#define AR_PHY_TPC_18_VOLT_CAL_VALUE_S          8
+
+#define AR_PHY_TPC_19                           (AR_SM_BASE + 0x240)
+#define AR_PHY_TPC_19_ALPHA_VOLT                0x001f0000
+#define AR_PHY_TPC_19_ALPHA_VOLT_S              16
+#define AR_PHY_TPC_19_ALPHA_THERM               0xff
+#define AR_PHY_TPC_19_ALPHA_THERM_S             0
+
+#define AR_PHY_TX_FORCED_GAIN                           (AR_SM_BASE + 0x258)
+#define AR_PHY_TX_FORCED_GAIN_FORCE_TX_GAIN             0x00000001
+#define AR_PHY_TX_FORCED_GAIN_FORCE_TX_GAIN_S           0
+#define AR_PHY_TX_FORCED_GAIN_FORCED_TXBB1DBGAIN        0x0000000e
+#define AR_PHY_TX_FORCED_GAIN_FORCED_TXBB1DBGAIN_S      1
+#define AR_PHY_TX_FORCED_GAIN_FORCED_TXBB6DBGAIN        0x00000030
+#define AR_PHY_TX_FORCED_GAIN_FORCED_TXBB6DBGAIN_S      4
+#define AR_PHY_TX_FORCED_GAIN_FORCED_TXMXRGAIN          0x000003c0
+#define AR_PHY_TX_FORCED_GAIN_FORCED_TXMXRGAIN_S        6
+#define AR_PHY_TX_FORCED_GAIN_FORCED_PADRVGNA           0x00003c00
+#define AR_PHY_TX_FORCED_GAIN_FORCED_PADRVGNA_S         10
+#define AR_PHY_TX_FORCED_GAIN_FORCED_PADRVGNB           0x0003c000
+#define AR_PHY_TX_FORCED_GAIN_FORCED_PADRVGNB_S         14
+#define AR_PHY_TX_FORCED_GAIN_FORCED_PADRVGNC           0x003c0000
+#define AR_PHY_TX_FORCED_GAIN_FORCED_PADRVGNC_S         18
+#define AR_PHY_TX_FORCED_GAIN_FORCED_PADRVGND           0x00c00000
+#define AR_PHY_TX_FORCED_GAIN_FORCED_PADRVGND_S         22
+#define AR_PHY_TX_FORCED_GAIN_FORCED_ENABLE_PAL         0x01000000
+#define AR_PHY_TX_FORCED_GAIN_FORCED_ENABLE_PAL_S       24
 
-#define AR_PHY_TX_FORCED_GAIN    (AR_SM_BASE + 0x258)
 
 #define AR_PHY_PDADC_TAB_0       (AR_SM_BASE + 0x280)
 
+#define AR_PHY_TXGAIN_TABLE      (AR_SM_BASE + 0x300)
+
 #define AR_PHY_TX_IQCAL_CONTROL_1   (AR_SM_BASE + 0x448)
 #define AR_PHY_TX_IQCAL_START       (AR_SM_BASE + 0x440)
 #define AR_PHY_TX_IQCAL_STATUS_B0   (AR_SM_BASE + 0x48c)
 #define AR_PHY_TX_IQCAL_CORR_COEFF_01_B0    (AR_SM_BASE + 0x450)
 
-#define AR_PHY_PANIC_WD_STATUS      (AR_SM_BASE + 0x5c0)
-#define AR_PHY_PANIC_WD_CTL_1       (AR_SM_BASE + 0x5c4)
-#define AR_PHY_PANIC_WD_CTL_2       (AR_SM_BASE + 0x5c8)
-#define AR_PHY_BT_CTL               (AR_SM_BASE + 0x5cc)
+#define AR_PHY_WATCHDOG_STATUS      (AR_SM_BASE + 0x5c0)
+#define AR_PHY_WATCHDOG_CTL_1       (AR_SM_BASE + 0x5c4)
+#define AR_PHY_WATCHDOG_CTL_2       (AR_SM_BASE + 0x5c8)
+#define AR_PHY_WATCHDOG_CTL         (AR_SM_BASE + 0x5cc)
 #define AR_PHY_ONLY_WARMRESET       (AR_SM_BASE + 0x5d0)
 #define AR_PHY_ONLY_CTL             (AR_SM_BASE + 0x5d4)
 #define AR_PHY_ECO_CTRL             (AR_SM_BASE + 0x5dc)
-#define AR_PHY_BB_THERM_ADC_1       (AR_SM_BASE + 0x248)
+
+#define AR_PHY_BB_THERM_ADC_1                           (AR_SM_BASE + 0x248)
+#define AR_PHY_BB_THERM_ADC_1_INIT_THERM                0x000000ff
+#define AR_PHY_BB_THERM_ADC_1_INIT_THERM_S              0
+
+#define AR_PHY_BB_THERM_ADC_4                           (AR_SM_BASE + 0x254)
+#define AR_PHY_BB_THERM_ADC_4_LATEST_THERM_VALUE        0x000000ff
+#define AR_PHY_BB_THERM_ADC_4_LATEST_THERM_VALUE_S      0
+#define AR_PHY_BB_THERM_ADC_4_LATEST_VOLT_VALUE         0x0000ff00
+#define AR_PHY_BB_THERM_ADC_4_LATEST_VOLT_VALUE_S       8
+
 
 #define AR_PHY_65NM_CH0_SYNTH4      0x1608c
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT   0x00000002
@@ -660,17 +728,9 @@
 #define AR_PHY_TX_IQCAL_CORR_COEFF_01_COEFF_TABLE      0x00003fff
 #define AR_PHY_TX_IQCAL_CORR_COEFF_01_COEFF_TABLE_S    0
 
-#define AR_PHY_TPC_18_THERM_CAL_VALUE           0xff
-#define AR_PHY_TPC_18_THERM_CAL_VALUE_S         0
-#define AR_PHY_TPC_19_ALPHA_THERM               0xff
-#define AR_PHY_TPC_19_ALPHA_THERM_S             0
-
 #define AR_PHY_65NM_CH0_RXTX4_THERM_ON          0x10000000
 #define AR_PHY_65NM_CH0_RXTX4_THERM_ON_S        28
 
-#define AR_PHY_BB_THERM_ADC_1_INIT_THERM        0x000000ff
-#define AR_PHY_BB_THERM_ADC_1_INIT_THERM_S      0
-
 /*
  * Channel 1 Register Map
  */
@@ -812,35 +872,173 @@
 #define AR_PHY_CAL_MEAS_2_9300_10(_i) (AR_PHY_IQ_ADC_MEAS_2_B0_9300_10 + (AR_PHY_CHAIN_OFFSET * (_i)))
 #define AR_PHY_CAL_MEAS_3_9300_10(_i) (AR_PHY_IQ_ADC_MEAS_3_B0_9300_10 + (AR_PHY_CHAIN_OFFSET * (_i)))
 
-#define AR_PHY_BB_PANIC_NON_IDLE_ENABLE 0x00000001
-#define AR_PHY_BB_PANIC_IDLE_ENABLE     0x00000002
-#define AR_PHY_BB_PANIC_IDLE_MASK       0xFFFF0000
-#define AR_PHY_BB_PANIC_NON_IDLE_MASK   0x0000FFFC
-
-#define AR_PHY_BB_PANIC_RST_ENABLE      0x00000002
-#define AR_PHY_BB_PANIC_IRQ_ENABLE      0x00000004
-#define AR_PHY_BB_PANIC_CNTL2_MASK      0xFFFFFFF9
-
-#define AR_PHY_BB_WD_STATUS             0x00000007
-#define AR_PHY_BB_WD_STATUS_S           0
-#define AR_PHY_BB_WD_DET_HANG           0x00000008
-#define AR_PHY_BB_WD_DET_HANG_S         3
-#define AR_PHY_BB_WD_RADAR_SM           0x000000F0
-#define AR_PHY_BB_WD_RADAR_SM_S         4
-#define AR_PHY_BB_WD_RX_OFDM_SM         0x00000F00
-#define AR_PHY_BB_WD_RX_OFDM_SM_S       8
-#define AR_PHY_BB_WD_RX_CCK_SM          0x0000F000
-#define AR_PHY_BB_WD_RX_CCK_SM_S        12
-#define AR_PHY_BB_WD_TX_OFDM_SM         0x000F0000
-#define AR_PHY_BB_WD_TX_OFDM_SM_S       16
-#define AR_PHY_BB_WD_TX_CCK_SM          0x00F00000
-#define AR_PHY_BB_WD_TX_CCK_SM_S        20
-#define AR_PHY_BB_WD_AGC_SM             0x0F000000
-#define AR_PHY_BB_WD_AGC_SM_S           24
-#define AR_PHY_BB_WD_SRCH_SM            0xF0000000
-#define AR_PHY_BB_WD_SRCH_SM_S          28
-
-#define AR_PHY_BB_WD_STATUS_CLR         0x00000008
+#define AR_PHY_WATCHDOG_NON_IDLE_ENABLE    0x00000001
+#define AR_PHY_WATCHDOG_IDLE_ENABLE        0x00000002
+#define AR_PHY_WATCHDOG_IDLE_MASK          0xFFFF0000
+#define AR_PHY_WATCHDOG_NON_IDLE_MASK      0x0000FFFC
+
+#define AR_PHY_WATCHDOG_RST_ENABLE         0x00000002
+#define AR_PHY_WATCHDOG_IRQ_ENABLE         0x00000004
+#define AR_PHY_WATCHDOG_CNTL2_MASK         0xFFFFFFF9
+
+#define AR_PHY_WATCHDOG_INFO               0x00000007
+#define AR_PHY_WATCHDOG_INFO_S             0
+#define AR_PHY_WATCHDOG_DET_HANG           0x00000008
+#define AR_PHY_WATCHDOG_DET_HANG_S         3
+#define AR_PHY_WATCHDOG_RADAR_SM           0x000000F0
+#define AR_PHY_WATCHDOG_RADAR_SM_S         4
+#define AR_PHY_WATCHDOG_RX_OFDM_SM         0x00000F00
+#define AR_PHY_WATCHDOG_RX_OFDM_SM_S       8
+#define AR_PHY_WATCHDOG_RX_CCK_SM          0x0000F000
+#define AR_PHY_WATCHDOG_RX_CCK_SM_S        12
+#define AR_PHY_WATCHDOG_TX_OFDM_SM         0x000F0000
+#define AR_PHY_WATCHDOG_TX_OFDM_SM_S       16
+#define AR_PHY_WATCHDOG_TX_CCK_SM          0x00F00000
+#define AR_PHY_WATCHDOG_TX_CCK_SM_S        20
+#define AR_PHY_WATCHDOG_AGC_SM             0x0F000000
+#define AR_PHY_WATCHDOG_AGC_SM_S           24
+#define AR_PHY_WATCHDOG_SRCH_SM            0xF0000000
+#define AR_PHY_WATCHDOG_SRCH_SM_S          28
+
+#define AR_PHY_WATCHDOG_STATUS_CLR         0x00000008
+
+/*
+ * PAPRD registers
+ */
+#define AR_PHY_XPA_TIMING_CTL           (AR_SM_BASE + 0x64)
+
+#define AR_PHY_PAPRD_AM2AM              (AR_CHAN_BASE + 0xe4)
+#define AR_PHY_PAPRD_AM2AM_MASK         0x01ffffff
+#define AR_PHY_PAPRD_AM2AM_MASK_S       0
+
+#define AR_PHY_PAPRD_AM2PM              (AR_CHAN_BASE + 0xe8)
+#define AR_PHY_PAPRD_AM2PM_MASK         0x01ffffff
+#define AR_PHY_PAPRD_AM2PM_MASK_S       0
+
+#define AR_PHY_PAPRD_HT40               (AR_CHAN_BASE + 0xec)
+#define AR_PHY_PAPRD_HT40_MASK          0x01ffffff
+#define AR_PHY_PAPRD_HT40_MASK_S        0
+
+#define AR_PHY_PAPRD_CTRL0_B0                           (AR_CHAN_BASE + 0xf0)
+#define AR_PHY_PAPRD_CTRL0_B1                           (AR_CHAN1_BASE + 0xf0)
+#define AR_PHY_PAPRD_CTRL0_B2                           (AR_CHAN2_BASE + 0xf0)
+#define AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE                 0x00000001
+#define AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE_S               0
+#define AR_PHY_PAPRD_CTRL0_USE_SINGLE_TABLE_MASK        0x00000002
+#define AR_PHY_PAPRD_CTRL0_USE_SINGLE_TABLE_MASK_S      1
+#define AR_PHY_PAPRD_CTRL0_PAPRD_MAG_THRSH              0xf8000000
+#define AR_PHY_PAPRD_CTRL0_PAPRD_MAG_THRSH_S            27
+
+#define AR_PHY_PAPRD_CTRL1_B0                           (AR_CHAN_BASE + 0xf4)
+#define AR_PHY_PAPRD_CTRL1_B1                           (AR_CHAN1_BASE + 0xf4)
+#define AR_PHY_PAPRD_CTRL1_B2                           (AR_CHAN2_BASE + 0xf4)
+#define AR_PHY_PAPRD_CTRL1_ADAPTIVE_SCALING_ENA         0x00000001
+#define AR_PHY_PAPRD_CTRL1_ADAPTIVE_SCALING_ENA_S       0
+#define AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2AM_ENABLE        0x00000002
+#define AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2AM_ENABLE_S      1
+#define AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2PM_ENABLE        0x00000004
+#define AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2PM_ENABLE_S      2
+#define AR_PHY_PAPRD_CTRL1_PAPRD_POWER_AT_AM2AM_CAL     0x000001f8
+#define AR_PHY_PAPRD_CTRL1_PAPRD_POWER_AT_AM2AM_CAL_S   3
+#define AR_PHY_PAPRD_CTRL1_PA_GAIN_SCALE_FACT_MASK      0x0001fe00
+#define AR_PHY_PAPRD_CTRL1_PA_GAIN_SCALE_FACT_MASK_S    9
+#define AR_PHY_PAPRD_CTRL1_PAPRD_MAG_SCALE_FACT         0x0ffe0000
+#define AR_PHY_PAPRD_CTRL1_PAPRD_MAG_SCALE_FACT_S       17
+
+#define AR_PHY_PAPRD_TRAINER_CNTL1                              (AR_SM_BASE + 0x490)
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_CF_PAPRD_TRAIN_ENABLE     0x00000001
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_CF_PAPRD_TRAIN_ENABLE_S   0
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_AGC2_SETTLING       0x0000007e
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_AGC2_SETTLING_S     1
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_IQCORR_ENABLE       0x00000100
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_IQCORR_ENABLE_S     8
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_RX_BB_GAIN_FORCE    0x00000200
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_RX_BB_GAIN_FORCE_S  9
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_TX_GAIN_FORCE       0x00000400
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_TX_GAIN_FORCE_S     10
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_LB_ENABLE           0x00000800
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_LB_ENABLE_S         11
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_LB_SKIP             0x0003f000
+#define AR_PHY_PAPRD_TRAINER_CNTL1_CF_PAPRD_LB_SKIP_S           12
+
+#define AR_PHY_PAPRD_TRAINER_CNTL2                              (AR_SM_BASE + 0x494)
+#define AR_PHY_PAPRD_TRAINER_CNTL2_CF_PAPRD_INIT_RX_BB_GAIN     0xFFFFFFFF
+#define AR_PHY_PAPRD_TRAINER_CNTL2_CF_PAPRD_INIT_RX_BB_GAIN_S   0
+
+#define AR_PHY_PAPRD_TRAINER_CNTL3                              (AR_SM_BASE + 0x498)
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_ADC_DESIRED_SIZE    0x0000003f
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_ADC_DESIRED_SIZE_S  0
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_QUICK_DROP          0x00000fc0
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_QUICK_DROP_S        6
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_MIN_LOOPBACK_DEL    0x0001f000
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_MIN_LOOPBACK_DEL_S  12
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_NUM_CORR_STAGES     0x000e0000
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_NUM_CORR_STAGES_S   17
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_COARSE_CORR_LEN     0x00f00000
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_COARSE_CORR_LEN_S   20
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_FINE_CORR_LEN       0x0f000000
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_FINE_CORR_LEN_S     24
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_BBTXMIX_DISABLE     0x20000000
+#define AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_BBTXMIX_DISABLE_S   29
+
+#define AR_PHY_PAPRD_TRAINER_CNTL4                              (AR_SM_BASE + 0x49c)
+#define AR_PHY_PAPRD_TRAINER_CNTL4_CF_PAPRD_NUM_TRAIN_SAMPLES   0x03ff0000
+#define AR_PHY_PAPRD_TRAINER_CNTL4_CF_PAPRD_NUM_TRAIN_SAMPLES_S 16
+#define AR_PHY_PAPRD_TRAINER_CNTL4_CF_PAPRD_SAFETY_DELTA        0x0000f000
+#define AR_PHY_PAPRD_TRAINER_CNTL4_CF_PAPRD_SAFETY_DELTA_S      12
+#define AR_PHY_PAPRD_TRAINER_CNTL4_CF_PAPRD_MIN_CORR            0x00000fff
+#define AR_PHY_PAPRD_TRAINER_CNTL4_CF_PAPRD_MIN_CORR_S          0
+
+#define AR_PHY_PAPRD_PRE_POST_SCALE_0_B0                        (AR_CHAN_BASE + 0x100)
+#define AR_PHY_PAPRD_PRE_POST_SCALE_1_B0                        (AR_CHAN_BASE + 0x104)
+#define AR_PHY_PAPRD_PRE_POST_SCALE_2_B0                        (AR_CHAN_BASE + 0x108)
+#define AR_PHY_PAPRD_PRE_POST_SCALE_3_B0                        (AR_CHAN_BASE + 0x10c)
+#define AR_PHY_PAPRD_PRE_POST_SCALE_4_B0                        (AR_CHAN_BASE + 0x110)
+#define AR_PHY_PAPRD_PRE_POST_SCALE_5_B0                        (AR_CHAN_BASE + 0x114)
+#define AR_PHY_PAPRD_PRE_POST_SCALE_6_B0                        (AR_CHAN_BASE + 0x118)
+#define AR_PHY_PAPRD_PRE_POST_SCALE_7_B0                        (AR_CHAN_BASE + 0x11c)
+#define AR_PHY_PAPRD_PRE_POST_SCALING                           0x3FFFF
+#define AR_PHY_PAPRD_PRE_POST_SCALING_S                         0
+
+#define AR_PHY_PAPRD_TRAINER_STAT1                              (AR_SM_BASE + 0x4a0)
+#define AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_DONE             0x00000001
+#define AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_DONE_S           0
+#define AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_INCOMPLETE       0x00000002
+#define AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_INCOMPLETE_S     1
+#define AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_CORR_ERR               0x00000004
+#define AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_CORR_ERR_S             2
+#define AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_ACTIVE           0x00000008
+#define AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_ACTIVE_S         3
+#define AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_RX_GAIN_IDX            0x000001f0
+#define AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_RX_GAIN_IDX_S          4
+#define AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_AGC2_PWR               0x0001fe00
+#define AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_AGC2_PWR_S             9
+
+#define AR_PHY_PAPRD_TRAINER_STAT2                              (AR_SM_BASE + 0x4a4)
+#define AR_PHY_PAPRD_TRAINER_STAT2_PAPRD_FINE_VAL               0x0000ffff
+#define AR_PHY_PAPRD_TRAINER_STAT2_PAPRD_FINE_VAL_S             0
+#define AR_PHY_PAPRD_TRAINER_STAT2_PAPRD_COARSE_IDX             0x001f0000
+#define AR_PHY_PAPRD_TRAINER_STAT2_PAPRD_COARSE_IDX_S           16
+#define AR_PHY_PAPRD_TRAINER_STAT2_PAPRD_FINE_IDX               0x00600000
+#define AR_PHY_PAPRD_TRAINER_STAT2_PAPRD_FINE_IDX_S             21
+
+#define AR_PHY_PAPRD_TRAINER_STAT3                              (AR_SM_BASE + 0x4a8)
+#define AR_PHY_PAPRD_TRAINER_STAT3_PAPRD_TRAIN_SAMPLES_CNT      0x000fffff
+#define AR_PHY_PAPRD_TRAINER_STAT3_PAPRD_TRAIN_SAMPLES_CNT_S    0
+
+#define AR_PHY_PAPRD_MEM_TAB_B0                 (AR_CHAN_BASE + 0x120)
+#define AR_PHY_PAPRD_MEM_TAB_B1                 (AR_CHAN1_BASE + 0x120)
+#define AR_PHY_PAPRD_MEM_TAB_B2                 (AR_CHAN2_BASE + 0x120)
+
+#define AR_PHY_PA_GAIN123_B0                    (AR_CHAN_BASE + 0xf8)
+#define AR_PHY_PA_GAIN123_B1                    (AR_CHAN1_BASE + 0xf8)
+#define AR_PHY_PA_GAIN123_B2                    (AR_CHAN2_BASE + 0xf8)
+#define AR_PHY_PA_GAIN123_PA_GAIN1              0x3FF
+#define AR_PHY_PA_GAIN123_PA_GAIN1_S            0
+
+#define AR_PHY_POWERTX_RATE5                    (AR_SM_BASE + 0x1d0)
+#define AR_PHY_POWERTX_RATE5_POWERTXHT20_0      0x3F
+#define AR_PHY_POWERTX_RATE5_POWERTXHT20_0_S    0
 
 void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx);
 
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 5ea87736a6ae..72d5e52abb8f 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -20,6 +20,7 @@
 #include <linux/etherdevice.h>
 #include <linux/device.h>
 #include <linux/leds.h>
+#include <linux/completion.h>
 
 #include "debug.h"
 #include "common.h"
@@ -136,6 +137,8 @@ void ath_descdma_cleanup(struct ath_softc *sc, struct ath_descdma *dd,
 #define ATH_MAX_ANTENNA         3
 #define ATH_RXBUF               512
 #define ATH_TXBUF               512
+#define ATH_TXBUF_RESERVE       5
+#define ATH_MAX_QDEPTH          (ATH_TXBUF / 4 - ATH_TXBUF_RESERVE)
 #define ATH_TXMAXTRY            13
 #define ATH_MGT_TXMAXTRY        4
 
@@ -192,6 +195,7 @@ enum ATH_AGGR_STATUS {
 
 #define ATH_TXFIFO_DEPTH 8
 struct ath_txq {
+        int axq_class;
         u32 axq_qnum;
         u32 *axq_link;
         struct list_head axq_q;
@@ -206,6 +210,71 @@ struct ath_txq {
         u8 txq_tailidx;
 };
 
+struct ath_atx_ac {
+        int sched;
+        int qnum;
+        struct list_head list;
+        struct list_head tid_q;
+};
+
+struct ath_buf_state {
+        int bfs_nframes;
+        u16 bfs_al;
+        u16 bfs_frmlen;
+        int bfs_seqno;
+        int bfs_tidno;
+        int bfs_retries;
+        u8 bf_type;
+        u8 bfs_paprd;
+        unsigned long bfs_paprd_timestamp;
+        u32 bfs_keyix;
+        enum ath9k_key_type bfs_keytype;
+};
+
+struct ath_buf {
+        struct list_head list;
+        struct ath_buf *bf_lastbf;      /* last buf of this unit (a frame or
+                                           an aggregate) */
+        struct ath_buf *bf_next;        /* next subframe in the aggregate */
+        struct sk_buff *bf_mpdu;        /* enclosing frame structure */
+        void *bf_desc;                  /* virtual addr of desc */
+        dma_addr_t bf_daddr;            /* physical addr of desc */
+        dma_addr_t bf_buf_addr;         /* physical addr of data buffer */
+        bool bf_stale;
+        bool bf_isnullfunc;
+        bool bf_tx_aborted;
+        u16 bf_flags;
+        struct ath_buf_state bf_state;
+        dma_addr_t bf_dmacontext;
+        struct ath_wiphy *aphy;
+};
+
+struct ath_atx_tid {
+        struct list_head list;
+        struct list_head buf_q;
+        struct ath_node *an;
+        struct ath_atx_ac *ac;
+        struct ath_buf *tx_buf[ATH_TID_MAX_BUFS];
+        u16 seq_start;
+        u16 seq_next;
+        u16 baw_size;
+        int tidno;
+        int baw_head;   /* first un-acked tx buffer */
+        int baw_tail;   /* next unused tx buffer slot */
+        int sched;
+        int paused;
+        u8 state;
+};
+
+struct ath_node {
+        struct ath_common *common;
+        struct ath_atx_tid tid[WME_NUM_TID];
+        struct ath_atx_ac ac[WME_NUM_AC];
+        u16 maxampdu;
+        u8 mpdudensity;
+        int last_rssi;
+};
+
 #define AGGR_CLEANUP         BIT(1)
 #define AGGR_ADDBA_COMPLETE  BIT(2)
 #define AGGR_ADDBA_PROGRESS  BIT(3)
@@ -214,6 +283,7 @@ struct ath_tx_control {
         struct ath_txq *txq;
         int if_id;
         enum ath9k_internal_frame_type frame_type;
+        u8 paprd;
 };
 
 #define ATH_TX_ERROR        0x01
@@ -223,11 +293,12 @@ struct ath_tx_control {
 struct ath_tx {
         u16 seq_no;
         u32 txqsetup;
-        int hwq_map[ATH9K_WME_AC_VO+1];
+        int hwq_map[WME_NUM_AC];
         spinlock_t txbuflock;
         struct list_head txbuf;
         struct ath_txq txq[ATH9K_NUM_TX_QUEUES];
         struct ath_descdma txdma;
+        int pending_frames[WME_NUM_AC];
 };
 
 struct ath_rx_edma {
@@ -267,7 +338,6 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an);
 void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq);
 int ath_tx_init(struct ath_softc *sc, int nbufs);
 void ath_tx_cleanup(struct ath_softc *sc);
-struct ath_txq *ath_test_get_txq(struct ath_softc *sc, struct sk_buff *skb);
 int ath_txq_update(struct ath_softc *sc, int qnum,
                    struct ath9k_tx_queue_info *q);
 int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
@@ -351,10 +421,14 @@ int ath_beaconq_config(struct ath_softc *sc);
 
 #define ATH_STA_SHORT_CALINTERVAL 1000    /* 1 second */
 #define ATH_AP_SHORT_CALINTERVAL  100     /* 100 ms */
-#define ATH_ANI_POLLINTERVAL      100     /* 100 ms */
+#define ATH_ANI_POLLINTERVAL_OLD  100     /* 100 ms */
+#define ATH_ANI_POLLINTERVAL_NEW  1000    /* 1000 ms */
 #define ATH_LONG_CALINTERVAL      30000   /* 30 seconds */
 #define ATH_RESTART_CALINTERVAL   1200000 /* 20 minutes */
 
+#define ATH_PAPRD_TIMEOUT       100 /* msecs */
+
+void ath_paprd_calibrate(struct work_struct *work);
 void ath_ani_calibrate(unsigned long data);
 
 /**********/
@@ -487,6 +561,8 @@ struct ath_softc {
         spinlock_t sc_serial_rw;
         spinlock_t sc_pm_lock;
         struct mutex mutex;
+        struct work_struct paprd_work;
+        struct completion paprd_complete;
 
         u32 intrstatus;
         u32 sc_flags; /* SC_OP_* */
@@ -545,7 +621,6 @@ struct ath_wiphy {
 
 void ath9k_tasklet(unsigned long data);
 int ath_reset(struct ath_softc *sc, bool retry_tx);
-int ath_get_hal_qnum(u16 queue, struct ath_softc *sc);
 int ath_get_mac80211_qnum(u32 queue, struct ath_softc *sc);
 int ath_cabq_update(struct ath_softc *);
 
@@ -556,13 +631,12 @@ static inline void ath_read_cachesize(struct ath_common *common, int *csz)
 
 extern struct ieee80211_ops ath9k_ops;
 extern int modparam_nohwcrypt;
+extern int led_blink;
 
 irqreturn_t ath_isr(int irq, void *dev);
 int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
                     const struct ath_bus_ops *bus_ops);
 void ath9k_deinit_device(struct ath_softc *sc);
-const char *ath_mac_bb_name(u32 mac_bb_version);
-const char *ath_rf_name(u16 rf_version);
 void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw);
 void ath9k_update_ichannel(struct ath_softc *sc, struct ieee80211_hw *hw,
                            struct ath9k_channel *ichan);
@@ -613,8 +687,6 @@ void ath9k_set_wiphy_idle(struct ath_wiphy *aphy, bool idle);
 void ath_mac80211_stop_queue(struct ath_softc *sc, u16 skb_queue);
 void ath_mac80211_start_queue(struct ath_softc *sc, u16 skb_queue);
 
-int ath_tx_get_qnum(struct ath_softc *sc, int qtype, int haltype);
-
 void ath_start_rfkill_poll(struct ath_softc *sc);
 extern void ath9k_rfkill_poll_state(struct ieee80211_hw *hw);
 
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index f43d85a302c4..4d4b22d52dfd 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -38,8 +38,7 @@ int ath_beaconq_config(struct ath_softc *sc)
                 qi.tqi_cwmax = 0;
         } else {
                 /* Adhoc mode; important thing is to use 2x cwmin. */
-                qnum = ath_tx_get_qnum(sc, ATH9K_TX_QUEUE_DATA,
-                                       ATH9K_WME_AC_BE);
+                qnum = sc->tx.hwq_map[WME_AC_BE];
                 ath9k_hw_get_txq_props(ah, qnum, &qi_be);
                 qi.tqi_aifs = qi_be.tqi_aifs;
                 qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index 7707341cd0d3..16e2849f644d 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -27,270 +27,6 @@ MODULE_AUTHOR("Atheros Communications");
 MODULE_DESCRIPTION("Shared library for Atheros wireless 802.11n LAN cards.");
 MODULE_LICENSE("Dual BSD/GPL");
 
-/* Common RX processing */
-
-/* Assumes you've already done the endian to CPU conversion */
-static bool ath9k_rx_accept(struct ath_common *common,
-                            struct sk_buff *skb,
-                            struct ieee80211_rx_status *rxs,
-                            struct ath_rx_status *rx_stats,
-                            bool *decrypt_error)
-{
-        struct ath_hw *ah = common->ah;
-        struct ieee80211_hdr *hdr;
-        __le16 fc;
-
-        hdr = (struct ieee80211_hdr *) skb->data;
-        fc = hdr->frame_control;
-
-        if (!rx_stats->rs_datalen)
-                return false;
-        /*
-         * rs_status follows rs_datalen so if rs_datalen is too large
-         * we can take a hint that hardware corrupted it, so ignore
-         * those frames.
-         */
-        if (rx_stats->rs_datalen > common->rx_bufsize)
-                return false;
-
-        /*
-         * rs_more indicates chained descriptors which can be used
-         * to link buffers together for a sort of scatter-gather
-         * operation.
-         * reject the frame, we don't support scatter-gather yet and
-         * the frame is probably corrupt anyway
-         */
-        if (rx_stats->rs_more)
-                return false;
-
-        /*
-         * The rx_stats->rs_status will not be set until the end of the
-         * chained descriptors so it can be ignored if rs_more is set. The
-         * rs_more will be false at the last element of the chained
-         * descriptors.
-         */
-        if (rx_stats->rs_status != 0) {
-                if (rx_stats->rs_status & ATH9K_RXERR_CRC)
-                        rxs->flag |= RX_FLAG_FAILED_FCS_CRC;
-                if (rx_stats->rs_status & ATH9K_RXERR_PHY)
-                        return false;
-
-                if (rx_stats->rs_status & ATH9K_RXERR_DECRYPT) {
-                        *decrypt_error = true;
-                } else if (rx_stats->rs_status & ATH9K_RXERR_MIC) {
-                        if (ieee80211_is_ctl(fc))
-                                /*
-                                 * Sometimes, we get invalid
-                                 * MIC failures on valid control frames.
-                                 * Remove these mic errors.
-                                 */
-                                rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
-                        else
-                                rxs->flag |= RX_FLAG_MMIC_ERROR;
-                }
-                /*
-                 * Reject error frames with the exception of
-                 * decryption and MIC failures. For monitor mode,
-                 * we also ignore the CRC error.
-                 */
-                if (ah->opmode == NL80211_IFTYPE_MONITOR) {
-                        if (rx_stats->rs_status &
-                            ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC |
-                              ATH9K_RXERR_CRC))
-                                return false;
-                } else {
-                        if (rx_stats->rs_status &
-                            ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC)) {
-                                return false;
-                        }
-                }
-        }
-        return true;
-}
-
-static int ath9k_process_rate(struct ath_common *common,
-                              struct ieee80211_hw *hw,
-                              struct ath_rx_status *rx_stats,
-                              struct ieee80211_rx_status *rxs,
-                              struct sk_buff *skb)
-{
-        struct ieee80211_supported_band *sband;
-        enum ieee80211_band band;
-        unsigned int i = 0;
-
-        band = hw->conf.channel->band;
-        sband = hw->wiphy->bands[band];
-
-        if (rx_stats->rs_rate & 0x80) {
-                /* HT rate */
-                rxs->flag |= RX_FLAG_HT;
-                if (rx_stats->rs_flags & ATH9K_RX_2040)
-                        rxs->flag |= RX_FLAG_40MHZ;
-                if (rx_stats->rs_flags & ATH9K_RX_GI)
-                        rxs->flag |= RX_FLAG_SHORT_GI;
-                rxs->rate_idx = rx_stats->rs_rate & 0x7f;
-                return 0;
-        }
-
-        for (i = 0; i < sband->n_bitrates; i++) {
-                if (sband->bitrates[i].hw_value == rx_stats->rs_rate) {
-                        rxs->rate_idx = i;
-                        return 0;
-                }
-                if (sband->bitrates[i].hw_value_short == rx_stats->rs_rate) {
-                        rxs->flag |= RX_FLAG_SHORTPRE;
-                        rxs->rate_idx = i;
-                        return 0;
-                }
-        }
-
-        /*
-         * No valid hardware bitrate found -- we should not get here
-         * because hardware has already validated this frame as OK.
-         */
-        ath_print(common, ATH_DBG_XMIT, "unsupported hw bitrate detected "
-                  "0x%02x using 1 Mbit\n", rx_stats->rs_rate);
-        if ((common->debug_mask & ATH_DBG_XMIT))
-                print_hex_dump_bytes("", DUMP_PREFIX_NONE, skb->data, skb->len);
-
-        return -EINVAL;
-}
-
-static void ath9k_process_rssi(struct ath_common *common,
-                               struct ieee80211_hw *hw,
-                               struct sk_buff *skb,
-                               struct ath_rx_status *rx_stats)
-{
-        struct ath_hw *ah = common->ah;
-        struct ieee80211_sta *sta;
-        struct ieee80211_hdr *hdr;
-        struct ath_node *an;
-        int last_rssi = ATH_RSSI_DUMMY_MARKER;
-        __le16 fc;
-
-        hdr = (struct ieee80211_hdr *)skb->data;
-        fc = hdr->frame_control;
-
-        rcu_read_lock();
-        /*
-         * XXX: use ieee80211_find_sta! This requires quite a bit of work
-         * under the current ath9k virtual wiphy implementation as we have
-         * no way of tying a vif to wiphy. Typically vifs are attached to
-         * at least one sdata of a wiphy on mac80211 but with ath9k virtual
-         * wiphy you'd have to iterate over every wiphy and each sdata.
-         */
-        sta = ieee80211_find_sta_by_hw(hw, hdr->addr2);
-        if (sta) {
-                an = (struct ath_node *) sta->drv_priv;
-                if (rx_stats->rs_rssi != ATH9K_RSSI_BAD &&
-                   !rx_stats->rs_moreaggr)
-                        ATH_RSSI_LPF(an->last_rssi, rx_stats->rs_rssi);
-                last_rssi = an->last_rssi;
-        }
-        rcu_read_unlock();
-
-        if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
-                rx_stats->rs_rssi = ATH_EP_RND(last_rssi,
-                                              ATH_RSSI_EP_MULTIPLIER);
-        if (rx_stats->rs_rssi < 0)
-                rx_stats->rs_rssi = 0;
-
-        /* Update Beacon RSSI, this is used by ANI. */
-        if (ieee80211_is_beacon(fc))
-                ah->stats.avgbrssi = rx_stats->rs_rssi;
-}
-
-/*
- * For Decrypt or Demic errors, we only mark packet status here and always push
- * up the frame up to let mac80211 handle the actual error case, be it no
- * decryption key or real decryption error. This let us keep statistics there.
- */
-int ath9k_cmn_rx_skb_preprocess(struct ath_common *common,
-                                struct ieee80211_hw *hw,
-                                struct sk_buff *skb,
-                                struct ath_rx_status *rx_stats,
-                                struct ieee80211_rx_status *rx_status,
-                                bool *decrypt_error)
-{
-        struct ath_hw *ah = common->ah;
-
-        memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
-
-        /*
-         * everything but the rate is checked here, the rate check is done
-         * separately to avoid doing two lookups for a rate for each frame.
-         */
-        if (!ath9k_rx_accept(common, skb, rx_status, rx_stats, decrypt_error))
-                return -EINVAL;
-
-        ath9k_process_rssi(common, hw, skb, rx_stats);
-
-        if (ath9k_process_rate(common, hw, rx_stats, rx_status, skb))
-                return -EINVAL;
-
-        rx_status->mactime = ath9k_hw_extend_tsf(ah, rx_stats->rs_tstamp);
-        rx_status->band = hw->conf.channel->band;
-        rx_status->freq = hw->conf.channel->center_freq;
-        rx_status->signal = ATH_DEFAULT_NOISE_FLOOR + rx_stats->rs_rssi;
-        rx_status->antenna = rx_stats->rs_antenna;
-        rx_status->flag |= RX_FLAG_TSFT;
-
-        return 0;
-}
-EXPORT_SYMBOL(ath9k_cmn_rx_skb_preprocess);
-
-void ath9k_cmn_rx_skb_postprocess(struct ath_common *common,
-                                  struct sk_buff *skb,
-                                  struct ath_rx_status *rx_stats,
-                                  struct ieee80211_rx_status *rxs,
-                                  bool decrypt_error)
-{
-        struct ath_hw *ah = common->ah;
-        struct ieee80211_hdr *hdr;
-        int hdrlen, padpos, padsize;
-        u8 keyix;
-        __le16 fc;
-
-        /* see if any padding is done by the hw and remove it */
-        hdr = (struct ieee80211_hdr *) skb->data;
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        fc = hdr->frame_control;
-        padpos = ath9k_cmn_padpos(hdr->frame_control);
-
-        /* The MAC header is padded to have 32-bit boundary if the
-         * packet payload is non-zero. The general calculation for
-         * padsize would take into account odd header lengths:
-         * padsize = (4 - padpos % 4) % 4; However, since only
-         * even-length headers are used, padding can only be 0 or 2
-         * bytes and we can optimize this a bit. In addition, we must
-         * not try to remove padding from short control frames that do
-         * not have payload. */
-        padsize = padpos & 3;
-        if (padsize && skb->len>=padpos+padsize+FCS_LEN) {
-                memmove(skb->data + padsize, skb->data, padpos);
-                skb_pull(skb, padsize);
-        }
-
-        keyix = rx_stats->rs_keyix;
-
-        if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error &&
-            ieee80211_has_protected(fc)) {
-                rxs->flag |= RX_FLAG_DECRYPTED;
-        } else if (ieee80211_has_protected(fc)
-                   && !decrypt_error && skb->len >= hdrlen + 4) {
-                keyix = skb->data[hdrlen + 3] >> 6;
-
-                if (test_bit(keyix, common->keymap))
-                        rxs->flag |= RX_FLAG_DECRYPTED;
-        }
-        if (ah->sw_mgmt_crypto &&
-            (rxs->flag & RX_FLAG_DECRYPTED) &&
-            ieee80211_is_mgmt(fc))
-                /* Use software decrypt for management frames. */
-                rxs->flag &= ~RX_FLAG_DECRYPTED;
-}
-EXPORT_SYMBOL(ath9k_cmn_rx_skb_postprocess);
-
 int ath9k_cmn_padpos(__le16 frame_control)
 {
         int padpos = 24;
@@ -475,10 +211,14 @@ static int ath_reserve_key_cache_slot_tkip(struct ath_common *common)
         return -1;
 }
 
-static int ath_reserve_key_cache_slot(struct ath_common *common)
+static int ath_reserve_key_cache_slot(struct ath_common *common,
+                                      enum ieee80211_key_alg alg)
 {
         int i;
 
+        if (alg == ALG_TKIP)
+                return ath_reserve_key_cache_slot_tkip(common);
+
         /* First, try to find slots that would not be available for TKIP. */
         if (common->splitmic) {
                 for (i = IEEE80211_WEP_NKID; i < common->keymax / 4; i++) {
@@ -547,6 +287,7 @@ int ath9k_cmn_key_config(struct ath_common *common,
         struct ath_hw *ah = common->ah;
         struct ath9k_keyval hk;
         const u8 *mac = NULL;
+        u8 gmac[ETH_ALEN];
         int ret = 0;
         int idx;
 
@@ -570,9 +311,23 @@ int ath9k_cmn_key_config(struct ath_common *common,
         memcpy(hk.kv_val, key->key, key->keylen);
 
         if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
-                /* For now, use the default keys for broadcast keys. This may
-                 * need to change with virtual interfaces. */
-                idx = key->keyidx;
+                switch (vif->type) {
+                case NL80211_IFTYPE_AP:
+                        memcpy(gmac, vif->addr, ETH_ALEN);
+                        gmac[0] |= 0x01;
+                        mac = gmac;
+                        idx = ath_reserve_key_cache_slot(common, key->alg);
+                        break;
+                case NL80211_IFTYPE_ADHOC:
+                        memcpy(gmac, sta->addr, ETH_ALEN);
+                        gmac[0] |= 0x01;
+                        mac = gmac;
+                        idx = ath_reserve_key_cache_slot(common, key->alg);
+                        break;
+                default:
+                        idx = key->keyidx;
+                        break;
+                }
         } else if (key->keyidx) {
                 if (WARN_ON(!sta))
                         return -EOPNOTSUPP;
@@ -589,14 +344,12 @@ int ath9k_cmn_key_config(struct ath_common *common,
                         return -EOPNOTSUPP;
                 mac = sta->addr;
 
-                if (key->alg == ALG_TKIP)
-                        idx = ath_reserve_key_cache_slot_tkip(common);
-                else
-                        idx = ath_reserve_key_cache_slot(common);
-                if (idx < 0)
-                        return -ENOSPC; /* no free key cache entries */
+                idx = ath_reserve_key_cache_slot(common, key->alg);
         }
 
+        if (idx < 0)
+                return -ENOSPC; /* no free key cache entries */
+
         if (key->alg == ALG_TKIP)
                 ret = ath_setkey_tkip(common, idx, key->key, &hk, mac,
                                       vif->type == NL80211_IFTYPE_AP);
@@ -644,6 +397,19 @@ void ath9k_cmn_key_delete(struct ath_common *common,
 }
 EXPORT_SYMBOL(ath9k_cmn_key_delete);
 
+int ath9k_cmn_count_streams(unsigned int chainmask, int max)
+{
+        int streams = 0;
+
+        do {
+                if (++streams == max)
+                        break;
+        } while ((chainmask = chainmask & (chainmask - 1)));
+
+        return streams;
+}
+EXPORT_SYMBOL(ath9k_cmn_count_streams);
+
 static int __init ath9k_cmn_init(void)
 {
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index e08f7e5a26e0..97809d39c73f 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -52,82 +52,6 @@
 #define ATH_EP_RND(x, mul)                                              \
         ((((x)%(mul)) >= ((mul)/2)) ? ((x) + ((mul) - 1)) / (mul) : (x)/(mul))
 
-struct ath_atx_ac {
-        int sched;
-        int qnum;
-        struct list_head list;
-        struct list_head tid_q;
-};
-
-struct ath_buf_state {
-        int bfs_nframes;
-        u16 bfs_al;
-        u16 bfs_frmlen;
-        int bfs_seqno;
-        int bfs_tidno;
-        int bfs_retries;
-        u8 bf_type;
-        u32 bfs_keyix;
-        enum ath9k_key_type bfs_keytype;
-};
-
-struct ath_buf {
-        struct list_head list;
-        struct ath_buf *bf_lastbf;      /* last buf of this unit (a frame or
-                                           an aggregate) */
-        struct ath_buf *bf_next;        /* next subframe in the aggregate */
-        struct sk_buff *bf_mpdu;        /* enclosing frame structure */
-        void *bf_desc;                  /* virtual addr of desc */
-        dma_addr_t bf_daddr;            /* physical addr of desc */
-        dma_addr_t bf_buf_addr;         /* physical addr of data buffer */
-        bool bf_stale;
-        bool bf_isnullfunc;
-        bool bf_tx_aborted;
-        u16 bf_flags;
-        struct ath_buf_state bf_state;
-        dma_addr_t bf_dmacontext;
-        struct ath_wiphy *aphy;
-};
-
-struct ath_atx_tid {
-        struct list_head list;
-        struct list_head buf_q;
-        struct ath_node *an;
-        struct ath_atx_ac *ac;
-        struct ath_buf *tx_buf[ATH_TID_MAX_BUFS];
-        u16 seq_start;
-        u16 seq_next;
-        u16 baw_size;
-        int tidno;
-        int baw_head;   /* first un-acked tx buffer */
-        int baw_tail;   /* next unused tx buffer slot */
-        int sched;
-        int paused;
-        u8 state;
-};
-
-struct ath_node {
-        struct ath_common *common;
-        struct ath_atx_tid tid[WME_NUM_TID];
-        struct ath_atx_ac ac[WME_NUM_AC];
-        u16 maxampdu;
-        u8 mpdudensity;
-        int last_rssi;
-};
-
-int ath9k_cmn_rx_skb_preprocess(struct ath_common *common,
-                                struct ieee80211_hw *hw,
-                                struct sk_buff *skb,
-                                struct ath_rx_status *rx_stats,
-                                struct ieee80211_rx_status *rx_status,
-                                bool *decrypt_error);
-
-void ath9k_cmn_rx_skb_postprocess(struct ath_common *common,
-                                  struct sk_buff *skb,
-                                  struct ath_rx_status *rx_stats,
-                                  struct ieee80211_rx_status *rxs,
-                                  bool decrypt_error);
-
 int ath9k_cmn_padpos(__le16 frame_control);
 int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb);
 void ath9k_cmn_update_ichannel(struct ieee80211_hw *hw,
@@ -140,3 +64,4 @@ int ath9k_cmn_key_config(struct ath_common *common,
                          struct ieee80211_key_conf *key);
 void ath9k_cmn_key_delete(struct ath_common *common,
                           struct ieee80211_key_conf *key);
+int ath9k_cmn_count_streams(unsigned int chainmask, int max);
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 29898f8d1893..54aae931424e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -42,7 +42,7 @@ static ssize_t read_file_debug(struct file *file, char __user *user_buf,
         char buf[32];
         unsigned int len;
 
-        len = snprintf(buf, sizeof(buf), "0x%08x\n", common->debug_mask);
+        len = sprintf(buf, "0x%08x\n", common->debug_mask);
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -57,7 +57,7 @@ static ssize_t write_file_debug(struct file *file, const char __user *user_buf,
 
         len = min(count, sizeof(buf) - 1);
         if (copy_from_user(buf, user_buf, len))
-                return -EINVAL;
+                return -EFAULT;
 
         buf[len] = '\0';
         if (strict_strtoul(buf, 0, &mask))
@@ -86,7 +86,7 @@ static ssize_t read_file_tx_chainmask(struct file *file, char __user *user_buf,
         char buf[32];
         unsigned int len;
 
-        len = snprintf(buf, sizeof(buf), "0x%08x\n", common->tx_chainmask);
+        len = sprintf(buf, "0x%08x\n", common->tx_chainmask);
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -101,7 +101,7 @@ static ssize_t write_file_tx_chainmask(struct file *file, const char __user *use
 
         len = min(count, sizeof(buf) - 1);
         if (copy_from_user(buf, user_buf, len))
-                return -EINVAL;
+                return -EFAULT;
 
         buf[len] = '\0';
         if (strict_strtoul(buf, 0, &mask))
@@ -128,7 +128,7 @@ static ssize_t read_file_rx_chainmask(struct file *file, char __user *user_buf,
         char buf[32];
         unsigned int len;
 
-        len = snprintf(buf, sizeof(buf), "0x%08x\n", common->rx_chainmask);
+        len = sprintf(buf, "0x%08x\n", common->rx_chainmask);
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -143,7 +143,7 @@ static ssize_t write_file_rx_chainmask(struct file *file, const char __user *use
 
         len = min(count, sizeof(buf) - 1);
         if (copy_from_user(buf, user_buf, len))
-                return -EINVAL;
+                return -EFAULT;
 
         buf[len] = '\0';
         if (strict_strtoul(buf, 0, &mask))
@@ -176,7 +176,7 @@ static ssize_t read_file_dma(struct file *file, char __user *user_buf,
 
         buf = kmalloc(DMA_BUF_LEN, GFP_KERNEL);
         if (!buf)
-                return 0;
+                return -ENOMEM;
 
         ath9k_ps_wakeup(sc);
 
@@ -248,6 +248,9 @@ static ssize_t read_file_dma(struct file *file, char __user *user_buf,
 
         ath9k_ps_restore(sc);
 
+        if (len > DMA_BUF_LEN)
+                len = DMA_BUF_LEN;
+
         retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
         kfree(buf);
         return retval;
@@ -269,6 +272,8 @@ void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status)
                         sc->debug.stats.istats.rxlp++;
                 if (status & ATH9K_INT_RXHP)
                         sc->debug.stats.istats.rxhp++;
+                if (status & ATH9K_INT_BB_WATCHDOG)
+                        sc->debug.stats.istats.bb_watchdog++;
         } else {
                 if (status & ATH9K_INT_RX)
                         sc->debug.stats.istats.rxok++;
@@ -319,6 +324,9 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
                         "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
                 len += snprintf(buf + len, sizeof(buf) - len,
                         "%8s: %10u\n", "RXHP", sc->debug.stats.istats.rxhp);
+                len += snprintf(buf + len, sizeof(buf) - len,
+                        "%8s: %10u\n", "WATCHDOG",
+                        sc->debug.stats.istats.bb_watchdog);
         } else {
                 len += snprintf(buf + len, sizeof(buf) - len,
                         "%8s: %10u\n", "RX", sc->debug.stats.istats.rxok);
@@ -358,6 +366,9 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
         len += snprintf(buf + len, sizeof(buf) - len,
                 "%8s: %10u\n", "TOTAL", sc->debug.stats.istats.total);
 
+        if (len > sizeof(buf))
+                len = sizeof(buf);
+
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -397,11 +408,10 @@ static ssize_t read_file_rcstat(struct file *file, char __user *user_buf,
         if (sc->cur_rate_table == NULL)
                 return 0;
 
-        max = 80 + sc->cur_rate_table->rate_cnt * 1024;
-        buf = kmalloc(max + 1, GFP_KERNEL);
+        max = 80 + sc->cur_rate_table->rate_cnt * 1024 + 1;
+        buf = kmalloc(max, GFP_KERNEL);
         if (buf == NULL)
-                return 0;
-        buf[max] = 0;
+                return -ENOMEM;
 
         len += sprintf(buf, "%6s %6s %6s "
                        "%10s %10s %10s %10s\n",
@@ -443,6 +453,9 @@ static ssize_t read_file_rcstat(struct file *file, char __user *user_buf,
                         stats->per);
         }
 
+        if (len > max)
+                len = max;
+
         retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
         kfree(buf);
         return retval;
@@ -505,6 +518,9 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
         len += snprintf(buf + len, sizeof(buf) - len,
                         "addrmask: %pM\n", addr);
 
+        if (len > sizeof(buf))
+                len = sizeof(buf);
+
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -614,10 +630,10 @@ static const struct file_operations fops_wiphy = {
         do {                                                            \
                 len += snprintf(buf + len, size - len,                  \
                                 "%s%13u%11u%10u%10u\n", str,            \
-                sc->debug.stats.txstats[sc->tx.hwq_map[ATH9K_WME_AC_BE]].elem, \
-                sc->debug.stats.txstats[sc->tx.hwq_map[ATH9K_WME_AC_BK]].elem, \
-                sc->debug.stats.txstats[sc->tx.hwq_map[ATH9K_WME_AC_VI]].elem, \
-                sc->debug.stats.txstats[sc->tx.hwq_map[ATH9K_WME_AC_VO]].elem); \
+                sc->debug.stats.txstats[sc->tx.hwq_map[WME_AC_BE]].elem, \
+                sc->debug.stats.txstats[sc->tx.hwq_map[WME_AC_BK]].elem, \
+                sc->debug.stats.txstats[sc->tx.hwq_map[WME_AC_VI]].elem, \
+                sc->debug.stats.txstats[sc->tx.hwq_map[WME_AC_VO]].elem); \
 } while(0)
 
 static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
@@ -630,7 +646,7 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
 
         buf = kzalloc(size, GFP_KERNEL);
         if (buf == NULL)
-                return 0;
+                return -ENOMEM;
 
         len += sprintf(buf, "%30s %10s%10s%10s\n\n", "BE", "BK", "VI", "VO");
 
@@ -648,6 +664,9 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
         PR("DATA Underrun:   ", data_underrun);
         PR("DELIM Underrun:  ", delim_underrun);
 
+        if (len > size)
+                len = size;
+
         retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
         kfree(buf);
 
@@ -700,7 +719,7 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
 
         buf = kzalloc(size, GFP_KERNEL);
         if (buf == NULL)
-                return 0;
+                return -ENOMEM;
 
         len += snprintf(buf + len, size - len,
                         "%18s : %10u\n", "CRC ERR",
@@ -751,6 +770,9 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         PHY_ERR("HT-LENGTH", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
         PHY_ERR("HT-RATE", ATH9K_PHYERR_HT_RATE_ILLEGAL);
 
+        if (len > size)
+                len = size;
+
         retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
         kfree(buf);
 
@@ -802,7 +824,7 @@ static ssize_t read_file_regidx(struct file *file, char __user *user_buf,
         char buf[32];
         unsigned int len;
 
-        len = snprintf(buf, sizeof(buf), "0x%08x\n", sc->debug.regidx);
+        len = sprintf(buf, "0x%08x\n", sc->debug.regidx);
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -816,7 +838,7 @@ static ssize_t write_file_regidx(struct file *file, const char __user *user_buf,
 
         len = min(count, sizeof(buf) - 1);
         if (copy_from_user(buf, user_buf, len))
-                return -EINVAL;
+                return -EFAULT;
 
         buf[len] = '\0';
         if (strict_strtoul(buf, 0, &regidx))
@@ -843,7 +865,7 @@ static ssize_t read_file_regval(struct file *file, char __user *user_buf,
         u32 regval;
 
         regval = REG_READ_D(ah, sc->debug.regidx);
-        len = snprintf(buf, sizeof(buf), "0x%08x\n", regval);
+        len = sprintf(buf, "0x%08x\n", regval);
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -858,7 +880,7 @@ static ssize_t write_file_regval(struct file *file, const char __user *user_buf,
 
         len = min(count, sizeof(buf) - 1);
         if (copy_from_user(buf, user_buf, len))
-                return -EINVAL;
+                return -EFAULT;
 
         buf[len] = '\0';
         if (strict_strtoul(buf, 0, &regval))
@@ -934,6 +956,10 @@ int ath9k_init_debug(struct ath_hw *ah)
                         sc->debug.debugfs_phy, sc, &fops_regval))
                 goto err;
 
+        if (!debugfs_create_bool("ignore_extcca", S_IRUSR | S_IWUSR,
+                        sc->debug.debugfs_phy, &ah->config.cwm_ignore_extcca))
+                goto err;
+
         sc->debug.regidx = 0;
         return 0;
 err:
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 5147b8709e10..5d21704e87ff 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -53,6 +53,7 @@ struct ath_buf;
  * @cabend: RX End of CAB traffic
  * @dtimsync: DTIM sync lossage
  * @dtim: RX Beacon with DTIM
+ * @bb_watchdog: Baseband watchdog
  */
 struct ath_interrupt_stats {
         u32 total;
@@ -76,6 +77,7 @@ struct ath_interrupt_stats {
         u32 cabend;
         u32 dtimsync;
         u32 dtim;
+        u32 bb_watchdog;
 };
 
 struct ath_rc_stats {
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index ca8704a9d7ac..1266333f586d 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -24,6 +24,14 @@ static inline u16 ath9k_hw_fbin2freq(u8 fbin, bool is2GHz)
         return (u16) ((is2GHz) ? (2300 + fbin) : (4800 + 5 * fbin));
 }
 
+void ath9k_hw_analog_shift_regwrite(struct ath_hw *ah, u32 reg, u32 val)
+{
+        REG_WRITE(ah, reg, val);
+
+        if (ah->config.analog_shiftreg)
+                udelay(100);
+}
+
 void ath9k_hw_analog_shift_rmw(struct ath_hw *ah, u32 reg, u32 mask,
                                u32 shift, u32 val)
 {
@@ -250,6 +258,27 @@ u16 ath9k_hw_get_max_edge_power(u16 freq, struct cal_ctl_edges *pRdEdgesPower,
         return twiceMaxEdgePower;
 }
 
+void ath9k_hw_update_regulatory_maxpower(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
+
+        switch (ar5416_get_ntxchains(ah->txchainmask)) {
+        case 1:
+                break;
+        case 2:
+                regulatory->max_power_level += INCREASE_MAXPOW_BY_TWO_CHAIN;
+                break;
+        case 3:
+                regulatory->max_power_level += INCREASE_MAXPOW_BY_THREE_CHAIN;
+                break;
+        default:
+                ath_print(common, ATH_DBG_EEPROM,
+                          "Invalid chainmask configuration\n");
+                break;
+        }
+}
+
 int ath9k_hw_eeprom_init(struct ath_hw *ah)
 {
         int status;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index 21354c15a9a9..bdd8aa054b80 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -263,7 +263,8 @@ enum eeprom_param {
         EEP_PWR_TABLE_OFFSET,
         EEP_DRIVE_STRENGTH,
         EEP_INTERNAL_REGULATOR,
-        EEP_SWREG
+        EEP_SWREG,
+        EEP_PAPRD,
 };
 
 enum ar5416_rates {
@@ -679,6 +680,7 @@ struct eeprom_ops {
         u16 (*get_spur_channel)(struct ath_hw *ah, u16 i, bool is2GHz);
 };
 
+void ath9k_hw_analog_shift_regwrite(struct ath_hw *ah, u32 reg, u32 val);
 void ath9k_hw_analog_shift_rmw(struct ath_hw *ah, u32 reg, u32 mask,
                                u32 shift, u32 val);
 int16_t ath9k_hw_interpolate(u16 target, u16 srcLeft, u16 srcRight,
@@ -704,6 +706,7 @@ void ath9k_hw_get_target_powers(struct ath_hw *ah,
                                 u16 numRates, bool isHt40Target);
 u16 ath9k_hw_get_max_edge_power(u16 freq, struct cal_ctl_edges *pRdEdgesPower,
                                 bool is2GHz, int num_band_edges);
+void ath9k_hw_update_regulatory_maxpower(struct ath_hw *ah);
 int ath9k_hw_eeprom_init(struct ath_hw *ah);
 
 #define ar5416_get_ntxchains(_txchainmask)                      \
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 41a77d1bd439..e25a2abbf561 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -249,6 +249,7 @@ static void ath9k_hw_get_4k_gain_boundaries_pdadcs(struct ath_hw *ah,
         struct chan_centers centers;
 #define PD_GAIN_BOUNDARY_DEFAULT 58;
 
+        memset(&minPwrT4, 0, AR9287_NUM_PD_GAINS);
         ath9k_hw_get_channel_centers(ah, chan, &centers);
 
         for (numPiers = 0; numPiers < availPiers; numPiers++) {
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index b471db5fb82d..39a41053705f 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -17,17 +17,19 @@
 #include "hw.h"
 #include "ar9002_phy.h"
 
-static int ath9k_hw_AR9287_get_eeprom_ver(struct ath_hw *ah)
+#define NUM_EEP_WORDS (sizeof(struct ar9287_eeprom) / sizeof(u16))
+
+static int ath9k_hw_ar9287_get_eeprom_ver(struct ath_hw *ah)
 {
         return (ah->eeprom.map9287.baseEepHeader.version >> 12) & 0xF;
 }
 
-static int ath9k_hw_AR9287_get_eeprom_rev(struct ath_hw *ah)
+static int ath9k_hw_ar9287_get_eeprom_rev(struct ath_hw *ah)
 {
         return (ah->eeprom.map9287.baseEepHeader.version) & 0xFFF;
 }
 
-static bool ath9k_hw_AR9287_fill_eeprom(struct ath_hw *ah)
+static bool ath9k_hw_ar9287_fill_eeprom(struct ath_hw *ah)
 {
         struct ar9287_eeprom *eep = &ah->eeprom.map9287;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -40,20 +42,20 @@ static bool ath9k_hw_AR9287_fill_eeprom(struct ath_hw *ah)
                           "Reading from EEPROM, not flash\n");
         }
 
-        for (addr = 0; addr < sizeof(struct ar9287_eeprom) / sizeof(u16);
-                        addr++) {
-                if (!ath9k_hw_nvram_read(common,
-                                         addr + eep_start_loc, eep_data)) {
+        for (addr = 0; addr < NUM_EEP_WORDS; addr++) {
+                if (!ath9k_hw_nvram_read(common, addr + eep_start_loc,
+                                         eep_data)) {
                         ath_print(common, ATH_DBG_EEPROM,
                                   "Unable to read eeprom region\n");
                         return false;
                 }
                 eep_data++;
         }
+
         return true;
 }
 
-static int ath9k_hw_AR9287_check_eeprom(struct ath_hw *ah)
+static int ath9k_hw_ar9287_check_eeprom(struct ath_hw *ah)
 {
         u32 sum = 0, el, integer;
         u16 temp, word, magic, magic2, *eepdata;
@@ -63,8 +65,8 @@ static int ath9k_hw_AR9287_check_eeprom(struct ath_hw *ah)
         struct ath_common *common = ath9k_hw_common(ah);
 
         if (!ath9k_hw_use_flash(ah)) {
-                if (!ath9k_hw_nvram_read(common,
-                                         AR5416_EEPROM_MAGIC_OFFSET, &magic)) {
+                if (!ath9k_hw_nvram_read(common, AR5416_EEPROM_MAGIC_OFFSET,
+                                         &magic)) {
                         ath_print(common, ATH_DBG_FATAL,
                                   "Reading Magic # failed\n");
                         return false;
@@ -72,6 +74,7 @@ static int ath9k_hw_AR9287_check_eeprom(struct ath_hw *ah)
 
                 ath_print(common, ATH_DBG_EEPROM,
                           "Read Magic = 0x%04X\n", magic);
+
                 if (magic != AR5416_EEPROM_MAGIC) {
                         magic2 = swab16(magic);
 
@@ -79,9 +82,7 @@ static int ath9k_hw_AR9287_check_eeprom(struct ath_hw *ah)
                                 need_swap = true;
                                 eepdata = (u16 *)(&ah->eeprom);
 
-                                for (addr = 0;
-                                     addr < sizeof(struct ar9287_eeprom) / sizeof(u16);
-                                     addr++) {
+                                for (addr = 0; addr < NUM_EEP_WORDS; addr++) {
                                         temp = swab16(*eepdata);
                                         *eepdata = temp;
                                         eepdata++;
@@ -89,13 +90,14 @@ static int ath9k_hw_AR9287_check_eeprom(struct ath_hw *ah)
                         } else {
                                 ath_print(common, ATH_DBG_FATAL,
                                           "Invalid EEPROM Magic. "
-                                          "endianness mismatch.\n");
+                                          "Endianness mismatch.\n");
                                 return -EINVAL;
                         }
                 }
         }
-        ath_print(common, ATH_DBG_EEPROM, "need_swap = %s.\n", need_swap ?
-                  "True" : "False");
+
+        ath_print(common, ATH_DBG_EEPROM, "need_swap = %s.\n",
+                  need_swap ? "True" : "False");
 
         if (need_swap)
                 el = swab16(ah->eeprom.map9287.baseEepHeader.length);
@@ -108,6 +110,7 @@ static int ath9k_hw_AR9287_check_eeprom(struct ath_hw *ah)
                 el = el / sizeof(u16);
 
         eepdata = (u16 *)(&ah->eeprom);
+
         for (i = 0; i < el; i++)
                 sum ^= *eepdata++;
 
@@ -161,7 +164,7 @@ static int ath9k_hw_AR9287_check_eeprom(struct ath_hw *ah)
         return 0;
 }
 
-static u32 ath9k_hw_AR9287_get_eeprom(struct ath_hw *ah,
+static u32 ath9k_hw_ar9287_get_eeprom(struct ath_hw *ah,
                                       enum eeprom_param param)
 {
         struct ar9287_eeprom *eep = &ah->eeprom.map9287;
@@ -170,6 +173,7 @@ static u32 ath9k_hw_AR9287_get_eeprom(struct ath_hw *ah,
         u16 ver_minor;
 
         ver_minor = pBase->version & AR9287_EEP_VER_MINOR_MASK;
+
         switch (param) {
         case EEP_NFTHRESH_2:
                 return pModal->noiseFloorThreshCh[0];
@@ -214,29 +218,30 @@ static u32 ath9k_hw_AR9287_get_eeprom(struct ath_hw *ah,
         }
 }
 
-
-static void ath9k_hw_get_AR9287_gain_boundaries_pdadcs(struct ath_hw *ah,
-                                   struct ath9k_channel *chan,
-                                   struct cal_data_per_freq_ar9287 *pRawDataSet,
-                                   u8 *bChans,  u16 availPiers,
-                                   u16 tPdGainOverlap, int16_t *pMinCalPower,
-                                   u16 *pPdGainBoundaries, u8 *pPDADCValues,
-                                   u16 numXpdGains)
+static void ath9k_hw_get_ar9287_gain_boundaries_pdadcs(struct ath_hw *ah,
+                               struct ath9k_channel *chan,
+                               struct cal_data_per_freq_ar9287 *pRawDataSet,
+                               u8 *bChans, u16 availPiers,
+                               u16 tPdGainOverlap,
+                               int16_t *pMinCalPower,
+                               u16 *pPdGainBoundaries,
+                               u8 *pPDADCValues,
+                               u16 numXpdGains)
 {
-#define TMP_VAL_VPD_TABLE \
+#define TMP_VAL_VPD_TABLE                                               \
         ((vpdTableI[i][sizeCurrVpdTable - 1] + (ss - maxIndex + 1) * vpdStep));
 
-        int       i, j, k;
-        int16_t   ss;
-        u16  idxL = 0, idxR = 0, numPiers;
-        u8   *pVpdL, *pVpdR, *pPwrL, *pPwrR;
-        u8   minPwrT4[AR9287_NUM_PD_GAINS];
-        u8   maxPwrT4[AR9287_NUM_PD_GAINS];
-        int16_t   vpdStep;
-        int16_t   tmpVal;
-        u16  sizeCurrVpdTable, maxIndex, tgtIndex;
-        bool    match;
-        int16_t  minDelta = 0;
+        int i, j, k;
+        int16_t ss;
+        u16 idxL = 0, idxR = 0, numPiers;
+        u8 *pVpdL, *pVpdR, *pPwrL, *pPwrR;
+        u8 minPwrT4[AR9287_NUM_PD_GAINS];
+        u8 maxPwrT4[AR9287_NUM_PD_GAINS];
+        int16_t vpdStep;
+        int16_t tmpVal;
+        u16 sizeCurrVpdTable, maxIndex, tgtIndex;
+        bool match;
+        int16_t minDelta = 0;
         struct chan_centers centers;
         static u8 vpdTableL[AR5416_EEP4K_NUM_PD_GAINS]
                 [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
@@ -245,6 +250,7 @@ static void ath9k_hw_get_AR9287_gain_boundaries_pdadcs(struct ath_hw *ah,
         static u8 vpdTableI[AR5416_EEP4K_NUM_PD_GAINS]
                 [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
 
+        memset(&minPwrT4, 0, AR9287_NUM_PD_GAINS);
         ath9k_hw_get_channel_centers(ah, chan, &centers);
 
         for (numPiers = 0; numPiers < availPiers; numPiers++) {
@@ -253,18 +259,18 @@ static void ath9k_hw_get_AR9287_gain_boundaries_pdadcs(struct ath_hw *ah,
         }
 
         match = ath9k_hw_get_lower_upper_index(
-                                   (u8)FREQ2FBIN(centers.synth_center,
-                                    IS_CHAN_2GHZ(chan)), bChans, numPiers,
-                                    &idxL, &idxR);
+                (u8)FREQ2FBIN(centers.synth_center, IS_CHAN_2GHZ(chan)),
+                bChans, numPiers, &idxL, &idxR);
 
         if (match) {
                 for (i = 0; i < numXpdGains; i++) {
                         minPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][0];
                         maxPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][4];
                         ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
-                                        pRawDataSet[idxL].pwrPdg[i],
-                                        pRawDataSet[idxL].vpdPdg[i],
-                                        AR9287_PD_GAIN_ICEPTS, vpdTableI[i]);
+                                                pRawDataSet[idxL].pwrPdg[i],
+                                                pRawDataSet[idxL].vpdPdg[i],
+                                                AR9287_PD_GAIN_ICEPTS,
+                                                vpdTableI[i]);
                 }
         } else {
                 for (i = 0; i < numXpdGains; i++) {
@@ -275,61 +281,59 @@ static void ath9k_hw_get_AR9287_gain_boundaries_pdadcs(struct ath_hw *ah,
 
                         minPwrT4[i] = max(pPwrL[0], pPwrR[0]);
 
-                        maxPwrT4[i] =
-                                min(pPwrL[AR9287_PD_GAIN_ICEPTS - 1],
-                                    pPwrR[AR9287_PD_GAIN_ICEPTS - 1]);
+                        maxPwrT4[i] = min(pPwrL[AR9287_PD_GAIN_ICEPTS - 1],
+                                          pPwrR[AR9287_PD_GAIN_ICEPTS - 1]);
 
                         ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
-                                        pPwrL, pVpdL,
-                                        AR9287_PD_GAIN_ICEPTS,
-                                        vpdTableL[i]);
+                                                pPwrL, pVpdL,
+                                                AR9287_PD_GAIN_ICEPTS,
+                                                vpdTableL[i]);
                         ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
-                                        pPwrR, pVpdR,
-                                        AR9287_PD_GAIN_ICEPTS,
-                                        vpdTableR[i]);
+                                                pPwrR, pVpdR,
+                                                AR9287_PD_GAIN_ICEPTS,
+                                                vpdTableR[i]);
 
                         for (j = 0; j <= (maxPwrT4[i] - minPwrT4[i]) / 2; j++) {
-                                vpdTableI[i][j] =
-                                        (u8)(ath9k_hw_interpolate((u16)
-                                        FREQ2FBIN(centers. synth_center,
-                                        IS_CHAN_2GHZ(chan)),
-                                        bChans[idxL], bChans[idxR],
-                                        vpdTableL[i][j], vpdTableR[i][j]));
+                                vpdTableI[i][j] = (u8)(ath9k_hw_interpolate(
+                                       (u16)FREQ2FBIN(centers. synth_center,
+                                                      IS_CHAN_2GHZ(chan)),
+                                       bChans[idxL], bChans[idxR],
+                                       vpdTableL[i][j], vpdTableR[i][j]));
                         }
                 }
         }
-        *pMinCalPower = (int16_t)(minPwrT4[0] / 2);
 
+        *pMinCalPower = (int16_t)(minPwrT4[0] / 2);
         k = 0;
+
         for (i = 0; i < numXpdGains; i++) {
                 if (i == (numXpdGains - 1))
-                        pPdGainBoundaries[i] = (u16)(maxPwrT4[i] / 2);
+                        pPdGainBoundaries[i] =
+                                (u16)(maxPwrT4[i] / 2);
                 else
-                        pPdGainBoundaries[i] = (u16)((maxPwrT4[i] +
-                                                      minPwrT4[i+1]) / 4);
+                        pPdGainBoundaries[i] =
+                                (u16)((maxPwrT4[i] + minPwrT4[i+1]) / 4);
 
                 pPdGainBoundaries[i] = min((u16)AR5416_MAX_RATE_POWER,
-                                            pPdGainBoundaries[i]);
+                                           pPdGainBoundaries[i]);
 
 
-                if ((i == 0) && !AR_SREV_5416_20_OR_LATER(ah)) {
-                        minDelta = pPdGainBoundaries[0] - 23;
-                        pPdGainBoundaries[0] = 23;
-                } else
-                        minDelta = 0;
+                minDelta = 0;
 
                 if (i == 0) {
                         if (AR_SREV_9280_10_OR_LATER(ah))
                                 ss = (int16_t)(0 - (minPwrT4[i] / 2));
                         else
                                 ss = 0;
-                } else
+                } else {
                         ss = (int16_t)((pPdGainBoundaries[i-1] -
-                                       (minPwrT4[i] / 2)) -
+                                        (minPwrT4[i] / 2)) -
                                        tPdGainOverlap + 1 + minDelta);
+                }
 
                 vpdStep = (int16_t)(vpdTableI[i][1] - vpdTableI[i][0]);
                 vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
+
                 while ((ss < 0) && (k < (AR9287_NUM_PDADC_VALUES - 1))) {
                         tmpVal = (int16_t)(vpdTableI[i][0] + ss * vpdStep);
                         pPDADCValues[k++] = (u8)((tmpVal < 0) ? 0 : tmpVal);
@@ -348,12 +352,13 @@ static void ath9k_hw_get_AR9287_gain_boundaries_pdadcs(struct ath_hw *ah,
                 vpdStep = (int16_t)(vpdTableI[i][sizeCurrVpdTable - 1] -
                                     vpdTableI[i][sizeCurrVpdTable - 2]);
                 vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
+
                 if (tgtIndex > maxIndex) {
                         while ((ss <= tgtIndex) &&
                                 (k < (AR9287_NUM_PDADC_VALUES - 1))) {
                                 tmpVal = (int16_t) TMP_VAL_VPD_TABLE;
-                                pPDADCValues[k++] = (u8)((tmpVal > 255) ?
-                                                          255 : tmpVal);
+                                pPDADCValues[k++] =
+                                        (u8)((tmpVal > 255) ? 255 : tmpVal);
                                 ss++;
                         }
                 }
@@ -375,10 +380,9 @@ static void ath9k_hw_get_AR9287_gain_boundaries_pdadcs(struct ath_hw *ah,
 static void ar9287_eeprom_get_tx_gain_index(struct ath_hw *ah,
                             struct ath9k_channel *chan,
                             struct cal_data_op_loop_ar9287 *pRawDatasetOpLoop,
-                            u8 *pCalChans,  u16 availPiers,
-                            int8_t *pPwr)
+                            u8 *pCalChans,  u16 availPiers, int8_t *pPwr)
 {
-        u16  idxL = 0, idxR = 0, numPiers;
+        u16 idxL = 0, idxR = 0, numPiers;
         bool match;
         struct chan_centers centers;
 
@@ -390,15 +394,14 @@ static void ar9287_eeprom_get_tx_gain_index(struct ath_hw *ah,
         }
 
         match = ath9k_hw_get_lower_upper_index(
-                        (u8)FREQ2FBIN(centers.synth_center, IS_CHAN_2GHZ(chan)),
-                        pCalChans, numPiers,
-                        &idxL, &idxR);
+                (u8)FREQ2FBIN(centers.synth_center, IS_CHAN_2GHZ(chan)),
+                pCalChans, numPiers, &idxL, &idxR);
 
         if (match) {
                 *pPwr = (int8_t) pRawDatasetOpLoop[idxL].pwrPdg[0][0];
         } else {
                 *pPwr = ((int8_t) pRawDatasetOpLoop[idxL].pwrPdg[0][0] +
-                            (int8_t) pRawDatasetOpLoop[idxR].pwrPdg[0][0])/2;
+                         (int8_t) pRawDatasetOpLoop[idxR].pwrPdg[0][0])/2;
         }
 
 }
@@ -409,16 +412,22 @@ static void ar9287_eeprom_olpc_set_pdadcs(struct ath_hw *ah,
         u32 tmpVal;
         u32 a;
 
+        /* Enable OLPC for chain 0 */
+
         tmpVal = REG_READ(ah, 0xa270);
         tmpVal = tmpVal & 0xFCFFFFFF;
         tmpVal = tmpVal | (0x3 << 24);
         REG_WRITE(ah, 0xa270, tmpVal);
 
+        /* Enable OLPC for chain 1 */
+
         tmpVal = REG_READ(ah, 0xb270);
         tmpVal = tmpVal & 0xFCFFFFFF;
         tmpVal = tmpVal | (0x3 << 24);
         REG_WRITE(ah, 0xb270, tmpVal);
 
+        /* Write the OLPC ref power for chain 0 */
+
         if (chain == 0) {
                 tmpVal = REG_READ(ah, 0xa398);
                 tmpVal = tmpVal & 0xff00ffff;
@@ -427,6 +436,8 @@ static void ar9287_eeprom_olpc_set_pdadcs(struct ath_hw *ah,
                 REG_WRITE(ah, 0xa398, tmpVal);
         }
 
+        /* Write the OLPC ref power for chain 1 */
+
         if (chain == 1) {
                 tmpVal = REG_READ(ah, 0xb398);
                 tmpVal = tmpVal & 0xff00ffff;
@@ -436,28 +447,29 @@ static void ar9287_eeprom_olpc_set_pdadcs(struct ath_hw *ah,
         }
 }
 
-static void ath9k_hw_set_AR9287_power_cal_table(struct ath_hw *ah,
+static void ath9k_hw_set_ar9287_power_cal_table(struct ath_hw *ah,
                                                 struct ath9k_channel *chan,
                                                 int16_t *pTxPowerIndexOffset)
 {
-        struct ath_common *common = ath9k_hw_common(ah);
         struct cal_data_per_freq_ar9287 *pRawDataset;
         struct cal_data_op_loop_ar9287 *pRawDatasetOpenLoop;
-        u8  *pCalBChans = NULL;
+        u8 *pCalBChans = NULL;
         u16 pdGainOverlap_t2;
-        u8  pdadcValues[AR9287_NUM_PDADC_VALUES];
+        u8 pdadcValues[AR9287_NUM_PDADC_VALUES];
         u16 gainBoundaries[AR9287_PD_GAINS_IN_MASK];
         u16 numPiers = 0, i, j;
-        int16_t  tMinCalPower;
+        int16_t tMinCalPower;
         u16 numXpdGain, xpdMask;
         u16 xpdGainValues[AR9287_NUM_PD_GAINS] = {0, 0, 0, 0};
-        u32 reg32, regOffset, regChainOffset;
-        int16_t   modalIdx, diff = 0;
+        u32 reg32, regOffset, regChainOffset, regval;
+        int16_t modalIdx, diff = 0;
         struct ar9287_eeprom *pEepData = &ah->eeprom.map9287;
+
         modalIdx = IS_CHAN_2GHZ(chan) ? 1 : 0;
         xpdMask = pEepData->modalHeader.xpdGain;
+
         if ((pEepData->baseEepHeader.version & AR9287_EEP_VER_MINOR_MASK) >=
-                        AR9287_EEP_MINOR_VER_2)
+            AR9287_EEP_MINOR_VER_2)
                 pdGainOverlap_t2 = pEepData->modalHeader.pdGainOverlap;
         else
                 pdGainOverlap_t2 = (u16)(MS(REG_READ(ah, AR_PHY_TPCRG5),
@@ -466,15 +478,16 @@ static void ath9k_hw_set_AR9287_power_cal_table(struct ath_hw *ah,
         if (IS_CHAN_2GHZ(chan)) {
                 pCalBChans = pEepData->calFreqPier2G;
                 numPiers = AR9287_NUM_2G_CAL_PIERS;
-                if (ath9k_hw_AR9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
+                if (ath9k_hw_ar9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
                         pRawDatasetOpenLoop =
-                                (struct cal_data_op_loop_ar9287 *)
-                                pEepData->calPierData2G[0];
+                        (struct cal_data_op_loop_ar9287 *)pEepData->calPierData2G[0];
                         ah->initPDADC = pRawDatasetOpenLoop->vpdPdg[0][0];
                 }
         }
 
         numXpdGain = 0;
+
+        /* Calculate the value of xpdgains from the xpdGain Mask */
         for (i = 1; i <= AR9287_PD_GAINS_IN_MASK; i++) {
                 if ((xpdMask >> (AR9287_PD_GAINS_IN_MASK - i)) & 1) {
                         if (numXpdGain >= AR9287_NUM_PD_GAINS)
@@ -496,99 +509,80 @@ static void ath9k_hw_set_AR9287_power_cal_table(struct ath_hw *ah,
 
         for (i = 0; i < AR9287_MAX_CHAINS; i++) {
                 regChainOffset = i * 0x1000;
+
                 if (pEepData->baseEepHeader.txMask & (1 << i)) {
-                        pRawDatasetOpenLoop = (struct cal_data_op_loop_ar9287 *)
-                                               pEepData->calPierData2G[i];
-                        if (ath9k_hw_AR9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
+                        pRawDatasetOpenLoop =
+                        (struct cal_data_op_loop_ar9287 *)pEepData->calPierData2G[i];
+
+                        if (ath9k_hw_ar9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
                                 int8_t txPower;
                                 ar9287_eeprom_get_tx_gain_index(ah, chan,
-                                                          pRawDatasetOpenLoop,
-                                                          pCalBChans, numPiers,
-                                                          &txPower);
+                                                        pRawDatasetOpenLoop,
+                                                        pCalBChans, numPiers,
+                                                        &txPower);
                                 ar9287_eeprom_olpc_set_pdadcs(ah, txPower, i);
                         } else {
                                 pRawDataset =
                                         (struct cal_data_per_freq_ar9287 *)
                                         pEepData->calPierData2G[i];
-                                ath9k_hw_get_AR9287_gain_boundaries_pdadcs(
-                                                  ah, chan, pRawDataset,
-                                                  pCalBChans, numPiers,
-                                                  pdGainOverlap_t2,
-                                                  &tMinCalPower, gainBoundaries,
-                                                  pdadcValues, numXpdGain);
+
+                                ath9k_hw_get_ar9287_gain_boundaries_pdadcs(ah, chan,
+                                                           pRawDataset,
+                                                           pCalBChans, numPiers,
+                                                           pdGainOverlap_t2,
+                                                           &tMinCalPower,
+                                                           gainBoundaries,
+                                                           pdadcValues,
+                                                           numXpdGain);
                         }
 
                         if (i == 0) {
-                                if (!ath9k_hw_AR9287_get_eeprom(
-                                            ah, EEP_OL_PWRCTRL)) {
-                                        REG_WRITE(ah, AR_PHY_TPCRG5 +
-                                          regChainOffset,
-                                          SM(pdGainOverlap_t2,
-                                             AR_PHY_TPCRG5_PD_GAIN_OVERLAP) |
-                                          SM(gainBoundaries[0],
-                                             AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1)
-                                          | SM(gainBoundaries[1],
-                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2)
-                                          | SM(gainBoundaries[2],
-                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3)
-                                          | SM(gainBoundaries[3],
-                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4));
+                                if (!ath9k_hw_ar9287_get_eeprom(ah,
+                                                        EEP_OL_PWRCTRL)) {
+
+                                        regval = SM(pdGainOverlap_t2,
+                                                    AR_PHY_TPCRG5_PD_GAIN_OVERLAP)
+                                                | SM(gainBoundaries[0],
+                                                     AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1)
+                                                | SM(gainBoundaries[1],
+                                                     AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2)
+                                                | SM(gainBoundaries[2],
+                                                     AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3)
+                                                | SM(gainBoundaries[3],
+                                                     AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4);
+
+                                        REG_WRITE(ah,
+                                                  AR_PHY_TPCRG5 + regChainOffset,
+                                                  regval);
                                 }
                         }
 
                         if ((int32_t)AR9287_PWR_TABLE_OFFSET_DB !=
-                                     pEepData->baseEepHeader.pwrTableOffset) {
-                                diff = (u16)
-                                       (pEepData->baseEepHeader.pwrTableOffset
-                                        - (int32_t)AR9287_PWR_TABLE_OFFSET_DB);
+                            pEepData->baseEepHeader.pwrTableOffset) {
+                                diff = (u16)(pEepData->baseEepHeader.pwrTableOffset -
+                                             (int32_t)AR9287_PWR_TABLE_OFFSET_DB);
                                 diff *= 2;
 
-                                for (j = 0;
-                                     j < ((u16)AR9287_NUM_PDADC_VALUES-diff);
-                                     j++)
+                                for (j = 0; j < ((u16)AR9287_NUM_PDADC_VALUES-diff); j++)
                                         pdadcValues[j] = pdadcValues[j+diff];
 
                                 for (j = (u16)(AR9287_NUM_PDADC_VALUES-diff);
                                      j < AR9287_NUM_PDADC_VALUES; j++)
                                         pdadcValues[j] =
-                                          pdadcValues[
-                                          AR9287_NUM_PDADC_VALUES-diff];
+                                          pdadcValues[AR9287_NUM_PDADC_VALUES-diff];
                         }
 
-                        if (!ath9k_hw_AR9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
-                                regOffset = AR_PHY_BASE + (672 << 2) +
-                                                           regChainOffset;
-                                for (j = 0; j < 32; j++) {
-                                        reg32 = ((pdadcValues[4*j + 0]
-                                                  & 0xFF) << 0)  |
-                                                ((pdadcValues[4*j + 1]
-                                                  & 0xFF) << 8)  |
-                                                ((pdadcValues[4*j + 2]
-                                                  & 0xFF) << 16) |
-                                                ((pdadcValues[4*j + 3]
-                                                  & 0xFF) << 24) ;
-                                        REG_WRITE(ah, regOffset, reg32);
+                        if (!ath9k_hw_ar9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
+                                regOffset = AR_PHY_BASE +
+                                        (672 << 2) + regChainOffset;
 
-                                        ath_print(common, ATH_DBG_EEPROM,
-                                                  "PDADC (%d,%4x): %4.4x "
-                                                  "%8.8x\n",
-                                                  i, regChainOffset, regOffset,
-                                                  reg32);
-
-                                        ath_print(common, ATH_DBG_EEPROM,
-                                                  "PDADC: Chain %d | "
-                                                  "PDADC %3d Value %3d | "
-                                                  "PDADC %3d Value %3d | "
-                                                  "PDADC %3d Value %3d | "
-                                                  "PDADC %3d Value %3d |\n",
-                                                  i, 4 * j, pdadcValues[4 * j],
-                                                  4 * j + 1,
-                                                  pdadcValues[4 * j + 1],
-                                                  4 * j + 2,
-                                                  pdadcValues[4 * j + 2],
-                                                  4 * j + 3,
-                                                  pdadcValues[4 * j + 3]);
+                                for (j = 0; j < 32; j++) {
+                                        reg32 = ((pdadcValues[4*j + 0] & 0xFF) << 0)
+                                                | ((pdadcValues[4*j + 1] & 0xFF) << 8)
+                                                | ((pdadcValues[4*j + 2] & 0xFF) << 16)
+                                                | ((pdadcValues[4*j + 3] & 0xFF) << 24);
 
+                                        REG_WRITE(ah, regOffset, reg32);
                                         regOffset += 4;
                                 }
                         }
@@ -598,30 +592,45 @@ static void ath9k_hw_set_AR9287_power_cal_table(struct ath_hw *ah,
         *pTxPowerIndexOffset = 0;
 }
 
-static void ath9k_hw_set_AR9287_power_per_rate_table(struct ath_hw *ah,
-                struct ath9k_channel *chan, int16_t *ratesArray, u16 cfgCtl,
-                u16 AntennaReduction, u16 twiceMaxRegulatoryPower,
-                u16 powerLimit)
+static void ath9k_hw_set_ar9287_power_per_rate_table(struct ath_hw *ah,
+                                                     struct ath9k_channel *chan,
+                                                     int16_t *ratesArray,
+                                                     u16 cfgCtl,
+                                                     u16 AntennaReduction,
+                                                     u16 twiceMaxRegulatoryPower,
+                                                     u16 powerLimit)
 {
+#define CMP_CTL \
+        (((cfgCtl & ~CTL_MODE_M) | (pCtlMode[ctlMode] & CTL_MODE_M)) == \
+         pEepData->ctlIndex[i])
+
+#define CMP_NO_CTL \
+        (((cfgCtl & ~CTL_MODE_M) | (pCtlMode[ctlMode] & CTL_MODE_M)) == \
+         ((pEepData->ctlIndex[i] & CTL_MODE_M) | SD_NO_CTL))
+
 #define REDUCE_SCALED_POWER_BY_TWO_CHAIN     6
 #define REDUCE_SCALED_POWER_BY_THREE_CHAIN   10
+
         struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
         u16 twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
         static const u16 tpScaleReductionTable[5] =
                 { 0, 3, 6, 9, AR5416_MAX_RATE_POWER };
         int i;
-        int16_t  twiceLargestAntenna;
+        int16_t twiceLargestAntenna;
         struct cal_ctl_data_ar9287 *rep;
         struct cal_target_power_leg targetPowerOfdm = {0, {0, 0, 0, 0} },
                                     targetPowerCck = {0, {0, 0, 0, 0} };
         struct cal_target_power_leg targetPowerOfdmExt = {0, {0, 0, 0, 0} },
                                     targetPowerCckExt = {0, {0, 0, 0, 0} };
-        struct cal_target_power_ht  targetPowerHt20,
+        struct cal_target_power_ht targetPowerHt20,
                                     targetPowerHt40 = {0, {0, 0, 0, 0} };
         u16 scaledPower = 0, minCtlPower, maxRegAllowedPower;
-        u16 ctlModesFor11g[] =
-                {CTL_11B, CTL_11G, CTL_2GHT20,
-                 CTL_11B_EXT, CTL_11G_EXT, CTL_2GHT40};
+        u16 ctlModesFor11g[] = {CTL_11B,
+                                CTL_11G,
+                                CTL_2GHT20,
+                                CTL_11B_EXT,
+                                CTL_11G_EXT,
+                                CTL_2GHT40};
         u16 numCtlModes = 0, *pCtlMode = NULL, ctlMode, freq;
         struct chan_centers centers;
         int tx_chainmask;
@@ -631,19 +640,28 @@ static void ath9k_hw_set_AR9287_power_per_rate_table(struct ath_hw *ah,
 
         ath9k_hw_get_channel_centers(ah, chan, &centers);
 
+        /* Compute TxPower reduction due to Antenna Gain */
         twiceLargestAntenna = max(pEepData->modalHeader.antennaGainCh[0],
                                   pEepData->modalHeader.antennaGainCh[1]);
+        twiceLargestAntenna = (int16_t)min((AntennaReduction) -
+                                           twiceLargestAntenna, 0);
 
-        twiceLargestAntenna =  (int16_t)min((AntennaReduction) -
-                                            twiceLargestAntenna, 0);
-
+        /*
+         * scaledPower is the minimum of the user input power level
+         * and the regulatory allowed power level.
+         */
         maxRegAllowedPower = twiceMaxRegulatoryPower + twiceLargestAntenna;
+
         if (regulatory->tp_scale != ATH9K_TP_SCALE_MAX)
                 maxRegAllowedPower -=
                         (tpScaleReductionTable[(regulatory->tp_scale)] * 2);
 
         scaledPower = min(powerLimit, maxRegAllowedPower);
 
+        /*
+         * Reduce scaled Power by number of chains active
+         * to get the per chain tx power level.
+         */
         switch (ar5416_get_ntxchains(tx_chainmask)) {
         case 1:
                 break;
@@ -656,9 +674,14 @@ static void ath9k_hw_set_AR9287_power_per_rate_table(struct ath_hw *ah,
         }
         scaledPower = max((u16)0, scaledPower);
 
+        /*
+         * Get TX power from EEPROM.
+         */
         if (IS_CHAN_2GHZ(chan)) {
+                /* CTL_11B, CTL_11G, CTL_2GHT20 */
                 numCtlModes =
                         ARRAY_SIZE(ctlModesFor11g) - SUB_NUM_CTL_MODES_AT_2G_40;
+
                 pCtlMode = ctlModesFor11g;
 
                 ath9k_hw_get_legacy_target_powers(ah, chan,
@@ -675,6 +698,7 @@ static void ath9k_hw_set_AR9287_power_per_rate_table(struct ath_hw *ah,
                                            &targetPowerHt20, 8, false);
 
                 if (IS_CHAN_HT40(chan)) {
+                        /* All 2G CTLs */
                         numCtlModes = ARRAY_SIZE(ctlModesFor11g);
                         ath9k_hw_get_target_powers(ah, chan,
                                                    pEepData->calTargetPower2GHT40,
@@ -692,8 +716,9 @@ static void ath9k_hw_set_AR9287_power_per_rate_table(struct ath_hw *ah,
         }
 
         for (ctlMode = 0; ctlMode < numCtlModes; ctlMode++) {
-                bool isHt40CtlMode = (pCtlMode[ctlMode] == CTL_5GHT40) ||
-                                     (pCtlMode[ctlMode] == CTL_2GHT40);
+                bool isHt40CtlMode =
+                        (pCtlMode[ctlMode] == CTL_2GHT40) ? true : false;
+
                 if (isHt40CtlMode)
                         freq = centers.synth_center;
                 else if (pCtlMode[ctlMode] & EXT_ADDITIVE)
@@ -701,31 +726,28 @@ static void ath9k_hw_set_AR9287_power_per_rate_table(struct ath_hw *ah,
                 else
                         freq = centers.ctl_center;
 
-                if (ah->eep_ops->get_eeprom_ver(ah) == 14 &&
-                    ah->eep_ops->get_eeprom_rev(ah) <= 2)
-                        twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
-
+                /* Walk through the CTL indices stored in EEPROM */
                 for (i = 0; (i < AR9287_NUM_CTLS) && pEepData->ctlIndex[i]; i++) {
-                        if ((((cfgCtl & ~CTL_MODE_M) |
-                              (pCtlMode[ctlMode] & CTL_MODE_M)) ==
-                             pEepData->ctlIndex[i]) ||
-                            (((cfgCtl & ~CTL_MODE_M) |
-                              (pCtlMode[ctlMode] & CTL_MODE_M)) ==
-                             ((pEepData->ctlIndex[i] &
-                               CTL_MODE_M) | SD_NO_CTL))) {
+                        struct cal_ctl_edges *pRdEdgesPower;
 
+                        /*
+                         * Compare test group from regulatory channel list
+                         * with test mode from pCtlMode list
+                         */
+                        if (CMP_CTL || CMP_NO_CTL) {
                                 rep = &(pEepData->ctlData[i]);
-                                twiceMinEdgePower = ath9k_hw_get_max_edge_power(
-                                    freq,
-                                    rep->ctlEdges[ar5416_get_ntxchains(
-                                    tx_chainmask) - 1],
-                                    IS_CHAN_2GHZ(chan), AR5416_NUM_BAND_EDGES);
-
-                                if ((cfgCtl & ~CTL_MODE_M) == SD_NO_CTL)
-                                        twiceMaxEdgePower = min(
-                                                            twiceMaxEdgePower,
-                                                            twiceMinEdgePower);
-                                else {
+                                pRdEdgesPower =
+                                rep->ctlEdges[ar5416_get_ntxchains(tx_chainmask) - 1];
+
+                                twiceMinEdgePower = ath9k_hw_get_max_edge_power(freq,
+                                                                pRdEdgesPower,
+                                                                IS_CHAN_2GHZ(chan),
+                                                                AR5416_NUM_BAND_EDGES);
+
+                                if ((cfgCtl & ~CTL_MODE_M) == SD_NO_CTL) {
+                                        twiceMaxEdgePower = min(twiceMaxEdgePower,
+                                                                twiceMinEdgePower);
+                                } else {
                                         twiceMaxEdgePower = twiceMinEdgePower;
                                         break;
                                 }
@@ -734,55 +756,48 @@ static void ath9k_hw_set_AR9287_power_per_rate_table(struct ath_hw *ah,
 
                 minCtlPower = (u8)min(twiceMaxEdgePower, scaledPower);
 
+                /* Apply ctl mode to correct target power set */
                 switch (pCtlMode[ctlMode]) {
                 case CTL_11B:
-                        for (i = 0;
-                             i < ARRAY_SIZE(targetPowerCck.tPow2x);
-                             i++) {
-                                targetPowerCck.tPow2x[i] = (u8)min(
-                                        (u16)targetPowerCck.tPow2x[i],
-                                        minCtlPower);
+                        for (i = 0; i < ARRAY_SIZE(targetPowerCck.tPow2x); i++) {
+                                targetPowerCck.tPow2x[i] =
+                                        (u8)min((u16)targetPowerCck.tPow2x[i],
+                                                minCtlPower);
                         }
                         break;
                 case CTL_11A:
                 case CTL_11G:
-                        for (i = 0;
-                             i < ARRAY_SIZE(targetPowerOfdm.tPow2x);
-                             i++) {
-                                targetPowerOfdm.tPow2x[i] = (u8)min(
-                                        (u16)targetPowerOfdm.tPow2x[i],
-                                        minCtlPower);
+                        for (i = 0; i < ARRAY_SIZE(targetPowerOfdm.tPow2x); i++) {
+                                targetPowerOfdm.tPow2x[i] =
+                                        (u8)min((u16)targetPowerOfdm.tPow2x[i],
+                                                minCtlPower);
                         }
                         break;
                 case CTL_5GHT20:
                 case CTL_2GHT20:
-                        for (i = 0;
-                             i < ARRAY_SIZE(targetPowerHt20.tPow2x);
-                             i++) {
-                                targetPowerHt20.tPow2x[i] = (u8)min(
-                                        (u16)targetPowerHt20.tPow2x[i],
-                                        minCtlPower);
+                        for (i = 0; i < ARRAY_SIZE(targetPowerHt20.tPow2x); i++) {
+                                targetPowerHt20.tPow2x[i] =
+                                        (u8)min((u16)targetPowerHt20.tPow2x[i],
+                                                minCtlPower);
                         }
                         break;
                 case CTL_11B_EXT:
-                        targetPowerCckExt.tPow2x[0] = (u8)min(
-                                    (u16)targetPowerCckExt.tPow2x[0],
-                                    minCtlPower);
+                        targetPowerCckExt.tPow2x[0] =
+                                (u8)min((u16)targetPowerCckExt.tPow2x[0],
+                                        minCtlPower);
                         break;
                 case CTL_11A_EXT:
                 case CTL_11G_EXT:
-                        targetPowerOfdmExt.tPow2x[0] = (u8)min(
-                                    (u16)targetPowerOfdmExt.tPow2x[0],
-                                    minCtlPower);
+                        targetPowerOfdmExt.tPow2x[0] =
+                                (u8)min((u16)targetPowerOfdmExt.tPow2x[0],
+                                        minCtlPower);
                         break;
                 case CTL_5GHT40:
                 case CTL_2GHT40:
-                        for (i = 0;
-                             i < ARRAY_SIZE(targetPowerHt40.tPow2x);
-                             i++) {
-                                targetPowerHt40.tPow2x[i] = (u8)min(
-                                        (u16)targetPowerHt40.tPow2x[i],
-                                        minCtlPower);
+                        for (i = 0; i < ARRAY_SIZE(targetPowerHt40.tPow2x); i++) {
+                                targetPowerHt40.tPow2x[i] =
+                                        (u8)min((u16)targetPowerHt40.tPow2x[i],
+                                                minCtlPower);
                         }
                         break;
                 default:
@@ -790,12 +805,13 @@ static void ath9k_hw_set_AR9287_power_per_rate_table(struct ath_hw *ah,
                 }
         }
 
+        /* Now set the rates array */
+
         ratesArray[rate6mb] =
         ratesArray[rate9mb] =
         ratesArray[rate12mb] =
         ratesArray[rate18mb] =
-        ratesArray[rate24mb] =
-        targetPowerOfdm.tPow2x[0];
+        ratesArray[rate24mb] = targetPowerOfdm.tPow2x[0];
 
         ratesArray[rate36mb] = targetPowerOfdm.tPow2x[1];
         ratesArray[rate48mb] = targetPowerOfdm.tPow2x[2];
@@ -807,12 +823,12 @@ static void ath9k_hw_set_AR9287_power_per_rate_table(struct ath_hw *ah,
 
         if (IS_CHAN_2GHZ(chan)) {
                 ratesArray[rate1l] = targetPowerCck.tPow2x[0];
-                ratesArray[rate2s] = ratesArray[rate2l] =
-                        targetPowerCck.tPow2x[1];
-                ratesArray[rate5_5s] = ratesArray[rate5_5l] =
-                        targetPowerCck.tPow2x[2];
-                ratesArray[rate11s] = ratesArray[rate11l] =
-                        targetPowerCck.tPow2x[3];
+                ratesArray[rate2s] =
+                ratesArray[rate2l] = targetPowerCck.tPow2x[1];
+                ratesArray[rate5_5s] =
+                ratesArray[rate5_5l] = targetPowerCck.tPow2x[2];
+                ratesArray[rate11s] =
+                ratesArray[rate11l] = targetPowerCck.tPow2x[3];
         }
         if (IS_CHAN_HT40(chan)) {
                 for (i = 0; i < ARRAY_SIZE(targetPowerHt40.tPow2x); i++)
@@ -821,28 +837,28 @@ static void ath9k_hw_set_AR9287_power_per_rate_table(struct ath_hw *ah,
                 ratesArray[rateDupOfdm] = targetPowerHt40.tPow2x[0];
                 ratesArray[rateDupCck]  = targetPowerHt40.tPow2x[0];
                 ratesArray[rateExtOfdm] = targetPowerOfdmExt.tPow2x[0];
+
                 if (IS_CHAN_2GHZ(chan))
                         ratesArray[rateExtCck] = targetPowerCckExt.tPow2x[0];
         }
 
+#undef CMP_CTL
+#undef CMP_NO_CTL
 #undef REDUCE_SCALED_POWER_BY_TWO_CHAIN
 #undef REDUCE_SCALED_POWER_BY_THREE_CHAIN
 }
 
-static void ath9k_hw_AR9287_set_txpower(struct ath_hw *ah,
+static void ath9k_hw_ar9287_set_txpower(struct ath_hw *ah,
                                         struct ath9k_channel *chan, u16 cfgCtl,
                                         u8 twiceAntennaReduction,
                                         u8 twiceMaxRegulatoryPower,
                                         u8 powerLimit)
 {
-#define INCREASE_MAXPOW_BY_TWO_CHAIN     6
-#define INCREASE_MAXPOW_BY_THREE_CHAIN   10
-        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
         struct ar9287_eeprom *pEepData = &ah->eeprom.map9287;
         struct modal_eep_ar9287_header *pModal = &pEepData->modalHeader;
         int16_t ratesArray[Ar5416RateSize];
-        int16_t  txPowerIndexOffset = 0;
+        int16_t txPowerIndexOffset = 0;
         u8 ht40PowerIncForPdadc = 2;
         int i;
 
@@ -852,13 +868,13 @@ static void ath9k_hw_AR9287_set_txpower(struct ath_hw *ah,
             AR9287_EEP_MINOR_VER_2)
                 ht40PowerIncForPdadc = pModal->ht40PowerIncForPdadc;
 
-        ath9k_hw_set_AR9287_power_per_rate_table(ah, chan,
+        ath9k_hw_set_ar9287_power_per_rate_table(ah, chan,
                                                  &ratesArray[0], cfgCtl,
                                                  twiceAntennaReduction,
                                                  twiceMaxRegulatoryPower,
                                                  powerLimit);
 
-        ath9k_hw_set_AR9287_power_cal_table(ah, chan, &txPowerIndexOffset);
+        ath9k_hw_set_ar9287_power_cal_table(ah, chan, &txPowerIndexOffset);
 
         for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
                 ratesArray[i] = (int16_t)(txPowerIndexOffset + ratesArray[i]);
@@ -871,6 +887,7 @@ static void ath9k_hw_AR9287_set_txpower(struct ath_hw *ah,
                         ratesArray[i] -= AR9287_PWR_TABLE_OFFSET_DB * 2;
         }
 
+        /* OFDM power per rate */
         REG_WRITE(ah, AR_PHY_POWER_TX_RATE1,
                   ATH9K_POW_SM(ratesArray[rate18mb], 24)
                   | ATH9K_POW_SM(ratesArray[rate12mb], 16)
@@ -883,6 +900,7 @@ static void ath9k_hw_AR9287_set_txpower(struct ath_hw *ah,
                   | ATH9K_POW_SM(ratesArray[rate36mb], 8)
                   | ATH9K_POW_SM(ratesArray[rate24mb], 0));
 
+        /* CCK power per rate */
         if (IS_CHAN_2GHZ(chan)) {
                 REG_WRITE(ah, AR_PHY_POWER_TX_RATE3,
                           ATH9K_POW_SM(ratesArray[rate2s], 24)
@@ -896,6 +914,7 @@ static void ath9k_hw_AR9287_set_txpower(struct ath_hw *ah,
                           | ATH9K_POW_SM(ratesArray[rate5_5l], 0));
         }
 
+        /* HT20 power per rate */
         REG_WRITE(ah, AR_PHY_POWER_TX_RATE5,
                   ATH9K_POW_SM(ratesArray[rateHt20_3], 24)
                   | ATH9K_POW_SM(ratesArray[rateHt20_2], 16)
@@ -908,8 +927,9 @@ static void ath9k_hw_AR9287_set_txpower(struct ath_hw *ah,
                   | ATH9K_POW_SM(ratesArray[rateHt20_5], 8)
                   | ATH9K_POW_SM(ratesArray[rateHt20_4], 0));
 
+        /* HT40 power per rate */
         if (IS_CHAN_HT40(chan)) {
-                if (ath9k_hw_AR9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
+                if (ath9k_hw_ar9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
                         REG_WRITE(ah, AR_PHY_POWER_TX_RATE7,
                                   ATH9K_POW_SM(ratesArray[rateHt40_3], 24)
                                   | ATH9K_POW_SM(ratesArray[rateHt40_2], 16)
@@ -943,6 +963,7 @@ static void ath9k_hw_AR9287_set_txpower(struct ath_hw *ah,
                                                  ht40PowerIncForPdadc, 0));
                 }
 
+                /* Dup/Ext power per rate */
                 REG_WRITE(ah, AR_PHY_POWER_TX_RATE9,
                           ATH9K_POW_SM(ratesArray[rateExtOfdm], 24)
                           | ATH9K_POW_SM(ratesArray[rateExtCck], 16)
@@ -960,37 +981,20 @@ static void ath9k_hw_AR9287_set_txpower(struct ath_hw *ah,
                         ratesArray[i] + AR9287_PWR_TABLE_OFFSET_DB * 2;
         else
                 regulatory->max_power_level = ratesArray[i];
-
-        switch (ar5416_get_ntxchains(ah->txchainmask)) {
-        case 1:
-                break;
-        case 2:
-                regulatory->max_power_level +=
-                        INCREASE_MAXPOW_BY_TWO_CHAIN;
-                break;
-        case 3:
-                regulatory->max_power_level +=
-                        INCREASE_MAXPOW_BY_THREE_CHAIN;
-                break;
-        default:
-                ath_print(common, ATH_DBG_EEPROM,
-                          "Invalid chainmask configuration\n");
-                break;
-        }
 }
 
-static void ath9k_hw_AR9287_set_addac(struct ath_hw *ah,
+static void ath9k_hw_ar9287_set_addac(struct ath_hw *ah,
                                       struct ath9k_channel *chan)
 {
 }
 
-static void ath9k_hw_AR9287_set_board_values(struct ath_hw *ah,
+static void ath9k_hw_ar9287_set_board_values(struct ath_hw *ah,
                                              struct ath9k_channel *chan)
 {
         struct ar9287_eeprom *eep = &ah->eeprom.map9287;
         struct modal_eep_ar9287_header *pModal = &eep->modalHeader;
         u16 antWrites[AR9287_ANT_16S];
-        u32 regChainOffset;
+        u32 regChainOffset, regval;
         u8 txRxAttenLocal;
         int i, j, offset_num;
 
@@ -1077,42 +1081,37 @@ static void ath9k_hw_AR9287_set_board_values(struct ath_hw *ah,
         REG_RMW_FIELD(ah, AR_PHY_EXT_CCA0,
                       AR_PHY_EXT_CCA0_THRESH62, pModal->thresh62);
 
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0, AR9287_AN_RF2G3_DB1,
-                                  AR9287_AN_RF2G3_DB1_S, pModal->db1);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0, AR9287_AN_RF2G3_DB2,
-                                  AR9287_AN_RF2G3_DB2_S, pModal->db2);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0,
-                                  AR9287_AN_RF2G3_OB_CCK,
-                                  AR9287_AN_RF2G3_OB_CCK_S, pModal->ob_cck);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0,
-                                  AR9287_AN_RF2G3_OB_PSK,
-                                  AR9287_AN_RF2G3_OB_PSK_S, pModal->ob_psk);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0,
-                                  AR9287_AN_RF2G3_OB_QAM,
-                                  AR9287_AN_RF2G3_OB_QAM_S, pModal->ob_qam);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0,
-                                  AR9287_AN_RF2G3_OB_PAL_OFF,
-                                  AR9287_AN_RF2G3_OB_PAL_OFF_S,
-                                  pModal->ob_pal_off);
-
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
-                                  AR9287_AN_RF2G3_DB1, AR9287_AN_RF2G3_DB1_S,
-                                  pModal->db1);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1, AR9287_AN_RF2G3_DB2,
-                                  AR9287_AN_RF2G3_DB2_S, pModal->db2);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
-                                  AR9287_AN_RF2G3_OB_CCK,
-                                  AR9287_AN_RF2G3_OB_CCK_S, pModal->ob_cck);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
-                                  AR9287_AN_RF2G3_OB_PSK,
-                                  AR9287_AN_RF2G3_OB_PSK_S, pModal->ob_psk);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
-                                  AR9287_AN_RF2G3_OB_QAM,
-                                  AR9287_AN_RF2G3_OB_QAM_S, pModal->ob_qam);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
-                                  AR9287_AN_RF2G3_OB_PAL_OFF,
-                                  AR9287_AN_RF2G3_OB_PAL_OFF_S,
-                                  pModal->ob_pal_off);
+        regval = REG_READ(ah, AR9287_AN_RF2G3_CH0);
+        regval &= ~(AR9287_AN_RF2G3_DB1 |
+                    AR9287_AN_RF2G3_DB2 |
+                    AR9287_AN_RF2G3_OB_CCK |
+                    AR9287_AN_RF2G3_OB_PSK |
+                    AR9287_AN_RF2G3_OB_QAM |
+                    AR9287_AN_RF2G3_OB_PAL_OFF);
+        regval |= (SM(pModal->db1, AR9287_AN_RF2G3_DB1) |
+                   SM(pModal->db2, AR9287_AN_RF2G3_DB2) |
+                   SM(pModal->ob_cck, AR9287_AN_RF2G3_OB_CCK) |
+                   SM(pModal->ob_psk, AR9287_AN_RF2G3_OB_PSK) |
+                   SM(pModal->ob_qam, AR9287_AN_RF2G3_OB_QAM) |
+                   SM(pModal->ob_pal_off, AR9287_AN_RF2G3_OB_PAL_OFF));
+
+        ath9k_hw_analog_shift_regwrite(ah, AR9287_AN_RF2G3_CH0, regval);
+
+        regval = REG_READ(ah, AR9287_AN_RF2G3_CH1);
+        regval &= ~(AR9287_AN_RF2G3_DB1 |
+                    AR9287_AN_RF2G3_DB2 |
+                    AR9287_AN_RF2G3_OB_CCK |
+                    AR9287_AN_RF2G3_OB_PSK |
+                    AR9287_AN_RF2G3_OB_QAM |
+                    AR9287_AN_RF2G3_OB_PAL_OFF);
+        regval |= (SM(pModal->db1, AR9287_AN_RF2G3_DB1) |
+                   SM(pModal->db2, AR9287_AN_RF2G3_DB2) |
+                   SM(pModal->ob_cck, AR9287_AN_RF2G3_OB_CCK) |
+                   SM(pModal->ob_psk, AR9287_AN_RF2G3_OB_PSK) |
+                   SM(pModal->ob_qam, AR9287_AN_RF2G3_OB_QAM) |
+                   SM(pModal->ob_pal_off, AR9287_AN_RF2G3_OB_PAL_OFF));
+
+        ath9k_hw_analog_shift_regwrite(ah, AR9287_AN_RF2G3_CH1, regval);
 
         REG_RMW_FIELD(ah, AR_PHY_RF_CTL2,
                       AR_PHY_TX_END_DATA_START, pModal->txFrameToDataStart);
@@ -1125,13 +1124,13 @@ static void ath9k_hw_AR9287_set_board_values(struct ath_hw *ah,
                                   pModal->xpaBiasLvl);
 }
 
-static u8 ath9k_hw_AR9287_get_num_ant_config(struct ath_hw *ah,
+static u8 ath9k_hw_ar9287_get_num_ant_config(struct ath_hw *ah,
                                              enum ieee80211_band freq_band)
 {
         return 1;
 }
 
-static u16 ath9k_hw_AR9287_get_eeprom_antenna_cfg(struct ath_hw *ah,
+static u16 ath9k_hw_ar9287_get_eeprom_antenna_cfg(struct ath_hw *ah,
                                                   struct ath9k_channel *chan)
 {
         struct ar9287_eeprom *eep = &ah->eeprom.map9287;
@@ -1140,11 +1139,12 @@ static u16 ath9k_hw_AR9287_get_eeprom_antenna_cfg(struct ath_hw *ah,
         return pModal->antCtrlCommon & 0xFFFF;
 }
 
-static u16 ath9k_hw_AR9287_get_spur_channel(struct ath_hw *ah,
+static u16 ath9k_hw_ar9287_get_spur_channel(struct ath_hw *ah,
                                             u16 i, bool is2GHz)
 {
 #define EEP_MAP9287_SPURCHAN \
         (ah->eeprom.map9287.modalHeader.spurChans[i].spurChan)
+
         struct ath_common *common = ath9k_hw_common(ah);
         u16 spur_val = AR_NO_SPUR;
 
@@ -1171,15 +1171,15 @@ static u16 ath9k_hw_AR9287_get_spur_channel(struct ath_hw *ah,
 }
 
 const struct eeprom_ops eep_ar9287_ops = {
-        .check_eeprom           = ath9k_hw_AR9287_check_eeprom,
-        .get_eeprom             = ath9k_hw_AR9287_get_eeprom,
-        .fill_eeprom            = ath9k_hw_AR9287_fill_eeprom,
-        .get_eeprom_ver         = ath9k_hw_AR9287_get_eeprom_ver,
-        .get_eeprom_rev         = ath9k_hw_AR9287_get_eeprom_rev,
-        .get_num_ant_config     = ath9k_hw_AR9287_get_num_ant_config,
-        .get_eeprom_antenna_cfg = ath9k_hw_AR9287_get_eeprom_antenna_cfg,
-        .set_board_values       = ath9k_hw_AR9287_set_board_values,
-        .set_addac              = ath9k_hw_AR9287_set_addac,
-        .set_txpower            = ath9k_hw_AR9287_set_txpower,
-        .get_spur_channel       = ath9k_hw_AR9287_get_spur_channel
+        .check_eeprom           = ath9k_hw_ar9287_check_eeprom,
+        .get_eeprom             = ath9k_hw_ar9287_get_eeprom,
+        .fill_eeprom            = ath9k_hw_ar9287_fill_eeprom,
+        .get_eeprom_ver         = ath9k_hw_ar9287_get_eeprom_ver,
+        .get_eeprom_rev         = ath9k_hw_ar9287_get_eeprom_rev,
+        .get_num_ant_config     = ath9k_hw_ar9287_get_num_ant_config,
+        .get_eeprom_antenna_cfg = ath9k_hw_ar9287_get_eeprom_antenna_cfg,
+        .set_board_values       = ath9k_hw_ar9287_set_board_values,
+        .set_addac              = ath9k_hw_ar9287_set_addac,
+        .set_txpower            = ath9k_hw_ar9287_set_txpower,
+        .get_spur_channel       = ath9k_hw_ar9287_get_spur_channel
 };
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 7e1ed78d0e64..77b1433312cc 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -617,6 +617,7 @@ static void ath9k_hw_get_def_gain_boundaries_pdadcs(struct ath_hw *ah,
         int16_t minDelta = 0;
         struct chan_centers centers;
 
+        memset(&minPwrT4, 0, AR9287_NUM_PD_GAINS);
         ath9k_hw_get_channel_centers(ah, chan, &centers);
 
         for (numPiers = 0; numPiers < availPiers; numPiers++) {
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index 0ee75e79fe35..3a8ee999da5d 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -76,7 +76,8 @@ static void ath_led_brightness(struct led_classdev *led_cdev,
         case LED_FULL:
                 if (led->led_type == ATH_LED_ASSOC) {
                         sc->sc_flags |= SC_OP_LED_ASSOCIATED;
-                        ieee80211_queue_delayed_work(sc->hw,
+                        if (led_blink)
+                                ieee80211_queue_delayed_work(sc->hw,
                                                      &sc->ath_led_blink_work, 0);
                 } else if (led->led_type == ATH_LED_RADIO) {
                         ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 0);
@@ -143,7 +144,8 @@ void ath_init_leds(struct ath_softc *sc)
         /* LED off, active low */
         ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
 
-        INIT_DELAYED_WORK(&sc->ath_led_blink_work, ath_led_blink_work);
+        if (led_blink)
+                INIT_DELAYED_WORK(&sc->ath_led_blink_work, ath_led_blink_work);
 
         trigger = ieee80211_get_radio_led_name(sc->hw);
         snprintf(sc->radio_led.name, sizeof(sc->radio_led.name),
@@ -180,7 +182,8 @@ void ath_init_leds(struct ath_softc *sc)
         return;
 
 fail:
-        cancel_delayed_work_sync(&sc->ath_led_blink_work);
+        if (led_blink)
+                cancel_delayed_work_sync(&sc->ath_led_blink_work);
         ath_deinit_leds(sc);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 77b359162d6c..ad9134bddd1e 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -16,12 +16,27 @@
 
 #include "htc.h"
 
-#define ATH9K_FW_USB_DEV(devid, fw)                                     \
-        { USB_DEVICE(0x0cf3, devid), .driver_info = (unsigned long) fw }
+/* identify firmware images */
+#define FIRMWARE_AR7010         "ar7010.fw"
+#define FIRMWARE_AR7010_1_1     "ar7010_1_1.fw"
+#define FIRMWARE_AR9271         "ar9271.fw"
+
+MODULE_FIRMWARE(FIRMWARE_AR7010);
+MODULE_FIRMWARE(FIRMWARE_AR7010_1_1);
+MODULE_FIRMWARE(FIRMWARE_AR9271);
 
 static struct usb_device_id ath9k_hif_usb_ids[] = {
-        ATH9K_FW_USB_DEV(0x9271, "ar9271.fw"),
-        ATH9K_FW_USB_DEV(0x1006, "ar9271.fw"),
+        { USB_DEVICE(0x0cf3, 0x9271) }, /* Atheros */
+        { USB_DEVICE(0x0cf3, 0x1006) }, /* Atheros */
+        { USB_DEVICE(0x0cf3, 0x7010) }, /* Atheros */
+        { USB_DEVICE(0x0cf3, 0x7015) }, /* Atheros */
+        { USB_DEVICE(0x0846, 0x9030) }, /* Netgear N150 */
+        { USB_DEVICE(0x0846, 0x9018) }, /* Netgear WNDA3200 */
+        { USB_DEVICE(0x07D1, 0x3A10) }, /* Dlink Wireless 150 */
+        { USB_DEVICE(0x13D3, 0x3327) }, /* Azurewave */
+        { USB_DEVICE(0x13D3, 0x3328) }, /* Azurewave */
+        { USB_DEVICE(0x04CA, 0x4605) }, /* Liteon */
+        { USB_DEVICE(0x083A, 0xA704) }, /* SMC Networks */
         { },
 };
 
@@ -756,6 +771,7 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
         size_t len = hif_dev->firmware->size;
         u32 addr = AR9271_FIRMWARE;
         u8 *buf = kzalloc(4096, GFP_KERNEL);
+        u32 firm_offset;
 
         if (!buf)
                 return -ENOMEM;
@@ -779,32 +795,37 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
         }
         kfree(buf);
 
+        if (hif_dev->device_id == 0x7010)
+                firm_offset = AR7010_FIRMWARE_TEXT;
+        else
+                firm_offset = AR9271_FIRMWARE_TEXT;
+
         /*
          * Issue FW download complete command to firmware.
          */
         err = usb_control_msg(hif_dev->udev, usb_sndctrlpipe(hif_dev->udev, 0),
                               FIRMWARE_DOWNLOAD_COMP,
                               0x40 | USB_DIR_OUT,
-                              AR9271_FIRMWARE_TEXT >> 8, 0, NULL, 0, HZ);
+                              firm_offset >> 8, 0, NULL, 0, HZ);
         if (err)
                 return -EIO;
 
         dev_info(&hif_dev->udev->dev, "ath9k_htc: Transferred FW: %s, size: %ld\n",
-                 "ar9271.fw", (unsigned long) hif_dev->firmware->size);
+                 hif_dev->fw_name, (unsigned long) hif_dev->firmware->size);
 
         return 0;
 }
 
-static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev,
-                                  const char *fw_name)
+static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
 {
         int ret;
 
         /* Request firmware */
-        ret = request_firmware(&hif_dev->firmware, fw_name, &hif_dev->udev->dev);
+        ret = request_firmware(&hif_dev->firmware, hif_dev->fw_name,
+                               &hif_dev->udev->dev);
         if (ret) {
                 dev_err(&hif_dev->udev->dev,
-                        "ath9k_htc: Firmware - %s not found\n", fw_name);
+                        "ath9k_htc: Firmware - %s not found\n", hif_dev->fw_name);
                 goto err_fw_req;
         }
 
@@ -820,7 +841,8 @@ static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev,
         ret = ath9k_hif_usb_download_fw(hif_dev);
         if (ret) {
                 dev_err(&hif_dev->udev->dev,
-                        "ath9k_htc: Firmware - %s download failed\n", fw_name);
+                        "ath9k_htc: Firmware - %s download failed\n",
+                        hif_dev->fw_name);
                 goto err_fw_download;
         }
 
@@ -847,7 +869,6 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
 {
         struct usb_device *udev = interface_to_usbdev(interface);
         struct hif_device_usb *hif_dev;
-        const char *fw_name = (const char *) id->driver_info;
         int ret = 0;
 
         hif_dev = kzalloc(sizeof(struct hif_device_usb), GFP_KERNEL);
@@ -872,7 +893,27 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
                 goto err_htc_hw_alloc;
         }
 
-        ret = ath9k_hif_usb_dev_init(hif_dev, fw_name);
+        /* Find out which firmware to load */
+
+        switch(hif_dev->device_id) {
+        case 0x7010:
+        case 0x9018:
+                if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x0202)
+                        hif_dev->fw_name = FIRMWARE_AR7010_1_1;
+                else
+                        hif_dev->fw_name = FIRMWARE_AR7010;
+                break;
+        default:
+                hif_dev->fw_name = FIRMWARE_AR9271;
+                break;
+        }
+
+        if (!hif_dev->fw_name) {
+                dev_err(&udev->dev, "Can't determine firmware !\n");
+                goto err_htc_hw_alloc;
+        }
+
+        ret = ath9k_hif_usb_dev_init(hif_dev);
         if (ret) {
                 ret = -EINVAL;
                 goto err_hif_init_usb;
@@ -907,12 +948,10 @@ static void ath9k_hif_usb_reboot(struct usb_device *udev)
         void *buf;
         int ret;
 
-        buf = kmalloc(4, GFP_KERNEL);
+        buf = kmemdup(&reboot_cmd, 4, GFP_KERNEL);
         if (!buf)
                 return;
 
-        memcpy(buf, &reboot_cmd, 4);
-
         ret = usb_bulk_msg(udev, usb_sndbulkpipe(udev, USB_REG_OUT_PIPE),
                            buf, 4, NULL, HZ);
         if (ret)
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
index 0aca49b6fcb6..2daf97b11c08 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
@@ -19,6 +19,7 @@
 
 #define AR9271_FIRMWARE       0x501000
 #define AR9271_FIRMWARE_TEXT  0x903000
+#define AR7010_FIRMWARE_TEXT  0x906000
 
 #define FIRMWARE_DOWNLOAD       0x30
 #define FIRMWARE_DOWNLOAD_COMP  0x31
@@ -90,6 +91,7 @@ struct hif_device_usb {
         struct usb_anchor regout_submitted;
         struct usb_anchor rx_submitted;
         struct sk_buff *remain_skb;
+        const char *fw_name;
         int rx_remain_len;
         int rx_pkt_len;
         int rx_transfer_len;
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index c251603ab032..58f52a1dc7ea 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -223,15 +223,6 @@ struct ath9k_htc_sta {
         enum tid_aggr_state tid_state[ATH9K_HTC_MAX_TID];
 };
 
-struct ath9k_htc_aggr_work {
-        u16 tid;
-        u8 sta_addr[ETH_ALEN];
-        struct ieee80211_hw *hw;
-        struct ieee80211_vif *vif;
-        enum ieee80211_ampdu_mlme_action action;
-        struct mutex mutex;
-};
-
 #define ATH9K_HTC_RXBUF 256
 #define HTC_RX_FRAME_HEADER_SIZE 40
 
@@ -257,12 +248,15 @@ struct ath9k_htc_tx_ctl {
 #define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
 #define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.rx_stats.c++)
 
+#define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++)
+
 struct ath_tx_stats {
         u32 buf_queued;
         u32 buf_completed;
         u32 skb_queued;
         u32 skb_completed;
         u32 skb_dropped;
+        u32 queue_stats[WME_NUM_AC];
 };
 
 struct ath_rx_stats {
@@ -286,6 +280,8 @@ struct ath9k_debug {
 #define TX_STAT_INC(c) do { } while (0)
 #define RX_STAT_INC(c) do { } while (0)
 
+#define TX_QSTAT_INC(c) do { } while (0)
+
 #endif /* CONFIG_ATH9K_HTC_DEBUGFS */
 
 #define ATH_LED_PIN_DEF             1
@@ -326,11 +322,10 @@ struct htc_beacon_config {
 #define OP_LED_ON         BIT(4)
 #define OP_PREAMBLE_SHORT BIT(5)
 #define OP_PROTECT_ENABLE BIT(6)
-#define OP_TXAGGR         BIT(7)
-#define OP_ASSOCIATED     BIT(8)
-#define OP_ENABLE_BEACON  BIT(9)
-#define OP_LED_DEINIT     BIT(10)
-#define OP_UNPLUGGED      BIT(11)
+#define OP_ASSOCIATED     BIT(7)
+#define OP_ENABLE_BEACON  BIT(8)
+#define OP_LED_DEINIT     BIT(9)
+#define OP_UNPLUGGED      BIT(10)
 
 struct ath9k_htc_priv {
         struct device *dev;
@@ -371,8 +366,6 @@ struct ath9k_htc_priv {
         struct ath9k_htc_rx rx;
         struct tasklet_struct tx_tasklet;
         struct sk_buff_head tx_queue;
-        struct ath9k_htc_aggr_work aggr_work;
-        struct delayed_work ath9k_aggr_work;
         struct delayed_work ath9k_ani_work;
         struct work_struct ps_work;
 
