165 files changed, 13423 insertions, 3528 deletions

diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 4373adb2119a..9d9490e22e07 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -26,6 +26,10 @@
 #define PCI_DEVICE_ID_INTEL_82965GME_IG     0x2A12
 #define PCI_DEVICE_ID_INTEL_82945GME_HB     0x27AC
 #define PCI_DEVICE_ID_INTEL_82945GME_IG     0x27AE
+#define PCI_DEVICE_ID_INTEL_IGDGM_HB        0xA010
+#define PCI_DEVICE_ID_INTEL_IGDGM_IG        0xA011
+#define PCI_DEVICE_ID_INTEL_IGDG_HB         0xA000
+#define PCI_DEVICE_ID_INTEL_IGDG_IG         0xA001
 #define PCI_DEVICE_ID_INTEL_G33_HB          0x29C0
 #define PCI_DEVICE_ID_INTEL_G33_IG          0x29C2
 #define PCI_DEVICE_ID_INTEL_Q35_HB          0x29B0
@@ -60,7 +64,12 @@
 
 #define IS_G33 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G33_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q35_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q33_HB)
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q33_HB || \
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDGM_HB || \
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDG_HB)
+
+#define IS_IGD (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDGM_HB || \
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDG_HB)
 
 #define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGD_E_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
@@ -510,7 +519,7 @@ static void intel_i830_init_gtt_entries(void)
                         size = 512;
                 }
                 size += 4; /* add in BIOS popup space */
-        } else if (IS_G33) {
+        } else if (IS_G33 && !IS_IGD) {
         /* G33's GTT size defined in gmch_ctrl */
                 switch (gmch_ctrl & G33_PGETBL_SIZE_MASK) {
                 case G33_PGETBL_SIZE_1M:
@@ -526,7 +535,7 @@ static void intel_i830_init_gtt_entries(void)
                         size = 512;
                 }
                 size += 4;
-        } else if (IS_G4X) {
+        } else if (IS_G4X || IS_IGD) {
                 /* On 4 series hardware, GTT stolen is separate from graphics
                  * stolen, ignore it in stolen gtt entries counting.  However,
                  * 4KB of the stolen memory doesn't get mapped to the GTT.
@@ -2161,6 +2170,10 @@ static const struct intel_driver_description {
                 NULL, &intel_g33_driver },
         { PCI_DEVICE_ID_INTEL_Q33_HB, PCI_DEVICE_ID_INTEL_Q33_IG, 0, "Q33",
                 NULL, &intel_g33_driver },
+        { PCI_DEVICE_ID_INTEL_IGDGM_HB, PCI_DEVICE_ID_INTEL_IGDGM_IG, 0, "IGD",
+                NULL, &intel_g33_driver },
+        { PCI_DEVICE_ID_INTEL_IGDG_HB, PCI_DEVICE_ID_INTEL_IGDG_IG, 0, "IGD",
+                NULL, &intel_g33_driver },
         { PCI_DEVICE_ID_INTEL_GM45_HB, PCI_DEVICE_ID_INTEL_GM45_IG, 0,
             "Mobile Intel® GM45 Express", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_IGD_E_HB, PCI_DEVICE_ID_INTEL_IGD_E_IG, 0,
@@ -2355,6 +2368,8 @@ static struct pci_device_id agp_intel_pci_table[] = {
         ID(PCI_DEVICE_ID_INTEL_82945G_HB),
         ID(PCI_DEVICE_ID_INTEL_82945GM_HB),
         ID(PCI_DEVICE_ID_INTEL_82945GME_HB),
+        ID(PCI_DEVICE_ID_INTEL_IGDGM_HB),
+        ID(PCI_DEVICE_ID_INTEL_IGDG_HB),
         ID(PCI_DEVICE_ID_INTEL_82946GZ_HB),
         ID(PCI_DEVICE_ID_INTEL_82G35_HB),
         ID(PCI_DEVICE_ID_INTEL_82965Q_HB),
diff --git a/drivers/firewire/fw-card.c b/drivers/firewire/fw-card.c
index a5dd7a665aa8..8b8c8c22f0fc 100644
--- a/drivers/firewire/fw-card.c
+++ b/drivers/firewire/fw-card.c
@@ -63,8 +63,7 @@ static int descriptor_count;
 #define BIB_CMC                 ((1) << 30)
 #define BIB_IMC                 ((1) << 31)
 
-static u32 *
-generate_config_rom(struct fw_card *card, size_t *config_rom_length)
+static u32 *generate_config_rom(struct fw_card *card, size_t *config_rom_length)
 {
         struct fw_descriptor *desc;
         static u32 config_rom[256];
@@ -128,8 +127,7 @@ generate_config_rom(struct fw_card *card, size_t *config_rom_length)
         return config_rom;
 }
 
-static void
-update_config_roms(void)
+static void update_config_roms(void)
 {
         struct fw_card *card;
         u32 *config_rom;
@@ -141,8 +139,7 @@ update_config_roms(void)
         }
 }
 
-int
-fw_core_add_descriptor(struct fw_descriptor *desc)
+int fw_core_add_descriptor(struct fw_descriptor *desc)
 {
         size_t i;
 
@@ -171,8 +168,7 @@ fw_core_add_descriptor(struct fw_descriptor *desc)
         return 0;
 }
 
-void
-fw_core_remove_descriptor(struct fw_descriptor *desc)
+void fw_core_remove_descriptor(struct fw_descriptor *desc)
 {
         mutex_lock(&card_mutex);
 
@@ -185,12 +181,30 @@ fw_core_remove_descriptor(struct fw_descriptor *desc)
         mutex_unlock(&card_mutex);
 }
 
+static int set_broadcast_channel(struct device *dev, void *data)
+{
+        fw_device_set_broadcast_channel(fw_device(dev), (long)data);
+        return 0;
+}
+
+static void allocate_broadcast_channel(struct fw_card *card, int generation)
+{
+        int channel, bandwidth = 0;
+
+        fw_iso_resource_manage(card, generation, 1ULL << 31,
+                               &channel, &bandwidth, true);
+        if (channel == 31) {
+                card->broadcast_channel_allocated = true;
+                device_for_each_child(card->device, (void *)(long)generation,
+                                      set_broadcast_channel);
+        }
+}
+
 static const char gap_count_table[] = {
         63, 5, 7, 8, 10, 13, 16, 18, 21, 24, 26, 29, 32, 35, 37, 40
 };
 
-void
-fw_schedule_bm_work(struct fw_card *card, unsigned long delay)
+void fw_schedule_bm_work(struct fw_card *card, unsigned long delay)
 {
         int scheduled;
 
@@ -200,37 +214,38 @@ fw_schedule_bm_work(struct fw_card *card, unsigned long delay)
                 fw_card_put(card);
 }
 
-static void
-fw_card_bm_work(struct work_struct *work)
+static void fw_card_bm_work(struct work_struct *work)
 {
         struct fw_card *card = container_of(work, struct fw_card, work.work);
         struct fw_device *root_device;
-        struct fw_node *root_node, *local_node;
+        struct fw_node *root_node;
         unsigned long flags;
-        int root_id, new_root_id, irm_id, gap_count, generation, grace, rcode;
+        int root_id, new_root_id, irm_id, local_id;
+        int gap_count, generation, grace, rcode;
         bool do_reset = false;
         bool root_device_is_running;
         bool root_device_is_cmc;
         __be32 lock_data[2];
 
         spin_lock_irqsave(&card->lock, flags);
-        local_node = card->local_node;
-        root_node  = card->root_node;
 
-        if (local_node == NULL) {
+        if (card->local_node == NULL) {
                 spin_unlock_irqrestore(&card->lock, flags);
                 goto out_put_card;
         }
-        fw_node_get(local_node);
-        fw_node_get(root_node);
 
         generation = card->generation;
+        root_node = card->root_node;
+        fw_node_get(root_node);
         root_device = root_node->data;
         root_device_is_running = root_device &&
                         atomic_read(&root_device->state) == FW_DEVICE_RUNNING;
         root_device_is_cmc = root_device && root_device->cmc;
-        root_id = root_node->node_id;
-        grace = time_after(jiffies, card->reset_jiffies + DIV_ROUND_UP(HZ, 10));
+        root_id  = root_node->node_id;
+        irm_id   = card->irm_node->node_id;
+        local_id = card->local_node->node_id;
+
+        grace = time_after(jiffies, card->reset_jiffies + DIV_ROUND_UP(HZ, 8));
 
         if (is_next_generation(generation, card->bm_generation) ||
             (card->bm_generation != generation && grace)) {
@@ -246,16 +261,15 @@ fw_card_bm_work(struct work_struct *work)
                  * next generation.
                  */
 
-                irm_id = card->irm_node->node_id;
                 if (!card->irm_node->link_on) {
-                        new_root_id = local_node->node_id;
+                        new_root_id = local_id;
                         fw_notify("IRM has link off, making local node (%02x) root.\n",
                                   new_root_id);
                         goto pick_me;
                 }
 
                 lock_data[0] = cpu_to_be32(0x3f);
-                lock_data[1] = cpu_to_be32(local_node->node_id);
+                lock_data[1] = cpu_to_be32(local_id);
 
                 spin_unlock_irqrestore(&card->lock, flags);
 
@@ -269,9 +283,14 @@ fw_card_bm_work(struct work_struct *work)
                         goto out;
 
                 if (rcode == RCODE_COMPLETE &&
-                    lock_data[0] != cpu_to_be32(0x3f))
-                        /* Somebody else is BM, let them do the work. */
+                    lock_data[0] != cpu_to_be32(0x3f)) {
+
+                        /* Somebody else is BM.  Only act as IRM. */
+                        if (local_id == irm_id)
+                                allocate_broadcast_channel(card, generation);
+
                         goto out;
+                }
 
                 spin_lock_irqsave(&card->lock, flags);
 
@@ -282,19 +301,18 @@ fw_card_bm_work(struct work_struct *work)
                          * do a bus reset and pick the local node as
                          * root, and thus, IRM.
                          */
-                        new_root_id = local_node->node_id;
+                        new_root_id = local_id;
                         fw_notify("BM lock failed, making local node (%02x) root.\n",
                                   new_root_id);
                         goto pick_me;
                 }
         } else if (card->bm_generation != generation) {
                 /*
-                 * OK, we weren't BM in the last generation, and it's
-                 * less than 100ms since last bus reset. Reschedule
-                 * this task 100ms from now.
+                 * We weren't BM in the last generation, and the last
+                 * bus reset is less than 125ms ago.  Reschedule this job.
                  */
                 spin_unlock_irqrestore(&card->lock, flags);
-                fw_schedule_bm_work(card, DIV_ROUND_UP(HZ, 10));
+                fw_schedule_bm_work(card, DIV_ROUND_UP(HZ, 8));
                 goto out;
         }
 
@@ -310,7 +328,7 @@ fw_card_bm_work(struct work_struct *work)
                  * Either link_on is false, or we failed to read the
                  * config rom.  In either case, pick another root.
                  */
-                new_root_id = local_node->node_id;
+                new_root_id = local_id;
         } else if (!root_device_is_running) {
                 /*
                  * If we haven't probed this device yet, bail out now
@@ -332,7 +350,7 @@ fw_card_bm_work(struct work_struct *work)
                  * successfully read the config rom, but it's not
                  * cycle master capable.
                  */
-                new_root_id = local_node->node_id;
+                new_root_id = local_id;
         }
 
  pick_me:
@@ -363,25 +381,28 @@ fw_card_bm_work(struct work_struct *work)
                           card->index, new_root_id, gap_count);
                 fw_send_phy_config(card, new_root_id, generation, gap_count);
                 fw_core_initiate_bus_reset(card, 1);
+                /* Will allocate broadcast channel after the reset. */
+        } else {
+                if (local_id == irm_id)
+                        allocate_broadcast_channel(card, generation);
         }
+
  out:
         fw_node_put(root_node);
-        fw_node_put(local_node);
  out_put_card:
         fw_card_put(card);
 }
 
-static void
-flush_timer_callback(unsigned long data)
+static void flush_timer_callback(unsigned long data)
 {
         struct fw_card *card = (struct fw_card *)data;
 
         fw_flush_transactions(card);
 }
 
-void
-fw_card_initialize(struct fw_card *card, const struct fw_card_driver *driver,
-                   struct device *device)
+void fw_card_initialize(struct fw_card *card,
+                        const struct fw_card_driver *driver,
+                        struct device *device)
 {
         static atomic_t index = ATOMIC_INIT(-1);
 
@@ -406,13 +427,12 @@ fw_card_initialize(struct fw_card *card, const struct fw_card_driver *driver,
 }
 EXPORT_SYMBOL(fw_card_initialize);
 
-int
-fw_card_add(struct fw_card *card,
-            u32 max_receive, u32 link_speed, u64 guid)
+int fw_card_add(struct fw_card *card,
+                u32 max_receive, u32 link_speed, u64 guid)
 {
         u32 *config_rom;
         size_t length;
-        int err;
+        int ret;
 
         card->max_receive = max_receive;
         card->link_speed = link_speed;
@@ -423,13 +443,14 @@ fw_card_add(struct fw_card *card,
         list_add_tail(&card->link, &card_list);
         mutex_unlock(&card_mutex);
 
-        err = card->driver->enable(card, config_rom, length);
-        if (err < 0) {
+        ret = card->driver->enable(card, config_rom, length);
+        if (ret < 0) {
                 mutex_lock(&card_mutex);
                 list_del(&card->link);
                 mutex_unlock(&card_mutex);
         }
-        return err;
+
+        return ret;
 }
 EXPORT_SYMBOL(fw_card_add);
 
@@ -442,23 +463,20 @@ EXPORT_SYMBOL(fw_card_add);
  * dummy driver just fails all IO.
  */
 
-static int
-dummy_enable(struct fw_card *card, u32 *config_rom, size_t length)
+static int dummy_enable(struct fw_card *card, u32 *config_rom, size_t length)
 {
         BUG();
         return -1;
 }
 
-static int
-dummy_update_phy_reg(struct fw_card *card, int address,
-                     int clear_bits, int set_bits)
+static int dummy_update_phy_reg(struct fw_card *card, int address,
+                                int clear_bits, int set_bits)
 {
         return -ENODEV;
 }
 
-static int
-dummy_set_config_rom(struct fw_card *card,
-                     u32 *config_rom, size_t length)
+static int dummy_set_config_rom(struct fw_card *card,
+                                u32 *config_rom, size_t length)
 {
         /*
          * We take the card out of card_list before setting the dummy
@@ -468,27 +486,23 @@ dummy_set_config_rom(struct fw_card *card,
         return -1;
 }
 
-static void
-dummy_send_request(struct fw_card *card, struct fw_packet *packet)
+static void dummy_send_request(struct fw_card *card, struct fw_packet *packet)
 {
         packet->callback(packet, card, -ENODEV);
 }
 
-static void
-dummy_send_response(struct fw_card *card, struct fw_packet *packet)
+static void dummy_send_response(struct fw_card *card, struct fw_packet *packet)
 {
         packet->callback(packet, card, -ENODEV);
 }
 
-static int
-dummy_cancel_packet(struct fw_card *card, struct fw_packet *packet)
+static int dummy_cancel_packet(struct fw_card *card, struct fw_packet *packet)
 {
         return -ENOENT;
 }
 
-static int
-dummy_enable_phys_dma(struct fw_card *card,
-                      int node_id, int generation)
+static int dummy_enable_phys_dma(struct fw_card *card,
+                                 int node_id, int generation)
 {
         return -ENODEV;
 }
@@ -503,16 +517,14 @@ static struct fw_card_driver dummy_driver = {
         .enable_phys_dma = dummy_enable_phys_dma,
 };
 
-void
-fw_card_release(struct kref *kref)
+void fw_card_release(struct kref *kref)
 {
         struct fw_card *card = container_of(kref, struct fw_card, kref);
 
         complete(&card->done);
 }
 
-void
-fw_core_remove_card(struct fw_card *card)
+void fw_core_remove_card(struct fw_card *card)
 {
         card->driver->update_phy_reg(card, 4,
                                      PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
@@ -536,8 +548,7 @@ fw_core_remove_card(struct fw_card *card)
 }
 EXPORT_SYMBOL(fw_core_remove_card);
 
-int
-fw_core_initiate_bus_reset(struct fw_card *card, int short_reset)
+int fw_core_initiate_bus_reset(struct fw_card *card, int short_reset)
 {
         int reg = short_reset ? 5 : 1;
         int bit = short_reset ? PHY_BUS_SHORT_RESET : PHY_BUS_RESET;
diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
index ed03234cbea8..7eb6594cc3e5 100644
--- a/drivers/firewire/fw-cdev.c
+++ b/drivers/firewire/fw-cdev.c
@@ -18,87 +18,162 @@
  * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  */
 
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/wait.h>
-#include <linux/errno.h>
+#include <linux/compat.h>
+#include <linux/delay.h>
 #include <linux/device.h>
-#include <linux/vmalloc.h>
+#include <linux/errno.h>
+#include <linux/firewire-cdev.h>
+#include <linux/idr.h>
+#include <linux/jiffies.h>
+#include <linux/kernel.h>
+#include <linux/kref.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/poll.h>
 #include <linux/preempt.h>
+#include <linux/spinlock.h>
 #include <linux/time.h>
-#include <linux/delay.h>
-#include <linux/mm.h>
-#include <linux/idr.h>
-#include <linux/compat.h>
-#include <linux/firewire-cdev.h>
+#include <linux/vmalloc.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+
 #include <asm/system.h>
 #include <asm/uaccess.h>
-#include "fw-transaction.h"
-#include "fw-topology.h"
+
 #include "fw-device.h"
+#include "fw-topology.h"
+#include "fw-transaction.h"
+
+struct client {
+        u32 version;
+        struct fw_device *device;
+
+        spinlock_t lock;
+        bool in_shutdown;
+        struct idr resource_idr;
+        struct list_head event_list;
+        wait_queue_head_t wait;
+        u64 bus_reset_closure;
+
+        struct fw_iso_context *iso_context;
+        u64 iso_closure;
+        struct fw_iso_buffer buffer;
+        unsigned long vm_start;
 
-struct client;
-struct client_resource {
         struct list_head link;
-        void (*release)(struct client *client, struct client_resource *r);
-        u32 handle;
+        struct kref kref;
 };
 
+static inline void client_get(struct client *client)
+{
+        kref_get(&client->kref);
+}
+
+static void client_release(struct kref *kref)
+{
+        struct client *client = container_of(kref, struct client, kref);
+
+        fw_device_put(client->device);
+        kfree(client);
+}
+
+static void client_put(struct client *client)
+{
+        kref_put(&client->kref, client_release);
+}
+
+struct client_resource;
+typedef void (*client_resource_release_fn_t)(struct client *,
+                                             struct client_resource *);
+struct client_resource {
+        client_resource_release_fn_t release;
+        int handle;
+};
+
+struct address_handler_resource {
+        struct client_resource resource;
+        struct fw_address_handler handler;
+        __u64 closure;
+        struct client *client;
+};
+
+struct outbound_transaction_resource {
+        struct client_resource resource;
+        struct fw_transaction transaction;
+};
+
+struct inbound_transaction_resource {
+        struct client_resource resource;
+        struct fw_request *request;
+        void *data;
+        size_t length;
+};
+
+struct descriptor_resource {
+        struct client_resource resource;
+        struct fw_descriptor descriptor;
+        u32 data[0];
+};
+
+struct iso_resource {
+        struct client_resource resource;
+        struct client *client;
+        /* Schedule work and access todo only with client->lock held. */
+        struct delayed_work work;
+        enum {ISO_RES_ALLOC, ISO_RES_REALLOC, ISO_RES_DEALLOC,
+              ISO_RES_ALLOC_ONCE, ISO_RES_DEALLOC_ONCE,} todo;
+        int generation;
+        u64 channels;
+        s32 bandwidth;
+        struct iso_resource_event *e_alloc, *e_dealloc;
+};
+
+static void schedule_iso_resource(struct iso_resource *);
+static void release_iso_resource(struct client *, struct client_resource *);
+
 /*
  * dequeue_event() just kfree()'s the event, so the event has to be
- * the first field in the struct.
+ * the first field in a struct XYZ_event.
  */
-
 struct event {
         struct { void *data; size_t size; } v[2];
         struct list_head link;
 };
 
-struct bus_reset {
+struct bus_reset_event {
         struct event event;
         struct fw_cdev_event_bus_reset reset;
 };
 
-struct response {
+struct outbound_transaction_event {
         struct event event;
-        struct fw_transaction transaction;
         struct client *client;
-        struct client_resource resource;
+        struct outbound_transaction_resource r;
         struct fw_cdev_event_response response;
 };
 
-struct iso_interrupt {
+struct inbound_transaction_event {
         struct event event;
-        struct fw_cdev_event_iso_interrupt interrupt;
+        struct fw_cdev_event_request request;
 };
 
-struct client {
-        u32 version;
-        struct fw_device *device;
-        spinlock_t lock;
-        u32 resource_handle;
-        struct list_head resource_list;
-        struct list_head event_list;
-        wait_queue_head_t wait;
-        u64 bus_reset_closure;
-
-        struct fw_iso_context *iso_context;
-        u64 iso_closure;
-        struct fw_iso_buffer buffer;
-        unsigned long vm_start;
+struct iso_interrupt_event {
+        struct event event;
+        struct fw_cdev_event_iso_interrupt interrupt;
+};
 
-        struct list_head link;
+struct iso_resource_event {
+        struct event event;
+        struct fw_cdev_event_iso_resource resource;
 };
 
-static inline void __user *
-u64_to_uptr(__u64 value)
+static inline void __user *u64_to_uptr(__u64 value)
 {
         return (void __user *)(unsigned long)value;
 }
 
-static inline __u64
-uptr_to_u64(void __user *ptr)
+static inline __u64 uptr_to_u64(void __user *ptr)
 {
         return (__u64)(unsigned long)ptr;
 }
@@ -107,7 +182,6 @@ static int fw_device_op_open(struct inode *inode, struct file *file)
 {
         struct fw_device *device;
         struct client *client;
-        unsigned long flags;
 
         device = fw_device_get_by_devt(inode->i_rdev);
         if (device == NULL)
@@ -125,16 +199,17 @@ static int fw_device_op_open(struct inode *inode, struct file *file)
         }
 
         client->device = device;
-        INIT_LIST_HEAD(&client->event_list);
-        INIT_LIST_HEAD(&client->resource_list);
         spin_lock_init(&client->lock);
+        idr_init(&client->resource_idr);
+        INIT_LIST_HEAD(&client->event_list);
         init_waitqueue_head(&client->wait);
+        kref_init(&client->kref);
 
         file->private_data = client;
 
-        spin_lock_irqsave(&device->card->lock, flags);
+        mutex_lock(&device->client_list_mutex);
         list_add_tail(&client->link, &device->client_list);
-        spin_unlock_irqrestore(&device->card->lock, flags);
+        mutex_unlock(&device->client_list_mutex);
 
         return 0;
 }
@@ -150,68 +225,69 @@ static void queue_event(struct client *client, struct event *event,
         event->v[1].size = size1;
 
         spin_lock_irqsave(&client->lock, flags);
-        list_add_tail(&event->link, &client->event_list);
+        if (client->in_shutdown)
+                kfree(event);
+        else
+                list_add_tail(&event->link, &client->event_list);
         spin_unlock_irqrestore(&client->lock, flags);
 
         wake_up_interruptible(&client->wait);
 }
 
-static int
-dequeue_event(struct client *client, char __user *buffer, size_t count)
+static int dequeue_event(struct client *client,
+                         char __user *buffer, size_t count)
 {
-        unsigned long flags;
         struct event *event;
         size_t size, total;
-        int i, retval;
+        int i, ret;
 
-        retval = wait_event_interruptible(client->wait,
-                                          !list_empty(&client->event_list) ||
-                                          fw_device_is_shutdown(client->device));
-        if (retval < 0)
-                return retval;
+        ret = wait_event_interruptible(client->wait,
+                        !list_empty(&client->event_list) ||
+                        fw_device_is_shutdown(client->device));
+        if (ret < 0)
+                return ret;
 
         if (list_empty(&client->event_list) &&
                        fw_device_is_shutdown(client->device))
                 return -ENODEV;
 
-        spin_lock_irqsave(&client->lock, flags);
-        event = container_of(client->event_list.next, struct event, link);
+        spin_lock_irq(&client->lock);
+        event = list_first_entry(&client->event_list, struct event, link);
         list_del(&event->link);
-        spin_unlock_irqrestore(&client->lock, flags);
+        spin_unlock_irq(&client->lock);
 
         total = 0;
         for (i = 0; i < ARRAY_SIZE(event->v) && total < count; i++) {
                 size = min(event->v[i].size, count - total);
                 if (copy_to_user(buffer + total, event->v[i].data, size)) {
-                        retval = -EFAULT;
+                        ret = -EFAULT;
                         goto out;
                 }
                 total += size;
         }
-        retval = total;
+        ret = total;
 
  out:
         kfree(event);
 
-        return retval;
+        return ret;
 }
 
-static ssize_t
-fw_device_op_read(struct file *file,
-                  char __user *buffer, size_t count, loff_t *offset)
+static ssize_t fw_device_op_read(struct file *file, char __user *buffer,
+                                 size_t count, loff_t *offset)
 {
         struct client *client = file->private_data;
 
         return dequeue_event(client, buffer, count);
 }
 
-/* caller must hold card->lock so that node pointers can be dereferenced here */
-static void
-fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,
-                     struct client *client)
+static void fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,
+                                 struct client *client)
 {
         struct fw_card *card = client->device->card;
 
+        spin_lock_irq(&card->lock);
+
         event->closure       = client->bus_reset_closure;
         event->type          = FW_CDEV_EVENT_BUS_RESET;
         event->generation    = client->device->generation;
@@ -220,39 +296,49 @@ fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,
         event->bm_node_id    = 0; /* FIXME: We don't track the BM. */
         event->irm_node_id   = card->irm_node->node_id;
         event->root_node_id  = card->root_node->node_id;
+
+        spin_unlock_irq(&card->lock);
 }
 
-static void
-for_each_client(struct fw_device *device,
-                void (*callback)(struct client *client))
+static void for_each_client(struct fw_device *device,
+                            void (*callback)(struct client *client))
 {
-        struct fw_card *card = device->card;
         struct client *c;
-        unsigned long flags;
-
-        spin_lock_irqsave(&card->lock, flags);
 
+        mutex_lock(&device->client_list_mutex);
         list_for_each_entry(c, &device->client_list, link)
                 callback(c);
+        mutex_unlock(&device->client_list_mutex);
+}
+
+static int schedule_reallocations(int id, void *p, void *data)
+{
+        struct client_resource *r = p;
 
-        spin_unlock_irqrestore(&card->lock, flags);
+        if (r->release == release_iso_resource)
+                schedule_iso_resource(container_of(r,
+                                        struct iso_resource, resource));
+        return 0;
 }
 
-static void
-queue_bus_reset_event(struct client *client)
+static void queue_bus_reset_event(struct client *client)
 {
-        struct bus_reset *bus_reset;
+        struct bus_reset_event *e;
 
-        bus_reset = kzalloc(sizeof(*bus_reset), GFP_ATOMIC);
-        if (bus_reset == NULL) {
+        e = kzalloc(sizeof(*e), GFP_KERNEL);
+        if (e == NULL) {
                 fw_notify("Out of memory when allocating bus reset event\n");
                 return;
         }
 
-        fill_bus_reset_event(&bus_reset->reset, client);
+        fill_bus_reset_event(&e->reset, client);
+
+        queue_event(client, &e->event,
+                    &e->reset, sizeof(e->reset), NULL, 0);
 
-        queue_event(client, &bus_reset->event,
-                    &bus_reset->reset, sizeof(bus_reset->reset), NULL, 0);
+        spin_lock_irq(&client->lock);
+        idr_for_each(&client->resource_idr, schedule_reallocations, client);
+        spin_unlock_irq(&client->lock);
 }
 
 void fw_device_cdev_update(struct fw_device *device)
@@ -274,11 +360,11 @@ static int ioctl_get_info(struct client *client, void *buffer)
 {
         struct fw_cdev_get_info *get_info = buffer;
         struct fw_cdev_event_bus_reset bus_reset;
-        struct fw_card *card = client->device->card;
         unsigned long ret = 0;
 
         client->version = get_info->version;
         get_info->version = FW_CDEV_VERSION;
+        get_info->card = client->device->card->index;
 
         down_read(&fw_device_rwsem);
 
@@ -300,49 +386,61 @@ static int ioctl_get_info(struct client *client, void *buffer)
         client->bus_reset_closure = get_info->bus_reset_closure;
         if (get_info->bus_reset != 0) {
                 void __user *uptr = u64_to_uptr(get_info->bus_reset);
-                unsigned long flags;
 
-                spin_lock_irqsave(&card->lock, flags);
                 fill_bus_reset_event(&bus_reset, client);
-                spin_unlock_irqrestore(&card->lock, flags);
-
                 if (copy_to_user(uptr, &bus_reset, sizeof(bus_reset)))
                         return -EFAULT;
         }
 
-        get_info->card = card->index;
-
         return 0;
 }
 
-static void
-add_client_resource(struct client *client, struct client_resource *resource)
+static int add_client_resource(struct client *client,
+                               struct client_resource *resource, gfp_t gfp_mask)
 {
         unsigned long flags;
+        int ret;
+
+ retry:
+        if (idr_pre_get(&client->resource_idr, gfp_mask) == 0)
+                return -ENOMEM;
 
         spin_lock_irqsave(&client->lock, flags);
-        list_add_tail(&resource->link, &client->resource_list);
-        resource->handle = client->resource_handle++;
+        if (client->in_shutdown)
+                ret = -ECANCELED;
+        else
+                ret = idr_get_new(&client->resource_idr, resource,
+                                  &resource->handle);
+        if (ret >= 0) {
+                client_get(client);
+                if (resource->release == release_iso_resource)
+                        schedule_iso_resource(container_of(resource,
+                                                struct iso_resource, resource));
+        }
         spin_unlock_irqrestore(&client->lock, flags);
+
+        if (ret == -EAGAIN)
+                goto retry;
+
+        return ret < 0 ? ret : 0;
 }
 
-static int
-release_client_resource(struct client *client, u32 handle,
-                        struct client_resource **resource)
+static int release_client_resource(struct client *client, u32 handle,
+                                   client_resource_release_fn_t release,
+                                   struct client_resource **resource)
 {
         struct client_resource *r;
-        unsigned long flags;
 
-        spin_lock_irqsave(&client->lock, flags);
-        list_for_each_entry(r, &client->resource_list, link) {
-                if (r->handle == handle) {
-                        list_del(&r->link);
-                        break;
-                }
-        }
-        spin_unlock_irqrestore(&client->lock, flags);
+        spin_lock_irq(&client->lock);
+        if (client->in_shutdown)
+                r = NULL;
+        else
+                r = idr_find(&client->resource_idr, handle);
+        if (r && r->release == release)
+                idr_remove(&client->resource_idr, handle);
+        spin_unlock_irq(&client->lock);
 
-        if (&r->link == &client->resource_list)
+        if (!(r && r->release == release))
                 return -EINVAL;
 
         if (resource)
@@ -350,203 +448,239 @@ release_client_resource(struct client *client, u32 handle,
         else
                 r->release(client, r);
 
+        client_put(client);
+
         return 0;
 }
 
-static void
-release_transaction(struct client *client, struct client_resource *resource)
+static void release_transaction(struct client *client,
+                                struct client_resource *resource)
 {
-        struct response *response =
-                container_of(resource, struct response, resource);
+        struct outbound_transaction_resource *r = container_of(resource,
+                        struct outbound_transaction_resource, resource);
 
-        fw_cancel_transaction(client->device->card, &response->transaction);
+        fw_cancel_transaction(client->device->card, &r->transaction);
 }
 
-static void
-complete_transaction(struct fw_card *card, int rcode,
-                     void *payload, size_t length, void *data)
+static void complete_transaction(struct fw_card *card, int rcode,
+                                 void *payload, size_t length, void *data)
 {
-        struct response *response = data;
-        struct client *client = response->client;
+        struct outbound_transaction_event *e = data;
+        struct fw_cdev_event_response *rsp = &e->response;
+        struct client *client = e->client;
         unsigned long flags;
-        struct fw_cdev_event_response *r = &response->response;
 
-        if (length < r->length)
-                r->length = length;
+        if (length < rsp->length)
+                rsp->length = length;
         if (rcode == RCODE_COMPLETE)
-                memcpy(r->data, payload, r->length);
+                memcpy(rsp->data, payload, rsp->length);
 
         spin_lock_irqsave(&client->lock, flags);
-        list_del(&response->resource.link);
+        /*
+         * 1. If called while in shutdown, the idr tree must be left untouched.
+         *    The idr handle will be removed and the client reference will be
+         *    dropped later.
+         * 2. If the call chain was release_client_resource ->
+         *    release_transaction -> complete_transaction (instead of a normal
+         *    conclusion of the transaction), i.e. if this resource was already
+         *    unregistered from the idr, the client reference will be dropped
+         *    by release_client_resource and we must not drop it here.
+         */
+        if (!client->in_shutdown &&
+            idr_find(&client->resource_idr, e->r.resource.handle)) {
+                idr_remove(&client->resource_idr, e->r.resource.handle);
+                /* Drop the idr's reference */
+                client_put(client);
+        }
         spin_unlock_irqrestore(&client->lock, flags);
 
-        r->type   = FW_CDEV_EVENT_RESPONSE;
-        r->rcode  = rcode;
+        rsp->type = FW_CDEV_EVENT_RESPONSE;
+        rsp->rcode = rcode;
 
         /*
-         * In the case that sizeof(*r) doesn't align with the position of the
+         * In the case that sizeof(*rsp) doesn't align with the position of the
          * data, and the read is short, preserve an extra copy of the data
          * to stay compatible with a pre-2.6.27 bug.  Since the bug is harmless
          * for short reads and some apps depended on it, this is both safe
          * and prudent for compatibility.
          */
-        if (r->length <= sizeof(*r) - offsetof(typeof(*r), data))
-                queue_event(client, &response->event, r, sizeof(*r),
-                            r->data, r->length);
+        if (rsp->length <= sizeof(*rsp) - offsetof(typeof(*rsp), data))
+                queue_event(client, &e->event, rsp, sizeof(*rsp),
+                            rsp->data, rsp->length);
         else
-                queue_event(client, &response->event, r, sizeof(*r) + r->length,
+                queue_event(client, &e->event, rsp, sizeof(*rsp) + rsp->length,
                             NULL, 0);
+
+        /* Drop the transaction callback's reference */
+        client_put(client);
 }
 
-static int ioctl_send_request(struct client *client, void *buffer)
+static int init_request(struct client *client,
+                        struct fw_cdev_send_request *request,
+                        int destination_id, int speed)
 {
-        struct fw_device *device = client->device;
-        struct fw_cdev_send_request *request = buffer;
-        struct response *response;
+        struct outbound_transaction_event *e;
+        int ret;
 
-        /* What is the biggest size we'll accept, really? */
-        if (request->length > 4096)
-                return -EINVAL;
+        if (request->tcode != TCODE_STREAM_DATA &&
+            (request->length > 4096 || request->length > 512 << speed))
+                return -EIO;
 
-        response = kmalloc(sizeof(*response) + request->length, GFP_KERNEL);
-        if (response == NULL)
+        e = kmalloc(sizeof(*e) + request->length, GFP_KERNEL);
+        if (e == NULL)
                 return -ENOMEM;
 
-        response->client = client;
-        response->response.length = request->length;
-        response->response.closure = request->closure;
+        e->client = client;
+        e->response.length = request->length;
+        e->response.closure = request->closure;
 
         if (request->data &&
-            copy_from_user(response->response.data,
+            copy_from_user(e->response.data,
                            u64_to_uptr(request->data), request->length)) {
-                kfree(response);
-                return -EFAULT;
+                ret = -EFAULT;
+                goto failed;
         }
 
-        response->resource.release = release_transaction;
-        add_client_resource(client, &response->resource);
+        e->r.resource.release = release_transaction;
+        ret = add_client_resource(client, &e->r.resource, GFP_KERNEL);
+        if (ret < 0)
+                goto failed;
 
-        fw_send_request(device->card, &response->transaction,
-                        request->tcode & 0x1f,
-                        device->node->node_id,
-                        request->generation,
-                        device->max_speed,
-                        request->offset,
-                        response->response.data, request->length,
-                        complete_transaction, response);
+        /* Get a reference for the transaction callback */
+        client_get(client);
 
-        if (request->data)
-                return sizeof(request) + request->length;
-        else
-                return sizeof(request);
+        fw_send_request(client->device->card, &e->r.transaction,
+                        request->tcode, destination_id, request->generation,
+                        speed, request->offset, e->response.data,
+                        request->length, complete_transaction, e);
+        return 0;
+
+ failed:
+        kfree(e);
+
+        return ret;
 }
 
-struct address_handler {
-        struct fw_address_handler handler;
-        __u64 closure;
-        struct client *client;
-        struct client_resource resource;
-};
+static int ioctl_send_request(struct client *client, void *buffer)
+{
+        struct fw_cdev_send_request *request = buffer;
 
-struct request {
-        struct fw_request *request;
-        void *data;
-        size_t length;
-        struct client_resource resource;
-};
+        switch (request->tcode) {
+        case TCODE_WRITE_QUADLET_REQUEST:
+        case TCODE_WRITE_BLOCK_REQUEST:
+        case TCODE_READ_QUADLET_REQUEST:
+        case TCODE_READ_BLOCK_REQUEST:
+        case TCODE_LOCK_MASK_SWAP:
+        case TCODE_LOCK_COMPARE_SWAP:
+        case TCODE_LOCK_FETCH_ADD:
+        case TCODE_LOCK_LITTLE_ADD:
+        case TCODE_LOCK_BOUNDED_ADD:
+        case TCODE_LOCK_WRAP_ADD:
+        case TCODE_LOCK_VENDOR_DEPENDENT:
+                break;
+        default:
+                return -EINVAL;
+        }
 
-struct request_event {
-        struct event event;
-        struct fw_cdev_event_request request;
-};
+        return init_request(client, request, client->device->node_id,
+                            client->device->max_speed);
+}
 
-static void
-release_request(struct client *client, struct client_resource *resource)
+static void release_request(struct client *client,
+                            struct client_resource *resource)
 {
-        struct request *request =
-                container_of(resource, struct request, resource);
+        struct inbound_transaction_resource *r = container_of(resource,
+                        struct inbound_transaction_resource, resource);
 
-        fw_send_response(client->device->card, request->request,
+        fw_send_response(client->device->card, r->request,
                          RCODE_CONFLICT_ERROR);
-        kfree(request);
+        kfree(r);
 }
 
-static void
-handle_request(struct fw_card *card, struct fw_request *r,
-               int tcode, int destination, int source,
-               int generation, int speed,
-               unsigned long long offset,
-               void *payload, size_t length, void *callback_data)
+static void handle_request(struct fw_card *card, struct fw_request *request,
+                           int tcode, int destination, int source,
+                           int generation, int speed,
+                           unsigned long long offset,
+                           void *payload, size_t length, void *callback_data)
 {
-        struct address_handler *handler = callback_data;
-        struct request *request;
-        struct request_event *e;
-        struct client *client = handler->client;
+        struct address_handler_resource *handler = callback_data;
+        struct inbound_transaction_resource *r;
+        struct inbound_transaction_event *e;
+        int ret;
 
-        request = kmalloc(sizeof(*request), GFP_ATOMIC);
+        r = kmalloc(sizeof(*r), GFP_ATOMIC);
         e = kmalloc(sizeof(*e), GFP_ATOMIC);
-        if (request == NULL || e == NULL) {
-                kfree(request);
-                kfree(e);
-                fw_send_response(card, r, RCODE_CONFLICT_ERROR);
-                return;
-        }
+        if (r == NULL || e == NULL)
+                goto failed;
 
-        request->request = r;
-        request->data    = payload;
-        request->length  = length;
+        r->request = request;
+        r->data    = payload;
+        r->length  = length;
 
-        request->resource.release = release_request;
-        add_client_resource(client, &request->resource);
+        r->resource.release = release_request;
+        ret = add_client_resource(handler->client, &r->resource, GFP_ATOMIC);
+        if (ret < 0)
+                goto failed;
 
         e->request.type    = FW_CDEV_EVENT_REQUEST;
         e->request.tcode   = tcode;
         e->request.offset  = offset;
         e->request.length  = length;
-        e->request.handle  = request->resource.handle;
+        e->request.handle  = r->resource.handle;
         e->request.closure = handler->closure;
 
-        queue_event(client, &e->event,
+        queue_event(handler->client, &e->event,
                     &e->request, sizeof(e->request), payload, length);
+        return;
+
+ failed:
+        kfree(r);
+        kfree(e);
+        fw_send_response(card, request, RCODE_CONFLICT_ERROR);
 }
 
-static void
-release_address_handler(struct client *client,
-                        struct client_resource *resource)
+static void release_address_handler(struct client *client,
+                                    struct client_resource *resource)
 {
-        struct address_handler *handler =
-                container_of(resource, struct address_handler, resource);
+        struct address_handler_resource *r =
+            container_of(resource, struct address_handler_resource, resource);
 
-        fw_core_remove_address_handler(&handler->handler);
-        kfree(handler);
+        fw_core_remove_address_handler(&r->handler);
+        kfree(r);
 }
 
 static int ioctl_allocate(struct client *client, void *buffer)
 {
         struct fw_cdev_allocate *request = buffer;
-        struct address_handler *handler;
+        struct address_handler_resource *r;
         struct fw_address_region region;
+        int ret;
 
-        handler = kmalloc(sizeof(*handler), GFP_KERNEL);
-        if (handler == NULL)
+        r = kmalloc(sizeof(*r), GFP_KERNEL);
+        if (r == NULL)
                 return -ENOMEM;
 
         region.start = request->offset;
         region.end = request->offset + request->length;
-        handler->handler.length = request->length;
-        handler->handler.address_callback = handle_request;
-        handler->handler.callback_data = handler;
-        handler->closure = request->closure;
-        handler->client = client;
-
-        if (fw_core_add_address_handler(&handler->handler, &region) < 0) {
-                kfree(handler);
-                return -EBUSY;
+        r->handler.length = request->length;
+        r->handler.address_callback = handle_request;
+        r->handler.callback_data = r;
+        r->closure = request->closure;
+        r->client = client;
+
+        ret = fw_core_add_address_handler(&r->handler, &region);
+        if (ret < 0) {
+                kfree(r);
+                return ret;
         }
 
-        handler->resource.release = release_address_handler;
-        add_client_resource(client, &handler->resource);
-        request->handle = handler->resource.handle;
+        r->resource.release = release_address_handler;
+        ret = add_client_resource(client, &r->resource, GFP_KERNEL);
+        if (ret < 0) {
+                release_address_handler(client, &r->resource);
+                return ret;
+        }
+        request->handle = r->resource.handle;
 
         return 0;
 }
@@ -555,18 +689,22 @@ static int ioctl_deallocate(struct client *client, void *buffer)
 {
         struct fw_cdev_deallocate *request = buffer;
 
-        return release_client_resource(client, request->handle, NULL);
+        return release_client_resource(client, request->handle,
+                                       release_address_handler, NULL);
 }
 
 static int ioctl_send_response(struct client *client, void *buffer)
 {
         struct fw_cdev_send_response *request = buffer;
         struct client_resource *resource;
-        struct request *r;
+        struct inbound_transaction_resource *r;
 
-        if (release_client_resource(client, request->handle, &resource) < 0)
+        if (release_client_resource(client, request->handle,
+                                    release_request, &resource) < 0)
                 return -EINVAL;
-        r = container_of(resource, struct request, resource);
+
+        r = container_of(resource, struct inbound_transaction_resource,
+                         resource);
         if (request->length < r->length)
                 r->length = request->length;
         if (copy_from_user(r->data, u64_to_uptr(request->data), r->length))
@@ -588,85 +726,92 @@ static int ioctl_initiate_bus_reset(struct client *client, void *buffer)
         return fw_core_initiate_bus_reset(client->device->card, short_reset);
 }
 
-struct descriptor {
-        struct fw_descriptor d;
-        struct client_resource resource;
-        u32 data[0];
-};
-
 static void release_descriptor(struct client *client,
                                struct client_resource *resource)
 {
-        struct descriptor *descriptor =
-                container_of(resource, struct descriptor, resource);
+        struct descriptor_resource *r =
+                container_of(resource, struct descriptor_resource, resource);
 
-        fw_core_remove_descriptor(&descriptor->d);
-        kfree(descriptor);
+        fw_core_remove_descriptor(&r->descriptor);
+        kfree(r);
 }
 
 static int ioctl_add_descriptor(struct client *client, void *buffer)
 {
         struct fw_cdev_add_descriptor *request = buffer;
-        struct descriptor *descriptor;
-        int retval;
+        struct fw_card *card = client->device->card;
+        struct descriptor_resource *r;
+        int ret;
+
+        /* Access policy: Allow this ioctl only on local nodes' device files. */
+        spin_lock_irq(&card->lock);
+        ret = client->device->node_id != card->local_node->node_id;
+        spin_unlock_irq(&card->lock);
+        if (ret)
+                return -ENOSYS;
 
         if (request->length > 256)
                 return -EINVAL;
 
-        descriptor =
-                kmalloc(sizeof(*descriptor) + request->length * 4, GFP_KERNEL);
-        if (descriptor == NULL)
+        r = kmalloc(sizeof(*r) + request->length * 4, GFP_KERNEL);
+        if (r == NULL)
                 return -ENOMEM;
 
-        if (copy_from_user(descriptor->data,
+        if (copy_from_user(r->data,
                            u64_to_uptr(request->data), request->length * 4)) {
-                kfree(descriptor);
-                return -EFAULT;
+                ret = -EFAULT;
+                goto failed;
         }
 
-        descriptor->d.length = request->length;
-        descriptor->d.immediate = request->immediate;
-        descriptor->d.key = request->key;
-        descriptor->d.data = descriptor->data;
+        r->descriptor.length    = request->length;
+        r->descriptor.immediate = request->immediate;
+        r->descriptor.key       = request->key;
+        r->descriptor.data      = r->data;
 
-        retval = fw_core_add_descriptor(&descriptor->d);
-        if (retval < 0) {
-                kfree(descriptor);
-                return retval;
-        }
+        ret = fw_core_add_descriptor(&r->descriptor);
+        if (ret < 0)
+                goto failed;
 
-        descriptor->resource.release = release_descriptor;
-        add_client_resource(client, &descriptor->resource);
-        request->handle = descriptor->resource.handle;
+        r->resource.release = release_descriptor;
+        ret = add_client_resource(client, &r->resource, GFP_KERNEL);
+        if (ret < 0) {
+                fw_core_remove_descriptor(&r->descriptor);
+                goto failed;
+        }
+        request->handle = r->resource.handle;
 
         return 0;
+ failed:
+        kfree(r);
+
+        return ret;
 }
 
 static int ioctl_remove_descriptor(struct client *client, void *buffer)
 {
         struct fw_cdev_remove_descriptor *request = buffer;
 
-        return release_client_resource(client, request->handle, NULL);
+        return release_client_resource(client, request->handle,
+                                       release_descriptor, NULL);
 }
 
-static void
-iso_callback(struct fw_iso_context *context, u32 cycle,
-             size_t header_length, void *header, void *data)
+static void iso_callback(struct fw_iso_context *context, u32 cycle,
+                         size_t header_length, void *header, void *data)
 {
         struct client *client = data;
-        struct iso_interrupt *irq;
+        struct iso_interrupt_event *e;
 
-        irq = kzalloc(sizeof(*irq) + header_length, GFP_ATOMIC);
-        if (irq == NULL)
+        e = kzalloc(sizeof(*e) + header_length, GFP_ATOMIC);
+        if (e == NULL)
                 return;
 
-        irq->interrupt.type      = FW_CDEV_EVENT_ISO_INTERRUPT;
-        irq->interrupt.closure   = client->iso_closure;
-        irq->interrupt.cycle     = cycle;
-        irq->interrupt.header_length = header_length;
-        memcpy(irq->interrupt.header, header, header_length);
-        queue_event(client, &irq->event, &irq->interrupt,
-                    sizeof(irq->interrupt) + header_length, NULL, 0);
+        e->interrupt.type      = FW_CDEV_EVENT_ISO_INTERRUPT;
+        e->interrupt.closure   = client->iso_closure;
+        e->interrupt.cycle     = cycle;
+        e->interrupt.header_length = header_length;
+        memcpy(e->interrupt.header, header, header_length);
+        queue_event(client, &e->event, &e->interrupt,
+                    sizeof(e->interrupt) + header_length, NULL, 0);
 }
 
 static int ioctl_create_iso_context(struct client *client, void *buffer)
@@ -871,6 +1016,261 @@ static int ioctl_get_cycle_timer(struct client *client, void *buffer)
         return 0;
 }
 
+static void iso_resource_work(struct work_struct *work)
+{
+        struct iso_resource_event *e;
+        struct iso_resource *r =
+                        container_of(work, struct iso_resource, work.work);
+        struct client *client = r->client;
+        int generation, channel, bandwidth, todo;
+        bool skip, free, success;
+
+        spin_lock_irq(&client->lock);
+        generation = client->device->generation;
+        todo = r->todo;
+        /* Allow 1000ms grace period for other reallocations. */
+        if (todo == ISO_RES_ALLOC &&
+            time_is_after_jiffies(client->device->card->reset_jiffies + HZ)) {
+                if (schedule_delayed_work(&r->work, DIV_ROUND_UP(HZ, 3)))
+                        client_get(client);
+                skip = true;
+        } else {
+                /* We could be called twice within the same generation. */
+                skip = todo == ISO_RES_REALLOC &&
+                       r->generation == generation;
+        }
+        free = todo == ISO_RES_DEALLOC ||
+               todo == ISO_RES_ALLOC_ONCE ||
+               todo == ISO_RES_DEALLOC_ONCE;
+        r->generation = generation;
+        spin_unlock_irq(&client->lock);
+
+        if (skip)
+                goto out;
+
+        bandwidth = r->bandwidth;
+
+        fw_iso_resource_manage(client->device->card, generation,
+                        r->channels, &channel, &bandwidth,
+                        todo == ISO_RES_ALLOC ||
+                        todo == ISO_RES_REALLOC ||
+                        todo == ISO_RES_ALLOC_ONCE);
+        /*
+         * Is this generation outdated already?  As long as this resource sticks
+         * in the idr, it will be scheduled again for a newer generation or at
+         * shutdown.
+         */
+        if (channel == -EAGAIN &&
+            (todo == ISO_RES_ALLOC || todo == ISO_RES_REALLOC))
+                goto out;
+
+        success = channel >= 0 || bandwidth > 0;
+
+        spin_lock_irq(&client->lock);
+        /*
+         * Transit from allocation to reallocation, except if the client
+         * requested deallocation in the meantime.
+         */
+        if (r->todo == ISO_RES_ALLOC)
+                r->todo = ISO_RES_REALLOC;
+        /*
+         * Allocation or reallocation failure?  Pull this resource out of the
+         * idr and prepare for deletion, unless the client is shutting down.
+         */
+        if (r->todo == ISO_RES_REALLOC && !success &&
+            !client->in_shutdown &&
+            idr_find(&client->resource_idr, r->resource.handle)) {
+                idr_remove(&client->resource_idr, r->resource.handle);
+                client_put(client);
+                free = true;
+        }
+        spin_unlock_irq(&client->lock);
+
+        if (todo == ISO_RES_ALLOC && channel >= 0)
+                r->channels = 1ULL << channel;
+
+        if (todo == ISO_RES_REALLOC && success)
+                goto out;
+
+        if (todo == ISO_RES_ALLOC || todo == ISO_RES_ALLOC_ONCE) {
+                e = r->e_alloc;
+                r->e_alloc = NULL;
+        } else {
+                e = r->e_dealloc;
+                r->e_dealloc = NULL;
+        }
+        e->resource.handle      = r->resource.handle;
+        e->resource.channel     = channel;
+        e->resource.bandwidth   = bandwidth;
+
+        queue_event(client, &e->event,
+                    &e->resource, sizeof(e->resource), NULL, 0);
+
+        if (free) {
+                cancel_delayed_work(&r->work);
+                kfree(r->e_alloc);
+                kfree(r->e_dealloc);
+                kfree(r);
+        }
+ out:
+        client_put(client);
+}
+
+static void schedule_iso_resource(struct iso_resource *r)
+{
+        client_get(r->client);
+        if (!schedule_delayed_work(&r->work, 0))
+                client_put(r->client);
+}
+
+static void release_iso_resource(struct client *client,
+                                 struct client_resource *resource)
+{
+        struct iso_resource *r =
+                container_of(resource, struct iso_resource, resource);
+
+        spin_lock_irq(&client->lock);
+        r->todo = ISO_RES_DEALLOC;
+        schedule_iso_resource(r);
+        spin_unlock_irq(&client->lock);
+}
+
+static int init_iso_resource(struct client *client,
+                struct fw_cdev_allocate_iso_resource *request, int todo)
+{
+        struct iso_resource_event *e1, *e2;
+        struct iso_resource *r;
+        int ret;
+
+        if ((request->channels == 0 && request->bandwidth == 0) ||
+            request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
+            request->bandwidth < 0)
+                return -EINVAL;
+
+        r  = kmalloc(sizeof(*r), GFP_KERNEL);
+        e1 = kmalloc(sizeof(*e1), GFP_KERNEL);
+        e2 = kmalloc(sizeof(*e2), GFP_KERNEL);
+        if (r == NULL || e1 == NULL || e2 == NULL) {
+                ret = -ENOMEM;
+                goto fail;
+        }
+
+        INIT_DELAYED_WORK(&r->work, iso_resource_work);
+        r->client       = client;
+        r->todo         = todo;
+        r->generation   = -1;
+        r->channels     = request->channels;
+        r->bandwidth    = request->bandwidth;
+        r->e_alloc      = e1;
+        r->e_dealloc    = e2;
+
+        e1->resource.closure    = request->closure;
+        e1->resource.type       = FW_CDEV_EVENT_ISO_RESOURCE_ALLOCATED;
+        e2->resource.closure    = request->closure;
+        e2->resource.type       = FW_CDEV_EVENT_ISO_RESOURCE_DEALLOCATED;
+
+        if (todo == ISO_RES_ALLOC) {
+                r->resource.release = release_iso_resource;
+                ret = add_client_resource(client, &r->resource, GFP_KERNEL);
+                if (ret < 0)
+                        goto fail;
+        } else {
+                r->resource.release = NULL;
+                r->resource.handle = -1;
+                schedule_iso_resource(r);
+        }
+        request->handle = r->resource.handle;
+
+        return 0;
+ fail:
+        kfree(r);
+        kfree(e1);
+        kfree(e2);
+
+        return ret;
+}
+
+static int ioctl_allocate_iso_resource(struct client *client, void *buffer)
+{
+        struct fw_cdev_allocate_iso_resource *request = buffer;
+
+        return init_iso_resource(client, request, ISO_RES_ALLOC);
+}
+
+static int ioctl_deallocate_iso_resource(struct client *client, void *buffer)
+{
+        struct fw_cdev_deallocate *request = buffer;
+
+        return release_client_resource(client, request->handle,
+                                       release_iso_resource, NULL);
+}
+
+static int ioctl_allocate_iso_resource_once(struct client *client, void *buffer)
+{
+        struct fw_cdev_allocate_iso_resource *request = buffer;
+
+        return init_iso_resource(client, request, ISO_RES_ALLOC_ONCE);
+}
+
+static int ioctl_deallocate_iso_resource_once(struct client *client, void *buffer)
+{
+        struct fw_cdev_allocate_iso_resource *request = buffer;
+
+        return init_iso_resource(client, request, ISO_RES_DEALLOC_ONCE);
+}
+
+/*
+ * Returns a speed code:  Maximum speed to or from this device,
+ * limited by the device's link speed, the local node's link speed,
+ * and all PHY port speeds between the two links.
+ */
+static int ioctl_get_speed(struct client *client, void *buffer)
+{
+        return client->device->max_speed;
+}
+
+static int ioctl_send_broadcast_request(struct client *client, void *buffer)
+{
+        struct fw_cdev_send_request *request = buffer;
+
+        switch (request->tcode) {
+        case TCODE_WRITE_QUADLET_REQUEST:
+        case TCODE_WRITE_BLOCK_REQUEST:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        /* Security policy: Only allow accesses to Units Space. */
+        if (request->offset < CSR_REGISTER_BASE + CSR_CONFIG_ROM_END)
+                return -EACCES;
+
+        return init_request(client, request, LOCAL_BUS | 0x3f, SCODE_100);
+}
+
+static int ioctl_send_stream_packet(struct client *client, void *buffer)
+{
+        struct fw_cdev_send_stream_packet *p = buffer;
+        struct fw_cdev_send_request request;
+        int dest;
+
+        if (p->speed > client->device->card->link_speed ||
+            p->length > 1024 << p->speed)
+                return -EIO;
+
+        if (p->tag > 3 || p->channel > 63 || p->sy > 15)
+                return -EINVAL;
+
+        dest = fw_stream_packet_destination_id(p->tag, p->channel, p->sy);
+        request.tcode           = TCODE_STREAM_DATA;
+        request.length          = p->length;
+        request.closure         = p->closure;
+        request.data            = p->data;
+        request.generation      = p->generation;
+
+        return init_request(client, &request, dest, p->speed);
+}
+
 static int (* const ioctl_handlers[])(struct client *client, void *buffer) = {
         ioctl_get_info,
         ioctl_send_request,
@@ -885,13 +1285,20 @@ static int (* const ioctl_handlers[])(struct client *client, void *buffer) = {
         ioctl_start_iso,
         ioctl_stop_iso,
         ioctl_get_cycle_timer,
+        ioctl_allocate_iso_resource,
+        ioctl_deallocate_iso_resource,
+        ioctl_allocate_iso_resource_once,
+        ioctl_deallocate_iso_resource_once,
+        ioctl_get_speed,
+        ioctl_send_broadcast_request,
+        ioctl_send_stream_packet,
 };
 
-static int
-dispatch_ioctl(struct client *client, unsigned int cmd, void __user *arg)
+static int dispatch_ioctl(struct client *client,
+                          unsigned int cmd, void __user *arg)
 {
         char buffer[256];
-        int retval;
+        int ret;
 
         if (_IOC_TYPE(cmd) != '#' ||
             _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers))
@@ -903,9 +1310,9 @@ dispatch_ioctl(struct client *client, unsigned int cmd, void __user *arg)
                         return -EFAULT;
         }
 
-        retval = ioctl_handlers[_IOC_NR(cmd)](client, buffer);
-        if (retval < 0)
-                return retval;
+        ret = ioctl_handlers[_IOC_NR(cmd)](client, buffer);
+        if (ret < 0)
+                return ret;
 
         if (_IOC_DIR(cmd) & _IOC_READ) {
                 if (_IOC_SIZE(cmd) > sizeof(buffer) ||
@@ -913,12 +1320,11 @@ dispatch_ioctl(struct client *client, unsigned int cmd, void __user *arg)
                         return -EFAULT;
         }
 
-        return retval;
+        return ret;
 }
 
-static long
-fw_device_op_ioctl(struct file *file,
-                   unsigned int cmd, unsigned long arg)
+static long fw_device_op_ioctl(struct file *file,
+                               unsigned int cmd, unsigned long arg)
 {
         struct client *client = file->private_data;
 
@@ -929,9 +1335,8 @@ fw_device_op_ioctl(struct file *file,
 }
 
 #ifdef CONFIG_COMPAT
-static long
-fw_device_op_compat_ioctl(struct file *file,
-                          unsigned int cmd, unsigned long arg)
+static long fw_device_op_compat_ioctl(struct file *file,
+                                      unsigned int cmd, unsigned long arg)
 {
         struct client *client = file->private_data;
 
@@ -947,7 +1352,7 @@ static int fw_device_op_mmap(struct file *file, struct vm_area_struct *vma)
         struct client *client = file->private_data;
         enum dma_data_direction direction;
         unsigned long size;
-        int page_count, retval;
+        int page_count, ret;
 
         if (fw_device_is_shutdown(client->device))
                 return -ENODEV;
@@ -973,48 +1378,57 @@ static int fw_device_op_mmap(struct file *file, struct vm_area_struct *vma)
         else
                 direction = DMA_FROM_DEVICE;
 
-        retval = fw_iso_buffer_init(&client->buffer, client->device->card,
-                                    page_count, direction);
-        if (retval < 0)
-                return retval;
+        ret = fw_iso_buffer_init(&client->buffer, client->device->card,
+                                 page_count, direction);
+        if (ret < 0)
+                return ret;
 
-        retval = fw_iso_buffer_map(&client->buffer, vma);
-        if (retval < 0)
+        ret = fw_iso_buffer_map(&client->buffer, vma);
+        if (ret < 0)
                 fw_iso_buffer_destroy(&client->buffer, client->device->card);
 
-        return retval;
+        return ret;
+}
+
+static int shutdown_resource(int id, void *p, void *data)
+{
+        struct client_resource *r = p;
+        struct client *client = data;
+
+        r->release(client, r);
+        client_put(client);
+
+        return 0;
 }
 
 static int fw_device_op_release(struct inode *inode, struct file *file)
 {
         struct client *client = file->private_data;
         struct event *e, *next_e;
-        struct client_resource *r, *next_r;
-        unsigned long flags;
 
-        if (client->buffer.pages)
-                fw_iso_buffer_destroy(&client->buffer, client->device->card);
+        mutex_lock(&client->device->client_list_mutex);
+        list_del(&client->link);
+        mutex_unlock(&client->device->client_list_mutex);
 
         if (client->iso_context)
                 fw_iso_context_destroy(client->iso_context);
 
-        list_for_each_entry_safe(r, next_r, &client->resource_list, link)
-                r->release(client, r);
+        if (client->buffer.pages)
+                fw_iso_buffer_destroy(&client->buffer, client->device->card);
 
-        /*
-         * FIXME: We should wait for the async tasklets to stop
-         * running before freeing the memory.
-         */
+        /* Freeze client->resource_idr and client->event_list */
+        spin_lock_irq(&client->lock);
+        client->in_shutdown = true;
+        spin_unlock_irq(&client->lock);
+
+        idr_for_each(&client->resource_idr, shutdown_resource, client);
+        idr_remove_all(&client->resource_idr);
+        idr_destroy(&client->resource_idr);
 
         list_for_each_entry_safe(e, next_e, &client->event_list, link)
                 kfree(e);
 
-        spin_lock_irqsave(&client->device->card->lock, flags);
-        list_del(&client->link);
-        spin_unlock_irqrestore(&client->device->card->lock, flags);
-
-        fw_device_put(client->device);
-        kfree(client);
+        client_put(client);
 
         return 0;
 }
diff --git a/drivers/firewire/fw-device.c b/drivers/firewire/fw-device.c
index bf53acb45652..a47e2129d83d 100644
--- a/drivers/firewire/fw-device.c
+++ b/drivers/firewire/fw-device.c
@@ -18,22 +18,26 @@
  * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  */
 