@@ -390,13 +383,14 @@ struct ath9k_htc_priv {
         int led_off_duration;
         int led_on_cnt;
         int led_off_cnt;
-        int hwq_map[ATH9K_WME_AC_VO+1];
+
+        int beaconq;
+        int cabq;
+        int hwq_map[WME_NUM_AC];
 
 #ifdef CONFIG_ATH9K_HTC_DEBUGFS
         struct ath9k_debug debug;
 #endif
-        struct ath9k_htc_target_rate tgt_rate;
-
         struct mutex mutex;
 };
 
@@ -405,6 +399,7 @@ static inline void ath_read_cachesize(struct ath_common *common, int *csz)
         common->bus_ops->read_cachesize(common, csz);
 }
 
+void ath9k_htc_beaconq_config(struct ath9k_htc_priv *priv);
 void ath9k_htc_beacon_config(struct ath9k_htc_priv *priv,
                              struct ieee80211_vif *vif);
 void ath9k_htc_swba(struct ath9k_htc_priv *priv, u8 beacon_pending);
@@ -424,8 +419,8 @@ int ath9k_tx_init(struct ath9k_htc_priv *priv);
 void ath9k_tx_tasklet(unsigned long data);
 int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb);
 void ath9k_tx_cleanup(struct ath9k_htc_priv *priv);
-bool ath9k_htc_txq_setup(struct ath9k_htc_priv *priv,
-                         enum ath9k_tx_queue_subtype qtype);
+bool ath9k_htc_txq_setup(struct ath9k_htc_priv *priv, int subtype);
+int ath9k_htc_cabq_setup(struct ath9k_htc_priv *priv);
 int get_hw_qnum(u16 queue, int *hwq_map);
 int ath_htc_txq_update(struct ath9k_htc_priv *priv, int qnum,
                        struct ath9k_tx_queue_info *qinfo);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
index c10c7d002eb7..bd1506e69105 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
@@ -222,6 +222,29 @@ void ath9k_htc_swba(struct ath9k_htc_priv *priv, u8 beacon_pending)
         spin_unlock_bh(&priv->beacon_lock);
 }
 
+/* Currently, only for IBSS */
+void ath9k_htc_beaconq_config(struct ath9k_htc_priv *priv)
+{
+        struct ath_hw *ah = priv->ah;
+        struct ath9k_tx_queue_info qi, qi_be;
+        int qnum = priv->hwq_map[WME_AC_BE];
+
+        memset(&qi, 0, sizeof(struct ath9k_tx_queue_info));
+        memset(&qi_be, 0, sizeof(struct ath9k_tx_queue_info));
+
+        ath9k_hw_get_txq_props(ah, qnum, &qi_be);
+
+        qi.tqi_aifs = qi_be.tqi_aifs;
+        qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
+        qi.tqi_cwmax = qi_be.tqi_cwmax;
+
+        if (!ath9k_hw_set_txq_props(ah, priv->beaconq, &qi)) {
+                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                          "Unable to update beacon queue %u!\n", qnum);
+        } else {
+                ath9k_hw_resettxqueue(ah, priv->beaconq);
+        }
+}
 
 void ath9k_htc_beacon_config(struct ath9k_htc_priv *priv,
                              struct ieee80211_vif *vif)
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index dc015077a8d9..148b43317fdb 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -34,6 +34,13 @@ MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
         .max_power = 20, \
 }
 
+#define CHAN5G(_freq, _idx) { \
+        .band = IEEE80211_BAND_5GHZ, \
+        .center_freq = (_freq), \
+        .hw_value = (_idx), \
+        .max_power = 20, \
+}
+
 static struct ieee80211_channel ath9k_2ghz_channels[] = {
         CHAN2G(2412, 0), /* Channel 1 */
         CHAN2G(2417, 1), /* Channel 2 */
@@ -51,6 +58,37 @@ static struct ieee80211_channel ath9k_2ghz_channels[] = {
         CHAN2G(2484, 13), /* Channel 14 */
 };
 
+static struct ieee80211_channel ath9k_5ghz_channels[] = {
+        /* _We_ call this UNII 1 */
+        CHAN5G(5180, 14), /* Channel 36 */
+        CHAN5G(5200, 15), /* Channel 40 */
+        CHAN5G(5220, 16), /* Channel 44 */
+        CHAN5G(5240, 17), /* Channel 48 */
+        /* _We_ call this UNII 2 */
+        CHAN5G(5260, 18), /* Channel 52 */
+        CHAN5G(5280, 19), /* Channel 56 */
+        CHAN5G(5300, 20), /* Channel 60 */
+        CHAN5G(5320, 21), /* Channel 64 */
+        /* _We_ call this "Middle band" */
+        CHAN5G(5500, 22), /* Channel 100 */
+        CHAN5G(5520, 23), /* Channel 104 */
+        CHAN5G(5540, 24), /* Channel 108 */
+        CHAN5G(5560, 25), /* Channel 112 */
+        CHAN5G(5580, 26), /* Channel 116 */
+        CHAN5G(5600, 27), /* Channel 120 */
+        CHAN5G(5620, 28), /* Channel 124 */
+        CHAN5G(5640, 29), /* Channel 128 */
+        CHAN5G(5660, 30), /* Channel 132 */
+        CHAN5G(5680, 31), /* Channel 136 */
+        CHAN5G(5700, 32), /* Channel 140 */
+        /* _We_ call this UNII 3 */
+        CHAN5G(5745, 33), /* Channel 149 */
+        CHAN5G(5765, 34), /* Channel 153 */
+        CHAN5G(5785, 35), /* Channel 157 */
+        CHAN5G(5805, 36), /* Channel 161 */
+        CHAN5G(5825, 37), /* Channel 165 */
+};
+
 /* Atheros hardware rate code addition for short premble */
 #define SHPCHECK(__hw_rate, __flags) \
         ((__flags & IEEE80211_RATE_SHORT_PREAMBLE) ? (__hw_rate | 0x04) : 0)
@@ -141,7 +179,7 @@ static inline int ath9k_htc_connect_svc(struct ath9k_htc_priv *priv,
         return htc_connect_service(priv->htc, &req, ep_id);
 }
 
-static int ath9k_init_htc_services(struct ath9k_htc_priv *priv)
+static int ath9k_init_htc_services(struct ath9k_htc_priv *priv, u16 devid)
 {
         int ret;
 
@@ -199,10 +237,28 @@ static int ath9k_init_htc_services(struct ath9k_htc_priv *priv)
         if (ret)
                 goto err;
 
+        /*
+         * Setup required credits before initializing HTC.
+         * This is a bit hacky, but, since queuing is done in
+         * the HIF layer, shouldn't matter much.
+         */
+
+        switch(devid) {
+        case 0x7010:
+        case 0x9018:
+                priv->htc->credits = 45;
+                break;
+        default:
+                priv->htc->credits = 33;
+        }
+
         ret = htc_init(priv->htc);
         if (ret)
                 goto err;
 
+        dev_info(priv->dev, "ath9k_htc: HTC initialized with %d credits\n",
+                 priv->htc->credits);
+
         return 0;
 
 err:
@@ -398,17 +454,43 @@ static const struct ath_bus_ops ath9k_usb_bus_ops = {
 static void setup_ht_cap(struct ath9k_htc_priv *priv,
                          struct ieee80211_sta_ht_cap *ht_info)
 {
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        u8 tx_streams, rx_streams;
+        int i;
+
         ht_info->ht_supported = true;
         ht_info->cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
                        IEEE80211_HT_CAP_SM_PS |
                        IEEE80211_HT_CAP_SGI_40 |
                        IEEE80211_HT_CAP_DSSSCCK40;
 
+        if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_SGI_20)
+                ht_info->cap |= IEEE80211_HT_CAP_SGI_20;
+
+        ht_info->cap |= (1 << IEEE80211_HT_CAP_RX_STBC_SHIFT);
+
         ht_info->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
         ht_info->ampdu_density = IEEE80211_HT_MPDU_DENSITY_8;
 
         memset(&ht_info->mcs, 0, sizeof(ht_info->mcs));
-        ht_info->mcs.rx_mask[0] = 0xff;
+
+        /* ath9k_htc supports only 1 or 2 stream devices */
+        tx_streams = ath9k_cmn_count_streams(common->tx_chainmask, 2);
+        rx_streams = ath9k_cmn_count_streams(common->rx_chainmask, 2);
+
+        ath_print(common, ATH_DBG_CONFIG,
+                  "TX streams %d, RX streams: %d\n",
+                  tx_streams, rx_streams);
+
+        if (tx_streams != rx_streams) {
+                ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_RX_DIFF;
+                ht_info->mcs.tx_params |= ((tx_streams - 1) <<
+                                           IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT);
+        }
+
+        for (i = 0; i < rx_streams; i++)
+                ht_info->mcs.rx_mask[i] = 0xff;
+
         ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_DEFINED;
 }
 
@@ -420,23 +502,37 @@ static int ath9k_init_queues(struct ath9k_htc_priv *priv)
         for (i = 0; i < ARRAY_SIZE(priv->hwq_map); i++)
                 priv->hwq_map[i] = -1;
 
-        if (!ath9k_htc_txq_setup(priv, ATH9K_WME_AC_BE)) {
+        priv->beaconq = ath9k_hw_beaconq_setup(priv->ah);
+        if (priv->beaconq == -1) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to setup BEACON xmit queue\n");
+                goto err;
+        }
+
+        priv->cabq = ath9k_htc_cabq_setup(priv);
+        if (priv->cabq == -1) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to setup CAB xmit queue\n");
+                goto err;
+        }
+
+        if (!ath9k_htc_txq_setup(priv, WME_AC_BE)) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to setup xmit queue for BE traffic\n");
                 goto err;
         }
 
-        if (!ath9k_htc_txq_setup(priv, ATH9K_WME_AC_BK)) {
+        if (!ath9k_htc_txq_setup(priv, WME_AC_BK)) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to setup xmit queue for BK traffic\n");
                 goto err;
         }
-        if (!ath9k_htc_txq_setup(priv, ATH9K_WME_AC_VI)) {
+        if (!ath9k_htc_txq_setup(priv, WME_AC_VI)) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to setup xmit queue for VI traffic\n");
                 goto err;
         }
-        if (!ath9k_htc_txq_setup(priv, ATH9K_WME_AC_VO)) {
+        if (!ath9k_htc_txq_setup(priv, WME_AC_VO)) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to setup xmit queue for VO traffic\n");
                 goto err;
@@ -468,36 +564,6 @@ static void ath9k_init_crypto(struct ath9k_htc_priv *priv)
          */
         for (i = 0; i < common->keymax; i++)
                 ath9k_hw_keyreset(priv->ah, (u16) i);
-
-        if (ath9k_hw_getcapability(priv->ah, ATH9K_CAP_CIPHER,
-                                   ATH9K_CIPHER_TKIP, NULL)) {
-                /*
-                 * Whether we should enable h/w TKIP MIC.
-                 * XXX: if we don't support WME TKIP MIC, then we wouldn't
-                 * report WMM capable, so it's always safe to turn on
-                 * TKIP MIC in this case.
-                 */
-                ath9k_hw_setcapability(priv->ah, ATH9K_CAP_TKIP_MIC, 0, 1, NULL);
-        }
-
-        /*
-         * Check whether the separate key cache entries
-         * are required to handle both tx+rx MIC keys.
-         * With split mic keys the number of stations is limited
-         * to 27 otherwise 59.
-         */
-        if (ath9k_hw_getcapability(priv->ah, ATH9K_CAP_CIPHER,
-                                   ATH9K_CIPHER_TKIP, NULL)
-            && ath9k_hw_getcapability(priv->ah, ATH9K_CAP_CIPHER,
-                                      ATH9K_CIPHER_MIC, NULL)
-            && ath9k_hw_getcapability(priv->ah, ATH9K_CAP_TKIP_SPLIT,
-                                      0, NULL))
-                common->splitmic = 1;
-
-        /* turn on mcast key search if possible */
-        if (!ath9k_hw_getcapability(priv->ah, ATH9K_CAP_MCAST_KEYSRCH, 0, NULL))
-                (void)ath9k_hw_setcapability(priv->ah, ATH9K_CAP_MCAST_KEYSRCH,
-                                             1, 1, NULL);
 }
 
 static void ath9k_init_channels_rates(struct ath9k_htc_priv *priv)
@@ -512,6 +578,17 @@ static void ath9k_init_channels_rates(struct ath9k_htc_priv *priv)
                 priv->sbands[IEEE80211_BAND_2GHZ].n_bitrates =
                         ARRAY_SIZE(ath9k_legacy_rates);
         }
+
+        if (test_bit(ATH9K_MODE_11A, priv->ah->caps.wireless_modes)) {
+                priv->sbands[IEEE80211_BAND_5GHZ].channels = ath9k_5ghz_channels;
+                priv->sbands[IEEE80211_BAND_5GHZ].band = IEEE80211_BAND_5GHZ;
+                priv->sbands[IEEE80211_BAND_5GHZ].n_channels =
+                        ARRAY_SIZE(ath9k_5ghz_channels);
+                priv->sbands[IEEE80211_BAND_5GHZ].bitrates =
+                        ath9k_legacy_rates + 4;
+                priv->sbands[IEEE80211_BAND_5GHZ].n_bitrates =
+                        ARRAY_SIZE(ath9k_legacy_rates) - 4;
+        }
 }
 
 static void ath9k_init_misc(struct ath9k_htc_priv *priv)
@@ -524,7 +601,6 @@ static void ath9k_init_misc(struct ath9k_htc_priv *priv)
         if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
                 memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
 
-        priv->op_flags |= OP_TXAGGR;
         priv->ah->opmode = NL80211_IFTYPE_STATION;
 }
 
@@ -556,14 +632,12 @@ static int ath9k_init_priv(struct ath9k_htc_priv *priv, u16 devid)
         spin_lock_init(&priv->beacon_lock);
         spin_lock_init(&priv->tx_lock);
         mutex_init(&priv->mutex);
-        mutex_init(&priv->aggr_work.mutex);
         mutex_init(&priv->htc_pm_lock);
         tasklet_init(&priv->wmi_tasklet, ath9k_wmi_tasklet,
                      (unsigned long)priv);
         tasklet_init(&priv->rx_tasklet, ath9k_rx_tasklet,
                      (unsigned long)priv);
         tasklet_init(&priv->tx_tasklet, ath9k_tx_tasklet, (unsigned long)priv);
-        INIT_DELAYED_WORK(&priv->ath9k_aggr_work, ath9k_htc_aggr_work);
         INIT_DELAYED_WORK(&priv->ath9k_ani_work, ath9k_ani_work);
         INIT_WORK(&priv->ps_work, ath9k_ps_work);
 
@@ -643,11 +717,17 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
         if (test_bit(ATH9K_MODE_11G, priv->ah->caps.wireless_modes))
                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
                         &priv->sbands[IEEE80211_BAND_2GHZ];
+        if (test_bit(ATH9K_MODE_11A, priv->ah->caps.wireless_modes))
+                hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
+                        &priv->sbands[IEEE80211_BAND_5GHZ];
 
         if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
                 if (test_bit(ATH9K_MODE_11G, priv->ah->caps.wireless_modes))
                         setup_ht_cap(priv,
                                      &priv->sbands[IEEE80211_BAND_2GHZ].ht_cap);
+                if (test_bit(ATH9K_MODE_11A, priv->ah->caps.wireless_modes))
+                        setup_ht_cap(priv,
+                                     &priv->sbands[IEEE80211_BAND_5GHZ].ht_cap);
         }
 
         SET_IEEE80211_PERM_ADDR(hw, common->macaddr);
@@ -747,7 +827,7 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
                 goto err_free;
         }
 
-        ret = ath9k_init_htc_services(priv);
+        ret = ath9k_init_htc_services(priv, devid);
         if (ret)
                 goto err_init;
 
@@ -790,7 +870,8 @@ int ath9k_htc_resume(struct htc_target *htc_handle)
         if (ret)
                 return ret;
 
-        ret = ath9k_init_htc_services(htc_handle->drv_priv);
+        ret = ath9k_init_htc_services(htc_handle->drv_priv,
+                              htc_handle->drv_priv->ah->hw_version.devid);
         return ret;
 }
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 9d371c18eb41..05445d8a9818 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -27,13 +27,11 @@ static struct dentry *ath9k_debugfs_root;
 static void ath_update_txpow(struct ath9k_htc_priv *priv)
 {
         struct ath_hw *ah = priv->ah;
-        u32 txpow;
 
         if (priv->curtxpow != priv->txpowlimit) {
                 ath9k_hw_set_txpowerlimit(ah, priv->txpowlimit);
                 /* read back in case value is clamped */
-                ath9k_hw_getcapability(ah, ATH9K_CAP_TXPOW, 1, &txpow);
-                priv->curtxpow = txpow;
+                priv->curtxpow = ath9k_hw_regulatory(ah)->power_limit;
         }
 }
 
@@ -325,142 +323,128 @@ static int ath9k_htc_update_cap_target(struct ath9k_htc_priv *priv)
         tcap.flags_ext = 0x80601000;
         tcap.ampdu_limit = 0xffff0000;
         tcap.ampdu_subframes = 20;
-        tcap.tx_chainmask_legacy = 1;
+        tcap.tx_chainmask_legacy = priv->ah->caps.tx_chainmask;
         tcap.protmode = 1;
-        tcap.tx_chainmask = 1;
+        tcap.tx_chainmask = priv->ah->caps.tx_chainmask;
 
         WMI_CMD_BUF(WMI_TARGET_IC_UPDATE_CMDID, &tcap);
 
         return ret;
 }
 
-static int ath9k_htc_init_rate(struct ath9k_htc_priv *priv,
-                                 struct ieee80211_vif *vif,
-                                 struct ieee80211_sta *sta)
+static void ath9k_htc_setup_rate(struct ath9k_htc_priv *priv,
+                                 struct ieee80211_sta *sta,
+                                 struct ath9k_htc_target_rate *trate)
 {
-        struct ath_common *common = ath9k_hw_common(priv->ah);
         struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
         struct ieee80211_supported_band *sband;
-        struct ath9k_htc_target_rate trate;
         u32 caps = 0;
-        u8 cmd_rsp;
-        int i, j, ret;
-
-        memset(&trate, 0, sizeof(trate));
+        int i, j;
 
-        /* Only 2GHz is supported */
-        sband = priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ];
+        sband = priv->hw->wiphy->bands[priv->hw->conf.channel->band];
 
         for (i = 0, j = 0; i < sband->n_bitrates; i++) {
                 if (sta->supp_rates[sband->band] & BIT(i)) {
-                        priv->tgt_rate.rates.legacy_rates.rs_rates[j]
+                        trate->rates.legacy_rates.rs_rates[j]
                                 = (sband->bitrates[i].bitrate * 2) / 10;
                         j++;
                 }
         }
-        priv->tgt_rate.rates.legacy_rates.rs_nrates = j;
+        trate->rates.legacy_rates.rs_nrates = j;
 
         if (sta->ht_cap.ht_supported) {
                 for (i = 0, j = 0; i < 77; i++) {
                         if (sta->ht_cap.mcs.rx_mask[i/8] & (1<<(i%8)))
-                                priv->tgt_rate.rates.ht_rates.rs_rates[j++] = i;
+                                trate->rates.ht_rates.rs_rates[j++] = i;
                         if (j == ATH_HTC_RATE_MAX)
                                 break;
                 }
-                priv->tgt_rate.rates.ht_rates.rs_nrates = j;
+                trate->rates.ht_rates.rs_nrates = j;
 
                 caps = WLAN_RC_HT_FLAG;
+                if (sta->ht_cap.mcs.rx_mask[1])
+                        caps |= WLAN_RC_DS_FLAG;
                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
                         caps |= WLAN_RC_40_FLAG;
-                if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
+                if (conf_is_ht40(&priv->hw->conf) &&
+                    (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40))
+                        caps |= WLAN_RC_SGI_FLAG;
+                else if (conf_is_ht20(&priv->hw->conf) &&
+                         (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20))
                         caps |= WLAN_RC_SGI_FLAG;
-
         }
 
-        priv->tgt_rate.sta_index = ista->index;
-        priv->tgt_rate.isnew = 1;
-        trate = priv->tgt_rate;
-        priv->tgt_rate.capflags = cpu_to_be32(caps);
-        trate.capflags = cpu_to_be32(caps);
+        trate->sta_index = ista->index;
+        trate->isnew = 1;
+        trate->capflags = cpu_to_be32(caps);
+}
+
+static int ath9k_htc_send_rate_cmd(struct ath9k_htc_priv *priv,
+                                    struct ath9k_htc_target_rate *trate)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        int ret;
+        u8 cmd_rsp;
 
-        WMI_CMD_BUF(WMI_RC_RATE_UPDATE_CMDID, &trate);
+        WMI_CMD_BUF(WMI_RC_RATE_UPDATE_CMDID, trate);
         if (ret) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to initialize Rate information on target\n");
-                return ret;
         }
 
-        ath_print(common, ATH_DBG_CONFIG,
-                  "Updated target STA: %pM (caps: 0x%x)\n", sta->addr, caps);
-        return 0;
+        return ret;
 }
 
-static bool check_rc_update(struct ieee80211_hw *hw, bool *cw40)
+static void ath9k_htc_init_rate(struct ath9k_htc_priv *priv,
+                                struct ieee80211_sta *sta)
 {
-        struct ath9k_htc_priv *priv = hw->priv;
-        struct ieee80211_conf *conf = &hw->conf;
-
-        if (!conf_is_ht(conf))
-                return false;
-
-        if (!(priv->op_flags & OP_ASSOCIATED) ||
-            (priv->op_flags & OP_SCANNING))
-                return false;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_target_rate trate;
+        int ret;
 
-        if (conf_is_ht40(conf)) {
-                if (priv->ah->curchan->chanmode &
-                        (CHANNEL_HT40PLUS | CHANNEL_HT40MINUS)) {
-                        return false;
-                } else {
-                        *cw40 = true;
-                        return true;
-                }
-        } else {  /* ht20 */
-                if (priv->ah->curchan->chanmode & CHANNEL_HT20)
-                        return false;
-                else
-                        return true;
-        }
+        memset(&trate, 0, sizeof(struct ath9k_htc_target_rate));
+        ath9k_htc_setup_rate(priv, sta, &trate);
+        ret = ath9k_htc_send_rate_cmd(priv, &trate);
+        if (!ret)
+                ath_print(common, ATH_DBG_CONFIG,
+                          "Updated target sta: %pM, rate caps: 0x%X\n",
+                          sta->addr, be32_to_cpu(trate.capflags));
 }
 
-static void ath9k_htc_rc_update(struct ath9k_htc_priv *priv, bool is_cw40)
+static void ath9k_htc_update_rate(struct ath9k_htc_priv *priv,
+                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_bss_conf *bss_conf)
 {
-        struct ath9k_htc_target_rate trate;
         struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_target_rate trate;
+        struct ieee80211_sta *sta;
         int ret;
-        u32 caps = be32_to_cpu(priv->tgt_rate.capflags);
-        u8 cmd_rsp;
-
-        memset(&trate, 0, sizeof(trate));
-
-        trate = priv->tgt_rate;
 
-        if (is_cw40)
-                caps |= WLAN_RC_40_FLAG;
-        else
-                caps &= ~WLAN_RC_40_FLAG;
-
-        priv->tgt_rate.capflags = cpu_to_be32(caps);
-        trate.capflags = cpu_to_be32(caps);
+        memset(&trate, 0, sizeof(struct ath9k_htc_target_rate));
 
-        WMI_CMD_BUF(WMI_RC_RATE_UPDATE_CMDID, &trate);
-        if (ret) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "Unable to update Rate information on target\n");
+        rcu_read_lock();
+        sta = ieee80211_find_sta(vif, bss_conf->bssid);
+        if (!sta) {
+                rcu_read_unlock();
                 return;
         }
+        ath9k_htc_setup_rate(priv, sta, &trate);
+        rcu_read_unlock();
 
-        ath_print(common, ATH_DBG_CONFIG, "Rate control updated with "
-                  "caps:0x%x on target\n", priv->tgt_rate.capflags);
+        ret = ath9k_htc_send_rate_cmd(priv, &trate);
+        if (!ret)
+                ath_print(common, ATH_DBG_CONFIG,
+                          "Updated target sta: %pM, rate caps: 0x%X\n",
+                          bss_conf->bssid, be32_to_cpu(trate.capflags));
 }
 
-static int ath9k_htc_aggr_oper(struct ath9k_htc_priv *priv,
-                               struct ieee80211_vif *vif,
-                               u8 *sta_addr, u8 tid, bool oper)
+int ath9k_htc_tx_aggr_oper(struct ath9k_htc_priv *priv,
+                           struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta,
+                           enum ieee80211_ampdu_mlme_action action, u16 tid)
 {
         struct ath_common *common = ath9k_hw_common(priv->ah);
         struct ath9k_htc_target_aggr aggr;
-        struct ieee80211_sta *sta = NULL;
         struct ath9k_htc_sta *ista;
         int ret = 0;
         u8 cmd_rsp;
@@ -469,72 +453,28 @@ static int ath9k_htc_aggr_oper(struct ath9k_htc_priv *priv,
                 return -EINVAL;
 
         memset(&aggr, 0, sizeof(struct ath9k_htc_target_aggr));
-
-        rcu_read_lock();
-
-        /* Check if we are able to retrieve the station */
-        sta = ieee80211_find_sta(vif, sta_addr);
-        if (!sta) {
-                rcu_read_unlock();
-                return -EINVAL;
-        }
-
         ista = (struct ath9k_htc_sta *) sta->drv_priv;
 
-        if (oper)
-                ista->tid_state[tid] = AGGR_START;
-        else
-                ista->tid_state[tid] = AGGR_STOP;
-
         aggr.sta_index = ista->index;
-
-        rcu_read_unlock();
-
-        aggr.tidno = tid;
-        aggr.aggr_enable = oper;
+        aggr.tidno = tid & 0xf;
+        aggr.aggr_enable = (action == IEEE80211_AMPDU_TX_START) ? true : false;
 
         WMI_CMD_BUF(WMI_TX_AGGR_ENABLE_CMDID, &aggr);
         if (ret)
                 ath_print(common, ATH_DBG_CONFIG,
                           "Unable to %s TX aggregation for (%pM, %d)\n",
-                          (oper) ? "start" : "stop", sta->addr, tid);
+                          (aggr.aggr_enable) ? "start" : "stop", sta->addr, tid);
         else
                 ath_print(common, ATH_DBG_CONFIG,
-                          "%s aggregation for (%pM, %d)\n",
-                          (oper) ? "Starting" : "Stopping", sta->addr, tid);
-
-        return ret;
-}
+                          "%s TX aggregation for (%pM, %d)\n",
+                          (aggr.aggr_enable) ? "Starting" : "Stopping",
+                          sta->addr, tid);
 
-void ath9k_htc_aggr_work(struct work_struct *work)
-{
-        int ret = 0;
-        struct ath9k_htc_priv *priv =
-                container_of(work, struct ath9k_htc_priv,
-                             ath9k_aggr_work.work);
-        struct ath9k_htc_aggr_work *wk = &priv->aggr_work;
-
-        mutex_lock(&wk->mutex);
-
-        switch (wk->action) {
-        case IEEE80211_AMPDU_TX_START:
-                ret = ath9k_htc_aggr_oper(priv, wk->vif, wk->sta_addr,
-                                          wk->tid, true);
-                if (!ret)
-                        ieee80211_start_tx_ba_cb(wk->vif, wk->sta_addr,
-                                                 wk->tid);
-                break;
-        case IEEE80211_AMPDU_TX_STOP:
-                ath9k_htc_aggr_oper(priv, wk->vif, wk->sta_addr,
-                                    wk->tid, false);
-                ieee80211_stop_tx_ba_cb(wk->vif, wk->sta_addr, wk->tid);
-                break;
-        default:
-                ath_print(ath9k_hw_common(priv->ah), ATH_DBG_FATAL,
-                          "Unknown AMPDU action\n");
-        }
+        spin_lock_bh(&priv->tx_lock);
+        ista->tid_state[tid] = (aggr.aggr_enable && !ret) ? AGGR_START : AGGR_STOP;
+        spin_unlock_bh(&priv->tx_lock);
 
-        mutex_unlock(&wk->mutex);
+        return ret;
 }
 
 /*********/
@@ -617,6 +557,19 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
                         "%20s : %10u\n", "SKBs dropped",
                         priv->debug.tx_stats.skb_dropped);
 
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "BE queued",
+                        priv->debug.tx_stats.queue_stats[WME_AC_BE]);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "BK queued",
+                        priv->debug.tx_stats.queue_stats[WME_AC_BK]);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "VI queued",
+                        priv->debug.tx_stats.queue_stats[WME_AC_VI]);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "VO queued",
+                        priv->debug.tx_stats.queue_stats[WME_AC_VO]);
+
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -1054,6 +1007,95 @@ void ath9k_start_rfkill_poll(struct ath9k_htc_priv *priv)
                 wiphy_rfkill_start_polling(priv->hw->wiphy);
 }
 
+static void ath9k_htc_radio_enable(struct ieee80211_hw *hw)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_hw *ah = priv->ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        int ret;
+        u8 cmd_rsp;
+
+        if (!ah->curchan)
+                ah->curchan = ath9k_cmn_get_curchannel(hw, ah);
+
+        /* Reset the HW */
+        ret = ath9k_hw_reset(ah, ah->curchan, false);
+        if (ret) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to reset hardware; reset status %d "
+                          "(freq %u MHz)\n", ret, ah->curchan->channel);
+        }
+
+        ath_update_txpow(priv);
+
+        /* Start RX */
+        WMI_CMD(WMI_START_RECV_CMDID);
+        ath9k_host_rx_init(priv);
+
+        /* Start TX */
+        htc_start(priv->htc);
+        spin_lock_bh(&priv->tx_lock);
+        priv->tx_queues_stop = false;
+        spin_unlock_bh(&priv->tx_lock);
+        ieee80211_wake_queues(hw);
+
+        WMI_CMD(WMI_ENABLE_INTR_CMDID);
+
+        /* Enable LED */
+        ath9k_hw_cfg_output(ah, ah->led_pin,
+                            AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+        ath9k_hw_set_gpio(ah, ah->led_pin, 0);
+}
+
+static void ath9k_htc_radio_disable(struct ieee80211_hw *hw)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_hw *ah = priv->ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        int ret;
+        u8 cmd_rsp;
+
+        ath9k_htc_ps_wakeup(priv);
+
+        /* Disable LED */
+        ath9k_hw_set_gpio(ah, ah->led_pin, 1);
+        ath9k_hw_cfg_gpio_input(ah, ah->led_pin);
+
+        WMI_CMD(WMI_DISABLE_INTR_CMDID);
+
+        /* Stop TX */
+        ieee80211_stop_queues(hw);
+        htc_stop(priv->htc);
+        WMI_CMD(WMI_DRAIN_TXQ_ALL_CMDID);
+        skb_queue_purge(&priv->tx_queue);
+
+        /* Stop RX */
+        WMI_CMD(WMI_STOP_RECV_CMDID);
+
+        /*
+         * The MIB counters have to be disabled here,
+         * since the target doesn't do it.
+         */
+        ath9k_hw_disable_mib_counters(ah);
+
+        if (!ah->curchan)
+                ah->curchan = ath9k_cmn_get_curchannel(hw, ah);
+
+        /* Reset the HW */
+        ret = ath9k_hw_reset(ah, ah->curchan, false);
+        if (ret) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to reset hardware; reset status %d "
+                          "(freq %u MHz)\n", ret, ah->curchan->channel);
+        }
+
+        /* Disable the PHY */
+        ath9k_hw_phy_disable(ah);
+
+        ath9k_htc_ps_restore(priv);
+        ath9k_htc_setpower(priv, ATH9K_PM_FULL_SLEEP);
+}
+
 /**********************/
 /* mac80211 Callbacks */
 /**********************/
@@ -1099,7 +1141,7 @@ fail_tx:
         return 0;
 }
 
-static int ath9k_htc_radio_enable(struct ieee80211_hw *hw, bool led)
+static int ath9k_htc_start(struct ieee80211_hw *hw)
 {
         struct ath9k_htc_priv *priv = hw->priv;
         struct ath_hw *ah = priv->ah;
@@ -1111,10 +1153,16 @@ static int ath9k_htc_radio_enable(struct ieee80211_hw *hw, bool led)
         __be16 htc_mode;
         u8 cmd_rsp;
 
+        mutex_lock(&priv->mutex);
+
         ath_print(common, ATH_DBG_CONFIG,
                   "Starting driver with initial channel: %d MHz\n",
                   curchan->center_freq);
 
+        /* Ensure that HW is awake before flushing RX */
+        ath9k_htc_setpower(priv, ATH9K_PM_AWAKE);
+        WMI_CMD(WMI_FLUSH_RECV_CMDID);
+
         /* setup initial channel */
         init_channel = ath9k_cmn_get_curchannel(hw, ah);
 
@@ -1127,6 +1175,7 @@ static int ath9k_htc_radio_enable(struct ieee80211_hw *hw, bool led)
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d "
                           "(freq %u MHz)\n", ret, curchan->center_freq);
+                mutex_unlock(&priv->mutex);
                 return ret;
         }
 
@@ -1147,31 +1196,14 @@ static int ath9k_htc_radio_enable(struct ieee80211_hw *hw, bool led)
         priv->tx_queues_stop = false;
         spin_unlock_bh(&priv->tx_lock);
 
-        if (led) {
-                /* Enable LED */
-                ath9k_hw_cfg_output(ah, ah->led_pin,
-                                    AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
-                ath9k_hw_set_gpio(ah, ah->led_pin, 0);
-        }
-
         ieee80211_wake_queues(hw);
 
-        return ret;
-}
-
-static int ath9k_htc_start(struct ieee80211_hw *hw)
-{
-        struct ath9k_htc_priv *priv = hw->priv;
-        int ret = 0;
-
-        mutex_lock(&priv->mutex);
-        ret = ath9k_htc_radio_enable(hw, false);
         mutex_unlock(&priv->mutex);
 
         return ret;
 }
 
-static void ath9k_htc_radio_disable(struct ieee80211_hw *hw, bool led)
+static void ath9k_htc_stop(struct ieee80211_hw *hw)
 {
         struct ath9k_htc_priv *priv = hw->priv;
         struct ath_hw *ah = priv->ah;
@@ -1179,21 +1211,17 @@ static void ath9k_htc_radio_disable(struct ieee80211_hw *hw, bool led)
         int ret = 0;
         u8 cmd_rsp;
 
+        mutex_lock(&priv->mutex);
+
         if (priv->op_flags & OP_INVALID) {
                 ath_print(common, ATH_DBG_ANY, "Device not present\n");
+                mutex_unlock(&priv->mutex);
                 return;
         }
 
-        if (led) {
-                /* Disable LED */
-                ath9k_hw_set_gpio(ah, ah->led_pin, 1);
-                ath9k_hw_cfg_gpio_input(ah, ah->led_pin);
-        }
-
         /* Cancel all the running timers/work .. */
         cancel_work_sync(&priv->ps_work);
         cancel_delayed_work_sync(&priv->ath9k_ani_work);
-        cancel_delayed_work_sync(&priv->ath9k_aggr_work);
         cancel_delayed_work_sync(&priv->ath9k_led_blink_work);
         ath9k_led_stop_brightness(priv);
 
@@ -1202,12 +1230,6 @@ static void ath9k_htc_radio_disable(struct ieee80211_hw *hw, bool led)
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
         WMI_CMD(WMI_DRAIN_TXQ_ALL_CMDID);
         WMI_CMD(WMI_STOP_RECV_CMDID);
-        ath9k_hw_phy_disable(ah);
-        ath9k_hw_disable(ah);
-        ath9k_hw_configpcipowersave(ah, 1, 1);
-        ath9k_htc_ps_restore(priv);
-        ath9k_htc_setpower(priv, ATH9K_PM_FULL_SLEEP);
-
         skb_queue_purge(&priv->tx_queue);
 
         /* Remove monitor interface here */
@@ -1220,21 +1242,18 @@ static void ath9k_htc_radio_disable(struct ieee80211_hw *hw, bool led)
                                   "Monitor interface removed\n");
         }
 
+        ath9k_hw_phy_disable(ah);
+        ath9k_hw_disable(ah);
+        ath9k_hw_configpcipowersave(ah, 1, 1);
+        ath9k_htc_ps_restore(priv);
+        ath9k_htc_setpower(priv, ATH9K_PM_FULL_SLEEP);
+
         priv->op_flags |= OP_INVALID;
 
         ath_print(common, ATH_DBG_CONFIG, "Driver halt\n");
-}
-
-static void ath9k_htc_stop(struct ieee80211_hw *hw)
-{
-        struct ath9k_htc_priv *priv = hw->priv;
-
-        mutex_lock(&priv->mutex);
-        ath9k_htc_radio_disable(hw, false);
         mutex_unlock(&priv->mutex);
 }
 
-
 static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
                                    struct ieee80211_vif *vif)
 {
@@ -1302,6 +1321,7 @@ static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
 out:
         ath9k_htc_ps_restore(priv);
         mutex_unlock(&priv->mutex);
+
         return ret;
 }
 
@@ -1318,6 +1338,7 @@ static void ath9k_htc_remove_interface(struct ieee80211_hw *hw,
         ath_print(common, ATH_DBG_CONFIG, "Detach Interface\n");
 
         mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
 
         memset(&hvif, 0, sizeof(struct ath9k_htc_target_vif));
         memcpy(&hvif.myaddr, vif->addr, ETH_ALEN);
@@ -1328,6 +1349,7 @@ static void ath9k_htc_remove_interface(struct ieee80211_hw *hw,
         ath9k_htc_remove_station(priv, vif, NULL);
         priv->vif = NULL;
 
+        ath9k_htc_ps_restore(priv);
         mutex_unlock(&priv->mutex);
 }
 
@@ -1343,30 +1365,27 @@ static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
                 bool enable_radio = false;
                 bool idle = !!(conf->flags & IEEE80211_CONF_IDLE);
 
+                mutex_lock(&priv->htc_pm_lock);
                 if (!idle && priv->ps_idle)
                         enable_radio = true;
-
                 priv->ps_idle = idle;
+                mutex_unlock(&priv->htc_pm_lock);
 
                 if (enable_radio) {
-                        ath9k_htc_setpower(priv, ATH9K_PM_AWAKE);
-                        ath9k_htc_radio_enable(hw, true);
                         ath_print(common, ATH_DBG_CONFIG,
                                   "not-idle: enabling radio\n");
+                        ath9k_htc_setpower(priv, ATH9K_PM_AWAKE);
+                        ath9k_htc_radio_enable(hw);
                 }
         }
 
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
                 struct ieee80211_channel *curchan = hw->conf.channel;
                 int pos = curchan->hw_value;
-                bool is_cw40 = false;
 
                 ath_print(common, ATH_DBG_CONFIG, "Set channel: %d MHz\n",
                           curchan->center_freq);
 
-                if (check_rc_update(hw, &is_cw40))
-                        ath9k_htc_rc_update(priv, is_cw40);
-
                 ath9k_cmn_update_ichannel(hw, &priv->ah->channels[pos]);
 
                 if (ath9k_htc_set_channel(priv, hw, &priv->ah->channels[pos]) < 0) {
@@ -1399,14 +1418,21 @@ static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
                 }
         }
 
-        if (priv->ps_idle) {
+        if (changed & IEEE80211_CONF_CHANGE_IDLE) {
+                mutex_lock(&priv->htc_pm_lock);
+                if (!priv->ps_idle) {
+                        mutex_unlock(&priv->htc_pm_lock);
+                        goto out;
+                }
+                mutex_unlock(&priv->htc_pm_lock);
+
                 ath_print(common, ATH_DBG_CONFIG,
                           "idle: disabling radio\n");
-                ath9k_htc_radio_disable(hw, true);
+                ath9k_htc_radio_disable(hw);
         }
 
+out:
         mutex_unlock(&priv->mutex);
-
         return 0;
 }
 
@@ -1428,8 +1454,8 @@ static void ath9k_htc_configure_filter(struct ieee80211_hw *hw,
         u32 rfilt;
 
         mutex_lock(&priv->mutex);
-
         ath9k_htc_ps_wakeup(priv);
+
         changed_flags &= SUPPORTED_FILTERS;
         *total_flags &= SUPPORTED_FILTERS;
 
@@ -1444,30 +1470,38 @@ static void ath9k_htc_configure_filter(struct ieee80211_hw *hw,
         mutex_unlock(&priv->mutex);
 }
 
-static void ath9k_htc_sta_notify(struct ieee80211_hw *hw,
-                                 struct ieee80211_vif *vif,
-                                 enum sta_notify_cmd cmd,
-                                 struct ieee80211_sta *sta)
+static int ath9k_htc_sta_add(struct ieee80211_hw *hw,
+                             struct ieee80211_vif *vif,
+                             struct ieee80211_sta *sta)
 {
         struct ath9k_htc_priv *priv = hw->priv;
         int ret;
 
         mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
+        ret = ath9k_htc_add_station(priv, vif, sta);
+        if (!ret)
+                ath9k_htc_init_rate(priv, sta);
+        ath9k_htc_ps_restore(priv);
+        mutex_unlock(&priv->mutex);
 
-        switch (cmd) {
-        case STA_NOTIFY_ADD:
-                ret = ath9k_htc_add_station(priv, vif, sta);
-                if (!ret)
-                        ath9k_htc_init_rate(priv, vif, sta);
-                break;
-        case STA_NOTIFY_REMOVE:
-                ath9k_htc_remove_station(priv, vif, sta);
-                break;
-        default:
-                break;
-        }
+        return ret;
+}
+
+static int ath9k_htc_sta_remove(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_sta *sta)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        int ret;
 
+        mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
+        ret = ath9k_htc_remove_station(priv, vif, sta);
+        ath9k_htc_ps_restore(priv);
         mutex_unlock(&priv->mutex);
+
+        return ret;
 }
 
 static int ath9k_htc_conf_tx(struct ieee80211_hw *hw, u16 queue,
@@ -1482,6 +1516,7 @@ static int ath9k_htc_conf_tx(struct ieee80211_hw *hw, u16 queue,
                 return 0;
 
         mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
 
         memset(&qi, 0, sizeof(struct ath9k_tx_queue_info));
 
@@ -1499,9 +1534,16 @@ static int ath9k_htc_conf_tx(struct ieee80211_hw *hw, u16 queue,
                   params->cw_max, params->txop);
 
         ret = ath_htc_txq_update(priv, qnum, &qi);
-        if (ret)
+        if (ret) {
                 ath_print(common, ATH_DBG_FATAL, "TXQ Update failed\n");
+                goto out;
+        }
 
+        if ((priv->ah->opmode == NL80211_IFTYPE_ADHOC) &&
+            (qnum == priv->hwq_map[WME_AC_BE]))
+                    ath9k_htc_beaconq_config(priv);
+out:
+        ath9k_htc_ps_restore(priv);
         mutex_unlock(&priv->mutex);
 
         return ret;
@@ -1574,7 +1616,6 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
                         ath_start_ani(priv);
                 } else {
                         priv->op_flags &= ~OP_ASSOCIATED;
-                        cancel_work_sync(&priv->ps_work);
                         cancel_delayed_work_sync(&priv->ath9k_ani_work);
                 }
         }
@@ -1631,6 +1672,9 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
                 ath9k_hw_init_global_settings(ah);
         }
 
+        if (changed & BSS_CHANGED_HT)
+                ath9k_htc_update_rate(priv, vif, bss_conf);
+
         ath9k_htc_ps_restore(priv);
         mutex_unlock(&priv->mutex);
 }
@@ -1641,7 +1685,9 @@ static u64 ath9k_htc_get_tsf(struct ieee80211_hw *hw)
         u64 tsf;
 
         mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
         tsf = ath9k_hw_gettsf64(priv->ah);
+        ath9k_htc_ps_restore(priv);
         mutex_unlock(&priv->mutex);
 
         return tsf;
@@ -1652,7 +1698,9 @@ static void ath9k_htc_set_tsf(struct ieee80211_hw *hw, u64 tsf)
         struct ath9k_htc_priv *priv = hw->priv;
 
         mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
         ath9k_hw_settsf64(priv->ah, tsf);
+        ath9k_htc_ps_restore(priv);
         mutex_unlock(&priv->mutex);
 }
 
@@ -1660,11 +1708,11 @@ static void ath9k_htc_reset_tsf(struct ieee80211_hw *hw)
 {
         struct ath9k_htc_priv *priv = hw->priv;
 
-        ath9k_htc_ps_wakeup(priv);
         mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
         ath9k_hw_reset_tsf(priv->ah);
-        mutex_unlock(&priv->mutex);
         ath9k_htc_ps_restore(priv);
+        mutex_unlock(&priv->mutex);
 }
 
 static int ath9k_htc_ampdu_action(struct ieee80211_hw *hw,
@@ -1674,8 +1722,8 @@ static int ath9k_htc_ampdu_action(struct ieee80211_hw *hw,
                                   u16 tid, u16 *ssn)
 {
         struct ath9k_htc_priv *priv = hw->priv;
-        struct ath9k_htc_aggr_work *work = &priv->aggr_work;
         struct ath9k_htc_sta *ista;
+        int ret = 0;
 
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
@@ -1683,26 +1731,26 @@ static int ath9k_htc_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_RX_STOP:
                 break;
         case IEEE80211_AMPDU_TX_START:
+                ret = ath9k_htc_tx_aggr_oper(priv, vif, sta, action, tid);
+                if (!ret)
+                        ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
         case IEEE80211_AMPDU_TX_STOP:
-                if (!(priv->op_flags & OP_TXAGGR))
-                        return -ENOTSUPP;
-                memcpy(work->sta_addr, sta->addr, ETH_ALEN);
-                work->hw = hw;
-                work->vif = vif;
-                work->action = action;
-                work->tid = tid;
-                ieee80211_queue_delayed_work(hw, &priv->ath9k_aggr_work, 0);
+                ath9k_htc_tx_aggr_oper(priv, vif, sta, action, tid);
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
                 ista = (struct ath9k_htc_sta *) sta->drv_priv;
+                spin_lock_bh(&priv->tx_lock);
                 ista->tid_state[tid] = AGGR_OPERATIONAL;
+                spin_unlock_bh(&priv->tx_lock);
                 break;
         default:
                 ath_print(ath9k_hw_common(priv->ah), ATH_DBG_FATAL,
                           "Unknown AMPDU action\n");
         }
 
-        return 0;
+        return ret;
 }
 
 static void ath9k_htc_sw_scan_start(struct ieee80211_hw *hw)
@@ -1722,8 +1770,8 @@ static void ath9k_htc_sw_scan_complete(struct ieee80211_hw *hw)
 {
         struct ath9k_htc_priv *priv = hw->priv;
 
-        ath9k_htc_ps_wakeup(priv);
         mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
         spin_lock_bh(&priv->beacon_lock);
         priv->op_flags &= ~OP_SCANNING;
         spin_unlock_bh(&priv->beacon_lock);
@@ -1731,8 +1779,8 @@ static void ath9k_htc_sw_scan_complete(struct ieee80211_hw *hw)
         if (priv->op_flags & OP_ASSOCIATED)
                 ath9k_htc_beacon_config(priv, priv->vif);
         ath_start_ani(priv);
-        mutex_unlock(&priv->mutex);
         ath9k_htc_ps_restore(priv);
+        mutex_unlock(&priv->mutex);
 }
 
 static int ath9k_htc_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
@@ -1746,8 +1794,10 @@ static void ath9k_htc_set_coverage_class(struct ieee80211_hw *hw,
         struct ath9k_htc_priv *priv = hw->priv;
 
         mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
         priv->ah->coverage_class = coverage_class;
         ath9k_hw_init_global_settings(priv->ah);
+        ath9k_htc_ps_restore(priv);
         mutex_unlock(&priv->mutex);
 }
 
@@ -1759,7 +1809,8 @@ struct ieee80211_ops ath9k_htc_ops = {
         .remove_interface   = ath9k_htc_remove_interface,
         .config             = ath9k_htc_config,
         .configure_filter   = ath9k_htc_configure_filter,
-        .sta_notify         = ath9k_htc_sta_notify,
+        .sta_add            = ath9k_htc_sta_add,
+        .sta_remove         = ath9k_htc_sta_remove,
         .conf_tx            = ath9k_htc_conf_tx,
         .bss_info_changed   = ath9k_htc_bss_info_changed,
         .set_key            = ath9k_htc_set_key,
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 2571b443ac82..bd0b4acc3ece 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -20,19 +20,29 @@
 /* TX */
 /******/
 
+#define ATH9K_HTC_INIT_TXQ(subtype) do {                        \
+                qi.tqi_subtype = subtype;                       \
+                qi.tqi_aifs = ATH9K_TXQ_USEDEFAULT;             \
+                qi.tqi_cwmin = ATH9K_TXQ_USEDEFAULT;            \
+                qi.tqi_cwmax = ATH9K_TXQ_USEDEFAULT;            \
+                qi.tqi_physCompBuf = 0;                         \
+                qi.tqi_qflags = TXQ_FLAG_TXEOLINT_ENABLE |      \
+                        TXQ_FLAG_TXDESCINT_ENABLE;              \
+        } while (0)
+
 int get_hw_qnum(u16 queue, int *hwq_map)
 {
         switch (queue) {
         case 0:
-                return hwq_map[ATH9K_WME_AC_VO];
+                return hwq_map[WME_AC_VO];
         case 1:
-                return hwq_map[ATH9K_WME_AC_VI];
+                return hwq_map[WME_AC_VI];
         case 2:
-                return hwq_map[ATH9K_WME_AC_BE];
+                return hwq_map[WME_AC_BE];
         case 3:
-                return hwq_map[ATH9K_WME_AC_BK];
+                return hwq_map[WME_AC_BK];
         default:
-                return hwq_map[ATH9K_WME_AC_BE];
+                return hwq_map[WME_AC_BE];
         }
 }
 
@@ -71,7 +81,7 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
         struct ath9k_htc_vif *avp;
         struct ath9k_htc_tx_ctl tx_ctl;
         enum htc_endpoint_id epid;
-        u16 qnum, hw_qnum;
+        u16 qnum;
         __le16 fc;
         u8 *tx_fhdr;
         u8 sta_idx;
@@ -131,20 +141,23 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
                 memcpy(tx_fhdr, (u8 *) &tx_hdr, sizeof(tx_hdr));
 
                 qnum = skb_get_queue_mapping(skb);
-                hw_qnum = get_hw_qnum(qnum, priv->hwq_map);
 
-                switch (hw_qnum) {
+                switch (qnum) {
                 case 0:
-                        epid = priv->data_be_ep;
+                        TX_QSTAT_INC(WME_AC_VO);
+                        epid = priv->data_vo_ep;
                         break;
-                case 2:
+                case 1:
+                        TX_QSTAT_INC(WME_AC_VI);
                         epid = priv->data_vi_ep;
                         break;
-                case 3:
-                        epid = priv->data_vo_ep;
+                case 2:
+                        TX_QSTAT_INC(WME_AC_BE);
+                        epid = priv->data_be_ep;
                         break;
-                case 1:
+                case 3:
                 default:
+                        TX_QSTAT_INC(WME_AC_BK);
                         epid = priv->data_bk_ep;
                         break;
                 }
@@ -174,6 +187,19 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
         return htc_send(priv->htc, skb, epid, &tx_ctl);
 }
 
+static bool ath9k_htc_check_tx_aggr(struct ath9k_htc_priv *priv,
+                                    struct ath9k_htc_sta *ista, u8 tid)
+{
+        bool ret = false;
+
+        spin_lock_bh(&priv->tx_lock);
+        if ((tid < ATH9K_HTC_MAX_TID) && (ista->tid_state[tid] == AGGR_STOP))
+                ret = true;
+        spin_unlock_bh(&priv->tx_lock);
+
+        return ret;
+}
+
 void ath9k_tx_tasklet(unsigned long data)
 {
         struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *)data;
@@ -203,8 +229,7 @@ void ath9k_tx_tasklet(unsigned long data)
                 /* Check if we need to start aggregation */
 
                 if (sta && conf_is_ht(&priv->hw->conf) &&
-                    (priv->op_flags & OP_TXAGGR)
-                    && !(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
+                    !(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
                         if (ieee80211_is_data_qos(fc)) {
                                 u8 *qc, tid;
                                 struct ath9k_htc_sta *ista;
@@ -213,10 +238,11 @@ void ath9k_tx_tasklet(unsigned long data)
                                 tid = qc[0] & 0xf;
                                 ista = (struct ath9k_htc_sta *)sta->drv_priv;
 
-                                if ((tid < ATH9K_HTC_MAX_TID) &&
-                                    ista->tid_state[tid] == AGGR_STOP) {
+                                if (ath9k_htc_check_tx_aggr(priv, ista, tid)) {
                                         ieee80211_start_tx_ba_session(sta, tid);
+                                        spin_lock_bh(&priv->tx_lock);
                                         ista->tid_state[tid] = AGGR_PROGRESS;
+                                        spin_unlock_bh(&priv->tx_lock);
                                 }
                         }
                 }
@@ -284,8 +310,7 @@ void ath9k_tx_cleanup(struct ath9k_htc_priv *priv)
 
 }
 
-bool ath9k_htc_txq_setup(struct ath9k_htc_priv *priv,
-                         enum ath9k_tx_queue_subtype subtype)
+bool ath9k_htc_txq_setup(struct ath9k_htc_priv *priv, int subtype)
 {
         struct ath_hw *ah = priv->ah;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -293,13 +318,7 @@ bool ath9k_htc_txq_setup(struct ath9k_htc_priv *priv,
         int qnum;
 
         memset(&qi, 0, sizeof(qi));
-
-        qi.tqi_subtype = subtype;
-        qi.tqi_aifs = ATH9K_TXQ_USEDEFAULT;
-        qi.tqi_cwmin = ATH9K_TXQ_USEDEFAULT;
-        qi.tqi_cwmax = ATH9K_TXQ_USEDEFAULT;
-        qi.tqi_physCompBuf = 0;
-        qi.tqi_qflags = TXQ_FLAG_TXEOLINT_ENABLE | TXQ_FLAG_TXDESCINT_ENABLE;
+        ATH9K_HTC_INIT_TXQ(subtype);
 
         qnum = ath9k_hw_setuptxqueue(priv->ah, ATH9K_TX_QUEUE_DATA, &qi);
         if (qnum == -1)
@@ -317,6 +336,16 @@ bool ath9k_htc_txq_setup(struct ath9k_htc_priv *priv,
         return true;
 }
 
+int ath9k_htc_cabq_setup(struct ath9k_htc_priv *priv)
+{
+        struct ath9k_tx_queue_info qi;
+
+        memset(&qi, 0, sizeof(qi));
+        ATH9K_HTC_INIT_TXQ(0);
+
+        return ath9k_hw_setuptxqueue(priv->ah, ATH9K_TX_QUEUE_CAB, &qi);
+}
+
 /******/
 /* RX */
 /******/
@@ -387,9 +416,6 @@ static void ath9k_htc_opmode_init(struct ath9k_htc_priv *priv)
         /* configure operational mode */
         ath9k_hw_setopmode(ah);
 
-        /* Handle any link-level address change. */
-        ath9k_hw_setmac(ah, common->macaddr);
-
         /* calculate and install multicast filter */
         mfilt[0] = mfilt[1] = ~0;
         ath9k_hw_setmcastfilter(ah, mfilt[0], mfilt[1]);
@@ -399,7 +425,7 @@ void ath9k_host_rx_init(struct ath9k_htc_priv *priv)
 {
         ath9k_hw_rxena(priv->ah);
         ath9k_htc_opmode_init(priv);
-        ath9k_hw_startpcureceive(priv->ah);
+        ath9k_hw_startpcureceive(priv->ah, (priv->op_flags & OP_SCANNING));
         priv->rx.last_rssi = ATH_RSSI_DUMMY_MARKER;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 064397fd738e..705c0f342e1c 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -89,7 +89,6 @@ static void htc_process_target_rdy(struct htc_target *target,
         struct htc_endpoint *endpoint;
         struct htc_ready_msg *htc_ready_msg = (struct htc_ready_msg *) buf;
 
-        target->credits = be16_to_cpu(htc_ready_msg->credits);
         target->credit_size = be16_to_cpu(htc_ready_msg->credit_size);
 
         endpoint = &target->endpoint[ENDPOINT0];
@@ -159,7 +158,7 @@ static int htc_config_pipe_credits(struct htc_target *target)
 
         cp_msg->message_id = cpu_to_be16(HTC_MSG_CONFIG_PIPE_ID);
         cp_msg->pipe_id = USB_WLAN_TX_PIPE;
-        cp_msg->credits = 28;
+        cp_msg->credits = target->credits;
 
         target->htc_flags |= HTC_OP_CONFIG_PIPE_CREDITS;
 
diff --git a/drivers/net/wireless/ath/ath9k/hw-ops.h b/drivers/net/wireless/ath/ath9k/hw-ops.h
index 624422a8169e..381da6c93b14 100644
--- a/drivers/net/wireless/ath/ath9k/hw-ops.h
+++ b/drivers/net/wireless/ath/ath9k/hw-ops.h
@@ -128,6 +128,17 @@ static inline void ath9k_hw_set11n_virtualmorefrag(struct ath_hw *ah, void *ds,
         ath9k_hw_ops(ah)->set11n_virtualmorefrag(ah, ds, vmf);
 }
 
+static inline void ath9k_hw_procmibevent(struct ath_hw *ah)
+{
+        ath9k_hw_ops(ah)->ani_proc_mib_event(ah);
+}
+
+static inline void ath9k_hw_ani_monitor(struct ath_hw *ah,
+                                        struct ath9k_channel *chan)
+{
+        ath9k_hw_ops(ah)->ani_monitor(ah, chan);
+}
+
 /* Private hardware call ops */
 
 /* PHY ops */
@@ -277,4 +288,9 @@ static inline bool ath9k_hw_iscal_supported(struct ath_hw *ah,
         return ath9k_hw_private_ops(ah)->iscal_supported(ah, calType);
 }
 
+static inline void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
+{
+        ath9k_hw_private_ops(ah)->ani_reset(ah, is_scanning);
+}
+
 #endif /* ATH9K_HW_OPS_H */
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index c33f17dbe6f1..1ed144038c36 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -23,11 +23,6 @@
 #include "rc.h"
 #include "ar9003_mac.h"
 
-#define ATH9K_CLOCK_RATE_CCK            22
-#define ATH9K_CLOCK_RATE_5GHZ_OFDM      40
-#define ATH9K_CLOCK_RATE_2GHZ_OFDM      44
-#define ATH9K_CLOCK_FAST_RATE_5GHZ_OFDM 44
-
 static bool ath9k_hw_set_reset_reg(struct ath_hw *ah, u32 type);
 
 MODULE_AUTHOR("Atheros Communications");
@@ -80,6 +75,15 @@ static void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
         ath9k_hw_private_ops(ah)->init_mode_gain_regs(ah);
 }
 
+static void ath9k_hw_ani_cache_ini_regs(struct ath_hw *ah)
+{
+        /* You will not have this callback if using the old ANI */
+        if (!ath9k_hw_private_ops(ah)->ani_cache_ini_regs)
+                return;
+
+        ath9k_hw_private_ops(ah)->ani_cache_ini_regs(ah);
+}
+
 /********************/
 /* Helper Functions */
 /********************/
@@ -371,13 +375,7 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         ah->config.ofdm_trig_high = 500;
         ah->config.cck_trig_high = 200;
         ah->config.cck_trig_low = 100;
-
-        /*
-         * For now ANI is disabled for AR9003, it is still
-         * being tested.
-         */
-        if (!AR_SREV_9300_20_OR_LATER(ah))
-                ah->config.enable_ani = 1;
+        ah->config.enable_ani = true;
 
         for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
                 ah->config.spurchans[i][0] = AR_NO_SPUR;
@@ -390,12 +388,7 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
                 ah->config.ht_enable = 0;
 
         ah->config.rx_intr_mitigation = true;
-
-        /*
-         * Tx IQ Calibration (ah->config.tx_iq_calibration) is only
-         * used by AR9003, but it is showing reliability issues.
-         * It will take a while to fix so this is currently disabled.
-         */
+        ah->config.pcieSerDesWrite = true;
 
         /*
          * We need this for PCI devices only (Cardbus, PCI, miniPCI)
@@ -433,7 +426,9 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
                 ah->ah_flags = AH_USE_EEPROM;
 
         ah->atim_window = 0;
-        ah->sta_id1_defaults = AR_STA_ID1_CRPT_MIC_ENABLE;
+        ah->sta_id1_defaults =
+                AR_STA_ID1_CRPT_MIC_ENABLE |
+                AR_STA_ID1_MCAST_KSRCH;
         ah->beacon_interval = 100;
         ah->enable_32kHz_clock = DONT_USE_32KHZ;
         ah->slottime = (u32) -1;
@@ -571,28 +566,19 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         ah->ani_function = ATH9K_ANI_ALL;
         if (AR_SREV_9280_10_OR_LATER(ah) && !AR_SREV_9300_20_OR_LATER(ah))
                 ah->ani_function &= ~ATH9K_ANI_NOISE_IMMUNITY_LEVEL;
+        if (!AR_SREV_9300_20_OR_LATER(ah))
+                ah->ani_function &= ~ATH9K_ANI_MRC_CCK;
 
         ath9k_hw_init_mode_regs(ah);
 
         /*
-         * Configire PCIE after Ini init. SERDES values now come from ini file
-         * This enables PCIe low power mode.
+         * Read back AR_WA into a permanent copy and set bits 14 and 17.
+         * We need to do this to avoid RMW of this register. We cannot
+         * read the reg when chip is asleep.
          */
-        if (AR_SREV_9300_20_OR_LATER(ah)) {
-                u32 regval;
-                unsigned int i;
-
-                /* Set Bits 16 and 17 in the AR_WA register. */
-                regval = REG_READ(ah, AR_WA);
-                regval |= 0x00030000;
-                REG_WRITE(ah, AR_WA, regval);
-
-                for (i = 0; i < ah->iniPcieSerdesLowPower.ia_rows; i++) {
-                        REG_WRITE(ah,
-                                  INI_RA(&ah->iniPcieSerdesLowPower, i, 0),
-                                  INI_RA(&ah->iniPcieSerdesLowPower, i, 1));
-                }
-        }
+        ah->WARegVal = REG_READ(ah, AR_WA);
+        ah->WARegVal |= (AR_WA_D3_L1_DISABLE |
+                         AR_WA_ASPM_TIMER_BASED_DISABLE);
 
         if (ah->is_pciexpress)
                 ath9k_hw_configpcipowersave(ah, 0, 0);
@@ -627,6 +613,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
                 ar9003_hw_set_nf_limits(ah);
 
         ath9k_init_nfcal_hist_buffer(ah);
+        ah->bb_watchdog_timeout_ms = 25;
 
         common->state = ATH_HW_INITIALIZED;
 
@@ -1012,6 +999,11 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
 
         ENABLE_REGWRITE_BUFFER(ah);
 
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                REG_WRITE(ah, AR_WA, ah->WARegVal);
+                udelay(10);
+        }
+
         REG_WRITE(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_EN |
                   AR_RTC_FORCE_WAKE_ON_INT);
 
@@ -1066,6 +1058,11 @@ static bool ath9k_hw_set_reset_power_on(struct ath_hw *ah)
 {
         ENABLE_REGWRITE_BUFFER(ah);
 
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                REG_WRITE(ah, AR_WA, ah->WARegVal);
+                udelay(10);
+        }
+
         REG_WRITE(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_EN |
                   AR_RTC_FORCE_WAKE_ON_INT);
 
@@ -1073,6 +1070,7 @@ static bool ath9k_hw_set_reset_power_on(struct ath_hw *ah)
                 REG_WRITE(ah, AR_RC, AR_RC_AHB);
 
         REG_WRITE(ah, AR_RTC_RESET, 0);
+        udelay(2);
 
         REGWRITE_BUFFER_FLUSH(ah);
         DISABLE_REGWRITE_BUFFER(ah);
@@ -1102,6 +1100,11 @@ static bool ath9k_hw_set_reset_power_on(struct ath_hw *ah)
 
 static bool ath9k_hw_set_reset_reg(struct ath_hw *ah, u32 type)
 {
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                REG_WRITE(ah, AR_WA, ah->WARegVal);
+                udelay(10);
+        }
+
         REG_WRITE(ah, AR_RTC_FORCE_WAKE,
                   AR_RTC_FORCE_WAKE_EN | AR_RTC_FORCE_WAKE_ON_INT);
 
@@ -1303,6 +1306,9 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (AR_SREV_9280_10_OR_LATER(ah))
                 REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL, AR_GPIO_JTAG_DISABLE);
 
+        if (!AR_SREV_9300_20_OR_LATER(ah))
+                ar9002_hw_enable_async_fifo(ah);
+
         r = ath9k_hw_process_ini(ah, chan);
         if (r)
                 return r;
@@ -1367,6 +1373,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 ath9k_hw_resettxqueue(ah, i);
 
         ath9k_hw_init_interrupt_masks(ah, ah->opmode);
+        ath9k_hw_ani_cache_ini_regs(ah);
         ath9k_hw_init_qos(ah);
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_RFSILENT)
@@ -1375,7 +1382,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         ath9k_hw_init_global_settings(ah);
 
         if (!AR_SREV_9300_20_OR_LATER(ah)) {
-                ar9002_hw_enable_async_fifo(ah);
+                ar9002_hw_update_async_fifo(ah);
                 ar9002_hw_enable_wep_aggregation(ah);
         }
 
@@ -1426,9 +1433,13 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                                 "Setting CFG 0x%x\n", REG_READ(ah, AR_CFG));
                 }
         } else {
-                /* Configure AR9271 target WLAN */
-                if (AR_SREV_9271(ah))
-                        REG_WRITE(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB);
+                if (common->bus_ops->ath_bus_type == ATH_USB) {
+                        /* Configure AR9271 target WLAN */
+                        if (AR_SREV_9271(ah))
+                                REG_WRITE(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB);
+                        else
+                                REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
+                }
 #ifdef __BIG_ENDIAN
                 else
                         REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
@@ -1441,6 +1452,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (AR_SREV_9300_20_OR_LATER(ah)) {
                 ath9k_hw_loadnf(ah, curchan);
                 ath9k_hw_start_nfcal(ah);
+                ar9003_hw_bb_watchdog_config(ah);
         }
 
         return 0;
@@ -1489,6 +1501,7 @@ EXPORT_SYMBOL(ath9k_hw_keyreset);
 bool ath9k_hw_keysetmac(struct ath_hw *ah, u16 entry, const u8 *mac)
 {
         u32 macHi, macLo;
+        u32 unicast_flag = AR_KEYTABLE_VALID;
 
         if (entry >= ah->caps.keycache_size) {
                 ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
@@ -1497,6 +1510,16 @@ bool ath9k_hw_keysetmac(struct ath_hw *ah, u16 entry, const u8 *mac)
         }
 
         if (mac != NULL) {
+                /*
+                 * AR_KEYTABLE_VALID indicates that the address is a unicast
+                 * address, which must match the transmitter address for
+                 * decrypting frames.
+                 * Not setting this bit allows the hardware to use the key
+                 * for multicast frame decryption.
+                 */
+                if (mac[0] & 0x01)
+                        unicast_flag = 0;
+
                 macHi = (mac[5] << 8) | mac[4];
                 macLo = (mac[3] << 24) |
                         (mac[2] << 16) |
@@ -1509,7 +1532,7 @@ bool ath9k_hw_keysetmac(struct ath_hw *ah, u16 entry, const u8 *mac)
                 macLo = macHi = 0;
         }
         REG_WRITE(ah, AR_KEYTABLE_MAC0(entry), macLo);
-        REG_WRITE(ah, AR_KEYTABLE_MAC1(entry), macHi | AR_KEYTABLE_VALID);
+        REG_WRITE(ah, AR_KEYTABLE_MAC1(entry), macHi | unicast_flag);
 
         return true;
 }
@@ -1751,6 +1774,11 @@ static void ath9k_set_power_sleep(struct ath_hw *ah, int setChip)
                         REG_CLR_BIT(ah, (AR_RTC_RESET),
                                     AR_RTC_RESET_EN);
         }
+
+        /* Clear Bit 14 of AR_WA after putting chip into Full Sleep mode. */
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                REG_WRITE(ah, AR_WA,
+                          ah->WARegVal & ~AR_WA_D3_L1_DISABLE);
 }
 
 /*
@@ -1777,6 +1805,10 @@ static void ath9k_set_power_network_sleep(struct ath_hw *ah, int setChip)
                                     AR_RTC_FORCE_WAKE_EN);
                 }
         }
+
+        /* Clear Bit 14 of AR_WA after putting chip into Net Sleep mode. */
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                REG_WRITE(ah, AR_WA, ah->WARegVal & ~AR_WA_D3_L1_DISABLE);
 }
 
 static bool ath9k_hw_set_power_awake(struct ath_hw *ah, int setChip)
@@ -1784,6 +1816,12 @@ static bool ath9k_hw_set_power_awake(struct ath_hw *ah, int setChip)
         u32 val;
         int i;
 
+        /* Set Bits 14 and 17 of AR_WA before powering on the chip. */
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                REG_WRITE(ah, AR_WA, ah->WARegVal);
+                udelay(10);
+        }
+
         if (setChip) {
                 if ((REG_READ(ah, AR_RTC_STATUS) &
                      AR_RTC_STATUS_M) == AR_RTC_STATUS_SHUTDOWN) {
@@ -2165,7 +2203,7 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->hw_caps |= ATH9K_HW_CAP_RFSILENT;
         }
 #endif
-        if (AR_SREV_9271(ah))
+        if (AR_SREV_9271(ah) || AR_SREV_9300_20_OR_LATER(ah))
                 pCap->hw_caps |= ATH9K_HW_CAP_AUTOSLEEP;
         else
                 pCap->hw_caps &= ~ATH9K_HW_CAP_AUTOSLEEP;
@@ -2220,6 +2258,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->rx_status_len = sizeof(struct ar9003_rxs);
                 pCap->tx_desc_len = sizeof(struct ar9003_txc);
                 pCap->txs_len = sizeof(struct ar9003_txs);
+                if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+                        pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
         } else {
                 pCap->tx_desc_len = sizeof(struct ath_desc);
                 if (AR_SREV_9280_20(ah) &&
@@ -2232,100 +2272,11 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         if (AR_SREV_9300_20_OR_LATER(ah))
                 pCap->hw_caps |= ATH9K_HW_CAP_RAC_SUPPORTED;
 
-        return 0;
-}
+        if (AR_SREV_9287_10_OR_LATER(ah) || AR_SREV_9271(ah))
+                pCap->hw_caps |= ATH9K_HW_CAP_SGI_20;
 
-bool ath9k_hw_getcapability(struct ath_hw *ah, enum ath9k_capability_type type,
-                            u32 capability, u32 *result)
-{
-        struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
-        switch (type) {
-        case ATH9K_CAP_CIPHER:
-                switch (capability) {
-                case ATH9K_CIPHER_AES_CCM:
-                case ATH9K_CIPHER_AES_OCB:
-                case ATH9K_CIPHER_TKIP:
-                case ATH9K_CIPHER_WEP:
-                case ATH9K_CIPHER_MIC:
-                case ATH9K_CIPHER_CLR:
-                        return true;
-                default:
-                        return false;
-                }
-        case ATH9K_CAP_TKIP_MIC:
-                switch (capability) {
-                case 0:
-                        return true;
-                case 1:
-                        return (ah->sta_id1_defaults &
-                                AR_STA_ID1_CRPT_MIC_ENABLE) ? true :
-                        false;
-                }
-        case ATH9K_CAP_TKIP_SPLIT:
-                return (ah->misc_mode & AR_PCU_MIC_NEW_LOC_ENA) ?
-                        false : true;
-        case ATH9K_CAP_MCAST_KEYSRCH:
-                switch (capability) {
-                case 0:
-                        return true;
-                case 1:
-                        if (REG_READ(ah, AR_STA_ID1) & AR_STA_ID1_ADHOC) {
-                                return false;
-                        } else {
-                                return (ah->sta_id1_defaults &
-                                        AR_STA_ID1_MCAST_KSRCH) ? true :
-                                        false;
-                        }
-                }
-                return false;
-        case ATH9K_CAP_TXPOW:
-                switch (capability) {
-                case 0:
-                        return 0;
-                case 1:
-                        *result = regulatory->power_limit;
-                        return 0;
-                case 2:
-                        *result = regulatory->max_power_level;
-                        return 0;
-                case 3:
-                        *result = regulatory->tp_scale;
-                        return 0;
-                }
-                return false;
-        case ATH9K_CAP_DS:
-                return (AR_SREV_9280_20_OR_LATER(ah) &&
-                        (ah->eep_ops->get_eeprom(ah, EEP_RC_CHAIN_MASK) == 1))
-                        ? false : true;
-        default:
-                return false;
-        }
-}
-EXPORT_SYMBOL(ath9k_hw_getcapability);
-
-bool ath9k_hw_setcapability(struct ath_hw *ah, enum ath9k_capability_type type,
-                            u32 capability, u32 setting, int *status)
-{
-        switch (type) {
-        case ATH9K_CAP_TKIP_MIC:
-                if (setting)
-                        ah->sta_id1_defaults |=
-                                AR_STA_ID1_CRPT_MIC_ENABLE;
-                else
-                        ah->sta_id1_defaults &=
-                                ~AR_STA_ID1_CRPT_MIC_ENABLE;
-                return true;
-        case ATH9K_CAP_MCAST_KEYSRCH:
-                if (setting)
-                        ah->sta_id1_defaults |= AR_STA_ID1_MCAST_KSRCH;
-                else
-                        ah->sta_id1_defaults &= ~AR_STA_ID1_MCAST_KSRCH;
-                return true;
-        default:
-                return false;
-        }
+        return 0;
 }
-EXPORT_SYMBOL(ath9k_hw_setcapability);
 
 /****************************/
 /* GPIO / RFKILL / Antennae */
@@ -2520,12 +2471,6 @@ void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit)
 }
 EXPORT_SYMBOL(ath9k_hw_set_txpowerlimit);
 
-void ath9k_hw_setmac(struct ath_hw *ah, const u8 *mac)
-{
-        memcpy(ath9k_hw_common(ah)->macaddr, mac, ETH_ALEN);
-}
-EXPORT_SYMBOL(ath9k_hw_setmac);
-
 void ath9k_hw_setopmode(struct ath_hw *ah)
 {
         ath9k_hw_set_operating_mode(ah, ah->opmode);
@@ -2598,21 +2543,6 @@ void ath9k_hw_set_tsfadjust(struct ath_hw *ah, u32 setting)
 }
 EXPORT_SYMBOL(ath9k_hw_set_tsfadjust);
 
-/*
- *  Extend 15-bit time stamp from rx descriptor to
- *  a full 64-bit TSF using the current h/w TSF.
-*/
-u64 ath9k_hw_extend_tsf(struct ath_hw *ah, u32 rstamp)
-{
-        u64 tsf;
-
-        tsf = ath9k_hw_gettsf64(ah);
-        if ((tsf & 0x7fff) < rstamp)
-                tsf -= 0x8000;
-        return (tsf & ~0x7fff) | rstamp;
-}
-EXPORT_SYMBOL(ath9k_hw_extend_tsf);
-
 void ath9k_hw_set11nmac2040(struct ath_hw *ah)
 {
         struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 77245dff5993..e9578a4c912f 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -158,6 +158,9 @@
 #define ATH9K_HW_RX_HP_QDEPTH   16
 #define ATH9K_HW_RX_LP_QDEPTH   128
 
+#define PAPRD_GAIN_TABLE_ENTRIES    32
+#define PAPRD_TABLE_SZ              24
+
 enum ath_ini_subsys {
         ATH_INI_PRE = 0,
         ATH_INI_CORE,
@@ -199,15 +202,8 @@ enum ath9k_hw_caps {
         ATH9K_HW_CAP_RAC_SUPPORTED              = BIT(18),
         ATH9K_HW_CAP_LDPC                       = BIT(19),
         ATH9K_HW_CAP_FASTCLOCK                  = BIT(20),
-};
-
-enum ath9k_capability_type {
-        ATH9K_CAP_CIPHER = 0,
-        ATH9K_CAP_TKIP_MIC,
-        ATH9K_CAP_TKIP_SPLIT,
-        ATH9K_CAP_TXPOW,
-        ATH9K_CAP_MCAST_KEYSRCH,
-        ATH9K_CAP_DS
+        ATH9K_HW_CAP_SGI_20                     = BIT(21),
+        ATH9K_HW_CAP_PAPRD                      = BIT(22),
 };
 
 struct ath9k_hw_capabilities {
@@ -237,8 +233,9 @@ struct ath9k_ops_config {
         int sw_beacon_response_time;
         int additional_swba_backoff;
         int ack_6mb;
-        int cwm_ignore_extcca;
+        u32 cwm_ignore_extcca;
         u8 pcie_powersave_enable;
+        bool pcieSerDesWrite;
         u8 pcie_clock_req;
         u32 pcie_waen;
         u8 analog_shiftreg;
@@ -262,10 +259,10 @@ struct ath9k_ops_config {
 #define AR_BASE_FREQ_5GHZ       4900
 #define AR_SPUR_FEEQ_BOUND_HT40 19
 #define AR_SPUR_FEEQ_BOUND_HT20 10
-        bool tx_iq_calibration; /* Only available for >= AR9003 */
         int spurmode;
         u16 spurchans[AR_EEPROM_MODAL_SPURS][2];
         u8 max_txtrig_level;
+        u16 ani_poll_interval; /* ANI poll interval in ms */
 };
 
 enum ath9k_int {
@@ -279,6 +276,7 @@ enum ath9k_int {
         ATH9K_INT_TX = 0x00000040,
         ATH9K_INT_TXDESC = 0x00000080,
         ATH9K_INT_TIM_TIMER = 0x00000100,
+        ATH9K_INT_BB_WATCHDOG = 0x00000400,
         ATH9K_INT_TXURN = 0x00000800,
         ATH9K_INT_MIB = 0x00001000,
         ATH9K_INT_RXPHY = 0x00004000,
@@ -358,6 +356,9 @@ struct ath9k_channel {
         int8_t iCoff;
         int8_t qCoff;
         int16_t rawNoiseFloor;
+        bool paprd_done;
+        u16 small_signal_gain[AR9300_MAX_CHAINS];
+        u32 pa_table[AR9300_MAX_CHAINS][PAPRD_TABLE_SZ];
 };
 
 #define IS_CHAN_G(_c) ((((_c)->channelFlags & (CHANNEL_G)) == CHANNEL_G) || \
@@ -459,7 +460,7 @@ struct ath9k_hw_version {
 #define AR_GENTMR_BIT(_index)   (1 << (_index))
 
 /*
- * Using de Bruijin sequence to to look up 1's index in a 32 bit number
+ * Using de Bruijin sequence to look up 1's index in a 32 bit number
  * debruijn32 = 0000 0111 0111 1100 1011 0101 0011 0001
  */
 #define debruijn32 0x077CB531U
@@ -510,6 +511,17 @@ struct ath_gen_timer_table {
  * @setup_calibration: set up calibration
  * @iscal_supported: used to query if a type of calibration is supported
  * @loadnf: load noise floor read from each chain on the CCA registers
+ *
+ * @ani_reset: reset ANI parameters to default values
+ * @ani_lower_immunity: lower the noise immunity level. The level controls
+ *      the power-based packet detection on hardware. If a power jump is
+ *      detected the adapter takes it as an indication that a packet has
+ *      arrived. The level ranges from 0-5. Each level corresponds to a
+ *      few dB more of noise immunity. If you have a strong time-varying
+ *      interference that is causing false detections (OFDM timing errors or
+ *      CCK timing errors) the level can be increased.
+ * @ani_cache_ini_regs: cache the values for ANI from the initial
+ *      register settings through the register initialization.
  */
 struct ath_hw_private_ops {
         /* Calibration ops */
@@ -553,6 +565,11 @@ struct ath_hw_private_ops {
                             int param);
         void (*do_getnf)(struct ath_hw *ah, int16_t nfarray[NUM_NF_READINGS]);
         void (*loadnf)(struct ath_hw *ah, struct ath9k_channel *chan);
+
+        /* ANI */
+        void (*ani_reset)(struct ath_hw *ah, bool is_scanning);
+        void (*ani_lower_immunity)(struct ath_hw *ah);
+        void (*ani_cache_ini_regs)(struct ath_hw *ah);
 };
 
 /**
@@ -563,6 +580,11 @@ struct ath_hw_private_ops {
  *
  * @config_pci_powersave:
  * @calibrate: periodic calibration for NF, ANI, IQ, ADC gain, ADC-DC
+ *
+ * @ani_proc_mib_event: process MIB events, this would happen upon specific ANI
+ *      thresholds being reached or having overflowed.
+ * @ani_monitor: called periodically by the core driver to collect
+ *      MIB stats and adjust ANI if specific thresholds have been reached.
  */
 struct ath_hw_ops {
         void (*config_pci_powersave)(struct ath_hw *ah,
@@ -603,6 +625,9 @@ struct ath_hw_ops {
                                      u32 burstDuration);
         void (*set11n_virtualmorefrag)(struct ath_hw *ah, void *ds,
                                        u32 vmf);
+
+        void (*ani_proc_mib_event)(struct ath_hw *ah);
+        void (*ani_monitor)(struct ath_hw *ah, struct ath9k_channel *chan);
 };
 
 struct ath_hw {
@@ -789,6 +814,18 @@ struct ath_hw {
         u32 ts_paddr_end;
         u16 ts_tail;
         u8 ts_size;
+
+        u32 bb_watchdog_last_status;
+        u32 bb_watchdog_timeout_ms; /* in ms, 0 to disable */
+
+        u32 paprd_gain_table_entries[PAPRD_GAIN_TABLE_ENTRIES];
+        u8 paprd_gain_table_index[PAPRD_GAIN_TABLE_ENTRIES];
+        /*
+         * Store the permanent value of Reg 0x4004in WARegVal
+         * so we dont have to R/M/W. We should not be reading
+         * this register when in sleep states.
+         */
+        u32 WARegVal;
 };
 
 static inline struct ath_common *ath9k_hw_common(struct ath_hw *ah)
@@ -818,10 +855,6 @@ int ath9k_hw_init(struct ath_hw *ah);
 int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                    bool bChannelChange);
 int ath9k_hw_fill_cap_info(struct ath_hw *ah);
-bool ath9k_hw_getcapability(struct ath_hw *ah, enum ath9k_capability_type type,
-                            u32 capability, u32 *result);
-bool ath9k_hw_setcapability(struct ath_hw *ah, enum ath9k_capability_type type,
-                            u32 capability, u32 setting, int *status);
 u32 ath9k_regd_get_ctl(struct ath_regulatory *reg, struct ath9k_channel *chan);
 
 /* Key Cache Management */
@@ -856,7 +889,6 @@ void ath9k_hw_setrxfilter(struct ath_hw *ah, u32 bits);
 bool ath9k_hw_phy_disable(struct ath_hw *ah);
 bool ath9k_hw_disable(struct ath_hw *ah);
 void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit);
-void ath9k_hw_setmac(struct ath_hw *ah, const u8 *mac);
 void ath9k_hw_setopmode(struct ath_hw *ah);
 void ath9k_hw_setmcastfilter(struct ath_hw *ah, u32 filter0, u32 filter1);
 void ath9k_hw_setbssidmask(struct ath_hw *ah);
@@ -865,7 +897,6 @@ u64 ath9k_hw_gettsf64(struct ath_hw *ah);
 void ath9k_hw_settsf64(struct ath_hw *ah, u64 tsf64);
 void ath9k_hw_reset_tsf(struct ath_hw *ah);
 void ath9k_hw_set_tsfadjust(struct ath_hw *ah, u32 setting);
-u64 ath9k_hw_extend_tsf(struct ath_hw *ah, u32 rstamp);
 void ath9k_hw_init_global_settings(struct ath_hw *ah);
 void ath9k_hw_set11nmac2040(struct ath_hw *ah);
 void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period);
@@ -907,13 +938,26 @@ void ath9k_hw_get_delta_slope_vals(struct ath_hw *ah, u32 coef_scaled,
 void ar9002_hw_cck_chan14_spread(struct ath_hw *ah);
 int ar9002_hw_rf_claim(struct ath_hw *ah);
 void ar9002_hw_enable_async_fifo(struct ath_hw *ah);
+void ar9002_hw_update_async_fifo(struct ath_hw *ah);
 void ar9002_hw_enable_wep_aggregation(struct ath_hw *ah);
 
 /*
- * Code specifric to AR9003, we stuff these here to avoid callbacks
+ * Code specific to AR9003, we stuff these here to avoid callbacks
  * for older families
  */
 void ar9003_hw_set_nf_limits(struct ath_hw *ah);
+void ar9003_hw_bb_watchdog_config(struct ath_hw *ah);
+void ar9003_hw_bb_watchdog_read(struct ath_hw *ah);
+void ar9003_hw_bb_watchdog_dbg_info(struct ath_hw *ah);
+void ar9003_paprd_enable(struct ath_hw *ah, bool val);
+void ar9003_paprd_populate_single_table(struct ath_hw *ah,
+                                        struct ath9k_channel *chan, int chain);
+int ar9003_paprd_create_curve(struct ath_hw *ah, struct ath9k_channel *chan,
+                              int chain);
+int ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain);
+int ar9003_paprd_init_table(struct ath_hw *ah);
+bool ar9003_paprd_is_done(struct ath_hw *ah);
+void ar9003_hw_set_paprd_txdesc(struct ath_hw *ah, void *ds, u8 chains);
 
 /* Hardware family op attach helpers */
 void ar5008_hw_attach_phy_ops(struct ath_hw *ah);
@@ -926,8 +970,24 @@ void ar9003_hw_attach_calib_ops(struct ath_hw *ah);
 void ar9002_hw_attach_ops(struct ath_hw *ah);
 void ar9003_hw_attach_ops(struct ath_hw *ah);
 
+/*
+ * ANI work can be shared between all families but a next
+ * generation implementation of ANI will be used only for AR9003 only
+ * for now as the other families still need to be tested with the same
+ * next generation ANI. Feel free to start testing it though for the
+ * older families (AR5008, AR9001, AR9002) by using modparam_force_new_ani.
+ */
+extern int modparam_force_new_ani;
+void ath9k_hw_attach_ani_ops_old(struct ath_hw *ah);
+void ath9k_hw_attach_ani_ops_new(struct ath_hw *ah);
+
 #define ATH_PCIE_CAP_LINK_CTRL  0x70
 #define ATH_PCIE_CAP_LINK_L0S   1
 #define ATH_PCIE_CAP_LINK_L1    2
 
+#define ATH9K_CLOCK_RATE_CCK            22
+#define ATH9K_CLOCK_RATE_5GHZ_OFDM      40
+#define ATH9K_CLOCK_RATE_2GHZ_OFDM      44
+#define ATH9K_CLOCK_FAST_RATE_5GHZ_OFDM 44
+
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index d457cb3bd772..8700e3dc53cf 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -33,6 +33,10 @@ int modparam_nohwcrypt;
 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
 
+int led_blink = 1;
+module_param_named(blink, led_blink, int, 0444);
+MODULE_PARM_DESC(blink, "Enable LED blink on activity");
+
 /* We use the hw_value as an index into our private channel structure */
 
 #define CHAN2G(_freq, _idx)  { \
@@ -175,18 +179,6 @@ static const struct ath_ops ath9k_common_ops = {
         .write = ath9k_iowrite32,
 };
 
-static int count_streams(unsigned int chainmask, int max)
-{
-        int streams = 0;
-
-        do {
-                if (++streams == max)
-                        break;
-        } while ((chainmask = chainmask & (chainmask - 1)));
-
-        return streams;
-}
-
 /**************************/
 /*     Initialization     */
 /**************************/
@@ -208,6 +200,9 @@ static void setup_ht_cap(struct ath_softc *sc,
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_LDPC)
                 ht_info->cap |= IEEE80211_HT_CAP_LDPC_CODING;
 
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_SGI_20)
+                ht_info->cap |= IEEE80211_HT_CAP_SGI_20;
+
         ht_info->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
         ht_info->ampdu_density = IEEE80211_HT_MPDU_DENSITY_8;
 
@@ -224,8 +219,8 @@ static void setup_ht_cap(struct ath_softc *sc,
 
         /* set up supported mcs set */
         memset(&ht_info->mcs, 0, sizeof(ht_info->mcs));
-        tx_streams = count_streams(common->tx_chainmask, max_streams);
-        rx_streams = count_streams(common->rx_chainmask, max_streams);
+        tx_streams = ath9k_cmn_count_streams(common->tx_chainmask, max_streams);
+        rx_streams = ath9k_cmn_count_streams(common->rx_chainmask, max_streams);
 
         ath_print(common, ATH_DBG_CONFIG,
                   "TX streams %d, RX streams: %d\n",
@@ -388,36 +383,14 @@ static void ath9k_init_crypto(struct ath_softc *sc)
         for (i = 0; i < common->keymax; i++)
                 ath9k_hw_keyreset(sc->sc_ah, (u16) i);
 
-        if (ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_CIPHER,
-                                   ATH9K_CIPHER_TKIP, NULL)) {
-                /*
-                 * Whether we should enable h/w TKIP MIC.
-                 * XXX: if we don't support WME TKIP MIC, then we wouldn't
-                 * report WMM capable, so it's always safe to turn on
-                 * TKIP MIC in this case.
-                 */
-                ath9k_hw_setcapability(sc->sc_ah, ATH9K_CAP_TKIP_MIC, 0, 1, NULL);
-        }
-
         /*
          * Check whether the separate key cache entries
          * are required to handle both tx+rx MIC keys.
          * With split mic keys the number of stations is limited
          * to 27 otherwise 59.
          */
-        if (ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_CIPHER,
-                                   ATH9K_CIPHER_TKIP, NULL)
-            && ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_CIPHER,
-                                      ATH9K_CIPHER_MIC, NULL)
-            && ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_TKIP_SPLIT,
-                                      0, NULL))
+        if (!(sc->sc_ah->misc_mode & AR_PCU_MIC_NEW_LOC_ENA))
                 common->splitmic = 1;
-
-        /* turn on mcast key search if possible */
-        if (!ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_MCAST_KEYSRCH, 0, NULL))
-                (void)ath9k_hw_setcapability(sc->sc_ah, ATH9K_CAP_MCAST_KEYSRCH,
-                                             1, 1, NULL);
-
 }
 
 static int ath9k_init_btcoex(struct ath_softc *sc)
@@ -435,7 +408,7 @@ static int ath9k_init_btcoex(struct ath_softc *sc)
                 r = ath_init_btcoex_timer(sc);
                 if (r)
                         return -1;
-                qnum = ath_tx_get_qnum(sc, ATH9K_TX_QUEUE_DATA, ATH9K_WME_AC_BE);
+                qnum = sc->tx.hwq_map[WME_AC_BE];
                 ath9k_hw_init_btcoex_hw(sc->sc_ah, qnum);
                 sc->btcoex.bt_stomp_type = ATH_BTCOEX_STOMP_LOW;
                 break;
@@ -472,23 +445,23 @@ static int ath9k_init_queues(struct ath_softc *sc)
         sc->config.cabqReadytime = ATH_CABQ_READY_TIME;
         ath_cabq_update(sc);
 
-        if (!ath_tx_setup(sc, ATH9K_WME_AC_BK)) {
+        if (!ath_tx_setup(sc, WME_AC_BK)) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to setup xmit queue for BK traffic\n");
                 goto err;
         }
 
-        if (!ath_tx_setup(sc, ATH9K_WME_AC_BE)) {
+        if (!ath_tx_setup(sc, WME_AC_BE)) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to setup xmit queue for BE traffic\n");
                 goto err;
         }
-        if (!ath_tx_setup(sc, ATH9K_WME_AC_VI)) {
+        if (!ath_tx_setup(sc, WME_AC_VI)) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to setup xmit queue for VI traffic\n");
                 goto err;
         }
-        if (!ath_tx_setup(sc, ATH9K_WME_AC_VO)) {
+        if (!ath_tx_setup(sc, WME_AC_VO)) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to setup xmit queue for VO traffic\n");
                 goto err;
@@ -745,6 +718,7 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
                         goto error_world;
         }
 
+        INIT_WORK(&sc->paprd_work, ath_paprd_calibrate);
         INIT_WORK(&sc->chan_work, ath9k_wiphy_chan_work);
         INIT_DELAYED_WORK(&sc->wiphy_work, ath9k_wiphy_work);
         sc->wiphy_scheduler_int = msecs_to_jiffies(500);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 0e425cb4bbb1..e955bb9d98cb 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -15,6 +15,7 @@
  */
 
 #include "hw.h"
+#include "hw-ops.h"
 
 static void ath9k_hw_set_txq_interrupts(struct ath_hw *ah,
                                         struct ath9k_tx_queue_info *qi)
@@ -554,8 +555,13 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
                 REGWRITE_BUFFER_FLUSH(ah);
                 DISABLE_REGWRITE_BUFFER(ah);
 
-                /* cwmin and cwmax should be 0 for beacon queue */
-                if (AR_SREV_9300_20_OR_LATER(ah)) {
+                /*
+                 * cwmin and cwmax should be 0 for beacon queue
+                 * but not for IBSS as we would create an imbalance
+                 * on beaconing fairness for participating nodes.
+                 */
+                if (AR_SREV_9300_20_OR_LATER(ah) &&
+                    ah->opmode != NL80211_IFTYPE_ADHOC) {
                         REG_WRITE(ah, AR_DLCL_IFS(q), SM(0, AR_D_LCL_IFS_CWMIN)
                                   | SM(0, AR_D_LCL_IFS_CWMAX)
                                   | SM(qi->tqi_aifs, AR_D_LCL_IFS_AIFS));
@@ -756,11 +762,11 @@ void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp)
 }
 EXPORT_SYMBOL(ath9k_hw_putrxbuf);
 
-void ath9k_hw_startpcureceive(struct ath_hw *ah)
+void ath9k_hw_startpcureceive(struct ath_hw *ah, bool is_scanning)
 {
         ath9k_enable_mib_counters(ah);
 
-        ath9k_ani_reset(ah);
+        ath9k_ani_reset(ah, is_scanning);
 
         REG_CLR_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
 }
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 00f3e0c7528a..7559fb2b28a5 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -577,13 +577,8 @@ enum ath9k_tx_queue {
 
 #define ATH9K_NUM_TX_QUEUES 10
 
-enum ath9k_tx_queue_subtype {
-        ATH9K_WME_AC_BK = 0,
-        ATH9K_WME_AC_BE,
-        ATH9K_WME_AC_VI,
-        ATH9K_WME_AC_VO,
-        ATH9K_WME_UPSD
-};
+/* Used as a queue subtype instead of a WMM AC */
+#define ATH9K_WME_UPSD  4
 
 enum ath9k_tx_queue_flags {
         TXQ_FLAG_TXOKINT_ENABLE = 0x0001,
@@ -617,7 +612,7 @@ enum ath9k_pkt_type {
 struct ath9k_tx_queue_info {
         u32 tqi_ver;
         enum ath9k_tx_queue tqi_type;
-        enum ath9k_tx_queue_subtype tqi_subtype;
+        int tqi_subtype;
         enum ath9k_tx_queue_flags tqi_qflags;
         u32 tqi_priority;
         u32 tqi_aifs;
@@ -715,7 +710,7 @@ void ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
                           u32 size, u32 flags);
 bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set);
 void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp);
-void ath9k_hw_startpcureceive(struct ath_hw *ah);
+void ath9k_hw_startpcureceive(struct ath_hw *ah, bool is_scanning);
 void ath9k_hw_stoppcurecv(struct ath_hw *ah);
 void ath9k_hw_abortpcurecv(struct ath_hw *ah);
 bool ath9k_hw_stopdmarecv(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 1e2a68ea9355..efbf53534ade 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -51,13 +51,11 @@ static void ath_cache_conf_rate(struct ath_softc *sc,
 static void ath_update_txpow(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
-        u32 txpow;
 
         if (sc->curtxpow != sc->config.txpowlimit) {
                 ath9k_hw_set_txpowerlimit(ah, sc->config.txpowlimit);
                 /* read back in case value is clamped */
-                ath9k_hw_getcapability(ah, ATH9K_CAP_TXPOW, 1, &txpow);
-                sc->curtxpow = txpow;
+                sc->curtxpow = ath9k_hw_regulatory(ah)->power_limit;
         }
 }
 
@@ -232,6 +230,114 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
         return r;
 }
 
+static void ath_paprd_activate(struct ath_softc *sc)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        int chain;
+
+        if (!ah->curchan->paprd_done)
+                return;
+
+        ath9k_ps_wakeup(sc);
+        for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
+                if (!(ah->caps.tx_chainmask & BIT(chain)))
+                        continue;
+
+                ar9003_paprd_populate_single_table(ah, ah->curchan, chain);
+        }
+
+        ar9003_paprd_enable(ah, true);
+        ath9k_ps_restore(sc);
+}
+
+void ath_paprd_calibrate(struct work_struct *work)
+{
+        struct ath_softc *sc = container_of(work, struct ath_softc, paprd_work);
+        struct ieee80211_hw *hw = sc->hw;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ieee80211_hdr *hdr;
+        struct sk_buff *skb = NULL;
+        struct ieee80211_tx_info *tx_info;
+        int band = hw->conf.channel->band;
+        struct ieee80211_supported_band *sband = &sc->sbands[band];
+        struct ath_tx_control txctl;
+        int qnum, ftype;
+        int chain_ok = 0;
+        int chain;
+        int len = 1800;
+        int time_left;
+        int i;
+
+        skb = alloc_skb(len, GFP_KERNEL);
+        if (!skb)
+                return;
+
+        tx_info = IEEE80211_SKB_CB(skb);
+
+        skb_put(skb, len);
+        memset(skb->data, 0, len);
+        hdr = (struct ieee80211_hdr *)skb->data;
+        ftype = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC;
+        hdr->frame_control = cpu_to_le16(ftype);
+        hdr->duration_id = 10;
+        memcpy(hdr->addr1, hw->wiphy->perm_addr, ETH_ALEN);
+        memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+        memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+
+        memset(&txctl, 0, sizeof(txctl));
+        qnum = sc->tx.hwq_map[WME_AC_BE];
+        txctl.txq = &sc->tx.txq[qnum];
+
+        ath9k_ps_wakeup(sc);
+        ar9003_paprd_init_table(ah);
+        for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
+                if (!(ah->caps.tx_chainmask & BIT(chain)))
+                        continue;
+
+                chain_ok = 0;
+                memset(tx_info, 0, sizeof(*tx_info));
+                tx_info->band = band;
+
+                for (i = 0; i < 4; i++) {
+                        tx_info->control.rates[i].idx = sband->n_bitrates - 1;
+                        tx_info->control.rates[i].count = 6;
+                }
+
+                init_completion(&sc->paprd_complete);
+                ar9003_paprd_setup_gain_table(ah, chain);
+                txctl.paprd = BIT(chain);
+                if (ath_tx_start(hw, skb, &txctl) != 0)
+                        break;
+
+                time_left = wait_for_completion_timeout(&sc->paprd_complete,
+                                msecs_to_jiffies(ATH_PAPRD_TIMEOUT));
+                if (!time_left) {
+                        ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
+                                  "Timeout waiting for paprd training on "
+                                  "TX chain %d\n",
+                                  chain);
+                        goto fail_paprd;
+                }
+
+                if (!ar9003_paprd_is_done(ah))
+                        break;
+
+                if (ar9003_paprd_create_curve(ah, ah->curchan, chain) != 0)
+                        break;
+
+                chain_ok = 1;
+        }
+        kfree_skb(skb);
+
+        if (chain_ok) {
+                ah->curchan->paprd_done = true;
+                ath_paprd_activate(sc);
+        }
+
+fail_paprd:
+        ath9k_ps_restore(sc);
+}
+
 /*
  *  This routine performs the periodic noise floor calibration function
  *  that is used to adjust and optimize the chip performance.  This
@@ -285,7 +391,8 @@ void ath_ani_calibrate(unsigned long data)
         }
 
         /* Verify whether we must check ANI */
-        if ((timestamp - common->ani.checkani_timer) >= ATH_ANI_POLLINTERVAL) {
+        if ((timestamp - common->ani.checkani_timer) >=
+             ah->config.ani_poll_interval) {
                 aniflag = true;
                 common->ani.checkani_timer = timestamp;
         }
@@ -326,15 +433,24 @@ set_timer:
         */
         cal_interval = ATH_LONG_CALINTERVAL;
         if (sc->sc_ah->config.enable_ani)
-                cal_interval = min(cal_interval, (u32)ATH_ANI_POLLINTERVAL);
+                cal_interval = min(cal_interval,
+                                   (u32)ah->config.ani_poll_interval);
         if (!common->ani.caldone)
                 cal_interval = min(cal_interval, (u32)short_cal_interval);
 
         mod_timer(&common->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
+        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_PAPRD) &&
+            !(sc->sc_flags & SC_OP_SCANNING)) {
+                if (!sc->sc_ah->curchan->paprd_done)
+                        ieee80211_queue_work(sc->hw, &sc->paprd_work);
+                else
+                        ath_paprd_activate(sc);
+        }
 }
 
 static void ath_start_ani(struct ath_common *common)
 {
+        struct ath_hw *ah = common->ah;
         unsigned long timestamp = jiffies_to_msecs(jiffies);
         struct ath_softc *sc = (struct ath_softc *) common->priv;
 
@@ -346,7 +462,8 @@ static void ath_start_ani(struct ath_common *common)
         common->ani.checkani_timer = timestamp;
 
         mod_timer(&common->ani.timer,
-                  jiffies + msecs_to_jiffies(ATH_ANI_POLLINTERVAL));
+                  jiffies +
+                        msecs_to_jiffies((u32)ah->config.ani_poll_interval));
 }
 
 /*
@@ -524,6 +641,12 @@ irqreturn_t ath_isr(int irq, void *dev)
             !(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)))
                 goto chip_reset;
 
+        if ((ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
+            (status & ATH9K_INT_BB_WATCHDOG)) {
+                ar9003_hw_bb_watchdog_dbg_info(ah);
+                goto chip_reset;
+        }
+
         if (status & ATH9K_INT_SWBA)
                 tasklet_schedule(&sc->bcon_tasklet);
 
@@ -619,234 +742,6 @@ static u32 ath_get_extchanmode(struct ath_softc *sc,
         return chanmode;
 }
 
-static int ath_setkey_tkip(struct ath_common *common, u16 keyix, const u8 *key,
-                           struct ath9k_keyval *hk, const u8 *addr,
-                           bool authenticator)
-{
-        struct ath_hw *ah = common->ah;
-        const u8 *key_rxmic;
-        const u8 *key_txmic;
-
-        key_txmic = key + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
-        key_rxmic = key + NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
-
-        if (addr == NULL) {
-                /*
-                 * Group key installation - only two key cache entries are used
-                 * regardless of splitmic capability since group key is only
-                 * used either for TX or RX.
-                 */
-                if (authenticator) {
-                        memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
-                        memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_mic));
-                } else {
-                        memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
-                        memcpy(hk->kv_txmic, key_rxmic, sizeof(hk->kv_mic));
-                }
-                return ath9k_hw_set_keycache_entry(ah, keyix, hk, addr);
-        }
-        if (!common->splitmic) {
-                /* TX and RX keys share the same key cache entry. */
-                memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
-                memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_txmic));
-                return ath9k_hw_set_keycache_entry(ah, keyix, hk, addr);
-        }
-
-        /* Separate key cache entries for TX and RX */
-
-        /* TX key goes at first index, RX key at +32. */
-        memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
-        if (!ath9k_hw_set_keycache_entry(ah, keyix, hk, NULL)) {
-                /* TX MIC entry failed. No need to proceed further */
-                ath_print(common, ATH_DBG_FATAL,
-                          "Setting TX MIC Key Failed\n");
-                return 0;
-        }
-
-        memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
-        /* XXX delete tx key on failure? */
-        return ath9k_hw_set_keycache_entry(ah, keyix + 32, hk, addr);
-}
-
-static int ath_reserve_key_cache_slot_tkip(struct ath_common *common)
-{
-        int i;
-
-        for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
-                if (test_bit(i, common->keymap) ||
-                    test_bit(i + 64, common->keymap))
-                        continue; /* At least one part of TKIP key allocated */
-                if (common->splitmic &&
-                    (test_bit(i + 32, common->keymap) ||
-                     test_bit(i + 64 + 32, common->keymap)))
-                        continue; /* At least one part of TKIP key allocated */
-
-                /* Found a free slot for a TKIP key */
-                return i;
-        }
-        return -1;
-}
-
-static int ath_reserve_key_cache_slot(struct ath_common *common)
-{
-        int i;
-
-        /* First, try to find slots that would not be available for TKIP. */
-        if (common->splitmic) {
-                for (i = IEEE80211_WEP_NKID; i < common->keymax / 4; i++) {
-                        if (!test_bit(i, common->keymap) &&
-                            (test_bit(i + 32, common->keymap) ||
-                             test_bit(i + 64, common->keymap) ||
-                             test_bit(i + 64 + 32, common->keymap)))
-                                return i;
-                        if (!test_bit(i + 32, common->keymap) &&
-                            (test_bit(i, common->keymap) ||
-                             test_bit(i + 64, common->keymap) ||
-                             test_bit(i + 64 + 32, common->keymap)))
-                                return i + 32;
-                        if (!test_bit(i + 64, common->keymap) &&
-                            (test_bit(i , common->keymap) ||
-                             test_bit(i + 32, common->keymap) ||
-                             test_bit(i + 64 + 32, common->keymap)))
-                                return i + 64;
-                        if (!test_bit(i + 64 + 32, common->keymap) &&
-                            (test_bit(i, common->keymap) ||
-                             test_bit(i + 32, common->keymap) ||
-                             test_bit(i + 64, common->keymap)))
-                                return i + 64 + 32;
-                }
-        } else {
-                for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
-                        if (!test_bit(i, common->keymap) &&
-                            test_bit(i + 64, common->keymap))
-                                return i;
-                        if (test_bit(i, common->keymap) &&
-                            !test_bit(i + 64, common->keymap))
-                                return i + 64;
-                }
-        }
-
-        /* No partially used TKIP slots, pick any available slot */
-        for (i = IEEE80211_WEP_NKID; i < common->keymax; i++) {
-                /* Do not allow slots that could be needed for TKIP group keys
-                 * to be used. This limitation could be removed if we know that
-                 * TKIP will not be used. */
-                if (i >= 64 && i < 64 + IEEE80211_WEP_NKID)
-                        continue;
-                if (common->splitmic) {
-                        if (i >= 32 && i < 32 + IEEE80211_WEP_NKID)
-                                continue;
-                        if (i >= 64 + 32 && i < 64 + 32 + IEEE80211_WEP_NKID)
-                                continue;
-                }
-
-                if (!test_bit(i, common->keymap))
-                        return i; /* Found a free slot for a key */
-        }
-
-        /* No free slot found */
-        return -1;
-}
-
-static int ath_key_config(struct ath_common *common,
-                          struct ieee80211_vif *vif,
-                          struct ieee80211_sta *sta,
-                          struct ieee80211_key_conf *key)
-{
-        struct ath_hw *ah = common->ah;
-        struct ath9k_keyval hk;
-        const u8 *mac = NULL;
-        int ret = 0;
-        int idx;
-
-        memset(&hk, 0, sizeof(hk));
-
-        switch (key->alg) {
-        case ALG_WEP:
-                hk.kv_type = ATH9K_CIPHER_WEP;
-                break;
-        case ALG_TKIP:
-                hk.kv_type = ATH9K_CIPHER_TKIP;
-                break;
-        case ALG_CCMP:
-                hk.kv_type = ATH9K_CIPHER_AES_CCM;
-                break;
-        default:
-                return -EOPNOTSUPP;
-        }
-
-        hk.kv_len = key->keylen;
-        memcpy(hk.kv_val, key->key, key->keylen);
-
-        if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
-                /* For now, use the default keys for broadcast keys. This may
-                 * need to change with virtual interfaces. */
-                idx = key->keyidx;
-        } else if (key->keyidx) {
-                if (WARN_ON(!sta))
-                        return -EOPNOTSUPP;
-                mac = sta->addr;
-
-                if (vif->type != NL80211_IFTYPE_AP) {
-                        /* Only keyidx 0 should be used with unicast key, but
-                         * allow this for client mode for now. */
-                        idx = key->keyidx;
-                } else
-                        return -EIO;
-        } else {
-                if (WARN_ON(!sta))
-                        return -EOPNOTSUPP;
-                mac = sta->addr;
-
-                if (key->alg == ALG_TKIP)
-                        idx = ath_reserve_key_cache_slot_tkip(common);
-                else
-                        idx = ath_reserve_key_cache_slot(common);
-                if (idx < 0)
-                        return -ENOSPC; /* no free key cache entries */
-        }
-
-        if (key->alg == ALG_TKIP)
-                ret = ath_setkey_tkip(common, idx, key->key, &hk, mac,
-                                      vif->type == NL80211_IFTYPE_AP);
-        else
-                ret = ath9k_hw_set_keycache_entry(ah, idx, &hk, mac);
-
-        if (!ret)
-                return -EIO;
-
-        set_bit(idx, common->keymap);
-        if (key->alg == ALG_TKIP) {
-                set_bit(idx + 64, common->keymap);
-                if (common->splitmic) {
-                        set_bit(idx + 32, common->keymap);
-                        set_bit(idx + 64 + 32, common->keymap);
-                }
-        }
-
-        return idx;
-}
-
-static void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key)
-{
-        struct ath_hw *ah = common->ah;
-
-        ath9k_hw_keyreset(ah, key->hw_key_idx);
-        if (key->hw_key_idx < IEEE80211_WEP_NKID)
-                return;
-
-        clear_bit(key->hw_key_idx, common->keymap);
-        if (key->alg != ALG_TKIP)
-                return;
-
-        clear_bit(key->hw_key_idx + 64, common->keymap);
-        if (common->splitmic) {
-                ath9k_hw_keyreset(ah, key->hw_key_idx + 32);
-                clear_bit(key->hw_key_idx + 32, common->keymap);
-                clear_bit(key->hw_key_idx + 64 + 32, common->keymap);
-        }
-}
-
 static void ath9k_bss_assoc_info(struct ath_softc *sc,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_bss_conf *bss_conf)
@@ -1032,25 +927,25 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
         return r;
 }
 
-int ath_get_hal_qnum(u16 queue, struct ath_softc *sc)
+static int ath_get_hal_qnum(u16 queue, struct ath_softc *sc)
 {
         int qnum;
 
         switch (queue) {
         case 0:
-                qnum = sc->tx.hwq_map[ATH9K_WME_AC_VO];
+                qnum = sc->tx.hwq_map[WME_AC_VO];
                 break;
         case 1:
-                qnum = sc->tx.hwq_map[ATH9K_WME_AC_VI];
+                qnum = sc->tx.hwq_map[WME_AC_VI];
                 break;
         case 2:
-                qnum = sc->tx.hwq_map[ATH9K_WME_AC_BE];
+                qnum = sc->tx.hwq_map[WME_AC_BE];
                 break;
         case 3:
-                qnum = sc->tx.hwq_map[ATH9K_WME_AC_BK];
+                qnum = sc->tx.hwq_map[WME_AC_BK];
                 break;
         default:
-                qnum = sc->tx.hwq_map[ATH9K_WME_AC_BE];
+                qnum = sc->tx.hwq_map[WME_AC_BE];
                 break;
         }
 
@@ -1062,16 +957,16 @@ int ath_get_mac80211_qnum(u32 queue, struct ath_softc *sc)
         int qnum;
 
         switch (queue) {
-        case ATH9K_WME_AC_VO:
+        case WME_AC_VO:
                 qnum = 0;
                 break;
-        case ATH9K_WME_AC_VI:
+        case WME_AC_VI:
                 qnum = 1;
                 break;
-        case ATH9K_WME_AC_BE:
+        case WME_AC_BE:
                 qnum = 2;
                 break;
-        case ATH9K_WME_AC_BK:
+        case WME_AC_BK:
                 qnum = 3;
                 break;
         default:
@@ -1201,7 +1096,9 @@ static int ath9k_start(struct ieee80211_hw *hw)
                     ATH9K_INT_GLOBAL;
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
-                ah->imask |= ATH9K_INT_RXHP | ATH9K_INT_RXLP;
+                ah->imask |= ATH9K_INT_RXHP |
+                             ATH9K_INT_RXLP |
+                             ATH9K_INT_BB_WATCHDOG;
         else
                 ah->imask |= ATH9K_INT_RX;
 
@@ -1251,6 +1148,7 @@ static int ath9k_tx(struct ieee80211_hw *hw,
         struct ath_tx_control txctl;
         int padpos, padsize;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        int qnum;
 
         if (aphy->state != ATH_WIPHY_ACTIVE && aphy->state != ATH_WIPHY_SCAN) {
                 ath_print(common, ATH_DBG_XMIT,
@@ -1280,7 +1178,8 @@ static int ath9k_tx(struct ieee80211_hw *hw,
                  * completed and if needed, also for RX of buffered frames.
                  */
                 ath9k_ps_wakeup(sc);
-                ath9k_hw_setrxabort(sc->sc_ah, 0);
+                if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
+                        ath9k_hw_setrxabort(sc->sc_ah, 0);
                 if (ieee80211_is_pspoll(hdr->frame_control)) {
                         ath_print(common, ATH_DBG_PS,
                                   "Sending PS-Poll to pick a buffered frame\n");
@@ -1322,11 +1221,8 @@ static int ath9k_tx(struct ieee80211_hw *hw,
                 memmove(skb->data, skb->data + padsize, padpos);
         }
 
-        /* Check if a tx queue is available */
-
-        txctl.txq = ath_test_get_txq(sc, skb);
-        if (!txctl.txq)
-                goto exit;
+        qnum = ath_get_hal_qnum(skb_get_queue_mapping(skb), sc);
+        txctl.txq = &sc->tx.txq[qnum];
 
         ath_print(common, ATH_DBG_XMIT, "transmitting packet, skb: %p\n", skb);
 
@@ -1352,8 +1248,11 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         aphy->state = ATH_WIPHY_INACTIVE;
 
-        cancel_delayed_work_sync(&sc->ath_led_blink_work);
+        if (led_blink)
+                cancel_delayed_work_sync(&sc->ath_led_blink_work);
+
         cancel_delayed_work_sync(&sc->tx_complete_work);
+        cancel_work_sync(&sc->paprd_work);
 
         if (!sc->num_sec_wiphy) {
                 cancel_delayed_work_sync(&sc->wiphy_work);
@@ -1547,8 +1446,8 @@ void ath9k_enable_ps(struct ath_softc *sc)
                         ah->imask |= ATH9K_INT_TIM_TIMER;
                         ath9k_hw_set_interrupts(ah, ah->imask);
                 }
+                ath9k_hw_setrxabort(ah, 1);
         }
-        ath9k_hw_setrxabort(ah, 1);
 }
 
 static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
@@ -1785,7 +1684,7 @@ static int ath9k_conf_tx(struct ieee80211_hw *hw, u16 queue,
                 ath_print(common, ATH_DBG_FATAL, "TXQ Update failed\n");
 
         if (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC)
-                if ((qnum == sc->tx.hwq_map[ATH9K_WME_AC_BE]) && !ret)
+                if ((qnum == sc->tx.hwq_map[WME_AC_BE]) && !ret)
                         ath_beaconq_config(sc);
 
         mutex_unlock(&sc->mutex);
@@ -1813,7 +1712,7 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
 
         switch (cmd) {
         case SET_KEY:
-                ret = ath_key_config(common, vif, sta, key);
+                ret = ath9k_cmn_key_config(common, vif, sta, key);
                 if (ret >= 0) {
                         key->hw_key_idx = ret;
                         /* push IV and Michael MIC generation to stack */
@@ -1826,7 +1725,7 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
                 }
                 break;
         case DISABLE_KEY:
-                ath_key_delete(common, key);
+                ath9k_cmn_key_delete(common, key);
                 break;
         default:
                 ret = -EINVAL;
@@ -1999,6 +1898,8 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
         struct ath_softc *sc = aphy->sc;
         int ret = 0;
 
+        local_bh_disable();
+
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
                 if (!(sc->sc_flags & SC_OP_RXAGGR))
@@ -2028,6 +1929,8 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
                           "Unknown AMPDU action\n");
         }
 
+        local_bh_enable();
+
         return ret;
 }
 
@@ -2072,6 +1975,7 @@ static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
         ath9k_wiphy_pause_all_forced(sc, aphy);
         sc->sc_flags |= SC_OP_SCANNING;
         del_timer_sync(&common->ani.timer);
+        cancel_work_sync(&sc->paprd_work);
         cancel_delayed_work_sync(&sc->tx_complete_work);
         mutex_unlock(&sc->mutex);
 }
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 1ec836cf1c0d..257b10ba6f57 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -28,6 +28,7 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
         { PCI_VDEVICE(ATHEROS, 0x002C) }, /* PCI-E 802.11n bonded out */
         { PCI_VDEVICE(ATHEROS, 0x002D) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x002E) }, /* PCI-E */
+        { PCI_VDEVICE(ATHEROS, 0x0030) }, /* PCI-E  AR9300 */
         { 0 }
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 8519452c95f1..600ee0ba2880 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -20,7 +20,7 @@
 #include "ath9k.h"
 
 static const struct ath_rate_table ar5416_11na_ratetable = {
-        42,
+        43,
         8, /* MCS start */
         {
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 6000, /* 6 Mb */
@@ -40,73 +40,75 @@ static const struct ath_rate_table ar5416_11na_ratetable = {
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 54000, /* 54 Mb */
                         29300, 7, 108, 4, 7, 7, 7, 7 },
                 { VALID_2040, VALID_2040, WLAN_RC_PHY_HT_20_SS, 6500, /* 6.5 Mb */
-                        6400, 0, 0, 0, 8, 24, 8, 24 },
+                        6400, 0, 0, 0, 8, 25, 8, 25 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 13000, /* 13 Mb */
-                        12700, 1, 1, 2, 9, 25, 9, 25 },
+                        12700, 1, 1, 2, 9, 26, 9, 26 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 19500, /* 19.5 Mb */
-                        18800, 2, 2, 2, 10, 26, 10, 26 },
+                        18800, 2, 2, 2, 10, 27, 10, 27 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 26000, /* 26 Mb */
-                        25000, 3, 3, 4, 11, 27, 11, 27 },
+                        25000, 3, 3, 4, 11, 28, 11, 28 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 39000, /* 39 Mb */
-                        36700, 4, 4, 4, 12, 28, 12, 28 },
+                        36700, 4, 4, 4, 12, 29, 12, 29 },
                 { INVALID, VALID_20, WLAN_RC_PHY_HT_20_SS, 52000, /* 52 Mb */
-                        48100, 5, 5, 4, 13, 29, 13, 29 },
+                        48100, 5, 5, 4, 13, 30, 13, 30 },
                 { INVALID, VALID_20, WLAN_RC_PHY_HT_20_SS, 58500, /* 58.5 Mb */
-                        53500, 6, 6, 4, 14, 30, 14, 30 },
+                        53500, 6, 6, 4, 14, 31, 14, 31 },
                 { INVALID, VALID_20, WLAN_RC_PHY_HT_20_SS, 65000, /* 65 Mb */
-                        59000, 7, 7, 4, 15, 31, 15, 32 },
+                        59000, 7, 7, 4, 15, 32, 15, 33 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_DS, 13000, /* 13 Mb */
-                        12700, 8, 8, 3, 16, 33, 16, 33 },
+                        12700, 8, 8, 3, 16, 34, 16, 34 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_DS, 26000, /* 26 Mb */
-                        24800, 9, 9, 2, 17, 34, 17, 34 },
+                        24800, 9, 9, 2, 17, 35, 17, 35 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_DS, 39000, /* 39 Mb */
-                        36600, 10, 10, 2, 18, 35, 18, 35 },
+                        36600, 10, 10, 2, 18, 36, 18, 36 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 52000, /* 52 Mb */
-                        48100, 11, 11, 4, 19, 36, 19, 36 },
+                        48100, 11, 11, 4, 19, 37, 19, 37 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 78000, /* 78 Mb */
-                        69500, 12, 12, 4, 20, 37, 20, 37 },
+                        69500, 12, 12, 4, 20, 38, 20, 38 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 104000, /* 104 Mb */
-                        89500, 13, 13, 4, 21, 38, 21, 38 },
+                        89500, 13, 13, 4, 21, 39, 21, 39 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 117000, /* 117 Mb */
-                        98900, 14, 14, 4, 22, 39, 22, 39 },
+                        98900, 14, 14, 4, 22, 40, 22, 40 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 130000, /* 130 Mb */
-                        108300, 15, 15, 4, 23, 40, 23, 41 },
+                        108300, 15, 15, 4, 23, 41, 24, 42 },
+                { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS_HGI, 144400, /* 144.4 Mb */
+                        12000, 15, 15, 4, 23, 41, 24, 42 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 13500, /* 13.5 Mb */
-                        13200, 0, 0, 0, 8, 24, 24, 24 },
+                        13200, 0, 0, 0, 8, 25, 25, 25 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 27500, /* 27.0 Mb */
-                        25900, 1, 1, 2, 9, 25, 25, 25 },
+                        25900, 1, 1, 2, 9, 26, 26, 26 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 40500, /* 40.5 Mb */
-                        38600, 2, 2, 2, 10, 26, 26, 26 },
+                        38600, 2, 2, 2, 10, 27, 27, 27 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 54000, /* 54 Mb */
-                        49800, 3, 3, 4, 11, 27, 27, 27 },
+                        49800, 3, 3, 4, 11, 28, 28, 28 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 81500, /* 81 Mb */
-                        72200, 4, 4, 4, 12, 28, 28, 28 },
+                        72200, 4, 4, 4, 12, 29, 29, 29 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS, 108000, /* 108 Mb */
-                        92900, 5, 5, 4, 13, 29, 29, 29 },
+                        92900, 5, 5, 4, 13, 30, 30, 30 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS, 121500, /* 121.5 Mb */
-                        102700, 6, 6, 4, 14, 30, 30, 30 },
+                        102700, 6, 6, 4, 14, 31, 31, 31 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS, 135000, /* 135 Mb */
-                        112000, 7, 7, 4, 15, 31, 32, 32 },
+                        112000, 7, 7, 4, 15, 32, 33, 33 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS_HGI, 150000, /* 150 Mb */
-                        122000, 7, 7, 4, 15, 31, 32, 32 },
+                        122000, 7, 7, 4, 15, 32, 33, 33 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_40_DS, 27000, /* 27 Mb */
-                        25800, 8, 8, 0, 16, 33, 33, 33 },
+                        25800, 8, 8, 0, 16, 34, 34, 34 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_40_DS, 54000, /* 54 Mb */
-                        49800, 9, 9, 2, 17, 34, 34, 34 },
+                        49800, 9, 9, 2, 17, 35, 35, 35 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_40_DS, 81000, /* 81 Mb */
-                        71900, 10, 10, 2, 18, 35, 35, 35 },
+                        71900, 10, 10, 2, 18, 36, 36, 36 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 108000, /* 108 Mb */
-                        92500, 11, 11, 4, 19, 36, 36, 36 },
+                        92500, 11, 11, 4, 19, 37, 37, 37 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 162000, /* 162 Mb */
-                        130300, 12, 12, 4, 20, 37, 37, 37 },
+                        130300, 12, 12, 4, 20, 38, 38, 38 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 216000, /* 216 Mb */
-                        162800, 13, 13, 4, 21, 38, 38, 38 },
+                        162800, 13, 13, 4, 21, 39, 39, 39 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 243000, /* 243 Mb */
-                        178200, 14, 14, 4, 22, 39, 39, 39 },
+                        178200, 14, 14, 4, 22, 40, 40, 40 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 270000, /* 270 Mb */
-                        192100, 15, 15, 4, 23, 40, 41, 41 },
+                        192100, 15, 15, 4, 23, 41, 42, 42 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS_HGI, 300000, /* 300 Mb */
-                        207000, 15, 15, 4, 23, 40, 41, 41 },
+                        207000, 15, 15, 4, 23, 41, 42, 42 },
         },
         50,  /* probe interval */
         WLAN_RC_HT_FLAG,  /* Phy rates allowed initially */
@@ -116,7 +118,7 @@ static const struct ath_rate_table ar5416_11na_ratetable = {
  * for HT are the 64K max aggregate limit */
 
 static const struct ath_rate_table ar5416_11ng_ratetable = {
-        46,
+        47,
         12, /* MCS start */
         {
                 { VALID_ALL, VALID_ALL, WLAN_RC_PHY_CCK, 1000, /* 1 Mb */
@@ -144,73 +146,75 @@ static const struct ath_rate_table ar5416_11ng_ratetable = {
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 54000, /* 54 Mb */
                         30900, 11, 108, 8, 11, 11, 11, 11 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_SS, 6500, /* 6.5 Mb */
-                        6400, 0, 0, 4, 12, 28, 12, 28 },
+                        6400, 0, 0, 4, 12, 29, 12, 29 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 13000, /* 13 Mb */
-                        12700, 1, 1, 6, 13, 29, 13, 29 },
+                        12700, 1, 1, 6, 13, 30, 13, 30 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 19500, /* 19.5 Mb */
-                        18800, 2, 2, 6, 14, 30, 14, 30 },
+                        18800, 2, 2, 6, 14, 31, 14, 31 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 26000, /* 26 Mb */
-                        25000, 3, 3, 8, 15, 31, 15, 31 },
+                        25000, 3, 3, 8, 15, 32, 15, 32 },
                 { VALID_20, VALID_20, WLAN_RC_PHY_HT_20_SS, 39000, /* 39 Mb */
-                        36700, 4, 4, 8, 16, 32, 16, 32 },
+                        36700, 4, 4, 8, 16, 33, 16, 33 },
                 { INVALID, VALID_20, WLAN_RC_PHY_HT_20_SS, 52000, /* 52 Mb */
-                        48100, 5, 5, 8, 17, 33, 17, 33 },
+                        48100, 5, 5, 8, 17, 34, 17, 34 },
                 { INVALID,  VALID_20, WLAN_RC_PHY_HT_20_SS, 58500, /* 58.5 Mb */
-                        53500, 6, 6, 8, 18, 34, 18, 34 },
+                        53500, 6, 6, 8, 18, 35, 18, 35 },
                 { INVALID, VALID_20, WLAN_RC_PHY_HT_20_SS, 65000, /* 65 Mb */
-                        59000, 7, 7, 8, 19, 35, 19, 36 },
+                        59000, 7, 7, 8, 19, 36, 19, 37 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_DS, 13000, /* 13 Mb */
-                        12700, 8, 8, 4, 20, 37, 20, 37 },
+                        12700, 8, 8, 4, 20, 38, 20, 38 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_DS, 26000, /* 26 Mb */
-                        24800, 9, 9, 6, 21, 38, 21, 38 },
+                        24800, 9, 9, 6, 21, 39, 21, 39 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_20_DS, 39000, /* 39 Mb */
-                        36600, 10, 10, 6, 22, 39, 22, 39 },
+                        36600, 10, 10, 6, 22, 40, 22, 40 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 52000, /* 52 Mb */
-                        48100, 11, 11, 8, 23, 40, 23, 40 },
+                        48100, 11, 11, 8, 23, 41, 23, 41 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 78000, /* 78 Mb */
-                        69500, 12, 12, 8, 24, 41, 24, 41 },
+                        69500, 12, 12, 8, 24, 42, 24, 42 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 104000, /* 104 Mb */
-                        89500, 13, 13, 8, 25, 42, 25, 42 },
+                        89500, 13, 13, 8, 25, 43, 25, 43 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 117000, /* 117 Mb */
-                        98900, 14, 14, 8, 26, 43, 26, 44 },
+                        98900, 14, 14, 8, 26, 44, 26, 44 },
                 { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS, 130000, /* 130 Mb */
-                        108300, 15, 15, 8, 27, 44, 27, 45 },
+                        108300, 15, 15, 8, 27, 45, 28, 46 },
+                { VALID_20, INVALID, WLAN_RC_PHY_HT_20_DS_HGI, 144400, /* 130 Mb */
+                        120000, 15, 15, 8, 27, 45, 28, 46 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 13500, /* 13.5 Mb */
-                        13200, 0, 0, 8, 12, 28, 28, 28 },
+                        13200, 0, 0, 8, 12, 29, 29, 29 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 27500, /* 27.0 Mb */
-                        25900, 1, 1, 8, 13, 29, 29, 29 },
+                        25900, 1, 1, 8, 13, 30, 30, 30 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 40500, /* 40.5 Mb */
-                        38600, 2, 2, 8, 14, 30, 30, 30 },
+                        38600, 2, 2, 8, 14, 31, 31, 31 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 54000, /* 54 Mb */
-                        49800, 3, 3, 8,  15, 31, 31, 31 },
+                        49800, 3, 3, 8,  15, 32, 32, 32 },
                 { VALID_40, VALID_40, WLAN_RC_PHY_HT_40_SS, 81500, /* 81 Mb */
-                        72200, 4, 4, 8, 16, 32, 32, 32 },
+                        72200, 4, 4, 8, 16, 33, 33, 33 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS, 108000, /* 108 Mb */
-                        92900, 5, 5, 8, 17, 33, 33, 33 },
+                        92900, 5, 5, 8, 17, 34, 34, 34 },
                 { INVALID,  VALID_40, WLAN_RC_PHY_HT_40_SS, 121500, /* 121.5 Mb */
-                        102700, 6, 6, 8, 18, 34, 34, 34 },
+                        102700, 6, 6, 8, 18, 35, 35, 35 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS, 135000, /* 135 Mb */
-                        112000, 7, 7, 8, 19, 35, 36, 36 },
+                        112000, 7, 7, 8, 19, 36, 37, 37 },
                 { INVALID, VALID_40, WLAN_RC_PHY_HT_40_SS_HGI, 150000, /* 150 Mb */
-                        122000, 7, 7, 8, 19, 35, 36, 36 },
+                        122000, 7, 7, 8, 19, 36, 37, 37 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_40_DS, 27000, /* 27 Mb */
-                        25800, 8, 8, 8, 20, 37, 37, 37 },
+                        25800, 8, 8, 8, 20, 38, 38, 38 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_40_DS, 54000, /* 54 Mb */
-                        49800, 9, 9, 8, 21, 38, 38, 38 },
+                        49800, 9, 9, 8, 21, 39, 39, 39 },
                 { INVALID, INVALID, WLAN_RC_PHY_HT_40_DS, 81000, /* 81 Mb */
-                        71900, 10, 10, 8, 22, 39, 39, 39 },
+                        71900, 10, 10, 8, 22, 40, 40, 40 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 108000, /* 108 Mb */
-                        92500, 11, 11, 8, 23, 40, 40, 40 },
+                        92500, 11, 11, 8, 23, 41, 41, 41 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 162000, /* 162 Mb */
-                        130300, 12, 12, 8, 24, 41, 41, 41 },
+                        130300, 12, 12, 8, 24, 42, 42, 42 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 216000, /* 216 Mb */
-                        162800, 13, 13, 8, 25, 42, 42, 42 },
+                        162800, 13, 13, 8, 25, 43, 43, 43 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 243000, /* 243 Mb */
-                        178200, 14, 14, 8, 26, 43, 43, 43 },
+                        178200, 14, 14, 8, 26, 44, 44, 44 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS, 270000, /* 270 Mb */
-                        192100, 15, 15, 8, 27, 44, 45, 45 },
+                        192100, 15, 15, 8, 27, 45, 46, 46 },
                 { VALID_40, INVALID, WLAN_RC_PHY_HT_40_DS_HGI, 300000, /* 300 Mb */
-                        207000, 15, 15, 8, 27, 44, 45, 45 },
+                        207000, 15, 15, 8, 27, 45, 46, 46 },
         },
         50,  /* probe interval */
         WLAN_RC_HT_FLAG,  /* Phy rates allowed initially */
@@ -1193,21 +1197,19 @@ static void ath_rc_init(struct ath_softc *sc,
 }
 
 static u8 ath_rc_build_ht_caps(struct ath_softc *sc, struct ieee80211_sta *sta,
-                               bool is_cw40, bool is_sgi40)
+                               bool is_cw40, bool is_sgi)
 {
         u8 caps = 0;
 
         if (sta->ht_cap.ht_supported) {
                 caps = WLAN_RC_HT_FLAG;
-                if (sc->sc_ah->caps.tx_chainmask != 1 &&
-                    ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_DS, 0, NULL)) {
-                        if (sta->ht_cap.mcs.rx_mask[1])
-                                caps |= WLAN_RC_DS_FLAG;
-                }
+                if (sta->ht_cap.mcs.rx_mask[1])
+                        caps |= WLAN_RC_DS_FLAG;
                 if (is_cw40)
                         caps |= WLAN_RC_40_FLAG;
-                if (is_sgi40)
+                if (is_sgi)
                         caps |= WLAN_RC_SGI_FLAG;
+
         }
 
         return caps;
@@ -1300,7 +1302,7 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
         struct ath_softc *sc = priv;
         struct ath_rate_priv *ath_rc_priv = priv_sta;
         const struct ath_rate_table *rate_table;
-        bool is_cw40, is_sgi40;
+        bool is_cw40, is_sgi = false;
         int i, j = 0;
 
         for (i = 0; i < sband->n_bitrates; i++) {
@@ -1323,7 +1325,11 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
         }
 
         is_cw40 = sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-        is_sgi40 = sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40;
+
+        if (is_cw40)
+                is_sgi = sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40;
+        else if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_SGI_20)
+                is_sgi = sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20;
 