-#include <linux/module.h>
-#include <linux/wait.h>
-#include <linux/errno.h>
-#include <linux/kthread.h>
-#include <linux/device.h>
+#include <linux/ctype.h>
 #include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/errno.h>
 #include <linux/idr.h>
 #include <linux/jiffies.h>
-#include <linux/string.h>
+#include <linux/kobject.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
 #include <linux/rwsem.h>
 #include <linux/semaphore.h>
+#include <linux/spinlock.h>
+#include <linux/string.h>
+#include <linux/workqueue.h>
+
 #include <asm/system.h>
-#include <linux/ctype.h>
-#include "fw-transaction.h"
-#include "fw-topology.h"
+
 #include "fw-device.h"
+#include "fw-topology.h"
+#include "fw-transaction.h"
 
 void fw_csr_iterator_init(struct fw_csr_iterator *ci, u32 * p)
 {
@@ -132,8 +136,7 @@ static int get_modalias(struct fw_unit *unit, char *buffer, size_t buffer_size)
                         vendor, model, specifier_id, version);
 }
 
-static int
-fw_unit_uevent(struct device *dev, struct kobj_uevent_env *env)
+static int fw_unit_uevent(struct device *dev, struct kobj_uevent_env *env)
 {
         struct fw_unit *unit = fw_unit(dev);
         char modalias[64];
@@ -152,27 +155,6 @@ struct bus_type fw_bus_type = {
 };
 EXPORT_SYMBOL(fw_bus_type);
 
-static void fw_device_release(struct device *dev)
-{
-        struct fw_device *device = fw_device(dev);
-        struct fw_card *card = device->card;
-        unsigned long flags;
-
-        /*
-         * Take the card lock so we don't set this to NULL while a
-         * FW_NODE_UPDATED callback is being handled or while the
-         * bus manager work looks at this node.
-         */
-        spin_lock_irqsave(&card->lock, flags);
-        device->node->data = NULL;
-        spin_unlock_irqrestore(&card->lock, flags);
-
-        fw_node_put(device->node);
-        kfree(device->config_rom);
-        kfree(device);
-        fw_card_put(card);
-}
-
 int fw_device_enable_phys_dma(struct fw_device *device)
 {
         int generation = device->generation;
@@ -191,8 +173,8 @@ struct config_rom_attribute {
         u32 key;
 };
 
-static ssize_t
-show_immediate(struct device *dev, struct device_attribute *dattr, char *buf)
+static ssize_t show_immediate(struct device *dev,
+                              struct device_attribute *dattr, char *buf)
 {
         struct config_rom_attribute *attr =
                 container_of(dattr, struct config_rom_attribute, attr);
@@ -223,8 +205,8 @@ show_immediate(struct device *dev, struct device_attribute *dattr, char *buf)
 #define IMMEDIATE_ATTR(name, key)                               \
         { __ATTR(name, S_IRUGO, show_immediate, NULL), key }
 
-static ssize_t
-show_text_leaf(struct device *dev, struct device_attribute *dattr, char *buf)
+static ssize_t show_text_leaf(struct device *dev,
+                              struct device_attribute *dattr, char *buf)
 {
         struct config_rom_attribute *attr =
                 container_of(dattr, struct config_rom_attribute, attr);
@@ -293,10 +275,9 @@ static struct config_rom_attribute config_rom_attributes[] = {
         TEXT_LEAF_ATTR(hardware_version_name, CSR_HARDWARE_VERSION),
 };
 
-static void
-init_fw_attribute_group(struct device *dev,
-                        struct device_attribute *attrs,
-                        struct fw_attribute_group *group)
+static void init_fw_attribute_group(struct device *dev,
+                                    struct device_attribute *attrs,
+                                    struct fw_attribute_group *group)
 {
         struct device_attribute *attr;
         int i, j;
@@ -319,9 +300,8 @@ init_fw_attribute_group(struct device *dev,
         dev->groups = group->groups;
 }
 
-static ssize_t
-modalias_show(struct device *dev,
-              struct device_attribute *attr, char *buf)
+static ssize_t modalias_show(struct device *dev,
+                             struct device_attribute *attr, char *buf)
 {
         struct fw_unit *unit = fw_unit(dev);
         int length;
@@ -332,9 +312,8 @@ modalias_show(struct device *dev,
         return length + 1;
 }
 
-static ssize_t
-rom_index_show(struct device *dev,
-               struct device_attribute *attr, char *buf)
+static ssize_t rom_index_show(struct device *dev,
+                              struct device_attribute *attr, char *buf)
 {
         struct fw_device *device = fw_device(dev->parent);
         struct fw_unit *unit = fw_unit(dev);
@@ -349,8 +328,8 @@ static struct device_attribute fw_unit_attributes[] = {
         __ATTR_NULL,
 };
 
-static ssize_t
-config_rom_show(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t config_rom_show(struct device *dev,
+                               struct device_attribute *attr, char *buf)
 {
         struct fw_device *device = fw_device(dev);
         size_t length;
@@ -363,8 +342,8 @@ config_rom_show(struct device *dev, struct device_attribute *attr, char *buf)
         return length;
 }
 
-static ssize_t
-guid_show(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t guid_show(struct device *dev,
+                         struct device_attribute *attr, char *buf)
 {
         struct fw_device *device = fw_device(dev);
         int ret;
@@ -383,8 +362,8 @@ static struct device_attribute fw_device_attributes[] = {
         __ATTR_NULL,
 };
 
-static int
-read_rom(struct fw_device *device, int generation, int index, u32 *data)
+static int read_rom(struct fw_device *device,
+                    int generation, int index, u32 *data)
 {
         int rcode;
 
@@ -539,7 +518,7 @@ static int read_bus_info_block(struct fw_device *device, int generation)
 
         kfree(old_rom);
         ret = 0;
-        device->cmc = rom[2] & 1 << 30;
+        device->cmc = rom[2] >> 30 & 1;
  out:
         kfree(rom);
 
@@ -679,11 +658,53 @@ static void fw_device_shutdown(struct work_struct *work)
         fw_device_put(device);
 }
 
+static void fw_device_release(struct device *dev)
+{
+        struct fw_device *device = fw_device(dev);
+        struct fw_card *card = device->card;
+        unsigned long flags;
+
+        /*
+         * Take the card lock so we don't set this to NULL while a
+         * FW_NODE_UPDATED callback is being handled or while the
+         * bus manager work looks at this node.
+         */
+        spin_lock_irqsave(&card->lock, flags);
+        device->node->data = NULL;
+        spin_unlock_irqrestore(&card->lock, flags);
+
+        fw_node_put(device->node);
+        kfree(device->config_rom);
+        kfree(device);
+        fw_card_put(card);
+}
+
 static struct device_type fw_device_type = {
-        .release        = fw_device_release,
+        .release = fw_device_release,
 };
 
-static void fw_device_update(struct work_struct *work);
+static int update_unit(struct device *dev, void *data)
+{
+        struct fw_unit *unit = fw_unit(dev);
+        struct fw_driver *driver = (struct fw_driver *)dev->driver;
+
+        if (is_fw_unit(dev) && driver != NULL && driver->update != NULL) {
+                down(&dev->sem);
+                driver->update(unit);
+                up(&dev->sem);
+        }
+
+        return 0;
+}
+
+static void fw_device_update(struct work_struct *work)
+{
+        struct fw_device *device =
+                container_of(work, struct fw_device, work.work);
+
+        fw_device_cdev_update(device);
+        device_for_each_child(&device->device, NULL, update_unit);
+}
 
 /*
  * If a device was pending for deletion because its node went away but its
@@ -735,12 +756,50 @@ static int lookup_existing_device(struct device *dev, void *data)
         return match;
 }
 
+enum { BC_UNKNOWN = 0, BC_UNIMPLEMENTED, BC_IMPLEMENTED, };
+
+void fw_device_set_broadcast_channel(struct fw_device *device, int generation)
+{
+        struct fw_card *card = device->card;
+        __be32 data;
+        int rcode;
+
+        if (!card->broadcast_channel_allocated)
+                return;
+
+        if (device->bc_implemented == BC_UNKNOWN) {
+                rcode = fw_run_transaction(card, TCODE_READ_QUADLET_REQUEST,
+                                device->node_id, generation, device->max_speed,
+                                CSR_REGISTER_BASE + CSR_BROADCAST_CHANNEL,
+                                &data, 4);
+                switch (rcode) {
+                case RCODE_COMPLETE:
+                        if (data & cpu_to_be32(1 << 31)) {
+                                device->bc_implemented = BC_IMPLEMENTED;
+                                break;
+                        }
+                        /* else fall through to case address error */
+                case RCODE_ADDRESS_ERROR:
+                        device->bc_implemented = BC_UNIMPLEMENTED;
+                }
+        }
+
+        if (device->bc_implemented == BC_IMPLEMENTED) {
+                data = cpu_to_be32(BROADCAST_CHANNEL_INITIAL |
+                                   BROADCAST_CHANNEL_VALID);
+                fw_run_transaction(card, TCODE_WRITE_QUADLET_REQUEST,
+                                device->node_id, generation, device->max_speed,
+                                CSR_REGISTER_BASE + CSR_BROADCAST_CHANNEL,
+                                &data, 4);
+        }
+}
+
 static void fw_device_init(struct work_struct *work)
 {
         struct fw_device *device =
                 container_of(work, struct fw_device, work.work);
         struct device *revived_dev;
-        int minor, err;
+        int minor, ret;
 
         /*
          * All failure paths here set node->data to NULL, so that we
@@ -776,12 +835,12 @@ static void fw_device_init(struct work_struct *work)
 
         fw_device_get(device);
         down_write(&fw_device_rwsem);
-        err = idr_pre_get(&fw_device_idr, GFP_KERNEL) ?
+        ret = idr_pre_get(&fw_device_idr, GFP_KERNEL) ?
               idr_get_new(&fw_device_idr, device, &minor) :
               -ENOMEM;
         up_write(&fw_device_rwsem);
 
-        if (err < 0)
+        if (ret < 0)
                 goto error;
 
         device->device.bus = &fw_bus_type;
@@ -828,6 +887,8 @@ static void fw_device_init(struct work_struct *work)
                                   device->config_rom[3], device->config_rom[4],
                                   1 << device->max_speed);
                 device->config_rom_retries = 0;
+
+                fw_device_set_broadcast_channel(device, device->generation);
         }
 
         /*
@@ -851,29 +912,6 @@ static void fw_device_init(struct work_struct *work)
         put_device(&device->device);    /* our reference */
 }
 
-static int update_unit(struct device *dev, void *data)
-{
-        struct fw_unit *unit = fw_unit(dev);
-        struct fw_driver *driver = (struct fw_driver *)dev->driver;
-
-        if (is_fw_unit(dev) && driver != NULL && driver->update != NULL) {
-                down(&dev->sem);
-                driver->update(unit);
-                up(&dev->sem);
-        }
-
-        return 0;
-}
-
-static void fw_device_update(struct work_struct *work)
-{
-        struct fw_device *device =
-                container_of(work, struct fw_device, work.work);
-
-        fw_device_cdev_update(device);
-        device_for_each_child(&device->device, NULL, update_unit);
-}
-
 enum {
         REREAD_BIB_ERROR,
         REREAD_BIB_GONE,
@@ -894,7 +932,7 @@ static int reread_bus_info_block(struct fw_device *device, int generation)
                 if (i == 0 && q == 0)
                         return REREAD_BIB_GONE;
 
-                if (i > device->config_rom_length || q != device->config_rom[i])
+                if (q != device->config_rom[i])
                         return REREAD_BIB_CHANGED;
         }
 
@@ -1004,6 +1042,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                 device->node = fw_node_get(node);
                 device->node_id = node->node_id;
                 device->generation = card->generation;
+                mutex_init(&device->client_list_mutex);
                 INIT_LIST_HEAD(&device->client_list);
 
                 /*
diff --git a/drivers/firewire/fw-device.h b/drivers/firewire/fw-device.h
index 8ef6ec2ca21c..97588937c018 100644
--- a/drivers/firewire/fw-device.h
+++ b/drivers/firewire/fw-device.h
@@ -19,10 +19,17 @@
 #ifndef __fw_device_h
 #define __fw_device_h
 
+#include <linux/device.h>
 #include <linux/fs.h>
-#include <linux/cdev.h>
 #include <linux/idr.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
 #include <linux/rwsem.h>
+#include <linux/sysfs.h>
+#include <linux/types.h>
+#include <linux/workqueue.h>
+
 #include <asm/atomic.h>
 
 enum fw_device_state {
@@ -38,6 +45,9 @@ struct fw_attribute_group {
         struct attribute *attrs[11];
 };
 
+struct fw_node;
+struct fw_card;
+
 /*
  * Note, fw_device.generation always has to be read before fw_device.node_id.
  * Use SMP memory barriers to ensure this.  Otherwise requests will be sent
@@ -61,13 +71,18 @@ struct fw_device {
         int node_id;
         int generation;
         unsigned max_speed;
-        bool cmc;
         struct fw_card *card;
         struct device device;
+
+        struct mutex client_list_mutex;
         struct list_head client_list;
+
         u32 *config_rom;
         size_t config_rom_length;
         int config_rom_retries;
+        unsigned cmc:1;
+        unsigned bc_implemented:2;
+
         struct delayed_work work;
         struct fw_attribute_group attribute_group;
 };
@@ -96,6 +111,7 @@ static inline void fw_device_put(struct fw_device *device)
 
 struct fw_device *fw_device_get_by_devt(dev_t devt);
 int fw_device_enable_phys_dma(struct fw_device *device);
+void fw_device_set_broadcast_channel(struct fw_device *device, int generation);
 
 void fw_device_cdev_update(struct fw_device *device);
 void fw_device_cdev_remove(struct fw_device *device);
@@ -176,8 +192,7 @@ struct fw_driver {
         const struct fw_device_id *id_table;
 };
 
-static inline struct fw_driver *
-fw_driver(struct device_driver *drv)
+static inline struct fw_driver *fw_driver(struct device_driver *drv)
 {
         return container_of(drv, struct fw_driver, driver);
 }
diff --git a/drivers/firewire/fw-iso.c b/drivers/firewire/fw-iso.c
index e14c03dc0065..2baf1007253e 100644
--- a/drivers/firewire/fw-iso.c
+++ b/drivers/firewire/fw-iso.c
@@ -1,5 +1,7 @@
 /*
- * Isochronous IO functionality
+ * Isochronous I/O functionality:
+ *   - Isochronous DMA context management
+ *   - Isochronous bus resource management (channels, bandwidth), client side
  *
  * Copyright (C) 2006 Kristian Hoegsberg <krh@bitplanet.net>
  *
@@ -18,21 +20,25 @@
  * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  */
 
-#include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/dma-mapping.h>
-#include <linux/vmalloc.h>
+#include <linux/errno.h>
+#include <linux/firewire-constants.h>
+#include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/spinlock.h>
+#include <linux/vmalloc.h>
 
-#include "fw-transaction.h"
 #include "fw-topology.h"
-#include "fw-device.h"
+#include "fw-transaction.h"
 
-int
-fw_iso_buffer_init(struct fw_iso_buffer *buffer, struct fw_card *card,
-                   int page_count, enum dma_data_direction direction)
+/*
+ * Isochronous DMA context management
+ */
+
+int fw_iso_buffer_init(struct fw_iso_buffer *buffer, struct fw_card *card,
+                       int page_count, enum dma_data_direction direction)
 {
-        int i, j, retval = -ENOMEM;
+        int i, j;
         dma_addr_t address;
 
         buffer->page_count = page_count;
@@ -69,19 +75,21 @@ fw_iso_buffer_init(struct fw_iso_buffer *buffer, struct fw_card *card,
         kfree(buffer->pages);
  out:
         buffer->pages = NULL;
-        return retval;
+
+        return -ENOMEM;
 }
 
 int fw_iso_buffer_map(struct fw_iso_buffer *buffer, struct vm_area_struct *vma)
 {
         unsigned long uaddr;
-        int i, retval;
+        int i, err;
 
         uaddr = vma->vm_start;
         for (i = 0; i < buffer->page_count; i++) {
-                retval = vm_insert_page(vma, uaddr, buffer->pages[i]);
-                if (retval)
-                        return retval;
+                err = vm_insert_page(vma, uaddr, buffer->pages[i]);
+                if (err)
+                        return err;
+
                 uaddr += PAGE_SIZE;
         }
 
@@ -105,14 +113,14 @@ void fw_iso_buffer_destroy(struct fw_iso_buffer *buffer,
         buffer->pages = NULL;
 }
 
-struct fw_iso_context *
-fw_iso_context_create(struct fw_card *card, int type,
-                      int channel, int speed, size_t header_size,
-                      fw_iso_callback_t callback, void *callback_data)
+struct fw_iso_context *fw_iso_context_create(struct fw_card *card,
+                int type, int channel, int speed, size_t header_size,
+                fw_iso_callback_t callback, void *callback_data)
 {
         struct fw_iso_context *ctx;
 
-        ctx = card->driver->allocate_iso_context(card, type, header_size);
+        ctx = card->driver->allocate_iso_context(card,
+                                                 type, channel, header_size);
         if (IS_ERR(ctx))
                 return ctx;
 
@@ -134,25 +142,186 @@ void fw_iso_context_destroy(struct fw_iso_context *ctx)
         card->driver->free_iso_context(ctx);
 }
 
-int
-fw_iso_context_start(struct fw_iso_context *ctx, int cycle, int sync, int tags)
+int fw_iso_context_start(struct fw_iso_context *ctx,
+                         int cycle, int sync, int tags)
 {
         return ctx->card->driver->start_iso(ctx, cycle, sync, tags);
 }
 
-int
-fw_iso_context_queue(struct fw_iso_context *ctx,
-                     struct fw_iso_packet *packet,
-                     struct fw_iso_buffer *buffer,
-                     unsigned long payload)
+int fw_iso_context_queue(struct fw_iso_context *ctx,
+                         struct fw_iso_packet *packet,
+                         struct fw_iso_buffer *buffer,
+                         unsigned long payload)
 {
         struct fw_card *card = ctx->card;
 
         return card->driver->queue_iso(ctx, packet, buffer, payload);
 }
 
-int
-fw_iso_context_stop(struct fw_iso_context *ctx)
+int fw_iso_context_stop(struct fw_iso_context *ctx)
 {
         return ctx->card->driver->stop_iso(ctx);
 }
+
+/*
+ * Isochronous bus resource management (channels, bandwidth), client side
+ */
+
+static int manage_bandwidth(struct fw_card *card, int irm_id, int generation,
+                            int bandwidth, bool allocate)
+{
+        __be32 data[2];
+        int try, new, old = allocate ? BANDWIDTH_AVAILABLE_INITIAL : 0;
+
+        /*
+         * On a 1394a IRM with low contention, try < 1 is enough.
+         * On a 1394-1995 IRM, we need at least try < 2.
+         * Let's just do try < 5.
+         */
+        for (try = 0; try < 5; try++) {
+                new = allocate ? old - bandwidth : old + bandwidth;
+                if (new < 0 || new > BANDWIDTH_AVAILABLE_INITIAL)
+                        break;
+
+                data[0] = cpu_to_be32(old);
+                data[1] = cpu_to_be32(new);
+                switch (fw_run_transaction(card, TCODE_LOCK_COMPARE_SWAP,
+                                irm_id, generation, SCODE_100,
+                                CSR_REGISTER_BASE + CSR_BANDWIDTH_AVAILABLE,
+                                data, sizeof(data))) {
+                case RCODE_GENERATION:
+                        /* A generation change frees all bandwidth. */
+                        return allocate ? -EAGAIN : bandwidth;
+
+                case RCODE_COMPLETE:
+                        if (be32_to_cpup(data) == old)
+                                return bandwidth;
+
+                        old = be32_to_cpup(data);
+                        /* Fall through. */
+                }
+        }
+
+        return -EIO;
+}
+
+static int manage_channel(struct fw_card *card, int irm_id, int generation,
+                          u32 channels_mask, u64 offset, bool allocate)
+{
+        __be32 data[2], c, all, old;
+        int i, retry = 5;
+
+        old = all = allocate ? cpu_to_be32(~0) : 0;
+
+        for (i = 0; i < 32; i++) {
+                if (!(channels_mask & 1 << i))
+                        continue;
+
+                c = cpu_to_be32(1 << (31 - i));
+                if ((old & c) != (all & c))
+                        continue;
+
+                data[0] = old;
+                data[1] = old ^ c;
+                switch (fw_run_transaction(card, TCODE_LOCK_COMPARE_SWAP,
+                                           irm_id, generation, SCODE_100,
+                                           offset, data, sizeof(data))) {
+                case RCODE_GENERATION:
+                        /* A generation change frees all channels. */
+                        return allocate ? -EAGAIN : i;
+
+                case RCODE_COMPLETE:
+                        if (data[0] == old)
+                                return i;
+
+                        old = data[0];
+
+                        /* Is the IRM 1394a-2000 compliant? */
+                        if ((data[0] & c) == (data[1] & c))
+                                continue;
+
+                        /* 1394-1995 IRM, fall through to retry. */
+                default:
+                        if (retry--)
+                                i--;
+                }
+        }
+
+        return -EIO;
+}
+
+static void deallocate_channel(struct fw_card *card, int irm_id,
+                               int generation, int channel)
+{
+        u32 mask;
+        u64 offset;
+
+        mask = channel < 32 ? 1 << channel : 1 << (channel - 32);
+        offset = channel < 32 ? CSR_REGISTER_BASE + CSR_CHANNELS_AVAILABLE_HI :
+                                CSR_REGISTER_BASE + CSR_CHANNELS_AVAILABLE_LO;
+
+        manage_channel(card, irm_id, generation, mask, offset, false);
+}
+
+/**
+ * fw_iso_resource_manage - Allocate or deallocate a channel and/or bandwidth
+ *
+ * In parameters: card, generation, channels_mask, bandwidth, allocate
+ * Out parameters: channel, bandwidth
+ * This function blocks (sleeps) during communication with the IRM.
+ *
+ * Allocates or deallocates at most one channel out of channels_mask.
+ * channels_mask is a bitfield with MSB for channel 63 and LSB for channel 0.
+ * (Note, the IRM's CHANNELS_AVAILABLE is a big-endian bitfield with MSB for
+ * channel 0 and LSB for channel 63.)
+ * Allocates or deallocates as many bandwidth allocation units as specified.
+ *
+ * Returns channel < 0 if no channel was allocated or deallocated.
+ * Returns bandwidth = 0 if no bandwidth was allocated or deallocated.
+ *
+ * If generation is stale, deallocations succeed but allocations fail with
+ * channel = -EAGAIN.
+ *
+ * If channel allocation fails, no bandwidth will be allocated either.
+ * If bandwidth allocation fails, no channel will be allocated either.
+ * But deallocations of channel and bandwidth are tried independently
+ * of each other's success.
+ */
+void fw_iso_resource_manage(struct fw_card *card, int generation,
+                            u64 channels_mask, int *channel, int *bandwidth,
+                            bool allocate)
+{
+        u32 channels_hi = channels_mask;        /* channels 31...0 */
+        u32 channels_lo = channels_mask >> 32;  /* channels 63...32 */
+        int irm_id, ret, c = -EINVAL;
+
+        spin_lock_irq(&card->lock);
+        irm_id = card->irm_node->node_id;
+        spin_unlock_irq(&card->lock);
+
+        if (channels_hi)
+                c = manage_channel(card, irm_id, generation, channels_hi,
+                    CSR_REGISTER_BASE + CSR_CHANNELS_AVAILABLE_HI, allocate);
+        if (channels_lo && c < 0) {
+                c = manage_channel(card, irm_id, generation, channels_lo,
+                    CSR_REGISTER_BASE + CSR_CHANNELS_AVAILABLE_LO, allocate);
+                if (c >= 0)
+                        c += 32;
+        }
+        *channel = c;
+
+        if (allocate && channels_mask != 0 && c < 0)
+                *bandwidth = 0;
+
+        if (*bandwidth == 0)
+                return;
+
+        ret = manage_bandwidth(card, irm_id, generation, *bandwidth, allocate);
+        if (ret < 0)
+                *bandwidth = 0;
+
+        if (allocate && ret < 0 && c >= 0) {
+                deallocate_channel(card, irm_id, generation, c);
+                *channel = ret;
+        }
+}
diff --git a/drivers/firewire/fw-ohci.c b/drivers/firewire/fw-ohci.c
index 6d19828a93a5..1180d0be0bb4 100644
--- a/drivers/firewire/fw-ohci.c
+++ b/drivers/firewire/fw-ohci.c
@@ -205,6 +205,7 @@ struct fw_ohci {
 
         u32 it_context_mask;
         struct iso_context *it_context_list;
+        u64 ir_context_channels;
         u32 ir_context_mask;
         struct iso_context *ir_context_list;
 };
@@ -441,9 +442,8 @@ static inline void flush_writes(const struct fw_ohci *ohci)
         reg_read(ohci, OHCI1394_Version);
 }
 
-static int
-ohci_update_phy_reg(struct fw_card *card, int addr,
-                    int clear_bits, int set_bits)
+static int ohci_update_phy_reg(struct fw_card *card, int addr,
+                               int clear_bits, int set_bits)
 {
         struct fw_ohci *ohci = fw_ohci(card);
         u32 val, old;
@@ -658,8 +658,8 @@ static void ar_context_tasklet(unsigned long data)
         }
 }
 
-static int
-ar_context_init(struct ar_context *ctx, struct fw_ohci *ohci, u32 regs)
+static int ar_context_init(struct ar_context *ctx,
+                           struct fw_ohci *ohci, u32 regs)
 {
         struct ar_buffer ab;
 
@@ -690,8 +690,7 @@ static void ar_context_run(struct ar_context *ctx)
         flush_writes(ctx->ohci);
 }
 
-static struct descriptor *
-find_branch_descriptor(struct descriptor *d, int z)
+static struct descriptor *find_branch_descriptor(struct descriptor *d, int z)
 {
         int b, key;
 
@@ -751,8 +750,7 @@ static void context_tasklet(unsigned long data)
  * Allocate a new buffer and add it to the list of free buffers for this
  * context.  Must be called with ohci->lock held.
  */
-static int
-context_add_buffer(struct context *ctx)
+static int context_add_buffer(struct context *ctx)
 {
         struct descriptor_buffer *desc;
         dma_addr_t uninitialized_var(bus_addr);
@@ -781,9 +779,8 @@ context_add_buffer(struct context *ctx)
         return 0;
 }
 
-static int
-context_init(struct context *ctx, struct fw_ohci *ohci,
-             u32 regs, descriptor_callback_t callback)
+static int context_init(struct context *ctx, struct fw_ohci *ohci,
+                        u32 regs, descriptor_callback_t callback)
 {
         ctx->ohci = ohci;
         ctx->regs = regs;
@@ -814,8 +811,7 @@ context_init(struct context *ctx, struct fw_ohci *ohci,
         return 0;
 }
 
-static void
-context_release(struct context *ctx)
+static void context_release(struct context *ctx)
 {
         struct fw_card *card = &ctx->ohci->card;
         struct descriptor_buffer *desc, *tmp;
@@ -827,8 +823,8 @@ context_release(struct context *ctx)
 }
 
 /* Must be called with ohci->lock held */
-static struct descriptor *
-context_get_descriptors(struct context *ctx, int z, dma_addr_t *d_bus)
+static struct descriptor *context_get_descriptors(struct context *ctx,
+                                                  int z, dma_addr_t *d_bus)
 {
         struct descriptor *d = NULL;
         struct descriptor_buffer *desc = ctx->buffer_tail;
@@ -912,8 +908,8 @@ struct driver_data {
  * Must always be called with the ochi->lock held to ensure proper
  * generation handling and locking around packet queue manipulation.
  */
-static int
-at_context_queue_packet(struct context *ctx, struct fw_packet *packet)
+static int at_context_queue_packet(struct context *ctx,
+                                   struct fw_packet *packet)
 {
         struct fw_ohci *ohci = ctx->ohci;
         dma_addr_t d_bus, uninitialized_var(payload_bus);
@@ -940,7 +936,9 @@ at_context_queue_packet(struct context *ctx, struct fw_packet *packet)
          */
 
         header = (__le32 *) &d[1];
-        if (packet->header_length > 8) {
+        switch (packet->header_length) {
+        case 16:
+        case 12:
                 header[0] = cpu_to_le32((packet->header[0] & 0xffff) |
                                         (packet->speed << 16));
                 header[1] = cpu_to_le32((packet->header[1] & 0xffff) |
@@ -954,12 +952,27 @@ at_context_queue_packet(struct context *ctx, struct fw_packet *packet)
                         header[3] = (__force __le32) packet->header[3];
 
                 d[0].req_count = cpu_to_le16(packet->header_length);
-        } else {
+                break;
+
+        case 8:
                 header[0] = cpu_to_le32((OHCI1394_phy_tcode << 4) |
                                         (packet->speed << 16));
                 header[1] = cpu_to_le32(packet->header[0]);
                 header[2] = cpu_to_le32(packet->header[1]);
                 d[0].req_count = cpu_to_le16(12);
+                break;
+
+        case 4:
+                header[0] = cpu_to_le32((packet->header[0] & 0xffff) |
+                                        (packet->speed << 16));
+                header[1] = cpu_to_le32(packet->header[0] & 0xffff0000);
+                d[0].req_count = cpu_to_le16(8);
+                break;
+
+        default:
+                /* BUG(); */
+                packet->ack = RCODE_SEND_ERROR;
+                return -1;
         }
 
         driver_data = (struct driver_data *) &d[3];
@@ -1095,8 +1108,8 @@ static int handle_at_packet(struct context *context,
 #define HEADER_GET_DATA_LENGTH(q)       (((q) >> 16) & 0xffff)
 #define HEADER_GET_EXTENDED_TCODE(q)    (((q) >> 0) & 0xffff)
 
-static void
-handle_local_rom(struct fw_ohci *ohci, struct fw_packet *packet, u32 csr)
+static void handle_local_rom(struct fw_ohci *ohci,
+                             struct fw_packet *packet, u32 csr)
 {
         struct fw_packet response;
         int tcode, length, i;
@@ -1122,8 +1135,8 @@ handle_local_rom(struct fw_ohci *ohci, struct fw_packet *packet, u32 csr)
         fw_core_handle_response(&ohci->card, &response);
 }
 
-static void
-handle_local_lock(struct fw_ohci *ohci, struct fw_packet *packet, u32 csr)
+static void handle_local_lock(struct fw_ohci *ohci,
+                              struct fw_packet *packet, u32 csr)
 {
         struct fw_packet response;
         int tcode, length, ext_tcode, sel;
@@ -1164,8 +1177,7 @@ handle_local_lock(struct fw_ohci *ohci, struct fw_packet *packet, u32 csr)
         fw_core_handle_response(&ohci->card, &response);
 }
 
-static void
-handle_local_request(struct context *ctx, struct fw_packet *packet)
+static void handle_local_request(struct context *ctx, struct fw_packet *packet)
 {
         u64 offset;
         u32 csr;
@@ -1205,11 +1217,10 @@ handle_local_request(struct context *ctx, struct fw_packet *packet)
         }
 }
 
-static void
-at_context_transmit(struct context *ctx, struct fw_packet *packet)
+static void at_context_transmit(struct context *ctx, struct fw_packet *packet)
 {
         unsigned long flags;
-        int retval;
+        int ret;
 
         spin_lock_irqsave(&ctx->ohci->lock, flags);
 
@@ -1220,10 +1231,10 @@ at_context_transmit(struct context *ctx, struct fw_packet *packet)
                 return;
         }
 
-        retval = at_context_queue_packet(ctx, packet);
+        ret = at_context_queue_packet(ctx, packet);
         spin_unlock_irqrestore(&ctx->ohci->lock, flags);
 
-        if (retval < 0)
+        if (ret < 0)
                 packet->callback(packet, &ctx->ohci->card, packet->ack);
 
 }
@@ -1590,12 +1601,12 @@ static int ohci_enable(struct fw_card *card, u32 *config_rom, size_t length)
         return 0;
 }
 
-static int
-ohci_set_config_rom(struct fw_card *card, u32 *config_rom, size_t length)
+static int ohci_set_config_rom(struct fw_card *card,
+                               u32 *config_rom, size_t length)
 {
         struct fw_ohci *ohci;
         unsigned long flags;
-        int retval = -EBUSY;
+        int ret = -EBUSY;
         __be32 *next_config_rom;
         dma_addr_t uninitialized_var(next_config_rom_bus);
 
@@ -1649,7 +1660,7 @@ ohci_set_config_rom(struct fw_card *card, u32 *config_rom, size_t length)
 
                 reg_write(ohci, OHCI1394_ConfigROMmap,
                           ohci->next_config_rom_bus);
-                retval = 0;
+                ret = 0;
         }
 
         spin_unlock_irqrestore(&ohci->lock, flags);
@@ -1661,13 +1672,13 @@ ohci_set_config_rom(struct fw_card *card, u32 *config_rom, size_t length)
          * controller could need to access it before the bus reset
          * takes effect.
          */
-        if (retval == 0)
+        if (ret == 0)
                 fw_core_initiate_bus_reset(&ohci->card, 1);
         else
                 dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
                                   next_config_rom, next_config_rom_bus);
 
-        return retval;
+        return ret;
 }
 
 static void ohci_send_request(struct fw_card *card, struct fw_packet *packet)
@@ -1689,7 +1700,7 @@ static int ohci_cancel_packet(struct fw_card *card, struct fw_packet *packet)
         struct fw_ohci *ohci = fw_ohci(card);
         struct context *ctx = &ohci->at_request_ctx;
         struct driver_data *driver_data = packet->driver_data;
-        int retval = -ENOENT;
+        int ret = -ENOENT;
 
         tasklet_disable(&ctx->tasklet);
 
@@ -1704,23 +1715,22 @@ static int ohci_cancel_packet(struct fw_card *card, struct fw_packet *packet)
         driver_data->packet = NULL;
         packet->ack = RCODE_CANCELLED;
         packet->callback(packet, &ohci->card, packet->ack);
-        retval = 0;
-
+        ret = 0;
  out:
         tasklet_enable(&ctx->tasklet);
 
-        return retval;
+        return ret;
 }
 
-static int
-ohci_enable_phys_dma(struct fw_card *card, int node_id, int generation)
+static int ohci_enable_phys_dma(struct fw_card *card,
+                                int node_id, int generation)
 {
 #ifdef CONFIG_FIREWIRE_OHCI_REMOTE_DMA
         return 0;
 #else
         struct fw_ohci *ohci = fw_ohci(card);
         unsigned long flags;
-        int n, retval = 0;
+        int n, ret = 0;
 
         /*
          * FIXME:  Make sure this bitmask is cleared when we clear the busReset
@@ -1730,7 +1740,7 @@ ohci_enable_phys_dma(struct fw_card *card, int node_id, int generation)
         spin_lock_irqsave(&ohci->lock, flags);
 
         if (ohci->generation != generation) {
-                retval = -ESTALE;
+                ret = -ESTALE;
                 goto out;
         }
 
@@ -1748,12 +1758,12 @@ ohci_enable_phys_dma(struct fw_card *card, int node_id, int generation)
         flush_writes(ohci);
  out:
         spin_unlock_irqrestore(&ohci->lock, flags);
-        return retval;
+
+        return ret;
 #endif /* CONFIG_FIREWIRE_OHCI_REMOTE_DMA */
 }
 
-static u64
-ohci_get_bus_time(struct fw_card *card)
+static u64 ohci_get_bus_time(struct fw_card *card)
 {
         struct fw_ohci *ohci = fw_ohci(card);
         u32 cycle_time;
@@ -1765,6 +1775,28 @@ ohci_get_bus_time(struct fw_card *card)
         return bus_time;
 }
 
+static void copy_iso_headers(struct iso_context *ctx, void *p)
+{
+        int i = ctx->header_length;
+
+        if (i + ctx->base.header_size > PAGE_SIZE)
+                return;
+
+        /*
+         * The iso header is byteswapped to little endian by
+         * the controller, but the remaining header quadlets
+         * are big endian.  We want to present all the headers
+         * as big endian, so we have to swap the first quadlet.
+         */
+        if (ctx->base.header_size > 0)
+                *(u32 *) (ctx->header + i) = __swab32(*(u32 *) (p + 4));
+        if (ctx->base.header_size > 4)
+                *(u32 *) (ctx->header + i + 4) = __swab32(*(u32 *) p);
+        if (ctx->base.header_size > 8)
+                memcpy(ctx->header + i + 8, p + 8, ctx->base.header_size - 8);
+        ctx->header_length += ctx->base.header_size;
+}
+
 static int handle_ir_dualbuffer_packet(struct context *context,
                                        struct descriptor *d,
                                        struct descriptor *last)
@@ -1775,7 +1807,6 @@ static int handle_ir_dualbuffer_packet(struct context *context,
         __le32 *ir_header;
         size_t header_length;
         void *p, *end;
-        int i;
 
         if (db->first_res_count != 0 && db->second_res_count != 0) {
                 if (ctx->excess_bytes <= le16_to_cpu(db->second_req_count)) {
@@ -1788,25 +1819,14 @@ static int handle_ir_dualbuffer_packet(struct context *context,
         header_length = le16_to_cpu(db->first_req_count) -
                 le16_to_cpu(db->first_res_count);
 
-        i = ctx->header_length;
         p = db + 1;
         end = p + header_length;
-        while (p < end && i + ctx->base.header_size <= PAGE_SIZE) {
-                /*
-                 * The iso header is byteswapped to little endian by
-                 * the controller, but the remaining header quadlets
-                 * are big endian.  We want to present all the headers
-                 * as big endian, so we have to swap the first
-                 * quadlet.
-                 */
-                *(u32 *) (ctx->header + i) = __swab32(*(u32 *) (p + 4));
-                memcpy(ctx->header + i + 4, p + 8, ctx->base.header_size - 4);
-                i += ctx->base.header_size;
+        while (p < end) {
+                copy_iso_headers(ctx, p);
                 ctx->excess_bytes +=
                         (le32_to_cpu(*(__le32 *)(p + 4)) >> 16) & 0xffff;
-                p += ctx->base.header_size + 4;
+                p += max(ctx->base.header_size, (size_t)8);
         }
-        ctx->header_length = i;
 
         ctx->excess_bytes -= le16_to_cpu(db->second_req_count) -
                 le16_to_cpu(db->second_res_count);
@@ -1832,7 +1852,6 @@ static int handle_ir_packet_per_buffer(struct context *context,
         struct descriptor *pd;
         __le32 *ir_header;
         void *p;
-        int i;
 
         for (pd = d; pd <= last; pd++) {
                 if (pd->transfer_status)
@@ -1842,21 +1861,8 @@ static int handle_ir_packet_per_buffer(struct context *context,
                 /* Descriptor(s) not done yet, stop iteration */
                 return 0;
 
-        i   = ctx->header_length;
-        p   = last + 1;
-
-        if (ctx->base.header_size > 0 &&
-                        i + ctx->base.header_size <= PAGE_SIZE) {
-                /*
-                 * The iso header is byteswapped to little endian by
-                 * the controller, but the remaining header quadlets
-                 * are big endian.  We want to present all the headers
-                 * as big endian, so we have to swap the first quadlet.
-                 */
-                *(u32 *) (ctx->header + i) = __swab32(*(u32 *) (p + 4));
-                memcpy(ctx->header + i + 4, p + 8, ctx->base.header_size - 4);
-                ctx->header_length += ctx->base.header_size;
-        }
+        p = last + 1;
+        copy_iso_headers(ctx, p);
 
         if (le16_to_cpu(last->control) & DESCRIPTOR_IRQ_ALWAYS) {
                 ir_header = (__le32 *) p;
@@ -1888,21 +1894,24 @@ static int handle_it_packet(struct context *context,
         return 1;
 }
 
-static struct fw_iso_context *
-ohci_allocate_iso_context(struct fw_card *card, int type, size_t header_size)
+static struct fw_iso_context *ohci_allocate_iso_context(struct fw_card *card,
+                                int type, int channel, size_t header_size)
 {
         struct fw_ohci *ohci = fw_ohci(card);
         struct iso_context *ctx, *list;
         descriptor_callback_t callback;
+        u64 *channels, dont_care = ~0ULL;
         u32 *mask, regs;
         unsigned long flags;
-        int index, retval = -ENOMEM;
+        int index, ret = -ENOMEM;
 
         if (type == FW_ISO_CONTEXT_TRANSMIT) {
+                channels = &dont_care;
                 mask = &ohci->it_context_mask;
                 list = ohci->it_context_list;
                 callback = handle_it_packet;
         } else {
+                channels = &ohci->ir_context_channels;
                 mask = &ohci->ir_context_mask;
                 list = ohci->ir_context_list;
                 if (ohci->use_dualbuffer)
@@ -1912,9 +1921,11 @@ ohci_allocate_iso_context(struct fw_card *card, int type, size_t header_size)
         }
 
         spin_lock_irqsave(&ohci->lock, flags);
-        index = ffs(*mask) - 1;
-        if (index >= 0)
+        index = *channels & 1ULL << channel ? ffs(*mask) - 1 : -1;
+        if (index >= 0) {
+                *channels &= ~(1ULL << channel);
                 *mask &= ~(1 << index);
+        }
         spin_unlock_irqrestore(&ohci->lock, flags);
 
         if (index < 0)
@@ -1932,8 +1943,8 @@ ohci_allocate_iso_context(struct fw_card *card, int type, size_t header_size)
         if (ctx->header == NULL)
                 goto out;
 
-        retval = context_init(&ctx->context, ohci, regs, callback);
-        if (retval < 0)
+        ret = context_init(&ctx->context, ohci, regs, callback);
+        if (ret < 0)
                 goto out_with_header;
 
         return &ctx->base;
@@ -1945,7 +1956,7 @@ ohci_allocate_iso_context(struct fw_card *card, int type, size_t header_size)
         *mask |= 1 << index;
         spin_unlock_irqrestore(&ohci->lock, flags);
 
-        return ERR_PTR(retval);
+        return ERR_PTR(ret);
 }
 
 static int ohci_start_iso(struct fw_iso_context *base,
@@ -2024,16 +2035,16 @@ static void ohci_free_iso_context(struct fw_iso_context *base)
         } else {
                 index = ctx - ohci->ir_context_list;
                 ohci->ir_context_mask |= 1 << index;
+                ohci->ir_context_channels |= 1ULL << base->channel;
         }
 
         spin_unlock_irqrestore(&ohci->lock, flags);
 }
 
-static int
-ohci_queue_iso_transmit(struct fw_iso_context *base,
-                        struct fw_iso_packet *packet,
-                        struct fw_iso_buffer *buffer,
-                        unsigned long payload)
+static int ohci_queue_iso_transmit(struct fw_iso_context *base,
+                                   struct fw_iso_packet *packet,
+                                   struct fw_iso_buffer *buffer,
+                                   unsigned long payload)
 {
         struct iso_context *ctx = container_of(base, struct iso_context, base);
         struct descriptor *d, *last, *pd;
@@ -2128,11 +2139,10 @@ ohci_queue_iso_transmit(struct fw_iso_context *base,
         return 0;
 }
 
-static int
-ohci_queue_iso_receive_dualbuffer(struct fw_iso_context *base,
-                                  struct fw_iso_packet *packet,
-                                  struct fw_iso_buffer *buffer,
-                                  unsigned long payload)
+static int ohci_queue_iso_receive_dualbuffer(struct fw_iso_context *base,
+                                             struct fw_iso_packet *packet,
+                                             struct fw_iso_buffer *buffer,
+                                             unsigned long payload)
 {
         struct iso_context *ctx = container_of(base, struct iso_context, base);
         struct db_descriptor *db = NULL;
@@ -2151,11 +2161,11 @@ ohci_queue_iso_receive_dualbuffer(struct fw_iso_context *base,
         z = 2;
 
         /*
-         * The OHCI controller puts the status word in the header
-         * buffer too, so we need 4 extra bytes per packet.
+         * The OHCI controller puts the isochronous header and trailer in the
+         * buffer, so we need at least 8 bytes.
          */
         packet_count = p->header_length / ctx->base.header_size;
-        header_size = packet_count * (ctx->base.header_size + 4);
+        header_size = packet_count * max(ctx->base.header_size, (size_t)8);
 
         /* Get header size in number of descriptors. */
         header_z = DIV_ROUND_UP(header_size, sizeof(*d));
@@ -2173,7 +2183,8 @@ ohci_queue_iso_receive_dualbuffer(struct fw_iso_context *base,
                 db = (struct db_descriptor *) d;
                 db->control = cpu_to_le16(DESCRIPTOR_STATUS |
                                           DESCRIPTOR_BRANCH_ALWAYS);
-                db->first_size = cpu_to_le16(ctx->base.header_size + 4);
+                db->first_size =
+                    cpu_to_le16(max(ctx->base.header_size, (size_t)8));
                 if (p->skip && rest == p->payload_length) {
                         db->control |= cpu_to_le16(DESCRIPTOR_WAIT);
                         db->first_req_count = db->first_size;
@@ -2208,11 +2219,10 @@ ohci_queue_iso_receive_dualbuffer(struct fw_iso_context *base,
         return 0;
 }
 
-static int
-ohci_queue_iso_receive_packet_per_buffer(struct fw_iso_context *base,
-                                         struct fw_iso_packet *packet,
-                                         struct fw_iso_buffer *buffer,
-                                         unsigned long payload)
+static int ohci_queue_iso_receive_packet_per_buffer(struct fw_iso_context *base,
+                                        struct fw_iso_packet *packet,
+                                        struct fw_iso_buffer *buffer,
+                                        unsigned long payload)
 {
         struct iso_context *ctx = container_of(base, struct iso_context, base);
         struct descriptor *d = NULL, *pd = NULL;
@@ -2223,11 +2233,11 @@ ohci_queue_iso_receive_packet_per_buffer(struct fw_iso_context *base,
         int page, offset, packet_count, header_size, payload_per_buffer;
 
         /*
-         * The OHCI controller puts the status word in the
-         * buffer too, so we need 4 extra bytes per packet.
+         * The OHCI controller puts the isochronous header and trailer in the
+         * buffer, so we need at least 8 bytes.
          */
         packet_count = p->header_length / ctx->base.header_size;
-        header_size  = ctx->base.header_size + 4;
+        header_size  = max(ctx->base.header_size, (size_t)8);
 
         /* Get header size in number of descriptors. */
         header_z = DIV_ROUND_UP(header_size, sizeof(*d));
@@ -2286,29 +2296,27 @@ ohci_queue_iso_receive_packet_per_buffer(struct fw_iso_context *base,
         return 0;
 }
 
-static int
-ohci_queue_iso(struct fw_iso_context *base,
-               struct fw_iso_packet *packet,
-               struct fw_iso_buffer *buffer,
-               unsigned long payload)
+static int ohci_queue_iso(struct fw_iso_context *base,
+                          struct fw_iso_packet *packet,
+                          struct fw_iso_buffer *buffer,
+                          unsigned long payload)
 {
         struct iso_context *ctx = container_of(base, struct iso_context, base);
         unsigned long flags;
-        int retval;
+        int ret;
 
         spin_lock_irqsave(&ctx->context.ohci->lock, flags);
         if (base->type == FW_ISO_CONTEXT_TRANSMIT)
-                retval = ohci_queue_iso_transmit(base, packet, buffer, payload);
+                ret = ohci_queue_iso_transmit(base, packet, buffer, payload);
         else if (ctx->context.ohci->use_dualbuffer)
-                retval = ohci_queue_iso_receive_dualbuffer(base, packet,
-                                                         buffer, payload);
+                ret = ohci_queue_iso_receive_dualbuffer(base, packet,
+                                                        buffer, payload);
         else
-                retval = ohci_queue_iso_receive_packet_per_buffer(base, packet,
-                                                                buffer,
-                                                                payload);
+                ret = ohci_queue_iso_receive_packet_per_buffer(base, packet,
+                                                        buffer, payload);
         spin_unlock_irqrestore(&ctx->context.ohci->lock, flags);
 
-        return retval;
+        return ret;
 }
 
 static const struct fw_card_driver ohci_driver = {
@@ -2357,8 +2365,8 @@ static void ohci_pmac_off(struct pci_dev *dev)
 #define ohci_pmac_off(dev)
 #endif /* CONFIG_PPC_PMAC */
 
-static int __devinit
-pci_probe(struct pci_dev *dev, const struct pci_device_id *ent)
+static int __devinit pci_probe(struct pci_dev *dev,
+                               const struct pci_device_id *ent)
 {
         struct fw_ohci *ohci;
         u32 bus_options, max_receive, link_speed, version;
@@ -2440,6 +2448,7 @@ pci_probe(struct pci_dev *dev, const struct pci_device_id *ent)
         ohci->it_context_list = kzalloc(size, GFP_KERNEL);
 
         reg_write(ohci, OHCI1394_IsoXmitIntMaskSet, ~0);
+        ohci->ir_context_channels = ~0ULL;
         ohci->ir_context_mask = reg_read(ohci, OHCI1394_IsoXmitIntMaskSet);
         reg_write(ohci, OHCI1394_IsoXmitIntMaskClear, ~0);
         size = sizeof(struct iso_context) * hweight32(ohci->ir_context_mask);
@@ -2467,11 +2476,12 @@ pci_probe(struct pci_dev *dev, const struct pci_device_id *ent)
                 reg_read(ohci, OHCI1394_GUIDLo);
 
         err = fw_card_add(&ohci->card, max_receive, link_speed, guid);
-        if (err < 0)
+        if (err)
                 goto fail_self_id;
 
         fw_notify("Added fw-ohci device %s, OHCI version %x.%x\n",
                   dev_name(&dev->dev), version >> 16, version & 0xff);
+
         return 0;
 
  fail_self_id:
diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
index c71c4419d9e8..2bcf51557c72 100644
--- a/drivers/firewire/fw-sbp2.c
+++ b/drivers/firewire/fw-sbp2.c
@@ -392,20 +392,18 @@ static const struct {
         }
 };
 
-static void
-free_orb(struct kref *kref)
+static void free_orb(struct kref *kref)
 {
         struct sbp2_orb *orb = container_of(kref, struct sbp2_orb, kref);
 
         kfree(orb);
 }
 
-static void
-sbp2_status_write(struct fw_card *card, struct fw_request *request,
-                  int tcode, int destination, int source,
-                  int generation, int speed,
-                  unsigned long long offset,
-                  void *payload, size_t length, void *callback_data)
+static void sbp2_status_write(struct fw_card *card, struct fw_request *request,
+                              int tcode, int destination, int source,
+                              int generation, int speed,
+                              unsigned long long offset,
+                              void *payload, size_t length, void *callback_data)
 {
         struct sbp2_logical_unit *lu = callback_data;
         struct sbp2_orb *orb;
@@ -451,9 +449,8 @@ sbp2_status_write(struct fw_card *card, struct fw_request *request,
         fw_send_response(card, request, RCODE_COMPLETE);
 }
 
-static void
-complete_transaction(struct fw_card *card, int rcode,
-                     void *payload, size_t length, void *data)
+static void complete_transaction(struct fw_card *card, int rcode,
+                                 void *payload, size_t length, void *data)
 {
         struct sbp2_orb *orb = data;
         unsigned long flags;
@@ -482,9 +479,8 @@ complete_transaction(struct fw_card *card, int rcode,
         kref_put(&orb->kref, free_orb);
 }
 
-static void
-sbp2_send_orb(struct sbp2_orb *orb, struct sbp2_logical_unit *lu,
-              int node_id, int generation, u64 offset)
+static void sbp2_send_orb(struct sbp2_orb *orb, struct sbp2_logical_unit *lu,
+                          int node_id, int generation, u64 offset)
 {
         struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
         unsigned long flags;
@@ -531,8 +527,8 @@ static int sbp2_cancel_orbs(struct sbp2_logical_unit *lu)
         return retval;
 }
 
-static void
-complete_management_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
+static void complete_management_orb(struct sbp2_orb *base_orb,
+                                    struct sbp2_status *status)
 {
         struct sbp2_management_orb *orb =
                 container_of(base_orb, struct sbp2_management_orb, base);
@@ -542,10 +538,9 @@ complete_management_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
         complete(&orb->done);
 }
 
-static int
-sbp2_send_management_orb(struct sbp2_logical_unit *lu, int node_id,
-                         int generation, int function, int lun_or_login_id,
-                         void *response)
+static int sbp2_send_management_orb(struct sbp2_logical_unit *lu, int node_id,
+                                    int generation, int function,
+                                    int lun_or_login_id, void *response)
 {
         struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
         struct sbp2_management_orb *orb;
@@ -652,9 +647,8 @@ static void sbp2_agent_reset(struct sbp2_logical_unit *lu)
                            &d, sizeof(d));
 }
 
-static void
-complete_agent_reset_write_no_wait(struct fw_card *card, int rcode,
-                                   void *payload, size_t length, void *data)
+static void complete_agent_reset_write_no_wait(struct fw_card *card,
+                int rcode, void *payload, size_t length, void *data)
 {
         kfree(data);
 }
@@ -1299,8 +1293,7 @@ static void sbp2_unmap_scatterlist(struct device *card_device,
                                  sizeof(orb->page_table), DMA_TO_DEVICE);
 }
 
-static unsigned int
-sbp2_status_to_sense_data(u8 *sbp2_status, u8 *sense_data)
+static unsigned int sbp2_status_to_sense_data(u8 *sbp2_status, u8 *sense_data)
 {
         int sam_status;
 
@@ -1337,8 +1330,8 @@ sbp2_status_to_sense_data(u8 *sbp2_status, u8 *sense_data)
         }
 }
 
-static void
-complete_command_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
+static void complete_command_orb(struct sbp2_orb *base_orb,
+                                 struct sbp2_status *status)
 {
         struct sbp2_command_orb *orb =
                 container_of(base_orb, struct sbp2_command_orb, base);
@@ -1384,9 +1377,8 @@ complete_command_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
         orb->done(orb->cmd);
 }
 
-static int
-sbp2_map_scatterlist(struct sbp2_command_orb *orb, struct fw_device *device,
-                     struct sbp2_logical_unit *lu)
+static int sbp2_map_scatterlist(struct sbp2_command_orb *orb,
+                struct fw_device *device, struct sbp2_logical_unit *lu)
 {
         struct scatterlist *sg = scsi_sglist(orb->cmd);
         int i, n;
@@ -1584,9 +1576,8 @@ static int sbp2_scsi_abort(struct scsi_cmnd *cmd)
  * This is the concatenation of target port identifier and logical unit
  * identifier as per SAM-2...SAM-4 annex A.
  */
-static ssize_t
-sbp2_sysfs_ieee1394_id_show(struct device *dev, struct device_attribute *attr,
-                            char *buf)
+static ssize_t sbp2_sysfs_ieee1394_id_show(struct device *dev,
+                        struct device_attribute *attr, char *buf)
 {
         struct scsi_device *sdev = to_scsi_device(dev);
         struct sbp2_logical_unit *lu;
diff --git a/drivers/firewire/fw-topology.c b/drivers/firewire/fw-topology.c
index 8dd6703b55cd..d0deecc4de93 100644
--- a/drivers/firewire/fw-topology.c
+++ b/drivers/firewire/fw-topology.c
@@ -314,9 +314,8 @@ typedef void (*fw_node_callback_t)(struct fw_card * card,
                                    struct fw_node * node,
                                    struct fw_node * parent);
 
-static void
-for_each_fw_node(struct fw_card *card, struct fw_node *root,
-                 fw_node_callback_t callback)
+static void for_each_fw_node(struct fw_card *card, struct fw_node *root,
+                             fw_node_callback_t callback)
 {
         struct list_head list;
         struct fw_node *node, *next, *child, *parent;
@@ -349,9 +348,8 @@ for_each_fw_node(struct fw_card *card, struct fw_node *root,
                 fw_node_put(node);
 }
 
-static void
-report_lost_node(struct fw_card *card,
-                 struct fw_node *node, struct fw_node *parent)
+static void report_lost_node(struct fw_card *card,
+                             struct fw_node *node, struct fw_node *parent)
 {
         fw_node_event(card, node, FW_NODE_DESTROYED);
         fw_node_put(node);
@@ -360,9 +358,8 @@ report_lost_node(struct fw_card *card,
         card->bm_retries = 0;
 }
 
-static void
-report_found_node(struct fw_card *card,
-                  struct fw_node *node, struct fw_node *parent)
+static void report_found_node(struct fw_card *card,
+                              struct fw_node *node, struct fw_node *parent)
 {
         int b_path = (node->phy_speed == SCODE_BETA);
 
@@ -415,8 +412,7 @@ static void move_tree(struct fw_node *node0, struct fw_node *node1, int port)
  * found, lost or updated.  Update the nodes in the card topology tree
  * as we go.
  */
-static void
-update_tree(struct fw_card *card, struct fw_node *root)
+static void update_tree(struct fw_card *card, struct fw_node *root)
 {
         struct list_head list0, list1;
         struct fw_node *node0, *node1, *next1;
@@ -497,8 +493,8 @@ update_tree(struct fw_card *card, struct fw_node *root)
         }
 }
 
-static void
-update_topology_map(struct fw_card *card, u32 *self_ids, int self_id_count)
+static void update_topology_map(struct fw_card *card,
+                                u32 *self_ids, int self_id_count)
 {
         int node_count;
 
@@ -510,10 +506,8 @@ update_topology_map(struct fw_card *card, u32 *self_ids, int self_id_count)
         fw_compute_block_crc(card->topology_map);
 }
 
-void
-fw_core_handle_bus_reset(struct fw_card *card,
-                         int node_id, int generation,
-                         int self_id_count, u32 * self_ids)
+void fw_core_handle_bus_reset(struct fw_card *card, int node_id, int generation,
+                              int self_id_count, u32 *self_ids)
 {
         struct fw_node *local_node;
         unsigned long flags;
@@ -532,6 +526,7 @@ fw_core_handle_bus_reset(struct fw_card *card,
 
         spin_lock_irqsave(&card->lock, flags);
 
+        card->broadcast_channel_allocated = false;
         card->node_id = node_id;
         /*
          * Update node_id before generation to prevent anybody from using
diff --git a/drivers/firewire/fw-topology.h b/drivers/firewire/fw-topology.h
index addb9f8ea776..3c497bb4fae4 100644
--- a/drivers/firewire/fw-topology.h
+++ b/drivers/firewire/fw-topology.h
@@ -19,6 +19,11 @@
 #ifndef __fw_topology_h
 #define __fw_topology_h
 
+#include <linux/list.h>
+#include <linux/slab.h>
+
+#include <asm/atomic.h>
+
 enum {
         FW_NODE_CREATED,
         FW_NODE_UPDATED,
@@ -51,26 +56,22 @@ struct fw_node {
         struct fw_node *ports[0];
 };
 
-static inline struct fw_node *
-fw_node_get(struct fw_node *node)
+static inline struct fw_node *fw_node_get(struct fw_node *node)
 {
         atomic_inc(&node->ref_count);
 
         return node;
 }
 
-static inline void
-fw_node_put(struct fw_node *node)
+static inline void fw_node_put(struct fw_node *node)
 {
         if (atomic_dec_and_test(&node->ref_count))
                 kfree(node);
 }
 
-void
-fw_destroy_nodes(struct fw_card *card);
-
-int
-fw_compute_block_crc(u32 *block);
+struct fw_card;
+void fw_destroy_nodes(struct fw_card *card);
 
+int fw_compute_block_crc(u32 *block);
 
 #endif /* __fw_topology_h */
diff --git a/drivers/firewire/fw-transaction.c b/drivers/firewire/fw-transaction.c
index 699ac041f39a..283dac6d327d 100644
--- a/drivers/firewire/fw-transaction.c
+++ b/drivers/firewire/fw-transaction.c
@@ -64,10 +64,8 @@
 #define PHY_CONFIG_ROOT_ID(node_id)     ((((node_id) & 0x3f) << 24) | (1 << 23))
 #define PHY_IDENTIFIER(id)              ((id) << 30)
 
-static int
-close_transaction(struct fw_transaction *transaction,
-                  struct fw_card *card, int rcode,
-                  u32 *payload, size_t length)
+static int close_transaction(struct fw_transaction *transaction,
+                             struct fw_card *card, int rcode)
 {
         struct fw_transaction *t;
         unsigned long flags;
@@ -83,7 +81,7 @@ close_transaction(struct fw_transaction *transaction,
         spin_unlock_irqrestore(&card->lock, flags);
 
         if (&t->link != &card->transaction_list) {
-                t->callback(card, rcode, payload, length, t->callback_data);
+                t->callback(card, rcode, NULL, 0, t->callback_data);
                 return 0;
         }
 
@@ -94,9 +92,8 @@ close_transaction(struct fw_transaction *transaction,
  * Only valid for transactions that are potentially pending (ie have
  * been sent).
  */
-int
-fw_cancel_transaction(struct fw_card *card,
-                      struct fw_transaction *transaction)
+int fw_cancel_transaction(struct fw_card *card,
+                          struct fw_transaction *transaction)
 {
         /*
          * Cancel the packet transmission if it's still queued.  That
@@ -112,20 +109,19 @@ fw_cancel_transaction(struct fw_card *card,
          * if the transaction is still pending and remove it in that case.
          */
 
-        return close_transaction(transaction, card, RCODE_CANCELLED, NULL, 0);
+        return close_transaction(transaction, card, RCODE_CANCELLED);
 }
 EXPORT_SYMBOL(fw_cancel_transaction);
 
-static void
-transmit_complete_callback(struct fw_packet *packet,
-                           struct fw_card *card, int status)
+static void transmit_complete_callback(struct fw_packet *packet,
+                                       struct fw_card *card, int status)
 {
         struct fw_transaction *t =
             container_of(packet, struct fw_transaction, packet);
 
         switch (status) {
         case ACK_COMPLETE:
-                close_transaction(t, card, RCODE_COMPLETE, NULL, 0);
+                close_transaction(t, card, RCODE_COMPLETE);
                 break;
         case ACK_PENDING:
                 t->timestamp = packet->timestamp;
@@ -133,31 +129,42 @@ transmit_complete_callback(struct fw_packet *packet,
         case ACK_BUSY_X:
         case ACK_BUSY_A:
         case ACK_BUSY_B:
-                close_transaction(t, card, RCODE_BUSY, NULL, 0);
+                close_transaction(t, card, RCODE_BUSY);
                 break;
         case ACK_DATA_ERROR:
-                close_transaction(t, card, RCODE_DATA_ERROR, NULL, 0);
+                close_transaction(t, card, RCODE_DATA_ERROR);
                 break;
         case ACK_TYPE_ERROR:
-                close_transaction(t, card, RCODE_TYPE_ERROR, NULL, 0);
+                close_transaction(t, card, RCODE_TYPE_ERROR);
                 break;
         default:
                 /*
                  * In this case the ack is really a juju specific
                  * rcode, so just forward that to the callback.
                  */
-                close_transaction(t, card, status, NULL, 0);
+                close_transaction(t, card, status);
                 break;
         }
 }
 
-static void
-fw_fill_request(struct fw_packet *packet, int tcode, int tlabel,
+static void fw_fill_request(struct fw_packet *packet, int tcode, int tlabel,
                 int destination_id, int source_id, int generation, int speed,
                 unsigned long long offset, void *payload, size_t length)
 {
         int ext_tcode;
 