         /* Choose rate table first */
 
@@ -1336,7 +1342,7 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
                 rate_table = hw_rate_table[sc->cur_rate_mode];
         }
 
-        ath_rc_priv->ht_cap = ath_rc_build_ht_caps(sc, sta, is_cw40, is_sgi40);
+        ath_rc_priv->ht_cap = ath_rc_build_ht_caps(sc, sta, is_cw40, is_sgi);
         ath_rc_init(sc, priv_sta, sband, sta, rate_table);
 }
 
@@ -1347,10 +1353,10 @@ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
         struct ath_softc *sc = priv;
         struct ath_rate_priv *ath_rc_priv = priv_sta;
         const struct ath_rate_table *rate_table = NULL;
-        bool oper_cw40 = false, oper_sgi40;
+        bool oper_cw40 = false, oper_sgi;
         bool local_cw40 = (ath_rc_priv->ht_cap & WLAN_RC_40_FLAG) ?
                 true : false;
-        bool local_sgi40 = (ath_rc_priv->ht_cap & WLAN_RC_SGI_FLAG) ?
+        bool local_sgi = (ath_rc_priv->ht_cap & WLAN_RC_SGI_FLAG) ?
                 true : false;
 
         /* FIXME: Handle AP mode later when we support CWM */
@@ -1363,15 +1369,21 @@ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
                     oper_chan_type == NL80211_CHAN_HT40PLUS)
                         oper_cw40 = true;
 
-                oper_sgi40 = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
-                        true : false;
+                if (oper_cw40)
+                        oper_sgi = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
+                                   true : false;
+                else if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_SGI_20)
+                        oper_sgi = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
+                                   true : false;
+                else
+                        oper_sgi = false;
 
-                if ((local_cw40 != oper_cw40) || (local_sgi40 != oper_sgi40)) {
+                if ((local_cw40 != oper_cw40) || (local_sgi != oper_sgi)) {
                         rate_table = ath_choose_rate_table(sc, sband->band,
                                                    sta->ht_cap.ht_supported,
                                                    oper_cw40);
                         ath_rc_priv->ht_cap = ath_rc_build_ht_caps(sc, sta,
-                                                   oper_cw40, oper_sgi40);
+                                                   oper_cw40, oper_sgi);
                         ath_rc_init(sc, priv_sta, sband, sta, rate_table);
 
                         ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_CONFIG,
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index ca6065b71b46..da0cfe90c38a 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -116,9 +116,6 @@ static void ath_opmode_init(struct ath_softc *sc)
         /* configure operational mode */
         ath9k_hw_setopmode(ah);
 
-        /* Handle any link-level address change. */
-        ath9k_hw_setmac(ah, common->macaddr);
-
         /* calculate and install multicast filter */
         mfilt[0] = mfilt[1] = ~0;
         ath9k_hw_setmcastfilter(ah, mfilt[0], mfilt[1]);
@@ -295,7 +292,7 @@ static void ath_edma_start_recv(struct ath_softc *sc)
 
         ath_opmode_init(sc);
 
-        ath9k_hw_startpcureceive(sc->sc_ah);
+        ath9k_hw_startpcureceive(sc->sc_ah, (sc->sc_flags & SC_OP_SCANNING));
 }
 
 static void ath_edma_stop_recv(struct ath_softc *sc)
@@ -501,7 +498,7 @@ int ath_startrecv(struct ath_softc *sc)
 start_recv:
         spin_unlock_bh(&sc->rx.rxbuflock);
         ath_opmode_init(sc);
-        ath9k_hw_startpcureceive(ah);
+        ath9k_hw_startpcureceive(ah, (sc->sc_flags & SC_OP_SCANNING));
 
         return 0;
 }
@@ -700,12 +697,16 @@ static bool ath_edma_get_buffers(struct ath_softc *sc,
         bf = SKB_CB_ATHBUF(skb);
         BUG_ON(!bf);
 
-        dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+        dma_sync_single_for_cpu(sc->dev, bf->bf_buf_addr,
                                 common->rx_bufsize, DMA_FROM_DEVICE);
 
         ret = ath9k_hw_process_rxdesc_edma(ah, NULL, skb->data);
-        if (ret == -EINPROGRESS)
+        if (ret == -EINPROGRESS) {
+                /*let device gain the buffer again*/
+                dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+                                common->rx_bufsize, DMA_FROM_DEVICE);
                 return false;
+        }
 
         __skb_unlink(skb, &rx_edma->rx_fifo);
         if (ret == -EINVAL) {
@@ -814,13 +815,263 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
          * 1. accessing the frame
          * 2. requeueing the same buffer to h/w
          */
-        dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+        dma_sync_single_for_cpu(sc->dev, bf->bf_buf_addr,
                         common->rx_bufsize,
                         DMA_FROM_DEVICE);
 
         return bf;
 }
 
+/* Assumes you've already done the endian to CPU conversion */
+static bool ath9k_rx_accept(struct ath_common *common,
+                            struct ieee80211_hdr *hdr,
+                            struct ieee80211_rx_status *rxs,
+                            struct ath_rx_status *rx_stats,
+                            bool *decrypt_error)
+{
+        struct ath_hw *ah = common->ah;
+        __le16 fc;
+        u8 rx_status_len = ah->caps.rx_status_len;
+
+        fc = hdr->frame_control;
+
+        if (!rx_stats->rs_datalen)
+                return false;
+        /*
+         * rs_status follows rs_datalen so if rs_datalen is too large
+         * we can take a hint that hardware corrupted it, so ignore
+         * those frames.
+         */
+        if (rx_stats->rs_datalen > (common->rx_bufsize - rx_status_len))
+                return false;
+
+        /*
+         * rs_more indicates chained descriptors which can be used
+         * to link buffers together for a sort of scatter-gather
+         * operation.
+         * reject the frame, we don't support scatter-gather yet and
+         * the frame is probably corrupt anyway
+         */
+        if (rx_stats->rs_more)
+                return false;
+
+        /*
+         * The rx_stats->rs_status will not be set until the end of the
+         * chained descriptors so it can be ignored if rs_more is set. The
+         * rs_more will be false at the last element of the chained
+         * descriptors.
+         */
+        if (rx_stats->rs_status != 0) {
+                if (rx_stats->rs_status & ATH9K_RXERR_CRC)
+                        rxs->flag |= RX_FLAG_FAILED_FCS_CRC;
+                if (rx_stats->rs_status & ATH9K_RXERR_PHY)
+                        return false;
+
+                if (rx_stats->rs_status & ATH9K_RXERR_DECRYPT) {
+                        *decrypt_error = true;
+                } else if (rx_stats->rs_status & ATH9K_RXERR_MIC) {
+                        if (ieee80211_is_ctl(fc))
+                                /*
+                                 * Sometimes, we get invalid
+                                 * MIC failures on valid control frames.
+                                 * Remove these mic errors.
+                                 */
+                                rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
+                        else
+                                rxs->flag |= RX_FLAG_MMIC_ERROR;
+                }
+                /*
+                 * Reject error frames with the exception of
+                 * decryption and MIC failures. For monitor mode,
+                 * we also ignore the CRC error.
+                 */
+                if (ah->opmode == NL80211_IFTYPE_MONITOR) {
+                        if (rx_stats->rs_status &
+                            ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC |
+                              ATH9K_RXERR_CRC))
+                                return false;
+                } else {
+                        if (rx_stats->rs_status &
+                            ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC)) {
+                                return false;
+                        }
+                }
+        }
+        return true;
+}
+
+static int ath9k_process_rate(struct ath_common *common,
+                              struct ieee80211_hw *hw,
+                              struct ath_rx_status *rx_stats,
+                              struct ieee80211_rx_status *rxs)
+{
+        struct ieee80211_supported_band *sband;
+        enum ieee80211_band band;
+        unsigned int i = 0;
+
+        band = hw->conf.channel->band;
+        sband = hw->wiphy->bands[band];
+
+        if (rx_stats->rs_rate & 0x80) {
+                /* HT rate */
+                rxs->flag |= RX_FLAG_HT;
+                if (rx_stats->rs_flags & ATH9K_RX_2040)
+                        rxs->flag |= RX_FLAG_40MHZ;
+                if (rx_stats->rs_flags & ATH9K_RX_GI)
+                        rxs->flag |= RX_FLAG_SHORT_GI;
+                rxs->rate_idx = rx_stats->rs_rate & 0x7f;
+                return 0;
+        }
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if (sband->bitrates[i].hw_value == rx_stats->rs_rate) {
+                        rxs->rate_idx = i;
+                        return 0;
+                }
+                if (sband->bitrates[i].hw_value_short == rx_stats->rs_rate) {
+                        rxs->flag |= RX_FLAG_SHORTPRE;
+                        rxs->rate_idx = i;
+                        return 0;
+                }
+        }
+
+        /*
+         * No valid hardware bitrate found -- we should not get here
+         * because hardware has already validated this frame as OK.
+         */
+        ath_print(common, ATH_DBG_XMIT, "unsupported hw bitrate detected "
+                  "0x%02x using 1 Mbit\n", rx_stats->rs_rate);
+
+        return -EINVAL;
+}
+
+static void ath9k_process_rssi(struct ath_common *common,
+                               struct ieee80211_hw *hw,
+                               struct ieee80211_hdr *hdr,
+                               struct ath_rx_status *rx_stats)
+{
+        struct ath_hw *ah = common->ah;
+        struct ieee80211_sta *sta;
+        struct ath_node *an;
+        int last_rssi = ATH_RSSI_DUMMY_MARKER;
+        __le16 fc;
+
+        fc = hdr->frame_control;
+
+        rcu_read_lock();
+        /*
+         * XXX: use ieee80211_find_sta! This requires quite a bit of work
+         * under the current ath9k virtual wiphy implementation as we have
+         * no way of tying a vif to wiphy. Typically vifs are attached to
+         * at least one sdata of a wiphy on mac80211 but with ath9k virtual
+         * wiphy you'd have to iterate over every wiphy and each sdata.
+         */
+        sta = ieee80211_find_sta_by_hw(hw, hdr->addr2);
+        if (sta) {
+                an = (struct ath_node *) sta->drv_priv;
+                if (rx_stats->rs_rssi != ATH9K_RSSI_BAD &&
+                   !rx_stats->rs_moreaggr)
+                        ATH_RSSI_LPF(an->last_rssi, rx_stats->rs_rssi);
+                last_rssi = an->last_rssi;
+        }
+        rcu_read_unlock();
+
+        if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
+                rx_stats->rs_rssi = ATH_EP_RND(last_rssi,
+                                              ATH_RSSI_EP_MULTIPLIER);
+        if (rx_stats->rs_rssi < 0)
+                rx_stats->rs_rssi = 0;
+
+        /* Update Beacon RSSI, this is used by ANI. */
+        if (ieee80211_is_beacon(fc))
+                ah->stats.avgbrssi = rx_stats->rs_rssi;
+}
+
+/*
+ * For Decrypt or Demic errors, we only mark packet status here and always push
+ * up the frame up to let mac80211 handle the actual error case, be it no
+ * decryption key or real decryption error. This let us keep statistics there.
+ */
+static int ath9k_rx_skb_preprocess(struct ath_common *common,
+                                   struct ieee80211_hw *hw,
+                                   struct ieee80211_hdr *hdr,
+                                   struct ath_rx_status *rx_stats,
+                                   struct ieee80211_rx_status *rx_status,
+                                   bool *decrypt_error)
+{
+        memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
+
+        /*
+         * everything but the rate is checked here, the rate check is done
+         * separately to avoid doing two lookups for a rate for each frame.
+         */
+        if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error))
+                return -EINVAL;
+
+        ath9k_process_rssi(common, hw, hdr, rx_stats);
+
+        if (ath9k_process_rate(common, hw, rx_stats, rx_status))
+                return -EINVAL;
+
+        rx_status->band = hw->conf.channel->band;
+        rx_status->freq = hw->conf.channel->center_freq;
+        rx_status->signal = ATH_DEFAULT_NOISE_FLOOR + rx_stats->rs_rssi;
+        rx_status->antenna = rx_stats->rs_antenna;
+        rx_status->flag |= RX_FLAG_TSFT;
+
+        return 0;
+}
+
+static void ath9k_rx_skb_postprocess(struct ath_common *common,
+                                     struct sk_buff *skb,
+                                     struct ath_rx_status *rx_stats,
+                                     struct ieee80211_rx_status *rxs,
+                                     bool decrypt_error)
+{
+        struct ath_hw *ah = common->ah;
+        struct ieee80211_hdr *hdr;
+        int hdrlen, padpos, padsize;
+        u8 keyix;
+        __le16 fc;
+
+        /* see if any padding is done by the hw and remove it */
+        hdr = (struct ieee80211_hdr *) skb->data;
+        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+        fc = hdr->frame_control;
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+
+        /* The MAC header is padded to have 32-bit boundary if the
+         * packet payload is non-zero. The general calculation for
+         * padsize would take into account odd header lengths:
+         * padsize = (4 - padpos % 4) % 4; However, since only
+         * even-length headers are used, padding can only be 0 or 2
+         * bytes and we can optimize this a bit. In addition, we must
+         * not try to remove padding from short control frames that do
+         * not have payload. */
+        padsize = padpos & 3;
+        if (padsize && skb->len>=padpos+padsize+FCS_LEN) {
+                memmove(skb->data + padsize, skb->data, padpos);
+                skb_pull(skb, padsize);
+        }
+
+        keyix = rx_stats->rs_keyix;
+
+        if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error &&
+            ieee80211_has_protected(fc)) {
+                rxs->flag |= RX_FLAG_DECRYPTED;
+        } else if (ieee80211_has_protected(fc)
+                   && !decrypt_error && skb->len >= hdrlen + 4) {
+                keyix = skb->data[hdrlen + 3] >> 6;
+
+                if (test_bit(keyix, common->keymap))
+                        rxs->flag |= RX_FLAG_DECRYPTED;
+        }
+        if (ah->sw_mgmt_crypto &&
+            (rxs->flag & RX_FLAG_DECRYPTED) &&
+            ieee80211_is_mgmt(fc))
+                /* Use software decrypt for management frames. */
+                rxs->flag &= ~RX_FLAG_DECRYPTED;
+}
 
 int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 {
@@ -842,15 +1093,21 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
         enum ath9k_rx_qtype qtype;
         bool edma = !!(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA);
         int dma_type;
+        u8 rx_status_len = ah->caps.rx_status_len;
+        u64 tsf = 0;
+        u32 tsf_lower = 0;
 
         if (edma)
-                dma_type = DMA_FROM_DEVICE;
-        else
                 dma_type = DMA_BIDIRECTIONAL;
+        else
+                dma_type = DMA_FROM_DEVICE;
 
         qtype = hp ? ATH9K_RX_QUEUE_HP : ATH9K_RX_QUEUE_LP;
         spin_lock_bh(&sc->rx.rxbuflock);
 
+        tsf = ath9k_hw_gettsf64(ah);
+        tsf_lower = tsf & 0xffffffff;
+
         do {
                 /* If handling rx interrupt and flush is in progress => exit */
                 if ((sc->sc_flags & SC_OP_RXFLUSH) && (flush == 0))
@@ -869,7 +1126,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                 if (!skb)
                         continue;
 
-                hdr = (struct ieee80211_hdr *) skb->data;
+                hdr = (struct ieee80211_hdr *) (skb->data + rx_status_len);
                 rxs =  IEEE80211_SKB_RXCB(skb);
 
                 hw = ath_get_virt_hw(sc, hdr);
@@ -883,8 +1140,17 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                 if (flush)
                         goto requeue;
 
-                retval = ath9k_cmn_rx_skb_preprocess(common, hw, skb, &rs,
-                                                     rxs, &decrypt_error);
+                rxs->mactime = (tsf & ~0xffffffffULL) | rs.rs_tstamp;
+                if (rs.rs_tstamp > tsf_lower &&
+                    unlikely(rs.rs_tstamp - tsf_lower > 0x10000000))
+                        rxs->mactime -= 0x100000000ULL;
+
+                if (rs.rs_tstamp < tsf_lower &&
+                    unlikely(tsf_lower - rs.rs_tstamp > 0x10000000))
+                        rxs->mactime += 0x100000000ULL;
+
+                retval = ath9k_rx_skb_preprocess(common, hw, hdr, &rs,
+                                                 rxs, &decrypt_error);
                 if (retval)
                         goto requeue;
 
@@ -908,8 +1174,8 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                 if (ah->caps.rx_status_len)
                         skb_pull(skb, ah->caps.rx_status_len);
 
-                ath9k_cmn_rx_skb_postprocess(common, skb, &rs,
-                                             rxs, decrypt_error);
+                ath9k_rx_skb_postprocess(common, skb, &rs,
+                                         rxs, decrypt_error);
 
                 /* We will now give hardware our shiny new allocated skb */
                 bf->bf_mpdu = requeue_skb;
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index d4371a43bdaa..47be667fe4ff 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -222,6 +222,7 @@
 
 #define AR_ISR_S2              0x008c
 #define AR_ISR_S2_QCU_TXURN    0x000003FF
+#define AR_ISR_S2_BB_WATCHDOG  0x00010000
 #define AR_ISR_S2_CST          0x00400000
 #define AR_ISR_S2_GTT          0x00800000
 #define AR_ISR_S2_TIM          0x01000000
@@ -699,7 +700,15 @@
 #define AR_RC_HOSTIF         0x00000100
 
 #define AR_WA                           0x4004
+#define AR_WA_BIT6                      (1 << 6)
+#define AR_WA_BIT7                      (1 << 7)
+#define AR_WA_BIT23                     (1 << 23)
 #define AR_WA_D3_L1_DISABLE             (1 << 14)
+#define AR_WA_D3_TO_L1_DISABLE_REAL     (1 << 16)
+#define AR_WA_ASPM_TIMER_BASED_DISABLE  (1 << 17)
+#define AR_WA_RESET_EN                  (1 << 18) /* Sw Control to enable PCI-Reset to POR (bit 15) */
+#define AR_WA_ANALOG_SHIFT              (1 << 20)
+#define AR_WA_POR_SHORT                 (1 << 21) /* PCI-E Phy reset control */
 #define AR9285_WA_DEFAULT               0x004a050b
 #define AR9280_WA_DEFAULT               0x0040073b
 #define AR_WA_DEFAULT                   0x0000073f
@@ -756,32 +765,33 @@
 #define AR_SREV_REVISION2                     0x00000F00
 #define AR_SREV_REVISION2_S                   8
 
-#define AR_SREV_VERSION_5416_PCI               0xD
-#define AR_SREV_VERSION_5416_PCIE              0xC
-#define AR_SREV_REVISION_5416_10               0
-#define AR_SREV_REVISION_5416_20               1
-#define AR_SREV_REVISION_5416_22               2
-#define AR_SREV_VERSION_9100                  0x14
-#define AR_SREV_VERSION_9160                  0x40
-#define AR_SREV_REVISION_9160_10              0
-#define AR_SREV_REVISION_9160_11              1
-#define AR_SREV_VERSION_9280                0x80
-#define AR_SREV_REVISION_9280_10            0
-#define AR_SREV_REVISION_9280_20            1
-#define AR_SREV_REVISION_9280_21            2
-#define AR_SREV_VERSION_9285                  0xC0
-#define AR_SREV_REVISION_9285_10              0
-#define AR_SREV_REVISION_9285_11              1
-#define AR_SREV_REVISION_9285_12              2
-#define AR_SREV_VERSION_9287                  0x180
-#define AR_SREV_REVISION_9287_10              0
-#define AR_SREV_REVISION_9287_11              1
-#define AR_SREV_REVISION_9287_12              2
-#define AR_SREV_VERSION_9271                    0x140
-#define AR_SREV_REVISION_9271_10                0
-#define AR_SREV_REVISION_9271_11                1
-#define AR_SREV_VERSION_9300                  0x1c0
-#define AR_SREV_REVISION_9300_20              2 /* 2.0 and 2.1 */
+#define AR_SREV_VERSION_5416_PCI        0xD
+#define AR_SREV_VERSION_5416_PCIE       0xC
+#define AR_SREV_REVISION_5416_10        0
+#define AR_SREV_REVISION_5416_20        1
+#define AR_SREV_REVISION_5416_22        2
+#define AR_SREV_VERSION_9100            0x14
+#define AR_SREV_VERSION_9160            0x40
+#define AR_SREV_REVISION_9160_10        0
+#define AR_SREV_REVISION_9160_11        1
+#define AR_SREV_VERSION_9280            0x80
+#define AR_SREV_REVISION_9280_10        0
+#define AR_SREV_REVISION_9280_20        1
+#define AR_SREV_REVISION_9280_21        2
+#define AR_SREV_VERSION_9285            0xC0
+#define AR_SREV_REVISION_9285_10        0
+#define AR_SREV_REVISION_9285_11        1
+#define AR_SREV_REVISION_9285_12        2
+#define AR_SREV_VERSION_9287            0x180
+#define AR_SREV_REVISION_9287_10        0
+#define AR_SREV_REVISION_9287_11        1
+#define AR_SREV_REVISION_9287_12        2
+#define AR_SREV_REVISION_9287_13        3
+#define AR_SREV_VERSION_9271            0x140
+#define AR_SREV_REVISION_9271_10        0
+#define AR_SREV_REVISION_9271_11        1
+#define AR_SREV_VERSION_9300            0x1c0
+#define AR_SREV_REVISION_9300_20        2 /* 2.0 and 2.1 */
 
 #define AR_SREV_5416(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_5416_PCI) || \
@@ -859,6 +869,11 @@
         (((_ah)->hw_version.macVersion > AR_SREV_VERSION_9287) || \
          (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9287) && \
           ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9287_12)))
+#define AR_SREV_9287_13_OR_LATER(_ah) \
+        (((_ah)->hw_version.macVersion > AR_SREV_VERSION_9287) || \
+         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9287) && \
+          ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9287_13)))
+
 #define AR_SREV_9271(_ah) \
     (((_ah))->hw_version.macVersion == AR_SREV_VERSION_9271)
 #define AR_SREV_9271_10(_ah) \
diff --git a/drivers/net/wireless/ath/ath9k/virtual.c b/drivers/net/wireless/ath/ath9k/virtual.c
index 105ad40968f6..89423ca23d2c 100644
--- a/drivers/net/wireless/ath/ath9k/virtual.c
+++ b/drivers/net/wireless/ath/ath9k/virtual.c
@@ -219,7 +219,7 @@ static int ath9k_send_nullfunc(struct ath_wiphy *aphy,
         info->control.rates[1].idx = -1;
 
         memset(&txctl, 0, sizeof(struct ath_tx_control));
-        txctl.txq = &sc->tx.txq[sc->tx.hwq_map[ATH9K_WME_AC_VO]];
+        txctl.txq = &sc->tx.txq[sc->tx.hwq_map[WME_AC_VO]];
         txctl.frame_type = ps ? ATH9K_IFT_PAUSE : ATH9K_IFT_UNPAUSE;
 
         if (ath_tx_start(aphy->hw, skb, &txctl) != 0)
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index e23172c9caaf..6260faa658a2 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -279,9 +279,6 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
         if (wmi->drv_priv->op_flags & OP_UNPLUGGED)
                 return 0;
 
-        if (!wmi)
-                return -EINVAL;
-
         skb = alloc_skb(headroom + cmd_len, GFP_ATOMIC);
         if (!skb)
                 return -ENOMEM;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 859aa4ab0769..c41185b28c0a 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -941,6 +941,7 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
         if (!ATH_TXQ_SETUP(sc, qnum)) {
                 struct ath_txq *txq = &sc->tx.txq[qnum];
 
+                txq->axq_class = subtype;
                 txq->axq_qnum = qnum;
                 txq->axq_link = NULL;
                 INIT_LIST_HEAD(&txq->axq_q);
@@ -958,58 +959,6 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
         return &sc->tx.txq[qnum];
 }
 
-int ath_tx_get_qnum(struct ath_softc *sc, int qtype, int haltype)
-{
-        int qnum;
-
-        switch (qtype) {
-        case ATH9K_TX_QUEUE_DATA:
-                if (haltype >= ARRAY_SIZE(sc->tx.hwq_map)) {
-                        ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
-                                  "HAL AC %u out of range, max %zu!\n",
-                                  haltype, ARRAY_SIZE(sc->tx.hwq_map));
-                        return -1;
-                }
-                qnum = sc->tx.hwq_map[haltype];
-                break;
-        case ATH9K_TX_QUEUE_BEACON:
-                qnum = sc->beacon.beaconq;
-                break;
-        case ATH9K_TX_QUEUE_CAB:
-                qnum = sc->beacon.cabq->axq_qnum;
-                break;
-        default:
-                qnum = -1;
-        }
-        return qnum;
-}
-
-struct ath_txq *ath_test_get_txq(struct ath_softc *sc, struct sk_buff *skb)
-{
-        struct ath_txq *txq = NULL;
-        u16 skb_queue = skb_get_queue_mapping(skb);
-        int qnum;
-
-        qnum = ath_get_hal_qnum(skb_queue, sc);
-        txq = &sc->tx.txq[qnum];
-
-        spin_lock_bh(&txq->axq_lock);
-
-        if (txq->axq_depth >= (ATH_TXBUF - 20)) {
-                ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_XMIT,
-                          "TX queue: %d is full, depth: %d\n",
-                          qnum, txq->axq_depth);
-                ath_mac80211_stop_queue(sc, skb_queue);
-                txq->stopped = 1;
-                spin_unlock_bh(&txq->axq_lock);
-                return NULL;
-        }
-
-        spin_unlock_bh(&txq->axq_lock);
-
-        return txq;
-}
-
 int ath_txq_update(struct ath_softc *sc, int qnum,
                    struct ath9k_tx_queue_info *qinfo)
 {
@@ -1688,12 +1637,15 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
                 bf->bf_frmlen -= padsize;
         }
 
-        if (conf_is_ht(&hw->conf)) {
+        if (!txctl->paprd && conf_is_ht(&hw->conf)) {
                 bf->bf_state.bf_type |= BUF_HT;
                 if (tx_info->flags & IEEE80211_TX_CTL_LDPC)
                         use_ldpc = true;
         }
 
+        bf->bf_state.bfs_paprd = txctl->paprd;
+        if (txctl->paprd)
+                bf->bf_state.bfs_paprd_timestamp = jiffies;
         bf->bf_flags = setup_tx_flags(skb, use_ldpc);
 
         bf->bf_keytype = get_hw_crypto_keytype(skb);
@@ -1768,6 +1720,9 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
                             bf->bf_buf_addr,
                             txctl->txq->axq_qnum);
 
+        if (bf->bf_state.bfs_paprd)
+                ar9003_hw_set_paprd_txdesc(ah, ds, bf->bf_state.bfs_paprd);
+
         spin_lock_bh(&txctl->txq->axq_lock);
 
         if (bf_isht(bf) && (sc->sc_flags & SC_OP_TXAGGR) &&
@@ -1809,8 +1764,9 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_txq *txq = txctl->txq;
         struct ath_buf *bf;
-        int r;
+        int q, r;
 
         bf = ath_tx_get_buffer(sc);
         if (!bf) {
@@ -1820,8 +1776,6 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
 
         r = ath_tx_setup_buffer(hw, bf, skb, txctl);
         if (unlikely(r)) {
-                struct ath_txq *txq = txctl->txq;
-
                 ath_print(common, ATH_DBG_FATAL, "TX mem alloc failure\n");
 
                 /* upon ath_tx_processq() this TX queue will be resumed, we
@@ -1829,7 +1783,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                  * we will at least have to run TX completionon one buffer
                  * on the queue */
                 spin_lock_bh(&txq->axq_lock);
-                if (sc->tx.txq[txq->axq_qnum].axq_depth > 1) {
+                if (!txq->stopped && txq->axq_depth > 1) {
                         ath_mac80211_stop_queue(sc, skb_get_queue_mapping(skb));
                         txq->stopped = 1;
                 }
@@ -1840,6 +1794,17 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                 return r;
         }
 
+        q = skb_get_queue_mapping(skb);
+        if (q >= 4)
+                q = 0;
+
+        spin_lock_bh(&txq->axq_lock);
+        if (++sc->tx.pending_frames[q] > ATH_MAX_QDEPTH && !txq->stopped) {
+                ath_mac80211_stop_queue(sc, skb_get_queue_mapping(skb));
+                txq->stopped = 1;
+        }
+        spin_unlock_bh(&txq->axq_lock);
+
         ath_tx_start_dma(sc, bf, txctl);
 
         return 0;
@@ -1909,7 +1874,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
-        int padpos, padsize;
+        int q, padpos, padsize;
 
         ath_print(common, ATH_DBG_XMIT, "TX complete: skb: %p\n", skb);
 
@@ -1948,8 +1913,16 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
 
         if (unlikely(tx_info->pad[0] & ATH_TX_INFO_FRAME_TYPE_INTERNAL))
                 ath9k_tx_status(hw, skb);
-        else
+        else {
+                q = skb_get_queue_mapping(skb);
+                if (q >= 4)
+                        q = 0;
+
+                if (--sc->tx.pending_frames[q] < 0)
+                        sc->tx.pending_frames[q] = 0;
+
                 ieee80211_tx_status(hw, skb);
+        }
 }
 
 static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
@@ -1971,8 +1944,18 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
         }
 
         dma_unmap_single(sc->dev, bf->bf_dmacontext, skb->len, DMA_TO_DEVICE);
-        ath_tx_complete(sc, skb, bf->aphy, tx_flags);
-        ath_debug_stat_tx(sc, txq, bf, ts);
+
+        if (bf->bf_state.bfs_paprd) {
+                if (time_after(jiffies,
+                               bf->bf_state.bfs_paprd_timestamp +
+                               msecs_to_jiffies(ATH_PAPRD_TIMEOUT)))
+                        dev_kfree_skb_any(skb);
+                else
+                        complete(&sc->paprd_complete);
+        } else {
+                ath_tx_complete(sc, skb, bf->aphy, tx_flags);
+                ath_debug_stat_tx(sc, txq, bf, ts);
+        }
 
         /*
          * Return the list of ath_buf of this mpdu to free queue
@@ -2057,14 +2040,14 @@ static void ath_wake_mac80211_queue(struct ath_softc *sc, struct ath_txq *txq)
 {
         int qnum;
 
+        qnum = ath_get_mac80211_qnum(txq->axq_class, sc);
+        if (qnum == -1)
+                return;
+
         spin_lock_bh(&txq->axq_lock);
-        if (txq->stopped &&
-            sc->tx.txq[txq->axq_qnum].axq_depth <= (ATH_TXBUF - 20)) {
-                qnum = ath_get_mac80211_qnum(txq->axq_qnum, sc);
-                if (qnum != -1) {
-                        ath_mac80211_start_queue(sc, qnum);
-                        txq->stopped = 0;
-                }
+        if (txq->stopped && sc->tx.pending_frames[qnum] < ATH_MAX_QDEPTH) {
+                ath_mac80211_start_queue(sc, qnum);
+                txq->stopped = 0;
         }
         spin_unlock_bh(&txq->axq_lock);
 }
@@ -2279,6 +2262,17 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
 
                 txok = !(txs.ts_status & ATH9K_TXERR_MASK);
 
+                /*
+                 * Make sure null func frame is acked before configuring
+                 * hw into ps mode.
+                 */
+                if (bf->bf_isnullfunc && txok) {
+                        if ((sc->ps_flags & PS_ENABLED))
+                                ath9k_enable_ps(sc);
+                        else
+                                sc->ps_flags |= PS_NULLFUNC_COMPLETED;
+                }
+
                 if (!bf_isampdu(bf)) {
                         bf->bf_retries = txs.ts_longretry;
                         if (txs.ts_status & ATH9K_TXERR_XRETRY)
@@ -2424,26 +2418,8 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
         for (acno = 0, ac = &an->ac[acno];
              acno < WME_NUM_AC; acno++, ac++) {
                 ac->sched    = false;
+                ac->qnum = sc->tx.hwq_map[acno];
                 INIT_LIST_HEAD(&ac->tid_q);
-
-                switch (acno) {
-                case WME_AC_BE:
-                        ac->qnum = ath_tx_get_qnum(sc,
-                                   ATH9K_TX_QUEUE_DATA, ATH9K_WME_AC_BE);
-                        break;
-                case WME_AC_BK:
-                        ac->qnum = ath_tx_get_qnum(sc,
-                                   ATH9K_TX_QUEUE_DATA, ATH9K_WME_AC_BK);
-                        break;
-                case WME_AC_VI:
-                        ac->qnum = ath_tx_get_qnum(sc,
-                                   ATH9K_TX_QUEUE_DATA, ATH9K_WME_AC_VI);
-                        break;
-                case WME_AC_VO:
-                        ac->qnum = ath_tx_get_qnum(sc,
-                                   ATH9K_TX_QUEUE_DATA, ATH9K_WME_AC_VO);
-                        break;
-                }
         }
 }
 
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index fa40fdfea719..10d0aaf754c5 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -333,11 +333,11 @@ static inline
         dma_addr_t dmaaddr;
 
         if (tx) {
-                dmaaddr = ssb_dma_map_single(ring->dev->dev,
-                                             buf, len, DMA_TO_DEVICE);
+                dmaaddr = dma_map_single(ring->dev->dev->dma_dev,
+                                         buf, len, DMA_TO_DEVICE);
         } else {
-                dmaaddr = ssb_dma_map_single(ring->dev->dev,
-                                             buf, len, DMA_FROM_DEVICE);
+                dmaaddr = dma_map_single(ring->dev->dev->dma_dev,
+                                         buf, len, DMA_FROM_DEVICE);
         }
 
         return dmaaddr;
@@ -348,11 +348,11 @@ static inline
                           dma_addr_t addr, size_t len, int tx)
 {
         if (tx) {
-                ssb_dma_unmap_single(ring->dev->dev,
-                                     addr, len, DMA_TO_DEVICE);
+                dma_unmap_single(ring->dev->dev->dma_dev,
+                                 addr, len, DMA_TO_DEVICE);
         } else {
-                ssb_dma_unmap_single(ring->dev->dev,
-                                     addr, len, DMA_FROM_DEVICE);
+                dma_unmap_single(ring->dev->dev->dma_dev,
+                                 addr, len, DMA_FROM_DEVICE);
         }
 }
 
@@ -361,7 +361,7 @@ static inline
                                  dma_addr_t addr, size_t len)
 {
         B43_WARN_ON(ring->tx);
-        ssb_dma_sync_single_for_cpu(ring->dev->dev,
+        dma_sync_single_for_cpu(ring->dev->dev->dma_dev,
                                     addr, len, DMA_FROM_DEVICE);
 }
 
@@ -370,8 +370,8 @@ static inline
                                     dma_addr_t addr, size_t len)
 {
         B43_WARN_ON(ring->tx);
-        ssb_dma_sync_single_for_device(ring->dev->dev,
-                                       addr, len, DMA_FROM_DEVICE);
+        dma_sync_single_for_device(ring->dev->dev->dma_dev,
+                                   addr, len, DMA_FROM_DEVICE);
 }
 
 static inline
@@ -401,9 +401,9 @@ static int alloc_ringmemory(struct b43_dmaring *ring)
          */
         if (ring->type == B43_DMA_64BIT)
                 flags |= GFP_DMA;
-        ring->descbase = ssb_dma_alloc_consistent(ring->dev->dev,
-                                                  B43_DMA_RINGMEMSIZE,
-                                                  &(ring->dmabase), flags);
+        ring->descbase = dma_alloc_coherent(ring->dev->dev->dma_dev,
+                                            B43_DMA_RINGMEMSIZE,
+                                            &(ring->dmabase), flags);
         if (!ring->descbase) {
                 b43err(ring->dev->wl, "DMA ringmemory allocation failed\n");
                 return -ENOMEM;
@@ -420,8 +420,8 @@ static void free_ringmemory(struct b43_dmaring *ring)
         if (ring->type == B43_DMA_64BIT)
                 flags |= GFP_DMA;
 
-        ssb_dma_free_consistent(ring->dev->dev, B43_DMA_RINGMEMSIZE,
-                                ring->descbase, ring->dmabase, flags);
+        dma_free_coherent(ring->dev->dev->dma_dev, B43_DMA_RINGMEMSIZE,
+                          ring->descbase, ring->dmabase);
 }
 
 /* Reset the RX DMA channel */
@@ -528,7 +528,7 @@ static bool b43_dma_mapping_error(struct b43_dmaring *ring,
                                   dma_addr_t addr,
                                   size_t buffersize, bool dma_to_device)
 {
-        if (unlikely(ssb_dma_mapping_error(ring->dev->dev, addr)))
+        if (unlikely(dma_mapping_error(ring->dev->dev->dma_dev, addr)))
                 return 1;
 
         switch (ring->type) {
@@ -874,10 +874,10 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                         goto err_kfree_meta;
 
                 /* test for ability to dma to txhdr_cache */
-                dma_test = ssb_dma_map_single(dev->dev,
-                                              ring->txhdr_cache,
-                                              b43_txhdr_size(dev),
-                                              DMA_TO_DEVICE);
+                dma_test = dma_map_single(dev->dev->dma_dev,
+                                          ring->txhdr_cache,
+                                          b43_txhdr_size(dev),
+                                          DMA_TO_DEVICE);
 
                 if (b43_dma_mapping_error(ring, dma_test,
                                           b43_txhdr_size(dev), 1)) {
@@ -889,10 +889,10 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                         if (!ring->txhdr_cache)
                                 goto err_kfree_meta;
 
-                        dma_test = ssb_dma_map_single(dev->dev,
-                                                      ring->txhdr_cache,
-                                                      b43_txhdr_size(dev),
-                                                      DMA_TO_DEVICE);
+                        dma_test = dma_map_single(dev->dev->dma_dev,
+                                                  ring->txhdr_cache,
+                                                  b43_txhdr_size(dev),
+                                                  DMA_TO_DEVICE);
 
                         if (b43_dma_mapping_error(ring, dma_test,
                                                   b43_txhdr_size(dev), 1)) {
@@ -903,9 +903,9 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                         }
                 }
 
-                ssb_dma_unmap_single(dev->dev,
-                                     dma_test, b43_txhdr_size(dev),
-                                     DMA_TO_DEVICE);
+                dma_unmap_single(dev->dev->dma_dev,
+                                 dma_test, b43_txhdr_size(dev),
+                                 DMA_TO_DEVICE);
         }
 
         err = alloc_ringmemory(ring);
@@ -1018,9 +1018,12 @@ static int b43_dma_set_mask(struct b43_wldev *dev, u64 mask)
         /* Try to set the DMA mask. If it fails, try falling back to a
          * lower mask, as we can always also support a lower one. */
         while (1) {
-                err = ssb_dma_set_mask(dev->dev, mask);
-                if (!err)
-                        break;
+                err = dma_set_mask(dev->dev->dma_dev, mask);
+                if (!err) {
+                        err = dma_set_coherent_mask(dev->dev->dma_dev, mask);
+                        if (!err)
+                                break;
+                }
                 if (mask == DMA_BIT_MASK(64)) {
                         mask = DMA_BIT_MASK(32);
                         fallback = 1;
@@ -1221,14 +1224,14 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
         meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
         /* create a bounce buffer in zone_dma on mapping failure. */
         if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
-                priv_info->bouncebuffer = kmalloc(skb->len, GFP_ATOMIC | GFP_DMA);
+                priv_info->bouncebuffer = kmemdup(skb->data, skb->len,
+                                                  GFP_ATOMIC | GFP_DMA);
                 if (!priv_info->bouncebuffer) {
                         ring->current_slot = old_top_slot;
                         ring->used_slots = old_used_slots;
                         err = -ENOMEM;
                         goto out_unmap_hdr;
                 }
-                memcpy(priv_info->bouncebuffer, skb->data, skb->len);
 
                 meta->dmaaddr = map_descbuffer(ring, priv_info->bouncebuffer, skb->len, 1);
                 if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 7965b70efbab..8e243798ae93 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1804,7 +1804,7 @@ static void b43_do_interrupt_thread(struct b43_wldev *dev)
                                dma_reason[2], dma_reason[3],
                                dma_reason[4], dma_reason[5]);
                         b43err(dev->wl, "This device does not support DMA "
-                               "on your system. Please use PIO instead.\n");
+                               "on your system. It will now be switched to PIO.\n");
                         /* Fall back to PIO transfers if we get fatal DMA errors! */
                         dev->use_pio = 1;
                         b43_controller_restart(dev, "DMA error");
diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index e91520d0312e..e03e01d0bc35 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -394,11 +394,11 @@ dma_addr_t map_descbuffer(struct b43legacy_dmaring *ring,
         dma_addr_t dmaaddr;
 
         if (tx)
-                dmaaddr = ssb_dma_map_single(ring->dev->dev,
+                dmaaddr = dma_map_single(ring->dev->dev->dma_dev,
                                              buf, len,
                                              DMA_TO_DEVICE);
         else
-                dmaaddr = ssb_dma_map_single(ring->dev->dev,
+                dmaaddr = dma_map_single(ring->dev->dev->dma_dev,
                                              buf, len,
                                              DMA_FROM_DEVICE);
 
@@ -412,11 +412,11 @@ void unmap_descbuffer(struct b43legacy_dmaring *ring,
                       int tx)
 {
         if (tx)
-                ssb_dma_unmap_single(ring->dev->dev,
+                dma_unmap_single(ring->dev->dev->dma_dev,
                                      addr, len,
                                      DMA_TO_DEVICE);
         else
-                ssb_dma_unmap_single(ring->dev->dev,
+                dma_unmap_single(ring->dev->dev->dma_dev,
                                      addr, len,
                                      DMA_FROM_DEVICE);
 }
@@ -428,8 +428,8 @@ void sync_descbuffer_for_cpu(struct b43legacy_dmaring *ring,
 {
         B43legacy_WARN_ON(ring->tx);
 
-        ssb_dma_sync_single_for_cpu(ring->dev->dev,
-                                    addr, len, DMA_FROM_DEVICE);
+        dma_sync_single_for_cpu(ring->dev->dev->dma_dev,
+                                addr, len, DMA_FROM_DEVICE);
 }
 
 static inline
@@ -439,8 +439,8 @@ void sync_descbuffer_for_device(struct b43legacy_dmaring *ring,
 {
         B43legacy_WARN_ON(ring->tx);
 
-        ssb_dma_sync_single_for_device(ring->dev->dev,
-                                       addr, len, DMA_FROM_DEVICE);
+        dma_sync_single_for_device(ring->dev->dev->dma_dev,
+                                   addr, len, DMA_FROM_DEVICE);
 }
 
 static inline
@@ -460,10 +460,10 @@ void free_descriptor_buffer(struct b43legacy_dmaring *ring,
 static int alloc_ringmemory(struct b43legacy_dmaring *ring)
 {
         /* GFP flags must match the flags in free_ringmemory()! */
-        ring->descbase = ssb_dma_alloc_consistent(ring->dev->dev,
-                                                  B43legacy_DMA_RINGMEMSIZE,
-                                                  &(ring->dmabase),
-                                                  GFP_KERNEL);
+        ring->descbase = dma_alloc_coherent(ring->dev->dev->dma_dev,
+                                            B43legacy_DMA_RINGMEMSIZE,
+                                            &(ring->dmabase),
+                                            GFP_KERNEL);
         if (!ring->descbase) {
                 b43legacyerr(ring->dev->wl, "DMA ringmemory allocation"
                              " failed\n");
@@ -476,8 +476,8 @@ static int alloc_ringmemory(struct b43legacy_dmaring *ring)
 
 static void free_ringmemory(struct b43legacy_dmaring *ring)
 {
-        ssb_dma_free_consistent(ring->dev->dev, B43legacy_DMA_RINGMEMSIZE,
-                                ring->descbase, ring->dmabase, GFP_KERNEL);
+        dma_free_coherent(ring->dev->dev->dma_dev, B43legacy_DMA_RINGMEMSIZE,
+                          ring->descbase, ring->dmabase);
 }
 
 /* Reset the RX DMA channel */
@@ -589,7 +589,7 @@ static bool b43legacy_dma_mapping_error(struct b43legacy_dmaring *ring,
                                          size_t buffersize,
                                          bool dma_to_device)
 {
-        if (unlikely(ssb_dma_mapping_error(ring->dev->dev, addr)))
+        if (unlikely(dma_mapping_error(ring->dev->dev->dma_dev, addr)))
                 return 1;
 
         switch (ring->type) {
@@ -906,7 +906,7 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev,
                         goto err_kfree_meta;
 
                 /* test for ability to dma to txhdr_cache */
-                dma_test = ssb_dma_map_single(dev->dev, ring->txhdr_cache,
+                dma_test = dma_map_single(dev->dev->dma_dev, ring->txhdr_cache,
                                               sizeof(struct b43legacy_txhdr_fw3),
                                               DMA_TO_DEVICE);
 
@@ -920,7 +920,7 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev,
                         if (!ring->txhdr_cache)
                                 goto err_kfree_meta;
 
-                        dma_test = ssb_dma_map_single(dev->dev,
+                        dma_test = dma_map_single(dev->dev->dma_dev,
                                         ring->txhdr_cache,
                                         sizeof(struct b43legacy_txhdr_fw3),
                                         DMA_TO_DEVICE);
@@ -930,9 +930,9 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev,
                                 goto err_kfree_txhdr_cache;
                 }
 
-                ssb_dma_unmap_single(dev->dev, dma_test,
-                                     sizeof(struct b43legacy_txhdr_fw3),
-                                     DMA_TO_DEVICE);
+                dma_unmap_single(dev->dev->dma_dev, dma_test,
+                                 sizeof(struct b43legacy_txhdr_fw3),
+                                 DMA_TO_DEVICE);
         }
 
         ring->nr_slots = nr_slots;
@@ -1040,9 +1040,12 @@ static int b43legacy_dma_set_mask(struct b43legacy_wldev *dev, u64 mask)
         /* Try to set the DMA mask. If it fails, try falling back to a
          * lower mask, as we can always also support a lower one. */
         while (1) {
-                err = ssb_dma_set_mask(dev->dev, mask);
-                if (!err)
-                        break;
+                err = dma_set_mask(dev->dev->dma_dev, mask);
+                if (!err) {
+                        err = dma_set_coherent_mask(dev->dev->dma_dev, mask);
+                        if (!err)
+                                break;
+                }
                 if (mask == DMA_BIT_MASK(64)) {
                         mask = DMA_BIT_MASK(32);
                         fallback = 1;
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index 231dbd77f5f5..9cadaa296fac 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -688,7 +688,7 @@ static void hostap_ap_tx_cb_assoc(struct sk_buff *skb, int ok, void *data)
         struct ap_data *ap = data;
         struct net_device *dev = ap->local->dev;
         struct ieee80211_hdr *hdr;
-        u16 fc, status;
+        u16 status;
         __le16 *pos;
         struct sta_info *sta = NULL;
         char *txt = NULL;
@@ -699,7 +699,6 @@ static void hostap_ap_tx_cb_assoc(struct sk_buff *skb, int ok, void *data)
         }
 
         hdr = (struct ieee80211_hdr *) skb->data;
-        fc = le16_to_cpu(hdr->frame_control);
         if ((!ieee80211_is_assoc_resp(hdr->frame_control) &&
              !ieee80211_is_reassoc_resp(hdr->frame_control)) ||
             skb->len < IEEE80211_MGMT_HDR_LEN + 4) {
diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index eb57d1ea361f..eaee84b55887 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -741,9 +741,7 @@ void hostap_set_multicast_list_queue(struct work_struct *work)
         local_info_t *local =
                 container_of(work, local_info_t, set_multicast_list_queue);
         struct net_device *dev = local->dev;
-        struct hostap_interface *iface;
 
-        iface = netdev_priv(dev);
         if (hostap_set_word(dev, HFA384X_RID_PROMISCUOUSMODE,
                             local->is_promisc)) {
                 printk(KERN_INFO "%s: %sabling promiscuous mode failed\n",
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 0bd4dfa59a8a..18ebd602670d 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -3467,10 +3467,8 @@ static int ipw2100_msg_allocate(struct ipw2100_priv *priv)
         dma_addr_t p;
 
         priv->msg_buffers =
-            (struct ipw2100_tx_packet *)kmalloc(IPW_COMMAND_POOL_SIZE *
-                                                sizeof(struct
-                                                       ipw2100_tx_packet),
-                                                GFP_KERNEL);
+            kmalloc(IPW_COMMAND_POOL_SIZE * sizeof(struct ipw2100_tx_packet),
+                    GFP_KERNEL);
         if (!priv->msg_buffers) {
                 printk(KERN_ERR DRV_NAME ": %s: PCI alloc failed for msg "
                        "buffers.\n", priv->net_dev->name);
@@ -4499,10 +4497,8 @@ static int ipw2100_tx_allocate(struct ipw2100_priv *priv)
         }
 
         priv->tx_buffers =
-            (struct ipw2100_tx_packet *)kmalloc(TX_PENDED_QUEUE_LENGTH *
-                                                sizeof(struct
-                                                       ipw2100_tx_packet),
-                                                GFP_ATOMIC);
+            kmalloc(TX_PENDED_QUEUE_LENGTH * sizeof(struct ipw2100_tx_packet),
+                    GFP_ATOMIC);
         if (!priv->tx_buffers) {
                 printk(KERN_ERR DRV_NAME
                        ": %s: alloc failed form tx buffers.\n",
@@ -4651,9 +4647,9 @@ static int ipw2100_rx_allocate(struct ipw2100_priv *priv)
         /*
          * allocate packets
          */
-        priv->rx_buffers = (struct ipw2100_rx_packet *)
-            kmalloc(RX_QUEUE_LENGTH * sizeof(struct ipw2100_rx_packet),
-                    GFP_KERNEL);
+        priv->rx_buffers = kmalloc(RX_QUEUE_LENGTH *
+                                   sizeof(struct ipw2100_rx_packet),
+                                   GFP_KERNEL);
         if (!priv->rx_buffers) {
                 IPW_DEBUG_INFO("can't allocate rx packet buffer table\n");
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 3aa3bb18f615..cb2552a6777c 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -96,7 +96,7 @@ static int network_mode = 0;
 static u32 ipw_debug_level;
 static int associate;
 static int auto_create = 1;
-static int led_support = 0;
+static int led_support = 1;
 static int disable = 0;
 static int bt_coexist = 0;
 static int hwcrypto = 0;
@@ -6624,13 +6624,12 @@ static int ipw_wx_set_genie(struct net_device *dev,
                 return -EINVAL;
 
         if (wrqu->data.length) {
-                buf = kmalloc(wrqu->data.length, GFP_KERNEL);
+                buf = kmemdup(extra, wrqu->data.length, GFP_KERNEL);
                 if (buf == NULL) {
                         err = -ENOMEM;
                         goto out;
                 }
 
-                memcpy(buf, extra, wrqu->data.length);
                 kfree(ieee->wpa_ie);
                 ieee->wpa_ie = buf;
                 ieee->wpa_ie_len = wrqu->data.length;
@@ -12083,7 +12082,7 @@ module_param(auto_create, int, 0444);
 MODULE_PARM_DESC(auto_create, "auto create adhoc network (default on)");
 
 module_param_named(led, led_support, int, 0444);
-MODULE_PARM_DESC(led, "enable led control on some systems (default 0 off)");
+MODULE_PARM_DESC(led, "enable led control on some systems (default 1 on)");
 
 module_param(debug, int, 0444);
 MODULE_PARM_DESC(debug, "debug output mask");
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index dc8ed1527666..6491e27baac5 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -30,9 +30,11 @@ config IWLWIFI_DEBUG
 
 config IWLWIFI_DEBUGFS
         bool "iwlagn debugfs support"
-        depends on IWLWIFI && IWLWIFI_DEBUG && MAC80211_DEBUGFS
+        depends on IWLWIFI && MAC80211_DEBUGFS
         ---help---
-          Enable creation of debugfs files for the iwlwifi drivers.
+          Enable creation of debugfs files for the iwlwifi drivers. This
+          is a low-impact option that allows getting insight into the
+          driver's state at runtime.
 
 config IWLWIFI_DEVICE_TRACING
         bool "iwlwifi device access tracing"
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index 7c7235385513..728bb858ba97 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -1,6 +1,6 @@
 obj-$(CONFIG_IWLWIFI)   += iwlcore.o
 iwlcore-objs            := iwl-core.o iwl-eeprom.o iwl-hcmd.o iwl-power.o
-iwlcore-objs            += iwl-rx.o iwl-tx.o iwl-sta.o iwl-calib.o
+iwlcore-objs            += iwl-rx.o iwl-tx.o iwl-sta.o
 iwlcore-objs            += iwl-scan.o iwl-led.o
 iwlcore-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-debugfs.o
 iwlcore-$(CONFIG_IWLWIFI_DEVICE_TRACING) += iwl-devtrace.o
@@ -11,7 +11,7 @@ CFLAGS_iwl-devtrace.o := -I$(src)
 obj-$(CONFIG_IWLAGN)    += iwlagn.o
 iwlagn-objs             := iwl-agn.o iwl-agn-rs.o iwl-agn-led.o iwl-agn-ict.o
 iwlagn-objs             += iwl-agn-ucode.o iwl-agn-hcmd.o iwl-agn-tx.o
-iwlagn-objs             += iwl-agn-lib.o
+iwlagn-objs             += iwl-agn-lib.o iwl-agn-rx.o iwl-agn-calib.o
 iwlagn-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-agn-debugfs.o
 
 iwlagn-$(CONFIG_IWL4965) += iwl-4965.o
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 6be2992f8f21..dba91e0233b6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -158,6 +158,8 @@ static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
                         BIT(IWL_CALIB_TX_IQ_PERD)       |
                         BIT(IWL_CALIB_BASE_BAND);
 
+        priv->hw_params.beacon_time_tsf_bits = IWLAGN_EXT_BEACON_TIME_POS;
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.c
index 6a9c64a50e36..ef0835b01b6b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.c
@@ -28,6 +28,28 @@
 
 #include "iwl-3945-debugfs.h"
 
+
+static int iwl3945_statistics_flag(struct iwl_priv *priv, char *buf, int bufsz)
+{
+        int p = 0;
+
+        p += scnprintf(buf + p, bufsz - p, "Statistics Flag(0x%X):\n",
+                       le32_to_cpu(priv->_3945.statistics.flag));
+        if (le32_to_cpu(priv->_3945.statistics.flag) &
+                        UCODE_STATISTICS_CLEAR_MSK)
+                p += scnprintf(buf + p, bufsz - p,
+                               "\tStatistics have been cleared\n");
+        p += scnprintf(buf + p, bufsz - p, "\tOperational Frequency: %s\n",
+                       (le32_to_cpu(priv->_3945.statistics.flag) &
+                        UCODE_STATISTICS_FREQUENCY_MSK)
+                        ? "2.4 GHz" : "5.2 GHz");
+        p += scnprintf(buf + p, bufsz - p, "\tTGj Narrow Band: %s\n",
+                       (le32_to_cpu(priv->_3945.statistics.flag) &
+                        UCODE_STATISTICS_NARROW_BAND_MSK)
+                        ? "enabled" : "disabled");
+        return p;
+}
+
 ssize_t iwl3945_ucode_rx_stats_read(struct file *file,
                                     char __user *user_buf,
                                     size_t count, loff_t *ppos)
@@ -70,7 +92,7 @@ ssize_t iwl3945_ucode_rx_stats_read(struct file *file,
         max_cck = &priv->_3945.max_delta.rx.cck;
         max_general = &priv->_3945.max_delta.rx.general;
 
-        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += iwl3945_statistics_flag(priv, buf, bufsz);
         pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
                          "acumulative       delta         max\n",
                          "Statistics_Rx - OFDM:");
@@ -331,7 +353,7 @@ ssize_t iwl3945_ucode_tx_stats_read(struct file *file,
         accum_tx = &priv->_3945.accum_statistics.tx;
         delta_tx = &priv->_3945.delta_statistics.tx;
         max_tx = &priv->_3945.max_delta.tx;
-        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += iwl3945_statistics_flag(priv, buf, bufsz);
         pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
                          "acumulative       delta         max\n",
                          "Statistics_Tx:");
@@ -438,7 +460,7 @@ ssize_t iwl3945_ucode_general_stats_read(struct file *file,
         accum_div = &priv->_3945.accum_statistics.general.div;
         delta_div = &priv->_3945.delta_statistics.general.div;
         max_div = &priv->_3945.max_delta.general.div;
-        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += iwl3945_statistics_flag(priv, buf, bufsz);
         pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
                          "acumulative       delta         max\n",
                          "Statistics_General:");
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index c44a303e62ed..93d513e14186 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -279,8 +279,8 @@ static void iwl3945_tx_queue_reclaim(struct iwl_priv *priv,
                 q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
 
                 tx_info = &txq->txb[txq->q.read_ptr];
-                ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb[0]);
-                tx_info->skb[0] = NULL;
+                ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb);
+                tx_info->skb = NULL;
                 priv->cfg->ops->lib->txq_free_tfd(priv, txq);
         }
 
@@ -315,7 +315,7 @@ static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
                 return;
         }
 
-        info = IEEE80211_SKB_CB(txq->txb[txq->q.read_ptr].skb[0]);
+        info = IEEE80211_SKB_CB(txq->txb[txq->q.read_ptr].skb);
         ieee80211_tx_info_clear_status(info);
 
         /* Fill the MRR chain with some info about on-chip retransmissions */
@@ -352,7 +352,7 @@ static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
  *  RX handler implementations
  *
  *****************************************************************************/
-#ifdef CONFIG_IWLWIFI_DEBUG
+#ifdef CONFIG_IWLWIFI_DEBUGFS
 /*
  *  based on the assumption of all statistics counter are in DWORD
  *  FIXME: This function is for debugging, do not deal with
@@ -460,7 +460,7 @@ void iwl3945_hw_rx_statistics(struct iwl_priv *priv,
         IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
                      (int)sizeof(struct iwl3945_notif_statistics),
                      le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
-#ifdef CONFIG_IWLWIFI_DEBUG
+#ifdef CONFIG_IWLWIFI_DEBUGFS
         iwl3945_accumulative_statistics(priv, (__le32 *)&pkt->u.raw);
 #endif
         iwl_recover_from_statistics(priv, pkt);
@@ -475,7 +475,7 @@ void iwl3945_reply_statistics(struct iwl_priv *priv,
         __le32 *flag = (__le32 *)&pkt->u.raw;
 
         if (le32_to_cpu(*flag) & UCODE_STATISTICS_CLEAR_MSK) {
-#ifdef CONFIG_IWLWIFI_DEBUG
+#ifdef CONFIG_IWLWIFI_DEBUGFS
                 memset(&priv->_3945.accum_statistics, 0,
                         sizeof(struct iwl3945_notif_statistics));
                 memset(&priv->_3945.delta_statistics, 0,
@@ -494,158 +494,6 @@ void iwl3945_reply_statistics(struct iwl_priv *priv,
  * Misc. internal state and helper functions
  *
  ******************************************************************************/
-#ifdef CONFIG_IWLWIFI_DEBUG
-
-/**
- * iwl3945_report_frame - dump frame to syslog during debug sessions
- *
- * You may hack this function to show different aspects of received frames,
- * including selective frame dumps.
- * group100 parameter selects whether to show 1 out of 100 good frames.
- */
-static void _iwl3945_dbg_report_frame(struct iwl_priv *priv,
-                      struct iwl_rx_packet *pkt,
-                      struct ieee80211_hdr *header, int group100)
-{
-        u32 to_us;
-        u32 print_summary = 0;
-        u32 print_dump = 0;     /* set to 1 to dump all frames' contents */
-        u32 hundred = 0;
-        u32 dataframe = 0;
-        __le16 fc;
-        u16 seq_ctl;
-        u16 channel;
-        u16 phy_flags;
-        u16 length;
-        u16 status;
-        u16 bcn_tmr;
-        u32 tsf_low;
-        u64 tsf;
-        u8 rssi;
-        u8 agc;
-        u16 sig_avg;
-        u16 noise_diff;
-        struct iwl3945_rx_frame_stats *rx_stats = IWL_RX_STATS(pkt);
-        struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
-        struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
-        u8 *data = IWL_RX_DATA(pkt);
-
-        /* MAC header */
-        fc = header->frame_control;
-        seq_ctl = le16_to_cpu(header->seq_ctrl);
-
-        /* metadata */
-        channel = le16_to_cpu(rx_hdr->channel);
-        phy_flags = le16_to_cpu(rx_hdr->phy_flags);
-        length = le16_to_cpu(rx_hdr->len);
-
-        /* end-of-frame status and timestamp */
-        status = le32_to_cpu(rx_end->status);
-        bcn_tmr = le32_to_cpu(rx_end->beacon_timestamp);
-        tsf_low = le64_to_cpu(rx_end->timestamp) & 0x0ffffffff;
-        tsf = le64_to_cpu(rx_end->timestamp);
-
-        /* signal statistics */
-        rssi = rx_stats->rssi;
-        agc = rx_stats->agc;
-        sig_avg = le16_to_cpu(rx_stats->sig_avg);
-        noise_diff = le16_to_cpu(rx_stats->noise_diff);
-
-        to_us = !compare_ether_addr(header->addr1, priv->mac_addr);
-
-        /* if data frame is to us and all is good,
-         *   (optionally) print summary for only 1 out of every 100 */
-        if (to_us && (fc & ~cpu_to_le16(IEEE80211_FCTL_PROTECTED)) ==
-            cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FTYPE_DATA)) {
-                dataframe = 1;
-                if (!group100)
-                        print_summary = 1;      /* print each frame */
-                else if (priv->framecnt_to_us < 100) {
-                        priv->framecnt_to_us++;
-                        print_summary = 0;
-                } else {
-                        priv->framecnt_to_us = 0;
-                        print_summary = 1;
-                        hundred = 1;
-                }
-        } else {
-                /* print summary for all other frames */
-                print_summary = 1;
-        }
-
-        if (print_summary) {
-                char *title;
-                int rate;
-
-                if (hundred)
-                        title = "100Frames";
-                else if (ieee80211_has_retry(fc))
-                        title = "Retry";
-                else if (ieee80211_is_assoc_resp(fc))
-                        title = "AscRsp";
-                else if (ieee80211_is_reassoc_resp(fc))
-                        title = "RasRsp";
-                else if (ieee80211_is_probe_resp(fc)) {
-                        title = "PrbRsp";
-                        print_dump = 1; /* dump frame contents */
-                } else if (ieee80211_is_beacon(fc)) {
-                        title = "Beacon";
-                        print_dump = 1; /* dump frame contents */
-                } else if (ieee80211_is_atim(fc))
-                        title = "ATIM";
-                else if (ieee80211_is_auth(fc))
-                        title = "Auth";
-                else if (ieee80211_is_deauth(fc))
-                        title = "DeAuth";
-                else if (ieee80211_is_disassoc(fc))
-                        title = "DisAssoc";
-                else
-                        title = "Frame";
-
-                rate = iwl3945_hwrate_to_plcp_idx(rx_hdr->rate);
-                if (rate == -1)
-                        rate = 0;
-                else
-                        rate = iwl3945_rates[rate].ieee / 2;
-
-                /* print frame summary.
-                 * MAC addresses show just the last byte (for brevity),
-                 *    but you can hack it to show more, if you'd like to. */
-                if (dataframe)
-                        IWL_DEBUG_RX(priv, "%s: mhd=0x%04x, dst=0x%02x, "
-                                     "len=%u, rssi=%d, chnl=%d, rate=%d,\n",
-                                     title, le16_to_cpu(fc), header->addr1[5],
-                                     length, rssi, channel, rate);
-                else {
-                        /* src/dst addresses assume managed mode */
-                        IWL_DEBUG_RX(priv, "%s: 0x%04x, dst=0x%02x, "
-                                     "src=0x%02x, rssi=%u, tim=%lu usec, "
-                                     "phy=0x%02x, chnl=%d\n",
-                                     title, le16_to_cpu(fc), header->addr1[5],
-                                     header->addr3[5], rssi,
-                                     tsf_low - priv->scan_start_tsf,
-                                     phy_flags, channel);
-                }
-        }
-        if (print_dump)
-                iwl_print_hex_dump(priv, IWL_DL_RX, data, length);
-}
-
-static void iwl3945_dbg_report_frame(struct iwl_priv *priv,
-                      struct iwl_rx_packet *pkt,
-                      struct ieee80211_hdr *header, int group100)
-{
-        if (iwl_get_debug_level(priv) & IWL_DL_RX)
-                _iwl3945_dbg_report_frame(priv, pkt, header, group100);
-}
-
-#else
-static inline void iwl3945_dbg_report_frame(struct iwl_priv *priv,
-                      struct iwl_rx_packet *pkt,
-                      struct ieee80211_hdr *header, int group100)
-{
-}
-#endif
 
 /* This is necessary only for a number of statistics, see the caller. */
 static int iwl3945_is_network_packet(struct iwl_priv *priv,
@@ -777,8 +625,6 @@ static void iwl3945_rx_reply_rx(struct iwl_priv *priv,
                               rx_status.signal, rx_status.signal,
                               rx_status.rate_idx);
 
-        /* Set "1" to report good data frames in groups of 100 */
-        iwl3945_dbg_report_frame(priv, pkt, header, 1);
         iwl_dbg_log_rx_data_frame(priv, le16_to_cpu(rx_hdr->len), header);
 
         if (network_packet) {
@@ -850,25 +696,28 @@ void iwl3945_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq)
         /* Unmap tx_cmd */
         if (counter)
                 pci_unmap_single(dev,
-                                pci_unmap_addr(&txq->meta[index], mapping),
-                                pci_unmap_len(&txq->meta[index], len),
+                                dma_unmap_addr(&txq->meta[index], mapping),
+                                dma_unmap_len(&txq->meta[index], len),
                                 PCI_DMA_TODEVICE);
 
         /* unmap chunks if any */
 
-        for (i = 1; i < counter; i++) {
+        for (i = 1; i < counter; i++)
                 pci_unmap_single(dev, le32_to_cpu(tfd->tbs[i].addr),
                          le32_to_cpu(tfd->tbs[i].len), PCI_DMA_TODEVICE);
-                if (txq->txb[txq->q.read_ptr].skb[0]) {
-                        struct sk_buff *skb = txq->txb[txq->q.read_ptr].skb[0];
-                        if (txq->txb[txq->q.read_ptr].skb[0]) {
-                                /* Can be called from interrupt context */
-                                dev_kfree_skb_any(skb);
-                                txq->txb[txq->q.read_ptr].skb[0] = NULL;
-                        }
+
+        /* free SKB */
+        if (txq->txb) {
+                struct sk_buff *skb;
+
+                skb = txq->txb[txq->q.read_ptr].skb;
+
+                /* can be called from irqs-disabled context */
+                if (skb) {
+                        dev_kfree_skb_any(skb);
+                        txq->txb[txq->q.read_ptr].skb = NULL;
                 }
         }
-        return ;
 }
 
 /**
@@ -947,8 +796,7 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv,
                        tx_cmd->supp_rates[1], tx_cmd->supp_rates[0]);
 }
 
-static u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id,
-                           u16 tx_rate, u8 flags)
+static u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id, u16 tx_rate)
 {
         unsigned long flags_spin;
         struct iwl_station_entry *station;
@@ -962,10 +810,9 @@ static u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id,
         station->sta.sta.modify_mask = STA_MODIFY_TX_RATE_MSK;
         station->sta.rate_n_flags = cpu_to_le16(tx_rate);
         station->sta.mode = STA_CONTROL_MODIFY_MSK;
-
+        iwl_send_add_sta(priv, &station->sta, CMD_ASYNC);
         spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
 
-        iwl_send_add_sta(priv, &station->sta, flags);
         IWL_DEBUG_RATE(priv, "SCALE sync station %d to rate %d\n",
                         sta_id, tx_rate);
         return sta_id;
@@ -997,7 +844,7 @@ static int iwl3945_set_pwr_src(struct iwl_priv *priv, enum iwl_pwr_src src)
 
 static int iwl3945_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
 {
-        iwl_write_direct32(priv, FH39_RCSR_RBD_BASE(0), rxq->dma_addr);
+        iwl_write_direct32(priv, FH39_RCSR_RBD_BASE(0), rxq->bd_dma);
         iwl_write_direct32(priv, FH39_RCSR_RPTR_ADDR(0), rxq->rb_stts_dma);
         iwl_write_direct32(priv, FH39_RCSR_WPTR(0), 0);
         iwl_write_direct32(priv, FH39_RCSR_CONFIG(0),
@@ -2473,8 +2320,7 @@ static int iwl3945_manage_ibss_station(struct iwl_priv *priv,
 
                 iwl3945_sync_sta(priv, vif_priv->ibss_bssid_sta_id,
                                  (priv->band == IEEE80211_BAND_5GHZ) ?
-                                 IWL_RATE_6M_PLCP : IWL_RATE_1M_PLCP,
-                                 CMD_ASYNC);
+                                 IWL_RATE_6M_PLCP : IWL_RATE_1M_PLCP);
                 iwl3945_rate_scale_init(priv->hw, vif_priv->ibss_bssid_sta_id);
 
                 return 0;
@@ -2590,6 +2436,7 @@ int iwl3945_hw_set_hw_params(struct iwl_priv *priv)
 
         priv->hw_params.rx_wrt_ptr_reg = FH39_RSCSR_CHNL0_WPTR;
         priv->hw_params.max_beacon_itrvl = IWL39_MAX_UCODE_BEACON_INTERVAL;
+        priv->hw_params.beacon_time_tsf_bits = IWL3945_EXT_BEACON_TIME_POS;
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index d3afddae8d9f..67526a1be025 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -346,9 +346,19 @@ static void iwl4965_chain_noise_reset(struct iwl_priv *priv)
 {
         struct iwl_chain_noise_data *data = &(priv->chain_noise_data);
 
-        if ((data->state == IWL_CHAIN_NOISE_ALIVE) && iwl_is_associated(priv)) {
+        if ((data->state == IWL_CHAIN_NOISE_ALIVE) &&
+             iwl_is_associated(priv)) {
                 struct iwl_calib_diff_gain_cmd cmd;
 
+                /* clear data for chain noise calibration algorithm */
+                data->chain_noise_a = 0;
+                data->chain_noise_b = 0;
+                data->chain_noise_c = 0;
+                data->chain_signal_a = 0;
+                data->chain_signal_b = 0;
+                data->chain_signal_c = 0;
+                data->beacon_count = 0;
+
                 memset(&cmd, 0, sizeof(cmd));
                 cmd.hdr.op_code = IWL_PHY_CALIBRATE_DIFF_GAIN_CMD;
                 cmd.diff_gain_a = 0;
@@ -419,13 +429,6 @@ static void iwl4965_gain_computation(struct iwl_priv *priv,
                 /* Mark so we run this algo only once! */
                 data->state = IWL_CHAIN_NOISE_CALIBRATED;
         }
-        data->chain_noise_a = 0;
-        data->chain_noise_b = 0;
-        data->chain_noise_c = 0;
-        data->chain_signal_a = 0;
-        data->chain_signal_b = 0;
-        data->chain_signal_c = 0;
-        data->beacon_count = 0;
 }
 
 static void iwl4965_bg_txpower_work(struct work_struct *work)
@@ -669,6 +672,7 @@ static int iwl4965_hw_set_hw_params(struct iwl_priv *priv)
                 priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
 
         priv->hw_params.sens = &iwl4965_sensitivity;
+        priv->hw_params.beacon_time_tsf_bits = IWLAGN_EXT_BEACON_TIME_POS;
 
         return 0;
 }
@@ -1441,7 +1445,8 @@ static int iwl4965_send_rxon_assoc(struct iwl_priv *priv)
         return ret;
 }
 
-static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
+static int iwl4965_hw_channel_switch(struct iwl_priv *priv,
+                                     struct ieee80211_channel_switch *ch_switch)
 {
         int rc;
         u8 band = 0;
@@ -1449,11 +1454,14 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
         u8 ctrl_chan_high = 0;
         struct iwl4965_channel_switch_cmd cmd;
         const struct iwl_channel_info *ch_info;
-
+        u32 switch_time_in_usec, ucode_switch_time;
+        u16 ch;
+        u32 tsf_low;
+        u8 switch_count;
+        u16 beacon_interval = le16_to_cpu(priv->rxon_timing.beacon_interval);
+        struct ieee80211_vif *vif = priv->vif;
         band = priv->band == IEEE80211_BAND_2GHZ;
 
-        ch_info = iwl_get_channel_info(priv, priv->band, channel);
-
         is_ht40 = is_ht40_channel(priv->staging_rxon.flags);
 
         if (is_ht40 &&
@@ -1462,26 +1470,56 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
 
         cmd.band = band;
         cmd.expect_beacon = 0;
-        cmd.channel = cpu_to_le16(channel);
+        ch = ieee80211_frequency_to_channel(ch_switch->channel->center_freq);
+        cmd.channel = cpu_to_le16(ch);
         cmd.rxon_flags = priv->staging_rxon.flags;
         cmd.rxon_filter_flags = priv->staging_rxon.filter_flags;
-        cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+        switch_count = ch_switch->count;
+        tsf_low = ch_switch->timestamp & 0x0ffffffff;
+        /*
+         * calculate the ucode channel switch time
+         * adding TSF as one of the factor for when to switch
+         */
+        if ((priv->ucode_beacon_time > tsf_low) && beacon_interval) {
+                if (switch_count > ((priv->ucode_beacon_time - tsf_low) /
+                    beacon_interval)) {
+                        switch_count -= (priv->ucode_beacon_time -
+                                tsf_low) / beacon_interval;
+                } else
+                        switch_count = 0;
+        }
+        if (switch_count <= 1)
+                cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+        else {
+                switch_time_in_usec =
+                        vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
+                ucode_switch_time = iwl_usecs_to_beacons(priv,
+                                                         switch_time_in_usec,
+                                                         beacon_interval);
+                cmd.switch_time = iwl_add_beacon_time(priv,
+                                                      priv->ucode_beacon_time,
+                                                      ucode_switch_time,
+                                                      beacon_interval);
+        }
+        IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
+                      cmd.switch_time);
+        ch_info = iwl_get_channel_info(priv, priv->band, ch);
         if (ch_info)
                 cmd.expect_beacon = is_channel_radar(ch_info);
         else {
                 IWL_ERR(priv, "invalid channel switch from %u to %u\n",
-                        priv->active_rxon.channel, channel);
+                        priv->active_rxon.channel, ch);
                 return -EFAULT;
         }
 
-        rc = iwl4965_fill_txpower_tbl(priv, band, channel, is_ht40,
+        rc = iwl4965_fill_txpower_tbl(priv, band, ch, is_ht40,
                                       ctrl_chan_high, &cmd.tx_power);
         if (rc) {
                 IWL_DEBUG_11H(priv, "error:%d  fill txpower_tbl\n", rc);
                 return rc;
         }
 
-        priv->switch_rxon.channel = cpu_to_le16(channel);
+        priv->switch_rxon.channel = cmd.channel;
         priv->switch_rxon.switch_in_progress = true;
 
         return iwl_send_cmd_pdu(priv, REPLY_CHANNEL_SWITCH, sizeof(cmd), &cmd);
@@ -1542,7 +1580,8 @@ static int iwl4965_hw_get_temperature(struct iwl_priv *priv)
         u32 R4;
 
         if (test_bit(STATUS_TEMPERATURE, &priv->status) &&
-                (priv->statistics.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)) {
+            (priv->_agn.statistics.flag &
+                        STATISTICS_REPLY_FLG_HT40_MODE_MSK)) {
                 IWL_DEBUG_TEMP(priv, "Running HT40 temperature calibration\n");
                 R1 = (s32)le32_to_cpu(priv->card_alive_init.therm_r1[1]);
                 R2 = (s32)le32_to_cpu(priv->card_alive_init.therm_r2[1]);
@@ -1566,8 +1605,8 @@ static int iwl4965_hw_get_temperature(struct iwl_priv *priv)
         if (!test_bit(STATUS_TEMPERATURE, &priv->status))
                 vt = sign_extend(R4, 23);
         else
-                vt = sign_extend(
-                        le32_to_cpu(priv->statistics.general.temperature), 23);
+                vt = sign_extend(le32_to_cpu(
+                                priv->_agn.statistics.general.temperature), 23);
 
         IWL_DEBUG_TEMP(priv, "Calib values R[1-3]: %d %d %d R4: %d\n", R1, R2, R3, vt);
 
@@ -1747,6 +1786,7 @@ static int iwl4965_txq_agg_enable(struct iwl_priv *priv, int txq_id,
 {
         unsigned long flags;
         u16 ra_tid;
+        int ret;
 
         if ((IWL49_FIRST_AMPDU_QUEUE > txq_id) ||
             (IWL49_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
@@ -1762,7 +1802,9 @@ static int iwl4965_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         ra_tid = BUILD_RAxTID(sta_id, tid);
 
         /* Modify device's station table to Tx this TID */
-        iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
+        ret = iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
+        if (ret)
+                return ret;
 
         spin_lock_irqsave(&priv->lock, flags);
 
@@ -1870,7 +1912,7 @@ static int iwl4965_tx_status_reply_tx(struct iwl_priv *priv,
                 IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, StartIdx=%d idx=%d\n",
                                    agg->frame_count, agg->start_idx, idx);
 
-                info = IEEE80211_SKB_CB(priv->txq[txq_id].txb[idx].skb[0]);
+                info = IEEE80211_SKB_CB(priv->txq[txq_id].txb[idx].skb);
                 info->status.rates[0].count = tx_resp->failure_frame + 1;
                 info->flags &= ~IEEE80211_TX_CTL_AMPDU;
                 info->flags |= iwl_tx_status_to_mac80211(status);
@@ -2026,6 +2068,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
         int sta_id;
         int freed;
         u8 *qc = NULL;
+        unsigned long flags;
 
         if ((index >= txq->q.n_bd) || (iwl_queue_used(&txq->q, index) == 0)) {
                 IWL_ERR(priv, "Read index for DMA queue txq_id (%d) index %d "
@@ -2035,7 +2078,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                 return;
         }
 
-        info = IEEE80211_SKB_CB(txq->txb[txq->q.read_ptr].skb[0]);
+        info = IEEE80211_SKB_CB(txq->txb[txq->q.read_ptr].skb);
         memset(&info->status, 0, sizeof(info->status));
 
         hdr = iwl_tx_queue_get_hdr(priv, txq_id, index);
@@ -2050,10 +2093,10 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                 return;
         }
 
+        spin_lock_irqsave(&priv->sta_lock, flags);
         if (txq->sched_retry) {
                 const u32 scd_ssn = iwl4965_get_scd_ssn(tx_resp);
                 struct iwl_ht_agg *agg = NULL;
-
                 WARN_ON(!qc);
 
                 agg = &priv->stations[sta_id].tid[tid].agg;
@@ -2110,6 +2153,8 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                 iwlagn_txq_check_empty(priv, sta_id, tid, txq_id);
 
         iwl_check_abort_status(priv, tx_resp->frame_count, status);
+
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
 
 static int iwl4965_calc_rssi(struct iwl_priv *priv,
@@ -2285,7 +2330,7 @@ struct iwl_cfg iwl4965_agn_cfg = {
          * Force use of chains B and C for scan RX on 5 GHz band
          * because the device has off-channel reception on chain A.
          */
-        .scan_antennas[IEEE80211_BAND_5GHZ] = ANT_BC,
+        .scan_rx_antennas[IEEE80211_BAND_5GHZ] = ANT_BC,
 };
 
 /* Module firmware */
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index a28af7eb67eb..c6ccc25d6c13 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -208,6 +208,8 @@ static int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
                 BIT(IWL_CALIB_TX_IQ_PERD)       |
                 BIT(IWL_CALIB_BASE_BAND);
 
+        priv->hw_params.beacon_time_tsf_bits = IWLAGN_EXT_BEACON_TIME_POS;
+
         return 0;
 }
 
@@ -252,6 +254,8 @@ static int iwl5150_hw_set_hw_params(struct iwl_priv *priv)
                 BIT(IWL_CALIB_TX_IQ)            |
                 BIT(IWL_CALIB_BASE_BAND);
 
+        priv->hw_params.beacon_time_tsf_bits = IWLAGN_EXT_BEACON_TIME_POS;
+
         return 0;
 }
 
@@ -260,40 +264,76 @@ static void iwl5150_temperature(struct iwl_priv *priv)
         u32 vt = 0;
         s32 offset =  iwl_temp_calib_to_offset(priv);
 
-        vt = le32_to_cpu(priv->statistics.general.temperature);
+        vt = le32_to_cpu(priv->_agn.statistics.general.temperature);
         vt = vt / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF + offset;
         /* now vt hold the temperature in Kelvin */
         priv->temperature = KELVIN_TO_CELSIUS(vt);
         iwl_tt_handler(priv);
 }
 
-static int iwl5000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
+static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
+                                     struct ieee80211_channel_switch *ch_switch)
 {
         struct iwl5000_channel_switch_cmd cmd;
         const struct iwl_channel_info *ch_info;
+        u32 switch_time_in_usec, ucode_switch_time;
+        u16 ch;
+        u32 tsf_low;
+        u8 switch_count;
+        u16 beacon_interval = le16_to_cpu(priv->rxon_timing.beacon_interval);
+        struct ieee80211_vif *vif = priv->vif;
         struct iwl_host_cmd hcmd = {
                 .id = REPLY_CHANNEL_SWITCH,
                 .len = sizeof(cmd),
-                .flags = CMD_SIZE_HUGE,
+                .flags = CMD_SYNC,
                 .data = &cmd,
         };
 
-        IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
-                priv->active_rxon.channel, channel);
         cmd.band = priv->band == IEEE80211_BAND_2GHZ;
-        cmd.channel = cpu_to_le16(channel);
+        ch = ieee80211_frequency_to_channel(ch_switch->channel->center_freq);
+        IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
+                priv->active_rxon.channel, ch);
+        cmd.channel = cpu_to_le16(ch);
         cmd.rxon_flags = priv->staging_rxon.flags;
         cmd.rxon_filter_flags = priv->staging_rxon.filter_flags;
-        cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
-        ch_info = iwl_get_channel_info(priv, priv->band, channel);
+        switch_count = ch_switch->count;
+        tsf_low = ch_switch->timestamp & 0x0ffffffff;
+        /*
+         * calculate the ucode channel switch time
+         * adding TSF as one of the factor for when to switch
+         */
+        if ((priv->ucode_beacon_time > tsf_low) && beacon_interval) {
+                if (switch_count > ((priv->ucode_beacon_time - tsf_low) /
+                    beacon_interval)) {
+                        switch_count -= (priv->ucode_beacon_time -
+                                tsf_low) / beacon_interval;
+                } else
+                        switch_count = 0;
+        }
+        if (switch_count <= 1)
+                cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+        else {
+                switch_time_in_usec =
+                        vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
+                ucode_switch_time = iwl_usecs_to_beacons(priv,
+                                                         switch_time_in_usec,
+                                                         beacon_interval);
+                cmd.switch_time = iwl_add_beacon_time(priv,
+                                                      priv->ucode_beacon_time,
+                                                      ucode_switch_time,
+                                                      beacon_interval);
+        }
+        IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
+                      cmd.switch_time);
+        ch_info = iwl_get_channel_info(priv, priv->band, ch);
         if (ch_info)
                 cmd.expect_beacon = is_channel_radar(ch_info);
         else {
                 IWL_ERR(priv, "invalid channel switch from %u to %u\n",
-                        priv->active_rxon.channel, channel);
+                        priv->active_rxon.channel, ch);
                 return -EFAULT;
         }
-        priv->switch_rxon.channel = cpu_to_le16(channel);
+        priv->switch_rxon.channel = cmd.channel;
         priv->switch_rxon.switch_in_progress = true;
 
         return iwl_send_cmd_sync(priv, &hcmd);
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 9fbf54cd3e1a..afdeec56b13f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -71,6 +71,10 @@
 #define _IWL6000G2A_MODULE_FIRMWARE(api) IWL6000G2A_FW_PRE #api ".ucode"
 #define IWL6000G2A_MODULE_FIRMWARE(api) _IWL6000G2A_MODULE_FIRMWARE(api)
 
+#define IWL6000G2B_FW_PRE "iwlwifi-6000g2b-"
+#define _IWL6000G2B_MODULE_FIRMWARE(api) IWL6000G2B_FW_PRE #api ".ucode"
+#define IWL6000G2B_MODULE_FIRMWARE(api) _IWL6000G2B_MODULE_FIRMWARE(api)
+
 
 static void iwl6000_set_ct_threshold(struct iwl_priv *priv)
 {
@@ -183,6 +187,8 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
                 BIT(IWL_CALIB_TX_IQ)            |
                 BIT(IWL_CALIB_BASE_BAND);
 
+        priv->hw_params.beacon_time_tsf_bits = IWLAGN_EXT_BEACON_TIME_POS;
+
         return 0;
 }
 
@@ -228,37 +234,74 @@ static int iwl6050_hw_set_hw_params(struct iwl_priv *priv)
                 BIT(IWL_CALIB_TX_IQ)            |
                 BIT(IWL_CALIB_BASE_BAND);
 
+        priv->hw_params.beacon_time_tsf_bits = IWLAGN_EXT_BEACON_TIME_POS;
+
         return 0;
 }
 
-static int iwl6000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
+static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
+                                     struct ieee80211_channel_switch *ch_switch)
 {
         struct iwl6000_channel_switch_cmd cmd;
         const struct iwl_channel_info *ch_info;
+        u32 switch_time_in_usec, ucode_switch_time;
+        u16 ch;
+        u32 tsf_low;
+        u8 switch_count;
+        u16 beacon_interval = le16_to_cpu(priv->rxon_timing.beacon_interval);
+        struct ieee80211_vif *vif = priv->vif;
         struct iwl_host_cmd hcmd = {
                 .id = REPLY_CHANNEL_SWITCH,
                 .len = sizeof(cmd),
-                .flags = CMD_SIZE_HUGE,
+                .flags = CMD_SYNC,
                 .data = &cmd,
         };
 
-        IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
-                priv->active_rxon.channel, channel);
-
         cmd.band = priv->band == IEEE80211_BAND_2GHZ;
-        cmd.channel = cpu_to_le16(channel);
+        ch = ieee80211_frequency_to_channel(ch_switch->channel->center_freq);
+        IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
+                      priv->active_rxon.channel, ch);
+        cmd.channel = cpu_to_le16(ch);
         cmd.rxon_flags = priv->staging_rxon.flags;
         cmd.rxon_filter_flags = priv->staging_rxon.filter_flags;
-        cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
-        ch_info = iwl_get_channel_info(priv, priv->band, channel);
+        switch_count = ch_switch->count;
+        tsf_low = ch_switch->timestamp & 0x0ffffffff;
+        /*
+         * calculate the ucode channel switch time
+         * adding TSF as one of the factor for when to switch
+         */
+        if ((priv->ucode_beacon_time > tsf_low) && beacon_interval) {
+                if (switch_count > ((priv->ucode_beacon_time - tsf_low) /
+                    beacon_interval)) {
+                        switch_count -= (priv->ucode_beacon_time -
+                                tsf_low) / beacon_interval;
+                } else
+                        switch_count = 0;
+        }
+        if (switch_count <= 1)
+                cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+        else {
+                switch_time_in_usec =
+                        vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
+                ucode_switch_time = iwl_usecs_to_beacons(priv,
+                                                         switch_time_in_usec,
+                                                         beacon_interval);
+                cmd.switch_time = iwl_add_beacon_time(priv,
+                                                      priv->ucode_beacon_time,
+                                                      ucode_switch_time,
+                                                      beacon_interval);
+        }
+        IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
+                      cmd.switch_time);
+        ch_info = iwl_get_channel_info(priv, priv->band, ch);
         if (ch_info)
                 cmd.expect_beacon = is_channel_radar(ch_info);
         else {
                 IWL_ERR(priv, "invalid channel switch from %u to %u\n",
-                        priv->active_rxon.channel, channel);
+                        priv->active_rxon.channel, ch);
                 return -EFAULT;
         }
-        priv->switch_rxon.channel = cpu_to_le16(channel);
+        priv->switch_rxon.channel = cmd.channel;
         priv->switch_rxon.switch_in_progress = true;
 
         return iwl_send_cmd_sync(priv, &hcmd);
@@ -335,6 +378,25 @@ static const struct iwl_ops iwl6000_ops = {
         .led = &iwlagn_led_ops,
 };
 
+static void do_not_send_bt_config(struct iwl_priv *priv)
+{
+}
+
+static struct iwl_hcmd_ops iwl6000g2b_hcmd = {
+        .rxon_assoc = iwlagn_send_rxon_assoc,
+        .commit_rxon = iwl_commit_rxon,
+        .set_rxon_chain = iwl_set_rxon_chain,
+        .set_tx_ant = iwlagn_send_tx_ant_config,
+        .send_bt_config = do_not_send_bt_config,
+};
+
+static const struct iwl_ops iwl6000g2b_ops = {
+        .lib = &iwl6000_lib,
+        .hcmd = &iwl6000g2b_hcmd,
+        .utils = &iwlagn_hcmd_utils,
+        .led = &iwlagn_led_ops,
+};
+
 static struct iwl_lib_ops iwl6050_lib = {
         .set_hw_params = iwl6050_hw_set_hw_params,
         .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
@@ -445,6 +507,268 @@ struct iwl_cfg iwl6000g2a_2agn_cfg = {
         .chain_noise_calib_by_driver = true,
 };
 
+struct iwl_cfg iwl6000g2a_2abg_cfg = {
+        .name = "6000 Series 2x2 ABG Gen2a",
+        .fw_name_pre = IWL6000G2A_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G,
+        .ops = &iwl6000_ops,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
+        .pa_type = IWL_PA_SYSTEM,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .shadow_ram_support = true,
+        .led_compensation = 51,
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+};
+
+struct iwl_cfg iwl6000g2a_2bg_cfg = {
+        .name = "6000 Series 2x2 BG Gen2a",
+        .fw_name_pre = IWL6000G2A_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
+        .sku = IWL_SKU_G,
+        .ops = &iwl6000_ops,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
+        .pa_type = IWL_PA_SYSTEM,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .shadow_ram_support = true,
+        .led_compensation = 51,
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+};
+
+struct iwl_cfg iwl6000g2b_2agn_cfg = {
+        .name = "6000 Series 2x2 AGN Gen2b",
+        .fw_name_pre = IWL6000G2B_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
+        .ops = &iwl6000g2b_ops,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
+        .pa_type = IWL_PA_SYSTEM,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .shadow_ram_support = true,
+        .ht_greenfield_support = true,
+        .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+};
+
+struct iwl_cfg iwl6000g2b_2abg_cfg = {
+        .name = "6000 Series 2x2 ABG Gen2b",
+        .fw_name_pre = IWL6000G2B_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G,
+        .ops = &iwl6000g2b_ops,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
+        .pa_type = IWL_PA_SYSTEM,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .shadow_ram_support = true,
+        .led_compensation = 51,
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+};
+
+struct iwl_cfg iwl6000g2b_2bgn_cfg = {
+        .name = "6000 Series 2x2 BGN Gen2b",
+        .fw_name_pre = IWL6000G2B_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
+        .sku = IWL_SKU_G|IWL_SKU_N,
+        .ops = &iwl6000g2b_ops,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
+        .pa_type = IWL_PA_SYSTEM,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .shadow_ram_support = true,
+        .ht_greenfield_support = true,
+        .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+};
+
+struct iwl_cfg iwl6000g2b_2bg_cfg = {
+        .name = "6000 Series 2x2 BG Gen2b",
+        .fw_name_pre = IWL6000G2B_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
+        .sku = IWL_SKU_G,
+        .ops = &iwl6000g2b_ops,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
+        .pa_type = IWL_PA_SYSTEM,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .shadow_ram_support = true,
+        .led_compensation = 51,
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+};
+
+struct iwl_cfg iwl6000g2b_bgn_cfg = {
+        .name = "6000 Series 1x2 BGN Gen2b",
+        .fw_name_pre = IWL6000G2B_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
+        .sku = IWL_SKU_G|IWL_SKU_N,
+        .ops = &iwl6000g2b_ops,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
+        .pa_type = IWL_PA_SYSTEM,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .shadow_ram_support = true,
+        .ht_greenfield_support = true,
+        .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+};
+
+struct iwl_cfg iwl6000g2b_bg_cfg = {
+        .name = "6000 Series 1x2 BG Gen2b",
+        .fw_name_pre = IWL6000G2B_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
+        .sku = IWL_SKU_G,
+        .ops = &iwl6000g2b_ops,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
+        .valid_tx_ant = ANT_A,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
+        .pa_type = IWL_PA_SYSTEM,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .shadow_ram_support = true,
+        .led_compensation = 51,
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+};
+
 /*
  * "i": Internal configuration, use internal Power Amplifier
  */
@@ -667,3 +991,4 @@ struct iwl_cfg iwl6000_3agn_cfg = {
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL6000G2A_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL6000G2B_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
index 7e8227773213..400eb312b555 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
@@ -96,17 +96,16 @@ int iwl_send_calib_results(struct iwl_priv *priv)
                         hcmd.len = priv->calib_results[i].buf_len;
                         hcmd.data = priv->calib_results[i].buf;
                         ret = iwl_send_cmd_sync(priv, &hcmd);
-                        if (ret)
-                                goto err;
+                        if (ret) {
+                                IWL_ERR(priv, "Error %d iteration %d\n",
+                                        ret, i);
+                                break;
+                        }
                 }
         }
 
-        return 0;
-err:
-        IWL_ERR(priv, "Error %d iteration %d\n", ret, i);
         return ret;
 }
-EXPORT_SYMBOL(iwl_send_calib_results);
 
 int iwl_calib_set(struct iwl_calib_result *res, const u8 *buf, int len)
 {
@@ -121,7 +120,6 @@ int iwl_calib_set(struct iwl_calib_result *res, const u8 *buf, int len)
         memcpy(res->buf, buf, len);
         return 0;
 }
-EXPORT_SYMBOL(iwl_calib_set);
 
 void iwl_calib_free_results(struct iwl_priv *priv)
 {
@@ -133,7 +131,6 @@ void iwl_calib_free_results(struct iwl_priv *priv)
                 priv->calib_results[i].buf_len = 0;
         }
 }
-EXPORT_SYMBOL(iwl_calib_free_results);
 
 /*****************************************************************************
  * RUNTIME calibrations framework
@@ -533,7 +530,6 @@ void iwl_init_sensitivity(struct iwl_priv *priv)
         ret |= iwl_sensitivity_write(priv);
         IWL_DEBUG_CALIB(priv, "<<return 0x%X\n", ret);
 }
-EXPORT_SYMBOL(iwl_init_sensitivity);
 
 void iwl_sensitivity_calibration(struct iwl_priv *priv,
                                     struct iwl_notif_statistics *resp)
@@ -639,7 +635,6 @@ void iwl_sensitivity_calibration(struct iwl_priv *priv,
         iwl_sens_energy_cck(priv, norm_fa_cck, rx_enable_time, &statis);
         iwl_sensitivity_write(priv);
 }
-EXPORT_SYMBOL(iwl_sensitivity_calibration);
 
 static inline u8 find_first_chain(u8 mask)
 {
@@ -846,6 +841,13 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
                 }
         }
 
+        if (active_chains != priv->hw_params.valid_rx_ant &&
+            active_chains != priv->chain_noise_data.active_chains)
+                IWL_WARN(priv,
+                         "Detected that not all antennas are connected! "
+                         "Connected: %#x, valid: %#x.\n",
+                         active_chains, priv->hw_params.valid_rx_ant);
+
         /* Save for use within RXON, TX, SCAN commands, etc. */
         priv->chain_noise_data.active_chains = active_chains;
         IWL_DEBUG_CALIB(priv, "active_chains (bitwise) = 0x%x\n",
@@ -890,8 +892,6 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
         data->state = IWL_CHAIN_NOISE_DONE;
         iwl_power_update_mode(priv, false);
 }
-EXPORT_SYMBOL(iwl_chain_noise_calibration);
-
 
 void iwl_reset_run_time_calib(struct iwl_priv *priv)
 {
@@ -908,5 +908,3 @@ void iwl_reset_run_time_calib(struct iwl_priv *priv)
          * periodically after association */
         iwl_send_statistics_request(priv, CMD_ASYNC, true);
 }
-EXPORT_SYMBOL(iwl_reset_run_time_calib);
-
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
index 48c023b4ca36..75d6bfcbc607 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
@@ -28,6 +28,27 @@
 
 #include "iwl-agn-debugfs.h"
 
+static int iwl_statistics_flag(struct iwl_priv *priv, char *buf, int bufsz)
+{
+        int p = 0;
+
+        p += scnprintf(buf + p, bufsz - p, "Statistics Flag(0x%X):\n",
+                       le32_to_cpu(priv->_agn.statistics.flag));
+        if (le32_to_cpu(priv->_agn.statistics.flag) &
+                        UCODE_STATISTICS_CLEAR_MSK)
+                p += scnprintf(buf + p, bufsz - p,
+                               "\tStatistics have been cleared\n");
+        p += scnprintf(buf + p, bufsz - p, "\tOperational Frequency: %s\n",
+                       (le32_to_cpu(priv->_agn.statistics.flag) &
+                        UCODE_STATISTICS_FREQUENCY_MSK)
+                        ? "2.4 GHz" : "5.2 GHz");
+        p += scnprintf(buf + p, bufsz - p, "\tTGj Narrow Band: %s\n",
+                       (le32_to_cpu(priv->_agn.statistics.flag) &
+                        UCODE_STATISTICS_NARROW_BAND_MSK)
+                        ? "enabled" : "disabled");
+        return p;
+}
+
 ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
   {
@@ -58,24 +79,24 @@ ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
          * the last statistics notification from uCode
          * might not reflect the current uCode activity
          */
-        ofdm = &priv->statistics.rx.ofdm;
-        cck = &priv->statistics.rx.cck;
-        general = &priv->statistics.rx.general;
-        ht = &priv->statistics.rx.ofdm_ht;
-        accum_ofdm = &priv->accum_statistics.rx.ofdm;
-        accum_cck = &priv->accum_statistics.rx.cck;
-        accum_general = &priv->accum_statistics.rx.general;
-        accum_ht = &priv->accum_statistics.rx.ofdm_ht;
-        delta_ofdm = &priv->delta_statistics.rx.ofdm;
-        delta_cck = &priv->delta_statistics.rx.cck;
-        delta_general = &priv->delta_statistics.rx.general;
-        delta_ht = &priv->delta_statistics.rx.ofdm_ht;
-        max_ofdm = &priv->max_delta.rx.ofdm;
-        max_cck = &priv->max_delta.rx.cck;
-        max_general = &priv->max_delta.rx.general;
-        max_ht = &priv->max_delta.rx.ofdm_ht;
+        ofdm = &priv->_agn.statistics.rx.ofdm;
+        cck = &priv->_agn.statistics.rx.cck;
+        general = &priv->_agn.statistics.rx.general;
+        ht = &priv->_agn.statistics.rx.ofdm_ht;
+        accum_ofdm = &priv->_agn.accum_statistics.rx.ofdm;
+        accum_cck = &priv->_agn.accum_statistics.rx.cck;
+        accum_general = &priv->_agn.accum_statistics.rx.general;
+        accum_ht = &priv->_agn.accum_statistics.rx.ofdm_ht;
+        delta_ofdm = &priv->_agn.delta_statistics.rx.ofdm;
+        delta_cck = &priv->_agn.delta_statistics.rx.cck;
+        delta_general = &priv->_agn.delta_statistics.rx.general;
+        delta_ht = &priv->_agn.delta_statistics.rx.ofdm_ht;
+        max_ofdm = &priv->_agn.max_delta.rx.ofdm;
+        max_cck = &priv->_agn.max_delta.rx.cck;
+        max_general = &priv->_agn.max_delta.rx.general;
+        max_ht = &priv->_agn.max_delta.rx.ofdm_ht;
 
-        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += iwl_statistics_flag(priv, buf, bufsz);
         pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
                          "acumulative       delta         max\n",
                          "Statistics_Rx - OFDM:");
@@ -539,11 +560,11 @@ ssize_t iwl_ucode_tx_stats_read(struct file *file,
           * the last statistics notification from uCode
           * might not reflect the current uCode activity
           */
-        tx = &priv->statistics.tx;
-        accum_tx = &priv->accum_statistics.tx;
-        delta_tx = &priv->delta_statistics.tx;
-        max_tx = &priv->max_delta.tx;
-        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        tx = &priv->_agn.statistics.tx;
+        accum_tx = &priv->_agn.accum_statistics.tx;
+        delta_tx = &priv->_agn.delta_statistics.tx;
+        max_tx = &priv->_agn.max_delta.tx;
+        pos += iwl_statistics_flag(priv, buf, bufsz);
         pos += scnprintf(buf + pos, bufsz - pos,  "%-32s     current"
                          "acumulative       delta         max\n",
                          "Statistics_Tx:");
@@ -756,19 +777,19 @@ ssize_t iwl_ucode_general_stats_read(struct file *file, char __user *user_buf,
           * the last statistics notification from uCode
           * might not reflect the current uCode activity
           */
-        general = &priv->statistics.general;
-        dbg = &priv->statistics.general.dbg;
-        div = &priv->statistics.general.div;
-        accum_general = &priv->accum_statistics.general;
-        delta_general = &priv->delta_statistics.general;
-        max_general = &priv->max_delta.general;
-        accum_dbg = &priv->accum_statistics.general.dbg;
-        delta_dbg = &priv->delta_statistics.general.dbg;
-        max_dbg = &priv->max_delta.general.dbg;
-        accum_div = &priv->accum_statistics.general.div;
-        delta_div = &priv->delta_statistics.general.div;
-        max_div = &priv->max_delta.general.div;
-        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        general = &priv->_agn.statistics.general;
+        dbg = &priv->_agn.statistics.general.dbg;
+        div = &priv->_agn.statistics.general.div;
+        accum_general = &priv->_agn.accum_statistics.general;
+        delta_general = &priv->_agn.delta_statistics.general;
+        max_general = &priv->_agn.max_delta.general;
+        accum_dbg = &priv->_agn.accum_statistics.general.dbg;
+        delta_dbg = &priv->_agn.delta_statistics.general.dbg;
+        max_dbg = &priv->_agn.max_delta.general.dbg;
+        accum_div = &priv->_agn.accum_statistics.general.div;
+        delta_div = &priv->_agn.delta_statistics.general.div;
+        max_div = &priv->_agn.max_delta.general.div;
+        pos += iwl_statistics_flag(priv, buf, bufsz);
         pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
                          "acumulative       delta         max\n",
                          "Statistics_General:");
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
index 01658cf82d39..d89a11c6558e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
@@ -37,7 +37,7 @@
 #include "iwl-io.h"
 #include "iwl-agn.h"
 
-static int iwlagn_send_rxon_assoc(struct iwl_priv *priv)
+int iwlagn_send_rxon_assoc(struct iwl_priv *priv)
 {
         int ret = 0;
         struct iwl5000_rxon_assoc_cmd rxon_assoc;
@@ -84,7 +84,7 @@ static int iwlagn_send_rxon_assoc(struct iwl_priv *priv)
         return ret;
 }
 
-static int iwlagn_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant)
+int iwlagn_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant)
 {
         struct iwl_tx_ant_config_cmd tx_ant_cmd = {
           .valid = cpu_to_le32(valid_tx_ant),
@@ -176,14 +176,6 @@ static void iwlagn_gain_computation(struct iwl_priv *priv,
                 data->radio_write = 1;
                 data->state = IWL_CHAIN_NOISE_CALIBRATED;
         }
-
-        data->chain_noise_a = 0;
-        data->chain_noise_b = 0;
-        data->chain_noise_c = 0;
-        data->chain_signal_a = 0;
-        data->chain_signal_b = 0;
-        data->chain_signal_c = 0;
-        data->beacon_count = 0;
 }
 
 static void iwlagn_chain_noise_reset(struct iwl_priv *priv)
@@ -191,10 +183,20 @@ static void iwlagn_chain_noise_reset(struct iwl_priv *priv)
         struct iwl_chain_noise_data *data = &priv->chain_noise_data;
         int ret;
 
-        if ((data->state == IWL_CHAIN_NOISE_ALIVE) && iwl_is_associated(priv)) {
+        if ((data->state == IWL_CHAIN_NOISE_ALIVE) &&
+             iwl_is_associated(priv)) {
                 struct iwl_calib_chain_noise_reset_cmd cmd;
-                memset(&cmd, 0, sizeof(cmd));
 
+                /* clear data for chain noise calibration algorithm */
+                data->chain_noise_a = 0;
+                data->chain_noise_b = 0;
+                data->chain_noise_c = 0;
+                data->chain_signal_a = 0;
+                data->chain_signal_b = 0;
+                data->chain_signal_c = 0;
+                data->beacon_count = 0;
+
+                memset(&cmd, 0, sizeof(cmd));
                 cmd.hdr.op_code = IWL_PHY_CALIBRATE_CHAIN_NOISE_RESET_CMD;
                 cmd.hdr.first_group = 0;
                 cmd.hdr.groups_num = 1;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 0f292a210ed9..5f1e7d802cbf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -77,7 +77,7 @@ static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
                 IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, StartIdx=%d idx=%d\n",
                                    agg->frame_count, agg->start_idx, idx);
 
-                info = IEEE80211_SKB_CB(priv->txq[txq_id].txb[idx].skb[0]);
+                info = IEEE80211_SKB_CB(priv->txq[txq_id].txb[idx].skb);
                 info->status.rates[0].count = tx_resp->failure_frame + 1;
                 info->flags &= ~IEEE80211_TX_CTL_AMPDU;
                 info->flags |= iwl_tx_status_to_mac80211(status);
@@ -93,6 +93,12 @@ static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
         } else {
                 /* Two or more frames were attempted; expect block-ack */
                 u64 bitmap = 0;
+
+                /*
+                 * Start is the lowest frame sent. It may not be the first
+                 * frame in the batch; we figure this out dynamically during
+                 * the following loop.
+                 */
                 int start = agg->start_idx;
 
                 /* Construct bit-map of pending frames within Tx window */
@@ -131,25 +137,58 @@ static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
                         IWL_DEBUG_TX_REPLY(priv, "AGG Frame i=%d idx %d seq=%d\n",
                                            i, idx, SEQ_TO_SN(sc));
 
+                        /*
+                         * sh -> how many frames ahead of the starting frame is
+                         * the current one?
+                         *
+                         * Note that all frames sent in the batch must be in a
+                         * 64-frame window, so this number should be in [0,63].
+                         * If outside of this window, then we've found a new
+                         * "first" frame in the batch and need to change start.
+                         */
                         sh = idx - start;
-                        if (sh > 64) {
-                                sh = (start - idx) + 0xff;
+
+                        /*
+                         * If >= 64, out of window. start must be at the front
+                         * of the circular buffer, idx must be near the end of
+                         * the buffer, and idx is the new "first" frame. Shift
+                         * the indices around.
+                         */
+                        if (sh >= 64) {
+                                /* Shift bitmap by start - idx, wrapped */
+                                sh = 0x100 - idx + start;
                                 bitmap = bitmap << sh;
+                                /* Now idx is the new start so sh = 0 */
                                 sh = 0;
                                 start = idx;
-                        } else if (sh < -64)
-                                sh  = 0xff - (start - idx);
-                        else if (sh < 0) {
+                        /*
+                         * If <= -64 then wraps the 256-pkt circular buffer
+                         * (e.g., start = 255 and idx = 0, sh should be 1)
+                         */
+                        } else if (sh <= -64) {
+                                sh  = 0x100 - start + idx;
+                        /*
+                         * If < 0 but > -64, out of window. idx is before start
+                         * but not wrapped. Shift the indices around.
+                         */
+                        } else if (sh < 0) {
+                                /* Shift by how far start is ahead of idx */
                                 sh = start - idx;
-                                start = idx;
                                 bitmap = bitmap << sh;
+                                /* Now idx is the new start so sh = 0 */
+                                start = idx;
                                 sh = 0;
                         }
+                        /* Sequence number start + sh was sent in this batch */
                         bitmap |= 1ULL << sh;
                         IWL_DEBUG_TX_REPLY(priv, "start=%d bitmap=0x%llx\n",
                                            start, (unsigned long long)bitmap);
                 }
 
+                /*
+                 * Store the bitmap and possibly the new start, if we wrapped
+                 * the buffer above
+                 */
                 agg->bitmap = bitmap;
                 agg->start_idx = start;
                 IWL_DEBUG_TX_REPLY(priv, "Frames %d start_idx=%d bitmap=0x%llx\n",
@@ -184,6 +223,7 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
         int tid;
         int sta_id;
         int freed;
+        unsigned long flags;
 
         if ((index >= txq->q.n_bd) || (iwl_queue_used(&txq->q, index) == 0)) {
                 IWL_ERR(priv, "Read index for DMA queue txq_id (%d) index %d "
@@ -193,15 +233,16 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
                 return;
         }
 
-        info = IEEE80211_SKB_CB(txq->txb[txq->q.read_ptr].skb[0]);
+        info = IEEE80211_SKB_CB(txq->txb[txq->q.read_ptr].skb);
         memset(&info->status, 0, sizeof(info->status));
 
         tid = (tx_resp->ra_tid & IWL50_TX_RES_TID_MSK) >> IWL50_TX_RES_TID_POS;
         sta_id = (tx_resp->ra_tid & IWL50_TX_RES_RA_MSK) >> IWL50_TX_RES_RA_POS;
 
+        spin_lock_irqsave(&priv->sta_lock, flags);
         if (txq->sched_retry) {
                 const u32 scd_ssn = iwlagn_get_scd_ssn(tx_resp);
-                struct iwl_ht_agg *agg = NULL;
+                struct iwl_ht_agg *agg;
 
                 agg = &priv->stations[sta_id].tid[tid].agg;
 
@@ -256,6 +297,7 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
         iwlagn_txq_check_empty(priv, sta_id, tid, txq_id);
 
         iwl_check_abort_status(priv, tx_resp->frame_count, status);
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
 
 void iwlagn_rx_handler_setup(struct iwl_priv *priv)
@@ -319,7 +361,8 @@ int iwlagn_send_tx_power(struct iwl_priv *priv)
 void iwlagn_temperature(struct iwl_priv *priv)
 {
         /* store temperature from statistics (in Celsius) */
-        priv->temperature = le32_to_cpu(priv->statistics.general.temperature);
+        priv->temperature =
+                le32_to_cpu(priv->_agn.statistics.general.temperature);
         iwl_tt_handler(priv);
 }
 
@@ -444,7 +487,7 @@ int iwlagn_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
 
         /* Tell device where to find RBD circular buffer in DRAM */
         iwl_write_direct32(priv, FH_RSCSR_CHNL0_RBDCB_BASE_REG,
-                           (u32)(rxq->dma_addr >> 8));
+                           (u32)(rxq->bd_dma >> 8));
 
         /* Tell device where in DRAM to update its Rx status */
         iwl_write_direct32(priv, FH_RSCSR_CHNL0_STTS_WPTR_REG,
@@ -709,7 +752,7 @@ void iwlagn_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         }
 
         dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
-                          rxq->dma_addr);
+                          rxq->bd_dma);
         dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
                           rxq->rb_stts, rxq->rb_stts_dma);
         rxq->bd = NULL;
@@ -755,132 +798,6 @@ static inline int iwlagn_calc_rssi(struct iwl_priv *priv,
         return priv->cfg->ops->utils->calc_rssi(priv, rx_resp);
 }
 
-#ifdef CONFIG_IWLWIFI_DEBUG
-/**
- * iwlagn_dbg_report_frame - dump frame to syslog during debug sessions
- *
- * You may hack this function to show different aspects of received frames,
- * including selective frame dumps.
- * group100 parameter selects whether to show 1 out of 100 good data frames.
- *    All beacon and probe response frames are printed.
- */
-static void iwlagn_dbg_report_frame(struct iwl_priv *priv,
-                      struct iwl_rx_phy_res *phy_res, u16 length,
-                      struct ieee80211_hdr *header, int group100)
-{
-        u32 to_us;
-        u32 print_summary = 0;
-        u32 print_dump = 0;     /* set to 1 to dump all frames' contents */
-        u32 hundred = 0;
-        u32 dataframe = 0;
-        __le16 fc;
-        u16 seq_ctl;
-        u16 channel;
-        u16 phy_flags;
-        u32 rate_n_flags;
-        u32 tsf_low;
-        int rssi;
-
-        if (likely(!(iwl_get_debug_level(priv) & IWL_DL_RX)))
-                return;
-
-        /* MAC header */
-        fc = header->frame_control;
-        seq_ctl = le16_to_cpu(header->seq_ctrl);
-
-        /* metadata */
-        channel = le16_to_cpu(phy_res->channel);
-        phy_flags = le16_to_cpu(phy_res->phy_flags);
-        rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);
-
-        /* signal statistics */
-        rssi = iwlagn_calc_rssi(priv, phy_res);
-        tsf_low = le64_to_cpu(phy_res->timestamp) & 0x0ffffffff;
-
-        to_us = !compare_ether_addr(header->addr1, priv->mac_addr);
-
-        /* if data frame is to us and all is good,
-         *   (optionally) print summary for only 1 out of every 100 */
-        if (to_us && (fc & ~cpu_to_le16(IEEE80211_FCTL_PROTECTED)) ==
-            cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FTYPE_DATA)) {
-                dataframe = 1;
-                if (!group100)
-                        print_summary = 1;      /* print each frame */
-                else if (priv->framecnt_to_us < 100) {
-                        priv->framecnt_to_us++;
-                        print_summary = 0;
-                } else {
-                        priv->framecnt_to_us = 0;
-                        print_summary = 1;
-                        hundred = 1;
-                }
-        } else {
-                /* print summary for all other frames */
-                print_summary = 1;
-        }
-
-        if (print_summary) {
-                char *title;
-                int rate_idx;
-                u32 bitrate;
-
-                if (hundred)
-                        title = "100Frames";
-                else if (ieee80211_has_retry(fc))
-                        title = "Retry";
-                else if (ieee80211_is_assoc_resp(fc))
-                        title = "AscRsp";
-                else if (ieee80211_is_reassoc_resp(fc))
-                        title = "RasRsp";
-                else if (ieee80211_is_probe_resp(fc)) {
-                        title = "PrbRsp";
-                        print_dump = 1; /* dump frame contents */
-                } else if (ieee80211_is_beacon(fc)) {
-                        title = "Beacon";
-                        print_dump = 1; /* dump frame contents */
-                } else if (ieee80211_is_atim(fc))
-                        title = "ATIM";
-                else if (ieee80211_is_auth(fc))
-                        title = "Auth";
-                else if (ieee80211_is_deauth(fc))
-                        title = "DeAuth";
-                else if (ieee80211_is_disassoc(fc))
-                        title = "DisAssoc";
-                else
-                        title = "Frame";
-
-                rate_idx = iwl_hwrate_to_plcp_idx(rate_n_flags);
-                if (unlikely((rate_idx < 0) || (rate_idx >= IWL_RATE_COUNT))) {
-                        bitrate = 0;
-                        WARN_ON_ONCE(1);
-                } else {
-                        bitrate = iwl_rates[rate_idx].ieee / 2;
-                }
-
-                /* print frame summary.
-                 * MAC addresses show just the last byte (for brevity),
-                 *    but you can hack it to show more, if you'd like to. */
-                if (dataframe)
-                        IWL_DEBUG_RX(priv, "%s: mhd=0x%04x, dst=0x%02x, "
-                                     "len=%u, rssi=%d, chnl=%d, rate=%u,\n",
-                                     title, le16_to_cpu(fc), header->addr1[5],
-                                     length, rssi, channel, bitrate);
-                else {
-                        /* src/dst addresses assume managed mode */
-                        IWL_DEBUG_RX(priv, "%s: 0x%04x, dst=0x%02x, src=0x%02x, "
-                                     "len=%u, rssi=%d, tim=%lu usec, "
-                                     "phy=0x%02x, chnl=%d\n",
-                                     title, le16_to_cpu(fc), header->addr1[5],
-                                     header->addr3[5], length, rssi,
-                                     tsf_low - priv->scan_start_tsf,
-                                     phy_flags, channel);
-                }
-        }
-        if (print_dump)
-                iwl_print_hex_dump(priv, IWL_DL_RX, header, length);
-}
-#endif
-
 static u32 iwlagn_translate_rx_status(struct iwl_priv *priv, u32 decrypt_in)
 {
         u32 decrypt_out = 0;
@@ -988,7 +905,7 @@ void iwlagn_rx_reply_rx(struct iwl_priv *priv,
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_rx_phy_res *phy_res;
         __le32 rx_pkt_status;
-        struct iwl4965_rx_mpdu_res_start *amsdu;
+        struct iwl_rx_mpdu_res_start *amsdu;
         u32 len;
         u32 ampdu_status;
         u32 rate_n_flags;
@@ -1017,7 +934,7 @@ void iwlagn_rx_reply_rx(struct iwl_priv *priv,
                         return;
                 }
                 phy_res = &priv->_agn.last_phy_res;
-                amsdu = (struct iwl4965_rx_mpdu_res_start *)pkt->u.raw;
+                amsdu = (struct iwl_rx_mpdu_res_start *)pkt->u.raw;
                 header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*amsdu));
                 len = le16_to_cpu(amsdu->byte_count);
                 rx_pkt_status = *(__le32 *)(pkt->u.raw + sizeof(*amsdu) + len);
@@ -1060,11 +977,6 @@ void iwlagn_rx_reply_rx(struct iwl_priv *priv,
         /* Find max signal strength (dBm) among 3 antenna/receiver chains */
         rx_status.signal = iwlagn_calc_rssi(priv, phy_res);
 
-#ifdef CONFIG_IWLWIFI_DEBUG
-        /* Set "1" to report good data frames in groups of 100 */
-        if (unlikely(iwl_get_debug_level(priv) & IWL_DL_RX))
-                iwlagn_dbg_report_frame(priv, phy_res, len, header, 1);
-#endif
         iwl_dbg_log_rx_data_frame(priv, len, header);
         IWL_DEBUG_STATS_LIMIT(priv, "Rssi %d, TSF %llu\n",
                 rx_status.signal, (unsigned long long)rx_status.mactime);
@@ -1252,6 +1164,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         bool is_active = false;
         int  chan_mod;
         u8 active_chains;
+        u8 scan_tx_antennas = priv->hw_params.valid_tx_ant;
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
@@ -1403,11 +1316,14 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
         band = priv->scan_band;
 
-        if (priv->cfg->scan_antennas[band])
-                rx_ant = priv->cfg->scan_antennas[band];
+        if (priv->cfg->scan_rx_antennas[band])
+                rx_ant = priv->cfg->scan_rx_antennas[band];
 
-        priv->scan_tx_ant[band] =
-                        iwl_toggle_tx_ant(priv, priv->scan_tx_ant[band]);
+        if (priv->cfg->scan_tx_antennas[band])
+                scan_tx_antennas = priv->cfg->scan_tx_antennas[band];
+
+        priv->scan_tx_ant[band] = iwl_toggle_tx_ant(priv, priv->scan_tx_ant[band],
+                                                    scan_tx_antennas);
         rate_flags |= iwl_ant_idx_to_flags(priv->scan_tx_ant[band]);
         scan->tx_cmd.rate_n_flags = iwl_hw_set_rate_n_flags(rate, rate_flags);
 
@@ -1433,13 +1349,15 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         if (!priv->is_internal_short_scan) {
                 cmd_len = iwl_fill_probe_req(priv,
                                         (struct ieee80211_mgmt *)scan->data,
+                                        vif->addr,
                                         priv->scan_request->ie,
                                         priv->scan_request->ie_len,
                                         IWL_MAX_SCAN_SIZE - sizeof(*scan));
         } else {
+                /* use bcast addr, will not be transmitted but must be valid */
                 cmd_len = iwl_fill_probe_req(priv,
                                         (struct ieee80211_mgmt *)scan->data,
-                                        NULL, 0,
+                                        iwl_bcast_addr, NULL, 0,
                                         IWL_MAX_SCAN_SIZE - sizeof(*scan));
 