+        if (tcode == TCODE_STREAM_DATA) {
+                packet->header[0] =
+                        HEADER_DATA_LENGTH(length) |
+                        destination_id |
+                        HEADER_TCODE(TCODE_STREAM_DATA);
+                packet->header_length = 4;
+                packet->payload = payload;
+                packet->payload_length = length;
+
+                goto common;
+        }
+
         if (tcode > 0x10) {
                 ext_tcode = tcode & ~0x10;
                 tcode = TCODE_LOCK_REQUEST;
@@ -204,7 +211,7 @@ fw_fill_request(struct fw_packet *packet, int tcode, int tlabel,
                 packet->payload_length = 0;
                 break;
         }
-
+ common:
         packet->speed = speed;
         packet->generation = generation;
         packet->ack = 0;
@@ -246,13 +253,14 @@ fw_fill_request(struct fw_packet *packet, int tcode, int tlabel,
  * @param callback function to be called when the transaction is completed
  * @param callback_data pointer to arbitrary data, which will be
  *   passed to the callback
+ *
+ * In case of asynchronous stream packets i.e. TCODE_STREAM_DATA, the caller
+ * needs to synthesize @destination_id with fw_stream_packet_destination_id().
  */
-void
-fw_send_request(struct fw_card *card, struct fw_transaction *t,
-                int tcode, int destination_id, int generation, int speed,
-                unsigned long long offset,
-                void *payload, size_t length,
-                fw_transaction_callback_t callback, void *callback_data)
+void fw_send_request(struct fw_card *card, struct fw_transaction *t, int tcode,
+                     int destination_id, int generation, int speed,
+                     unsigned long long offset, void *payload, size_t length,
+                     fw_transaction_callback_t callback, void *callback_data)
 {
         unsigned long flags;
         int tlabel;
@@ -322,16 +330,16 @@ static void transaction_callback(struct fw_card *card, int rcode,
  * Returns the RCODE.
  */
 int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
-                int generation, int speed, unsigned long long offset,
-                void *data, size_t length)
+                       int generation, int speed, unsigned long long offset,
+                       void *payload, size_t length)
 {
         struct transaction_callback_data d;
         struct fw_transaction t;
 
         init_completion(&d.done);
-        d.payload = data;
+        d.payload = payload;
         fw_send_request(card, &t, tcode, destination_id, generation, speed,
-                        offset, data, length, transaction_callback, &d);
+                        offset, payload, length, transaction_callback, &d);
         wait_for_completion(&d.done);
 
         return d.rcode;
@@ -399,9 +407,8 @@ void fw_flush_transactions(struct fw_card *card)
         }
 }
 
-static struct fw_address_handler *
-lookup_overlapping_address_handler(struct list_head *list,
-                                   unsigned long long offset, size_t length)
+static struct fw_address_handler *lookup_overlapping_address_handler(
+        struct list_head *list, unsigned long long offset, size_t length)
 {
         struct fw_address_handler *handler;
 
@@ -414,9 +421,8 @@ lookup_overlapping_address_handler(struct list_head *list,
         return NULL;
 }
 
-static struct fw_address_handler *
-lookup_enclosing_address_handler(struct list_head *list,
-                                 unsigned long long offset, size_t length)
+static struct fw_address_handler *lookup_enclosing_address_handler(
+        struct list_head *list, unsigned long long offset, size_t length)
 {
         struct fw_address_handler *handler;
 
@@ -449,36 +455,44 @@ const struct fw_address_region fw_unit_space_region =
 #endif  /*  0  */
 
 /**
- * Allocate a range of addresses in the node space of the OHCI
- * controller.  When a request is received that falls within the
- * specified address range, the specified callback is invoked.  The
- * parameters passed to the callback give the details of the
- * particular request.
+ * fw_core_add_address_handler - register for incoming requests
+ * @handler: callback
+ * @region: region in the IEEE 1212 node space address range
+ *
+ * region->start, ->end, and handler->length have to be quadlet-aligned.
+ *
+ * When a request is received that falls within the specified address range,
+ * the specified callback is invoked.  The parameters passed to the callback
+ * give the details of the particular request.
  *
  * Return value:  0 on success, non-zero otherwise.
  * The start offset of the handler's address region is determined by
  * fw_core_add_address_handler() and is returned in handler->offset.
- * The offset is quadlet-aligned.
  */
-int
-fw_core_add_address_handler(struct fw_address_handler *handler,
-                            const struct fw_address_region *region)
+int fw_core_add_address_handler(struct fw_address_handler *handler,
+                                const struct fw_address_region *region)
 {
         struct fw_address_handler *other;
         unsigned long flags;
         int ret = -EBUSY;
 
+        if (region->start & 0xffff000000000003ULL ||
+            region->end   & 0xffff000000000003ULL ||
+            region->start >= region->end ||
+            handler->length & 3 ||
+            handler->length == 0)
+                return -EINVAL;
+
         spin_lock_irqsave(&address_handler_lock, flags);
 
-        handler->offset = roundup(region->start, 4);
+        handler->offset = region->start;
         while (handler->offset + handler->length <= region->end) {
                 other =
                     lookup_overlapping_address_handler(&address_handler_list,
                                                        handler->offset,
                                                        handler->length);
                 if (other != NULL) {
-                        handler->offset =
-                            roundup(other->offset + other->length, 4);
+                        handler->offset += other->length;
                 } else {
                         list_add_tail(&handler->link, &address_handler_list);
                         ret = 0;
@@ -493,12 +507,7 @@ fw_core_add_address_handler(struct fw_address_handler *handler,
 EXPORT_SYMBOL(fw_core_add_address_handler);
 
 /**
- * Deallocate a range of addresses allocated with fw_allocate.  This
- * will call the associated callback one last time with a the special
- * tcode TCODE_DEALLOCATE, to let the client destroy the registered
- * callback data.  For convenience, the callback parameters offset and
- * length are set to the start and the length respectively for the
- * deallocated region, payload is set to NULL.
+ * fw_core_remove_address_handler - unregister an address handler
  */
 void fw_core_remove_address_handler(struct fw_address_handler *handler)
 {
@@ -518,9 +527,8 @@ struct fw_request {
         u32 data[0];
 };
 
-static void
-free_response_callback(struct fw_packet *packet,
-                       struct fw_card *card, int status)
+static void free_response_callback(struct fw_packet *packet,
+                                   struct fw_card *card, int status)
 {
         struct fw_request *request;
 
@@ -528,9 +536,8 @@ free_response_callback(struct fw_packet *packet,
         kfree(request);
 }
 
-void
-fw_fill_response(struct fw_packet *response, u32 *request_header,
-                 int rcode, void *payload, size_t length)
+void fw_fill_response(struct fw_packet *response, u32 *request_header,
+                      int rcode, void *payload, size_t length)
 {
         int tcode, tlabel, extended_tcode, source, destination;
 
@@ -588,8 +595,7 @@ fw_fill_response(struct fw_packet *response, u32 *request_header,
 }
 EXPORT_SYMBOL(fw_fill_response);
 
-static struct fw_request *
-allocate_request(struct fw_packet *p)
+static struct fw_request *allocate_request(struct fw_packet *p)
 {
         struct fw_request *request;
         u32 *data, length;
@@ -649,8 +655,8 @@ allocate_request(struct fw_packet *p)
         return request;
 }
 
-void
-fw_send_response(struct fw_card *card, struct fw_request *request, int rcode)
+void fw_send_response(struct fw_card *card,
+                      struct fw_request *request, int rcode)
 {
         /* unified transaction or broadcast transaction: don't respond */
         if (request->ack != ACK_PENDING ||
@@ -670,8 +676,7 @@ fw_send_response(struct fw_card *card, struct fw_request *request, int rcode)
 }
 EXPORT_SYMBOL(fw_send_response);
 
-void
-fw_core_handle_request(struct fw_card *card, struct fw_packet *p)
+void fw_core_handle_request(struct fw_card *card, struct fw_packet *p)
 {
         struct fw_address_handler *handler;
         struct fw_request *request;
@@ -719,8 +724,7 @@ fw_core_handle_request(struct fw_card *card, struct fw_packet *p)
 }
 EXPORT_SYMBOL(fw_core_handle_request);
 
-void
-fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
+void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
 {
         struct fw_transaction *t;
         unsigned long flags;
@@ -793,12 +797,10 @@ static const struct fw_address_region topology_map_region =
         { .start = CSR_REGISTER_BASE | CSR_TOPOLOGY_MAP,
           .end   = CSR_REGISTER_BASE | CSR_TOPOLOGY_MAP_END, };
 
-static void
-handle_topology_map(struct fw_card *card, struct fw_request *request,
-                    int tcode, int destination, int source,
-                    int generation, int speed,
-                    unsigned long long offset,
-                    void *payload, size_t length, void *callback_data)
+static void handle_topology_map(struct fw_card *card, struct fw_request *request,
+                int tcode, int destination, int source, int generation,
+                int speed, unsigned long long offset,
+                void *payload, size_t length, void *callback_data)
 {
         int i, start, end;
         __be32 *map;
@@ -832,12 +834,10 @@ static const struct fw_address_region registers_region =
         { .start = CSR_REGISTER_BASE,
           .end   = CSR_REGISTER_BASE | CSR_CONFIG_ROM, };
 
-static void
-handle_registers(struct fw_card *card, struct fw_request *request,
-                 int tcode, int destination, int source,
-                 int generation, int speed,
-                 unsigned long long offset,
-                 void *payload, size_t length, void *callback_data)
+static void handle_registers(struct fw_card *card, struct fw_request *request,
+                int tcode, int destination, int source, int generation,
+                int speed, unsigned long long offset,
+                void *payload, size_t length, void *callback_data)
 {
         int reg = offset & ~CSR_REGISTER_BASE;
         unsigned long long bus_time;
@@ -939,11 +939,11 @@ static struct fw_descriptor model_id_descriptor = {
 
 static int __init fw_core_init(void)
 {
-        int retval;
+        int ret;
 
-        retval = bus_register(&fw_bus_type);
-        if (retval < 0)
-                return retval;
+        ret = bus_register(&fw_bus_type);
+        if (ret < 0)
+                return ret;
 
         fw_cdev_major = register_chrdev(0, "firewire", &fw_device_ops);
         if (fw_cdev_major < 0) {
@@ -951,19 +951,10 @@ static int __init fw_core_init(void)
                 return fw_cdev_major;
         }
 
-        retval = fw_core_add_address_handler(&topology_map,
-                                             &topology_map_region);
-        BUG_ON(retval < 0);
-
-        retval = fw_core_add_address_handler(&registers,
-                                             &registers_region);
-        BUG_ON(retval < 0);
-
-        /* Add the vendor textual descriptor. */
-        retval = fw_core_add_descriptor(&vendor_id_descriptor);
-        BUG_ON(retval < 0);
-        retval = fw_core_add_descriptor(&model_id_descriptor);
-        BUG_ON(retval < 0);
+        fw_core_add_address_handler(&topology_map, &topology_map_region);
+        fw_core_add_address_handler(&registers, &registers_region);
+        fw_core_add_descriptor(&vendor_id_descriptor);
+        fw_core_add_descriptor(&model_id_descriptor);
 
         return 0;
 }
diff --git a/drivers/firewire/fw-transaction.h b/drivers/firewire/fw-transaction.h
index 1d78e9cc5940..dfa799068f89 100644
--- a/drivers/firewire/fw-transaction.h
+++ b/drivers/firewire/fw-transaction.h
@@ -82,14 +82,14 @@
 #define CSR_SPEED_MAP                   0x2000
 #define CSR_SPEED_MAP_END               0x3000
 
+#define BANDWIDTH_AVAILABLE_INITIAL     4915
 #define BROADCAST_CHANNEL_INITIAL       (1 << 31 | 31)
 #define BROADCAST_CHANNEL_VALID         (1 << 30)
 
 #define fw_notify(s, args...) printk(KERN_NOTICE KBUILD_MODNAME ": " s, ## args)
 #define fw_error(s, args...) printk(KERN_ERR KBUILD_MODNAME ": " s, ## args)
 
-static inline void
-fw_memcpy_from_be32(void *_dst, void *_src, size_t size)
+static inline void fw_memcpy_from_be32(void *_dst, void *_src, size_t size)
 {
         u32    *dst = _dst;
         __be32 *src = _src;
@@ -99,8 +99,7 @@ fw_memcpy_from_be32(void *_dst, void *_src, size_t size)
                 dst[i] = be32_to_cpu(src[i]);
 }
 
-static inline void
-fw_memcpy_to_be32(void *_dst, void *_src, size_t size)
+static inline void fw_memcpy_to_be32(void *_dst, void *_src, size_t size)
 {
         fw_memcpy_from_be32(_dst, _src, size);
 }
@@ -125,8 +124,7 @@ typedef void (*fw_packet_callback_t)(struct fw_packet *packet,
                                      struct fw_card *card, int status);
 
 typedef void (*fw_transaction_callback_t)(struct fw_card *card, int rcode,
-                                          void *data,
-                                          size_t length,
+                                          void *data, size_t length,
                                           void *callback_data);
 
 /*
@@ -141,12 +139,6 @@ typedef void (*fw_address_callback_t)(struct fw_card *card,
                                       void *data, size_t length,
                                       void *callback_data);
 
-typedef void (*fw_bus_reset_callback_t)(struct fw_card *handle,
-                                        int node_id, int generation,
-                                        u32 *self_ids,
-                                        int self_id_count,
-                                        void *callback_data);
-
 struct fw_packet {
         int speed;
         int generation;
@@ -187,12 +179,6 @@ struct fw_transaction {
         void *callback_data;
 };
 
-static inline struct fw_packet *
-fw_packet(struct list_head *l)
-{
-        return list_entry(l, struct fw_packet, link);
-}
-
 struct fw_address_handler {
         u64 offset;
         size_t length;
@@ -201,7 +187,6 @@ struct fw_address_handler {
         struct list_head link;
 };
 
-
 struct fw_address_region {
         u64 start;
         u64 end;
@@ -255,6 +240,7 @@ struct fw_card {
         int bm_retries;
         int bm_generation;
 
+        bool broadcast_channel_allocated;
         u32 broadcast_channel;
         u32 topology_map[(CSR_TOPOLOGY_MAP_END - CSR_TOPOLOGY_MAP) / 4];
 };
@@ -315,10 +301,8 @@ struct fw_iso_packet {
 struct fw_iso_context;
 
 typedef void (*fw_iso_callback_t)(struct fw_iso_context *context,
-                                  u32 cycle,
-                                  size_t header_length,
-                                  void *header,
-                                  void *data);
+                                  u32 cycle, size_t header_length,
+                                  void *header, void *data);
 
 /*
  * An iso buffer is just a set of pages mapped for DMA in the
@@ -344,36 +328,25 @@ struct fw_iso_context {
         void *callback_data;
 };
 
-int
-fw_iso_buffer_init(struct fw_iso_buffer *buffer,
-                   struct fw_card *card,
-                   int page_count,
-                   enum dma_data_direction direction);
-int
-fw_iso_buffer_map(struct fw_iso_buffer *buffer, struct vm_area_struct *vma);
-void
-fw_iso_buffer_destroy(struct fw_iso_buffer *buffer, struct fw_card *card);
-
-struct fw_iso_context *
-fw_iso_context_create(struct fw_card *card, int type,
-                      int channel, int speed, size_t header_size,
-                      fw_iso_callback_t callback, void *callback_data);
-
-void
-fw_iso_context_destroy(struct fw_iso_context *ctx);
-
-int
-fw_iso_context_queue(struct fw_iso_context *ctx,
-                     struct fw_iso_packet *packet,
-                     struct fw_iso_buffer *buffer,
-                     unsigned long payload);
-
-int
-fw_iso_context_start(struct fw_iso_context *ctx,
-                     int cycle, int sync, int tags);
-
-int
-fw_iso_context_stop(struct fw_iso_context *ctx);
+int fw_iso_buffer_init(struct fw_iso_buffer *buffer, struct fw_card *card,
+                       int page_count, enum dma_data_direction direction);
+int fw_iso_buffer_map(struct fw_iso_buffer *buffer, struct vm_area_struct *vma);
+void fw_iso_buffer_destroy(struct fw_iso_buffer *buffer, struct fw_card *card);
+
+struct fw_iso_context *fw_iso_context_create(struct fw_card *card,
+                int type, int channel, int speed, size_t header_size,
+                fw_iso_callback_t callback, void *callback_data);
+int fw_iso_context_queue(struct fw_iso_context *ctx,
+                         struct fw_iso_packet *packet,
+                         struct fw_iso_buffer *buffer,
+                         unsigned long payload);
+int fw_iso_context_start(struct fw_iso_context *ctx,
+                         int cycle, int sync, int tags);
+int fw_iso_context_stop(struct fw_iso_context *ctx);
+void fw_iso_context_destroy(struct fw_iso_context *ctx);
+
+void fw_iso_resource_manage(struct fw_card *card, int generation,
+                u64 channels_mask, int *channel, int *bandwidth, bool allocate);
 
 struct fw_card_driver {
         /*
@@ -415,7 +388,7 @@ struct fw_card_driver {
 
         struct fw_iso_context *
         (*allocate_iso_context)(struct fw_card *card,
-                                int type, size_t header_size);
+                                int type, int channel, size_t header_size);
         void (*free_iso_context)(struct fw_iso_context *ctx);
 
         int (*start_iso)(struct fw_iso_context *ctx,
@@ -429,54 +402,45 @@ struct fw_card_driver {
         int (*stop_iso)(struct fw_iso_context *ctx);
 };
 
-int
-fw_core_initiate_bus_reset(struct fw_card *card, int short_reset);
+int fw_core_initiate_bus_reset(struct fw_card *card, int short_reset);
 
-void
-fw_send_request(struct fw_card *card, struct fw_transaction *t,
+void fw_send_request(struct fw_card *card, struct fw_transaction *t,
                 int tcode, int destination_id, int generation, int speed,
-                unsigned long long offset, void *data, size_t length,
+                unsigned long long offset, void *payload, size_t length,
                 fw_transaction_callback_t callback, void *callback_data);
-
-int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
-                       int generation, int speed, unsigned long long offset,
-                       void *data, size_t length);
-
 int fw_cancel_transaction(struct fw_card *card,
                           struct fw_transaction *transaction);
-
 void fw_flush_transactions(struct fw_card *card);
-
+int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
+                       int generation, int speed, unsigned long long offset,
+                       void *payload, size_t length);
 void fw_send_phy_config(struct fw_card *card,
                         int node_id, int generation, int gap_count);
 
+static inline int fw_stream_packet_destination_id(int tag, int channel, int sy)
+{
+        return tag << 14 | channel << 8 | sy;
+}
+
 /*
  * Called by the topology code to inform the device code of node
  * activity; found, lost, or updated nodes.
  */
-void
-fw_node_event(struct fw_card *card, struct fw_node *node, int event);
+void fw_node_event(struct fw_card *card, struct fw_node *node, int event);
 
 /* API used by card level drivers */
 
-void
-fw_card_initialize(struct fw_card *card, const struct fw_card_driver *driver,
-                   struct device *device);
-int
-fw_card_add(struct fw_card *card,
-            u32 max_receive, u32 link_speed, u64 guid);
-
-void
-fw_core_remove_card(struct fw_card *card);
-
-void
-fw_core_handle_bus_reset(struct fw_card *card,
-                         int node_id, int generation,
-                         int self_id_count, u32 *self_ids);
-void
-fw_core_handle_request(struct fw_card *card, struct fw_packet *request);
-
-void
-fw_core_handle_response(struct fw_card *card, struct fw_packet *packet);
+void fw_card_initialize(struct fw_card *card,
+                const struct fw_card_driver *driver, struct device *device);
+int fw_card_add(struct fw_card *card,
+                u32 max_receive, u32 link_speed, u64 guid);
+void fw_core_remove_card(struct fw_card *card);
+void fw_core_handle_bus_reset(struct fw_card *card, int node_id,
+                int generation, int self_id_count, u32 *self_ids);
+void fw_core_handle_request(struct fw_card *card, struct fw_packet *request);
+void fw_core_handle_response(struct fw_card *card, struct fw_packet *packet);
+
+extern int fw_irm_set_broadcast_channel_register(struct device *dev,
+                                                 void *data);
 
 #endif /* __fw_transaction_h */
diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile
index 30022c4a5c12..4ec5061fa584 100644
--- a/drivers/gpu/drm/Makefile
+++ b/drivers/gpu/drm/Makefile
@@ -10,7 +10,8 @@ drm-y       :=	drm_auth.o drm_bufs.o drm_cache.o \
                 drm_lock.o drm_memory.o drm_proc.o drm_stub.o drm_vm.o \
                 drm_agpsupport.o drm_scatter.o ati_pcigart.o drm_pci.o \
                 drm_sysfs.o drm_hashtab.o drm_sman.o drm_mm.o \
-                drm_crtc.o drm_crtc_helper.o drm_modes.o drm_edid.o
+                drm_crtc.o drm_crtc_helper.o drm_modes.o drm_edid.o \
+                drm_info.o drm_debugfs.o
 
 drm-$(CONFIG_COMPAT) += drm_ioc32.o
 
diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
new file mode 100644
index 000000000000..c77c6c6d9d2c
--- /dev/null
+++ b/drivers/gpu/drm/drm_debugfs.c
@@ -0,0 +1,235 @@
+/**
+ * \file drm_debugfs.c
+ * debugfs support for DRM
+ *
+ * \author Ben Gamari <bgamari@gmail.com>
+ */
+
+/*
+ * Created: Sun Dec 21 13:08:50 2008 by bgamari@gmail.com
+ *
+ * Copyright 2008 Ben Gamari <bgamari@gmail.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include "drmP.h"
+
+#if defined(CONFIG_DEBUG_FS)
+
+/***************************************************
+ * Initialization, etc.
+ **************************************************/
+
+static struct drm_info_list drm_debugfs_list[] = {
+        {"name", drm_name_info, 0},
+        {"vm", drm_vm_info, 0},
+        {"clients", drm_clients_info, 0},
+        {"queues", drm_queues_info, 0},
+        {"bufs", drm_bufs_info, 0},
+        {"gem_names", drm_gem_name_info, DRIVER_GEM},
+        {"gem_objects", drm_gem_object_info, DRIVER_GEM},
+#if DRM_DEBUG_CODE
+        {"vma", drm_vma_info, 0},
+#endif
+};
+#define DRM_DEBUGFS_ENTRIES ARRAY_SIZE(drm_debugfs_list)
+
+
+static int drm_debugfs_open(struct inode *inode, struct file *file)
+{
+        struct drm_info_node *node = inode->i_private;
+
+        return single_open(file, node->info_ent->show, node);
+}
+
+
+static const struct file_operations drm_debugfs_fops = {
+        .owner = THIS_MODULE,
+        .open = drm_debugfs_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
+
+
+/**
+ * Initialize a given set of debugfs files for a device
+ *
+ * \param files The array of files to create
+ * \param count The number of files given
+ * \param root DRI debugfs dir entry.
+ * \param minor device minor number
+ * \return Zero on success, non-zero on failure
+ *
+ * Create a given set of debugfs files represented by an array of
+ * gdm_debugfs_lists in the given root directory.
+ */
+int drm_debugfs_create_files(struct drm_info_list *files, int count,
+                             struct dentry *root, struct drm_minor *minor)
+{
+        struct drm_device *dev = minor->dev;
+        struct dentry *ent;
+        struct drm_info_node *tmp;
+        char name[64];
+        int i, ret;
+
+        for (i = 0; i < count; i++) {
+                u32 features = files[i].driver_features;
+
+                if (features != 0 &&
+                    (dev->driver->driver_features & features) != features)
+                        continue;
+
+                tmp = drm_alloc(sizeof(struct drm_info_node),
+                                _DRM_DRIVER);
+                ent = debugfs_create_file(files[i].name, S_IFREG | S_IRUGO,
+                                          root, tmp, &drm_debugfs_fops);
+                if (!ent) {
+                        DRM_ERROR("Cannot create /debugfs/dri/%s/%s\n",
+                                  name, files[i].name);
+                        drm_free(tmp, sizeof(struct drm_info_node),
+                                 _DRM_DRIVER);
+                        ret = -1;
+                        goto fail;
+                }
+
+                tmp->minor = minor;
+                tmp->dent = ent;
+                tmp->info_ent = &files[i];
+                list_add(&(tmp->list), &(minor->debugfs_nodes.list));
+        }
+        return 0;
+
+fail:
+        drm_debugfs_remove_files(files, count, minor);
+        return ret;
+}
+EXPORT_SYMBOL(drm_debugfs_create_files);
+
+/**
+ * Initialize the DRI debugfs filesystem for a device
+ *
+ * \param dev DRM device
+ * \param minor device minor number
+ * \param root DRI debugfs dir entry.
+ *
+ * Create the DRI debugfs root entry "/debugfs/dri", the device debugfs root entry
+ * "/debugfs/dri/%minor%/", and each entry in debugfs_list as
+ * "/debugfs/dri/%minor%/%name%".
+ */
+int drm_debugfs_init(struct drm_minor *minor, int minor_id,
+                     struct dentry *root)
+{
+        struct drm_device *dev = minor->dev;
+        char name[64];
+        int ret;
+
+        INIT_LIST_HEAD(&minor->debugfs_nodes.list);
+        sprintf(name, "%d", minor_id);
+        minor->debugfs_root = debugfs_create_dir(name, root);
+        if (!minor->debugfs_root) {
+                DRM_ERROR("Cannot create /debugfs/dri/%s\n", name);
+                return -1;
+        }
+
+        ret = drm_debugfs_create_files(drm_debugfs_list, DRM_DEBUGFS_ENTRIES,
+                                       minor->debugfs_root, minor);
+        if (ret) {
+                debugfs_remove(minor->debugfs_root);
+                minor->debugfs_root = NULL;
+                DRM_ERROR("Failed to create core drm debugfs files\n");
+                return ret;
+        }
+
+        if (dev->driver->debugfs_init) {
+                ret = dev->driver->debugfs_init(minor);
+                if (ret) {
+                        DRM_ERROR("DRM: Driver failed to initialize "
+                                  "/debugfs/dri.\n");
+                        return ret;
+                }
+        }
+        return 0;
+}
+
+
+/**
+ * Remove a list of debugfs files
+ *
+ * \param files The list of files
+ * \param count The number of files
+ * \param minor The minor of which we should remove the files
+ * \return always zero.
+ *
+ * Remove all debugfs entries created by debugfs_init().
+ */
+int drm_debugfs_remove_files(struct drm_info_list *files, int count,
+                             struct drm_minor *minor)
+{
+        struct list_head *pos, *q;
+        struct drm_info_node *tmp;
+        int i;
+
+        for (i = 0; i < count; i++) {
+                list_for_each_safe(pos, q, &minor->debugfs_nodes.list) {
+                        tmp = list_entry(pos, struct drm_info_node, list);
+                        if (tmp->info_ent == &files[i]) {
+                                debugfs_remove(tmp->dent);
+                                list_del(pos);
+                                drm_free(tmp, sizeof(struct drm_info_node),
+                                         _DRM_DRIVER);
+                        }
+                }
+        }
+        return 0;
+}
+EXPORT_SYMBOL(drm_debugfs_remove_files);
+
+/**
+ * Cleanup the debugfs filesystem resources.
+ *
+ * \param minor device minor number.
+ * \return always zero.
+ *
+ * Remove all debugfs entries created by debugfs_init().
+ */
+int drm_debugfs_cleanup(struct drm_minor *minor)
+{
+        struct drm_device *dev = minor->dev;
+
+        if (!minor->debugfs_root)
+                return 0;
+
+        if (dev->driver->debugfs_cleanup)
+                dev->driver->debugfs_cleanup(minor);
+
+        drm_debugfs_remove_files(drm_debugfs_list, DRM_DEBUGFS_ENTRIES, minor);
+
+        debugfs_remove(minor->debugfs_root);
+        minor->debugfs_root = NULL;
+
+        return 0;
+}
+
+#endif /* CONFIG_DEBUG_FS */
+
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 14c7a23dc157..ed32edb17166 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -46,9 +46,11 @@
  * OTHER DEALINGS IN THE SOFTWARE.
  */
 
+#include <linux/debugfs.h>
 #include "drmP.h"
 #include "drm_core.h"
 
+
 static int drm_version(struct drm_device *dev, void *data,
                        struct drm_file *file_priv);
 
@@ -178,7 +180,7 @@ int drm_lastclose(struct drm_device * dev)
 
         /* Clear AGP information */
         if (drm_core_has_AGP(dev) && dev->agp &&
-            !drm_core_check_feature(dev, DRIVER_MODESET)) {
+                        !drm_core_check_feature(dev, DRIVER_MODESET)) {
                 struct drm_agp_mem *entry, *tempe;
 
                 /* Remove AGP resources, but leave dev->agp
@@ -382,6 +384,13 @@ static int __init drm_core_init(void)
                 goto err_p3;
         }
 
+        drm_debugfs_root = debugfs_create_dir("dri", NULL);
+        if (!drm_debugfs_root) {
+                DRM_ERROR("Cannot create /debugfs/dri\n");
+                ret = -1;
+                goto err_p3;
+        }
+
         drm_mem_init();
 
         DRM_INFO("Initialized %s %d.%d.%d %s\n",
@@ -400,6 +409,7 @@ err_p1:
 static void __exit drm_core_exit(void)
 {
         remove_proc_entry("dri", NULL);
+        debugfs_remove(drm_debugfs_root);
         drm_sysfs_destroy();
 
         unregister_chrdev(DRM_MAJOR, "drm");
diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
new file mode 100644
index 000000000000..1b699768ccfb
--- /dev/null
+++ b/drivers/gpu/drm/drm_info.c
@@ -0,0 +1,328 @@
+/**
+ * \file drm_info.c
+ * DRM info file implementations
+ *
+ * \author Ben Gamari <bgamari@gmail.com>
+ */
+
+/*
+ * Created: Sun Dec 21 13:09:50 2008 by bgamari@gmail.com
+ *
+ * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
+ * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
+ * Copyright 2008 Ben Gamari <bgamari@gmail.com>
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <linux/seq_file.h>
+#include "drmP.h"
+
+/**
+ * Called when "/proc/dri/.../name" is read.
+ *
+ * Prints the device name together with the bus id if available.
+ */
+int drm_name_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_minor *minor = node->minor;
+        struct drm_device *dev = minor->dev;
+        struct drm_master *master = minor->master;
+
+        if (!master)
+                return 0;
+
+        if (master->unique) {
+                seq_printf(m, "%s %s %s\n",
+                           dev->driver->pci_driver.name,
+                           pci_name(dev->pdev), master->unique);
+        } else {
+                seq_printf(m, "%s %s\n", dev->driver->pci_driver.name,
+                           pci_name(dev->pdev));
+        }
+
+        return 0;
+}
+
+/**
+ * Called when "/proc/dri/.../vm" is read.
+ *
+ * Prints information about all mappings in drm_device::maplist.
+ */
+int drm_vm_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        struct drm_map *map;
+        struct drm_map_list *r_list;
+
+        /* Hardcoded from _DRM_FRAME_BUFFER,
+           _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
+           _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
+        const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
+        const char *type;
+        int i;
+
+        mutex_lock(&dev->struct_mutex);
+        seq_printf(m, "slot      offset       size type flags    address mtrr\n\n");
+        i = 0;
+        list_for_each_entry(r_list, &dev->maplist, head) {
+                map = r_list->map;
+                if (!map)
+                        continue;
+                if (map->type < 0 || map->type > 5)
+                        type = "??";
+                else
+                        type = types[map->type];
+
+                seq_printf(m, "%4d 0x%08lx 0x%08lx %4.4s  0x%02x 0x%08lx ",
+                           i,
+                           map->offset,
+                           map->size, type, map->flags,
+                           (unsigned long) r_list->user_token);
+                if (map->mtrr < 0)
+                        seq_printf(m, "none\n");
+                else
+                        seq_printf(m, "%4d\n", map->mtrr);
+                i++;
+        }
+        mutex_unlock(&dev->struct_mutex);
+        return 0;
+}
+
+/**
+ * Called when "/proc/dri/.../queues" is read.
+ */
+int drm_queues_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        int i;
+        struct drm_queue *q;
+
+        mutex_lock(&dev->struct_mutex);
+        seq_printf(m, "  ctx/flags   use   fin"
+                   "   blk/rw/rwf  wait    flushed         queued"
+                   "      locks\n\n");
+        for (i = 0; i < dev->queue_count; i++) {
+                q = dev->queuelist[i];
+                atomic_inc(&q->use_count);
+                seq_printf(m,   "%5d/0x%03x %5d %5d"
+                           " %5d/%c%c/%c%c%c %5Zd\n",
+                           i,
+                           q->flags,
+                           atomic_read(&q->use_count),
+                           atomic_read(&q->finalization),
+                           atomic_read(&q->block_count),
+                           atomic_read(&q->block_read) ? 'r' : '-',
+                           atomic_read(&q->block_write) ? 'w' : '-',
+                           waitqueue_active(&q->read_queue) ? 'r' : '-',
+                           waitqueue_active(&q->write_queue) ? 'w' : '-',
+                           waitqueue_active(&q->flush_queue) ? 'f' : '-',
+                           DRM_BUFCOUNT(&q->waitlist));
+                atomic_dec(&q->use_count);
+        }
+        mutex_unlock(&dev->struct_mutex);
+        return 0;
+}
+
+/**
+ * Called when "/proc/dri/.../bufs" is read.
+ */
+int drm_bufs_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        struct drm_device_dma *dma;
+        int i, seg_pages;
+
+        mutex_lock(&dev->struct_mutex);
+        dma = dev->dma;
+        if (!dma) {
+                mutex_unlock(&dev->struct_mutex);
+                return 0;
+        }
+
+        seq_printf(m, " o     size count  free   segs pages    kB\n\n");
+        for (i = 0; i <= DRM_MAX_ORDER; i++) {
+                if (dma->bufs[i].buf_count) {
+                        seg_pages = dma->bufs[i].seg_count * (1 << dma->bufs[i].page_order);
+                        seq_printf(m, "%2d %8d %5d %5d %5d %5d %5ld\n",
+                                   i,
+                                   dma->bufs[i].buf_size,
+                                   dma->bufs[i].buf_count,
+                                   atomic_read(&dma->bufs[i].freelist.count),
+                                   dma->bufs[i].seg_count,
+                                   seg_pages,
+                                   seg_pages * PAGE_SIZE / 1024);
+                }
+        }
+        seq_printf(m, "\n");
+        for (i = 0; i < dma->buf_count; i++) {
+                if (i && !(i % 32))
+                        seq_printf(m, "\n");
+                seq_printf(m, " %d", dma->buflist[i]->list);
+        }
+        seq_printf(m, "\n");
+        mutex_unlock(&dev->struct_mutex);
+        return 0;
+}
+
+/**
+ * Called when "/proc/dri/.../vblank" is read.
+ */
+int drm_vblank_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        int crtc;
+
+        mutex_lock(&dev->struct_mutex);
+        for (crtc = 0; crtc < dev->num_crtcs; crtc++) {
+                seq_printf(m, "CRTC %d enable:     %d\n",
+                           crtc, atomic_read(&dev->vblank_refcount[crtc]));
+                seq_printf(m, "CRTC %d counter:    %d\n",
+                           crtc, drm_vblank_count(dev, crtc));
+                seq_printf(m, "CRTC %d last wait:  %d\n",
+                           crtc, dev->last_vblank_wait[crtc]);
+                seq_printf(m, "CRTC %d in modeset: %d\n",
+                           crtc, dev->vblank_inmodeset[crtc]);
+        }
+        mutex_unlock(&dev->struct_mutex);
+        return 0;
+}
+
+/**
+ * Called when "/proc/dri/.../clients" is read.
+ *
+ */
+int drm_clients_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        struct drm_file *priv;
+
+        mutex_lock(&dev->struct_mutex);
+        seq_printf(m, "a dev    pid    uid      magic     ioctls\n\n");
+        list_for_each_entry(priv, &dev->filelist, lhead) {
+                seq_printf(m, "%c %3d %5d %5d %10u %10lu\n",
+                           priv->authenticated ? 'y' : 'n',
+                           priv->minor->index,
+                           priv->pid,
+                           priv->uid, priv->magic, priv->ioctl_count);
+        }
+        mutex_unlock(&dev->struct_mutex);
+        return 0;
+}
+
+
+int drm_gem_one_name_info(int id, void *ptr, void *data)
+{
+        struct drm_gem_object *obj = ptr;
+        struct seq_file *m = data;
+
+        seq_printf(m, "name %d size %zd\n", obj->name, obj->size);
+
+        seq_printf(m, "%6d %8zd %7d %8d\n",
+                   obj->name, obj->size,
+                   atomic_read(&obj->handlecount.refcount),
+                   atomic_read(&obj->refcount.refcount));
+        return 0;
+}
+
+int drm_gem_name_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+
+        seq_printf(m, "  name     size handles refcount\n");
+        idr_for_each(&dev->object_name_idr, drm_gem_one_name_info, m);
+        return 0;
+}
+
+int drm_gem_object_info(struct seq_file *m, void* data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+
+        seq_printf(m, "%d objects\n", atomic_read(&dev->object_count));
+        seq_printf(m, "%d object bytes\n", atomic_read(&dev->object_memory));
+        seq_printf(m, "%d pinned\n", atomic_read(&dev->pin_count));
+        seq_printf(m, "%d pin bytes\n", atomic_read(&dev->pin_memory));
+        seq_printf(m, "%d gtt bytes\n", atomic_read(&dev->gtt_memory));
+        seq_printf(m, "%d gtt total\n", dev->gtt_total);
+        return 0;
+}
+
+#if DRM_DEBUG_CODE
+
+int drm_vma_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        struct drm_vma_entry *pt;
+        struct vm_area_struct *vma;
+#if defined(__i386__)
+        unsigned int pgprot;
+#endif
+
+        mutex_lock(&dev->struct_mutex);
+        seq_printf(m, "vma use count: %d, high_memory = %p, 0x%08llx\n",
+                   atomic_read(&dev->vma_count),
+                   high_memory, (u64)virt_to_phys(high_memory));
+
+        list_for_each_entry(pt, &dev->vmalist, head) {
+                vma = pt->vma;
+                if (!vma)
+                        continue;
+                seq_printf(m,
+                           "\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000",
+                           pt->pid, vma->vm_start, vma->vm_end,
+                           vma->vm_flags & VM_READ ? 'r' : '-',
+                           vma->vm_flags & VM_WRITE ? 'w' : '-',
+                           vma->vm_flags & VM_EXEC ? 'x' : '-',
+                           vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
+                           vma->vm_flags & VM_LOCKED ? 'l' : '-',
+                           vma->vm_flags & VM_IO ? 'i' : '-',
+                           vma->vm_pgoff);
+
+#if defined(__i386__)
+                pgprot = pgprot_val(vma->vm_page_prot);
+                seq_printf(m, " %c%c%c%c%c%c%c%c%c",
+                           pgprot & _PAGE_PRESENT ? 'p' : '-',
+                           pgprot & _PAGE_RW ? 'w' : 'r',
+                           pgprot & _PAGE_USER ? 'u' : 's',
+                           pgprot & _PAGE_PWT ? 't' : 'b',
+                           pgprot & _PAGE_PCD ? 'u' : 'c',
+                           pgprot & _PAGE_ACCESSED ? 'a' : '-',
+                           pgprot & _PAGE_DIRTY ? 'd' : '-',
+                           pgprot & _PAGE_PSE ? 'm' : 'k',
+                           pgprot & _PAGE_GLOBAL ? 'g' : 'l');
+#endif
+                seq_printf(m, "\n");
+        }
+        mutex_unlock(&dev->struct_mutex);
+        return 0;
+}
+
+#endif
+
diff --git a/drivers/gpu/drm/drm_proc.c b/drivers/gpu/drm/drm_proc.c
index b756f043a5f4..9b3c5af61e98 100644
--- a/drivers/gpu/drm/drm_proc.c
+++ b/drivers/gpu/drm/drm_proc.c
@@ -37,697 +37,196 @@
  * OTHER DEALINGS IN THE SOFTWARE.
  */
 
+#include <linux/seq_file.h>
 #include "drmP.h"
 
-static int drm_name_info(char *buf, char **start, off_t offset,
-                         int request, int *eof, void *data);
-static int drm_vm_info(char *buf, char **start, off_t offset,
-                       int request, int *eof, void *data);
-static int drm_clients_info(char *buf, char **start, off_t offset,
-                            int request, int *eof, void *data);
-static int drm_queues_info(char *buf, char **start, off_t offset,
-                           int request, int *eof, void *data);
-static int drm_bufs_info(char *buf, char **start, off_t offset,
-                         int request, int *eof, void *data);
-static int drm_vblank_info(char *buf, char **start, off_t offset,
-                           int request, int *eof, void *data);
-static int drm_gem_name_info(char *buf, char **start, off_t offset,
-                             int request, int *eof, void *data);
-static int drm_gem_object_info(char *buf, char **start, off_t offset,
-                               int request, int *eof, void *data);
-#if DRM_DEBUG_CODE
-static int drm_vma_info(char *buf, char **start, off_t offset,
-                        int request, int *eof, void *data);
-#endif
+
+/***************************************************
+ * Initialization, etc.
+ **************************************************/
 
 /**
  * Proc file list.
  */
-static struct drm_proc_list {
-        const char *name;       /**< file name */
-        int (*f) (char *, char **, off_t, int, int *, void *);          /**< proc callback*/
-        u32 driver_features; /**< Required driver features for this entry */
-} drm_proc_list[] = {
+static struct drm_info_list drm_proc_list[] = {
         {"name", drm_name_info, 0},
-        {"mem", drm_mem_info, 0},
         {"vm", drm_vm_info, 0},
         {"clients", drm_clients_info, 0},
         {"queues", drm_queues_info, 0},
         {"bufs", drm_bufs_info, 0},
-        {"vblank", drm_vblank_info, 0},
         {"gem_names", drm_gem_name_info, DRIVER_GEM},
         {"gem_objects", drm_gem_object_info, DRIVER_GEM},
 #if DRM_DEBUG_CODE
-        {"vma", drm_vma_info},
+        {"vma", drm_vma_info, 0},
 #endif
 };
-
 #define DRM_PROC_ENTRIES ARRAY_SIZE(drm_proc_list)
 
+static int drm_proc_open(struct inode *inode, struct file *file)
+{
+        struct drm_info_node* node = PDE(inode)->data;
+
+        return single_open(file, node->info_ent->show, node);
+}
+
+static const struct file_operations drm_proc_fops = {
+        .owner = THIS_MODULE,
+        .open = drm_proc_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
+
+
 /**
- * Initialize the DRI proc filesystem for a device.
+ * Initialize a given set of proc files for a device
  *
- * \param dev DRM device.
- * \param minor device minor number.
+ * \param files The array of files to create
+ * \param count The number of files given
  * \param root DRI proc dir entry.
- * \param dev_root resulting DRI device proc dir entry.
- * \return root entry pointer on success, or NULL on failure.
+ * \param minor device minor number
+ * \return Zero on success, non-zero on failure
  *
- * Create the DRI proc root entry "/proc/dri", the device proc root entry
- * "/proc/dri/%minor%/", and each entry in proc_list as
- * "/proc/dri/%minor%/%name%".
+ * Create a given set of proc files represented by an array of
+ * gdm_proc_lists in the given root directory.
  */
-int drm_proc_init(struct drm_minor *minor, int minor_id,
-                  struct proc_dir_entry *root)
+int drm_proc_create_files(struct drm_info_list *files, int count,
+                          struct proc_dir_entry *root, struct drm_minor *minor)
 {
         struct drm_device *dev = minor->dev;
         struct proc_dir_entry *ent;
-        int i, j, ret;
+        struct drm_info_node *tmp;
         char name[64];
+        int i, ret;
 
-        sprintf(name, "%d", minor_id);
-        minor->dev_root = proc_mkdir(name, root);
-        if (!minor->dev_root) {
-                DRM_ERROR("Cannot create /proc/dri/%s\n", name);
-                return -1;
-        }
-
-        for (i = 0; i < DRM_PROC_ENTRIES; i++) {
-                u32 features = drm_proc_list[i].driver_features;
+        for (i = 0; i < count; i++) {
+                u32 features = files[i].driver_features;
 
                 if (features != 0 &&
                     (dev->driver->driver_features & features) != features)
                         continue;
 
-                ent = create_proc_entry(drm_proc_list[i].name,
-                                        S_IFREG | S_IRUGO, minor->dev_root);
+                tmp = drm_alloc(sizeof(struct drm_info_node), _DRM_DRIVER);
+                ent = create_proc_entry(files[i].name, S_IFREG | S_IRUGO, root);
                 if (!ent) {
                         DRM_ERROR("Cannot create /proc/dri/%s/%s\n",
-                                  name, drm_proc_list[i].name);
+                                  name, files[i].name);
+                        drm_free(tmp, sizeof(struct drm_info_node),
+                                 _DRM_DRIVER);
                         ret = -1;
                         goto fail;
                 }
-                ent->read_proc = drm_proc_list[i].f;
-                ent->data = minor;
-        }
 
-        if (dev->driver->proc_init) {
-                ret = dev->driver->proc_init(minor);
-                if (ret) {
-                        DRM_ERROR("DRM: Driver failed to initialize "
-                                  "/proc/dri.\n");
-                        goto fail;
-                }
+                ent->proc_fops = &drm_proc_fops;
+                ent->data = tmp;
+                tmp->minor = minor;
+                tmp->info_ent = &files[i];
+                list_add(&(tmp->list), &(minor->proc_nodes.list));
         }
-
         return 0;
- fail:
 
-        for (j = 0; j < i; j++)
-                remove_proc_entry(drm_proc_list[i].name,
-                                  minor->dev_root);
-        remove_proc_entry(name, root);
-        minor->dev_root = NULL;
+fail:
+        for (i = 0; i < count; i++)
+                remove_proc_entry(drm_proc_list[i].name, minor->proc_root);
         return ret;
 }
 
 /**
- * Cleanup the proc filesystem resources.
+ * Initialize the DRI proc filesystem for a device
  *
- * \param minor device minor number.
+ * \param dev DRM device
+ * \param minor device minor number
  * \param root DRI proc dir entry.
- * \param dev_root DRI device proc dir entry.
- * \return always zero.
+ * \param dev_root resulting DRI device proc dir entry.
+ * \return root entry pointer on success, or NULL on failure.
  *
- * Remove all proc entries created by proc_init().
+ * Create the DRI proc root entry "/proc/dri", the device proc root entry
+ * "/proc/dri/%minor%/", and each entry in proc_list as
+ * "/proc/dri/%minor%/%name%".
  */
-int drm_proc_cleanup(struct drm_minor *minor, struct proc_dir_entry *root)
+int drm_proc_init(struct drm_minor *minor, int minor_id,
+                  struct proc_dir_entry *root)
 {
         struct drm_device *dev = minor->dev;
-        int i;
         char name[64];
+        int ret;
 
-        if (!root || !minor->dev_root)
-                return 0;
-
-        if (dev->driver->proc_cleanup)
-                dev->driver->proc_cleanup(minor);
-
-        for (i = 0; i < DRM_PROC_ENTRIES; i++)
-                remove_proc_entry(drm_proc_list[i].name, minor->dev_root);
-        sprintf(name, "%d", minor->index);
-        remove_proc_entry(name, root);
-
-        return 0;
-}
-
-/**
- * Called when "/proc/dri/.../name" is read.
- *
- * \param buf output buffer.
- * \param start start of output data.
- * \param offset requested start offset.
- * \param request requested number of bytes.
- * \param eof whether there is no more data to return.
- * \param data private data.
- * \return number of written bytes.
- *
- * Prints the device name together with the bus id if available.
- */
-static int drm_name_info(char *buf, char **start, off_t offset, int request,
-                         int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_master *master = minor->master;
-        struct drm_device *dev = minor->dev;
-        int len = 0;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
+        INIT_LIST_HEAD(&minor->proc_nodes.list);
+        sprintf(name, "%d", minor_id);
+        minor->proc_root = proc_mkdir(name, root);
+        if (!minor->proc_root) {
+                DRM_ERROR("Cannot create /proc/dri/%s\n", name);
+                return -1;
         }
 
-        if (!master)
-                return 0;
-
-        *start = &buf[offset];
-        *eof = 0;
-
-        if (master->unique) {
-                DRM_PROC_PRINT("%s %s %s\n",
-                               dev->driver->pci_driver.name,
-                               pci_name(dev->pdev), master->unique);
-        } else {
-                DRM_PROC_PRINT("%s %s\n", dev->driver->pci_driver.name,
-                               pci_name(dev->pdev));
+        ret = drm_proc_create_files(drm_proc_list, DRM_PROC_ENTRIES,
+                                    minor->proc_root, minor);
+        if (ret) {
+                remove_proc_entry(name, root);
+                minor->proc_root = NULL;
+                DRM_ERROR("Failed to create core drm proc files\n");
+                return ret;
         }
 
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-/**
- * Called when "/proc/dri/.../vm" is read.
- *
- * \param buf output buffer.
- * \param start start of output data.
- * \param offset requested start offset.
- * \param request requested number of bytes.
- * \param eof whether there is no more data to return.
- * \param data private data.
- * \return number of written bytes.
- *
- * Prints information about all mappings in drm_device::maplist.
- */
-static int drm__vm_info(char *buf, char **start, off_t offset, int request,
-                        int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        int len = 0;
-        struct drm_map *map;
-        struct drm_map_list *r_list;
-
-        /* Hardcoded from _DRM_FRAME_BUFFER,
-           _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
-           _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
-        const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
-        const char *type;
-        int i;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-
-        DRM_PROC_PRINT("slot     offset       size type flags    "
-                       "address mtrr\n\n");
-        i = 0;
-        list_for_each_entry(r_list, &dev->maplist, head) {
-                map = r_list->map;
-                if (!map)
-                        continue;
-                if (map->type < 0 || map->type > 5)
-                        type = "??";
-                else
-                        type = types[map->type];
-                DRM_PROC_PRINT("%4d 0x%08lx 0x%08lx %4.4s  0x%02x 0x%08lx ",
-                               i,
-                               map->offset,
-                               map->size, type, map->flags,
-                               (unsigned long) r_list->user_token);
-                if (map->mtrr < 0) {
-                        DRM_PROC_PRINT("none\n");
-                } else {
-                        DRM_PROC_PRINT("%4d\n", map->mtrr);
+        if (dev->driver->proc_init) {
+                ret = dev->driver->proc_init(minor);
+                if (ret) {
+                        DRM_ERROR("DRM: Driver failed to initialize "
+                                  "/proc/dri.\n");
+                        return ret;
                 }
-                i++;
-        }
-
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-/**
- * Simply calls _vm_info() while holding the drm_device::struct_mutex lock.
- */
-static int drm_vm_info(char *buf, char **start, off_t offset, int request,
-                       int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        int ret;
-
-        mutex_lock(&dev->struct_mutex);
-        ret = drm__vm_info(buf, start, offset, request, eof, data);
-        mutex_unlock(&dev->struct_mutex);
-        return ret;
-}
-
-/**
- * Called when "/proc/dri/.../queues" is read.
- *
- * \param buf output buffer.
- * \param start start of output data.
- * \param offset requested start offset.
- * \param request requested number of bytes.
- * \param eof whether there is no more data to return.
- * \param data private data.
- * \return number of written bytes.
- */
-static int drm__queues_info(char *buf, char **start, off_t offset,
-                            int request, int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        int len = 0;
-        int i;
-        struct drm_queue *q;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
         }
-
-        *start = &buf[offset];
-        *eof = 0;
-
-        DRM_PROC_PRINT("  ctx/flags   use   fin"
-                       "   blk/rw/rwf  wait    flushed     queued"
-                       "      locks\n\n");
-        for (i = 0; i < dev->queue_count; i++) {
-                q = dev->queuelist[i];
-                atomic_inc(&q->use_count);
-                DRM_PROC_PRINT_RET(atomic_dec(&q->use_count),
-                                   "%5d/0x%03x %5d %5d"
-                                   " %5d/%c%c/%c%c%c %5Zd\n",
-                                   i,
-                                   q->flags,
-                                   atomic_read(&q->use_count),
-                                   atomic_read(&q->finalization),
-                                   atomic_read(&q->block_count),
-                                   atomic_read(&q->block_read) ? 'r' : '-',
-                                   atomic_read(&q->block_write) ? 'w' : '-',
-                                   waitqueue_active(&q->read_queue) ? 'r' : '-',
-                                   waitqueue_active(&q->
-                                                    write_queue) ? 'w' : '-',
-                                   waitqueue_active(&q->
-                                                    flush_queue) ? 'f' : '-',
-                                   DRM_BUFCOUNT(&q->waitlist));
-                atomic_dec(&q->use_count);
-        }
-
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-/**
- * Simply calls _queues_info() while holding the drm_device::struct_mutex lock.
- */
-static int drm_queues_info(char *buf, char **start, off_t offset, int request,
-                           int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        int ret;
-
-        mutex_lock(&dev->struct_mutex);
-        ret = drm__queues_info(buf, start, offset, request, eof, data);
-        mutex_unlock(&dev->struct_mutex);
-        return ret;
+        return 0;
 }
 
-/**
- * Called when "/proc/dri/.../bufs" is read.
- *
- * \param buf output buffer.
- * \param start start of output data.
- * \param offset requested start offset.
- * \param request requested number of bytes.
- * \param eof whether there is no more data to return.
- * \param data private data.
- * \return number of written bytes.
- */
-static int drm__bufs_info(char *buf, char **start, off_t offset, int request,
-                          int *eof, void *data)
+int drm_proc_remove_files(struct drm_info_list *files, int count,
+                          struct drm_minor *minor)
 {
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        int len = 0;
-        struct drm_device_dma *dma = dev->dma;
+        struct list_head *pos, *q;
+        struct drm_info_node *tmp;
         int i;
 
-        if (!dma || offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-
-        DRM_PROC_PRINT(" o     size count  free  segs pages    kB\n\n");
-        for (i = 0; i <= DRM_MAX_ORDER; i++) {
-                if (dma->bufs[i].buf_count)
-                        DRM_PROC_PRINT("%2d %8d %5d %5d %5d %5d %5ld\n",
-                                       i,
-                                       dma->bufs[i].buf_size,
-                                       dma->bufs[i].buf_count,
-                                       atomic_read(&dma->bufs[i]
-                                                   .freelist.count),
-                                       dma->bufs[i].seg_count,
-                                       dma->bufs[i].seg_count
-                                       * (1 << dma->bufs[i].page_order),
-                                       (dma->bufs[i].seg_count
-                                        * (1 << dma->bufs[i].page_order))
-                                       * PAGE_SIZE / 1024);
-        }
-        DRM_PROC_PRINT("\n");
-        for (i = 0; i < dma->buf_count; i++) {
-                if (i && !(i % 32))
-                        DRM_PROC_PRINT("\n");
-                DRM_PROC_PRINT(" %d", dma->buflist[i]->list);
+        for (i = 0; i < count; i++) {
+                list_for_each_safe(pos, q, &minor->proc_nodes.list) {
+                        tmp = list_entry(pos, struct drm_info_node, list);
+                        if (tmp->info_ent == &files[i]) {
+                                remove_proc_entry(files[i].name,
+                                                  minor->proc_root);
+                                list_del(pos);
+                                drm_free(tmp, sizeof(struct drm_info_node),
+                                         _DRM_DRIVER);
+                        }
+                }
         }
-        DRM_PROC_PRINT("\n");
-
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-/**
- * Simply calls _bufs_info() while holding the drm_device::struct_mutex lock.
- */
-static int drm_bufs_info(char *buf, char **start, off_t offset, int request,
-                         int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        int ret;
-
-        mutex_lock(&dev->struct_mutex);
-        ret = drm__bufs_info(buf, start, offset, request, eof, data);
-        mutex_unlock(&dev->struct_mutex);
-        return ret;
+        return 0;
 }
 
 /**
- * Called when "/proc/dri/.../vblank" is read.
+ * Cleanup the proc filesystem resources.
  *
- * \param buf output buffer.
- * \param start start of output data.
- * \param offset requested start offset.
- * \param request requested number of bytes.
- * \param eof whether there is no more data to return.
- * \param data private data.
- * \return number of written bytes.
- */
-static int drm__vblank_info(char *buf, char **start, off_t offset, int request,
-                          int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        int len = 0;
-        int crtc;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-
-        for (crtc = 0; crtc < dev->num_crtcs; crtc++) {
-                DRM_PROC_PRINT("CRTC %d enable:     %d\n",
-                               crtc, atomic_read(&dev->vblank_refcount[crtc]));
-                DRM_PROC_PRINT("CRTC %d counter:    %d\n",
-                               crtc, drm_vblank_count(dev, crtc));
-                DRM_PROC_PRINT("CRTC %d last wait:  %d\n",
-                               crtc, dev->last_vblank_wait[crtc]);
-                DRM_PROC_PRINT("CRTC %d in modeset: %d\n",
-                               crtc, dev->vblank_inmodeset[crtc]);
-        }
-
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-/**
- * Simply calls _vblank_info() while holding the drm_device::struct_mutex lock.
- */
-static int drm_vblank_info(char *buf, char **start, off_t offset, int request,
-                         int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        int ret;
-
-        mutex_lock(&dev->struct_mutex);
-        ret = drm__vblank_info(buf, start, offset, request, eof, data);
-        mutex_unlock(&dev->struct_mutex);
-        return ret;
-}
-
-/**
- * Called when "/proc/dri/.../clients" is read.
+ * \param minor device minor number.
+ * \param root DRI proc dir entry.
+ * \param dev_root DRI device proc dir entry.
+ * \return always zero.
  *
- * \param buf output buffer.
- * \param start start of output data.
- * \param offset requested start offset.
- * \param request requested number of bytes.
- * \param eof whether there is no more data to return.
- * \param data private data.
- * \return number of written bytes.
+ * Remove all proc entries created by proc_init().
  */
-static int drm__clients_info(char *buf, char **start, off_t offset,
-                             int request, int *eof, void *data)
+int drm_proc_cleanup(struct drm_minor *minor, struct proc_dir_entry *root)
 {
-        struct drm_minor *minor = (struct drm_minor *) data;
         struct drm_device *dev = minor->dev;
-        int len = 0;
-        struct drm_file *priv;
+        char name[64];
 
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
+        if (!root || !minor->proc_root)
                 return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-
-        DRM_PROC_PRINT("a dev   pid    uid      magic     ioctls\n\n");
-        list_for_each_entry(priv, &dev->filelist, lhead) {
-                DRM_PROC_PRINT("%c %3d %5d %5d %10u %10lu\n",
-                               priv->authenticated ? 'y' : 'n',
-                               priv->minor->index,
-                               priv->pid,
-                               priv->uid, priv->magic, priv->ioctl_count);
-        }
 
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-/**
- * Simply calls _clients_info() while holding the drm_device::struct_mutex lock.
- */
-static int drm_clients_info(char *buf, char **start, off_t offset,
-                            int request, int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        int ret;
-
-        mutex_lock(&dev->struct_mutex);
-        ret = drm__clients_info(buf, start, offset, request, eof, data);
-        mutex_unlock(&dev->struct_mutex);
-        return ret;
-}
-
-struct drm_gem_name_info_data {
-       int                     len;
-       char                    *buf;
-       int                     eof;
-};
+        if (dev->driver->proc_cleanup)
+                dev->driver->proc_cleanup(minor);
 
-static int drm_gem_one_name_info(int id, void *ptr, void *data)
-{
-        struct drm_gem_object *obj = ptr;
-        struct drm_gem_name_info_data   *nid = data;
+        drm_proc_remove_files(drm_proc_list, DRM_PROC_ENTRIES, minor);
 
-        DRM_INFO("name %d size %zd\n", obj->name, obj->size);
-        if (nid->eof)
-                return 0;
+        sprintf(name, "%d", minor->index);
+        remove_proc_entry(name, root);
 
-        nid->len += sprintf(&nid->buf[nid->len],
-                            "%6d %8zd %7d %8d\n",
-                            obj->name, obj->size,
-                            atomic_read(&obj->handlecount.refcount),
-                            atomic_read(&obj->refcount.refcount));
-        if (nid->len > DRM_PROC_LIMIT) {
-                nid->eof = 1;
-                return 0;
-        }
         return 0;
 }
 
-static int drm_gem_name_info(char *buf, char **start, off_t offset,
-                             int request, int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        struct drm_gem_name_info_data nid;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        nid.len = sprintf(buf, "  name     size handles refcount\n");
-        nid.buf = buf;
-        nid.eof = 0;
-        idr_for_each(&dev->object_name_idr, drm_gem_one_name_info, &nid);
-
-        *start = &buf[offset];
-        *eof = 0;
-        if (nid.len > request + offset)
-                return request;
-        *eof = 1;
-        return nid.len - offset;
-}
-
-static int drm_gem_object_info(char *buf, char **start, off_t offset,
-                               int request, int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        int len = 0;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-        DRM_PROC_PRINT("%d objects\n", atomic_read(&dev->object_count));
-        DRM_PROC_PRINT("%d object bytes\n", atomic_read(&dev->object_memory));
-        DRM_PROC_PRINT("%d pinned\n", atomic_read(&dev->pin_count));
-        DRM_PROC_PRINT("%d pin bytes\n", atomic_read(&dev->pin_memory));
-        DRM_PROC_PRINT("%d gtt bytes\n", atomic_read(&dev->gtt_memory));
-        DRM_PROC_PRINT("%d gtt total\n", dev->gtt_total);
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-#if DRM_DEBUG_CODE
-
-static int drm__vma_info(char *buf, char **start, off_t offset, int request,
-                         int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        int len = 0;
-        struct drm_vma_entry *pt;
-        struct vm_area_struct *vma;
-#if defined(__i386__)
-        unsigned int pgprot;
-#endif
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-
-        DRM_PROC_PRINT("vma use count: %d, high_memory = %p, 0x%llx\n",
-                       atomic_read(&dev->vma_count),
-                       high_memory, (u64)virt_to_phys(high_memory));
-        list_for_each_entry(pt, &dev->vmalist, head) {
-                if (!(vma = pt->vma))
-                        continue;
-                DRM_PROC_PRINT("\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000",
-                               pt->pid,
-                               vma->vm_start,
-                               vma->vm_end,
-                               vma->vm_flags & VM_READ ? 'r' : '-',
-                               vma->vm_flags & VM_WRITE ? 'w' : '-',
-                               vma->vm_flags & VM_EXEC ? 'x' : '-',
-                               vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
-                               vma->vm_flags & VM_LOCKED ? 'l' : '-',
-                               vma->vm_flags & VM_IO ? 'i' : '-',
-                               vma->vm_pgoff);
-
-#if defined(__i386__)
-                pgprot = pgprot_val(vma->vm_page_prot);
-                DRM_PROC_PRINT(" %c%c%c%c%c%c%c%c%c",
-                               pgprot & _PAGE_PRESENT ? 'p' : '-',
-                               pgprot & _PAGE_RW ? 'w' : 'r',
-                               pgprot & _PAGE_USER ? 'u' : 's',
-                               pgprot & _PAGE_PWT ? 't' : 'b',
-                               pgprot & _PAGE_PCD ? 'u' : 'c',
-                               pgprot & _PAGE_ACCESSED ? 'a' : '-',
-                               pgprot & _PAGE_DIRTY ? 'd' : '-',
-                               pgprot & _PAGE_PSE ? 'm' : 'k',
-                               pgprot & _PAGE_GLOBAL ? 'g' : 'l');
-#endif
-                DRM_PROC_PRINT("\n");
-        }
-
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-static int drm_vma_info(char *buf, char **start, off_t offset, int request,
-                        int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        int ret;
-
-        mutex_lock(&dev->struct_mutex);
-        ret = drm__vma_info(buf, start, offset, request, eof, data);
-        mutex_unlock(&dev->struct_mutex);
-        return ret;
-}
-#endif
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index 7c8b15b22bf2..48f33be8fd0f 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -50,6 +50,7 @@ struct idr drm_minors_idr;
 
 struct class *drm_class;
 struct proc_dir_entry *drm_proc_root;
+struct dentry *drm_debugfs_root;
 
 static int drm_minor_get_id(struct drm_device *dev, int type)
 {
@@ -313,7 +314,15 @@ static int drm_get_minor(struct drm_device *dev, struct drm_minor **minor, int t
                         goto err_mem;
                 }
         } else
-                new_minor->dev_root = NULL;
+                new_minor->proc_root = NULL;
+
+#if defined(CONFIG_DEBUG_FS)
+        ret = drm_debugfs_init(new_minor, minor_id, drm_debugfs_root);
+        if (ret) {
+                DRM_ERROR("DRM: Failed to initialize /debugfs/dri.\n");
+                goto err_g2;
+        }
+#endif
 
         ret = drm_sysfs_device_add(new_minor);
         if (ret) {
@@ -451,6 +460,10 @@ int drm_put_minor(struct drm_minor **minor_p)
 
         if (minor->type == DRM_MINOR_LEGACY)
                 drm_proc_cleanup(minor, drm_proc_root);
+#if defined(CONFIG_DEBUG_FS)
+        drm_debugfs_cleanup(minor);
+#endif
+
         drm_sysfs_device_remove(minor);
 
         idr_remove(&drm_minors_idr, minor->index);
diff --git a/drivers/gpu/drm/i915/Makefile b/drivers/gpu/drm/i915/Makefile
index 793cba39d832..51c5a050aa73 100644
--- a/drivers/gpu/drm/i915/Makefile
+++ b/drivers/gpu/drm/i915/Makefile
@@ -7,7 +7,7 @@ i915-y := i915_drv.o i915_dma.o i915_irq.o i915_mem.o \
           i915_suspend.o \
           i915_gem.o \
           i915_gem_debug.o \
-          i915_gem_proc.o \
+          i915_gem_debugfs.o \
           i915_gem_tiling.o \
           intel_display.o \
           intel_crt.o \
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 6d21b9e48b89..a818b377e1f7 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -41,7 +41,6 @@
 int i915_wait_ring(struct drm_device * dev, int n, const char *caller)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
         drm_i915_ring_buffer_t *ring = &(dev_priv->ring);
         u32 acthd_reg = IS_I965G(dev) ? ACTHD_I965 : ACTHD;
         u32 last_acthd = I915_READ(acthd_reg);
@@ -58,8 +57,12 @@ int i915_wait_ring(struct drm_device * dev, int n, const char *caller)
                 if (ring->space >= n)
                         return 0;
 
-                if (master_priv->sarea_priv)
-                        master_priv->sarea_priv->perf_boxes |= I915_BOX_WAIT;
+                if (dev->primary->master) {
+                        struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
+                        if (master_priv->sarea_priv)
+                                master_priv->sarea_priv->perf_boxes |= I915_BOX_WAIT;
+                }
+
 
                 if (ring->head != last_head)
                         i = 0;
@@ -356,7 +359,7 @@ static int validate_cmd(int cmd)
         return ret;
 }
 
-static int i915_emit_cmds(struct drm_device * dev, int __user * buffer, int dwords)
+static int i915_emit_cmds(struct drm_device * dev, int *buffer, int dwords)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
         int i;
@@ -370,8 +373,7 @@ static int i915_emit_cmds(struct drm_device * dev, int __user * buffer, int dwor
         for (i = 0; i < dwords;) {
                 int cmd, sz;
 
-                if (DRM_COPY_FROM_USER_UNCHECKED(&cmd, &buffer[i], sizeof(cmd)))
-                        return -EINVAL;
+                cmd = buffer[i];
 
                 if ((sz = validate_cmd(cmd)) == 0 || i + sz > dwords)
                         return -EINVAL;
@@ -379,11 +381,7 @@ static int i915_emit_cmds(struct drm_device * dev, int __user * buffer, int dwor
                 OUT_RING(cmd);
 
                 while (++i, --sz) {
-                        if (DRM_COPY_FROM_USER_UNCHECKED(&cmd, &buffer[i],
-                                                         sizeof(cmd))) {
-                                return -EINVAL;
-                        }
-                        OUT_RING(cmd);
+                        OUT_RING(buffer[i]);
                 }
         }
 
@@ -397,17 +395,13 @@ static int i915_emit_cmds(struct drm_device * dev, int __user * buffer, int dwor
 
 int
 i915_emit_box(struct drm_device *dev,
-              struct drm_clip_rect __user *boxes,
+              struct drm_clip_rect *boxes,
               int i, int DR1, int DR4)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_clip_rect box;
+        struct drm_clip_rect box = boxes[i];
         RING_LOCALS;
 
-        if (DRM_COPY_FROM_USER_UNCHECKED(&box, &boxes[i], sizeof(box))) {
-                return -EFAULT;
-        }
-
         if (box.y2 <= box.y1 || box.x2 <= box.x1 || box.y2 <= 0 || box.x2 <= 0) {
                 DRM_ERROR("Bad box %d,%d..%d,%d\n",
                           box.x1, box.y1, box.x2, box.y2);
@@ -460,7 +454,9 @@ static void i915_emit_breadcrumb(struct drm_device *dev)
 }
 
 static int i915_dispatch_cmdbuffer(struct drm_device * dev,
-                                   drm_i915_cmdbuffer_t * cmd)
+                                   drm_i915_cmdbuffer_t *cmd,
+                                   struct drm_clip_rect *cliprects,
+                                   void *cmdbuf)
 {
         int nbox = cmd->num_cliprects;
         int i = 0, count, ret;
@@ -476,13 +472,13 @@ static int i915_dispatch_cmdbuffer(struct drm_device * dev,
 
         for (i = 0; i < count; i++) {
                 if (i < nbox) {
-                        ret = i915_emit_box(dev, cmd->cliprects, i,
+                        ret = i915_emit_box(dev, cliprects, i,
                                             cmd->DR1, cmd->DR4);
                         if (ret)
                                 return ret;
                 }
 
-                ret = i915_emit_cmds(dev, (int __user *)cmd->buf, cmd->sz / 4);
+                ret = i915_emit_cmds(dev, cmdbuf, cmd->sz / 4);
                 if (ret)
                         return ret;
         }
@@ -492,10 +488,10 @@ static int i915_dispatch_cmdbuffer(struct drm_device * dev,
 }
 
 static int i915_dispatch_batchbuffer(struct drm_device * dev,
-                                     drm_i915_batchbuffer_t * batch)
+                                     drm_i915_batchbuffer_t * batch,
+                                     struct drm_clip_rect *cliprects)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_clip_rect __user *boxes = batch->cliprects;
         int nbox = batch->num_cliprects;
         int i = 0, count;
         RING_LOCALS;
@@ -511,7 +507,7 @@ static int i915_dispatch_batchbuffer(struct drm_device * dev,
 
         for (i = 0; i < count; i++) {
                 if (i < nbox) {
-                        int ret = i915_emit_box(dev, boxes, i,
+                        int ret = i915_emit_box(dev, cliprects, i,
                                                 batch->DR1, batch->DR4);
                         if (ret)
                                 return ret;
@@ -626,6 +622,7 @@ static int i915_batchbuffer(struct drm_device *dev, void *data,
             master_priv->sarea_priv;
         drm_i915_batchbuffer_t *batch = data;
         int ret;
+        struct drm_clip_rect *cliprects = NULL;
 
         if (!dev_priv->allow_batchbuffer) {
                 DRM_ERROR("Batchbuffer ioctl disabled\n");
@@ -637,17 +634,35 @@ static int i915_batchbuffer(struct drm_device *dev, void *data,
 
         RING_LOCK_TEST_WITH_RETURN(dev, file_priv);
 
-        if (batch->num_cliprects && DRM_VERIFYAREA_READ(batch->cliprects,
-                                                       batch->num_cliprects *
-                                                       sizeof(struct drm_clip_rect)))
-                return -EFAULT;
+        if (batch->num_cliprects < 0)
+                return -EINVAL;
+
+        if (batch->num_cliprects) {
+                cliprects = drm_calloc(batch->num_cliprects,
+                                       sizeof(struct drm_clip_rect),
+                                       DRM_MEM_DRIVER);
+                if (cliprects == NULL)
+                        return -ENOMEM;
+
+                ret = copy_from_user(cliprects, batch->cliprects,
+                                     batch->num_cliprects *
+                                     sizeof(struct drm_clip_rect));
+                if (ret != 0)
+                        goto fail_free;
+        }
 
         mutex_lock(&dev->struct_mutex);
-        ret = i915_dispatch_batchbuffer(dev, batch);
+        ret = i915_dispatch_batchbuffer(dev, batch, cliprects);
         mutex_unlock(&dev->struct_mutex);
 
         if (sarea_priv)
                 sarea_priv->last_dispatch = READ_BREADCRUMB(dev_priv);
+
+fail_free:
+        drm_free(cliprects,
+                 batch->num_cliprects * sizeof(struct drm_clip_rect),
+                 DRM_MEM_DRIVER);
+
         return ret;
 }
 
@@ -659,6 +674,8 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data,
         drm_i915_sarea_t *sarea_priv = (drm_i915_sarea_t *)
             master_priv->sarea_priv;
         drm_i915_cmdbuffer_t *cmdbuf = data;
+        struct drm_clip_rect *cliprects = NULL;
+        void *batch_data;
         int ret;
 
         DRM_DEBUG("i915 cmdbuffer, buf %p sz %d cliprects %d\n",
@@ -666,25 +683,50 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data,
 
         RING_LOCK_TEST_WITH_RETURN(dev, file_priv);
 
-        if (cmdbuf->num_cliprects &&
-            DRM_VERIFYAREA_READ(cmdbuf->cliprects,
-                                cmdbuf->num_cliprects *
-                                sizeof(struct drm_clip_rect))) {
-                DRM_ERROR("Fault accessing cliprects\n");
-                return -EFAULT;
+        if (cmdbuf->num_cliprects < 0)
+                return -EINVAL;
+
+        batch_data = drm_alloc(cmdbuf->sz, DRM_MEM_DRIVER);
+        if (batch_data == NULL)
+                return -ENOMEM;
+
+        ret = copy_from_user(batch_data, cmdbuf->buf, cmdbuf->sz);
+        if (ret != 0)
+                goto fail_batch_free;
+
+        if (cmdbuf->num_cliprects) {
+                cliprects = drm_calloc(cmdbuf->num_cliprects,
+                                       sizeof(struct drm_clip_rect),
+                                       DRM_MEM_DRIVER);
+                if (cliprects == NULL)
+                        goto fail_batch_free;
+
+                ret = copy_from_user(cliprects, cmdbuf->cliprects,
+                                     cmdbuf->num_cliprects *
+                                     sizeof(struct drm_clip_rect));
+                if (ret != 0)
+                        goto fail_clip_free;
         }
 
         mutex_lock(&dev->struct_mutex);
-        ret = i915_dispatch_cmdbuffer(dev, cmdbuf);
+        ret = i915_dispatch_cmdbuffer(dev, cmdbuf, cliprects, batch_data);
         mutex_unlock(&dev->struct_mutex);
         if (ret) {
                 DRM_ERROR("i915_dispatch_cmdbuffer failed\n");
-                return ret;
+                goto fail_batch_free;
         }
 
         if (sarea_priv)
                 sarea_priv->last_dispatch = READ_BREADCRUMB(dev_priv);
-        return 0;
+
+fail_batch_free:
+        drm_free(batch_data, cmdbuf->sz, DRM_MEM_DRIVER);
+fail_clip_free:
+        drm_free(cliprects,
+                 cmdbuf->num_cliprects * sizeof(struct drm_clip_rect),
+                 DRM_MEM_DRIVER);
+
+        return ret;
 }
 
 static int i915_flip_bufs(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index b293ef0bae71..dcb91f5df6e3 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -150,8 +150,10 @@ static struct drm_driver driver = {
         .get_reg_ofs = drm_core_get_reg_ofs,
         .master_create = i915_master_create,
         .master_destroy = i915_master_destroy,
-        .proc_init = i915_gem_proc_init,
-        .proc_cleanup = i915_gem_proc_cleanup,
+#if defined(CONFIG_DEBUG_FS)
+        .debugfs_init = i915_gem_debugfs_init,
+        .debugfs_cleanup = i915_gem_debugfs_cleanup,
+#endif
         .gem_init_object = i915_gem_init_object,
         .gem_free_object = i915_gem_free_object,
         .gem_vm_ops = &i915_gem_vm_ops,
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index d6cc9861e0a1..c1685d0c704f 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -404,7 +404,8 @@ struct drm_i915_gem_object {
         /** AGP memory structure for our GTT binding. */
         DRM_AGP_MEM *agp_mem;
 
-        struct page **page_list;
+        struct page **pages;
+        int pages_refcount;
 
         /**
          * Current offset of the object in GTT space.
@@ -519,7 +520,7 @@ extern int i915_driver_device_is_agp(struct drm_device * dev);
 extern long i915_compat_ioctl(struct file *filp, unsigned int cmd,
                               unsigned long arg);
 extern int i915_emit_box(struct drm_device *dev,
-                         struct drm_clip_rect __user *boxes,
+                         struct drm_clip_rect *boxes,
                          int i, int DR1, int DR4);
 
 /* i915_irq.c */
@@ -604,8 +605,6 @@ int i915_gem_get_tiling(struct drm_device *dev, void *data,
 int i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
                                 struct drm_file *file_priv);
 void i915_gem_load(struct drm_device *dev);
-int i915_gem_proc_init(struct drm_minor *minor);
-void i915_gem_proc_cleanup(struct drm_minor *minor);
 int i915_gem_init_object(struct drm_gem_object *obj);
 void i915_gem_free_object(struct drm_gem_object *obj);
 int i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment);
@@ -649,6 +648,10 @@ void i915_gem_dump_object(struct drm_gem_object *obj, int len,
                           const char *where, uint32_t mark);
 void i915_dump_lru(struct drm_device *dev, const char *where);
 
+/* i915_debugfs.c */
+int i915_gem_debugfs_init(struct drm_minor *minor);
+void i915_gem_debugfs_cleanup(struct drm_minor *minor);
+
 /* i915_suspend.c */
 extern int i915_save_state(struct drm_device *dev);
 extern int i915_restore_state(struct drm_device *dev);
@@ -784,15 +787,21 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
                      (dev)->pci_device == 0x2E22 || \
                      IS_GM45(dev))
 
+#define IS_IGDG(dev) ((dev)->pci_device == 0xa001)
+#define IS_IGDGM(dev) ((dev)->pci_device == 0xa011)
+#define IS_IGD(dev) (IS_IGDG(dev) || IS_IGDGM(dev))
+
 #define IS_G33(dev)    ((dev)->pci_device == 0x29C2 ||  \
                         (dev)->pci_device == 0x29B2 ||  \
-                        (dev)->pci_device == 0x29D2)
+                        (dev)->pci_device == 0x29D2 ||  \
+                        (IS_IGD(dev)))
 
 #define IS_I9XX(dev) (IS_I915G(dev) || IS_I915GM(dev) || IS_I945G(dev) || \
                       IS_I945GM(dev) || IS_I965G(dev) || IS_G33(dev))
 
 #define IS_MOBILE(dev) (IS_I830(dev) || IS_I85X(dev) || IS_I915GM(dev) || \
-                        IS_I945GM(dev) || IS_I965GM(dev) || IS_GM45(dev))
+                        IS_I945GM(dev) || IS_I965GM(dev) || IS_GM45(dev) || \
+                        IS_IGD(dev))
 
 #define I915_NEED_GFX_HWS(dev) (IS_G33(dev) || IS_GM45(dev) || IS_G4X(dev))
 /* With the 945 and later, Y tiling got adjusted so that it was 32 128-byte
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 37427e4016cb..b52cba0f16d2 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -43,8 +43,8 @@ static int i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
                                                      uint64_t offset,
                                                      uint64_t size);
 static void i915_gem_object_set_to_full_cpu_read_domain(struct drm_gem_object *obj);
-static int i915_gem_object_get_page_list(struct drm_gem_object *obj);
-static void i915_gem_object_free_page_list(struct drm_gem_object *obj);
+static int i915_gem_object_get_pages(struct drm_gem_object *obj);
+static void i915_gem_object_put_pages(struct drm_gem_object *obj);
 static int i915_gem_object_wait_rendering(struct drm_gem_object *obj);
 static int i915_gem_object_bind_to_gtt(struct drm_gem_object *obj,
                                            unsigned alignment);
@@ -136,6 +136,224 @@ i915_gem_create_ioctl(struct drm_device *dev, void *data,
         return 0;
 }
 
+static inline int
+fast_shmem_read(struct page **pages,
+                loff_t page_base, int page_offset,
+                char __user *data,
+                int length)
+{
+        char __iomem *vaddr;
+        int ret;
+
+        vaddr = kmap_atomic(pages[page_base >> PAGE_SHIFT], KM_USER0);
+        if (vaddr == NULL)
+                return -ENOMEM;
+        ret = __copy_to_user_inatomic(data, vaddr + page_offset, length);
+        kunmap_atomic(vaddr, KM_USER0);
+
+        return ret;
+}
+
+static inline int
+slow_shmem_copy(struct page *dst_page,
+                int dst_offset,
+                struct page *src_page,
+                int src_offset,
+                int length)
+{
+        char *dst_vaddr, *src_vaddr;
+
+        dst_vaddr = kmap_atomic(dst_page, KM_USER0);
+        if (dst_vaddr == NULL)
+                return -ENOMEM;
+
+        src_vaddr = kmap_atomic(src_page, KM_USER1);
+        if (src_vaddr == NULL) {
+                kunmap_atomic(dst_vaddr, KM_USER0);
+                return -ENOMEM;
+        }
+
+        memcpy(dst_vaddr + dst_offset, src_vaddr + src_offset, length);
+
+        kunmap_atomic(src_vaddr, KM_USER1);
+        kunmap_atomic(dst_vaddr, KM_USER0);
+
+        return 0;
+}
+
+/**
+ * This is the fast shmem pread path, which attempts to copy_from_user directly
+ * from the backing pages of the object to the user's address space.  On a
+ * fault, it fails so we can fall back to i915_gem_shmem_pwrite_slow().
+ */
+static int
+i915_gem_shmem_pread_fast(struct drm_device *dev, struct drm_gem_object *obj,
+                          struct drm_i915_gem_pread *args,
+                          struct drm_file *file_priv)
+{
+        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        ssize_t remain;
+        loff_t offset, page_base;
+        char __user *user_data;
+        int page_offset, page_length;
+        int ret;
+
+        user_data = (char __user *) (uintptr_t) args->data_ptr;
+        remain = args->size;
+
+        mutex_lock(&dev->struct_mutex);
+
+        ret = i915_gem_object_get_pages(obj);
+        if (ret != 0)
+                goto fail_unlock;
+
+        ret = i915_gem_object_set_cpu_read_domain_range(obj, args->offset,
+                                                        args->size);
+        if (ret != 0)
+                goto fail_put_pages;
+
+        obj_priv = obj->driver_private;
+        offset = args->offset;
+
+        while (remain > 0) {
+                /* Operation in this page
+                 *
+                 * page_base = page offset within aperture
+                 * page_offset = offset within page
+                 * page_length = bytes to copy for this page
+                 */
+                page_base = (offset & ~(PAGE_SIZE-1));
+                page_offset = offset & (PAGE_SIZE-1);
+                page_length = remain;
+                if ((page_offset + remain) > PAGE_SIZE)
+                        page_length = PAGE_SIZE - page_offset;
+
+                ret = fast_shmem_read(obj_priv->pages,
+                                      page_base, page_offset,
+                                      user_data, page_length);
+                if (ret)
+                        goto fail_put_pages;
+
+                remain -= page_length;
+                user_data += page_length;
+                offset += page_length;
+        }
+
+fail_put_pages:
+        i915_gem_object_put_pages(obj);
+fail_unlock:
+        mutex_unlock(&dev->struct_mutex);
+
+        return ret;
+}
+
+/**
+ * This is the fallback shmem pread path, which allocates temporary storage
+ * in kernel space to copy_to_user into outside of the struct_mutex, so we
+ * can copy out of the object's backing pages while holding the struct mutex
+ * and not take page faults.
+ */
+static int
+i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
+                          struct drm_i915_gem_pread *args,
+                          struct drm_file *file_priv)
+{
+        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct mm_struct *mm = current->mm;
+        struct page **user_pages;
+        ssize_t remain;
+        loff_t offset, pinned_pages, i;
+        loff_t first_data_page, last_data_page, num_pages;
+        int shmem_page_index, shmem_page_offset;
+        int data_page_index,  data_page_offset;
+        int page_length;
+        int ret;
+        uint64_t data_ptr = args->data_ptr;
+
+        remain = args->size;
+
+        /* Pin the user pages containing the data.  We can't fault while
+         * holding the struct mutex, yet we want to hold it while
+         * dereferencing the user data.
+         */
+        first_data_page = data_ptr / PAGE_SIZE;
+        last_data_page = (data_ptr + args->size - 1) / PAGE_SIZE;
+        num_pages = last_data_page - first_data_page + 1;
+
+        user_pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL);
+        if (user_pages == NULL)
+                return -ENOMEM;
+
+        down_read(&mm->mmap_sem);
+        pinned_pages = get_user_pages(current, mm, (uintptr_t)args->data_ptr,
+                                      num_pages, 0, 0, user_pages, NULL);
+        up_read(&mm->mmap_sem);
+        if (pinned_pages < num_pages) {
+                ret = -EFAULT;
+                goto fail_put_user_pages;
+        }
+
+        mutex_lock(&dev->struct_mutex);
+
+        ret = i915_gem_object_get_pages(obj);
+        if (ret != 0)
+                goto fail_unlock;
+
+        ret = i915_gem_object_set_cpu_read_domain_range(obj, args->offset,
+                                                        args->size);
+        if (ret != 0)
+                goto fail_put_pages;
+
+        obj_priv = obj->driver_private;
+        offset = args->offset;
+
+        while (remain > 0) {
+                /* Operation in this page
+                 *
+                 * shmem_page_index = page number within shmem file
+                 * shmem_page_offset = offset within page in shmem file
+                 * data_page_index = page number in get_user_pages return
+                 * data_page_offset = offset with data_page_index page.
+                 * page_length = bytes to copy for this page
+                 */
+                shmem_page_index = offset / PAGE_SIZE;
+                shmem_page_offset = offset & ~PAGE_MASK;
+                data_page_index = data_ptr / PAGE_SIZE - first_data_page;
+                data_page_offset = data_ptr & ~PAGE_MASK;
+
+                page_length = remain;
+                if ((shmem_page_offset + page_length) > PAGE_SIZE)
+                        page_length = PAGE_SIZE - shmem_page_offset;
+                if ((data_page_offset + page_length) > PAGE_SIZE)
+                        page_length = PAGE_SIZE - data_page_offset;
+
+                ret = slow_shmem_copy(user_pages[data_page_index],
+                                      data_page_offset,
+                                      obj_priv->pages[shmem_page_index],
+                                      shmem_page_offset,
+                                      page_length);
+                if (ret)
+                        goto fail_put_pages;
+
+                remain -= page_length;
+                data_ptr += page_length;
+                offset += page_length;
+        }
+
+fail_put_pages:
+        i915_gem_object_put_pages(obj);
+fail_unlock:
+        mutex_unlock(&dev->struct_mutex);
+fail_put_user_pages:
+        for (i = 0; i < pinned_pages; i++) {
+                SetPageDirty(user_pages[i]);
+                page_cache_release(user_pages[i]);
+        }
+        kfree(user_pages);
+
+        return ret;
+}
+
 /**
  * Reads data from the object referenced by handle.
  *
@@ -148,8 +366,6 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
         struct drm_i915_gem_pread *args = data;
         struct drm_gem_object *obj;
         struct drm_i915_gem_object *obj_priv;
-        ssize_t read;
-        loff_t offset;
         int ret;
 
         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
@@ -167,33 +383,13 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                 return -EINVAL;
         }
 
-        mutex_lock(&dev->struct_mutex);
-
-        ret = i915_gem_object_set_cpu_read_domain_range(obj, args->offset,
-                                                        args->size);
-        if (ret != 0) {
-                drm_gem_object_unreference(obj);
-                mutex_unlock(&dev->struct_mutex);
-                return ret;
-        }
-
-        offset = args->offset;
-
-        read = vfs_read(obj->filp, (char __user *)(uintptr_t)args->data_ptr,
-                        args->size, &offset);
-        if (read != args->size) {
-                drm_gem_object_unreference(obj);
-                mutex_unlock(&dev->struct_mutex);
-                if (read < 0)
-                        return read;
-                else
-                        return -EINVAL;
-        }
+        ret = i915_gem_shmem_pread_fast(dev, obj, args, file_priv);
+        if (ret != 0)
+                ret = i915_gem_shmem_pread_slow(dev, obj, args, file_priv);
 
         drm_gem_object_unreference(obj);
-        mutex_unlock(&dev->struct_mutex);
 
-        return 0;
+        return ret;
 }
 
 /* This is the fast write path which cannot handle
@@ -223,29 +419,51 @@ fast_user_write(struct io_mapping *mapping,
  */
 
 static inline int
-slow_user_write(struct io_mapping *mapping,
-                loff_t page_base, int page_offset,
-                char __user *user_data,
-                int length)
+slow_kernel_write(struct io_mapping *mapping,
+                  loff_t gtt_base, int gtt_offset,
+                  struct page *user_page, int user_offset,
+                  int length)
 {
-        char __iomem *vaddr;
+        char *src_vaddr, *dst_vaddr;
         unsigned long unwritten;
 
-        vaddr = io_mapping_map_wc(mapping, page_base);
-        if (vaddr == NULL)
-                return -EFAULT;
-        unwritten = __copy_from_user(vaddr + page_offset,
-                                     user_data, length);
-        io_mapping_unmap(vaddr);
+        dst_vaddr = io_mapping_map_atomic_wc(mapping, gtt_base);
+        src_vaddr = kmap_atomic(user_page, KM_USER1);
+        unwritten = __copy_from_user_inatomic_nocache(dst_vaddr + gtt_offset,
+                                                      src_vaddr + user_offset,
+                                                      length);
+        kunmap_atomic(src_vaddr, KM_USER1);
+        io_mapping_unmap_atomic(dst_vaddr);
         if (unwritten)
                 return -EFAULT;
         return 0;
 }
 
+static inline int
+fast_shmem_write(struct page **pages,
+                 loff_t page_base, int page_offset,
+                 char __user *data,
+                 int length)
+{
+        char __iomem *vaddr;
+
+        vaddr = kmap_atomic(pages[page_base >> PAGE_SHIFT], KM_USER0);
+        if (vaddr == NULL)
+                return -ENOMEM;
+        __copy_from_user_inatomic(vaddr + page_offset, data, length);
+        kunmap_atomic(vaddr, KM_USER0);
+
+        return 0;
+}
+
+/**
+ * This is the fast pwrite path, where we copy the data directly from the
+ * user into the GTT, uncached.
+ */
 static int
-i915_gem_gtt_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
-                    struct drm_i915_gem_pwrite *args,
-                    struct drm_file *file_priv)
+i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
+                         struct drm_i915_gem_pwrite *args,
+                         struct drm_file *file_priv)
 {
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
         drm_i915_private_t *dev_priv = dev->dev_private;
@@ -273,7 +491,6 @@ i915_gem_gtt_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
 
         obj_priv = obj->driver_private;
         offset = obj_priv->gtt_offset + args->offset;
-        obj_priv->dirty = 1;
 
         while (remain > 0) {
                 /* Operation in this page
@@ -292,16 +509,11 @@ i915_gem_gtt_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
                                        page_offset, user_data, page_length);
 
                 /* If we get a fault while copying data, then (presumably) our
-                 * source page isn't available. In this case, use the
-                 * non-atomic function
+                 * source page isn't available.  Return the error and we'll
+                 * retry in the slow path.
                  */
-                if (ret) {
-                        ret = slow_user_write (dev_priv->mm.gtt_mapping,
-                                               page_base, page_offset,
-                                               user_data, page_length);
-                        if (ret)
-                                goto fail;
-                }
+                if (ret)
+                        goto fail;
 
                 remain -= page_length;
                 user_data += page_length;
@@ -315,39 +527,284 @@ fail:
         return ret;
 }
 
+/**
+ * This is the fallback GTT pwrite path, which uses get_user_pages to pin
+ * the memory and maps it using kmap_atomic for copying.
+ *
+ * This code resulted in x11perf -rgb10text consuming about 10% more CPU
+ * than using i915_gem_gtt_pwrite_fast on a G45 (32-bit).
+ */
 static int
-i915_gem_shmem_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
-                      struct drm_i915_gem_pwrite *args,
-                      struct drm_file *file_priv)
+i915_gem_gtt_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
+                         struct drm_i915_gem_pwrite *args,
+                         struct drm_file *file_priv)
 {
+        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        ssize_t remain;
+        loff_t gtt_page_base, offset;
+        loff_t first_data_page, last_data_page, num_pages;
+        loff_t pinned_pages, i;
+        struct page **user_pages;
+        struct mm_struct *mm = current->mm;
+        int gtt_page_offset, data_page_offset, data_page_index, page_length;
         int ret;
-        loff_t offset;
-        ssize_t written;
+        uint64_t data_ptr = args->data_ptr;
+
+        remain = args->size;
+
+        /* Pin the user pages containing the data.  We can't fault while
+         * holding the struct mutex, and all of the pwrite implementations
+         * want to hold it while dereferencing the user data.
+         */
+        first_data_page = data_ptr / PAGE_SIZE;
+        last_data_page = (data_ptr + args->size - 1) / PAGE_SIZE;
+        num_pages = last_data_page - first_data_page + 1;
+
+        user_pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL);
+        if (user_pages == NULL)
+                return -ENOMEM;
+
+        down_read(&mm->mmap_sem);
+        pinned_pages = get_user_pages(current, mm, (uintptr_t)args->data_ptr,
+                                      num_pages, 0, 0, user_pages, NULL);
+        up_read(&mm->mmap_sem);
+        if (pinned_pages < num_pages) {
+                ret = -EFAULT;
+                goto out_unpin_pages;
+        }
 
         mutex_lock(&dev->struct_mutex);
+        ret = i915_gem_object_pin(obj, 0);
+        if (ret)
+                goto out_unlock;
+
+        ret = i915_gem_object_set_to_gtt_domain(obj, 1);
+        if (ret)
+                goto out_unpin_object;
+
+        obj_priv = obj->driver_private;
+        offset = obj_priv->gtt_offset + args->offset;
+
+        while (remain > 0) {
+                /* Operation in this page
+                 *
+                 * gtt_page_base = page offset within aperture
+                 * gtt_page_offset = offset within page in aperture
+                 * data_page_index = page number in get_user_pages return
+                 * data_page_offset = offset with data_page_index page.
+                 * page_length = bytes to copy for this page
+                 */
+                gtt_page_base = offset & PAGE_MASK;
+                gtt_page_offset = offset & ~PAGE_MASK;
+                data_page_index = data_ptr / PAGE_SIZE - first_data_page;
+                data_page_offset = data_ptr & ~PAGE_MASK;
+
+                page_length = remain;
+                if ((gtt_page_offset + page_length) > PAGE_SIZE)
+                        page_length = PAGE_SIZE - gtt_page_offset;
+                if ((data_page_offset + page_length) > PAGE_SIZE)
+                        page_length = PAGE_SIZE - data_page_offset;
+
+                ret = slow_kernel_write(dev_priv->mm.gtt_mapping,
+                                        gtt_page_base, gtt_page_offset,
+                                        user_pages[data_page_index],
+                                        data_page_offset,
+                                        page_length);
+
+                /* If we get a fault while copying data, then (presumably) our
+                 * source page isn't available.  Return the error and we'll
+                 * retry in the slow path.
+                 */
+                if (ret)
+                        goto out_unpin_object;
+
+                remain -= page_length;
+                offset += page_length;
+                data_ptr += page_length;
+        }
+
+out_unpin_object:
+        i915_gem_object_unpin(obj);
+out_unlock:
+        mutex_unlock(&dev->struct_mutex);
+out_unpin_pages:
+        for (i = 0; i < pinned_pages; i++)
+                page_cache_release(user_pages[i]);
+        kfree(user_pages);
+
+        return ret;
+}
+
+/**
+ * This is the fast shmem pwrite path, which attempts to directly
+ * copy_from_user into the kmapped pages backing the object.
+ */
+static int
+i915_gem_shmem_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
+                           struct drm_i915_gem_pwrite *args,
+                           struct drm_file *file_priv)
+{
+        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        ssize_t remain;
+        loff_t offset, page_base;
+        char __user *user_data;
+        int page_offset, page_length;
+        int ret;
+
+        user_data = (char __user *) (uintptr_t) args->data_ptr;
+        remain = args->size;
+
+        mutex_lock(&dev->struct_mutex);
+
+        ret = i915_gem_object_get_pages(obj);
+        if (ret != 0)
+                goto fail_unlock;
 
         ret = i915_gem_object_set_to_cpu_domain(obj, 1);
-        if (ret) {
-                mutex_unlock(&dev->struct_mutex);
-                return ret;
+        if (ret != 0)
+                goto fail_put_pages;
+
+        obj_priv = obj->driver_private;
+        offset = args->offset;
+        obj_priv->dirty = 1;
+
+        while (remain > 0) {
+                /* Operation in this page
+                 *
+                 * page_base = page offset within aperture
+                 * page_offset = offset within page
+                 * page_length = bytes to copy for this page
+                 */
+                page_base = (offset & ~(PAGE_SIZE-1));
+                page_offset = offset & (PAGE_SIZE-1);
+                page_length = remain;
+                if ((page_offset + remain) > PAGE_SIZE)
+                        page_length = PAGE_SIZE - page_offset;
+
+                ret = fast_shmem_write(obj_priv->pages,
+                                       page_base, page_offset,
+                                       user_data, page_length);
+                if (ret)
+                        goto fail_put_pages;
+
+                remain -= page_length;
+                user_data += page_length;
+                offset += page_length;
         }
 
+fail_put_pages:
+        i915_gem_object_put_pages(obj);
+fail_unlock:
+        mutex_unlock(&dev->struct_mutex);
+
+        return ret;
+}
+
+/**
+ * This is the fallback shmem pwrite path, which uses get_user_pages to pin
+ * the memory and maps it using kmap_atomic for copying.
+ *
+ * This avoids taking mmap_sem for faulting on the user's address while the
+ * struct_mutex is held.
+ */
+static int
+i915_gem_shmem_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
+                           struct drm_i915_gem_pwrite *args,
+                           struct drm_file *file_priv)
+{
+        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct mm_struct *mm = current->mm;
+        struct page **user_pages;
+        ssize_t remain;
+        loff_t offset, pinned_pages, i;
+        loff_t first_data_page, last_data_page, num_pages;
+        int shmem_page_index, shmem_page_offset;
+        int data_page_index,  data_page_offset;
+        int page_length;
+        int ret;
+        uint64_t data_ptr = args->data_ptr;
+
+        remain = args->size;
+
+        /* Pin the user pages containing the data.  We can't fault while
+         * holding the struct mutex, and all of the pwrite implementations
+         * want to hold it while dereferencing the user data.
+         */
+        first_data_page = data_ptr / PAGE_SIZE;
+        last_data_page = (data_ptr + args->size - 1) / PAGE_SIZE;
+        num_pages = last_data_page - first_data_page + 1;
+
+        user_pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL);
+        if (user_pages == NULL)
+                return -ENOMEM;
+
+        down_read(&mm->mmap_sem);
+        pinned_pages = get_user_pages(current, mm, (uintptr_t)args->data_ptr,
+                                      num_pages, 0, 0, user_pages, NULL);
+        up_read(&mm->mmap_sem);
+        if (pinned_pages < num_pages) {
+                ret = -EFAULT;
+                goto fail_put_user_pages;
+        }
+
+        mutex_lock(&dev->struct_mutex);
+
+        ret = i915_gem_object_get_pages(obj);
+        if (ret != 0)
+                goto fail_unlock;
+
+        ret = i915_gem_object_set_to_cpu_domain(obj, 1);
+        if (ret != 0)
+                goto fail_put_pages;
+
+        obj_priv = obj->driver_private;
         offset = args->offset;
+        obj_priv->dirty = 1;
 
-        written = vfs_write(obj->filp,
-                            (char __user *)(uintptr_t) args->data_ptr,
-                            args->size, &offset);
-        if (written != args->size) {
-                mutex_unlock(&dev->struct_mutex);
-                if (written < 0)
-                        return written;
-                else
-                        return -EINVAL;
+        while (remain > 0) {
+                /* Operation in this page
+                 *
+                 * shmem_page_index = page number within shmem file
+                 * shmem_page_offset = offset within page in shmem file
+                 * data_page_index = page number in get_user_pages return
+                 * data_page_offset = offset with data_page_index page.
+                 * page_length = bytes to copy for this page
+                 */
+                shmem_page_index = offset / PAGE_SIZE;
+                shmem_page_offset = offset & ~PAGE_MASK;
+                data_page_index = data_ptr / PAGE_SIZE - first_data_page;
+                data_page_offset = data_ptr & ~PAGE_MASK;
+
+                page_length = remain;
+                if ((shmem_page_offset + page_length) > PAGE_SIZE)
+                        page_length = PAGE_SIZE - shmem_page_offset;
+                if ((data_page_offset + page_length) > PAGE_SIZE)
+                        page_length = PAGE_SIZE - data_page_offset;
+
+                ret = slow_shmem_copy(obj_priv->pages[shmem_page_index],
+                                      shmem_page_offset,
+                                      user_pages[data_page_index],
+                                      data_page_offset,
+                                      page_length);
+                if (ret)
+                        goto fail_put_pages;
+
+                remain -= page_length;
+                data_ptr += page_length;
+                offset += page_length;
         }
 
+fail_put_pages:
+        i915_gem_object_put_pages(obj);
+fail_unlock:
         mutex_unlock(&dev->struct_mutex);
+fail_put_user_pages:
+        for (i = 0; i < pinned_pages; i++)
+                page_cache_release(user_pages[i]);
+        kfree(user_pages);
 
-        return 0;
+        return ret;
 }
 
 /**
@@ -388,10 +845,19 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
         if (obj_priv->phys_obj)
                 ret = i915_gem_phys_pwrite(dev, obj, args, file_priv);
         else if (obj_priv->tiling_mode == I915_TILING_NONE &&
-                 dev->gtt_total != 0)
-                ret = i915_gem_gtt_pwrite(dev, obj, args, file_priv);
-        else
-                ret = i915_gem_shmem_pwrite(dev, obj, args, file_priv);
+                 dev->gtt_total != 0) {
+                ret = i915_gem_gtt_pwrite_fast(dev, obj, args, file_priv);
+                if (ret == -EFAULT) {
+                        ret = i915_gem_gtt_pwrite_slow(dev, obj, args,
+                                                       file_priv);
+                }
+        } else {
+                ret = i915_gem_shmem_pwrite_fast(dev, obj, args, file_priv);
+                if (ret == -EFAULT) {
+                        ret = i915_gem_shmem_pwrite_slow(dev, obj, args,
+                                                         file_priv);
+                }
+        }
 
 #if WATCH_PWRITE
         if (ret)
@@ -816,29 +1282,30 @@ i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
 }
 
 static void
-i915_gem_object_free_page_list(struct drm_gem_object *obj)
+i915_gem_object_put_pages(struct drm_gem_object *obj)
 {
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
         int page_count = obj->size / PAGE_SIZE;
         int i;
 
-        if (obj_priv->page_list == NULL)
-                return;
+        BUG_ON(obj_priv->pages_refcount == 0);
 
+        if (--obj_priv->pages_refcount != 0)
+                return;
 
         for (i = 0; i < page_count; i++)
-                if (obj_priv->page_list[i] != NULL) {
+                if (obj_priv->pages[i] != NULL) {
                         if (obj_priv->dirty)
-                                set_page_dirty(obj_priv->page_list[i]);
-                        mark_page_accessed(obj_priv->page_list[i]);
-                        page_cache_release(obj_priv->page_list[i]);
+                                set_page_dirty(obj_priv->pages[i]);
+                        mark_page_accessed(obj_priv->pages[i]);
+                        page_cache_release(obj_priv->pages[i]);
                 }
         obj_priv->dirty = 0;
 
-        drm_free(obj_priv->page_list,
+        drm_free(obj_priv->pages,
                  page_count * sizeof(struct page *),
                  DRM_MEM_DRIVER);
-        obj_priv->page_list = NULL;
+        obj_priv->pages = NULL;
 }
 
 static void
@@ -1290,7 +1757,7 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
         if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
                 i915_gem_clear_fence_reg(obj);
 
-        i915_gem_object_free_page_list(obj);
+        i915_gem_object_put_pages(obj);
 
         if (obj_priv->gtt_space) {
                 atomic_dec(&dev->gtt_count);
@@ -1409,7 +1876,7 @@ i915_gem_evict_everything(struct drm_device *dev)
 }
 
 static int
-i915_gem_object_get_page_list(struct drm_gem_object *obj)
+i915_gem_object_get_pages(struct drm_gem_object *obj)
 {
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
         int page_count, i;
@@ -1418,18 +1885,19 @@ i915_gem_object_get_page_list(struct drm_gem_object *obj)
         struct page *page;
         int ret;
 
-        if (obj_priv->page_list)
+        if (obj_priv->pages_refcount++ != 0)
                 return 0;
 
         /* Get the list of pages out of our struct file.  They'll be pinned
          * at this point until we release them.
          */
         page_count = obj->size / PAGE_SIZE;
-        BUG_ON(obj_priv->page_list != NULL);
-        obj_priv->page_list = drm_calloc(page_count, sizeof(struct page *),
-                                         DRM_MEM_DRIVER);
-        if (obj_priv->page_list == NULL) {
+        BUG_ON(obj_priv->pages != NULL);
+        obj_priv->pages = drm_calloc(page_count, sizeof(struct page *),
+                                     DRM_MEM_DRIVER);
+        if (obj_priv->pages == NULL) {
                 DRM_ERROR("Faled to allocate page list\n");
+                obj_priv->pages_refcount--;
                 return -ENOMEM;
         }
 
@@ -1440,10 +1908,10 @@ i915_gem_object_get_page_list(struct drm_gem_object *obj)
                 if (IS_ERR(page)) {
                         ret = PTR_ERR(page);
                         DRM_ERROR("read_mapping_page failed: %d\n", ret);
-                        i915_gem_object_free_page_list(obj);
+                        i915_gem_object_put_pages(obj);
                         return ret;
                 }
-                obj_priv->page_list[i] = page;
+                obj_priv->pages[i] = page;
         }
         return 0;
 }
@@ -1766,7 +2234,7 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
         DRM_INFO("Binding object of size %d at 0x%08x\n",
                  obj->size, obj_priv->gtt_offset);
 #endif
-        ret = i915_gem_object_get_page_list(obj);
+        ret = i915_gem_object_get_pages(obj);
         if (ret) {
                 drm_mm_put_block(obj_priv->gtt_space);
                 obj_priv->gtt_space = NULL;
@@ -1778,12 +2246,12 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
          * into the GTT.
          */
         obj_priv->agp_mem = drm_agp_bind_pages(dev,
-                                               obj_priv->page_list,
+                                               obj_priv->pages,
                                                page_count,
                                                obj_priv->gtt_offset,
                                                obj_priv->agp_type);
         if (obj_priv->agp_mem == NULL) {
-                i915_gem_object_free_page_list(obj);
+                i915_gem_object_put_pages(obj);
                 drm_mm_put_block(obj_priv->gtt_space);
                 obj_priv->gtt_space = NULL;
                 return -ENOMEM;
@@ -1810,10 +2278,10 @@ i915_gem_clflush_object(struct drm_gem_object *obj)
          * to GPU, and we can ignore the cache flush because it'll happen
          * again at bind time.
          */
-        if (obj_priv->page_list == NULL)
+        if (obj_priv->pages == NULL)
                 return;
 
-        drm_clflush_pages(obj_priv->page_list, obj->size / PAGE_SIZE);
+        drm_clflush_pages(obj_priv->pages, obj->size / PAGE_SIZE);
 }
 
 /** Flushes any GPU write domain for the object if it's dirty. */
@@ -1913,7 +2381,6 @@ i915_gem_object_set_to_gtt_domain(struct drm_gem_object *obj, int write)
 static int
 i915_gem_object_set_to_cpu_domain(struct drm_gem_object *obj, int write)
 {
-        struct drm_device *dev = obj->dev;
         int ret;
 
         i915_gem_object_flush_gpu_write_domain(obj);
@@ -1932,7 +2399,6 @@ i915_gem_object_set_to_cpu_domain(struct drm_gem_object *obj, int write)
         /* Flush the CPU cache if it's still invalid. */
         if ((obj->read_domains & I915_GEM_DOMAIN_CPU) == 0) {
                 i915_gem_clflush_object(obj);
-                drm_agp_chipset_flush(dev);
 
                 obj->read_domains |= I915_GEM_DOMAIN_CPU;
         }
@@ -2144,7 +2610,6 @@ i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj)
 static void
 i915_gem_object_set_to_full_cpu_read_domain(struct drm_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
 
         if (!obj_priv->page_cpu_valid)
@@ -2158,9 +2623,8 @@ i915_gem_object_set_to_full_cpu_read_domain(struct drm_gem_object *obj)
                 for (i = 0; i <= (obj->size - 1) / PAGE_SIZE; i++) {
                         if (obj_priv->page_cpu_valid[i])
                                 continue;
-                        drm_clflush_pages(obj_priv->page_list + i, 1);
+                        drm_clflush_pages(obj_priv->pages + i, 1);
                 }
-                drm_agp_chipset_flush(dev);
         }
 
         /* Free the page_cpu_valid mappings which are now stale, whether
@@ -2224,7 +2688,7 @@ i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
                 if (obj_priv->page_cpu_valid[i])
                         continue;
 
-                drm_clflush_pages(obj_priv->page_list + i, 1);
+                drm_clflush_pages(obj_priv->pages + i, 1);
 
                 obj_priv->page_cpu_valid[i] = 1;
         }
@@ -2245,12 +2709,11 @@ i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
 static int
 i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                                  struct drm_file *file_priv,
-                                 struct drm_i915_gem_exec_object *entry)
+                                 struct drm_i915_gem_exec_object *entry,
+                                 struct drm_i915_gem_relocation_entry *relocs)
 {
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_relocation_entry reloc;
-        struct drm_i915_gem_relocation_entry __user *relocs;
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
         int i, ret;
         void __iomem *reloc_page;
@@ -2262,25 +2725,18 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
 
         entry->offset = obj_priv->gtt_offset;
 
-        relocs = (struct drm_i915_gem_relocation_entry __user *)
-                 (uintptr_t) entry->relocs_ptr;
         /* Apply the relocations, using the GTT aperture to avoid cache
          * flushing requirements.
          */
         for (i = 0; i < entry->relocation_count; i++) {
+                struct drm_i915_gem_relocation_entry *reloc= &relocs[i];
                 struct drm_gem_object *target_obj;
                 struct drm_i915_gem_object *target_obj_priv;
                 uint32_t reloc_val, reloc_offset;
                 uint32_t __iomem *reloc_entry;
 
-                ret = copy_from_user(&reloc, relocs + i, sizeof(reloc));
-                if (ret != 0) {
-                        i915_gem_object_unpin(obj);
-                        return ret;
-                }
-
                 target_obj = drm_gem_object_lookup(obj->dev, file_priv,
-                                                   reloc.target_handle);
+                                                   reloc->target_handle);
                 if (target_obj == NULL) {
                         i915_gem_object_unpin(obj);
                         return -EBADF;
@@ -2292,53 +2748,53 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                  */
                 if (target_obj_priv->gtt_space == NULL) {
                         DRM_ERROR("No GTT space found for object %d\n",
-                                  reloc.target_handle);
+                                  reloc->target_handle);
                         drm_gem_object_unreference(target_obj);
                         i915_gem_object_unpin(obj);
                         return -EINVAL;
                 }
 
-                if (reloc.offset > obj->size - 4) {
+                if (reloc->offset > obj->size - 4) {
                         DRM_ERROR("Relocation beyond object bounds: "
                                   "obj %p target %d offset %d size %d.\n",
-                                  obj, reloc.target_handle,
-                                  (int) reloc.offset, (int) obj->size);
+                                  obj, reloc->target_handle,
+                                  (int) reloc->offset, (int) obj->size);
                         drm_gem_object_unreference(target_obj);
                         i915_gem_object_unpin(obj);
                         return -EINVAL;
                 }
-                if (reloc.offset & 3) {
+                if (reloc->offset & 3) {
                         DRM_ERROR("Relocation not 4-byte aligned: "
                                   "obj %p target %d offset %d.\n",
-                                  obj, reloc.target_handle,
-                                  (int) reloc.offset);
+                                  obj, reloc->target_handle,
+                                  (int) reloc->offset);
                         drm_gem_object_unreference(target_obj);
                         i915_gem_object_unpin(obj);
                         return -EINVAL;
                 }
 
-                if (reloc.write_domain & I915_GEM_DOMAIN_CPU ||
-                    reloc.read_domains & I915_GEM_DOMAIN_CPU) {
+                if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||
+                    reloc->read_domains & I915_GEM_DOMAIN_CPU) {
                         DRM_ERROR("reloc with read/write CPU domains: "
                                   "obj %p target %d offset %d "
                                   "read %08x write %08x",
-                                  obj, reloc.target_handle,
-                                  (int) reloc.offset,
-                                  reloc.read_domains,
-                                  reloc.write_domain);
+                                  obj, reloc->target_handle,
+                                  (int) reloc->offset,
+                                  reloc->read_domains,
+                                  reloc->write_domain);
                         drm_gem_object_unreference(target_obj);
                         i915_gem_object_unpin(obj);
                         return -EINVAL;
                 }
 
-                if (reloc.write_domain && target_obj->pending_write_domain &&
-                    reloc.write_domain != target_obj->pending_write_domain) {
+                if (reloc->write_domain && target_obj->pending_write_domain &&
+                    reloc->write_domain != target_obj->pending_write_domain) {
                         DRM_ERROR("Write domain conflict: "
                                   "obj %p target %d offset %d "
                                   "new %08x old %08x\n",
-                                  obj, reloc.target_handle,
-                                  (int) reloc.offset,
-                                  reloc.write_domain,
+                                  obj, reloc->target_handle,
+                                  (int) reloc->offset,
+                                  reloc->write_domain,
                                   target_obj->pending_write_domain);
                         drm_gem_object_unreference(target_obj);
                         i915_gem_object_unpin(obj);
@@ -2351,22 +2807,22 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                          "presumed %08x delta %08x\n",
                          __func__,
                          obj,
-                         (int) reloc.offset,
-                         (int) reloc.target_handle,
-                         (int) reloc.read_domains,
-                         (int) reloc.write_domain,
+                         (int) reloc->offset,
+                         (int) reloc->target_handle,
+                         (int) reloc->read_domains,
+                         (int) reloc->write_domain,
                          (int) target_obj_priv->gtt_offset,
-                         (int) reloc.presumed_offset,
-                         reloc.delta);
+                         (int) reloc->presumed_offset,
+                         reloc->delta);
 #endif
 
-                target_obj->pending_read_domains |= reloc.read_domains;
-                target_obj->pending_write_domain |= reloc.write_domain;
+                target_obj->pending_read_domains |= reloc->read_domains;
+                target_obj->pending_write_domain |= reloc->write_domain;
 
                 /* If the relocation already has the right value in it, no
                  * more work needs to be done.
                  */
-                if (target_obj_priv->gtt_offset == reloc.presumed_offset) {
+                if (target_obj_priv->gtt_offset == reloc->presumed_offset) {
                         drm_gem_object_unreference(target_obj);
                         continue;
                 }
@@ -2381,32 +2837,26 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                 /* Map the page containing the relocation we're going to
                  * perform.
                  */
-                reloc_offset = obj_priv->gtt_offset + reloc.offset;
+                reloc_offset = obj_priv->gtt_offset + reloc->offset;
                 reloc_page = io_mapping_map_atomic_wc(dev_priv->mm.gtt_mapping,
                                                       (reloc_offset &
                                                        ~(PAGE_SIZE - 1)));
                 reloc_entry = (uint32_t __iomem *)(reloc_page +
                                                    (reloc_offset & (PAGE_SIZE - 1)));
-                reloc_val = target_obj_priv->gtt_offset + reloc.delta;
+                reloc_val = target_obj_priv->gtt_offset + reloc->delta;
 
 #if WATCH_BUF
                 DRM_INFO("Applied relocation: %p@0x%08x %08x -> %08x\n",
-                          obj, (unsigned int) reloc.offset,
+                          obj, (unsigned int) reloc->offset,
                           readl(reloc_entry), reloc_val);
 #endif
                 writel(reloc_val, reloc_entry);
                 io_mapping_unmap_atomic(reloc_page);
 
-                /* Write the updated presumed offset for this entry back out
-                 * to the user.
+                /* The updated presumed offset for this entry will be
+                 * copied back out to the user.
                  */
-                reloc.presumed_offset = target_obj_priv->gtt_offset;
-                ret = copy_to_user(relocs + i, &reloc, sizeof(reloc));
-                if (ret != 0) {
-                        drm_gem_object_unreference(target_obj);
-                        i915_gem_object_unpin(obj);
-                        return ret;
-                }
+                reloc->presumed_offset = target_obj_priv->gtt_offset;
 
                 drm_gem_object_unreference(target_obj);
         }
@@ -2423,11 +2873,10 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
 static int
 i915_dispatch_gem_execbuffer(struct drm_device *dev,
                               struct drm_i915_gem_execbuffer *exec,
+                              struct drm_clip_rect *cliprects,
                               uint64_t exec_offset)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_clip_rect __user *boxes = (struct drm_clip_rect __user *)
-                                             (uintptr_t) exec->cliprects_ptr;
         int nbox = exec->num_cliprects;
         int i = 0, count;
         uint32_t        exec_start, exec_len;
@@ -2448,7 +2897,7 @@ i915_dispatch_gem_execbuffer(struct drm_device *dev,
 
         for (i = 0; i < count; i++) {
                 if (i < nbox) {
-                        int ret = i915_emit_box(dev, boxes, i,
+                        int ret = i915_emit_box(dev, cliprects, i,
                                                 exec->DR1, exec->DR4);
                         if (ret)
                                 return ret;
@@ -2504,6 +2953,75 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file_priv)
         return ret;
 }
 
+static int
+i915_gem_get_relocs_from_user(struct drm_i915_gem_exec_object *exec_list,
+                              uint32_t buffer_count,
+                              struct drm_i915_gem_relocation_entry **relocs)
+{
+        uint32_t reloc_count = 0, reloc_index = 0, i;
+        int ret;
+
+        *relocs = NULL;
+        for (i = 0; i < buffer_count; i++) {
+                if (reloc_count + exec_list[i].relocation_count < reloc_count)
+                        return -EINVAL;
+                reloc_count += exec_list[i].relocation_count;
+        }
+
+        *relocs = drm_calloc(reloc_count, sizeof(**relocs), DRM_MEM_DRIVER);
+        if (*relocs == NULL)
+                return -ENOMEM;
+
+        for (i = 0; i < buffer_count; i++) {
+                struct drm_i915_gem_relocation_entry __user *user_relocs;
+
+                user_relocs = (void __user *)(uintptr_t)exec_list[i].relocs_ptr;
+
+                ret = copy_from_user(&(*relocs)[reloc_index],
+                                     user_relocs,
+                                     exec_list[i].relocation_count *
+                                     sizeof(**relocs));
+                if (ret != 0) {
+                        drm_free(*relocs, reloc_count * sizeof(**relocs),
+                                 DRM_MEM_DRIVER);
+                        *relocs = NULL;
+                        return ret;
+                }
+
+                reloc_index += exec_list[i].relocation_count;
+        }
+
+        return ret;
+}
+
+static int
+i915_gem_put_relocs_to_user(struct drm_i915_gem_exec_object *exec_list,
+                            uint32_t buffer_count,
+                            struct drm_i915_gem_relocation_entry *relocs)
+{
+        uint32_t reloc_count = 0, i;
+        int ret;
+
+        for (i = 0; i < buffer_count; i++) {
+                struct drm_i915_gem_relocation_entry __user *user_relocs;
+
+                user_relocs = (void __user *)(uintptr_t)exec_list[i].relocs_ptr;
+
+                if (ret == 0) {
+                        ret = copy_to_user(user_relocs,
+                                           &relocs[reloc_count],
+                                           exec_list[i].relocation_count *
+                                           sizeof(*relocs));
+                }
+
+                reloc_count += exec_list[i].relocation_count;
+        }
+
+        drm_free(relocs, reloc_count * sizeof(*relocs), DRM_MEM_DRIVER);
+
+        return ret;
+}
+
 int
 i915_gem_execbuffer(struct drm_device *dev, void *data,
                     struct drm_file *file_priv)
@@ -2515,9 +3033,11 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
         struct drm_gem_object **object_list = NULL;
         struct drm_gem_object *batch_obj;
         struct drm_i915_gem_object *obj_priv;
-        int ret, i, pinned = 0;
+        struct drm_clip_rect *cliprects = NULL;
+        struct drm_i915_gem_relocation_entry *relocs;
+        int ret, ret2, i, pinned = 0;
         uint64_t exec_offset;
-        uint32_t seqno, flush_domains;
+        uint32_t seqno, flush_domains, reloc_index;
         int pin_tries;
 
 #if WATCH_EXEC
@@ -2551,6 +3071,28 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
                 goto pre_mutex_err;
         }
 
+        if (args->num_cliprects != 0) {
+                cliprects = drm_calloc(args->num_cliprects, sizeof(*cliprects),
+                                       DRM_MEM_DRIVER);
+                if (cliprects == NULL)
+                        goto pre_mutex_err;
+
+                ret = copy_from_user(cliprects,
+                                     (struct drm_clip_rect __user *)
+                                     (uintptr_t) args->cliprects_ptr,
+                                     sizeof(*cliprects) * args->num_cliprects);
+                if (ret != 0) {
+                        DRM_ERROR("copy %d cliprects failed: %d\n",
+                                  args->num_cliprects, ret);
+                        goto pre_mutex_err;
+                }
+        }
+
+        ret = i915_gem_get_relocs_from_user(exec_list, args->buffer_count,
+                                            &relocs);
+        if (ret != 0)
+                goto pre_mutex_err;
+
         mutex_lock(&dev->struct_mutex);
 
         i915_verify_inactive(dev, __FILE__, __LINE__);
@@ -2593,15 +3135,19 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
         /* Pin and relocate */
         for (pin_tries = 0; ; pin_tries++) {
                 ret = 0;
+                reloc_index = 0;
+
                 for (i = 0; i < args->buffer_count; i++) {
                         object_list[i]->pending_read_domains = 0;
                         object_list[i]->pending_write_domain = 0;
                         ret = i915_gem_object_pin_and_relocate(object_list[i],
                                                                file_priv,
-                                                               &exec_list[i]);
+                                                               &exec_list[i],
+                                                               &relocs[reloc_index]);
                         if (ret)
                                 break;
                         pinned = i + 1;
+                        reloc_index += exec_list[i].relocation_count;
                 }
                 /* success */
                 if (ret == 0)
@@ -2687,7 +3233,7 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
 #endif
 
         /* Exec the batchbuffer */
-        ret = i915_dispatch_gem_execbuffer(dev, args, exec_offset);
+        ret = i915_dispatch_gem_execbuffer(dev, args, cliprects, exec_offset);
         if (ret) {
                 DRM_ERROR("dispatch failed %d\n", ret);
                 goto err;
@@ -2751,11 +3297,27 @@ err:
                                   args->buffer_count, ret);
         }
 
+        /* Copy the updated relocations out regardless of current error
+         * state.  Failure to update the relocs would mean that the next
+         * time userland calls execbuf, it would do so with presumed offset
+         * state that didn't match the actual object state.
+         */
+        ret2 = i915_gem_put_relocs_to_user(exec_list, args->buffer_count,
+                                           relocs);
+        if (ret2 != 0) {
+                DRM_ERROR("Failed to copy relocations back out: %d\n", ret2);
+
+                if (ret == 0)
+                        ret = ret2;
+        }
+
 pre_mutex_err:
         drm_free(object_list, sizeof(*object_list) * args->buffer_count,
                  DRM_MEM_DRIVER);
         drm_free(exec_list, sizeof(*exec_list) * args->buffer_count,
                  DRM_MEM_DRIVER);
+        drm_free(cliprects, sizeof(*cliprects) * args->num_cliprects,
+                 DRM_MEM_DRIVER);
 
         return ret;
 }
@@ -3192,7 +3754,7 @@ i915_gem_init_hws(struct drm_device *dev)
 
         dev_priv->status_gfx_addr = obj_priv->gtt_offset;
 
-        dev_priv->hw_status_page = kmap(obj_priv->page_list[0]);
+        dev_priv->hw_status_page = kmap(obj_priv->pages[0]);
         if (dev_priv->hw_status_page == NULL) {
                 DRM_ERROR("Failed to map status page.\n");
                 memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
@@ -3222,7 +3784,7 @@ i915_gem_cleanup_hws(struct drm_device *dev)
         obj = dev_priv->hws_obj;
         obj_priv = obj->driver_private;
 
-        kunmap(obj_priv->page_list[0]);
+        kunmap(obj_priv->pages[0]);
         i915_gem_object_unpin(obj);
         drm_gem_object_unreference(obj);
         dev_priv->hws_obj = NULL;
@@ -3525,20 +4087,20 @@ void i915_gem_detach_phys_object(struct drm_device *dev,
         if (!obj_priv->phys_obj)
                 return;
 
-        ret = i915_gem_object_get_page_list(obj);
+        ret = i915_gem_object_get_pages(obj);
         if (ret)
                 goto out;
 
         page_count = obj->size / PAGE_SIZE;
 
         for (i = 0; i < page_count; i++) {
-                char *dst = kmap_atomic(obj_priv->page_list[i], KM_USER0);
+                char *dst = kmap_atomic(obj_priv->pages[i], KM_USER0);
                 char *src = obj_priv->phys_obj->handle->vaddr + (i * PAGE_SIZE);
 
                 memcpy(dst, src, PAGE_SIZE);
                 kunmap_atomic(dst, KM_USER0);
         }
-        drm_clflush_pages(obj_priv->page_list, page_count);
+        drm_clflush_pages(obj_priv->pages, page_count);
         drm_agp_chipset_flush(dev);
 out:
         obj_priv->phys_obj->cur_obj = NULL;
@@ -3581,7 +4143,7 @@ i915_gem_attach_phys_object(struct drm_device *dev,
         obj_priv->phys_obj = dev_priv->mm.phys_objs[id - 1];
         obj_priv->phys_obj->cur_obj = obj;
 