         }
@@ -1502,3 +1420,18 @@ int iwlagn_manage_ibss_station(struct iwl_priv *priv,
         return iwl_remove_station(priv, vif_priv->ibss_bssid_sta_id,
                                   vif->bss_conf.bssid);
 }
+
+void iwl_free_tfds_in_queue(struct iwl_priv *priv,
+                            int sta_id, int tid, int freed)
+{
+        WARN_ON(!spin_is_locked(&priv->sta_lock));
+
+        if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)
+                priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+        else {
+                IWL_DEBUG_TX(priv, "free more than tfds_in_queue (%u:%d)\n",
+                        priv->stations[sta_id].tid[tid].tfds_in_queue,
+                        freed);
+                priv->stations[sta_id].tid[tid].tfds_in_queue = 0;
+        }
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index cf4a95bae4ff..40933a5de027 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -313,8 +313,7 @@ static int rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
                          */
                         IWL_DEBUG_HT(priv, "Fail start Tx agg on tid: %d\n",
                                 tid);
-                        ieee80211_stop_tx_ba_session(sta, tid,
-                                                WLAN_BACK_INITIATOR);
+                        ieee80211_stop_tx_ba_session(sta, tid);
                 }
         } else
                 IWL_ERR(priv, "Fail finding valid aggregation tid: %d\n", tid);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
new file mode 100644
index 000000000000..ad2bead25c82
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
@@ -0,0 +1,278 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-calib.h"
+#include "iwl-sta.h"
+#include "iwl-io.h"
+#include "iwl-helpers.h"
+#include "iwl-agn-hw.h"
+#include "iwl-agn.h"
+
+void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
+                                struct iwl_rx_mem_buffer *rxb)
+
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_missed_beacon_notif *missed_beacon;
+
+        missed_beacon = &pkt->u.missed_beacon;
+        if (le32_to_cpu(missed_beacon->consecutive_missed_beacons) >
+            priv->missed_beacon_threshold) {
+                IWL_DEBUG_CALIB(priv,
+                    "missed bcn cnsq %d totl %d rcd %d expctd %d\n",
+                    le32_to_cpu(missed_beacon->consecutive_missed_beacons),
+                    le32_to_cpu(missed_beacon->total_missed_becons),
+                    le32_to_cpu(missed_beacon->num_recvd_beacons),
+                    le32_to_cpu(missed_beacon->num_expected_beacons));
+                if (!test_bit(STATUS_SCANNING, &priv->status))
+                        iwl_init_sensitivity(priv);
+        }
+}
+
+/* Calculate noise level, based on measurements during network silence just
+ *   before arriving beacon.  This measurement can be done only if we know
+ *   exactly when to expect beacons, therefore only when we're associated. */
+static void iwl_rx_calc_noise(struct iwl_priv *priv)
+{
+        struct statistics_rx_non_phy *rx_info
+                                = &(priv->_agn.statistics.rx.general);
+        int num_active_rx = 0;
+        int total_silence = 0;
+        int bcn_silence_a =
+                le32_to_cpu(rx_info->beacon_silence_rssi_a) & IN_BAND_FILTER;
+        int bcn_silence_b =
+                le32_to_cpu(rx_info->beacon_silence_rssi_b) & IN_BAND_FILTER;
+        int bcn_silence_c =
+                le32_to_cpu(rx_info->beacon_silence_rssi_c) & IN_BAND_FILTER;
+        int last_rx_noise;
+
+        if (bcn_silence_a) {
+                total_silence += bcn_silence_a;
+                num_active_rx++;
+        }
+        if (bcn_silence_b) {
+                total_silence += bcn_silence_b;
+                num_active_rx++;
+        }
+        if (bcn_silence_c) {
+                total_silence += bcn_silence_c;
+                num_active_rx++;
+        }
+
+        /* Average among active antennas */
+        if (num_active_rx)
+                last_rx_noise = (total_silence / num_active_rx) - 107;
+        else
+                last_rx_noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
+
+        IWL_DEBUG_CALIB(priv, "inband silence a %u, b %u, c %u, dBm %d\n",
+                        bcn_silence_a, bcn_silence_b, bcn_silence_c,
+                        last_rx_noise);
+}
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+/*
+ *  based on the assumption of all statistics counter are in DWORD
+ *  FIXME: This function is for debugging, do not deal with
+ *  the case of counters roll-over.
+ */
+static void iwl_accumulative_statistics(struct iwl_priv *priv,
+                                        __le32 *stats)
+{
+        int i;
+        __le32 *prev_stats;
+        u32 *accum_stats;
+        u32 *delta, *max_delta;
+
+        prev_stats = (__le32 *)&priv->_agn.statistics;
+        accum_stats = (u32 *)&priv->_agn.accum_statistics;
+        delta = (u32 *)&priv->_agn.delta_statistics;
+        max_delta = (u32 *)&priv->_agn.max_delta;
+
+        for (i = sizeof(__le32); i < sizeof(struct iwl_notif_statistics);
+             i += sizeof(__le32), stats++, prev_stats++, delta++,
+             max_delta++, accum_stats++) {
+                if (le32_to_cpu(*stats) > le32_to_cpu(*prev_stats)) {
+                        *delta = (le32_to_cpu(*stats) -
+                                le32_to_cpu(*prev_stats));
+                        *accum_stats += *delta;
+                        if (*delta > *max_delta)
+                                *max_delta = *delta;
+                }
+        }
+
+        /* reset accumulative statistics for "no-counter" type statistics */
+        priv->_agn.accum_statistics.general.temperature =
+                priv->_agn.statistics.general.temperature;
+        priv->_agn.accum_statistics.general.temperature_m =
+                priv->_agn.statistics.general.temperature_m;
+        priv->_agn.accum_statistics.general.ttl_timestamp =
+                priv->_agn.statistics.general.ttl_timestamp;
+        priv->_agn.accum_statistics.tx.tx_power.ant_a =
+                priv->_agn.statistics.tx.tx_power.ant_a;
+        priv->_agn.accum_statistics.tx.tx_power.ant_b =
+                priv->_agn.statistics.tx.tx_power.ant_b;
+        priv->_agn.accum_statistics.tx.tx_power.ant_c =
+                priv->_agn.statistics.tx.tx_power.ant_c;
+}
+#endif
+
+#define REG_RECALIB_PERIOD (60)
+
+/**
+ * iwl_good_plcp_health - checks for plcp error.
+ *
+ * When the plcp error is exceeding the thresholds, reset the radio
+ * to improve the throughput.
+ */
+bool iwl_good_plcp_health(struct iwl_priv *priv,
+                                struct iwl_rx_packet *pkt)
+{
+        bool rc = true;
+        int combined_plcp_delta;
+        unsigned int plcp_msec;
+        unsigned long plcp_received_jiffies;
+
+        /*
+         * check for plcp_err and trigger radio reset if it exceeds
+         * the plcp error threshold plcp_delta.
+         */
+        plcp_received_jiffies = jiffies;
+        plcp_msec = jiffies_to_msecs((long) plcp_received_jiffies -
+                                        (long) priv->plcp_jiffies);
+        priv->plcp_jiffies = plcp_received_jiffies;
+        /*
+         * check to make sure plcp_msec is not 0 to prevent division
+         * by zero.
+         */
+        if (plcp_msec) {
+                combined_plcp_delta =
+                        (le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err) -
+                        le32_to_cpu(priv->_agn.statistics.rx.ofdm.plcp_err)) +
+                        (le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err) -
+                        le32_to_cpu(priv->_agn.statistics.rx.ofdm_ht.plcp_err));
+
+                if ((combined_plcp_delta > 0) &&
+                    ((combined_plcp_delta * 100) / plcp_msec) >
+                        priv->cfg->plcp_delta_threshold) {
+                        /*
+                         * if plcp_err exceed the threshold,
+                         * the following data is printed in csv format:
+                         *    Text: plcp_err exceeded %d,
+                         *    Received ofdm.plcp_err,
+                         *    Current ofdm.plcp_err,
+                         *    Received ofdm_ht.plcp_err,
+                         *    Current ofdm_ht.plcp_err,
+                         *    combined_plcp_delta,
+                         *    plcp_msec
+                         */
+                        IWL_DEBUG_RADIO(priv, "plcp_err exceeded %u, "
+                                "%u, %u, %u, %u, %d, %u mSecs\n",
+                                priv->cfg->plcp_delta_threshold,
+                                le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err),
+                                le32_to_cpu(
+                                       priv->_agn.statistics.rx.ofdm.plcp_err),
+                                le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err),
+                                le32_to_cpu(
+                                  priv->_agn.statistics.rx.ofdm_ht.plcp_err),
+                                combined_plcp_delta, plcp_msec);
+                        rc = false;
+                }
+        }
+        return rc;
+}
+
+void iwl_rx_statistics(struct iwl_priv *priv,
+                              struct iwl_rx_mem_buffer *rxb)
+{
+        int change;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+
+
+        IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
+                     (int)sizeof(priv->_agn.statistics),
+                     le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
+
+        change = ((priv->_agn.statistics.general.temperature !=
+                   pkt->u.stats.general.temperature) ||
+                  ((priv->_agn.statistics.flag &
+                    STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
+                   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        iwl_accumulative_statistics(priv, (__le32 *)&pkt->u.stats);
+#endif
+        iwl_recover_from_statistics(priv, pkt);
+
+        memcpy(&priv->_agn.statistics, &pkt->u.stats,
+               sizeof(priv->_agn.statistics));
+
+        set_bit(STATUS_STATISTICS, &priv->status);
+
+        /* Reschedule the statistics timer to occur in
+         * REG_RECALIB_PERIOD seconds to ensure we get a
+         * thermal update even if the uCode doesn't give
+         * us one */
+        mod_timer(&priv->statistics_periodic, jiffies +
+                  msecs_to_jiffies(REG_RECALIB_PERIOD * 1000));
+
+        if (unlikely(!test_bit(STATUS_SCANNING, &priv->status)) &&
+            (pkt->hdr.cmd == STATISTICS_NOTIFICATION)) {
+                iwl_rx_calc_noise(priv);
+                queue_work(priv->workqueue, &priv->run_time_calib_work);
+        }
+        if (priv->cfg->ops->lib->temp_ops.temperature && change)
+                priv->cfg->ops->lib->temp_ops.temperature(priv);
+}
+
+void iwl_reply_statistics(struct iwl_priv *priv,
+                              struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+
+        if (le32_to_cpu(pkt->u.stats.flag) & UCODE_STATISTICS_CLEAR_MSK) {
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+                memset(&priv->_agn.accum_statistics, 0,
+                        sizeof(struct iwl_notif_statistics));
+                memset(&priv->_agn.delta_statistics, 0,
+                        sizeof(struct iwl_notif_statistics));
+                memset(&priv->_agn.max_delta, 0,
+                        sizeof(struct iwl_notif_statistics));
+#endif
+                IWL_DEBUG_RX(priv, "Statistics have been cleared\n");
+        }
+        iwl_rx_statistics(priv, rxb);
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index 7d614c4d3c62..2573234e4db1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -233,6 +233,7 @@ int iwlagn_txq_agg_enable(struct iwl_priv *priv, int txq_id,
 {
         unsigned long flags;
         u16 ra_tid;
+        int ret;
 
         if ((IWLAGN_FIRST_AMPDU_QUEUE > txq_id) ||
             (IWLAGN_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
@@ -248,7 +249,9 @@ int iwlagn_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         ra_tid = BUILD_RAxTID(sta_id, tid);
 
         /* Modify device's station table to Tx this TID */
-        iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
+        ret = iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
+        if (ret)
+                return ret;
 
         spin_lock_irqsave(&priv->lock, flags);
 
@@ -469,7 +472,8 @@ static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
         }
 
         /* Set up antennas */
-        priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant);
+        priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
+                                              priv->hw_params.valid_tx_ant);
         rate_flags |= iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
 
         /* Set the rate in the TX cmd */
@@ -567,10 +571,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         hdr_len = ieee80211_hdrlen(fc);
 
         /* Find index into station table for destination station */
-        if (!info->control.sta)
-                sta_id = priv->hw_params.bcast_sta_id;
-        else
-                sta_id = iwl_sta_id(info->control.sta);
+        sta_id = iwl_sta_id_or_broadcast(priv, info->control.sta);
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                                hdr->addr1);
@@ -598,11 +599,17 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         }
 
         txq_id = get_queue_from_ac(skb_get_queue_mapping(skb));
+
+        /* irqs already disabled/saved above when locking priv->lock */
+        spin_lock(&priv->sta_lock);
+
         if (ieee80211_is_data_qos(fc)) {
                 qc = ieee80211_get_qos_ctl(hdr);
                 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
-                if (unlikely(tid >= MAX_TID_COUNT))
+                if (WARN_ON_ONCE(tid >= MAX_TID_COUNT)) {
+                        spin_unlock(&priv->sta_lock);
                         goto drop_unlock;
+                }
                 seq_number = priv->stations[sta_id].tid[tid].seq_number;
                 seq_number &= IEEE80211_SCTL_SEQ;
                 hdr->seq_ctrl = hdr->seq_ctrl &
@@ -620,15 +627,22 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         swq_id = txq->swq_id;
         q = &txq->q;
 
-        if (unlikely(iwl_queue_space(q) < q->high_mark))
+        if (unlikely(iwl_queue_space(q) < q->high_mark)) {
+                spin_unlock(&priv->sta_lock);
                 goto drop_unlock;
+        }
 
-        if (ieee80211_is_data_qos(fc))
+        if (ieee80211_is_data_qos(fc)) {
                 priv->stations[sta_id].tid[tid].tfds_in_queue++;
+                if (!ieee80211_has_morefrags(fc))
+                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
+        }
+
+        spin_unlock(&priv->sta_lock);
 
         /* Set up driver data for this TFD */
         memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
-        txq->txb[q->write_ptr].skb[0] = skb;
+        txq->txb[q->write_ptr].skb = skb;
 
         /* Set up first empty entry in queue's array of Tx/cmd buffers */
         out_cmd = txq->cmd[q->write_ptr];
@@ -694,8 +708,8 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         txcmd_phys = pci_map_single(priv->pci_dev,
                                     &out_cmd->hdr, len,
                                     PCI_DMA_BIDIRECTIONAL);
-        pci_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        pci_unmap_len_set(out_meta, len, len);
+        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
+        dma_unmap_len_set(out_meta, len, len);
         /* Add buffer containing Tx command and MAC(!) header to TFD's
          * first entry */
         priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
@@ -703,8 +717,6 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         if (!ieee80211_has_morefrags(hdr->frame_control)) {
                 txq->need_update = 1;
-                if (qc)
-                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
         } else {
                 wait_write_ptr = 1;
                 txq->need_update = 0;
@@ -1009,6 +1021,8 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
         if (ret)
                 return ret;
 
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        tid_data = &priv->stations[sta_id].tid[tid];
         if (tid_data->tfds_in_queue == 0) {
                 IWL_DEBUG_HT(priv, "HW queue is empty\n");
                 tid_data->agg.state = IWL_AGG_ON;
@@ -1018,6 +1032,7 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
                              tid_data->tfds_in_queue);
                 tid_data->agg.state = IWL_EMPTYING_HW_QUEUE_ADDBA;
         }
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
         return ret;
 }
 
@@ -1040,11 +1055,14 @@ int iwlagn_tx_agg_stop(struct iwl_priv *priv, struct ieee80211_vif *vif,
                 return -ENXIO;
         }
 
+        spin_lock_irqsave(&priv->sta_lock, flags);
+
         if (priv->stations[sta_id].tid[tid].agg.state ==
                                 IWL_EMPTYING_HW_QUEUE_ADDBA) {
                 IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
                 return 0;
         }
 
@@ -1062,13 +1080,17 @@ int iwlagn_tx_agg_stop(struct iwl_priv *priv, struct ieee80211_vif *vif,
                 IWL_DEBUG_HT(priv, "Stopping a non empty AGG HW QUEUE\n");
                 priv->stations[sta_id].tid[tid].agg.state =
                                 IWL_EMPTYING_HW_QUEUE_DELBA;
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
                 return 0;
         }
 
         IWL_DEBUG_HT(priv, "HW queue is empty\n");
         priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        /* do not restore/save irqs */
+        spin_unlock(&priv->sta_lock);
+        spin_lock(&priv->lock);
+
         /*
          * the only reason this call can fail is queue number out of range,
          * which can happen if uCode is reloaded and all the station
@@ -1092,6 +1114,8 @@ int iwlagn_txq_check_empty(struct iwl_priv *priv,
         u8 *addr = priv->stations[sta_id].sta.sta.addr;
         struct iwl_tid_data *tid_data = &priv->stations[sta_id].tid[tid];
 
+        WARN_ON(!spin_is_locked(&priv->sta_lock));
+
         switch (priv->stations[sta_id].tid[tid].agg.state) {
         case IWL_EMPTYING_HW_QUEUE_DELBA:
                 /* We are reclaiming the last packet of the */
@@ -1116,6 +1140,7 @@ int iwlagn_txq_check_empty(struct iwl_priv *priv,
                 }
                 break;
         }
+
         return 0;
 }
 
@@ -1159,12 +1184,12 @@ int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
 
                 tx_info = &txq->txb[txq->q.read_ptr];
-                iwlagn_tx_status(priv, tx_info->skb[0]);
+                iwlagn_tx_status(priv, tx_info->skb);
 
-                hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
+                hdr = (struct ieee80211_hdr *)tx_info->skb->data;
                 if (hdr && ieee80211_is_data_qos(hdr->frame_control))
                         nfreed++;
-                tx_info->skb[0] = NULL;
+                tx_info->skb = NULL;
 
                 if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
                         priv->cfg->ops->lib->txq_inval_byte_cnt_tbl(priv, txq);
@@ -1188,7 +1213,7 @@ static int iwlagn_tx_status_reply_compressed_ba(struct iwl_priv *priv,
         int i, sh, ack;
         u16 seq_ctl = le16_to_cpu(ba_resp->seq_ctl);
         u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
-        u64 bitmap;
+        u64 bitmap, sent_bitmap;
         int successes = 0;
         struct ieee80211_tx_info *info;
 
@@ -1216,24 +1241,26 @@ static int iwlagn_tx_status_reply_compressed_ba(struct iwl_priv *priv,
 
         /* check for success or failure according to the
          * transmitted bitmap and block-ack bitmap */
-        bitmap &= agg->bitmap;
+        sent_bitmap = bitmap & agg->bitmap;
 
         /* For each frame attempted in aggregation,
          * update driver's record of tx frame's status. */
-        for (i = 0; i < agg->frame_count ; i++) {
-                ack = bitmap & (1ULL << i);
-                successes += !!ack;
+        i = 0;
+        while (sent_bitmap) {
+                ack = sent_bitmap & 1ULL;
+                successes += ack;
                 IWL_DEBUG_TX_REPLY(priv, "%s ON i=%d idx=%d raw=%d\n",
                         ack ? "ACK" : "NACK", i, (agg->start_idx + i) & 0xff,
                         agg->start_idx + i);
+                sent_bitmap >>= 1;
+                ++i;
         }
 
-        info = IEEE80211_SKB_CB(priv->txq[scd_flow].txb[agg->start_idx].skb[0]);
+        info = IEEE80211_SKB_CB(priv->txq[scd_flow].txb[agg->start_idx].skb);
         memset(&info->status, 0, sizeof(info->status));
         info->flags |= IEEE80211_TX_STAT_ACK;
         info->flags |= IEEE80211_TX_STAT_AMPDU;
         info->status.ampdu_ack_len = successes;
-        info->status.ampdu_ack_map = bitmap;
         info->status.ampdu_len = agg->frame_count;
         iwlagn_hwrate_to_tx_control(priv, agg->rate_n_flags, info);
 
@@ -1281,6 +1308,7 @@ void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
         int index;
         int sta_id;
         int tid;
+        unsigned long flags;
 
         /* "flow" corresponds to Tx queue */
         u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
@@ -1308,7 +1336,7 @@ void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
         /* Find index just before block-ack window */
         index = iwl_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd);
 
-        /* TODO: Need to get this copy more safely - now good for debug */
+        spin_lock_irqsave(&priv->sta_lock, flags);
 
         IWL_DEBUG_TX_REPLY(priv, "REPLY_COMPRESSED_BA [%d] Received from %pM, "
                            "sta_id = %d\n",
@@ -1344,4 +1372,6 @@ void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
 
                 iwlagn_txq_check_empty(priv, sta_id, tid, scd_flow);
         }
+
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
index 637286c396fe..6f77441cb65a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
@@ -423,3 +423,126 @@ int iwlagn_alive_notify(struct iwl_priv *priv)
 
         return 0;
 }
+
+
+/**
+ * iwl_verify_inst_sparse - verify runtime uCode image in card vs. host,
+ *   using sample data 100 bytes apart.  If these sample points are good,
+ *   it's a pretty good bet that everything between them is good, too.
+ */
+static int iwlcore_verify_inst_sparse(struct iwl_priv *priv, __le32 *image, u32 len)
+{
+        u32 val;
+        int ret = 0;
+        u32 errcnt = 0;
+        u32 i;
+
+        IWL_DEBUG_INFO(priv, "ucode inst image size is %u\n", len);
+
+        for (i = 0; i < len; i += 100, image += 100/sizeof(u32)) {
+                /* read data comes through single port, auto-incr addr */
+                /* NOTE: Use the debugless read so we don't flood kernel log
+                 * if IWL_DL_IO is set */
+                iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR,
+                        i + IWLAGN_RTC_INST_LOWER_BOUND);
+                val = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                if (val != le32_to_cpu(*image)) {
+                        ret = -EIO;
+                        errcnt++;
+                        if (errcnt >= 3)
+                                break;
+                }
+        }
+
+        return ret;
+}
+
+/**
+ * iwlcore_verify_inst_full - verify runtime uCode image in card vs. host,
+ *     looking at all data.
+ */
+static int iwl_verify_inst_full(struct iwl_priv *priv, __le32 *image,
+                                 u32 len)
+{
+        u32 val;
+        u32 save_len = len;
+        int ret = 0;
+        u32 errcnt;
+
+        IWL_DEBUG_INFO(priv, "ucode inst image size is %u\n", len);
+
+        iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR,
+                           IWLAGN_RTC_INST_LOWER_BOUND);
+
+        errcnt = 0;
+        for (; len > 0; len -= sizeof(u32), image++) {
+                /* read data comes through single port, auto-incr addr */
+                /* NOTE: Use the debugless read so we don't flood kernel log
+                 * if IWL_DL_IO is set */
+                val = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                if (val != le32_to_cpu(*image)) {
+                        IWL_ERR(priv, "uCode INST section is invalid at "
+                                  "offset 0x%x, is 0x%x, s/b 0x%x\n",
+                                  save_len - len, val, le32_to_cpu(*image));
+                        ret = -EIO;
+                        errcnt++;
+                        if (errcnt >= 20)
+                                break;
+                }
+        }
+
+        if (!errcnt)
+                IWL_DEBUG_INFO(priv,
+                    "ucode image in INSTRUCTION memory is good\n");
+
+        return ret;
+}
+
+/**
+ * iwl_verify_ucode - determine which instruction image is in SRAM,
+ *    and verify its contents
+ */
+int iwl_verify_ucode(struct iwl_priv *priv)
+{
+        __le32 *image;
+        u32 len;
+        int ret;
+
+        /* Try bootstrap */
+        image = (__le32 *)priv->ucode_boot.v_addr;
+        len = priv->ucode_boot.len;
+        ret = iwlcore_verify_inst_sparse(priv, image, len);
+        if (!ret) {
+                IWL_DEBUG_INFO(priv, "Bootstrap uCode is good in inst SRAM\n");
+                return 0;
+        }
+
+        /* Try initialize */
+        image = (__le32 *)priv->ucode_init.v_addr;
+        len = priv->ucode_init.len;
+        ret = iwlcore_verify_inst_sparse(priv, image, len);
+        if (!ret) {
+                IWL_DEBUG_INFO(priv, "Initialize uCode is good in inst SRAM\n");
+                return 0;
+        }
+
+        /* Try runtime/protocol */
+        image = (__le32 *)priv->ucode_code.v_addr;
+        len = priv->ucode_code.len;
+        ret = iwlcore_verify_inst_sparse(priv, image, len);
+        if (!ret) {
+                IWL_DEBUG_INFO(priv, "Runtime uCode is good in inst SRAM\n");
+                return 0;
+        }
+
+        IWL_ERR(priv, "NO VALID UCODE IMAGE IN INSTRUCTION SRAM!!\n");
+
+        /* Since nothing seems to match, show first several data entries in
+         * instruction SRAM, so maybe visual inspection will give a clue.
+         * Selection of bootstrap image (vs. other images) is arbitrary. */
+        image = (__le32 *)priv->ucode_boot.v_addr;
+        len = priv->ucode_boot.len;
+        ret = iwl_verify_inst_full(priv, image, len);
+
+        return ret;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 24aff654fa9c..7488a68b83b1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -120,7 +120,7 @@ int iwl_commit_rxon(struct iwl_priv *priv)
             (priv->switch_rxon.channel != priv->staging_rxon.channel)) {
                 IWL_DEBUG_11H(priv, "abort channel switch on %d\n",
                       le16_to_cpu(priv->switch_rxon.channel));
-                priv->switch_rxon.switch_in_progress = false;
+                iwl_chswitch_done(priv, false);
         }
 
         /* If we don't need to send a full RXON, we can use
@@ -367,7 +367,8 @@ static unsigned int iwl_hw_get_beacon_cmd(struct iwl_priv *priv,
 
         /* Set up packet rate and flags */
         rate = iwl_rate_get_lowest_plcp(priv);
-        priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant);
+        priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
+                                              priv->hw_params.valid_tx_ant);
         rate_flags = iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
         if ((rate >= IWL_FIRST_CCK_RATE) && (rate <= IWL_LAST_CCK_RATE))
                 rate_flags |= RATE_MCS_CCK_MSK;
@@ -474,18 +475,25 @@ void iwl_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq)
         /* Unmap tx_cmd */
         if (num_tbs)
                 pci_unmap_single(dev,
-                                pci_unmap_addr(&txq->meta[index], mapping),
-                                pci_unmap_len(&txq->meta[index], len),
+                                dma_unmap_addr(&txq->meta[index], mapping),
+                                dma_unmap_len(&txq->meta[index], len),
                                 PCI_DMA_BIDIRECTIONAL);
 
         /* Unmap chunks, if any. */
-        for (i = 1; i < num_tbs; i++) {
+        for (i = 1; i < num_tbs; i++)
                 pci_unmap_single(dev, iwl_tfd_tb_get_addr(tfd, i),
                                 iwl_tfd_tb_get_len(tfd, i), PCI_DMA_TODEVICE);
 
-                if (txq->txb) {
-                        dev_kfree_skb(txq->txb[txq->q.read_ptr].skb[i - 1]);
-                        txq->txb[txq->q.read_ptr].skb[i - 1] = NULL;
+        /* free SKB */
+        if (txq->txb) {
+                struct sk_buff *skb;
+
+                skb = txq->txb[txq->q.read_ptr].skb;
+
+                /* can be called from irqs-disabled context */
+                if (skb) {
+                        dev_kfree_skb_any(skb);
+                        txq->txb[txq->q.read_ptr].skb = NULL;
                 }
         }
 }
@@ -933,6 +941,8 @@ void iwl_rx_handle(struct iwl_priv *priv)
                 fill_rx = 1;
 
         while (i != r) {
+                int len;
+
                 rxb = rxq->queue[i];
 
                 /* If an RXB doesn't have a Rx queue slot associated with it,
@@ -947,8 +957,9 @@ void iwl_rx_handle(struct iwl_priv *priv)
                                PCI_DMA_FROMDEVICE);
                 pkt = rxb_addr(rxb);
 
-                trace_iwlwifi_dev_rx(priv, pkt,
-                        le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
+                len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+                len += sizeof(u32); /* account for status word */
+                trace_iwlwifi_dev_rx(priv, pkt, len);
 
                 /* Reclaim a command buffer only if this packet is a response
                  *   to a (driver-originated) command.
@@ -1450,13 +1461,13 @@ bool iwl_good_ack_health(struct iwl_priv *priv,
 
         actual_ack_cnt_delta =
                 le32_to_cpu(pkt->u.stats.tx.actual_ack_cnt) -
-                le32_to_cpu(priv->statistics.tx.actual_ack_cnt);
+                le32_to_cpu(priv->_agn.statistics.tx.actual_ack_cnt);
         expected_ack_cnt_delta =
                 le32_to_cpu(pkt->u.stats.tx.expected_ack_cnt) -
-                le32_to_cpu(priv->statistics.tx.expected_ack_cnt);
+                le32_to_cpu(priv->_agn.statistics.tx.expected_ack_cnt);
         ba_timeout_delta =
                 le32_to_cpu(pkt->u.stats.tx.agg.ba_timeout) -
-                le32_to_cpu(priv->statistics.tx.agg.ba_timeout);
+                le32_to_cpu(priv->_agn.statistics.tx.agg.ba_timeout);
         if ((priv->_agn.agg_tids_count > 0) &&
             (expected_ack_cnt_delta > 0) &&
             (((actual_ack_cnt_delta * 100) / expected_ack_cnt_delta)
@@ -1466,12 +1477,17 @@ bool iwl_good_ack_health(struct iwl_priv *priv,
                                 " expected_ack_cnt = %d\n",
                                 actual_ack_cnt_delta, expected_ack_cnt_delta);
 
-#ifdef CONFIG_IWLWIFI_DEBUG
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+                /*
+                 * This is ifdef'ed on DEBUGFS because otherwise the
+                 * statistics aren't available. If DEBUGFS is set but
+                 * DEBUG is not, these will just compile out.
+                 */
                 IWL_DEBUG_RADIO(priv, "rx_detected_cnt delta = %d\n",
-                                priv->delta_statistics.tx.rx_detected_cnt);
+                                priv->_agn.delta_statistics.tx.rx_detected_cnt);
                 IWL_DEBUG_RADIO(priv,
                                 "ack_or_ba_timeout_collision delta = %d\n",
-                                priv->delta_statistics.tx.
+                                priv->_agn.delta_statistics.tx.
                                 ack_or_ba_timeout_collision);
 #endif
                 IWL_DEBUG_RADIO(priv, "agg ba_timeout delta = %d\n",
@@ -1694,6 +1710,9 @@ struct iwlagn_firmware_pieces {
         size_t inst_size, data_size, init_size, init_data_size, boot_size;
 
         u32 build;
+
+        u32 init_evtlog_ptr, init_evtlog_size, init_errlog_ptr;
+        u32 inst_evtlog_ptr, inst_evtlog_size, inst_errlog_ptr;
 };
 
 static int iwlagn_load_legacy_firmware(struct iwl_priv *priv,
@@ -1871,6 +1890,42 @@ static int iwlagn_load_firmware(struct iwl_priv *priv,
                         capa->max_probe_length =
                                 le32_to_cpup((__le32 *)tlv_data);
                         break;
+                case IWL_UCODE_TLV_INIT_EVTLOG_PTR:
+                        if (tlv_len != 4)
+                                return -EINVAL;
+                        pieces->init_evtlog_ptr =
+                                le32_to_cpup((__le32 *)tlv_data);
+                        break;
+                case IWL_UCODE_TLV_INIT_EVTLOG_SIZE:
+                        if (tlv_len != 4)
+                                return -EINVAL;
+                        pieces->init_evtlog_size =
+                                le32_to_cpup((__le32 *)tlv_data);
+                        break;
+                case IWL_UCODE_TLV_INIT_ERRLOG_PTR:
+                        if (tlv_len != 4)
+                                return -EINVAL;
+                        pieces->init_errlog_ptr =
+                                le32_to_cpup((__le32 *)tlv_data);
+                        break;
+                case IWL_UCODE_TLV_RUNT_EVTLOG_PTR:
+                        if (tlv_len != 4)
+                                return -EINVAL;
+                        pieces->inst_evtlog_ptr =
+                                le32_to_cpup((__le32 *)tlv_data);
+                        break;
+                case IWL_UCODE_TLV_RUNT_EVTLOG_SIZE:
+                        if (tlv_len != 4)
+                                return -EINVAL;
+                        pieces->inst_evtlog_size =
+                                le32_to_cpup((__le32 *)tlv_data);
+                        break;
+                case IWL_UCODE_TLV_RUNT_ERRLOG_PTR:
+                        if (tlv_len != 4)
+                                return -EINVAL;
+                        pieces->inst_errlog_ptr =
+                                le32_to_cpup((__le32 *)tlv_data);
+                        break;
                 default:
                         break;
                 }
@@ -2063,6 +2118,26 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
                         goto err_pci_alloc;
         }
 
+        /* Now that we can no longer fail, copy information */
+
+        /*
+         * The (size - 16) / 12 formula is based on the information recorded
+         * for each event, which is of mode 1 (including timestamp) for all
+         * new microcodes that include this information.
+         */
+        priv->_agn.init_evtlog_ptr = pieces.init_evtlog_ptr;
+        if (pieces.init_evtlog_size)
+                priv->_agn.init_evtlog_size = (pieces.init_evtlog_size - 16)/12;
+        else
+                priv->_agn.init_evtlog_size = priv->cfg->max_event_log_size;
+        priv->_agn.init_errlog_ptr = pieces.init_errlog_ptr;
+        priv->_agn.inst_evtlog_ptr = pieces.inst_evtlog_ptr;
+        if (pieces.inst_evtlog_size)
+                priv->_agn.inst_evtlog_size = (pieces.inst_evtlog_size - 16)/12;
+        else
+                priv->_agn.inst_evtlog_size = priv->cfg->max_event_log_size;
+        priv->_agn.inst_errlog_ptr = pieces.inst_errlog_ptr;
+
         /* Copy images into buffers for card's bus-master reads ... */
 
         /* Runtime instructions (first block of data in file) */
@@ -2195,10 +2270,15 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
         u32 blink1, blink2, ilink1, ilink2;
         u32 pc, hcmd;
 
-        if (priv->ucode_type == UCODE_INIT)
+        if (priv->ucode_type == UCODE_INIT) {
                 base = le32_to_cpu(priv->card_alive_init.error_event_table_ptr);
-        else
+                if (!base)
+                        base = priv->_agn.init_errlog_ptr;
+        } else {
                 base = le32_to_cpu(priv->card_alive.error_event_table_ptr);
+                if (!base)
+                        base = priv->_agn.inst_errlog_ptr;
+        }
 
         if (!priv->cfg->ops->lib->is_valid_rtc_data_addr(base)) {
                 IWL_ERR(priv,
@@ -2230,9 +2310,9 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
         trace_iwlwifi_dev_ucode_error(priv, desc, time, data1, data2, line,
                                       blink1, blink2, ilink1, ilink2);
 
-        IWL_ERR(priv, "Desc                               Time       "
+        IWL_ERR(priv, "Desc                                  Time       "
                 "data1      data2      line\n");
-        IWL_ERR(priv, "%-28s (#%02d) %010u 0x%08X 0x%08X %u\n",
+        IWL_ERR(priv, "%-28s (0x%04X) %010u 0x%08X 0x%08X %u\n",
                 desc_lookup(desc), desc, time, data1, data2, line);
         IWL_ERR(priv, "pc      blink1  blink2  ilink1  ilink2  hcmd\n");
         IWL_ERR(priv, "0x%05X 0x%05X 0x%05X 0x%05X 0x%05X 0x%05X\n",
@@ -2258,10 +2338,16 @@ static int iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
 
         if (num_events == 0)
                 return pos;
-        if (priv->ucode_type == UCODE_INIT)
+
+        if (priv->ucode_type == UCODE_INIT) {
                 base = le32_to_cpu(priv->card_alive_init.log_event_table_ptr);
-        else
+                if (!base)
+                        base = priv->_agn.init_evtlog_ptr;
+        } else {
                 base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
+                if (!base)
+                        base = priv->_agn.inst_evtlog_ptr;
+        }
 
         if (mode == 0)
                 event_size = 2 * sizeof(u32);
@@ -2363,13 +2449,21 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
         u32 num_wraps;  /* # times uCode wrapped to top of log */
         u32 next_entry; /* index of next entry to be written by uCode */
         u32 size;       /* # entries that we'll print */
+        u32 logsize;
         int pos = 0;
         size_t bufsz = 0;
 
-        if (priv->ucode_type == UCODE_INIT)
+        if (priv->ucode_type == UCODE_INIT) {
                 base = le32_to_cpu(priv->card_alive_init.log_event_table_ptr);
-        else
+                logsize = priv->_agn.init_evtlog_size;
+                if (!base)
+                        base = priv->_agn.init_evtlog_ptr;
+        } else {
                 base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
+                logsize = priv->_agn.inst_evtlog_size;
+                if (!base)
+                        base = priv->_agn.inst_evtlog_ptr;
+        }
 
         if (!priv->cfg->ops->lib->is_valid_rtc_data_addr(base)) {
                 IWL_ERR(priv,
@@ -2384,16 +2478,16 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
         num_wraps = iwl_read_targ_mem(priv, base + (2 * sizeof(u32)));
         next_entry = iwl_read_targ_mem(priv, base + (3 * sizeof(u32)));
 
-        if (capacity > priv->cfg->max_event_log_size) {
+        if (capacity > logsize) {
                 IWL_ERR(priv, "Log capacity %d is bogus, limit to %d entries\n",
-                        capacity, priv->cfg->max_event_log_size);
-                capacity = priv->cfg->max_event_log_size;
+                        capacity, logsize);
+                capacity = logsize;
         }
 
-        if (next_entry > priv->cfg->max_event_log_size) {
+        if (next_entry > logsize) {
                 IWL_ERR(priv, "Log write index %d is bogus, limit to %d\n",
-                        next_entry, priv->cfg->max_event_log_size);
-                next_entry = priv->cfg->max_event_log_size;
+                        next_entry, logsize);
+                next_entry = logsize;
         }
 
         size = num_wraps ? capacity : next_entry;
@@ -2518,8 +2612,6 @@ static void iwl_alive_start(struct iwl_priv *priv)
 
                 if (priv->cfg->ops->hcmd->set_rxon_chain)
                         priv->cfg->ops->hcmd->set_rxon_chain(priv);
-
-                memcpy(priv->staging_rxon.node_addr, priv->mac_addr, ETH_ALEN);
         }
 
         /* Configure Bluetooth device coexistence support */
@@ -2843,9 +2935,9 @@ static void iwl_bg_run_time_calib_work(struct work_struct *work)
         }
 
         if (priv->start_calib) {
-                iwl_chain_noise_calibration(priv, &priv->statistics);
+                iwl_chain_noise_calibration(priv, &priv->_agn.statistics);
 
-                iwl_sensitivity_calibration(priv, &priv->statistics);
+                iwl_sensitivity_calibration(priv, &priv->_agn.statistics);
         }
 
         mutex_unlock(&priv->mutex);
@@ -2934,20 +3026,16 @@ void iwl_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
         IWL_DEBUG_ASSOC(priv, "assoc id %d beacon interval %d\n",
                         vif->bss_conf.aid, vif->bss_conf.beacon_int);
 
-        if (vif->bss_conf.assoc_capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
+        if (vif->bss_conf.use_short_preamble)
                 priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
         else
                 priv->staging_rxon.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
         if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
-                if (vif->bss_conf.assoc_capability &
-                                        WLAN_CAPABILITY_SHORT_SLOT_TIME)
+                if (vif->bss_conf.use_short_slot)
                         priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
                 else
                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
-
-                if (vif->type == NL80211_IFTYPE_ADHOC)
-                        priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
         }
 
         iwlcore_commit_rxon(priv);
@@ -3173,8 +3261,7 @@ void iwl_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
                 priv->staging_rxon.assoc_id = 0;
 
-                if (vif->bss_conf.assoc_capability &
-                                                WLAN_CAPABILITY_SHORT_PREAMBLE)
+                if (vif->bss_conf.use_short_preamble)
                         priv->staging_rxon.flags |=
                                 RXON_FLG_SHORT_PREAMBLE_MSK;
                 else
@@ -3182,17 +3269,12 @@ void iwl_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
                                 ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
                 if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
-                        if (vif->bss_conf.assoc_capability &
-                                                WLAN_CAPABILITY_SHORT_SLOT_TIME)
+                        if (vif->bss_conf.use_short_slot)
                                 priv->staging_rxon.flags |=
                                         RXON_FLG_SHORT_SLOT_MSK;
                         else
                                 priv->staging_rxon.flags &=
                                         ~RXON_FLG_SHORT_SLOT_MSK;
-
-                        if (vif->type == NL80211_IFTYPE_ADHOC)
-                                priv->staging_rxon.flags &=
-                                        ~RXON_FLG_SHORT_SLOT_MSK;
                 }
                 /* restore RXON assoc */
                 priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
@@ -3238,17 +3320,9 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 return -EOPNOTSUPP;
         }
 
-        if (sta) {
-                sta_id = iwl_sta_id(sta);
-
-                if (sta_id == IWL_INVALID_STATION) {
-                        IWL_DEBUG_MAC80211(priv, "leave - %pM not in station map.\n",
-                                           sta->addr);
-                        return -EINVAL;
-                }
-        } else {
-                sta_id = priv->hw_params.bcast_sta_id;
-        }
+        sta_id = iwl_sta_id_or_broadcast(priv, sta);
+        if (sta_id == IWL_INVALID_STATION)
+                return -EINVAL;
 
         mutex_lock(&priv->mutex);
         iwl_scan_cancel_timeout(priv, 100);
@@ -3300,7 +3374,7 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
                                 struct ieee80211_sta *sta, u16 tid, u16 *ssn)
 {
         struct iwl_priv *priv = hw->priv;
-        int ret;
+        int ret = -EINVAL;
 
         IWL_DEBUG_HT(priv, "A-MPDU action on addr %pM tid %d\n",
                      sta->addr, tid);
@@ -3308,17 +3382,19 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
         if (!(priv->cfg->sku & IWL_SKU_N))
                 return -EACCES;
 
+        mutex_lock(&priv->mutex);
+
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
                 IWL_DEBUG_HT(priv, "start Rx\n");
-                return iwl_sta_rx_agg_start(priv, sta, tid, *ssn);
+                ret = iwl_sta_rx_agg_start(priv, sta, tid, *ssn);
+                break;
         case IEEE80211_AMPDU_RX_STOP:
                 IWL_DEBUG_HT(priv, "stop Rx\n");
                 ret = iwl_sta_rx_agg_stop(priv, sta, tid);
                 if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                        return 0;
-                else
-                        return ret;
+                        ret = 0;
+                break;
         case IEEE80211_AMPDU_TX_START:
                 IWL_DEBUG_HT(priv, "start Tx\n");
                 ret = iwlagn_tx_agg_start(priv, vif, sta, tid, ssn);
@@ -3327,7 +3403,7 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
                         IWL_DEBUG_HT(priv, "priv->_agn.agg_tids_count = %u\n",
                                      priv->_agn.agg_tids_count);
                 }
-                return ret;
+                break;
         case IEEE80211_AMPDU_TX_STOP:
                 IWL_DEBUG_HT(priv, "stop Tx\n");
                 ret = iwlagn_tx_agg_stop(priv, vif, sta, tid);
@@ -3337,18 +3413,15 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
                                      priv->_agn.agg_tids_count);
                 }
                 if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                        return 0;
-                else
-                        return ret;
+                        ret = 0;
+                break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
-                /* do nothing */
-                return -EOPNOTSUPP;
-        default:
-                IWL_DEBUG_HT(priv, "unknown\n");
-                return -EINVAL;
+                /* do nothing, return value ignored */
                 break;
         }
-        return 0;
+        mutex_unlock(&priv->mutex);
+
+        return ret;
 }
 
 static void iwl_mac_sta_notify(struct ieee80211_hw *hw,
@@ -3423,6 +3496,98 @@ static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
         return 0;
 }
 
+static void iwl_mac_channel_switch(struct ieee80211_hw *hw,
+                                   struct ieee80211_channel_switch *ch_switch)
+{
+        struct iwl_priv *priv = hw->priv;
+        const struct iwl_channel_info *ch_info;
+        struct ieee80211_conf *conf = &hw->conf;
+        struct iwl_ht_config *ht_conf = &priv->current_ht_config;
+        u16 ch;
+        unsigned long flags = 0;
+
+        IWL_DEBUG_MAC80211(priv, "enter\n");
+
+        if (iwl_is_rfkill(priv))
+                goto out_exit;
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
+            test_bit(STATUS_SCANNING, &priv->status))
+                goto out_exit;
+
+        if (!iwl_is_associated(priv))
+                goto out_exit;
+
+        /* channel switch in progress */
+        if (priv->switch_rxon.switch_in_progress == true)
+                goto out_exit;
+
+        mutex_lock(&priv->mutex);
+        if (priv->cfg->ops->lib->set_channel_switch) {
+
+                ch = ieee80211_frequency_to_channel(
+                        ch_switch->channel->center_freq);
+                if (le16_to_cpu(priv->active_rxon.channel) != ch) {
+                        ch_info = iwl_get_channel_info(priv,
+                                                       conf->channel->band,
+                                                       ch);
+                        if (!is_channel_valid(ch_info)) {
+                                IWL_DEBUG_MAC80211(priv, "invalid channel\n");
+                                goto out;
+                        }
+                        spin_lock_irqsave(&priv->lock, flags);
+
+                        priv->current_ht_config.smps = conf->smps_mode;
+
+                        /* Configure HT40 channels */
+                        ht_conf->is_ht = conf_is_ht(conf);
+                        if (ht_conf->is_ht) {
+                                if (conf_is_ht40_minus(conf)) {
+                                        ht_conf->extension_chan_offset =
+                                                IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                                        ht_conf->is_40mhz = true;
+                                } else if (conf_is_ht40_plus(conf)) {
+                                        ht_conf->extension_chan_offset =
+                                                IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                                        ht_conf->is_40mhz = true;
+                                } else {
+                                        ht_conf->extension_chan_offset =
+                                                IEEE80211_HT_PARAM_CHA_SEC_NONE;
+                                        ht_conf->is_40mhz = false;
+                                }
+                        } else
+                                ht_conf->is_40mhz = false;
+
+                        /* if we are switching from ht to 2.4 clear flags
+                         * from any ht related info since 2.4 does not
+                         * support ht */
+                        if ((le16_to_cpu(priv->staging_rxon.channel) != ch))
+                                priv->staging_rxon.flags = 0;
+
+                        iwl_set_rxon_channel(priv, conf->channel);
+                        iwl_set_rxon_ht(priv, ht_conf);
+                        iwl_set_flags_for_band(priv, conf->channel->band,
+                                               priv->vif);
+                        spin_unlock_irqrestore(&priv->lock, flags);
+
+                        iwl_set_rate(priv);
+                        /*
+                         * at this point, staging_rxon has the
+                         * configuration for channel switch
+                         */
+                        if (priv->cfg->ops->lib->set_channel_switch(priv,
+                                                                    ch_switch))
+                                priv->switch_rxon.switch_in_progress = false;
+                }
+        }
+out:
+        mutex_unlock(&priv->mutex);
+out_exit:
+        if (!priv->switch_rxon.switch_in_progress)
+                ieee80211_chswitch_done(priv->vif, false);
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+}
+
 /*****************************************************************************
  *
  * driver setup and teardown
@@ -3479,6 +3644,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
         cancel_delayed_work(&priv->scan_check);
         cancel_work_sync(&priv->start_internal_scan);
         cancel_delayed_work(&priv->alive_start);
+        cancel_work_sync(&priv->run_time_calib_work);
         cancel_work_sync(&priv->beacon_update);
         del_timer_sync(&priv->statistics_periodic);
         del_timer_sync(&priv->ucode_trace);
@@ -3594,6 +3760,7 @@ static struct ieee80211_ops iwl_hw_ops = {
         .sta_notify = iwl_mac_sta_notify,
         .sta_add = iwlagn_mac_sta_add,
         .sta_remove = iwl_mac_sta_remove,
+        .channel_switch = iwl_mac_channel_switch,
 };
 
 static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
@@ -3604,6 +3771,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         struct iwl_cfg *cfg = (struct iwl_cfg *)(ent->driver_data);
         unsigned long flags;
         u16 pci_cmd;
+        u8 perm_addr[ETH_ALEN];
 
         /************************
          * 1. Allocating HW data
@@ -3633,9 +3801,6 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         priv->pci_dev = pdev;
         priv->inta_mask = CSR_INI_SET_MASK;
 
-#ifdef CONFIG_IWLWIFI_DEBUG
-        atomic_set(&priv->restrict_refcnt, 0);
-#endif
         if (iwl_alloc_traffic_mem(priv))
                 IWL_ERR(priv, "Not enough memory to generate traffic log\n");
 
@@ -3724,9 +3889,9 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto out_free_eeprom;
 
         /* extract MAC Address */
-        iwl_eeprom_get_mac(priv, priv->mac_addr);
-        IWL_DEBUG_INFO(priv, "MAC address: %pM\n", priv->mac_addr);
-        SET_IEEE80211_PERM_ADDR(priv->hw, priv->mac_addr);
+        iwl_eeprom_get_mac(priv, perm_addr);
+        IWL_DEBUG_INFO(priv, "MAC address: %pM\n", perm_addr);
+        SET_IEEE80211_PERM_ADDR(priv->hw, perm_addr);
 
         /************************
          * 5. Setup HW constants
@@ -3993,6 +4158,47 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x0082, 0x1201, iwl6000g2a_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0085, 0x1211, iwl6000g2a_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1221, iwl6000g2a_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1206, iwl6000g2a_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0085, 0x1216, iwl6000g2a_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1226, iwl6000g2a_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1207, iwl6000g2a_2bg_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1301, iwl6000g2a_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1306, iwl6000g2a_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1307, iwl6000g2a_2bg_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1321, iwl6000g2a_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1326, iwl6000g2a_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0085, 0x1311, iwl6000g2a_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0085, 0x1316, iwl6000g2a_2abg_cfg)},
+
+/* 6x00 Series Gen2b */
+        {IWL_PCI_DEVICE(0x008F, 0x5105, iwl6000g2b_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0090, 0x5115, iwl6000g2b_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x008F, 0x5125, iwl6000g2b_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x008F, 0x5107, iwl6000g2b_bg_cfg)},
+        {IWL_PCI_DEVICE(0x008F, 0x5201, iwl6000g2b_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0090, 0x5211, iwl6000g2b_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x008F, 0x5221, iwl6000g2b_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x008F, 0x5206, iwl6000g2b_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0090, 0x5216, iwl6000g2b_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x008F, 0x5226, iwl6000g2b_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x008F, 0x5207, iwl6000g2b_2bg_cfg)},
+        {IWL_PCI_DEVICE(0x008A, 0x5301, iwl6000g2b_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x008A, 0x5305, iwl6000g2b_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x008A, 0x5307, iwl6000g2b_bg_cfg)},
+        {IWL_PCI_DEVICE(0x008A, 0x5321, iwl6000g2b_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x008A, 0x5325, iwl6000g2b_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x008B, 0x5311, iwl6000g2b_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x008B, 0x5315, iwl6000g2b_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0090, 0x5211, iwl6000g2b_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0090, 0x5215, iwl6000g2b_2bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0090, 0x5216, iwl6000g2b_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0091, 0x5201, iwl6000g2b_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0091, 0x5205, iwl6000g2b_2bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0091, 0x5206, iwl6000g2b_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0091, 0x5207, iwl6000g2b_2bg_cfg)},
+        {IWL_PCI_DEVICE(0x0091, 0x5221, iwl6000g2b_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0091, 0x5225, iwl6000g2b_2bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0091, 0x5226, iwl6000g2b_2abg_cfg)},
 
 /* 6x50 WiFi/WiMax Series */
         {IWL_PCI_DEVICE(0x0087, 0x1301, iwl6050_2agn_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
index 2d748053358e..be9d298cae2c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -65,6 +65,33 @@
 
 #include "iwl-dev.h"
 
+/* configuration for the _agn devices */
+extern struct iwl_cfg iwl4965_agn_cfg;
+extern struct iwl_cfg iwl5300_agn_cfg;
+extern struct iwl_cfg iwl5100_agn_cfg;
+extern struct iwl_cfg iwl5350_agn_cfg;
+extern struct iwl_cfg iwl5100_bgn_cfg;
+extern struct iwl_cfg iwl5100_abg_cfg;
+extern struct iwl_cfg iwl5150_agn_cfg;
+extern struct iwl_cfg iwl5150_abg_cfg;
+extern struct iwl_cfg iwl6000g2a_2agn_cfg;
+extern struct iwl_cfg iwl6000g2a_2abg_cfg;
+extern struct iwl_cfg iwl6000g2a_2bg_cfg;
+extern struct iwl_cfg iwl6000g2b_bgn_cfg;
+extern struct iwl_cfg iwl6000g2b_bg_cfg;
+extern struct iwl_cfg iwl6000g2b_2agn_cfg;
+extern struct iwl_cfg iwl6000g2b_2abg_cfg;
+extern struct iwl_cfg iwl6000g2b_2bgn_cfg;
+extern struct iwl_cfg iwl6000g2b_2bg_cfg;
+extern struct iwl_cfg iwl6000i_2agn_cfg;
+extern struct iwl_cfg iwl6000i_2abg_cfg;
+extern struct iwl_cfg iwl6000i_2bg_cfg;
+extern struct iwl_cfg iwl6000_3agn_cfg;
+extern struct iwl_cfg iwl6050_2agn_cfg;
+extern struct iwl_cfg iwl6050_2abg_cfg;
+extern struct iwl_cfg iwl1000_bgn_cfg;
+extern struct iwl_cfg iwl1000_bg_cfg;
+
 extern struct iwl_mod_params iwlagn_mod_params;
 extern struct iwl_hcmd_ops iwlagn_hcmd;
 extern struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
@@ -93,6 +120,8 @@ int iwlagn_txq_agg_enable(struct iwl_priv *priv, int txq_id,
 int iwlagn_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                            u16 ssn_idx, u8 tx_fifo);
 void iwlagn_txq_set_sched(struct iwl_priv *priv, u32 mask);
+void iwl_free_tfds_in_queue(struct iwl_priv *priv,
+                            int sta_id, int tid, int freed);
 
 /* uCode */
 int iwlagn_load_ucode(struct iwl_priv *priv);
@@ -102,6 +131,7 @@ void iwlagn_rx_calib_complete(struct iwl_priv *priv,
                            struct iwl_rx_mem_buffer *rxb);
 void iwlagn_init_alive_start(struct iwl_priv *priv);
 int iwlagn_alive_notify(struct iwl_priv *priv);
+int iwl_verify_ucode(struct iwl_priv *priv);
 
 /* lib */
 void iwl_check_abort_status(struct iwl_priv *priv,
@@ -171,6 +201,16 @@ static inline bool iwl_is_tx_success(u32 status)
                (status == TX_STATUS_DIRECT_DONE);
 }
 
+/* rx */
+void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
+                                struct iwl_rx_mem_buffer *rxb);
+bool iwl_good_plcp_health(struct iwl_priv *priv,
+                          struct iwl_rx_packet *pkt);
+void iwl_rx_statistics(struct iwl_priv *priv,
+                       struct iwl_rx_mem_buffer *rxb);
+void iwl_reply_statistics(struct iwl_priv *priv,
+                          struct iwl_rx_mem_buffer *rxb);
+
 /* scan */
 void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
 
@@ -178,4 +218,8 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
                                struct ieee80211_vif *vif, bool add);
 
+/* hcmd */
+int iwlagn_send_rxon_assoc(struct iwl_priv *priv);
+int iwlagn_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant);
+
 #endif /* __iwl_agn_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 9aab020c474b..498492565912 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -95,7 +95,7 @@ enum {
 
         /* Multi-Station support */
         REPLY_ADD_STA = 0x18,
-        REPLY_REMOVE_STA = 0x19,        /* not used */
+        REPLY_REMOVE_STA = 0x19,
         REPLY_REMOVE_ALL_STA = 0x1a,    /* not used */
 
         /* Security */
@@ -952,7 +952,6 @@ struct iwl_qosparam_cmd {
 
 /* Special, dedicated locations within device's station table */
 #define IWL_AP_ID               0
-#define IWL_MULTICAST_ID        1
 #define IWL_STA_ID              2
 #define IWL3945_BROADCAST_ID    24
 #define IWL3945_STATION_COUNT   25
@@ -1367,7 +1366,7 @@ struct iwl_rx_phy_res {
         __le16 reserved3;
 } __attribute__ ((packed));
 
-struct iwl4965_rx_mpdu_res_start {
+struct iwl_rx_mpdu_res_start {
         __le16 byte_count;
         __le16 reserved;
 } __attribute__ ((packed));
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 5bbc5298ef96..329e5107b5c3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -141,13 +141,14 @@ int iwl_hwrate_to_plcp_idx(u32 rate_n_flags)
 }
 EXPORT_SYMBOL(iwl_hwrate_to_plcp_idx);
 
-u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant)
+u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant, u8 valid)
 {
         int i;
         u8 ind = ant;
+
         for (i = 0; i < RATE_ANT_NUM - 1; i++) {
                 ind = (ind + 1) < RATE_ANT_NUM ?  ind + 1 : 0;
-                if (priv->hw_params.valid_tx_ant & BIT(ind))
+                if (valid & BIT(ind))
                         return ind;
         }
         return ant;
@@ -457,7 +458,7 @@ u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                 if (!sta_ht_inf->ht_supported)
                         return 0;
         }
-#ifdef CONFIG_IWLWIFI_DEBUG
+#ifdef CONFIG_IWLWIFI_DEBUGFS
         if (priv->disable_ht40)
                 return 0;
 #endif
@@ -506,11 +507,11 @@ void iwl_setup_rxon_timing(struct iwl_priv *priv, struct ieee80211_vif *vif)
         }
 
         beacon_int = iwl_adjust_beacon_interval(beacon_int,
-                                priv->hw_params.max_beacon_itrvl * 1024);
+                                priv->hw_params.max_beacon_itrvl * TIME_UNIT);
         priv->rxon_timing.beacon_interval = cpu_to_le16(beacon_int);
 
         tsf = priv->timestamp; /* tsf is modifed by do_div: copy it */
-        interval_tm = beacon_int * 1024;
+        interval_tm = beacon_int * TIME_UNIT;
         rem = do_div(tsf, interval_tm);
         priv->rxon_timing.beacon_init_val = cpu_to_le32(interval_tm - rem);
 
@@ -932,9 +933,9 @@ int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch)
 }
 EXPORT_SYMBOL(iwl_set_rxon_channel);
 
-static void iwl_set_flags_for_band(struct iwl_priv *priv,
-                                   enum ieee80211_band band,
-                                   struct ieee80211_vif *vif)
+void iwl_set_flags_for_band(struct iwl_priv *priv,
+                            enum ieee80211_band band,
+                            struct ieee80211_vif *vif)
 {
         if (band == IEEE80211_BAND_5GHZ) {
                 priv->staging_rxon.flags &=
@@ -943,19 +944,17 @@ static void iwl_set_flags_for_band(struct iwl_priv *priv,
                 priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
         } else {
                 /* Copied from iwl_post_associate() */
-                if (vif && vif->bss_conf.assoc_capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
+                if (vif && vif->bss_conf.use_short_slot)
                         priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
                 else
                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
 
-                if (vif && vif->type == NL80211_IFTYPE_ADHOC)
-                        priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
-
                 priv->staging_rxon.flags |= RXON_FLG_BAND_24G_MSK;
                 priv->staging_rxon.flags |= RXON_FLG_AUTO_DETECT_MSK;
                 priv->staging_rxon.flags &= ~RXON_FLG_CCK_MSK;
         }
 }
+EXPORT_SYMBOL(iwl_set_flags_for_band);
 
 /*
  * initialize rxon structure with default values from eeprom
@@ -1021,15 +1020,17 @@ void iwl_connection_init_rx_config(struct iwl_priv *priv,
         /* clear both MIX and PURE40 mode flag */
         priv->staging_rxon.flags &= ~(RXON_FLG_CHANNEL_MODE_MIXED |
                                         RXON_FLG_CHANNEL_MODE_PURE_40);
-        memcpy(priv->staging_rxon.node_addr, priv->mac_addr, ETH_ALEN);
-        memcpy(priv->staging_rxon.wlap_bssid_addr, priv->mac_addr, ETH_ALEN);
+
+        if (vif)
+                memcpy(priv->staging_rxon.node_addr, vif->addr, ETH_ALEN);
+
         priv->staging_rxon.ofdm_ht_single_stream_basic_rates = 0xff;
         priv->staging_rxon.ofdm_ht_dual_stream_basic_rates = 0xff;
         priv->staging_rxon.ofdm_ht_triple_stream_basic_rates = 0xff;
 }
 EXPORT_SYMBOL(iwl_connection_init_rx_config);
 
-static void iwl_set_rate(struct iwl_priv *priv)
+void iwl_set_rate(struct iwl_priv *priv)
 {
         const struct ieee80211_supported_band *hw = NULL;
         struct ieee80211_rate *rate;
@@ -1057,6 +1058,21 @@ static void iwl_set_rate(struct iwl_priv *priv)
         priv->staging_rxon.ofdm_basic_rates =
            (IWL_OFDM_BASIC_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
 }
+EXPORT_SYMBOL(iwl_set_rate);
+
+void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
+{
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        if (priv->switch_rxon.switch_in_progress) {
+                ieee80211_chswitch_done(priv->vif, is_success);
+                mutex_lock(&priv->mutex);
+                priv->switch_rxon.switch_in_progress = false;
+                mutex_unlock(&priv->mutex);
+        }
+}
+EXPORT_SYMBOL(iwl_chswitch_done);
 
 void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 {
@@ -1071,11 +1087,12 @@ void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
                         priv->staging_rxon.channel = csa->channel;
                         IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
                               le16_to_cpu(csa->channel));
-                } else
+                        iwl_chswitch_done(priv, true);
+                } else {
                         IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
                               le16_to_cpu(csa->channel));
-
-                priv->switch_rxon.switch_in_progress = false;
+                        iwl_chswitch_done(priv, false);
+                }
         }
 }
 EXPORT_SYMBOL(iwl_rx_csa);
@@ -1507,130 +1524,6 @@ int iwl_send_statistics_request(struct iwl_priv *priv, u8 flags, bool clear)
 }
 EXPORT_SYMBOL(iwl_send_statistics_request);
 
-/**
- * iwl_verify_inst_sparse - verify runtime uCode image in card vs. host,
- *   using sample data 100 bytes apart.  If these sample points are good,
- *   it's a pretty good bet that everything between them is good, too.
- */
-static int iwlcore_verify_inst_sparse(struct iwl_priv *priv, __le32 *image, u32 len)
-{
-        u32 val;
-        int ret = 0;
-        u32 errcnt = 0;
-        u32 i;
-
-        IWL_DEBUG_INFO(priv, "ucode inst image size is %u\n", len);
-
-        for (i = 0; i < len; i += 100, image += 100/sizeof(u32)) {
-                /* read data comes through single port, auto-incr addr */
-                /* NOTE: Use the debugless read so we don't flood kernel log
-                 * if IWL_DL_IO is set */
-                iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR,
-                        i + IWL49_RTC_INST_LOWER_BOUND);
-                val = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
-                if (val != le32_to_cpu(*image)) {
-                        ret = -EIO;
-                        errcnt++;
-                        if (errcnt >= 3)
-                                break;
-                }
-        }
-
-        return ret;
-}
-
-/**
- * iwlcore_verify_inst_full - verify runtime uCode image in card vs. host,
- *     looking at all data.
- */
-static int iwl_verify_inst_full(struct iwl_priv *priv, __le32 *image,
-                                 u32 len)
-{
-        u32 val;
-        u32 save_len = len;
-        int ret = 0;
-        u32 errcnt;
-
-        IWL_DEBUG_INFO(priv, "ucode inst image size is %u\n", len);
-
-        iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR,
-                           IWL49_RTC_INST_LOWER_BOUND);
-
-        errcnt = 0;
-        for (; len > 0; len -= sizeof(u32), image++) {
-                /* read data comes through single port, auto-incr addr */
-                /* NOTE: Use the debugless read so we don't flood kernel log
-                 * if IWL_DL_IO is set */
-                val = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
-                if (val != le32_to_cpu(*image)) {
-                        IWL_ERR(priv, "uCode INST section is invalid at "
-                                  "offset 0x%x, is 0x%x, s/b 0x%x\n",
-                                  save_len - len, val, le32_to_cpu(*image));
-                        ret = -EIO;
-                        errcnt++;
-                        if (errcnt >= 20)
-                                break;
-                }
-        }
-
-        if (!errcnt)
-                IWL_DEBUG_INFO(priv,
-                    "ucode image in INSTRUCTION memory is good\n");
-
-        return ret;
-}
-
-/**
- * iwl_verify_ucode - determine which instruction image is in SRAM,
- *    and verify its contents
- */
-int iwl_verify_ucode(struct iwl_priv *priv)
-{
-        __le32 *image;
-        u32 len;
-        int ret;
-
-        /* Try bootstrap */
-        image = (__le32 *)priv->ucode_boot.v_addr;
-        len = priv->ucode_boot.len;
-        ret = iwlcore_verify_inst_sparse(priv, image, len);
-        if (!ret) {
-                IWL_DEBUG_INFO(priv, "Bootstrap uCode is good in inst SRAM\n");
-                return 0;
-        }
-
-        /* Try initialize */
-        image = (__le32 *)priv->ucode_init.v_addr;
-        len = priv->ucode_init.len;
-        ret = iwlcore_verify_inst_sparse(priv, image, len);
-        if (!ret) {
-                IWL_DEBUG_INFO(priv, "Initialize uCode is good in inst SRAM\n");
-                return 0;
-        }
-
-        /* Try runtime/protocol */
-        image = (__le32 *)priv->ucode_code.v_addr;
-        len = priv->ucode_code.len;
-        ret = iwlcore_verify_inst_sparse(priv, image, len);
-        if (!ret) {
-                IWL_DEBUG_INFO(priv, "Runtime uCode is good in inst SRAM\n");
-                return 0;
-        }
-
-        IWL_ERR(priv, "NO VALID UCODE IMAGE IN INSTRUCTION SRAM!!\n");
-
-        /* Since nothing seems to match, show first several data entries in
-         * instruction SRAM, so maybe visual inspection will give a clue.
-         * Selection of bootstrap image (vs. other images) is arbitrary. */
-        image = (__le32 *)priv->ucode_boot.v_addr;
-        len = priv->ucode_boot.len;
-        ret = iwl_verify_inst_full(priv, image, len);
-
-        return ret;
-}
-EXPORT_SYMBOL(iwl_verify_ucode);
-
-
 void iwl_rf_kill_ct_config(struct iwl_priv *priv)
 {
         struct iwl_ct_kill_config cmd;
@@ -2051,8 +1944,6 @@ static int iwl_set_mode(struct iwl_priv *priv, struct ieee80211_vif *vif)
         if (priv->cfg->ops->hcmd->set_rxon_chain)
                 priv->cfg->ops->hcmd->set_rxon_chain(priv);
 
-        memcpy(priv->staging_rxon.node_addr, priv->mac_addr, ETH_ALEN);
-
         return iwlcore_commit_rxon(priv);
 }
 
@@ -2061,7 +1952,8 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
         struct iwl_priv *priv = hw->priv;
         int err = 0;
 
-        IWL_DEBUG_MAC80211(priv, "enter: type %d\n", vif->type);
+        IWL_DEBUG_MAC80211(priv, "enter: type %d, addr %pM\n",
+                           vif->type, vif->addr);
 
         mutex_lock(&priv->mutex);
 
@@ -2079,9 +1971,6 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
         priv->vif = vif;
         priv->iw_mode = vif->type;
 
-        IWL_DEBUG_MAC80211(priv, "Set %pM\n", vif->addr);
-        memcpy(priv->mac_addr, vif->addr, ETH_ALEN);
-
         err = iwl_set_mode(priv, vif);
         if (err)
                 goto out_err;
@@ -2115,6 +2004,11 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
         }
         if (priv->vif == vif) {
                 priv->vif = NULL;
+                if (priv->scan_vif == vif) {
+                        ieee80211_scan_completed(priv->hw, true);
+                        priv->scan_vif = NULL;
+                        priv->scan_request = NULL;
+                }
                 memset(priv->bssid, 0, ETH_ALEN);
         }
         mutex_unlock(&priv->mutex);
@@ -2215,22 +2109,7 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
 
                 iwl_set_flags_for_band(priv, conf->channel->band, priv->vif);
                 spin_unlock_irqrestore(&priv->lock, flags);
-                if (iwl_is_associated(priv) &&
-                    (le16_to_cpu(priv->active_rxon.channel) != ch) &&
-                    priv->cfg->ops->lib->set_channel_switch) {
-                        iwl_set_rate(priv);
-                        /*
-                         * at this point, staging_rxon has the
-                         * configuration for channel switch
-                         */
-                        ret = priv->cfg->ops->lib->set_channel_switch(priv,
-                                ch);
-                        if (!ret) {
-                                iwl_print_rx_config_cmd(priv);
-                                goto out;
-                        }
-                        priv->switch_rxon.switch_in_progress = false;
-                }
+
  set_ch_out:
                 /* The list of supported rates and rate mask can be different
                  * for each band; since the band may have changed, reset
@@ -2588,7 +2467,7 @@ void iwl_update_stats(struct iwl_priv *priv, bool is_tx, __le16 fc, u16 len)
 EXPORT_SYMBOL(iwl_update_stats);
 #endif
 
-const static char *get_csr_string(int cmd)
+static const char *get_csr_string(int cmd)
 {
         switch (cmd) {
                 IWL_CMD(CSR_HW_IF_CONFIG_REG);
@@ -2659,7 +2538,7 @@ void iwl_dump_csr(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_dump_csr);
 
-const static char *get_fh_string(int cmd)
+static const char *get_fh_string(int cmd)
 {
         switch (cmd) {
                 IWL_CMD(FH_RSCSR_CHNL0_STTS_WPTR_REG);
@@ -2881,6 +2760,61 @@ void iwl_bg_monitor_recover(unsigned long data)
 }
 EXPORT_SYMBOL(iwl_bg_monitor_recover);
 
+
+/*
+ * extended beacon time format
+ * time in usec will be changed into a 32-bit value in extended:internal format
+ * the extended part is the beacon counts
+ * the internal part is the time in usec within one beacon interval
+ */
+u32 iwl_usecs_to_beacons(struct iwl_priv *priv, u32 usec, u32 beacon_interval)
+{
+        u32 quot;
+        u32 rem;
+        u32 interval = beacon_interval * TIME_UNIT;
+
+        if (!interval || !usec)
+                return 0;
+
+        quot = (usec / interval) &
+                (iwl_beacon_time_mask_high(priv,
+                priv->hw_params.beacon_time_tsf_bits) >>
+                priv->hw_params.beacon_time_tsf_bits);
+        rem = (usec % interval) & iwl_beacon_time_mask_low(priv,
+                                   priv->hw_params.beacon_time_tsf_bits);
+
+        return (quot << priv->hw_params.beacon_time_tsf_bits) + rem;
+}
+EXPORT_SYMBOL(iwl_usecs_to_beacons);
+
+/* base is usually what we get from ucode with each received frame,
+ * the same as HW timer counter counting down
+ */
+__le32 iwl_add_beacon_time(struct iwl_priv *priv, u32 base,
+                           u32 addon, u32 beacon_interval)
+{
+        u32 base_low = base & iwl_beacon_time_mask_low(priv,
+                                        priv->hw_params.beacon_time_tsf_bits);
+        u32 addon_low = addon & iwl_beacon_time_mask_low(priv,
+                                        priv->hw_params.beacon_time_tsf_bits);
+        u32 interval = beacon_interval * TIME_UNIT;
+        u32 res = (base & iwl_beacon_time_mask_high(priv,
+                                priv->hw_params.beacon_time_tsf_bits)) +
+                                (addon & iwl_beacon_time_mask_high(priv,
+                                priv->hw_params.beacon_time_tsf_bits));
+
+        if (base_low > addon_low)
+                res += base_low - addon_low;
+        else if (base_low < addon_low) {
+                res += interval + base_low - addon_low;
+                res += (1 << priv->hw_params.beacon_time_tsf_bits);
+        } else
+                res += (1 << priv->hw_params.beacon_time_tsf_bits);
+
+        return cpu_to_le32(res);
+}
+EXPORT_SYMBOL(iwl_add_beacon_time);
+
 #ifdef CONFIG_PM
 
 int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 31775bd9c361..5e72d743d9ee 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -79,6 +79,8 @@ struct iwl_cmd;
         .subvendor = PCI_ANY_ID, .subdevice = (subdev), \
         .driver_data = (kernel_ulong_t)&(cfg)
 
+#define TIME_UNIT               1024
+
 #define IWL_SKU_G       0x1
 #define IWL_SKU_A       0x2
 #define IWL_SKU_N       0x8
@@ -173,7 +175,8 @@ struct iwl_lib_ops {
         void (*dump_nic_error_log)(struct iwl_priv *priv);
         void (*dump_csr)(struct iwl_priv *priv);
         int (*dump_fh)(struct iwl_priv *priv, char **buf, bool display);
-        int (*set_channel_switch)(struct iwl_priv *priv, u16 channel);
+        int (*set_channel_switch)(struct iwl_priv *priv,
+                                  struct ieee80211_channel_switch *ch_switch);
         /* power management */
         struct iwl_apm_ops apm_ops;
 
@@ -325,7 +328,8 @@ struct iwl_cfg {
         const bool ucode_tracing;
         const bool sensitivity_calib_by_driver;
         const bool chain_noise_calib_by_driver;
-        u8 scan_antennas[IEEE80211_NUM_BANDS];
+        u8 scan_rx_antennas[IEEE80211_NUM_BANDS];
+        u8 scan_tx_antennas[IEEE80211_NUM_BANDS];
 };
 
 /***************************
@@ -343,6 +347,9 @@ int iwl_check_rxon_cmd(struct iwl_priv *priv);
 int iwl_full_rxon_required(struct iwl_priv *priv);
 void iwl_set_rxon_chain(struct iwl_priv *priv);
 int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch);
+void iwl_set_flags_for_band(struct iwl_priv *priv,
+                            enum ieee80211_band band,
+                            struct ieee80211_vif *vif);
 u8 iwl_get_single_channel_number(struct iwl_priv *priv,
                                   enum ieee80211_band band);
 void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf);
@@ -350,6 +357,7 @@ u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                          struct ieee80211_sta_ht_cap *sta_ht_inf);
 void iwl_connection_init_rx_config(struct iwl_priv *priv,
                                    struct ieee80211_vif *vif);
+void iwl_set_rate(struct iwl_priv *priv);
 int iwl_set_decrypted_flag(struct iwl_priv *priv,
                            struct ieee80211_hdr *hdr,
                            u32 decrypt_res,
@@ -447,20 +455,11 @@ void iwl_rx_queue_update_write_ptr(struct iwl_priv *priv,
 int iwl_rx_queue_space(const struct iwl_rx_queue *q);
 void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
 /* Handlers */
-void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
-                               struct iwl_rx_mem_buffer *rxb);
 void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
                                           struct iwl_rx_mem_buffer *rxb);
-bool iwl_good_plcp_health(struct iwl_priv *priv,
-                                 struct iwl_rx_packet *pkt);
-bool iwl_good_ack_health(struct iwl_priv *priv,
-                                 struct iwl_rx_packet *pkt);
 void iwl_recover_from_statistics(struct iwl_priv *priv,
                                 struct iwl_rx_packet *pkt);
-void iwl_rx_statistics(struct iwl_priv *priv,
-                              struct iwl_rx_mem_buffer *rxb);
-void iwl_reply_statistics(struct iwl_priv *priv,
-                          struct iwl_rx_mem_buffer *rxb);
+void iwl_chswitch_done(struct iwl_priv *priv, bool is_success);
 void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
 
 /* TX helpers */
@@ -474,8 +473,6 @@ int iwl_hw_txq_attach_buf_to_tfd(struct iwl_priv *priv,
                                  dma_addr_t addr, u16 len, u8 reset, u8 pad);
 int iwl_hw_tx_queue_init(struct iwl_priv *priv,
                          struct iwl_tx_queue *txq);
-void iwl_free_tfds_in_queue(struct iwl_priv *priv,
-                            int sta_id, int tid, int freed);
 void iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq);
 int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
                       int slots_num, u32 txq_id);
@@ -495,7 +492,7 @@ int iwl_hwrate_to_plcp_idx(u32 rate_n_flags);
 
 u8 iwl_rate_get_lowest_plcp(struct iwl_priv *priv);
 
-u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant_idx);
+u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant_idx, u8 valid);
 
 static inline u32 iwl_ant_idx_to_flags(u8 ant_idx)
 {
@@ -528,7 +525,7 @@ void iwl_bg_start_internal_scan(struct work_struct *work);
 void iwl_internal_short_hw_scan(struct iwl_priv *priv);
 int iwl_force_reset(struct iwl_priv *priv, int mode);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
-                       const u8 *ie, int ie_len, int left);
+                       const u8 *ta, const u8 *ie, int ie_len, int left);
 void iwl_setup_rx_scan_handlers(struct iwl_priv *priv);
 u16 iwl_get_active_dwell_time(struct iwl_priv *priv,
                               enum ieee80211_band band,
@@ -595,6 +592,9 @@ static inline u16 iwl_pcie_link_ctl(struct iwl_priv *priv)
 }
 
 void iwl_bg_monitor_recover(unsigned long data);
+u32 iwl_usecs_to_beacons(struct iwl_priv *priv, u32 usec, u32 beacon_interval);
+__le32 iwl_add_beacon_time(struct iwl_priv *priv, u32 base,
+                           u32 addon, u32 beacon_interval);
 
 #ifdef CONFIG_PM
 int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state);
@@ -693,7 +693,6 @@ extern void iwl_rf_kill_ct_config(struct iwl_priv *priv);
 extern void iwl_send_bt_config(struct iwl_priv *priv);
 extern int iwl_send_statistics_request(struct iwl_priv *priv,
                                        u8 flags, bool clear);
-extern int iwl_verify_ucode(struct iwl_priv *priv);
 extern int iwl_send_lq_cmd(struct iwl_priv *priv,
                 struct iwl_link_quality_cmd *lq, u8 flags, bool init);
 void iwl_apm_stop(struct iwl_priv *priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 9659c5d01df9..cee3d12eb383 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -106,27 +106,6 @@ static const struct file_operations iwl_dbgfs_##name##_ops = {          \
         .open = iwl_dbgfs_open_file_generic,                            \
 };
 
-int iwl_dbgfs_statistics_flag(struct iwl_priv *priv, char *buf, int bufsz)
-{
-        int p = 0;
-
-        p += scnprintf(buf + p, bufsz - p, "Statistics Flag(0x%X):\n",
-                       le32_to_cpu(priv->statistics.flag));
-        if (le32_to_cpu(priv->statistics.flag) & UCODE_STATISTICS_CLEAR_MSK)
-                p += scnprintf(buf + p, bufsz - p,
-                               "\tStatistics have been cleared\n");
-        p += scnprintf(buf + p, bufsz - p, "\tOperational Frequency: %s\n",
-                       (le32_to_cpu(priv->statistics.flag) &
-                        UCODE_STATISTICS_FREQUENCY_MSK)
-                        ? "2.4 GHz" : "5.2 GHz");
-        p += scnprintf(buf + p, bufsz - p, "\tTGj Narrow Band: %s\n",
-                       (le32_to_cpu(priv->statistics.flag) &
-                        UCODE_STATISTICS_NARROW_BAND_MSK)
-                        ? "enabled" : "disabled");
-        return p;
-}
-EXPORT_SYMBOL(iwl_dbgfs_statistics_flag);
-
 static ssize_t iwl_dbgfs_tx_statistics_read(struct file *file,
                                                 char __user *user_buf,
                                                 size_t count, loff_t *ppos) {
@@ -330,45 +309,35 @@ static ssize_t iwl_dbgfs_stations_read(struct file *file, char __user *user_buf,
 
         for (i = 0; i < max_sta; i++) {
                 station = &priv->stations[i];
-                if (station->used) {
-                        pos += scnprintf(buf + pos, bufsz - pos,
-                                        "station %d:\ngeneral data:\n", i+1);
-                        pos += scnprintf(buf + pos, bufsz - pos, "id: %u\n",
-                                        station->sta.sta.sta_id);
-                        pos += scnprintf(buf + pos, bufsz - pos, "mode: %u\n",
-                                        station->sta.mode);
-                        pos += scnprintf(buf + pos, bufsz - pos,
-                                        "flags: 0x%x\n",
-                                        station->sta.station_flags_msk);
-                        pos += scnprintf(buf + pos, bufsz - pos, "tid data:\n");
-                        pos += scnprintf(buf + pos, bufsz - pos,
-                                        "seq_num\t\ttxq_id");
-                        pos += scnprintf(buf + pos, bufsz - pos,
-                                        "\tframe_count\twait_for_ba\t");
-                        pos += scnprintf(buf + pos, bufsz - pos,
-                                        "start_idx\tbitmap0\t");
-                        pos += scnprintf(buf + pos, bufsz - pos,
-                                        "bitmap1\trate_n_flags");
-                        pos += scnprintf(buf + pos, bufsz - pos, "\n");
+                if (!station->used)
+                        continue;
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                 "station %d - addr: %pM, flags: %#x\n",
+                                 i, station->sta.sta.addr,
+                                 station->sta.station_flags_msk);
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                "TID\tseq_num\ttxq_id\tframes\ttfds\t");
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                "start_idx\tbitmap\t\t\trate_n_flags\n");
 
-                        for (j = 0; j < MAX_TID_COUNT; j++) {
-                                pos += scnprintf(buf + pos, bufsz - pos,
-                                                "[%d]:\t\t%u", j,
-                                                station->tid[j].seq_number);
-                                pos += scnprintf(buf + pos, bufsz - pos,
-                                                "\t%u\t\t%u\t\t%u\t\t",
-                                                station->tid[j].agg.txq_id,
-                                                station->tid[j].agg.frame_count,
-                                                station->tid[j].agg.wait_for_ba);
+                for (j = 0; j < MAX_TID_COUNT; j++) {
+                        pos += scnprintf(buf + pos, bufsz - pos,
+                                "%d:\t%#x\t%#x\t%u\t%u\t%u\t\t%#.16llx\t%#x",
+                                j, station->tid[j].seq_number,
+                                station->tid[j].agg.txq_id,
+                                station->tid[j].agg.frame_count,
+                                station->tid[j].tfds_in_queue,
+                                station->tid[j].agg.start_idx,
+                                station->tid[j].agg.bitmap,
+                                station->tid[j].agg.rate_n_flags);
+
+                        if (station->tid[j].agg.wait_for_ba)
                                 pos += scnprintf(buf + pos, bufsz - pos,
-                                                "%u\t%llu\t%u",
-                                                station->tid[j].agg.start_idx,
-                                                (unsigned long long)station->tid[j].agg.bitmap,
-                                                station->tid[j].agg.rate_n_flags);
-                                pos += scnprintf(buf + pos, bufsz - pos, "\n");
-                        }
+                                                 " - waitforba");
                         pos += scnprintf(buf + pos, bufsz - pos, "\n");
                 }
+
+                pos += scnprintf(buf + pos, bufsz - pos, "\n");
         }
 
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
@@ -1049,8 +1018,13 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
                                                 rxq->write);
         pos += scnprintf(buf + pos, bufsz - pos, "free_count: %u\n",
                                                 rxq->free_count);
-        pos += scnprintf(buf + pos, bufsz - pos, "closed_rb_num: %u\n",
+        if (rxq->rb_stts) {
+                pos += scnprintf(buf + pos, bufsz - pos, "closed_rb_num: %u\n",
                          le16_to_cpu(rxq->rb_stts->closed_rb_num) &  0x0FFF);
+        } else {
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                        "closed_rb_num: Not Allocated\n");
+        }
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index f3f3473c5c7e..1af845c0f0b9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -48,25 +48,6 @@
 #include "iwl-power.h"
 #include "iwl-agn-rs.h"
 
-/* configuration for the iwl4965 */
-extern struct iwl_cfg iwl4965_agn_cfg;
-extern struct iwl_cfg iwl5300_agn_cfg;
-extern struct iwl_cfg iwl5100_agn_cfg;
-extern struct iwl_cfg iwl5350_agn_cfg;
-extern struct iwl_cfg iwl5100_bgn_cfg;
-extern struct iwl_cfg iwl5100_abg_cfg;
-extern struct iwl_cfg iwl5150_agn_cfg;
-extern struct iwl_cfg iwl5150_abg_cfg;
-extern struct iwl_cfg iwl6000g2a_2agn_cfg;
-extern struct iwl_cfg iwl6000i_2agn_cfg;
-extern struct iwl_cfg iwl6000i_2abg_cfg;
-extern struct iwl_cfg iwl6000i_2bg_cfg;
-extern struct iwl_cfg iwl6000_3agn_cfg;
-extern struct iwl_cfg iwl6050_2agn_cfg;
-extern struct iwl_cfg iwl6050_2abg_cfg;
-extern struct iwl_cfg iwl1000_bgn_cfg;
-extern struct iwl_cfg iwl1000_bg_cfg;
-
 struct iwl_tx_queue;
 
 /* CT-KILL constants */
@@ -133,8 +114,8 @@ struct iwl_cmd_meta {
          * structure is stored at the end of the shared queue memory. */
         u32 flags;
 
-        DECLARE_PCI_UNMAP_ADDR(mapping)
-        DECLARE_PCI_UNMAP_LEN(len)
+        DEFINE_DMA_UNMAP_ADDR(mapping);
+        DEFINE_DMA_UNMAP_LEN(len);
 };
 
 /*
@@ -161,7 +142,7 @@ struct iwl_queue {
 
 /* One for each TFD */
 struct iwl_tx_info {
-        struct sk_buff *skb[IWL_NUM_OF_TBS - 1];
+        struct sk_buff *skb;
 };
 
 /**
@@ -367,7 +348,7 @@ struct iwl_host_cmd {
 /**
  * struct iwl_rx_queue - Rx queue
  * @bd: driver's pointer to buffer of receive buffer descriptors (rbd)
- * @dma_addr: bus address of buffer of receive buffer descriptors (rbd)
+ * @bd_dma: bus address of buffer of receive buffer descriptors (rbd)
  * @read: Shared index to newest available Rx buffer
  * @write: Shared index to oldest written Rx packet
  * @free_count: Number of pre-allocated buffers in rx_free
@@ -381,7 +362,7 @@ struct iwl_host_cmd {
  */
 struct iwl_rx_queue {
         __le32 *bd;
-        dma_addr_t dma_addr;
+        dma_addr_t bd_dma;
         struct iwl_rx_mem_buffer pool[RX_QUEUE_SIZE + RX_FREE_BUFFERS];
         struct iwl_rx_mem_buffer *queue[RX_QUEUE_SIZE];
         u32 read;
@@ -433,7 +414,7 @@ struct iwl_ht_agg {
 
 
 struct iwl_tid_data {
-        u16 seq_number;
+        u16 seq_number; /* agn only */
         u16 tfds_in_queue;
         struct iwl_ht_agg agg;
 };
@@ -583,6 +564,12 @@ enum iwl_ucode_tlv_type {
         IWL_UCODE_TLV_INIT_DATA         = 4,
         IWL_UCODE_TLV_BOOT              = 5,
         IWL_UCODE_TLV_PROBE_MAX_LEN     = 6, /* a u32 value */
+        IWL_UCODE_TLV_RUNT_EVTLOG_PTR   = 8,
+        IWL_UCODE_TLV_RUNT_EVTLOG_SIZE  = 9,
+        IWL_UCODE_TLV_RUNT_ERRLOG_PTR   = 10,
+        IWL_UCODE_TLV_INIT_EVTLOG_PTR   = 11,
+        IWL_UCODE_TLV_INIT_EVTLOG_SIZE  = 12,
+        IWL_UCODE_TLV_INIT_ERRLOG_PTR   = 13,
 };
 
 struct iwl_ucode_tlv {
@@ -675,6 +662,7 @@ struct iwl_sensitivity_ranges {
  * @sw_crypto: 0 for hw, 1 for sw
  * @max_xxx_size: for ucode uses
  * @ct_kill_threshold: temperature threshold
+ * @beacon_time_tsf_bits: number of valid tsf bits for beacon time
  * @calib_init_cfg: setup initial calibrations for the hw
  * @struct iwl_sensitivity_ranges: range of sensitivity values
  */
@@ -701,6 +689,7 @@ struct iwl_hw_params {
         u32 ct_kill_threshold; /* value in hw-dependent units */
         u32 ct_kill_exit_threshold; /* value in hw-dependent units */
                                     /* for 1000, 6000 series and up */
+        u16 beacon_time_tsf_bits;
         u32 calib_init_cfg;
         const struct iwl_sensitivity_ranges *sens;
 };
@@ -1075,6 +1064,20 @@ struct iwl_force_reset {
         unsigned long last_force_reset_jiffies;
 };
 
+/* extend beacon time format bit shifting  */
+/*
+ * for _3945 devices
+ * bits 31:24 - extended
+ * bits 23:0  - interval
+ */
+#define IWL3945_EXT_BEACON_TIME_POS     24
+/*
+ * for _agn devices
+ * bits 31:22 - extended
+ * bits 21:0  - interval
+ */
+#define IWLAGN_EXT_BEACON_TIME_POS      22
+
 struct iwl_priv {
 
         /* ieee device used by generic ieee processing code */
@@ -1109,7 +1112,7 @@ struct iwl_priv {
         /* force reset */
         struct iwl_force_reset force_reset[IWL_MAX_FORCE_RESET];
 
-        /* we allocate array of iwl4965_channel_info for NIC's valid channels.
+        /* we allocate array of iwl_channel_info for NIC's valid channels.
          *    Access via channel # using indirect index array */
         struct iwl_channel_info *channel_info;  /* channel info array */
         u8 channel_count;       /* # of channels */
@@ -1127,6 +1130,7 @@ struct iwl_priv {
         void *scan_cmd;
         enum ieee80211_band scan_band;
         struct cfg80211_scan_request *scan_request;
+        struct ieee80211_vif *scan_vif;
         bool is_internal_short_scan;
         u8 scan_tx_ant[IEEE80211_NUM_BANDS];
         u8 mgmt_tx_ant;
@@ -1174,7 +1178,7 @@ struct iwl_priv {
         struct iwl_switch_rxon switch_rxon;
 
         /* 1st responses from initialize and runtime uCode images.
-         * 4965's initialize alive response contains some calibration data. */
+         * _agn's initialize alive response contains some calibration data. */
         struct iwl_init_alive_resp card_alive_init;
         struct iwl_alive_resp card_alive;
 
@@ -1220,18 +1224,12 @@ struct iwl_priv {
         struct iwl_power_mgr power_data;
         struct iwl_tt_mgmt thermal_throttle;
 
-        struct iwl_notif_statistics statistics;
-#ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_notif_statistics accum_statistics;
-        struct iwl_notif_statistics delta_statistics;
-        struct iwl_notif_statistics max_delta;
-#endif
-
         /* context information */
         u8 bssid[ETH_ALEN]; /* used only on 3945 but filled by core */
-        u8 mac_addr[ETH_ALEN];
 
-        /*station table variables */
+        /* station table variables */
+
+        /* Note: if lock and sta_lock are needed, lock must be acquired first */
         spinlock_t sta_lock;
         int num_stations;
         struct iwl_station_entry stations[IWL_STATION_COUNT];
@@ -1273,7 +1271,7 @@ struct iwl_priv {
                         struct delayed_work rfkill_poll;
 
                         struct iwl3945_notif_statistics statistics;
-#ifdef CONFIG_IWLWIFI_DEBUG
+#ifdef CONFIG_IWLWIFI_DEBUGFS
                         struct iwl3945_notif_statistics accum_statistics;
                         struct iwl3945_notif_statistics delta_statistics;
                         struct iwl3945_notif_statistics max_delta;
@@ -1315,6 +1313,16 @@ struct iwl_priv {
                         bool last_phy_res_valid;
 
                         struct completion firmware_loading_complete;
+
+                        u32 init_evtlog_ptr, init_evtlog_size, init_errlog_ptr;
+                        u32 inst_evtlog_ptr, inst_evtlog_size, inst_errlog_ptr;
+
+                        struct iwl_notif_statistics statistics;
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+                        struct iwl_notif_statistics accum_statistics;
+                        struct iwl_notif_statistics delta_statistics;
+                        struct iwl_notif_statistics max_delta;
+#endif
                 } _agn;
 #endif
         };
@@ -1353,9 +1361,7 @@ struct iwl_priv {
         /* debugging info */
         u32 debug_level; /* per device debugging will override global
                             iwl_debug_level if set */
-        u32 framecnt_to_us;
-        atomic_t restrict_refcnt;
-        bool disable_ht40;
+#endif /* CONFIG_IWLWIFI_DEBUG */
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         /* debugfs */
         u16 tx_traffic_idx;
@@ -1364,8 +1370,8 @@ struct iwl_priv {
         u8 *rx_traffic;
         struct dentry *debugfs_dir;
         u32 dbgfs_sram_offset, dbgfs_sram_len;
+        bool disable_ht40;
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
-#endif /* CONFIG_IWLWIFI_DEBUG */
 
         struct work_struct txpower_work;
         u32 disable_sens_cal;
@@ -1419,9 +1425,9 @@ static inline u32 iwl_get_debug_level(struct iwl_priv *priv)
 static inline struct ieee80211_hdr *iwl_tx_queue_get_hdr(struct iwl_priv *priv,
                                                          int txq_id, int idx)
 {
-        if (priv->txq[txq_id].txb[idx].skb[0])
+        if (priv->txq[txq_id].txb[idx].skb)
                 return (struct ieee80211_hdr *)priv->txq[txq_id].
-                                txb[idx].skb[0]->data;
+                                txb[idx].skb->data;
         return NULL;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
index 3ff6b9d25a10..621abe3c5afc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
+++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
@@ -92,6 +92,11 @@ static inline void iwl_free_fw_desc(struct pci_dev *pci_dev,
 static inline int iwl_alloc_fw_desc(struct pci_dev *pci_dev,
                                     struct fw_desc *desc)
 {
+        if (!desc->len) {
+                desc->v_addr = NULL;
+                return -EINVAL;
+        }
+
         desc->v_addr = dma_alloc_coherent(&pci_dev->dev, desc->len,
                                           &desc->p_addr, GFP_KERNEL);
         return (desc->v_addr != NULL) ? 0 : -ENOMEM;
@@ -170,4 +175,26 @@ static inline void iwl_enable_interrupts(struct iwl_priv *priv)
         iwl_write32(priv, CSR_INT_MASK, priv->inta_mask);
 }
 
+/**
+ * iwl_beacon_time_mask_low - mask of lower 32 bit of beacon time
+ * @priv -- pointer to iwl_priv data structure
+ * @tsf_bits -- number of bits need to shift for masking)
+ */
+static inline u32 iwl_beacon_time_mask_low(struct iwl_priv *priv,
+                                           u16 tsf_bits)
+{
+        return (1 << tsf_bits) - 1;
+}
+
+/**
+ * iwl_beacon_time_mask_high - mask of higher 32 bit of beacon time
+ * @priv -- pointer to iwl_priv data structure
+ * @tsf_bits -- number of bits need to shift for masking)
+ */
+static inline u32 iwl_beacon_time_mask_high(struct iwl_priv *priv,
+                                            u16 tsf_bits)
+{
+        return ((1 << (32 - tsf_bits)) - 1) << tsf_bits;
+}
+
 #endif                          /* __iwl_helpers_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 0a5d7cf25196..b437f317b979 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -175,7 +175,7 @@ int iwl_rx_queue_alloc(struct iwl_priv *priv)
         INIT_LIST_HEAD(&rxq->rx_used);
 
         /* Alloc the circular buffer of Read Buffer Descriptors (RBDs) */
-        rxq->bd = dma_alloc_coherent(dev, 4 * RX_QUEUE_SIZE, &rxq->dma_addr,
+        rxq->bd = dma_alloc_coherent(dev, 4 * RX_QUEUE_SIZE, &rxq->bd_dma,
                                      GFP_KERNEL);
         if (!rxq->bd)
                 goto err_bd;
@@ -199,32 +199,12 @@ int iwl_rx_queue_alloc(struct iwl_priv *priv)
 
 err_rb:
         dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
-                          rxq->dma_addr);
+                          rxq->bd_dma);
 err_bd:
         return -ENOMEM;
 }
 EXPORT_SYMBOL(iwl_rx_queue_alloc);
 
-void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
-                                struct iwl_rx_mem_buffer *rxb)
-
-{
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        struct iwl_missed_beacon_notif *missed_beacon;
-
-        missed_beacon = &pkt->u.missed_beacon;
-        if (le32_to_cpu(missed_beacon->consecutive_missed_beacons) >
-            priv->missed_beacon_threshold) {
-                IWL_DEBUG_CALIB(priv, "missed bcn cnsq %d totl %d rcd %d expctd %d\n",
-                    le32_to_cpu(missed_beacon->consecutive_missed_beacons),
-                    le32_to_cpu(missed_beacon->total_missed_becons),
-                    le32_to_cpu(missed_beacon->num_recvd_beacons),
-                    le32_to_cpu(missed_beacon->num_expected_beacons));
-                if (!test_bit(STATUS_SCANNING, &priv->status))
-                        iwl_init_sensitivity(priv);
-        }
-}
-EXPORT_SYMBOL(iwl_rx_missed_beacon_notif);
 
 void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
                                           struct iwl_rx_mem_buffer *rxb)
@@ -243,161 +223,6 @@ void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_rx_spectrum_measure_notif);
 
-
-
-/* Calculate noise level, based on measurements during network silence just
- *   before arriving beacon.  This measurement can be done only if we know
- *   exactly when to expect beacons, therefore only when we're associated. */
-static void iwl_rx_calc_noise(struct iwl_priv *priv)
-{
-        struct statistics_rx_non_phy *rx_info
-                                = &(priv->statistics.rx.general);
-        int num_active_rx = 0;
-        int total_silence = 0;
-        int bcn_silence_a =
-                le32_to_cpu(rx_info->beacon_silence_rssi_a) & IN_BAND_FILTER;
-        int bcn_silence_b =
-                le32_to_cpu(rx_info->beacon_silence_rssi_b) & IN_BAND_FILTER;
-        int bcn_silence_c =
-                le32_to_cpu(rx_info->beacon_silence_rssi_c) & IN_BAND_FILTER;
-        int last_rx_noise;
-
-        if (bcn_silence_a) {
-                total_silence += bcn_silence_a;
-                num_active_rx++;
-        }
-        if (bcn_silence_b) {
-                total_silence += bcn_silence_b;
-                num_active_rx++;
-        }
-        if (bcn_silence_c) {
-                total_silence += bcn_silence_c;
-                num_active_rx++;
-        }
-
-        /* Average among active antennas */
-        if (num_active_rx)
-                last_rx_noise = (total_silence / num_active_rx) - 107;
-        else
-                last_rx_noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
-
-        IWL_DEBUG_CALIB(priv, "inband silence a %u, b %u, c %u, dBm %d\n",
-                        bcn_silence_a, bcn_silence_b, bcn_silence_c,
-                        last_rx_noise);
-}
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-/*
- *  based on the assumption of all statistics counter are in DWORD
- *  FIXME: This function is for debugging, do not deal with
- *  the case of counters roll-over.
- */
-static void iwl_accumulative_statistics(struct iwl_priv *priv,
-                                        __le32 *stats)
-{
-        int i;
-        __le32 *prev_stats;
-        u32 *accum_stats;
-        u32 *delta, *max_delta;
-
-        prev_stats = (__le32 *)&priv->statistics;
-        accum_stats = (u32 *)&priv->accum_statistics;
-        delta = (u32 *)&priv->delta_statistics;
-        max_delta = (u32 *)&priv->max_delta;
-
-        for (i = sizeof(__le32); i < sizeof(struct iwl_notif_statistics);
-             i += sizeof(__le32), stats++, prev_stats++, delta++,
-             max_delta++, accum_stats++) {
-                if (le32_to_cpu(*stats) > le32_to_cpu(*prev_stats)) {
-                        *delta = (le32_to_cpu(*stats) -
-                                le32_to_cpu(*prev_stats));
-                        *accum_stats += *delta;
-                        if (*delta > *max_delta)
-                                *max_delta = *delta;
-                }
-        }
-
-        /* reset accumulative statistics for "no-counter" type statistics */
-        priv->accum_statistics.general.temperature =
-                priv->statistics.general.temperature;
-        priv->accum_statistics.general.temperature_m =
-                priv->statistics.general.temperature_m;
-        priv->accum_statistics.general.ttl_timestamp =
-                priv->statistics.general.ttl_timestamp;
-        priv->accum_statistics.tx.tx_power.ant_a =
-                priv->statistics.tx.tx_power.ant_a;
-        priv->accum_statistics.tx.tx_power.ant_b =
-                priv->statistics.tx.tx_power.ant_b;
-        priv->accum_statistics.tx.tx_power.ant_c =
-                priv->statistics.tx.tx_power.ant_c;
-}
-#endif
-
-#define REG_RECALIB_PERIOD (60)
-
-/**
- * iwl_good_plcp_health - checks for plcp error.
- *
- * When the plcp error is exceeding the thresholds, reset the radio
- * to improve the throughput.
- */
-bool iwl_good_plcp_health(struct iwl_priv *priv,
-                                struct iwl_rx_packet *pkt)
-{
-        bool rc = true;
-        int combined_plcp_delta;
-        unsigned int plcp_msec;
-        unsigned long plcp_received_jiffies;
-
-        /*
-         * check for plcp_err and trigger radio reset if it exceeds
-         * the plcp error threshold plcp_delta.
-         */
-        plcp_received_jiffies = jiffies;
-        plcp_msec = jiffies_to_msecs((long) plcp_received_jiffies -
-                                        (long) priv->plcp_jiffies);
-        priv->plcp_jiffies = plcp_received_jiffies;
-        /*
-         * check to make sure plcp_msec is not 0 to prevent division
-         * by zero.
-         */
-        if (plcp_msec) {
-                combined_plcp_delta =
-                        (le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err) -
-                        le32_to_cpu(priv->statistics.rx.ofdm.plcp_err)) +
-                        (le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err) -
-                        le32_to_cpu(priv->statistics.rx.ofdm_ht.plcp_err));
-
-                if ((combined_plcp_delta > 0) &&
-                    ((combined_plcp_delta * 100) / plcp_msec) >
-                        priv->cfg->plcp_delta_threshold) {
-                        /*
-                         * if plcp_err exceed the threshold,
-                         * the following data is printed in csv format:
-                         *    Text: plcp_err exceeded %d,
-                         *    Received ofdm.plcp_err,
-                         *    Current ofdm.plcp_err,
-                         *    Received ofdm_ht.plcp_err,
-                         *    Current ofdm_ht.plcp_err,
-                         *    combined_plcp_delta,
-                         *    plcp_msec
-                         */
-                        IWL_DEBUG_RADIO(priv, "plcp_err exceeded %u, "
-                                "%u, %u, %u, %u, %d, %u mSecs\n",
-                                priv->cfg->plcp_delta_threshold,
-                                le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err),
-                                le32_to_cpu(priv->statistics.rx.ofdm.plcp_err),
-                                le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err),
-                                le32_to_cpu(
-                                  priv->statistics.rx.ofdm_ht.plcp_err),
-                                combined_plcp_delta, plcp_msec);
-                        rc = false;
-                }
-        }
-        return rc;
-}
-EXPORT_SYMBOL(iwl_good_plcp_health);
-
 void iwl_recover_from_statistics(struct iwl_priv *priv,
                                 struct iwl_rx_packet *pkt)
 {
@@ -431,69 +256,6 @@ void iwl_recover_from_statistics(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_recover_from_statistics);
 
-void iwl_rx_statistics(struct iwl_priv *priv,
-                              struct iwl_rx_mem_buffer *rxb)
-{
-        int change;
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-
-
-        IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
-                     (int)sizeof(priv->statistics),
-                     le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
-
-        change = ((priv->statistics.general.temperature !=
-                   pkt->u.stats.general.temperature) ||
-                  ((priv->statistics.flag &
-                    STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
-                   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        iwl_accumulative_statistics(priv, (__le32 *)&pkt->u.stats);
-#endif
-        iwl_recover_from_statistics(priv, pkt);
-
-        memcpy(&priv->statistics, &pkt->u.stats, sizeof(priv->statistics));
-
-        set_bit(STATUS_STATISTICS, &priv->status);
-
-        /* Reschedule the statistics timer to occur in
-         * REG_RECALIB_PERIOD seconds to ensure we get a
-         * thermal update even if the uCode doesn't give
-         * us one */
-        mod_timer(&priv->statistics_periodic, jiffies +
-                  msecs_to_jiffies(REG_RECALIB_PERIOD * 1000));
-
-        if (unlikely(!test_bit(STATUS_SCANNING, &priv->status)) &&
-            (pkt->hdr.cmd == STATISTICS_NOTIFICATION)) {
-                iwl_rx_calc_noise(priv);
-                queue_work(priv->workqueue, &priv->run_time_calib_work);
-        }
-        if (priv->cfg->ops->lib->temp_ops.temperature && change)
-                priv->cfg->ops->lib->temp_ops.temperature(priv);
-}
-EXPORT_SYMBOL(iwl_rx_statistics);
-
-void iwl_reply_statistics(struct iwl_priv *priv,
-                              struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-
-        if (le32_to_cpu(pkt->u.stats.flag) & UCODE_STATISTICS_CLEAR_MSK) {
-#ifdef CONFIG_IWLWIFI_DEBUG
-                memset(&priv->accum_statistics, 0,
-                        sizeof(struct iwl_notif_statistics));
-                memset(&priv->delta_statistics, 0,
-                        sizeof(struct iwl_notif_statistics));
-                memset(&priv->max_delta, 0,
-                        sizeof(struct iwl_notif_statistics));
-#endif
-                IWL_DEBUG_RX(priv, "Statistics have been cleared\n");
-        }
-        iwl_rx_statistics(priv, rxb);
-}
-EXPORT_SYMBOL(iwl_reply_statistics);
-
 /*
  * returns non-zero if packet should be dropped
  */
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 386c5f96eff8..798f93e0ff50 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -333,7 +333,8 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
                 goto out_unlock;
         }
 
-        if (test_bit(STATUS_SCANNING, &priv->status)) {
+        if (test_bit(STATUS_SCANNING, &priv->status) &&
+            !priv->is_internal_short_scan) {
                 IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
                 ret = -EAGAIN;
                 goto out_unlock;
@@ -348,8 +349,16 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
         /* mac80211 will only ask for one band at a time */
         priv->scan_band = req->channels[0]->band;
         priv->scan_request = req;
+        priv->scan_vif = vif;
 
-        ret = iwl_scan_initiate(priv, vif);
+        /*
+         * If an internal scan is in progress, just set
+         * up the scan_request as per above.
+         */
+        if (priv->is_internal_short_scan)
+                ret = 0;
+        else
+                ret = iwl_scan_initiate(priv, vif);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
@@ -438,7 +447,7 @@ EXPORT_SYMBOL(iwl_bg_scan_check);
  */
 
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
-                       const u8 *ies, int ie_len, int left)
+                       const u8 *ta, const u8 *ies, int ie_len, int left)
 {
         int len = 0;
         u8 *pos = NULL;
@@ -451,7 +460,7 @@ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
 
         frame->frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
         memcpy(frame->da, iwl_bcast_addr, ETH_ALEN);
-        memcpy(frame->sa, priv->mac_addr, ETH_ALEN);
+        memcpy(frame->sa, ta, ETH_ALEN);
         memcpy(frame->bssid, iwl_bcast_addr, ETH_ALEN);
         frame->seq_ctrl = 0;
 
@@ -514,7 +523,21 @@ void iwl_bg_scan_completed(struct work_struct *work)
                 priv->is_internal_short_scan = false;
                 IWL_DEBUG_SCAN(priv, "internal short scan completed\n");
                 internal = true;
+        } else {
+                priv->scan_request = NULL;
+                priv->scan_vif = NULL;
         }
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                goto out;
+
+        if (internal && priv->scan_request)
+                iwl_scan_initiate(priv, priv->scan_vif);
+
+        /* Since setting the TXPOWER may have been deferred while
+         * performing the scan, fire one off */
+        iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
+ out:
         mutex_unlock(&priv->mutex);
 
         /*
@@ -524,15 +547,6 @@ void iwl_bg_scan_completed(struct work_struct *work)
          */
         if (!internal)
                 ieee80211_scan_completed(priv->hw, false);
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        /* Since setting the TXPOWER may have been deferred while
-         * performing the scan, fire one off */
-        mutex_lock(&priv->mutex);
-        iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
-        mutex_unlock(&priv->mutex);
 }
 EXPORT_SYMBOL(iwl_bg_scan_completed);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index c27c13fbb1ae..6a9cd08bd449 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -30,6 +30,7 @@
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
 #include <linux/sched.h>
+#include <linux/lockdep.h>
 
 #include "iwl-dev.h"
 #include "iwl-core.h"
@@ -54,18 +55,19 @@ static void iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
         }
 }
 
-static void iwl_process_add_sta_resp(struct iwl_priv *priv,
-                                     struct iwl_addsta_cmd *addsta,
-                                     struct iwl_rx_packet *pkt,
-                                     bool sync)
+static int iwl_process_add_sta_resp(struct iwl_priv *priv,
+                                    struct iwl_addsta_cmd *addsta,
+                                    struct iwl_rx_packet *pkt,
+                                    bool sync)
 {
         u8 sta_id = addsta->sta.sta_id;
         unsigned long flags;
+        int ret = -EIO;
 
         if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_ADD_STA (0x%08X)\n",
                         pkt->hdr.flags);
-                return;
+                return ret;
         }
 
         IWL_DEBUG_INFO(priv, "Processing response for adding station %u\n",
@@ -77,6 +79,7 @@ static void iwl_process_add_sta_resp(struct iwl_priv *priv,
         case ADD_STA_SUCCESS_MSK:
                 IWL_DEBUG_INFO(priv, "REPLY_ADD_STA PASSED\n");
                 iwl_sta_ucode_activate(priv, sta_id);
+                ret = 0;
                 break;
         case ADD_STA_NO_ROOM_IN_TABLE:
                 IWL_ERR(priv, "Adding station %d failed, no room in table.\n",
@@ -114,6 +117,8 @@ static void iwl_process_add_sta_resp(struct iwl_priv *priv,
                        STA_CONTROL_MODIFY_MSK ? "Modified" : "Added",
                        addsta->sta.addr);
         spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        return ret;
 }
 
 static void iwl_add_sta_callback(struct iwl_priv *priv,
@@ -145,8 +150,10 @@ int iwl_send_add_sta(struct iwl_priv *priv,
 
         if (flags & CMD_ASYNC)
                 cmd.callback = iwl_add_sta_callback;
-        else
+        else {
                 cmd.flags |= CMD_WANT_SKB;
+                might_sleep();
+        }
 
         cmd.len = priv->cfg->ops->utils->build_addsta_hcmd(sta, data);
         ret = iwl_send_cmd(priv, &cmd);
@@ -156,7 +163,7 @@ int iwl_send_add_sta(struct iwl_priv *priv,
 
         if (ret == 0) {
                 pkt = (struct iwl_rx_packet *)cmd.reply_page;
-                iwl_process_add_sta_resp(priv, sta, pkt, true);
+                ret = iwl_process_add_sta_resp(priv, sta, pkt, true);
         }
         iwl_free_pages(priv, cmd.reply_page);
 
@@ -311,10 +318,10 @@ int iwl_add_station_common(struct iwl_priv *priv, const u8 *addr,
                                   struct ieee80211_sta_ht_cap *ht_info,
                                   u8 *sta_id_r)
 {
-        struct iwl_station_entry *station;
         unsigned long flags_spin;
         int ret = 0;
         u8 sta_id;
+        struct iwl_addsta_cmd sta_cmd;
 
         *sta_id_r = 0;
         spin_lock_irqsave(&priv->sta_lock, flags_spin);
@@ -347,14 +354,15 @@ int iwl_add_station_common(struct iwl_priv *priv, const u8 *addr,
         }
 
         priv->stations[sta_id].used |= IWL_STA_UCODE_INPROGRESS;
-        station = &priv->stations[sta_id];
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
 
         /* Add station to device's station table */
-        ret = iwl_send_add_sta(priv, &station->sta, CMD_SYNC);
+        ret = iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
         if (ret) {
-                IWL_ERR(priv, "Adding station %pM failed.\n", station->sta.sta.addr);
                 spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                IWL_ERR(priv, "Adding station %pM failed.\n",
+                        priv->stations[sta_id].sta.sta.addr);
                 priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
                 priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
                 spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
@@ -488,7 +496,7 @@ static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, u8 sta_id)
 }
 
 static int iwl_send_remove_station(struct iwl_priv *priv,
-                                   struct iwl_station_entry *station)
+                                   const u8 *addr, int sta_id)
 {
         struct iwl_rx_packet *pkt;
         int ret;
@@ -505,7 +513,7 @@ static int iwl_send_remove_station(struct iwl_priv *priv,
 
         memset(&rm_sta_cmd, 0, sizeof(rm_sta_cmd));
         rm_sta_cmd.num_sta = 1;
-        memcpy(&rm_sta_cmd.addr, &station->sta.sta.addr , ETH_ALEN);
+        memcpy(&rm_sta_cmd.addr, addr, ETH_ALEN);
 
         cmd.flags |= CMD_WANT_SKB;
 
@@ -525,7 +533,7 @@ static int iwl_send_remove_station(struct iwl_priv *priv,
                 switch (pkt->u.rem_sta.status) {
                 case REM_STA_SUCCESS_MSK:
                         spin_lock_irqsave(&priv->sta_lock, flags_spin);
-                        iwl_sta_ucode_deactivate(priv, station->sta.sta.sta_id);
+                        iwl_sta_ucode_deactivate(priv, sta_id);
                         spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
                         IWL_DEBUG_ASSOC(priv, "REPLY_REMOVE_STA PASSED\n");
                         break;
@@ -546,7 +554,6 @@ static int iwl_send_remove_station(struct iwl_priv *priv,
 int iwl_remove_station(struct iwl_priv *priv, const u8 sta_id,
                        const u8 *addr)
 {
-        struct iwl_station_entry *station;
         unsigned long flags;
 
         if (!iwl_is_ready(priv)) {
@@ -592,10 +599,9 @@ int iwl_remove_station(struct iwl_priv *priv, const u8 sta_id,
 
         BUG_ON(priv->num_stations < 0);
 
-        station = &priv->stations[sta_id];
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        return iwl_send_remove_station(priv, station);
+        return iwl_send_remove_station(priv, addr, sta_id);
 out_err:
         spin_unlock_irqrestore(&priv->sta_lock, flags);
         return -EINVAL;
@@ -643,11 +649,13 @@ EXPORT_SYMBOL(iwl_clear_ucode_stations);
  */
 void iwl_restore_stations(struct iwl_priv *priv)
 {
-        struct iwl_station_entry *station;
+        struct iwl_addsta_cmd sta_cmd;
+        struct iwl_link_quality_cmd lq;
         unsigned long flags_spin;
         int i;
         bool found = false;
         int ret;
+        bool send_lq;
 
         if (!iwl_is_ready(priv)) {
                 IWL_DEBUG_INFO(priv, "Not ready yet, not restoring any stations.\n");
@@ -669,13 +677,20 @@ void iwl_restore_stations(struct iwl_priv *priv)
 
         for (i = 0; i < priv->hw_params.max_stations; i++) {
                 if ((priv->stations[i].used & IWL_STA_UCODE_INPROGRESS)) {
+                        memcpy(&sta_cmd, &priv->stations[i].sta,
+                               sizeof(struct iwl_addsta_cmd));
+                        send_lq = false;
+                        if (priv->stations[i].lq) {
+                                memcpy(&lq, priv->stations[i].lq,
+                                       sizeof(struct iwl_link_quality_cmd));
+                                send_lq = true;
+                        }
                         spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
-                        station = &priv->stations[i];
-                        ret = iwl_send_add_sta(priv, &priv->stations[i].sta, CMD_SYNC);
+                        ret = iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
                         if (ret) {
-                                IWL_ERR(priv, "Adding station %pM failed.\n",
-                                        station->sta.sta.addr);
                                 spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                                IWL_ERR(priv, "Adding station %pM failed.\n",
+                                        priv->stations[i].sta.sta.addr);
                                 priv->stations[i].used &= ~IWL_STA_DRIVER_ACTIVE;
                                 priv->stations[i].used &= ~IWL_STA_UCODE_INPROGRESS;
                                 spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
@@ -684,8 +699,8 @@ void iwl_restore_stations(struct iwl_priv *priv)
                          * Rate scaling has already been initialized, send
                          * current LQ command
                          */
-                        if (station->lq)
-                                iwl_send_lq_cmd(priv, station->lq, CMD_SYNC, true);
+                        if (send_lq)
+                                iwl_send_lq_cmd(priv, &lq, CMD_SYNC, true);
                         spin_lock_irqsave(&priv->sta_lock, flags_spin);
                         priv->stations[i].used &= ~IWL_STA_UCODE_INPROGRESS;
                 }
@@ -823,7 +838,9 @@ static int iwl_set_wep_dynamic_key_info(struct iwl_priv *priv,
 {
         unsigned long flags;
         __le16 key_flags = 0;
-        int ret;
+        struct iwl_addsta_cmd sta_cmd;
+
+        lockdep_assert_held(&priv->mutex);
 
         keyconf->flags &= ~IEEE80211_KEY_FLAG_GENERATE_IV;
 
@@ -863,11 +880,10 @@ static int iwl_set_wep_dynamic_key_info(struct iwl_priv *priv,
         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
-        ret = iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
-
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        return ret;
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
 }
 
 static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
@@ -876,7 +892,9 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
 {
         unsigned long flags;
         __le16 key_flags = 0;
-        int ret;
+        struct iwl_addsta_cmd sta_cmd;
+
+        lockdep_assert_held(&priv->mutex);
 
         key_flags |= (STA_KEY_FLG_CCMP | STA_KEY_FLG_MAP_KEY_MSK);
         key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
@@ -911,11 +929,10 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
-        ret = iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
-
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        return ret;
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
 }
 
 static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
@@ -972,24 +989,16 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
         unsigned long flags;
         int i;
 
-        if (sta) {
-                sta_id = iwl_sta_id(sta);
-
-                if (sta_id == IWL_INVALID_STATION) {
-                        IWL_DEBUG_MAC80211(priv, "leave - %pM not initialised.\n",
-                                           sta->addr);
-                        return;
-                }
-        } else
-                sta_id = priv->hw_params.bcast_sta_id;
-
-
         if (iwl_scan_cancel(priv)) {
                 /* cancel scan failed, just live w/ bad key and rely
                    briefly on SW decryption */
                 return;
         }
 
+        sta_id = iwl_sta_id_or_broadcast(priv, sta);
+        if (sta_id == IWL_INVALID_STATION)
+                return;
+
         spin_lock_irqsave(&priv->sta_lock, flags);
 
         priv->stations[sta_id].sta.key.tkip_rx_tsc_byte2 = (u8) iv32;
@@ -1013,9 +1022,11 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                                 u8 sta_id)
 {
         unsigned long flags;
-        int ret = 0;
         u16 key_flags;
         u8 keyidx;
+        struct iwl_addsta_cmd sta_cmd;
+
+        lockdep_assert_held(&priv->mutex);
 
         priv->key_mapping_key--;
 
@@ -1062,9 +1073,10 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                 spin_unlock_irqrestore(&priv->sta_lock, flags);
                 return 0;
         }
-        ret =  iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_irqrestore(&priv->sta_lock, flags);
-        return ret;
+
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
 }
 EXPORT_SYMBOL(iwl_remove_dynamic_key);
 
@@ -1073,6 +1085,8 @@ int iwl_set_dynamic_key(struct iwl_priv *priv,
 {
         int ret;
 
+        lockdep_assert_held(&priv->mutex);
+
         priv->key_mapping_key++;
         keyconf->hw_key_idx = HW_KEY_DYNAMIC;
 
@@ -1268,18 +1282,22 @@ EXPORT_SYMBOL_GPL(iwl_dealloc_bcast_station);
 /**
  * iwl_sta_tx_modify_enable_tid - Enable Tx for this TID in station table
  */
-void iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid)
+int iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid)
 {
         unsigned long flags;
+        struct iwl_addsta_cmd sta_cmd;
+
+        lockdep_assert_held(&priv->mutex);
 
         /* Remove "disable" flag, to enable Tx for this TID */
         spin_lock_irqsave(&priv->sta_lock, flags);
         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_TID_DISABLE_TX;
         priv->stations[sta_id].sta.tid_disable_tx &= cpu_to_le16(~(1 << tid));
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
 }
 EXPORT_SYMBOL(iwl_sta_tx_modify_enable_tid);
 
@@ -1288,6 +1306,9 @@ int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
 {
         unsigned long flags;
         int sta_id;
+        struct iwl_addsta_cmd sta_cmd;
+
+        lockdep_assert_held(&priv->mutex);
 
         sta_id = iwl_sta_id(sta);
         if (sta_id == IWL_INVALID_STATION)
@@ -1299,10 +1320,10 @@ int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
         priv->stations[sta_id].sta.add_immediate_ba_tid = (u8)tid;
         priv->stations[sta_id].sta.add_immediate_ba_ssn = cpu_to_le16(ssn);
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        return iwl_send_add_sta(priv, &priv->stations[sta_id].sta,
-                                CMD_ASYNC);
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
 }
 EXPORT_SYMBOL(iwl_sta_rx_agg_start);
 
@@ -1311,6 +1332,9 @@ int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
 {
         unsigned long flags;
         int sta_id;
+        struct iwl_addsta_cmd sta_cmd;
+
+        lockdep_assert_held(&priv->mutex);
 
         sta_id = iwl_sta_id(sta);
         if (sta_id == IWL_INVALID_STATION) {
@@ -1323,10 +1347,10 @@ int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_DELBA_TID_MSK;
         priv->stations[sta_id].sta.remove_immediate_ba_tid = (u8)tid;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        return iwl_send_add_sta(priv, &priv->stations[sta_id].sta,
-                                        CMD_ASYNC);
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
 }
 EXPORT_SYMBOL(iwl_sta_rx_agg_stop);
 
@@ -1340,9 +1364,9 @@ void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id)
         priv->stations[sta_id].sta.sta.modify_mask = 0;
         priv->stations[sta_id].sta.sleep_tx_count = 0;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
 }
 EXPORT_SYMBOL(iwl_sta_modify_ps_wake);
 
@@ -1357,9 +1381,9 @@ void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt)
                                         STA_MODIFY_SLEEP_TX_COUNT_MSK;
         priv->stations[sta_id].sta.sleep_tx_count = cpu_to_le16(cnt);
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
 }
 EXPORT_SYMBOL(iwl_sta_modify_sleep_tx_count);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.h b/drivers/net/wireless/iwlwifi/iwl-sta.h
index c2a453a1a991..619bb99d85cf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.h
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.h
@@ -73,7 +73,7 @@ int iwl_remove_station(struct iwl_priv *priv, const u8 sta_id,
                        const u8 *addr);
 int iwl_mac_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct ieee80211_sta *sta);
-void iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid);
+int iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid);
 int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
                          int tid, u16 ssn);
 int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
@@ -107,4 +107,33 @@ static inline int iwl_sta_id(struct ieee80211_sta *sta)
 
         return ((struct iwl_station_priv_common *)sta->drv_priv)->sta_id;
 }
+
+/**
+ * iwl_sta_id_or_broadcast - return sta_id or broadcast sta
+ * @priv: iwl priv
+ * @sta: mac80211 station
+ *
+ * In certain circumstances mac80211 passes a station pointer
+ * that may be %NULL, for example during TX or key setup. In
+ * that case, we need to use the broadcast station, so this
+ * inline wraps that pattern.
+ */
+static inline int iwl_sta_id_or_broadcast(struct iwl_priv *priv,
+                                          struct ieee80211_sta *sta)
+{
+        int sta_id;
+
+        if (!sta)
+                return priv->hw_params.bcast_sta_id;
+
+        sta_id = iwl_sta_id(sta);
+
+        /*
+         * mac80211 should not be passing a partially
+         * initialised station!
+         */
+        WARN_ON(sta_id == IWL_INVALID_STATION);
+
+        return sta_id;
+}
 #endif /* __iwl_sta_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 1ece2ea09773..a81989c06983 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -77,21 +77,6 @@ void iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq)
 }
 EXPORT_SYMBOL(iwl_txq_update_write_ptr);
 
-
-void iwl_free_tfds_in_queue(struct iwl_priv *priv,
-                            int sta_id, int tid, int freed)
-{
-        if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)
-                priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
-        else {
-                IWL_DEBUG_TX(priv, "free more than tfds_in_queue (%u:%d)\n",
-                        priv->stations[sta_id].tid[tid].tfds_in_queue,
-                        freed);
-                priv->stations[sta_id].tid[tid].tfds_in_queue = 0;
-        }
-}
-EXPORT_SYMBOL(iwl_free_tfds_in_queue);
-
 /**
  * iwl_tx_queue_free - Deallocate DMA queue.
  * @txq: Transmit queue to deallocate.
@@ -169,15 +154,15 @@ void iwl_cmd_queue_free(struct iwl_priv *priv)
                 }
 
                 pci_unmap_single(priv->pci_dev,
-                                 pci_unmap_addr(&txq->meta[i], mapping),
-                                 pci_unmap_len(&txq->meta[i], len),
+                                 dma_unmap_addr(&txq->meta[i], mapping),
+                                 dma_unmap_len(&txq->meta[i], len),
                                  PCI_DMA_BIDIRECTIONAL);
         }
         if (huge) {
                 i = q->n_window;
                 pci_unmap_single(priv->pci_dev,
-                                 pci_unmap_addr(&txq->meta[i], mapping),
-                                 pci_unmap_len(&txq->meta[i], len),
+                                 dma_unmap_addr(&txq->meta[i], mapping),
+                                 dma_unmap_len(&txq->meta[i], len),
                                  PCI_DMA_BIDIRECTIONAL);
         }
 