-        ret = i915_gem_object_get_page_list(obj);
+        ret = i915_gem_object_get_pages(obj);
         if (ret) {
                 DRM_ERROR("failed to get page list\n");
                 goto out;
@@ -3590,7 +4152,7 @@ i915_gem_attach_phys_object(struct drm_device *dev,
         page_count = obj->size / PAGE_SIZE;
 
         for (i = 0; i < page_count; i++) {
-                char *src = kmap_atomic(obj_priv->page_list[i], KM_USER0);
+                char *src = kmap_atomic(obj_priv->pages[i], KM_USER0);
                 char *dst = obj_priv->phys_obj->handle->vaddr + (i * PAGE_SIZE);
 
                 memcpy(dst, src, PAGE_SIZE);
diff --git a/drivers/gpu/drm/i915/i915_gem_debugfs.c b/drivers/gpu/drm/i915/i915_gem_debugfs.c
new file mode 100644
index 000000000000..455ec970b385
--- /dev/null
+++ b/drivers/gpu/drm/i915/i915_gem_debugfs.c
@@ -0,0 +1,257 @@
+/*
+ * Copyright © 2008 Intel Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Eric Anholt <eric@anholt.net>
+ *    Keith Packard <keithp@keithp.com>
+ *
+ */
+
+#include <linux/seq_file.h>
+#include "drmP.h"
+#include "drm.h"
+#include "i915_drm.h"
+#include "i915_drv.h"
+
+#define DRM_I915_RING_DEBUG 1
+
+
+#if defined(CONFIG_DEBUG_FS)
+
+#define ACTIVE_LIST     1
+#define FLUSHING_LIST   2
+#define INACTIVE_LIST   3
+
+static const char *get_pin_flag(struct drm_i915_gem_object *obj_priv)
+{
+        if (obj_priv->user_pin_count > 0)
+                return "P";
+        else if (obj_priv->pin_count > 0)
+                return "p";
+        else
+                return " ";
+}
+
+static const char *get_tiling_flag(struct drm_i915_gem_object *obj_priv)
+{
+    switch (obj_priv->tiling_mode) {
+    default:
+    case I915_TILING_NONE: return " ";
+    case I915_TILING_X: return "X";
+    case I915_TILING_Y: return "Y";
+    }
+}
+
+static int i915_gem_object_list_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        uintptr_t list = (uintptr_t) node->info_ent->data;
+        struct list_head *head;
+        struct drm_device *dev = node->minor->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_gem_object *obj_priv;
+
+        switch (list) {
+        case ACTIVE_LIST:
+                seq_printf(m, "Active:\n");
+                head = &dev_priv->mm.active_list;
+                break;
+        case INACTIVE_LIST:
+                seq_printf(m, "Inctive:\n");
+                head = &dev_priv->mm.inactive_list;
+                break;
+        case FLUSHING_LIST:
+                seq_printf(m, "Flushing:\n");
+                head = &dev_priv->mm.flushing_list;
+                break;
+        default:
+                DRM_INFO("Ooops, unexpected list\n");
+                return 0;
+        }
+
+        list_for_each_entry(obj_priv, head, list)
+        {
+                struct drm_gem_object *obj = obj_priv->obj;
+
+                seq_printf(m, "    %p: %s %08x %08x %d",
+                           obj,
+                           get_pin_flag(obj_priv),
+                           obj->read_domains, obj->write_domain,
+                           obj_priv->last_rendering_seqno);
+
+                if (obj->name)
+                        seq_printf(m, " (name: %d)", obj->name);
+                if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
+                        seq_printf(m, " (fence: %d\n", obj_priv->fence_reg);
+                seq_printf(m, "\n");
+        }
+        return 0;
+}
+
+static int i915_gem_request_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_gem_request *gem_request;
+
+        seq_printf(m, "Request:\n");
+        list_for_each_entry(gem_request, &dev_priv->mm.request_list, list) {
+                seq_printf(m, "    %d @ %d\n",
+                           gem_request->seqno,
+                           (int) (jiffies - gem_request->emitted_jiffies));
+        }
+        return 0;
+}
+
+static int i915_gem_seqno_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+
+        if (dev_priv->hw_status_page != NULL) {
+                seq_printf(m, "Current sequence: %d\n",
+                           i915_get_gem_seqno(dev));
+        } else {
+                seq_printf(m, "Current sequence: hws uninitialized\n");
+        }
+        seq_printf(m, "Waiter sequence:  %d\n",
+                        dev_priv->mm.waiting_gem_seqno);
+        seq_printf(m, "IRQ sequence:     %d\n", dev_priv->mm.irq_gem_seqno);
+        return 0;
+}
+
+
+static int i915_interrupt_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+
+        seq_printf(m, "Interrupt enable:    %08x\n",
+                   I915_READ(IER));
+        seq_printf(m, "Interrupt identity:  %08x\n",
+                   I915_READ(IIR));
+        seq_printf(m, "Interrupt mask:      %08x\n",
+                   I915_READ(IMR));
+        seq_printf(m, "Pipe A stat:         %08x\n",
+                   I915_READ(PIPEASTAT));
+        seq_printf(m, "Pipe B stat:         %08x\n",
+                   I915_READ(PIPEBSTAT));
+        seq_printf(m, "Interrupts received: %d\n",
+                   atomic_read(&dev_priv->irq_received));
+        if (dev_priv->hw_status_page != NULL) {
+                seq_printf(m, "Current sequence:    %d\n",
+                           i915_get_gem_seqno(dev));
+        } else {
+                seq_printf(m, "Current sequence:    hws uninitialized\n");
+        }
+        seq_printf(m, "Waiter sequence:     %d\n",
+                   dev_priv->mm.waiting_gem_seqno);
+        seq_printf(m, "IRQ sequence:        %d\n",
+                   dev_priv->mm.irq_gem_seqno);
+        return 0;
+}
+
+static int i915_gem_fence_regs_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        int i;
+
+        seq_printf(m, "Reserved fences = %d\n", dev_priv->fence_reg_start);
+        seq_printf(m, "Total fences = %d\n", dev_priv->num_fence_regs);
+        for (i = 0; i < dev_priv->num_fence_regs; i++) {
+                struct drm_gem_object *obj = dev_priv->fence_regs[i].obj;
+
+                if (obj == NULL) {
+                        seq_printf(m, "Fenced object[%2d] = unused\n", i);
+                } else {
+                        struct drm_i915_gem_object *obj_priv;
+
+                        obj_priv = obj->driver_private;
+                        seq_printf(m, "Fenced object[%2d] = %p: %s "
+                                   "%08x %08zx %08x %s %08x %08x %d",
+                                   i, obj, get_pin_flag(obj_priv),
+                                   obj_priv->gtt_offset,
+                                   obj->size, obj_priv->stride,
+                                   get_tiling_flag(obj_priv),
+                                   obj->read_domains, obj->write_domain,
+                                   obj_priv->last_rendering_seqno);
+                        if (obj->name)
+                                seq_printf(m, " (name: %d)", obj->name);
+                        seq_printf(m, "\n");
+                }
+        }
+
+        return 0;
+}
+
+static int i915_hws_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        int i;
+        volatile u32 *hws;
+
+        hws = (volatile u32 *)dev_priv->hw_status_page;
+        if (hws == NULL)
+                return 0;
+
+        for (i = 0; i < 4096 / sizeof(u32) / 4; i += 4) {
+                seq_printf(m, "0x%08x: 0x%08x 0x%08x 0x%08x 0x%08x\n",
+                           i * 4,
+                           hws[i], hws[i + 1], hws[i + 2], hws[i + 3]);
+        }
+        return 0;
+}
+
+static struct drm_info_list i915_gem_debugfs_list[] = {
+        {"i915_gem_active", i915_gem_object_list_info, 0, (void *) ACTIVE_LIST},
+        {"i915_gem_flushing", i915_gem_object_list_info, 0, (void *) FLUSHING_LIST},
+        {"i915_gem_inactive", i915_gem_object_list_info, 0, (void *) INACTIVE_LIST},
+        {"i915_gem_request", i915_gem_request_info, 0},
+        {"i915_gem_seqno", i915_gem_seqno_info, 0},
+        {"i915_gem_fence_regs", i915_gem_fence_regs_info, 0},
+        {"i915_gem_interrupt", i915_interrupt_info, 0},
+        {"i915_gem_hws", i915_hws_info, 0},
+};
+#define I915_GEM_DEBUGFS_ENTRIES ARRAY_SIZE(i915_gem_debugfs_list)
+
+int i915_gem_debugfs_init(struct drm_minor *minor)
+{
+        return drm_debugfs_create_files(i915_gem_debugfs_list,
+                                        I915_GEM_DEBUGFS_ENTRIES,
+                                        minor->debugfs_root, minor);
+}
+
+void i915_gem_debugfs_cleanup(struct drm_minor *minor)
+{
+        drm_debugfs_remove_files(i915_gem_debugfs_list,
+                                 I915_GEM_DEBUGFS_ENTRIES, minor);
+}
+
+#endif /* CONFIG_DEBUG_FS */
+
diff --git a/drivers/gpu/drm/i915/i915_gem_proc.c b/drivers/gpu/drm/i915/i915_gem_proc.c
deleted file mode 100644
index 4d1b9de0cd8b..000000000000
--- a/drivers/gpu/drm/i915/i915_gem_proc.c
+++ /dev/null
@@ -1,334 +0,0 @@
-/*
- * Copyright © 2008 Intel Corporation
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the next
- * paragraph) shall be included in all copies or substantial portions of the
- * Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
- * IN THE SOFTWARE.
- *
- * Authors:
- *    Eric Anholt <eric@anholt.net>
- *    Keith Packard <keithp@keithp.com>
- *
- */
-
-#include "drmP.h"
-#include "drm.h"
-#include "i915_drm.h"
-#include "i915_drv.h"
-
-static int i915_gem_active_info(char *buf, char **start, off_t offset,
-                                int request, int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv;
-        int len = 0;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-        DRM_PROC_PRINT("Active:\n");
-        list_for_each_entry(obj_priv, &dev_priv->mm.active_list,
-                            list)
-        {
-                struct drm_gem_object *obj = obj_priv->obj;
-                if (obj->name) {
-                        DRM_PROC_PRINT("    %p(%d): %08x %08x %d\n",
-                                       obj, obj->name,
-                                       obj->read_domains, obj->write_domain,
-                                       obj_priv->last_rendering_seqno);
-                } else {
-                        DRM_PROC_PRINT("       %p: %08x %08x %d\n",
-                                       obj,
-                                       obj->read_domains, obj->write_domain,
-                                       obj_priv->last_rendering_seqno);
-                }
-        }
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-static int i915_gem_flushing_info(char *buf, char **start, off_t offset,
-                                  int request, int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv;
-        int len = 0;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-        DRM_PROC_PRINT("Flushing:\n");
-        list_for_each_entry(obj_priv, &dev_priv->mm.flushing_list,
-                            list)
-        {
-                struct drm_gem_object *obj = obj_priv->obj;
-                if (obj->name) {
-                        DRM_PROC_PRINT("    %p(%d): %08x %08x %d\n",
-                                       obj, obj->name,
-                                       obj->read_domains, obj->write_domain,
-                                       obj_priv->last_rendering_seqno);
-                } else {
-                        DRM_PROC_PRINT("       %p: %08x %08x %d\n", obj,
-                                       obj->read_domains, obj->write_domain,
-                                       obj_priv->last_rendering_seqno);
-                }
-        }
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-static int i915_gem_inactive_info(char *buf, char **start, off_t offset,
-                                  int request, int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv;
-        int len = 0;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-        DRM_PROC_PRINT("Inactive:\n");
-        list_for_each_entry(obj_priv, &dev_priv->mm.inactive_list,
-                            list)
-        {
-                struct drm_gem_object *obj = obj_priv->obj;
-                if (obj->name) {
-                        DRM_PROC_PRINT("    %p(%d): %08x %08x %d\n",
-                                       obj, obj->name,
-                                       obj->read_domains, obj->write_domain,
-                                       obj_priv->last_rendering_seqno);
-                } else {
-                        DRM_PROC_PRINT("       %p: %08x %08x %d\n", obj,
-                                       obj->read_domains, obj->write_domain,
-                                       obj_priv->last_rendering_seqno);
-                }
-        }
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-static int i915_gem_request_info(char *buf, char **start, off_t offset,
-                                 int request, int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_request *gem_request;
-        int len = 0;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-        DRM_PROC_PRINT("Request:\n");
-        list_for_each_entry(gem_request, &dev_priv->mm.request_list,
-                            list)
-        {
-                DRM_PROC_PRINT("    %d @ %d\n",
-                               gem_request->seqno,
-                               (int) (jiffies - gem_request->emitted_jiffies));
-        }
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-static int i915_gem_seqno_info(char *buf, char **start, off_t offset,
-                               int request, int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        int len = 0;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-        if (dev_priv->hw_status_page != NULL) {
-                DRM_PROC_PRINT("Current sequence: %d\n",
-                               i915_get_gem_seqno(dev));
-        } else {
-                DRM_PROC_PRINT("Current sequence: hws uninitialized\n");
-        }
-        DRM_PROC_PRINT("Waiter sequence:  %d\n",
-                       dev_priv->mm.waiting_gem_seqno);
-        DRM_PROC_PRINT("IRQ sequence:     %d\n", dev_priv->mm.irq_gem_seqno);
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-
-static int i915_interrupt_info(char *buf, char **start, off_t offset,
-                               int request, int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        int len = 0;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-        DRM_PROC_PRINT("Interrupt enable:    %08x\n",
-                       I915_READ(IER));
-        DRM_PROC_PRINT("Interrupt identity:  %08x\n",
-                       I915_READ(IIR));
-        DRM_PROC_PRINT("Interrupt mask:      %08x\n",
-                       I915_READ(IMR));
-        DRM_PROC_PRINT("Pipe A stat:         %08x\n",
-                       I915_READ(PIPEASTAT));
-        DRM_PROC_PRINT("Pipe B stat:         %08x\n",
-                       I915_READ(PIPEBSTAT));
-        DRM_PROC_PRINT("Interrupts received: %d\n",
-                       atomic_read(&dev_priv->irq_received));
-        if (dev_priv->hw_status_page != NULL) {
-                DRM_PROC_PRINT("Current sequence:    %d\n",
-                               i915_get_gem_seqno(dev));
-        } else {
-                DRM_PROC_PRINT("Current sequence:    hws uninitialized\n");
-        }
-        DRM_PROC_PRINT("Waiter sequence:     %d\n",
-                       dev_priv->mm.waiting_gem_seqno);
-        DRM_PROC_PRINT("IRQ sequence:        %d\n",
-                       dev_priv->mm.irq_gem_seqno);
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-static int i915_hws_info(char *buf, char **start, off_t offset,
-                         int request, int *eof, void *data)
-{
-        struct drm_minor *minor = (struct drm_minor *) data;
-        struct drm_device *dev = minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        int len = 0, i;
-        volatile u32 *hws;
-
-        if (offset > DRM_PROC_LIMIT) {
-                *eof = 1;
-                return 0;
-        }
-
-        hws = (volatile u32 *)dev_priv->hw_status_page;
-        if (hws == NULL) {
-                *eof = 1;
-                return 0;
-        }
-
-        *start = &buf[offset];
-        *eof = 0;
-        for (i = 0; i < 4096 / sizeof(u32) / 4; i += 4) {
-                DRM_PROC_PRINT("0x%08x: 0x%08x 0x%08x 0x%08x 0x%08x\n",
-                               i * 4,
-                               hws[i], hws[i + 1], hws[i + 2], hws[i + 3]);
-        }
-        if (len > request + offset)
-                return request;
-        *eof = 1;
-        return len - offset;
-}
-
-static struct drm_proc_list {
-        /** file name */
-        const char *name;
-        /** proc callback*/
-        int (*f) (char *, char **, off_t, int, int *, void *);
-} i915_gem_proc_list[] = {
-        {"i915_gem_active", i915_gem_active_info},
-        {"i915_gem_flushing", i915_gem_flushing_info},
-        {"i915_gem_inactive", i915_gem_inactive_info},
-        {"i915_gem_request", i915_gem_request_info},
-        {"i915_gem_seqno", i915_gem_seqno_info},
-        {"i915_gem_interrupt", i915_interrupt_info},
-        {"i915_gem_hws", i915_hws_info},
-};
-
-#define I915_GEM_PROC_ENTRIES ARRAY_SIZE(i915_gem_proc_list)
-
-int i915_gem_proc_init(struct drm_minor *minor)
-{
-        struct proc_dir_entry *ent;
-        int i, j;
-
-        for (i = 0; i < I915_GEM_PROC_ENTRIES; i++) {
-                ent = create_proc_entry(i915_gem_proc_list[i].name,
-                                        S_IFREG | S_IRUGO, minor->dev_root);
-                if (!ent) {
-                        DRM_ERROR("Cannot create /proc/dri/.../%s\n",
-                                  i915_gem_proc_list[i].name);
-                        for (j = 0; j < i; j++)
-                                remove_proc_entry(i915_gem_proc_list[i].name,
-                                                  minor->dev_root);
-                        return -1;
-                }
-                ent->read_proc = i915_gem_proc_list[i].f;
-                ent->data = minor;
-        }
-        return 0;
-}
-
-void i915_gem_proc_cleanup(struct drm_minor *minor)
-{
-        int i;
-
-        if (!minor->dev_root)
-                return;
-
-        for (i = 0; i < I915_GEM_PROC_ENTRIES; i++)
-                remove_proc_entry(i915_gem_proc_list[i].name, minor->dev_root);
-}
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 7fb4191ef934..4cce1aef438e 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -96,16 +96,16 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
                  */
                 swizzle_x = I915_BIT_6_SWIZZLE_NONE;
                 swizzle_y = I915_BIT_6_SWIZZLE_NONE;
-        } else if ((!IS_I965G(dev) && !IS_G33(dev)) || IS_I965GM(dev) ||
-                   IS_GM45(dev)) {
+        } else if (IS_MOBILE(dev)) {
                 uint32_t dcc;
 
-                /* On 915-945 and GM965, channel interleave by the CPU is
-                 * determined by DCC.  The CPU will alternate based on bit 6
-                 * in interleaved mode, and the GPU will then also alternate
-                 * on bit 6, 9, and 10 for X, but the CPU may also optionally
-                 * alternate based on bit 17 (XOR not disabled and XOR
-                 * bit == 17).
+                /* On mobile 9xx chipsets, channel interleave by the CPU is
+                 * determined by DCC.  For single-channel, neither the CPU
+                 * nor the GPU do swizzling.  For dual channel interleaved,
+                 * the GPU's interleave is bit 9 and 10 for X tiled, and bit
+                 * 9 for Y tiled.  The CPU's interleave is independent, and
+                 * can be based on either bit 11 (haven't seen this yet) or
+                 * bit 17 (common).
                  */
                 dcc = I915_READ(DCC);
                 switch (dcc & DCC_ADDRESSING_MODE_MASK) {
@@ -115,19 +115,18 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
                         swizzle_y = I915_BIT_6_SWIZZLE_NONE;
                         break;
                 case DCC_ADDRESSING_MODE_DUAL_CHANNEL_INTERLEAVED:
-                        if (IS_I915G(dev) || IS_I915GM(dev) ||
-                            dcc & DCC_CHANNEL_XOR_DISABLE) {
+                        if (dcc & DCC_CHANNEL_XOR_DISABLE) {
+                                /* This is the base swizzling by the GPU for
+                                 * tiled buffers.
+                                 */
                                 swizzle_x = I915_BIT_6_SWIZZLE_9_10;
                                 swizzle_y = I915_BIT_6_SWIZZLE_9;
-                        } else if ((IS_I965GM(dev) || IS_GM45(dev)) &&
-                                   (dcc & DCC_CHANNEL_XOR_BIT_17) == 0) {
-                                /* GM965/GM45 does either bit 11 or bit 17
-                                 * swizzling.
-                                 */
+                        } else if ((dcc & DCC_CHANNEL_XOR_BIT_17) == 0) {
+                                /* Bit 11 swizzling by the CPU in addition. */
                                 swizzle_x = I915_BIT_6_SWIZZLE_9_10_11;
                                 swizzle_y = I915_BIT_6_SWIZZLE_9_11;
                         } else {
-                                /* Bit 17 or perhaps other swizzling */
+                                /* Bit 17 swizzling by the CPU in addition. */
                                 swizzle_x = I915_BIT_6_SWIZZLE_UNKNOWN;
                                 swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
                         }
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 90600d899413..377cc588f5e9 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -359,6 +359,7 @@
 #define   DPLLB_LVDS_P2_CLOCK_DIV_7     (1 << 24) /* i915 */
 #define   DPLL_P2_CLOCK_DIV_MASK        0x03000000 /* i915 */
 #define   DPLL_FPA01_P1_POST_DIV_MASK   0x00ff0000 /* i915 */
+#define   DPLL_FPA01_P1_POST_DIV_MASK_IGD       0x00ff8000 /* IGD */
 
 #define I915_FIFO_UNDERRUN_STATUS               (1UL<<31)
 #define I915_CRC_ERROR_ENABLE                   (1UL<<29)
@@ -435,6 +436,7 @@
  */
 #define   DPLL_FPA01_P1_POST_DIV_MASK_I830_LVDS 0x003f0000
 #define   DPLL_FPA01_P1_POST_DIV_SHIFT  16
+#define   DPLL_FPA01_P1_POST_DIV_SHIFT_IGD 15
 /* i830, required in DVO non-gang */
 #define   PLL_P2_DIVIDE_BY_4            (1 << 23)
 #define   PLL_P1_DIVIDE_BY_TWO          (1 << 21) /* i830 */
@@ -501,10 +503,12 @@
 #define FPB0    0x06048
 #define FPB1    0x0604c
 #define   FP_N_DIV_MASK         0x003f0000
+#define   FP_N_IGD_DIV_MASK     0x00ff0000
 #define   FP_N_DIV_SHIFT                16
 #define   FP_M1_DIV_MASK        0x00003f00
 #define   FP_M1_DIV_SHIFT                8
 #define   FP_M2_DIV_MASK        0x0000003f
+#define   FP_M2_IGD_DIV_MASK    0x000000ff
 #define   FP_M2_DIV_SHIFT                0
 #define DPLL_TEST       0x606c
 #define   DPLLB_TEST_SDVO_DIV_1         (0 << 22)
@@ -629,6 +633,22 @@
 #define   TV_HOTPLUG_INT_EN                     (1 << 18)
 #define   CRT_HOTPLUG_INT_EN                    (1 << 9)
 #define   CRT_HOTPLUG_FORCE_DETECT              (1 << 3)
+#define CRT_HOTPLUG_ACTIVATION_PERIOD_32        (0 << 8)
+/* must use period 64 on GM45 according to docs */
+#define CRT_HOTPLUG_ACTIVATION_PERIOD_64        (1 << 8)
+#define CRT_HOTPLUG_DAC_ON_TIME_2M              (0 << 7)
+#define CRT_HOTPLUG_DAC_ON_TIME_4M              (1 << 7)
+#define CRT_HOTPLUG_VOLTAGE_COMPARE_40          (0 << 5)
+#define CRT_HOTPLUG_VOLTAGE_COMPARE_50          (1 << 5)
+#define CRT_HOTPLUG_VOLTAGE_COMPARE_60          (2 << 5)
+#define CRT_HOTPLUG_VOLTAGE_COMPARE_70          (3 << 5)
+#define CRT_HOTPLUG_VOLTAGE_COMPARE_MASK        (3 << 5)
+#define CRT_HOTPLUG_DETECT_DELAY_1G             (0 << 4)
+#define CRT_HOTPLUG_DETECT_DELAY_2G             (1 << 4)
+#define CRT_HOTPLUG_DETECT_VOLTAGE_325MV        (0 << 2)
+#define CRT_HOTPLUG_DETECT_VOLTAGE_475MV        (1 << 2)
+#define CRT_HOTPLUG_MASK                        (0x3fc) /* Bits 9-2 */
+
 
 #define PORT_HOTPLUG_STAT       0x61114
 #define   HDMIB_HOTPLUG_INT_STATUS              (1 << 29)
@@ -856,7 +876,7 @@
  */
 # define TV_ENC_C0_FIX                  (1 << 10)
 /** Bits that must be preserved by software */
-# define TV_CTL_SAVE                    ((3 << 8) | (3 << 6))
+# define TV_CTL_SAVE                    ((1 << 11) | (3 << 9) | (7 << 6) | 0xf)
 # define TV_FUSE_STATE_MASK             (3 << 4)
 /** Read-only state that reports all features enabled */
 # define TV_FUSE_STATE_ENABLED          (0 << 4)
diff --git a/drivers/gpu/drm/i915/intel_bios.h b/drivers/gpu/drm/i915/intel_bios.h
index 5ea715ace3a0..de621aad85b5 100644
--- a/drivers/gpu/drm/i915/intel_bios.h
+++ b/drivers/gpu/drm/i915/intel_bios.h
@@ -162,13 +162,13 @@ struct bdb_lvds_options {
         u8 panel_type;
         u8 rsvd1;
         /* LVDS capabilities, stored in a dword */
-        u8 rsvd2:1;
-        u8 lvds_edid:1;
-        u8 pixel_dither:1;
-        u8 pfit_ratio_auto:1;
-        u8 pfit_gfx_mode_enhanced:1;
-        u8 pfit_text_mode_enhanced:1;
         u8 pfit_mode:2;
+        u8 pfit_text_mode_enhanced:1;
+        u8 pfit_gfx_mode_enhanced:1;
+        u8 pfit_ratio_auto:1;
+        u8 pixel_dither:1;
+        u8 lvds_edid:1;
+        u8 rsvd2:1;
         u8 rsvd4;
 } __attribute__((packed));
 
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index dcaed3466e83..2b6d44381c31 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -64,11 +64,21 @@ static void intel_crt_dpms(struct drm_encoder *encoder, int mode)
 static int intel_crt_mode_valid(struct drm_connector *connector,
                                 struct drm_display_mode *mode)
 {
+        struct drm_device *dev = connector->dev;
+
+        int max_clock = 0;
         if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
                 return MODE_NO_DBLESCAN;
 
-        if (mode->clock > 400000 || mode->clock < 25000)
-                return MODE_CLOCK_RANGE;
+        if (mode->clock < 25000)
+                return MODE_CLOCK_LOW;
+
+        if (!IS_I9XX(dev))
+                max_clock = 350000;
+        else
+                max_clock = 400000;
+        if (mode->clock > max_clock)
+                return MODE_CLOCK_HIGH;
 
         return MODE_OK;
 }
@@ -113,10 +123,13 @@ static void intel_crt_mode_set(struct drm_encoder *encoder,
         if (adjusted_mode->flags & DRM_MODE_FLAG_PVSYNC)
                 adpa |= ADPA_VSYNC_ACTIVE_HIGH;
 
-        if (intel_crtc->pipe == 0)
+        if (intel_crtc->pipe == 0) {
                 adpa |= ADPA_PIPE_A_SELECT;
-        else
+                I915_WRITE(BCLRPAT_A, 0);
+        } else {
                 adpa |= ADPA_PIPE_B_SELECT;
+                I915_WRITE(BCLRPAT_B, 0);
+        }
 
         I915_WRITE(ADPA, adpa);
 }
@@ -133,20 +146,39 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        u32 temp;
-
-        unsigned long timeout = jiffies + msecs_to_jiffies(1000);
-
-        temp = I915_READ(PORT_HOTPLUG_EN);
-
-        I915_WRITE(PORT_HOTPLUG_EN,
-                   temp | CRT_HOTPLUG_FORCE_DETECT | (1 << 5));
+        u32 hotplug_en;
+        int i, tries = 0;
+        /*
+         * On 4 series desktop, CRT detect sequence need to be done twice
+         * to get a reliable result.
+         */
 
-        do {
-                if (!(I915_READ(PORT_HOTPLUG_EN) & CRT_HOTPLUG_FORCE_DETECT))
-                        break;
-                msleep(1);
-        } while (time_after(timeout, jiffies));
+        if (IS_G4X(dev) && !IS_GM45(dev))
+                tries = 2;
+        else
+                tries = 1;
+        hotplug_en = I915_READ(PORT_HOTPLUG_EN);
+        hotplug_en &= ~(CRT_HOTPLUG_MASK);
+        hotplug_en |= CRT_HOTPLUG_FORCE_DETECT;
+
+        if (IS_GM45(dev))
+                hotplug_en |= CRT_HOTPLUG_ACTIVATION_PERIOD_64;
+
+        hotplug_en |= CRT_HOTPLUG_VOLTAGE_COMPARE_50;
+
+        for (i = 0; i < tries ; i++) {
+                unsigned long timeout;
+                /* turn on the FORCE_DETECT */
+                I915_WRITE(PORT_HOTPLUG_EN, hotplug_en);
+                timeout = jiffies + msecs_to_jiffies(1000);
+                /* wait for FORCE_DETECT to go off */
+                do {
+                        if (!(I915_READ(PORT_HOTPLUG_EN) &
+                                        CRT_HOTPLUG_FORCE_DETECT))
+                                break;
+                        msleep(1);
+                } while (time_after(timeout, jiffies));
+        }
 
         if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) ==
             CRT_HOTPLUG_MONITOR_COLOR)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index a2834276cb38..d9c50ff94d76 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -56,11 +56,13 @@ typedef struct {
 } intel_p2_t;
 
 #define INTEL_P2_NUM                  2
-
-typedef struct {
+typedef struct intel_limit intel_limit_t;
+struct intel_limit {
     intel_range_t   dot, vco, n, m, m1, m2, p, p1;
     intel_p2_t      p2;
-} intel_limit_t;
+    bool (* find_pll)(const intel_limit_t *, struct drm_crtc *,
+                      int, int, intel_clock_t *);
+};
 
 #define I8XX_DOT_MIN              25000
 #define I8XX_DOT_MAX             350000
@@ -90,18 +92,32 @@ typedef struct {
 #define I9XX_DOT_MAX             400000
 #define I9XX_VCO_MIN            1400000
 #define I9XX_VCO_MAX            2800000
+#define IGD_VCO_MIN             1700000
+#define IGD_VCO_MAX             3500000
 #define I9XX_N_MIN                    1
 #define I9XX_N_MAX                    6
+/* IGD's Ncounter is a ring counter */
+#define IGD_N_MIN                     3
+#define IGD_N_MAX                     6
 #define I9XX_M_MIN                   70
 #define I9XX_M_MAX                  120
+#define IGD_M_MIN                     2
+#define IGD_M_MAX                   256
 #define I9XX_M1_MIN                  10
 #define I9XX_M1_MAX                  22
 #define I9XX_M2_MIN                   5
 #define I9XX_M2_MAX                   9
+/* IGD M1 is reserved, and must be 0 */
+#define IGD_M1_MIN                    0
+#define IGD_M1_MAX                    0
+#define IGD_M2_MIN                    0
+#define IGD_M2_MAX                    254
 #define I9XX_P_SDVO_DAC_MIN           5
 #define I9XX_P_SDVO_DAC_MAX          80
 #define I9XX_P_LVDS_MIN               7
 #define I9XX_P_LVDS_MAX              98
+#define IGD_P_LVDS_MIN                7
+#define IGD_P_LVDS_MAX               112
 #define I9XX_P1_MIN                   1
 #define I9XX_P1_MAX                   8
 #define I9XX_P2_SDVO_DAC_SLOW                10
@@ -115,6 +131,97 @@ typedef struct {
 #define INTEL_LIMIT_I8XX_LVDS       1
 #define INTEL_LIMIT_I9XX_SDVO_DAC   2
 #define INTEL_LIMIT_I9XX_LVDS       3
+#define INTEL_LIMIT_G4X_SDVO        4
+#define INTEL_LIMIT_G4X_HDMI_DAC   5
+#define INTEL_LIMIT_G4X_SINGLE_CHANNEL_LVDS   6
+#define INTEL_LIMIT_G4X_DUAL_CHANNEL_LVDS   7
+#define INTEL_LIMIT_IGD_SDVO_DAC    8
+#define INTEL_LIMIT_IGD_LVDS        9
+
+/*The parameter is for SDVO on G4x platform*/
+#define G4X_DOT_SDVO_MIN           25000
+#define G4X_DOT_SDVO_MAX           270000
+#define G4X_VCO_MIN                1750000
+#define G4X_VCO_MAX                3500000
+#define G4X_N_SDVO_MIN             1
+#define G4X_N_SDVO_MAX             4
+#define G4X_M_SDVO_MIN             104
+#define G4X_M_SDVO_MAX             138
+#define G4X_M1_SDVO_MIN            17
+#define G4X_M1_SDVO_MAX            23
+#define G4X_M2_SDVO_MIN            5
+#define G4X_M2_SDVO_MAX            11
+#define G4X_P_SDVO_MIN             10
+#define G4X_P_SDVO_MAX             30
+#define G4X_P1_SDVO_MIN            1
+#define G4X_P1_SDVO_MAX            3
+#define G4X_P2_SDVO_SLOW           10
+#define G4X_P2_SDVO_FAST           10
+#define G4X_P2_SDVO_LIMIT          270000
+
+/*The parameter is for HDMI_DAC on G4x platform*/
+#define G4X_DOT_HDMI_DAC_MIN           22000
+#define G4X_DOT_HDMI_DAC_MAX           400000
+#define G4X_N_HDMI_DAC_MIN             1
+#define G4X_N_HDMI_DAC_MAX             4
+#define G4X_M_HDMI_DAC_MIN             104
+#define G4X_M_HDMI_DAC_MAX             138
+#define G4X_M1_HDMI_DAC_MIN            16
+#define G4X_M1_HDMI_DAC_MAX            23
+#define G4X_M2_HDMI_DAC_MIN            5
+#define G4X_M2_HDMI_DAC_MAX            11
+#define G4X_P_HDMI_DAC_MIN             5
+#define G4X_P_HDMI_DAC_MAX             80
+#define G4X_P1_HDMI_DAC_MIN            1
+#define G4X_P1_HDMI_DAC_MAX            8
+#define G4X_P2_HDMI_DAC_SLOW           10
+#define G4X_P2_HDMI_DAC_FAST           5
+#define G4X_P2_HDMI_DAC_LIMIT          165000
+
+/*The parameter is for SINGLE_CHANNEL_LVDS on G4x platform*/
+#define G4X_DOT_SINGLE_CHANNEL_LVDS_MIN           20000
+#define G4X_DOT_SINGLE_CHANNEL_LVDS_MAX           115000
+#define G4X_N_SINGLE_CHANNEL_LVDS_MIN             1
+#define G4X_N_SINGLE_CHANNEL_LVDS_MAX             3
+#define G4X_M_SINGLE_CHANNEL_LVDS_MIN             104
+#define G4X_M_SINGLE_CHANNEL_LVDS_MAX             138
+#define G4X_M1_SINGLE_CHANNEL_LVDS_MIN            17
+#define G4X_M1_SINGLE_CHANNEL_LVDS_MAX            23
+#define G4X_M2_SINGLE_CHANNEL_LVDS_MIN            5
+#define G4X_M2_SINGLE_CHANNEL_LVDS_MAX            11
+#define G4X_P_SINGLE_CHANNEL_LVDS_MIN             28
+#define G4X_P_SINGLE_CHANNEL_LVDS_MAX             112
+#define G4X_P1_SINGLE_CHANNEL_LVDS_MIN            2
+#define G4X_P1_SINGLE_CHANNEL_LVDS_MAX            8
+#define G4X_P2_SINGLE_CHANNEL_LVDS_SLOW           14
+#define G4X_P2_SINGLE_CHANNEL_LVDS_FAST           14
+#define G4X_P2_SINGLE_CHANNEL_LVDS_LIMIT          0
+
+/*The parameter is for DUAL_CHANNEL_LVDS on G4x platform*/
+#define G4X_DOT_DUAL_CHANNEL_LVDS_MIN           80000
+#define G4X_DOT_DUAL_CHANNEL_LVDS_MAX           224000
+#define G4X_N_DUAL_CHANNEL_LVDS_MIN             1
+#define G4X_N_DUAL_CHANNEL_LVDS_MAX             3
+#define G4X_M_DUAL_CHANNEL_LVDS_MIN             104
+#define G4X_M_DUAL_CHANNEL_LVDS_MAX             138
+#define G4X_M1_DUAL_CHANNEL_LVDS_MIN            17
+#define G4X_M1_DUAL_CHANNEL_LVDS_MAX            23
+#define G4X_M2_DUAL_CHANNEL_LVDS_MIN            5
+#define G4X_M2_DUAL_CHANNEL_LVDS_MAX            11
+#define G4X_P_DUAL_CHANNEL_LVDS_MIN             14
+#define G4X_P_DUAL_CHANNEL_LVDS_MAX             42
+#define G4X_P1_DUAL_CHANNEL_LVDS_MIN            2
+#define G4X_P1_DUAL_CHANNEL_LVDS_MAX            6
+#define G4X_P2_DUAL_CHANNEL_LVDS_SLOW           7
+#define G4X_P2_DUAL_CHANNEL_LVDS_FAST           7
+#define G4X_P2_DUAL_CHANNEL_LVDS_LIMIT          0
+
+static bool
+intel_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
+                    int target, int refclk, intel_clock_t *best_clock);
+static bool
+intel_g4x_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
+                        int target, int refclk, intel_clock_t *best_clock);
 
 static const intel_limit_t intel_limits[] = {
     { /* INTEL_LIMIT_I8XX_DVO_DAC */
@@ -128,6 +235,7 @@ static const intel_limit_t intel_limits[] = {
         .p1  = { .min = I8XX_P1_MIN,            .max = I8XX_P1_MAX },
         .p2  = { .dot_limit = I8XX_P2_SLOW_LIMIT,
                  .p2_slow = I8XX_P2_SLOW,       .p2_fast = I8XX_P2_FAST },
+        .find_pll = intel_find_best_PLL,
     },
     { /* INTEL_LIMIT_I8XX_LVDS */
         .dot = { .min = I8XX_DOT_MIN,           .max = I8XX_DOT_MAX },
@@ -140,6 +248,7 @@ static const intel_limit_t intel_limits[] = {
         .p1  = { .min = I8XX_P1_LVDS_MIN,       .max = I8XX_P1_LVDS_MAX },
         .p2  = { .dot_limit = I8XX_P2_SLOW_LIMIT,
                  .p2_slow = I8XX_P2_LVDS_SLOW,  .p2_fast = I8XX_P2_LVDS_FAST },
+        .find_pll = intel_find_best_PLL,
     },
     { /* INTEL_LIMIT_I9XX_SDVO_DAC */
         .dot = { .min = I9XX_DOT_MIN,           .max = I9XX_DOT_MAX },
@@ -152,6 +261,7 @@ static const intel_limit_t intel_limits[] = {
         .p1  = { .min = I9XX_P1_MIN,            .max = I9XX_P1_MAX },
         .p2  = { .dot_limit = I9XX_P2_SDVO_DAC_SLOW_LIMIT,
                  .p2_slow = I9XX_P2_SDVO_DAC_SLOW,      .p2_fast = I9XX_P2_SDVO_DAC_FAST },
+        .find_pll = intel_find_best_PLL,
     },
     { /* INTEL_LIMIT_I9XX_LVDS */
         .dot = { .min = I9XX_DOT_MIN,           .max = I9XX_DOT_MAX },
@@ -167,19 +277,157 @@ static const intel_limit_t intel_limits[] = {
          */
         .p2  = { .dot_limit = I9XX_P2_LVDS_SLOW_LIMIT,
                  .p2_slow = I9XX_P2_LVDS_SLOW,  .p2_fast = I9XX_P2_LVDS_FAST },
+        .find_pll = intel_find_best_PLL,
+    },
+    /* below parameter and function is for G4X Chipset Family*/
+    { /* INTEL_LIMIT_G4X_SDVO */
+        .dot = { .min = G4X_DOT_SDVO_MIN,       .max = G4X_DOT_SDVO_MAX },
+        .vco = { .min = G4X_VCO_MIN,            .max = G4X_VCO_MAX},
+        .n   = { .min = G4X_N_SDVO_MIN,         .max = G4X_N_SDVO_MAX },
+        .m   = { .min = G4X_M_SDVO_MIN,         .max = G4X_M_SDVO_MAX },
+        .m1  = { .min = G4X_M1_SDVO_MIN,        .max = G4X_M1_SDVO_MAX },
+        .m2  = { .min = G4X_M2_SDVO_MIN,        .max = G4X_M2_SDVO_MAX },
+        .p   = { .min = G4X_P_SDVO_MIN,         .max = G4X_P_SDVO_MAX },
+        .p1  = { .min = G4X_P1_SDVO_MIN,        .max = G4X_P1_SDVO_MAX},
+        .p2  = { .dot_limit = G4X_P2_SDVO_LIMIT,
+                 .p2_slow = G4X_P2_SDVO_SLOW,
+                 .p2_fast = G4X_P2_SDVO_FAST
+        },
+        .find_pll = intel_g4x_find_best_PLL,
+    },
+    { /* INTEL_LIMIT_G4X_HDMI_DAC */
+        .dot = { .min = G4X_DOT_HDMI_DAC_MIN,   .max = G4X_DOT_HDMI_DAC_MAX },
+        .vco = { .min = G4X_VCO_MIN,            .max = G4X_VCO_MAX},
+        .n   = { .min = G4X_N_HDMI_DAC_MIN,     .max = G4X_N_HDMI_DAC_MAX },
+        .m   = { .min = G4X_M_HDMI_DAC_MIN,     .max = G4X_M_HDMI_DAC_MAX },
+        .m1  = { .min = G4X_M1_HDMI_DAC_MIN,    .max = G4X_M1_HDMI_DAC_MAX },
+        .m2  = { .min = G4X_M2_HDMI_DAC_MIN,    .max = G4X_M2_HDMI_DAC_MAX },
+        .p   = { .min = G4X_P_HDMI_DAC_MIN,     .max = G4X_P_HDMI_DAC_MAX },
+        .p1  = { .min = G4X_P1_HDMI_DAC_MIN,    .max = G4X_P1_HDMI_DAC_MAX},
+        .p2  = { .dot_limit = G4X_P2_HDMI_DAC_LIMIT,
+                 .p2_slow = G4X_P2_HDMI_DAC_SLOW,
+                 .p2_fast = G4X_P2_HDMI_DAC_FAST
+        },
+        .find_pll = intel_g4x_find_best_PLL,
+    },
+    { /* INTEL_LIMIT_G4X_SINGLE_CHANNEL_LVDS */
+        .dot = { .min = G4X_DOT_SINGLE_CHANNEL_LVDS_MIN,
+                 .max = G4X_DOT_SINGLE_CHANNEL_LVDS_MAX },
+        .vco = { .min = G4X_VCO_MIN,
+                 .max = G4X_VCO_MAX },
+        .n   = { .min = G4X_N_SINGLE_CHANNEL_LVDS_MIN,
+                 .max = G4X_N_SINGLE_CHANNEL_LVDS_MAX },
+        .m   = { .min = G4X_M_SINGLE_CHANNEL_LVDS_MIN,
+                 .max = G4X_M_SINGLE_CHANNEL_LVDS_MAX },
+        .m1  = { .min = G4X_M1_SINGLE_CHANNEL_LVDS_MIN,
+                 .max = G4X_M1_SINGLE_CHANNEL_LVDS_MAX },
+        .m2  = { .min = G4X_M2_SINGLE_CHANNEL_LVDS_MIN,
+                 .max = G4X_M2_SINGLE_CHANNEL_LVDS_MAX },
+        .p   = { .min = G4X_P_SINGLE_CHANNEL_LVDS_MIN,
+                 .max = G4X_P_SINGLE_CHANNEL_LVDS_MAX },
+        .p1  = { .min = G4X_P1_SINGLE_CHANNEL_LVDS_MIN,
+                 .max = G4X_P1_SINGLE_CHANNEL_LVDS_MAX },
+        .p2  = { .dot_limit = G4X_P2_SINGLE_CHANNEL_LVDS_LIMIT,
+                 .p2_slow = G4X_P2_SINGLE_CHANNEL_LVDS_SLOW,
+                 .p2_fast = G4X_P2_SINGLE_CHANNEL_LVDS_FAST
+        },
+        .find_pll = intel_g4x_find_best_PLL,
+    },
+    { /* INTEL_LIMIT_G4X_DUAL_CHANNEL_LVDS */
+        .dot = { .min = G4X_DOT_DUAL_CHANNEL_LVDS_MIN,
+                 .max = G4X_DOT_DUAL_CHANNEL_LVDS_MAX },
+        .vco = { .min = G4X_VCO_MIN,
+                 .max = G4X_VCO_MAX },
+        .n   = { .min = G4X_N_DUAL_CHANNEL_LVDS_MIN,
+                 .max = G4X_N_DUAL_CHANNEL_LVDS_MAX },
+        .m   = { .min = G4X_M_DUAL_CHANNEL_LVDS_MIN,
+                 .max = G4X_M_DUAL_CHANNEL_LVDS_MAX },
+        .m1  = { .min = G4X_M1_DUAL_CHANNEL_LVDS_MIN,
+                 .max = G4X_M1_DUAL_CHANNEL_LVDS_MAX },
+        .m2  = { .min = G4X_M2_DUAL_CHANNEL_LVDS_MIN,
+                 .max = G4X_M2_DUAL_CHANNEL_LVDS_MAX },
+        .p   = { .min = G4X_P_DUAL_CHANNEL_LVDS_MIN,
+                 .max = G4X_P_DUAL_CHANNEL_LVDS_MAX },
+        .p1  = { .min = G4X_P1_DUAL_CHANNEL_LVDS_MIN,
+                 .max = G4X_P1_DUAL_CHANNEL_LVDS_MAX },
+        .p2  = { .dot_limit = G4X_P2_DUAL_CHANNEL_LVDS_LIMIT,
+                 .p2_slow = G4X_P2_DUAL_CHANNEL_LVDS_SLOW,
+                 .p2_fast = G4X_P2_DUAL_CHANNEL_LVDS_FAST
+        },
+        .find_pll = intel_g4x_find_best_PLL,
+    },
+    { /* INTEL_LIMIT_IGD_SDVO */
+        .dot = { .min = I9XX_DOT_MIN,           .max = I9XX_DOT_MAX},
+        .vco = { .min = IGD_VCO_MIN,            .max = IGD_VCO_MAX },
+        .n   = { .min = IGD_N_MIN,              .max = IGD_N_MAX },
+        .m   = { .min = IGD_M_MIN,              .max = IGD_M_MAX },
+        .m1  = { .min = IGD_M1_MIN,             .max = IGD_M1_MAX },
+        .m2  = { .min = IGD_M2_MIN,             .max = IGD_M2_MAX },
+        .p   = { .min = I9XX_P_SDVO_DAC_MIN,    .max = I9XX_P_SDVO_DAC_MAX },
+        .p1  = { .min = I9XX_P1_MIN,            .max = I9XX_P1_MAX },
+        .p2  = { .dot_limit = I9XX_P2_SDVO_DAC_SLOW_LIMIT,
+                 .p2_slow = I9XX_P2_SDVO_DAC_SLOW,      .p2_fast = I9XX_P2_SDVO_DAC_FAST },
     },
+    { /* INTEL_LIMIT_IGD_LVDS */
+        .dot = { .min = I9XX_DOT_MIN,           .max = I9XX_DOT_MAX },
+        .vco = { .min = IGD_VCO_MIN,            .max = IGD_VCO_MAX },
+        .n   = { .min = IGD_N_MIN,              .max = IGD_N_MAX },
+        .m   = { .min = IGD_M_MIN,              .max = IGD_M_MAX },
+        .m1  = { .min = IGD_M1_MIN,             .max = IGD_M1_MAX },
+        .m2  = { .min = IGD_M2_MIN,             .max = IGD_M2_MAX },
+        .p   = { .min = IGD_P_LVDS_MIN, .max = IGD_P_LVDS_MAX },
+        .p1  = { .min = I9XX_P1_MIN,            .max = I9XX_P1_MAX },
+        /* IGD only supports single-channel mode. */
+        .p2  = { .dot_limit = I9XX_P2_LVDS_SLOW_LIMIT,
+                 .p2_slow = I9XX_P2_LVDS_SLOW,  .p2_fast = I9XX_P2_LVDS_SLOW },
+    },
+
 };
 
+static const intel_limit_t *intel_g4x_limit(struct drm_crtc *crtc)
+{
+        struct drm_device *dev = crtc->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        const intel_limit_t *limit;
+
+        if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+                if ((I915_READ(LVDS) & LVDS_CLKB_POWER_MASK) ==
+                    LVDS_CLKB_POWER_UP)
+                        /* LVDS with dual channel */
+                        limit = &intel_limits
+                                        [INTEL_LIMIT_G4X_DUAL_CHANNEL_LVDS];
+                else
+                        /* LVDS with dual channel */
+                        limit = &intel_limits
+                                        [INTEL_LIMIT_G4X_SINGLE_CHANNEL_LVDS];
+        } else if (intel_pipe_has_type(crtc, INTEL_OUTPUT_HDMI) ||
+                   intel_pipe_has_type(crtc, INTEL_OUTPUT_ANALOG)) {
+                limit = &intel_limits[INTEL_LIMIT_G4X_HDMI_DAC];
+        } else if (intel_pipe_has_type(crtc, INTEL_OUTPUT_SDVO)) {
+                limit = &intel_limits[INTEL_LIMIT_G4X_SDVO];
+        } else /* The option is for other outputs */
+                limit = &intel_limits[INTEL_LIMIT_I9XX_SDVO_DAC];
+
+        return limit;
+}
+
 static const intel_limit_t *intel_limit(struct drm_crtc *crtc)
 {
         struct drm_device *dev = crtc->dev;
         const intel_limit_t *limit;
 
-        if (IS_I9XX(dev)) {
+        if (IS_G4X(dev)) {
+                limit = intel_g4x_limit(crtc);
+        } else if (IS_I9XX(dev) && !IS_IGD(dev)) {
                 if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
                         limit = &intel_limits[INTEL_LIMIT_I9XX_LVDS];
                 else
                         limit = &intel_limits[INTEL_LIMIT_I9XX_SDVO_DAC];
+        } else if (IS_IGD(dev)) {
+                if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
+                        limit = &intel_limits[INTEL_LIMIT_IGD_LVDS];
+                else
+                        limit = &intel_limits[INTEL_LIMIT_IGD_SDVO_DAC];
         } else {
                 if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
                         limit = &intel_limits[INTEL_LIMIT_I8XX_LVDS];
@@ -189,8 +437,21 @@ static const intel_limit_t *intel_limit(struct drm_crtc *crtc)
         return limit;
 }
 
-static void intel_clock(int refclk, intel_clock_t *clock)
+/* m1 is reserved as 0 in IGD, n is a ring counter */
+static void igd_clock(int refclk, intel_clock_t *clock)
 {
+        clock->m = clock->m2 + 2;
+        clock->p = clock->p1 * clock->p2;
+        clock->vco = refclk * clock->m / clock->n;
+        clock->dot = clock->vco / clock->p;
+}
+
+static void intel_clock(struct drm_device *dev, int refclk, intel_clock_t *clock)
+{
+        if (IS_IGD(dev)) {
+                igd_clock(refclk, clock);
+                return;
+        }
         clock->m = 5 * (clock->m1 + 2) + (clock->m2 + 2);
         clock->p = clock->p1 * clock->p2;
         clock->vco = refclk * clock->m / (clock->n + 2);
@@ -226,6 +487,7 @@ bool intel_pipe_has_type (struct drm_crtc *crtc, int type)
 static bool intel_PLL_is_valid(struct drm_crtc *crtc, intel_clock_t *clock)
 {
         const intel_limit_t *limit = intel_limit (crtc);
+        struct drm_device *dev = crtc->dev;
 
         if (clock->p1  < limit->p1.min  || limit->p1.max  < clock->p1)
                 INTELPllInvalid ("p1 out of range\n");
@@ -235,7 +497,7 @@ static bool intel_PLL_is_valid(struct drm_crtc *crtc, intel_clock_t *clock)
                 INTELPllInvalid ("m2 out of range\n");
         if (clock->m1  < limit->m1.min  || limit->m1.max  < clock->m1)
                 INTELPllInvalid ("m1 out of range\n");
-        if (clock->m1 <= clock->m2)
+        if (clock->m1 <= clock->m2 && !IS_IGD(dev))
                 INTELPllInvalid ("m1 <= m2\n");
         if (clock->m   < limit->m.min   || limit->m.max   < clock->m)
                 INTELPllInvalid ("m out of range\n");
@@ -252,18 +514,14 @@ static bool intel_PLL_is_valid(struct drm_crtc *crtc, intel_clock_t *clock)
         return true;
 }
 
-/**
- * Returns a set of divisors for the desired target clock with the given
- * refclk, or FALSE.  The returned values represent the clock equation:
- * reflck * (5 * (m1 + 2) + (m2 + 2)) / (n + 2) / p1 / p2.
- */
-static bool intel_find_best_PLL(struct drm_crtc *crtc, int target,
-                                int refclk, intel_clock_t *best_clock)
+static bool
+intel_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
+                    int target, int refclk, intel_clock_t *best_clock)
+
 {
         struct drm_device *dev = crtc->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         intel_clock_t clock;
-        const intel_limit_t *limit = intel_limit(crtc);
         int err = target;
 
         if (IS_I9XX(dev) && intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS) &&
@@ -289,15 +547,17 @@ static bool intel_find_best_PLL(struct drm_crtc *crtc, int target,
         memset (best_clock, 0, sizeof (*best_clock));
 
         for (clock.m1 = limit->m1.min; clock.m1 <= limit->m1.max; clock.m1++) {
-                for (clock.m2 = limit->m2.min; clock.m2 < clock.m1 &&
-                             clock.m2 <= limit->m2.max; clock.m2++) {
+                for (clock.m2 = limit->m2.min; clock.m2 <= limit->m2.max; clock.m2++) {
+                        /* m1 is always 0 in IGD */
+                        if (clock.m2 >= clock.m1 && !IS_IGD(dev))
+                                break;
                         for (clock.n = limit->n.min; clock.n <= limit->n.max;
                              clock.n++) {
                                 for (clock.p1 = limit->p1.min;
                                      clock.p1 <= limit->p1.max; clock.p1++) {
                                         int this_err;
 
-                                        intel_clock(refclk, &clock);
+                                        intel_clock(dev, refclk, &clock);
 
                                         if (!intel_PLL_is_valid(crtc, &clock))
                                                 continue;
@@ -315,6 +575,63 @@ static bool intel_find_best_PLL(struct drm_crtc *crtc, int target,
         return (err != target);
 }
 
+static bool
+intel_g4x_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
+                        int target, int refclk, intel_clock_t *best_clock)
+{
+        struct drm_device *dev = crtc->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        intel_clock_t clock;
+        int max_n;
+        bool found;
+        /* approximately equals target * 0.00488 */
+        int err_most = (target >> 8) + (target >> 10);
+        found = false;
+
+        if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+                if ((I915_READ(LVDS) & LVDS_CLKB_POWER_MASK) ==
+                    LVDS_CLKB_POWER_UP)
+                        clock.p2 = limit->p2.p2_fast;
+                else
+                        clock.p2 = limit->p2.p2_slow;
+        } else {
+                if (target < limit->p2.dot_limit)
+                        clock.p2 = limit->p2.p2_slow;
+                else
+                        clock.p2 = limit->p2.p2_fast;
+        }
+
+        memset(best_clock, 0, sizeof(*best_clock));
+        max_n = limit->n.max;
+        /* based on hardware requriment prefer smaller n to precision */
+        for (clock.n = limit->n.min; clock.n <= max_n; clock.n++) {
+                /* based on hardware requirment prefere larger m1,m2, p1 */
+                for (clock.m1 = limit->m1.max;
+                     clock.m1 >= limit->m1.min; clock.m1--) {
+                        for (clock.m2 = limit->m2.max;
+                             clock.m2 >= limit->m2.min; clock.m2--) {
+                                for (clock.p1 = limit->p1.max;
+                                     clock.p1 >= limit->p1.min; clock.p1--) {
+                                        int this_err;
+
+                                        intel_clock(dev, refclk, &clock);
+                                        if (!intel_PLL_is_valid(crtc, &clock))
+                                                continue;
+                                        this_err = abs(clock.dot - target) ;
+                                        if (this_err < err_most) {
+                                                *best_clock = clock;
+                                                err_most = this_err;
+                                                max_n = clock.n;
+                                                found = true;
+                                        }
+                                }
+                        }
+                }
+        }
+
+        return found;
+}
+
 void
 intel_wait_for_vblank(struct drm_device *dev)
 {
@@ -634,7 +951,7 @@ static int intel_get_core_clock_speed(struct drm_device *dev)
                 return 400000;
         else if (IS_I915G(dev))
                 return 333000;
-        else if (IS_I945GM(dev) || IS_845G(dev))
+        else if (IS_I945GM(dev) || IS_845G(dev) || IS_IGDGM(dev))
                 return 200000;
         else if (IS_I915GM(dev)) {
                 u16 gcfgc = 0;
@@ -733,6 +1050,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
         bool is_crt = false, is_lvds = false, is_tv = false;
         struct drm_mode_config *mode_config = &dev->mode_config;
         struct drm_connector *connector;
+        const intel_limit_t *limit;
         int ret;
 
         drm_vblank_pre_modeset(dev, pipe);
@@ -776,13 +1094,22 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                 refclk = 48000;
         }
 
-        ok = intel_find_best_PLL(crtc, adjusted_mode->clock, refclk, &clock);
+        /*
+         * Returns a set of divisors for the desired target clock with the given
+         * refclk, or FALSE.  The returned values represent the clock equation:
+         * reflck * (5 * (m1 + 2) + (m2 + 2)) / (n + 2) / p1 / p2.
+         */
+        limit = intel_limit(crtc);
+        ok = limit->find_pll(limit, crtc, adjusted_mode->clock, refclk, &clock);
         if (!ok) {
                 DRM_ERROR("Couldn't find PLL settings for mode!\n");
                 return -EINVAL;
         }
 
-        fp = clock.n << 16 | clock.m1 << 8 | clock.m2;
+        if (IS_IGD(dev))
+                fp = (1 << clock.n) << 16 | clock.m1 << 8 | clock.m2;
+        else
+                fp = clock.n << 16 | clock.m1 << 8 | clock.m2;
 
         dpll = DPLL_VGA_MODE_DIS;
         if (IS_I9XX(dev)) {
@@ -799,7 +1126,10 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                 }
 
                 /* compute bitmask from p1 value */
-                dpll |= (1 << (clock.p1 - 1)) << 16;
+                if (IS_IGD(dev))
+                        dpll |= (1 << (clock.p1 - 1)) << DPLL_FPA01_P1_POST_DIV_SHIFT_IGD;
+                else
+                        dpll |= (1 << (clock.p1 - 1)) << DPLL_FPA01_P1_POST_DIV_SHIFT;
                 switch (clock.p2) {
                 case 5:
                         dpll |= DPLL_DAC_SERIAL_P2_CLOCK_DIV_5;
@@ -1279,10 +1609,20 @@ static int intel_crtc_clock_get(struct drm_device *dev, struct drm_crtc *crtc)
                 fp = I915_READ((pipe == 0) ? FPA1 : FPB1);
 
         clock.m1 = (fp & FP_M1_DIV_MASK) >> FP_M1_DIV_SHIFT;
-        clock.m2 = (fp & FP_M2_DIV_MASK) >> FP_M2_DIV_SHIFT;
-        clock.n = (fp & FP_N_DIV_MASK) >> FP_N_DIV_SHIFT;
+        if (IS_IGD(dev)) {
+                clock.n = ffs((fp & FP_N_IGD_DIV_MASK) >> FP_N_DIV_SHIFT) - 1;
+                clock.m2 = (fp & FP_M2_IGD_DIV_MASK) >> FP_M2_DIV_SHIFT;
+        } else {
+                clock.n = (fp & FP_N_DIV_MASK) >> FP_N_DIV_SHIFT;
+                clock.m2 = (fp & FP_M2_DIV_MASK) >> FP_M2_DIV_SHIFT;
+        }
+
         if (IS_I9XX(dev)) {
-                clock.p1 = ffs((dpll & DPLL_FPA01_P1_POST_DIV_MASK) >>
+                if (IS_IGD(dev))
+                        clock.p1 = ffs((dpll & DPLL_FPA01_P1_POST_DIV_MASK_IGD) >>
+                                DPLL_FPA01_P1_POST_DIV_SHIFT_IGD);
+                else
+                        clock.p1 = ffs((dpll & DPLL_FPA01_P1_POST_DIV_MASK) >>
                                DPLL_FPA01_P1_POST_DIV_SHIFT);
 
                 switch (dpll & DPLL_MODE_MASK) {
@@ -1301,7 +1641,7 @@ static int intel_crtc_clock_get(struct drm_device *dev, struct drm_crtc *crtc)
                 }
 
                 /* XXX: Handle the 100Mhz refclk */
-                intel_clock(96000, &clock);
+                intel_clock(dev, 96000, &clock);
         } else {
                 bool is_lvds = (pipe == 1) && (I915_READ(LVDS) & LVDS_PORT_EN);
 
@@ -1313,9 +1653,9 @@ static int intel_crtc_clock_get(struct drm_device *dev, struct drm_crtc *crtc)
                         if ((dpll & PLL_REF_INPUT_MASK) ==
                             PLLB_REF_INPUT_SPREADSPECTRUMIN) {
                                 /* XXX: might not be 66MHz */
-                                intel_clock(66000, &clock);
+                                intel_clock(dev, 66000, &clock);
                         } else
-                                intel_clock(48000, &clock);
+                                intel_clock(dev, 48000, &clock);
                 } else {
                         if (dpll & PLL_P1_DIVIDE_BY_TWO)
                                 clock.p1 = 2;
@@ -1328,7 +1668,7 @@ static int intel_crtc_clock_get(struct drm_device *dev, struct drm_crtc *crtc)
                         else
                                 clock.p2 = 2;
 
-                        intel_clock(48000, &clock);
+                        intel_clock(dev, 48000, &clock);
                 }
         }
 
@@ -1474,13 +1814,21 @@ static void intel_setup_outputs(struct drm_device *dev)
 
         if (IS_I9XX(dev)) {
                 int found;
+                u32 reg;
 
                 if (I915_READ(SDVOB) & SDVO_DETECTED) {
                         found = intel_sdvo_init(dev, SDVOB);
                         if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
                                 intel_hdmi_init(dev, SDVOB);
                 }
-                if (!IS_G4X(dev) || (I915_READ(SDVOB) & SDVO_DETECTED)) {
+
+                /* Before G4X SDVOC doesn't have its own detect register */
+                if (IS_G4X(dev))
+                        reg = SDVOC;
+                else
+                        reg = SDVOB;
+
+                if (I915_READ(reg) & SDVO_DETECTED) {
                         found = intel_sdvo_init(dev, SDVOC);
                         if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
                                 intel_hdmi_init(dev, SDVOC);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 0d211af98854..6619f26e46a5 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -265,7 +265,7 @@ static void intel_lvds_mode_set(struct drm_encoder *encoder,
                 pfit_control = 0;
 
         if (!IS_I965G(dev)) {
-                if (dev_priv->panel_wants_dither)
+                if (dev_priv->panel_wants_dither || dev_priv->lvds_dither)
                         pfit_control |= PANEL_8TO6_DITHER_ENABLE;
         }
         else
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index 56485d67369b..ceca9471a75a 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -217,8 +217,8 @@ static const u32 filter_table[] = {
  */
 static const struct color_conversion ntsc_m_csc_composite = {
         .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0104,
-        .ru = 0x0733, .gu = 0x052d, .bu = 0x05c7, .au = 0x0f00,
-        .rv = 0x0340, .gv = 0x030c, .bv = 0x06d0, .av = 0x0f00,
+        .ru = 0x0733, .gu = 0x052d, .bu = 0x05c7, .au = 0x0200,
+        .rv = 0x0340, .gv = 0x030c, .bv = 0x06d0, .av = 0x0200,
 };
 
 static const struct video_levels ntsc_m_levels_composite = {
@@ -226,9 +226,9 @@ static const struct video_levels ntsc_m_levels_composite = {
 };
 
 static const struct color_conversion ntsc_m_csc_svideo = {
-        .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0134,
-        .ru = 0x076a, .gu = 0x0564, .bu = 0x030d, .au = 0x0f00,
-        .rv = 0x037a, .gv = 0x033d, .bv = 0x06f6, .av = 0x0f00,
+        .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0133,
+        .ru = 0x076a, .gu = 0x0564, .bu = 0x030d, .au = 0x0200,
+        .rv = 0x037a, .gv = 0x033d, .bv = 0x06f6, .av = 0x0200,
 };
 
 static const struct video_levels ntsc_m_levels_svideo = {
@@ -237,8 +237,8 @@ static const struct video_levels ntsc_m_levels_svideo = {
 
 static const struct color_conversion ntsc_j_csc_composite = {
         .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0119,
-        .ru = 0x074c, .gu = 0x0546, .bu = 0x05ec, .au = 0x0f00,
-        .rv = 0x035a, .gv = 0x0322, .bv = 0x06e1, .av = 0x0f00,
+        .ru = 0x074c, .gu = 0x0546, .bu = 0x05ec, .au = 0x0200,
+        .rv = 0x035a, .gv = 0x0322, .bv = 0x06e1, .av = 0x0200,
 };
 
 static const struct video_levels ntsc_j_levels_composite = {
@@ -247,8 +247,8 @@ static const struct video_levels ntsc_j_levels_composite = {
 
 static const struct color_conversion ntsc_j_csc_svideo = {
         .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x014c,
-        .ru = 0x0788, .gu = 0x0581, .bu = 0x0322, .au = 0x0f00,
-        .rv = 0x0399, .gv = 0x0356, .bv = 0x070a, .av = 0x0f00,
+        .ru = 0x0788, .gu = 0x0581, .bu = 0x0322, .au = 0x0200,
+        .rv = 0x0399, .gv = 0x0356, .bv = 0x070a, .av = 0x0200,
 };
 
 static const struct video_levels ntsc_j_levels_svideo = {
@@ -257,8 +257,8 @@ static const struct video_levels ntsc_j_levels_svideo = {
 
 static const struct color_conversion pal_csc_composite = {
         .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0113,
-        .ru = 0x0745, .gu = 0x053f, .bu = 0x05e1, .au = 0x0f00,
-        .rv = 0x0353, .gv = 0x031c, .bv = 0x06dc, .av = 0x0f00,
+        .ru = 0x0745, .gu = 0x053f, .bu = 0x05e1, .au = 0x0200,
+        .rv = 0x0353, .gv = 0x031c, .bv = 0x06dc, .av = 0x0200,
 };
 
 static const struct video_levels pal_levels_composite = {
@@ -267,8 +267,8 @@ static const struct video_levels pal_levels_composite = {
 
 static const struct color_conversion pal_csc_svideo = {
         .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0145,
-        .ru = 0x0780, .gu = 0x0579, .bu = 0x031c, .au = 0x0f00,
-        .rv = 0x0390, .gv = 0x034f, .bv = 0x0705, .av = 0x0f00,
+        .ru = 0x0780, .gu = 0x0579, .bu = 0x031c, .au = 0x0200,
+        .rv = 0x0390, .gv = 0x034f, .bv = 0x0705, .av = 0x0200,
 };
 
 static const struct video_levels pal_levels_svideo = {
@@ -277,8 +277,8 @@ static const struct video_levels pal_levels_svideo = {
 
 static const struct color_conversion pal_m_csc_composite = {
         .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0104,
-        .ru = 0x0733, .gu = 0x052d, .bu = 0x05c7, .au = 0x0f00,
-        .rv = 0x0340, .gv = 0x030c, .bv = 0x06d0, .av = 0x0f00,
+        .ru = 0x0733, .gu = 0x052d, .bu = 0x05c7, .au = 0x0200,
+        .rv = 0x0340, .gv = 0x030c, .bv = 0x06d0, .av = 0x0200,
 };
 
 static const struct video_levels pal_m_levels_composite = {
@@ -286,9 +286,9 @@ static const struct video_levels pal_m_levels_composite = {
 };
 
 static const struct color_conversion pal_m_csc_svideo = {
-        .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0134,
-        .ru = 0x076a, .gu = 0x0564, .bu = 0x030d, .au = 0x0f00,
-        .rv = 0x037a, .gv = 0x033d, .bv = 0x06f6, .av = 0x0f00,
+        .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0133,
+        .ru = 0x076a, .gu = 0x0564, .bu = 0x030d, .au = 0x0200,
+        .rv = 0x037a, .gv = 0x033d, .bv = 0x06f6, .av = 0x0200,
 };
 
 static const struct video_levels pal_m_levels_svideo = {
@@ -297,8 +297,8 @@ static const struct video_levels pal_m_levels_svideo = {
 
 static const struct color_conversion pal_n_csc_composite = {
         .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0104,
-        .ru = 0x0733, .gu = 0x052d, .bu = 0x05c7, .au = 0x0f00,
-        .rv = 0x0340, .gv = 0x030c, .bv = 0x06d0, .av = 0x0f00,
+        .ru = 0x0733, .gu = 0x052d, .bu = 0x05c7, .au = 0x0200,
+        .rv = 0x0340, .gv = 0x030c, .bv = 0x06d0, .av = 0x0200,
 };
 
 static const struct video_levels pal_n_levels_composite = {
@@ -306,9 +306,9 @@ static const struct video_levels pal_n_levels_composite = {
 };
 
 static const struct color_conversion pal_n_csc_svideo = {
-        .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0134,
-        .ru = 0x076a, .gu = 0x0564, .bu = 0x030d, .au = 0x0f00,
-        .rv = 0x037a, .gv = 0x033d, .bv = 0x06f6, .av = 0x0f00,
+        .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0133,
+        .ru = 0x076a, .gu = 0x0564, .bu = 0x030d, .au = 0x0200,
+        .rv = 0x037a, .gv = 0x033d, .bv = 0x06f6, .av = 0x0200,
 };
 
 static const struct video_levels pal_n_levels_svideo = {
@@ -319,9 +319,9 @@ static const struct video_levels pal_n_levels_svideo = {
  * Component connections
  */
 static const struct color_conversion sdtv_csc_yprpb = {
-        .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0146,
-        .ru = 0x0559, .gu = 0x0353, .bu = 0x0100, .au = 0x0f00,
-        .rv = 0x0100, .gv = 0x03ad, .bv = 0x074d, .av = 0x0f00,
+        .ry = 0x0332, .gy = 0x012d, .by = 0x07d3, .ay = 0x0145,
+        .ru = 0x0559, .gu = 0x0353, .bu = 0x0100, .au = 0x0200,
+        .rv = 0x0100, .gv = 0x03ad, .bv = 0x074d, .av = 0x0200,
 };
 
 static const struct color_conversion sdtv_csc_rgb = {
@@ -331,9 +331,9 @@ static const struct color_conversion sdtv_csc_rgb = {
 };
 
 static const struct color_conversion hdtv_csc_yprpb = {
-        .ry = 0x05b3, .gy = 0x016e, .by = 0x0728, .ay = 0x0146,
-        .ru = 0x07d5, .gu = 0x038b, .bu = 0x0100, .au = 0x0f00,
-        .rv = 0x0100, .gv = 0x03d1, .bv = 0x06bc, .av = 0x0f00,
+        .ry = 0x05b3, .gy = 0x016e, .by = 0x0728, .ay = 0x0145,
+        .ru = 0x07d5, .gu = 0x038b, .bu = 0x0100, .au = 0x0200,
+        .rv = 0x0100, .gv = 0x03d1, .bv = 0x06bc, .av = 0x0200,
 };
 
 static const struct color_conversion hdtv_csc_rgb = {
@@ -414,7 +414,7 @@ struct tv_mode {
 static const struct tv_mode tv_modes[] = {
         {
                 .name           = "NTSC-M",
-                .clock          = 107520,
+                .clock          = 108000,
                 .refresh        = 29970,
                 .oversample     = TV_OVERSAMPLE_8X,
                 .component_only = 0,
@@ -442,8 +442,8 @@ static const struct tv_mode tv_modes[] = {
                 .vburst_start_f4 = 10,              .vburst_end_f4      = 240,
 
                 /* desired 3.5800000 actual 3.5800000 clock 107.52 */
-                .dda1_inc       =    136,
-                .dda2_inc       =   7624,           .dda2_size          =  20013,
+                .dda1_inc       =    135,
+                .dda2_inc       =  20800,           .dda2_size          =  27456,
                 .dda3_inc       =      0,           .dda3_size          =      0,
                 .sc_reset       = TV_SC_RESET_EVERY_4,
                 .pal_burst      = false,
@@ -457,7 +457,7 @@ static const struct tv_mode tv_modes[] = {
         },
         {
                 .name           = "NTSC-443",
-                .clock          = 107520,
+                .clock          = 108000,
                 .refresh        = 29970,
                 .oversample     = TV_OVERSAMPLE_8X,
                 .component_only = 0,
@@ -485,10 +485,10 @@ static const struct tv_mode tv_modes[] = {
 
                 /* desired 4.4336180 actual 4.4336180 clock 107.52 */
                 .dda1_inc       =    168,
-                .dda2_inc       =  18557,       .dda2_size      =  20625,
-                .dda3_inc       =      0,       .dda3_size      =      0,
-                .sc_reset   = TV_SC_RESET_EVERY_8,
-                .pal_burst  = true,
+                .dda2_inc       =   4093,       .dda2_size      =  27456,
+                .dda3_inc       =    310,       .dda3_size      =    525,
+                .sc_reset   = TV_SC_RESET_NEVER,
+                .pal_burst  = false,
 
                 .composite_levels = &ntsc_m_levels_composite,
                 .composite_color = &ntsc_m_csc_composite,
@@ -499,7 +499,7 @@ static const struct tv_mode tv_modes[] = {
         },
         {
                 .name           = "NTSC-J",
-                .clock          = 107520,
+                .clock          = 108000,
                 .refresh        = 29970,
                 .oversample     = TV_OVERSAMPLE_8X,
                 .component_only = 0,
@@ -527,8 +527,8 @@ static const struct tv_mode tv_modes[] = {
                 .vburst_start_f4 = 10,              .vburst_end_f4      = 240,
 
                 /* desired 3.5800000 actual 3.5800000 clock 107.52 */
-                .dda1_inc       =    136,
-                .dda2_inc       =   7624,           .dda2_size          =  20013,
+                .dda1_inc       =    135,
+                .dda2_inc       =  20800,           .dda2_size          =  27456,
                 .dda3_inc       =      0,           .dda3_size          =      0,
                 .sc_reset       = TV_SC_RESET_EVERY_4,
                 .pal_burst      = false,
@@ -542,7 +542,7 @@ static const struct tv_mode tv_modes[] = {
         },
         {
                 .name           = "PAL-M",
-                .clock          = 107520,
+                .clock          = 108000,
                 .refresh        = 29970,
                 .oversample     = TV_OVERSAMPLE_8X,
                 .component_only = 0,
@@ -570,11 +570,11 @@ static const struct tv_mode tv_modes[] = {
                 .vburst_start_f4 = 10,              .vburst_end_f4      = 240,
 
                 /* desired 3.5800000 actual 3.5800000 clock 107.52 */
-                .dda1_inc       =    136,
-                .dda2_inc       =    7624,          .dda2_size          =  20013,
+                .dda1_inc       =    135,
+                .dda2_inc       =  16704,           .dda2_size          =  27456,
                 .dda3_inc       =      0,           .dda3_size          =      0,
-                .sc_reset       = TV_SC_RESET_EVERY_4,
-                .pal_burst  = false,
+                .sc_reset       = TV_SC_RESET_EVERY_8,
+                .pal_burst  = true,
 
                 .composite_levels = &pal_m_levels_composite,
                 .composite_color = &pal_m_csc_composite,
@@ -586,7 +586,7 @@ static const struct tv_mode tv_modes[] = {
         {
                 /* 625 Lines, 50 Fields, 15.625KHz line, Sub-Carrier 4.434MHz */
                 .name       = "PAL-N",
-                .clock          = 107520,
+                .clock          = 108000,
                 .refresh        = 25000,
                 .oversample     = TV_OVERSAMPLE_8X,
                 .component_only = 0,
@@ -615,9 +615,9 @@ static const struct tv_mode tv_modes[] = {
 
 
                 /* desired 4.4336180 actual 4.4336180 clock 107.52 */
-                .dda1_inc       =    168,
-                .dda2_inc       =  18557,       .dda2_size      =  20625,
-                .dda3_inc       =      0,       .dda3_size      =      0,
+                .dda1_inc       =    135,
+                .dda2_inc       =  23578,       .dda2_size      =  27648,
+                .dda3_inc       =    134,       .dda3_size      =    625,
                 .sc_reset   = TV_SC_RESET_EVERY_8,
                 .pal_burst  = true,
 
@@ -631,12 +631,12 @@ static const struct tv_mode tv_modes[] = {
         {
                 /* 625 Lines, 50 Fields, 15.625KHz line, Sub-Carrier 4.434MHz */
                 .name       = "PAL",
-                .clock          = 107520,
+                .clock          = 108000,
                 .refresh        = 25000,
                 .oversample     = TV_OVERSAMPLE_8X,
                 .component_only = 0,
 
-                .hsync_end      = 64,               .hblank_end         = 128,
+                .hsync_end      = 64,               .hblank_end         = 142,
                 .hblank_start   = 844,      .htotal             = 863,
 
                 .progressive    = false,    .trilevel_sync = false,
@@ -659,8 +659,8 @@ static const struct tv_mode tv_modes[] = {
 
                 /* desired 4.4336180 actual 4.4336180 clock 107.52 */
                 .dda1_inc       =    168,
-                .dda2_inc       =  18557,       .dda2_size      =  20625,
-                .dda3_inc       =      0,       .dda3_size      =      0,
+                .dda2_inc       =   4122,       .dda2_size      =  27648,
+                .dda3_inc       =     67,       .dda3_size      =    625,
                 .sc_reset   = TV_SC_RESET_EVERY_8,
                 .pal_burst  = true,
 
@@ -689,7 +689,7 @@ static const struct tv_mode tv_modes[] = {
                 .veq_ena        = false,
 
                 .vi_end_f1      = 44,               .vi_end_f2          = 44,
-                .nbr_end        = 496,
+                .nbr_end        = 479,
 
                 .burst_ena      = false,
 
@@ -713,7 +713,7 @@ static const struct tv_mode tv_modes[] = {
                 .veq_ena        = false,
 
                 .vi_end_f1      = 44,               .vi_end_f2          = 44,
-                .nbr_end        = 496,
+                .nbr_end        = 479,
 
                 .burst_ena      = false,
 
@@ -876,7 +876,7 @@ static const struct tv_mode tv_modes[] = {
                 .component_only = 1,
 
                 .hsync_end      = 88,               .hblank_end         = 235,
-                .hblank_start   = 2155,             .htotal             = 2200,
+                .hblank_start   = 2155,             .htotal             = 2201,
 
                 .progressive    = false,            .trilevel_sync = true,
 
@@ -1082,7 +1082,7 @@ intel_tv_mode_valid(struct drm_connector *connector, struct drm_display_mode *mo
         const struct tv_mode *tv_mode = intel_tv_mode_find(intel_output);
 
         /* Ensure TV refresh is close to desired refresh */
-        if (tv_mode && abs(tv_mode->refresh - drm_mode_vrefresh(mode)) < 1)
+        if (tv_mode && abs(tv_mode->refresh - drm_mode_vrefresh(mode)) < 10)
                 return MODE_OK;
         return MODE_CLOCK_RANGE;
 }
@@ -1135,7 +1135,8 @@ intel_tv_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
         if (!tv_mode)
                 return; /* can't happen (mode_prepare prevents this) */
 
-        tv_ctl = 0;
+        tv_ctl = I915_READ(TV_CTL);
+        tv_ctl &= TV_CTL_SAVE;
 
         switch (tv_priv->type) {
         default:
@@ -1215,7 +1216,6 @@ intel_tv_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
         /* dda1 implies valid video levels */
         if (tv_mode->dda1_inc) {
                 scctl1 |= TV_SC_DDA1_EN;
-                scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT;
         }
 
         if (tv_mode->dda2_inc)
@@ -1225,6 +1225,7 @@ intel_tv_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
                 scctl1 |= TV_SC_DDA3_EN;
 
         scctl1 |= tv_mode->sc_reset;
+        scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT;
         scctl1 |= tv_mode->dda1_inc << TV_SCDDA1_INC_SHIFT;
 
         scctl2 = tv_mode->dda2_size << TV_SCDDA2_SIZE_SHIFT |
@@ -1266,7 +1267,11 @@ intel_tv_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
                            color_conversion->av);
         }
 
-        I915_WRITE(TV_CLR_KNOBS, 0x00606000);
+        if (IS_I965G(dev))
+                I915_WRITE(TV_CLR_KNOBS, 0x00404000);
+        else
+                I915_WRITE(TV_CLR_KNOBS, 0x00606000);
+
         if (video_levels)
                 I915_WRITE(TV_CLR_LEVEL,
                            ((video_levels->black << TV_BLACK_LEVEL_SHIFT) |
@@ -1401,6 +1406,7 @@ intel_tv_detect_type (struct drm_crtc *crtc, struct intel_output *intel_output)
                 tv_dac = I915_READ(TV_DAC);
                 I915_WRITE(TV_DAC, save_tv_dac);
                 I915_WRITE(TV_CTL, save_tv_ctl);
+                intel_wait_for_vblank(dev);
         }
         /*
          *  A B C
@@ -1451,7 +1457,7 @@ intel_tv_detect(struct drm_connector *connector)
         mode = reported_modes[0];
         drm_mode_set_crtcinfo(&mode, CRTC_INTERLACE_HALVE_V);
 
-        if (encoder->crtc) {
+        if (encoder->crtc && encoder->crtc->enabled) {
                 type = intel_tv_detect_type(encoder->crtc, intel_output);
         } else {
                 crtc = intel_get_load_detect_pipe(intel_output, &mode, &dpms_mode);
@@ -1462,6 +1468,8 @@ intel_tv_detect(struct drm_connector *connector)
                         type = -1;
         }
 
+        tv_priv->type = type;
+
         if (type < 0)
                 return connector_status_disconnected;
 
@@ -1495,7 +1503,8 @@ intel_tv_get_modes(struct drm_connector *connector)
         struct drm_display_mode *mode_ptr;
         struct intel_output *intel_output = to_intel_output(connector);
         const struct tv_mode *tv_mode = intel_tv_mode_find(intel_output);
-        int j;
+        int j, count = 0;
+        u64 tmp;
 
         for (j = 0; j < sizeof(input_res_table) / sizeof(input_res_table[0]);
              j++) {
@@ -1510,8 +1519,9 @@ intel_tv_get_modes(struct drm_connector *connector)
                                         && !tv_mode->component_only))
                         continue;
 
-                mode_ptr = drm_calloc(1, sizeof(struct drm_display_mode),
-                                      DRM_MEM_DRIVER);
+                mode_ptr = drm_mode_create(connector->dev);
+                if (!mode_ptr)
+                        continue;
                 strncpy(mode_ptr->name, input->name, DRM_DISPLAY_MODE_LEN);
 
                 mode_ptr->hdisplay = hactive_s;
@@ -1528,15 +1538,17 @@ intel_tv_get_modes(struct drm_connector *connector)
                         mode_ptr->vsync_end = mode_ptr->vsync_start  + 1;
                 mode_ptr->vtotal = vactive_s + 33;
 
-                mode_ptr->clock = (int) (tv_mode->refresh *
-                                         mode_ptr->vtotal *
-                                         mode_ptr->htotal / 1000) / 1000;
+                tmp = (u64) tv_mode->refresh * mode_ptr->vtotal;
+                tmp *= mode_ptr->htotal;
+                tmp = div_u64(tmp, 1000000);
+                mode_ptr->clock = (int) tmp;
 
                 mode_ptr->type = DRM_MODE_TYPE_DRIVER;
                 drm_mode_probed_add(connector, mode_ptr);
+                count++;
         }
 
-        return 0;
+        return count;
 }
 
 static void
diff --git a/drivers/ieee1394/csr.c b/drivers/ieee1394/csr.c
index 31400c8ae051..d696f69ebce5 100644
--- a/drivers/ieee1394/csr.c
+++ b/drivers/ieee1394/csr.c
@@ -68,22 +68,22 @@ static struct hpsb_highlevel csr_highlevel = {
         .host_reset =   host_reset,
 };
 
-const static struct hpsb_address_ops map_ops = {
+static const struct hpsb_address_ops map_ops = {
         .read = read_maps,
 };
 
-const static struct hpsb_address_ops fcp_ops = {
+static const struct hpsb_address_ops fcp_ops = {
         .write = write_fcp,
 };
 
-const static struct hpsb_address_ops reg_ops = {
+static const struct hpsb_address_ops reg_ops = {
         .read = read_regs,
         .write = write_regs,
         .lock = lock_regs,
         .lock64 = lock64_regs,
 };
 
-const static struct hpsb_address_ops config_rom_ops = {
+static const struct hpsb_address_ops config_rom_ops = {
         .read = read_config_rom,
 };
 
diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
index cb15bfa38d70..823a6297a1af 100644
--- a/drivers/ieee1394/dv1394.c
+++ b/drivers/ieee1394/dv1394.c
@@ -2171,7 +2171,7 @@ static const struct file_operations dv1394_fops=
  * Export information about protocols/devices supported by this driver.
  */
 #ifdef MODULE
-static struct ieee1394_device_id dv1394_id_table[] = {
+static const struct ieee1394_device_id dv1394_id_table[] = {
         {
                 .match_flags    = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
                 .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
diff --git a/drivers/ieee1394/eth1394.c b/drivers/ieee1394/eth1394.c
index 1a919df809f8..4ca103577c0a 100644
--- a/drivers/ieee1394/eth1394.c
+++ b/drivers/ieee1394/eth1394.c
@@ -181,7 +181,7 @@ static void ether1394_remove_host(struct hpsb_host *host);
 static void ether1394_host_reset(struct hpsb_host *host);
 
 /* Function for incoming 1394 packets */
-const static struct hpsb_address_ops addr_ops = {
+static const struct hpsb_address_ops addr_ops = {
         .write =        ether1394_write,
 };
 
@@ -438,7 +438,7 @@ static int eth1394_update(struct unit_directory *ud)
         return eth1394_new_node(hi, ud);
 }
 
-static struct ieee1394_device_id eth1394_id_table[] = {
+static const struct ieee1394_device_id eth1394_id_table[] = {
         {
                 .match_flags = (IEEE1394_MATCH_SPECIFIER_ID |
                                 IEEE1394_MATCH_VERSION),
diff --git a/drivers/ieee1394/highlevel.c b/drivers/ieee1394/highlevel.c
index 600e391c8fe7..4bc443546e04 100644
--- a/drivers/ieee1394/highlevel.c
+++ b/drivers/ieee1394/highlevel.c
@@ -478,7 +478,7 @@ int hpsb_unregister_addrspace(struct hpsb_highlevel *hl, struct hpsb_host *host,
         return retval;
 }
 
-const static struct hpsb_address_ops dummy_ops;
+static const struct hpsb_address_ops dummy_ops;
 
 /* dummy address spaces as lower and upper bounds of the host's a.s. list */
 static void init_hpsb_highlevel(struct hpsb_host *host)
diff --git a/drivers/ieee1394/nodemgr.c b/drivers/ieee1394/nodemgr.c
index 53aada5bbe1e..a6d55bebe61a 100644
--- a/drivers/ieee1394/nodemgr.c
+++ b/drivers/ieee1394/nodemgr.c
@@ -484,7 +484,7 @@ static struct device_attribute *const fw_host_attrs[] = {
 static ssize_t fw_show_drv_device_ids(struct device_driver *drv, char *buf)
 {
         struct hpsb_protocol_driver *driver;
-        struct ieee1394_device_id *id;
+        const struct ieee1394_device_id *id;
         int length = 0;
         char *scratch = buf;
 
@@ -658,7 +658,7 @@ static int nodemgr_bus_match(struct device * dev, struct device_driver * drv)
 {
         struct hpsb_protocol_driver *driver;
         struct unit_directory *ud;
-        struct ieee1394_device_id *id;
+        const struct ieee1394_device_id *id;
 
         /* We only match unit directories */
         if (dev->platform_data != &nodemgr_ud_platform_data)
diff --git a/drivers/ieee1394/nodemgr.h b/drivers/ieee1394/nodemgr.h
index ee5acdbd114a..749b271d3107 100644
--- a/drivers/ieee1394/nodemgr.h
+++ b/drivers/ieee1394/nodemgr.h
@@ -125,7 +125,7 @@ struct hpsb_protocol_driver {
          * probe function below can implement further protocol
          * dependent or vendor dependent checking.
          */
-        struct ieee1394_device_id *id_table;
+        const struct ieee1394_device_id *id_table;
 
         /*
          * The update function is called when the node has just
diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c
index bad66c65b0d6..da5f8829b503 100644
--- a/drivers/ieee1394/raw1394.c
+++ b/drivers/ieee1394/raw1394.c
@@ -90,7 +90,7 @@ static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
                       u16 flags);
-const static struct hpsb_address_ops arm_ops = {
+static const struct hpsb_address_ops arm_ops = {
         .read = arm_read,
         .write = arm_write,
         .lock = arm_lock,
@@ -369,6 +369,7 @@ static const char __user *raw1394_compat_write(const char __user *buf)
 {
         struct compat_raw1394_req __user *cr = (typeof(cr)) buf;
         struct raw1394_request __user *r;
+
         r = compat_alloc_user_space(sizeof(struct raw1394_request));
 
 #define C(x) __copy_in_user(&r->x, &cr->x, sizeof(r->x))
@@ -378,7 +379,8 @@ static const char __user *raw1394_compat_write(const char __user *buf)
             C(tag) ||
             C(sendb) ||
             C(recvb))
-                return ERR_PTR(-EFAULT);
+                return (__force const char __user *)ERR_PTR(-EFAULT);
+
         return (const char __user *)r;
 }
 #undef C
@@ -389,6 +391,7 @@ static int
 raw1394_compat_read(const char __user *buf, struct raw1394_request *r)
 {
         struct compat_raw1394_req __user *cr = (typeof(cr)) buf;
+
         if (!access_ok(VERIFY_WRITE, cr, sizeof(struct compat_raw1394_req)) ||
             P(type) ||
             P(error) ||
@@ -400,6 +403,7 @@ raw1394_compat_read(const char __user *buf, struct raw1394_request *r)
             P(sendb) ||
             P(recvb))
                 return -EFAULT;
+
         return sizeof(struct compat_raw1394_req);
 }
 #undef P
@@ -2249,8 +2253,8 @@ static ssize_t raw1394_write(struct file *file, const char __user * buffer,
             sizeof(struct compat_raw1394_req) !=
                         sizeof(struct raw1394_request)) {
                 buffer = raw1394_compat_write(buffer);
-                if (IS_ERR(buffer))
-                        return PTR_ERR(buffer);
+                if (IS_ERR((__force void *)buffer))
+                        return PTR_ERR((__force void *)buffer);
         } else
 #endif
         if (count != sizeof(struct raw1394_request)) {
@@ -2978,7 +2982,7 @@ static int raw1394_release(struct inode *inode, struct file *file)
  * Export information about protocols/devices supported by this driver.
  */
 #ifdef MODULE
-static struct ieee1394_device_id raw1394_id_table[] = {
+static const struct ieee1394_device_id raw1394_id_table[] = {
         {
          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
          .specifier_id = AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index f3fd8657ce4b..a51ab233342d 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -265,7 +265,7 @@ static struct hpsb_highlevel sbp2_highlevel = {
         .host_reset     = sbp2_host_reset,
 };
 
-const static struct hpsb_address_ops sbp2_ops = {
+static const struct hpsb_address_ops sbp2_ops = {
         .write          = sbp2_handle_status_write
 };
 
@@ -275,7 +275,7 @@ static int sbp2_handle_physdma_write(struct hpsb_host *, int, int, quadlet_t *,
 static int sbp2_handle_physdma_read(struct hpsb_host *, int, quadlet_t *, u64,
                                     size_t, u16);
 
-const static struct hpsb_address_ops sbp2_physdma_ops = {
+static const struct hpsb_address_ops sbp2_physdma_ops = {
         .read           = sbp2_handle_physdma_read,
         .write          = sbp2_handle_physdma_write,
 };
@@ -285,7 +285,7 @@ const static struct hpsb_address_ops sbp2_physdma_ops = {
 /*
  * Interface to driver core and IEEE 1394 core
  */
-static struct ieee1394_device_id sbp2_id_table[] = {
+static const struct ieee1394_device_id sbp2_id_table[] = {
         {
          .match_flags   = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
          .specifier_id  = SBP2_UNIT_SPEC_ID_ENTRY & 0xffffff,
@@ -1413,8 +1413,7 @@ static void sbp2_parse_unit_directory(struct sbp2_lu *lu,
                           "(firmware_revision 0x%06x, vendor_id 0x%06x,"
                           " model_id 0x%06x)",
                           NODE_BUS_ARGS(ud->ne->host, ud->ne->nodeid),
-                          workarounds, firmware_revision,
-                          ud->vendor_id ? ud->vendor_id : ud->ne->vendor_id,
+                          workarounds, firmware_revision, ud->vendor_id,
                           model);
 
         /* We would need one SCSI host template for each target to adjust
diff --git a/drivers/ieee1394/video1394.c b/drivers/ieee1394/video1394.c
index 679a918a5cc7..d287ba79821d 100644
--- a/drivers/ieee1394/video1394.c
+++ b/drivers/ieee1394/video1394.c
@@ -1294,7 +1294,7 @@ static const struct file_operations video1394_fops=
  * Export information about protocols/devices supported by this driver.
  */
 #ifdef MODULE
-static struct ieee1394_device_id video1394_id_table[] = {
+static const struct ieee1394_device_id video1394_id_table[] = {
         {
                 .match_flags    = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
                 .specifier_id   = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
index 8d3e4c6f237e..ecb1f6fd6276 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -1602,8 +1602,6 @@ struct net_device *nes_netdev_init(struct nes_device *nesdev,
         netif_napi_add(netdev, &nesvnic->napi, nes_netdev_poll, 128);
         nes_debug(NES_DBG_INIT, "Enabling VLAN Insert/Delete.\n");
         netdev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
-        netdev->vlan_rx_register = nes_netdev_vlan_rx_register;
-        netdev->features |= NETIF_F_LLTX;
 
         /* Fill in the port structure */
         nesvnic->netdev = netdev;
diff --git a/drivers/media/dvb/firewire/firedtv-avc.c b/drivers/media/dvb/firewire/firedtv-avc.c
index b55d9ccaf33e..32526f103b59 100644
--- a/drivers/media/dvb/firewire/firedtv-avc.c
+++ b/drivers/media/dvb/firewire/firedtv-avc.c
@@ -115,7 +115,7 @@ static const char *debug_fcp_ctype(unsigned int ctype)
 }
 
 static const char *debug_fcp_opcode(unsigned int opcode,
-                                    const u8 *data, size_t length)
+                                    const u8 *data, int length)
 {
         switch (opcode) {
         case AVC_OPCODE_VENDOR:                 break;
@@ -135,13 +135,14 @@ static const char *debug_fcp_opcode(unsigned int opcode,
         case SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL: return "RegisterRC";
         case SFE_VENDOR_OPCODE_LNB_CONTROL:             return "LNBControl";
         case SFE_VENDOR_OPCODE_TUNE_QPSK:               return "TuneQPSK";
+        case SFE_VENDOR_OPCODE_TUNE_QPSK2:              return "TuneQPSK2";
         case SFE_VENDOR_OPCODE_HOST2CA:                 return "Host2CA";
         case SFE_VENDOR_OPCODE_CA2HOST:                 return "CA2Host";
         }
         return "Vendor";
 }
 
-static void debug_fcp(const u8 *data, size_t length)
+static void debug_fcp(const u8 *data, int length)
 {
         unsigned int subunit_type, subunit_id, op;
         const char *prefix = data[0] > 7 ? "FCP <- " : "FCP -> ";
@@ -266,7 +267,10 @@ static void avc_tuner_tuneqpsk(struct firedtv *fdtv,
         c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
         c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
         c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
-        c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK;
+        if (fdtv->type == FIREDTV_DVB_S2)
+                c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK2;
+        else
+                c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK;
 
         c->operand[4] = (params->frequency >> 24) & 0xff;
         c->operand[5] = (params->frequency >> 16) & 0xff;
diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
index 00d46e137b2a..92285d0089c2 100644
--- a/drivers/mtd/mtdsuper.c
+++ b/drivers/mtd/mtdsuper.c
@@ -81,13 +81,16 @@ static int get_sb_mtd_aux(struct file_system_type *fs_type, int flags,
 
         /* go */
         sb->s_flags |= MS_ACTIVE;
-        return simple_set_mnt(mnt, sb);
+        simple_set_mnt(mnt, sb);
+
+        return 0;
 
         /* new mountpoint for an already mounted superblock */
 already_mounted:
         DEBUG(1, "MTDSB: Device %d (\"%s\") is already mounted\n",
               mtd->index, mtd->name);
-        ret = simple_set_mnt(mnt, sb);
+        simple_set_mnt(mnt, sb);
+        ret = 0;
         goto out_put;
 
 out_error:
diff --git a/drivers/net/3c503.c b/drivers/net/3c503.c
index 5b91a85fe107..4f08bd995836 100644
--- a/drivers/net/3c503.c
+++ b/drivers/net/3c503.c
@@ -353,9 +353,6 @@ el2_probe1(struct net_device *dev, int ioaddr)
 
     dev->netdev_ops = &el2_netdev_ops;
     dev->ethtool_ops = &netdev_ethtool_ops;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-    dev->poll_controller = eip_poll;
-#endif
 
     retval = register_netdev(dev);
     if (retval)
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index e5ffc1c606c1..f062b424704e 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -972,6 +972,14 @@ config ENC28J60_WRITEVERIFY
           Enable the verify after the buffer write useful for debugging purpose.
           If unsure, say N.
 
+config ETHOC
+        tristate "OpenCores 10/100 Mbps Ethernet MAC support"
+        depends on NET_ETHERNET
+        select MII
+        select PHYLIB
+        help
+          Say Y here if you want to use the OpenCores 10/100 Mbps Ethernet MAC.
+
 config SMC911X
         tristate "SMSC LAN911[5678] support"
         select CRC32
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 758ecdf4c820..98409c9dd445 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -230,6 +230,7 @@ obj-$(CONFIG_PASEMI_MAC) += pasemi_mac_driver.o
 pasemi_mac_driver-objs := pasemi_mac.o pasemi_mac_ethtool.o
 obj-$(CONFIG_MLX4_CORE) += mlx4/
 obj-$(CONFIG_ENC28J60) += enc28j60.o
+obj-$(CONFIG_ETHOC) += ethoc.o
 
 obj-$(CONFIG_XTENSA_XT2000_SONIC) += xtsonic.o
 
diff --git a/drivers/net/ac3200.c b/drivers/net/ac3200.c
index 071a851a2ea1..eac73382c087 100644
--- a/drivers/net/ac3200.c
+++ b/drivers/net/ac3200.c
@@ -143,6 +143,22 @@ out:
 }
 #endif
 
+static const struct net_device_ops ac_netdev_ops = {
+        .ndo_open               = ac_open,
+        .ndo_stop               = ac_close_card,
+
+        .ndo_start_xmit         = ei_start_xmit,
+        .ndo_tx_timeout         = ei_tx_timeout,
+        .ndo_get_stats          = ei_get_stats,
+        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_change_mtu         = eth_change_mtu,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = ei_poll,
+#endif
+};
+
 static int __init ac_probe1(int ioaddr, struct net_device *dev)
 {
         int i, retval;
@@ -253,11 +269,7 @@ static int __init ac_probe1(int ioaddr, struct net_device *dev)
         ei_status.block_output = &ac_block_output;
         ei_status.get_8390_hdr = &ac_get_8390_hdr;
 
-        dev->open = &ac_open;
-        dev->stop = &ac_close_card;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        dev->poll_controller = ei_poll;
-#endif
+        dev->netdev_ops = &ac_netdev_ops;
         NS8390_init(dev, 0);
 
         retval = register_netdev(dev);
diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c
index 54819a34ba0a..7f8325419803 100644
--- a/drivers/net/appletalk/cops.c
+++ b/drivers/net/appletalk/cops.c
@@ -171,7 +171,6 @@ static unsigned int cops_debug = COPS_DEBUG;
 
 struct cops_local
 {
-        struct net_device_stats stats;
         int board;                      /* Holds what board type is. */
         int nodeid;                     /* Set to 1 once have nodeid. */
         unsigned char node_acquire;     /* Node ID when acquired. */
@@ -197,7 +196,6 @@ static int  cops_send_packet (struct sk_buff *skb, struct net_device *dev);
 static void set_multicast_list (struct net_device *dev);
 static int  cops_ioctl (struct net_device *dev, struct ifreq *rq, int cmd);
 static int  cops_close (struct net_device *dev);
-static struct net_device_stats *cops_get_stats (struct net_device *dev);
 
 static void cleanup_card(struct net_device *dev)
 {
@@ -260,6 +258,15 @@ out:
         return ERR_PTR(err);
 }
 
+static const struct net_device_ops cops_netdev_ops = {
+        .ndo_open               = cops_open,
+        .ndo_stop               = cops_close,
+        .ndo_start_xmit         = cops_send_packet,
+        .ndo_tx_timeout         = cops_timeout,
+        .ndo_do_ioctl           = cops_ioctl,
+        .ndo_set_multicast_list = set_multicast_list,
+};
+
 /*
  *      This is the real probe routine. Linux has a history of friendly device
  *      probes on the ISA bus. A good device probes avoids doing writes, and
@@ -333,16 +340,9 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr)
         /* Copy local board variable to lp struct. */
         lp->board               = board;
 
-        dev->hard_start_xmit    = cops_send_packet;
-        dev->tx_timeout         = cops_timeout;
+        dev->netdev_ops         = &cops_netdev_ops;
         dev->watchdog_timeo     = HZ * 2;
 
-        dev->get_stats          = cops_get_stats;
-        dev->open               = cops_open;
-        dev->stop               = cops_close;
-        dev->do_ioctl           = cops_ioctl;
-        dev->set_multicast_list = set_multicast_list;
-        dev->mc_list            = NULL;
 
         /* Tell the user where the card is and what mode we're in. */
         if(board==DAYNA)
@@ -797,7 +797,7 @@ static void cops_rx(struct net_device *dev)
         {
                 printk(KERN_WARNING "%s: Memory squeeze, dropping packet.\n",
                         dev->name);
-                lp->stats.rx_dropped++;
+                dev->stats.rx_dropped++;
                 while(pkt_len--)        /* Discard packet */
                         inb(ioaddr);
                 spin_unlock_irqrestore(&lp->lock, flags);
@@ -819,7 +819,7 @@ static void cops_rx(struct net_device *dev)
         {
                 printk(KERN_WARNING "%s: Bad packet length of %d bytes.\n", 
                         dev->name, pkt_len);
-                lp->stats.tx_errors++;
+                dev->stats.tx_errors++;
                 dev_kfree_skb_any(skb);
                 return;
         }
@@ -836,7 +836,7 @@ static void cops_rx(struct net_device *dev)
         if(rsp_type != LAP_RESPONSE)
         {
                 printk(KERN_WARNING "%s: Bad packet type %d.\n", dev->name, rsp_type);
-                lp->stats.tx_errors++;
+                dev->stats.tx_errors++;
                 dev_kfree_skb_any(skb);
                 return;
         }
@@ -846,8 +846,8 @@ static void cops_rx(struct net_device *dev)
         skb_reset_transport_header(skb);    /* Point to data (Skip header). */
 
         /* Update the counters. */
-        lp->stats.rx_packets++;
-        lp->stats.rx_bytes += skb->len;
+        dev->stats.rx_packets++;
+        dev->stats.rx_bytes += skb->len;
 
         /* Send packet to a higher place. */
         netif_rx(skb);
@@ -858,7 +858,7 @@ static void cops_timeout(struct net_device *dev)
         struct cops_local *lp = netdev_priv(dev);
         int ioaddr = dev->base_addr;
 
-        lp->stats.tx_errors++;
+        dev->stats.tx_errors++;
         if(lp->board==TANGENT)
         {
                 if((inb(ioaddr+TANG_CARD_STATUS)&TANG_TX_READY)==0)
@@ -916,8 +916,8 @@ static int cops_send_packet(struct sk_buff *skb, struct net_device *dev)
         spin_unlock_irqrestore(&lp->lock, flags);       /* Restore interrupts. */
 
         /* Done sending packet, update counters and cleanup. */
-        lp->stats.tx_packets++;
-        lp->stats.tx_bytes += skb->len;
+        dev->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
         dev->trans_start = jiffies;
         dev_kfree_skb (skb);
         return 0;
@@ -986,15 +986,6 @@ static int cops_close(struct net_device *dev)
         return 0;
 }
 
-/*
- *      Get the current statistics.
- *      This may be called with the card open or closed.
- */
-static struct net_device_stats *cops_get_stats(struct net_device *dev)
-{
-        struct cops_local *lp = netdev_priv(dev);
-        return &lp->stats;
-}
 
 #ifdef MODULE
 static struct net_device *cops_dev;
diff --git a/drivers/net/appletalk/ltpc.c b/drivers/net/appletalk/ltpc.c
index dc4d49605603..78cc71469136 100644
--- a/drivers/net/appletalk/ltpc.c
+++ b/drivers/net/appletalk/ltpc.c
@@ -261,7 +261,6 @@ static unsigned char *ltdmacbuf;
 
 struct ltpc_private
 {
-        struct net_device_stats stats;
         struct atalk_addr my_addr;
 };
 
@@ -699,7 +698,6 @@ static int do_read(struct net_device *dev, void *cbuf, int cbuflen,
 static struct timer_list ltpc_timer;
 
 static int ltpc_xmit(struct sk_buff *skb, struct net_device *dev);
-static struct net_device_stats *ltpc_get_stats(struct net_device *dev);
 
 static int read_30 ( struct net_device *dev)
 {
@@ -726,8 +724,6 @@ static int sendup_buffer (struct net_device *dev)
         int dnode, snode, llaptype, len; 
         int sklen;
         struct sk_buff *skb;
-        struct ltpc_private *ltpc_priv = netdev_priv(dev);
-        struct net_device_stats *stats = &ltpc_priv->stats;
         struct lt_rcvlap *ltc = (struct lt_rcvlap *) ltdmacbuf;
 
         if (ltc->command != LT_RCVLAP) {
@@ -779,8 +775,8 @@ static int sendup_buffer (struct net_device *dev)
 
         skb_reset_transport_header(skb);
 
-        stats->rx_packets++;
-        stats->rx_bytes+=skb->len;
+        dev->stats.rx_packets++;
+        dev->stats.rx_bytes += skb->len;
 
         /* toss it onwards */
         netif_rx(skb);
@@ -904,10 +900,6 @@ static int ltpc_xmit(struct sk_buff *skb, struct net_device *dev)
         /* in kernel 1.3.xx, on entry skb->data points to ddp header,
          * and skb->len is the length of the ddp data + ddp header
          */
-
-        struct ltpc_private *ltpc_priv = netdev_priv(dev);
-        struct net_device_stats *stats = &ltpc_priv->stats;
-
         int i;
         struct lt_sendlap cbuf;
         unsigned char *hdr;
@@ -936,20 +928,13 @@ static int ltpc_xmit(struct sk_buff *skb, struct net_device *dev)
                 printk("\n");
         }
 
-        stats->tx_packets++;
-        stats->tx_bytes+=skb->len;
+        dev->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
 
         dev_kfree_skb(skb);
         return 0;
 }
 
-static struct net_device_stats *ltpc_get_stats(struct net_device *dev)
-{
-        struct ltpc_private *ltpc_priv = netdev_priv(dev);
-        struct net_device_stats *stats = &ltpc_priv->stats;
-        return stats;
-}
-
 /* initialization stuff */
   
 static int __init ltpc_probe_dma(int base, int dma)
@@ -1027,6 +1012,12 @@ static int __init ltpc_probe_dma(int base, int dma)
         return (want & 2) ? 3 : 1;
 }
 
+static const struct net_device_ops ltpc_netdev = {
+        .ndo_start_xmit         = ltpc_xmit,
+        .ndo_do_ioctl           = ltpc_ioctl,
+        .ndo_set_multicast_list = set_multicast_list,
+};
+
 struct net_device * __init ltpc_probe(void)
 {
         struct net_device *dev;
@@ -1133,14 +1124,7 @@ struct net_device * __init ltpc_probe(void)
         else
                 printk(KERN_INFO "Apple/Farallon LocalTalk-PC card at %03x, DMA%d.  Using polled mode.\n",io,dma);
 
-        /* Fill in the fields of the device structure with ethernet-generic values. */
-        dev->hard_start_xmit = ltpc_xmit;
-        dev->get_stats = ltpc_get_stats;
-
-        /* add the ltpc-specific things */
-        dev->do_ioctl = &ltpc_ioctl;
-
-        dev->set_multicast_list = &set_multicast_list;
+        dev->netdev_ops = &ltpc_netdev;
         dev->mc_list = NULL;
         dev->base_addr = io;
         dev->irq = irq;
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
index ced70799b898..18b566ad4fd1 100644
--- a/drivers/net/at1700.c
+++ b/drivers/net/at1700.c
@@ -249,6 +249,17 @@ out:
         return ERR_PTR(err);
 }
 
+static const struct net_device_ops at1700_netdev_ops = {
+        .ndo_open               = net_open,
+        .ndo_stop               = net_close,
+        .ndo_start_xmit         = net_send_packet,
+        .ndo_set_multicast_list = set_rx_mode,
+        .ndo_tx_timeout         = net_tx_timeout,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 /* The Fujitsu datasheet suggests that the NIC be probed for by checking its
    "signature", the default bit pattern after a reset.  This *doesn't* work --
    there is no way to reset the bus interface without a complete power-cycle!
@@ -448,13 +459,7 @@ found:
         if (net_debug)
                 printk(version);
 
-        memset(lp, 0, sizeof(struct net_local));
-
-        dev->open               = net_open;
-        dev->stop               = net_close;
-        dev->hard_start_xmit = net_send_packet;
-        dev->set_multicast_list = &set_rx_mode;
-        dev->tx_timeout = net_tx_timeout;
+        dev->netdev_ops = &at1700_netdev_ops;
         dev->watchdog_timeo = TX_TIMEOUT;
 
         spin_lock_init(&lp->lock);
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index f901fee79a20..9b75aa630062 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -16,6 +16,7 @@
  */
 
 #include "be.h"
+#include <asm/div64.h>
 
 MODULE_VERSION(DRV_VER);
 MODULE_DEVICE_TABLE(pci, be_dev_ids);
@@ -290,6 +291,17 @@ static struct net_device_stats *be_get_stats(struct net_device *dev)
         return &adapter->stats.net_stats;
 }
 
+static u32 be_calc_rate(u64 bytes, unsigned long ticks)
+{
+        u64 rate = bytes;
+
+        do_div(rate, ticks / HZ);
+        rate <<= 3;                     /* bytes/sec -> bits/sec */
+        do_div(rate, 1000000ul);        /* MB/Sec */
+
+        return rate;
+}
+
 static void be_tx_rate_update(struct be_adapter *adapter)
 {
         struct be_drvr_stats *stats = drvr_stats(adapter);
@@ -303,11 +315,9 @@ static void be_tx_rate_update(struct be_adapter *adapter)
 
         /* Update tx rate once in two seconds */
         if ((now - stats->be_tx_jiffies) > 2 * HZ) {
-                u32 r;
-                r = (stats->be_tx_bytes - stats->be_tx_bytes_prev) /
-                        ((now - stats->be_tx_jiffies) / HZ);
-                r = r / 1000000;                        /* M bytes/s */
-                stats->be_tx_rate = r * 8;      /* M bits/s */
+                stats->be_tx_rate = be_calc_rate(stats->be_tx_bytes
+                                                  - stats->be_tx_bytes_prev,
+                                                 now - stats->be_tx_jiffies);
                 stats->be_tx_jiffies = now;
                 stats->be_tx_bytes_prev = stats->be_tx_bytes;
         }
@@ -599,7 +609,6 @@ static void be_rx_rate_update(struct be_adapter *adapter)
 {
         struct be_drvr_stats *stats = drvr_stats(adapter);
         ulong now = jiffies;
-        u32 rate;
 
         /* Wrapped around */
         if (time_before(now, stats->be_rx_jiffies)) {
@@ -611,10 +620,9 @@ static void be_rx_rate_update(struct be_adapter *adapter)
         if ((now - stats->be_rx_jiffies) < 2 * HZ)
                 return;
 
-        rate = (stats->be_rx_bytes - stats->be_rx_bytes_prev) /
-                ((now - stats->be_rx_jiffies) / HZ);
-        rate = rate / 1000000;  /* MB/Sec */
-        stats->be_rx_rate = rate * 8;   /* Mega Bits/Sec */
+        stats->be_rx_rate = be_calc_rate(stats->be_rx_bytes
+                                          - stats->be_rx_bytes_prev,
+                                         now - stats->be_rx_jiffies);
         stats->be_rx_jiffies = now;
         stats->be_rx_bytes_prev = stats->be_rx_bytes;
 }
diff --git a/drivers/net/cs89x0.c b/drivers/net/cs89x0.c
index ff6497658a45..7433b88eed7e 100644
--- a/drivers/net/cs89x0.c
+++ b/drivers/net/cs89x0.c
@@ -501,6 +501,21 @@ static void net_poll_controller(struct net_device *dev)
 }
 #endif
 
+static const struct net_device_ops net_ops = {
+        .ndo_open               = net_open,
+        .ndo_stop               = net_close,
+        .ndo_tx_timeout         = net_timeout,
+        .ndo_start_xmit         = net_send_packet,
+        .ndo_get_stats          = net_get_stats,
+        .ndo_set_multicast_list = set_multicast_list,
+        .ndo_set_mac_address    = set_mac_address,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = net_poll_controller,
+#endif
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 /* This is the real probe routine.  Linux has a history of friendly device
    probes on the ISA bus.  A good device probes avoids doing writes, and
    verifies that the correct device exists and functions.
@@ -843,17 +858,8 @@ cs89x0_probe1(struct net_device *dev, int ioaddr, int modular)
         /* print the ethernet address. */
         printk(", MAC %pM", dev->dev_addr);
 
-        dev->open               = net_open;
-        dev->stop               = net_close;
-        dev->tx_timeout         = net_timeout;
-        dev->watchdog_timeo     = HZ;
-        dev->hard_start_xmit    = net_send_packet;
-        dev->get_stats          = net_get_stats;
-        dev->set_multicast_list = set_multicast_list;
-        dev->set_mac_address    = set_mac_address;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        dev->poll_controller    = net_poll_controller;
-#endif
+        dev->netdev_ops = &net_ops;
+        dev->watchdog_timeo = HZ;
 
         printk("\n");
         if (net_debug)
diff --git a/drivers/net/cxgb3/adapter.h b/drivers/net/cxgb3/adapter.h
index 71eaa431371d..714df2b675e6 100644
--- a/drivers/net/cxgb3/adapter.h
+++ b/drivers/net/cxgb3/adapter.h
@@ -85,6 +85,8 @@ struct fl_pg_chunk {
         struct page *page;
         void *va;
         unsigned int offset;
+        u64 *p_cnt;
+        DECLARE_PCI_UNMAP_ADDR(mapping);
 };
 
 struct rx_desc;
@@ -101,6 +103,7 @@ struct sge_fl {                     /* SGE per free-buffer list state */
         struct fl_pg_chunk pg_chunk;/* page chunk cache */
         unsigned int use_pages;     /* whether FL uses pages or sk_buffs */
         unsigned int order;         /* order of page allocations */
+        unsigned int alloc_size;    /* size of allocated buffer */
         struct rx_desc *desc;       /* address of HW Rx descriptor ring */
         struct rx_sw_desc *sdesc;   /* address of SW Rx descriptor ring */
         dma_addr_t   phys_addr;     /* physical address of HW ring start */
@@ -291,6 +294,7 @@ void t3_os_link_fault_handler(struct adapter *adapter, int port_id);
 
 void t3_sge_start(struct adapter *adap);
 void t3_sge_stop(struct adapter *adap);
+void t3_start_sge_timers(struct adapter *adap);
 void t3_stop_sge_timers(struct adapter *adap);
 void t3_free_sge_resources(struct adapter *adap);
 void t3_sge_err_intr_handler(struct adapter *adapter);
diff --git a/drivers/net/cxgb3/common.h b/drivers/net/cxgb3/common.h
index 9ee021e750c8..e508dc32f3ec 100644
--- a/drivers/net/cxgb3/common.h
+++ b/drivers/net/cxgb3/common.h
@@ -191,7 +191,8 @@ struct mdio_ops {
 };
 
 struct adapter_info {
-        unsigned char nports;   /* # of ports */
+        unsigned char nports0;        /* # of ports on channel 0 */
+        unsigned char nports1;        /* # of ports on channel 1 */
         unsigned char phy_base_addr;    /* MDIO PHY base address */
         unsigned int gpio_out;  /* GPIO output settings */
         unsigned char gpio_intr[MAX_NPORTS]; /* GPIO PHY IRQ pins */
@@ -422,6 +423,7 @@ struct adapter_params {
         unsigned short b_wnd[NCCTRL_WIN];
 
         unsigned int nports;    /* # of ethernet ports */
+        unsigned int chan_map;  /* bitmap of in-use Tx channels */
         unsigned int stats_update_period;       /* MAC stats accumulation period */
         unsigned int linkpoll_period;   /* link poll period in 0.1s */
         unsigned int rev;       /* chip revision */
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index d8be89621bf7..2c2aaa741450 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -602,7 +602,6 @@ static int setup_sge_qsets(struct adapter *adap)
                                 &adap->params.sge.qset[qset_idx], ntxq, dev,
                                 netdev_get_tx_queue(dev, j));
                         if (err) {
-                                t3_stop_sge_timers(adap);
                                 t3_free_sge_resources(adap);
                                 return err;
                         }
@@ -1046,6 +1045,8 @@ static int cxgb_up(struct adapter *adap)
                 setup_rss(adap);
                 if (!(adap->flags & NAPI_INIT))
                         init_napi(adap);
+
+                t3_start_sge_timers(adap);
                 adap->flags |= FULL_INIT_DONE;
         }
 
@@ -2870,6 +2871,9 @@ static void t3_io_resume(struct pci_dev *pdev)
 {
         struct adapter *adapter = pci_get_drvdata(pdev);
 
+        CH_ALERT(adapter, "adapter recovering, PEX ERR 0x%x\n",
+                 t3_read_reg(adapter, A_PCIE_PEX_ERR));
+
         t3_resume_ports(adapter);
 }
 
@@ -3002,7 +3006,7 @@ static int __devinit init_one(struct pci_dev *pdev,
         static int version_printed;
 
         int i, err, pci_using_dac = 0;
-        unsigned long mmio_start, mmio_len;
+        resource_size_t mmio_start, mmio_len;
         const struct adapter_info *ai;
         struct adapter *adapter = NULL;
         struct port_info *pi;
@@ -3082,7 +3086,7 @@ static int __devinit init_one(struct pci_dev *pdev,
         INIT_WORK(&adapter->fatal_error_handler_task, fatal_error_task);
         INIT_DELAYED_WORK(&adapter->adap_check_task, t3_adap_check_task);
 
-        for (i = 0; i < ai->nports; ++i) {
+        for (i = 0; i < ai->nports0 + ai->nports1; ++i) {
                 struct net_device *netdev;
 
                 netdev = alloc_etherdev_mq(sizeof(struct port_info), SGE_QSETS);
@@ -3172,7 +3176,7 @@ static int __devinit init_one(struct pci_dev *pdev,
 
 out_free_dev:
         iounmap(adapter->regs);
-        for (i = ai->nports - 1; i >= 0; --i)
+        for (i = ai->nports0 + ai->nports1 - 1; i >= 0; --i)
                 if (adapter->port[i])
                         free_netdev(adapter->port[i]);
 
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index a7555cb3fa4a..26d3587f3399 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -50,6 +50,7 @@
 #define SGE_RX_COPY_THRES  256
 #define SGE_RX_PULL_LEN    128
 
+#define SGE_PG_RSVD SMP_CACHE_BYTES
 /*
  * Page chunk size for FL0 buffers if FL0 is to be populated with page chunks.
  * It must be a divisor of PAGE_SIZE.  If set to 0 FL0 will use sk_buffs
@@ -57,8 +58,10 @@
  */
 #define FL0_PG_CHUNK_SIZE  2048
 #define FL0_PG_ORDER 0
+#define FL0_PG_ALLOC_SIZE (PAGE_SIZE << FL0_PG_ORDER)
 #define FL1_PG_CHUNK_SIZE (PAGE_SIZE > 8192 ? 16384 : 8192)
 #define FL1_PG_ORDER (PAGE_SIZE > 8192 ? 0 : 1)
+#define FL1_PG_ALLOC_SIZE (PAGE_SIZE << FL1_PG_ORDER)
 
 #define SGE_RX_DROP_THRES 16
 #define RX_RECLAIM_PERIOD (HZ/4)
@@ -345,13 +348,21 @@ static inline int should_restart_tx(const struct sge_txq *q)
         return q->in_use - r < (q->size >> 1);
 }
 
-static void clear_rx_desc(const struct sge_fl *q, struct rx_sw_desc *d)
+static void clear_rx_desc(struct pci_dev *pdev, const struct sge_fl *q,
+                          struct rx_sw_desc *d)
 {
-        if (q->use_pages) {
-                if (d->pg_chunk.page)
-                        put_page(d->pg_chunk.page);
+        if (q->use_pages && d->pg_chunk.page) {
+                (*d->pg_chunk.p_cnt)--;
+                if (!*d->pg_chunk.p_cnt)
+                        pci_unmap_page(pdev,
+                                       pci_unmap_addr(&d->pg_chunk, mapping),
+                                       q->alloc_size, PCI_DMA_FROMDEVICE);
+
+                put_page(d->pg_chunk.page);
                 d->pg_chunk.page = NULL;
         } else {
+                pci_unmap_single(pdev, pci_unmap_addr(d, dma_addr),
+                                 q->buf_size, PCI_DMA_FROMDEVICE);
                 kfree_skb(d->skb);
                 d->skb = NULL;
         }
@@ -372,9 +383,8 @@ static void free_rx_bufs(struct pci_dev *pdev, struct sge_fl *q)
         while (q->credits--) {
                 struct rx_sw_desc *d = &q->sdesc[cidx];
 
-                pci_unmap_single(pdev, pci_unmap_addr(d, dma_addr),
-                                 q->buf_size, PCI_DMA_FROMDEVICE);
-                clear_rx_desc(q, d);
+
+                clear_rx_desc(pdev, q, d);
                 if (++cidx == q->size)
                         cidx = 0;
         }
@@ -417,18 +427,39 @@ static inline int add_one_rx_buf(void *va, unsigned int len,
         return 0;
 }
 
-static int alloc_pg_chunk(struct sge_fl *q, struct rx_sw_desc *sd, gfp_t gfp,
+static inline int add_one_rx_chunk(dma_addr_t mapping, struct rx_desc *d,
+                                   unsigned int gen)
+{
+        d->addr_lo = cpu_to_be32(mapping);
+        d->addr_hi = cpu_to_be32((u64) mapping >> 32);
+        wmb();
+        d->len_gen = cpu_to_be32(V_FLD_GEN1(gen));
+        d->gen2 = cpu_to_be32(V_FLD_GEN2(gen));
+        return 0;
+}
+
+static int alloc_pg_chunk(struct adapter *adapter, struct sge_fl *q,
+                          struct rx_sw_desc *sd, gfp_t gfp,
                           unsigned int order)
 {
         if (!q->pg_chunk.page) {
+                dma_addr_t mapping;
+
                 q->pg_chunk.page = alloc_pages(gfp, order);
                 if (unlikely(!q->pg_chunk.page))
                         return -ENOMEM;
                 q->pg_chunk.va = page_address(q->pg_chunk.page);
+                q->pg_chunk.p_cnt = q->pg_chunk.va + (PAGE_SIZE << order) -
+                                    SGE_PG_RSVD;
                 q->pg_chunk.offset = 0;
+                mapping = pci_map_page(adapter->pdev, q->pg_chunk.page,
+                                       0, q->alloc_size, PCI_DMA_FROMDEVICE);
+                pci_unmap_addr_set(&q->pg_chunk, mapping, mapping);
         }
         sd->pg_chunk = q->pg_chunk;
 
+        prefetch(sd->pg_chunk.p_cnt);
+
         q->pg_chunk.offset += q->buf_size;
         if (q->pg_chunk.offset == (PAGE_SIZE << order))
                 q->pg_chunk.page = NULL;
@@ -436,6 +467,12 @@ static int alloc_pg_chunk(struct sge_fl *q, struct rx_sw_desc *sd, gfp_t gfp,
                 q->pg_chunk.va += q->buf_size;
                 get_page(q->pg_chunk.page);
         }
+
+        if (sd->pg_chunk.offset == 0)
+                *sd->pg_chunk.p_cnt = 1;
+        else
+                *sd->pg_chunk.p_cnt += 1;
+
         return 0;
 }
 
@@ -460,35 +497,43 @@ static inline void ring_fl_db(struct adapter *adap, struct sge_fl *q)
  */
 static int refill_fl(struct adapter *adap, struct sge_fl *q, int n, gfp_t gfp)
 {
-        void *buf_start;
         struct rx_sw_desc *sd = &q->sdesc[q->pidx];
         struct rx_desc *d = &q->desc[q->pidx];
         unsigned int count = 0;
 
         while (n--) {
+                dma_addr_t mapping;
                 int err;
 
                 if (q->use_pages) {
-                        if (unlikely(alloc_pg_chunk(q, sd, gfp, q->order))) {
+                        if (unlikely(alloc_pg_chunk(adap, q, sd, gfp,
+                                                    q->order))) {
 nomem:                          q->alloc_failed++;
                                 break;
                         }
-                        buf_start = sd->pg_chunk.va;
+                        mapping = pci_unmap_addr(&sd->pg_chunk, mapping) +
+                                                 sd->pg_chunk.offset;
+                        pci_unmap_addr_set(sd, dma_addr, mapping);
+
+                        add_one_rx_chunk(mapping, d, q->gen);
+                        pci_dma_sync_single_for_device(adap->pdev, mapping,
+                                                q->buf_size - SGE_PG_RSVD,
+                                                PCI_DMA_FROMDEVICE);
                 } else {
-                        struct sk_buff *skb = alloc_skb(q->buf_size, gfp);
+                        void *buf_start;
 
+                        struct sk_buff *skb = alloc_skb(q->buf_size, gfp);
                         if (!skb)
                                 goto nomem;
 