@@ -287,7 +272,7 @@ static int iwl_tx_queue_alloc(struct iwl_priv *priv,
         /* Driver private data, only for Tx (not command) queues,
          * not shared with device. */
         if (id != IWL_CMD_QUEUE_NUM) {
-                txq->txb = kmalloc(sizeof(txq->txb[0]) *
+                txq->txb = kzalloc(sizeof(txq->txb[0]) *
                                    TFD_QUEUE_SIZE_MAX, GFP_KERNEL);
                 if (!txq->txb) {
                         IWL_ERR(priv, "kmalloc for auxiliary BD "
@@ -531,8 +516,8 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
 
         phys_addr = pci_map_single(priv->pci_dev, &out_cmd->hdr,
                                    fix_size, PCI_DMA_BIDIRECTIONAL);
-        pci_unmap_addr_set(out_meta, mapping, phys_addr);
-        pci_unmap_len_set(out_meta, len, fix_size);
+        dma_unmap_addr_set(out_meta, mapping, phys_addr);
+        dma_unmap_len_set(out_meta, len, fix_size);
 
         trace_iwlwifi_dev_hcmd(priv, &out_cmd->hdr, fix_size, cmd->flags);
 
@@ -626,8 +611,8 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
         meta = &txq->meta[cmd_index];
 
         pci_unmap_single(priv->pci_dev,
-                         pci_unmap_addr(meta, mapping),
-                         pci_unmap_len(meta, len),
+                         dma_unmap_addr(meta, mapping),
+                         dma_unmap_len(meta, len),
                          PCI_DMA_BIDIRECTIONAL);
 
         /* Input error checking is done when commands are added to queue. */
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index a27872de4106..8eb347106902 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -197,6 +197,7 @@ static int iwl3945_set_wep_dynamic_key_info(struct iwl_priv *priv,
 static int iwl3945_clear_sta_key_info(struct iwl_priv *priv, u8 sta_id)
 {
         unsigned long flags;
+        struct iwl_addsta_cmd sta_cmd;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
         memset(&priv->stations[sta_id].keyinfo, 0, sizeof(struct iwl_hw_key));
@@ -205,11 +206,11 @@ static int iwl3945_clear_sta_key_info(struct iwl_priv *priv, u8 sta_id)
         priv->stations[sta_id].sta.key.key_flags = STA_KEY_FLG_NO_ENC;
         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         IWL_DEBUG_INFO(priv, "hwcrypto: clear ucode station key info\n");
-        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, 0);
-        return 0;
+        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
 }
 
 static int iwl3945_set_dynamic_key(struct iwl_priv *priv,
@@ -474,10 +475,8 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         u8 unicast;
         u8 sta_id;
         u8 tid = 0;
-        u16 seq_number = 0;
         __le16 fc;
         u8 wait_write_ptr = 0;
-        u8 *qc = NULL;
         unsigned long flags;
 
         spin_lock_irqsave(&priv->lock, flags);
@@ -510,10 +509,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         hdr_len = ieee80211_hdrlen(fc);
 
         /* Find index into station table for destination station */
-        if (!info->control.sta)
-                sta_id = priv->hw_params.bcast_sta_id;
-        else
-                sta_id = iwl_sta_id(info->control.sta);
+        sta_id = iwl_sta_id_or_broadcast(priv, info->control.sta);
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                                hdr->addr1);
@@ -523,16 +519,10 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         IWL_DEBUG_RATE(priv, "station Id %d\n", sta_id);
 
         if (ieee80211_is_data_qos(fc)) {
-                qc = ieee80211_get_qos_ctl(hdr);
+                u8 *qc = ieee80211_get_qos_ctl(hdr);
                 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
                 if (unlikely(tid >= MAX_TID_COUNT))
                         goto drop;
-                seq_number = priv->stations[sta_id].tid[tid].seq_number &
-                                IEEE80211_SCTL_SEQ;
-                hdr->seq_ctrl = cpu_to_le16(seq_number) |
-                        (hdr->seq_ctrl &
-                                cpu_to_le16(IEEE80211_SCTL_FRAG));
-                seq_number += 0x10;
         }
 
         /* Descriptor for chosen Tx queue */
@@ -548,7 +538,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         /* Set up driver data for this TFD */
         memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
-        txq->txb[q->write_ptr].skb[0] = skb;
+        txq->txb[q->write_ptr].skb = skb;
 
         /* Init first empty entry in queue's array of Tx/cmd buffers */
         out_cmd = txq->cmd[idx];
@@ -591,8 +581,6 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         if (!ieee80211_has_morefrags(hdr->frame_control)) {
                 txq->need_update = 1;
-                if (qc)
-                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
         } else {
                 wait_write_ptr = 1;
                 txq->need_update = 0;
@@ -631,8 +619,8 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                                     len, PCI_DMA_TODEVICE);
         /* we do not map meta data ... so we can safely access address to
          * provide to unmap command*/
-        pci_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        pci_unmap_len_set(out_meta, len, len);
+        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
+        dma_unmap_len_set(out_meta, len, len);
 
         /* Add buffer containing Tx command and MAC(!) header to TFD's
          * first entry */
@@ -677,55 +665,6 @@ drop:
         return -1;
 }
 
-#define BEACON_TIME_MASK_LOW    0x00FFFFFF
-#define BEACON_TIME_MASK_HIGH   0xFF000000
-#define TIME_UNIT               1024
-
-/*
- * extended beacon time format
- * time in usec will be changed into a 32-bit value in 8:24 format
- * the high 1 byte is the beacon counts
- * the lower 3 bytes is the time in usec within one beacon interval
- */
-
-static u32 iwl3945_usecs_to_beacons(u32 usec, u32 beacon_interval)
-{
-        u32 quot;
-        u32 rem;
-        u32 interval = beacon_interval * 1024;
-
-        if (!interval || !usec)
-                return 0;
-
-        quot = (usec / interval) & (BEACON_TIME_MASK_HIGH >> 24);
-        rem = (usec % interval) & BEACON_TIME_MASK_LOW;
-
-        return (quot << 24) + rem;
-}
-
-/* base is usually what we get from ucode with each received frame,
- * the same as HW timer counter counting down
- */
-
-static __le32 iwl3945_add_beacon_time(u32 base, u32 addon, u32 beacon_interval)
-{
-        u32 base_low = base & BEACON_TIME_MASK_LOW;
-        u32 addon_low = addon & BEACON_TIME_MASK_LOW;
-        u32 interval = beacon_interval * TIME_UNIT;
-        u32 res = (base & BEACON_TIME_MASK_HIGH) +
-            (addon & BEACON_TIME_MASK_HIGH);
-
-        if (base_low > addon_low)
-                res += base_low - addon_low;
-        else if (base_low < addon_low) {
-                res += interval + base_low - addon_low;
-                res += (1 << 24);
-        } else
-                res += (1 << 24);
-
-        return cpu_to_le32(res);
-}
-
 static int iwl3945_get_measurement(struct iwl_priv *priv,
                                struct ieee80211_measurement_params *params,
                                u8 type)
@@ -743,8 +682,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
         int duration = le16_to_cpu(params->duration);
 
         if (iwl_is_associated(priv))
-                add_time =
-                    iwl3945_usecs_to_beacons(
+                add_time = iwl_usecs_to_beacons(priv,
                         le64_to_cpu(params->start_time) - priv->_3945.last_tsf,
                         le16_to_cpu(priv->rxon_timing.beacon_interval));
 
@@ -759,8 +697,8 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
 
         if (iwl_is_associated(priv))
                 spectrum.start_time =
-                    iwl3945_add_beacon_time(priv->_3945.last_beacon_time,
-                                add_time,
+                        iwl_add_beacon_time(priv,
+                                priv->_3945.last_beacon_time, add_time,
                                 le16_to_cpu(priv->rxon_timing.beacon_interval));
         else
                 spectrum.start_time = 0;
@@ -1233,7 +1171,7 @@ static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rx
         }
 
         dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
-                          rxq->dma_addr);
+                          rxq->bd_dma);
         dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
                           rxq->rb_stts, rxq->rb_stts_dma);
         rxq->bd = NULL;
@@ -1314,6 +1252,8 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                 IWL_DEBUG_RX(priv, "r = %d, i = %d\n", r, i);
 
         while (i != r) {
+                int len;
+
                 rxb = rxq->queue[i];
 
                 /* If an RXB doesn't have a Rx queue slot associated with it,
@@ -1328,8 +1268,9 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                                PCI_DMA_FROMDEVICE);
                 pkt = rxb_addr(rxb);
 
-                trace_iwlwifi_dev_rx(priv, pkt,
-                        le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
+                len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+                len += sizeof(u32); /* account for status word */
+                trace_iwlwifi_dev_rx(priv, pkt, len);
 
                 /* Reclaim a command buffer only if this packet is a response
                  *   to a (driver-originated) command.
@@ -1483,7 +1424,7 @@ void iwl3945_dump_nic_error_log(struct iwl_priv *priv)
                     iwl_read_targ_mem(priv, base + i + 6 * sizeof(u32));
 
                 IWL_ERR(priv,
-                        "%-13s (#%d) %010u 0x%05X 0x%05X 0x%05X 0x%05X %u\n\n",
+                        "%-13s (0x%X) %010u 0x%05X 0x%05X 0x%05X 0x%05X %u\n\n",
                         desc_lookup(desc), desc, time, blink1, blink2,
                         ilink1, ilink2, data1);
                 trace_iwlwifi_dev_ucode_error(priv, desc, time, data1, 0,
@@ -3022,14 +2963,16 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                 scan->tx_cmd.len = cpu_to_le16(
                         iwl_fill_probe_req(priv,
                                 (struct ieee80211_mgmt *)scan->data,
+                                vif->addr,
                                 priv->scan_request->ie,
                                 priv->scan_request->ie_len,
                                 IWL_MAX_SCAN_SIZE - sizeof(*scan)));
         } else {
+                /* use bcast addr, will not be transmitted but must be valid */
                 scan->tx_cmd.len = cpu_to_le16(
                         iwl_fill_probe_req(priv,
                                 (struct ieee80211_mgmt *)scan->data,
-                                NULL, 0,
+                                iwl_bcast_addr, NULL, 0,
                                 IWL_MAX_SCAN_SIZE - sizeof(*scan)));
         }
         /* select Rx antennas */
@@ -3158,19 +3101,16 @@ void iwl3945_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
         IWL_DEBUG_ASSOC(priv, "assoc id %d beacon interval %d\n",
                         vif->bss_conf.aid, vif->bss_conf.beacon_int);
 
-        if (vif->bss_conf.assoc_capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
+        if (vif->bss_conf.use_short_preamble)
                 priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
         else
                 priv->staging_rxon.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
         if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
-                if (vif->bss_conf.assoc_capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
+                if (vif->bss_conf.use_short_slot)
                         priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
                 else
                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
-
-                if (vif->type == NL80211_IFTYPE_ADHOC)
-                        priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
         }
 
         iwlcore_commit_rxon(priv);
@@ -3334,8 +3274,7 @@ void iwl3945_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
                 priv->staging_rxon.assoc_id = 0;
 
-                if (vif->bss_conf.assoc_capability &
-                                        WLAN_CAPABILITY_SHORT_PREAMBLE)
+                if (vif->bss_conf.use_short_preamble)
                         priv->staging_rxon.flags |=
                                 RXON_FLG_SHORT_PREAMBLE_MSK;
                 else
@@ -3343,17 +3282,12 @@ void iwl3945_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
                                 ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
                 if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
-                        if (vif->bss_conf.assoc_capability &
-                                        WLAN_CAPABILITY_SHORT_SLOT_TIME)
+                        if (vif->bss_conf.use_short_slot)
                                 priv->staging_rxon.flags |=
                                         RXON_FLG_SHORT_SLOT_MSK;
                         else
                                 priv->staging_rxon.flags &=
                                         ~RXON_FLG_SHORT_SLOT_MSK;
-
-                        if (vif->type == NL80211_IFTYPE_ADHOC)
-                                priv->staging_rxon.flags &=
-                                        ~RXON_FLG_SHORT_SLOT_MSK;
                 }
                 /* restore RXON assoc */
                 priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
@@ -3386,17 +3320,9 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         static_key = !iwl_is_associated(priv);
 
         if (!static_key) {
-                if (!sta) {
-                        sta_id = priv->hw_params.bcast_sta_id;
-                } else {
-                        sta_id = iwl_sta_id(sta);
-                        if (sta_id == IWL_INVALID_STATION) {
-                                IWL_DEBUG_MAC80211(priv,
-                                                   "leave - %pM not in station map.\n",
-                                                   sta->addr);
-                                return -EINVAL;
-                        }
-                }
+                sta_id = iwl_sta_id_or_broadcast(priv, sta);
+                if (sta_id == IWL_INVALID_STATION)
+                        return -EINVAL;
         }
 
         mutex_lock(&priv->mutex);
@@ -4028,9 +3954,6 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         priv->pci_dev = pdev;
         priv->inta_mask = CSR_INI_SET_MASK;
 
-#ifdef CONFIG_IWLWIFI_DEBUG
-        atomic_set(&priv->restrict_refcnt, 0);
-#endif
         if (iwl_alloc_traffic_mem(priv))
                 IWL_ERR(priv, "Not enough memory to generate traffic log\n");
 
@@ -4099,9 +4022,8 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         }
         /* MAC Address location in EEPROM same for 3945/4965 */
         eeprom = (struct iwl3945_eeprom *)priv->eeprom;
-        memcpy(priv->mac_addr, eeprom->mac_address, ETH_ALEN);
-        IWL_DEBUG_INFO(priv, "MAC address: %pM\n", priv->mac_addr);
-        SET_IEEE80211_PERM_ADDR(priv->hw, priv->mac_addr);
+        IWL_DEBUG_INFO(priv, "MAC address: %pM\n", eeprom->mac_address);
+        SET_IEEE80211_PERM_ADDR(priv->hw, eeprom->mac_address);
 
         /***********************
          * 5. Setup HW Constants
diff --git a/drivers/net/wireless/iwmc3200wifi/cfg80211.c b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
index 902e95f70f6e..60619678f4ec 100644
--- a/drivers/net/wireless/iwmc3200wifi/cfg80211.c
+++ b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
@@ -670,20 +670,24 @@ static int iwm_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int iwm_cfg80211_set_txpower(struct wiphy *wiphy,
-                                    enum tx_power_setting type, int dbm)
+                                    enum nl80211_tx_power_setting type, int mbm)
 {
         struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
         int ret;
 
         switch (type) {
-        case TX_POWER_AUTOMATIC:
+        case NL80211_TX_POWER_AUTOMATIC:
                 return 0;
-        case TX_POWER_FIXED:
+        case NL80211_TX_POWER_FIXED:
+                if (mbm < 0 || (mbm % 100))
+                        return -EOPNOTSUPP;
+
                 if (!test_bit(IWM_STATUS_READY, &iwm->status))
                         return 0;
 
                 ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                              CFG_TX_PWR_LIMIT_USR, dbm * 2);
+                                              CFG_TX_PWR_LIMIT_USR,
+                                              MBM_TO_DBM(mbm) * 2);
                 if (ret < 0)
                         return ret;
 
diff --git a/drivers/net/wireless/iwmc3200wifi/hal.c b/drivers/net/wireless/iwmc3200wifi/hal.c
index 9531b18cf72a..907ac890997c 100644
--- a/drivers/net/wireless/iwmc3200wifi/hal.c
+++ b/drivers/net/wireless/iwmc3200wifi/hal.c
@@ -54,7 +54,7 @@
  *   LMAC. If you look at LMAC commands you'll se that they
  *   are actually regular iwlwifi target commands encapsulated
  *   into a special UMAC command called UMAC passthrough.
- *   This is due to the fact the the host talks exclusively
+ *   This is due to the fact the host talks exclusively
  *   to the UMAC and so there needs to be a special UMAC
  *   command for talking to the LMAC.
  *   This is how a wifi command is layed out:
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index e1184deca559..c02fcedea9fa 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -321,14 +321,14 @@ iwm_rx_ticket_node_alloc(struct iwm_priv *iwm, struct iwm_rx_ticket *ticket)
                 return ERR_PTR(-ENOMEM);
         }
 
-        ticket_node->ticket = kzalloc(sizeof(struct iwm_rx_ticket), GFP_KERNEL);
+        ticket_node->ticket = kmemdup(ticket, sizeof(struct iwm_rx_ticket),
+                                      GFP_KERNEL);
         if (!ticket_node->ticket) {
                 IWM_ERR(iwm, "Couldn't allocate RX ticket\n");
                 kfree(ticket_node);
                 return ERR_PTR(-ENOMEM);
         }
 
-        memcpy(ticket_node->ticket, ticket, sizeof(struct iwm_rx_ticket));
         INIT_LIST_HEAD(&ticket_node->node);
 
         return ticket_node;
diff --git a/drivers/net/wireless/libertas/Makefile b/drivers/net/wireless/libertas/Makefile
index 45e870e33117..f7d01bfa2e4a 100644
--- a/drivers/net/wireless/libertas/Makefile
+++ b/drivers/net/wireless/libertas/Makefile
@@ -1,4 +1,3 @@
-libertas-y += assoc.o
 libertas-y += cfg.o
 libertas-y += cmd.o
 libertas-y += cmdresp.o
@@ -6,9 +5,7 @@ libertas-y += debugfs.o
 libertas-y += ethtool.o
 libertas-y += main.o
 libertas-y += rx.o
-libertas-y += scan.o
 libertas-y += tx.o
-libertas-y += wext.o
 libertas-$(CONFIG_LIBERTAS_MESH) += mesh.o
 
 usb8xxx-objs += if_usb.o
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
deleted file mode 100644
index aa06070e5eab..000000000000
--- a/drivers/net/wireless/libertas/assoc.c
+++ /dev/null
@@ -1,2264 +0,0 @@
-/* Copyright (C) 2006, Red Hat, Inc. */
-
-#include <linux/types.h>
-#include <linux/etherdevice.h>
-#include <linux/ieee80211.h>
-#include <linux/if_arp.h>
-#include <linux/slab.h>
-#include <net/lib80211.h>
-
-#include "assoc.h"
-#include "decl.h"
-#include "host.h"
-#include "scan.h"
-#include "cmd.h"
-
-static const u8 bssid_any[ETH_ALEN]  __attribute__ ((aligned (2))) =
-        { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
-static const u8 bssid_off[ETH_ALEN]  __attribute__ ((aligned (2))) =
-        { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
-
-/* The firmware needs the following bits masked out of the beacon-derived
- * capability field when associating/joining to a BSS:
- *  9 (QoS), 11 (APSD), 12 (unused), 14 (unused), 15 (unused)
- */
-#define CAPINFO_MASK    (~(0xda00))
-
-/**
- * 802.11b/g supported bitrates (in 500Kb/s units)
- */
-u8 lbs_bg_rates[MAX_RATES] =
-    { 0x02, 0x04, 0x0b, 0x16, 0x0c, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6c,
-0x00, 0x00 };
-
-
-static int assoc_helper_wep_keys(struct lbs_private *priv,
-                struct assoc_request *assoc_req);
-
-/**
- *  @brief This function finds common rates between rates and card rates.
- *
- * It will fill common rates in rates as output if found.
- *
- * NOTE: Setting the MSB of the basic rates need to be taken
- *   care, either before or after calling this function
- *
- *  @param priv     A pointer to struct lbs_private structure
- *  @param rates       the buffer which keeps input and output
- *  @param rates_size  the size of rates buffer; new size of buffer on return,
- *                     which will be less than or equal to original rates_size
- *
- *  @return            0 on success, or -1 on error
- */
-static int get_common_rates(struct lbs_private *priv,
-        u8 *rates,
-        u16 *rates_size)
-{
-        int i, j;
-        u8 intersection[MAX_RATES];
-        u16 intersection_size;
-        u16 num_rates = 0;
-
-        intersection_size = min_t(u16, *rates_size, ARRAY_SIZE(intersection));
-
-        /* Allow each rate from 'rates' that is supported by the hardware */
-        for (i = 0; i < ARRAY_SIZE(lbs_bg_rates) && lbs_bg_rates[i]; i++) {
-                for (j = 0; j < intersection_size && rates[j]; j++) {
-                        if (rates[j] == lbs_bg_rates[i])
-                                intersection[num_rates++] = rates[j];
-                }
-        }
-
-        lbs_deb_hex(LBS_DEB_JOIN, "AP rates    ", rates, *rates_size);
-        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", lbs_bg_rates,
-                        ARRAY_SIZE(lbs_bg_rates));
-        lbs_deb_hex(LBS_DEB_JOIN, "common rates", intersection, num_rates);
-        lbs_deb_join("TX data rate 0x%02x\n", priv->cur_rate);
-
-        if (!priv->enablehwauto) {
-                for (i = 0; i < num_rates; i++) {
-                        if (intersection[i] == priv->cur_rate)
-                                goto done;
-                }
-                lbs_pr_alert("Previously set fixed data rate %#x isn't "
-                       "compatible with the network.\n", priv->cur_rate);
-                return -1;
-        }
-
-done:
-        memset(rates, 0, *rates_size);
-        *rates_size = num_rates;
-        memcpy(rates, intersection, num_rates);
-        return 0;
-}
-
-
-/**
- *  @brief Sets the MSB on basic rates as the firmware requires
- *
- * Scan through an array and set the MSB for basic data rates.
- *
- *  @param rates     buffer of data rates
- *  @param len       size of buffer
- */
-static void lbs_set_basic_rate_flags(u8 *rates, size_t len)
-{
-        int i;
-
-        for (i = 0; i < len; i++) {
-                if (rates[i] == 0x02 || rates[i] == 0x04 ||
-                    rates[i] == 0x0b || rates[i] == 0x16)
-                        rates[i] |= 0x80;
-        }
-}
-
-
-static u8 iw_auth_to_ieee_auth(u8 auth)
-{
-        if (auth == IW_AUTH_ALG_OPEN_SYSTEM)
-                return 0x00;
-        else if (auth == IW_AUTH_ALG_SHARED_KEY)
-                return 0x01;
-        else if (auth == IW_AUTH_ALG_LEAP)
-                return 0x80;
-
-        lbs_deb_join("%s: invalid auth alg 0x%X\n", __func__, auth);
-        return 0;
-}
-
-/**
- *  @brief This function prepares the authenticate command.  AUTHENTICATE only
- *  sets the authentication suite for future associations, as the firmware
- *  handles authentication internally during the ASSOCIATE command.
- *
- *  @param priv      A pointer to struct lbs_private structure
- *  @param bssid     The peer BSSID with which to authenticate
- *  @param auth      The authentication mode to use (from wireless.h)
- *
- *  @return         0 or -1
- */
-static int lbs_set_authentication(struct lbs_private *priv, u8 bssid[6], u8 auth)
-{
-        struct cmd_ds_802_11_authenticate cmd;
-        int ret = -1;
-
-        lbs_deb_enter(LBS_DEB_JOIN);
-
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-        memcpy(cmd.bssid, bssid, ETH_ALEN);
-
-        cmd.authtype = iw_auth_to_ieee_auth(auth);
-
-        lbs_deb_join("AUTH_CMD: BSSID %pM, auth 0x%x\n", bssid, cmd.authtype);
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_AUTHENTICATE, &cmd);
-
-        lbs_deb_leave_args(LBS_DEB_JOIN, "ret %d", ret);
-        return ret;
-}
-
-
-int lbs_cmd_802_11_set_wep(struct lbs_private *priv, uint16_t cmd_action,
-                           struct assoc_request *assoc)
-{
-        struct cmd_ds_802_11_set_wep cmd;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.hdr.command = cpu_to_le16(CMD_802_11_SET_WEP);
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        cmd.action = cpu_to_le16(cmd_action);
-
-        if (cmd_action == CMD_ACT_ADD) {
-                int i;
-
-                /* default tx key index */
-                cmd.keyindex = cpu_to_le16(assoc->wep_tx_keyidx &
-                                           CMD_WEP_KEY_INDEX_MASK);
-
-                /* Copy key types and material to host command structure */
-                for (i = 0; i < 4; i++) {
-                        struct enc_key *pkey = &assoc->wep_keys[i];
-
-                        switch (pkey->len) {
-                        case KEY_LEN_WEP_40:
-                                cmd.keytype[i] = CMD_TYPE_WEP_40_BIT;
-                                memmove(cmd.keymaterial[i], pkey->key, pkey->len);
-                                lbs_deb_cmd("SET_WEP: add key %d (40 bit)\n", i);
-                                break;
-                        case KEY_LEN_WEP_104:
-                                cmd.keytype[i] = CMD_TYPE_WEP_104_BIT;
-                                memmove(cmd.keymaterial[i], pkey->key, pkey->len);
-                                lbs_deb_cmd("SET_WEP: add key %d (104 bit)\n", i);
-                                break;
-                        case 0:
-                                break;
-                        default:
-                                lbs_deb_cmd("SET_WEP: invalid key %d, length %d\n",
-                                            i, pkey->len);
-                                ret = -1;
-                                goto done;
-                                break;
-                        }
-                }
-        } else if (cmd_action == CMD_ACT_REMOVE) {
-                /* ACT_REMOVE clears _all_ WEP keys */
-
-                /* default tx key index */
-                cmd.keyindex = cpu_to_le16(priv->wep_tx_keyidx &
-                                           CMD_WEP_KEY_INDEX_MASK);
-                lbs_deb_cmd("SET_WEP: remove key %d\n", priv->wep_tx_keyidx);
-        }
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
-done:
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-
-int lbs_cmd_802_11_enable_rsn(struct lbs_private *priv, uint16_t cmd_action,
-                              uint16_t *enable)
-{
-        struct cmd_ds_802_11_enable_rsn cmd;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-        cmd.action = cpu_to_le16(cmd_action);
-
-        if (cmd_action == CMD_ACT_GET)
-                cmd.enable = 0;
-        else {
-                if (*enable)
-                        cmd.enable = cpu_to_le16(CMD_ENABLE_RSN);
-                else
-                        cmd.enable = cpu_to_le16(CMD_DISABLE_RSN);
-                lbs_deb_cmd("ENABLE_RSN: %d\n", *enable);
-        }
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_ENABLE_RSN, &cmd);
-        if (!ret && cmd_action == CMD_ACT_GET)
-                *enable = le16_to_cpu(cmd.enable);
-
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-
-static void set_one_wpa_key(struct MrvlIEtype_keyParamSet *keyparam,
-                struct enc_key *key)
-{
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        if (key->flags & KEY_INFO_WPA_ENABLED)
-                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_ENABLED);
-        if (key->flags & KEY_INFO_WPA_UNICAST)
-                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_UNICAST);
-        if (key->flags & KEY_INFO_WPA_MCAST)
-                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_MCAST);
-
-        keyparam->type = cpu_to_le16(TLV_TYPE_KEY_MATERIAL);
-        keyparam->keytypeid = cpu_to_le16(key->type);
-        keyparam->keylen = cpu_to_le16(key->len);
-        memcpy(keyparam->key, key->key, key->len);
-
-        /* Length field doesn't include the {type,length} header */
-        keyparam->length = cpu_to_le16(sizeof(*keyparam) - 4);
-        lbs_deb_leave(LBS_DEB_CMD);
-}
-
-int lbs_cmd_802_11_key_material(struct lbs_private *priv, uint16_t cmd_action,
-                                struct assoc_request *assoc)
-{
-        struct cmd_ds_802_11_key_material cmd;
-        int ret = 0;
-        int index = 0;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        cmd.action = cpu_to_le16(cmd_action);
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        if (cmd_action == CMD_ACT_GET) {
-                cmd.hdr.size = cpu_to_le16(sizeof(struct cmd_header) + 2);
-        } else {
-                memset(cmd.keyParamSet, 0, sizeof(cmd.keyParamSet));
-
-                if (test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc->flags)) {
-                        set_one_wpa_key(&cmd.keyParamSet[index],
-                                        &assoc->wpa_unicast_key);
-                        index++;
-                }
-
-                if (test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc->flags)) {
-                        set_one_wpa_key(&cmd.keyParamSet[index],
-                                        &assoc->wpa_mcast_key);
-                        index++;
-                }
-
-                /* The common header and as many keys as we included */
-                cmd.hdr.size = cpu_to_le16(offsetof(typeof(cmd),
-                                                    keyParamSet[index]));
-        }
-        ret = lbs_cmd_with_response(priv, CMD_802_11_KEY_MATERIAL, &cmd);
-        /* Copy the returned key to driver private data */
-        if (!ret && cmd_action == CMD_ACT_GET) {
-                void *buf_ptr = cmd.keyParamSet;
-                void *resp_end = &(&cmd)[1];
-
-                while (buf_ptr < resp_end) {
-                        struct MrvlIEtype_keyParamSet *keyparam = buf_ptr;
-                        struct enc_key *key;
-                        uint16_t param_set_len = le16_to_cpu(keyparam->length);
-                        uint16_t key_len = le16_to_cpu(keyparam->keylen);
-                        uint16_t key_flags = le16_to_cpu(keyparam->keyinfo);
-                        uint16_t key_type = le16_to_cpu(keyparam->keytypeid);
-                        void *end;
-
-                        end = (void *)keyparam + sizeof(keyparam->type)
-                                + sizeof(keyparam->length) + param_set_len;
-
-                        /* Make sure we don't access past the end of the IEs */
-                        if (end > resp_end)
-                                break;
-
-                        if (key_flags & KEY_INFO_WPA_UNICAST)
-                                key = &priv->wpa_unicast_key;
-                        else if (key_flags & KEY_INFO_WPA_MCAST)
-                                key = &priv->wpa_mcast_key;
-                        else
-                                break;
-
-                        /* Copy returned key into driver */
-                        memset(key, 0, sizeof(struct enc_key));
-                        if (key_len > sizeof(key->key))
-                                break;
-                        key->type = key_type;
-                        key->flags = key_flags;
-                        key->len = key_len;
-                        memcpy(key->key, keyparam->key, key->len);
-
-                        buf_ptr = end + 1;
-                }
-        }
-
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-
-static __le16 lbs_rate_to_fw_bitmap(int rate, int lower_rates_ok)
-{
-/*              Bit     Rate
-*               15:13 Reserved
-*               12    54 Mbps
-*               11    48 Mbps
-*               10    36 Mbps
-*               9     24 Mbps
-*               8     18 Mbps
-*               7     12 Mbps
-*               6     9 Mbps
-*               5     6 Mbps
-*               4     Reserved
-*               3     11 Mbps
-*               2     5.5 Mbps
-*               1     2 Mbps
-*               0     1 Mbps
-**/
-
-        uint16_t ratemask;
-        int i = lbs_data_rate_to_fw_index(rate);
-        if (lower_rates_ok)
-                ratemask = (0x1fef >> (12 - i));
-        else
-                ratemask = (1 << i);
-        return cpu_to_le16(ratemask);
-}
-
-int lbs_cmd_802_11_rate_adapt_rateset(struct lbs_private *priv,
-                                      uint16_t cmd_action)
-{
-        struct cmd_ds_802_11_rate_adapt_rateset cmd;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        if (!priv->cur_rate && !priv->enablehwauto)
-                return -EINVAL;
-
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        cmd.action = cpu_to_le16(cmd_action);
-        cmd.enablehwauto = cpu_to_le16(priv->enablehwauto);
-        cmd.bitmap = lbs_rate_to_fw_bitmap(priv->cur_rate, priv->enablehwauto);
-        ret = lbs_cmd_with_response(priv, CMD_802_11_RATE_ADAPT_RATESET, &cmd);
-        if (!ret && cmd_action == CMD_ACT_GET)
-                priv->enablehwauto = le16_to_cpu(cmd.enablehwauto);
-
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief Set the data rate
- *
- *  @param priv         A pointer to struct lbs_private structure
- *  @param rate         The desired data rate, or 0 to clear a locked rate
- *
- *  @return             0 on success, error on failure
- */
-int lbs_set_data_rate(struct lbs_private *priv, u8 rate)
-{
-        struct cmd_ds_802_11_data_rate cmd;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        if (rate > 0) {
-                cmd.action = cpu_to_le16(CMD_ACT_SET_TX_FIX_RATE);
-                cmd.rates[0] = lbs_data_rate_to_fw_index(rate);
-                if (cmd.rates[0] == 0) {
-                        lbs_deb_cmd("DATA_RATE: invalid requested rate of"
-                                " 0x%02X\n", rate);
-                        ret = 0;
-                        goto out;
-                }
-                lbs_deb_cmd("DATA_RATE: set fixed 0x%02X\n", cmd.rates[0]);
-        } else {
-                cmd.action = cpu_to_le16(CMD_ACT_SET_TX_AUTO);
-                lbs_deb_cmd("DATA_RATE: setting auto\n");
-        }
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_DATA_RATE, &cmd);
-        if (ret)
-                goto out;
-
-        lbs_deb_hex(LBS_DEB_CMD, "DATA_RATE_RESP", (u8 *) &cmd, sizeof(cmd));
-
-        /* FIXME: get actual rates FW can do if this command actually returns
-         * all data rates supported.
-         */
-        priv->cur_rate = lbs_fw_index_to_data_rate(cmd.rates[0]);
-        lbs_deb_cmd("DATA_RATE: current rate is 0x%02x\n", priv->cur_rate);
-
-out:
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-
-
-int lbs_cmd_802_11_rssi(struct lbs_private *priv,
-                                struct cmd_ds_command *cmd)
-{
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        cmd->command = cpu_to_le16(CMD_802_11_RSSI);
-        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_802_11_rssi) +
-                sizeof(struct cmd_header));
-        cmd->params.rssi.N = cpu_to_le16(DEFAULT_BCN_AVG_FACTOR);
-
-        /* reset Beacon SNR/NF/RSSI values */
-        priv->SNR[TYPE_BEACON][TYPE_NOAVG] = 0;
-        priv->SNR[TYPE_BEACON][TYPE_AVG] = 0;
-        priv->NF[TYPE_BEACON][TYPE_NOAVG] = 0;
-        priv->NF[TYPE_BEACON][TYPE_AVG] = 0;
-        priv->RSSI[TYPE_BEACON][TYPE_NOAVG] = 0;
-        priv->RSSI[TYPE_BEACON][TYPE_AVG] = 0;
-
-        lbs_deb_leave(LBS_DEB_CMD);
-        return 0;
-}
-
-int lbs_ret_802_11_rssi(struct lbs_private *priv,
-                                struct cmd_ds_command *resp)
-{
-        struct cmd_ds_802_11_rssi_rsp *rssirsp = &resp->params.rssirsp;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        /* store the non average value */
-        priv->SNR[TYPE_BEACON][TYPE_NOAVG] = get_unaligned_le16(&rssirsp->SNR);
-        priv->NF[TYPE_BEACON][TYPE_NOAVG] =
-                get_unaligned_le16(&rssirsp->noisefloor);
-
-        priv->SNR[TYPE_BEACON][TYPE_AVG] = get_unaligned_le16(&rssirsp->avgSNR);
-        priv->NF[TYPE_BEACON][TYPE_AVG] =
-                get_unaligned_le16(&rssirsp->avgnoisefloor);
-
-        priv->RSSI[TYPE_BEACON][TYPE_NOAVG] =
-            CAL_RSSI(priv->SNR[TYPE_BEACON][TYPE_NOAVG],
-                     priv->NF[TYPE_BEACON][TYPE_NOAVG]);
-
-        priv->RSSI[TYPE_BEACON][TYPE_AVG] =
-            CAL_RSSI(priv->SNR[TYPE_BEACON][TYPE_AVG] / AVG_SCALE,
-                     priv->NF[TYPE_BEACON][TYPE_AVG] / AVG_SCALE);
-
-        lbs_deb_cmd("RSSI: beacon %d, avg %d\n",
-               priv->RSSI[TYPE_BEACON][TYPE_NOAVG],
-               priv->RSSI[TYPE_BEACON][TYPE_AVG]);
-
-        lbs_deb_leave(LBS_DEB_CMD);
-        return 0;
-}
-
-
-int lbs_cmd_bcn_ctrl(struct lbs_private *priv,
-                                struct cmd_ds_command *cmd,
-                                u16 cmd_action)
-{
-        struct cmd_ds_802_11_beacon_control
-                *bcn_ctrl = &cmd->params.bcn_ctrl;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        cmd->size =
-            cpu_to_le16(sizeof(struct cmd_ds_802_11_beacon_control)
-                             + sizeof(struct cmd_header));
-        cmd->command = cpu_to_le16(CMD_802_11_BEACON_CTRL);
-
-        bcn_ctrl->action = cpu_to_le16(cmd_action);
-        bcn_ctrl->beacon_enable = cpu_to_le16(priv->beacon_enable);
-        bcn_ctrl->beacon_period = cpu_to_le16(priv->beacon_period);
-
-        lbs_deb_leave(LBS_DEB_CMD);
-        return 0;
-}
-
-int lbs_ret_802_11_bcn_ctrl(struct lbs_private *priv,
-                                        struct cmd_ds_command *resp)
-{
-        struct cmd_ds_802_11_beacon_control *bcn_ctrl =
-            &resp->params.bcn_ctrl;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        if (bcn_ctrl->action == CMD_ACT_GET) {
-                priv->beacon_enable = (u8) le16_to_cpu(bcn_ctrl->beacon_enable);
-                priv->beacon_period = le16_to_cpu(bcn_ctrl->beacon_period);
-        }
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        return 0;
-}
-
-
-
-static int lbs_assoc_post(struct lbs_private *priv,
-                          struct cmd_ds_802_11_associate_response *resp)
-{
-        int ret = 0;
-        union iwreq_data wrqu;
-        struct bss_descriptor *bss;
-        u16 status_code;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        if (!priv->in_progress_assoc_req) {
-                lbs_deb_assoc("ASSOC_RESP: no in-progress assoc request\n");
-                ret = -1;
-                goto done;
-        }
-        bss = &priv->in_progress_assoc_req->bss;
-
-        /*
-         * Older FW versions map the IEEE 802.11 Status Code in the association
-         * response to the following values returned in resp->statuscode:
-         *
-         *    IEEE Status Code                Marvell Status Code
-         *    0                       ->      0x0000 ASSOC_RESULT_SUCCESS
-         *    13                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
-         *    14                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
-         *    15                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
-         *    16                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
-         *    others                  ->      0x0003 ASSOC_RESULT_REFUSED
-         *
-         * Other response codes:
-         *    0x0001 -> ASSOC_RESULT_INVALID_PARAMETERS (unused)
-         *    0x0002 -> ASSOC_RESULT_TIMEOUT (internal timer expired waiting for
-         *                                    association response from the AP)
-         */
-
-        status_code = le16_to_cpu(resp->statuscode);
-        if (priv->fwrelease < 0x09000000) {
-                switch (status_code) {
-                case 0x00:
-                        break;
-                case 0x01:
-                        lbs_deb_assoc("ASSOC_RESP: invalid parameters\n");
-                        break;
-                case 0x02:
-                        lbs_deb_assoc("ASSOC_RESP: internal timer "
-                                "expired while waiting for the AP\n");
-                        break;
-                case 0x03:
-                        lbs_deb_assoc("ASSOC_RESP: association "
-                                "refused by AP\n");
-                        break;
-                case 0x04:
-                        lbs_deb_assoc("ASSOC_RESP: authentication "
-                                "refused by AP\n");
-                        break;
-                default:
-                        lbs_deb_assoc("ASSOC_RESP: failure reason 0x%02x "
-                                " unknown\n", status_code);
-                        break;
-                }
-        } else {
-                /* v9+ returns the AP's association response */
-                lbs_deb_assoc("ASSOC_RESP: failure reason 0x%02x\n", status_code);
-        }
-
-        if (status_code) {
-                lbs_mac_event_disconnected(priv);
-                ret = status_code;
-                goto done;
-        }
-
-        lbs_deb_hex(LBS_DEB_ASSOC, "ASSOC_RESP",
-                    (void *) (resp + sizeof (resp->hdr)),
-                    le16_to_cpu(resp->hdr.size) - sizeof (resp->hdr));
-
-        /* Send a Media Connected event, according to the Spec */
-        priv->connect_status = LBS_CONNECTED;
-
-        /* Update current SSID and BSSID */
-        memcpy(&priv->curbssparams.ssid, &bss->ssid, IEEE80211_MAX_SSID_LEN);
-        priv->curbssparams.ssid_len = bss->ssid_len;
-        memcpy(priv->curbssparams.bssid, bss->bssid, ETH_ALEN);
-
-        priv->SNR[TYPE_RXPD][TYPE_AVG] = 0;
-        priv->NF[TYPE_RXPD][TYPE_AVG] = 0;
-
-        memset(priv->rawSNR, 0x00, sizeof(priv->rawSNR));
-        memset(priv->rawNF, 0x00, sizeof(priv->rawNF));
-        priv->nextSNRNF = 0;
-        priv->numSNRNF = 0;
-
-        netif_carrier_on(priv->dev);
-        if (!priv->tx_pending_len)
-                netif_wake_queue(priv->dev);
-
-        memcpy(wrqu.ap_addr.sa_data, priv->curbssparams.bssid, ETH_ALEN);
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
-
-done:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief This function prepares an association-class command.
- *
- *  @param priv      A pointer to struct lbs_private structure
- *  @param assoc_req The association request describing the BSS to associate
- *                   or reassociate with
- *  @param command   The actual command, either CMD_802_11_ASSOCIATE or
- *                   CMD_802_11_REASSOCIATE
- *
- *  @return         0 or -1
- */
-static int lbs_associate(struct lbs_private *priv,
-                         struct assoc_request *assoc_req,
-                         u16 command)
-{
-        struct cmd_ds_802_11_associate cmd;
-        int ret = 0;
-        struct bss_descriptor *bss = &assoc_req->bss;
-        u8 *pos = &(cmd.iebuf[0]);
-        u16 tmpcap, tmplen, tmpauth;
-        struct mrvl_ie_ssid_param_set *ssid;
-        struct mrvl_ie_ds_param_set *ds;
-        struct mrvl_ie_cf_param_set *cf;
-        struct mrvl_ie_rates_param_set *rates;
-        struct mrvl_ie_rsn_param_set *rsn;
-        struct mrvl_ie_auth_type *auth;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        BUG_ON((command != CMD_802_11_ASSOCIATE) &&
-                (command != CMD_802_11_REASSOCIATE));
-
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.hdr.command = cpu_to_le16(command);
-
-        /* Fill in static fields */
-        memcpy(cmd.bssid, bss->bssid, ETH_ALEN);
-        cmd.listeninterval = cpu_to_le16(MRVDRV_DEFAULT_LISTEN_INTERVAL);
-
-        /* Capability info */
-        tmpcap = (bss->capability & CAPINFO_MASK);
-        if (bss->mode == IW_MODE_INFRA)
-                tmpcap |= WLAN_CAPABILITY_ESS;
-        cmd.capability = cpu_to_le16(tmpcap);
-        lbs_deb_assoc("ASSOC_CMD: capability 0x%04x\n", tmpcap);
-
-        /* SSID */
-        ssid = (struct mrvl_ie_ssid_param_set *) pos;
-        ssid->header.type = cpu_to_le16(TLV_TYPE_SSID);
-        tmplen = bss->ssid_len;
-        ssid->header.len = cpu_to_le16(tmplen);
-        memcpy(ssid->ssid, bss->ssid, tmplen);
-        pos += sizeof(ssid->header) + tmplen;
-
-        ds = (struct mrvl_ie_ds_param_set *) pos;
-        ds->header.type = cpu_to_le16(TLV_TYPE_PHY_DS);
-        ds->header.len = cpu_to_le16(1);
-        ds->channel = bss->phy.ds.channel;
-        pos += sizeof(ds->header) + 1;
-
-        cf = (struct mrvl_ie_cf_param_set *) pos;
-        cf->header.type = cpu_to_le16(TLV_TYPE_CF);
-        tmplen = sizeof(*cf) - sizeof (cf->header);
-        cf->header.len = cpu_to_le16(tmplen);
-        /* IE payload should be zeroed, firmware fills it in for us */
-        pos += sizeof(*cf);
-
-        rates = (struct mrvl_ie_rates_param_set *) pos;
-        rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
-        tmplen = min_t(u16, ARRAY_SIZE(bss->rates), MAX_RATES);
-        memcpy(&rates->rates, &bss->rates, tmplen);
-        if (get_common_rates(priv, rates->rates, &tmplen)) {
-                ret = -1;
-                goto done;
-        }
-        pos += sizeof(rates->header) + tmplen;
-        rates->header.len = cpu_to_le16(tmplen);
-        lbs_deb_assoc("ASSOC_CMD: num rates %u\n", tmplen);
-
-        /* Copy the infra. association rates into Current BSS state structure */
-        memset(&priv->curbssparams.rates, 0, sizeof(priv->curbssparams.rates));
-        memcpy(&priv->curbssparams.rates, &rates->rates, tmplen);
-
-        /* Set MSB on basic rates as the firmware requires, but _after_
-         * copying to current bss rates.
-         */
-        lbs_set_basic_rate_flags(rates->rates, tmplen);
-
-        /* Firmware v9+ indicate authentication suites as a TLV */
-        if (priv->fwrelease >= 0x09000000) {
-                auth = (struct mrvl_ie_auth_type *) pos;
-                auth->header.type = cpu_to_le16(TLV_TYPE_AUTH_TYPE);
-                auth->header.len = cpu_to_le16(2);
-                tmpauth = iw_auth_to_ieee_auth(priv->secinfo.auth_mode);
-                auth->auth = cpu_to_le16(tmpauth);
-                pos += sizeof(auth->header) + 2;
-
-                lbs_deb_join("AUTH_CMD: BSSID %pM, auth 0x%x\n",
-                        bss->bssid, priv->secinfo.auth_mode);
-        }
-
-        /* WPA/WPA2 IEs */
-        if (assoc_req->secinfo.WPAenabled || assoc_req->secinfo.WPA2enabled) {
-                rsn = (struct mrvl_ie_rsn_param_set *) pos;
-                /* WPA_IE or WPA2_IE */
-                rsn->header.type = cpu_to_le16((u16) assoc_req->wpa_ie[0]);
-                tmplen = (u16) assoc_req->wpa_ie[1];
-                rsn->header.len = cpu_to_le16(tmplen);
-                memcpy(rsn->rsnie, &assoc_req->wpa_ie[2], tmplen);
-                lbs_deb_hex(LBS_DEB_JOIN, "ASSOC_CMD: WPA/RSN IE", (u8 *) rsn,
-                        sizeof(rsn->header) + tmplen);
-                pos += sizeof(rsn->header) + tmplen;
-        }
-
-        cmd.hdr.size = cpu_to_le16((sizeof(cmd) - sizeof(cmd.iebuf)) +
-                                   (u16)(pos - (u8 *) &cmd.iebuf));
-
-        /* update curbssparams */
-        priv->channel = bss->phy.ds.channel;
-
-        ret = lbs_cmd_with_response(priv, command, &cmd);
-        if (ret == 0) {
-                ret = lbs_assoc_post(priv,
-                        (struct cmd_ds_802_11_associate_response *) &cmd);
-        }
-
-done:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief Associate to a specific BSS discovered in a scan
- *
- *  @param priv      A pointer to struct lbs_private structure
- *  @param assoc_req The association request describing the BSS to associate with
- *
- *  @return          0-success, otherwise fail
- */
-static int lbs_try_associate(struct lbs_private *priv,
-        struct assoc_request *assoc_req)
-{
-        int ret;
-        u8 preamble = RADIO_PREAMBLE_LONG;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        /* FW v9 and higher indicate authentication suites as a TLV in the
-         * association command, not as a separate authentication command.
-         */
-        if (priv->fwrelease < 0x09000000) {
-                ret = lbs_set_authentication(priv, assoc_req->bss.bssid,
-                                             priv->secinfo.auth_mode);
-                if (ret)
-                        goto out;
-        }
-
-        /* Use short preamble only when both the BSS and firmware support it */
-        if (assoc_req->bss.capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
-                preamble = RADIO_PREAMBLE_SHORT;
-
-        ret = lbs_set_radio(priv, preamble, 1);
-        if (ret)
-                goto out;
-
-        ret = lbs_associate(priv, assoc_req, CMD_802_11_ASSOCIATE);
-        /* If the association fails with current auth mode, let's
-         * try by changing the auth mode
-         */
-        if ((priv->authtype_auto) &&
-                        (ret == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) &&
-                        (assoc_req->secinfo.wep_enabled) &&
-                        (priv->connect_status != LBS_CONNECTED)) {
-                if (priv->secinfo.auth_mode == IW_AUTH_ALG_OPEN_SYSTEM)
-                        priv->secinfo.auth_mode = IW_AUTH_ALG_SHARED_KEY;
-                else
-                        priv->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
-                if (!assoc_helper_wep_keys(priv, assoc_req))
-                        ret = lbs_associate(priv, assoc_req,
-                                                CMD_802_11_ASSOCIATE);
-        }
-
-        if (ret)
-                ret = -1;
-out:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-static int lbs_adhoc_post(struct lbs_private *priv,
-                          struct cmd_ds_802_11_ad_hoc_result *resp)
-{
-        int ret = 0;
-        u16 command = le16_to_cpu(resp->hdr.command);
-        u16 result = le16_to_cpu(resp->hdr.result);
-        union iwreq_data wrqu;
-        struct bss_descriptor *bss;
-        DECLARE_SSID_BUF(ssid);
-
-        lbs_deb_enter(LBS_DEB_JOIN);
-
-        if (!priv->in_progress_assoc_req) {
-                lbs_deb_join("ADHOC_RESP: no in-progress association "
-                        "request\n");
-                ret = -1;
-                goto done;
-        }
-        bss = &priv->in_progress_assoc_req->bss;
-
-        /*
-         * Join result code 0 --> SUCCESS
-         */
-        if (result) {
-                lbs_deb_join("ADHOC_RESP: failed (result 0x%X)\n", result);
-                if (priv->connect_status == LBS_CONNECTED)
-                        lbs_mac_event_disconnected(priv);
-                ret = -1;
-                goto done;
-        }
-
-        /* Send a Media Connected event, according to the Spec */
-        priv->connect_status = LBS_CONNECTED;
-
-        if (command == CMD_RET(CMD_802_11_AD_HOC_START)) {
-                /* Update the created network descriptor with the new BSSID */
-                memcpy(bss->bssid, resp->bssid, ETH_ALEN);
-        }
-
-        /* Set the BSSID from the joined/started descriptor */
-        memcpy(&priv->curbssparams.bssid, bss->bssid, ETH_ALEN);
-
-        /* Set the new SSID to current SSID */
-        memcpy(&priv->curbssparams.ssid, &bss->ssid, IEEE80211_MAX_SSID_LEN);
-        priv->curbssparams.ssid_len = bss->ssid_len;
-
-        netif_carrier_on(priv->dev);
-        if (!priv->tx_pending_len)
-                netif_wake_queue(priv->dev);
-
-        memset(&wrqu, 0, sizeof(wrqu));
-        memcpy(wrqu.ap_addr.sa_data, priv->curbssparams.bssid, ETH_ALEN);
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
-
-        lbs_deb_join("ADHOC_RESP: Joined/started '%s', BSSID %pM, channel %d\n",
-                     print_ssid(ssid, bss->ssid, bss->ssid_len),
-                     priv->curbssparams.bssid,
-                     priv->channel);
-
-done:
-        lbs_deb_leave_args(LBS_DEB_JOIN, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief Join an adhoc network found in a previous scan
- *
- *  @param priv         A pointer to struct lbs_private structure
- *  @param assoc_req    The association request describing the BSS to join
- *
- *  @return             0 on success, error on failure
- */
-static int lbs_adhoc_join(struct lbs_private *priv,
-        struct assoc_request *assoc_req)
-{
-        struct cmd_ds_802_11_ad_hoc_join cmd;
-        struct bss_descriptor *bss = &assoc_req->bss;
-        u8 preamble = RADIO_PREAMBLE_LONG;
-        DECLARE_SSID_BUF(ssid);
-        u16 ratesize = 0;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        lbs_deb_join("current SSID '%s', ssid length %u\n",
-                print_ssid(ssid, priv->curbssparams.ssid,
-                priv->curbssparams.ssid_len),
-                priv->curbssparams.ssid_len);
-        lbs_deb_join("requested ssid '%s', ssid length %u\n",
-                print_ssid(ssid, bss->ssid, bss->ssid_len),
-                bss->ssid_len);
-
-        /* check if the requested SSID is already joined */
-        if (priv->curbssparams.ssid_len &&
-            !lbs_ssid_cmp(priv->curbssparams.ssid,
-                        priv->curbssparams.ssid_len,
-                        bss->ssid, bss->ssid_len) &&
-            (priv->mode == IW_MODE_ADHOC) &&
-            (priv->connect_status == LBS_CONNECTED)) {
-                union iwreq_data wrqu;
-
-                lbs_deb_join("ADHOC_J_CMD: New ad-hoc SSID is the same as "
-                        "current, not attempting to re-join");
-
-                /* Send the re-association event though, because the association
-                 * request really was successful, even if just a null-op.
-                 */
-                memset(&wrqu, 0, sizeof(wrqu));
-                memcpy(wrqu.ap_addr.sa_data, priv->curbssparams.bssid,
-                       ETH_ALEN);
-                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-                wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
-                goto out;
-        }
-
-        /* Use short preamble only when both the BSS and firmware support it */
-        if (bss->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) {
-                lbs_deb_join("AdhocJoin: Short preamble\n");
-                preamble = RADIO_PREAMBLE_SHORT;
-        }
-
-        ret = lbs_set_radio(priv, preamble, 1);
-        if (ret)
-                goto out;
-
-        lbs_deb_join("AdhocJoin: channel = %d\n", assoc_req->channel);
-        lbs_deb_join("AdhocJoin: band = %c\n", assoc_req->band);
-
-        priv->adhoccreate = 0;
-        priv->channel = bss->channel;
-
-        /* Build the join command */
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        cmd.bss.type = CMD_BSS_TYPE_IBSS;
-        cmd.bss.beaconperiod = cpu_to_le16(bss->beaconperiod);
-
-        memcpy(&cmd.bss.bssid, &bss->bssid, ETH_ALEN);
-        memcpy(&cmd.bss.ssid, &bss->ssid, bss->ssid_len);
-
-        memcpy(&cmd.bss.ds, &bss->phy.ds, sizeof(struct ieee_ie_ds_param_set));
-
-        memcpy(&cmd.bss.ibss, &bss->ss.ibss,
-               sizeof(struct ieee_ie_ibss_param_set));
-
-        cmd.bss.capability = cpu_to_le16(bss->capability & CAPINFO_MASK);
-        lbs_deb_join("ADHOC_J_CMD: tmpcap=%4X CAPINFO_MASK=%4X\n",
-               bss->capability, CAPINFO_MASK);
-
-        /* information on BSSID descriptor passed to FW */
-        lbs_deb_join("ADHOC_J_CMD: BSSID = %pM, SSID = '%s'\n",
-                        cmd.bss.bssid, cmd.bss.ssid);
-
-        /* Only v8 and below support setting these */
-        if (priv->fwrelease < 0x09000000) {
-                /* failtimeout */
-                cmd.failtimeout = cpu_to_le16(MRVDRV_ASSOCIATION_TIME_OUT);
-                /* probedelay */
-                cmd.probedelay = cpu_to_le16(CMD_SCAN_PROBE_DELAY_TIME);
-        }
-
-        /* Copy Data rates from the rates recorded in scan response */
-        memset(cmd.bss.rates, 0, sizeof(cmd.bss.rates));
-        ratesize = min_t(u16, ARRAY_SIZE(cmd.bss.rates), ARRAY_SIZE (bss->rates));
-        memcpy(cmd.bss.rates, bss->rates, ratesize);
-        if (get_common_rates(priv, cmd.bss.rates, &ratesize)) {
-                lbs_deb_join("ADHOC_JOIN: get_common_rates returned error.\n");
-                ret = -1;
-                goto out;
-        }
-
-        /* Copy the ad-hoc creation rates into Current BSS state structure */
-        memset(&priv->curbssparams.rates, 0, sizeof(priv->curbssparams.rates));
-        memcpy(&priv->curbssparams.rates, cmd.bss.rates, ratesize);
-
-        /* Set MSB on basic rates as the firmware requires, but _after_
-         * copying to current bss rates.
-         */
-        lbs_set_basic_rate_flags(cmd.bss.rates, ratesize);
-
-        cmd.bss.ibss.atimwindow = bss->atimwindow;
-
-        if (assoc_req->secinfo.wep_enabled) {
-                u16 tmp = le16_to_cpu(cmd.bss.capability);
-                tmp |= WLAN_CAPABILITY_PRIVACY;
-                cmd.bss.capability = cpu_to_le16(tmp);
-        }
-
-        if (priv->psmode == LBS802_11POWERMODEMAX_PSP) {
-                __le32 local_ps_mode = cpu_to_le32(LBS802_11POWERMODECAM);
-
-                /* wake up first */
-                ret = lbs_prepare_and_send_command(priv, CMD_802_11_PS_MODE,
-                                                   CMD_ACT_SET, 0, 0,
-                                                   &local_ps_mode);
-                if (ret) {
-                        ret = -1;
-                        goto out;
-                }
-        }
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_JOIN, &cmd);
-        if (ret == 0) {
-                ret = lbs_adhoc_post(priv,
-                                     (struct cmd_ds_802_11_ad_hoc_result *)&cmd);
-        }
-
-out:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief Start an Adhoc Network
- *
- *  @param priv         A pointer to struct lbs_private structure
- *  @param assoc_req    The association request describing the BSS to start
- *
- *  @return             0 on success, error on failure
- */
-static int lbs_adhoc_start(struct lbs_private *priv,
-        struct assoc_request *assoc_req)
-{
-        struct cmd_ds_802_11_ad_hoc_start cmd;
-        u8 preamble = RADIO_PREAMBLE_SHORT;
-        size_t ratesize = 0;
-        u16 tmpcap = 0;
-        int ret = 0;
-        DECLARE_SSID_BUF(ssid);
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        ret = lbs_set_radio(priv, preamble, 1);
-        if (ret)
-                goto out;
-
-        /* Build the start command */
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        memcpy(cmd.ssid, assoc_req->ssid, assoc_req->ssid_len);
-
-        lbs_deb_join("ADHOC_START: SSID '%s', ssid length %u\n",
-                print_ssid(ssid, assoc_req->ssid, assoc_req->ssid_len),
-                assoc_req->ssid_len);
-
-        cmd.bsstype = CMD_BSS_TYPE_IBSS;
-
-        if (priv->beacon_period == 0)
-                priv->beacon_period = MRVDRV_BEACON_INTERVAL;
-        cmd.beaconperiod = cpu_to_le16(priv->beacon_period);
-
-        WARN_ON(!assoc_req->channel);
-
-        /* set Physical parameter set */
-        cmd.ds.header.id = WLAN_EID_DS_PARAMS;
-        cmd.ds.header.len = 1;
-        cmd.ds.channel = assoc_req->channel;
-
-        /* set IBSS parameter set */
-        cmd.ibss.header.id = WLAN_EID_IBSS_PARAMS;
-        cmd.ibss.header.len = 2;
-        cmd.ibss.atimwindow = cpu_to_le16(0);
-
-        /* set capability info */
-        tmpcap = WLAN_CAPABILITY_IBSS;
-        if (assoc_req->secinfo.wep_enabled ||
-            assoc_req->secinfo.WPAenabled ||
-            assoc_req->secinfo.WPA2enabled) {
-                lbs_deb_join("ADHOC_START: WEP/WPA enabled, privacy on\n");
-                tmpcap |= WLAN_CAPABILITY_PRIVACY;
-        } else
-                lbs_deb_join("ADHOC_START: WEP disabled, privacy off\n");
-
-        cmd.capability = cpu_to_le16(tmpcap);
-
-        /* Only v8 and below support setting probe delay */
-        if (priv->fwrelease < 0x09000000)
-                cmd.probedelay = cpu_to_le16(CMD_SCAN_PROBE_DELAY_TIME);
-
-        ratesize = min(sizeof(cmd.rates), sizeof(lbs_bg_rates));
-        memcpy(cmd.rates, lbs_bg_rates, ratesize);
-
-        /* Copy the ad-hoc creating rates into Current BSS state structure */
-        memset(&priv->curbssparams.rates, 0, sizeof(priv->curbssparams.rates));
-        memcpy(&priv->curbssparams.rates, &cmd.rates, ratesize);
-
-        /* Set MSB on basic rates as the firmware requires, but _after_
-         * copying to current bss rates.
-         */
-        lbs_set_basic_rate_flags(cmd.rates, ratesize);
-
-        lbs_deb_join("ADHOC_START: rates=%02x %02x %02x %02x\n",
-               cmd.rates[0], cmd.rates[1], cmd.rates[2], cmd.rates[3]);
-
-        lbs_deb_join("ADHOC_START: Starting Ad-Hoc BSS on channel %d, band %d\n",
-                     assoc_req->channel, assoc_req->band);
-
-        priv->adhoccreate = 1;
-        priv->mode = IW_MODE_ADHOC;
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_START, &cmd);
-        if (ret == 0)
-                ret = lbs_adhoc_post(priv,
-                                     (struct cmd_ds_802_11_ad_hoc_result *)&cmd);
-
-out:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief Stop and Ad-Hoc network and exit Ad-Hoc mode
- *
- *  @param priv         A pointer to struct lbs_private structure
- *  @return             0 on success, or an error
- */
-int lbs_adhoc_stop(struct lbs_private *priv)
-{
-        struct cmd_ds_802_11_ad_hoc_stop cmd;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_JOIN);
-
-        memset(&cmd, 0, sizeof (cmd));
-        cmd.hdr.size = cpu_to_le16 (sizeof (cmd));
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_STOP, &cmd);
-
-        /* Clean up everything even if there was an error */
-        lbs_mac_event_disconnected(priv);
-
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-static inline int match_bss_no_security(struct lbs_802_11_security *secinfo,
-                                        struct bss_descriptor *match_bss)
-{
-        if (!secinfo->wep_enabled &&
-            !secinfo->WPAenabled && !secinfo->WPA2enabled &&
-            match_bss->wpa_ie[0] != WLAN_EID_GENERIC &&
-            match_bss->rsn_ie[0] != WLAN_EID_RSN &&
-            !(match_bss->capability & WLAN_CAPABILITY_PRIVACY))
-                return 1;
-        else
-                return 0;
-}
-
-static inline int match_bss_static_wep(struct lbs_802_11_security *secinfo,
-                                       struct bss_descriptor *match_bss)
-{
-        if (secinfo->wep_enabled &&
-            !secinfo->WPAenabled && !secinfo->WPA2enabled &&
-            (match_bss->capability & WLAN_CAPABILITY_PRIVACY))
-                return 1;
-        else
-                return 0;
-}
-
-static inline int match_bss_wpa(struct lbs_802_11_security *secinfo,
-                                struct bss_descriptor *match_bss)
-{
-        if (!secinfo->wep_enabled && secinfo->WPAenabled &&
-            (match_bss->wpa_ie[0] == WLAN_EID_GENERIC)
-            /* privacy bit may NOT be set in some APs like LinkSys WRT54G
-            && (match_bss->capability & WLAN_CAPABILITY_PRIVACY) */
-           )
-                return 1;
-        else
-                return 0;
-}
-
-static inline int match_bss_wpa2(struct lbs_802_11_security *secinfo,
-                                 struct bss_descriptor *match_bss)
-{
-        if (!secinfo->wep_enabled && secinfo->WPA2enabled &&
-            (match_bss->rsn_ie[0] == WLAN_EID_RSN)
-            /* privacy bit may NOT be set in some APs like LinkSys WRT54G
-            (match_bss->capability & WLAN_CAPABILITY_PRIVACY) */
-           )
-                return 1;
-        else
-                return 0;
-}
-
-static inline int match_bss_dynamic_wep(struct lbs_802_11_security *secinfo,
-                                        struct bss_descriptor *match_bss)
-{
-        if (!secinfo->wep_enabled &&
-            !secinfo->WPAenabled && !secinfo->WPA2enabled &&
-            (match_bss->wpa_ie[0] != WLAN_EID_GENERIC) &&
-            (match_bss->rsn_ie[0] != WLAN_EID_RSN) &&
-            (match_bss->capability & WLAN_CAPABILITY_PRIVACY))
-                return 1;
-        else
-                return 0;
-}
-
-/**
- *  @brief Check if a scanned network compatible with the driver settings
- *
- *   WEP     WPA     WPA2    ad-hoc  encrypt                      Network
- * enabled enabled  enabled   AES     mode   privacy  WPA  WPA2  Compatible
- *    0       0        0       0      NONE      0      0    0   yes No security
- *    1       0        0       0      NONE      1      0    0   yes Static WEP
- *    0       1        0       0       x        1x     1    x   yes WPA
- *    0       0        1       0       x        1x     x    1   yes WPA2
- *    0       0        0       1      NONE      1      0    0   yes Ad-hoc AES
- *    0       0        0       0     !=NONE     1      0    0   yes Dynamic WEP
- *
- *
- *  @param priv A pointer to struct lbs_private
- *  @param index   Index in scantable to check against current driver settings
- *  @param mode    Network mode: Infrastructure or IBSS
- *
- *  @return        Index in scantable, or error code if negative
- */
-static int is_network_compatible(struct lbs_private *priv,
-                                 struct bss_descriptor *bss, uint8_t mode)
-{
-        int matched = 0;
-
-        lbs_deb_enter(LBS_DEB_SCAN);
-
-        if (bss->mode != mode)
-                goto done;
-
-        matched = match_bss_no_security(&priv->secinfo, bss);
-        if (matched)
-                goto done;
-        matched = match_bss_static_wep(&priv->secinfo, bss);
-        if (matched)
-                goto done;
-        matched = match_bss_wpa(&priv->secinfo, bss);
-        if (matched) {
-                lbs_deb_scan("is_network_compatible() WPA: wpa_ie 0x%x "
-                             "wpa2_ie 0x%x WEP %s WPA %s WPA2 %s "
-                             "privacy 0x%x\n", bss->wpa_ie[0], bss->rsn_ie[0],
-                             priv->secinfo.wep_enabled ? "e" : "d",
-                             priv->secinfo.WPAenabled ? "e" : "d",
-                             priv->secinfo.WPA2enabled ? "e" : "d",
-                             (bss->capability & WLAN_CAPABILITY_PRIVACY));
-                goto done;
-        }
-        matched = match_bss_wpa2(&priv->secinfo, bss);
-        if (matched) {
-                lbs_deb_scan("is_network_compatible() WPA2: wpa_ie 0x%x "
-                             "wpa2_ie 0x%x WEP %s WPA %s WPA2 %s "
-                             "privacy 0x%x\n", bss->wpa_ie[0], bss->rsn_ie[0],
-                             priv->secinfo.wep_enabled ? "e" : "d",
-                             priv->secinfo.WPAenabled ? "e" : "d",
-                             priv->secinfo.WPA2enabled ? "e" : "d",
-                             (bss->capability & WLAN_CAPABILITY_PRIVACY));
-                goto done;
-        }
-        matched = match_bss_dynamic_wep(&priv->secinfo, bss);
-        if (matched) {
-                lbs_deb_scan("is_network_compatible() dynamic WEP: "
-                             "wpa_ie 0x%x wpa2_ie 0x%x privacy 0x%x\n",
-                             bss->wpa_ie[0], bss->rsn_ie[0],
-                             (bss->capability & WLAN_CAPABILITY_PRIVACY));
-                goto done;
-        }
-
-        /* bss security settings don't match those configured on card */
-        lbs_deb_scan("is_network_compatible() FAILED: wpa_ie 0x%x "
-                     "wpa2_ie 0x%x WEP %s WPA %s WPA2 %s privacy 0x%x\n",
-                     bss->wpa_ie[0], bss->rsn_ie[0],
-                     priv->secinfo.wep_enabled ? "e" : "d",
-                     priv->secinfo.WPAenabled ? "e" : "d",
-                     priv->secinfo.WPA2enabled ? "e" : "d",
-                     (bss->capability & WLAN_CAPABILITY_PRIVACY));
-
-done:
-        lbs_deb_leave_args(LBS_DEB_SCAN, "matched: %d", matched);
-        return matched;
-}
-
-/**
- *  @brief This function finds a specific compatible BSSID in the scan list
- *
- *  Used in association code
- *
- *  @param priv  A pointer to struct lbs_private
- *  @param bssid    BSSID to find in the scan list
- *  @param mode     Network mode: Infrastructure or IBSS
- *
- *  @return         index in BSSID list, or error return code (< 0)
- */
-static struct bss_descriptor *lbs_find_bssid_in_list(struct lbs_private *priv,
-                                              uint8_t *bssid, uint8_t mode)
-{
-        struct bss_descriptor *iter_bss;
-        struct bss_descriptor *found_bss = NULL;
-
-        lbs_deb_enter(LBS_DEB_SCAN);
-
-        if (!bssid)
-                goto out;
-
-        lbs_deb_hex(LBS_DEB_SCAN, "looking for", bssid, ETH_ALEN);
-
-        /* Look through the scan table for a compatible match.  The loop will
-         *   continue past a matched bssid that is not compatible in case there
-         *   is an AP with multiple SSIDs assigned to the same BSSID
-         */
-        mutex_lock(&priv->lock);
-        list_for_each_entry(iter_bss, &priv->network_list, list) {
-                if (compare_ether_addr(iter_bss->bssid, bssid))
-                        continue; /* bssid doesn't match */
-                switch (mode) {
-                case IW_MODE_INFRA:
-                case IW_MODE_ADHOC:
-                        if (!is_network_compatible(priv, iter_bss, mode))
-                                break;
-                        found_bss = iter_bss;
-                        break;
-                default:
-                        found_bss = iter_bss;
-                        break;
-                }
-        }
-        mutex_unlock(&priv->lock);
-
-out:
-        lbs_deb_leave_args(LBS_DEB_SCAN, "found_bss %p", found_bss);
-        return found_bss;
-}
-
-/**
- *  @brief This function finds ssid in ssid list.
- *
- *  Used in association code
- *
- *  @param priv  A pointer to struct lbs_private
- *  @param ssid     SSID to find in the list
- *  @param bssid    BSSID to qualify the SSID selection (if provided)
- *  @param mode     Network mode: Infrastructure or IBSS
- *
- *  @return         index in BSSID list
- */
-static struct bss_descriptor *lbs_find_ssid_in_list(struct lbs_private *priv,
-                                             uint8_t *ssid, uint8_t ssid_len,
-                                             uint8_t *bssid, uint8_t mode,
-                                             int channel)
-{
-        u32 bestrssi = 0;
-        struct bss_descriptor *iter_bss = NULL;
-        struct bss_descriptor *found_bss = NULL;
-        struct bss_descriptor *tmp_oldest = NULL;
-
-        lbs_deb_enter(LBS_DEB_SCAN);
-
-        mutex_lock(&priv->lock);
-
-        list_for_each_entry(iter_bss, &priv->network_list, list) {
-                if (!tmp_oldest ||
-                    (iter_bss->last_scanned < tmp_oldest->last_scanned))
-                        tmp_oldest = iter_bss;
-
-                if (lbs_ssid_cmp(iter_bss->ssid, iter_bss->ssid_len,
-                                 ssid, ssid_len) != 0)
-                        continue; /* ssid doesn't match */
-                if (bssid && compare_ether_addr(iter_bss->bssid, bssid) != 0)
-                        continue; /* bssid doesn't match */
-                if ((channel > 0) && (iter_bss->channel != channel))
-                        continue; /* channel doesn't match */
-
-                switch (mode) {
-                case IW_MODE_INFRA:
-                case IW_MODE_ADHOC:
-                        if (!is_network_compatible(priv, iter_bss, mode))
-                                break;
-
-                        if (bssid) {
-                                /* Found requested BSSID */
-                                found_bss = iter_bss;
-                                goto out;
-                        }
-
-                        if (SCAN_RSSI(iter_bss->rssi) > bestrssi) {
-                                bestrssi = SCAN_RSSI(iter_bss->rssi);
-                                found_bss = iter_bss;
-                        }
-                        break;
-                case IW_MODE_AUTO:
-                default:
-                        if (SCAN_RSSI(iter_bss->rssi) > bestrssi) {
-                                bestrssi = SCAN_RSSI(iter_bss->rssi);
-                                found_bss = iter_bss;
-                        }
-                        break;
-                }
-        }
-
-out:
-        mutex_unlock(&priv->lock);
-        lbs_deb_leave_args(LBS_DEB_SCAN, "found_bss %p", found_bss);
-        return found_bss;
-}
-
-static int assoc_helper_essid(struct lbs_private *priv,
-                              struct assoc_request * assoc_req)
-{
-        int ret = 0;
-        struct bss_descriptor * bss;
-        int channel = -1;
-        DECLARE_SSID_BUF(ssid);
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        /* FIXME: take channel into account when picking SSIDs if a channel
-         * is set.
-         */
-
-        if (test_bit(ASSOC_FLAG_CHANNEL, &assoc_req->flags))
-                channel = assoc_req->channel;
-
-        lbs_deb_assoc("SSID '%s' requested\n",
-                      print_ssid(ssid, assoc_req->ssid, assoc_req->ssid_len));
-        if (assoc_req->mode == IW_MODE_INFRA) {
-                lbs_send_specific_ssid_scan(priv, assoc_req->ssid,
-                        assoc_req->ssid_len);
-
-                bss = lbs_find_ssid_in_list(priv, assoc_req->ssid,
-                                assoc_req->ssid_len, NULL, IW_MODE_INFRA, channel);
-                if (bss != NULL) {
-                        memcpy(&assoc_req->bss, bss, sizeof(struct bss_descriptor));
-                        ret = lbs_try_associate(priv, assoc_req);
-                } else {
-                        lbs_deb_assoc("SSID not found; cannot associate\n");
-                }
-        } else if (assoc_req->mode == IW_MODE_ADHOC) {
-                /* Scan for the network, do not save previous results.  Stale
-                 *   scan data will cause us to join a non-existant adhoc network
-                 */
-                lbs_send_specific_ssid_scan(priv, assoc_req->ssid,
-                        assoc_req->ssid_len);
-
-                /* Search for the requested SSID in the scan table */
-                bss = lbs_find_ssid_in_list(priv, assoc_req->ssid,
-                                assoc_req->ssid_len, NULL, IW_MODE_ADHOC, channel);
-                if (bss != NULL) {
-                        lbs_deb_assoc("SSID found, will join\n");
-                        memcpy(&assoc_req->bss, bss, sizeof(struct bss_descriptor));
-                        lbs_adhoc_join(priv, assoc_req);
-                } else {
-                        /* else send START command */
-                        lbs_deb_assoc("SSID not found, creating adhoc network\n");
-                        memcpy(&assoc_req->bss.ssid, &assoc_req->ssid,
-                                IEEE80211_MAX_SSID_LEN);
-                        assoc_req->bss.ssid_len = assoc_req->ssid_len;
-                        lbs_adhoc_start(priv, assoc_req);
-                }
-        }
-
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-
-static int assoc_helper_bssid(struct lbs_private *priv,
-                              struct assoc_request * assoc_req)
-{
-        int ret = 0;
-        struct bss_descriptor * bss;
-
-        lbs_deb_enter_args(LBS_DEB_ASSOC, "BSSID %pM", assoc_req->bssid);
-
-        /* Search for index position in list for requested MAC */
-        bss = lbs_find_bssid_in_list(priv, assoc_req->bssid,
-                            assoc_req->mode);
-        if (bss == NULL) {
-                lbs_deb_assoc("ASSOC: WAP: BSSID %pM not found, "
-                        "cannot associate.\n", assoc_req->bssid);
-                goto out;
-        }
-
-        memcpy(&assoc_req->bss, bss, sizeof(struct bss_descriptor));
-        if (assoc_req->mode == IW_MODE_INFRA) {
-                ret = lbs_try_associate(priv, assoc_req);
-                lbs_deb_assoc("ASSOC: lbs_try_associate(bssid) returned %d\n",
-                              ret);
-        } else if (assoc_req->mode == IW_MODE_ADHOC) {
-                lbs_adhoc_join(priv, assoc_req);
-        }
-
-out:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-
-static int assoc_helper_associate(struct lbs_private *priv,
-                                  struct assoc_request * assoc_req)
-{
-        int ret = 0, done = 0;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        /* If we're given and 'any' BSSID, try associating based on SSID */
-
-        if (test_bit(ASSOC_FLAG_BSSID, &assoc_req->flags)) {
-                if (compare_ether_addr(bssid_any, assoc_req->bssid) &&
-                    compare_ether_addr(bssid_off, assoc_req->bssid)) {
-                        ret = assoc_helper_bssid(priv, assoc_req);
-                        done = 1;
-                }
-        }
-
-        if (!done && test_bit(ASSOC_FLAG_SSID, &assoc_req->flags)) {
-                ret = assoc_helper_essid(priv, assoc_req);
-        }
-
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-
-static int assoc_helper_mode(struct lbs_private *priv,
-                             struct assoc_request * assoc_req)
-{
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        if (assoc_req->mode == priv->mode)
-                goto done;
-
-        if (assoc_req->mode == IW_MODE_INFRA) {
-                if (priv->psstate != PS_STATE_FULL_POWER)
-                        lbs_ps_wakeup(priv, CMD_OPTION_WAITFORRSP);
-                priv->psmode = LBS802_11POWERMODECAM;
-        }
-
-        priv->mode = assoc_req->mode;
-        ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE,
-                assoc_req->mode == IW_MODE_ADHOC ? 2 : 1);
-
-done:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-static int assoc_helper_channel(struct lbs_private *priv,
-                                struct assoc_request * assoc_req)
-{
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        ret = lbs_update_channel(priv);
-        if (ret) {
-                lbs_deb_assoc("ASSOC: channel: error getting channel.\n");
-                goto done;
-        }
-
-        if (assoc_req->channel == priv->channel)
-                goto done;
-
-        if (priv->mesh_dev) {
-                /* Change mesh channel first; 21.p21 firmware won't let
-                   you change channel otherwise (even though it'll return
-                   an error to this */
-                lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_STOP,
-                                assoc_req->channel);
-        }
-
-        lbs_deb_assoc("ASSOC: channel: %d -> %d\n",
-                      priv->channel, assoc_req->channel);
-
-        ret = lbs_set_channel(priv, assoc_req->channel);
-        if (ret < 0)
-                lbs_deb_assoc("ASSOC: channel: error setting channel.\n");
-
-        /* FIXME: shouldn't need to grab the channel _again_ after setting
-         * it since the firmware is supposed to return the new channel, but
-         * whatever... */
-        ret = lbs_update_channel(priv);
-        if (ret) {
-                lbs_deb_assoc("ASSOC: channel: error getting channel.\n");
-                goto done;
-        }
-
-        if (assoc_req->channel != priv->channel) {
-                lbs_deb_assoc("ASSOC: channel: failed to update channel to %d\n",
-                              assoc_req->channel);
-                goto restore_mesh;
-        }
-
-        if (assoc_req->secinfo.wep_enabled &&
-            (assoc_req->wep_keys[0].len || assoc_req->wep_keys[1].len ||
-             assoc_req->wep_keys[2].len || assoc_req->wep_keys[3].len)) {
-                /* Make sure WEP keys are re-sent to firmware */
-                set_bit(ASSOC_FLAG_WEP_KEYS, &assoc_req->flags);
-        }
-
-        /* Must restart/rejoin adhoc networks after channel change */
-        set_bit(ASSOC_FLAG_SSID, &assoc_req->flags);
-
- restore_mesh:
-        if (priv->mesh_dev)
-                lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
-                                priv->channel);
-
- done:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-
-static int assoc_helper_wep_keys(struct lbs_private *priv,
-                                 struct assoc_request *assoc_req)
-{
-        int i;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        /* Set or remove WEP keys */
-        if (assoc_req->wep_keys[0].len || assoc_req->wep_keys[1].len ||
-            assoc_req->wep_keys[2].len || assoc_req->wep_keys[3].len)
-                ret = lbs_cmd_802_11_set_wep(priv, CMD_ACT_ADD, assoc_req);
-        else
-                ret = lbs_cmd_802_11_set_wep(priv, CMD_ACT_REMOVE, assoc_req);
-
-        if (ret)
-                goto out;
-
-        /* enable/disable the MAC's WEP packet filter */
-        if (assoc_req->secinfo.wep_enabled)
-                priv->mac_control |= CMD_ACT_MAC_WEP_ENABLE;
-        else
-                priv->mac_control &= ~CMD_ACT_MAC_WEP_ENABLE;
-
-        lbs_set_mac_control(priv);
-
-        mutex_lock(&priv->lock);
-
-        /* Copy WEP keys into priv wep key fields */
-        for (i = 0; i < 4; i++) {
-                memcpy(&priv->wep_keys[i], &assoc_req->wep_keys[i],
-                       sizeof(struct enc_key));
-        }
-        priv->wep_tx_keyidx = assoc_req->wep_tx_keyidx;
-
-        mutex_unlock(&priv->lock);
-
-out:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-static int assoc_helper_secinfo(struct lbs_private *priv,
-                                struct assoc_request * assoc_req)
-{
-        int ret = 0;
-        uint16_t do_wpa;
-        uint16_t rsn = 0;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        memcpy(&priv->secinfo, &assoc_req->secinfo,
-                sizeof(struct lbs_802_11_security));
-
-        lbs_set_mac_control(priv);
-
-        /* If RSN is already enabled, don't try to enable it again, since
-         * ENABLE_RSN resets internal state machines and will clobber the
-         * 4-way WPA handshake.
-         */
-
-        /* Get RSN enabled/disabled */
-        ret = lbs_cmd_802_11_enable_rsn(priv, CMD_ACT_GET, &rsn);
-        if (ret) {
-                lbs_deb_assoc("Failed to get RSN status: %d\n", ret);
-                goto out;
-        }
-
-        /* Don't re-enable RSN if it's already enabled */
-        do_wpa = assoc_req->secinfo.WPAenabled || assoc_req->secinfo.WPA2enabled;
-        if (do_wpa == rsn)
-                goto out;
-
-        /* Set RSN enabled/disabled */
-        ret = lbs_cmd_802_11_enable_rsn(priv, CMD_ACT_SET, &do_wpa);
-
-out:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-
-static int assoc_helper_wpa_keys(struct lbs_private *priv,
-                                 struct assoc_request * assoc_req)
-{
-        int ret = 0;
-        unsigned int flags = assoc_req->flags;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        /* Work around older firmware bug where WPA unicast and multicast
-         * keys must be set independently.  Seen in SDIO parts with firmware
-         * version 5.0.11p0.
-         */
-
-        if (test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc_req->flags)) {
-                clear_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc_req->flags);
-                ret = lbs_cmd_802_11_key_material(priv, CMD_ACT_SET, assoc_req);
-                assoc_req->flags = flags;
-        }
-
-        if (ret)
-                goto out;
-
-        memcpy(&priv->wpa_unicast_key, &assoc_req->wpa_unicast_key,
-                        sizeof(struct enc_key));
-
-        if (test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc_req->flags)) {
-                clear_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc_req->flags);
-
-                ret = lbs_cmd_802_11_key_material(priv, CMD_ACT_SET, assoc_req);
-                assoc_req->flags = flags;
-
-                memcpy(&priv->wpa_mcast_key, &assoc_req->wpa_mcast_key,
-                                sizeof(struct enc_key));
-        }
-
-out:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-
-static int assoc_helper_wpa_ie(struct lbs_private *priv,
-                               struct assoc_request * assoc_req)
-{
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        if (assoc_req->secinfo.WPAenabled || assoc_req->secinfo.WPA2enabled) {
-                memcpy(&priv->wpa_ie, &assoc_req->wpa_ie, assoc_req->wpa_ie_len);
-                priv->wpa_ie_len = assoc_req->wpa_ie_len;
-        } else {
-                memset(&priv->wpa_ie, 0, MAX_WPA_IE_LEN);
-                priv->wpa_ie_len = 0;
-        }
-
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-
-static int should_deauth_infrastructure(struct lbs_private *priv,
-                                        struct assoc_request * assoc_req)
-{
-        int ret = 0;
-
-        if (priv->connect_status != LBS_CONNECTED)
-                return 0;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-        if (test_bit(ASSOC_FLAG_SSID, &assoc_req->flags)) {
-                lbs_deb_assoc("Deauthenticating due to new SSID\n");
-                ret = 1;
-                goto out;
-        }
-
-        if (test_bit(ASSOC_FLAG_SECINFO, &assoc_req->flags)) {
-                if (priv->secinfo.auth_mode != assoc_req->secinfo.auth_mode) {
-                        lbs_deb_assoc("Deauthenticating due to new security\n");
-                        ret = 1;
-                        goto out;
-                }
-        }
-
-        if (test_bit(ASSOC_FLAG_BSSID, &assoc_req->flags)) {
-                lbs_deb_assoc("Deauthenticating due to new BSSID\n");
-                ret = 1;
-                goto out;
-        }
-
-        if (test_bit(ASSOC_FLAG_CHANNEL, &assoc_req->flags)) {
-                lbs_deb_assoc("Deauthenticating due to channel switch\n");
-                ret = 1;
-                goto out;
-        }
-
-        /* FIXME: deal with 'auto' mode somehow */
-        if (test_bit(ASSOC_FLAG_MODE, &assoc_req->flags)) {
-                if (assoc_req->mode != IW_MODE_INFRA) {
-                        lbs_deb_assoc("Deauthenticating due to leaving "
-                                "infra mode\n");
-                        ret = 1;
-                        goto out;
-                }
-        }
-
-out:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-
-static int should_stop_adhoc(struct lbs_private *priv,
-                             struct assoc_request * assoc_req)
-{
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        if (priv->connect_status != LBS_CONNECTED)
-                return 0;
-
-        if (lbs_ssid_cmp(priv->curbssparams.ssid,
-                              priv->curbssparams.ssid_len,
-                              assoc_req->ssid, assoc_req->ssid_len) != 0)
-                return 1;
-
-        /* FIXME: deal with 'auto' mode somehow */
-        if (test_bit(ASSOC_FLAG_MODE, &assoc_req->flags)) {
-                if (assoc_req->mode != IW_MODE_ADHOC)
-                        return 1;
-        }
-
-        if (test_bit(ASSOC_FLAG_CHANNEL, &assoc_req->flags)) {
-                if (assoc_req->channel != priv->channel)
-                        return 1;
-        }
-
-        lbs_deb_leave(LBS_DEB_ASSOC);
-        return 0;
-}
-
-
-/**
- *  @brief This function finds the best SSID in the Scan List
- *
- *  Search the scan table for the best SSID that also matches the current
- *   adapter network preference (infrastructure or adhoc)
- *
- *  @param priv  A pointer to struct lbs_private
- *
- *  @return         index in BSSID list
- */
-static struct bss_descriptor *lbs_find_best_ssid_in_list(
-        struct lbs_private *priv, uint8_t mode)
-{
-        uint8_t bestrssi = 0;
-        struct bss_descriptor *iter_bss;
-        struct bss_descriptor *best_bss = NULL;
-
-        lbs_deb_enter(LBS_DEB_SCAN);
-
-        mutex_lock(&priv->lock);
-
-        list_for_each_entry(iter_bss, &priv->network_list, list) {
-                switch (mode) {
-                case IW_MODE_INFRA:
-                case IW_MODE_ADHOC:
-                        if (!is_network_compatible(priv, iter_bss, mode))
-                                break;
-                        if (SCAN_RSSI(iter_bss->rssi) <= bestrssi)
-                                break;
-                        bestrssi = SCAN_RSSI(iter_bss->rssi);
-                        best_bss = iter_bss;
-                        break;
-                case IW_MODE_AUTO:
-                default:
-                        if (SCAN_RSSI(iter_bss->rssi) <= bestrssi)
-                                break;
-                        bestrssi = SCAN_RSSI(iter_bss->rssi);
-                        best_bss = iter_bss;
-                        break;
-                }
-        }
-
-        mutex_unlock(&priv->lock);
-        lbs_deb_leave_args(LBS_DEB_SCAN, "best_bss %p", best_bss);
-        return best_bss;
-}
-
-/**
- *  @brief Find the best AP
- *
- *  Used from association worker.
- *
- *  @param priv         A pointer to struct lbs_private structure
- *  @param pSSID        A pointer to AP's ssid
- *
- *  @return             0--success, otherwise--fail
- */
-static int lbs_find_best_network_ssid(struct lbs_private *priv,
-        uint8_t *out_ssid, uint8_t *out_ssid_len, uint8_t preferred_mode,
-        uint8_t *out_mode)
-{
-        int ret = -1;
-        struct bss_descriptor *found;
-
-        lbs_deb_enter(LBS_DEB_SCAN);
-
-        priv->scan_ssid_len = 0;
-        lbs_scan_networks(priv, 1);
-        if (priv->surpriseremoved)
-                goto out;
-
-        found = lbs_find_best_ssid_in_list(priv, preferred_mode);
-        if (found && (found->ssid_len > 0)) {
-                memcpy(out_ssid, &found->ssid, IEEE80211_MAX_SSID_LEN);
-                *out_ssid_len = found->ssid_len;
-                *out_mode = found->mode;
-                ret = 0;
-        }
-
-out:
-        lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
-        return ret;
-}
-
-
-void lbs_association_worker(struct work_struct *work)
-{
-        struct lbs_private *priv = container_of(work, struct lbs_private,
-                assoc_work.work);
-        struct assoc_request * assoc_req = NULL;
-        int ret = 0;
-        int find_any_ssid = 0;
-        DECLARE_SSID_BUF(ssid);
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        mutex_lock(&priv->lock);
-        assoc_req = priv->pending_assoc_req;
-        priv->pending_assoc_req = NULL;
-        priv->in_progress_assoc_req = assoc_req;
-        mutex_unlock(&priv->lock);
-
-        if (!assoc_req)
-                goto done;
-
-        lbs_deb_assoc(
-                "Association Request:\n"
-                "    flags:     0x%08lx\n"
-                "    SSID:      '%s'\n"
-                "    chann:     %d\n"
-                "    band:      %d\n"
-                "    mode:      %d\n"
-                "    BSSID:     %pM\n"
-                "    secinfo:  %s%s%s\n"
-                "    auth_mode: %d\n",
-                assoc_req->flags,
-                print_ssid(ssid, assoc_req->ssid, assoc_req->ssid_len),
-                assoc_req->channel, assoc_req->band, assoc_req->mode,
-                assoc_req->bssid,
-                assoc_req->secinfo.WPAenabled ? " WPA" : "",
-                assoc_req->secinfo.WPA2enabled ? " WPA2" : "",
-                assoc_req->secinfo.wep_enabled ? " WEP" : "",
-                assoc_req->secinfo.auth_mode);
-
-        /* If 'any' SSID was specified, find an SSID to associate with */
-        if (test_bit(ASSOC_FLAG_SSID, &assoc_req->flags) &&
-            !assoc_req->ssid_len)
-                find_any_ssid = 1;
-
-        /* But don't use 'any' SSID if there's a valid locked BSSID to use */
-        if (test_bit(ASSOC_FLAG_BSSID, &assoc_req->flags)) {
-                if (compare_ether_addr(assoc_req->bssid, bssid_any) &&
-                    compare_ether_addr(assoc_req->bssid, bssid_off))
-                        find_any_ssid = 0;
-        }
-
-        if (find_any_ssid) {
-                u8 new_mode = assoc_req->mode;
-
-                ret = lbs_find_best_network_ssid(priv, assoc_req->ssid,
-                                &assoc_req->ssid_len, assoc_req->mode, &new_mode);
-                if (ret) {
-                        lbs_deb_assoc("Could not find best network\n");
-                        ret = -ENETUNREACH;
-                        goto out;
-                }
-
-                /* Ensure we switch to the mode of the AP */
-                if (assoc_req->mode == IW_MODE_AUTO) {
-                        set_bit(ASSOC_FLAG_MODE, &assoc_req->flags);
-                        assoc_req->mode = new_mode;
-                }
-        }
-
-        /*
-         * Check if the attributes being changing require deauthentication
-         * from the currently associated infrastructure access point.
-         */
-        if (priv->mode == IW_MODE_INFRA) {
-                if (should_deauth_infrastructure(priv, assoc_req)) {
-                        ret = lbs_cmd_80211_deauthenticate(priv,
-                                                           priv->curbssparams.bssid,
-                                                           WLAN_REASON_DEAUTH_LEAVING);
-                        if (ret) {
-                                lbs_deb_assoc("Deauthentication due to new "
-                                        "configuration request failed: %d\n",
-                                        ret);
-                        }
-                }
-        } else if (priv->mode == IW_MODE_ADHOC) {
-                if (should_stop_adhoc(priv, assoc_req)) {
-                        ret = lbs_adhoc_stop(priv);
-                        if (ret) {
-                                lbs_deb_assoc("Teardown of AdHoc network due to "
-                                        "new configuration request failed: %d\n",
-                                        ret);
-                        }
-
-                }
-        }
-
-        /* Send the various configuration bits to the firmware */
-        if (test_bit(ASSOC_FLAG_MODE, &assoc_req->flags)) {
-                ret = assoc_helper_mode(priv, assoc_req);
-                if (ret)
-                        goto out;
-        }
-
-        if (test_bit(ASSOC_FLAG_CHANNEL, &assoc_req->flags)) {
-                ret = assoc_helper_channel(priv, assoc_req);
-                if (ret)
-                        goto out;
-        }
-
-        if (test_bit(ASSOC_FLAG_SECINFO, &assoc_req->flags)) {
-                ret = assoc_helper_secinfo(priv, assoc_req);
-                if (ret)
-                        goto out;
-        }
-
-        if (test_bit(ASSOC_FLAG_WPA_IE, &assoc_req->flags)) {
-                ret = assoc_helper_wpa_ie(priv, assoc_req);
-                if (ret)
-                        goto out;
-        }
-
-        /*
-         * v10 FW wants WPA keys to be set/cleared before WEP key operations,
-         * otherwise it will fail to correctly associate to WEP networks.
-         * Other firmware versions don't appear to care.
-         */
-        if (test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc_req->flags) ||
-            test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc_req->flags)) {
-                ret = assoc_helper_wpa_keys(priv, assoc_req);
-                if (ret)
-                        goto out;
-        }
-
-        if (test_bit(ASSOC_FLAG_WEP_KEYS, &assoc_req->flags) ||
-            test_bit(ASSOC_FLAG_WEP_TX_KEYIDX, &assoc_req->flags)) {
-                ret = assoc_helper_wep_keys(priv, assoc_req);
-                if (ret)
-                        goto out;
-        }
-
-
-        /* SSID/BSSID should be the _last_ config option set, because they
-         * trigger the association attempt.
-         */
-        if (test_bit(ASSOC_FLAG_BSSID, &assoc_req->flags) ||
-            test_bit(ASSOC_FLAG_SSID, &assoc_req->flags)) {
-                int success = 1;
-
-                ret = assoc_helper_associate(priv, assoc_req);
-                if (ret) {
-                        lbs_deb_assoc("ASSOC: association unsuccessful: %d\n",
-                                ret);
-                        success = 0;
-                }
-
-                if (priv->connect_status != LBS_CONNECTED) {
-                        lbs_deb_assoc("ASSOC: association unsuccessful, "
-                                "not connected\n");
-                        success = 0;
-                }
-
-                if (success) {
-                        lbs_deb_assoc("associated to %pM\n",
-                                priv->curbssparams.bssid);
-                        lbs_prepare_and_send_command(priv,
-                                CMD_802_11_RSSI,
-                                0, CMD_OPTION_WAITFORRSP, 0, NULL);
-                } else {
-                        ret = -1;
-                }
-        }
-
-out:
-        if (ret) {
-                lbs_deb_assoc("ASSOC: reconfiguration attempt unsuccessful: %d\n",
-                        ret);
-        }
-
-        mutex_lock(&priv->lock);
-        priv->in_progress_assoc_req = NULL;
-        mutex_unlock(&priv->lock);
-        kfree(assoc_req);
-
-done:
-        lbs_deb_leave(LBS_DEB_ASSOC);
-}
-
-
-/*
- * Caller MUST hold any necessary locks
- */
-struct assoc_request *lbs_get_association_request(struct lbs_private *priv)
-{
-        struct assoc_request * assoc_req;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-        if (!priv->pending_assoc_req) {
-                priv->pending_assoc_req = kzalloc(sizeof(struct assoc_request),
-                                                     GFP_KERNEL);
-                if (!priv->pending_assoc_req) {
-                        lbs_pr_info("Not enough memory to allocate association"
-                                " request!\n");
-                        return NULL;
-                }
-        }
-
-        /* Copy current configuration attributes to the association request,
-         * but don't overwrite any that are already set.
-         */
-        assoc_req = priv->pending_assoc_req;
-        if (!test_bit(ASSOC_FLAG_SSID, &assoc_req->flags)) {
-                memcpy(&assoc_req->ssid, &priv->curbssparams.ssid,
-                       IEEE80211_MAX_SSID_LEN);
-                assoc_req->ssid_len = priv->curbssparams.ssid_len;
-        }
-
-        if (!test_bit(ASSOC_FLAG_CHANNEL, &assoc_req->flags))
-                assoc_req->channel = priv->channel;
-
-        if (!test_bit(ASSOC_FLAG_BAND, &assoc_req->flags))
-                assoc_req->band = priv->curbssparams.band;
-
-        if (!test_bit(ASSOC_FLAG_MODE, &assoc_req->flags))
-                assoc_req->mode = priv->mode;
-
-        if (!test_bit(ASSOC_FLAG_BSSID, &assoc_req->flags)) {
-                memcpy(&assoc_req->bssid, priv->curbssparams.bssid,
-                        ETH_ALEN);
-        }
-
-        if (!test_bit(ASSOC_FLAG_WEP_KEYS, &assoc_req->flags)) {
-                int i;
-                for (i = 0; i < 4; i++) {
-                        memcpy(&assoc_req->wep_keys[i], &priv->wep_keys[i],
-                                sizeof(struct enc_key));
-                }
-        }
-
-        if (!test_bit(ASSOC_FLAG_WEP_TX_KEYIDX, &assoc_req->flags))
-                assoc_req->wep_tx_keyidx = priv->wep_tx_keyidx;
-
-        if (!test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc_req->flags)) {
-                memcpy(&assoc_req->wpa_mcast_key, &priv->wpa_mcast_key,
-                        sizeof(struct enc_key));
-        }
-
-        if (!test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc_req->flags)) {
-                memcpy(&assoc_req->wpa_unicast_key, &priv->wpa_unicast_key,
-                        sizeof(struct enc_key));
-        }
-
-        if (!test_bit(ASSOC_FLAG_SECINFO, &assoc_req->flags)) {
-                memcpy(&assoc_req->secinfo, &priv->secinfo,
-                        sizeof(struct lbs_802_11_security));
-        }
-
-        if (!test_bit(ASSOC_FLAG_WPA_IE, &assoc_req->flags)) {
-                memcpy(&assoc_req->wpa_ie, &priv->wpa_ie,
-                        MAX_WPA_IE_LEN);
-                assoc_req->wpa_ie_len = priv->wpa_ie_len;
-        }
-
-        lbs_deb_leave(LBS_DEB_ASSOC);
-        return assoc_req;
-}
-
-
-/**
- *  @brief Deauthenticate from a specific BSS
- *
- *  @param priv        A pointer to struct lbs_private structure
- *  @param bssid       The specific BSS to deauthenticate from
- *  @param reason      The 802.11 sec. 7.3.1.7 Reason Code for deauthenticating
- *
- *  @return            0 on success, error on failure
- */
-int lbs_cmd_80211_deauthenticate(struct lbs_private *priv, u8 bssid[ETH_ALEN],
-                                 u16 reason)
-{
-        struct cmd_ds_802_11_deauthenticate cmd;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_JOIN);
-
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-        memcpy(cmd.macaddr, &bssid[0], ETH_ALEN);
-        cmd.reasoncode = cpu_to_le16(reason);
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_DEAUTHENTICATE, &cmd);
-
-        /* Clean up everything even if there was an error; can't assume that
-         * we're still authenticated to the AP after trying to deauth.
-         */
-        lbs_mac_event_disconnected(priv);
-
-        lbs_deb_leave(LBS_DEB_JOIN);
-        return ret;
-}
-
diff --git a/drivers/net/wireless/libertas/assoc.h b/drivers/net/wireless/libertas/assoc.h
deleted file mode 100644
index 40621b789fc5..000000000000
--- a/drivers/net/wireless/libertas/assoc.h
+++ /dev/null
@@ -1,155 +0,0 @@
-/* Copyright (C) 2006, Red Hat, Inc. */
-
-#ifndef _LBS_ASSOC_H_
-#define _LBS_ASSOC_H_
-
-
-#include "defs.h"
-#include "host.h"
-
-
-struct lbs_private;
-
-/*
- * In theory, the IE is limited to the IE length, 255,
- * but in practice 64 bytes are enough.
- */
-#define MAX_WPA_IE_LEN 64
-
-
-
-struct lbs_802_11_security {
-        u8 WPAenabled;
-        u8 WPA2enabled;
-        u8 wep_enabled;
-        u8 auth_mode;
-        u32 key_mgmt;
-};
-
-/** Current Basic Service Set State Structure */
-struct current_bss_params {
-        /** bssid */
-        u8 bssid[ETH_ALEN];
-        /** ssid */
-        u8 ssid[IEEE80211_MAX_SSID_LEN + 1];
-        u8 ssid_len;
-
-        /** band */
-        u8 band;
-        /** channel is directly in priv->channel */
-        /** zero-terminated array of supported data rates */
-        u8 rates[MAX_RATES + 1];
-};
-
-/**
- *  @brief Structure used to store information for each beacon/probe response
- */
-struct bss_descriptor {
-        u8 bssid[ETH_ALEN];
-
-        u8 ssid[IEEE80211_MAX_SSID_LEN + 1];
-        u8 ssid_len;
-
-        u16 capability;
-        u32 rssi;
-        u32 channel;
-        u16 beaconperiod;
-        __le16 atimwindow;
-
-        /* IW_MODE_AUTO, IW_MODE_ADHOC, IW_MODE_INFRA */
-        u8 mode;
-
-        /* zero-terminated array of supported data rates */
-        u8 rates[MAX_RATES + 1];
-
-        unsigned long last_scanned;
-
-        union ieee_phy_param_set phy;
-        union ieee_ss_param_set ss;
-
-        u8 wpa_ie[MAX_WPA_IE_LEN];
-        size_t wpa_ie_len;
-        u8 rsn_ie[MAX_WPA_IE_LEN];
-        size_t rsn_ie_len;
-
-        u8 mesh;
-
-        struct list_head list;
-};
-
-/** Association request
- *
- * Encapsulates all the options that describe a specific assocation request
- * or configuration of the wireless card's radio, mode, and security settings.
- */
-struct assoc_request {
-#define ASSOC_FLAG_SSID                 1
-#define ASSOC_FLAG_CHANNEL              2
-#define ASSOC_FLAG_BAND                 3
-#define ASSOC_FLAG_MODE                 4
-#define ASSOC_FLAG_BSSID                5
-#define ASSOC_FLAG_WEP_KEYS             6
-#define ASSOC_FLAG_WEP_TX_KEYIDX        7
-#define ASSOC_FLAG_WPA_MCAST_KEY        8
-#define ASSOC_FLAG_WPA_UCAST_KEY        9
-#define ASSOC_FLAG_SECINFO              10
-#define ASSOC_FLAG_WPA_IE               11
-        unsigned long flags;
-
-        u8 ssid[IEEE80211_MAX_SSID_LEN + 1];
-        u8 ssid_len;
-        u8 channel;
-        u8 band;
-        u8 mode;
-        u8 bssid[ETH_ALEN] __attribute__ ((aligned (2)));
-
-        /** WEP keys */
-        struct enc_key wep_keys[4];
-        u16 wep_tx_keyidx;
-
-        /** WPA keys */
-        struct enc_key wpa_mcast_key;
-        struct enc_key wpa_unicast_key;
-
-        struct lbs_802_11_security secinfo;
-
-        /** WPA Information Elements*/
-        u8 wpa_ie[MAX_WPA_IE_LEN];
-        u8 wpa_ie_len;
-
-        /* BSS to associate with for infrastructure of Ad-Hoc join */
-        struct bss_descriptor bss;
-};
-
-
-extern u8 lbs_bg_rates[MAX_RATES];
-
-void lbs_association_worker(struct work_struct *work);
-struct assoc_request *lbs_get_association_request(struct lbs_private *priv);
-
-int lbs_adhoc_stop(struct lbs_private *priv);
-
-int lbs_cmd_80211_deauthenticate(struct lbs_private *priv,
-                                 u8 bssid[ETH_ALEN], u16 reason);
-
-int lbs_cmd_802_11_rssi(struct lbs_private *priv,
-                                struct cmd_ds_command *cmd);
-int lbs_ret_802_11_rssi(struct lbs_private *priv,
-                                struct cmd_ds_command *resp);
-
-int lbs_cmd_bcn_ctrl(struct lbs_private *priv,
-                                struct cmd_ds_command *cmd,
-                                u16 cmd_action);
-int lbs_ret_802_11_bcn_ctrl(struct lbs_private *priv,
-                                        struct cmd_ds_command *resp);
-
-int lbs_cmd_802_11_set_wep(struct lbs_private *priv, uint16_t cmd_action,
-                           struct assoc_request *assoc);
-
-int lbs_cmd_802_11_enable_rsn(struct lbs_private *priv, uint16_t cmd_action,
-                              uint16_t *enable);
-
-int lbs_cmd_802_11_key_material(struct lbs_private *priv, uint16_t cmd_action,
-                                struct assoc_request *assoc);
-
-#endif /* _LBS_ASSOC_H */
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 9d5d3ccf08c8..f36cc970ad1b 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -7,8 +7,12 @@
  */
 
 #include <linux/slab.h>
+#include <linux/if_arp.h>
+#include <linux/ieee80211.h>
 #include <net/cfg80211.h>
+#include <asm/unaligned.h>
 
+#include "decl.h"
 #include "cfg.h"
 #include "cmd.h"
 
@@ -39,26 +43,27 @@ static struct ieee80211_channel lbs_2ghz_channels[] = {
         CHAN2G(14, 2484, 0),
 };
 
-#define RATETAB_ENT(_rate, _rateid, _flags) { \
-        .bitrate  = (_rate),                  \
-        .hw_value = (_rateid),                \
-        .flags    = (_flags),                 \
+#define RATETAB_ENT(_rate, _hw_value, _flags) { \
+        .bitrate  = (_rate),                    \
+        .hw_value = (_hw_value),                \
+        .flags    = (_flags),                   \
 }
 
 
+/* Table 6 in section 3.2.1.1 */
 static struct ieee80211_rate lbs_rates[] = {
-        RATETAB_ENT(10,  0x1,   0),
-        RATETAB_ENT(20,  0x2,   0),
-        RATETAB_ENT(55,  0x4,   0),
-        RATETAB_ENT(110, 0x8,   0),
-        RATETAB_ENT(60,  0x10,  0),
-        RATETAB_ENT(90,  0x20,  0),
-        RATETAB_ENT(120, 0x40,  0),
-        RATETAB_ENT(180, 0x80,  0),
-        RATETAB_ENT(240, 0x100, 0),
-        RATETAB_ENT(360, 0x200, 0),
-        RATETAB_ENT(480, 0x400, 0),
-        RATETAB_ENT(540, 0x800, 0),
+        RATETAB_ENT(10,  0,  0),
+        RATETAB_ENT(20,  1,  0),
+        RATETAB_ENT(55,  2,  0),
+        RATETAB_ENT(110, 3,  0),
+        RATETAB_ENT(60,  9,  0),
+        RATETAB_ENT(90,  6,  0),
+        RATETAB_ENT(120, 7,  0),
+        RATETAB_ENT(180, 8,  0),
+        RATETAB_ENT(240, 9,  0),
+        RATETAB_ENT(360, 10, 0),
+        RATETAB_ENT(480, 11, 0),
+        RATETAB_ENT(540, 12, 0),
 };
 
 static struct ieee80211_supported_band lbs_band_2ghz = {
@@ -76,22 +81,639 @@ static const u32 cipher_suites[] = {
         WLAN_CIPHER_SUITE_CCMP,
 };
 
+/* Time to stay on the channel */
+#define LBS_DWELL_PASSIVE 100
+#define LBS_DWELL_ACTIVE  40
 
 
+/***************************************************************************
+ * Misc utility functions
+ *
+ * TLVs are Marvell specific. They are very similar to IEs, they have the
+ * same structure: type, length, data*. The only difference: for IEs, the
+ * type and length are u8, but for TLVs they're __le16.
+ */
+
+/*
+ * Convert NL80211's auth_type to the one from Libertas, see chapter 5.9.1
+ * in the firmware spec
+ */
+static u8 lbs_auth_to_authtype(enum nl80211_auth_type auth_type)
+{
+        int ret = -ENOTSUPP;
+
+        switch (auth_type) {
+        case NL80211_AUTHTYPE_OPEN_SYSTEM:
+        case NL80211_AUTHTYPE_SHARED_KEY:
+                ret = auth_type;
+                break;
+        case NL80211_AUTHTYPE_AUTOMATIC:
+                ret = NL80211_AUTHTYPE_OPEN_SYSTEM;
+                break;
+        case NL80211_AUTHTYPE_NETWORK_EAP:
+                ret = 0x80;
+                break;
+        default:
+                /* silence compiler */
+                break;
+        }
+        return ret;
+}
+
+
+/* Various firmware commands need the list of supported rates, but with
+   the hight-bit set for basic rates */
+static int lbs_add_rates(u8 *rates)
+{
+        size_t i;
+
+        for (i = 0; i < ARRAY_SIZE(lbs_rates); i++) {
+                u8 rate = lbs_rates[i].bitrate / 5;
+                if (rate == 0x02 || rate == 0x04 ||
+                    rate == 0x0b || rate == 0x16)
+                        rate |= 0x80;
+                rates[i] = rate;
+        }
+        return ARRAY_SIZE(lbs_rates);
+}
+
+
+/***************************************************************************
+ * TLV utility functions
+ *
+ * TLVs are Marvell specific. They are very similar to IEs, they have the
+ * same structure: type, length, data*. The only difference: for IEs, the
+ * type and length are u8, but for TLVs they're __le16.
+ */
+
+
+/*
+ * Add ssid TLV
+ */
+#define LBS_MAX_SSID_TLV_SIZE                   \
+        (sizeof(struct mrvl_ie_header)          \
+         + IEEE80211_MAX_SSID_LEN)
+
+static int lbs_add_ssid_tlv(u8 *tlv, const u8 *ssid, int ssid_len)
+{
+        struct mrvl_ie_ssid_param_set *ssid_tlv = (void *)tlv;
+
+        /*
+         * TLV-ID SSID  00 00
+         * length       06 00
+         * ssid         4d 4e 54 45 53 54
+         */
+        ssid_tlv->header.type = cpu_to_le16(TLV_TYPE_SSID);
+        ssid_tlv->header.len = cpu_to_le16(ssid_len);
+        memcpy(ssid_tlv->ssid, ssid, ssid_len);
+        return sizeof(ssid_tlv->header) + ssid_len;
+}
+
+
+/*
+ * Add channel list TLV (section 8.4.2)
+ *
+ * Actual channel data comes from priv->wdev->wiphy->channels.
+ */
+#define LBS_MAX_CHANNEL_LIST_TLV_SIZE                                   \
+        (sizeof(struct mrvl_ie_header)                                  \
+         + (LBS_SCAN_BEFORE_NAP * sizeof(struct chanscanparamset)))
+
+static int lbs_add_channel_list_tlv(struct lbs_private *priv, u8 *tlv,
+                                    int last_channel, int active_scan)
+{
+        int chanscanparamsize = sizeof(struct chanscanparamset) *
+                (last_channel - priv->scan_channel);
+
+        struct mrvl_ie_header *header = (void *) tlv;
+
+        /*
+         * TLV-ID CHANLIST  01 01
+         * length           0e 00
+         * channel          00 01 00 00 00 64 00
+         *   radio type     00
+         *   channel           01
+         *   scan type            00
+         *   min scan time           00 00
+         *   max scan time                 64 00
+         * channel 2        00 02 00 00 00 64 00
+         *
+         */
+
+        header->type = cpu_to_le16(TLV_TYPE_CHANLIST);
+        header->len  = cpu_to_le16(chanscanparamsize);
+        tlv += sizeof(struct mrvl_ie_header);
+
+        /* lbs_deb_scan("scan: channels %d to %d\n", priv->scan_channel,
+                     last_channel); */
+        memset(tlv, 0, chanscanparamsize);
+
+        while (priv->scan_channel < last_channel) {
+                struct chanscanparamset *param = (void *) tlv;
+
+                param->radiotype = CMD_SCAN_RADIO_TYPE_BG;
+                param->channumber =
+                        priv->scan_req->channels[priv->scan_channel]->hw_value;
+                if (active_scan) {
+                        param->maxscantime = cpu_to_le16(LBS_DWELL_ACTIVE);
+                } else {
+                        param->chanscanmode.passivescan = 1;
+                        param->maxscantime = cpu_to_le16(LBS_DWELL_PASSIVE);
+                }
+                tlv += sizeof(struct chanscanparamset);
+                priv->scan_channel++;
+        }
+        return sizeof(struct mrvl_ie_header) + chanscanparamsize;
+}
+
+
+/*
+ * Add rates TLV
+ *
+ * The rates are in lbs_bg_rates[], but for the 802.11b
+ * rates the high bit is set. We add this TLV only because
+ * there's a firmware which otherwise doesn't report all
+ * APs in range.
+ */
+#define LBS_MAX_RATES_TLV_SIZE                  \
+        (sizeof(struct mrvl_ie_header)          \
+         + (ARRAY_SIZE(lbs_rates)))
+
+/* Adds a TLV with all rates the hardware supports */
+static int lbs_add_supported_rates_tlv(u8 *tlv)
+{
+        size_t i;
+        struct mrvl_ie_rates_param_set *rate_tlv = (void *)tlv;
+
+        /*
+         * TLV-ID RATES  01 00
+         * length        0e 00
+         * rates         82 84 8b 96 0c 12 18 24 30 48 60 6c
+         */
+        rate_tlv->header.type = cpu_to_le16(TLV_TYPE_RATES);
+        tlv += sizeof(rate_tlv->header);
+        i = lbs_add_rates(tlv);
+        tlv += i;
+        rate_tlv->header.len = cpu_to_le16(i);
+        return sizeof(rate_tlv->header) + i;
+}
+
+
+/*
+ * Adds a TLV with all rates the hardware *and* BSS supports.
+ */
+static int lbs_add_common_rates_tlv(u8 *tlv, struct cfg80211_bss *bss)
+{
+        struct mrvl_ie_rates_param_set *rate_tlv = (void *)tlv;
+        const u8 *rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
+        int n;
+
+        /*
+         * 01 00                   TLV_TYPE_RATES
+         * 04 00                   len
+         * 82 84 8b 96             rates
+         */
+        rate_tlv->header.type = cpu_to_le16(TLV_TYPE_RATES);
+        tlv += sizeof(rate_tlv->header);
+
+        if (!rates_eid) {
+                /* Fallback: add basic 802.11b rates */
+                *tlv++ = 0x82;
+                *tlv++ = 0x84;
+                *tlv++ = 0x8b;
+                *tlv++ = 0x96;
+                n = 4;
+        } else {
+                int hw, ap;
+                u8 ap_max = rates_eid[1];
+                n = 0;
+                for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
+                        u8 hw_rate = lbs_rates[hw].bitrate / 5;
+                        for (ap = 0; ap < ap_max; ap++) {
+                                if (hw_rate == (rates_eid[ap+2] & 0x7f)) {
+                                        *tlv++ = rates_eid[ap+2];
+                                        n++;
+                                }
+                        }
+                }
+        }
+
+        rate_tlv->header.len = cpu_to_le16(n);
+        return sizeof(rate_tlv->header) + n;
+}
+
+
+/*
+ * Add auth type TLV.
+ *
+ * This is only needed for newer firmware (V9 and up).
+ */
+#define LBS_MAX_AUTH_TYPE_TLV_SIZE \
+        sizeof(struct mrvl_ie_auth_type)
+
+static int lbs_add_auth_type_tlv(u8 *tlv, enum nl80211_auth_type auth_type)
+{
+        struct mrvl_ie_auth_type *auth = (void *) tlv;
+
+        /*
+         * 1f 01  TLV_TYPE_AUTH_TYPE
+         * 01 00  len
+         * 01     auth type
+         */
+        auth->header.type = cpu_to_le16(TLV_TYPE_AUTH_TYPE);
+        auth->header.len = cpu_to_le16(sizeof(*auth)-sizeof(auth->header));
+        auth->auth = cpu_to_le16(lbs_auth_to_authtype(auth_type));
+        return sizeof(*auth);
+}
+
+
+/*
+ * Add channel (phy ds) TLV
+ */
+#define LBS_MAX_CHANNEL_TLV_SIZE \
+        sizeof(struct mrvl_ie_header)
+
+static int lbs_add_channel_tlv(u8 *tlv, u8 channel)
+{
+        struct mrvl_ie_ds_param_set *ds = (void *) tlv;
+
+        /*
+         * 03 00  TLV_TYPE_PHY_DS
+         * 01 00  len
+         * 06     channel
+         */
+        ds->header.type = cpu_to_le16(TLV_TYPE_PHY_DS);
+        ds->header.len = cpu_to_le16(sizeof(*ds)-sizeof(ds->header));
+        ds->channel = channel;
+        return sizeof(*ds);
+}
+
+
+/*
+ * Add (empty) CF param TLV of the form:
+ */
+#define LBS_MAX_CF_PARAM_TLV_SIZE               \
+        sizeof(struct mrvl_ie_header)
+
+static int lbs_add_cf_param_tlv(u8 *tlv)
+{
+        struct mrvl_ie_cf_param_set *cf = (void *)tlv;
+
+        /*
+         * 04 00  TLV_TYPE_CF
+         * 06 00  len
+         * 00     cfpcnt
+         * 00     cfpperiod
+         * 00 00  cfpmaxduration
+         * 00 00  cfpdurationremaining
+         */
+        cf->header.type = cpu_to_le16(TLV_TYPE_CF);
+        cf->header.len = cpu_to_le16(sizeof(*cf)-sizeof(cf->header));
+        return sizeof(*cf);
+}
+
+/*
+ * Add WPA TLV
+ */
+#define LBS_MAX_WPA_TLV_SIZE                    \
+        (sizeof(struct mrvl_ie_header)          \
+         + 128 /* TODO: I guessed the size */)
+
+static int lbs_add_wpa_tlv(u8 *tlv, const u8 *ie, u8 ie_len)
+{
+        size_t tlv_len;
+
+        /*
+         * We need just convert an IE to an TLV. IEs use u8 for the header,
+         *   u8      type
+         *   u8      len
+         *   u8[]    data
+         * but TLVs use __le16 instead:
+         *   __le16  type
+         *   __le16  len
+         *   u8[]    data
+         */
+        *tlv++ = *ie++;
+        *tlv++ = 0;
+        tlv_len = *tlv++ = *ie++;
+        *tlv++ = 0;
+        while (tlv_len--)
+                *tlv++ = *ie++;
+        /* the TLV is two bytes larger than the IE */
+        return ie_len + 2;
+}
+
+/***************************************************************************
+ * Set Channel
+ */
+
 static int lbs_cfg_set_channel(struct wiphy *wiphy,
         struct net_device *netdev,
-        struct ieee80211_channel *chan,
+        struct ieee80211_channel *channel,
         enum nl80211_channel_type channel_type)
 {
         struct lbs_private *priv = wiphy_priv(wiphy);
         int ret = -ENOTSUPP;
 
-        lbs_deb_enter_args(LBS_DEB_CFG80211, "freq %d, type %d", chan->center_freq, channel_type);
+        lbs_deb_enter_args(LBS_DEB_CFG80211, "freq %d, type %d",
+                           channel->center_freq, channel_type);
 
         if (channel_type != NL80211_CHAN_NO_HT)
                 goto out;
 
-        ret = lbs_set_channel(priv, chan->hw_value);
+        ret = lbs_set_channel(priv, channel->hw_value);
+
+ out:
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+
+
+/***************************************************************************
+ * Scanning
+ */
+
+/*
+ * When scanning, the firmware doesn't send a nul packet with the power-safe
+ * bit to the AP. So we cannot stay away from our current channel too long,
+ * otherwise we loose data. So take a "nap" while scanning every other
+ * while.
+ */
+#define LBS_SCAN_BEFORE_NAP 4
+
+
+/*
+ * When the firmware reports back a scan-result, it gives us an "u8 rssi",
+ * which isn't really an RSSI, as it becomes larger when moving away from
+ * the AP. Anyway, we need to convert that into mBm.
+ */
+#define LBS_SCAN_RSSI_TO_MBM(rssi) \
+        ((-(int)rssi + 3)*100)
+
+static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
+        struct cmd_header *resp)
+{
+        struct cmd_ds_802_11_scan_rsp *scanresp = (void *)resp;
+        int bsssize;
+        const u8 *pos;
+        u16 nr_sets;
+        const u8 *tsfdesc;
+        int tsfsize;
+        int i;
+        int ret = -EILSEQ;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        bsssize = get_unaligned_le16(&scanresp->bssdescriptsize);
+        nr_sets = le16_to_cpu(resp->size);
+
+        /*
+         * The general layout of the scan response is described in chapter
+         * 5.7.1. Basically we have a common part, then any number of BSS
+         * descriptor sections. Finally we have section with the same number
+         * of TSFs.
+         *
+         * cmd_ds_802_11_scan_rsp
+         *   cmd_header
+         *   pos_size
+         *   nr_sets
+         *   bssdesc 1
+         *     bssid
+         *     rssi
+         *     timestamp
+         *     intvl
+         *     capa
+         *     IEs
+         *   bssdesc 2
+         *   bssdesc n
+         *   MrvlIEtypes_TsfFimestamp_t
+         *     TSF for BSS 1
+         *     TSF for BSS 2
+         *     TSF for BSS n
+         */
+
+        pos = scanresp->bssdesc_and_tlvbuffer;
+
+        tsfdesc = pos + bsssize;
+        tsfsize = 4 + 8 * scanresp->nr_sets;
+
+        /* Validity check: we expect a Marvell-Local TLV */
+        i = get_unaligned_le16(tsfdesc);
+        tsfdesc += 2;
+        if (i != TLV_TYPE_TSFTIMESTAMP)
+                goto done;
+        /* Validity check: the TLV holds TSF values with 8 bytes each, so
+         * the size in the TLV must match the nr_sets value */
+        i = get_unaligned_le16(tsfdesc);
+        tsfdesc += 2;
+        if (i / 8 != scanresp->nr_sets)
+                goto done;
+
+        for (i = 0; i < scanresp->nr_sets; i++) {
+                const u8 *bssid;
+                const u8 *ie;
+                int left;
+                int ielen;
+                int rssi;
+                u16 intvl;
+                u16 capa;
+                int chan_no = -1;
+                const u8 *ssid = NULL;
+                u8 ssid_len = 0;
+                DECLARE_SSID_BUF(ssid_buf);
+
+                int len = get_unaligned_le16(pos);
+                pos += 2;
+
+                /* BSSID */
+                bssid = pos;
+                pos += ETH_ALEN;
+                /* RSSI */
+                rssi = *pos++;
+                /* Packet time stamp */
+                pos += 8;
+                /* Beacon interval */
+                intvl = get_unaligned_le16(pos);
+                pos += 2;
+                /* Capabilities */
+                capa = get_unaligned_le16(pos);
+                pos += 2;
+
+                /* To find out the channel, we must parse the IEs */
+                ie = pos;
+                /* 6+1+8+2+2: size of BSSID, RSSI, time stamp, beacon
+                   interval, capabilities */
+                ielen = left = len - (6 + 1 + 8 + 2 + 2);
+                while (left >= 2) {
+                        u8 id, elen;
+                        id = *pos++;
+                        elen = *pos++;
+                        left -= 2;
+                        if (elen > left || elen == 0)
+                                goto done;
+                        if (id == WLAN_EID_DS_PARAMS)
+                                chan_no = *pos;
+                        if (id == WLAN_EID_SSID) {
+                                ssid = pos;
+                                ssid_len = elen;
+                        }
+                        left -= elen;
+                        pos += elen;
+                }
+
+                /* No channel, no luck */
+                if (chan_no != -1) {
+                        struct wiphy *wiphy = priv->wdev->wiphy;
+                        int freq = ieee80211_channel_to_frequency(chan_no);
+                        struct ieee80211_channel *channel =
+                                ieee80211_get_channel(wiphy, freq);
+
+                        lbs_deb_scan("scan: %pM, capa %04x, chan %2d, %s, "
+                                     "%d dBm\n",
+                                     bssid, capa, chan_no,
+                                     print_ssid(ssid_buf, ssid, ssid_len),
+                                     LBS_SCAN_RSSI_TO_MBM(rssi)/100);
+
+                        if (channel ||
+                            !(channel->flags & IEEE80211_CHAN_DISABLED))
+                                cfg80211_inform_bss(wiphy, channel,
+                                        bssid, le64_to_cpu(*(__le64 *)tsfdesc),
+                                        capa, intvl, ie, ielen,
+                                        LBS_SCAN_RSSI_TO_MBM(rssi),
+                                        GFP_KERNEL);
+                }
+                tsfdesc += 8;
+        }
+        ret = 0;
+
+ done:
+        lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
+        return ret;
+}
+
+
+/*
+ * Our scan command contains a TLV, consting of a SSID TLV, a channel list
+ * TLV and a rates TLV. Determine the maximum size of them:
+ */
+#define LBS_SCAN_MAX_CMD_SIZE                   \
+        (sizeof(struct cmd_ds_802_11_scan)      \
+         + LBS_MAX_SSID_TLV_SIZE                \
+         + LBS_MAX_CHANNEL_LIST_TLV_SIZE        \
+         + LBS_MAX_RATES_TLV_SIZE)
+
+/*
+ * Assumes priv->scan_req is initialized and valid
+ * Assumes priv->scan_channel is initialized
+ */
+static void lbs_scan_worker(struct work_struct *work)
+{
+        struct lbs_private *priv =
+                container_of(work, struct lbs_private, scan_work.work);
+        struct cmd_ds_802_11_scan *scan_cmd;
+        u8 *tlv; /* pointer into our current, growing TLV storage area */
+        int last_channel;
+        int running, carrier;
+
+        lbs_deb_enter(LBS_DEB_SCAN);
+
+        scan_cmd = kzalloc(LBS_SCAN_MAX_CMD_SIZE, GFP_KERNEL);
+        if (scan_cmd == NULL)
+                goto out_no_scan_cmd;
+
+        /* prepare fixed part of scan command */
+        scan_cmd->bsstype = CMD_BSS_TYPE_ANY;
+
+        /* stop network while we're away from our main channel */
+        running = !netif_queue_stopped(priv->dev);
+        carrier = netif_carrier_ok(priv->dev);
+        if (running)
+                netif_stop_queue(priv->dev);
+        if (carrier)
+                netif_carrier_off(priv->dev);
+
+        /* prepare fixed part of scan command */
+        tlv = scan_cmd->tlvbuffer;
+
+        /* add SSID TLV */
+        if (priv->scan_req->n_ssids)
+                tlv += lbs_add_ssid_tlv(tlv,
+                                        priv->scan_req->ssids[0].ssid,
+                                        priv->scan_req->ssids[0].ssid_len);
+
+        /* add channel TLVs */
+        last_channel = priv->scan_channel + LBS_SCAN_BEFORE_NAP;
+        if (last_channel > priv->scan_req->n_channels)
+                last_channel = priv->scan_req->n_channels;
+        tlv += lbs_add_channel_list_tlv(priv, tlv, last_channel,
+                priv->scan_req->n_ssids);
+
+        /* add rates TLV */
+        tlv += lbs_add_supported_rates_tlv(tlv);
+
+        if (priv->scan_channel < priv->scan_req->n_channels) {
+                cancel_delayed_work(&priv->scan_work);
+                queue_delayed_work(priv->work_thread, &priv->scan_work,
+                        msecs_to_jiffies(300));
+        }
+
+        /* This is the final data we are about to send */
+        scan_cmd->hdr.size = cpu_to_le16(tlv - (u8 *)scan_cmd);
+        lbs_deb_hex(LBS_DEB_SCAN, "SCAN_CMD", (void *)scan_cmd,
+                    sizeof(*scan_cmd));
+        lbs_deb_hex(LBS_DEB_SCAN, "SCAN_TLV", scan_cmd->tlvbuffer,
+                    tlv - scan_cmd->tlvbuffer);
+
+        __lbs_cmd(priv, CMD_802_11_SCAN, &scan_cmd->hdr,
+                le16_to_cpu(scan_cmd->hdr.size),
+                lbs_ret_scan, 0);
+
+        if (priv->scan_channel >= priv->scan_req->n_channels) {
+                /* Mark scan done */
+                cfg80211_scan_done(priv->scan_req, false);
+                priv->scan_req = NULL;
+        }
+
+        /* Restart network */
+        if (carrier)
+                netif_carrier_on(priv->dev);
+        if (running && !priv->tx_pending_len)
+                netif_wake_queue(priv->dev);
+
+        kfree(scan_cmd);
+
+ out_no_scan_cmd:
+        lbs_deb_leave(LBS_DEB_SCAN);
+}
+
+
+static int lbs_cfg_scan(struct wiphy *wiphy,
+        struct net_device *dev,
+        struct cfg80211_scan_request *request)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        if (priv->scan_req || delayed_work_pending(&priv->scan_work)) {
+                /* old scan request not yet processed */
+                ret = -EAGAIN;
+                goto out;
+        }
+
+        lbs_deb_scan("scan: ssids %d, channels %d, ie_len %zd\n",
+                request->n_ssids, request->n_channels, request->ie_len);
+
+        priv->scan_channel = 0;
+        queue_delayed_work(priv->work_thread, &priv->scan_work,
+                msecs_to_jiffies(50));
+
+        if (priv->surpriseremoved)
+                ret = -EIO;
+
+        priv->scan_req = request;
 
  out:
         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
@@ -101,8 +723,1228 @@ static int lbs_cfg_set_channel(struct wiphy *wiphy,
 