                         sd->skb = skb;
                         buf_start = skb->data;
-                }
-
-                err = add_one_rx_buf(buf_start, q->buf_size, d, sd, q->gen,
-                                     adap->pdev);
-                if (unlikely(err)) {
-                        clear_rx_desc(q, sd);
-                        break;
+                        err = add_one_rx_buf(buf_start, q->buf_size, d, sd,
+                                             q->gen, adap->pdev);
+                        if (unlikely(err)) {
+                                clear_rx_desc(adap->pdev, q, sd);
+                                break;
+                        }
                 }
 
                 d++;
@@ -795,19 +840,19 @@ static struct sk_buff *get_packet_pg(struct adapter *adap, struct sge_fl *fl,
         struct sk_buff *newskb, *skb;
         struct rx_sw_desc *sd = &fl->sdesc[fl->cidx];
 
-        newskb = skb = q->pg_skb;
+        dma_addr_t dma_addr = pci_unmap_addr(sd, dma_addr);
 
+        newskb = skb = q->pg_skb;
         if (!skb && (len <= SGE_RX_COPY_THRES)) {
                 newskb = alloc_skb(len, GFP_ATOMIC);
                 if (likely(newskb != NULL)) {
                         __skb_put(newskb, len);
-                        pci_dma_sync_single_for_cpu(adap->pdev,
-                                            pci_unmap_addr(sd, dma_addr), len,
+                        pci_dma_sync_single_for_cpu(adap->pdev, dma_addr, len,
                                             PCI_DMA_FROMDEVICE);
                         memcpy(newskb->data, sd->pg_chunk.va, len);
-                        pci_dma_sync_single_for_device(adap->pdev,
-                                            pci_unmap_addr(sd, dma_addr), len,
-                                            PCI_DMA_FROMDEVICE);
+                        pci_dma_sync_single_for_device(adap->pdev, dma_addr,
+                                                       len,
+                                                       PCI_DMA_FROMDEVICE);
                 } else if (!drop_thres)
                         return NULL;
 recycle:
@@ -820,16 +865,25 @@ recycle:
         if (unlikely(q->rx_recycle_buf || (!skb && fl->credits <= drop_thres)))
                 goto recycle;
 
+        prefetch(sd->pg_chunk.p_cnt);
+
         if (!skb)
                 newskb = alloc_skb(SGE_RX_PULL_LEN, GFP_ATOMIC);
+
         if (unlikely(!newskb)) {
                 if (!drop_thres)
                         return NULL;
                 goto recycle;
         }
 
-        pci_unmap_single(adap->pdev, pci_unmap_addr(sd, dma_addr),
-                         fl->buf_size, PCI_DMA_FROMDEVICE);
+        pci_dma_sync_single_for_cpu(adap->pdev, dma_addr, len,
+                                    PCI_DMA_FROMDEVICE);
+        (*sd->pg_chunk.p_cnt)--;
+        if (!*sd->pg_chunk.p_cnt)
+                pci_unmap_page(adap->pdev,
+                               pci_unmap_addr(&sd->pg_chunk, mapping),
+                               fl->alloc_size,
+                               PCI_DMA_FROMDEVICE);
         if (!skb) {
                 __skb_put(newskb, SGE_RX_PULL_LEN);
                 memcpy(newskb->data, sd->pg_chunk.va, SGE_RX_PULL_LEN);
@@ -1089,7 +1143,7 @@ static void write_tx_pkt_wr(struct adapter *adap, struct sk_buff *skb,
         struct tx_desc *d = &q->desc[pidx];
         struct cpl_tx_pkt *cpl = (struct cpl_tx_pkt *)d;
 
-        cpl->len = htonl(skb->len | 0x80000000);
+        cpl->len = htonl(skb->len);
         cntrl = V_TXPKT_INTF(pi->port_id);
 
         if (vlan_tx_tag_present(skb) && pi->vlan_grp)
@@ -1958,8 +2012,8 @@ static void rx_eth(struct adapter *adap, struct sge_rspq *rq,
         skb_pull(skb, sizeof(*p) + pad);
         skb->protocol = eth_type_trans(skb, adap->port[p->iff]);
         pi = netdev_priv(skb->dev);
-        if ((pi->rx_offload & T3_RX_CSUM) && p->csum_valid && p->csum == htons(0xffff) &&
-            !p->fragment) {
+        if ((pi->rx_offload & T3_RX_CSUM) && p->csum_valid &&
+            p->csum == htons(0xffff) && !p->fragment) {
                 qs->port_stats[SGE_PSTAT_RX_CSUM_GOOD]++;
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         } else
@@ -2034,10 +2088,19 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
         fl->credits--;
 
         len -= offset;
-        pci_unmap_single(adap->pdev, pci_unmap_addr(sd, dma_addr),
-                         fl->buf_size, PCI_DMA_FROMDEVICE);
+        pci_dma_sync_single_for_cpu(adap->pdev,
+                                    pci_unmap_addr(sd, dma_addr),
+                                    fl->buf_size - SGE_PG_RSVD,
+                                    PCI_DMA_FROMDEVICE);
 
-        prefetch(&qs->lro_frag_tbl);
+        (*sd->pg_chunk.p_cnt)--;
+        if (!*sd->pg_chunk.p_cnt)
+                pci_unmap_page(adap->pdev,
+                               pci_unmap_addr(&sd->pg_chunk, mapping),
+                               fl->alloc_size,
+                               PCI_DMA_FROMDEVICE);
+
+        prefetch(qs->lro_va);
 
         rx_frag += nr_frags;
         rx_frag->page = sd->pg_chunk.page;
@@ -2047,6 +2110,7 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
         qs->lro_frag_tbl.nr_frags++;
         qs->lro_frag_tbl.len = frag_len;
 
+
         if (!complete)
                 return;
 
@@ -2236,6 +2300,8 @@ no_mem:
                         if (fl->use_pages) {
                                 void *addr = fl->sdesc[fl->cidx].pg_chunk.va;
 
+                                prefetch(&qs->lro_frag_tbl);
+
                                 prefetch(addr);
 #if L1_CACHE_BYTES < 128
                                 prefetch(addr + L1_CACHE_BYTES);
@@ -2972,21 +3038,23 @@ int t3_sge_alloc_qset(struct adapter *adapter, unsigned int id, int nports,
         q->fl[1].use_pages = FL1_PG_CHUNK_SIZE > 0;
         q->fl[0].order = FL0_PG_ORDER;
         q->fl[1].order = FL1_PG_ORDER;
+        q->fl[0].alloc_size = FL0_PG_ALLOC_SIZE;
+        q->fl[1].alloc_size = FL1_PG_ALLOC_SIZE;
 
         spin_lock_irq(&adapter->sge.reg_lock);
 
         /* FL threshold comparison uses < */
         ret = t3_sge_init_rspcntxt(adapter, q->rspq.cntxt_id, irq_vec_idx,
                                    q->rspq.phys_addr, q->rspq.size,
-                                   q->fl[0].buf_size, 1, 0);
+                                   q->fl[0].buf_size - SGE_PG_RSVD, 1, 0);
         if (ret)
                 goto err_unlock;
 
         for (i = 0; i < SGE_RXQ_PER_SET; ++i) {
                 ret = t3_sge_init_flcntxt(adapter, q->fl[i].cntxt_id, 0,
                                           q->fl[i].phys_addr, q->fl[i].size,
-                                          q->fl[i].buf_size, p->cong_thres, 1,
-                                          0);
+                                          q->fl[i].buf_size - SGE_PG_RSVD,
+                                          p->cong_thres, 1, 0);
                 if (ret)
                         goto err_unlock;
         }
@@ -3044,9 +3112,6 @@ int t3_sge_alloc_qset(struct adapter *adapter, unsigned int id, int nports,
         t3_write_reg(adapter, A_SG_GTS, V_RSPQ(q->rspq.cntxt_id) |
                      V_NEWTIMER(q->rspq.holdoff_tmr));
 
-        mod_timer(&q->tx_reclaim_timer, jiffies + TX_RECLAIM_PERIOD);
-        mod_timer(&q->rx_reclaim_timer, jiffies + RX_RECLAIM_PERIOD);
-
         return 0;
 
 err_unlock:
@@ -3057,6 +3122,27 @@ err:
 }
 
 /**
+ *      t3_start_sge_timers - start SGE timer call backs
+ *      @adap: the adapter
+ *
+ *      Starts each SGE queue set's timer call back
+ */
+void t3_start_sge_timers(struct adapter *adap)
+{
+        int i;
+
+        for (i = 0; i < SGE_QSETS; ++i) {
+                struct sge_qset *q = &adap->sge.qs[i];
+
+        if (q->tx_reclaim_timer.function)
+                mod_timer(&q->tx_reclaim_timer, jiffies + TX_RECLAIM_PERIOD);
+
+        if (q->rx_reclaim_timer.function)
+                mod_timer(&q->rx_reclaim_timer, jiffies + RX_RECLAIM_PERIOD);
+        }
+}
+
+/**
  *      t3_stop_sge_timers - stop SGE timer call backs
  *      @adap: the adapter
  *
diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
index ff262a04ded0..31ed31a3428b 100644
--- a/drivers/net/cxgb3/t3_hw.c
+++ b/drivers/net/cxgb3/t3_hw.c
@@ -493,20 +493,20 @@ int t3_phy_lasi_intr_handler(struct cphy *phy)
 }
 
 static const struct adapter_info t3_adap_info[] = {
-        {2, 0,
+        {1, 1, 0,
          F_GPIO2_OEN | F_GPIO4_OEN |
          F_GPIO2_OUT_VAL | F_GPIO4_OUT_VAL, { S_GPIO3, S_GPIO5 }, 0,
          &mi1_mdio_ops, "Chelsio PE9000"},
-        {2, 0,
+        {1, 1, 0,
          F_GPIO2_OEN | F_GPIO4_OEN |
          F_GPIO2_OUT_VAL | F_GPIO4_OUT_VAL, { S_GPIO3, S_GPIO5 }, 0,
          &mi1_mdio_ops, "Chelsio T302"},
-        {1, 0,
+        {1, 0, 0,
          F_GPIO1_OEN | F_GPIO6_OEN | F_GPIO7_OEN | F_GPIO10_OEN |
          F_GPIO11_OEN | F_GPIO1_OUT_VAL | F_GPIO6_OUT_VAL | F_GPIO10_OUT_VAL,
          { 0 }, SUPPORTED_10000baseT_Full | SUPPORTED_AUI,
          &mi1_mdio_ext_ops, "Chelsio T310"},
-        {2, 0,
+        {1, 1, 0,
          F_GPIO1_OEN | F_GPIO2_OEN | F_GPIO4_OEN | F_GPIO5_OEN | F_GPIO6_OEN |
          F_GPIO7_OEN | F_GPIO10_OEN | F_GPIO11_OEN | F_GPIO1_OUT_VAL |
          F_GPIO5_OUT_VAL | F_GPIO6_OUT_VAL | F_GPIO10_OUT_VAL,
@@ -514,7 +514,7 @@ static const struct adapter_info t3_adap_info[] = {
          &mi1_mdio_ext_ops, "Chelsio T320"},
         {},
         {},
-        {1, 0,
+        {1, 0, 0,
          F_GPIO1_OEN | F_GPIO2_OEN | F_GPIO4_OEN | F_GPIO6_OEN | F_GPIO7_OEN |
          F_GPIO10_OEN | F_GPIO1_OUT_VAL | F_GPIO6_OUT_VAL | F_GPIO10_OUT_VAL,
          { S_GPIO9 }, SUPPORTED_10000baseT_Full | SUPPORTED_AUI,
@@ -2128,16 +2128,40 @@ void t3_port_intr_clear(struct adapter *adapter, int idx)
 static int t3_sge_write_context(struct adapter *adapter, unsigned int id,
                                 unsigned int type)
 {
-        t3_write_reg(adapter, A_SG_CONTEXT_MASK0, 0xffffffff);
-        t3_write_reg(adapter, A_SG_CONTEXT_MASK1, 0xffffffff);
-        t3_write_reg(adapter, A_SG_CONTEXT_MASK2, 0xffffffff);
-        t3_write_reg(adapter, A_SG_CONTEXT_MASK3, 0xffffffff);
+        if (type == F_RESPONSEQ) {
+                /*
+                 * Can't write the Response Queue Context bits for
+                 * Interrupt Armed or the Reserve bits after the chip
+                 * has been initialized out of reset.  Writing to these
+                 * bits can confuse the hardware.
+                 */
+                t3_write_reg(adapter, A_SG_CONTEXT_MASK0, 0xffffffff);
+                t3_write_reg(adapter, A_SG_CONTEXT_MASK1, 0xffffffff);
+                t3_write_reg(adapter, A_SG_CONTEXT_MASK2, 0x17ffffff);
+                t3_write_reg(adapter, A_SG_CONTEXT_MASK3, 0xffffffff);
+        } else {
+                t3_write_reg(adapter, A_SG_CONTEXT_MASK0, 0xffffffff);
+                t3_write_reg(adapter, A_SG_CONTEXT_MASK1, 0xffffffff);
+                t3_write_reg(adapter, A_SG_CONTEXT_MASK2, 0xffffffff);
+                t3_write_reg(adapter, A_SG_CONTEXT_MASK3, 0xffffffff);
+        }
         t3_write_reg(adapter, A_SG_CONTEXT_CMD,
                      V_CONTEXT_CMD_OPCODE(1) | type | V_CONTEXT(id));
         return t3_wait_op_done(adapter, A_SG_CONTEXT_CMD, F_CONTEXT_CMD_BUSY,
                                0, SG_CONTEXT_CMD_ATTEMPTS, 1);
 }
 
+/**
+ *      clear_sge_ctxt - completely clear an SGE context
+ *      @adapter: the adapter
+ *      @id: the context id
+ *      @type: the context type
+ *
+ *      Completely clear an SGE context.  Used predominantly at post-reset
+ *      initialization.  Note in particular that we don't skip writing to any
+ *      "sensitive bits" in the contexts the way that t3_sge_write_context()
+ *      does ...
+ */
 static int clear_sge_ctxt(struct adapter *adap, unsigned int id,
                           unsigned int type)
 {
@@ -2145,7 +2169,14 @@ static int clear_sge_ctxt(struct adapter *adap, unsigned int id,
         t3_write_reg(adap, A_SG_CONTEXT_DATA1, 0);
         t3_write_reg(adap, A_SG_CONTEXT_DATA2, 0);
         t3_write_reg(adap, A_SG_CONTEXT_DATA3, 0);
-        return t3_sge_write_context(adap, id, type);
+        t3_write_reg(adap, A_SG_CONTEXT_MASK0, 0xffffffff);
+        t3_write_reg(adap, A_SG_CONTEXT_MASK1, 0xffffffff);
+        t3_write_reg(adap, A_SG_CONTEXT_MASK2, 0xffffffff);
+        t3_write_reg(adap, A_SG_CONTEXT_MASK3, 0xffffffff);
+        t3_write_reg(adap, A_SG_CONTEXT_CMD,
+                     V_CONTEXT_CMD_OPCODE(1) | type | V_CONTEXT(id));
+        return t3_wait_op_done(adap, A_SG_CONTEXT_CMD, F_CONTEXT_CMD_BUSY,
+                               0, SG_CONTEXT_CMD_ATTEMPTS, 1);
 }
 
 /**
@@ -2729,10 +2760,10 @@ static void tp_config(struct adapter *adap, const struct tp_params *p)
                      F_TCPCHECKSUMOFFLOAD | V_IPTTL(64));
         t3_write_reg(adap, A_TP_TCP_OPTIONS, V_MTUDEFAULT(576) |
                      F_MTUENABLE | V_WINDOWSCALEMODE(1) |
-                     V_TIMESTAMPSMODE(0) | V_SACKMODE(1) | V_SACKRX(1));
+                     V_TIMESTAMPSMODE(1) | V_SACKMODE(1) | V_SACKRX(1));
         t3_write_reg(adap, A_TP_DACK_CONFIG, V_AUTOSTATE3(1) |
                      V_AUTOSTATE2(1) | V_AUTOSTATE1(0) |
-                     V_BYTETHRESHOLD(16384) | V_MSSTHRESHOLD(2) |
+                     V_BYTETHRESHOLD(26880) | V_MSSTHRESHOLD(2) |
                      F_AUTOCAREFUL | F_AUTOENABLE | V_DACK_MODE(1));
         t3_set_reg_field(adap, A_TP_IN_CONFIG, F_RXFBARBPRIO | F_TXFBARBPRIO,
                          F_IPV6ENABLE | F_NICMODE);
@@ -3196,20 +3227,22 @@ int t3_mps_set_active_ports(struct adapter *adap, unsigned int port_mask)
 }
 
 /*
- * Perform the bits of HW initialization that are dependent on the number
- * of available ports.
+ * Perform the bits of HW initialization that are dependent on the Tx
+ * channels being used.
  */
-static void init_hw_for_avail_ports(struct adapter *adap, int nports)
+static void chan_init_hw(struct adapter *adap, unsigned int chan_map)
 {
         int i;
 
-        if (nports == 1) {
+        if (chan_map != 3) {                                 /* one channel */
                 t3_set_reg_field(adap, A_ULPRX_CTL, F_ROUND_ROBIN, 0);
                 t3_set_reg_field(adap, A_ULPTX_CONFIG, F_CFG_RR_ARB, 0);
-                t3_write_reg(adap, A_MPS_CFG, F_TPRXPORTEN | F_TPTXPORT0EN |
-                             F_PORT0ACTIVE | F_ENFORCEPKT);
-                t3_write_reg(adap, A_PM1_TX_CFG, 0xffffffff);
-        } else {
+                t3_write_reg(adap, A_MPS_CFG, F_TPRXPORTEN | F_ENFORCEPKT |
+                             (chan_map == 1 ? F_TPTXPORT0EN | F_PORT0ACTIVE :
+                                              F_TPTXPORT1EN | F_PORT1ACTIVE));
+                t3_write_reg(adap, A_PM1_TX_CFG,
+                             chan_map == 1 ? 0xffffffff : 0);
+        } else {                                             /* two channels */
                 t3_set_reg_field(adap, A_ULPRX_CTL, 0, F_ROUND_ROBIN);
                 t3_set_reg_field(adap, A_ULPTX_CONFIG, 0, F_CFG_RR_ARB);
                 t3_write_reg(adap, A_ULPTX_DMA_WEIGHT,
@@ -3517,7 +3550,7 @@ int t3_init_hw(struct adapter *adapter, u32 fw_params)
         t3_write_reg(adapter, A_PM1_RX_CFG, 0xffffffff);
         t3_write_reg(adapter, A_PM1_RX_MODE, 0);
         t3_write_reg(adapter, A_PM1_TX_MODE, 0);
-        init_hw_for_avail_ports(adapter, adapter->params.nports);
+        chan_init_hw(adapter, adapter->params.chan_map);
         t3_sge_init(adapter, &adapter->params.sge);
 
         t3_write_reg(adapter, A_T3DBG_GPIO_ACT_LOW, calc_gpio_intr(adapter));
@@ -3754,7 +3787,8 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
         get_pci_mode(adapter, &adapter->params.pci);
 
         adapter->params.info = ai;
-        adapter->params.nports = ai->nports;
+        adapter->params.nports = ai->nports0 + ai->nports1;
+        adapter->params.chan_map = !!ai->nports0 | (!!ai->nports1 << 1);
         adapter->params.rev = t3_read_reg(adapter, A_PL_REV);
         /*
          * We used to only run the "adapter check task" once a second if
@@ -3785,7 +3819,7 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
                 mc7_prep(adapter, &adapter->pmtx, MC7_PMTX_BASE_ADDR, "PMTX");
                 mc7_prep(adapter, &adapter->cm, MC7_CM_BASE_ADDR, "CM");
 
-                p->nchan = ai->nports;
+                p->nchan = adapter->params.chan_map == 3 ? 2 : 1;
                 p->pmrx_size = t3_mc7_size(&adapter->pmrx);
                 p->pmtx_size = t3_mc7_size(&adapter->pmtx);
                 p->cm_size = t3_mc7_size(&adapter->cm);
diff --git a/drivers/net/depca.c b/drivers/net/depca.c
index 55625dbbae5a..357f565851ed 100644
--- a/drivers/net/depca.c
+++ b/drivers/net/depca.c
@@ -566,6 +566,18 @@ MODULE_LICENSE("GPL");
     outw(CSR0, DEPCA_ADDR);\
     outw(STOP, DEPCA_DATA)
 
+static const struct net_device_ops depca_netdev_ops = {
+        .ndo_open               = depca_open,
+        .ndo_start_xmit         = depca_start_xmit,
+        .ndo_stop               = depca_close,
+        .ndo_set_multicast_list = set_multicast_list,
+        .ndo_do_ioctl           = depca_ioctl,
+        .ndo_tx_timeout         = depca_tx_timeout,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 static int __init depca_hw_init (struct net_device *dev, struct device *device)
 {
         struct depca_private *lp;
@@ -793,12 +805,7 @@ static int __init depca_hw_init (struct net_device *dev, struct device *device)
         }
 
         /* The DEPCA-specific entries in the device structure. */
-        dev->open = &depca_open;
-        dev->hard_start_xmit = &depca_start_xmit;
-        dev->stop = &depca_close;
-        dev->set_multicast_list = &set_multicast_list;
-        dev->do_ioctl = &depca_ioctl;
-        dev->tx_timeout = depca_tx_timeout;
+        dev->netdev_ops = &depca_netdev_ops;
         dev->watchdog_timeo = TX_TIMEOUT;
 
         dev->mem_start = 0;
diff --git a/drivers/net/eepro.c b/drivers/net/eepro.c
index e187c88ae145..cc2ab6412c73 100644
--- a/drivers/net/eepro.c
+++ b/drivers/net/eepro.c
@@ -739,6 +739,17 @@ static void __init eepro_print_info (struct net_device *dev)
 
 static const struct ethtool_ops eepro_ethtool_ops;
 
+static const struct net_device_ops eepro_netdev_ops = {
+        .ndo_open               = eepro_open,
+        .ndo_stop               = eepro_close,
+        .ndo_start_xmit         = eepro_send_packet,
+        .ndo_set_multicast_list = set_multicast_list,
+        .ndo_tx_timeout         = eepro_tx_timeout,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 /* This is the real probe routine.  Linux has a history of friendly device
    probes on the ISA bus.  A good device probe avoids doing writes, and
    verifies that the correct device exists and functions.  */
@@ -851,11 +862,7 @@ static int __init eepro_probe1(struct net_device *dev, int autoprobe)
                 }
         }
 
-        dev->open               = eepro_open;
-        dev->stop               = eepro_close;
-        dev->hard_start_xmit    = eepro_send_packet;
-        dev->set_multicast_list = &set_multicast_list;
-        dev->tx_timeout         = eepro_tx_timeout;
+        dev->netdev_ops         = &eepro_netdev_ops;
         dev->watchdog_timeo     = TX_TIMEOUT;
         dev->ethtool_ops        = &eepro_ethtool_ops;
 
diff --git a/drivers/net/eexpress.c b/drivers/net/eexpress.c
index 9ff3f2f5e382..1686dca28748 100644
--- a/drivers/net/eexpress.c
+++ b/drivers/net/eexpress.c
@@ -1043,6 +1043,17 @@ static void eexp_hw_tx_pio(struct net_device *dev, unsigned short *buf,
         lp->last_tx = jiffies;
 }
 
+static const struct net_device_ops eexp_netdev_ops = {
+        .ndo_open               = eexp_open,
+        .ndo_stop               = eexp_close,
+        .ndo_start_xmit         = eexp_xmit,
+        .ndo_set_multicast_list = eexp_set_multicast,
+        .ndo_tx_timeout         = eexp_timeout,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 /*
  * Sanity check the suspected EtherExpress card
  * Read hardware address, reset card, size memory and initialize buffer
@@ -1163,11 +1174,7 @@ static int __init eexp_hw_probe(struct net_device *dev, unsigned short ioaddr)
         lp->rx_buf_start = TX_BUF_START + (lp->num_tx_bufs*TX_BUF_SIZE);
         lp->width = buswidth;
 
-        dev->open = eexp_open;
-        dev->stop = eexp_close;
-        dev->hard_start_xmit = eexp_xmit;
-        dev->set_multicast_list = &eexp_set_multicast;
-        dev->tx_timeout = eexp_timeout;
+        dev->netdev_ops = &eexp_netdev_ops;
         dev->watchdog_timeo = 2*HZ;
 
         return register_netdev(dev);
diff --git a/drivers/net/eth16i.c b/drivers/net/eth16i.c
index 5c048f2fd74f..0d8b6da046f2 100644
--- a/drivers/net/eth16i.c
+++ b/drivers/net/eth16i.c
@@ -475,6 +475,17 @@ out:
 }
 #endif
 
+static const struct net_device_ops eth16i_netdev_ops = {
+        .ndo_open               = eth16i_open,
+        .ndo_stop               = eth16i_close,
+        .ndo_start_xmit         = eth16i_tx,
+        .ndo_set_multicast_list = eth16i_multicast,
+        .ndo_tx_timeout         = eth16i_timeout,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 static int __init eth16i_probe1(struct net_device *dev, int ioaddr)
 {
         struct eth16i_local *lp = netdev_priv(dev);
@@ -549,12 +560,7 @@ static int __init eth16i_probe1(struct net_device *dev, int ioaddr)
         BITCLR(ioaddr + CONFIG_REG_1, POWERUP);
 
         /* Initialize the device structure */
-        memset(lp, 0, sizeof(struct eth16i_local));
-        dev->open               = eth16i_open;
-        dev->stop               = eth16i_close;
-        dev->hard_start_xmit    = eth16i_tx;
-        dev->set_multicast_list = eth16i_multicast;
-        dev->tx_timeout         = eth16i_timeout;
+        dev->netdev_ops         = &eth16i_netdev_ops;
         dev->watchdog_timeo     = TX_TIMEOUT;
         spin_lock_init(&lp->lock);
 
diff --git a/drivers/net/ethoc.c b/drivers/net/ethoc.c
new file mode 100644
index 000000000000..91a9b1a33764
--- /dev/null
+++ b/drivers/net/ethoc.c
@@ -0,0 +1,1112 @@
+/*
+ * linux/drivers/net/ethoc.c
+ *
+ * Copyright (C) 2007-2008 Avionic Design Development GmbH
+ * Copyright (C) 2008-2009 Avionic Design GmbH
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Written by Thierry Reding <thierry.reding@avionic-design.de>
+ */
+
+#include <linux/etherdevice.h>
+#include <linux/crc32.h>
+#include <linux/io.h>
+#include <linux/mii.h>
+#include <linux/phy.h>
+#include <linux/platform_device.h>
+#include <net/ethoc.h>
+
+/* register offsets */
+#define MODER           0x00
+#define INT_SOURCE      0x04
+#define INT_MASK        0x08
+#define IPGT            0x0c
+#define IPGR1           0x10
+#define IPGR2           0x14
+#define PACKETLEN       0x18
+#define COLLCONF        0x1c
+#define TX_BD_NUM       0x20
+#define CTRLMODER       0x24
+#define MIIMODER        0x28
+#define MIICOMMAND      0x2c
+#define MIIADDRESS      0x30
+#define MIITX_DATA      0x34
+#define MIIRX_DATA      0x38
+#define MIISTATUS       0x3c
+#define MAC_ADDR0       0x40
+#define MAC_ADDR1       0x44
+#define ETH_HASH0       0x48
+#define ETH_HASH1       0x4c
+#define ETH_TXCTRL      0x50
+
+/* mode register */
+#define MODER_RXEN      (1 <<  0) /* receive enable */
+#define MODER_TXEN      (1 <<  1) /* transmit enable */
+#define MODER_NOPRE     (1 <<  2) /* no preamble */
+#define MODER_BRO       (1 <<  3) /* broadcast address */
+#define MODER_IAM       (1 <<  4) /* individual address mode */
+#define MODER_PRO       (1 <<  5) /* promiscuous mode */
+#define MODER_IFG       (1 <<  6) /* interframe gap for incoming frames */
+#define MODER_LOOP      (1 <<  7) /* loopback */
+#define MODER_NBO       (1 <<  8) /* no back-off */
+#define MODER_EDE       (1 <<  9) /* excess defer enable */
+#define MODER_FULLD     (1 << 10) /* full duplex */
+#define MODER_RESET     (1 << 11) /* FIXME: reset (undocumented) */
+#define MODER_DCRC      (1 << 12) /* delayed CRC enable */
+#define MODER_CRC       (1 << 13) /* CRC enable */
+#define MODER_HUGE      (1 << 14) /* huge packets enable */
+#define MODER_PAD       (1 << 15) /* padding enabled */
+#define MODER_RSM       (1 << 16) /* receive small packets */
+
+/* interrupt source and mask registers */
+#define INT_MASK_TXF    (1 << 0) /* transmit frame */
+#define INT_MASK_TXE    (1 << 1) /* transmit error */
+#define INT_MASK_RXF    (1 << 2) /* receive frame */
+#define INT_MASK_RXE    (1 << 3) /* receive error */
+#define INT_MASK_BUSY   (1 << 4)
+#define INT_MASK_TXC    (1 << 5) /* transmit control frame */
+#define INT_MASK_RXC    (1 << 6) /* receive control frame */
+
+#define INT_MASK_TX     (INT_MASK_TXF | INT_MASK_TXE)
+#define INT_MASK_RX     (INT_MASK_RXF | INT_MASK_RXE)
+
+#define INT_MASK_ALL ( \
+                INT_MASK_TXF | INT_MASK_TXE | \
+                INT_MASK_RXF | INT_MASK_RXE | \
+                INT_MASK_TXC | INT_MASK_RXC | \
+                INT_MASK_BUSY \
+        )
+
+/* packet length register */
+#define PACKETLEN_MIN(min)              (((min) & 0xffff) << 16)
+#define PACKETLEN_MAX(max)              (((max) & 0xffff) <<  0)
+#define PACKETLEN_MIN_MAX(min, max)     (PACKETLEN_MIN(min) | \
+                                        PACKETLEN_MAX(max))
+
+/* transmit buffer number register */
+#define TX_BD_NUM_VAL(x)        (((x) <= 0x80) ? (x) : 0x80)
+
+/* control module mode register */
+#define CTRLMODER_PASSALL       (1 << 0) /* pass all receive frames */
+#define CTRLMODER_RXFLOW        (1 << 1) /* receive control flow */
+#define CTRLMODER_TXFLOW        (1 << 2) /* transmit control flow */
+
+/* MII mode register */
+#define MIIMODER_CLKDIV(x)      ((x) & 0xfe) /* needs to be an even number */
+#define MIIMODER_NOPRE          (1 << 8) /* no preamble */
+
+/* MII command register */
+#define MIICOMMAND_SCAN         (1 << 0) /* scan status */
+#define MIICOMMAND_READ         (1 << 1) /* read status */
+#define MIICOMMAND_WRITE        (1 << 2) /* write control data */
+
+/* MII address register */
+#define MIIADDRESS_FIAD(x)              (((x) & 0x1f) << 0)
+#define MIIADDRESS_RGAD(x)              (((x) & 0x1f) << 8)
+#define MIIADDRESS_ADDR(phy, reg)       (MIIADDRESS_FIAD(phy) | \
+                                        MIIADDRESS_RGAD(reg))
+
+/* MII transmit data register */
+#define MIITX_DATA_VAL(x)       ((x) & 0xffff)
+
+/* MII receive data register */
+#define MIIRX_DATA_VAL(x)       ((x) & 0xffff)
+
+/* MII status register */
+#define MIISTATUS_LINKFAIL      (1 << 0)
+#define MIISTATUS_BUSY          (1 << 1)
+#define MIISTATUS_INVALID       (1 << 2)
+
+/* TX buffer descriptor */
+#define TX_BD_CS                (1 <<  0) /* carrier sense lost */
+#define TX_BD_DF                (1 <<  1) /* defer indication */
+#define TX_BD_LC                (1 <<  2) /* late collision */
+#define TX_BD_RL                (1 <<  3) /* retransmission limit */
+#define TX_BD_RETRY_MASK        (0x00f0)
+#define TX_BD_RETRY(x)          (((x) & 0x00f0) >>  4)
+#define TX_BD_UR                (1 <<  8) /* transmitter underrun */
+#define TX_BD_CRC               (1 << 11) /* TX CRC enable */
+#define TX_BD_PAD               (1 << 12) /* pad enable for short packets */
+#define TX_BD_WRAP              (1 << 13)
+#define TX_BD_IRQ               (1 << 14) /* interrupt request enable */
+#define TX_BD_READY             (1 << 15) /* TX buffer ready */
+#define TX_BD_LEN(x)            (((x) & 0xffff) << 16)
+#define TX_BD_LEN_MASK          (0xffff << 16)
+
+#define TX_BD_STATS             (TX_BD_CS | TX_BD_DF | TX_BD_LC | \
+                                TX_BD_RL | TX_BD_RETRY_MASK | TX_BD_UR)
+
+/* RX buffer descriptor */
+#define RX_BD_LC        (1 <<  0) /* late collision */
+#define RX_BD_CRC       (1 <<  1) /* RX CRC error */
+#define RX_BD_SF        (1 <<  2) /* short frame */
+#define RX_BD_TL        (1 <<  3) /* too long */
+#define RX_BD_DN        (1 <<  4) /* dribble nibble */
+#define RX_BD_IS        (1 <<  5) /* invalid symbol */
+#define RX_BD_OR        (1 <<  6) /* receiver overrun */
+#define RX_BD_MISS      (1 <<  7)
+#define RX_BD_CF        (1 <<  8) /* control frame */
+#define RX_BD_WRAP      (1 << 13)
+#define RX_BD_IRQ       (1 << 14) /* interrupt request enable */
+#define RX_BD_EMPTY     (1 << 15)
+#define RX_BD_LEN(x)    (((x) & 0xffff) << 16)
+
+#define RX_BD_STATS     (RX_BD_LC | RX_BD_CRC | RX_BD_SF | RX_BD_TL | \
+                        RX_BD_DN | RX_BD_IS | RX_BD_OR | RX_BD_MISS)
+
+#define ETHOC_BUFSIZ            1536
+#define ETHOC_ZLEN              64
+#define ETHOC_BD_BASE           0x400
+#define ETHOC_TIMEOUT           (HZ / 2)
+#define ETHOC_MII_TIMEOUT       (1 + (HZ / 5))
+
+/**
+ * struct ethoc - driver-private device structure
+ * @iobase:     pointer to I/O memory region
+ * @membase:    pointer to buffer memory region
+ * @num_tx:     number of send buffers
+ * @cur_tx:     last send buffer written
+ * @dty_tx:     last buffer actually sent
+ * @num_rx:     number of receive buffers
+ * @cur_rx:     current receive buffer
+ * @netdev:     pointer to network device structure
+ * @napi:       NAPI structure
+ * @stats:      network device statistics
+ * @msg_enable: device state flags
+ * @rx_lock:    receive lock
+ * @lock:       device lock
+ * @phy:        attached PHY
+ * @mdio:       MDIO bus for PHY access
+ * @phy_id:     address of attached PHY
+ */
+struct ethoc {
+        void __iomem *iobase;
+        void __iomem *membase;
+
+        unsigned int num_tx;
+        unsigned int cur_tx;
+        unsigned int dty_tx;
+
+        unsigned int num_rx;
+        unsigned int cur_rx;
+
+        struct net_device *netdev;
+        struct napi_struct napi;
+        struct net_device_stats stats;
+        u32 msg_enable;
+
+        spinlock_t rx_lock;
+        spinlock_t lock;
+
+        struct phy_device *phy;
+        struct mii_bus *mdio;
+        s8 phy_id;
+};
+
+/**
+ * struct ethoc_bd - buffer descriptor
+ * @stat:       buffer statistics
+ * @addr:       physical memory address
+ */
+struct ethoc_bd {
+        u32 stat;
+        u32 addr;
+};
+
+static u32 ethoc_read(struct ethoc *dev, loff_t offset)
+{
+        return ioread32(dev->iobase + offset);
+}
+
+static void ethoc_write(struct ethoc *dev, loff_t offset, u32 data)
+{
+        iowrite32(data, dev->iobase + offset);
+}
+
+static void ethoc_read_bd(struct ethoc *dev, int index, struct ethoc_bd *bd)
+{
+        loff_t offset = ETHOC_BD_BASE + (index * sizeof(struct ethoc_bd));
+        bd->stat = ethoc_read(dev, offset + 0);
+        bd->addr = ethoc_read(dev, offset + 4);
+}
+
+static void ethoc_write_bd(struct ethoc *dev, int index,
+                const struct ethoc_bd *bd)
+{
+        loff_t offset = ETHOC_BD_BASE + (index * sizeof(struct ethoc_bd));
+        ethoc_write(dev, offset + 0, bd->stat);
+        ethoc_write(dev, offset + 4, bd->addr);
+}
+
+static void ethoc_enable_irq(struct ethoc *dev, u32 mask)
+{
+        u32 imask = ethoc_read(dev, INT_MASK);
+        imask |= mask;
+        ethoc_write(dev, INT_MASK, imask);
+}
+
+static void ethoc_disable_irq(struct ethoc *dev, u32 mask)
+{
+        u32 imask = ethoc_read(dev, INT_MASK);
+        imask &= ~mask;
+        ethoc_write(dev, INT_MASK, imask);
+}
+
+static void ethoc_ack_irq(struct ethoc *dev, u32 mask)
+{
+        ethoc_write(dev, INT_SOURCE, mask);
+}
+
+static void ethoc_enable_rx_and_tx(struct ethoc *dev)
+{
+        u32 mode = ethoc_read(dev, MODER);
+        mode |= MODER_RXEN | MODER_TXEN;
+        ethoc_write(dev, MODER, mode);
+}
+
+static void ethoc_disable_rx_and_tx(struct ethoc *dev)
+{
+        u32 mode = ethoc_read(dev, MODER);
+        mode &= ~(MODER_RXEN | MODER_TXEN);
+        ethoc_write(dev, MODER, mode);
+}
+
+static int ethoc_init_ring(struct ethoc *dev)
+{
+        struct ethoc_bd bd;
+        int i;
+
+        dev->cur_tx = 0;
+        dev->dty_tx = 0;
+        dev->cur_rx = 0;
+
+        /* setup transmission buffers */
+        bd.addr = 0;
+        bd.stat = TX_BD_IRQ | TX_BD_CRC;
+
+        for (i = 0; i < dev->num_tx; i++) {
+                if (i == dev->num_tx - 1)
+                        bd.stat |= TX_BD_WRAP;
+
+                ethoc_write_bd(dev, i, &bd);
+                bd.addr += ETHOC_BUFSIZ;
+        }
+
+        bd.addr = dev->num_tx * ETHOC_BUFSIZ;
+        bd.stat = RX_BD_EMPTY | RX_BD_IRQ;
+
+        for (i = 0; i < dev->num_rx; i++) {
+                if (i == dev->num_rx - 1)
+                        bd.stat |= RX_BD_WRAP;
+
+                ethoc_write_bd(dev, dev->num_tx + i, &bd);
+                bd.addr += ETHOC_BUFSIZ;
+        }
+
+        return 0;
+}
+
+static int ethoc_reset(struct ethoc *dev)
+{
+        u32 mode;
+
+        /* TODO: reset controller? */
+
+        ethoc_disable_rx_and_tx(dev);
+
+        /* TODO: setup registers */
+
+        /* enable FCS generation and automatic padding */
+        mode = ethoc_read(dev, MODER);
+        mode |= MODER_CRC | MODER_PAD;
+        ethoc_write(dev, MODER, mode);
+
+        /* set full-duplex mode */
+        mode = ethoc_read(dev, MODER);
+        mode |= MODER_FULLD;
+        ethoc_write(dev, MODER, mode);
+        ethoc_write(dev, IPGT, 0x15);
+
+        ethoc_ack_irq(dev, INT_MASK_ALL);
+        ethoc_enable_irq(dev, INT_MASK_ALL);
+        ethoc_enable_rx_and_tx(dev);
+        return 0;
+}
+
+static unsigned int ethoc_update_rx_stats(struct ethoc *dev,
+                struct ethoc_bd *bd)
+{
+        struct net_device *netdev = dev->netdev;
+        unsigned int ret = 0;
+
+        if (bd->stat & RX_BD_TL) {
+                dev_err(&netdev->dev, "RX: frame too long\n");
+                dev->stats.rx_length_errors++;
+                ret++;
+        }
+
+        if (bd->stat & RX_BD_SF) {
+                dev_err(&netdev->dev, "RX: frame too short\n");
+                dev->stats.rx_length_errors++;
+                ret++;
+        }
+
+        if (bd->stat & RX_BD_DN) {
+                dev_err(&netdev->dev, "RX: dribble nibble\n");
+                dev->stats.rx_frame_errors++;
+        }
+
+        if (bd->stat & RX_BD_CRC) {
+                dev_err(&netdev->dev, "RX: wrong CRC\n");
+                dev->stats.rx_crc_errors++;
+                ret++;
+        }
+
+        if (bd->stat & RX_BD_OR) {
+                dev_err(&netdev->dev, "RX: overrun\n");
+                dev->stats.rx_over_errors++;
+                ret++;
+        }
+
+        if (bd->stat & RX_BD_MISS)
+                dev->stats.rx_missed_errors++;
+
+        if (bd->stat & RX_BD_LC) {
+                dev_err(&netdev->dev, "RX: late collision\n");
+                dev->stats.collisions++;
+                ret++;
+        }
+
+        return ret;
+}
+
+static int ethoc_rx(struct net_device *dev, int limit)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        int count;
+
+        for (count = 0; count < limit; ++count) {
+                unsigned int entry;
+                struct ethoc_bd bd;
+
+                entry = priv->num_tx + (priv->cur_rx % priv->num_rx);
+                ethoc_read_bd(priv, entry, &bd);
+                if (bd.stat & RX_BD_EMPTY)
+                        break;
+
+                if (ethoc_update_rx_stats(priv, &bd) == 0) {
+                        int size = bd.stat >> 16;
+                        struct sk_buff *skb = netdev_alloc_skb(dev, size);
+                        if (likely(skb)) {
+                                void *src = priv->membase + bd.addr;
+                                memcpy_fromio(skb_put(skb, size), src, size);
+                                skb->protocol = eth_type_trans(skb, dev);
+                                dev->last_rx = jiffies;
+                                priv->stats.rx_packets++;
+                                priv->stats.rx_bytes += size;
+                                netif_receive_skb(skb);
+                        } else {
+                                if (net_ratelimit())
+                                        dev_warn(&dev->dev, "low on memory - "
+                                                        "packet dropped\n");
+
+                                priv->stats.rx_dropped++;
+                                break;
+                        }
+                }
+
+                /* clear the buffer descriptor so it can be reused */
+                bd.stat &= ~RX_BD_STATS;
+                bd.stat |=  RX_BD_EMPTY;
+                ethoc_write_bd(priv, entry, &bd);
+                priv->cur_rx++;
+        }
+
+        return count;
+}
+
+static int ethoc_update_tx_stats(struct ethoc *dev, struct ethoc_bd *bd)
+{
+        struct net_device *netdev = dev->netdev;
+
+        if (bd->stat & TX_BD_LC) {
+                dev_err(&netdev->dev, "TX: late collision\n");
+                dev->stats.tx_window_errors++;
+        }
+
+        if (bd->stat & TX_BD_RL) {
+                dev_err(&netdev->dev, "TX: retransmit limit\n");
+                dev->stats.tx_aborted_errors++;
+        }
+
+        if (bd->stat & TX_BD_UR) {
+                dev_err(&netdev->dev, "TX: underrun\n");
+                dev->stats.tx_fifo_errors++;
+        }
+
+        if (bd->stat & TX_BD_CS) {
+                dev_err(&netdev->dev, "TX: carrier sense lost\n");
+                dev->stats.tx_carrier_errors++;
+        }
+
+        if (bd->stat & TX_BD_STATS)
+                dev->stats.tx_errors++;
+
+        dev->stats.collisions += (bd->stat >> 4) & 0xf;
+        dev->stats.tx_bytes += bd->stat >> 16;
+        dev->stats.tx_packets++;
+        return 0;
+}
+
+static void ethoc_tx(struct net_device *dev)
+{
+        struct ethoc *priv = netdev_priv(dev);
+
+        spin_lock(&priv->lock);
+
+        while (priv->dty_tx != priv->cur_tx) {
+                unsigned int entry = priv->dty_tx % priv->num_tx;
+                struct ethoc_bd bd;
+
+                ethoc_read_bd(priv, entry, &bd);
+                if (bd.stat & TX_BD_READY)
+                        break;
+
+                entry = (++priv->dty_tx) % priv->num_tx;
+                (void)ethoc_update_tx_stats(priv, &bd);
+        }
+
+        if ((priv->cur_tx - priv->dty_tx) <= (priv->num_tx / 2))
+                netif_wake_queue(dev);
+
+        ethoc_ack_irq(priv, INT_MASK_TX);
+        spin_unlock(&priv->lock);
+}
+
+static irqreturn_t ethoc_interrupt(int irq, void *dev_id)
+{
+        struct net_device *dev = (struct net_device *)dev_id;
+        struct ethoc *priv = netdev_priv(dev);
+        u32 pending;
+
+        ethoc_disable_irq(priv, INT_MASK_ALL);
+        pending = ethoc_read(priv, INT_SOURCE);
+        if (unlikely(pending == 0)) {
+                ethoc_enable_irq(priv, INT_MASK_ALL);
+                return IRQ_NONE;
+        }
+
+        ethoc_ack_irq(priv, INT_MASK_ALL);
+
+        if (pending & INT_MASK_BUSY) {
+                dev_err(&dev->dev, "packet dropped\n");
+                priv->stats.rx_dropped++;
+        }
+
+        if (pending & INT_MASK_RX) {
+                if (napi_schedule_prep(&priv->napi))
+                        __napi_schedule(&priv->napi);
+        } else {
+                ethoc_enable_irq(priv, INT_MASK_RX);
+        }
+
+        if (pending & INT_MASK_TX)
+                ethoc_tx(dev);
+
+        ethoc_enable_irq(priv, INT_MASK_ALL & ~INT_MASK_RX);
+        return IRQ_HANDLED;
+}
+
+static int ethoc_get_mac_address(struct net_device *dev, void *addr)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        u8 *mac = (u8 *)addr;
+        u32 reg;
+
+        reg = ethoc_read(priv, MAC_ADDR0);
+        mac[2] = (reg >> 24) & 0xff;
+        mac[3] = (reg >> 16) & 0xff;
+        mac[4] = (reg >>  8) & 0xff;
+        mac[5] = (reg >>  0) & 0xff;
+
+        reg = ethoc_read(priv, MAC_ADDR1);
+        mac[0] = (reg >>  8) & 0xff;
+        mac[1] = (reg >>  0) & 0xff;
+
+        return 0;
+}
+
+static int ethoc_poll(struct napi_struct *napi, int budget)
+{
+        struct ethoc *priv = container_of(napi, struct ethoc, napi);
+        int work_done = 0;
+
+        work_done = ethoc_rx(priv->netdev, budget);
+        if (work_done < budget) {
+                ethoc_enable_irq(priv, INT_MASK_RX);
+                napi_complete(napi);
+        }
+
+        return work_done;
+}
+
+static int ethoc_mdio_read(struct mii_bus *bus, int phy, int reg)
+{
+        unsigned long timeout = jiffies + ETHOC_MII_TIMEOUT;
+        struct ethoc *priv = bus->priv;
+
+        ethoc_write(priv, MIIADDRESS, MIIADDRESS_ADDR(phy, reg));
+        ethoc_write(priv, MIICOMMAND, MIICOMMAND_READ);
+
+        while (time_before(jiffies, timeout)) {
+                u32 status = ethoc_read(priv, MIISTATUS);
+                if (!(status & MIISTATUS_BUSY)) {
+                        u32 data = ethoc_read(priv, MIIRX_DATA);
+                        /* reset MII command register */
+                        ethoc_write(priv, MIICOMMAND, 0);
+                        return data;
+                }
+
+                schedule();
+        }
+
+        return -EBUSY;
+}
+
+static int ethoc_mdio_write(struct mii_bus *bus, int phy, int reg, u16 val)
+{
+        unsigned long timeout = jiffies + ETHOC_MII_TIMEOUT;
+        struct ethoc *priv = bus->priv;
+
+        ethoc_write(priv, MIIADDRESS, MIIADDRESS_ADDR(phy, reg));
+        ethoc_write(priv, MIITX_DATA, val);
+        ethoc_write(priv, MIICOMMAND, MIICOMMAND_WRITE);
+
+        while (time_before(jiffies, timeout)) {
+                u32 stat = ethoc_read(priv, MIISTATUS);
+                if (!(stat & MIISTATUS_BUSY))
+                        return 0;
+
+                schedule();
+        }
+
+        return -EBUSY;
+}
+
+static int ethoc_mdio_reset(struct mii_bus *bus)
+{
+        return 0;
+}
+
+static void ethoc_mdio_poll(struct net_device *dev)
+{
+}
+
+static int ethoc_mdio_probe(struct net_device *dev)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        struct phy_device *phy;
+        int i;
+
+        for (i = 0; i < PHY_MAX_ADDR; i++) {
+                phy = priv->mdio->phy_map[i];
+                if (phy) {
+                        if (priv->phy_id != -1) {
+                                /* attach to specified PHY */
+                                if (priv->phy_id == phy->addr)
+                                        break;
+                        } else {
+                                /* autoselect PHY if none was specified */
+                                if (phy->addr != 0)
+                                        break;
+                        }
+                }
+        }
+
+        if (!phy) {
+                dev_err(&dev->dev, "no PHY found\n");
+                return -ENXIO;
+        }
+
+        phy = phy_connect(dev, dev_name(&phy->dev), &ethoc_mdio_poll, 0,
+                        PHY_INTERFACE_MODE_GMII);
+        if (IS_ERR(phy)) {
+                dev_err(&dev->dev, "could not attach to PHY\n");
+                return PTR_ERR(phy);
+        }
+
+        priv->phy = phy;
+        return 0;
+}
+
+static int ethoc_open(struct net_device *dev)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        unsigned int min_tx = 2;
+        unsigned int num_bd;
+        int ret;
+
+        ret = request_irq(dev->irq, ethoc_interrupt, IRQF_SHARED,
+                        dev->name, dev);
+        if (ret)
+                return ret;
+
+        /* calculate the number of TX/RX buffers */
+        num_bd = (dev->mem_end - dev->mem_start + 1) / ETHOC_BUFSIZ;
+        priv->num_tx = min(min_tx, num_bd / 4);
+        priv->num_rx = num_bd - priv->num_tx;
+        ethoc_write(priv, TX_BD_NUM, priv->num_tx);
+
+        ethoc_init_ring(priv);
+        ethoc_reset(priv);
+
+        if (netif_queue_stopped(dev)) {
+                dev_dbg(&dev->dev, " resuming queue\n");
+                netif_wake_queue(dev);
+        } else {
+                dev_dbg(&dev->dev, " starting queue\n");
+                netif_start_queue(dev);
+        }
+
+        phy_start(priv->phy);
+        napi_enable(&priv->napi);
+
+        if (netif_msg_ifup(priv)) {
+                dev_info(&dev->dev, "I/O: %08lx Memory: %08lx-%08lx\n",
+                                dev->base_addr, dev->mem_start, dev->mem_end);
+        }
+
+        return 0;
+}
+
+static int ethoc_stop(struct net_device *dev)
+{
+        struct ethoc *priv = netdev_priv(dev);
+
+        napi_disable(&priv->napi);
+
+        if (priv->phy)
+                phy_stop(priv->phy);
+
+        ethoc_disable_rx_and_tx(priv);
+        free_irq(dev->irq, dev);
+
+        if (!netif_queue_stopped(dev))
+                netif_stop_queue(dev);
+
+        return 0;
+}
+
+static int ethoc_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        struct mii_ioctl_data *mdio = if_mii(ifr);
+        struct phy_device *phy = NULL;
+
+        if (!netif_running(dev))
+                return -EINVAL;
+
+        if (cmd != SIOCGMIIPHY) {
+                if (mdio->phy_id >= PHY_MAX_ADDR)
+                        return -ERANGE;
+
+                phy = priv->mdio->phy_map[mdio->phy_id];
+                if (!phy)
+                        return -ENODEV;
+        } else {
+                phy = priv->phy;
+        }
+
+        return phy_mii_ioctl(phy, mdio, cmd);
+}
+
+static int ethoc_config(struct net_device *dev, struct ifmap *map)
+{
+        return -ENOSYS;
+}
+
+static int ethoc_set_mac_address(struct net_device *dev, void *addr)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        u8 *mac = (u8 *)addr;
+
+        ethoc_write(priv, MAC_ADDR0, (mac[2] << 24) | (mac[3] << 16) |
+                                     (mac[4] <<  8) | (mac[5] <<  0));
+        ethoc_write(priv, MAC_ADDR1, (mac[0] <<  8) | (mac[1] <<  0));
+
+        return 0;
+}
+
+static void ethoc_set_multicast_list(struct net_device *dev)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        u32 mode = ethoc_read(priv, MODER);
+        struct dev_mc_list *mc = NULL;
+        u32 hash[2] = { 0, 0 };
+
+        /* set loopback mode if requested */
+        if (dev->flags & IFF_LOOPBACK)
+                mode |=  MODER_LOOP;
+        else
+                mode &= ~MODER_LOOP;
+
+        /* receive broadcast frames if requested */
+        if (dev->flags & IFF_BROADCAST)
+                mode &= ~MODER_BRO;
+        else
+                mode |=  MODER_BRO;
+
+        /* enable promiscuous mode if requested */
+        if (dev->flags & IFF_PROMISC)
+                mode |=  MODER_PRO;
+        else
+                mode &= ~MODER_PRO;
+
+        ethoc_write(priv, MODER, mode);
+
+        /* receive multicast frames */
+        if (dev->flags & IFF_ALLMULTI) {
+                hash[0] = 0xffffffff;
+                hash[1] = 0xffffffff;
+        } else {
+                for (mc = dev->mc_list; mc; mc = mc->next) {
+                        u32 crc = ether_crc(mc->dmi_addrlen, mc->dmi_addr);
+                        int bit = (crc >> 26) & 0x3f;
+                        hash[bit >> 5] |= 1 << (bit & 0x1f);
+                }
+        }
+
+        ethoc_write(priv, ETH_HASH0, hash[0]);
+        ethoc_write(priv, ETH_HASH1, hash[1]);
+}
+
+static int ethoc_change_mtu(struct net_device *dev, int new_mtu)
+{
+        return -ENOSYS;
+}
+
+static void ethoc_tx_timeout(struct net_device *dev)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        u32 pending = ethoc_read(priv, INT_SOURCE);
+        if (likely(pending))
+                ethoc_interrupt(dev->irq, dev);
+}
+
+static struct net_device_stats *ethoc_stats(struct net_device *dev)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        return &priv->stats;
+}
+
+static int ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        struct ethoc_bd bd;
+        unsigned int entry;
+        void *dest;
+
+        if (unlikely(skb->len > ETHOC_BUFSIZ)) {
+                priv->stats.tx_errors++;
+                return -EMSGSIZE;
+        }
+
+        entry = priv->cur_tx % priv->num_tx;
+        spin_lock_irq(&priv->lock);
+        priv->cur_tx++;
+
+        ethoc_read_bd(priv, entry, &bd);
+        if (unlikely(skb->len < ETHOC_ZLEN))
+                bd.stat |=  TX_BD_PAD;
+        else
+                bd.stat &= ~TX_BD_PAD;
+
+        dest = priv->membase + bd.addr;
+        memcpy_toio(dest, skb->data, skb->len);
+
+        bd.stat &= ~(TX_BD_STATS | TX_BD_LEN_MASK);
+        bd.stat |= TX_BD_LEN(skb->len);
+        ethoc_write_bd(priv, entry, &bd);
+
+        bd.stat |= TX_BD_READY;
+        ethoc_write_bd(priv, entry, &bd);
+
+        if (priv->cur_tx == (priv->dty_tx + priv->num_tx)) {
+                dev_dbg(&dev->dev, "stopping queue\n");
+                netif_stop_queue(dev);
+        }
+
+        dev->trans_start = jiffies;
+        dev_kfree_skb(skb);
+
+        spin_unlock_irq(&priv->lock);
+        return NETDEV_TX_OK;
+}
+
+static const struct net_device_ops ethoc_netdev_ops = {
+        .ndo_open = ethoc_open,
+        .ndo_stop = ethoc_stop,
+        .ndo_do_ioctl = ethoc_ioctl,
+        .ndo_set_config = ethoc_config,
+        .ndo_set_mac_address = ethoc_set_mac_address,
+        .ndo_set_multicast_list = ethoc_set_multicast_list,
+        .ndo_change_mtu = ethoc_change_mtu,
+        .ndo_tx_timeout = ethoc_tx_timeout,
+        .ndo_get_stats = ethoc_stats,
+        .ndo_start_xmit = ethoc_start_xmit,
+};
+
+/**
+ * ethoc_probe() - initialize OpenCores ethernet MAC
+ * pdev:        platform device
+ */
+static int ethoc_probe(struct platform_device *pdev)
+{
+        struct net_device *netdev = NULL;
+        struct resource *res = NULL;
+        struct resource *mmio = NULL;
+        struct resource *mem = NULL;
+        struct ethoc *priv = NULL;
+        unsigned int phy;
+        int ret = 0;
+
+        /* allocate networking device */
+        netdev = alloc_etherdev(sizeof(struct ethoc));
+        if (!netdev) {
+                dev_err(&pdev->dev, "cannot allocate network device\n");
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        SET_NETDEV_DEV(netdev, &pdev->dev);
+        platform_set_drvdata(pdev, netdev);
+
+        /* obtain I/O memory space */
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "cannot obtain I/O memory space\n");
+                ret = -ENXIO;
+                goto free;
+        }
+
+        mmio = devm_request_mem_region(&pdev->dev, res->start,
+                        res->end - res->start + 1, res->name);
+        if (!res) {
+                dev_err(&pdev->dev, "cannot request I/O memory space\n");
+                ret = -ENXIO;
+                goto free;
+        }
+
+        netdev->base_addr = mmio->start;
+
+        /* obtain buffer memory space */
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        if (!res) {
+                dev_err(&pdev->dev, "cannot obtain memory space\n");
+                ret = -ENXIO;
+                goto free;
+        }
+
+        mem = devm_request_mem_region(&pdev->dev, res->start,
+                        res->end - res->start + 1, res->name);
+        if (!mem) {
+                dev_err(&pdev->dev, "cannot request memory space\n");
+                ret = -ENXIO;
+                goto free;
+        }
+
+        netdev->mem_start = mem->start;
+        netdev->mem_end   = mem->end;
+
+        /* obtain device IRQ number */
+        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "cannot obtain IRQ\n");
+                ret = -ENXIO;
+                goto free;
+        }
+
+        netdev->irq = res->start;
+
+        /* setup driver-private data */
+        priv = netdev_priv(netdev);
+        priv->netdev = netdev;
+
+        priv->iobase = devm_ioremap_nocache(&pdev->dev, netdev->base_addr,
+                        mmio->end - mmio->start + 1);
+        if (!priv->iobase) {
+                dev_err(&pdev->dev, "cannot remap I/O memory space\n");
+                ret = -ENXIO;
+                goto error;
+        }
+
+        priv->membase = devm_ioremap_nocache(&pdev->dev, netdev->mem_start,
+                        mem->end - mem->start + 1);
+        if (!priv->membase) {
+                dev_err(&pdev->dev, "cannot remap memory space\n");
+                ret = -ENXIO;
+                goto error;
+        }
+
+        /* Allow the platform setup code to pass in a MAC address. */
+        if (pdev->dev.platform_data) {
+                struct ethoc_platform_data *pdata =
+                        (struct ethoc_platform_data *)pdev->dev.platform_data;
+                memcpy(netdev->dev_addr, pdata->hwaddr, IFHWADDRLEN);
+                priv->phy_id = pdata->phy_id;
+        }
+
+        /* Check that the given MAC address is valid. If it isn't, read the
+         * current MAC from the controller. */
+        if (!is_valid_ether_addr(netdev->dev_addr))
+                ethoc_get_mac_address(netdev, netdev->dev_addr);
+
+        /* Check the MAC again for validity, if it still isn't choose and
+         * program a random one. */
+        if (!is_valid_ether_addr(netdev->dev_addr))
+                random_ether_addr(netdev->dev_addr);
+
+        ethoc_set_mac_address(netdev, netdev->dev_addr);
+
+        /* register MII bus */
+        priv->mdio = mdiobus_alloc();
+        if (!priv->mdio) {
+                ret = -ENOMEM;
+                goto free;
+        }
+
+        priv->mdio->name = "ethoc-mdio";
+        snprintf(priv->mdio->id, MII_BUS_ID_SIZE, "%s-%d",
+                        priv->mdio->name, pdev->id);
+        priv->mdio->read = ethoc_mdio_read;
+        priv->mdio->write = ethoc_mdio_write;
+        priv->mdio->reset = ethoc_mdio_reset;
+        priv->mdio->priv = priv;
+
+        priv->mdio->irq = kmalloc(sizeof(int) * PHY_MAX_ADDR, GFP_KERNEL);
+        if (!priv->mdio->irq) {
+                ret = -ENOMEM;
+                goto free_mdio;
+        }
+
+        for (phy = 0; phy < PHY_MAX_ADDR; phy++)
+                priv->mdio->irq[phy] = PHY_POLL;
+
+        ret = mdiobus_register(priv->mdio);
+        if (ret) {
+                dev_err(&netdev->dev, "failed to register MDIO bus\n");
+                goto free_mdio;
+        }
+
+        ret = ethoc_mdio_probe(netdev);
+        if (ret) {
+                dev_err(&netdev->dev, "failed to probe MDIO bus\n");
+                goto error;
+        }
+
+        ether_setup(netdev);
+
+        /* setup the net_device structure */
+        netdev->netdev_ops = &ethoc_netdev_ops;
+        netdev->watchdog_timeo = ETHOC_TIMEOUT;
+        netdev->features |= 0;
+
+        /* setup NAPI */
+        memset(&priv->napi, 0, sizeof(priv->napi));
+        netif_napi_add(netdev, &priv->napi, ethoc_poll, 64);
+
+        spin_lock_init(&priv->rx_lock);
+        spin_lock_init(&priv->lock);
+
+        ret = register_netdev(netdev);
+        if (ret < 0) {
+                dev_err(&netdev->dev, "failed to register interface\n");
+                goto error;
+        }
+
+        goto out;
+
+error:
+        mdiobus_unregister(priv->mdio);
+free_mdio:
+        kfree(priv->mdio->irq);
+        mdiobus_free(priv->mdio);
+free:
+        free_netdev(netdev);
+out:
+        return ret;
+}
+
+/**
+ * ethoc_remove() - shutdown OpenCores ethernet MAC
+ * @pdev:       platform device
+ */
+static int ethoc_remove(struct platform_device *pdev)
+{
+        struct net_device *netdev = platform_get_drvdata(pdev);
+        struct ethoc *priv = netdev_priv(netdev);
+
+        platform_set_drvdata(pdev, NULL);
+
+        if (netdev) {
+                phy_disconnect(priv->phy);
+                priv->phy = NULL;
+
+                if (priv->mdio) {
+                        mdiobus_unregister(priv->mdio);
+                        kfree(priv->mdio->irq);
+                        mdiobus_free(priv->mdio);
+                }
+
+                unregister_netdev(netdev);
+                free_netdev(netdev);
+        }
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int ethoc_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        return -ENOSYS;
+}
+
+static int ethoc_resume(struct platform_device *pdev)
+{
+        return -ENOSYS;
+}
+#else
+# define ethoc_suspend NULL
+# define ethoc_resume  NULL
+#endif
+
+static struct platform_driver ethoc_driver = {
+        .probe   = ethoc_probe,
+        .remove  = ethoc_remove,
+        .suspend = ethoc_suspend,
+        .resume  = ethoc_resume,
+        .driver  = {
+                .name = "ethoc",
+        },
+};
+
+static int __init ethoc_init(void)
+{
+        return platform_driver_register(&ethoc_driver);
+}
+
+static void __exit ethoc_exit(void)
+{
+        platform_driver_unregister(&ethoc_driver);
+}
+
+module_init(ethoc_init);
+module_exit(ethoc_exit);
+
+MODULE_AUTHOR("Thierry Reding <thierry.reding@avionic-design.de>");
+MODULE_DESCRIPTION("OpenCores Ethernet MAC driver");
+MODULE_LICENSE("GPL v2");
+
diff --git a/drivers/net/ewrk3.c b/drivers/net/ewrk3.c
index b852303c9362..1a685a04d4b2 100644
--- a/drivers/net/ewrk3.c
+++ b/drivers/net/ewrk3.c
@@ -388,6 +388,18 @@ static int __init ewrk3_probe1(struct net_device *dev, u_long iobase, int irq)
         return err;
 }
 