 
 
+/***************************************************************************
+ * Events
+ */
+
+void lbs_send_disconnect_notification(struct lbs_private *priv)
+{
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        cfg80211_disconnected(priv->dev,
+                0,
+                NULL, 0,
+                GFP_KERNEL);
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+}
+
+void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event)
+{
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        cfg80211_michael_mic_failure(priv->dev,
+                priv->assoc_bss,
+                event == MACREG_INT_CODE_MIC_ERR_MULTICAST ?
+                        NL80211_KEYTYPE_GROUP :
+                        NL80211_KEYTYPE_PAIRWISE,
+                -1,
+                NULL,
+                GFP_KERNEL);
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+}
+
+
+
+
+/***************************************************************************
+ * Connect/disconnect
+ */
+
+
+/*
+ * This removes all WEP keys
+ */
+static int lbs_remove_wep_keys(struct lbs_private *priv)
+{
+        struct cmd_ds_802_11_set_wep cmd;
+        int ret;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+        cmd.keyindex = cpu_to_le16(priv->wep_tx_key);
+        cmd.action = cpu_to_le16(CMD_ACT_REMOVE);
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+        return ret;
+}
+
+/*
+ * Set WEP keys
+ */
+static int lbs_set_wep_keys(struct lbs_private *priv)
+{
+        struct cmd_ds_802_11_set_wep cmd;
+        int i;
+        int ret;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        /*
+         * command         13 00
+         * size            50 00
+         * sequence        xx xx
+         * result          00 00
+         * action          02 00     ACT_ADD
+         * transmit key    00 00
+         * type for key 1  01        WEP40
+         * type for key 2  00
+         * type for key 3  00
+         * type for key 4  00
+         * key 1           39 39 39 39 39 00 00 00
+         *                 00 00 00 00 00 00 00 00
+         * key 2           00 00 00 00 00 00 00 00
+         *                 00 00 00 00 00 00 00 00
+         * key 3           00 00 00 00 00 00 00 00
+         *                 00 00 00 00 00 00 00 00
+         * key 4           00 00 00 00 00 00 00 00
+         */
+        if (priv->wep_key_len[0] || priv->wep_key_len[1] ||
+            priv->wep_key_len[2] || priv->wep_key_len[3]) {
+                /* Only set wep keys if we have at least one of them */
+                memset(&cmd, 0, sizeof(cmd));
+                cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+                cmd.keyindex = cpu_to_le16(priv->wep_tx_key);
+                cmd.action = cpu_to_le16(CMD_ACT_ADD);
+
+                for (i = 0; i < 4; i++) {
+                        switch (priv->wep_key_len[i]) {
+                        case WLAN_KEY_LEN_WEP40:
+                                cmd.keytype[i] = CMD_TYPE_WEP_40_BIT;
+                                break;
+                        case WLAN_KEY_LEN_WEP104:
+                                cmd.keytype[i] = CMD_TYPE_WEP_104_BIT;
+                                break;
+                        default:
+                                cmd.keytype[i] = 0;
+                                break;
+                        }
+                        memcpy(cmd.keymaterial[i], priv->wep_key[i],
+                               priv->wep_key_len[i]);
+                }
+
+                ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
+        } else {
+                /* Otherwise remove all wep keys */
+                ret = lbs_remove_wep_keys(priv);
+        }
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+        return ret;
+}
+
+
+/*
+ * Enable/Disable RSN status
+ */
+static int lbs_enable_rsn(struct lbs_private *priv, int enable)
+{
+        struct cmd_ds_802_11_enable_rsn cmd;
+        int ret;
+
+        lbs_deb_enter_args(LBS_DEB_CFG80211, "%d", enable);
+
+        /*
+         * cmd       2f 00
+         * size      0c 00
+         * sequence  xx xx
+         * result    00 00
+         * action    01 00    ACT_SET
+         * enable    01 00
+         */
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+        cmd.action = cpu_to_le16(CMD_ACT_SET);
+        cmd.enable = cpu_to_le16(enable);
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_ENABLE_RSN, &cmd);
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+        return ret;
+}
+
+
+/*
+ * Set WPA/WPA key material
+ */
+
+/* like "struct cmd_ds_802_11_key_material", but with cmd_header. Once we
+ * get rid of WEXT, this should go into host.h */
+
+struct cmd_key_material {
+        struct cmd_header hdr;
+
+        __le16 action;
+        struct MrvlIEtype_keyParamSet param;
+} __attribute__ ((packed));
+
+static int lbs_set_key_material(struct lbs_private *priv,
+                                int key_type,
+                                int key_info,
+                                u8 *key, u16 key_len)
+{
+        struct cmd_key_material cmd;
+        int ret;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        /*
+         * Example for WPA (TKIP):
+         *
+         * cmd       5e 00
+         * size      34 00
+         * sequence  xx xx
+         * result    00 00
+         * action    01 00
+         * TLV type  00 01    key param
+         * length    00 26
+         * key type  01 00    TKIP
+         * key info  06 00    UNICAST | ENABLED
+         * key len   20 00
+         * key       32 bytes
+         */
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+        cmd.action = cpu_to_le16(CMD_ACT_SET);
+        cmd.param.type = cpu_to_le16(TLV_TYPE_KEY_MATERIAL);
+        cmd.param.length = cpu_to_le16(sizeof(cmd.param) - 4);
+        cmd.param.keytypeid = cpu_to_le16(key_type);
+        cmd.param.keyinfo = cpu_to_le16(key_info);
+        cmd.param.keylen = cpu_to_le16(key_len);
+        if (key && key_len)
+                memcpy(cmd.param.key, key, key_len);
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_KEY_MATERIAL, &cmd);
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+        return ret;
+}
+
+
+/*
+ * Sets the auth type (open, shared, etc) in the firmware. That
+ * we use CMD_802_11_AUTHENTICATE is misleading, this firmware
+ * command doesn't send an authentication frame at all, it just
+ * stores the auth_type.
+ */
+static int lbs_set_authtype(struct lbs_private *priv,
+                            struct cfg80211_connect_params *sme)
+{
+        struct cmd_ds_802_11_authenticate cmd;
+        int ret;
+
+        lbs_deb_enter_args(LBS_DEB_CFG80211, "%d", sme->auth_type);
+
+        /*
+         * cmd        11 00
+         * size       19 00
+         * sequence   xx xx
+         * result     00 00
+         * BSS id     00 13 19 80 da 30
+         * auth type  00
+         * reserved   00 00 00 00 00 00 00 00 00 00
+         */
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+        if (sme->bssid)
+                memcpy(cmd.bssid, sme->bssid, ETH_ALEN);
+        /* convert auth_type */
+        ret = lbs_auth_to_authtype(sme->auth_type);
+        if (ret < 0)
+                goto done;
+
+        cmd.authtype = ret;
+        ret = lbs_cmd_with_response(priv, CMD_802_11_AUTHENTICATE, &cmd);
+
+ done:
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+
+/*
+ * Create association request
+ */
+#define LBS_ASSOC_MAX_CMD_SIZE                     \
+        (sizeof(struct cmd_ds_802_11_associate)    \
+         - 512 /* cmd_ds_802_11_associate.iebuf */ \
+         + LBS_MAX_SSID_TLV_SIZE                   \
+         + LBS_MAX_CHANNEL_TLV_SIZE                \
+         + LBS_MAX_CF_PARAM_TLV_SIZE               \
+         + LBS_MAX_AUTH_TYPE_TLV_SIZE              \
+         + LBS_MAX_WPA_TLV_SIZE)
+
+static int lbs_associate(struct lbs_private *priv,
+                struct cfg80211_bss *bss,
+                struct cfg80211_connect_params *sme)
+{
+        struct cmd_ds_802_11_associate_response *resp;
+        struct cmd_ds_802_11_associate *cmd = kzalloc(LBS_ASSOC_MAX_CMD_SIZE,
+                                                      GFP_KERNEL);
+        const u8 *ssid_eid;
+        size_t len, resp_ie_len;
+        int status;
+        int ret;
+        u8 *pos = &(cmd->iebuf[0]);
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto done;
+        }
+
+        /*
+         * cmd              50 00
+         * length           34 00
+         * sequence         xx xx
+         * result           00 00
+         * BSS id           00 13 19 80 da 30
+         * capabilities     11 00
+         * listen interval  0a 00
+         * beacon interval  00 00
+         * DTIM period      00
+         * TLVs             xx   (up to 512 bytes)
+         */
+        cmd->hdr.command = cpu_to_le16(CMD_802_11_ASSOCIATE);
+
+        /* Fill in static fields */
+        memcpy(cmd->bssid, bss->bssid, ETH_ALEN);
+        cmd->listeninterval = cpu_to_le16(MRVDRV_DEFAULT_LISTEN_INTERVAL);
+        cmd->capability = cpu_to_le16(bss->capability);
+
+        /* add SSID TLV */
+        ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
+        if (ssid_eid)
+                pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_eid[1]);
+        else
+                lbs_deb_assoc("no SSID\n");
+
+        /* add DS param TLV */
+        if (bss->channel)
+                pos += lbs_add_channel_tlv(pos, bss->channel->hw_value);
+        else
+                lbs_deb_assoc("no channel\n");
+
+        /* add (empty) CF param TLV */
+        pos += lbs_add_cf_param_tlv(pos);
+
+        /* add rates TLV */
+        pos += lbs_add_common_rates_tlv(pos, bss);
+
+        /* add auth type TLV */
+        if (priv->fwrelease >= 0x09000000)
+                pos += lbs_add_auth_type_tlv(pos, sme->auth_type);
+
+        /* add WPA/WPA2 TLV */
+        if (sme->ie && sme->ie_len)
+                pos += lbs_add_wpa_tlv(pos, sme->ie, sme->ie_len);
+
+        len = (sizeof(*cmd) - sizeof(cmd->iebuf)) +
+                (u16)(pos - (u8 *) &cmd->iebuf);
+        cmd->hdr.size = cpu_to_le16(len);
+
+        /* store for later use */
+        memcpy(priv->assoc_bss, bss->bssid, ETH_ALEN);
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_ASSOCIATE, cmd);
+        if (ret)
+                goto done;
+
+
+        /* generate connect message to cfg80211 */
+
+        resp = (void *) cmd; /* recast for easier field access */
+        status = le16_to_cpu(resp->statuscode);
+
+        /* Convert statis code of old firmware */
+        if (priv->fwrelease < 0x09000000)
+                switch (status) {
+                case 0:
+                        break;
+                case 1:
+                        lbs_deb_assoc("invalid association parameters\n");
+                        status = WLAN_STATUS_CAPS_UNSUPPORTED;
+                        break;
+                case 2:
+                        lbs_deb_assoc("timer expired while waiting for AP\n");
+                        status = WLAN_STATUS_AUTH_TIMEOUT;
+                        break;
+                case 3:
+                        lbs_deb_assoc("association refused by AP\n");
+                        status = WLAN_STATUS_ASSOC_DENIED_UNSPEC;
+                        break;
+                case 4:
+                        lbs_deb_assoc("authentication refused by AP\n");
+                        status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
+                        break;
+                default:
+                        lbs_deb_assoc("association failure %d\n", status);
+                        status = WLAN_STATUS_UNSPECIFIED_FAILURE;
+        }
+
+        lbs_deb_assoc("status %d, capability 0x%04x\n", status,
+                      le16_to_cpu(resp->capability));
+
+        resp_ie_len = le16_to_cpu(resp->hdr.size)
+                - sizeof(resp->hdr)
+                - 6;
+        cfg80211_connect_result(priv->dev,
+                                priv->assoc_bss,
+                                sme->ie, sme->ie_len,
+                                resp->iebuf, resp_ie_len,
+                                status,
+                                GFP_KERNEL);
+
+        if (status == 0) {
+                /* TODO: get rid of priv->connect_status */
+                priv->connect_status = LBS_CONNECTED;
+                netif_carrier_on(priv->dev);
+                if (!priv->tx_pending_len)
+                        netif_tx_wake_all_queues(priv->dev);
+        }
+
+
+done:
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+
+
+static int lbs_cfg_connect(struct wiphy *wiphy, struct net_device *dev,
+                           struct cfg80211_connect_params *sme)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        struct cfg80211_bss *bss = NULL;
+        int ret = 0;
+        u8 preamble = RADIO_PREAMBLE_SHORT;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        if (sme->bssid) {
+                bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
+                        sme->ssid, sme->ssid_len,
+                        WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+        } else {
+                /*
+                 * Here we have an impedance mismatch. The firmware command
+                 * CMD_802_11_ASSOCIATE always needs a BSSID, it cannot
+                 * connect otherwise. However, for the connect-API of
+                 * cfg80211 the bssid is purely optional. We don't get one,
+                 * except the user specifies one on the "iw" command line.
+                 *
+                 * If we don't got one, we could initiate a scan and look
+                 * for the best matching cfg80211_bss entry.
+                 *
+                 * Or, better yet, net/wireless/sme.c get's rewritten into
+                 * something more generally useful.
+                 */
+                lbs_pr_err("TODO: no BSS specified\n");
+                ret = -ENOTSUPP;
+                goto done;
+        }
+
+
+        if (!bss) {
+                lbs_pr_err("assicate: bss %pM not in scan results\n",
+                           sme->bssid);
+                ret = -ENOENT;
+                goto done;
+        }
+        lbs_deb_assoc("trying %pM", sme->bssid);
+        lbs_deb_assoc("cipher 0x%x, key index %d, key len %d\n",
+                      sme->crypto.cipher_group,
+                      sme->key_idx, sme->key_len);
+
+        /* As this is a new connection, clear locally stored WEP keys */
+        priv->wep_tx_key = 0;
+        memset(priv->wep_key, 0, sizeof(priv->wep_key));
+        memset(priv->wep_key_len, 0, sizeof(priv->wep_key_len));
+
+        /* set/remove WEP keys */
+        switch (sme->crypto.cipher_group) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
+                /* Store provided WEP keys in priv-> */
+                priv->wep_tx_key = sme->key_idx;
+                priv->wep_key_len[sme->key_idx] = sme->key_len;
+                memcpy(priv->wep_key[sme->key_idx], sme->key, sme->key_len);
+                /* Set WEP keys and WEP mode */
+                lbs_set_wep_keys(priv);
+                priv->mac_control |= CMD_ACT_MAC_WEP_ENABLE;
+                lbs_set_mac_control(priv);
+                /* No RSN mode for WEP */
+                lbs_enable_rsn(priv, 0);
+                break;
+        case 0: /* there's no WLAN_CIPHER_SUITE_NONE definition */
+                /*
+                 * If we don't have no WEP, no WPA and no WPA2,
+                 * we remove all keys like in the WPA/WPA2 setup,
+                 * we just don't set RSN.
+                 *
+                 * Therefore: fall-throught
+                 */
+        case WLAN_CIPHER_SUITE_TKIP:
+        case WLAN_CIPHER_SUITE_CCMP:
+                /* Remove WEP keys and WEP mode */
+                lbs_remove_wep_keys(priv);
+                priv->mac_control &= ~CMD_ACT_MAC_WEP_ENABLE;
+                lbs_set_mac_control(priv);
+
+                /* clear the WPA/WPA2 keys */
+                lbs_set_key_material(priv,
+                        KEY_TYPE_ID_WEP, /* doesn't matter */
+                        KEY_INFO_WPA_UNICAST,
+                        NULL, 0);
+                lbs_set_key_material(priv,
+                        KEY_TYPE_ID_WEP, /* doesn't matter */
+                        KEY_INFO_WPA_MCAST,
+                        NULL, 0);
+                /* RSN mode for WPA/WPA2 */
+                lbs_enable_rsn(priv, sme->crypto.cipher_group != 0);
+                break;
+        default:
+                lbs_pr_err("unsupported cipher group 0x%x\n",
+                           sme->crypto.cipher_group);
+                ret = -ENOTSUPP;
+                goto done;
+        }
+
+        lbs_set_authtype(priv, sme);
+        lbs_set_radio(priv, preamble, 1);
+
+        /* Do the actual association */
+        lbs_associate(priv, bss, sme);
+
+ done:
+        if (bss)
+                cfg80211_put_bss(bss);
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+static int lbs_cfg_disconnect(struct wiphy *wiphy, struct net_device *dev,
+        u16 reason_code)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        struct cmd_ds_802_11_deauthenticate cmd;
+
+        lbs_deb_enter_args(LBS_DEB_CFG80211, "reason_code %d", reason_code);
+
+        /* store for lbs_cfg_ret_disconnect() */
+        priv->disassoc_reason = reason_code;
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+        /* Mildly ugly to use a locally store my own BSSID ... */
+        memcpy(cmd.macaddr, &priv->assoc_bss, ETH_ALEN);
+        cmd.reasoncode = cpu_to_le16(reason_code);
+
+        if (lbs_cmd_with_response(priv, CMD_802_11_DEAUTHENTICATE, &cmd))
+                return -EFAULT;
+
+        cfg80211_disconnected(priv->dev,
+                        priv->disassoc_reason,
+                        NULL, 0,
+                        GFP_KERNEL);
+        priv->connect_status = LBS_DISCONNECTED;
+
+        return 0;
+}
+
+
+static int lbs_cfg_set_default_key(struct wiphy *wiphy,
+                                   struct net_device *netdev,
+                                   u8 key_index)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        if (key_index != priv->wep_tx_key) {
+                lbs_deb_assoc("set_default_key: to %d\n", key_index);
+                priv->wep_tx_key = key_index;
+                lbs_set_wep_keys(priv);
+        }
+
+        return 0;
+}
+
+
+static int lbs_cfg_add_key(struct wiphy *wiphy, struct net_device *netdev,
+                           u8 idx, const u8 *mac_addr,
+                           struct key_params *params)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        u16 key_info;
+        u16 key_type;
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        lbs_deb_assoc("add_key: cipher 0x%x, mac_addr %pM\n",
+                      params->cipher, mac_addr);
+        lbs_deb_assoc("add_key: key index %d, key len %d\n",
+                      idx, params->key_len);
+        if (params->key_len)
+                lbs_deb_hex(LBS_DEB_CFG80211, "KEY",
+                            params->key, params->key_len);
+
+        lbs_deb_assoc("add_key: seq len %d\n", params->seq_len);
+        if (params->seq_len)
+                lbs_deb_hex(LBS_DEB_CFG80211, "SEQ",
+                            params->seq, params->seq_len);
+
+        switch (params->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
+                /* actually compare if something has changed ... */
+                if ((priv->wep_key_len[idx] != params->key_len) ||
+                        memcmp(priv->wep_key[idx],
+                               params->key, params->key_len) != 0) {
+                        priv->wep_key_len[idx] = params->key_len;
+                        memcpy(priv->wep_key[idx],
+                               params->key, params->key_len);
+                        lbs_set_wep_keys(priv);
+                }
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+        case WLAN_CIPHER_SUITE_CCMP:
+                key_info = KEY_INFO_WPA_ENABLED | ((idx == 0)
+                                                   ? KEY_INFO_WPA_UNICAST
+                                                   : KEY_INFO_WPA_MCAST);
+                key_type = (params->cipher == WLAN_CIPHER_SUITE_TKIP)
+                        ? KEY_TYPE_ID_TKIP
+                        : KEY_TYPE_ID_AES;
+                lbs_set_key_material(priv,
+                                     key_type,
+                                     key_info,
+                                     params->key, params->key_len);
+                break;
+        default:
+                lbs_pr_err("unhandled cipher 0x%x\n", params->cipher);
+                ret = -ENOTSUPP;
+                break;
+        }
+
+        return ret;
+}
+
+
+static int lbs_cfg_del_key(struct wiphy *wiphy, struct net_device *netdev,
+                           u8 key_index, const u8 *mac_addr)
+{
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        lbs_deb_assoc("del_key: key_idx %d, mac_addr %pM\n",
+                      key_index, mac_addr);
+
+#ifdef TODO
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        /*
+         * I think can keep this a NO-OP, because:
+
+         * - we clear all keys whenever we do lbs_cfg_connect() anyway
+         * - neither "iw" nor "wpa_supplicant" won't call this during
+         *   an ongoing connection
+         * - TODO: but I have to check if this is still true when
+         *   I set the AP to periodic re-keying
+         * - we've not kzallec() something when we've added a key at
+         *   lbs_cfg_connect() or lbs_cfg_add_key().
+         *
+         * This causes lbs_cfg_del_key() only called at disconnect time,
+         * where we'd just waste time deleting a key that is not going
+         * to be used anyway.
+         */
+        if (key_index < 3 && priv->wep_key_len[key_index]) {
+                priv->wep_key_len[key_index] = 0;
+                lbs_set_wep_keys(priv);
+        }
+#endif
+
+        return 0;
+}
+
+
+
+/***************************************************************************
+ * Monitor mode
+ */
+
+/* like "struct cmd_ds_802_11_monitor_mode", but with cmd_header. Once we
+ * get rid of WEXT, this should go into host.h */
+struct cmd_monitor_mode {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 mode;
+} __attribute__ ((packed));
+
+static int lbs_enable_monitor_mode(struct lbs_private *priv, int mode)
+{
+        struct cmd_monitor_mode cmd;
+        int ret;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        /*
+         * cmd       98 00
+         * size      0c 00
+         * sequence  xx xx
+         * result    00 00
+         * action    01 00    ACT_SET
+         * enable    01 00
+         */
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+        cmd.action = cpu_to_le16(CMD_ACT_SET);
+        cmd.mode = cpu_to_le16(mode);
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_MONITOR_MODE, &cmd);
+
+        if (ret == 0)
+                priv->dev->type = ARPHRD_IEEE80211_RADIOTAP;
+        else
+                priv->dev->type = ARPHRD_ETHER;
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+        return ret;
+}
+
+
+
+
+
+
+/***************************************************************************
+ * Get station
+ */
+
+/*
+ * Returns the signal or 0 in case of an error.
+ */
+
+/* like "struct cmd_ds_802_11_rssi", but with cmd_header. Once we get rid
+ * of WEXT, this should go into host.h */
+struct cmd_rssi {
+        struct cmd_header hdr;
+
+        __le16 n_or_snr;
+        __le16 nf;
+        __le16 avg_snr;
+        __le16 avg_nf;
+} __attribute__ ((packed));
+
+static int lbs_get_signal(struct lbs_private *priv, s8 *signal, s8 *noise)
+{
+        struct cmd_rssi cmd;
+        int ret;
+
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+        cmd.n_or_snr = cpu_to_le16(DEFAULT_BCN_AVG_FACTOR);
+        ret = lbs_cmd_with_response(priv, CMD_802_11_RSSI, &cmd);
+
+        if (ret == 0) {
+                *signal = CAL_RSSI(le16_to_cpu(cmd.n_or_snr),
+                                le16_to_cpu(cmd.nf));
+                *noise  = CAL_NF(le16_to_cpu(cmd.nf));
+        }
+        return ret;
+}
+
+
+static int lbs_cfg_get_station(struct wiphy *wiphy, struct net_device *dev,
+                              u8 *mac, struct station_info *sinfo)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        s8 signal, noise;
+        int ret;
+        size_t i;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        sinfo->filled |= STATION_INFO_TX_BYTES |
+                         STATION_INFO_TX_PACKETS |
+                         STATION_INFO_RX_BYTES |
+                         STATION_INFO_RX_PACKETS;
+        sinfo->tx_bytes = priv->dev->stats.tx_bytes;
+        sinfo->tx_packets = priv->dev->stats.tx_packets;
+        sinfo->rx_bytes = priv->dev->stats.rx_bytes;
+        sinfo->rx_packets = priv->dev->stats.rx_packets;
+
+        /* Get current RSSI */
+        ret = lbs_get_signal(priv, &signal, &noise);
+        if (ret == 0) {
+                sinfo->signal = signal;
+                sinfo->filled |= STATION_INFO_SIGNAL;
+        }
+
+        /* Convert priv->cur_rate from hw_value to NL80211 value */
+        for (i = 0; i < ARRAY_SIZE(lbs_rates); i++) {
+                if (priv->cur_rate == lbs_rates[i].hw_value) {
+                        sinfo->txrate.legacy = lbs_rates[i].bitrate;
+                        sinfo->filled |= STATION_INFO_TX_BITRATE;
+                        break;
+                }
+        }
+
+        return 0;
+}
+
+
+
+
+/***************************************************************************
+ * "Site survey", here just current channel and noise level
+ */
+
+static int lbs_get_survey(struct wiphy *wiphy, struct net_device *dev,
+        int idx, struct survey_info *survey)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        s8 signal, noise;
+        int ret;
+
+        if (idx != 0)
+                ret = -ENOENT;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        survey->channel = ieee80211_get_channel(wiphy,
+                ieee80211_channel_to_frequency(priv->channel));
+
+        ret = lbs_get_signal(priv, &signal, &noise);
+        if (ret == 0) {
+                survey->filled = SURVEY_INFO_NOISE_DBM;
+                survey->noise = noise;
+        }
+
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+
+
+
+/***************************************************************************
+ * Change interface
+ */
+
+static int lbs_change_intf(struct wiphy *wiphy, struct net_device *dev,
+        enum nl80211_iftype type, u32 *flags,
+               struct vif_params *params)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        switch (type) {
+        case NL80211_IFTYPE_MONITOR:
+                ret = lbs_enable_monitor_mode(priv, 1);
+                break;
+        case NL80211_IFTYPE_STATION:
+                if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR)
+                        ret = lbs_enable_monitor_mode(priv, 0);
+                if (!ret)
+                        ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE, 1);
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR)
+                        ret = lbs_enable_monitor_mode(priv, 0);
+                if (!ret)
+                        ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE, 2);
+                break;
+        default:
+                ret = -ENOTSUPP;
+        }
+
+        if (!ret)
+                priv->wdev->iftype = type;
+
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+
+
+/***************************************************************************
+ * IBSS (Ad-Hoc)
+ */
+
+/* The firmware needs the following bits masked out of the beacon-derived
+ * capability field when associating/joining to a BSS:
+ *  9 (QoS), 11 (APSD), 12 (unused), 14 (unused), 15 (unused)
+ */
+#define CAPINFO_MASK (~(0xda00))
+
+
+static void lbs_join_post(struct lbs_private *priv,
+                          struct cfg80211_ibss_params *params,
+                          u8 *bssid, u16 capability)
+{
+        u8 fake_ie[2 + IEEE80211_MAX_SSID_LEN + /* ssid */
+                   2 + 4 +                      /* basic rates */
+                   2 + 1 +                      /* DS parameter */
+                   2 + 2 +                      /* atim */
+                   2 + 8];                      /* extended rates */
+        u8 *fake = fake_ie;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        /*
+         * For cfg80211_inform_bss, we'll need a fake IE, as we can't get
+         * the real IE from the firmware. So we fabricate a fake IE based on
+         * what the firmware actually sends (sniffed with wireshark).
+         */
+        /* Fake SSID IE */
+        *fake++ = WLAN_EID_SSID;
+        *fake++ = params->ssid_len;
+        memcpy(fake, params->ssid, params->ssid_len);
+        fake += params->ssid_len;
+        /* Fake supported basic rates IE */
+        *fake++ = WLAN_EID_SUPP_RATES;
+        *fake++ = 4;
+        *fake++ = 0x82;
+        *fake++ = 0x84;
+        *fake++ = 0x8b;
+        *fake++ = 0x96;
+        /* Fake DS channel IE */
+        *fake++ = WLAN_EID_DS_PARAMS;
+        *fake++ = 1;
+        *fake++ = params->channel->hw_value;
+        /* Fake IBSS params IE */
+        *fake++ = WLAN_EID_IBSS_PARAMS;
+        *fake++ = 2;
+        *fake++ = 0; /* ATIM=0 */
+        *fake++ = 0;
+        /* Fake extended rates IE, TODO: don't add this for 802.11b only,
+         * but I don't know how this could be checked */
+        *fake++ = WLAN_EID_EXT_SUPP_RATES;
+        *fake++ = 8;
+        *fake++ = 0x0c;
+        *fake++ = 0x12;
+        *fake++ = 0x18;
+        *fake++ = 0x24;
+        *fake++ = 0x30;
+        *fake++ = 0x48;
+        *fake++ = 0x60;
+        *fake++ = 0x6c;
+        lbs_deb_hex(LBS_DEB_CFG80211, "IE", fake_ie, fake - fake_ie);
+
+        cfg80211_inform_bss(priv->wdev->wiphy,
+                            params->channel,
+                            bssid,
+                            0,
+                            capability,
+                            params->beacon_interval,
+                            fake_ie, fake - fake_ie,
+                            0, GFP_KERNEL);
+
+        memcpy(priv->wdev->ssid, params->ssid, params->ssid_len);
+        priv->wdev->ssid_len = params->ssid_len;
+
+        cfg80211_ibss_joined(priv->dev, bssid, GFP_KERNEL);
+
+        /* TODO: consider doing this at MACREG_INT_CODE_LINK_SENSED time */
+        priv->connect_status = LBS_CONNECTED;
+        netif_carrier_on(priv->dev);
+        if (!priv->tx_pending_len)
+                netif_wake_queue(priv->dev);
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+}
+
+static int lbs_ibss_join_existing(struct lbs_private *priv,
+        struct cfg80211_ibss_params *params,
+        struct cfg80211_bss *bss)
+{
+        const u8 *rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
+        struct cmd_ds_802_11_ad_hoc_join cmd;
+        u8 preamble = RADIO_PREAMBLE_SHORT;
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        /* TODO: set preamble based on scan result */
+        ret = lbs_set_radio(priv, preamble, 1);
+        if (ret)
+                goto out;
+
+        /*
+         * Example CMD_802_11_AD_HOC_JOIN command:
+         *
+         * command         2c 00         CMD_802_11_AD_HOC_JOIN
+         * size            65 00
+         * sequence        xx xx
+         * result          00 00
+         * bssid           02 27 27 97 2f 96
+         * ssid            49 42 53 53 00 00 00 00
+         *                 00 00 00 00 00 00 00 00
+         *                 00 00 00 00 00 00 00 00
+         *                 00 00 00 00 00 00 00 00
+         * type            02            CMD_BSS_TYPE_IBSS
+         * beacon period   64 00
+         * dtim period     00
+         * timestamp       00 00 00 00 00 00 00 00
+         * localtime       00 00 00 00 00 00 00 00
+         * IE DS           03
+         * IE DS len       01
+         * IE DS channel   01
+         * reserveed       00 00 00 00
+         * IE IBSS         06
+         * IE IBSS len     02
+         * IE IBSS atim    00 00
+         * reserved        00 00 00 00
+         * capability      02 00
+         * rates           82 84 8b 96 0c 12 18 24 30 48 60 6c 00
+         * fail timeout    ff 00
+         * probe delay     00 00
+         */
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+
+        memcpy(cmd.bss.bssid, bss->bssid, ETH_ALEN);
+        memcpy(cmd.bss.ssid, params->ssid, params->ssid_len);
+        cmd.bss.type = CMD_BSS_TYPE_IBSS;
+        cmd.bss.beaconperiod = cpu_to_le16(params->beacon_interval);
+        cmd.bss.ds.header.id = WLAN_EID_DS_PARAMS;
+        cmd.bss.ds.header.len = 1;
+        cmd.bss.ds.channel = params->channel->hw_value;
+        cmd.bss.ibss.header.id = WLAN_EID_IBSS_PARAMS;
+        cmd.bss.ibss.header.len = 2;
+        cmd.bss.ibss.atimwindow = 0;
+        cmd.bss.capability = cpu_to_le16(bss->capability & CAPINFO_MASK);
+
+        /* set rates to the intersection of our rates and the rates in the
+           bss */
+        if (!rates_eid) {
+                lbs_add_rates(cmd.bss.rates);
+        } else {
+                int hw, i;
+                u8 rates_max = rates_eid[1];
+                u8 *rates = cmd.bss.rates;
+                for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
+                        u8 hw_rate = lbs_rates[hw].bitrate / 5;
+                        for (i = 0; i < rates_max; i++) {
+                                if (hw_rate == (rates_eid[i+2] & 0x7f)) {
+                                        u8 rate = rates_eid[i+2];
+                                        if (rate == 0x02 || rate == 0x04 ||
+                                            rate == 0x0b || rate == 0x16)
+                                                rate |= 0x80;
+                                        *rates++ = rate;
+                                }
+                        }
+                }
+        }
+
+        /* Only v8 and below support setting this */
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8) {
+                cmd.failtimeout = cpu_to_le16(MRVDRV_ASSOCIATION_TIME_OUT);
+                cmd.probedelay = cpu_to_le16(CMD_SCAN_PROBE_DELAY_TIME);
+        }
+        ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_JOIN, &cmd);
+        if (ret)
+                goto out;
+
+        /*
+         * This is a sample response to CMD_802_11_AD_HOC_JOIN:
+         *
+         * response        2c 80
+         * size            09 00
+         * sequence        xx xx
+         * result          00 00
+         * reserved        00
+         */
+        lbs_join_post(priv, params, bss->bssid, bss->capability);
+
+ out:
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+
+
+static int lbs_ibss_start_new(struct lbs_private *priv,
+        struct cfg80211_ibss_params *params)
+{
+        struct cmd_ds_802_11_ad_hoc_start cmd;
+        struct cmd_ds_802_11_ad_hoc_result *resp =
+                (struct cmd_ds_802_11_ad_hoc_result *) &cmd;
+        u8 preamble = RADIO_PREAMBLE_SHORT;
+        int ret = 0;
+        u16 capability;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        ret = lbs_set_radio(priv, preamble, 1);
+        if (ret)
+                goto out;
+
+        /*
+         * Example CMD_802_11_AD_HOC_START command:
+         *
+         * command         2b 00         CMD_802_11_AD_HOC_START
+         * size            b1 00
+         * sequence        xx xx
+         * result          00 00
+         * ssid            54 45 53 54 00 00 00 00
+         *                 00 00 00 00 00 00 00 00
+         *                 00 00 00 00 00 00 00 00
+         *                 00 00 00 00 00 00 00 00
+         * bss type        02
+         * beacon period   64 00
+         * dtim period     00
+         * IE IBSS         06
+         * IE IBSS len     02
+         * IE IBSS atim    00 00
+         * reserved        00 00 00 00
+         * IE DS           03
+         * IE DS len       01
+         * IE DS channel   01
+         * reserved        00 00 00 00
+         * probe delay     00 00
+         * capability      02 00
+         * rates           82 84 8b 96   (basic rates with have bit 7 set)
+         *                 0c 12 18 24 30 48 60 6c
+         * padding         100 bytes
+         */
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+        memcpy(cmd.ssid, params->ssid, params->ssid_len);
+        cmd.bsstype = CMD_BSS_TYPE_IBSS;
+        cmd.beaconperiod = cpu_to_le16(params->beacon_interval);
+        cmd.ibss.header.id = WLAN_EID_IBSS_PARAMS;
+        cmd.ibss.header.len = 2;
+        cmd.ibss.atimwindow = 0;
+        cmd.ds.header.id = WLAN_EID_DS_PARAMS;
+        cmd.ds.header.len = 1;
+        cmd.ds.channel = params->channel->hw_value;
+        /* Only v8 and below support setting probe delay */
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8)
+                cmd.probedelay = cpu_to_le16(CMD_SCAN_PROBE_DELAY_TIME);
+        /* TODO: mix in WLAN_CAPABILITY_PRIVACY */
+        capability = WLAN_CAPABILITY_IBSS;
+        cmd.capability = cpu_to_le16(capability);
+        lbs_add_rates(cmd.rates);
+
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_START, &cmd);
+        if (ret)
+                goto out;
+
+        /*
+         * This is a sample response to CMD_802_11_AD_HOC_JOIN:
+         *
+         * response        2b 80
+         * size            14 00
+         * sequence        xx xx
+         * result          00 00
+         * reserved        00
+         * bssid           02 2b 7b 0f 86 0e
+         */
+        lbs_join_post(priv, params, resp->bssid, capability);
+
+ out:
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+
+static int lbs_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+                struct cfg80211_ibss_params *params)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        int ret = 0;
+        struct cfg80211_bss *bss;
+        DECLARE_SSID_BUF(ssid_buf);
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        if (!params->channel) {
+                ret = -ENOTSUPP;
+                goto out;
+        }
+
+        ret = lbs_set_channel(priv, params->channel->hw_value);
+        if (ret)
+                goto out;
+
+        /* Search if someone is beaconing. This assumes that the
+         * bss list is populated already */
+        bss = cfg80211_get_bss(wiphy, params->channel, params->bssid,
+                params->ssid, params->ssid_len,
+                WLAN_CAPABILITY_IBSS, WLAN_CAPABILITY_IBSS);
+
+        if (bss) {
+                ret = lbs_ibss_join_existing(priv, params, bss);
+                cfg80211_put_bss(bss);
+        } else
+                ret = lbs_ibss_start_new(priv, params);
+
+
+ out:
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+
+static int lbs_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        struct cmd_ds_802_11_ad_hoc_stop cmd;
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+        ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_STOP, &cmd);
+
+        /* TODO: consider doing this at MACREG_INT_CODE_ADHOC_BCN_LOST time */
+        lbs_mac_event_disconnected(priv);
+
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+
+
+
+/***************************************************************************
+ * Initialization
+ */
+
 static struct cfg80211_ops lbs_cfg80211_ops = {
         .set_channel = lbs_cfg_set_channel,
+        .scan = lbs_cfg_scan,
+        .connect = lbs_cfg_connect,
+        .disconnect = lbs_cfg_disconnect,
+        .add_key = lbs_cfg_add_key,
+        .del_key = lbs_cfg_del_key,
+        .set_default_key = lbs_cfg_set_default_key,
+        .get_station = lbs_cfg_get_station,
+        .dump_survey = lbs_get_survey,
+        .change_virtual_intf = lbs_change_intf,
+        .join_ibss = lbs_join_ibss,
+        .leave_ibss = lbs_leave_ibss,
 };
 
 
@@ -142,6 +1984,36 @@ struct wireless_dev *lbs_cfg_alloc(struct device *dev)
 }
 
 
+static void lbs_cfg_set_regulatory_hint(struct lbs_private *priv)
+{
+        struct region_code_mapping {
+                const char *cn;
+                int code;
+        };
+
+        /* Section 5.17.2 */
+        static struct region_code_mapping regmap[] = {
+                {"US ", 0x10}, /* US FCC */
+                {"CA ", 0x20}, /* Canada */
+                {"EU ", 0x30}, /* ETSI   */
+                {"ES ", 0x31}, /* Spain  */
+                {"FR ", 0x32}, /* France */
+                {"JP ", 0x40}, /* Japan  */
+        };
+        size_t i;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        for (i = 0; i < ARRAY_SIZE(regmap); i++)
+                if (regmap[i].code == priv->regioncode) {
+                        regulatory_hint(priv->wdev->wiphy, regmap[i].cn);
+                        break;
+                }
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+}
+
+
 /*
  * This function get's called after lbs_setup_firmware() determined the
  * firmware capabities. So we can setup the wiphy according to our
@@ -157,10 +2029,12 @@ int lbs_cfg_register(struct lbs_private *priv)
         wdev->wiphy->max_scan_ssids = 1;
         wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
 
-        /* TODO: BIT(NL80211_IFTYPE_ADHOC); */
-        wdev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+        wdev->wiphy->interface_modes =
+                        BIT(NL80211_IFTYPE_STATION) |
+                        BIT(NL80211_IFTYPE_ADHOC);
+        if (lbs_rtap_supported(priv))
+                wdev->wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
 
-        /* TODO: honor priv->regioncode */
         wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &lbs_band_2ghz;
 
         /*
@@ -169,6 +2043,7 @@ int lbs_cfg_register(struct lbs_private *priv)
          */
         wdev->wiphy->cipher_suites = cipher_suites;
         wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+        wdev->wiphy->reg_notifier = lbs_reg_notifier;
 
         ret = wiphy_register(wdev->wiphy);
         if (ret < 0)
@@ -180,10 +2055,129 @@ int lbs_cfg_register(struct lbs_private *priv)
         if (ret)
                 lbs_pr_err("cannot register network device\n");
 
+        INIT_DELAYED_WORK(&priv->scan_work, lbs_scan_worker);
+
+        lbs_cfg_set_regulatory_hint(priv);
+
         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
         return ret;
 }
 
+/**
+ *  @brief This function sets DOMAIN INFO to FW
+ *  @param priv       pointer to struct lbs_private
+ *  @return          0; -1
+*/
+static int lbs_11d_set_domain_info(struct lbs_private *priv)
+{
+        int ret;
+
+        ret = lbs_prepare_and_send_command(priv, CMD_802_11D_DOMAIN_INFO,
+                        CMD_ACT_SET,
+                        CMD_OPTION_WAITFORRSP, 0, NULL);
+        if (ret)
+                lbs_deb_11d("fail to dnld domain info\n");
+
+        return ret;
+}
+
+static void lbs_send_domain_info_cmd_fw(struct wiphy *wiphy,
+                                        struct regulatory_request *request)
+{
+        u8   no_of_triplet = 0;
+        u8   no_of_parsed_chan = 0;
+        u8   first_channel = 0, next_chan = 0, max_pwr = 0;
+        u8   i, flag = 0;
+        enum ieee80211_band band;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *ch;
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        struct lbs_802_11d_domain_reg *domain_info = &priv->domain_reg;
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        /* Set country code */
+        domain_info->country_code[0] = request->alpha2[0];
+        domain_info->country_code[1] = request->alpha2[1];
+        domain_info->country_code[2] = ' ';
+
+        for (band = 0; band < IEEE80211_NUM_BANDS ; band++) {
+
+                if (!wiphy->bands[band])
+                        continue;
+
+                sband = wiphy->bands[band];
+
+                for (i = 0; i < sband->n_channels ; i++) {
+                        ch = &sband->channels[i];
+                        if (ch->flags & IEEE80211_CHAN_DISABLED)
+                                continue;
+
+                        if (!flag) {
+                                flag = 1;
+                                next_chan = first_channel = (u32) ch->hw_value;
+                                max_pwr = ch->max_power;
+                                no_of_parsed_chan = 1;
+                                continue;
+                        }
+
+                        if (ch->hw_value == next_chan + 1 &&
+                                        ch->max_power == max_pwr) {
+                                next_chan++;
+                                no_of_parsed_chan++;
+                        } else {
+                                domain_info->triplet[no_of_triplet]
+                                        .chans.first_channel = first_channel;
+                                domain_info->triplet[no_of_triplet]
+                                        .chans.num_channels = no_of_parsed_chan;
+                                domain_info->triplet[no_of_triplet]
+                                        .chans.max_power = max_pwr;
+                                no_of_triplet++;
+                                flag = 0;
+                        }
+                }
+                if (flag) {
+                        domain_info->triplet[no_of_triplet]
+                                .chans.first_channel = first_channel;
+                        domain_info->triplet[no_of_triplet]
+                                .chans.num_channels = no_of_parsed_chan;
+                        domain_info->triplet[no_of_triplet]
+                                .chans.max_power = max_pwr;
+                        no_of_triplet++;
+                }
+        }
+
+        domain_info->no_triplet = no_of_triplet;
+
+        /* Set domain info */
+        ret = lbs_11d_set_domain_info(priv);
+        if (ret)
+                lbs_pr_err("11D: error setting domain info in FW\n");
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+}
+
+int lbs_reg_notifier(struct wiphy *wiphy,
+                struct regulatory_request *request)
+{
+        lbs_deb_enter_args(LBS_DEB_CFG80211, "cfg80211 regulatory domain "
+                        "callback for domain %c%c\n", request->alpha2[0],
+                        request->alpha2[1]);
+
+        lbs_send_domain_info_cmd_fw(wiphy, request);
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+
+        return 0;
+}
+
+void lbs_scan_deinit(struct lbs_private *priv)
+{
+        lbs_deb_enter(LBS_DEB_CFG80211);
+        cancel_delayed_work_sync(&priv->scan_work);
+}
+
 
 void lbs_cfg_free(struct lbs_private *priv)
 {
diff --git a/drivers/net/wireless/libertas/cfg.h b/drivers/net/wireless/libertas/cfg.h
index e09a193a34d6..756fb98f9f05 100644
--- a/drivers/net/wireless/libertas/cfg.h
+++ b/drivers/net/wireless/libertas/cfg.h
@@ -1,16 +1,27 @@
 #ifndef __LBS_CFG80211_H__
 #define __LBS_CFG80211_H__
 
-#include "dev.h"
+struct device;
+struct lbs_private;
+struct regulatory_request;
+struct wiphy;
 
 struct wireless_dev *lbs_cfg_alloc(struct device *dev);
 int lbs_cfg_register(struct lbs_private *priv);
 void lbs_cfg_free(struct lbs_private *priv);
 
-int lbs_send_specific_ssid_scan(struct lbs_private *priv, u8 *ssid,
-        u8 ssid_len);
-int lbs_scan_networks(struct lbs_private *priv, int full_scan);
-void lbs_cfg_scan_worker(struct work_struct *work);
+int lbs_reg_notifier(struct wiphy *wiphy,
+                struct regulatory_request *request);
 
+/* All of those are TODOs: */
+#define lbs_cmd_802_11_rssi(priv, cmdptr) (0)
+#define lbs_ret_802_11_rssi(priv, resp) (0)
+#define lbs_cmd_bcn_ctrl(priv, cmdptr, cmd_action) (0)
+#define lbs_ret_802_11_bcn_ctrl(priv, resp) (0)
+
+void lbs_send_disconnect_notification(struct lbs_private *priv);
+void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event);
+
+void lbs_scan_deinit(struct lbs_private *priv);
 
 #endif
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index cdb9b9650d73..6c8a9d952a01 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -7,13 +7,8 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 
-#include "host.h"
 #include "decl.h"
-#include "defs.h"
-#include "dev.h"
-#include "assoc.h"
-#include "wext.h"
-#include "scan.h"
+#include "cfg.h"
 #include "cmd.h"
 
 
@@ -70,6 +65,8 @@ static u8 is_command_allowed_in_ps(u16 cmd)
         switch (cmd) {
         case CMD_802_11_RSSI:
                 return 1;
+        case CMD_802_11_HOST_SLEEP_CFG:
+                return 1;
         default:
                 break;
         }
@@ -175,16 +172,28 @@ int lbs_update_hw_spec(struct lbs_private *priv)
         if (priv->mesh_dev)
                 memcpy(priv->mesh_dev->dev_addr, priv->current_addr, ETH_ALEN);
 
-        if (lbs_set_regiontable(priv, priv->regioncode, 0)) {
-                ret = -1;
-                goto out;
-        }
-
 out:
         lbs_deb_leave(LBS_DEB_CMD);
         return ret;
 }
 
+static int lbs_ret_host_sleep_cfg(struct lbs_private *priv, unsigned long dummy,
+                        struct cmd_header *resp)
+{
+        lbs_deb_enter(LBS_DEB_CMD);
+        if (priv->wol_criteria == EHS_REMOVE_WAKEUP) {
+                priv->is_host_sleep_configured = 0;
+                if (priv->psstate == PS_STATE_FULL_POWER) {
+                        priv->is_host_sleep_activated = 0;
+                        wake_up_interruptible(&priv->host_sleep_q);
+                }
+        } else {
+                priv->is_host_sleep_configured = 1;
+        }
+        lbs_deb_leave(LBS_DEB_CMD);
+        return 0;
+}
+
 int lbs_host_sleep_cfg(struct lbs_private *priv, uint32_t criteria,
                 struct wol_config *p_wol_config)
 {
@@ -202,12 +211,11 @@ int lbs_host_sleep_cfg(struct lbs_private *priv, uint32_t criteria,
         else
                 cmd_config.wol_conf.action = CMD_ACT_ACTION_NONE;
 
-        ret = lbs_cmd_with_response(priv, CMD_802_11_HOST_SLEEP_CFG, &cmd_config);
+        ret = __lbs_cmd(priv, CMD_802_11_HOST_SLEEP_CFG, &cmd_config.hdr,
+                        le16_to_cpu(cmd_config.hdr.size),
+                        lbs_ret_host_sleep_cfg, 0);
         if (!ret) {
-                if (criteria) {
-                        lbs_deb_cmd("Set WOL criteria to %x\n", criteria);
-                        priv->wol_criteria = criteria;
-                } else
+                if (p_wol_config)
                         memcpy((uint8_t *) p_wol_config,
                                         (uint8_t *)&cmd_config.wol_conf,
                                         sizeof(struct wol_config));
@@ -712,6 +720,10 @@ static void lbs_queue_cmd(struct lbs_private *priv,
                 }
         }
 
+        if (le16_to_cpu(cmdnode->cmdbuf->command) ==
+                        CMD_802_11_WAKEUP_CONFIRM)
+                addtail = 0;
+
         spin_lock_irqsave(&priv->driver_lock, flags);
 
         if (addtail)
@@ -887,6 +899,66 @@ void lbs_set_mac_control(struct lbs_private *priv)
 }
 
 /**
+ *  @brief This function implements command CMD_802_11D_DOMAIN_INFO
+ *  @param priv       pointer to struct lbs_private
+ *  @param cmd        pointer to cmd buffer
+ *  @param cmdno      cmd ID
+ *  @param cmdOption  cmd action
+ *  @return           0
+*/
+int lbs_cmd_802_11d_domain_info(struct lbs_private *priv,
+                                 struct cmd_ds_command *cmd,
+                                 u16 cmdoption)
+{
+        struct cmd_ds_802_11d_domain_info *pdomaininfo =
+            &cmd->params.domaininfo;
+        struct mrvl_ie_domain_param_set *domain = &pdomaininfo->domain;
+        u8 nr_triplet = priv->domain_reg.no_triplet;
+
+        lbs_deb_enter(LBS_DEB_11D);
+
+        lbs_deb_11d("nr_triplet=%x\n", nr_triplet);
+
+        pdomaininfo->action = cpu_to_le16(cmdoption);
+        if (cmdoption == CMD_ACT_GET) {
+                cmd->size = cpu_to_le16(sizeof(pdomaininfo->action) +
+                                        sizeof(struct cmd_header));
+                lbs_deb_hex(LBS_DEB_11D, "802_11D_DOMAIN_INFO", (u8 *) cmd,
+                        le16_to_cpu(cmd->size));
+                goto done;
+        }
+
+        domain->header.type = cpu_to_le16(TLV_TYPE_DOMAIN);
+        memcpy(domain->countrycode, priv->domain_reg.country_code,
+               sizeof(domain->countrycode));
+
+        domain->header.len = cpu_to_le16(nr_triplet
+                                * sizeof(struct ieee80211_country_ie_triplet)
+                                + sizeof(domain->countrycode));
+
+        if (nr_triplet) {
+                memcpy(domain->triplet, priv->domain_reg.triplet,
+                                nr_triplet *
+                                sizeof(struct ieee80211_country_ie_triplet));
+
+                cmd->size = cpu_to_le16(sizeof(pdomaininfo->action) +
+                                             le16_to_cpu(domain->header.len) +
+                                             sizeof(struct mrvl_ie_header) +
+                                             sizeof(struct cmd_header));
+        } else {
+                cmd->size = cpu_to_le16(sizeof(pdomaininfo->action) +
+                                        sizeof(struct cmd_header));
+        }
+
+        lbs_deb_hex(LBS_DEB_11D, "802_11D_DOMAIN_INFO", (u8 *) cmd,
+                        le16_to_cpu(cmd->size));
+
+done:
+        lbs_deb_enter(LBS_DEB_11D);
+        return 0;
+}
+
+/**
  *  @brief This function prepare the command before send to firmware.
  *
  *  @param priv         A pointer to struct lbs_private structure
@@ -984,6 +1056,11 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
                 ret = 0;
                 goto done;
 
+        case CMD_802_11D_DOMAIN_INFO:
+                cmdptr->command = cpu_to_le16(cmd_no);
+                ret = lbs_cmd_802_11d_domain_info(priv, cmdptr, cmd_action);
+                break;
+
         case CMD_802_11_TPC_CFG:
                 cmdptr->command = cpu_to_le16(CMD_802_11_TPC_CFG);
                 cmdptr->size =
@@ -1303,6 +1380,15 @@ int lbs_execute_next_command(struct lbs_private *priv)
                  * check if in power save mode, if yes, put the device back
                  * to PS mode
                  */
+#ifdef TODO
+                /*
+                 * This was the old code for libertas+wext. Someone that
+                 * understands this beast should re-code it in a sane way.
+                 *
+                 * I actually don't understand why this is related to WPA
+                 * and to connection status, shouldn't powering should be
+                 * independ of such things?
+                 */
                 if ((priv->psmode != LBS802_11POWERMODECAM) &&
                     (priv->psstate == PS_STATE_FULL_POWER) &&
                     ((priv->connect_status == LBS_CONNECTED) ||
@@ -1324,6 +1410,7 @@ int lbs_execute_next_command(struct lbs_private *priv)
                                 lbs_ps_sleep(priv, 0);
                         }
                 }
+#endif
         }
 
         ret = 0;
@@ -1353,6 +1440,11 @@ static void lbs_send_confirmsleep(struct lbs_private *priv)
         /* We don't get a response on the sleep-confirmation */
         priv->dnld_sent = DNLD_RES_RECEIVED;
 
+        if (priv->is_host_sleep_configured) {
+                priv->is_host_sleep_activated = 1;
+                wake_up_interruptible(&priv->host_sleep_q);
+        }
+
         /* If nothing to do, go back to sleep (?) */
         if (!kfifo_len(&priv->event_fifo) && !priv->resp_len[priv->resp_idx])
                 priv->psstate = PS_STATE_SLEEP;
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index 88f7131d66e9..a0d9482ef5e2 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -5,18 +5,11 @@
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/sched.h>
-#include <linux/if_arp.h>
-#include <linux/netdevice.h>
 #include <asm/unaligned.h>
-#include <net/iw_handler.h>
+#include <net/cfg80211.h>
 
-#include "host.h"
-#include "decl.h"
+#include "cfg.h"
 #include "cmd.h"
-#include "defs.h"
-#include "dev.h"
-#include "assoc.h"
-#include "wext.h"
 
 /**
  *  @brief This function handles disconnect event. it
@@ -38,7 +31,9 @@ void lbs_mac_event_disconnected(struct lbs_private *priv)
          * It causes problem in the Supplicant
          */
         msleep_interruptible(1000);
-        lbs_send_disconnect_notification(priv);
+
+        if (priv->wdev->iftype == NL80211_IFTYPE_STATION)
+                lbs_send_disconnect_notification(priv);
 
         /* report disconnect to upper layer */
         netif_stop_queue(priv->dev);
@@ -49,23 +44,8 @@ void lbs_mac_event_disconnected(struct lbs_private *priv)
         priv->currenttxskb = NULL;
         priv->tx_pending_len = 0;
 
-        /* reset SNR/NF/RSSI values */
-        memset(priv->SNR, 0x00, sizeof(priv->SNR));
-        memset(priv->NF, 0x00, sizeof(priv->NF));
-        memset(priv->RSSI, 0x00, sizeof(priv->RSSI));
-        memset(priv->rawSNR, 0x00, sizeof(priv->rawSNR));
-        memset(priv->rawNF, 0x00, sizeof(priv->rawNF));
-        priv->nextSNRNF = 0;
-        priv->numSNRNF = 0;
         priv->connect_status = LBS_DISCONNECTED;
 
-        /* Clear out associated SSID and BSSID since connection is
-         * no longer valid.
-         */
-        memset(&priv->curbssparams.bssid, 0, ETH_ALEN);
-        memset(&priv->curbssparams.ssid, 0, IEEE80211_MAX_SSID_LEN);
-        priv->curbssparams.ssid_len = 0;
-
         if (priv->psstate != PS_STATE_FULL_POWER) {
                 /* make firmware to exit PS mode */
                 lbs_deb_cmd("disconnected, so exit PS mode\n");
@@ -117,6 +97,52 @@ static int lbs_ret_reg_access(struct lbs_private *priv,
         return ret;
 }
 
+/**
+ *  @brief This function parses countryinfo from AP and download country info to FW
+ *  @param priv    pointer to struct lbs_private
+ *  @param resp    pointer to command response buffer
+ *  @return        0; -1
+ */
+static int lbs_ret_802_11d_domain_info(struct cmd_ds_command *resp)
+{
+        struct cmd_ds_802_11d_domain_info *domaininfo =
+                        &resp->params.domaininforesp;
+        struct mrvl_ie_domain_param_set *domain = &domaininfo->domain;
+        u16 action = le16_to_cpu(domaininfo->action);
+        s16 ret = 0;
+        u8 nr_triplet = 0;
+
+        lbs_deb_enter(LBS_DEB_11D);
+
+        lbs_deb_hex(LBS_DEB_11D, "domain info resp", (u8 *) resp,
+                        (int)le16_to_cpu(resp->size));
+
+        nr_triplet = (le16_to_cpu(domain->header.len) - COUNTRY_CODE_LEN) /
+                sizeof(struct ieee80211_country_ie_triplet);
+
+        lbs_deb_11d("domain info resp: nr_triplet %d\n", nr_triplet);
+
+        if (nr_triplet > MRVDRV_MAX_TRIPLET_802_11D) {
+                lbs_deb_11d("invalid number of triplets returned!!\n");
+                return -1;
+        }
+
+        switch (action) {
+        case CMD_ACT_SET:       /*Proc set action */
+                break;
+
+        case CMD_ACT_GET:
+                break;
+        default:
+                lbs_deb_11d("invalid action:%d\n", domaininfo->action);
+                ret = -1;
+                break;
+        }
+
+        lbs_deb_leave_args(LBS_DEB_11D, "ret %d", ret);
+        return ret;
+}
+
 static inline int handle_cmd_response(struct lbs_private *priv,
                                       struct cmd_header *cmd_response)
 {
@@ -150,6 +176,10 @@ static inline int handle_cmd_response(struct lbs_private *priv,
                 ret = lbs_ret_802_11_rssi(priv, resp);
                 break;
 
+        case CMD_RET(CMD_802_11D_DOMAIN_INFO):
+                ret = lbs_ret_802_11d_domain_info(resp);
+                break;
+
         case CMD_RET(CMD_802_11_TPC_CFG):
                 spin_lock_irqsave(&priv->driver_lock, flags);
                 memmove((void *)priv->cur_cmd->callback_arg, &resp->params.tpccfg,
@@ -261,7 +291,7 @@ int lbs_process_command_response(struct lbs_private *priv, u8 *data, u32 len)
                          * ad-hoc mode. It takes place in
                          * lbs_execute_next_command().
                          */
-                        if (priv->mode == IW_MODE_ADHOC &&
+                        if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR &&
                             action == CMD_SUBCMD_ENTER_PS)
                                 priv->psmode = LBS802_11POWERMODECAM;
                 } else if (action == CMD_SUBCMD_ENTER_PS) {
@@ -341,32 +371,10 @@ done:
         return ret;
 }
 
-static int lbs_send_confirmwake(struct lbs_private *priv)
-{
-        struct cmd_header cmd;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_HOST);
-
-        cmd.command = cpu_to_le16(CMD_802_11_WAKEUP_CONFIRM);
-        cmd.size = cpu_to_le16(sizeof(cmd));
-        cmd.seqnum = cpu_to_le16(++priv->seqnum);
-        cmd.result = 0;
-
-        lbs_deb_hex(LBS_DEB_HOST, "wake confirm", (u8 *) &cmd,
-                sizeof(cmd));
-
-        ret = priv->hw_host_to_card(priv, MVMS_CMD, (u8 *) &cmd, sizeof(cmd));
-        if (ret)
-                lbs_pr_alert("SEND_WAKEC_CMD: Host to Card failed for Confirm Wake\n");
-
-        lbs_deb_leave_args(LBS_DEB_HOST, "ret %d", ret);
-        return ret;
-}
-
 int lbs_process_event(struct lbs_private *priv, u32 event)
 {
         int ret = 0;
+        struct cmd_header cmd;
 
         lbs_deb_enter(LBS_DEB_CMD);
 
@@ -410,7 +418,10 @@ int lbs_process_event(struct lbs_private *priv, u32 event)
                 if (priv->reset_deep_sleep_wakeup)
                         priv->reset_deep_sleep_wakeup(priv);
                 priv->is_deep_sleep = 0;
-                lbs_send_confirmwake(priv);
+                lbs_cmd_async(priv, CMD_802_11_WAKEUP_CONFIRM, &cmd,
+                                sizeof(cmd));
+                priv->is_host_sleep_activated = 0;
+                wake_up_interruptible(&priv->host_sleep_q);
                 break;
 
         case MACREG_INT_CODE_DEEP_SLEEP_AWAKE:
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index de2caac11dd6..17367463c855 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -1,18 +1,13 @@
-#include <linux/module.h>
 #include <linux/dcache.h>
 #include <linux/debugfs.h>
 #include <linux/delay.h>
 #include <linux/mm.h>
 #include <linux/string.h>
 #include <linux/slab.h>
-#include <net/iw_handler.h>
-#include <net/lib80211.h>
 
-#include "dev.h"
 #include "decl.h"
-#include "host.h"
-#include "debugfs.h"
 #include "cmd.h"
+#include "debugfs.h"
 
 static struct dentry *lbs_dir;
 static char *szStates[] = {
@@ -60,51 +55,6 @@ static ssize_t lbs_dev_info(struct file *file, char __user *userbuf,
         return res;
 }
 
-
-static ssize_t lbs_getscantable(struct file *file, char __user *userbuf,
-                                  size_t count, loff_t *ppos)
-{
-        struct lbs_private *priv = file->private_data;
-        size_t pos = 0;
-        int numscansdone = 0, res;
-        unsigned long addr = get_zeroed_page(GFP_KERNEL);
-        char *buf = (char *)addr;
-        DECLARE_SSID_BUF(ssid);
-        struct bss_descriptor * iter_bss;
-        if (!buf)
-                return -ENOMEM;
-
-        pos += snprintf(buf+pos, len-pos,
-                "# | ch  | rssi |       bssid       |   cap    | Qual | SSID\n");
-
-        mutex_lock(&priv->lock);
-        list_for_each_entry (iter_bss, &priv->network_list, list) {
-                u16 ibss = (iter_bss->capability & WLAN_CAPABILITY_IBSS);
-                u16 privacy = (iter_bss->capability & WLAN_CAPABILITY_PRIVACY);
-                u16 spectrum_mgmt = (iter_bss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT);
-
-                pos += snprintf(buf+pos, len-pos, "%02u| %03d | %04d | %pM |",
-                        numscansdone, iter_bss->channel, iter_bss->rssi,
-                        iter_bss->bssid);
-                pos += snprintf(buf+pos, len-pos, " %04x-", iter_bss->capability);
-                pos += snprintf(buf+pos, len-pos, "%c%c%c |",
-                                ibss ? 'A' : 'I', privacy ? 'P' : ' ',
-                                spectrum_mgmt ? 'S' : ' ');
-                pos += snprintf(buf+pos, len-pos, " %04d |", SCAN_RSSI(iter_bss->rssi));
-                pos += snprintf(buf+pos, len-pos, " %s\n",
-                                print_ssid(ssid, iter_bss->ssid,
-                                           iter_bss->ssid_len));
-
-                numscansdone++;
-        }
-        mutex_unlock(&priv->lock);
-
-        res = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
-
-        free_page(addr);
-        return res;
-}
-
 static ssize_t lbs_sleepparams_write(struct file *file,
                                 const char __user *user_buf, size_t count,
                                 loff_t *ppos)
@@ -723,8 +673,6 @@ struct lbs_debugfs_files {
 
 static const struct lbs_debugfs_files debugfs_files[] = {
         { "info", 0444, FOPS(lbs_dev_info, write_file_dummy), },
-        { "getscantable", 0444, FOPS(lbs_getscantable,
-                                        write_file_dummy), },
         { "sleepparams", 0644, FOPS(lbs_sleepparams_read,
                                 lbs_sleepparams_write), },
 };
diff --git a/drivers/net/wireless/libertas/decl.h b/drivers/net/wireless/libertas/decl.h
index 709ffcad22ad..ba5438a7ba17 100644
--- a/drivers/net/wireless/libertas/decl.h
+++ b/drivers/net/wireless/libertas/decl.h
@@ -1,3 +1,4 @@
+
 /**
   *  This file contains declaration referring to
   *  functions defined in other source files
@@ -12,6 +13,7 @@
 struct lbs_private;
 struct sk_buff;
 struct net_device;
+struct cmd_ds_command;
 
 
 /* ethtool.c */
@@ -34,11 +36,13 @@ int lbs_start_card(struct lbs_private *priv);
 void lbs_stop_card(struct lbs_private *priv);
 void lbs_host_to_card_done(struct lbs_private *priv);
 
+int lbs_rtap_supported(struct lbs_private *priv);
+
 int lbs_set_mac_address(struct net_device *dev, void *addr);
 void lbs_set_multicast_list(struct net_device *dev);
 
 int lbs_suspend(struct lbs_private *priv);
-void lbs_resume(struct lbs_private *priv);
+int lbs_resume(struct lbs_private *priv);
 
 void lbs_queue_event(struct lbs_private *priv, u32 event);
 void lbs_notify_command_response(struct lbs_private *priv, u8 resp_idx);
@@ -49,5 +53,9 @@ int lbs_exit_auto_deep_sleep(struct lbs_private *priv);
 u32 lbs_fw_index_to_data_rate(u8 index);
 u8 lbs_data_rate_to_fw_index(u32 rate);
 
+int lbs_cmd_802_11d_domain_info(struct lbs_private *priv,
+                struct cmd_ds_command *cmd, u16 cmdoption);
+
+int lbs_ret_802_11d_domain_info(struct cmd_ds_command *resp);
 
 #endif
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index a54880e4ad2b..4536d9c0ad87 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -7,8 +7,8 @@
 #define _LBS_DEV_H_
 
 #include "mesh.h"
-#include "scan.h"
-#include "assoc.h"
+#include "defs.h"
+#include "host.h"
 
 #include <linux/kfifo.h>
 
@@ -29,7 +29,6 @@ struct lbs_private {
         /* Basic networking */
         struct net_device *dev;
         u32 connect_status;
-        int infra_open;
         struct work_struct mcast_work;
         u32 nr_of_multicastmacaddr;
         u8 multicastlist[MRVDRV_MAX_MULTICAST_LIST_SIZE][ETH_ALEN];
@@ -37,6 +36,9 @@ struct lbs_private {
         /* CFG80211 */
         struct wireless_dev *wdev;
         bool wiphy_registered;
+        struct cfg80211_scan_request *scan_req;
+        u8 assoc_bss[ETH_ALEN];
+        u8 disassoc_reason;
 
         /* Mesh */
         struct net_device *mesh_dev; /* Virtual device */
@@ -49,10 +51,6 @@ struct lbs_private {
         u8 mesh_ssid_len;
 #endif
 
-        /* Monitor mode */
-        struct net_device *rtap_net_dev;
-        u32 monitormode;
-
         /* Debugfs */
         struct dentry *debugfs_dir;
         struct dentry *debugfs_debug;
@@ -62,6 +60,9 @@ struct lbs_private {
         struct dentry *regs_dir;
         struct dentry *debugfs_regs_files[6];
 
+        /** 11D and domain regulatory data */
+        struct lbs_802_11d_domain_reg domain_reg;
+
         /* Hardware debugging */
         u32 mac_offset;
         u32 bbp_offset;
@@ -75,6 +76,7 @@ struct lbs_private {
 
         /* Deep sleep */
         int is_deep_sleep;
+        int deep_sleep_required;
         int is_auto_deep_sleep_enabled;
         int wakeup_dev_required;
         int is_activity_detected;
@@ -82,6 +84,11 @@ struct lbs_private {
         wait_queue_head_t ds_awake_q;
         struct timer_list auto_deepsleep_timer;
 
+        /* Host sleep*/
+        int is_host_sleep_configured;
+        int is_host_sleep_activated;
+        wait_queue_head_t host_sleep_q;
+
         /* Hardware access */
         void *card;
         u8 fw_ready;
@@ -127,14 +134,10 @@ struct lbs_private {
         struct workqueue_struct *work_thread;
 
         /** Encryption stuff */
-        struct lbs_802_11_security secinfo;
-        struct enc_key wpa_mcast_key;
-        struct enc_key wpa_unicast_key;
-        u8 wpa_ie[MAX_WPA_IE_LEN];
-        u8 wpa_ie_len;
-        u16 wep_tx_keyidx;
-        struct enc_key wep_keys[4];
         u8 authtype_auto;
+        u8 wep_tx_key;
+        u8 wep_key[4][WLAN_KEY_LEN_WEP104];
+        u8 wep_key_len[4];
 
         /* Wake On LAN */
         uint32_t wol_criteria;
@@ -155,6 +158,7 @@ struct lbs_private {
         /* NIC/link operation characteristics */
         u16 mac_control;
         u8 radio_on;
+        u8 cur_rate;
         u8 channel;
         s16 txpower_cur;
         s16 txpower_min;
@@ -163,42 +167,6 @@ struct lbs_private {
         /** Scanning */
         struct delayed_work scan_work;
         int scan_channel;
-        /* remember which channel was scanned last, != 0 if currently scanning */
-        u8 scan_ssid[IEEE80211_MAX_SSID_LEN + 1];
-        u8 scan_ssid_len;
-
-        /* Associating */
-        struct delayed_work assoc_work;
-        struct current_bss_params curbssparams;
-        u8 mode;
-        struct list_head network_list;
-        struct list_head network_free_list;
-        struct bss_descriptor *networks;
-        struct assoc_request * pending_assoc_req;
-        struct assoc_request * in_progress_assoc_req;
-        uint16_t enablehwauto;
-
-        /* ADHOC */
-        u16 beacon_period;
-        u8 beacon_enable;
-        u8 adhoccreate;
-
-        /* WEXT */
-        char name[DEV_NAME_LEN];
-        u8 nodename[16];
-        struct iw_statistics wstats;
-        u8 cur_rate;
-#define MAX_REGION_CHANNEL_NUM  2
-        struct region_channel region_channel[MAX_REGION_CHANNEL_NUM];
-
-        /** Requested Signal Strength*/
-        u16 SNR[MAX_TYPE_B][MAX_TYPE_AVG];
-        u16 NF[MAX_TYPE_B][MAX_TYPE_AVG];
-        u8 RSSI[MAX_TYPE_B][MAX_TYPE_AVG];
-        u8 rawSNR[DEFAULT_DATA_AVG_FACTOR];
-        u8 rawNF[DEFAULT_DATA_AVG_FACTOR];
-        u16 nextSNRNF;
-        u16 numSNRNF;
 };
 
 extern struct cmd_confirm_sleep confirm_sleep;
diff --git a/drivers/net/wireless/libertas/ethtool.c b/drivers/net/wireless/libertas/ethtool.c
index 3804a58d7f4e..50193aac679e 100644
--- a/drivers/net/wireless/libertas/ethtool.c
+++ b/drivers/net/wireless/libertas/ethtool.c
@@ -2,13 +2,8 @@
 #include <linux/ethtool.h>
 #include <linux/delay.h>
 
-#include "host.h"
 #include "decl.h"
-#include "defs.h"
-#include "dev.h"
-#include "wext.h"
 #include "cmd.h"
-#include "mesh.h"
 
 
 static void lbs_ethtool_get_drvinfo(struct net_device *dev,
@@ -69,14 +64,11 @@ static void lbs_ethtool_get_wol(struct net_device *dev,
 {
         struct lbs_private *priv = dev->ml_priv;
 
-        if (priv->wol_criteria == 0xffffffff) {
-                /* Interface driver didn't configure wake */
-                wol->supported = wol->wolopts = 0;
-                return;
-        }
-
         wol->supported = WAKE_UCAST|WAKE_MCAST|WAKE_BCAST|WAKE_PHY;
 
+        if (priv->wol_criteria == EHS_REMOVE_WAKEUP)
+                return;
+
         if (priv->wol_criteria & EHS_WAKE_ON_UNICAST_DATA)
                 wol->wolopts |= WAKE_UCAST;
         if (priv->wol_criteria & EHS_WAKE_ON_MULTICAST_DATA)
@@ -91,23 +83,22 @@ static int lbs_ethtool_set_wol(struct net_device *dev,
                                struct ethtool_wolinfo *wol)
 {
         struct lbs_private *priv = dev->ml_priv;
-        uint32_t criteria = 0;
 
         if (wol->wolopts & ~(WAKE_UCAST|WAKE_MCAST|WAKE_BCAST|WAKE_PHY))
                 return -EOPNOTSUPP;
 
+        priv->wol_criteria = 0;
         if (wol->wolopts & WAKE_UCAST)
-                criteria |= EHS_WAKE_ON_UNICAST_DATA;
+                priv->wol_criteria |= EHS_WAKE_ON_UNICAST_DATA;
         if (wol->wolopts & WAKE_MCAST)
-                criteria |= EHS_WAKE_ON_MULTICAST_DATA;
+                priv->wol_criteria |= EHS_WAKE_ON_MULTICAST_DATA;
         if (wol->wolopts & WAKE_BCAST)
-                criteria |= EHS_WAKE_ON_BROADCAST_DATA;
+                priv->wol_criteria |= EHS_WAKE_ON_BROADCAST_DATA;
         if (wol->wolopts & WAKE_PHY)
-                criteria |= EHS_WAKE_ON_MAC_EVENT;
+                priv->wol_criteria |= EHS_WAKE_ON_MAC_EVENT;
         if (wol->wolopts == 0)
-                criteria |= EHS_REMOVE_WAKEUP;
-
-        return lbs_host_sleep_cfg(priv, criteria, (struct wol_config *)NULL);
+                priv->wol_criteria |= EHS_REMOVE_WAKEUP;
+        return 0;
 }
 
 const struct ethtool_ops lbs_ethtool_ops = {
diff --git a/drivers/net/wireless/libertas/host.h b/drivers/net/wireless/libertas/host.h
index 3809c0b49464..112fbf167dc8 100644
--- a/drivers/net/wireless/libertas/host.h
+++ b/drivers/net/wireless/libertas/host.h
@@ -389,6 +389,30 @@ struct lbs_offset_value {
         u32 value;
 } __attribute__ ((packed));
 
+#define MRVDRV_MAX_TRIPLET_802_11D              83
+
+#define COUNTRY_CODE_LEN                        3
+
+struct mrvl_ie_domain_param_set {
+        struct mrvl_ie_header header;
+
+        u8 countrycode[COUNTRY_CODE_LEN];
+        struct ieee80211_country_ie_triplet triplet[1];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11d_domain_info {
+        __le16 action;
+        struct mrvl_ie_domain_param_set domain;
+} __attribute__ ((packed));
+
+struct lbs_802_11d_domain_reg {
+        /** Country code*/
+        u8 country_code[COUNTRY_CODE_LEN];
+        /** No. of triplet*/
+        u8 no_triplet;
+        struct ieee80211_country_ie_triplet triplet[MRVDRV_MAX_TRIPLET_802_11D];
+} __attribute__ ((packed));
+
 /*
  * Define data structure for CMD_GET_HW_SPEC
  * This structure defines the response for the GET_HW_SPEC command
@@ -949,6 +973,9 @@ struct cmd_ds_command {
                 struct cmd_ds_bbp_reg_access bbpreg;
                 struct cmd_ds_rf_reg_access rfreg;
 
+                struct cmd_ds_802_11d_domain_info domaininfo;
+                struct cmd_ds_802_11d_domain_info domaininforesp;
+
                 struct cmd_ds_802_11_tpc_cfg tpccfg;
                 struct cmd_ds_802_11_afc afc;
                 struct cmd_ds_802_11_led_ctrl ledgpio;
@@ -958,5 +985,4 @@ struct cmd_ds_command {
                 struct cmd_ds_802_11_beacon_control bcn_ctrl;
         } params;
 } __attribute__ ((packed));
-
 #endif
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 64dd345d30f5..6e71346a7550 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -1182,11 +1182,69 @@ static void if_sdio_remove(struct sdio_func *func)
         lbs_deb_leave(LBS_DEB_SDIO);
 }
 
+static int if_sdio_suspend(struct device *dev)
+{
+        struct sdio_func *func = dev_to_sdio_func(dev);
+        int ret;
+        struct if_sdio_card *card = sdio_get_drvdata(func);
+
+        mmc_pm_flag_t flags = sdio_get_host_pm_caps(func);
+
+        lbs_pr_info("%s: suspend: PM flags = 0x%x\n",
+                                                sdio_func_id(func), flags);
+
+        /* If we aren't being asked to wake on anything, we should bail out
+         * and let the SD stack power down the card.
+         */
+        if (card->priv->wol_criteria == EHS_REMOVE_WAKEUP) {
+                lbs_pr_info("Suspend without wake params -- "
+                                                "powering down card.");
+                return -ENOSYS;
+        }
+
+        if (!(flags & MMC_PM_KEEP_POWER)) {
+                lbs_pr_err("%s: cannot remain alive while host is suspended\n",
+                        sdio_func_id(func));
+                return -ENOSYS;
+        }
+
+        ret = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
+        if (ret)
+                return ret;
+
+        ret = lbs_suspend(card->priv);
+        if (ret)
+                return ret;
+
+        return sdio_set_host_pm_flags(func, MMC_PM_WAKE_SDIO_IRQ);
+}
+
+static int if_sdio_resume(struct device *dev)
+{
+        struct sdio_func *func = dev_to_sdio_func(dev);
+        struct if_sdio_card *card = sdio_get_drvdata(func);
+        int ret;
+
+        lbs_pr_info("%s: resume: we're back\n", sdio_func_id(func));
+
+        ret = lbs_resume(card->priv);
+
+        return ret;
+}
+
+static const struct dev_pm_ops if_sdio_pm_ops = {
+        .suspend        = if_sdio_suspend,
+        .resume         = if_sdio_resume,
+};
+
 static struct sdio_driver if_sdio_driver = {
         .name           = "libertas_sdio",
         .id_table       = if_sdio_ids,
         .probe          = if_sdio_probe,
         .remove         = if_sdio_remove,
+        .drv = {
+                .pm = &if_sdio_pm_ops,
+        },
 };
 
 /*******************************************************************/
diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
index f41594c7ac16..3678e532874f 100644
--- a/drivers/net/wireless/libertas/if_usb.c
+++ b/drivers/net/wireless/libertas/if_usb.c
@@ -613,16 +613,14 @@ static void if_usb_receive_fwload(struct urb *urb)
                 return;
         }
 
-        syncfwheader = kmalloc(sizeof(struct fwsyncheader), GFP_ATOMIC);
+        syncfwheader = kmemdup(skb->data + IPFIELD_ALIGN_OFFSET,
+                               sizeof(struct fwsyncheader), GFP_ATOMIC);
         if (!syncfwheader) {
                 lbs_deb_usbd(&cardp->udev->dev, "Failure to allocate syncfwheader\n");
                 kfree_skb(skb);
                 return;
         }
 
-        memcpy(syncfwheader, skb->data + IPFIELD_ALIGN_OFFSET,
-               sizeof(struct fwsyncheader));
-
         if (!syncfwheader->cmd) {
                 lbs_deb_usb2(&cardp->udev->dev, "FW received Blk with correct CRC\n");
                 lbs_deb_usb2(&cardp->udev->dev, "FW received Blk seqnum = %d\n",
@@ -1043,6 +1041,12 @@ static int if_usb_suspend(struct usb_interface *intf, pm_message_t message)
         if (priv->psstate != PS_STATE_FULL_POWER)
                 return -1;
 
+        if (priv->wol_criteria == EHS_REMOVE_WAKEUP) {
+                lbs_pr_info("Suspend attempt without "
+                                                "configuring wake params!\n");
+                return -ENOSYS;
+        }
+
         ret = lbs_suspend(priv);
         if (ret)
                 goto out;
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index d9b8ee130c45..b519fc70f04f 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -11,20 +11,14 @@
 #include <linux/if_arp.h>
 #include <linux/kthread.h>
 #include <linux/kfifo.h>
-#include <linux/stddef.h>
-#include <linux/ieee80211.h>
 #include <linux/slab.h>
-#include <net/iw_handler.h>
 #include <net/cfg80211.h>
 
 #include "host.h"
 #include "decl.h"
 #include "dev.h"
-#include "wext.h"
 #include "cfg.h"
 #include "debugfs.h"
-#include "scan.h"
-#include "assoc.h"
 #include "cmd.h"
 
 #define DRIVER_RELEASE_VERSION "323.p0"
@@ -96,72 +90,6 @@ u8 lbs_data_rate_to_fw_index(u32 rate)
 }
 
 
-static int lbs_add_rtap(struct lbs_private *priv);
-static void lbs_remove_rtap(struct lbs_private *priv);
-
-
-/**
- * Get function for sysfs attribute rtap
- */
-static ssize_t lbs_rtap_get(struct device *dev,
-                struct device_attribute *attr, char * buf)
-{
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-        return snprintf(buf, 5, "0x%X\n", priv->monitormode);
-}
-
-/**
- *  Set function for sysfs attribute rtap
- */
-static ssize_t lbs_rtap_set(struct device *dev,
-                struct device_attribute *attr, const char * buf, size_t count)
-{
-        int monitor_mode;
-        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
-
-        sscanf(buf, "%x", &monitor_mode);
-        if (monitor_mode) {
-                if (priv->monitormode == monitor_mode)
-                        return strlen(buf);
-                if (!priv->monitormode) {
-                        if (priv->infra_open || lbs_mesh_open(priv))
-                                return -EBUSY;
-                        if (priv->mode == IW_MODE_INFRA)
-                                lbs_cmd_80211_deauthenticate(priv,
-                                                             priv->curbssparams.bssid,
-                                                             WLAN_REASON_DEAUTH_LEAVING);
-                        else if (priv->mode == IW_MODE_ADHOC)
-                                lbs_adhoc_stop(priv);
-                        lbs_add_rtap(priv);
-                }
-                priv->monitormode = monitor_mode;
-        } else {
-                if (!priv->monitormode)
-                        return strlen(buf);
-                priv->monitormode = 0;
-                lbs_remove_rtap(priv);
-
-                if (priv->currenttxskb) {
-                        dev_kfree_skb_any(priv->currenttxskb);
-                        priv->currenttxskb = NULL;
-                }
-
-                /* Wake queues, command thread, etc. */
-                lbs_host_to_card_done(priv);
-        }
-
-        lbs_prepare_and_send_command(priv,
-                        CMD_802_11_MONITOR_MODE, CMD_ACT_SET,
-                        CMD_OPTION_WAITFORRSP, 0, &priv->monitormode);
-        return strlen(buf);
-}
-
-/**
- * lbs_rtap attribute to be exported per ethX interface
- * through sysfs (/sys/class/net/ethX/lbs_rtap)
- */
-static DEVICE_ATTR(lbs_rtap, 0644, lbs_rtap_get, lbs_rtap_set );
-
 /**
  *  @brief This function opens the ethX interface
  *
@@ -177,13 +105,6 @@ static int lbs_dev_open(struct net_device *dev)
 
         spin_lock_irq(&priv->driver_lock);
 
-        if (priv->monitormode) {
-                ret = -EBUSY;
-                goto out;
-        }
-
-        priv->infra_open = 1;
-
         if (priv->connect_status == LBS_CONNECTED)
                 netif_carrier_on(dev);
         else
@@ -191,7 +112,6 @@ static int lbs_dev_open(struct net_device *dev)
 
         if (!priv->tx_pending_len)
                 netif_wake_queue(dev);
- out:
 
         spin_unlock_irq(&priv->driver_lock);
         lbs_deb_leave_args(LBS_DEB_NET, "ret %d", ret);
@@ -211,7 +131,6 @@ static int lbs_eth_stop(struct net_device *dev)
         lbs_deb_enter(LBS_DEB_NET);
 
         spin_lock_irq(&priv->driver_lock);
-        priv->infra_open = 0;
         netif_stop_queue(dev);
         spin_unlock_irq(&priv->driver_lock);
 
@@ -625,16 +544,13 @@ static int lbs_thread(void *data)
         return 0;
 }
 
-static int lbs_suspend_callback(struct lbs_private *priv, unsigned long dummy,
-                                struct cmd_header *cmd)
+static int lbs_ret_host_sleep_activate(struct lbs_private *priv,
+                unsigned long dummy,
+                struct cmd_header *cmd)
 {
         lbs_deb_enter(LBS_DEB_FW);
-
-        netif_device_detach(priv->dev);
-        if (priv->mesh_dev)
-                netif_device_detach(priv->mesh_dev);
-
-        priv->fw_ready = 0;
+        priv->is_host_sleep_activated = 1;
+        wake_up_interruptible(&priv->host_sleep_q);
         lbs_deb_leave(LBS_DEB_FW);
         return 0;
 }
@@ -646,39 +562,65 @@ int lbs_suspend(struct lbs_private *priv)
 
         lbs_deb_enter(LBS_DEB_FW);
 
-        if (priv->wol_criteria == 0xffffffff) {
-                lbs_pr_info("Suspend attempt without configuring wake params!\n");
-                return -EINVAL;
+        if (priv->is_deep_sleep) {
+                ret = lbs_set_deep_sleep(priv, 0);
+                if (ret) {
+                        lbs_pr_err("deep sleep cancellation failed: %d\n", ret);
+                        return ret;
+                }
+                priv->deep_sleep_required = 1;
         }
 
         memset(&cmd, 0, sizeof(cmd));
+        ret = lbs_host_sleep_cfg(priv, priv->wol_criteria,
+                                                (struct wol_config *)NULL);
+        if (ret) {
+                lbs_pr_info("Host sleep configuration failed: %d\n", ret);
+                return ret;
+        }
+        if (priv->psstate == PS_STATE_FULL_POWER) {
+                ret = __lbs_cmd(priv, CMD_802_11_HOST_SLEEP_ACTIVATE, &cmd,
+                                sizeof(cmd), lbs_ret_host_sleep_activate, 0);
+                if (ret)
+                        lbs_pr_info("HOST_SLEEP_ACTIVATE failed: %d\n", ret);
+        }
 
-        ret = __lbs_cmd(priv, CMD_802_11_HOST_SLEEP_ACTIVATE, &cmd,
-                        sizeof(cmd), lbs_suspend_callback, 0);
-        if (ret)
-                lbs_pr_info("HOST_SLEEP_ACTIVATE failed: %d\n", ret);
+        if (!wait_event_interruptible_timeout(priv->host_sleep_q,
+                                priv->is_host_sleep_activated, (10 * HZ))) {
+                lbs_pr_err("host_sleep_q: timer expired\n");
+                ret = -1;
+        }
+        netif_device_detach(priv->dev);
+        if (priv->mesh_dev)
+                netif_device_detach(priv->mesh_dev);
 
         lbs_deb_leave_args(LBS_DEB_FW, "ret %d", ret);
         return ret;
 }
 EXPORT_SYMBOL_GPL(lbs_suspend);
 
-void lbs_resume(struct lbs_private *priv)
+int lbs_resume(struct lbs_private *priv)
 {
-        lbs_deb_enter(LBS_DEB_FW);
+        int ret;
+        uint32_t criteria = EHS_REMOVE_WAKEUP;
 
-        priv->fw_ready = 1;
+        lbs_deb_enter(LBS_DEB_FW);
 
-        /* Firmware doesn't seem to give us RX packets any more
-           until we send it some command. Might as well update */
-        lbs_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
-                                     0, 0, NULL);
+        ret = lbs_host_sleep_cfg(priv, criteria, (struct wol_config *)NULL);
 
         netif_device_attach(priv->dev);
         if (priv->mesh_dev)
                 netif_device_attach(priv->mesh_dev);
 
-        lbs_deb_leave(LBS_DEB_FW);
+        if (priv->deep_sleep_required) {
+                priv->deep_sleep_required = 0;
+                ret = lbs_set_deep_sleep(priv, 1);
+                if (ret)
+                        lbs_pr_err("deep sleep activation failed: %d\n", ret);
+        }
+
+        lbs_deb_leave_args(LBS_DEB_FW, "ret %d", ret);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(lbs_resume);
 
@@ -710,6 +652,9 @@ static int lbs_setup_firmware(struct lbs_private *priv)
                 priv->txpower_max = maxlevel;
         }
 
+        /* Send cmd to FW to enable 11D function */
+        ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_11D_ENABLE, 1);
+
         lbs_set_mac_control(priv);
 done:
         lbs_deb_leave_args(LBS_DEB_FW, "ret %d", ret);
@@ -799,45 +744,27 @@ int lbs_exit_auto_deep_sleep(struct lbs_private *priv)
 
 static int lbs_init_adapter(struct lbs_private *priv)
 {
-        size_t bufsize;
-        int i, ret = 0;
+        int ret;
 
         lbs_deb_enter(LBS_DEB_MAIN);
 
-        /* Allocate buffer to store the BSSID list */
-        bufsize = MAX_NETWORK_COUNT * sizeof(struct bss_descriptor);
-        priv->networks = kzalloc(bufsize, GFP_KERNEL);
-        if (!priv->networks) {
-                lbs_pr_err("Out of memory allocating beacons\n");
-                ret = -1;
-                goto out;
-        }
-
-        /* Initialize scan result lists */
-        INIT_LIST_HEAD(&priv->network_free_list);
-        INIT_LIST_HEAD(&priv->network_list);
-        for (i = 0; i < MAX_NETWORK_COUNT; i++) {
-                list_add_tail(&priv->networks[i].list,
-                              &priv->network_free_list);
-        }
-
         memset(priv->current_addr, 0xff, ETH_ALEN);
 
         priv->connect_status = LBS_DISCONNECTED;
-        priv->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
-        priv->mode = IW_MODE_INFRA;
         priv->channel = DEFAULT_AD_HOC_CHANNEL;
         priv->mac_control = CMD_ACT_MAC_RX_ON | CMD_ACT_MAC_TX_ON;
         priv->radio_on = 1;
-        priv->enablehwauto = 1;
         priv->psmode = LBS802_11POWERMODECAM;
         priv->psstate = PS_STATE_FULL_POWER;
         priv->is_deep_sleep = 0;
         priv->is_auto_deep_sleep_enabled = 0;
+        priv->deep_sleep_required = 0;
         priv->wakeup_dev_required = 0;
         init_waitqueue_head(&priv->ds_awake_q);
         priv->authtype_auto = 1;
-
+        priv->is_host_sleep_configured = 0;
+        priv->is_host_sleep_activated = 0;
+        init_waitqueue_head(&priv->host_sleep_q);
         mutex_init(&priv->lock);
 
         setup_timer(&priv->command_timer, lbs_cmd_timeout_handler,
@@ -881,8 +808,6 @@ static void lbs_free_adapter(struct lbs_private *priv)
         kfifo_free(&priv->event_fifo);
         del_timer(&priv->command_timer);
         del_timer(&priv->auto_deepsleep_timer);
-        kfree(priv->networks);
-        priv->networks = NULL;
 
         lbs_deb_leave(LBS_DEB_MAIN);
 }
@@ -919,7 +844,7 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
                 lbs_pr_err("cfg80211 init failed\n");
                 goto done;
         }
-        /* TODO? */
+
         wdev->iftype = NL80211_IFTYPE_STATION;
         priv = wdev_priv(wdev);
         priv->wdev = wdev;
@@ -929,7 +854,6 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
                 goto err_wdev;
         }
 
-        //TODO? dev = alloc_netdev_mq(0, "wlan%d", ether_setup, IWM_TX_QUEUES);
         dev = alloc_netdev(0, "wlan%d", ether_setup);
         if (!dev) {
                 dev_err(dmdev, "no memory for network device instance\n");
@@ -945,20 +869,10 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
         dev->netdev_ops = &lbs_netdev_ops;
         dev->watchdog_timeo = 5 * HZ;
         dev->ethtool_ops = &lbs_ethtool_ops;
-#ifdef  WIRELESS_EXT
-        dev->wireless_handlers = &lbs_handler_def;
-#endif
         dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
 
-
-        // TODO: kzalloc + iwm_init_default_profile(iwm, iwm->umac_profile); ??
-
-
         priv->card = card;
-        priv->infra_open = 0;
 
-
-        priv->rtap_net_dev = NULL;
         strcpy(dev->name, "wlan%d");
 
         lbs_deb_thread("Starting main thread...\n");
@@ -970,12 +884,11 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
         }
 
         priv->work_thread = create_singlethread_workqueue("lbs_worker");
-        INIT_DELAYED_WORK(&priv->assoc_work, lbs_association_worker);
-        INIT_DELAYED_WORK(&priv->scan_work, lbs_scan_worker);
         INIT_WORK(&priv->mcast_work, lbs_set_mcast_worker);
 
         priv->wol_criteria = 0xffffffff;
         priv->wol_gpio = 0xff;
+        priv->wol_gap = 20;
 
         goto done;
 
@@ -1004,12 +917,10 @@ void lbs_remove_card(struct lbs_private *priv)
         lbs_deb_enter(LBS_DEB_MAIN);
 
         lbs_remove_mesh(priv);
-        lbs_remove_rtap(priv);
+        lbs_scan_deinit(priv);
 
         dev = priv->dev;
 
-        cancel_delayed_work_sync(&priv->scan_work);
-        cancel_delayed_work_sync(&priv->assoc_work);
         cancel_work_sync(&priv->mcast_work);
 
         /* worker thread destruction blocks on the in-flight command which
@@ -1024,13 +935,15 @@ void lbs_remove_card(struct lbs_private *priv)
                 lbs_ps_wakeup(priv, CMD_OPTION_WAITFORRSP);
         }
 
-        lbs_send_disconnect_notification(priv);
-
         if (priv->is_deep_sleep) {
                 priv->is_deep_sleep = 0;
                 wake_up_interruptible(&priv->ds_awake_q);
         }
 
+        priv->is_host_sleep_configured = 0;
+        priv->is_host_sleep_activated = 0;
+        wake_up_interruptible(&priv->host_sleep_q);
+
         /* Stop the thread servicing the interrupts */
         priv->surpriseremoved = 1;
         kthread_stop(priv->main_thread);
@@ -1046,7 +959,7 @@ void lbs_remove_card(struct lbs_private *priv)
 EXPORT_SYMBOL_GPL(lbs_remove_card);
 
 
-static int lbs_rtap_supported(struct lbs_private *priv)
+int lbs_rtap_supported(struct lbs_private *priv)
 {
         if (MRVL_FW_MAJOR_REV(priv->fwrelease) == MRVL_FW_V5)
                 return 1;
@@ -1078,16 +991,6 @@ int lbs_start_card(struct lbs_private *priv)
 
         lbs_init_mesh(priv);
 
-        /*
-         * While rtap isn't related to mesh, only mesh-enabled
-         * firmware implements the rtap functionality via
-         * CMD_802_11_MONITOR_MODE.
-         */
-        if (lbs_rtap_supported(priv)) {
-                if (device_create_file(&dev->dev, &dev_attr_lbs_rtap))
-                        lbs_pr_err("cannot register lbs_rtap attribute\n");
-        }
-
         lbs_debugfs_init_one(priv, dev);
 
         lbs_pr_info("%s: Marvell WLAN 802.11 adapter\n", dev->name);
@@ -1119,9 +1022,6 @@ void lbs_stop_card(struct lbs_private *priv)
         lbs_debugfs_remove_one(priv);
         lbs_deinit_mesh(priv);
 
-        if (lbs_rtap_supported(priv))
-                device_remove_file(&dev->dev, &dev_attr_lbs_rtap);
-
         /* Delete the timeout of the currently processing command */
         del_timer_sync(&priv->command_timer);
         del_timer_sync(&priv->auto_deepsleep_timer);
@@ -1208,87 +1108,6 @@ static void __exit lbs_exit_module(void)
         lbs_deb_leave(LBS_DEB_MAIN);
 }
 
-/*
- * rtap interface support fuctions
- */
-
-static int lbs_rtap_open(struct net_device *dev)
-{
-        /* Yes, _stop_ the queue. Because we don't support injection */
-        lbs_deb_enter(LBS_DEB_MAIN);
-        netif_carrier_off(dev);
-        netif_stop_queue(dev);
-        lbs_deb_leave(LBS_DEB_LEAVE);
-        return 0;
-}
-
-static int lbs_rtap_stop(struct net_device *dev)
-{
-        lbs_deb_enter(LBS_DEB_MAIN);
-        lbs_deb_leave(LBS_DEB_MAIN);
-        return 0;
-}
-
-static netdev_tx_t lbs_rtap_hard_start_xmit(struct sk_buff *skb,
-                                            struct net_device *dev)
-{
-        netif_stop_queue(dev);
-        return NETDEV_TX_BUSY;
-}
-
-static void lbs_remove_rtap(struct lbs_private *priv)
-{
-        lbs_deb_enter(LBS_DEB_MAIN);
-        if (priv->rtap_net_dev == NULL)
-                goto out;
-        unregister_netdev(priv->rtap_net_dev);
-        free_netdev(priv->rtap_net_dev);
-        priv->rtap_net_dev = NULL;
-out:
-        lbs_deb_leave(LBS_DEB_MAIN);
-}
-
-static const struct net_device_ops rtap_netdev_ops = {
-        .ndo_open = lbs_rtap_open,
-        .ndo_stop = lbs_rtap_stop,
-        .ndo_start_xmit = lbs_rtap_hard_start_xmit,
-};
-
-static int lbs_add_rtap(struct lbs_private *priv)
-{
-        int ret = 0;
-        struct net_device *rtap_dev;
-
-        lbs_deb_enter(LBS_DEB_MAIN);
-        if (priv->rtap_net_dev) {
-                ret = -EPERM;
-                goto out;
-        }
-
-        rtap_dev = alloc_netdev(0, "rtap%d", ether_setup);
-        if (rtap_dev == NULL) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        memcpy(rtap_dev->dev_addr, priv->current_addr, ETH_ALEN);
-        rtap_dev->type = ARPHRD_IEEE80211_RADIOTAP;
-        rtap_dev->netdev_ops = &rtap_netdev_ops;
-        rtap_dev->ml_priv = priv;
-        SET_NETDEV_DEV(rtap_dev, priv->dev->dev.parent);
-
-        ret = register_netdev(rtap_dev);
-        if (ret) {
-                free_netdev(rtap_dev);
-                goto out;
-        }
-        priv->rtap_net_dev = rtap_dev;
-
-out:
-        lbs_deb_leave_args(LBS_DEB_MAIN, "ret %d", ret);
-        return ret;
-}
-
 module_init(lbs_init_module);
 module_exit(lbs_exit_module);
 
diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c
index e385af1f4583..bc5bc1384c35 100644
--- a/drivers/net/wireless/libertas/mesh.c
+++ b/drivers/net/wireless/libertas/mesh.c
@@ -5,6 +5,7 @@
 #include <linux/if_arp.h>
 #include <linux/kthread.h>
 #include <linux/kfifo.h>
+#include <net/cfg80211.h>
 
 #include "mesh.h"
 #include "decl.h"
@@ -314,7 +315,7 @@ static int lbs_mesh_dev_open(struct net_device *dev)
 
         spin_lock_irq(&priv->driver_lock);
 
-        if (priv->monitormode) {
+        if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR) {
                 ret = -EBUSY;
                 goto out;
         }
@@ -369,9 +370,6 @@ int lbs_add_mesh(struct lbs_private *priv)
 
         SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent);
 
-#ifdef  WIRELESS_EXT
-        mesh_dev->wireless_handlers = &mesh_handler_def;
-#endif
         mesh_dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
         /* Register virtual mesh interface */
         ret = register_netdev(mesh_dev);
diff --git a/drivers/net/wireless/libertas/mesh.h b/drivers/net/wireless/libertas/mesh.h
index e2573303a328..84ea2481ff20 100644
--- a/drivers/net/wireless/libertas/mesh.h
+++ b/drivers/net/wireless/libertas/mesh.h
@@ -70,11 +70,6 @@ void lbs_persist_config_init(struct net_device *net);
 void lbs_persist_config_remove(struct net_device *net);
 
 
-/* WEXT handler */
-
-extern struct iw_handler_def mesh_handler_def;
-
-
 /* Ethtool statistics */
 
 struct ethtool_stats;
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index 7a377f5b7662..2163df01caed 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -4,12 +4,13 @@
 #include <linux/etherdevice.h>
 #include <linux/slab.h>
 #include <linux/types.h>
+#include <net/cfg80211.h>
 
+#include "defs.h"
 #include "host.h"
 #include "radiotap.h"
 #include "decl.h"
 #include "dev.h"
-#include "wext.h"
 
 struct eth803hdr {
         u8 dest_addr[6];
@@ -39,98 +40,6 @@ static int process_rxed_802_11_packet(struct lbs_private *priv,
         struct sk_buff *skb);
 
 /**
- *  @brief      This function computes the avgSNR .
- *
- *  @param      priv    A pointer to struct lbs_private structure
- *  @return     avgSNR
- */
-static u8 lbs_getavgsnr(struct lbs_private *priv)
-{
-        u8 i;
-        u16 temp = 0;
-        if (priv->numSNRNF == 0)
-                return 0;
-        for (i = 0; i < priv->numSNRNF; i++)
-                temp += priv->rawSNR[i];
-        return (u8) (temp / priv->numSNRNF);
-
-}
-
-/**
- *  @brief      This function computes the AvgNF
- *
- *  @param      priv    A pointer to struct lbs_private structure
- *  @return     AvgNF
- */
-static u8 lbs_getavgnf(struct lbs_private *priv)
-{
-        u8 i;
-        u16 temp = 0;
-        if (priv->numSNRNF == 0)
-                return 0;
-        for (i = 0; i < priv->numSNRNF; i++)
-                temp += priv->rawNF[i];
-        return (u8) (temp / priv->numSNRNF);
-
-}
-
-/**
- *  @brief      This function save the raw SNR/NF to our internel buffer
- *
- *  @param      priv    A pointer to struct lbs_private structure
- *  @param      prxpd   A pointer to rxpd structure of received packet
- *  @return     n/a
- */
-static void lbs_save_rawSNRNF(struct lbs_private *priv, struct rxpd *p_rx_pd)
-{
-        if (priv->numSNRNF < DEFAULT_DATA_AVG_FACTOR)
-                priv->numSNRNF++;
-        priv->rawSNR[priv->nextSNRNF] = p_rx_pd->snr;
-        priv->rawNF[priv->nextSNRNF] = p_rx_pd->nf;
-        priv->nextSNRNF++;
-        if (priv->nextSNRNF >= DEFAULT_DATA_AVG_FACTOR)
-                priv->nextSNRNF = 0;
-}
-
-/**
- *  @brief      This function computes the RSSI in received packet.
- *
- *  @param      priv    A pointer to struct lbs_private structure
- *  @param      prxpd   A pointer to rxpd structure of received packet
- *  @return     n/a
- */
-static void lbs_compute_rssi(struct lbs_private *priv, struct rxpd *p_rx_pd)
-{
-
-        lbs_deb_enter(LBS_DEB_RX);
-
-        lbs_deb_rx("rxpd: SNR %d, NF %d\n", p_rx_pd->snr, p_rx_pd->nf);
-        lbs_deb_rx("before computing SNR: SNR-avg = %d, NF-avg = %d\n",
-               priv->SNR[TYPE_RXPD][TYPE_AVG] / AVG_SCALE,
-               priv->NF[TYPE_RXPD][TYPE_AVG] / AVG_SCALE);
-
-        priv->SNR[TYPE_RXPD][TYPE_NOAVG] = p_rx_pd->snr;
-        priv->NF[TYPE_RXPD][TYPE_NOAVG] = p_rx_pd->nf;
-        lbs_save_rawSNRNF(priv, p_rx_pd);
-
-        priv->SNR[TYPE_RXPD][TYPE_AVG] = lbs_getavgsnr(priv) * AVG_SCALE;
-        priv->NF[TYPE_RXPD][TYPE_AVG] = lbs_getavgnf(priv) * AVG_SCALE;
-        lbs_deb_rx("after computing SNR: SNR-avg = %d, NF-avg = %d\n",
-               priv->SNR[TYPE_RXPD][TYPE_AVG] / AVG_SCALE,
-               priv->NF[TYPE_RXPD][TYPE_AVG] / AVG_SCALE);
-
-        priv->RSSI[TYPE_RXPD][TYPE_NOAVG] =
-            CAL_RSSI(priv->SNR[TYPE_RXPD][TYPE_NOAVG],
-                     priv->NF[TYPE_RXPD][TYPE_NOAVG]);
-
-        priv->RSSI[TYPE_RXPD][TYPE_AVG] =
-            CAL_RSSI(priv->SNR[TYPE_RXPD][TYPE_AVG] / AVG_SCALE,
-                     priv->NF[TYPE_RXPD][TYPE_AVG] / AVG_SCALE);
-
-        lbs_deb_leave(LBS_DEB_RX);
-}
-
-/**
  *  @brief This function processes received packet and forwards it
  *  to kernel/upper layer
  *
@@ -154,7 +63,7 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
 
         skb->ip_summed = CHECKSUM_NONE;
 
-        if (priv->monitormode)
+        if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR)
                 return process_rxed_802_11_packet(priv, skb);
 
         p_rx_pd = (struct rxpd *) skb->data;
@@ -225,13 +134,7 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
          */
         skb_pull(skb, hdrchop);
 
-        /* Take the data rate from the rxpd structure
-         * only if the rate is auto
-         */
-        if (priv->enablehwauto)
-                priv->cur_rate = lbs_fw_index_to_data_rate(p_rx_pd->rx_rate);
-
-        lbs_compute_rssi(priv, p_rx_pd);
+        priv->cur_rate = lbs_fw_index_to_data_rate(p_rx_pd->rx_rate);
 
         lbs_deb_rx("rx data: size of actual packet %d\n", skb->len);
         dev->stats.rx_bytes += skb->len;
@@ -352,20 +255,18 @@ static int process_rxed_802_11_packet(struct lbs_private *priv,
         pradiotap_hdr = (void *)skb_push(skb, sizeof(struct rx_radiotap_hdr));
         memcpy(pradiotap_hdr, &radiotap_hdr, sizeof(struct rx_radiotap_hdr));
 
-        /* Take the data rate from the rxpd structure
-         * only if the rate is auto
-         */
-        if (priv->enablehwauto)
-                priv->cur_rate = lbs_fw_index_to_data_rate(prxpd->rx_rate);
-
-        lbs_compute_rssi(priv, prxpd);
+        priv->cur_rate = lbs_fw_index_to_data_rate(prxpd->rx_rate);
 
         lbs_deb_rx("rx data: size of actual packet %d\n", skb->len);
         dev->stats.rx_bytes += skb->len;
         dev->stats.rx_packets++;
 
-        skb->protocol = eth_type_trans(skb, priv->rtap_net_dev);
-        netif_rx(skb);
+        skb->protocol = eth_type_trans(skb, priv->dev);
+
+        if (in_interrupt())
+                netif_rx(skb);
+        else
+                netif_rx_ni(skb);
 
         ret = 0;
 
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
deleted file mode 100644
index 24cd54b3a806..000000000000
--- a/drivers/net/wireless/libertas/scan.c
+++ /dev/null
@@ -1,1354 +0,0 @@
-/**
-  * Functions implementing wlan scan IOCTL and firmware command APIs
-  *
-  * IOCTL handlers as well as command preperation and response routines
-  *  for sending scan commands to the firmware.
-  */
-#include <linux/slab.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/etherdevice.h>
-#include <linux/if_arp.h>
-#include <asm/unaligned.h>
-#include <net/lib80211.h>
-
-#include "host.h"
-#include "dev.h"
-#include "scan.h"
-#include "assoc.h"
-#include "wext.h"
-#include "cmd.h"
-
-//! Approximate amount of data needed to pass a scan result back to iwlist
-#define MAX_SCAN_CELL_SIZE  (IW_EV_ADDR_LEN             \
-                             + IEEE80211_MAX_SSID_LEN   \
-                             + IW_EV_UINT_LEN           \
-                             + IW_EV_FREQ_LEN           \
-                             + IW_EV_QUAL_LEN           \
-                             + IEEE80211_MAX_SSID_LEN   \
-                             + IW_EV_PARAM_LEN          \
-                             + 40)      /* 40 for WPAIE */
-
-//! Memory needed to store a max sized channel List TLV for a firmware scan
-#define CHAN_TLV_MAX_SIZE  (sizeof(struct mrvl_ie_header)    \
-                            + (MRVDRV_MAX_CHANNELS_PER_SCAN     \
-                               * sizeof(struct chanscanparamset)))
-
-//! Memory needed to store a max number/size SSID TLV for a firmware scan
-#define SSID_TLV_MAX_SIZE  (1 * sizeof(struct mrvl_ie_ssid_param_set))
-
-//! Maximum memory needed for a cmd_ds_802_11_scan with all TLVs at max
-#define MAX_SCAN_CFG_ALLOC (sizeof(struct cmd_ds_802_11_scan)   \
-                            + CHAN_TLV_MAX_SIZE + SSID_TLV_MAX_SIZE)
-
-//! The maximum number of channels the firmware can scan per command
-#define MRVDRV_MAX_CHANNELS_PER_SCAN   14
-
-/**
- * @brief Number of channels to scan per firmware scan command issuance.
- *
- *  Number restricted to prevent hitting the limit on the amount of scan data
- *  returned in a single firmware scan command.
- */
-#define MRVDRV_CHANNELS_PER_SCAN_CMD   4
-
-//! Scan time specified in the channel TLV for each channel for passive scans
-#define MRVDRV_PASSIVE_SCAN_CHAN_TIME  100
-
-//! Scan time specified in the channel TLV for each channel for active scans
-#define MRVDRV_ACTIVE_SCAN_CHAN_TIME   100
-
-#define DEFAULT_MAX_SCAN_AGE (15 * HZ)
-
-static int lbs_ret_80211_scan(struct lbs_private *priv, unsigned long dummy,
-                              struct cmd_header *resp);
-
-/*********************************************************************/
-/*                                                                   */
-/*  Misc helper functions                                            */
-/*                                                                   */
-/*********************************************************************/
-
-/**
- *  @brief Unsets the MSB on basic rates
- *
- * Scan through an array and unset the MSB for basic data rates.
- *
- *  @param rates     buffer of data rates
- *  @param len       size of buffer
- */
-static void lbs_unset_basic_rate_flags(u8 *rates, size_t len)
-{
-        int i;
-
-        for (i = 0; i < len; i++)
-                rates[i] &= 0x7f;
-}
-
-
-static inline void clear_bss_descriptor(struct bss_descriptor *bss)
-{
-        /* Don't blow away ->list, just BSS data */
-        memset(bss, 0, offsetof(struct bss_descriptor, list));
-}
-
-/**
- *  @brief Compare two SSIDs
- *
- *  @param ssid1    A pointer to ssid to compare
- *  @param ssid2    A pointer to ssid to compare
- *
- *  @return         0: ssid is same, otherwise is different
- */
-int lbs_ssid_cmp(uint8_t *ssid1, uint8_t ssid1_len, uint8_t *ssid2,
-                 uint8_t ssid2_len)
-{
-        if (ssid1_len != ssid2_len)
-                return -1;
-
-        return memcmp(ssid1, ssid2, ssid1_len);
-}
-
-static inline int is_same_network(struct bss_descriptor *src,
-                                  struct bss_descriptor *dst)
-{
-        /* A network is only a duplicate if the channel, BSSID, and ESSID
-         * all match.  We treat all <hidden> with the same BSSID and channel
-         * as one network */
-        return ((src->ssid_len == dst->ssid_len) &&
-                (src->channel == dst->channel) &&
-                !compare_ether_addr(src->bssid, dst->bssid) &&
-                !memcmp(src->ssid, dst->ssid, src->ssid_len));
-}
-
-
-
-/*********************************************************************/
-/*                                                                   */
-/* Region channel support                                            */
-/*                                                                   */
-/*********************************************************************/
-
-#define LBS_TX_PWR_DEFAULT              20      /*100mW */
-#define LBS_TX_PWR_US_DEFAULT           20      /*100mW */
-#define LBS_TX_PWR_JP_DEFAULT           16      /*50mW */
-#define LBS_TX_PWR_FR_DEFAULT           20      /*100mW */
-#define LBS_TX_PWR_EMEA_DEFAULT 20      /*100mW */
-
-/* Format { channel, frequency (MHz), maxtxpower } */
-/* band: 'B/G', region: USA FCC/Canada IC */
-static struct chan_freq_power channel_freq_power_US_BG[] = {
-        {1, 2412, LBS_TX_PWR_US_DEFAULT},
-        {2, 2417, LBS_TX_PWR_US_DEFAULT},
-        {3, 2422, LBS_TX_PWR_US_DEFAULT},
-        {4, 2427, LBS_TX_PWR_US_DEFAULT},
-        {5, 2432, LBS_TX_PWR_US_DEFAULT},
-        {6, 2437, LBS_TX_PWR_US_DEFAULT},
-        {7, 2442, LBS_TX_PWR_US_DEFAULT},
-        {8, 2447, LBS_TX_PWR_US_DEFAULT},
-        {9, 2452, LBS_TX_PWR_US_DEFAULT},
-        {10, 2457, LBS_TX_PWR_US_DEFAULT},
-        {11, 2462, LBS_TX_PWR_US_DEFAULT}
-};
-
-/* band: 'B/G', region: Europe ETSI */
-static struct chan_freq_power channel_freq_power_EU_BG[] = {
-        {1, 2412, LBS_TX_PWR_EMEA_DEFAULT},
-        {2, 2417, LBS_TX_PWR_EMEA_DEFAULT},
-        {3, 2422, LBS_TX_PWR_EMEA_DEFAULT},
-        {4, 2427, LBS_TX_PWR_EMEA_DEFAULT},
-        {5, 2432, LBS_TX_PWR_EMEA_DEFAULT},
-        {6, 2437, LBS_TX_PWR_EMEA_DEFAULT},
-        {7, 2442, LBS_TX_PWR_EMEA_DEFAULT},
-        {8, 2447, LBS_TX_PWR_EMEA_DEFAULT},
-        {9, 2452, LBS_TX_PWR_EMEA_DEFAULT},
-        {10, 2457, LBS_TX_PWR_EMEA_DEFAULT},
-        {11, 2462, LBS_TX_PWR_EMEA_DEFAULT},
-        {12, 2467, LBS_TX_PWR_EMEA_DEFAULT},
-        {13, 2472, LBS_TX_PWR_EMEA_DEFAULT}
-};
-
-/* band: 'B/G', region: Spain */
-static struct chan_freq_power channel_freq_power_SPN_BG[] = {
-        {10, 2457, LBS_TX_PWR_DEFAULT},
-        {11, 2462, LBS_TX_PWR_DEFAULT}
-};
-
-/* band: 'B/G', region: France */
-static struct chan_freq_power channel_freq_power_FR_BG[] = {
-        {10, 2457, LBS_TX_PWR_FR_DEFAULT},
-        {11, 2462, LBS_TX_PWR_FR_DEFAULT},
-        {12, 2467, LBS_TX_PWR_FR_DEFAULT},
-        {13, 2472, LBS_TX_PWR_FR_DEFAULT}
-};
-
-/* band: 'B/G', region: Japan */
-static struct chan_freq_power channel_freq_power_JPN_BG[] = {
-        {1, 2412, LBS_TX_PWR_JP_DEFAULT},
-        {2, 2417, LBS_TX_PWR_JP_DEFAULT},
-        {3, 2422, LBS_TX_PWR_JP_DEFAULT},
-        {4, 2427, LBS_TX_PWR_JP_DEFAULT},
-        {5, 2432, LBS_TX_PWR_JP_DEFAULT},
-        {6, 2437, LBS_TX_PWR_JP_DEFAULT},
-        {7, 2442, LBS_TX_PWR_JP_DEFAULT},
-        {8, 2447, LBS_TX_PWR_JP_DEFAULT},
-        {9, 2452, LBS_TX_PWR_JP_DEFAULT},
-        {10, 2457, LBS_TX_PWR_JP_DEFAULT},
-        {11, 2462, LBS_TX_PWR_JP_DEFAULT},
-        {12, 2467, LBS_TX_PWR_JP_DEFAULT},
-        {13, 2472, LBS_TX_PWR_JP_DEFAULT},
-        {14, 2484, LBS_TX_PWR_JP_DEFAULT}
-};
-
-/**
- * the structure for channel, frequency and power
- */
-struct region_cfp_table {
-        u8 region;
-        struct chan_freq_power *cfp_BG;
-        int cfp_no_BG;
-};
-
-/**
- * the structure for the mapping between region and CFP
- */
-static struct region_cfp_table region_cfp_table[] = {
-        {0x10,                  /*US FCC */
-         channel_freq_power_US_BG,
-         ARRAY_SIZE(channel_freq_power_US_BG),
-         }
-        ,
-        {0x20,                  /*CANADA IC */
-         channel_freq_power_US_BG,
-         ARRAY_SIZE(channel_freq_power_US_BG),
-         }
-        ,
-        {0x30, /*EU*/ channel_freq_power_EU_BG,
-         ARRAY_SIZE(channel_freq_power_EU_BG),
-         }
-        ,
-        {0x31, /*SPAIN*/ channel_freq_power_SPN_BG,
-         ARRAY_SIZE(channel_freq_power_SPN_BG),
-         }
-        ,
-        {0x32, /*FRANCE*/ channel_freq_power_FR_BG,
-         ARRAY_SIZE(channel_freq_power_FR_BG),
-         }
-        ,
-        {0x40, /*JAPAN*/ channel_freq_power_JPN_BG,
-         ARRAY_SIZE(channel_freq_power_JPN_BG),
-         }
-        ,
-/*Add new region here */
-};
-
-/**
- *  @brief This function finds the CFP in
- *  region_cfp_table based on region and band parameter.
- *
- *  @param region  The region code
- *  @param band    The band
- *  @param cfp_no  A pointer to CFP number
- *  @return        A pointer to CFP
- */
-static struct chan_freq_power *lbs_get_region_cfp_table(u8 region, int *cfp_no)
-{
-        int i, end;
-
-        lbs_deb_enter(LBS_DEB_MAIN);
-
-        end = ARRAY_SIZE(region_cfp_table);
-
-        for (i = 0; i < end ; i++) {
-                lbs_deb_main("region_cfp_table[i].region=%d\n",
-                        region_cfp_table[i].region);
-                if (region_cfp_table[i].region == region) {
-                        *cfp_no = region_cfp_table[i].cfp_no_BG;
-                        lbs_deb_leave(LBS_DEB_MAIN);
-                        return region_cfp_table[i].cfp_BG;
-                }
-        }
-
-        lbs_deb_leave_args(LBS_DEB_MAIN, "ret NULL");
-        return NULL;
-}
-
-int lbs_set_regiontable(struct lbs_private *priv, u8 region, u8 band)
-{
-        int ret = 0;
-        int i = 0;
-
-        struct chan_freq_power *cfp;
-        int cfp_no;
-
-        lbs_deb_enter(LBS_DEB_MAIN);
-
-        memset(priv->region_channel, 0, sizeof(priv->region_channel));
-
-        cfp = lbs_get_region_cfp_table(region, &cfp_no);
-        if (cfp != NULL) {
-                priv->region_channel[i].nrcfp = cfp_no;
-                priv->region_channel[i].CFP = cfp;
-        } else {
-                lbs_deb_main("wrong region code %#x in band B/G\n",
-                       region);
-                ret = -1;
-                goto out;
-        }
-        priv->region_channel[i].valid = 1;
-        priv->region_channel[i].region = region;
-        priv->region_channel[i].band = band;
-        i++;
-out:
-        lbs_deb_leave_args(LBS_DEB_MAIN, "ret %d", ret);
-        return ret;
-}
-
-
-
-
-/*********************************************************************/
-/*                                                                   */
-/*  Main scanning support                                            */
-/*                                                                   */
-/*********************************************************************/
-
-/**
- *  @brief Create a channel list for the driver to scan based on region info
- *
- *  Only used from lbs_scan_setup_scan_config()
- *
- *  Use the driver region/band information to construct a comprehensive list
- *    of channels to scan.  This routine is used for any scan that is not
- *    provided a specific channel list to scan.
- *
- *  @param priv          A pointer to struct lbs_private structure
- *  @param scanchanlist  Output parameter: resulting channel list to scan
- *
- *  @return              void
- */
-static int lbs_scan_create_channel_list(struct lbs_private *priv,
-                                        struct chanscanparamset *scanchanlist)
-{
-        struct region_channel *scanregion;
-        struct chan_freq_power *cfp;
-        int rgnidx;
-        int chanidx;
-        int nextchan;
-        uint8_t scantype;
-
-        chanidx = 0;
-
-        /* Set the default scan type to the user specified type, will later
-         *   be changed to passive on a per channel basis if restricted by
-         *   regulatory requirements (11d or 11h)
-         */
-        scantype = CMD_SCAN_TYPE_ACTIVE;
-
-        for (rgnidx = 0; rgnidx < ARRAY_SIZE(priv->region_channel); rgnidx++) {
-                if (!priv->region_channel[rgnidx].valid)
-                        continue;
-                scanregion = &priv->region_channel[rgnidx];
-
-                for (nextchan = 0; nextchan < scanregion->nrcfp; nextchan++, chanidx++) {
-                        struct chanscanparamset *chan = &scanchanlist[chanidx];
-
-                        cfp = scanregion->CFP + nextchan;
-
-                        if (scanregion->band == BAND_B || scanregion->band == BAND_G)
-                                chan->radiotype = CMD_SCAN_RADIO_TYPE_BG;
-
-                        if (scantype == CMD_SCAN_TYPE_PASSIVE) {
-                                chan->maxscantime = cpu_to_le16(MRVDRV_PASSIVE_SCAN_CHAN_TIME);
-                                chan->chanscanmode.passivescan = 1;
-                        } else {
-                                chan->maxscantime = cpu_to_le16(MRVDRV_ACTIVE_SCAN_CHAN_TIME);
-                                chan->chanscanmode.passivescan = 0;
-                        }
-
-                        chan->channumber = cfp->channel;
-                }
-        }
-        return chanidx;
-}
-
-/*
- * Add SSID TLV of the form:
- *
- * TLV-ID SSID     00 00
- * length          06 00
- * ssid            4d 4e 54 45 53 54
- */
-static int lbs_scan_add_ssid_tlv(struct lbs_private *priv, u8 *tlv)
-{
-        struct mrvl_ie_ssid_param_set *ssid_tlv = (void *)tlv;
-
-        ssid_tlv->header.type = cpu_to_le16(TLV_TYPE_SSID);
-        ssid_tlv->header.len = cpu_to_le16(priv->scan_ssid_len);
-        memcpy(ssid_tlv->ssid, priv->scan_ssid, priv->scan_ssid_len);
-        return sizeof(ssid_tlv->header) + priv->scan_ssid_len;
-}
-
-/*
- * Add CHANLIST TLV of the form
- *
- * TLV-ID CHANLIST 01 01
- * length          5b 00
- * channel 1       00 01 00 00 00 64 00
- *   radio type    00
- *   channel          01
- *   scan type           00
- *   min scan time          00 00
- *   max scan time                64 00
- * channel 2       00 02 00 00 00 64 00
- * channel 3       00 03 00 00 00 64 00
- * channel 4       00 04 00 00 00 64 00
- * channel 5       00 05 00 00 00 64 00
- * channel 6       00 06 00 00 00 64 00
- * channel 7       00 07 00 00 00 64 00
- * channel 8       00 08 00 00 00 64 00
- * channel 9       00 09 00 00 00 64 00
- * channel 10      00 0a 00 00 00 64 00
- * channel 11      00 0b 00 00 00 64 00
- * channel 12      00 0c 00 00 00 64 00
- * channel 13      00 0d 00 00 00 64 00
- *
- */
-static int lbs_scan_add_chanlist_tlv(uint8_t *tlv,
-                                     struct chanscanparamset *chan_list,
-                                     int chan_count)
-{
-        size_t size = sizeof(struct chanscanparamset) *chan_count;
-        struct mrvl_ie_chanlist_param_set *chan_tlv = (void *)tlv;
-
-        chan_tlv->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
-        memcpy(chan_tlv->chanscanparam, chan_list, size);
-        chan_tlv->header.len = cpu_to_le16(size);
-        return sizeof(chan_tlv->header) + size;
-}
-
-/*
- * Add RATES TLV of the form
- *
- * TLV-ID RATES    01 00
- * length          0e 00
- * rates           82 84 8b 96 0c 12 18 24 30 48 60 6c
- *
- * The rates are in lbs_bg_rates[], but for the 802.11b
- * rates the high bit isn't set.
- */
-static int lbs_scan_add_rates_tlv(uint8_t *tlv)
-{
-        int i;
-        struct mrvl_ie_rates_param_set *rate_tlv = (void *)tlv;
-
-        rate_tlv->header.type = cpu_to_le16(TLV_TYPE_RATES);
-        tlv += sizeof(rate_tlv->header);
-        for (i = 0; i < MAX_RATES; i++) {
-                *tlv = lbs_bg_rates[i];
-                if (*tlv == 0)
-                        break;
-                /* This code makes sure that the 802.11b rates (1 MBit/s, 2
-                   MBit/s, 5.5 MBit/s and 11 MBit/s get's the high bit set.
-                   Note that the values are MBit/s * 2, to mark them as
-                   basic rates so that the firmware likes it better */
-                if (*tlv == 0x02 || *tlv == 0x04 ||
-                    *tlv == 0x0b || *tlv == 0x16)
-                        *tlv |= 0x80;
-                tlv++;
-        }
-        rate_tlv->header.len = cpu_to_le16(i);
-        return sizeof(rate_tlv->header) + i;
-}
-
-/*
- * Generate the CMD_802_11_SCAN command with the proper tlv
- * for a bunch of channels.
- */
-static int lbs_do_scan(struct lbs_private *priv, uint8_t bsstype,
-                       struct chanscanparamset *chan_list, int chan_count)
-{
-        int ret = -ENOMEM;
-        struct cmd_ds_802_11_scan *scan_cmd;
-        uint8_t *tlv;   /* pointer into our current, growing TLV storage area */
-
-        lbs_deb_enter_args(LBS_DEB_SCAN, "bsstype %d, chanlist[].chan %d, chan_count %d",
-                bsstype, chan_list ? chan_list[0].channumber : -1,
-                chan_count);
-
-        /* create the fixed part for scan command */
-        scan_cmd = kzalloc(MAX_SCAN_CFG_ALLOC, GFP_KERNEL);
-        if (scan_cmd == NULL)
-                goto out;
-
-        tlv = scan_cmd->tlvbuffer;
-        /* TODO: do we need to scan for a specific BSSID?
-        memcpy(scan_cmd->bssid, priv->scan_bssid, ETH_ALEN); */
-        scan_cmd->bsstype = bsstype;
-
-        /* add TLVs */
-        if (priv->scan_ssid_len)
-                tlv += lbs_scan_add_ssid_tlv(priv, tlv);
-        if (chan_list && chan_count)
-                tlv += lbs_scan_add_chanlist_tlv(tlv, chan_list, chan_count);
-        tlv += lbs_scan_add_rates_tlv(tlv);
-
-        /* This is the final data we are about to send */
-        scan_cmd->hdr.size = cpu_to_le16(tlv - (uint8_t *)scan_cmd);
-        lbs_deb_hex(LBS_DEB_SCAN, "SCAN_CMD", (void *)scan_cmd,
-                    sizeof(*scan_cmd));
-        lbs_deb_hex(LBS_DEB_SCAN, "SCAN_TLV", scan_cmd->tlvbuffer,
-                    tlv - scan_cmd->tlvbuffer);
-
-        ret = __lbs_cmd(priv, CMD_802_11_SCAN, &scan_cmd->hdr,
-                        le16_to_cpu(scan_cmd->hdr.size),
-                        lbs_ret_80211_scan, 0);
-
-out:
-        kfree(scan_cmd);
-        lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief Internal function used to start a scan based on an input config
- *
- *  Use the input user scan configuration information when provided in
- *    order to send the appropriate scan commands to firmware to populate or
- *    update the internal driver scan table
- *
- *  @param priv          A pointer to struct lbs_private structure
- *  @param full_scan     Do a full-scan (blocking)
- *
- *  @return              0 or < 0 if error
- */
-int lbs_scan_networks(struct lbs_private *priv, int full_scan)
-{
-        int ret = -ENOMEM;
-        struct chanscanparamset *chan_list;
-        struct chanscanparamset *curr_chans;
-        int chan_count;
-        uint8_t bsstype = CMD_BSS_TYPE_ANY;
-        int numchannels = MRVDRV_CHANNELS_PER_SCAN_CMD;
-        union iwreq_data wrqu;
-#ifdef CONFIG_LIBERTAS_DEBUG
-        struct bss_descriptor *iter;
-        int i = 0;
-        DECLARE_SSID_BUF(ssid);
-#endif
-
-        lbs_deb_enter_args(LBS_DEB_SCAN, "full_scan %d", full_scan);
-
-        /* Cancel any partial outstanding partial scans if this scan
-         * is a full scan.
-         */
-        if (full_scan && delayed_work_pending(&priv->scan_work))
-                cancel_delayed_work(&priv->scan_work);
-
-        /* User-specified bsstype or channel list
-        TODO: this can be implemented if some user-space application
-        need the feature. Formerly, it was accessible from debugfs,
-        but then nowhere used.
-        if (user_cfg) {
-                if (user_cfg->bsstype)
-                bsstype = user_cfg->bsstype;
-        } */
-
-        lbs_deb_scan("numchannels %d, bsstype %d\n", numchannels, bsstype);
-
-        /* Create list of channels to scan */
-        chan_list = kzalloc(sizeof(struct chanscanparamset) *
-                            LBS_IOCTL_USER_SCAN_CHAN_MAX, GFP_KERNEL);
-        if (!chan_list) {
-                lbs_pr_alert("SCAN: chan_list empty\n");
-                goto out;
-        }
-
-        /* We want to scan all channels */
-        chan_count = lbs_scan_create_channel_list(priv, chan_list);
-
-        netif_stop_queue(priv->dev);
-        if (priv->mesh_dev)
-                netif_stop_queue(priv->mesh_dev);
-
-        /* Prepare to continue an interrupted scan */
-        lbs_deb_scan("chan_count %d, scan_channel %d\n",
-                     chan_count, priv->scan_channel);
-        curr_chans = chan_list;
-        /* advance channel list by already-scanned-channels */
-        if (priv->scan_channel > 0) {
-                curr_chans += priv->scan_channel;
-                chan_count -= priv->scan_channel;
-        }
-
-        /* Send scan command(s)
-         * numchannels contains the number of channels we should maximally scan
-         * chan_count is the total number of channels to scan
-         */
-
-        while (chan_count) {
-                int to_scan = min(numchannels, chan_count);
-                lbs_deb_scan("scanning %d of %d channels\n",
-                             to_scan, chan_count);
-                ret = lbs_do_scan(priv, bsstype, curr_chans,
-                                  to_scan);
-                if (ret) {
-                        lbs_pr_err("SCAN_CMD failed\n");
-                        goto out2;
-                }
-                curr_chans += to_scan;
-                chan_count -= to_scan;
-
-                /* somehow schedule the next part of the scan */
-                if (chan_count && !full_scan &&
-                    !priv->surpriseremoved) {
-                        /* -1 marks just that we're currently scanning */
-                        if (priv->scan_channel < 0)
-                                priv->scan_channel = to_scan;
-                        else
-                                priv->scan_channel += to_scan;
-                        cancel_delayed_work(&priv->scan_work);
-                        queue_delayed_work(priv->work_thread, &priv->scan_work,
-                                           msecs_to_jiffies(300));
-                        /* skip over GIWSCAN event */
-                        goto out;
-                }
-
-        }
-        memset(&wrqu, 0, sizeof(union iwreq_data));
-        wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
-
-#ifdef CONFIG_LIBERTAS_DEBUG
-        /* Dump the scan table */
-        mutex_lock(&priv->lock);
-        lbs_deb_scan("scan table:\n");
-        list_for_each_entry(iter, &priv->network_list, list)
-                lbs_deb_scan("%02d: BSSID %pM, RSSI %d, SSID '%s'\n",
-                             i++, iter->bssid, iter->rssi,
-                             print_ssid(ssid, iter->ssid, iter->ssid_len));
-        mutex_unlock(&priv->lock);
-#endif
-
-out2:
-        priv->scan_channel = 0;
-
-out:
-        if (priv->connect_status == LBS_CONNECTED && !priv->tx_pending_len)
-                netif_wake_queue(priv->dev);
-
-        if (priv->mesh_dev && lbs_mesh_connected(priv) &&
-            !priv->tx_pending_len)
-                netif_wake_queue(priv->mesh_dev);
-
-        kfree(chan_list);
-
-        lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
-        return ret;
-}
-
-void lbs_scan_worker(struct work_struct *work)
-{
-        struct lbs_private *priv =
-                container_of(work, struct lbs_private, scan_work.work);
-
-        lbs_deb_enter(LBS_DEB_SCAN);
-        lbs_scan_networks(priv, 0);
-        lbs_deb_leave(LBS_DEB_SCAN);
-}
-
-
-/*********************************************************************/
-/*                                                                   */
-/*  Result interpretation                                            */
-/*                                                                   */
-/*********************************************************************/
-
-/**
- *  @brief Interpret a BSS scan response returned from the firmware
- *
- *  Parse the various fixed fields and IEs passed back for a a BSS probe
- *  response or beacon from the scan command.  Record information as needed
- *  in the scan table struct bss_descriptor for that entry.
- *
- *  @param bss  Output parameter: Pointer to the BSS Entry
- *
- *  @return             0 or -1
- */
-static int lbs_process_bss(struct bss_descriptor *bss,
-                           uint8_t **pbeaconinfo, int *bytesleft)
-{
-        struct ieee_ie_fh_param_set *fh;
-        struct ieee_ie_ds_param_set *ds;
-        struct ieee_ie_cf_param_set *cf;
-        struct ieee_ie_ibss_param_set *ibss;
-        DECLARE_SSID_BUF(ssid);
-        uint8_t *pos, *end, *p;
-        uint8_t n_ex_rates = 0, got_basic_rates = 0, n_basic_rates = 0;
-        uint16_t beaconsize = 0;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_SCAN);
-
-        if (*bytesleft >= sizeof(beaconsize)) {
-                /* Extract & convert beacon size from the command buffer */
-                beaconsize = get_unaligned_le16(*pbeaconinfo);
-                *bytesleft -= sizeof(beaconsize);
-                *pbeaconinfo += sizeof(beaconsize);
-        }
-
-        if (beaconsize == 0 || beaconsize > *bytesleft) {
-                *pbeaconinfo += *bytesleft;
-                *bytesleft = 0;
-                ret = -1;
-                goto done;
-        }
-
-        /* Initialize the current working beacon pointer for this BSS iteration */
-        pos = *pbeaconinfo;
-        end = pos + beaconsize;
-
-        /* Advance the return beacon pointer past the current beacon */
-        *pbeaconinfo += beaconsize;
-        *bytesleft -= beaconsize;
-
-        memcpy(bss->bssid, pos, ETH_ALEN);
-        lbs_deb_scan("process_bss: BSSID %pM\n", bss->bssid);
-        pos += ETH_ALEN;
-
-        if ((end - pos) < 12) {
-                lbs_deb_scan("process_bss: Not enough bytes left\n");
-                ret = -1;
-                goto done;
-        }
-
-        /*
-         * next 4 fields are RSSI, time stamp, beacon interval,
-         *   and capability information
-         */
-
-        /* RSSI is 1 byte long */
-        bss->rssi = *pos;
-        lbs_deb_scan("process_bss: RSSI %d\n", *pos);
-        pos++;
-
-        /* time stamp is 8 bytes long */
-        pos += 8;
-
-        /* beacon interval is 2 bytes long */
-        bss->beaconperiod = get_unaligned_le16(pos);
-        pos += 2;
-
-        /* capability information is 2 bytes long */
-        bss->capability = get_unaligned_le16(pos);
-        lbs_deb_scan("process_bss: capabilities 0x%04x\n", bss->capability);
-        pos += 2;
-
-        if (bss->capability & WLAN_CAPABILITY_PRIVACY)
-                lbs_deb_scan("process_bss: WEP enabled\n");
-        if (bss->capability & WLAN_CAPABILITY_IBSS)
-                bss->mode = IW_MODE_ADHOC;
-        else
-                bss->mode = IW_MODE_INFRA;
-
-        /* rest of the current buffer are IE's */
-        lbs_deb_scan("process_bss: IE len %zd\n", end - pos);
-        lbs_deb_hex(LBS_DEB_SCAN, "process_bss: IE info", pos, end - pos);
-
-        /* process variable IE */
-        while (pos <= end - 2) {
-                if (pos + pos[1] > end) {
-                        lbs_deb_scan("process_bss: error in processing IE, "
-                                     "bytes left < IE length\n");
-                        break;
-                }
-
-                switch (pos[0]) {
-                case WLAN_EID_SSID:
-                        bss->ssid_len = min_t(int, IEEE80211_MAX_SSID_LEN, pos[1]);
-                        memcpy(bss->ssid, pos + 2, bss->ssid_len);
-                        lbs_deb_scan("got SSID IE: '%s', len %u\n",
-                                     print_ssid(ssid, bss->ssid, bss->ssid_len),
-                                     bss->ssid_len);
-                        break;
-
-                case WLAN_EID_SUPP_RATES:
-                        n_basic_rates = min_t(uint8_t, MAX_RATES, pos[1]);
-                        memcpy(bss->rates, pos + 2, n_basic_rates);
-                        got_basic_rates = 1;
-                        lbs_deb_scan("got RATES IE\n");
-                        break;
-
-                case WLAN_EID_FH_PARAMS:
-                        fh = (struct ieee_ie_fh_param_set *) pos;
-                        memcpy(&bss->phy.fh, fh, sizeof(*fh));
-                        lbs_deb_scan("got FH IE\n");
-                        break;
-
-                case WLAN_EID_DS_PARAMS:
-                        ds = (struct ieee_ie_ds_param_set *) pos;
-                        bss->channel = ds->channel;
-                        memcpy(&bss->phy.ds, ds, sizeof(*ds));
-                        lbs_deb_scan("got DS IE, channel %d\n", bss->channel);
-                        break;
-
-                case WLAN_EID_CF_PARAMS:
-                        cf = (struct ieee_ie_cf_param_set *) pos;
-                        memcpy(&bss->ss.cf, cf, sizeof(*cf));
-                        lbs_deb_scan("got CF IE\n");
-                        break;
-
-                case WLAN_EID_IBSS_PARAMS:
-                        ibss = (struct ieee_ie_ibss_param_set *) pos;
-                        bss->atimwindow = ibss->atimwindow;
-                        memcpy(&bss->ss.ibss, ibss, sizeof(*ibss));
-                        lbs_deb_scan("got IBSS IE\n");
-                        break;
-
-                case WLAN_EID_EXT_SUPP_RATES:
-                        /* only process extended supported rate if data rate is
-                         * already found. Data rate IE should come before
-                         * extended supported rate IE
-                         */
-                        lbs_deb_scan("got RATESEX IE\n");
-                        if (!got_basic_rates) {
-                                lbs_deb_scan("... but ignoring it\n");
-                                break;
-                        }
-
-                        n_ex_rates = pos[1];
-                        if (n_basic_rates + n_ex_rates > MAX_RATES)
-                                n_ex_rates = MAX_RATES - n_basic_rates;
-
-                        p = bss->rates + n_basic_rates;
-                        memcpy(p, pos + 2, n_ex_rates);
-                        break;
-
-                case WLAN_EID_GENERIC:
-                        if (pos[1] >= 4 &&
-                            pos[2] == 0x00 && pos[3] == 0x50 &&
-                            pos[4] == 0xf2 && pos[5] == 0x01) {
-                                bss->wpa_ie_len = min(pos[1] + 2, MAX_WPA_IE_LEN);
-                                memcpy(bss->wpa_ie, pos, bss->wpa_ie_len);
-                                lbs_deb_scan("got WPA IE\n");
-                                lbs_deb_hex(LBS_DEB_SCAN, "WPA IE", bss->wpa_ie,
-                                            bss->wpa_ie_len);
-                        } else if (pos[1] >= MARVELL_MESH_IE_LENGTH &&
-                                   pos[2] == 0x00 && pos[3] == 0x50 &&
-                                   pos[4] == 0x43 && pos[5] == 0x04) {
-                                lbs_deb_scan("got mesh IE\n");
-                                bss->mesh = 1;
-                        } else {
-                                lbs_deb_scan("got generic IE: %02x:%02x:%02x:%02x, len %d\n",
-                                        pos[2], pos[3],
-                                        pos[4], pos[5],
-                                        pos[1]);
-                        }
-                        break;
-
-                case WLAN_EID_RSN:
-                        lbs_deb_scan("got RSN IE\n");
-                        bss->rsn_ie_len = min(pos[1] + 2, MAX_WPA_IE_LEN);
-                        memcpy(bss->rsn_ie, pos, bss->rsn_ie_len);
-                        lbs_deb_hex(LBS_DEB_SCAN, "process_bss: RSN_IE",
-                                    bss->rsn_ie, bss->rsn_ie_len);
-                        break;
-
-                default:
-                        lbs_deb_scan("got IE 0x%04x, len %d\n",
-                                     pos[0], pos[1]);
-                        break;
-                }
-
-                pos += pos[1] + 2;
-        }
-
-        /* Timestamp */
-        bss->last_scanned = jiffies;
-        lbs_unset_basic_rate_flags(bss->rates, sizeof(bss->rates));
-
-        ret = 0;
-
-done:
-        lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief Send a scan command for all available channels filtered on a spec
- *
- *  Used in association code and from debugfs
- *
- *  @param priv             A pointer to struct lbs_private structure
- *  @param ssid             A pointer to the SSID to scan for
- *  @param ssid_len         Length of the SSID
- *
- *  @return                0-success, otherwise fail
- */
-int lbs_send_specific_ssid_scan(struct lbs_private *priv, uint8_t *ssid,
-                                uint8_t ssid_len)
-{
-        DECLARE_SSID_BUF(ssid_buf);
-        int ret = 0;
-
-        lbs_deb_enter_args(LBS_DEB_SCAN, "SSID '%s'\n",
-                           print_ssid(ssid_buf, ssid, ssid_len));
-
-        if (!ssid_len)
-                goto out;
-
-        memcpy(priv->scan_ssid, ssid, ssid_len);
-        priv->scan_ssid_len = ssid_len;
-
-        lbs_scan_networks(priv, 1);
-        if (priv->surpriseremoved) {
-                ret = -1;
-                goto out;
-        }
-
-out:
-        lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
-        return ret;
-}
-
-
-
-
-/*********************************************************************/
-/*                                                                   */
-/*  Support for Wireless Extensions                                  */
-/*                                                                   */
-/*********************************************************************/
-
-
-#define MAX_CUSTOM_LEN 64
-
-static inline char *lbs_translate_scan(struct lbs_private *priv,
-                                            struct iw_request_info *info,
-                                            char *start, char *stop,
-                                            struct bss_descriptor *bss)
-{
-        struct chan_freq_power *cfp;
-        char *current_val;      /* For rates */
-        struct iw_event iwe;    /* Temporary buffer */
-        int j;
-#define PERFECT_RSSI ((uint8_t)50)
-#define WORST_RSSI   ((uint8_t)0)
-#define RSSI_DIFF    ((uint8_t)(PERFECT_RSSI - WORST_RSSI))
-        uint8_t rssi;
-
-        lbs_deb_enter(LBS_DEB_SCAN);
-
-        cfp = lbs_find_cfp_by_band_and_channel(priv, 0, bss->channel);
-        if (!cfp) {
-                lbs_deb_scan("Invalid channel number %d\n", bss->channel);
-                start = NULL;
-                goto out;
-        }
-
-        /* First entry *MUST* be the BSSID */
-        iwe.cmd = SIOCGIWAP;
-        iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-        memcpy(iwe.u.ap_addr.sa_data, &bss->bssid, ETH_ALEN);
-        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_ADDR_LEN);
-
-        /* SSID */
-        iwe.cmd = SIOCGIWESSID;
-        iwe.u.data.flags = 1;
-        iwe.u.data.length = min((uint32_t) bss->ssid_len, (uint32_t) IEEE80211_MAX_SSID_LEN);
-        start = iwe_stream_add_point(info, start, stop, &iwe, bss->ssid);
-
-        /* Mode */
-        iwe.cmd = SIOCGIWMODE;
-        iwe.u.mode = bss->mode;
-        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_UINT_LEN);
-
-        /* Frequency */
-        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = (long)cfp->freq * 100000;
-        iwe.u.freq.e = 1;
-        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_FREQ_LEN);
-
-        /* Add quality statistics */
-        iwe.cmd = IWEVQUAL;
-        iwe.u.qual.updated = IW_QUAL_ALL_UPDATED;
-        iwe.u.qual.level = SCAN_RSSI(bss->rssi);
-
-        rssi = iwe.u.qual.level - MRVDRV_NF_DEFAULT_SCAN_VALUE;
-        iwe.u.qual.qual =
-                (100 * RSSI_DIFF * RSSI_DIFF - (PERFECT_RSSI - rssi) *
-                 (15 * (RSSI_DIFF) + 62 * (PERFECT_RSSI - rssi))) /
-                (RSSI_DIFF * RSSI_DIFF);
-        if (iwe.u.qual.qual > 100)
-                iwe.u.qual.qual = 100;
-
-        if (priv->NF[TYPE_BEACON][TYPE_NOAVG] == 0) {
-                iwe.u.qual.noise = MRVDRV_NF_DEFAULT_SCAN_VALUE;
-        } else {
-                iwe.u.qual.noise = CAL_NF(priv->NF[TYPE_BEACON][TYPE_NOAVG]);
-        }
-
-        /* Locally created ad-hoc BSSs won't have beacons if this is the
-         * only station in the adhoc network; so get signal strength
-         * from receive statistics.
-         */
-        if ((priv->mode == IW_MODE_ADHOC) && priv->adhoccreate
-            && !lbs_ssid_cmp(priv->curbssparams.ssid,
-                             priv->curbssparams.ssid_len,
-                             bss->ssid, bss->ssid_len)) {
-                int snr, nf;
-                snr = priv->SNR[TYPE_RXPD][TYPE_AVG] / AVG_SCALE;
-                nf = priv->NF[TYPE_RXPD][TYPE_AVG] / AVG_SCALE;
-                iwe.u.qual.level = CAL_RSSI(snr, nf);
-        }
-        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_QUAL_LEN);
-
-        /* Add encryption capability */
-        iwe.cmd = SIOCGIWENCODE;
-        if (bss->capability & WLAN_CAPABILITY_PRIVACY) {
-                iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
-        } else {
-                iwe.u.data.flags = IW_ENCODE_DISABLED;
-        }
-        iwe.u.data.length = 0;
-        start = iwe_stream_add_point(info, start, stop, &iwe, bss->ssid);
-
-        current_val = start + iwe_stream_lcp_len(info);
-
-        iwe.cmd = SIOCGIWRATE;
-        iwe.u.bitrate.fixed = 0;
-        iwe.u.bitrate.disabled = 0;
-        iwe.u.bitrate.value = 0;
-
-        for (j = 0; j < ARRAY_SIZE(bss->rates) && bss->rates[j]; j++) {
-                /* Bit rate given in 500 kb/s units */
-                iwe.u.bitrate.value = bss->rates[j] * 500000;
-                current_val = iwe_stream_add_value(info, start, current_val,
-                                                   stop, &iwe, IW_EV_PARAM_LEN);
-        }
-        if ((bss->mode == IW_MODE_ADHOC) && priv->adhoccreate
-            && !lbs_ssid_cmp(priv->curbssparams.ssid,
-                             priv->curbssparams.ssid_len,
-                             bss->ssid, bss->ssid_len)) {
-                iwe.u.bitrate.value = 22 * 500000;
-                current_val = iwe_stream_add_value(info, start, current_val,
-                                                   stop, &iwe, IW_EV_PARAM_LEN);
-        }
-        /* Check if we added any event */
-        if ((current_val - start) > iwe_stream_lcp_len(info))
-                start = current_val;
-
-        memset(&iwe, 0, sizeof(iwe));
-        if (bss->wpa_ie_len) {
-                char buf[MAX_WPA_IE_LEN];
-                memcpy(buf, bss->wpa_ie, bss->wpa_ie_len);
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = bss->wpa_ie_len;
-                start = iwe_stream_add_point(info, start, stop, &iwe, buf);
-        }
-
-        memset(&iwe, 0, sizeof(iwe));
-        if (bss->rsn_ie_len) {
-                char buf[MAX_WPA_IE_LEN];
-                memcpy(buf, bss->rsn_ie, bss->rsn_ie_len);
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = bss->rsn_ie_len;
-                start = iwe_stream_add_point(info, start, stop, &iwe, buf);
-        }
-
-        if (bss->mesh) {
-                char custom[MAX_CUSTOM_LEN];
-                char *p = custom;
-
-                iwe.cmd = IWEVCUSTOM;
-                p += snprintf(p, MAX_CUSTOM_LEN, "mesh-type: olpc");
-                iwe.u.data.length = p - custom;
-                if (iwe.u.data.length)
-                        start = iwe_stream_add_point(info, start, stop,
-                                                     &iwe, custom);
-        }
-
-out:
-        lbs_deb_leave_args(LBS_DEB_SCAN, "start %p", start);
-        return start;
-}
-
-
-/**
- *  @brief Handle Scan Network ioctl
- *
- *  @param dev          A pointer to net_device structure
- *  @param info         A pointer to iw_request_info structure
- *  @param vwrq         A pointer to iw_param structure
- *  @param extra        A pointer to extra data buf
- *
- *  @return             0 --success, otherwise fail
- */
-int lbs_set_scan(struct net_device *dev, struct iw_request_info *info,
-                 union iwreq_data *wrqu, char *extra)
-{
-        DECLARE_SSID_BUF(ssid);
-        struct lbs_private *priv = dev->ml_priv;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (!priv->radio_on) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        if (!netif_running(dev)) {
-                ret = -ENETDOWN;
-                goto out;
-        }
-
-        /* mac80211 does this:
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->type != IEEE80211_IF_TYPE_xxx) {
-                ret = -EOPNOTSUPP;
-                goto out;
-        }
-        */
-
-        if (wrqu->data.length == sizeof(struct iw_scan_req) &&
-            wrqu->data.flags & IW_SCAN_THIS_ESSID) {
-                struct iw_scan_req *req = (struct iw_scan_req *)extra;
-                priv->scan_ssid_len = req->essid_len;
-                memcpy(priv->scan_ssid, req->essid, priv->scan_ssid_len);
-                lbs_deb_wext("set_scan, essid '%s'\n",
-                        print_ssid(ssid, priv->scan_ssid, priv->scan_ssid_len));
-        } else {
-                priv->scan_ssid_len = 0;
-        }
-
-        if (!delayed_work_pending(&priv->scan_work))
-                queue_delayed_work(priv->work_thread, &priv->scan_work,
-                                   msecs_to_jiffies(50));
-        /* set marker that currently a scan is taking place */
-        priv->scan_channel = -1;
-
-        if (priv->surpriseremoved)
-                ret = -EIO;
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-
-/**
- *  @brief  Handle Retrieve scan table ioctl
- *
- *  @param dev          A pointer to net_device structure
- *  @param info         A pointer to iw_request_info structure
- *  @param dwrq         A pointer to iw_point structure
- *  @param extra        A pointer to extra data buf
- *
- *  @return             0 --success, otherwise fail
- */
-int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
-                 struct iw_point *dwrq, char *extra)
-{
-#define SCAN_ITEM_SIZE 128
-        struct lbs_private *priv = dev->ml_priv;
-        int err = 0;
-        char *ev = extra;
-        char *stop = ev + dwrq->length;
-        struct bss_descriptor *iter_bss;
-        struct bss_descriptor *safe;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        /* iwlist should wait until the current scan is finished */
-        if (priv->scan_channel)
-                return -EAGAIN;
-
-        /* Update RSSI if current BSS is a locally created ad-hoc BSS */
-        if ((priv->mode == IW_MODE_ADHOC) && priv->adhoccreate) {
-                err = lbs_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
-                                CMD_OPTION_WAITFORRSP, 0, NULL);
-                if (err)
-                        goto out;
-        }
-
-        mutex_lock(&priv->lock);
-        list_for_each_entry_safe (iter_bss, safe, &priv->network_list, list) {
-                char *next_ev;
-                unsigned long stale_time;
-
-                if (stop - ev < SCAN_ITEM_SIZE) {
-                        err = -E2BIG;
-                        break;
-                }
-
-                /* For mesh device, list only mesh networks */
-                if (dev == priv->mesh_dev && !iter_bss->mesh)
-                        continue;
-
-                /* Prune old an old scan result */
-                stale_time = iter_bss->last_scanned + DEFAULT_MAX_SCAN_AGE;
-                if (time_after(jiffies, stale_time)) {
-                        list_move_tail(&iter_bss->list, &priv->network_free_list);
-                        clear_bss_descriptor(iter_bss);
-                        continue;
-                }
-
-                /* Translate to WE format this entry */
-                next_ev = lbs_translate_scan(priv, info, ev, stop, iter_bss);
-                if (next_ev == NULL)
-                        continue;
-                ev = next_ev;
-        }
-        mutex_unlock(&priv->lock);
-
-        dwrq->length = (ev - extra);
-        dwrq->flags = 0;
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", err);
-        return err;
-}
-
-
-
-
-/*********************************************************************/
-/*                                                                   */
-/*  Command execution                                                */
-/*                                                                   */
-/*********************************************************************/
-
-
-/**
- *  @brief This function handles the command response of scan
- *
- *  Called from handle_cmd_response() in cmdrespc.
- *
- *   The response buffer for the scan command has the following
- *      memory layout:
- *
- *     .-----------------------------------------------------------.
- *     |  header (4 * sizeof(u16)):  Standard command response hdr |
- *     .-----------------------------------------------------------.
- *     |  bufsize (u16) : sizeof the BSS Description data          |
- *     .-----------------------------------------------------------.
- *     |  NumOfSet (u8) : Number of BSS Descs returned             |
- *     .-----------------------------------------------------------.
- *     |  BSSDescription data (variable, size given in bufsize)    |
- *     .-----------------------------------------------------------.
- *     |  TLV data (variable, size calculated using header->size,  |
- *     |            bufsize and sizeof the fixed fields above)     |
- *     .-----------------------------------------------------------.
- *
- *  @param priv    A pointer to struct lbs_private structure
- *  @param resp    A pointer to cmd_ds_command
- *
- *  @return        0 or -1
- */
-static int lbs_ret_80211_scan(struct lbs_private *priv, unsigned long dummy,
-                              struct cmd_header *resp)
-{
-        struct cmd_ds_802_11_scan_rsp *scanresp = (void *)resp;
-        struct bss_descriptor *iter_bss;
-        struct bss_descriptor *safe;
-        uint8_t *bssinfo;
-        uint16_t scanrespsize;
-        int bytesleft;
-        int idx;
-        int tlvbufsize;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_SCAN);
-
-        /* Prune old entries from scan table */
-        list_for_each_entry_safe (iter_bss, safe, &priv->network_list, list) {
-                unsigned long stale_time = iter_bss->last_scanned + DEFAULT_MAX_SCAN_AGE;
-                if (time_before(jiffies, stale_time))
-                        continue;
-                list_move_tail (&iter_bss->list, &priv->network_free_list);
-                clear_bss_descriptor(iter_bss);
-        }
-
-        if (scanresp->nr_sets > MAX_NETWORK_COUNT) {
-                lbs_deb_scan("SCAN_RESP: too many scan results (%d, max %d)\n",
-                             scanresp->nr_sets, MAX_NETWORK_COUNT);
-                ret = -1;
-                goto done;
-        }
-
-        bytesleft = get_unaligned_le16(&scanresp->bssdescriptsize);
-        lbs_deb_scan("SCAN_RESP: bssdescriptsize %d\n", bytesleft);
-
-        scanrespsize = le16_to_cpu(resp->size);
-        lbs_deb_scan("SCAN_RESP: scan results %d\n", scanresp->nr_sets);
-
-        bssinfo = scanresp->bssdesc_and_tlvbuffer;
-
-        /* The size of the TLV buffer is equal to the entire command response
-         *   size (scanrespsize) minus the fixed fields (sizeof()'s), the
-         *   BSS Descriptions (bssdescriptsize as bytesLef) and the command
-         *   response header (sizeof(struct cmd_header))
-         */
-        tlvbufsize = scanrespsize - (bytesleft + sizeof(scanresp->bssdescriptsize)
-                                     + sizeof(scanresp->nr_sets)
-                                     + sizeof(struct cmd_header));
-
-        /*
-         *  Process each scan response returned (scanresp->nr_sets). Save
-         *    the information in the newbssentry and then insert into the
-         *    driver scan table either as an update to an existing entry
-         *    or as an addition at the end of the table
-         */
-        for (idx = 0; idx < scanresp->nr_sets && bytesleft; idx++) {
-                struct bss_descriptor new;
-                struct bss_descriptor *found = NULL;
-                struct bss_descriptor *oldest = NULL;
-
-                /* Process the data fields and IEs returned for this BSS */
-                memset(&new, 0, sizeof (struct bss_descriptor));
-                if (lbs_process_bss(&new, &bssinfo, &bytesleft) != 0) {
-                        /* error parsing the scan response, skipped */
-                        lbs_deb_scan("SCAN_RESP: process_bss returned ERROR\n");
-                        continue;
-                }
-
-                /* Try to find this bss in the scan table */
-                list_for_each_entry (iter_bss, &priv->network_list, list) {
-                        if (is_same_network(iter_bss, &new)) {
-                                found = iter_bss;
-                                break;
-                        }
-
-                        if ((oldest == NULL) ||
-                            (iter_bss->last_scanned < oldest->last_scanned))
-                                oldest = iter_bss;
-                }
-
-                if (found) {
-                        /* found, clear it */
-                        clear_bss_descriptor(found);
-                } else if (!list_empty(&priv->network_free_list)) {
-                        /* Pull one from the free list */
-                        found = list_entry(priv->network_free_list.next,
-                                           struct bss_descriptor, list);
-                        list_move_tail(&found->list, &priv->network_list);
-                } else if (oldest) {
-                        /* If there are no more slots, expire the oldest */
-                        found = oldest;
-                        clear_bss_descriptor(found);
-                        list_move_tail(&found->list, &priv->network_list);
-                } else {
-                        continue;
-                }
-
-                lbs_deb_scan("SCAN_RESP: BSSID %pM\n", new.bssid);
-
-                /* Copy the locally created newbssentry to the scan table */
-                memcpy(found, &new, offsetof(struct bss_descriptor, list));
-        }
-
-        ret = 0;
-
-done:
-        lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
-        return ret;
-}
diff --git a/drivers/net/wireless/libertas/scan.h b/drivers/net/wireless/libertas/scan.h
deleted file mode 100644
index 8fb1706d7526..000000000000
--- a/drivers/net/wireless/libertas/scan.h
+++ /dev/null
@@ -1,63 +0,0 @@
-/**
-  * Interface for the wlan network scan routines
-  *
-  * Driver interface functions and type declarations for the scan module
-  * implemented in scan.c.
-  */
-#ifndef _LBS_SCAN_H
-#define _LBS_SCAN_H
-
-#include <net/iw_handler.h>
-
-struct lbs_private;
-
-#define MAX_NETWORK_COUNT 128
-
-/** Chan-freq-TxPower mapping table*/
-struct chan_freq_power {
-        /** channel Number              */
-        u16 channel;
-        /** frequency of this channel   */
-        u32 freq;
-        /** Max allowed Tx power level  */
-        u16 maxtxpower;
-        /** TRUE:channel unsupported;  FLASE:supported*/
-        u8 unsupported;
-};
-
-/** region-band mapping table*/
-struct region_channel {
-        /** TRUE if this entry is valid              */
-        u8 valid;
-        /** region code for US, Japan ...            */
-        u8 region;
-        /** band B/G/A, used for BAND_CONFIG cmd             */
-        u8 band;
-        /** Actual No. of elements in the array below */
-        u8 nrcfp;
-        /** chan-freq-txpower mapping table*/
-        struct chan_freq_power *CFP;
-};
-
-/**
- *  @brief Maximum number of channels that can be sent in a setuserscan ioctl
- */
-#define LBS_IOCTL_USER_SCAN_CHAN_MAX  50
-
-int lbs_ssid_cmp(u8 *ssid1, u8 ssid1_len, u8 *ssid2, u8 ssid2_len);
-
-int lbs_set_regiontable(struct lbs_private *priv, u8 region, u8 band);
-
-int lbs_send_specific_ssid_scan(struct lbs_private *priv, u8 *ssid,
-                                u8 ssid_len);
-
-int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
-                         struct iw_point *dwrq, char *extra);
-int lbs_set_scan(struct net_device *dev, struct iw_request_info *info,
-                         union iwreq_data *wrqu, char *extra);
-
-int lbs_scan_networks(struct lbs_private *priv, int full_scan);
-
-void lbs_scan_worker(struct work_struct *work);
-
-#endif
diff --git a/drivers/net/wireless/libertas/tx.c b/drivers/net/wireless/libertas/tx.c
index a9bf658659eb..411a3bbf035e 100644
--- a/drivers/net/wireless/libertas/tx.c
+++ b/drivers/net/wireless/libertas/tx.c
@@ -4,13 +4,13 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/sched.h>
+#include <net/cfg80211.h>
 
 #include "host.h"
 #include "radiotap.h"
 #include "decl.h"
 #include "defs.h"
 #include "dev.h"
-#include "wext.h"
 
 /**
  *  @brief This function converts Tx/Rx rates from IEEE80211_RADIOTAP_RATE
@@ -111,7 +111,7 @@ netdev_tx_t lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         p802x_hdr = skb->data;
         pkt_len = skb->len;
 
-        if (dev == priv->rtap_net_dev) {
+        if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR) {
                 struct tx_radiotap_hdr *rtap_hdr = (void *)skb->data;
 
                 /* set txpd fields from the radiotap header */
@@ -147,7 +147,7 @@ netdev_tx_t lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         dev->stats.tx_packets++;
         dev->stats.tx_bytes += skb->len;
 
-        if (priv->monitormode) {
+        if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR) {
                 /* Keep the skb to echo it back once Tx feedback is
                    received from FW */
                 skb_orphan(skb);
@@ -158,6 +158,7 @@ netdev_tx_t lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
  free:
                 dev_kfree_skb_any(skb);
         }
+
  unlock:
         spin_unlock_irqrestore(&priv->driver_lock, flags);
         wake_up(&priv->waitq);
@@ -179,7 +180,8 @@ void lbs_send_tx_feedback(struct lbs_private *priv, u32 try_count)
 {
         struct tx_radiotap_hdr *radiotap_hdr;
 
-        if (!priv->monitormode || priv->currenttxskb == NULL)
+        if (!priv->wdev->iftype == NL80211_IFTYPE_MONITOR ||
+            priv->currenttxskb == NULL)
                 return;
 
         radiotap_hdr = (struct tx_radiotap_hdr *)priv->currenttxskb->data;
@@ -188,7 +190,7 @@ void lbs_send_tx_feedback(struct lbs_private *priv, u32 try_count)
                 (1 + priv->txretrycount - try_count) : 0;
 
         priv->currenttxskb->protocol = eth_type_trans(priv->currenttxskb,
-                                                      priv->rtap_net_dev);
+                                                      priv->dev);
         netif_rx(priv->currenttxskb);
 
         priv->currenttxskb = NULL;
diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
deleted file mode 100644
index f96a96031a50..000000000000
--- a/drivers/net/wireless/libertas/wext.c
+++ /dev/null
@@ -1,2353 +0,0 @@
-/**
-  * This file contains ioctl functions
-  */
-#include <linux/ctype.h>
-#include <linux/slab.h>
-#include <linux/delay.h>
-#include <linux/if.h>
-#include <linux/if_arp.h>
-#include <linux/wireless.h>
-#include <linux/bitops.h>
-
-#include <net/lib80211.h>
-#include <net/iw_handler.h>
-
-#include "host.h"
-#include "radiotap.h"
-#include "decl.h"
-#include "defs.h"
-#include "dev.h"
-#include "wext.h"
-#include "scan.h"
-#include "assoc.h"
-#include "cmd.h"
-
-
-static inline void lbs_postpone_association_work(struct lbs_private *priv)
-{
-        if (priv->surpriseremoved)
-                return;
-        cancel_delayed_work(&priv->assoc_work);
-        queue_delayed_work(priv->work_thread, &priv->assoc_work, HZ / 2);
-}
-
-static inline void lbs_do_association_work(struct lbs_private *priv)
-{
-        if (priv->surpriseremoved)
-                return;
-        cancel_delayed_work(&priv->assoc_work);
-        queue_delayed_work(priv->work_thread, &priv->assoc_work, 0);
-}
-
-static inline void lbs_cancel_association_work(struct lbs_private *priv)
-{
-        cancel_delayed_work(&priv->assoc_work);
-        kfree(priv->pending_assoc_req);
-        priv->pending_assoc_req = NULL;
-}
-
-void lbs_send_disconnect_notification(struct lbs_private *priv)
-{
-        union iwreq_data wrqu;
-
-        memset(wrqu.ap_addr.sa_data, 0x00, ETH_ALEN);
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
-}
-
-static void lbs_send_iwevcustom_event(struct lbs_private *priv, s8 *str)
-{
-        union iwreq_data iwrq;
-        u8 buf[50];
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        memset(&iwrq, 0, sizeof(union iwreq_data));
-        memset(buf, 0, sizeof(buf));
-
-        snprintf(buf, sizeof(buf) - 1, "%s", str);
-
-        iwrq.data.length = strlen(buf) + 1 + IW_EV_LCP_LEN;
-
-        /* Send Event to upper layer */
-        lbs_deb_wext("event indication string %s\n", (char *)buf);
-        lbs_deb_wext("event indication length %d\n", iwrq.data.length);
-        lbs_deb_wext("sending wireless event IWEVCUSTOM for %s\n", str);
-
-        wireless_send_event(priv->dev, IWEVCUSTOM, &iwrq, buf);
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-}
-
-/**
- *  @brief This function handles MIC failure event.
- *
- *  @param priv    A pointer to struct lbs_private structure
- *  @para  event   the event id
- *  @return        n/a
- */
-void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event)
-{
-        char buf[50];
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        memset(buf, 0, sizeof(buf));
-
-        sprintf(buf, "%s", "MLME-MICHAELMICFAILURE.indication ");
-
-        if (event == MACREG_INT_CODE_MIC_ERR_UNICAST)
-                strcat(buf, "unicast ");
-        else
-                strcat(buf, "multicast ");
-
-        lbs_send_iwevcustom_event(priv, buf);
-        lbs_deb_leave(LBS_DEB_CMD);
-}
-
-/**
- *  @brief Find the channel frequency power info with specific channel
- *
- *  @param priv         A pointer to struct lbs_private structure
- *  @param band         it can be BAND_A, BAND_G or BAND_B
- *  @param channel      the channel for looking
- *  @return             A pointer to struct chan_freq_power structure or NULL if not find.
- */
-struct chan_freq_power *lbs_find_cfp_by_band_and_channel(
-        struct lbs_private *priv,
-        u8 band,
-        u16 channel)
-{
-        struct chan_freq_power *cfp = NULL;
-        struct region_channel *rc;
-        int i, j;
-
-        for (j = 0; !cfp && (j < ARRAY_SIZE(priv->region_channel)); j++) {
-                rc = &priv->region_channel[j];
-
-                if (!rc->valid || !rc->CFP)
-                        continue;
-                if (rc->band != band)
-                        continue;
-                for (i = 0; i < rc->nrcfp; i++) {
-                        if (rc->CFP[i].channel == channel) {
-                                cfp = &rc->CFP[i];
-                                break;
-                        }
-                }
-        }
-
-        if (!cfp && channel)
-                lbs_deb_wext("lbs_find_cfp_by_band_and_channel: can't find "
-                       "cfp by band %d / channel %d\n", band, channel);
-
-        return cfp;
-}
-
-/**
- *  @brief Find the channel frequency power info with specific frequency
- *
- *  @param priv         A pointer to struct lbs_private structure
- *  @param band         it can be BAND_A, BAND_G or BAND_B
- *  @param freq         the frequency for looking
- *  @return             A pointer to struct chan_freq_power structure or NULL if not find.
- */
-static struct chan_freq_power *find_cfp_by_band_and_freq(
-        struct lbs_private *priv,
-        u8 band,
-        u32 freq)
-{
-        struct chan_freq_power *cfp = NULL;
-        struct region_channel *rc;
-        int i, j;
-
-        for (j = 0; !cfp && (j < ARRAY_SIZE(priv->region_channel)); j++) {
-                rc = &priv->region_channel[j];
-
-                if (!rc->valid || !rc->CFP)
-                        continue;
-                if (rc->band != band)
-                        continue;
-                for (i = 0; i < rc->nrcfp; i++) {
-                        if (rc->CFP[i].freq == freq) {
-                                cfp = &rc->CFP[i];
-                                break;
-                        }
-                }
-        }
-
-        if (!cfp && freq)
-                lbs_deb_wext("find_cfp_by_band_and_freql: can't find cfp by "
-                       "band %d / freq %d\n", band, freq);
-
-        return cfp;
-}
-
-/**
- *  @brief Copy active data rates based on adapter mode and status
- *
- *  @param priv              A pointer to struct lbs_private structure
- *  @param rate                 The buf to return the active rates
- */
-static void copy_active_data_rates(struct lbs_private *priv, u8 *rates)
-{
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if ((priv->connect_status != LBS_CONNECTED) &&
-                !lbs_mesh_connected(priv))
-                memcpy(rates, lbs_bg_rates, MAX_RATES);
-        else
-                memcpy(rates, priv->curbssparams.rates, MAX_RATES);
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-}
-
-static int lbs_get_name(struct net_device *dev, struct iw_request_info *info,
-                         char *cwrq, char *extra)
-{
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        /* We could add support for 802.11n here as needed. Jean II */
-        snprintf(cwrq, IFNAMSIZ, "IEEE 802.11b/g");
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-
-static int lbs_get_freq(struct net_device *dev, struct iw_request_info *info,
-                         struct iw_freq *fwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        struct chan_freq_power *cfp;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        cfp = lbs_find_cfp_by_band_and_channel(priv, 0,
-                                           priv->channel);
-
-        if (!cfp) {
-                if (priv->channel)
-                        lbs_deb_wext("invalid channel %d\n",
-                               priv->channel);
-                return -EINVAL;
-        }
-
-        fwrq->m = (long)cfp->freq * 100000;
-        fwrq->e = 1;
-
-        lbs_deb_wext("freq %u\n", fwrq->m);
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-
-static int lbs_get_wap(struct net_device *dev, struct iw_request_info *info,
-                        struct sockaddr *awrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (priv->connect_status == LBS_CONNECTED) {
-                memcpy(awrq->sa_data, priv->curbssparams.bssid, ETH_ALEN);
-        } else {
-                memset(awrq->sa_data, 0, ETH_ALEN);
-        }
-        awrq->sa_family = ARPHRD_ETHER;
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-
-static int lbs_set_nick(struct net_device *dev, struct iw_request_info *info,
-                         struct iw_point *dwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        /*
-         * Check the size of the string
-         */
-
-        if (dwrq->length > 16) {
-                return -E2BIG;
-        }
-
-        mutex_lock(&priv->lock);
-        memset(priv->nodename, 0, sizeof(priv->nodename));
-        memcpy(priv->nodename, extra, dwrq->length);
-        mutex_unlock(&priv->lock);
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-
-static int lbs_get_nick(struct net_device *dev, struct iw_request_info *info,
-                         struct iw_point *dwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        dwrq->length = strlen(priv->nodename);
-        memcpy(extra, priv->nodename, dwrq->length);
-        extra[dwrq->length] = '\0';
-
-        dwrq->flags = 1;        /* active */
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-
-#ifdef CONFIG_LIBERTAS_MESH
-static int mesh_get_nick(struct net_device *dev, struct iw_request_info *info,
-                         struct iw_point *dwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        /* Use nickname to indicate that mesh is on */
-
-        if (lbs_mesh_connected(priv)) {
-                strncpy(extra, "Mesh", 12);
-                extra[12] = '\0';
-                dwrq->length = strlen(extra);
-        }
-
-        else {
-                extra[0] = '\0';
-                dwrq->length = 0;
-        }
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-#endif
-
-static int lbs_set_rts(struct net_device *dev, struct iw_request_info *info,
-                        struct iw_param *vwrq, char *extra)
-{
-        int ret = 0;
-        struct lbs_private *priv = dev->ml_priv;
-        u32 val = vwrq->value;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (vwrq->disabled)
-                val = MRVDRV_RTS_MAX_VALUE;
-
-        if (val > MRVDRV_RTS_MAX_VALUE) /* min rts value is 0 */
-                return -EINVAL;
-
-        ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_RTS_THRESHOLD, (u16) val);
-
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-static int lbs_get_rts(struct net_device *dev, struct iw_request_info *info,
-                        struct iw_param *vwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        int ret = 0;
-        u16 val = 0;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        ret = lbs_get_snmp_mib(priv, SNMP_MIB_OID_RTS_THRESHOLD, &val);
-        if (ret)
-                goto out;
-
-        vwrq->value = val;
-        vwrq->disabled = val > MRVDRV_RTS_MAX_VALUE; /* min rts value is 0 */
-        vwrq->fixed = 1;
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-static int lbs_set_frag(struct net_device *dev, struct iw_request_info *info,
-                         struct iw_param *vwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        int ret = 0;
-        u32 val = vwrq->value;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (vwrq->disabled)
-                val = MRVDRV_FRAG_MAX_VALUE;
-
-        if (val < MRVDRV_FRAG_MIN_VALUE || val > MRVDRV_FRAG_MAX_VALUE)
-                return -EINVAL;
-
-        ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_FRAG_THRESHOLD, (u16) val);
-
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-static int lbs_get_frag(struct net_device *dev, struct iw_request_info *info,
-                         struct iw_param *vwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        int ret = 0;
-        u16 val = 0;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        ret = lbs_get_snmp_mib(priv, SNMP_MIB_OID_FRAG_THRESHOLD, &val);
-        if (ret)
-                goto out;
-
-        vwrq->value = val;
-        vwrq->disabled = ((val < MRVDRV_FRAG_MIN_VALUE)
-                          || (val > MRVDRV_FRAG_MAX_VALUE));
-        vwrq->fixed = 1;
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-static int lbs_get_mode(struct net_device *dev,
-                         struct iw_request_info *info, u32 * uwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        *uwrq = priv->mode;
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-
-#ifdef CONFIG_LIBERTAS_MESH
-static int mesh_wlan_get_mode(struct net_device *dev,
-                              struct iw_request_info *info, u32 * uwrq,
-                              char *extra)
-{
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        *uwrq = IW_MODE_REPEAT;
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-#endif
-
-static int lbs_get_txpow(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_param *vwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        s16 curlevel = 0;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (!priv->radio_on) {
-                lbs_deb_wext("tx power off\n");
-                vwrq->value = 0;
-                vwrq->disabled = 1;
-                goto out;
-        }
-
-        ret = lbs_get_tx_power(priv, &curlevel, NULL, NULL);
-        if (ret)
-                goto out;
-
-        lbs_deb_wext("tx power level %d dbm\n", curlevel);
-        priv->txpower_cur = curlevel;
-
-        vwrq->value = curlevel;
-        vwrq->fixed = 1;
-        vwrq->disabled = 0;
-        vwrq->flags = IW_TXPOW_DBM;
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-static int lbs_set_retry(struct net_device *dev, struct iw_request_info *info,
-                          struct iw_param *vwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        int ret = 0;
-        u16 slimit = 0, llimit = 0;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if ((vwrq->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT)
-                return -EOPNOTSUPP;
-
-        /* The MAC has a 4-bit Total_Tx_Count register
-           Total_Tx_Count = 1 + Tx_Retry_Count */
-#define TX_RETRY_MIN 0
-#define TX_RETRY_MAX 14
-        if (vwrq->value < TX_RETRY_MIN || vwrq->value > TX_RETRY_MAX)
-                return -EINVAL;
-
-        /* Add 1 to convert retry count to try count */
-        if (vwrq->flags & IW_RETRY_SHORT)
-                slimit = (u16) (vwrq->value + 1);
-        else if (vwrq->flags & IW_RETRY_LONG)
-                llimit = (u16) (vwrq->value + 1);
-        else
-                slimit = llimit = (u16) (vwrq->value + 1); /* set both */
-
-        if (llimit) {
-                ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_LONG_RETRY_LIMIT,
-                                       llimit);
-                if (ret)
-                        goto out;
-        }
-
-        if (slimit) {
-                /* txretrycount follows the short retry limit */
-                priv->txretrycount = slimit;
-                ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_SHORT_RETRY_LIMIT,
-                                       slimit);
-                if (ret)
-                        goto out;
-        }
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-static int lbs_get_retry(struct net_device *dev, struct iw_request_info *info,
-                          struct iw_param *vwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        int ret = 0;
-        u16 val = 0;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        vwrq->disabled = 0;
-
-        if (vwrq->flags & IW_RETRY_LONG) {
-                ret = lbs_get_snmp_mib(priv, SNMP_MIB_OID_LONG_RETRY_LIMIT, &val);
-                if (ret)
-                        goto out;
-
-                /* Subtract 1 to convert try count to retry count */
-                vwrq->value = val - 1;
-                vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
-        } else {
-                ret = lbs_get_snmp_mib(priv, SNMP_MIB_OID_SHORT_RETRY_LIMIT, &val);
-                if (ret)
-                        goto out;
-
-                /* txretry count follows the short retry limit */
-                priv->txretrycount = val;
-                /* Subtract 1 to convert try count to retry count */
-                vwrq->value = val - 1;
-                vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_SHORT;
-        }
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-static inline void sort_channels(struct iw_freq *freq, int num)
-{
-        int i, j;
-        struct iw_freq temp;
-
-        for (i = 0; i < num; i++)
-                for (j = i + 1; j < num; j++)
-                        if (freq[i].i > freq[j].i) {
-                                temp.i = freq[i].i;
-                                temp.m = freq[i].m;
-
-                                freq[i].i = freq[j].i;
-                                freq[i].m = freq[j].m;
-
-                                freq[j].i = temp.i;
-                                freq[j].m = temp.m;
-                        }
-}
-
-/* data rate listing
-        MULTI_BANDS:
-                abg             a       b       b/g
-   Infra        G(12)           A(8)    B(4)    G(12)
-   Adhoc        A+B(12)         A(8)    B(4)    B(4)
-
-        non-MULTI_BANDS:
-                                        b       b/g
-   Infra                                B(4)    G(12)
-   Adhoc                                B(4)    B(4)
- */
-/**
- *  @brief Get Range Info
- *
- *  @param dev                  A pointer to net_device structure
- *  @param info                 A pointer to iw_request_info structure
- *  @param vwrq                 A pointer to iw_param structure
- *  @param extra                A pointer to extra data buf
- *  @return                     0 --success, otherwise fail
- */
-static int lbs_get_range(struct net_device *dev, struct iw_request_info *info,
-                          struct iw_point *dwrq, char *extra)
-{
-        int i, j;
-        struct lbs_private *priv = dev->ml_priv;
-        struct iw_range *range = (struct iw_range *)extra;
-        struct chan_freq_power *cfp;
-        u8 rates[MAX_RATES + 1];
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        dwrq->length = sizeof(struct iw_range);
-        memset(range, 0, sizeof(struct iw_range));
-
-        range->min_nwid = 0;
-        range->max_nwid = 0;
-
-        memset(rates, 0, sizeof(rates));
-        copy_active_data_rates(priv, rates);
-        range->num_bitrates = strnlen(rates, IW_MAX_BITRATES);
-        for (i = 0; i < range->num_bitrates; i++)
-                range->bitrate[i] = rates[i] * 500000;
-        range->num_bitrates = i;
-        lbs_deb_wext("IW_MAX_BITRATES %d, num_bitrates %d\n", IW_MAX_BITRATES,
-               range->num_bitrates);
-
-        range->num_frequency = 0;
-
-        range->scan_capa = IW_SCAN_CAPA_ESSID;
-
-        for (j = 0; (range->num_frequency < IW_MAX_FREQUENCIES)
-             && (j < ARRAY_SIZE(priv->region_channel)); j++) {
-                cfp = priv->region_channel[j].CFP;
-                for (i = 0; (range->num_frequency < IW_MAX_FREQUENCIES)
-                     && priv->region_channel[j].valid
-                     && cfp
-                     && (i < priv->region_channel[j].nrcfp); i++) {
-                        range->freq[range->num_frequency].i =
-                            (long)cfp->channel;
-                        range->freq[range->num_frequency].m =
-                            (long)cfp->freq * 100000;
-                        range->freq[range->num_frequency].e = 1;
-                        cfp++;
-                        range->num_frequency++;
-                }
-        }
-
-        lbs_deb_wext("IW_MAX_FREQUENCIES %d, num_frequency %d\n",
-               IW_MAX_FREQUENCIES, range->num_frequency);
-
-        range->num_channels = range->num_frequency;
-
-        sort_channels(&range->freq[0], range->num_frequency);
-
-        /*
-         * Set an indication of the max TCP throughput in bit/s that we can
-         * expect using this interface
-         */
-        if (i > 2)
-                range->throughput = 5000 * 1000;
-        else
-                range->throughput = 1500 * 1000;
-
-        range->min_rts = MRVDRV_RTS_MIN_VALUE;
-        range->max_rts = MRVDRV_RTS_MAX_VALUE;
-        range->min_frag = MRVDRV_FRAG_MIN_VALUE;
-        range->max_frag = MRVDRV_FRAG_MAX_VALUE;
-
-        range->encoding_size[0] = 5;
-        range->encoding_size[1] = 13;
-        range->num_encoding_sizes = 2;
-        range->max_encoding_tokens = 4;
-
-        /*
-         * Right now we support only "iwconfig ethX power on|off"
-         */
-        range->pm_capa = IW_POWER_ON;
-
-        /*
-         * Minimum version we recommend
-         */
-        range->we_version_source = 15;
-
-        /*
-         * Version we are compiled with
-         */
-        range->we_version_compiled = WIRELESS_EXT;
-
-        range->retry_capa = IW_RETRY_LIMIT;
-        range->retry_flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
-
-        range->min_retry = TX_RETRY_MIN;
-        range->max_retry = TX_RETRY_MAX;
-
-        /*
-         * Set the qual, level and noise range values
-         */
-        range->max_qual.qual = 100;
-        range->max_qual.level = 0;
-        range->max_qual.noise = 0;
-        range->max_qual.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
-
-        range->avg_qual.qual = 70;
-        /* TODO: Find real 'good' to 'bad' threshold value for RSSI */
-        range->avg_qual.level = 0;
-        range->avg_qual.noise = 0;
-        range->avg_qual.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
-
-        range->sensitivity = 0;
-
-        /* Setup the supported power level ranges */
-        memset(range->txpower, 0, sizeof(range->txpower));
-        range->txpower_capa = IW_TXPOW_DBM | IW_TXPOW_RANGE;
-        range->txpower[0] = priv->txpower_min;
-        range->txpower[1] = priv->txpower_max;
-        range->num_txpower = 2;
-
-        range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
-                                IW_EVENT_CAPA_MASK(SIOCGIWAP) |
-                                IW_EVENT_CAPA_MASK(SIOCGIWSCAN));
-        range->event_capa[1] = IW_EVENT_CAPA_K_1;
-
-        if (priv->fwcapinfo & FW_CAPINFO_WPA) {
-                range->enc_capa =   IW_ENC_CAPA_WPA
-                                  | IW_ENC_CAPA_WPA2
-                                  | IW_ENC_CAPA_CIPHER_TKIP
-                                  | IW_ENC_CAPA_CIPHER_CCMP;
-        }
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-
-static int lbs_set_power(struct net_device *dev, struct iw_request_info *info,
-                          struct iw_param *vwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (!(priv->fwcapinfo & FW_CAPINFO_PS)) {
-                if (vwrq->disabled)
-                        return 0;
-                else
-                        return -EINVAL;
-        }
-
-        /* PS is currently supported only in Infrastructure mode
-         * Remove this check if it is to be supported in IBSS mode also
-         */
-
-        if (vwrq->disabled) {
-                priv->psmode = LBS802_11POWERMODECAM;
-                if (priv->psstate != PS_STATE_FULL_POWER) {
-                        lbs_ps_wakeup(priv, CMD_OPTION_WAITFORRSP);
-                }
-
-                return 0;
-        }
-
-        if ((vwrq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) {
-                lbs_deb_wext(
-                       "setting power timeout is not supported\n");
-                return -EINVAL;
-        } else if ((vwrq->flags & IW_POWER_TYPE) == IW_POWER_PERIOD) {
-                vwrq->value = vwrq->value / 1000;
-                if (!priv->enter_deep_sleep) {
-                        lbs_pr_err("deep sleep feature is not implemented "
-                                        "for this interface driver\n");
-                        return -EINVAL;
-                }
-
-                if (priv->connect_status == LBS_CONNECTED) {
-                        if ((priv->is_auto_deep_sleep_enabled) &&
-                                                (vwrq->value == -1000)) {
-                                lbs_exit_auto_deep_sleep(priv);
-                                return 0;
-                        } else {
-                                lbs_pr_err("can't use deep sleep cmd in "
-                                                "connected state\n");
-                                return -EINVAL;
-                        }
-                }
-
-                if ((vwrq->value < 0) && (vwrq->value != -1000)) {
-                        lbs_pr_err("unknown option\n");
-                        return -EINVAL;
-                }
-
-                if (vwrq->value > 0) {
-                        if (!priv->is_auto_deep_sleep_enabled) {
-                                priv->is_activity_detected = 0;
-                                priv->auto_deep_sleep_timeout = vwrq->value;
-                                lbs_enter_auto_deep_sleep(priv);
-                        } else {
-                                priv->auto_deep_sleep_timeout = vwrq->value;
-                                lbs_deb_debugfs("auto deep sleep: "
-                                                "already enabled\n");
-                        }
-                        return 0;
-                } else {
-                        if (priv->is_auto_deep_sleep_enabled) {
-                                lbs_exit_auto_deep_sleep(priv);
-                                /* Try to exit deep sleep if auto */
-                                /*deep sleep disabled */
-                                ret = lbs_set_deep_sleep(priv, 0);
-                        }
-                        if (vwrq->value == 0)
-                                ret = lbs_set_deep_sleep(priv, 1);
-                        else if (vwrq->value == -1000)
-                                ret = lbs_set_deep_sleep(priv, 0);
-                        return ret;
-                }
-        }
-
-        if (priv->psmode != LBS802_11POWERMODECAM) {
-                return 0;
-        }
-
-        priv->psmode = LBS802_11POWERMODEMAX_PSP;
-
-        if (priv->connect_status == LBS_CONNECTED) {
-                lbs_ps_sleep(priv, CMD_OPTION_WAITFORRSP);
-        }
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-
-        return 0;
-}
-
-static int lbs_get_power(struct net_device *dev, struct iw_request_info *info,
-                          struct iw_param *vwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        vwrq->value = 0;
-        vwrq->flags = 0;
-        vwrq->disabled = priv->psmode == LBS802_11POWERMODECAM
-                || priv->connect_status == LBS_DISCONNECTED;
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-
-static struct iw_statistics *lbs_get_wireless_stats(struct net_device *dev)
-{
-        enum {
-                POOR = 30,
-                FAIR = 60,
-                GOOD = 80,
-                VERY_GOOD = 90,
-                EXCELLENT = 95,
-                PERFECT = 100
-        };
-        struct lbs_private *priv = dev->ml_priv;
-        u32 rssi_qual;
-        u32 tx_qual;
-        u32 quality = 0;
-        int ret, stats_valid = 0;
-        u8 rssi;
-        u32 tx_retries;
-        struct cmd_ds_802_11_get_log log;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        priv->wstats.status = priv->mode;
-
-        /* If we're not associated, all quality values are meaningless */
-        if ((priv->connect_status != LBS_CONNECTED) &&
-            !lbs_mesh_connected(priv))
-                goto out;
-
-        /* Quality by RSSI */
-        priv->wstats.qual.level =
-            CAL_RSSI(priv->SNR[TYPE_BEACON][TYPE_NOAVG],
-             priv->NF[TYPE_BEACON][TYPE_NOAVG]);
-
-        if (priv->NF[TYPE_BEACON][TYPE_NOAVG] == 0) {
-                priv->wstats.qual.noise = MRVDRV_NF_DEFAULT_SCAN_VALUE;
-        } else {
-                priv->wstats.qual.noise =
-                    CAL_NF(priv->NF[TYPE_BEACON][TYPE_NOAVG]);
-        }
-
-        lbs_deb_wext("signal level %#x\n", priv->wstats.qual.level);
-        lbs_deb_wext("noise %#x\n", priv->wstats.qual.noise);
-
-        rssi = priv->wstats.qual.level - priv->wstats.qual.noise;
-        if (rssi < 15)
-                rssi_qual = rssi * POOR / 10;
-        else if (rssi < 20)
-                rssi_qual = (rssi - 15) * (FAIR - POOR) / 5 + POOR;
-        else if (rssi < 30)
-                rssi_qual = (rssi - 20) * (GOOD - FAIR) / 5 + FAIR;
-        else if (rssi < 40)
-                rssi_qual = (rssi - 30) * (VERY_GOOD - GOOD) /
-                    10 + GOOD;
-        else
-                rssi_qual = (rssi - 40) * (PERFECT - VERY_GOOD) /
-                    10 + VERY_GOOD;
-        quality = rssi_qual;
-
-        /* Quality by TX errors */
-        priv->wstats.discard.retries = dev->stats.tx_errors;
-
-        memset(&log, 0, sizeof(log));
-        log.hdr.size = cpu_to_le16(sizeof(log));
-        ret = lbs_cmd_with_response(priv, CMD_802_11_GET_LOG, &log);
-        if (ret)
-                goto out;
-
-        tx_retries = le32_to_cpu(log.retry);
-
-        if (tx_retries > 75)
-                tx_qual = (90 - tx_retries) * POOR / 15;
-        else if (tx_retries > 70)
-                tx_qual = (75 - tx_retries) * (FAIR - POOR) / 5 + POOR;
-        else if (tx_retries > 65)
-                tx_qual = (70 - tx_retries) * (GOOD - FAIR) / 5 + FAIR;
-        else if (tx_retries > 50)
-                tx_qual = (65 - tx_retries) * (VERY_GOOD - GOOD) /
-                    15 + GOOD;
-        else
-                tx_qual = (50 - tx_retries) *
-                    (PERFECT - VERY_GOOD) / 50 + VERY_GOOD;
-        quality = min(quality, tx_qual);
-
-        priv->wstats.discard.code = le32_to_cpu(log.wepundecryptable);
-        priv->wstats.discard.retries = tx_retries;
-        priv->wstats.discard.misc = le32_to_cpu(log.ackfailure);
-
-        /* Calculate quality */
-        priv->wstats.qual.qual = min_t(u8, quality, 100);
-        priv->wstats.qual.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
-        stats_valid = 1;
-
-        /* update stats asynchronously for future calls */
-        ret = lbs_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
-                                        0, 0, NULL);
-        if (ret)
-                lbs_pr_err("RSSI command failed\n");
-out:
-        if (!stats_valid) {
-                priv->wstats.miss.beacon = 0;
-                priv->wstats.discard.retries = 0;
-                priv->wstats.qual.qual = 0;
-                priv->wstats.qual.level = 0;
-                priv->wstats.qual.noise = 0;
-                priv->wstats.qual.updated = IW_QUAL_ALL_UPDATED;
-                priv->wstats.qual.updated |= IW_QUAL_NOISE_INVALID |
-                    IW_QUAL_QUAL_INVALID | IW_QUAL_LEVEL_INVALID;
-        }
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return &priv->wstats;
-
-
-}
-
-static int lbs_set_freq(struct net_device *dev, struct iw_request_info *info,
-                  struct iw_freq *fwrq, char *extra)
-{
-        int ret = -EINVAL;
-        struct lbs_private *priv = dev->ml_priv;
-        struct chan_freq_power *cfp;
-        struct assoc_request * assoc_req;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        mutex_lock(&priv->lock);
-        assoc_req = lbs_get_association_request(priv);
-        if (!assoc_req) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        /* If setting by frequency, convert to a channel */
-        if (fwrq->e == 1) {
-                long f = fwrq->m / 100000;
-
-                cfp = find_cfp_by_band_and_freq(priv, 0, f);
-                if (!cfp) {
-                        lbs_deb_wext("invalid freq %ld\n", f);
-                        goto out;
-                }
-
-                fwrq->e = 0;
-                fwrq->m = (int) cfp->channel;
-        }
-
-        /* Setting by channel number */
-        if (fwrq->m > 1000 || fwrq->e > 0) {
-                goto out;
-        }
-
-        cfp = lbs_find_cfp_by_band_and_channel(priv, 0, fwrq->m);
-        if (!cfp) {
-                goto out;
-        }
-
-        assoc_req->channel = fwrq->m;
-        ret = 0;
-
-out:
-        if (ret == 0) {
-                set_bit(ASSOC_FLAG_CHANNEL, &assoc_req->flags);
-                lbs_postpone_association_work(priv);
-        } else {
-                lbs_cancel_association_work(priv);
-        }
-        mutex_unlock(&priv->lock);
-
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-#ifdef CONFIG_LIBERTAS_MESH
-static int lbs_mesh_set_freq(struct net_device *dev,
-                             struct iw_request_info *info,
-                             struct iw_freq *fwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        struct chan_freq_power *cfp;
-        int ret = -EINVAL;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        /* If setting by frequency, convert to a channel */
-        if (fwrq->e == 1) {
-                long f = fwrq->m / 100000;
-
-                cfp = find_cfp_by_band_and_freq(priv, 0, f);
-                if (!cfp) {
-                        lbs_deb_wext("invalid freq %ld\n", f);
-                        goto out;
-                }
-
-                fwrq->e = 0;
-                fwrq->m = (int) cfp->channel;
-        }
-
-        /* Setting by channel number */
-        if (fwrq->m > 1000 || fwrq->e > 0) {
-                goto out;
-        }
-
-        cfp = lbs_find_cfp_by_band_and_channel(priv, 0, fwrq->m);
-        if (!cfp) {
-                goto out;
-        }
-
-        if (fwrq->m != priv->channel) {
-                lbs_deb_wext("mesh channel change forces eth disconnect\n");
-                if (priv->mode == IW_MODE_INFRA)
-                        lbs_cmd_80211_deauthenticate(priv,
-                                                     priv->curbssparams.bssid,
-                                                     WLAN_REASON_DEAUTH_LEAVING);
-                else if (priv->mode == IW_MODE_ADHOC)
-                        lbs_adhoc_stop(priv);
-        }
-        lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START, fwrq->m);
-        lbs_update_channel(priv);
-        ret = 0;
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-#endif
-
-static int lbs_set_rate(struct net_device *dev, struct iw_request_info *info,
-                  struct iw_param *vwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        u8 new_rate = 0;
-        int ret = -EINVAL;
-        u8 rates[MAX_RATES + 1];
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        lbs_deb_wext("vwrq->value %d\n", vwrq->value);
-        lbs_deb_wext("vwrq->fixed %d\n", vwrq->fixed);
-
-        if (vwrq->fixed && vwrq->value == -1)
-                goto out;
-
-        /* Auto rate? */
-        priv->enablehwauto = !vwrq->fixed;
-
-        if (vwrq->value == -1)
-                priv->cur_rate = 0;
-        else {
-                if (vwrq->value % 100000)
-                        goto out;
-
-                new_rate = vwrq->value / 500000;
-                priv->cur_rate = new_rate;
-                /* the rest is only needed for lbs_set_data_rate() */
-                memset(rates, 0, sizeof(rates));
-                copy_active_data_rates(priv, rates);
-                if (!memchr(rates, new_rate, sizeof(rates))) {
-                        lbs_pr_alert("fixed data rate 0x%X out of range\n",
-                                new_rate);
-                        goto out;
-                }
-                if (priv->fwrelease < 0x09000000) {
-                        ret = lbs_set_power_adapt_cfg(priv, 0,
-                                        POW_ADAPT_DEFAULT_P0,
-                                        POW_ADAPT_DEFAULT_P1,
-                                        POW_ADAPT_DEFAULT_P2);
-                        if (ret)
-                                goto out;
-                }
-                ret = lbs_set_tpc_cfg(priv, 0, TPC_DEFAULT_P0, TPC_DEFAULT_P1,
-                                TPC_DEFAULT_P2, 1);
-                if (ret)
-                        goto out;
-        }
-
-        /* Try the newer command first (Firmware Spec 5.1 and above) */
-        ret = lbs_cmd_802_11_rate_adapt_rateset(priv, CMD_ACT_SET);
-
-        /* Fallback to older version */
-        if (ret)
-                ret = lbs_set_data_rate(priv, new_rate);
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-static int lbs_get_rate(struct net_device *dev, struct iw_request_info *info,
-                  struct iw_param *vwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (priv->connect_status == LBS_CONNECTED) {
-                vwrq->value = priv->cur_rate * 500000;
-
-                if (priv->enablehwauto)
-                        vwrq->fixed = 0;
-                else
-                        vwrq->fixed = 1;
-
-        } else {
-                vwrq->fixed = 0;
-                vwrq->value = 0;
-        }
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-
-static int lbs_set_mode(struct net_device *dev,
-                  struct iw_request_info *info, u32 * uwrq, char *extra)
-{
-        int ret = 0;
-        struct lbs_private *priv = dev->ml_priv;
-        struct assoc_request * assoc_req;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (   (*uwrq != IW_MODE_ADHOC)
-            && (*uwrq != IW_MODE_INFRA)
-            && (*uwrq != IW_MODE_AUTO)) {
-                lbs_deb_wext("Invalid mode: 0x%x\n", *uwrq);
-                ret = -EINVAL;
-                goto out;
-        }
-
-        mutex_lock(&priv->lock);
-        assoc_req = lbs_get_association_request(priv);
-        if (!assoc_req) {
-                ret = -ENOMEM;
-                lbs_cancel_association_work(priv);
-        } else {
-                assoc_req->mode = *uwrq;
-                set_bit(ASSOC_FLAG_MODE, &assoc_req->flags);
-                lbs_postpone_association_work(priv);
-                lbs_deb_wext("Switching to mode: 0x%x\n", *uwrq);
-        }
-        mutex_unlock(&priv->lock);
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-
-/**
- *  @brief Get Encryption key
- *
- *  @param dev                  A pointer to net_device structure
- *  @param info                 A pointer to iw_request_info structure
- *  @param vwrq                 A pointer to iw_param structure
- *  @param extra                A pointer to extra data buf
- *  @return                     0 --success, otherwise fail
- */
-static int lbs_get_encode(struct net_device *dev,
-                           struct iw_request_info *info,
-                           struct iw_point *dwrq, u8 * extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        lbs_deb_wext("flags 0x%x, index %d, length %d, wep_tx_keyidx %d\n",
-               dwrq->flags, index, dwrq->length, priv->wep_tx_keyidx);
-
-        dwrq->flags = 0;
-
-        /* Authentication method */
-        switch (priv->secinfo.auth_mode) {
-        case IW_AUTH_ALG_OPEN_SYSTEM:
-                dwrq->flags = IW_ENCODE_OPEN;
-                break;
-
-        case IW_AUTH_ALG_SHARED_KEY:
-        case IW_AUTH_ALG_LEAP:
-                dwrq->flags = IW_ENCODE_RESTRICTED;
-                break;
-        default:
-                dwrq->flags = IW_ENCODE_DISABLED | IW_ENCODE_OPEN;
-                break;
-        }
-
-        memset(extra, 0, 16);
-
-        mutex_lock(&priv->lock);
-
-        /* Default to returning current transmit key */
-        if (index < 0)
-                index = priv->wep_tx_keyidx;
-
-        if ((priv->wep_keys[index].len) && priv->secinfo.wep_enabled) {
-                memcpy(extra, priv->wep_keys[index].key,
-                       priv->wep_keys[index].len);
-                dwrq->length = priv->wep_keys[index].len;
-
-                dwrq->flags |= (index + 1);
-                /* Return WEP enabled */
-                dwrq->flags &= ~IW_ENCODE_DISABLED;
-        } else if ((priv->secinfo.WPAenabled)
-                   || (priv->secinfo.WPA2enabled)) {
-                /* return WPA enabled */
-                dwrq->flags &= ~IW_ENCODE_DISABLED;
-                dwrq->flags |= IW_ENCODE_NOKEY;
-        } else {
-                dwrq->flags |= IW_ENCODE_DISABLED;
-        }
-
-        mutex_unlock(&priv->lock);
-
-        lbs_deb_wext("key: %02x:%02x:%02x:%02x:%02x:%02x, keylen %d\n",
-               extra[0], extra[1], extra[2],
-               extra[3], extra[4], extra[5], dwrq->length);
-
-        lbs_deb_wext("return flags 0x%x\n", dwrq->flags);
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-
-/**
- *  @brief Set Encryption key (internal)
- *
- *  @param priv                 A pointer to private card structure
- *  @param key_material         A pointer to key material
- *  @param key_length           length of key material
- *  @param index                key index to set
- *  @param set_tx_key           Force set TX key (1 = yes, 0 = no)
- *  @return                     0 --success, otherwise fail
- */
-static int lbs_set_wep_key(struct assoc_request *assoc_req,
-                            const char *key_material,
-                            u16 key_length,
-                            u16 index,
-                            int set_tx_key)
-{
-        int ret = 0;
-        struct enc_key *pkey;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        /* Paranoid validation of key index */
-        if (index > 3) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        /* validate max key length */
-        if (key_length > KEY_LEN_WEP_104) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        pkey = &assoc_req->wep_keys[index];
-
-        if (key_length > 0) {
-                memset(pkey, 0, sizeof(struct enc_key));
-                pkey->type = KEY_TYPE_ID_WEP;
-
-                /* Standardize the key length */
-                pkey->len = (key_length > KEY_LEN_WEP_40) ?
-                                KEY_LEN_WEP_104 : KEY_LEN_WEP_40;
-                memcpy(pkey->key, key_material, key_length);
-        }
-
-        if (set_tx_key) {
-                /* Ensure the chosen key is valid */
-                if (!pkey->len) {
-                        lbs_deb_wext("key not set, so cannot enable it\n");
-                        ret = -EINVAL;
-                        goto out;
-                }
-                assoc_req->wep_tx_keyidx = index;
-        }
-
-        assoc_req->secinfo.wep_enabled = 1;
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-static int validate_key_index(u16 def_index, u16 raw_index,
-                              u16 *out_index, u16 *is_default)
-{
-        if (!out_index || !is_default)
-                return -EINVAL;
-
-        /* Verify index if present, otherwise use default TX key index */
-        if (raw_index > 0) {
-                if (raw_index > 4)
-                        return -EINVAL;
-                *out_index = raw_index - 1;
-        } else {
-                *out_index = def_index;
-                *is_default = 1;
-        }
-        return 0;
-}
-
-static void disable_wep(struct assoc_request *assoc_req)
-{
-        int i;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        /* Set Open System auth mode */
-        assoc_req->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
-
-        /* Clear WEP keys and mark WEP as disabled */
-        assoc_req->secinfo.wep_enabled = 0;
-        for (i = 0; i < 4; i++)
-                assoc_req->wep_keys[i].len = 0;
-
-        set_bit(ASSOC_FLAG_SECINFO, &assoc_req->flags);
-        set_bit(ASSOC_FLAG_WEP_KEYS, &assoc_req->flags);
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-}
-
-static void disable_wpa(struct assoc_request *assoc_req)
-{
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        memset(&assoc_req->wpa_mcast_key, 0, sizeof (struct enc_key));
-        assoc_req->wpa_mcast_key.flags = KEY_INFO_WPA_MCAST;
-        set_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc_req->flags);
-
-        memset(&assoc_req->wpa_unicast_key, 0, sizeof (struct enc_key));
-        assoc_req->wpa_unicast_key.flags = KEY_INFO_WPA_UNICAST;
-        set_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc_req->flags);
-
-        assoc_req->secinfo.WPAenabled = 0;
-        assoc_req->secinfo.WPA2enabled = 0;
-        set_bit(ASSOC_FLAG_SECINFO, &assoc_req->flags);
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-}
-
-/**
- *  @brief Set Encryption key
- *
- *  @param dev                  A pointer to net_device structure
- *  @param info                 A pointer to iw_request_info structure
- *  @param vwrq                 A pointer to iw_param structure
- *  @param extra                A pointer to extra data buf
- *  @return                     0 --success, otherwise fail
- */
-static int lbs_set_encode(struct net_device *dev,
-                    struct iw_request_info *info,
-                    struct iw_point *dwrq, char *extra)
-{
-        int ret = 0;
-        struct lbs_private *priv = dev->ml_priv;
-        struct assoc_request * assoc_req;
-        u16 is_default = 0, index = 0, set_tx_key = 0;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        mutex_lock(&priv->lock);
-        assoc_req = lbs_get_association_request(priv);
-        if (!assoc_req) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        if (dwrq->flags & IW_ENCODE_DISABLED) {
-                disable_wep (assoc_req);
-                disable_wpa (assoc_req);
-                goto out;
-        }
-
-        ret = validate_key_index(assoc_req->wep_tx_keyidx,
-                                 (dwrq->flags & IW_ENCODE_INDEX),
-                                 &index, &is_default);
-        if (ret) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        /* If WEP isn't enabled, or if there is no key data but a valid
-         * index, set the TX key.
-         */
-        if (!assoc_req->secinfo.wep_enabled || (dwrq->length == 0 && !is_default))
-                set_tx_key = 1;
-
-        ret = lbs_set_wep_key(assoc_req, extra, dwrq->length, index, set_tx_key);
-        if (ret)
-                goto out;
-
-        if (dwrq->length)
-                set_bit(ASSOC_FLAG_WEP_KEYS, &assoc_req->flags);
-        if (set_tx_key)
-                set_bit(ASSOC_FLAG_WEP_TX_KEYIDX, &assoc_req->flags);
-
-        if (dwrq->flags & IW_ENCODE_RESTRICTED) {
-                priv->authtype_auto = 0;
-                assoc_req->secinfo.auth_mode = IW_AUTH_ALG_SHARED_KEY;
-        } else if (dwrq->flags & IW_ENCODE_OPEN) {
-                priv->authtype_auto = 0;
-                assoc_req->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
-        }
-
-out:
-        if (ret == 0) {
-                set_bit(ASSOC_FLAG_SECINFO, &assoc_req->flags);
-                lbs_postpone_association_work(priv);
-        } else {
-                lbs_cancel_association_work(priv);
-        }
-        mutex_unlock(&priv->lock);
-
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief Get Extended Encryption key (WPA/802.1x and WEP)
- *
- *  @param dev                  A pointer to net_device structure
- *  @param info                 A pointer to iw_request_info structure
- *  @param vwrq                 A pointer to iw_param structure
- *  @param extra                A pointer to extra data buf
- *  @return                     0 on success, otherwise failure
- */
-static int lbs_get_encodeext(struct net_device *dev,
-                              struct iw_request_info *info,
-                              struct iw_point *dwrq,
-                              char *extra)
-{
-        int ret = -EINVAL;
-        struct lbs_private *priv = dev->ml_priv;
-        struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-        int index, max_key_len;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        max_key_len = dwrq->length - sizeof(*ext);
-        if (max_key_len < 0)
-                goto out;
-
-        index = dwrq->flags & IW_ENCODE_INDEX;
-        if (index) {
-                if (index < 1 || index > 4)
-                        goto out;
-                index--;
-        } else {
-                index = priv->wep_tx_keyidx;
-        }
-
-        if (!(ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) &&
-            ext->alg != IW_ENCODE_ALG_WEP) {
-                if (index != 0 || priv->mode != IW_MODE_INFRA)
-                        goto out;
-        }
-
-        dwrq->flags = index + 1;
-        memset(ext, 0, sizeof(*ext));
-
-        if (   !priv->secinfo.wep_enabled
-            && !priv->secinfo.WPAenabled
-            && !priv->secinfo.WPA2enabled) {
-                ext->alg = IW_ENCODE_ALG_NONE;
-                ext->key_len = 0;
-                dwrq->flags |= IW_ENCODE_DISABLED;
-        } else {
-                u8 *key = NULL;
-
-                if (   priv->secinfo.wep_enabled
-                    && !priv->secinfo.WPAenabled
-                    && !priv->secinfo.WPA2enabled) {
-                        /* WEP */
-                        ext->alg = IW_ENCODE_ALG_WEP;
-                        ext->key_len = priv->wep_keys[index].len;
-                        key = &priv->wep_keys[index].key[0];
-                } else if (   !priv->secinfo.wep_enabled
-                           && (priv->secinfo.WPAenabled ||
-                               priv->secinfo.WPA2enabled)) {
-                        /* WPA */
-                        struct enc_key * pkey = NULL;
-
-                        if (   priv->wpa_mcast_key.len
-                            && (priv->wpa_mcast_key.flags & KEY_INFO_WPA_ENABLED))
-                                pkey = &priv->wpa_mcast_key;
-                        else if (   priv->wpa_unicast_key.len
-                                 && (priv->wpa_unicast_key.flags & KEY_INFO_WPA_ENABLED))
-                                pkey = &priv->wpa_unicast_key;
-
-                        if (pkey) {
-                                if (pkey->type == KEY_TYPE_ID_AES) {
-                                        ext->alg = IW_ENCODE_ALG_CCMP;
-                                } else {
-                                        ext->alg = IW_ENCODE_ALG_TKIP;
-                                }
-                                ext->key_len = pkey->len;
-                                key = &pkey->key[0];
-                        } else {
-                                ext->alg = IW_ENCODE_ALG_TKIP;
-                                ext->key_len = 0;
-                        }
-                } else {
-                        goto out;
-                }
-
-                if (ext->key_len > max_key_len) {
-                        ret = -E2BIG;
-                        goto out;
-                }
-
-                if (ext->key_len)
-                        memcpy(ext->key, key, ext->key_len);
-                else
-                        dwrq->flags |= IW_ENCODE_NOKEY;
-                dwrq->flags |= IW_ENCODE_ENABLED;
-        }
-        ret = 0;
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief Set Encryption key Extended (WPA/802.1x and WEP)
- *
- *  @param dev                  A pointer to net_device structure
- *  @param info                 A pointer to iw_request_info structure
- *  @param vwrq                 A pointer to iw_param structure
- *  @param extra                A pointer to extra data buf
- *  @return                     0 --success, otherwise fail
- */
-static int lbs_set_encodeext(struct net_device *dev,
-                              struct iw_request_info *info,
-                              struct iw_point *dwrq,
-                              char *extra)
-{
-        int ret = 0;
-        struct lbs_private *priv = dev->ml_priv;
-        struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-        int alg = ext->alg;
-        struct assoc_request * assoc_req;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        mutex_lock(&priv->lock);
-        assoc_req = lbs_get_association_request(priv);
-        if (!assoc_req) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        if ((alg == IW_ENCODE_ALG_NONE) || (dwrq->flags & IW_ENCODE_DISABLED)) {
-                disable_wep (assoc_req);
-                disable_wpa (assoc_req);
-        } else if (alg == IW_ENCODE_ALG_WEP) {
-                u16 is_default = 0, index, set_tx_key = 0;
-
-                ret = validate_key_index(assoc_req->wep_tx_keyidx,
-                                         (dwrq->flags & IW_ENCODE_INDEX),
-                                         &index, &is_default);
-                if (ret)
-                        goto out;
-
-                /* If WEP isn't enabled, or if there is no key data but a valid
-                 * index, or if the set-TX-key flag was passed, set the TX key.
-                 */
-                if (   !assoc_req->secinfo.wep_enabled
-                    || (dwrq->length == 0 && !is_default)
-                    || (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY))
-                        set_tx_key = 1;
-
-                /* Copy key to driver */
-                ret = lbs_set_wep_key(assoc_req, ext->key, ext->key_len, index,
-                                        set_tx_key);
-                if (ret)
-                        goto out;
-
-                if (dwrq->flags & IW_ENCODE_RESTRICTED) {
-                        priv->authtype_auto = 0;
-                        assoc_req->secinfo.auth_mode = IW_AUTH_ALG_SHARED_KEY;
-                } else if (dwrq->flags & IW_ENCODE_OPEN) {
-                        priv->authtype_auto = 0;
-                        assoc_req->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
-                }
-
-                /* Mark the various WEP bits as modified */
-                set_bit(ASSOC_FLAG_SECINFO, &assoc_req->flags);
-                if (dwrq->length)
-                        set_bit(ASSOC_FLAG_WEP_KEYS, &assoc_req->flags);
-                if (set_tx_key)
-                        set_bit(ASSOC_FLAG_WEP_TX_KEYIDX, &assoc_req->flags);
-        } else if ((alg == IW_ENCODE_ALG_TKIP) || (alg == IW_ENCODE_ALG_CCMP)) {
-                struct enc_key * pkey;
-
-                /* validate key length */
-                if (((alg == IW_ENCODE_ALG_TKIP)
-                        && (ext->key_len != KEY_LEN_WPA_TKIP))
-                    || ((alg == IW_ENCODE_ALG_CCMP)
-                        && (ext->key_len != KEY_LEN_WPA_AES))) {
-                                lbs_deb_wext("invalid size %d for key of alg "
-                                       "type %d\n",
-                                       ext->key_len,
-                                       alg);
-                                ret = -EINVAL;
-                                goto out;
-                }
-
-                if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
-                        pkey = &assoc_req->wpa_mcast_key;
-                        set_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc_req->flags);
-                } else {
-                        pkey = &assoc_req->wpa_unicast_key;
-                        set_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc_req->flags);
-                }
-
-                memset(pkey, 0, sizeof (struct enc_key));
-                memcpy(pkey->key, ext->key, ext->key_len);
-                pkey->len = ext->key_len;
-                if (pkey->len)
-                        pkey->flags |= KEY_INFO_WPA_ENABLED;
-
-                /* Do this after zeroing key structure */
-                if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
-                        pkey->flags |= KEY_INFO_WPA_MCAST;
-                } else {
-                        pkey->flags |= KEY_INFO_WPA_UNICAST;
-                }
-
-                if (alg == IW_ENCODE_ALG_TKIP) {
-                        pkey->type = KEY_TYPE_ID_TKIP;
-                } else if (alg == IW_ENCODE_ALG_CCMP) {
-                        pkey->type = KEY_TYPE_ID_AES;
-                }
-
-                /* If WPA isn't enabled yet, do that now */
-                if (   assoc_req->secinfo.WPAenabled == 0
-                    && assoc_req->secinfo.WPA2enabled == 0) {
-                        assoc_req->secinfo.WPAenabled = 1;
-                        assoc_req->secinfo.WPA2enabled = 1;
-                        set_bit(ASSOC_FLAG_SECINFO, &assoc_req->flags);
-                }
-
-                /* Only disable wep if necessary: can't waste time here. */
-                if (priv->mac_control & CMD_ACT_MAC_WEP_ENABLE)
-                        disable_wep(assoc_req);
-        }
-
-out:
-        if (ret == 0) {
-                /* 802.1x and WPA rekeying must happen as quickly as possible,
-                 * especially during the 4-way handshake; thus if in
-                 * infrastructure mode, and either (a) 802.1x is enabled or
-                 * (b) WPA is being used, set the key right away.
-                 */
-                if (assoc_req->mode == IW_MODE_INFRA &&
-                    ((assoc_req->secinfo.key_mgmt & IW_AUTH_KEY_MGMT_802_1X) ||
-                     (assoc_req->secinfo.key_mgmt & IW_AUTH_KEY_MGMT_PSK) ||
-                      assoc_req->secinfo.WPAenabled ||
-                      assoc_req->secinfo.WPA2enabled)) {
-                        lbs_do_association_work(priv);
-                } else
-                        lbs_postpone_association_work(priv);
-        } else {
-                lbs_cancel_association_work(priv);
-        }
-        mutex_unlock(&priv->lock);
-
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-
-static int lbs_set_genie(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_point *dwrq,
-                          char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        int ret = 0;
-        struct assoc_request * assoc_req;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        mutex_lock(&priv->lock);
-        assoc_req = lbs_get_association_request(priv);
-        if (!assoc_req) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        if (dwrq->length > MAX_WPA_IE_LEN ||
-            (dwrq->length && extra == NULL)) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        if (dwrq->length) {
-                memcpy(&assoc_req->wpa_ie[0], extra, dwrq->length);
-                assoc_req->wpa_ie_len = dwrq->length;
-        } else {
-                memset(&assoc_req->wpa_ie[0], 0, sizeof(priv->wpa_ie));
-                assoc_req->wpa_ie_len = 0;
-        }
-
-out:
-        if (ret == 0) {
-                set_bit(ASSOC_FLAG_WPA_IE, &assoc_req->flags);
-                lbs_postpone_association_work(priv);
-        } else {
-                lbs_cancel_association_work(priv);
-        }
-        mutex_unlock(&priv->lock);
-
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-static int lbs_get_genie(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_point *dwrq,
-                          char *extra)
-{
-        int ret = 0;
-        struct lbs_private *priv = dev->ml_priv;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (priv->wpa_ie_len == 0) {
-                dwrq->length = 0;
-                goto out;
-        }
-
-        if (dwrq->length < priv->wpa_ie_len) {
-                ret = -E2BIG;
-                goto out;
-        }
-
-        dwrq->length = priv->wpa_ie_len;
-        memcpy(extra, &priv->wpa_ie[0], priv->wpa_ie_len);
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-
-static int lbs_set_auth(struct net_device *dev,
-                         struct iw_request_info *info,
-                         struct iw_param *dwrq,
-                         char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        struct assoc_request * assoc_req;
-        int ret = 0;
-        int updated = 0;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        mutex_lock(&priv->lock);
-        assoc_req = lbs_get_association_request(priv);
-        if (!assoc_req) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        switch (dwrq->flags & IW_AUTH_INDEX) {
-        case IW_AUTH_PRIVACY_INVOKED:
-        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-        case IW_AUTH_TKIP_COUNTERMEASURES:
-        case IW_AUTH_CIPHER_PAIRWISE:
-        case IW_AUTH_CIPHER_GROUP:
-        case IW_AUTH_DROP_UNENCRYPTED:
-                /*
-                 * libertas does not use these parameters
-                 */
-                break;
-
-        case IW_AUTH_KEY_MGMT:
-                assoc_req->secinfo.key_mgmt = dwrq->value;
-                updated = 1;
-                break;
-
-        case IW_AUTH_WPA_VERSION:
-                if (dwrq->value & IW_AUTH_WPA_VERSION_DISABLED) {
-                        assoc_req->secinfo.WPAenabled = 0;
-                        assoc_req->secinfo.WPA2enabled = 0;
-                        disable_wpa (assoc_req);
-                }
-                if (dwrq->value & IW_AUTH_WPA_VERSION_WPA) {
-                        assoc_req->secinfo.WPAenabled = 1;
-                        assoc_req->secinfo.wep_enabled = 0;
-                        assoc_req->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
-                }
-                if (dwrq->value & IW_AUTH_WPA_VERSION_WPA2) {
-                        assoc_req->secinfo.WPA2enabled = 1;
-                        assoc_req->secinfo.wep_enabled = 0;
-                        assoc_req->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
-                }
-                updated = 1;
-                break;
-
-        case IW_AUTH_80211_AUTH_ALG:
-                if (dwrq->value & IW_AUTH_ALG_SHARED_KEY) {
-                        assoc_req->secinfo.auth_mode = IW_AUTH_ALG_SHARED_KEY;
-                } else if (dwrq->value & IW_AUTH_ALG_OPEN_SYSTEM) {
-                        assoc_req->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
-                } else if (dwrq->value & IW_AUTH_ALG_LEAP) {
-                        assoc_req->secinfo.auth_mode = IW_AUTH_ALG_LEAP;
-                } else {
-                        ret = -EINVAL;
-                }
-                updated = 1;
-                break;
-
-        case IW_AUTH_WPA_ENABLED:
-                if (dwrq->value) {
-                        if (!assoc_req->secinfo.WPAenabled &&
-                            !assoc_req->secinfo.WPA2enabled) {
-                                assoc_req->secinfo.WPAenabled = 1;
-                                assoc_req->secinfo.WPA2enabled = 1;
-                                assoc_req->secinfo.wep_enabled = 0;
-                                assoc_req->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
-                        }
-                } else {
-                        assoc_req->secinfo.WPAenabled = 0;
-                        assoc_req->secinfo.WPA2enabled = 0;
-                        disable_wpa (assoc_req);
-                }
-                updated = 1;
-                break;
-
-        default:
-                ret = -EOPNOTSUPP;
-                break;
-        }
-
-out:
-        if (ret == 0) {
-                if (updated)
-                        set_bit(ASSOC_FLAG_SECINFO, &assoc_req->flags);
-                lbs_postpone_association_work(priv);
-        } else if (ret != -EOPNOTSUPP) {
-                lbs_cancel_association_work(priv);
-        }
-        mutex_unlock(&priv->lock);
-
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-static int lbs_get_auth(struct net_device *dev,
-                         struct iw_request_info *info,
-                         struct iw_param *dwrq,
-                         char *extra)
-{
-        int ret = 0;
-        struct lbs_private *priv = dev->ml_priv;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        switch (dwrq->flags & IW_AUTH_INDEX) {
-        case IW_AUTH_KEY_MGMT:
-                dwrq->value = priv->secinfo.key_mgmt;
-                break;
-
-        case IW_AUTH_WPA_VERSION:
-                dwrq->value = 0;
-                if (priv->secinfo.WPAenabled)
-                        dwrq->value |= IW_AUTH_WPA_VERSION_WPA;
-                if (priv->secinfo.WPA2enabled)
-                        dwrq->value |= IW_AUTH_WPA_VERSION_WPA2;
-                if (!dwrq->value)
-                        dwrq->value |= IW_AUTH_WPA_VERSION_DISABLED;
-                break;
-
-        case IW_AUTH_80211_AUTH_ALG:
-                dwrq->value = priv->secinfo.auth_mode;
-                break;
-
-        case IW_AUTH_WPA_ENABLED:
-                if (priv->secinfo.WPAenabled && priv->secinfo.WPA2enabled)
-                        dwrq->value = 1;
-                break;
-
-        default:
-                ret = -EOPNOTSUPP;
-        }
-
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-
-static int lbs_set_txpow(struct net_device *dev, struct iw_request_info *info,
-                   struct iw_param *vwrq, char *extra)
-{
-        int ret = 0;
-        struct lbs_private *priv = dev->ml_priv;
-        s16 dbm = (s16) vwrq->value;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (vwrq->disabled) {
-                lbs_set_radio(priv, RADIO_PREAMBLE_AUTO, 0);
-                goto out;
-        }
-
-        if (vwrq->fixed == 0) {
-                /* User requests automatic tx power control, however there are
-                 * many auto tx settings.  For now use firmware defaults until
-                 * we come up with a good way to expose these to the user. */
-                if (priv->fwrelease < 0x09000000) {
-                        ret = lbs_set_power_adapt_cfg(priv, 1,
-                                        POW_ADAPT_DEFAULT_P0,
-                                        POW_ADAPT_DEFAULT_P1,
-                                        POW_ADAPT_DEFAULT_P2);
-                        if (ret)
-                                goto out;
-                }
-                ret = lbs_set_tpc_cfg(priv, 0, TPC_DEFAULT_P0, TPC_DEFAULT_P1,
-                                TPC_DEFAULT_P2, 1);
-                if (ret)
-                        goto out;
-                dbm = priv->txpower_max;
-        } else {
-                /* Userspace check in iwrange if it should use dBm or mW,
-                 * therefore this should never happen... Jean II */
-                if ((vwrq->flags & IW_TXPOW_TYPE) != IW_TXPOW_DBM) {
-                        ret = -EOPNOTSUPP;
-                        goto out;
-                }
-
-                /* Validate requested power level against firmware allowed
-                 * levels */
-                if (priv->txpower_min && (dbm < priv->txpower_min)) {
-                        ret = -EINVAL;
-                        goto out;
-                }
-
-                if (priv->txpower_max && (dbm > priv->txpower_max)) {
-                        ret = -EINVAL;
-                        goto out;
-                }
-                if (priv->fwrelease < 0x09000000) {
-                        ret = lbs_set_power_adapt_cfg(priv, 0,
-                                        POW_ADAPT_DEFAULT_P0,
-                                        POW_ADAPT_DEFAULT_P1,
-                                        POW_ADAPT_DEFAULT_P2);
-                        if (ret)
-                                goto out;
-                }
-                ret = lbs_set_tpc_cfg(priv, 0, TPC_DEFAULT_P0, TPC_DEFAULT_P1,
-                                TPC_DEFAULT_P2, 1);
-                if (ret)
-                        goto out;
-        }
-
-        /* If the radio was off, turn it on */
-        if (!priv->radio_on) {
-                ret = lbs_set_radio(priv, RADIO_PREAMBLE_AUTO, 1);
-                if (ret)
-                        goto out;
-        }
-
-        lbs_deb_wext("txpower set %d dBm\n", dbm);
-
-        ret = lbs_set_tx_power(priv, dbm);
-
-out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
-                   struct iw_point *dwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        /*
-         * Note : if dwrq->flags != 0, we should get the relevant SSID from
-         * the SSID list...
-         */
-
-        /*
-         * Get the current SSID
-         */
-        if (priv->connect_status == LBS_CONNECTED) {
-                memcpy(extra, priv->curbssparams.ssid,
-                       priv->curbssparams.ssid_len);
-        } else {
-                memset(extra, 0, 32);
-        }
-        /*
-         * If none, we may want to get the one that was set
-         */
-
-        dwrq->length = priv->curbssparams.ssid_len;
-
-        dwrq->flags = 1;        /* active */
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-
-static int lbs_set_essid(struct net_device *dev, struct iw_request_info *info,
-                   struct iw_point *dwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        int ret = 0;
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-        u8 ssid_len = 0;
-        struct assoc_request * assoc_req;
-        int in_ssid_len = dwrq->length;
-        DECLARE_SSID_BUF(ssid_buf);
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (!priv->radio_on) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        /* Check the size of the string */
-        if (in_ssid_len > IEEE80211_MAX_SSID_LEN) {
-                ret = -E2BIG;
-                goto out;
-        }
-
-        memset(&ssid, 0, sizeof(ssid));
-
-        if (!dwrq->flags || !in_ssid_len) {
-                /* "any" SSID requested; leave SSID blank */
-        } else {
-                /* Specific SSID requested */
-                memcpy(&ssid, extra, in_ssid_len);
-                ssid_len = in_ssid_len;
-        }
-
-        if (!ssid_len) {
-                lbs_deb_wext("requested any SSID\n");
-        } else {
-                lbs_deb_wext("requested SSID '%s'\n",
-                             print_ssid(ssid_buf, ssid, ssid_len));
-        }
-
-out:
-        mutex_lock(&priv->lock);
-        if (ret == 0) {
-                /* Get or create the current association request */
-                assoc_req = lbs_get_association_request(priv);
-                if (!assoc_req) {
-                        ret = -ENOMEM;
-                } else {
-                        /* Copy the SSID to the association request */
-                        memcpy(&assoc_req->ssid, &ssid, IEEE80211_MAX_SSID_LEN);
-                        assoc_req->ssid_len = ssid_len;
-                        set_bit(ASSOC_FLAG_SSID, &assoc_req->flags);
-                        lbs_postpone_association_work(priv);
-                }
-        }
-
-        /* Cancel the association request if there was an error */
-        if (ret != 0) {
-                lbs_cancel_association_work(priv);
-        }
-
-        mutex_unlock(&priv->lock);
-
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-
-#ifdef CONFIG_LIBERTAS_MESH
-static int lbs_mesh_get_essid(struct net_device *dev,
-                              struct iw_request_info *info,
-                              struct iw_point *dwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        memcpy(extra, priv->mesh_ssid, priv->mesh_ssid_len);
-
-        dwrq->length = priv->mesh_ssid_len;
-
-        dwrq->flags = 1;        /* active */
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-        return 0;
-}
-
-static int lbs_mesh_set_essid(struct net_device *dev,
-                              struct iw_request_info *info,
-                              struct iw_point *dwrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (!priv->radio_on) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        /* Check the size of the string */
-        if (dwrq->length > IEEE80211_MAX_SSID_LEN) {
-                ret = -E2BIG;
-                goto out;
-        }
-
-        if (!dwrq->flags || !dwrq->length) {
-                ret = -EINVAL;
-                goto out;
-        } else {
-                /* Specific SSID requested */
-                memcpy(priv->mesh_ssid, extra, dwrq->length);
-                priv->mesh_ssid_len = dwrq->length;
-        }
-
-        lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
-                        priv->channel);
- out:
-        lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
-        return ret;
-}
-#endif
-
-/**
- *  @brief Connect to the AP or Ad-hoc Network with specific bssid
- *
- *  @param dev          A pointer to net_device structure
- *  @param info         A pointer to iw_request_info structure
- *  @param awrq         A pointer to iw_param structure
- *  @param extra        A pointer to extra data buf
- *  @return             0 --success, otherwise fail
- */
-static int lbs_set_wap(struct net_device *dev, struct iw_request_info *info,
-                 struct sockaddr *awrq, char *extra)
-{
-        struct lbs_private *priv = dev->ml_priv;
-        struct assoc_request * assoc_req;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        if (!priv->radio_on)
-                return -EINVAL;
-
-        if (awrq->sa_family != ARPHRD_ETHER)
-                return -EINVAL;
-
-        lbs_deb_wext("ASSOC: WAP: sa_data %pM\n", awrq->sa_data);
-
-        mutex_lock(&priv->lock);
-
-        /* Get or create the current association request */
-        assoc_req = lbs_get_association_request(priv);
-        if (!assoc_req) {
-                lbs_cancel_association_work(priv);
-                ret = -ENOMEM;
-        } else {
-                /* Copy the BSSID to the association request */
-                memcpy(&assoc_req->bssid, awrq->sa_data, ETH_ALEN);
-                set_bit(ASSOC_FLAG_BSSID, &assoc_req->flags);
-                lbs_postpone_association_work(priv);
-        }
-
-        mutex_unlock(&priv->lock);
-
-        return ret;
-}
-
-/*
- * iwconfig settable callbacks
- */
-static const iw_handler lbs_handler[] = {
-        (iw_handler) NULL,      /* SIOCSIWCOMMIT */
-        (iw_handler) lbs_get_name,      /* SIOCGIWNAME */
-        (iw_handler) NULL,      /* SIOCSIWNWID */
-        (iw_handler) NULL,      /* SIOCGIWNWID */
-        (iw_handler) lbs_set_freq,      /* SIOCSIWFREQ */
-        (iw_handler) lbs_get_freq,      /* SIOCGIWFREQ */
-        (iw_handler) lbs_set_mode,      /* SIOCSIWMODE */
-        (iw_handler) lbs_get_mode,      /* SIOCGIWMODE */
-        (iw_handler) NULL,      /* SIOCSIWSENS */
-        (iw_handler) NULL,      /* SIOCGIWSENS */
-        (iw_handler) NULL,      /* SIOCSIWRANGE */
-        (iw_handler) lbs_get_range,     /* SIOCGIWRANGE */
-        (iw_handler) NULL,      /* SIOCSIWPRIV */
-        (iw_handler) NULL,      /* SIOCGIWPRIV */
-        (iw_handler) NULL,      /* SIOCSIWSTATS */
-        (iw_handler) NULL,      /* SIOCGIWSTATS */
-        iw_handler_set_spy,     /* SIOCSIWSPY */
-        iw_handler_get_spy,     /* SIOCGIWSPY */
-        iw_handler_set_thrspy,  /* SIOCSIWTHRSPY */
-        iw_handler_get_thrspy,  /* SIOCGIWTHRSPY */
-        (iw_handler) lbs_set_wap,       /* SIOCSIWAP */
-        (iw_handler) lbs_get_wap,       /* SIOCGIWAP */
-        (iw_handler) NULL,      /* SIOCSIWMLME */
-        (iw_handler) NULL,      /* SIOCGIWAPLIST - deprecated */
-        (iw_handler) lbs_set_scan,      /* SIOCSIWSCAN */
-        (iw_handler) lbs_get_scan,      /* SIOCGIWSCAN */
-        (iw_handler) lbs_set_essid,     /* SIOCSIWESSID */
-        (iw_handler) lbs_get_essid,     /* SIOCGIWESSID */
-        (iw_handler) lbs_set_nick,      /* SIOCSIWNICKN */
-        (iw_handler) lbs_get_nick,      /* SIOCGIWNICKN */
-        (iw_handler) NULL,      /* -- hole -- */
-        (iw_handler) NULL,      /* -- hole -- */
-        (iw_handler) lbs_set_rate,      /* SIOCSIWRATE */
-        (iw_handler) lbs_get_rate,      /* SIOCGIWRATE */
-        (iw_handler) lbs_set_rts,       /* SIOCSIWRTS */
-        (iw_handler) lbs_get_rts,       /* SIOCGIWRTS */
-        (iw_handler) lbs_set_frag,      /* SIOCSIWFRAG */
-        (iw_handler) lbs_get_frag,      /* SIOCGIWFRAG */
-        (iw_handler) lbs_set_txpow,     /* SIOCSIWTXPOW */
-        (iw_handler) lbs_get_txpow,     /* SIOCGIWTXPOW */
-        (iw_handler) lbs_set_retry,     /* SIOCSIWRETRY */
-        (iw_handler) lbs_get_retry,     /* SIOCGIWRETRY */
-        (iw_handler) lbs_set_encode,    /* SIOCSIWENCODE */
-        (iw_handler) lbs_get_encode,    /* SIOCGIWENCODE */
-        (iw_handler) lbs_set_power,     /* SIOCSIWPOWER */
-        (iw_handler) lbs_get_power,     /* SIOCGIWPOWER */
-        (iw_handler) NULL,      /* -- hole -- */
-        (iw_handler) NULL,      /* -- hole -- */
-        (iw_handler) lbs_set_genie,     /* SIOCSIWGENIE */
-        (iw_handler) lbs_get_genie,     /* SIOCGIWGENIE */
-        (iw_handler) lbs_set_auth,      /* SIOCSIWAUTH */
-        (iw_handler) lbs_get_auth,      /* SIOCGIWAUTH */
-        (iw_handler) lbs_set_encodeext,/* SIOCSIWENCODEEXT */
-        (iw_handler) lbs_get_encodeext,/* SIOCGIWENCODEEXT */
-        (iw_handler) NULL,              /* SIOCSIWPMKSA */
-};
-struct iw_handler_def lbs_handler_def = {
-        .num_standard   = ARRAY_SIZE(lbs_handler),
-        .standard       = (iw_handler *) lbs_handler,
-        .get_wireless_stats = lbs_get_wireless_stats,
-};
-
-#ifdef CONFIG_LIBERTAS_MESH
-static const iw_handler mesh_wlan_handler[] = {
-        (iw_handler) NULL,      /* SIOCSIWCOMMIT */
-        (iw_handler) lbs_get_name,      /* SIOCGIWNAME */
-        (iw_handler) NULL,      /* SIOCSIWNWID */
-        (iw_handler) NULL,      /* SIOCGIWNWID */
-        (iw_handler) lbs_mesh_set_freq, /* SIOCSIWFREQ */
-        (iw_handler) lbs_get_freq,      /* SIOCGIWFREQ */
-        (iw_handler) NULL,              /* SIOCSIWMODE */
-        (iw_handler) mesh_wlan_get_mode,        /* SIOCGIWMODE */
-        (iw_handler) NULL,      /* SIOCSIWSENS */
-        (iw_handler) NULL,      /* SIOCGIWSENS */
-        (iw_handler) NULL,      /* SIOCSIWRANGE */
-        (iw_handler) lbs_get_range,     /* SIOCGIWRANGE */
-        (iw_handler) NULL,      /* SIOCSIWPRIV */
-        (iw_handler) NULL,      /* SIOCGIWPRIV */
-        (iw_handler) NULL,      /* SIOCSIWSTATS */
-        (iw_handler) NULL,      /* SIOCGIWSTATS */
-        iw_handler_set_spy,     /* SIOCSIWSPY */
-        iw_handler_get_spy,     /* SIOCGIWSPY */
-        iw_handler_set_thrspy,  /* SIOCSIWTHRSPY */
-        iw_handler_get_thrspy,  /* SIOCGIWTHRSPY */
-        (iw_handler) NULL,      /* SIOCSIWAP */
-        (iw_handler) NULL,      /* SIOCGIWAP */
-        (iw_handler) NULL,      /* SIOCSIWMLME */
-        (iw_handler) NULL,      /* SIOCGIWAPLIST - deprecated */
-        (iw_handler) lbs_set_scan,      /* SIOCSIWSCAN */
-        (iw_handler) lbs_get_scan,      /* SIOCGIWSCAN */
-        (iw_handler) lbs_mesh_set_essid,/* SIOCSIWESSID */
-        (iw_handler) lbs_mesh_get_essid,/* SIOCGIWESSID */
-        (iw_handler) NULL,              /* SIOCSIWNICKN */
-        (iw_handler) mesh_get_nick,     /* SIOCGIWNICKN */
-        (iw_handler) NULL,      /* -- hole -- */
-        (iw_handler) NULL,      /* -- hole -- */
-        (iw_handler) lbs_set_rate,      /* SIOCSIWRATE */
-        (iw_handler) lbs_get_rate,      /* SIOCGIWRATE */
-        (iw_handler) lbs_set_rts,       /* SIOCSIWRTS */
-        (iw_handler) lbs_get_rts,       /* SIOCGIWRTS */
-        (iw_handler) lbs_set_frag,      /* SIOCSIWFRAG */
-        (iw_handler) lbs_get_frag,      /* SIOCGIWFRAG */
-        (iw_handler) lbs_set_txpow,     /* SIOCSIWTXPOW */
-        (iw_handler) lbs_get_txpow,     /* SIOCGIWTXPOW */
-        (iw_handler) lbs_set_retry,     /* SIOCSIWRETRY */
-        (iw_handler) lbs_get_retry,     /* SIOCGIWRETRY */
-        (iw_handler) lbs_set_encode,    /* SIOCSIWENCODE */
-        (iw_handler) lbs_get_encode,    /* SIOCGIWENCODE */
-        (iw_handler) lbs_set_power,     /* SIOCSIWPOWER */
-        (iw_handler) lbs_get_power,     /* SIOCGIWPOWER */
-        (iw_handler) NULL,      /* -- hole -- */
-        (iw_handler) NULL,      /* -- hole -- */
-        (iw_handler) lbs_set_genie,     /* SIOCSIWGENIE */
-        (iw_handler) lbs_get_genie,     /* SIOCGIWGENIE */
-        (iw_handler) lbs_set_auth,      /* SIOCSIWAUTH */
-        (iw_handler) lbs_get_auth,      /* SIOCGIWAUTH */
-        (iw_handler) lbs_set_encodeext,/* SIOCSIWENCODEEXT */
-        (iw_handler) lbs_get_encodeext,/* SIOCGIWENCODEEXT */
-        (iw_handler) NULL,              /* SIOCSIWPMKSA */
-};
-
-struct iw_handler_def mesh_handler_def = {
-        .num_standard   = ARRAY_SIZE(mesh_wlan_handler),
-        .standard       = (iw_handler *) mesh_wlan_handler,
-        .get_wireless_stats = lbs_get_wireless_stats,
-};
-#endif
diff --git a/drivers/net/wireless/libertas/wext.h b/drivers/net/wireless/libertas/wext.h
deleted file mode 100644
index f3f19fe8c6c6..000000000000
--- a/drivers/net/wireless/libertas/wext.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
-  * This file contains definition for IOCTL call.
-  */
-#ifndef _LBS_WEXT_H_
-#define _LBS_WEXT_H_
-
-void lbs_send_disconnect_notification(struct lbs_private *priv);
-void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event);
-
-struct chan_freq_power *lbs_find_cfp_by_band_and_channel(
-        struct lbs_private *priv,
-        u8 band,
-        u16 channel);
-
-extern struct iw_handler_def lbs_handler_def;
-
-#endif
diff --git a/drivers/net/wireless/libertas_tf/if_usb.c b/drivers/net/wireless/libertas_tf/if_usb.c
index c445500ffc61..b172f5d87a3b 100644
--- a/drivers/net/wireless/libertas_tf/if_usb.c
+++ b/drivers/net/wireless/libertas_tf/if_usb.c
@@ -538,7 +538,8 @@ static void if_usb_receive_fwload(struct urb *urb)
                 return;
         }
 
-        syncfwheader = kmalloc(sizeof(struct fwsyncheader), GFP_ATOMIC);
+        syncfwheader = kmemdup(skb->data, sizeof(struct fwsyncheader),
+                               GFP_ATOMIC);
         if (!syncfwheader) {
                 lbtf_deb_usbd(&cardp->udev->dev, "Failure to allocate syncfwheader\n");
                 kfree_skb(skb);
@@ -546,8 +547,6 @@ static void if_usb_receive_fwload(struct urb *urb)
                 return;
         }
 
-        memcpy(syncfwheader, skb->data, sizeof(struct fwsyncheader));
-
         if (!syncfwheader->cmd) {
                 lbtf_deb_usb2(&cardp->udev->dev, "FW received Blk with correct CRC\n");
                 lbtf_deb_usb2(&cardp->udev->dev, "FW received Blk seqnum = %d\n",
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 6f8cb3ee6fed..af50895e4bb0 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1291,6 +1291,11 @@ static int __init init_mac80211_hwsim(void)
                 hw->wiphy->n_addresses = 2;
                 hw->wiphy->addresses = data->addresses;
 
+                if (fake_hw_scan) {
+                        hw->wiphy->max_scan_ssids = 255;
+                        hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
+                }
+
                 hw->channel_change_time = 1;
                 hw->queues = 4;
                 hw->wiphy->interface_modes =
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 808adb909095..cd37b2ac5356 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -109,7 +109,7 @@ struct mwl8k_rx_queue {
         dma_addr_t rxd_dma;
         struct {
                 struct sk_buff *skb;
-                DECLARE_PCI_UNMAP_ADDR(dma)
+                DEFINE_DMA_UNMAP_ADDR(dma);
         } *buf;
 };
 
@@ -963,7 +963,7 @@ static int rxq_refill(struct ieee80211_hw *hw, int index, int limit)
                 if (rxq->tail == MWL8K_RX_DESCS)
                         rxq->tail = 0;
                 rxq->buf[rx].skb = skb;
-                pci_unmap_addr_set(&rxq->buf[rx], dma, addr);
+                dma_unmap_addr_set(&rxq->buf[rx], dma, addr);
 
                 rxd = rxq->rxd + (rx * priv->rxd_ops->rxd_size);
                 priv->rxd_ops->rxd_refill(rxd, addr, MWL8K_RX_MAXSZ);
@@ -984,9 +984,9 @@ static void mwl8k_rxq_deinit(struct ieee80211_hw *hw, int index)
         for (i = 0; i < MWL8K_RX_DESCS; i++) {
                 if (rxq->buf[i].skb != NULL) {
                         pci_unmap_single(priv->pdev,
-                                         pci_unmap_addr(&rxq->buf[i], dma),
+                                         dma_unmap_addr(&rxq->buf[i], dma),
                                          MWL8K_RX_MAXSZ, PCI_DMA_FROMDEVICE);
-                        pci_unmap_addr_set(&rxq->buf[i], dma, 0);
+                        dma_unmap_addr_set(&rxq->buf[i], dma, 0);
 
                         kfree_skb(rxq->buf[i].skb);
                         rxq->buf[i].skb = NULL;
@@ -1060,9 +1060,9 @@ static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
                 rxq->buf[rxq->head].skb = NULL;
 
                 pci_unmap_single(priv->pdev,
-                                 pci_unmap_addr(&rxq->buf[rxq->head], dma),
+                                 dma_unmap_addr(&rxq->buf[rxq->head], dma),
                                  MWL8K_RX_MAXSZ, PCI_DMA_FROMDEVICE);
-                pci_unmap_addr_set(&rxq->buf[rxq->head], dma, 0);
+                dma_unmap_addr_set(&rxq->buf[rxq->head], dma, 0);
 
                 rxq->head++;
                 if (rxq->head == MWL8K_RX_DESCS)
diff --git a/drivers/net/wireless/orinoco/hermes_dld.c b/drivers/net/wireless/orinoco/hermes_dld.c
index 6da85e75fce0..f750f49bbd4e 100644
--- a/drivers/net/wireless/orinoco/hermes_dld.c
+++ b/drivers/net/wireless/orinoco/hermes_dld.c
@@ -68,7 +68,7 @@ struct dblock {
 } __attribute__ ((packed));
 
 /*
- * Plug Data References are located in in the image after the last data
+ * Plug Data References are located in the image after the last data
  * block.  They refer to areas in the adapter memory where the plug data
  * items with matching ID should be written.
  */
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index 78f089baa8c9..020da76c9558 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -356,12 +356,10 @@ static struct request_context *ezusb_alloc_ctx(struct ezusb_priv *upriv,
 {
         struct request_context *ctx;
 
-        ctx = kmalloc(sizeof(*ctx), GFP_ATOMIC);
+        ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
         if (!ctx)
                 return NULL;
 
-        memset(ctx, 0, sizeof(*ctx));
-
         ctx->buf = kmalloc(BULK_BUF_SIZE, GFP_ATOMIC);
         if (!ctx->buf) {
                 kfree(ctx);
diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
index 5775124e2aee..a63108c6df7d 100644
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -993,11 +993,9 @@ static int orinoco_ioctl_set_genie(struct net_device *dev,
                 return -EINVAL;
 
         if (wrqu->data.length) {
-                buf = kmalloc(wrqu->data.length, GFP_KERNEL);
+                buf = kmemdup(extra, wrqu->data.length, GFP_KERNEL);
                 if (buf == NULL)
                         return -ENOMEM;
-
-                memcpy(buf, extra, wrqu->data.length);
         } else
                 buf = NULL;
 
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
index 187e263b045a..e51650ed49f2 100644
--- a/drivers/net/wireless/p54/eeprom.c
+++ b/drivers/net/wireless/p54/eeprom.c
@@ -599,13 +599,13 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                         }
                         break;
                 case PDR_PRISM_ZIF_TX_IQ_CALIBRATION:
-                        priv->iq_autocal = kmalloc(data_len, GFP_KERNEL);
+                        priv->iq_autocal = kmemdup(entry->data, data_len,
+                                                   GFP_KERNEL);
                         if (!priv->iq_autocal) {
                                 err = -ENOMEM;
                                 goto err;
                         }
 
-                        memcpy(priv->iq_autocal, entry->data, data_len);
                         priv->iq_autocal_len = data_len / sizeof(struct pda_iq_autocal_entry);
                         break;
                 case PDR_DEFAULT_COUNTRY:
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index c8f09da1f84d..087bf0698a5a 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -697,9 +697,7 @@ static int __devexit p54spi_remove(struct spi_device *spi)
 
 static struct spi_driver p54spi_driver = {
         .driver = {
-                /* use cx3110x name because board-n800.c uses that for the
-                 * SPI port */
-                .name           = "cx3110x",
+                .name           = "p54spi",
                 .bus            = &spi_bus_type,
                 .owner          = THIS_MODULE,
         },
@@ -733,3 +731,4 @@ module_exit(p54spi_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Christian Lamparter <chunkeey@web.de>");
 MODULE_ALIAS("spi:cx3110x");
+MODULE_ALIAS("spi:p54spi");
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 73073259f508..ad595958b7df 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -69,7 +69,8 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x0915, 0x2002)},   /* Cohiba Proto board */
         {USB_DEVICE(0x0baf, 0x0118)},   /* U.S. Robotics U5 802.11g Adapter*/
         {USB_DEVICE(0x0bf8, 0x1009)},   /* FUJITSU E-5400 USB D1700*/
-        {USB_DEVICE(0x0cde, 0x0006)},   /* Medion MD40900 */
+        /* {USB_DEVICE(0x0cde, 0x0006)}, * Medion MD40900 already listed above,
+                                         * just noting it here for clarity */
         {USB_DEVICE(0x0cde, 0x0008)},   /* Sagem XG703A */
         {USB_DEVICE(0x0cde, 0x0015)},   /* Zcomax XG-705A */
         {USB_DEVICE(0x0d8e, 0x3762)},   /* DLink DWL-G120 Cohiba */
@@ -434,10 +435,9 @@ static int p54u_firmware_reset_3887(struct ieee80211_hw *dev)
         u8 *buf;
         int ret;
 
-        buf = kmalloc(4, GFP_KERNEL);
+        buf = kmemdup(p54u_romboot_3887, 4, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
-        memcpy(buf, p54u_romboot_3887, 4);
         ret = p54u_bulk_msg(priv, P54U_PIPE_DATA,
                             buf, 4);
         kfree(buf);
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index 8d1190c0f062..236e37526d07 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -2751,14 +2751,9 @@ prism54_hostapd(struct net_device *ndev, struct iw_point *p)
            p->length > PRISM2_HOSTAPD_MAX_BUF_SIZE || !p->pointer)
                return -EINVAL;
 
-       param = kmalloc(p->length, GFP_KERNEL);
-       if (param == NULL)
-               return -ENOMEM;
-
-       if (copy_from_user(param, p->pointer, p->length)) {
-               kfree(param);
-               return -EFAULT;
-       }
+        param = memdup_user(p->pointer, p->length);
+        if (IS_ERR(param))
+                return PTR_ERR(param);
 
        switch (param->cmd) {
        case PRISM2_SET_ENCRYPTION:
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 4bd61ee627c0..5e26edb57d82 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -520,8 +520,9 @@ static int rndis_scan(struct wiphy *wiphy, struct net_device *dev,
 
 static int rndis_set_wiphy_params(struct wiphy *wiphy, u32 changed);
 
-static int rndis_set_tx_power(struct wiphy *wiphy, enum tx_power_setting type,
-                                int dbm);
+static int rndis_set_tx_power(struct wiphy *wiphy,
+                              enum nl80211_tx_power_setting type,
+                              int mbm);
 static int rndis_get_tx_power(struct wiphy *wiphy, int *dbm);
 
 static int rndis_connect(struct wiphy *wiphy, struct net_device *dev,
@@ -1856,20 +1857,25 @@ static int rndis_set_wiphy_params(struct wiphy *wiphy, u32 changed)
         return 0;
 }
 
-static int rndis_set_tx_power(struct wiphy *wiphy, enum tx_power_setting type,
-                                int dbm)
+static int rndis_set_tx_power(struct wiphy *wiphy,
+                              enum nl80211_tx_power_setting type,
+                              int mbm)
 {
         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
         struct usbnet *usbdev = priv->usbdev;
 
-        netdev_dbg(usbdev->net, "%s(): type:0x%x dbm:%i\n",
-                   __func__, type, dbm);
+        netdev_dbg(usbdev->net, "%s(): type:0x%x mbm:%i\n",
+                   __func__, type, mbm);
+
+        if (mbm < 0 || (mbm % 100))
+                return -ENOTSUPP;
 
         /* Device doesn't support changing txpower after initialization, only
          * turn off/on radio. Support 'auto' mode and setting same dBm that is
          * currently used.
          */
-        if (type == TX_POWER_AUTOMATIC || dbm == get_bcm4320_power_dbm(priv)) {
+        if (type == NL80211_TX_POWER_AUTOMATIC ||
+            MBM_TO_DBM(mbm) == get_bcm4320_power_dbm(priv)) {
                 if (!priv->radio_on)
                         disassociate(usbdev, true); /* turn on radio */
 
@@ -2495,8 +2501,7 @@ static int rndis_flush_pmksa(struct wiphy *wiphy, struct net_device *netdev)
 static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
 {
         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
-        struct ndis_80211_assoc_info *info;
-        u8 assoc_buf[sizeof(*info) + IW_CUSTOM_MAX + 32];
+        struct ndis_80211_assoc_info *info = NULL;
         u8 bssid[ETH_ALEN];
         int resp_ie_len, req_ie_len;
         u8 *req_ie, *resp_ie;
@@ -2515,23 +2520,43 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
         resp_ie = NULL;
 
         if (priv->infra_mode == NDIS_80211_INFRA_INFRA) {
-                memset(assoc_buf, 0, sizeof(assoc_buf));
-                info = (void *)assoc_buf;
+                info = kzalloc(CONTROL_BUFFER_SIZE, GFP_KERNEL);
+                if (!info) {
+                        /* No memory? Try resume work later */
+                        set_bit(WORK_LINK_UP, &priv->work_pending);
+                        queue_work(priv->workqueue, &priv->work);
+                        return;
+                }
 
-                /* Get association info IEs from device and send them back to
-                 * userspace. */
-                ret = get_association_info(usbdev, info, sizeof(assoc_buf));
+                /* Get association info IEs from device. */
+                ret = get_association_info(usbdev, info, CONTROL_BUFFER_SIZE);
                 if (!ret) {
                         req_ie_len = le32_to_cpu(info->req_ie_length);
                         if (req_ie_len > 0) {
                                 offset = le32_to_cpu(info->offset_req_ies);
+
+                                if (offset > CONTROL_BUFFER_SIZE)
+                                        offset = CONTROL_BUFFER_SIZE;
+
                                 req_ie = (u8 *)info + offset;
+
+                                if (offset + req_ie_len > CONTROL_BUFFER_SIZE)
+                                        req_ie_len =
+                                                CONTROL_BUFFER_SIZE - offset;
                         }
 
                         resp_ie_len = le32_to_cpu(info->resp_ie_length);
                         if (resp_ie_len > 0) {
                                 offset = le32_to_cpu(info->offset_resp_ies);
+
+                                if (offset > CONTROL_BUFFER_SIZE)
+                                        offset = CONTROL_BUFFER_SIZE;
+
                                 resp_ie = (u8 *)info + offset;
+
+                                if (offset + resp_ie_len > CONTROL_BUFFER_SIZE)
+                                        resp_ie_len =
+                                                CONTROL_BUFFER_SIZE - offset;
                         }
                 }
         } else if (WARN_ON(priv->infra_mode != NDIS_80211_INFRA_ADHOC))
@@ -2563,6 +2588,9 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
         } else if (priv->infra_mode == NDIS_80211_INFRA_ADHOC)
                 cfg80211_ibss_joined(usbdev->net, bssid, GFP_KERNEL);
 
+        if (info != NULL)
+                kfree(info);
+
         priv->connected = true;
         memcpy(priv->bssid, bssid, ETH_ALEN);
 
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index ad2c98af7e9d..1eb882e15fb4 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1076,9 +1076,6 @@ static void rt2400pci_write_beacon(struct queue_entry *entry,
                                    struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
-        u32 word;
         u32 reg;
 
         /*
@@ -1091,9 +1088,15 @@ static void rt2400pci_write_beacon(struct queue_entry *entry,
 
         rt2x00queue_map_txskb(rt2x00dev, entry->skb);
 
-        rt2x00_desc_read(entry_priv->desc, 1, &word);
-        rt2x00_set_field32(&word, TXD_W1_BUFFER_ADDRESS, skbdesc->skb_dma);
-        rt2x00_desc_write(entry_priv->desc, 1, word);
+        /*
+         * Write the TX descriptor for the beacon.
+         */
+        rt2400pci_write_tx_desc(rt2x00dev, entry->skb, txdesc);
+
+        /*
+         * Dump beacon to userspace through debugfs.
+         */
+        rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry->skb);
 
         /*
          * Enable beaconing again.
@@ -1226,7 +1229,7 @@ static void rt2400pci_txdone(struct rt2x00_dev *rt2x00dev,
                 }
                 txdesc.retry = rt2x00_get_field32(word, TXD_W0_RETRY_COUNT);
 
-                rt2x00lib_txdone(entry, &txdesc);
+                rt2x00pci_txdone(entry, &txdesc);
         }
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 41da3d218c65..a29cb212f89a 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1233,9 +1233,6 @@ static void rt2500pci_write_beacon(struct queue_entry *entry,
                                    struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
-        u32 word;
         u32 reg;
 
         /*
@@ -1248,9 +1245,15 @@ static void rt2500pci_write_beacon(struct queue_entry *entry,
 
         rt2x00queue_map_txskb(rt2x00dev, entry->skb);
 
-        rt2x00_desc_read(entry_priv->desc, 1, &word);
-        rt2x00_set_field32(&word, TXD_W1_BUFFER_ADDRESS, skbdesc->skb_dma);
-        rt2x00_desc_write(entry_priv->desc, 1, word);
+        /*
+         * Write the TX descriptor for the beacon.
+         */
+        rt2500pci_write_tx_desc(rt2x00dev, entry->skb, txdesc);
+
+        /*
+         * Dump beacon to userspace through debugfs.
+         */
+        rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry->skb);
 
         /*
          * Enable beaconing again.
@@ -1362,7 +1365,7 @@ static void rt2500pci_txdone(struct rt2x00_dev *rt2x00dev,
                 }
                 txdesc.retry = rt2x00_get_field32(word, TXD_W0_RETRY_COUNT);
 
-                rt2x00lib_txdone(entry, &txdesc);
+                rt2x00pci_txdone(entry, &txdesc);
         }
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 9ae96a626e6d..963238c89080 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -345,9 +345,9 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
                                 struct rt2x00lib_crypto *crypto,
                                 struct ieee80211_key_conf *key)
 {
-        int timeout;
         u32 mask;
         u16 reg;
+        enum cipher curr_cipher;
 
         if (crypto->cmd == SET_KEY) {
                 /*
@@ -358,6 +358,7 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
                 mask = TXRX_CSR0_KEY_ID.bit_mask;
 
                 rt2500usb_register_read(rt2x00dev, TXRX_CSR0, &reg);
+                curr_cipher = rt2x00_get_field16(reg, TXRX_CSR0_ALGORITHM);
                 reg &= mask;
 
                 if (reg && reg == mask)
@@ -366,19 +367,17 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
                 reg = rt2x00_get_field16(reg, TXRX_CSR0_KEY_ID);
 
                 key->hw_key_idx += reg ? ffz(reg) : 0;
-
                 /*
-                 * The encryption key doesn't fit within the CSR cache,
-                 * this means we should allocate it separately and use
-                 * rt2x00usb_vendor_request() to send the key to the hardware.
+                 * Hardware requires that all keys use the same cipher
+                 * (e.g. TKIP-only, AES-only, but not TKIP+AES).
+                 * If this is not the first key, compare the cipher with the
+                 * first one and fall back to SW crypto if not the same.
                  */
-                reg = KEY_ENTRY(key->hw_key_idx);
-                timeout = REGISTER_TIMEOUT32(sizeof(crypto->key));
-                rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
-                                                    USB_VENDOR_REQUEST_OUT, reg,
-                                                    crypto->key,
-                                                    sizeof(crypto->key),
-                                                    timeout);
+                if (key->hw_key_idx > 0 && crypto->cipher != curr_cipher)
+                        return -EOPNOTSUPP;
+
+                rt2500usb_register_multiwrite(rt2x00dev, reg,
+                                              crypto->key, sizeof(crypto->key));
 
                 /*
                  * The driver does not support the IV/EIV generation
@@ -1034,7 +1033,7 @@ static void rt2500usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                     struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        __le32 *txd = (__le32 *)(skb->data - TXD_DESC_SIZE);
+        __le32 *txd = (__le32 *) skb->data;
         u32 word;
 
         /*
@@ -1080,6 +1079,7 @@ static void rt2500usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         /*
          * Register descriptor details in skb frame descriptor.
          */
+        skbdesc->flags |= SKBDESC_DESC_IN_SKB;
         skbdesc->desc = txd;
         skbdesc->desc_len = TXD_DESC_SIZE;
 }
@@ -1108,9 +1108,20 @@ static void rt2500usb_write_beacon(struct queue_entry *entry,
         rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
 
         /*
-         * Take the descriptor in front of the skb into account.
+         * Add space for the descriptor in front of the skb.
          */
         skb_push(entry->skb, TXD_DESC_SIZE);
+        memset(entry->skb->data, 0, TXD_DESC_SIZE);
+
+        /*
+         * Write the TX descriptor for the beacon.
+         */
+        rt2500usb_write_tx_desc(rt2x00dev, entry->skb, txdesc);
+
+        /*
+         * Dump beacon to userspace through debugfs.
+         */
+        rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry->skb);
 
         /*
          * USB devices cannot blindly pass the skb->len as the
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index 2aa03751c341..3ed87badc2d3 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -63,7 +63,6 @@
  */
 #define REV_RT2860C                     0x0100
 #define REV_RT2860D                     0x0101
-#define REV_RT2870D                     0x0101
 #define REV_RT2872E                     0x0200
 #define REV_RT3070E                     0x0200
 #define REV_RT3070F                     0x0201
@@ -99,6 +98,21 @@
  */
 
 /*
+ * E2PROM_CSR: PCI EEPROM control register.
+ * RELOAD: Write 1 to reload eeprom content.
+ * TYPE: 0: 93c46, 1:93c66.
+ * LOAD_STATUS: 1:loading, 0:done.
+ */
+#define E2PROM_CSR                      0x0004
+#define E2PROM_CSR_DATA_CLOCK           FIELD32(0x00000001)
+#define E2PROM_CSR_CHIP_SELECT          FIELD32(0x00000002)
+#define E2PROM_CSR_DATA_IN              FIELD32(0x00000004)
+#define E2PROM_CSR_DATA_OUT             FIELD32(0x00000008)
+#define E2PROM_CSR_TYPE                 FIELD32(0x00000030)
+#define E2PROM_CSR_LOAD_STATUS          FIELD32(0x00000040)
+#define E2PROM_CSR_RELOAD               FIELD32(0x00000080)
+
+/*
  * OPT_14: Unknown register used by rt3xxx devices.
  */
 #define OPT_14_CSR                      0x0114
@@ -322,6 +336,39 @@
 #define RX_DRX_IDX                      0x029c
 
 /*
+ * USB_DMA_CFG
+ * RX_BULK_AGG_TIMEOUT: Rx Bulk Aggregation TimeOut in unit of 33ns.
+ * RX_BULK_AGG_LIMIT: Rx Bulk Aggregation Limit in unit of 256 bytes.
+ * PHY_CLEAR: phy watch dog enable.
+ * TX_CLEAR: Clear USB DMA TX path.
+ * TXOP_HALT: Halt TXOP count down when TX buffer is full.
+ * RX_BULK_AGG_EN: Enable Rx Bulk Aggregation.
+ * RX_BULK_EN: Enable USB DMA Rx.
+ * TX_BULK_EN: Enable USB DMA Tx.
+ * EP_OUT_VALID: OUT endpoint data valid.
+ * RX_BUSY: USB DMA RX FSM busy.
+ * TX_BUSY: USB DMA TX FSM busy.
+ */
+#define USB_DMA_CFG                     0x02a0
+#define USB_DMA_CFG_RX_BULK_AGG_TIMEOUT FIELD32(0x000000ff)
+#define USB_DMA_CFG_RX_BULK_AGG_LIMIT   FIELD32(0x0000ff00)
+#define USB_DMA_CFG_PHY_CLEAR           FIELD32(0x00010000)
+#define USB_DMA_CFG_TX_CLEAR            FIELD32(0x00080000)
+#define USB_DMA_CFG_TXOP_HALT           FIELD32(0x00100000)
+#define USB_DMA_CFG_RX_BULK_AGG_EN      FIELD32(0x00200000)
+#define USB_DMA_CFG_RX_BULK_EN          FIELD32(0x00400000)
+#define USB_DMA_CFG_TX_BULK_EN          FIELD32(0x00800000)
+#define USB_DMA_CFG_EP_OUT_VALID        FIELD32(0x3f000000)
+#define USB_DMA_CFG_RX_BUSY             FIELD32(0x40000000)
+#define USB_DMA_CFG_TX_BUSY             FIELD32(0x80000000)
+
+/*
+ * US_CYC_CNT
+ */
+#define US_CYC_CNT                      0x02a4
+#define US_CYC_CNT_CLOCK_CYCLE          FIELD32(0x000000ff)
+
+/*
  * PBF_SYS_CTRL
  * HOST_RAM_WRITE: enable Host program ram write selection
  */
@@ -1389,6 +1436,10 @@ struct mac_iveiv_entry {
 #define MAC_WCID_ATTRIBUTE_CIPHER       FIELD32(0x0000000e)
 #define MAC_WCID_ATTRIBUTE_BSS_IDX      FIELD32(0x00000070)
 #define MAC_WCID_ATTRIBUTE_RX_WIUDF     FIELD32(0x00000380)
+#define MAC_WCID_ATTRIBUTE_CIPHER_EXT   FIELD32(0x00000400)
+#define MAC_WCID_ATTRIBUTE_BSS_IDX_EXT  FIELD32(0x00000800)
+#define MAC_WCID_ATTRIBUTE_WAPI_MCBC    FIELD32(0x00008000)
+#define MAC_WCID_ATTRIBUTE_WAPI_KEY_IDX FIELD32(0xff000000)
 
 /*
  * SHARED_KEY_MODE:
@@ -1510,7 +1561,9 @@ struct mac_iveiv_entry {
  */
 
 /*
- * BBP 1: TX Antenna
+ * BBP 1: TX Antenna & Power
+ * POWER: 0 - normal, 1 - drop tx power by 6dBm, 2 - drop tx power by 12dBm,
+ *      3 - increase tx power by 6dBm
  */
 #define BBP1_TX_POWER                   FIELD8(0x07)
 #define BBP1_TX_ANTENNA                 FIELD8(0x18)
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index db4250d1c8b3..14c361ae87be 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -1,9 +1,9 @@
 /*
+        Copyright (C) 2010 Ivo van Doorn <IvDoorn@gmail.com>
         Copyright (C) 2009 Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
         Copyright (C) 2009 Gertjan van Wingerde <gwingerde@gmail.com>
 
         Based on the original rt2800pci.c and rt2800usb.c.
-          Copyright (C) 2009 Ivo van Doorn <IvDoorn@gmail.com>
           Copyright (C) 2009 Alban Browaeys <prahal@yahoo.com>
           Copyright (C) 2009 Felix Fietkau <nbd@openwrt.org>
           Copyright (C) 2009 Luis Correia <luis.f.correia@gmail.com>
@@ -38,16 +38,8 @@
 #include <linux/slab.h>
 
 #include "rt2x00.h"
-#if defined(CONFIG_RT2X00_LIB_USB) || defined(CONFIG_RT2X00_LIB_USB_MODULE)
-#include "rt2x00usb.h"
-#endif
 #include "rt2800lib.h"
 #include "rt2800.h"
-#include "rt2800usb.h"
-
-MODULE_AUTHOR("Bartlomiej Zolnierkiewicz");
-MODULE_DESCRIPTION("rt2800 library");
-MODULE_LICENSE("GPL");
 
 /*
  * Register access.
@@ -282,9 +274,8 @@ int rt2800_wait_wpdma_ready(struct rt2x00_dev *rt2x00dev)
 }
 EXPORT_SYMBOL_GPL(rt2800_wait_wpdma_ready);
 
-void rt2800_write_txwi(struct sk_buff *skb, struct txentry_desc *txdesc)
+void rt2800_write_txwi(__le32 *txwi, struct txentry_desc *txdesc)
 {
-        __le32 *txwi = (__le32 *)(skb->data - TXWI_DESC_SIZE);
         u32 word;
 
         /*
@@ -380,6 +371,67 @@ void rt2800_process_rxwi(struct sk_buff *skb, struct rxdone_entry_desc *rxdesc)
 }
 EXPORT_SYMBOL_GPL(rt2800_process_rxwi);
 
+void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
+{
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        unsigned int beacon_base;
+        u32 reg;
+
+        /*
+         * Disable beaconing while we are reloading the beacon data,
+         * otherwise we might be sending out invalid data.
+         */
+        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
+        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+
+        /*
+         * Add space for the TXWI in front of the skb.
+         */
+        skb_push(entry->skb, TXWI_DESC_SIZE);
+        memset(entry->skb, 0, TXWI_DESC_SIZE);
+
+        /*
+         * Register descriptor details in skb frame descriptor.
+         */
+        skbdesc->flags |= SKBDESC_DESC_IN_SKB;
+        skbdesc->desc = entry->skb->data;
+        skbdesc->desc_len = TXWI_DESC_SIZE;
+
+        /*
+         * Add the TXWI for the beacon to the skb.
+         */
+        rt2800_write_txwi((__le32 *)entry->skb->data, txdesc);
+
+        /*
+         * Dump beacon to userspace through debugfs.
+         */
+        rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry->skb);
+
+        /*
+         * Write entire beacon with TXWI to register.
+         */
+        beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
+        rt2800_register_multiwrite(rt2x00dev, beacon_base,
+                                   entry->skb->data, entry->skb->len);
+
+        /*
+         * Enable beaconing again.
+         */
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
+        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+
+        /*
+         * Clean up beacon skb.
+         */
+        dev_kfree_skb_any(entry->skb);
+        entry->skb = NULL;
+}
+EXPORT_SYMBOL(rt2800_write_beacon);
+
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
 const struct rt2x00debug rt2800_rt2x00debug = {
         .owner  = THIS_MODULE,
@@ -502,15 +554,28 @@ static void rt2800_config_wcid_attr(struct rt2x00_dev *rt2x00dev,
 
         offset = MAC_WCID_ATTR_ENTRY(key->hw_key_idx);
 
-        rt2800_register_read(rt2x00dev, offset, &reg);
-        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_KEYTAB,
-                           !!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE));
-        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_CIPHER,
-                           (crypto->cmd == SET_KEY) * crypto->cipher);
-        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_BSS_IDX,
-                           (crypto->cmd == SET_KEY) * crypto->bssidx);
-        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_RX_WIUDF, crypto->cipher);
-        rt2800_register_write(rt2x00dev, offset, reg);
+        if (crypto->cmd == SET_KEY) {
+                rt2800_register_read(rt2x00dev, offset, &reg);
+                rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_KEYTAB,
+                                   !!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE));
+                /*
+                 * Both the cipher as the BSS Idx numbers are split in a main
+                 * value of 3 bits, and a extended field for adding one additional
+                 * bit to the value.
+                 */
+                rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_CIPHER,
+                                   (crypto->cipher & 0x7));
+                rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_CIPHER_EXT,
+                                   (crypto->cipher & 0x8) >> 3);
+                rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_BSS_IDX,
+                                   (crypto->bssidx & 0x7));
+                rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_BSS_IDX_EXT,
+                                   (crypto->bssidx & 0x8) >> 3);
+                rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_RX_WIUDF, crypto->cipher);
+                rt2800_register_write(rt2x00dev, offset, reg);
+        } else {
+                rt2800_register_write(rt2x00dev, offset, 0);
+        }
 
         offset = MAC_IVEIV_ENTRY(key->hw_key_idx);
 
@@ -1023,7 +1088,7 @@ static void rt2800_config_txpower(struct rt2x00_dev *rt2x00dev,
         u8 r1;
 
         rt2800_bbp_read(rt2x00dev, 1, &r1);
-        rt2x00_set_field8(&reg, BBP1_TX_POWER, 0);
+        rt2x00_set_field8(&r1, BBP1_TX_POWER, 0);
         rt2800_bbp_write(rt2x00dev, 1, r1);
 
         rt2800_register_read(rt2x00dev, TX_PWR_CFG_0, &reg);
@@ -1212,6 +1277,7 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
         u32 reg;
         u16 eeprom;
         unsigned int i;
+        int ret;
 
         rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
         rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
@@ -1221,59 +1287,9 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
         rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
 
-        if (rt2x00_is_usb(rt2x00dev)) {
-                /*
-                 * Wait until BBP and RF are ready.
-                 */
-                for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                        rt2800_register_read(rt2x00dev, MAC_CSR0, &reg);
-                        if (reg && reg != ~0)
-                                break;
-                        msleep(1);
-                }
-
-                if (i == REGISTER_BUSY_COUNT) {
-                        ERROR(rt2x00dev, "Unstable hardware.\n");
-                        return -EBUSY;
-                }
-
-                rt2800_register_read(rt2x00dev, PBF_SYS_CTRL, &reg);
-                rt2800_register_write(rt2x00dev, PBF_SYS_CTRL,
-                                      reg & ~0x00002000);
-        } else if (rt2x00_is_pci(rt2x00dev) || rt2x00_is_soc(rt2x00dev)) {
-                /*
-                 * Reset DMA indexes
-                 */
-                rt2800_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
-                rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, 1);
-                rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, 1);
-                rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX2, 1);
-                rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX3, 1);
-                rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX4, 1);
-                rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX5, 1);
-                rt2x00_set_field32(&reg, WPDMA_RST_IDX_DRX_IDX0, 1);
-                rt2800_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
-
-                rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e1f);
-                rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e00);
-
-                rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000003);
-        }
-
-        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
-        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_CSR, 1);
-        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_BBP, 1);
-        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
-
-        if (rt2x00_is_usb(rt2x00dev)) {
-                rt2800_register_write(rt2x00dev, USB_DMA_CFG, 0x00000000);
-#if defined(CONFIG_RT2X00_LIB_USB) || defined(CONFIG_RT2X00_LIB_USB_MODULE)
-                rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0,
-                                            USB_MODE_RESET, REGISTER_TIMEOUT);
-#endif
-        }
-
-        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
+        ret = rt2800_drv_init_registers(rt2x00dev);
+        if (ret)
+                return ret;
 
         rt2800_register_read(rt2x00dev, BCN_OFFSET0, &reg);
         rt2x00_set_field32(&reg, BCN_OFFSET0_BCN0, 0xe0); /* 0x3800 */
@@ -1328,7 +1344,6 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
                 } else {
                         rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
                 }
-                rt2800_register_write(rt2x00dev, TX_SW_CFG2, reg);
         } else if (rt2x00_rt(rt2x00dev, RT3070)) {
                 rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000400);
 
@@ -1339,6 +1354,10 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
                         rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
                         rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
                 }
+        } else if (rt2800_is_305x_soc(rt2x00dev)) {
+                rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000400);
+                rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00000000);
+                rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x0000001f);
         } else {
                 rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000000);
                 rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
@@ -1560,9 +1579,9 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2800_register_write(rt2x00dev, HW_BEACON_BASE7, 0);
 
         if (rt2x00_is_usb(rt2x00dev)) {
-                rt2800_register_read(rt2x00dev, USB_CYC_CFG, &reg);
-                rt2x00_set_field32(&reg, USB_CYC_CFG_CLOCK_CYCLE, 30);
-                rt2800_register_write(rt2x00dev, USB_CYC_CFG, reg);
+                rt2800_register_read(rt2x00dev, US_CYC_CNT, &reg);
+                rt2x00_set_field32(&reg, US_CYC_CNT_CLOCK_CYCLE, 30);
+                rt2800_register_write(rt2x00dev, US_CYC_CNT, reg);
         }
 
         rt2800_register_read(rt2x00dev, HT_FBK_CFG0, &reg);
@@ -1706,8 +1725,7 @@ int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
         rt2800_bbp_write(rt2x00dev, 82, 0x62);
         rt2800_bbp_write(rt2x00dev, 83, 0x6a);
 
-        if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860D) ||
-            rt2x00_rt_rev(rt2x00dev, RT2870, REV_RT2870D))
+        if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860D))
                 rt2800_bbp_write(rt2x00dev, 84, 0x19);
         else
                 rt2800_bbp_write(rt2x00dev, 84, 0x99);
@@ -2013,8 +2031,7 @@ int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
         if (rt2x00_rt_rev_lt(rt2x00dev, RT3071, REV_RT3071E) ||
             rt2x00_rt_rev_lt(rt2x00dev, RT3090, REV_RT3090E) ||
             rt2x00_rt_rev_lt(rt2x00dev, RT3390, REV_RT3390E)) {
-                rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC, &eeprom);
-                if (rt2x00_get_field16(eeprom, EEPROM_NIC_EXTERNAL_LNA_BG))
+                if (test_bit(CONFIG_EXTERNAL_LNA_BG, &rt2x00dev->flags))
                         rt2x00_set_field8(&rfcsr, RFCSR17_R, 1);
         }
         rt2x00_eeprom_read(rt2x00dev, EEPROM_TXMIXER_GAIN_BG, &eeprom);
@@ -2147,7 +2164,6 @@ int rt2800_validate_eeprom(struct rt2x00_dev *rt2x00dev)
                 rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
                 EEPROM(rt2x00dev, "Antenna: 0x%04x\n", word);
         } else if (rt2x00_rt(rt2x00dev, RT2860) ||
-                   rt2x00_rt(rt2x00dev, RT2870) ||
                    rt2x00_rt(rt2x00dev, RT2872)) {
                 /*
                  * There is a max of 2 RX streams for RT28x0 series
@@ -2251,7 +2267,6 @@ int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
                         value, rt2x00_get_field32(reg, MAC_CSR0_REVISION));
 
         if (!rt2x00_rt(rt2x00dev, RT2860) &&
-            !rt2x00_rt(rt2x00dev, RT2870) &&
             !rt2x00_rt(rt2x00dev, RT2872) &&
             !rt2x00_rt(rt2x00dev, RT2883) &&
             !rt2x00_rt(rt2x00dev, RT3070) &&
@@ -2491,6 +2506,18 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                                 rt2x00_eeprom_addr(rt2x00dev,
                                                    EEPROM_MAC_ADDR_0));
 
+        /*
+         * As rt2800 has a global fallback table we cannot specify
+         * more then one tx rate per frame but since the hw will
+         * try several rates (based on the fallback table) we should
+         * still initialize max_rates to the maximum number of rates
+         * we are going to try. Otherwise mac80211 will truncate our
+         * reported tx rates and the rc algortihm will end up with
+         * incorrect data.
+         */
+        rt2x00dev->hw->max_rates = 7;
+        rt2x00dev->hw->max_rate_tries = 1;
+
         rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &eeprom);
 
         /*
@@ -2528,16 +2555,16 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         else
                 spec->ht.ht_supported = false;
 
-        /*
-         * Don't set IEEE80211_HT_CAP_SUP_WIDTH_20_40 for now as it causes
-         * reception problems with HT40 capable 11n APs
-         */
         spec->ht.cap =
+            IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
             IEEE80211_HT_CAP_GRN_FLD |
             IEEE80211_HT_CAP_SGI_20 |
             IEEE80211_HT_CAP_SGI_40 |
-            IEEE80211_HT_CAP_TX_STBC |
             IEEE80211_HT_CAP_RX_STBC;
+
+        if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_TXPATH) >= 2)
+                spec->ht.cap |= IEEE80211_HT_CAP_TX_STBC;
+
         spec->ht.ampdu_factor = 3;
         spec->ht.ampdu_density = 4;
         spec->ht.mcs.tx_params =
@@ -2743,3 +2770,8 @@ const struct ieee80211_ops rt2800_mac80211_ops = {
         .rfkill_poll            = rt2x00mac_rfkill_poll,
 };
 EXPORT_SYMBOL_GPL(rt2800_mac80211_ops);
+
+MODULE_AUTHOR(DRV_PROJECT ", Bartlomiej Zolnierkiewicz");
+MODULE_VERSION(DRV_VERSION);
+MODULE_DESCRIPTION("Ralink RT2800 library");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.h b/drivers/net/wireless/rt2x00/rt2800lib.h
index 94de999e2290..8313dbf441a5 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.h
+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
@@ -40,6 +40,8 @@ struct rt2800_ops {
         int (*regbusy_read)(struct rt2x00_dev *rt2x00dev,
                             const unsigned int offset,
                             const struct rt2x00_field32 field, u32 *reg);
+
+        int (*drv_init_registers)(struct rt2x00_dev *rt2x00dev);
 };
 
 static inline void rt2800_register_read(struct rt2x00_dev *rt2x00dev,
@@ -107,13 +109,22 @@ static inline int rt2800_regbusy_read(struct rt2x00_dev *rt2x00dev,
         return rt2800ops->regbusy_read(rt2x00dev, offset, field, reg);
 }
 
+static inline int rt2800_drv_init_registers(struct rt2x00_dev *rt2x00dev)
+{
+        const struct rt2800_ops *rt2800ops = rt2x00dev->priv;
+
+        return rt2800ops->drv_init_registers(rt2x00dev);
+}
+
 void rt2800_mcu_request(struct rt2x00_dev *rt2x00dev,
                         const u8 command, const u8 token,
                         const u8 arg0, const u8 arg1);
 
-void rt2800_write_txwi(struct sk_buff *skb, struct txentry_desc *txdesc);
+void rt2800_write_txwi(__le32 *txwi, struct txentry_desc *txdesc);
 void rt2800_process_rxwi(struct sk_buff *skb, struct rxdone_entry_desc *txdesc);
 
+void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc);
+
 extern const struct rt2x00debug rt2800_rt2x00debug;
 
 int rt2800_rfkill_poll(struct rt2x00_dev *rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index b2f23272c3aa..e5ea670a18db 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -51,7 +51,7 @@
 /*
  * Allow hardware encryption to be disabled.
  */
-static int modparam_nohwcrypt = 1;
+static int modparam_nohwcrypt = 0;
 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
 
@@ -446,6 +446,38 @@ static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
         rt2800_register_write(rt2x00dev, INT_MASK_CSR, reg);
 }
 
+static int rt2800pci_init_registers(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+
+        /*
+         * Reset DMA indexes
+         */
+        rt2800_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX2, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX3, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX4, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX5, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DRX_IDX0, 1);
+        rt2800_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
+
+        rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e1f);
+        rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e00);
+
+        rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000003);
+
+        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_CSR, 1);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_BBP, 1);
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
+
+        return 0;
+}
+
 static int rt2800pci_enable_radio(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
@@ -465,7 +497,7 @@ static int rt2800pci_enable_radio(struct rt2x00_dev *rt2x00dev)
         /*
          * Send signal to firmware during boot time.
          */
-        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0xff, 0, 0);
+        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
 
         /*
          * Enable RX.
@@ -613,18 +645,10 @@ static int rt2800pci_set_device_state(struct rt2x00_dev *rt2x00dev,
 /*
  * TX descriptor initialization
  */
-static int rt2800pci_write_tx_data(struct queue_entry* entry,
-                                   struct txentry_desc *txdesc)
+static void rt2800pci_write_tx_datadesc(struct queue_entry* entry,
+                                         struct txentry_desc *txdesc)
 {
-        int ret;
-
-        ret = rt2x00pci_write_tx_data(entry, txdesc);
-        if (ret)
-                return ret;
-
-        rt2800_write_txwi(entry->skb, txdesc);
-
-        return 0;
+        rt2800_write_txwi((__le32 *) entry->skb->data, txdesc);
 }
 
 
@@ -684,49 +708,6 @@ static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 /*
  * TX data initialization
  */
-static void rt2800pci_write_beacon(struct queue_entry *entry,
-                                   struct txentry_desc *txdesc)
-{
-        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        unsigned int beacon_base;
-        u32 reg;
-
-        /*
-         * Disable beaconing while we are reloading the beacon data,
-         * otherwise we might be sending out invalid data.
-         */
-        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
-        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
-
-        /*
-         * Add the TXWI for the beacon to the skb.
-         */
-        rt2800_write_txwi(entry->skb, txdesc);
-        skb_push(entry->skb, TXWI_DESC_SIZE);
-
-        /*
-         * Write entire beacon with TXWI to register.
-         */
-        beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
-        rt2800_register_multiwrite(rt2x00dev, beacon_base,
-                                   entry->skb->data, entry->skb->len);
-
-        /*
-         * Enable beaconing again.
-         */
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
-        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
-
-        /*
-         * Clean up beacon skb.
-         */
-        dev_kfree_skb_any(entry->skb);
-        entry->skb = NULL;
-}
-
 static void rt2800pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
                                     const enum data_queue_qid queue_idx)
 {
@@ -832,29 +813,24 @@ static void rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
         struct txdone_entry_desc txdesc;
         u32 word;
         u32 reg;
-        u32 old_reg;
         int wcid, ack, pid, tx_wcid, tx_ack, tx_pid;
         u16 mcs, real_mcs;
+        int i;
 
         /*
-         * During each loop we will compare the freshly read
-         * TX_STA_FIFO register value with the value read from
-         * the previous loop. If the 2 values are equal then
-         * we should stop processing because the chance it
-         * quite big that the device has been unplugged and
-         * we risk going into an endless loop.
+         * TX_STA_FIFO is a stack of X entries, hence read TX_STA_FIFO
+         * at most X times and also stop processing once the TX_STA_FIFO_VALID
+         * flag is not set anymore.
+         *
+         * The legacy drivers use X=TX_RING_SIZE but state in a comment
+         * that the TX_STA_FIFO stack has a size of 16. We stick to our
+         * tx ring size for now.
          */
-        old_reg = 0;
-
-        while (1) {
+        for (i = 0; i < TX_ENTRIES; i++) {
                 rt2800_register_read(rt2x00dev, TX_STA_FIFO, &reg);
                 if (!rt2x00_get_field32(reg, TX_STA_FIFO_VALID))
                         break;
 
-                if (old_reg == reg)
-                        break;
-                old_reg = reg;
-
                 wcid    = rt2x00_get_field32(reg, TX_STA_FIFO_WCID);
                 ack     = rt2x00_get_field32(reg, TX_STA_FIFO_TX_ACK_REQUIRED);
                 pid     = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE);
@@ -880,8 +856,7 @@ static void rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
 
                 /* Check if we got a match by looking at WCID/ACK/PID
                  * fields */
-                txwi = (__le32 *)(entry->skb->data -
-                                  rt2x00dev->ops->extra_tx_headroom);
+                txwi = (__le32 *) entry->skb->data;
 
                 rt2x00_desc_read(txwi, 1, &word);
                 tx_wcid = rt2x00_get_field32(word, TXWI_W1_WIRELESS_CLI_ID);
@@ -923,10 +898,14 @@ static void rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
                         txdesc.retry = 7;
                 }
 
-                __set_bit(TXDONE_FALLBACK, &txdesc.flags);
-
+                /*
+                 * the frame was retried at least once
+                 * -> hw used fallback rates
+                 */
+                if (txdesc.retry)
+                        __set_bit(TXDONE_FALLBACK, &txdesc.flags);
 
-                rt2x00lib_txdone(entry, &txdesc);
+                rt2x00pci_txdone(entry, &txdesc);
         }
 }
 
@@ -996,6 +975,8 @@ static const struct rt2800_ops rt2800pci_rt2800_ops = {
         .register_multiwrite    = rt2x00pci_register_multiwrite,
 
         .regbusy_read           = rt2x00pci_regbusy_read,
+
+        .drv_init_registers     = rt2800pci_init_registers,
 };
 
 static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
@@ -1063,8 +1044,9 @@ static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
         .reset_tuner            = rt2800_reset_tuner,
         .link_tuner             = rt2800_link_tuner,
         .write_tx_desc          = rt2800pci_write_tx_desc,
-        .write_tx_data          = rt2800pci_write_tx_data,
-        .write_beacon           = rt2800pci_write_beacon,
+        .write_tx_data          = rt2x00pci_write_tx_data,
+        .write_tx_datadesc      = rt2800pci_write_tx_datadesc,
+        .write_beacon           = rt2800_write_beacon,
         .kick_tx_queue          = rt2800pci_kick_tx_queue,
         .kill_tx_queue          = rt2800pci_kill_tx_queue,
         .fill_rxdone            = rt2800pci_fill_rxdone,
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.h b/drivers/net/wireless/rt2x00/rt2800pci.h
index afc8e7da27cb..5a8dda9b5b5a 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.h
+++ b/drivers/net/wireless/rt2x00/rt2800pci.h
@@ -35,25 +35,6 @@
 #define RT2800PCI_H
 
 /*
- * PCI registers.
- */
-
-/*
- * E2PROM_CSR: EEPROM control register.
- * RELOAD: Write 1 to reload eeprom content.
- * TYPE: 0: 93c46, 1:93c66.
- * LOAD_STATUS: 1:loading, 0:done.
- */
-#define E2PROM_CSR                      0x0004
-#define E2PROM_CSR_DATA_CLOCK           FIELD32(0x00000001)
-#define E2PROM_CSR_CHIP_SELECT          FIELD32(0x00000002)
-#define E2PROM_CSR_DATA_IN              FIELD32(0x00000004)
-#define E2PROM_CSR_DATA_OUT             FIELD32(0x00000008)
-#define E2PROM_CSR_TYPE                 FIELD32(0x00000030)
-#define E2PROM_CSR_LOAD_STATUS          FIELD32(0x00000040)
-#define E2PROM_CSR_RELOAD               FIELD32(0x00000080)
-
-/*
  * Queue register offset macros
  */
 #define TX_QUEUE_REG_OFFSET             0x10
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 0f8b84b7224c..f18c12a19cc9 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -45,7 +45,7 @@
 /*
  * Allow hardware encryption to be disabled.
  */
-static int modparam_nohwcrypt = 1;
+static int modparam_nohwcrypt = 0;
 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
 
@@ -169,11 +169,8 @@ static int rt2800usb_load_firmware(struct rt2x00_dev *rt2x00dev,
         /*
          * Write firmware to device.
          */
-        rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
-                                            USB_VENDOR_REQUEST_OUT,
-                                            FIRMWARE_IMAGE_BASE,
-                                            data + offset, length,
-                                            REGISTER_TIMEOUT32(length));
+        rt2800_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
+                                   data + offset, length);
 
         rt2800_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
         rt2800_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
@@ -196,7 +193,7 @@ static int rt2800usb_load_firmware(struct rt2x00_dev *rt2x00dev,
         /*
          * Send signal to firmware during boot time.
          */
-        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0xff, 0, 0);
+        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
 
         if (rt2x00_rt(rt2x00dev, RT3070) ||
             rt2x00_rt(rt2x00dev, RT3071) ||
@@ -246,6 +243,44 @@ static void rt2800usb_toggle_rx(struct rt2x00_dev *rt2x00dev,
         rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
 }
 
+static int rt2800usb_init_registers(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        int i;
+
+        /*
+         * Wait until BBP and RF are ready.
+         */
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2800_register_read(rt2x00dev, MAC_CSR0, &reg);
+                if (reg && reg != ~0)
+                        break;
+                msleep(1);
+        }
+
+        if (i == REGISTER_BUSY_COUNT) {
+                ERROR(rt2x00dev, "Unstable hardware.\n");
+                return -EBUSY;
+        }
+
+        rt2800_register_read(rt2x00dev, PBF_SYS_CTRL, &reg);
+        rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, reg & ~0x00002000);
+
+        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_CSR, 1);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_BBP, 1);
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        rt2800_register_write(rt2x00dev, USB_DMA_CFG, 0x00000000);
+
+        rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0,
+                                    USB_MODE_RESET, REGISTER_TIMEOUT);
+
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
+
+        return 0;
+}
+
 static int rt2800usb_enable_radio(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
@@ -400,20 +435,21 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                     struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        __le32 *txi = (__le32 *)(skb->data - TXWI_DESC_SIZE - TXINFO_DESC_SIZE);
+        __le32 *txi = (__le32 *) skb->data;
+        __le32 *txwi = (__le32 *) (skb->data + TXINFO_DESC_SIZE);
         u32 word;
 
         /*
          * Initialize TXWI descriptor
          */
-        rt2800_write_txwi(skb, txdesc);
+        rt2800_write_txwi(txwi, txdesc);
 
         /*
          * Initialize TXINFO descriptor
          */
         rt2x00_desc_read(txi, 0, &word);
         rt2x00_set_field32(&word, TXINFO_W0_USB_DMA_TX_PKT_LEN,
-                           skb->len + TXWI_DESC_SIZE);
+                           skb->len - TXINFO_DESC_SIZE);
         rt2x00_set_field32(&word, TXINFO_W0_WIV,
                            !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc->flags));
         rt2x00_set_field32(&word, TXINFO_W0_QSEL, 2);
@@ -426,6 +462,7 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         /*
          * Register descriptor details in skb frame descriptor.
          */
+        skbdesc->flags |= SKBDESC_DESC_IN_SKB;
         skbdesc->desc = txi;
         skbdesc->desc_len = TXINFO_DESC_SIZE + TXWI_DESC_SIZE;
 }
@@ -433,51 +470,6 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 /*
  * TX data initialization
  */
-static void rt2800usb_write_beacon(struct queue_entry *entry,
-                                   struct txentry_desc *txdesc)
-{
-        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        unsigned int beacon_base;
-        u32 reg;
-
-        /*
-         * Disable beaconing while we are reloading the beacon data,
-         * otherwise we might be sending out invalid data.
-         */
-        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
-        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
-
-        /*
-         * Add the TXWI for the beacon to the skb.
-         */
-        rt2800_write_txwi(entry->skb, txdesc);
-        skb_push(entry->skb, TXWI_DESC_SIZE);
-
-        /*
-         * Write entire beacon with descriptor to register.
-         */
-        beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
-        rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
-                                            USB_VENDOR_REQUEST_OUT, beacon_base,
-                                            entry->skb->data, entry->skb->len,
-                                            REGISTER_TIMEOUT32(entry->skb->len));
-
-        /*
-         * Enable beaconing again.
-         */
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
-        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
-
-        /*
-         * Clean up the beacon skb.
-         */
-        dev_kfree_skb(entry->skb);
-        entry->skb = NULL;
-}
-
 static int rt2800usb_get_tx_data_len(struct queue_entry *entry)
 {
         int length;
@@ -595,6 +587,8 @@ static const struct rt2800_ops rt2800usb_rt2800_ops = {
         .register_multiwrite    = rt2x00usb_register_multiwrite,
 
         .regbusy_read           = rt2x00usb_regbusy_read,
+
+        .drv_init_registers     = rt2800usb_init_registers,
 };
 
 static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
@@ -659,7 +653,7 @@ static const struct rt2x00lib_ops rt2800usb_rt2x00_ops = {
         .link_tuner             = rt2800_link_tuner,
         .write_tx_desc          = rt2800usb_write_tx_desc,
         .write_tx_data          = rt2x00usb_write_tx_data,
-        .write_beacon           = rt2800usb_write_beacon,
+        .write_beacon           = rt2800_write_beacon,
         .get_tx_data_len        = rt2800usb_get_tx_data_len,
         .kick_tx_queue          = rt2x00usb_kick_tx_queue,
         .kill_tx_queue          = rt2x00usb_kill_tx_queue,
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.h b/drivers/net/wireless/rt2x00/rt2800usb.h
index 2bca6a71a7f5..0722badccf86 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.h
+++ b/drivers/net/wireless/rt2x00/rt2800usb.h
@@ -32,43 +32,6 @@
 #define RT2800USB_H
 
 /*
- * USB registers.
- */
-
-/*
- * USB_DMA_CFG
- * RX_BULK_AGG_TIMEOUT: Rx Bulk Aggregation TimeOut in unit of 33ns.
- * RX_BULK_AGG_LIMIT: Rx Bulk Aggregation Limit in unit of 256 bytes.
- * PHY_CLEAR: phy watch dog enable.
- * TX_CLEAR: Clear USB DMA TX path.
- * TXOP_HALT: Halt TXOP count down when TX buffer is full.
- * RX_BULK_AGG_EN: Enable Rx Bulk Aggregation.
- * RX_BULK_EN: Enable USB DMA Rx.
- * TX_BULK_EN: Enable USB DMA Tx.
- * EP_OUT_VALID: OUT endpoint data valid.
- * RX_BUSY: USB DMA RX FSM busy.
- * TX_BUSY: USB DMA TX FSM busy.
- */
-#define USB_DMA_CFG                     0x02a0
-#define USB_DMA_CFG_RX_BULK_AGG_TIMEOUT FIELD32(0x000000ff)
-#define USB_DMA_CFG_RX_BULK_AGG_LIMIT   FIELD32(0x0000ff00)
-#define USB_DMA_CFG_PHY_CLEAR           FIELD32(0x00010000)
-#define USB_DMA_CFG_TX_CLEAR            FIELD32(0x00080000)
-#define USB_DMA_CFG_TXOP_HALT           FIELD32(0x00100000)
-#define USB_DMA_CFG_RX_BULK_AGG_EN      FIELD32(0x00200000)
-#define USB_DMA_CFG_RX_BULK_EN          FIELD32(0x00400000)
-#define USB_DMA_CFG_TX_BULK_EN          FIELD32(0x00800000)
-#define USB_DMA_CFG_EP_OUT_VALID        FIELD32(0x3f000000)
-#define USB_DMA_CFG_RX_BUSY             FIELD32(0x40000000)
-#define USB_DMA_CFG_TX_BUSY             FIELD32(0x80000000)
-
-/*
- * USB_CYC_CFG
- */
-#define USB_CYC_CFG                     0x02a4
-#define USB_CYC_CFG_CLOCK_CYCLE         FIELD32(0x000000ff)
-
-/*
  * 8051 firmware image.
  */
 #define FIRMWARE_RT2870                 "rt2870.bin"
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 6c1ff4c15c84..e7acc6abfd89 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -39,6 +39,7 @@
 #include <net/mac80211.h>
 
 #include "rt2x00debug.h"
+#include "rt2x00dump.h"
 #include "rt2x00leds.h"
 #include "rt2x00reg.h"
 #include "rt2x00queue.h"
@@ -159,6 +160,7 @@ struct avg_val {
 
 enum rt2x00_chip_intf {
         RT2X00_CHIP_INTF_PCI,
+        RT2X00_CHIP_INTF_PCIE,
         RT2X00_CHIP_INTF_USB,
         RT2X00_CHIP_INTF_SOC,
 };
@@ -175,8 +177,7 @@ struct rt2x00_chip {
 #define RT2570          0x2570
 #define RT2661          0x2661
 #define RT2573          0x2573
-#define RT2860          0x2860  /* 2.4GHz PCI/CB */
-#define RT2870          0x2870
+#define RT2860          0x2860  /* 2.4GHz */
 #define RT2872          0x2872  /* WSOC */
 #define RT2883          0x2883  /* WSOC */
 #define RT3070          0x3070
@@ -551,6 +552,8 @@ struct rt2x00lib_ops {
                                struct txentry_desc *txdesc);
         int (*write_tx_data) (struct queue_entry *entry,
                               struct txentry_desc *txdesc);
+        void (*write_tx_datadesc) (struct queue_entry *entry,
+                                   struct txentry_desc *txdesc);
         void (*write_beacon) (struct queue_entry *entry,
                               struct txentry_desc *txdesc);
         int (*get_tx_data_len) (struct queue_entry *entry);
@@ -978,7 +981,13 @@ static inline bool rt2x00_intf(struct rt2x00_dev *rt2x00dev,
 
 static inline bool rt2x00_is_pci(struct rt2x00_dev *rt2x00dev)
 {
-        return rt2x00_intf(rt2x00dev, RT2X00_CHIP_INTF_PCI);
+        return rt2x00_intf(rt2x00dev, RT2X00_CHIP_INTF_PCI) ||
+               rt2x00_intf(rt2x00dev, RT2X00_CHIP_INTF_PCIE);
+}
+
+static inline bool rt2x00_is_pcie(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_intf(rt2x00dev, RT2X00_CHIP_INTF_PCIE);
 }
 
 static inline bool rt2x00_is_usb(struct rt2x00_dev *rt2x00dev)
@@ -999,6 +1008,13 @@ static inline bool rt2x00_is_soc(struct rt2x00_dev *rt2x00dev)
 void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb);
 
 /**
+ * rt2x00queue_unmap_skb - Unmap a skb from DMA.
+ * @rt2x00dev: Pointer to &struct rt2x00_dev.
+ * @skb: The skb to unmap.
+ */
+void rt2x00queue_unmap_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb);
+
+/**
  * rt2x00queue_get_queue - Convert queue index to queue pointer
  * @rt2x00dev: Pointer to &struct rt2x00_dev.
  * @queue: rt2x00 queue index (see &enum data_queue_qid).
@@ -1015,6 +1031,26 @@ struct queue_entry *rt2x00queue_get_entry(struct data_queue *queue,
                                           enum queue_index index);
 
 /*
+ * Debugfs handlers.
+ */
+/**
+ * rt2x00debug_dump_frame - Dump a frame to userspace through debugfs.
+ * @rt2x00dev: Pointer to &struct rt2x00_dev.
+ * @type: The type of frame that is being dumped.
+ * @skb: The skb containing the frame to be dumped.
+ */
+#ifdef CONFIG_RT2X00_LIB_DEBUGFS
+void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
+                            enum rt2x00_dump_type type, struct sk_buff *skb);
+#else
+static inline void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
+                                          enum rt2x00_dump_type type,
+                                          struct sk_buff *skb)
+{
+}
+#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
+
+/*
  * Interrupt context handlers.
  */
 void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 098315a271ca..8dbd634dae27 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -170,23 +170,27 @@ void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
                       unsigned int ieee80211_flags)
 {
         struct rt2x00lib_conf libconf;
+        u16 hw_value;
 
         memset(&libconf, 0, sizeof(libconf));
 
         libconf.conf = conf;
 
         if (ieee80211_flags & IEEE80211_CONF_CHANGE_CHANNEL) {
-                if (conf_is_ht40(conf))
+                if (conf_is_ht40(conf)) {
                         __set_bit(CONFIG_CHANNEL_HT40, &rt2x00dev->flags);
-                else
+                        hw_value = rt2x00ht_center_channel(rt2x00dev, conf);
+                } else {
                         __clear_bit(CONFIG_CHANNEL_HT40, &rt2x00dev->flags);
+                        hw_value = conf->channel->hw_value;
+                }
 
                 memcpy(&libconf.rf,
-                       &rt2x00dev->spec.channels[conf->channel->hw_value],
+                       &rt2x00dev->spec.channels[hw_value],
                        sizeof(libconf.rf));
 
                 memcpy(&libconf.channel,
-                       &rt2x00dev->spec.channels_info[conf->channel->hw_value],
+                       &rt2x00dev->spec.channels_info[hw_value],
                        sizeof(libconf.channel));
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index e9fe93fd8042..b0498e7e7aae 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -211,6 +211,7 @@ void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
         if (!test_bit(FRAME_DUMP_FILE_OPEN, &intf->frame_dump_flags))
                 skb_queue_purge(&intf->frame_dump_skbqueue);
 }
+EXPORT_SYMBOL_GPL(rt2x00debug_dump_frame);
 
 static int rt2x00debug_file_open(struct inode *inode, struct file *file)
 {
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 3ae468c4d760..339cc84bf4fb 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -211,11 +211,6 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         bool success;
 
         /*
-         * Unmap the skb.
-         */
-        rt2x00queue_unmap_skb(rt2x00dev, entry->skb);
-
-        /*
          * Remove L2 padding which was added during
          */
         if (test_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags))
@@ -224,7 +219,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         /*
          * If the IV/EIV data was stripped from the frame before it was
          * passed to the hardware, we should now reinsert it again because
-         * mac80211 will expect the the same data to be present it the
+         * mac80211 will expect the same data to be present it the
          * frame as it was passed to us.
          */
         if (test_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags))
@@ -241,8 +236,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
          */
         success =
             test_bit(TXDONE_SUCCESS, &txdesc->flags) ||
-            test_bit(TXDONE_UNKNOWN, &txdesc->flags) ||
-            test_bit(TXDONE_FALLBACK, &txdesc->flags);
+            test_bit(TXDONE_UNKNOWN, &txdesc->flags);
 
         /*
          * Update TX statistics.
@@ -264,11 +258,22 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         /*
          * Frame was send with retries, hardware tried
          * different rates to send out the frame, at each
-         * retry it lowered the rate 1 step.
+         * retry it lowered the rate 1 step except when the
+         * lowest rate was used.
          */
         for (i = 0; i < retry_rates && i < IEEE80211_TX_MAX_RATES; i++) {
                 tx_info->status.rates[i].idx = rate_idx - i;
                 tx_info->status.rates[i].flags = rate_flags;
+
+                if (rate_idx - i == 0) {
+                        /*
+                         * The lowest rate (index 0) was used until the
+                         * number of max retries was reached.
+                         */
+                        tx_info->status.rates[i].count = retry_rates - i;
+                        i++;
+                        break;
+                }
                 tx_info->status.rates[i].count = 1;
         }
         if (i < (IEEE80211_TX_MAX_RATES - 1))
diff --git a/drivers/net/wireless/rt2x00/rt2x00dump.h b/drivers/net/wireless/rt2x00/rt2x00dump.h
index ed303b423e41..6df2e0b746b8 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dump.h
+++ b/drivers/net/wireless/rt2x00/rt2x00dump.h
@@ -20,7 +20,12 @@
 
 /*
         Module: rt2x00dump
-        Abstract: Data structures for the rt2x00debug & userspace.
+        Abstract:
+                Data structures for the rt2x00debug & userspace.
+
+                The declarations in this file can be used by both rt2x00
+                and userspace and therefore should be kept together in
+                this file.
  */
 
 #ifndef RT2X00DUMP_H
diff --git a/drivers/net/wireless/rt2x00/rt2x00ht.c b/drivers/net/wireless/rt2x00/rt2x00ht.c
index 5a407602ce3e..c004cd3a8847 100644
--- a/drivers/net/wireless/rt2x00/rt2x00ht.c
+++ b/drivers/net/wireless/rt2x00/rt2x00ht.c
@@ -44,11 +44,22 @@ void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
                 txdesc->mpdu_density = 0;
 
         txdesc->ba_size = 7;    /* FIXME: What value is needed? */
-        txdesc->stbc = 0;       /* FIXME: What value is needed? */
 
-        txdesc->mcs = rt2x00_get_rate_mcs(hwrate->mcs);
-        if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
-                txdesc->mcs |= 0x08;
+        txdesc->stbc =
+            (tx_info->flags & IEEE80211_TX_CTL_STBC) >> IEEE80211_TX_CTL_STBC_SHIFT;
+
+        /*
+         * If IEEE80211_TX_RC_MCS is set txrate->idx just contains the
+         * mcs rate to be used
+         */
+        if (txrate->flags & IEEE80211_TX_RC_MCS) {
+                txdesc->mcs = txrate->idx;
+        } else {
+                txdesc->mcs = rt2x00_get_rate_mcs(hwrate->mcs);
+                if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
+                        txdesc->mcs |= 0x08;
+        }
+
 
         /*
          * Convert flags
@@ -84,3 +95,31 @@ void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
         else
                 txdesc->txop = TXOP_HTTXOP;
 }
+
+u16 rt2x00ht_center_channel(struct rt2x00_dev *rt2x00dev,
+                            struct ieee80211_conf *conf)
+{
+        struct hw_mode_spec *spec = &rt2x00dev->spec;
+        int center_channel;
+        u16 i;
+
+        /*
+         * Initialize center channel to current channel.
+         */
+        center_channel = spec->channels[conf->channel->hw_value].channel;
+
+        /*
+         * Adjust center channel to HT40+ and HT40- operation.
+         */
+        if (conf_is_ht40_plus(conf))
+                center_channel += 2;
+        else if (conf_is_ht40_minus(conf))
+                center_channel -= (center_channel == 14) ? 1 : 2;
+
+        for (i = 0; i < spec->num_channels; i++)
+                if (spec->channels[i].channel == center_channel)
+                        return i;
+
+        WARN_ON(1);
+        return conf->channel->hw_value;
+}
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index be2e37fb4071..ed27de1de57b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -27,8 +27,6 @@
 #ifndef RT2X00LIB_H
 #define RT2X00LIB_H
 
-#include "rt2x00dump.h"
-
 /*
  * Interval defines
  */
@@ -107,13 +105,6 @@ struct sk_buff *rt2x00queue_alloc_rxskb(struct rt2x00_dev *rt2x00dev,
                                         struct queue_entry *entry);
 
 /**
- * rt2x00queue_unmap_skb - Unmap a skb from DMA.
- * @rt2x00dev: Pointer to &struct rt2x00_dev.
- * @skb: The skb to unmap.
- */
-void rt2x00queue_unmap_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb);
-
-/**
  * rt2x00queue_free_skb - free a skb
  * @rt2x00dev: Pointer to &struct rt2x00_dev.
  * @skb: The skb to free.
@@ -296,8 +287,6 @@ static inline void rt2x00lib_free_firmware(struct rt2x00_dev *rt2x00dev)
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
 void rt2x00debug_register(struct rt2x00_dev *rt2x00dev);
 void rt2x00debug_deregister(struct rt2x00_dev *rt2x00dev);
-void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
-                            enum rt2x00_dump_type type, struct sk_buff *skb);
 void rt2x00debug_update_crypto(struct rt2x00_dev *rt2x00dev,
                                struct rxdone_entry_desc *rxdesc);
 #else
@@ -309,12 +298,6 @@ static inline void rt2x00debug_deregister(struct rt2x00_dev *rt2x00dev)
 {
 }
 
-static inline void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
-                                          enum rt2x00_dump_type type,
-                                          struct sk_buff *skb)
-{
-}
-
 static inline void rt2x00debug_update_crypto(struct rt2x00_dev *rt2x00dev,
                                              struct rxdone_entry_desc *rxdesc)
 {
@@ -384,12 +367,21 @@ static inline void rt2x00crypto_rx_insert_iv(struct sk_buff *skb,
 void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
                                    struct txentry_desc *txdesc,
                                    const struct rt2x00_rate *hwrate);
+
+u16 rt2x00ht_center_channel(struct rt2x00_dev *rt2x00dev,
+                            struct ieee80211_conf *conf);
 #else
 static inline void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
                                                  struct txentry_desc *txdesc,
                                                  const struct rt2x00_rate *hwrate)
 {
 }
+
+static inline u16 rt2x00ht_center_channel(struct rt2x00_dev *rt2x00dev,
+                                          struct ieee80211_conf *conf)
+{
+        return conf->channel->hw_value;
+}
 #endif /* CONFIG_RT2X00_LIB_HT */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index f71eee67f977..10eaffd12b1b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -81,6 +81,24 @@ int rt2x00pci_write_tx_data(struct queue_entry *entry,
                 return -EINVAL;
         }
 
+        /*
+         * Add the requested extra tx headroom in front of the skb.
+         */
+        skb_push(entry->skb, rt2x00dev->ops->extra_tx_headroom);
+        memset(entry->skb->data, 0, rt2x00dev->ops->extra_tx_headroom);
+
+        /*
+         * Call the driver's write_tx_datadesc function, if it exists.
+         */
+        if (rt2x00dev->ops->lib->write_tx_datadesc)
+                rt2x00dev->ops->lib->write_tx_datadesc(entry, txdesc);
+
+        /*
+         * Map the skb to DMA.
+         */
+        if (test_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags))
+                rt2x00queue_map_txskb(rt2x00dev, entry->skb);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(rt2x00pci_write_tx_data);
@@ -88,6 +106,34 @@ EXPORT_SYMBOL_GPL(rt2x00pci_write_tx_data);
 /*
  * TX/RX data handlers.
  */
+void rt2x00pci_txdone(struct queue_entry *entry,
+                      struct txdone_entry_desc *txdesc)
+{
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+
+        /*
+         * Unmap the skb.
+         */
+        rt2x00queue_unmap_skb(rt2x00dev, entry->skb);
+
+        /*
+         * Remove the extra tx headroom from the skb.
+         */
+        skb_pull(entry->skb, rt2x00dev->ops->extra_tx_headroom);
+
+        /*
+         * Signal that the TX descriptor is no longer in the skb.
+         */
+        skbdesc->flags &= ~SKBDESC_DESC_IN_SKB;
+
+        /*
+         * Pass on to rt2x00lib.
+         */
+        rt2x00lib_txdone(entry, txdesc);
+}
+EXPORT_SYMBOL_GPL(rt2x00pci_txdone);
+
 void rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev)
 {
         struct data_queue *queue = rt2x00dev->rx;
@@ -305,7 +351,10 @@ int rt2x00pci_probe(struct pci_dev *pci_dev, const struct pci_device_id *id)
         rt2x00dev->irq = pci_dev->irq;
         rt2x00dev->name = pci_name(pci_dev);
 
-        rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_PCI);
+        if (pci_dev->is_pcie)
+                rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_PCIE);
+        else
+                rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_PCI);
 
         retval = rt2x00pci_alloc_reg(rt2x00dev);
         if (retval)
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.h b/drivers/net/wireless/rt2x00/rt2x00pci.h
index 51bcef3839ce..00528b8a754d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.h
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.h
@@ -109,6 +109,14 @@ struct queue_entry_priv_pci {
 };
 
 /**
+ * rt2x00pci_txdone - Handle TX done events.
+ * @entry: The queue entry for which a TX done event was received.
+ * @txdesc: The TX done descriptor for the entry.
+ */
+void rt2x00pci_txdone(struct queue_entry *entry,
+                      struct txdone_entry_desc *txdesc);
+
+/**
  * rt2x00pci_rxdone - Handle RX done events
  * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
  */
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 20dbdd6fb904..f91637147116 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -100,21 +100,8 @@ void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
 
-        /*
-         * If device has requested headroom, we should make sure that
-         * is also mapped to the DMA so it can be used for transfering
-         * additional descriptor information to the hardware.
-         */
-        skb_push(skb, rt2x00dev->ops->extra_tx_headroom);
-
         skbdesc->skb_dma =
             dma_map_single(rt2x00dev->dev, skb->data, skb->len, DMA_TO_DEVICE);
-
-        /*
-         * Restore data pointer to original location again.
-         */
-        skb_pull(skb, rt2x00dev->ops->extra_tx_headroom);
-
         skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
 }
 EXPORT_SYMBOL_GPL(rt2x00queue_map_txskb);
@@ -130,16 +117,12 @@ void rt2x00queue_unmap_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
         }
 
         if (skbdesc->flags & SKBDESC_DMA_MAPPED_TX) {
-                /*
-                 * Add headroom to the skb length, it has been removed
-                 * by the driver, but it was actually mapped to DMA.
-                 */
-                dma_unmap_single(rt2x00dev->dev, skbdesc->skb_dma,
-                                 skb->len + rt2x00dev->ops->extra_tx_headroom,
+                dma_unmap_single(rt2x00dev->dev, skbdesc->skb_dma, skb->len,
                                  DMA_TO_DEVICE);
                 skbdesc->flags &= ~SKBDESC_DMA_MAPPED_TX;
         }
 }
+EXPORT_SYMBOL_GPL(rt2x00queue_unmap_skb);
 
 void rt2x00queue_free_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
 {
@@ -370,13 +353,18 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
         /*
          * Check if more fragments are pending
          */
-        if (ieee80211_has_morefrags(hdr->frame_control) ||
-            (tx_info->flags & IEEE80211_TX_CTL_MORE_FRAMES)) {
+        if (ieee80211_has_morefrags(hdr->frame_control)) {
                 __set_bit(ENTRY_TXD_BURST, &txdesc->flags);
                 __set_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags);
         }
 
         /*
+         * Check if more frames (!= fragments) are pending
+         */
+        if (tx_info->flags & IEEE80211_TX_CTL_MORE_FRAMES)
+                __set_bit(ENTRY_TXD_BURST, &txdesc->flags);
+
+        /*
          * Beacons and probe responses require the tsf timestamp
          * to be inserted into the frame, except for a frame that has been injected
          * through a monitor interface. This latter is needed for testing a
@@ -421,7 +409,6 @@ static void rt2x00queue_write_tx_descriptor(struct queue_entry *entry,
 {
         struct data_queue *queue = entry->queue;
         struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
-        enum rt2x00_dump_type dump_type;
 
         rt2x00dev->ops->lib->write_tx_desc(rt2x00dev, entry->skb, txdesc);
 
@@ -429,9 +416,7 @@ static void rt2x00queue_write_tx_descriptor(struct queue_entry *entry,
          * All processing on the frame has been completed, this means
          * it is now ready to be dumped to userspace through debugfs.
          */
-        dump_type = (txdesc->queue == QID_BEACON) ?
-                                        DUMP_FRAME_BEACON : DUMP_FRAME_TX;
-        rt2x00debug_dump_frame(rt2x00dev, dump_type, entry->skb);
+        rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_TX, entry->skb);
 }
 
 static void rt2x00queue_kick_tx_queue(struct queue_entry *entry,
@@ -537,9 +522,6 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
                 return -EIO;
         }
 
-        if (test_bit(DRIVER_REQUIRE_DMA, &queue->rt2x00dev->flags))
-                rt2x00queue_map_txskb(queue->rt2x00dev, skb);
-
         set_bit(ENTRY_DATA_PENDING, &entry->flags);
 
         rt2x00queue_index_inc(queue, Q_INDEX);
@@ -595,11 +577,6 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
         skbdesc->entry = intf->beacon;
 
         /*
-         * Write TX descriptor into reserved room in front of the beacon.
-         */
-        rt2x00queue_write_tx_descriptor(intf->beacon, &txdesc);
-
-        /*
          * Send beacon to hardware and enable beacon genaration..
          */
         rt2x00dev->ops->lib->write_beacon(intf->beacon, &txdesc);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index f79170849add..bd54f55a8cb9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -213,9 +213,16 @@ struct rxdone_entry_desc {
 /**
  * enum txdone_entry_desc_flags: Flags for &struct txdone_entry_desc
  *
+ * Every txdone report has to contain the basic result of the
+ * transmission, either &TXDONE_UNKNOWN, &TXDONE_SUCCESS or
+ * &TXDONE_FAILURE. The flag &TXDONE_FALLBACK can be used in
+ * conjunction with all of these flags but should only be set
+ * if retires > 0. The flag &TXDONE_EXCESSIVE_RETRY can only be used
+ * in conjunction with &TXDONE_FAILURE.
+ *
  * @TXDONE_UNKNOWN: Hardware could not determine success of transmission.
  * @TXDONE_SUCCESS: Frame was successfully send
- * @TXDONE_FALLBACK: Frame was successfully send using a fallback rate.
+ * @TXDONE_FALLBACK: Hardware used fallback rates for retries
  * @TXDONE_FAILURE: Frame was not successfully send
  * @TXDONE_EXCESSIVE_RETRY: In addition to &TXDONE_FAILURE, the
  *      frame transmission failed due to excessive retries.
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index bd1546ba7ad2..b45bc24c3dae 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -113,26 +113,6 @@ int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
                                   const u16 offset, void *buffer,
                                   const u16 buffer_length, const int timeout)
 {
-        int status;
-
-        mutex_lock(&rt2x00dev->csr_mutex);
-
-        status = rt2x00usb_vendor_req_buff_lock(rt2x00dev, request,
-                                                requesttype, offset, buffer,
-                                                buffer_length, timeout);
-
-        mutex_unlock(&rt2x00dev->csr_mutex);
-
-        return status;
-}
-EXPORT_SYMBOL_GPL(rt2x00usb_vendor_request_buff);
-
-int rt2x00usb_vendor_request_large_buff(struct rt2x00_dev *rt2x00dev,
-                                        const u8 request, const u8 requesttype,
-                                        const u16 offset, const void *buffer,
-                                        const u16 buffer_length,
-                                        const int timeout)
-{
         int status = 0;
         unsigned char *tb;
         u16 off, len, bsize;
@@ -157,7 +137,7 @@ int rt2x00usb_vendor_request_large_buff(struct rt2x00_dev *rt2x00dev,
 
         return status;
 }
-EXPORT_SYMBOL_GPL(rt2x00usb_vendor_request_large_buff);
+EXPORT_SYMBOL_GPL(rt2x00usb_vendor_request_buff);
 
 int rt2x00usb_regbusy_read(struct rt2x00_dev *rt2x00dev,
                            const unsigned int offset,
@@ -198,6 +178,11 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
                 return;
 
         /*
+         * Remove the descriptor from the front of the skb.
+         */
+        skb_pull(entry->skb, entry->queue->desc_size);
+
+        /*
          * Obtain the status about this packet.
          * Note that when the status is 0 it does not mean the
          * frame was send out correctly. It only means the frame
@@ -243,10 +228,10 @@ int rt2x00usb_write_tx_data(struct queue_entry *entry,
                           rt2x00usb_interrupt_txdone, entry);
 
         /*
-         * Make sure the skb->data pointer points to the frame, not the
-         * descriptor.
+         * Call the driver's write_tx_datadesc function, if it exists.
          */
-        skb_pull(entry->skb, entry->queue->desc_size);
+        if (rt2x00dev->ops->lib->write_tx_datadesc)
+                rt2x00dev->ops->lib->write_tx_datadesc(entry, txdesc);
 
         return 0;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index 621d0f829251..255b81ef9530 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -167,25 +167,6 @@ int rt2x00usb_vendor_req_buff_lock(struct rt2x00_dev *rt2x00dev,
                                    const u16 buffer_length, const int timeout);
 
 /**
- * rt2x00usb_vendor_request_large_buff - Send register command to device (buffered)
- * @rt2x00dev: Pointer to &struct rt2x00_dev
- * @request: USB vendor command (See &enum rt2x00usb_vendor_request)
- * @requesttype: Request type &USB_VENDOR_REQUEST_*
- * @offset: Register start offset to perform action on
- * @buffer: Buffer where information will be read/written to by device
- * @buffer_length: Size of &buffer
- * @timeout: Operation timeout
- *
- * This function is used to transfer register data in blocks larger
- * then CSR_CACHE_SIZE. Use for firmware upload, keys and beacons.
- */
-int rt2x00usb_vendor_request_large_buff(struct rt2x00_dev *rt2x00dev,
-                                        const u8 request, const u8 requesttype,
-                                        const u16 offset, const void *buffer,
-                                        const u16 buffer_length,
-                                        const int timeout);
-
-/**
  * rt2x00usb_vendor_request_sw - Send single register command to device
  * @rt2x00dev: Pointer to &struct rt2x00_dev
  * @request: USB vendor command (See &enum rt2x00usb_vendor_request)
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 6a74baf4e934..7ca383478eeb 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -931,6 +931,9 @@ static void rt61pci_config_retry_limit(struct rt2x00_dev *rt2x00dev,
         u32 reg;
 
         rt2x00pci_register_read(rt2x00dev, TXRX_CSR4, &reg);
+        rt2x00_set_field32(&reg, TXRX_CSR4_OFDM_TX_RATE_DOWN, 1);
+        rt2x00_set_field32(&reg, TXRX_CSR4_OFDM_TX_RATE_STEP, 0);
+        rt2x00_set_field32(&reg, TXRX_CSR4_OFDM_TX_FALLBACK_CCK, 0);
         rt2x00_set_field32(&reg, TXRX_CSR4_LONG_RETRY_LIMIT,
                            libconf->conf->long_frame_max_tx_count);
         rt2x00_set_field32(&reg, TXRX_CSR4_SHORT_RETRY_LIMIT,
@@ -1874,6 +1877,16 @@ static void rt61pci_write_beacon(struct queue_entry *entry,
         rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
 
         /*
+         * Write the TX descriptor for the beacon.
+         */
+        rt61pci_write_tx_desc(rt2x00dev, entry->skb, txdesc);
+
+        /*
+         * Dump beacon to userspace through debugfs.
+         */
+        rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry->skb);
+
+        /*
          * Write entire beacon with descriptor to register.
          */
         beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
@@ -2039,29 +2052,24 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
         struct txdone_entry_desc txdesc;
         u32 word;
         u32 reg;
-        u32 old_reg;
         int type;
         int index;
+        int i;
 
         /*
-         * During each loop we will compare the freshly read
-         * STA_CSR4 register value with the value read from
-         * the previous loop. If the 2 values are equal then
-         * we should stop processing because the chance is
-         * quite big that the device has been unplugged and
-         * we risk going into an endless loop.
+         * TX_STA_FIFO is a stack of X entries, hence read TX_STA_FIFO
+         * at most X times and also stop processing once the TX_STA_FIFO_VALID
+         * flag is not set anymore.
+         *
+         * The legacy drivers use X=TX_RING_SIZE but state in a comment
+         * that the TX_STA_FIFO stack has a size of 16. We stick to our
+         * tx ring size for now.
          */
-        old_reg = 0;
-
-        while (1) {
+        for (i = 0; i < TX_ENTRIES; i++) {
                 rt2x00pci_register_read(rt2x00dev, STA_CSR4, &reg);
                 if (!rt2x00_get_field32(reg, STA_CSR4_VALID))
                         break;
 
-                if (old_reg == reg)
-                        break;
-                old_reg = reg;
-
                 /*
                  * Skip this entry when it contains an invalid
                  * queue identication number.
@@ -2100,7 +2108,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
                         __set_bit(TXDONE_UNKNOWN, &txdesc.flags);
                         txdesc.retry = 0;
 
-                        rt2x00lib_txdone(entry_done, &txdesc);
+                        rt2x00pci_txdone(entry_done, &txdesc);
                         entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
                 }
 
@@ -2120,7 +2128,14 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
                 }
                 txdesc.retry = rt2x00_get_field32(reg, STA_CSR4_RETRY_COUNT);
 
-                rt2x00lib_txdone(entry, &txdesc);
+                /*
+                 * the frame was retried at least once
+                 * -> hw used fallback rates
+                 */
+                if (txdesc.retry)
+                        __set_bit(TXDONE_FALLBACK, &txdesc.flags);
+
+                rt2x00pci_txdone(entry, &txdesc);
         }
 }
 
@@ -2577,6 +2592,18 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                                                    EEPROM_MAC_ADDR_0));
 
         /*
+         * As rt61 has a global fallback table we cannot specify
+         * more then one tx rate per frame but since the hw will
+         * try several rates (based on the fallback table) we should
+         * still initialize max_rates to the maximum number of rates
+         * we are going to try. Otherwise mac80211 will truncate our
+         * reported tx rates and the rc algortihm will end up with
+         * incorrect data.
+         */
+        rt2x00dev->hw->max_rates = 7;
+        rt2x00dev->hw->max_rate_tries = 1;
+
+        /*
          * Initialize hw_mode information.
          */
         spec->supported_bands = SUPPORT_BAND_2GHZ;
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 6e0d82efe924..d06d90f003e7 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -270,7 +270,6 @@ static int rt73usb_config_shared_key(struct rt2x00_dev *rt2x00dev,
 {
         struct hw_key_entry key_entry;
         struct rt2x00_field32 field;
-        int timeout;
         u32 mask;
         u32 reg;
 
@@ -306,12 +305,8 @@ static int rt73usb_config_shared_key(struct rt2x00_dev *rt2x00dev,
                        sizeof(key_entry.rx_mic));
 
                 reg = SHARED_KEY_ENTRY(key->hw_key_idx);
-                timeout = REGISTER_TIMEOUT32(sizeof(key_entry));
-                rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
-                                                    USB_VENDOR_REQUEST_OUT, reg,
-                                                    &key_entry,
-                                                    sizeof(key_entry),
-                                                    timeout);
+                rt2x00usb_register_multiwrite(rt2x00dev, reg,
+                                              &key_entry, sizeof(key_entry));
 
                 /*
                  * The cipher types are stored over 2 registers.
@@ -372,7 +367,6 @@ static int rt73usb_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
 {
         struct hw_pairwise_ta_entry addr_entry;
         struct hw_key_entry key_entry;
-        int timeout;
         u32 mask;
         u32 reg;
 
@@ -407,17 +401,11 @@ static int rt73usb_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
                        sizeof(key_entry.rx_mic));
 
                 reg = PAIRWISE_KEY_ENTRY(key->hw_key_idx);
-                timeout = REGISTER_TIMEOUT32(sizeof(key_entry));
-                rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
-                                                    USB_VENDOR_REQUEST_OUT, reg,
-                                                    &key_entry,
-                                                    sizeof(key_entry),
-                                                    timeout);
+                rt2x00usb_register_multiwrite(rt2x00dev, reg,
+                                              &key_entry, sizeof(key_entry));
 
                 /*
                  * Send the address and cipher type to the hardware register.
-                 * This data fits within the CSR cache size, so we can use
-                 * rt2x00usb_register_multiwrite() directly.
                  */
                 memset(&addr_entry, 0, sizeof(addr_entry));
                 memcpy(&addr_entry, crypto->address, ETH_ALEN);
@@ -828,6 +816,9 @@ static void rt73usb_config_retry_limit(struct rt2x00_dev *rt2x00dev,
         u32 reg;
 
         rt2x00usb_register_read(rt2x00dev, TXRX_CSR4, &reg);
+        rt2x00_set_field32(&reg, TXRX_CSR4_OFDM_TX_RATE_DOWN, 1);
+        rt2x00_set_field32(&reg, TXRX_CSR4_OFDM_TX_RATE_STEP, 0);
+        rt2x00_set_field32(&reg, TXRX_CSR4_OFDM_TX_FALLBACK_CCK, 0);
         rt2x00_set_field32(&reg, TXRX_CSR4_LONG_RETRY_LIMIT,
                            libconf->conf->long_frame_max_tx_count);
         rt2x00_set_field32(&reg, TXRX_CSR4_SHORT_RETRY_LIMIT,
@@ -1092,11 +1083,7 @@ static int rt73usb_load_firmware(struct rt2x00_dev *rt2x00dev,
         /*
          * Write firmware to device.
          */
-        rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
-                                            USB_VENDOR_REQUEST_OUT,
-                                            FIRMWARE_IMAGE_BASE,
-                                            data, len,
-                                            REGISTER_TIMEOUT32(len));
+        rt2x00usb_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE, data, len);
 
         /*
          * Send firmware request to device to load firmware,
@@ -1442,7 +1429,7 @@ static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                   struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        __le32 *txd = (__le32 *)(skb->data - TXD_DESC_SIZE);
+        __le32 *txd = (__le32 *) skb->data;
         u32 word;
 
         /*
@@ -1505,6 +1492,7 @@ static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         /*
          * Register descriptor details in skb frame descriptor.
          */
+        skbdesc->flags |= SKBDESC_DESC_IN_SKB;
         skbdesc->desc = txd;
         skbdesc->desc_len = TXD_DESC_SIZE;
 }
@@ -1528,18 +1516,27 @@ static void rt73usb_write_beacon(struct queue_entry *entry,
         rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
 
         /*
-         * Take the descriptor in front of the skb into account.
+         * Add space for the descriptor in front of the skb.
          */
         skb_push(entry->skb, TXD_DESC_SIZE);
+        memset(entry->skb->data, 0, TXD_DESC_SIZE);
+
+        /*
+         * Write the TX descriptor for the beacon.
+         */
+        rt73usb_write_tx_desc(rt2x00dev, entry->skb, txdesc);
+
+        /*
+         * Dump beacon to userspace through debugfs.
+         */
+        rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry->skb);
 
         /*
          * Write entire beacon with descriptor to register.
          */
         beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
-        rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
-                                            USB_VENDOR_REQUEST_OUT, beacon_base,
-                                            entry->skb->data, entry->skb->len,
-                                            REGISTER_TIMEOUT32(entry->skb->len));
+        rt2x00usb_register_multiwrite(rt2x00dev, beacon_base,
+                                      entry->skb->data, entry->skb->len);
 
         /*
          * Enable beaconing again.
diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
index 515817de2905..42705028751d 100644
--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
@@ -671,7 +671,7 @@ static u64 rtl8180_get_tsf(struct ieee80211_hw *dev)
                (u64)(rtl818x_ioread32(priv, &priv->map->TSFT[1])) << 32;
 }
 
-void rtl8180_beacon_work(struct work_struct *work)
+static void rtl8180_beacon_work(struct work_struct *work)
 {
         struct rtl8180_vif *vif_priv =
                 container_of(work, struct rtl8180_vif, beacon_work.work);
diff --git a/drivers/net/wireless/wl12xx/Kconfig b/drivers/net/wireless/wl12xx/Kconfig
index 337fc7bec5a5..2f98058be451 100644
--- a/drivers/net/wireless/wl12xx/Kconfig
+++ b/drivers/net/wireless/wl12xx/Kconfig
@@ -41,7 +41,7 @@ config WL1251_SDIO
 
 config WL1271
         tristate "TI wl1271 support"
-        depends on WL12XX && SPI_MASTER && GENERIC_HARDIRQS
+        depends on WL12XX && GENERIC_HARDIRQS
         depends on INET
         select FW_LOADER
         select CRC7
@@ -65,7 +65,7 @@ config WL1271_SPI
 
 config WL1271_SDIO
         tristate "TI wl1271 SDIO support"
-        depends on WL1271 && MMC && ARM
+        depends on WL1271 && MMC
         ---help---
           This module adds support for the SDIO interface of adapters using
           TI wl1271 chipset.  Select this if your platform is using
diff --git a/drivers/net/wireless/wl12xx/wl1251_main.c b/drivers/net/wireless/wl12xx/wl1251_main.c
index 00b24282fc73..c8f268951e10 100644
--- a/drivers/net/wireless/wl12xx/wl1251_main.c
+++ b/drivers/net/wireless/wl12xx/wl1251_main.c
@@ -124,7 +124,7 @@ static int wl1251_fetch_nvs(struct wl1251 *wl)
         }
 
         wl->nvs_len = fw->size;
-        wl->nvs = kmalloc(wl->nvs_len, GFP_KERNEL);
+        wl->nvs = kmemdup(fw->data, wl->nvs_len, GFP_KERNEL);
 
         if (!wl->nvs) {
                 wl1251_error("could not allocate memory for the nvs file");
@@ -132,8 +132,6 @@ static int wl1251_fetch_nvs(struct wl1251 *wl)
                 goto out;
         }
 
-        memcpy(wl->nvs, fw->data, wl->nvs_len);
-
         ret = 0;
 
 out:
diff --git a/drivers/net/wireless/wl12xx/wl1251_sdio.c b/drivers/net/wireless/wl12xx/wl1251_sdio.c
index c561332e7009..b901b6135654 100644
--- a/drivers/net/wireless/wl12xx/wl1251_sdio.c
+++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c
@@ -37,11 +37,17 @@
 #define SDIO_DEVICE_ID_TI_WL1251        0x9066
 #endif
 
+struct wl1251_sdio {
+        struct sdio_func *func;
+        u32 elp_val;
+};
+
 static struct wl12xx_platform_data *wl12xx_board_data;
 
 static struct sdio_func *wl_to_func(struct wl1251 *wl)
 {
-        return wl->if_priv;
+        struct wl1251_sdio *wl_sdio = wl->if_priv;
+        return wl_sdio->func;
 }
 
 static void wl1251_sdio_interrupt(struct sdio_func *func)
@@ -90,10 +96,17 @@ static void wl1251_sdio_write(struct wl1251 *wl, int addr,
 static void wl1251_sdio_read_elp(struct wl1251 *wl, int addr, u32 *val)
 {
         int ret = 0;
-        struct sdio_func *func = wl_to_func(wl);
-
+        struct wl1251_sdio *wl_sdio = wl->if_priv;
+        struct sdio_func *func = wl_sdio->func;
+
+        /*
+         * The hardware only supports RAW (read after write) access for
+         * reading, regular sdio_readb won't work here (it interprets
+         * the unused bits of CMD52 as write data even if we send read
+         * request).
+         */
         sdio_claim_host(func);
-        *val = sdio_readb(func, addr, &ret);
+        *val = sdio_writeb_readb(func, wl_sdio->elp_val, addr, &ret);
         sdio_release_host(func);
 
         if (ret)
@@ -103,7 +116,8 @@ static void wl1251_sdio_read_elp(struct wl1251 *wl, int addr, u32 *val)
 static void wl1251_sdio_write_elp(struct wl1251 *wl, int addr, u32 val)
 {
         int ret = 0;
-        struct sdio_func *func = wl_to_func(wl);
+        struct wl1251_sdio *wl_sdio = wl->if_priv;
+        struct sdio_func *func = wl_sdio->func;
 
         sdio_claim_host(func);
         sdio_writeb(func, val, addr, &ret);
@@ -111,6 +125,8 @@ static void wl1251_sdio_write_elp(struct wl1251 *wl, int addr, u32 val)
 
         if (ret)
                 wl1251_error("sdio_writeb failed (%d)", ret);
+        else
+                wl_sdio->elp_val = val;
 }
 
 static void wl1251_sdio_reset(struct wl1251 *wl)
@@ -197,6 +213,7 @@ static int wl1251_sdio_probe(struct sdio_func *func,
         int ret;
         struct wl1251 *wl;
         struct ieee80211_hw *hw;
+        struct wl1251_sdio *wl_sdio;
 
         hw = wl1251_alloc_hw();
         if (IS_ERR(hw))
@@ -204,6 +221,12 @@ static int wl1251_sdio_probe(struct sdio_func *func,
 
         wl = hw->priv;
 
+        wl_sdio = kzalloc(sizeof(*wl_sdio), GFP_KERNEL);
+        if (wl_sdio == NULL) {
+                ret = -ENOMEM;
+                goto out_free_hw;
+        }
+
         sdio_claim_host(func);
         ret = sdio_enable_func(func);
         if (ret)
@@ -213,7 +236,8 @@ static int wl1251_sdio_probe(struct sdio_func *func,
         sdio_release_host(func);
 
         SET_IEEE80211_DEV(hw, &func->dev);
-        wl->if_priv = func;
+        wl_sdio->func = func;
+        wl->if_priv = wl_sdio;
         wl->if_ops = &wl1251_sdio_ops;
         wl->set_power = wl1251_sdio_set_power;
 
@@ -259,6 +283,8 @@ disable:
         sdio_disable_func(func);
 release:
         sdio_release_host(func);
+        kfree(wl_sdio);
+out_free_hw:
         wl1251_free_hw(wl);
         return ret;
 }
@@ -266,9 +292,11 @@ release:
 static void __devexit wl1251_sdio_remove(struct sdio_func *func)
 {
         struct wl1251 *wl = sdio_get_drvdata(func);
+        struct wl1251_sdio *wl_sdio = wl->if_priv;
 
         if (wl->irq)
                 free_irq(wl->irq, wl);
+        kfree(wl_sdio);
         wl1251_free_hw(wl);
 
         sdio_claim_host(func);
diff --git a/drivers/net/wireless/wl12xx/wl1271.h b/drivers/net/wireless/wl12xx/wl1271.h
index 6f1b6b5640c0..1b52ce6a84d7 100644
--- a/drivers/net/wireless/wl12xx/wl1271.h
+++ b/drivers/net/wireless/wl12xx/wl1271.h
@@ -33,6 +33,7 @@
 #include <net/mac80211.h>
 
 #include "wl1271_conf.h"
+#include "wl1271_ini.h"
 
 #define DRIVER_NAME "wl1271"
 #define DRIVER_PREFIX DRIVER_NAME ": "
@@ -116,33 +117,6 @@ enum {
 #define WL1271_TX_SECURITY_LO16(s) ((u16)((s) & 0xffff))
 #define WL1271_TX_SECURITY_HI32(s) ((u32)(((s) >> 16) & 0xffffffff))
 
-/* NVS data structure */
-#define WL1271_NVS_SECTION_SIZE                  468
-
-#define WL1271_NVS_GENERAL_PARAMS_SIZE            57
-#define WL1271_NVS_GENERAL_PARAMS_SIZE_PADDED \
-        (WL1271_NVS_GENERAL_PARAMS_SIZE + 1)
-#define WL1271_NVS_STAT_RADIO_PARAMS_SIZE         17
-#define WL1271_NVS_STAT_RADIO_PARAMS_SIZE_PADDED \
-        (WL1271_NVS_STAT_RADIO_PARAMS_SIZE + 1)
-#define WL1271_NVS_DYN_RADIO_PARAMS_SIZE          65
-#define WL1271_NVS_DYN_RADIO_PARAMS_SIZE_PADDED \
-        (WL1271_NVS_DYN_RADIO_PARAMS_SIZE + 1)
-#define WL1271_NVS_FEM_COUNT                       2
-#define WL1271_NVS_INI_SPARE_SIZE                124
-
-struct wl1271_nvs_file {
-        /* NVS section */
-        u8 nvs[WL1271_NVS_SECTION_SIZE];
-
-        /* INI section */
-        u8 general_params[WL1271_NVS_GENERAL_PARAMS_SIZE_PADDED];
-        u8 stat_radio_params[WL1271_NVS_STAT_RADIO_PARAMS_SIZE_PADDED];
-        u8 dyn_radio_params[WL1271_NVS_FEM_COUNT]
-                           [WL1271_NVS_DYN_RADIO_PARAMS_SIZE_PADDED];
-        u8 ini_spare[WL1271_NVS_INI_SPARE_SIZE];
-} __attribute__ ((packed));
-
 /*
  * Enable/disable 802.11a support for WL1273
  */
@@ -325,6 +299,7 @@ struct wl1271_rx_mem_pool_addr {
 };
 
 struct wl1271_scan {
+        struct cfg80211_scan_request *req;
         u8 state;
         u8 ssid[IW_ESSID_MAX_SIZE+1];
         size_t ssid_len;
@@ -375,6 +350,7 @@ struct wl1271 {
 #define WL1271_FLAG_IRQ_PENDING        (9)
 #define WL1271_FLAG_IRQ_RUNNING       (10)
 #define WL1271_FLAG_IDLE              (11)
+#define WL1271_FLAG_IDLE_REQUESTED    (12)
         unsigned long flags;
 
         struct wl1271_partition_set part;
@@ -421,6 +397,7 @@ struct wl1271 {
 
         /* Pending TX frames */
         struct sk_buff *tx_frames[ACX_TX_DESCRIPTORS];
+        int tx_frames_cnt;
 
         /* Security sequence number counters */
         u8 tx_security_last_seq;
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.c b/drivers/net/wireless/wl12xx/wl1271_cmd.c
index 19393e236e2c..530678e45a13 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.c
@@ -212,8 +212,8 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
 
         gen_parms->test.id = TEST_CMD_INI_FILE_GENERAL_PARAM;
 
-        memcpy(gen_parms->params, wl->nvs->general_params,
-               WL1271_NVS_GENERAL_PARAMS_SIZE);
+        memcpy(&gen_parms->general_params, &wl->nvs->general_params,
+               sizeof(struct wl1271_ini_general_params));
 
         ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), 0);
         if (ret < 0)
@@ -238,13 +238,20 @@ int wl1271_cmd_radio_parms(struct wl1271 *wl)
 
         radio_parms->test.id = TEST_CMD_INI_FILE_RADIO_PARAM;
 
-        memcpy(radio_parms->stat_radio_params, wl->nvs->stat_radio_params,
-               WL1271_NVS_STAT_RADIO_PARAMS_SIZE);
-        memcpy(radio_parms->dyn_radio_params,
-               wl->nvs->dyn_radio_params[rparam->fem],
-               WL1271_NVS_DYN_RADIO_PARAMS_SIZE);
-
-        /* FIXME: current NVS is missing 5GHz parameters */
+        /* 2.4GHz parameters */
+        memcpy(&radio_parms->static_params_2, &wl->nvs->stat_radio_params_2,
+               sizeof(struct wl1271_ini_band_params_2));
+        memcpy(&radio_parms->dyn_params_2,
+               &wl->nvs->dyn_radio_params_2[rparam->fem].params,
+               sizeof(struct wl1271_ini_fem_params_2));
+
+        /* 5GHz parameters */
+        memcpy(&radio_parms->static_params_5,
+               &wl->nvs->stat_radio_params_5,
+               sizeof(struct wl1271_ini_band_params_5));
+        memcpy(&radio_parms->dyn_params_5,
+               &wl->nvs->dyn_radio_params_5[rparam->fem].params,
+               sizeof(struct wl1271_ini_fem_params_5));
 
         wl1271_dump(DEBUG_CMD, "TEST_CMD_INI_FILE_RADIO_PARAM: ",
                     radio_parms, sizeof(*radio_parms));
@@ -329,12 +336,6 @@ int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type)
         join->channel = wl->channel;
         join->ssid_len = wl->ssid_len;
         memcpy(join->ssid, wl->ssid, wl->ssid_len);
-        join->ctrl = WL1271_JOIN_CMD_CTRL_TX_FLUSH;
-
-        /* increment the session counter */
-        wl->session_counter++;
-        if (wl->session_counter >= SESSION_COUNTER_MAX)
-                wl->session_counter = 0;
 
         join->ctrl |= wl->session_counter << WL1271_JOIN_CMD_TX_SESSION_OFFSET;
 
@@ -517,7 +518,7 @@ int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, bool send)
         ps_params->send_null_data = send;
         ps_params->retries = 5;
         ps_params->hang_over_period = 1;
-        ps_params->null_data_rate = cpu_to_le32(1); /* 1 Mbps */
+        ps_params->null_data_rate = cpu_to_le32(wl->basic_rate_set);
 
         ret = wl1271_cmd_send(wl, CMD_SET_PS_MODE, ps_params,
                               sizeof(*ps_params), 0);
@@ -567,7 +568,7 @@ out:
 }
 
 int wl1271_cmd_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
-                    const u8 *ie, size_t ie_len, u8 active_scan,
+                    struct cfg80211_scan_request *req, u8 active_scan,
                     u8 high_prio, u8 band, u8 probe_requests)
 {
 
@@ -648,7 +649,7 @@ int wl1271_cmd_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
         }
 
         ret = wl1271_cmd_build_probe_req(wl, ssid, ssid_len,
-                                         ie, ie_len, ieee_band);
+                                         req->ie, req->ie_len, ieee_band);
         if (ret < 0) {
                 wl1271_error("PROBE request template failed");
                 goto out;
@@ -684,7 +685,9 @@ int wl1271_cmd_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
                                 memcpy(wl->scan.ssid, ssid, ssid_len);
                         } else
                                 wl->scan.ssid_len = 0;
-                }
+                        wl->scan.req = req;
+                } else
+                        wl->scan.req = NULL;
         }
 
         ret = wl1271_cmd_send(wl, CMD_SCAN, params, sizeof(*params), 0);
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.h b/drivers/net/wireless/wl12xx/wl1271_cmd.h
index f2820b42a943..68001dffe716 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.h
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.h
@@ -42,7 +42,7 @@ int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, bool send);
 int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
                            size_t len);
 int wl1271_cmd_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
-                    const u8 *ie, size_t ie_len, u8 active_scan,
+                    struct cfg80211_scan_request *req, u8 active_scan,
                     u8 high_prio, u8 band, u8 probe_requests);
 int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
                             void *buf, size_t buf_len, int index, u32 rates);
@@ -439,24 +439,30 @@ struct wl1271_general_parms_cmd {
 
         struct wl1271_cmd_test_header test;
 
-        u8 params[WL1271_NVS_GENERAL_PARAMS_SIZE];
-        s8 reserved[23];
-} __attribute__ ((packed));
+        struct wl1271_ini_general_params general_params;
 
-#define WL1271_STAT_RADIO_PARAMS_5_SIZE    29
-#define WL1271_DYN_RADIO_PARAMS_5_SIZE    104
+        u8 sr_debug_table[WL1271_INI_MAX_SMART_REFLEX_PARAM];
+        u8 sr_sen_n_p;
+        u8 sr_sen_n_p_gain;
+        u8 sr_sen_nrn;
+        u8 sr_sen_prn;
+        u8 padding[3];
+} __attribute__ ((packed));
 
 struct wl1271_radio_parms_cmd {
         struct wl1271_cmd_header header;
 
         struct wl1271_cmd_test_header test;
 
-        u8 stat_radio_params[WL1271_NVS_STAT_RADIO_PARAMS_SIZE];
-        u8 stat_radio_params_5[WL1271_STAT_RADIO_PARAMS_5_SIZE];
+        /* Static radio parameters */
+        struct wl1271_ini_band_params_2 static_params_2;
+        struct wl1271_ini_band_params_5 static_params_5;
 
-        u8 dyn_radio_params[WL1271_NVS_DYN_RADIO_PARAMS_SIZE];
-        u8 reserved;
-        u8 dyn_radio_params_5[WL1271_DYN_RADIO_PARAMS_5_SIZE];
+        /* Dynamic radio parameters */
+        struct wl1271_ini_fem_params_2 dyn_params_2;
+        u8 padding2;
+        struct wl1271_ini_fem_params_5 dyn_params_5;
+        u8 padding3[2];
 } __attribute__ ((packed));
 
 struct wl1271_cmd_cal_channel_tune {
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.c b/drivers/net/wireless/wl12xx/wl1271_event.c
index cf37aa6eb137..ca52cdec7a8f 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.c
+++ b/drivers/net/wireless/wl12xx/wl1271_event.c
@@ -43,11 +43,11 @@ static int wl1271_event_scan_complete(struct wl1271 *wl,
                         clear_bit(WL1271_FLAG_SCANNING, &wl->flags);
                         /* FIXME: ie missing! */
                         wl1271_cmd_scan(wl, wl->scan.ssid, wl->scan.ssid_len,
-                                                NULL, 0,
-                                                wl->scan.active,
-                                                wl->scan.high_prio,
-                                                WL1271_SCAN_BAND_5_GHZ,
-                                                wl->scan.probe_requests);
+                                        wl->scan.req,
+                                        wl->scan.active,
+                                        wl->scan.high_prio,
+                                        WL1271_SCAN_BAND_5_GHZ,
+                                        wl->scan.probe_requests);
                 } else {
                         mutex_unlock(&wl->mutex);
                         ieee80211_scan_completed(wl->hw, false);
diff --git a/drivers/net/wireless/wl12xx/wl1271_ini.h b/drivers/net/wireless/wl12xx/wl1271_ini.h
new file mode 100644
index 000000000000..0fb156a5af12
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_ini.h
@@ -0,0 +1,123 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2010 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_INI_H__
+#define __WL1271_INI_H__
+
+#define WL1271_INI_MAX_SMART_REFLEX_PARAM 16
+
+struct wl1271_ini_general_params {
+        u8 ref_clock;
+        u8 settling_time;
+        u8 clk_valid_on_wakeup;
+        u8 dc2dc_mode;
+        u8 dual_mode_select;
+        u8 tx_bip_fem_auto_detect;
+        u8 tx_bip_fem_manufacturer;
+        u8 general_settings;
+        u8 sr_state;
+        u8 srf1[WL1271_INI_MAX_SMART_REFLEX_PARAM];
+        u8 srf2[WL1271_INI_MAX_SMART_REFLEX_PARAM];
+        u8 srf3[WL1271_INI_MAX_SMART_REFLEX_PARAM];
+} __attribute__ ((packed));
+
+#define WL1271_INI_RSSI_PROCESS_COMPENS_SIZE 15
+
+struct wl1271_ini_band_params_2 {
+        u8 rx_trace_insertion_loss;
+        u8 tx_trace_loss;
+        u8 rx_rssi_process_compens[WL1271_INI_RSSI_PROCESS_COMPENS_SIZE];
+} __attribute__ ((packed));
+
+#define WL1271_INI_RATE_GROUP_COUNT 6
+#define WL1271_INI_CHANNEL_COUNT_2 14
+
+struct wl1271_ini_fem_params_2 {
+        __le16 tx_bip_ref_pd_voltage;
+        u8 tx_bip_ref_power;
+        u8 tx_bip_ref_offset;
+        u8 tx_per_rate_pwr_limits_normal[WL1271_INI_RATE_GROUP_COUNT];
+        u8 tx_per_rate_pwr_limits_degraded[WL1271_INI_RATE_GROUP_COUNT];
+        u8 tx_per_rate_pwr_limits_extreme[WL1271_INI_RATE_GROUP_COUNT];
+        u8 tx_per_chan_pwr_limits_11b[WL1271_INI_CHANNEL_COUNT_2];
+        u8 tx_per_chan_pwr_limits_ofdm[WL1271_INI_CHANNEL_COUNT_2];
+        u8 tx_pd_vs_rate_offsets[WL1271_INI_RATE_GROUP_COUNT];
+        u8 tx_ibias[WL1271_INI_RATE_GROUP_COUNT];
+        u8 rx_fem_insertion_loss;
+        u8 degraded_low_to_normal_thr;
+        u8 normal_to_degraded_high_thr;
+} __attribute__ ((packed));
+
+#define WL1271_INI_CHANNEL_COUNT_5 35
+#define WL1271_INI_SUB_BAND_COUNT_5 7
+
+struct wl1271_ini_band_params_5 {
+        u8 rx_trace_insertion_loss[WL1271_INI_SUB_BAND_COUNT_5];
+        u8 tx_trace_loss[WL1271_INI_SUB_BAND_COUNT_5];
+        u8 rx_rssi_process_compens[WL1271_INI_RSSI_PROCESS_COMPENS_SIZE];
+} __attribute__ ((packed));
+
+struct wl1271_ini_fem_params_5 {
+        __le16 tx_bip_ref_pd_voltage[WL1271_INI_SUB_BAND_COUNT_5];
+        u8 tx_bip_ref_power[WL1271_INI_SUB_BAND_COUNT_5];
+        u8 tx_bip_ref_offset[WL1271_INI_SUB_BAND_COUNT_5];
+        u8 tx_per_rate_pwr_limits_normal[WL1271_INI_RATE_GROUP_COUNT];
+        u8 tx_per_rate_pwr_limits_degraded[WL1271_INI_RATE_GROUP_COUNT];
+        u8 tx_per_rate_pwr_limits_extreme[WL1271_INI_RATE_GROUP_COUNT];
+        u8 tx_per_chan_pwr_limits_ofdm[WL1271_INI_CHANNEL_COUNT_5];
+        u8 tx_pd_vs_rate_offsets[WL1271_INI_RATE_GROUP_COUNT];
+        u8 tx_ibias[WL1271_INI_RATE_GROUP_COUNT];
+        u8 rx_fem_insertion_loss[WL1271_INI_SUB_BAND_COUNT_5];
+        u8 degraded_low_to_normal_thr;
+        u8 normal_to_degraded_high_thr;
+} __attribute__ ((packed));
+
+
+/* NVS data structure */
+#define WL1271_INI_NVS_SECTION_SIZE                  468
+#define WL1271_INI_FEM_MODULE_COUNT                  2
+
+#define WL1271_INI_LEGACY_NVS_FILE_SIZE              800
+
+struct wl1271_nvs_file {
+        /* NVS section */
+        u8 nvs[WL1271_INI_NVS_SECTION_SIZE];
+
+        /* INI section */
+        struct wl1271_ini_general_params general_params;
+        u8 padding1;
+        struct wl1271_ini_band_params_2 stat_radio_params_2;
+        u8 padding2;
+        struct {
+                struct wl1271_ini_fem_params_2 params;
+                u8 padding;
+        } dyn_radio_params_2[WL1271_INI_FEM_MODULE_COUNT];
+        struct wl1271_ini_band_params_5 stat_radio_params_5;
+        u8 padding3;
+        struct {
+                struct wl1271_ini_fem_params_5 params;
+                u8 padding;
+        } dyn_radio_params_5[WL1271_INI_FEM_MODULE_COUNT];
+} __attribute__ ((packed));
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/wl1271_main.c
index b7d9137851ac..7a14da506d78 100644
--- a/drivers/net/wireless/wl12xx/wl1271_main.c
+++ b/drivers/net/wireless/wl12xx/wl1271_main.c
@@ -566,14 +566,21 @@ static int wl1271_fetch_nvs(struct wl1271 *wl)
                 return ret;
         }
 
-        if (fw->size != sizeof(struct wl1271_nvs_file)) {
+        /*
+         * FIXME: the LEGACY NVS image support (NVS's missing the 5GHz band
+         * configurations) can be removed when those NVS files stop floating
+         * around.
+         */
+        if (fw->size != sizeof(struct wl1271_nvs_file) &&
+            (fw->size != WL1271_INI_LEGACY_NVS_FILE_SIZE ||
+             wl1271_11a_enabled())) {
                 wl1271_error("nvs size is not as expected: %zu != %zu",
                              fw->size, sizeof(struct wl1271_nvs_file));
                 ret = -EILSEQ;
                 goto out;
         }
 
-        wl->nvs = kmalloc(sizeof(struct wl1271_nvs_file), GFP_KERNEL);
+        wl->nvs = kzalloc(sizeof(struct wl1271_nvs_file), GFP_KERNEL);
 
         if (!wl->nvs) {
                 wl1271_error("could not allocate memory for the nvs file");
@@ -581,7 +588,7 @@ static int wl1271_fetch_nvs(struct wl1271 *wl)
                 goto out;
         }
 
-        memcpy(wl->nvs, fw->data, sizeof(struct wl1271_nvs_file));
+        memcpy(wl->nvs, fw->data, fw->size);
 
 out:
         release_firmware(fw);
@@ -1044,7 +1051,7 @@ static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
         mutex_lock(&wl->mutex);
 
         /* let's notify MAC80211 about the remaining pending TX frames */
-        wl1271_tx_flush(wl);
+        wl1271_tx_reset(wl);
         wl1271_power_off(wl);
 
         memset(wl->bssid, 0, ETH_ALEN);
@@ -1241,6 +1248,42 @@ static u32 wl1271_min_rate_get(struct wl1271 *wl)
         return rate;
 }
 
+static int wl1271_handle_idle(struct wl1271 *wl, bool idle)
+{
+        int ret;
+
+        if (idle) {
+                if (test_bit(WL1271_FLAG_JOINED, &wl->flags)) {
+                        ret = wl1271_unjoin(wl);
+                        if (ret < 0)
+                                goto out;
+                }
+                wl->rate_set = wl1271_min_rate_get(wl);
+                wl->sta_rate_set = 0;
+                ret = wl1271_acx_rate_policies(wl);
+                if (ret < 0)
+                        goto out;
+                ret = wl1271_acx_keep_alive_config(
+                        wl, CMD_TEMPL_KLV_IDX_NULL_DATA,
+                        ACX_KEEP_ALIVE_TPL_INVALID);
+                if (ret < 0)
+                        goto out;
+                set_bit(WL1271_FLAG_IDLE, &wl->flags);
+        } else {
+                /* increment the session counter */
+                wl->session_counter++;
+                if (wl->session_counter >= SESSION_COUNTER_MAX)
+                        wl->session_counter = 0;
+                ret = wl1271_dummy_join(wl);
+                if (ret < 0)
+                        goto out;
+                clear_bit(WL1271_FLAG_IDLE, &wl->flags);
+        }
+
+out:
+        return ret;
+}
+
 static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct wl1271 *wl = hw->priv;
@@ -1255,6 +1298,15 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
                      conf->power_level,
                      conf->flags & IEEE80211_CONF_IDLE ? "idle" : "in use");
 
+        /*
+         * mac80211 will go to idle nearly immediately after transmitting some
+         * frames, such as the deauth. To make sure those frames reach the air,
+         * wait here until the TX queue is fully flushed.
+         */
+        if ((changed & IEEE80211_CONF_CHANGE_IDLE) &&
+            (conf->flags & IEEE80211_CONF_IDLE))
+                wl1271_tx_flush(wl);
+
         mutex_lock(&wl->mutex);
 
         if (unlikely(wl->state == WL1271_STATE_OFF))
@@ -1295,22 +1347,9 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
         }
 
         if (changed & IEEE80211_CONF_CHANGE_IDLE) {
-                if (conf->flags & IEEE80211_CONF_IDLE &&
-                    test_bit(WL1271_FLAG_JOINED, &wl->flags))
-                        wl1271_unjoin(wl);
-                else if (!(conf->flags & IEEE80211_CONF_IDLE))
-                        wl1271_dummy_join(wl);
-
-                if (conf->flags & IEEE80211_CONF_IDLE) {
-                        wl->rate_set = wl1271_min_rate_get(wl);
-                        wl->sta_rate_set = 0;
-                        wl1271_acx_rate_policies(wl);
-                        wl1271_acx_keep_alive_config(
-                                wl, CMD_TEMPL_KLV_IDX_NULL_DATA,
-                                ACX_KEEP_ALIVE_TPL_INVALID);
-                        set_bit(WL1271_FLAG_IDLE, &wl->flags);
-                } else
-                        clear_bit(WL1271_FLAG_IDLE, &wl->flags);
+                ret = wl1271_handle_idle(wl, conf->flags & IEEE80211_CONF_IDLE);
+                if (ret < 0)
+                        wl1271_warning("idle mode change failed %d", ret);
         }
 
         if (conf->flags & IEEE80211_CONF_PS &&
@@ -1595,13 +1634,11 @@ static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
                 goto out;
 
         if (wl1271_11a_enabled())
-                ret = wl1271_cmd_scan(hw->priv, ssid, len,
-                                      req->ie, req->ie_len, 1, 0,
-                                      WL1271_SCAN_BAND_DUAL, 3);
+                ret = wl1271_cmd_scan(hw->priv, ssid, len, req,
+                                      1, 0, WL1271_SCAN_BAND_DUAL, 3);
         else
-                ret = wl1271_cmd_scan(hw->priv, ssid, len,
-                                      req->ie, req->ie_len, 1, 0,
-                                      WL1271_SCAN_BAND_2_4_GHZ, 3);
+                ret = wl1271_cmd_scan(hw->priv, ssid, len, req,
+                                      1, 0, WL1271_SCAN_BAND_2_4_GHZ, 3);
 
         wl1271_ps_elp_sleep(wl);
 
@@ -1991,7 +2028,7 @@ static struct ieee80211_channel wl1271_channels[] = {
 };
 
 /* mapping to indexes for wl1271_rates */
-const static u8 wl1271_rate_to_idx_2ghz[] = {
+static const u8 wl1271_rate_to_idx_2ghz[] = {
         /* MCS rates are used only with 11n */
         CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS7 */
         CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS6 */
@@ -2103,7 +2140,7 @@ static struct ieee80211_channel wl1271_channels_5ghz[] = {
 };
 
 /* mapping to indexes for wl1271_rates_5ghz */
-const static u8 wl1271_rate_to_idx_5ghz[] = {
+static const u8 wl1271_rate_to_idx_5ghz[] = {
         /* MCS rates are used only with 11n */
         CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS7 */
         CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS6 */
@@ -2139,7 +2176,7 @@ static struct ieee80211_supported_band wl1271_band_5ghz = {
         .n_bitrates = ARRAY_SIZE(wl1271_rates_5ghz),
 };
 
-const static u8 *wl1271_band_rate_to_idx[] = {
+static const u8 *wl1271_band_rate_to_idx[] = {
         [IEEE80211_BAND_2GHZ] = wl1271_rate_to_idx_2ghz,
         [IEEE80211_BAND_5GHZ] = wl1271_rate_to_idx_5ghz
 };
diff --git a/drivers/net/wireless/wl12xx/wl1271_sdio.c b/drivers/net/wireless/wl12xx/wl1271_sdio.c
index d3d6f302f705..7059b5cccf0f 100644
--- a/drivers/net/wireless/wl12xx/wl1271_sdio.c
+++ b/drivers/net/wireless/wl12xx/wl1271_sdio.c
@@ -28,7 +28,7 @@
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/sdio_ids.h>
 #include <linux/mmc/card.h>
-#include <plat/gpio.h>
+#include <linux/gpio.h>
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
diff --git a/drivers/net/wireless/wl12xx/wl1271_testmode.c b/drivers/net/wireless/wl12xx/wl1271_testmode.c
index 554deb4d024e..6e0952f79e9a 100644
--- a/drivers/net/wireless/wl12xx/wl1271_testmode.c
+++ b/drivers/net/wireless/wl12xx/wl1271_testmode.c
@@ -199,7 +199,14 @@ static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[])
         buf = nla_data(tb[WL1271_TM_ATTR_DATA]);
         len = nla_len(tb[WL1271_TM_ATTR_DATA]);
 
-        if (len != sizeof(struct wl1271_nvs_file)) {
+        /*
+         * FIXME: the LEGACY NVS image support (NVS's missing the 5GHz band
+         * configurations) can be removed when those NVS files stop floating
+         * around.
+         */
+        if (len != sizeof(struct wl1271_nvs_file) &&
+            (len != WL1271_INI_LEGACY_NVS_FILE_SIZE ||
+             wl1271_11a_enabled())) {
                 wl1271_error("nvs size is not as expected: %zu != %zu",
                              len, sizeof(struct wl1271_nvs_file));
                 return -EMSGSIZE;
@@ -209,7 +216,7 @@ static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[])
 
         kfree(wl->nvs);
 
-        wl->nvs = kmalloc(sizeof(struct wl1271_nvs_file), GFP_KERNEL);
+        wl->nvs = kzalloc(sizeof(struct wl1271_nvs_file), GFP_KERNEL);
         if (!wl->nvs) {
                 wl1271_error("could not allocate memory for the nvs file");
                 ret = -ENOMEM;
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.c b/drivers/net/wireless/wl12xx/wl1271_tx.c
index 62db79508ddf..c592cc2e9fe8 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.c
@@ -36,6 +36,7 @@ static int wl1271_tx_id(struct wl1271 *wl, struct sk_buff *skb)
         for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 if (wl->tx_frames[i] == NULL) {
                         wl->tx_frames[i] = skb;
+                        wl->tx_frames_cnt++;
                         return i;
                 }
 
@@ -73,8 +74,10 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra)
                 wl1271_debug(DEBUG_TX,
                              "tx_allocate: size: %d, blocks: %d, id: %d",
                              total_len, total_blocks, id);
-        } else
+        } else {
                 wl->tx_frames[id] = NULL;
+                wl->tx_frames_cnt--;
+        }
 
         return ret;
 }
@@ -358,6 +361,7 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
         /* return the packet to the stack */
         ieee80211_tx_status(wl->hw, skb);
         wl->tx_frames[result->id] = NULL;
+        wl->tx_frames_cnt--;
 }
 
 /* Called upon reception of a TX complete interrupt */
@@ -412,7 +416,7 @@ void wl1271_tx_complete(struct wl1271 *wl)
 }
 
 /* caller must hold wl->mutex */
-void wl1271_tx_flush(struct wl1271 *wl)
+void wl1271_tx_reset(struct wl1271 *wl)
 {
         int i;
         struct sk_buff *skb;
@@ -421,7 +425,7 @@ void wl1271_tx_flush(struct wl1271 *wl)
 /*      control->flags = 0; FIXME */
 
         while ((skb = skb_dequeue(&wl->tx_queue))) {
-                wl1271_debug(DEBUG_TX, "flushing skb 0x%p", skb);
+                wl1271_debug(DEBUG_TX, "freeing skb 0x%p", skb);
                 ieee80211_tx_status(wl->hw, skb);
         }
 
@@ -429,6 +433,32 @@ void wl1271_tx_flush(struct wl1271 *wl)
                 if (wl->tx_frames[i] != NULL) {
                         skb = wl->tx_frames[i];
                         wl->tx_frames[i] = NULL;
+                        wl1271_debug(DEBUG_TX, "freeing skb 0x%p", skb);
                         ieee80211_tx_status(wl->hw, skb);
                 }
+        wl->tx_frames_cnt = 0;
+}
+
+#define WL1271_TX_FLUSH_TIMEOUT 500000
+
+/* caller must *NOT* hold wl->mutex */
+void wl1271_tx_flush(struct wl1271 *wl)
+{
+        unsigned long timeout;
+        timeout = jiffies + usecs_to_jiffies(WL1271_TX_FLUSH_TIMEOUT);
+
+        while (!time_after(jiffies, timeout)) {
+                mutex_lock(&wl->mutex);
+                wl1271_debug(DEBUG_TX, "flushing tx buffer: %d",
+                             wl->tx_frames_cnt);
+                if ((wl->tx_frames_cnt == 0) &&
+                    skb_queue_empty(&wl->tx_queue)) {
+                        mutex_unlock(&wl->mutex);
+                        return;
+                }
+                mutex_unlock(&wl->mutex);
+                msleep(1);
+        }
+
+        wl1271_warning("Unable to flush all TX buffers, timed out.");
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.h b/drivers/net/wireless/wl12xx/wl1271_tx.h
index 3b8b7ac253fd..0ae00637933e 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.h
@@ -158,6 +158,7 @@ static inline int wl1271_tx_ac_to_tid(int ac)
 
 void wl1271_tx_work(struct work_struct *work);
 void wl1271_tx_complete(struct wl1271 *wl);
+void wl1271_tx_reset(struct wl1271 *wl);
 void wl1271_tx_flush(struct wl1271 *wl);
 u8 wl1271_rate_to_idx(struct wl1271 *wl, int rate);
 u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set);
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index b0b666019a93..43307bd42a69 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -42,7 +42,8 @@ static struct zd_reg_alpha2_map reg_alpha2_map[] = {
         { ZD_REGDOMAIN_IC, "CA" },
         { ZD_REGDOMAIN_ETSI, "DE" }, /* Generic ETSI, use most restrictive */
         { ZD_REGDOMAIN_JAPAN, "JP" },
-        { ZD_REGDOMAIN_JAPAN_ADD, "JP" },
+        { ZD_REGDOMAIN_JAPAN_2, "JP" },
+        { ZD_REGDOMAIN_JAPAN_3, "JP" },
         { ZD_REGDOMAIN_SPAIN, "ES" },
         { ZD_REGDOMAIN_FRANCE, "FR" },
 };
@@ -855,7 +856,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
         if (skb == NULL)
                 return -ENOMEM;
         if (need_padding) {
-                /* Make sure the the payload data is 4 byte aligned. */
+                /* Make sure the payload data is 4 byte aligned. */
                 skb_reserve(skb, 2);
         }
 
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.h b/drivers/net/wireless/zd1211rw/zd_mac.h
index 630c298a730e..d21739a530ec 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.h
+++ b/drivers/net/wireless/zd1211rw/zd_mac.h
@@ -212,8 +212,9 @@ struct zd_mac {
 #define ZD_REGDOMAIN_ETSI       0x30
 #define ZD_REGDOMAIN_SPAIN      0x31
 #define ZD_REGDOMAIN_FRANCE     0x32
-#define ZD_REGDOMAIN_JAPAN_ADD  0x40
+#define ZD_REGDOMAIN_JAPAN_2    0x40
 #define ZD_REGDOMAIN_JAPAN      0x41
+#define ZD_REGDOMAIN_JAPAN_3    0x49
 
 enum {
         MIN_CHANNEL24 = 1,
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index c257940b71b6..818e1480ca93 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -844,7 +844,7 @@ out:
  * @usb: a &struct zd_usb pointer
  * @urb: URB to be freed
  *
- * Frees the the transmission URB, which means to put it on the free URB
+ * Frees the transmission URB, which means to put it on the free URB
  * list.
  */
 static void free_tx_urb(struct zd_usb *usb, struct urb *urb)
diff --git a/drivers/ssb/driver_chipcommon.c b/drivers/ssb/driver_chipcommon.c
index 59ae76bace14..7c031fdc8205 100644
--- a/drivers/ssb/driver_chipcommon.c
+++ b/drivers/ssb/driver_chipcommon.c
@@ -209,6 +209,24 @@ static void chipco_powercontrol_init(struct ssb_chipcommon *cc)
         }
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PmuFastPwrupDelay */
+static u16 pmu_fast_powerup_delay(struct ssb_chipcommon *cc)
+{
+        struct ssb_bus *bus = cc->dev->bus;
+
+        switch (bus->chip_id) {
+        case 0x4312:
+        case 0x4322:
+        case 0x4328:
+                return 7000;
+        case 0x4325:
+                /* TODO: */
+        default:
+                return 15000;
+        }
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/ClkctlFastPwrupDelay */
 static void calc_fast_powerup_delay(struct ssb_chipcommon *cc)
 {
         struct ssb_bus *bus = cc->dev->bus;
@@ -218,6 +236,12 @@ static void calc_fast_powerup_delay(struct ssb_chipcommon *cc)
 
         if (bus->bustype != SSB_BUSTYPE_PCI)
                 return;
+
+        if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
+                cc->fast_pwrup_delay = pmu_fast_powerup_delay(cc);
+                return;
+        }
+
         if (!(cc->capabilities & SSB_CHIPCO_CAP_PCTL))
                 return;
 
@@ -235,6 +259,7 @@ void ssb_chipcommon_init(struct ssb_chipcommon *cc)
                 return; /* We don't have a ChipCommon */
         if (cc->dev->id.revision >= 11)
                 cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
+        ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status);
         ssb_pmu_init(cc);
         chipco_powercontrol_init(cc);
         ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST);
diff --git a/drivers/ssb/driver_chipcommon_pmu.c b/drivers/ssb/driver_chipcommon_pmu.c
index 3d551245a4e2..5732bb2c3578 100644
--- a/drivers/ssb/driver_chipcommon_pmu.c
+++ b/drivers/ssb/driver_chipcommon_pmu.c
@@ -502,9 +502,9 @@ static void ssb_pmu_resources_init(struct ssb_chipcommon *cc)
                 chipco_write32(cc, SSB_CHIPCO_PMU_MAXRES_MSK, max_msk);
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/SSB/PmuInit */
 void ssb_pmu_init(struct ssb_chipcommon *cc)
 {
-        struct ssb_bus *bus = cc->dev->bus;
         u32 pmucap;
 
         if (!(cc->capabilities & SSB_CHIPCO_CAP_PMU))
@@ -516,15 +516,12 @@ void ssb_pmu_init(struct ssb_chipcommon *cc)
         ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n",
                     cc->pmu.rev, pmucap);
 
-        if (cc->pmu.rev >= 1) {
-                if ((bus->chip_id == 0x4325) && (bus->chip_rev < 2)) {
-                        chipco_mask32(cc, SSB_CHIPCO_PMU_CTL,
-                                      ~SSB_CHIPCO_PMU_CTL_NOILPONW);
-                } else {
-                        chipco_set32(cc, SSB_CHIPCO_PMU_CTL,
-                                     SSB_CHIPCO_PMU_CTL_NOILPONW);
-                }
-        }
+        if (cc->pmu.rev == 1)
+                chipco_mask32(cc, SSB_CHIPCO_PMU_CTL,
+                              ~SSB_CHIPCO_PMU_CTL_NOILPONW);
+        else
+                chipco_set32(cc, SSB_CHIPCO_PMU_CTL,
+                             SSB_CHIPCO_PMU_CTL_NOILPONW);
         ssb_pmu_pll_init(cc);
         ssb_pmu_resources_init(cc);
 }
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 51275aac5b34..7cee7f4eb60b 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -486,6 +486,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
 #ifdef CONFIG_SSB_PCIHOST
                         sdev->irq = bus->host_pci->irq;
                         dev->parent = &bus->host_pci->dev;
+                        sdev->dma_dev = dev->parent;
 #endif
                         break;
                 case SSB_BUSTYPE_PCMCIA:
@@ -501,6 +502,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
                         break;
                 case SSB_BUSTYPE_SSB:
                         dev->dma_mask = &dev->coherent_dma_mask;
+                        sdev->dma_dev = dev;
                         break;
                 }
 
@@ -1226,80 +1228,6 @@ u32 ssb_dma_translation(struct ssb_device *dev)
 }
 EXPORT_SYMBOL(ssb_dma_translation);
 
-int ssb_dma_set_mask(struct ssb_device *dev, u64 mask)
-{
-#ifdef CONFIG_SSB_PCIHOST
-        int err;
-#endif
-
-        switch (dev->bus->bustype) {
-        case SSB_BUSTYPE_PCI:
-#ifdef CONFIG_SSB_PCIHOST
-                err = pci_set_dma_mask(dev->bus->host_pci, mask);
-                if (err)
-                        return err;
-                err = pci_set_consistent_dma_mask(dev->bus->host_pci, mask);
-                return err;
-#endif
-        case SSB_BUSTYPE_SSB:
-                return dma_set_mask(dev->dev, mask);
-        default:
-                __ssb_dma_not_implemented(dev);
-        }
-        return -ENOSYS;
-}
-EXPORT_SYMBOL(ssb_dma_set_mask);
-
-void * ssb_dma_alloc_consistent(struct ssb_device *dev, size_t size,
-                                dma_addr_t *dma_handle, gfp_t gfp_flags)
-{
-        switch (dev->bus->bustype) {
-        case SSB_BUSTYPE_PCI:
-#ifdef CONFIG_SSB_PCIHOST
-                if (gfp_flags & GFP_DMA) {
-                        /* Workaround: The PCI API does not support passing
-                         * a GFP flag. */
-                        return dma_alloc_coherent(&dev->bus->host_pci->dev,
-                                                  size, dma_handle, gfp_flags);
-                }
-                return pci_alloc_consistent(dev->bus->host_pci, size, dma_handle);
-#endif
-        case SSB_BUSTYPE_SSB:
-                return dma_alloc_coherent(dev->dev, size, dma_handle, gfp_flags);
-        default:
-                __ssb_dma_not_implemented(dev);
-        }
-        return NULL;
-}
-EXPORT_SYMBOL(ssb_dma_alloc_consistent);
-
-void ssb_dma_free_consistent(struct ssb_device *dev, size_t size,
-                             void *vaddr, dma_addr_t dma_handle,
-                             gfp_t gfp_flags)
-{
-        switch (dev->bus->bustype) {
-        case SSB_BUSTYPE_PCI:
-#ifdef CONFIG_SSB_PCIHOST
-                if (gfp_flags & GFP_DMA) {
-                        /* Workaround: The PCI API does not support passing
-                         * a GFP flag. */
-                        dma_free_coherent(&dev->bus->host_pci->dev,
-                                          size, vaddr, dma_handle);
-                        return;
-                }
-                pci_free_consistent(dev->bus->host_pci, size,
-                                    vaddr, dma_handle);
-                return;
-#endif
-        case SSB_BUSTYPE_SSB:
-                dma_free_coherent(dev->dev, size, vaddr, dma_handle);
-                return;
-        default:
-                __ssb_dma_not_implemented(dev);
-        }
-}
-EXPORT_SYMBOL(ssb_dma_free_consistent);
-
 int ssb_bus_may_powerdown(struct ssb_bus *bus)
 {
         struct ssb_chipcommon *cc;
diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
index 6dcda86be6eb..6e88d2b603b4 100644
--- a/drivers/ssb/pci.c
+++ b/drivers/ssb/pci.c
@@ -626,11 +626,22 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
                 return -ENODEV;
         }
         if (bus->chipco.dev) {  /* can be unavailible! */
-                bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
-                        SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
+                /*
+                 * get SPROM offset: SSB_SPROM_BASE1 except for
+                 * chipcommon rev >= 31 or chip ID is 0x4312 and
+                 * chipcommon status & 3 == 2
+                 */
+                if (bus->chipco.dev->id.revision >= 31)
+                        bus->sprom_offset = SSB_SPROM_BASE31;
+                else if (bus->chip_id == 0x4312 &&
+                         (bus->chipco.status & 0x03) == 2)
+                        bus->sprom_offset = SSB_SPROM_BASE31;
+                else
+                        bus->sprom_offset = SSB_SPROM_BASE1;
         } else {
                 bus->sprom_offset = SSB_SPROM_BASE1;
         }
+        ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset);
 
         buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
         if (!buf)