+static const struct net_device_ops ewrk3_netdev_ops = {
+        .ndo_open               = ewrk3_open,
+        .ndo_start_xmit         = ewrk3_queue_pkt,
+        .ndo_stop               = ewrk3_close,
+        .ndo_set_multicast_list = set_multicast_list,
+        .ndo_do_ioctl           = ewrk3_ioctl,
+        .ndo_tx_timeout         = ewrk3_timeout,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 static int __init
 ewrk3_hw_init(struct net_device *dev, u_long iobase)
 {
@@ -603,16 +615,11 @@ ewrk3_hw_init(struct net_device *dev, u_long iobase)
                 printk(version);
         }
         /* The EWRK3-specific entries in the device structure. */
-        dev->open = ewrk3_open;
-        dev->hard_start_xmit = ewrk3_queue_pkt;
-        dev->stop = ewrk3_close;
-        dev->set_multicast_list = set_multicast_list;
-        dev->do_ioctl = ewrk3_ioctl;
+        dev->netdev_ops = &ewrk3_netdev_ops;
         if (lp->adapter_name[4] == '3')
                 SET_ETHTOOL_OPS(dev, &ethtool_ops_203);
         else
                 SET_ETHTOOL_OPS(dev, &ethtool_ops);
-        dev->tx_timeout = ewrk3_timeout;
         dev->watchdog_timeo = QUEUE_PKT_TIMEOUT;
 
         dev->mem_start = 0;
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 9d81e7a48dba..6a38800be3f1 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1239,19 +1239,9 @@ static int gfar_enet_open(struct net_device *dev)
         return err;
 }
 
-static inline struct txfcb *gfar_add_fcb(struct sk_buff **skbp)
+static inline struct txfcb *gfar_add_fcb(struct sk_buff *skb)
 {
-        struct txfcb *fcb;
-        struct sk_buff *skb = *skbp;
-
-        if (unlikely(skb_headroom(skb) < GMAC_FCB_LEN)) {
-                struct sk_buff *old_skb = skb;
-                skb = skb_realloc_headroom(old_skb, GMAC_FCB_LEN);
-                if (!skb)
-                        return NULL;
-                dev_kfree_skb_any(old_skb);
-        }
-        fcb = (struct txfcb *)skb_push(skb, GMAC_FCB_LEN);
+        struct txfcb *fcb = (struct txfcb *)skb_push(skb, GMAC_FCB_LEN);
         cacheable_memzero(fcb, GMAC_FCB_LEN);
 
         return fcb;
@@ -1320,6 +1310,22 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         base = priv->tx_bd_base;
 
+        /* make space for additional header when fcb is needed */
+        if (((skb->ip_summed == CHECKSUM_PARTIAL) ||
+                        (priv->vlgrp && vlan_tx_tag_present(skb))) &&
+                        (skb_headroom(skb) < GMAC_FCB_LEN)) {
+                struct sk_buff *skb_new;
+
+                skb_new = skb_realloc_headroom(skb, GMAC_FCB_LEN);
+                if (!skb_new) {
+                        dev->stats.tx_errors++;
+                        kfree_skb(skb);
+                        return NETDEV_TX_OK;
+                }
+                kfree_skb(skb);
+                skb = skb_new;
+        }
+
         /* total number of fragments in the SKB */
         nr_frags = skb_shinfo(skb)->nr_frags;
 
@@ -1372,20 +1378,18 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* Set up checksumming */
         if (CHECKSUM_PARTIAL == skb->ip_summed) {
-                fcb = gfar_add_fcb(&skb);
-                if (likely(fcb != NULL)) {
-                        lstatus |= BD_LFLAG(TXBD_TOE);
-                        gfar_tx_checksum(skb, fcb);
-                }
+                fcb = gfar_add_fcb(skb);
+                lstatus |= BD_LFLAG(TXBD_TOE);
+                gfar_tx_checksum(skb, fcb);
         }
 
         if (priv->vlgrp && vlan_tx_tag_present(skb)) {
-                if (unlikely(NULL == fcb))
-                        fcb = gfar_add_fcb(&skb);
-                if (likely(fcb != NULL)) {
+                if (unlikely(NULL == fcb)) {
+                        fcb = gfar_add_fcb(skb);
                         lstatus |= BD_LFLAG(TXBD_TOE);
-                        gfar_tx_vlan(skb, fcb);
                 }
+
+                gfar_tx_vlan(skb, fcb);
         }
 
         /* setup the TxBD length and buffer pointer for the first BD */
@@ -1433,7 +1437,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         /* Unlock priv */
         spin_unlock_irqrestore(&priv->txlock, flags);
 
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 /* Stops the kernel queue, and halts the controller */
diff --git a/drivers/net/ibmlana.c b/drivers/net/ibmlana.c
index 5b5bf9f9861a..c25bc0bc0b25 100644
--- a/drivers/net/ibmlana.c
+++ b/drivers/net/ibmlana.c
@@ -905,6 +905,17 @@ static char *ibmlana_adapter_names[] __devinitdata = {
         NULL
 };
 
+
+static const struct net_device_ops ibmlana_netdev_ops = {
+        .ndo_open               = ibmlana_open,
+        .ndo_stop               = ibmlana_close,
+        .ndo_start_xmit         = ibmlana_tx,
+        .ndo_set_multicast_list = ibmlana_set_multicast_list,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 static int __devinit ibmlana_init_one(struct device *kdev)
 {
         struct mca_device *mdev = to_mca_device(kdev);
@@ -973,11 +984,7 @@ static int __devinit ibmlana_init_one(struct device *kdev)
         mca_device_set_claim(mdev, 1);
 
         /* set methods */
-
-        dev->open = ibmlana_open;
-        dev->stop = ibmlana_close;
-        dev->hard_start_xmit = ibmlana_tx;
-        dev->set_multicast_list = ibmlana_set_multicast_list;
+        dev->netdev_ops = &ibmlana_netdev_ops;
         dev->flags |= IFF_MULTICAST;
 
         /* copy out MAC address */
diff --git a/drivers/net/irda/donauboe.c b/drivers/net/irda/donauboe.c
index 6f3e7f71658d..6b6548b9fda0 100644
--- a/drivers/net/irda/donauboe.c
+++ b/drivers/net/irda/donauboe.c
@@ -1524,6 +1524,13 @@ toshoboe_close (struct pci_dev *pci_dev)
   free_netdev(self->netdev);
 }
 
+static const struct net_device_ops toshoboe_netdev_ops = {
+        .ndo_open       = toshoboe_net_open,
+        .ndo_stop       = toshoboe_net_close,
+        .ndo_start_xmit = toshoboe_hard_xmit,
+        .ndo_do_ioctl   = toshoboe_net_ioctl,
+};
+
 static int
 toshoboe_open (struct pci_dev *pci_dev, const struct pci_device_id *pdid)
 {
@@ -1657,10 +1664,7 @@ toshoboe_open (struct pci_dev *pci_dev, const struct pci_device_id *pdid)
 #endif
 
   SET_NETDEV_DEV(dev, &pci_dev->dev);
-  dev->hard_start_xmit = toshoboe_hard_xmit;
-  dev->open = toshoboe_net_open;
-  dev->stop = toshoboe_net_close;
-  dev->do_ioctl = toshoboe_net_ioctl;
+  dev->netdev_ops = &toshoboe_netdev_ops;
 
   err = register_netdev(dev);
   if (err)
diff --git a/drivers/net/lance.c b/drivers/net/lance.c
index d83d4010656d..633808d447be 100644
--- a/drivers/net/lance.c
+++ b/drivers/net/lance.c
@@ -454,6 +454,18 @@ out:
 }
 #endif
 
+static const struct net_device_ops lance_netdev_ops = {
+        .ndo_open               = lance_open,
+        .ndo_start_xmit         = lance_start_xmit,
+        .ndo_stop               = lance_close,
+        .ndo_get_stats          = lance_get_stats,
+        .ndo_set_multicast_list = set_multicast_list,
+        .ndo_tx_timeout         = lance_tx_timeout,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 static int __init lance_probe1(struct net_device *dev, int ioaddr, int irq, int options)
 {
         struct lance_private *lp;
@@ -714,12 +726,7 @@ static int __init lance_probe1(struct net_device *dev, int ioaddr, int irq, int
                 printk(version);
 
         /* The LANCE-specific entries in the device structure. */
-        dev->open = lance_open;
-        dev->hard_start_xmit = lance_start_xmit;
-        dev->stop = lance_close;
-        dev->get_stats = lance_get_stats;
-        dev->set_multicast_list = set_multicast_list;
-        dev->tx_timeout = lance_tx_timeout;
+        dev->netdev_ops = &lance_netdev_ops;
         dev->watchdog_timeo = TX_TIMEOUT;
 
         err = register_netdev(dev);
diff --git a/drivers/net/lp486e.c b/drivers/net/lp486e.c
index 4d1a059921c6..d44bddbee373 100644
--- a/drivers/net/lp486e.c
+++ b/drivers/net/lp486e.c
@@ -952,6 +952,17 @@ static void print_eth(char *add)
                 (unsigned char) add[12], (unsigned char) add[13]);
 }
 
+static const struct net_device_ops i596_netdev_ops = {
+        .ndo_open               = i596_open,
+        .ndo_stop               = i596_close,
+        .ndo_start_xmit         = i596_start_xmit,
+        .ndo_set_multicast_list = set_multicast_list,
+        .ndo_tx_timeout         = i596_tx_timeout,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 static int __init lp486e_probe(struct net_device *dev) {
         struct i596_private *lp;
         unsigned char eth_addr[6] = { 0, 0xaa, 0, 0, 0, 0 };
@@ -1014,12 +1025,8 @@ static int __init lp486e_probe(struct net_device *dev) {
         printk("\n");
 
         /* The LP486E-specific entries in the device structure. */
-        dev->open = &i596_open;
-        dev->stop = &i596_close;
-        dev->hard_start_xmit = &i596_start_xmit;
-        dev->set_multicast_list = &set_multicast_list;
+        dev->netdev_ops = &i596_netdev_ops;
         dev->watchdog_timeo = 5*HZ;
-        dev->tx_timeout = i596_tx_timeout;
 
 #if 0
         /* selftest reports 0x320925ae - don't know what that means */
diff --git a/drivers/net/ni52.c b/drivers/net/ni52.c
index a8bcc00c3302..77d44a061703 100644
--- a/drivers/net/ni52.c
+++ b/drivers/net/ni52.c
@@ -441,6 +441,18 @@ out:
         return ERR_PTR(err);
 }
 
+static const struct net_device_ops ni52_netdev_ops = {
+        .ndo_open               = ni52_open,
+        .ndo_stop               = ni52_close,
+        .ndo_get_stats          = ni52_get_stats,
+        .ndo_tx_timeout         = ni52_timeout,
+        .ndo_start_xmit         = ni52_send_packet,
+        .ndo_set_multicast_list = set_multicast_list,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 static int __init ni52_probe1(struct net_device *dev, int ioaddr)
 {
         int i, size, retval;
@@ -561,15 +573,8 @@ static int __init ni52_probe1(struct net_device *dev, int ioaddr)
                 printk("IRQ %d (assigned and not checked!).\n", dev->irq);
         }
 
-        dev->open               = ni52_open;
-        dev->stop               = ni52_close;
-        dev->get_stats          = ni52_get_stats;
-        dev->tx_timeout         = ni52_timeout;
+        dev->netdev_ops         = &ni52_netdev_ops;
         dev->watchdog_timeo     = HZ/20;
-        dev->hard_start_xmit    = ni52_send_packet;
-        dev->set_multicast_list = set_multicast_list;
-
-        dev->if_port            = 0;
 
         return 0;
 out:
diff --git a/drivers/net/ni65.c b/drivers/net/ni65.c
index df5f869e8d8f..6474f02bf783 100644
--- a/drivers/net/ni65.c
+++ b/drivers/net/ni65.c
@@ -237,7 +237,7 @@ struct priv
         void *tmdbounce[TMDNUM];
         int tmdbouncenum;
         int lock,xmit_queued;
-        struct net_device_stats stats;
+
         void *self;
         int cmdr_addr;
         int cardno;
@@ -257,7 +257,6 @@ static void  ni65_timeout(struct net_device *dev);
 static int  ni65_close(struct net_device *dev);
 static int  ni65_alloc_buffer(struct net_device *dev);
 static void ni65_free_buffer(struct priv *p);
-static struct net_device_stats *ni65_get_stats(struct net_device *);
 static void set_multicast_list(struct net_device *dev);
 
 static int irqtab[] __initdata = { 9,12,15,5 }; /* irq config-translate */
@@ -401,6 +400,17 @@ out:
         return ERR_PTR(err);
 }
 
+static const struct net_device_ops ni65_netdev_ops = {
+        .ndo_open               = ni65_open,
+        .ndo_stop               = ni65_close,
+        .ndo_start_xmit         = ni65_send_packet,
+        .ndo_tx_timeout         = ni65_timeout,
+        .ndo_set_multicast_list = set_multicast_list,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 /*
  * this is the real card probe ..
  */
@@ -549,13 +559,9 @@ static int __init ni65_probe1(struct net_device *dev,int ioaddr)
         }
 
         dev->base_addr = ioaddr;
-        dev->open               = ni65_open;
-        dev->stop               = ni65_close;
-        dev->hard_start_xmit    = ni65_send_packet;
-        dev->tx_timeout         = ni65_timeout;
+        dev->netdev_ops = &ni65_netdev_ops;
         dev->watchdog_timeo     = HZ/2;
-        dev->get_stats          = ni65_get_stats;
-        dev->set_multicast_list = set_multicast_list;
+
         return 0; /* everything is OK */
 }
 
@@ -901,13 +907,13 @@ static irqreturn_t ni65_interrupt(int irq, void * dev_id)
                         if(debuglevel > 1)
                                 printk(KERN_ERR "%s: general error: %04x.\n",dev->name,csr0);
                         if(csr0 & CSR0_BABL)
-                                p->stats.tx_errors++;
+                                dev->stats.tx_errors++;
                         if(csr0 & CSR0_MISS) {
                                 int i;
                                 for(i=0;i<RMDNUM;i++)
                                         printk("%02x ",p->rmdhead[i].u.s.status);
                                 printk("\n");
-                                p->stats.rx_errors++;
+                                dev->stats.rx_errors++;
                         }
                         if(csr0 & CSR0_MERR) {
                                 if(debuglevel > 1)
@@ -997,12 +1003,12 @@ static void ni65_xmit_intr(struct net_device *dev,int csr0)
 #endif
                  /* checking some errors */
                         if(tmdp->status2 & XMIT_RTRY)
-                                p->stats.tx_aborted_errors++;
+                                dev->stats.tx_aborted_errors++;
                         if(tmdp->status2 & XMIT_LCAR)
-                                p->stats.tx_carrier_errors++;
+                                dev->stats.tx_carrier_errors++;
                         if(tmdp->status2 & (XMIT_BUFF | XMIT_UFLO )) {
                 /* this stops the xmitter */
-                                p->stats.tx_fifo_errors++;
+                                dev->stats.tx_fifo_errors++;
                                 if(debuglevel > 0)
                                         printk(KERN_ERR "%s: Xmit FIFO/BUFF error\n",dev->name);
                                 if(p->features & INIT_RING_BEFORE_START) {
@@ -1016,12 +1022,12 @@ static void ni65_xmit_intr(struct net_device *dev,int csr0)
                         if(debuglevel > 2)
                                 printk(KERN_ERR "%s: xmit-error: %04x %02x-%04x\n",dev->name,csr0,(int) tmdstat,(int) tmdp->status2);
                         if(!(csr0 & CSR0_BABL)) /* don't count errors twice */
-                                p->stats.tx_errors++;
+                                dev->stats.tx_errors++;
                         tmdp->status2 = 0;
                 }
                 else {
-                        p->stats.tx_bytes -= (short)(tmdp->blen);
-                        p->stats.tx_packets++;
+                        dev->stats.tx_bytes -= (short)(tmdp->blen);
+                        dev->stats.tx_packets++;
                 }
 
 #ifdef XMT_VIA_SKB
@@ -1057,7 +1063,7 @@ static void ni65_recv_intr(struct net_device *dev,int csr0)
                         if(!(rmdstat & RCV_ERR)) {
                                 if(rmdstat & RCV_START)
                                 {
-                                        p->stats.rx_length_errors++;
+                                        dev->stats.rx_length_errors++;
                                         printk(KERN_ERR "%s: recv, packet too long: %d\n",dev->name,rmdp->mlen & 0x0fff);
                                 }
                         }
@@ -1066,16 +1072,16 @@ static void ni65_recv_intr(struct net_device *dev,int csr0)
                                         printk(KERN_ERR "%s: receive-error: %04x, lance-status: %04x/%04x\n",
                                                                         dev->name,(int) rmdstat,csr0,(int) inw(PORT+L_DATAREG) );
                                 if(rmdstat & RCV_FRAM)
-                                        p->stats.rx_frame_errors++;
+                                        dev->stats.rx_frame_errors++;
                                 if(rmdstat & RCV_OFLO)
-                                        p->stats.rx_over_errors++;
+                                        dev->stats.rx_over_errors++;
                                 if(rmdstat & RCV_CRC)
-                                        p->stats.rx_crc_errors++;
+                                        dev->stats.rx_crc_errors++;
                                 if(rmdstat & RCV_BUF_ERR)
-                                        p->stats.rx_fifo_errors++;
+                                        dev->stats.rx_fifo_errors++;
                         }
                         if(!(csr0 & CSR0_MISS)) /* don't count errors twice */
-                                p->stats.rx_errors++;
+                                dev->stats.rx_errors++;
                 }
                 else if( (len = (rmdp->mlen & 0x0fff) - 4) >= 60)
                 {
@@ -1106,20 +1112,20 @@ static void ni65_recv_intr(struct net_device *dev,int csr0)
                                 skb_put(skb,len);
                                 skb_copy_to_linear_data(skb, (unsigned char *) p->recvbounce[p->rmdnum],len);
 #endif
-                                p->stats.rx_packets++;
-                                p->stats.rx_bytes += len;
+                                dev->stats.rx_packets++;
+                                dev->stats.rx_bytes += len;
                                 skb->protocol=eth_type_trans(skb,dev);
                                 netif_rx(skb);
                         }
                         else
                         {
                                 printk(KERN_ERR "%s: can't alloc new sk_buff\n",dev->name);
-                                p->stats.rx_dropped++;
+                                dev->stats.rx_dropped++;
                         }
                 }
                 else {
                         printk(KERN_INFO "%s: received runt packet\n",dev->name);
-                        p->stats.rx_errors++;
+                        dev->stats.rx_errors++;
                 }
                 rmdp->blen = -(R_BUF_SIZE-8);
                 rmdp->mlen = 0;
@@ -1213,23 +1219,6 @@ static int ni65_send_packet(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
-static struct net_device_stats *ni65_get_stats(struct net_device *dev)
-{
-
-#if 0
-        int i;
-        struct priv *p = dev->ml_priv;
-        for(i=0;i<RMDNUM;i++)
-        {
-                struct rmd *rmdp = p->rmdhead + ((p->rmdnum + i) & (RMDNUM-1));
-                printk("%02x ",rmdp->u.s.status);
-        }
-        printk("\n");
-#endif
-
-        return &((struct priv *)dev->ml_priv)->stats;
-}
-
 static void set_multicast_list(struct net_device *dev)
 {
         if(!ni65_lance_reinit(dev))
diff --git a/drivers/net/seeq8005.c b/drivers/net/seeq8005.c
index 12a8ffffeb03..ebbbe09725fe 100644
--- a/drivers/net/seeq8005.c
+++ b/drivers/net/seeq8005.c
@@ -143,6 +143,17 @@ out:
         return ERR_PTR(err);
 }
 
+static const struct net_device_ops seeq8005_netdev_ops = {
+        .ndo_open               = seeq8005_open,
+        .ndo_stop               = seeq8005_close,
+        .ndo_start_xmit         = seeq8005_send_packet,
+        .ndo_tx_timeout         = seeq8005_timeout,
+        .ndo_set_multicast_list = set_multicast_list,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 /* This is the real probe routine.  Linux has a history of friendly device
    probes on the ISA bus.  A good device probes avoids doing writes, and
    verifies that the correct device exists and functions.  */
@@ -332,12 +343,8 @@ static int __init seeq8005_probe1(struct net_device *dev, int ioaddr)
                  }
         }
 #endif
-        dev->open               = seeq8005_open;
-        dev->stop               = seeq8005_close;
-        dev->hard_start_xmit    = seeq8005_send_packet;
-        dev->tx_timeout         = seeq8005_timeout;
+        dev->netdev_ops = &seeq8005_netdev_ops;
         dev->watchdog_timeo     = HZ/20;
-        dev->set_multicast_list = set_multicast_list;
         dev->flags &= ~IFF_MULTICAST;
 
         return 0;
diff --git a/drivers/net/smc-ultra.c b/drivers/net/smc-ultra.c
index 2033fee3143a..0291ea098a06 100644
--- a/drivers/net/smc-ultra.c
+++ b/drivers/net/smc-ultra.c
@@ -142,9 +142,6 @@ static int __init do_ultra_probe(struct net_device *dev)
         int base_addr = dev->base_addr;
         int irq = dev->irq;
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        dev->poll_controller = &ultra_poll;
-#endif
         if (base_addr > 0x1ff)          /* Check a single specified location. */
                 return ultra_probe1(dev, base_addr);
         else if (base_addr != 0)        /* Don't probe at all. */
@@ -199,7 +196,7 @@ static const struct net_device_ops ultra_netdev_ops = {
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = ultra_poll,
 #endif
 };
 
diff --git a/drivers/net/smc-ultra32.c b/drivers/net/smc-ultra32.c
index cb6c097a2e0a..7a554adc70fb 100644
--- a/drivers/net/smc-ultra32.c
+++ b/drivers/net/smc-ultra32.c
@@ -153,6 +153,22 @@ out:
         return ERR_PTR(err);
 }
 
+
+static const struct net_device_ops ultra32_netdev_ops = {
+        .ndo_open               = ultra32_open,
+        .ndo_stop               = ultra32_close,
+        .ndo_start_xmit         = ei_start_xmit,
+        .ndo_tx_timeout         = ei_tx_timeout,
+        .ndo_get_stats          = ei_get_stats,
+        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_change_mtu         = eth_change_mtu,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = ei_poll,
+#endif
+};
+
 static int __init ultra32_probe1(struct net_device *dev, int ioaddr)
 {
         int i, edge, media, retval;
@@ -273,11 +289,8 @@ static int __init ultra32_probe1(struct net_device *dev, int ioaddr)
         ei_status.block_output = &ultra32_block_output;
         ei_status.get_8390_hdr = &ultra32_get_8390_hdr;
         ei_status.reset_8390 = &ultra32_reset_8390;
-        dev->open = &ultra32_open;
-        dev->stop = &ultra32_close;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        dev->poll_controller = ei_poll;
-#endif
+
+        dev->netdev_ops = &ultra32_netdev_ops;
         NS8390_init(dev, 0);
 
         return 0;
diff --git a/drivers/net/smc9194.c b/drivers/net/smc9194.c
index 18d653bbd4e0..9a7973a54116 100644
--- a/drivers/net/smc9194.c
+++ b/drivers/net/smc9194.c
@@ -831,6 +831,17 @@ static int __init smc_findirq(int ioaddr)
 #endif
 }
 
+static const struct net_device_ops smc_netdev_ops = {
+        .ndo_open                = smc_open,
+        .ndo_stop               = smc_close,
+        .ndo_start_xmit         = smc_wait_to_send_packet,
+        .ndo_tx_timeout         = smc_timeout,
+        .ndo_set_multicast_list = smc_set_multicast_list,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 /*----------------------------------------------------------------------
  . Function: smc_probe( int ioaddr )
  .
@@ -1044,12 +1055,8 @@ static int __init smc_probe(struct net_device *dev, int ioaddr)
                 goto err_out;
         }
 
-        dev->open                       = smc_open;
-        dev->stop                       = smc_close;
-        dev->hard_start_xmit            = smc_wait_to_send_packet;
-        dev->tx_timeout                 = smc_timeout;
+        dev->netdev_ops                 = &smc_netdev_ops;
         dev->watchdog_timeo             = HZ/20;
-        dev->set_multicast_list         = smc_set_multicast_list;
 
         return 0;
 
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index ad3cbc91a8fa..af8f60ca0f57 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -1680,6 +1680,7 @@ static int smsc911x_eeprom_write_location(struct smsc911x_data *pdata,
                                           u8 address, u8 data)
 {
         u32 op = E2P_CMD_EPC_CMD_ERASE_ | address;
+        u32 temp;
         int ret;
 
         SMSC_TRACE(DRV, "address 0x%x, data 0x%x", address, data);
@@ -1688,6 +1689,10 @@ static int smsc911x_eeprom_write_location(struct smsc911x_data *pdata,
         if (!ret) {
                 op = E2P_CMD_EPC_CMD_WRITE_ | address;
                 smsc911x_reg_write(pdata, E2P_DATA, (u32)data);
+
+                /* Workaround for hardware read-after-write restriction */
+                temp = smsc911x_reg_read(pdata, BYTE_TEST);
+
                 ret = smsc911x_eeprom_send_cmd(pdata, op);
         }
 
diff --git a/drivers/net/tokenring/madgemc.c b/drivers/net/tokenring/madgemc.c
index 193308118f95..456f8bff40be 100644
--- a/drivers/net/tokenring/madgemc.c
+++ b/drivers/net/tokenring/madgemc.c
@@ -142,7 +142,7 @@ static void madgemc_sifwritew(struct net_device *dev, unsigned short val, unsign
         return;
 }
 
-
+static struct net_device_ops madgemc_netdev_ops __read_mostly;
 
 static int __devinit madgemc_probe(struct device *device)
 {       
@@ -168,7 +168,7 @@ static int __devinit madgemc_probe(struct device *device)
                 goto getout;
         }
 
-        dev->dma = 0;
+        dev->netdev_ops = &madgemc_netdev_ops;
 
         card = kmalloc(sizeof(struct card_info), GFP_KERNEL);
         if (card==NULL) {
@@ -348,9 +348,6 @@ static int __devinit madgemc_probe(struct device *device)
 
         memcpy(tp->ProductID, "Madge MCA 16/4    ", PROD_ID_SIZE + 1);
 
-        dev->open = madgemc_open;
-        dev->stop = madgemc_close;
-
         tp->tmspriv = card;
         dev_set_drvdata(device, dev);
 
@@ -758,6 +755,10 @@ static struct mca_driver madgemc_driver = {
 
 static int __init madgemc_init (void)
 {
+        madgemc_netdev_ops = tms380tr_netdev_ops;
+        madgemc_netdev_ops.ndo_open = madgemc_open;
+        madgemc_netdev_ops.ndo_stop = madgemc_close;
+
         return mca_register_driver (&madgemc_driver);
 }
 
diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c
index b8c955f6d31a..16e8783ee9cd 100644
--- a/drivers/net/tokenring/proteon.c
+++ b/drivers/net/tokenring/proteon.c
@@ -116,6 +116,8 @@ nodev:
         return -ENODEV;
 }
 
+static struct net_device_ops proteon_netdev_ops __read_mostly;
+
 static int __init setup_card(struct net_device *dev, struct device *pdev)
 {
         struct net_local *tp;
@@ -167,8 +169,7 @@ static int __init setup_card(struct net_device *dev, struct device *pdev)
 
         tp->tmspriv = NULL;
 
-        dev->open = proteon_open;
-        dev->stop = tms380tr_close;
+        dev->netdev_ops = &proteon_netdev_ops;
 
         if (dev->irq == 0)
         {
@@ -352,6 +353,10 @@ static int __init proteon_init(void)
         struct platform_device *pdev;
         int i, num = 0, err = 0;
 
+        proteon_netdev_ops = tms380tr_netdev_ops;
+        proteon_netdev_ops.ndo_open = proteon_open;
+        proteon_netdev_ops.ndo_stop = tms380tr_close;
+
         err = platform_driver_register(&proteon_driver);
         if (err)
                 return err;
diff --git a/drivers/net/tokenring/skisa.c b/drivers/net/tokenring/skisa.c
index c0f58f08782c..46db5c5395b2 100644
--- a/drivers/net/tokenring/skisa.c
+++ b/drivers/net/tokenring/skisa.c
@@ -133,6 +133,8 @@ static int __init sk_isa_probe1(struct net_device *dev, int ioaddr)
         return 0;
 }
 
+static struct net_device_ops sk_isa_netdev_ops __read_mostly;
+
 static int __init setup_card(struct net_device *dev, struct device *pdev)
 {
         struct net_local *tp;
@@ -184,8 +186,7 @@ static int __init setup_card(struct net_device *dev, struct device *pdev)
 
         tp->tmspriv = NULL;
 
-        dev->open = sk_isa_open;
-        dev->stop = tms380tr_close;
+        dev->netdev_ops = &sk_isa_netdev_ops;
 
         if (dev->irq == 0)
         {
@@ -362,6 +363,10 @@ static int __init sk_isa_init(void)
         struct platform_device *pdev;
         int i, num = 0, err = 0;
 
+        sk_isa_netdev_ops = tms380tr_netdev_ops;
+        sk_isa_netdev_ops.ndo_open = sk_isa_open;
+        sk_isa_netdev_ops.ndo_stop = tms380tr_close;
+
         err = platform_driver_register(&sk_isa_driver);
         if (err)
                 return err;
diff --git a/drivers/net/tokenring/smctr.c b/drivers/net/tokenring/smctr.c
index 9d7db2c8d661..a91d9c55d78e 100644
--- a/drivers/net/tokenring/smctr.c
+++ b/drivers/net/tokenring/smctr.c
@@ -124,7 +124,6 @@ static unsigned int smctr_get_num_rx_bdbs(struct net_device *dev);
 static int smctr_get_physical_drop_number(struct net_device *dev);
 static __u8 *smctr_get_rx_pointer(struct net_device *dev, short queue);
 static int smctr_get_station_id(struct net_device *dev);
-static struct net_device_stats *smctr_get_stats(struct net_device *dev);
 static FCBlock *smctr_get_tx_fcb(struct net_device *dev, __u16 queue,
         __u16 bytes_count);
 static int smctr_get_upstream_neighbor_addr(struct net_device *dev);
@@ -3633,6 +3632,14 @@ out:
         return ERR_PTR(err);
 }
 
+static const struct net_device_ops smctr_netdev_ops = {
+        .ndo_open          = smctr_open,
+        .ndo_stop          = smctr_close,
+        .ndo_start_xmit    = smctr_send_packet,
+        .ndo_tx_timeout    = smctr_timeout,
+        .ndo_get_stats     = smctr_get_stats,
+        .ndo_set_multicast_list = smctr_set_multicast_list,
+};
 
 static int __init smctr_probe1(struct net_device *dev, int ioaddr)
 {
@@ -3683,13 +3690,8 @@ static int __init smctr_probe1(struct net_device *dev, int ioaddr)
                 (unsigned int)dev->base_addr,
                 dev->irq, tp->rom_base, tp->ram_base);
 
-        dev->open               = smctr_open;
-        dev->stop               = smctr_close;
-        dev->hard_start_xmit    = smctr_send_packet;
-        dev->tx_timeout         = smctr_timeout;
+        dev->netdev_ops = &smctr_netdev_ops;
         dev->watchdog_timeo     = HZ;
-        dev->get_stats          = smctr_get_stats;
-        dev->set_multicast_list = &smctr_set_multicast_list;
         return (0);
 
 out:
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index a110326dce6f..86a479f61c0c 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -2009,6 +2009,9 @@ static void ucc_geth_stop(struct ucc_geth_private *ugeth)
         /* Disable Rx and Tx */
         clrbits32(&ug_regs->maccfg1, MACCFG1_ENABLE_RX | MACCFG1_ENABLE_TX);
 
+        phy_disconnect(ugeth->phydev);
+        ugeth->phydev = NULL;
+
         ucc_geth_memclean(ugeth);
 }
 
@@ -3345,6 +3348,14 @@ static int ucc_geth_open(struct net_device *dev)
                 return -EINVAL;
         }
 
+        err = init_phy(dev);
+        if (err) {
+                if (netif_msg_ifup(ugeth))
+                        ugeth_err("%s: Cannot initialize PHY, aborting.",
+                                  dev->name);
+                return err;
+        }
+
         err = ucc_struct_init(ugeth);
         if (err) {
                 if (netif_msg_ifup(ugeth))
@@ -3381,13 +3392,6 @@ static int ucc_geth_open(struct net_device *dev)
                                    &ugeth->ug_regs->macstnaddr1,
                                    &ugeth->ug_regs->macstnaddr2);
 
-        err = init_phy(dev);
-        if (err) {
-                if (netif_msg_ifup(ugeth))
-                        ugeth_err("%s: Cannot initialize PHY, aborting.", dev->name);
-                goto out_err;
-        }
-
         phy_start(ugeth->phydev);
 
         err = ugeth_enable(ugeth, COMM_DIR_RX_AND_TX);
@@ -3430,9 +3434,6 @@ static int ucc_geth_close(struct net_device *dev)
 
         free_irq(ugeth->ug_info->uf_info.irq, ugeth->dev);
 
-        phy_disconnect(ugeth->phydev);
-        ugeth->phydev = NULL;
-
         netif_stop_queue(dev);
 
         return 0;
diff --git a/drivers/net/wan/sdla.c b/drivers/net/wan/sdla.c
index 6a07ba9371db..1d637f407a0c 100644
--- a/drivers/net/wan/sdla.c
+++ b/drivers/net/wan/sdla.c
@@ -714,19 +714,19 @@ static int sdla_transmit(struct sk_buff *skb, struct net_device *dev)
                 switch (ret)
                 {
                         case SDLA_RET_OK:
-                                flp->stats.tx_packets++;
+                                dev->stats.tx_packets++;
                                 ret = DLCI_RET_OK;
                                 break;
 
                         case SDLA_RET_CIR_OVERFLOW:
                         case SDLA_RET_BUF_OVERSIZE:
                         case SDLA_RET_NO_BUFS:
-                                flp->stats.tx_dropped++;
+                                dev->stats.tx_dropped++;
                                 ret = DLCI_RET_DROP;
                                 break;
 
                         default:
-                                flp->stats.tx_errors++;
+                                dev->stats.tx_errors++;
                                 ret = DLCI_RET_ERR;
                                 break;
                 }
@@ -807,7 +807,7 @@ static void sdla_receive(struct net_device *dev)
                 if (i == CONFIG_DLCI_MAX)
                 {
                         printk(KERN_NOTICE "%s: Received packet from invalid DLCI %i, ignoring.", dev->name, dlci);
-                        flp->stats.rx_errors++;
+                        dev->stats.rx_errors++;
                         success = 0;
                 }
         }
@@ -819,7 +819,7 @@ static void sdla_receive(struct net_device *dev)
                 if (skb == NULL) 
                 {
                         printk(KERN_NOTICE "%s: Memory squeeze, dropping packet.\n", dev->name);
-                        flp->stats.rx_dropped++; 
+                        dev->stats.rx_dropped++;
                         success = 0;
                 }
                 else
@@ -859,7 +859,7 @@ static void sdla_receive(struct net_device *dev)
 
         if (success)
         {
-                flp->stats.rx_packets++;
+                dev->stats.rx_packets++;
                 dlp = netdev_priv(master);
                 (*dlp->receive)(skb, master);
         }
@@ -1590,13 +1590,14 @@ fail:
         return err;
 }
  
-static struct net_device_stats *sdla_stats(struct net_device *dev)
-{
-        struct frad_local *flp;
-        flp = netdev_priv(dev);
-
-        return(&flp->stats);
-}
+static const struct net_device_ops sdla_netdev_ops = {
+        .ndo_open       = sdla_open,
+        .ndo_stop       = sdla_close,
+        .ndo_do_ioctl   = sdla_ioctl,
+        .ndo_set_config = sdla_set_config,
+        .ndo_start_xmit = sdla_transmit,
+        .ndo_change_mtu = sdla_change_mtu,
+};
 
 static void setup_sdla(struct net_device *dev)
 {
@@ -1604,20 +1605,13 @@ static void setup_sdla(struct net_device *dev)
 
         netdev_boot_setup_check(dev);
 
+        dev->netdev_ops         = &sdla_netdev_ops;
         dev->flags              = 0;
         dev->type               = 0xFFFF;
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
         dev->mtu                = SDLA_MAX_MTU;
 
-        dev->open               = sdla_open;
-        dev->stop               = sdla_close;
-        dev->do_ioctl           = sdla_ioctl;
-        dev->set_config         = sdla_set_config;
-        dev->get_stats          = sdla_stats;
-        dev->hard_start_xmit    = sdla_transmit;
-        dev->change_mtu         = sdla_change_mtu;
-
         flp->activate           = sdla_activate;
         flp->deactivate         = sdla_deactivate;
         flp->assoc              = sdla_assoc;
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 612fffe100a6..8a0823588c51 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -485,6 +485,7 @@ config MWL8K
 source "drivers/net/wireless/p54/Kconfig"
 source "drivers/net/wireless/ath5k/Kconfig"
 source "drivers/net/wireless/ath9k/Kconfig"
+source "drivers/net/wireless/ar9170/Kconfig"
 source "drivers/net/wireless/ipw2x00/Kconfig"
 source "drivers/net/wireless/iwlwifi/Kconfig"
 source "drivers/net/wireless/hostap/Kconfig"
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index d780487c420f..50e7fba7f0ea 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -57,5 +57,6 @@ obj-$(CONFIG_P54_COMMON)	+= p54/
 
 obj-$(CONFIG_ATH5K)     += ath5k/
 obj-$(CONFIG_ATH9K)     += ath9k/
+obj-$(CONFIG_AR9170_USB)        += ar9170/
 
 obj-$(CONFIG_MAC80211_HWSIM)    += mac80211_hwsim.o
diff --git a/drivers/net/wireless/ar9170/Kconfig b/drivers/net/wireless/ar9170/Kconfig
new file mode 100644
index 000000000000..de4281fda129
--- /dev/null
+++ b/drivers/net/wireless/ar9170/Kconfig
@@ -0,0 +1,17 @@
+config AR9170_USB
+        tristate "Atheros AR9170 802.11n USB support"
+        depends on USB && MAC80211 && WLAN_80211 && EXPERIMENTAL
+        select FW_LOADER
+        help
+          This is a driver for the Atheros "otus" 802.11n USB devices.
+
+          These devices require additional firmware (2 files).
+          For now, these files can be downloaded from here:
+          http://wireless.kernel.org/en/users/Drivers/ar9170
+
+          If you choose to build a module, it'll be called ar9170usb.
+
+config AR9170_LEDS
+        bool
+        depends on AR9170_USB && MAC80211_LEDS && (LEDS_CLASS = y || LEDS_CLASS = AR9170_USB)
+        default y
diff --git a/drivers/net/wireless/ar9170/Makefile b/drivers/net/wireless/ar9170/Makefile
new file mode 100644
index 000000000000..8d91c7ee3215
--- /dev/null
+++ b/drivers/net/wireless/ar9170/Makefile
@@ -0,0 +1,3 @@
+ar9170usb-objs := usb.o main.o cmd.o mac.o phy.o led.o
+
+obj-$(CONFIG_AR9170_USB) += ar9170usb.o
diff --git a/drivers/net/wireless/ar9170/ar9170.h b/drivers/net/wireless/ar9170/ar9170.h
new file mode 100644
index 000000000000..f4fb2e94aea0
--- /dev/null
+++ b/drivers/net/wireless/ar9170/ar9170.h
@@ -0,0 +1,209 @@
+/*
+ * Atheros AR9170 driver
+ *
+ * Driver specific definitions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __AR9170_H
+#define __AR9170_H
+
+#include <linux/completion.h>
+#include <linux/spinlock.h>
+#include <net/wireless.h>
+#include <net/mac80211.h>
+#ifdef CONFIG_AR9170_LEDS
+#include <linux/leds.h>
+#endif /* CONFIG_AR9170_LEDS */
+#include "eeprom.h"
+#include "hw.h"
+
+#define PAYLOAD_MAX     (AR9170_MAX_CMD_LEN/4 - 1)
+
+enum ar9170_bw {
+        AR9170_BW_20,
+        AR9170_BW_40_BELOW,
+        AR9170_BW_40_ABOVE,
+
+        __AR9170_NUM_BW,
+};
+
+enum ar9170_rf_init_mode {
+        AR9170_RFI_NONE,
+        AR9170_RFI_WARM,
+        AR9170_RFI_COLD,
+};
+
+#define AR9170_MAX_RX_BUFFER_SIZE               8192
+
+#ifdef CONFIG_AR9170_LEDS
+struct ar9170;
+
+struct ar9170_led {
+        struct ar9170 *ar;
+        struct led_classdev l;
+        char name[32];
+        unsigned int toggled;
+        bool registered;
+};
+
+#endif /* CONFIG_AR9170_LEDS */
+
+enum ar9170_device_state {
+        AR9170_UNKNOWN_STATE,
+        AR9170_STOPPED,
+        AR9170_IDLE,
+        AR9170_STARTED,
+        AR9170_ASSOCIATED,
+};
+
+struct ar9170 {
+        struct ieee80211_hw *hw;
+        struct mutex mutex;
+        enum ar9170_device_state state;
+
+        int (*open)(struct ar9170 *);
+        void (*stop)(struct ar9170 *);
+        int (*tx)(struct ar9170 *, struct sk_buff *, bool, unsigned int);
+        int (*exec_cmd)(struct ar9170 *, enum ar9170_cmd, u32 ,
+                        void *, u32 , void *);
+        void (*callback_cmd)(struct ar9170 *, u32 , void *);
+
+        /* interface mode settings */
+        struct ieee80211_vif *vif;
+        u8 mac_addr[ETH_ALEN];
+        u8 bssid[ETH_ALEN];
+
+        /* beaconing */
+        struct sk_buff *beacon;
+        struct work_struct beacon_work;
+
+        /* cryptographic engine */
+        u64 usedkeys;
+        bool rx_software_decryption;
+        bool disable_offload;
+
+        /* filter settings */
+        struct work_struct filter_config_work;
+        u64 cur_mc_hash, want_mc_hash;
+        u32 cur_filter, want_filter;
+        unsigned int filter_changed;
+        bool sniffer_enabled;
+
+        /* PHY */
+        struct ieee80211_channel *channel;
+        int noise[4];
+
+        /* power calibration data */
+        u8 power_5G_leg[4];
+        u8 power_2G_cck[4];
+        u8 power_2G_ofdm[4];
+        u8 power_5G_ht20[8];
+        u8 power_5G_ht40[8];
+        u8 power_2G_ht20[8];
+        u8 power_2G_ht40[8];
+
+#ifdef CONFIG_AR9170_LEDS
+        struct delayed_work led_work;
+        struct ar9170_led leds[AR9170_NUM_LEDS];
+#endif /* CONFIG_AR9170_LEDS */
+
+        /* qos queue settings */
+        spinlock_t tx_stats_lock;
+        struct ieee80211_tx_queue_stats tx_stats[5];
+        struct ieee80211_tx_queue_params edcf[5];
+
+        spinlock_t cmdlock;
+        __le32 cmdbuf[PAYLOAD_MAX + 1];
+
+        /* MAC statistics */
+        struct ieee80211_low_level_stats stats;
+
+        /* EEPROM */
+        struct ar9170_eeprom eeprom;
+
+        /* global tx status for unregistered Stations. */
+        struct sk_buff_head global_tx_status;
+        struct sk_buff_head global_tx_status_waste;
+        struct delayed_work tx_status_janitor;
+};
+
+struct ar9170_sta_info {
+        struct sk_buff_head tx_status[__AR9170_NUM_TXQ];
+};
+
+#define IS_STARTED(a)           (a->state >= AR9170_STARTED)
+#define IS_ACCEPTING_CMD(a)     (a->state >= AR9170_IDLE)
+
+#define AR9170_FILTER_CHANGED_PROMISC           BIT(0)
+#define AR9170_FILTER_CHANGED_MULTICAST         BIT(1)
+#define AR9170_FILTER_CHANGED_FRAMEFILTER       BIT(2)
+
+/* exported interface */
+void *ar9170_alloc(size_t priv_size);
+int ar9170_register(struct ar9170 *ar, struct device *pdev);
+void ar9170_rx(struct ar9170 *ar, struct sk_buff *skb);
+void ar9170_unregister(struct ar9170 *ar);
+void ar9170_handle_tx_status(struct ar9170 *ar, struct sk_buff *skb,
+                             bool update_statistics, u16 tx_status);
+
+/* MAC */
+int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
+int ar9170_init_mac(struct ar9170 *ar);
+int ar9170_set_qos(struct ar9170 *ar);
+int ar9170_update_multicast(struct ar9170 *ar);
+int ar9170_update_frame_filter(struct ar9170 *ar);
+int ar9170_set_operating_mode(struct ar9170 *ar);
+int ar9170_set_beacon_timers(struct ar9170 *ar);
+int ar9170_set_hwretry_limit(struct ar9170 *ar, u32 max_retry);
+int ar9170_update_beacon(struct ar9170 *ar);
+void ar9170_new_beacon(struct work_struct *work);
+int ar9170_upload_key(struct ar9170 *ar, u8 id, const u8 *mac, u8 ktype,
+                      u8 keyidx, u8 *keydata, int keylen);
+int ar9170_disable_key(struct ar9170 *ar, u8 id);
+
+/* LEDs */
+#ifdef CONFIG_AR9170_LEDS
+int ar9170_register_leds(struct ar9170 *ar);
+void ar9170_unregister_leds(struct ar9170 *ar);
+#endif /* CONFIG_AR9170_LEDS */
+int ar9170_init_leds(struct ar9170 *ar);
+int ar9170_set_leds_state(struct ar9170 *ar, u32 led_state);
+
+/* PHY / RF */
+int ar9170_init_phy(struct ar9170 *ar, enum ieee80211_band band);
+int ar9170_init_rf(struct ar9170 *ar);
+int ar9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
+                       enum ar9170_rf_init_mode rfi, enum ar9170_bw bw);
+
+#endif /* __AR9170_H */
diff --git a/drivers/net/wireless/ar9170/cmd.c b/drivers/net/wireless/ar9170/cmd.c
new file mode 100644
index 000000000000..f57a6200167b
--- /dev/null
+++ b/drivers/net/wireless/ar9170/cmd.c
@@ -0,0 +1,129 @@
+/*
+ * Atheros AR9170 driver
+ *
+ * Basic HW register/memory/command access functions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ar9170.h"
+#include "cmd.h"
+
+int ar9170_write_mem(struct ar9170 *ar, const __le32 *data, size_t len)
+{
+        int err;
+
+        if (unlikely(!IS_ACCEPTING_CMD(ar)))
+                return 0;
+
+        err = ar->exec_cmd(ar, AR9170_CMD_WMEM, len, (u8 *) data, 0, NULL);
+        if (err)
+                printk(KERN_DEBUG "%s: writing memory failed\n",
+                       wiphy_name(ar->hw->wiphy));
+        return err;
+}
+
+int ar9170_write_reg(struct ar9170 *ar, const u32 reg, const u32 val)
+{
+        __le32 buf[2] = {
+                cpu_to_le32(reg),
+                cpu_to_le32(val),
+        };
+        int err;
+
+        if (unlikely(!IS_ACCEPTING_CMD(ar)))
+                return 0;
+
+        err = ar->exec_cmd(ar, AR9170_CMD_WREG, sizeof(buf),
+                           (u8 *) buf, 0, NULL);
+        if (err)
+                printk(KERN_DEBUG "%s: writing reg %#x (val %#x) failed\n",
+                       wiphy_name(ar->hw->wiphy), reg, val);
+        return err;
+}
+
+static int ar9170_read_mreg(struct ar9170 *ar, int nregs,
+                            const u32 *regs, u32 *out)
+{
+        int i, err;
+        __le32 *offs, *res;
+
+        if (unlikely(!IS_ACCEPTING_CMD(ar)))
+                return 0;
+
+        /* abuse "out" for the register offsets, must be same length */
+        offs = (__le32 *)out;
+        for (i = 0; i < nregs; i++)
+                offs[i] = cpu_to_le32(regs[i]);
+
+        /* also use the same buffer for the input */
+        res = (__le32 *)out;
+
+        err = ar->exec_cmd(ar, AR9170_CMD_RREG,
+                           4 * nregs, (u8 *)offs,
+                           4 * nregs, (u8 *)res);
+        if (err)
+                return err;
+
+        /* convert result to cpu endian */
+        for (i = 0; i < nregs; i++)
+                out[i] = le32_to_cpu(res[i]);
+
+        return 0;
+}
+
+int ar9170_read_reg(struct ar9170 *ar, u32 reg, u32 *val)
+{
+        return ar9170_read_mreg(ar, 1, &reg, val);
+}
+
+int ar9170_echo_test(struct ar9170 *ar, u32 v)
+{
+        __le32 echobuf = cpu_to_le32(v);
+        __le32 echores;
+        int err;
+
+        if (unlikely(!IS_ACCEPTING_CMD(ar)))
+                return -ENODEV;
+
+        err = ar->exec_cmd(ar, AR9170_CMD_ECHO,
+                           4, (u8 *)&echobuf,
+                           4, (u8 *)&echores);
+        if (err)
+                return err;
+
+        if (echobuf != echores)
+                return -EINVAL;
+
+        return 0;
+}
diff --git a/drivers/net/wireless/ar9170/cmd.h b/drivers/net/wireless/ar9170/cmd.h
new file mode 100644
index 000000000000..a4f0e50e52b4
--- /dev/null
+++ b/drivers/net/wireless/ar9170/cmd.h
@@ -0,0 +1,91 @@
+/*
+ * Atheros AR9170 driver
+ *
+ * Basic HW register/memory/command access functions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __CMD_H
+#define __CMD_H
+
+#include "ar9170.h"
+
+/* basic HW access */
+int ar9170_write_mem(struct ar9170 *ar, const __le32 *data, size_t len);
+int ar9170_write_reg(struct ar9170 *ar, const u32 reg, const u32 val);
+int ar9170_read_reg(struct ar9170 *ar, u32 reg, u32 *val);
+int ar9170_echo_test(struct ar9170 *ar, u32 v);
+
+/*
+ * Macros to facilitate writing multiple registers in a single
+ * write-combining USB command. Note that when the first group
+ * fails the whole thing will fail without any others attempted,
+ * but you won't know which write in the group failed.
+ */
+#define ar9170_regwrite_begin(ar)                                       \
+do {                                                                    \
+        int __nreg = 0, __err = 0;                                      \
+        struct ar9170 *__ar = ar;
+
+#define ar9170_regwrite(r, v) do {                                      \
+        __ar->cmdbuf[2 * __nreg + 1] = cpu_to_le32(r);                  \
+        __ar->cmdbuf[2 * __nreg + 2] = cpu_to_le32(v);                  \
+        __nreg++;                                                       \
+        if ((__nreg >= PAYLOAD_MAX/2)) {                                \
+                if (IS_ACCEPTING_CMD(__ar))                             \
+                        __err = ar->exec_cmd(__ar, AR9170_CMD_WREG,     \
+                                             8 * __nreg,                \
+                                             (u8 *) &__ar->cmdbuf[1],   \
+                                             0, NULL);                  \
+                __nreg = 0;                                             \
+                if (__err)                                              \
+                        goto __regwrite_out;                            \
+        }                                                               \
+} while (0)
+
+#define ar9170_regwrite_finish()                                        \
+__regwrite_out :                                                        \
+        if (__nreg) {                                                   \
+                if (IS_ACCEPTING_CMD(__ar))                             \
+                        __err = ar->exec_cmd(__ar, AR9170_CMD_WREG,     \
+                                             8 * __nreg,                \
+                                             (u8 *) &__ar->cmdbuf[1],   \
+                                             0, NULL);                  \
+                __nreg = 0;                                             \
+        }
+
+#define ar9170_regwrite_result()                                        \
+        __err;                                                          \
+} while (0);
+
+#endif /* __CMD_H */
diff --git a/drivers/net/wireless/ar9170/eeprom.h b/drivers/net/wireless/ar9170/eeprom.h
new file mode 100644
index 000000000000..d2c8cc83f1dd
--- /dev/null
+++ b/drivers/net/wireless/ar9170/eeprom.h
@@ -0,0 +1,179 @@
+/*
+ * Atheros AR9170 driver
+ *
+ * EEPROM layout
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __AR9170_EEPROM_H
+#define __AR9170_EEPROM_H
+
+#define AR5416_MAX_CHAINS               2
+#define AR5416_MODAL_SPURS              5
+
+struct ar9170_eeprom_modal {
+        __le32  antCtrlChain[AR5416_MAX_CHAINS];
+        __le32  antCtrlCommon;
+        s8      antennaGainCh[AR5416_MAX_CHAINS];
+        u8      switchSettling;
+        u8      txRxAttenCh[AR5416_MAX_CHAINS];
+        u8      rxTxMarginCh[AR5416_MAX_CHAINS];
+        s8      adcDesiredSize;
+        s8      pgaDesiredSize;
+        u8      xlnaGainCh[AR5416_MAX_CHAINS];
+        u8      txEndToXpaOff;
+        u8      txEndToRxOn;
+        u8      txFrameToXpaOn;
+        u8      thresh62;
+        s8      noiseFloorThreshCh[AR5416_MAX_CHAINS];
+        u8      xpdGain;
+        u8      xpd;
+        s8      iqCalICh[AR5416_MAX_CHAINS];
+        s8      iqCalQCh[AR5416_MAX_CHAINS];
+        u8      pdGainOverlap;
+        u8      ob;
+        u8      db;
+        u8      xpaBiasLvl;
+        u8      pwrDecreaseFor2Chain;
+        u8      pwrDecreaseFor3Chain;
+        u8      txFrameToDataStart;
+        u8      txFrameToPaOn;
+        u8      ht40PowerIncForPdadc;
+        u8      bswAtten[AR5416_MAX_CHAINS];
+        u8      bswMargin[AR5416_MAX_CHAINS];
+        u8      swSettleHt40;
+        u8      reserved[22];
+        struct spur_channel {
+                __le16 spurChan;
+                u8      spurRangeLow;
+                u8      spurRangeHigh;
+        } __packed spur_channels[AR5416_MODAL_SPURS];
+} __packed;
+
+#define AR5416_NUM_PD_GAINS             4
+#define AR5416_PD_GAIN_ICEPTS           5
+
+struct ar9170_calibration_data_per_freq {
+        u8      pwr_pdg[AR5416_NUM_PD_GAINS][AR5416_PD_GAIN_ICEPTS];
+        u8      vpd_pdg[AR5416_NUM_PD_GAINS][AR5416_PD_GAIN_ICEPTS];
+} __packed;
+
+#define AR5416_NUM_5G_CAL_PIERS         8
+#define AR5416_NUM_2G_CAL_PIERS         4
+
+#define AR5416_NUM_5G_TARGET_PWRS       8
+#define AR5416_NUM_2G_CCK_TARGET_PWRS   3
+#define AR5416_NUM_2G_OFDM_TARGET_PWRS  4
+#define AR5416_MAX_NUM_TGT_PWRS         8
+
+struct ar9170_calibration_target_power_legacy {
+        u8      freq;
+        u8      power[4];
+} __packed;
+
+struct ar9170_calibration_target_power_ht {
+        u8      freq;
+        u8      power[8];
+} __packed;
+
+#define AR5416_NUM_CTLS                 24
+
+struct ar9170_calctl_edges {
+        u8      channel;
+#define AR9170_CALCTL_EDGE_FLAGS        0xC0
+        u8      power_flags;
+} __packed;
+
+#define AR5416_NUM_BAND_EDGES           8
+
+struct ar9170_calctl_data {
+        struct ar9170_calctl_edges
+                control_edges[AR5416_MAX_CHAINS][AR5416_NUM_BAND_EDGES];
+} __packed;
+
+
+struct ar9170_eeprom {
+        __le16  length;
+        __le16  checksum;
+        __le16  version;
+        u8      operating_flags;
+#define AR9170_OPFLAG_5GHZ              1
+#define AR9170_OPFLAG_2GHZ              2
+        u8      misc;
+        __le16  reg_domain[2];
+        u8      mac_address[6];
+        u8      rx_mask;
+        u8      tx_mask;
+        __le16  rf_silent;
+        __le16  bluetooth_options;
+        __le16  device_capabilities;
+        __le32  build_number;
+        u8      deviceType;
+        u8      reserved[33];
+
+        u8      customer_data[64];
+
+        struct ar9170_eeprom_modal
+                modal_header[2];
+
+        u8      cal_freq_pier_5G[AR5416_NUM_5G_CAL_PIERS];
+        u8      cal_freq_pier_2G[AR5416_NUM_2G_CAL_PIERS];
+
+        struct ar9170_calibration_data_per_freq
+                cal_pier_data_5G[AR5416_MAX_CHAINS][AR5416_NUM_5G_CAL_PIERS],
+                cal_pier_data_2G[AR5416_MAX_CHAINS][AR5416_NUM_2G_CAL_PIERS];
+
+        /* power calibration data */
+        struct ar9170_calibration_target_power_legacy
+                cal_tgt_pwr_5G[AR5416_NUM_5G_TARGET_PWRS];
+        struct ar9170_calibration_target_power_ht
+                cal_tgt_pwr_5G_ht20[AR5416_NUM_5G_TARGET_PWRS],
+                cal_tgt_pwr_5G_ht40[AR5416_NUM_5G_TARGET_PWRS];
+
+        struct ar9170_calibration_target_power_legacy
+                cal_tgt_pwr_2G_cck[AR5416_NUM_2G_CCK_TARGET_PWRS],
+                cal_tgt_pwr_2G_ofdm[AR5416_NUM_2G_OFDM_TARGET_PWRS];
+        struct ar9170_calibration_target_power_ht
+                cal_tgt_pwr_2G_ht20[AR5416_NUM_2G_OFDM_TARGET_PWRS],
+                cal_tgt_pwr_2G_ht40[AR5416_NUM_2G_OFDM_TARGET_PWRS];
+
+        /* conformance testing limits */
+        u8      ctl_index[AR5416_NUM_CTLS];
+        struct ar9170_calctl_data
+                ctl_data[AR5416_NUM_CTLS];
+
+        u8      pad;
+        __le16  subsystem_id;
+} __packed;
+
+#endif /* __AR9170_EEPROM_H */
diff --git a/drivers/net/wireless/ar9170/hw.h b/drivers/net/wireless/ar9170/hw.h
new file mode 100644
index 000000000000..13091bd9d815
--- /dev/null
+++ b/drivers/net/wireless/ar9170/hw.h
@@ -0,0 +1,417 @@
+/*
+ * Atheros AR9170 driver
+ *
+ * Hardware-specific definitions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __AR9170_HW_H
+#define __AR9170_HW_H
+
+#define AR9170_MAX_CMD_LEN      64
+
+enum ar9170_cmd {
+        AR9170_CMD_RREG         = 0x00,
+        AR9170_CMD_WREG         = 0x01,
+        AR9170_CMD_RMEM         = 0x02,
+        AR9170_CMD_WMEM         = 0x03,
+        AR9170_CMD_BITAND       = 0x04,
+        AR9170_CMD_BITOR        = 0x05,
+        AR9170_CMD_EKEY         = 0x28,
+        AR9170_CMD_DKEY         = 0x29,
+        AR9170_CMD_FREQUENCY    = 0x30,
+        AR9170_CMD_RF_INIT      = 0x31,
+        AR9170_CMD_SYNTH        = 0x32,
+        AR9170_CMD_FREQ_START   = 0x33,
+        AR9170_CMD_ECHO         = 0x80,
+        AR9170_CMD_TALLY        = 0x81,
+        AR9170_CMD_TALLY_APD    = 0x82,
+        AR9170_CMD_CONFIG       = 0x83,
+        AR9170_CMD_RESET        = 0x90,
+        AR9170_CMD_DKRESET      = 0x91,
+        AR9170_CMD_DKTX_STATUS  = 0x92,
+        AR9170_CMD_FDC          = 0xA0,
+        AR9170_CMD_WREEPROM     = 0xB0,
+        AR9170_CMD_WFLASH       = 0xB0,
+        AR9170_CMD_FLASH_ERASE  = 0xB1,
+        AR9170_CMD_FLASH_PROG   = 0xB2,
+        AR9170_CMD_FLASH_CHKSUM = 0xB3,
+        AR9170_CMD_FLASH_READ   = 0xB4,
+        AR9170_CMD_FW_DL_INIT   = 0xB5,
+        AR9170_CMD_MEM_WREEPROM = 0xBB,
+};
+
+/* endpoints */
+#define AR9170_EP_TX                            1
+#define AR9170_EP_RX                            2
+#define AR9170_EP_IRQ                           3
+#define AR9170_EP_CMD                           4
+
+#define AR9170_EEPROM_START                     0x1600
+
+#define AR9170_GPIO_REG_BASE                    0x1d0100
+#define AR9170_GPIO_REG_PORT_TYPE               AR9170_GPIO_REG_BASE
+#define AR9170_GPIO_REG_DATA                    (AR9170_GPIO_REG_BASE + 4)
+#define AR9170_NUM_LEDS                         2
+
+
+#define AR9170_USB_REG_BASE                     0x1e1000
+#define AR9170_USB_REG_DMA_CTL                  (AR9170_USB_REG_BASE + 0x108)
+#define         AR9170_DMA_CTL_ENABLE_TO_DEVICE         0x1
+#define         AR9170_DMA_CTL_ENABLE_FROM_DEVICE       0x2
+#define         AR9170_DMA_CTL_HIGH_SPEED               0x4
+#define         AR9170_DMA_CTL_PACKET_MODE              0x8
+
+#define AR9170_USB_REG_MAX_AGG_UPLOAD           (AR9170_USB_REG_BASE + 0x110)
+#define AR9170_USB_REG_UPLOAD_TIME_CTL          (AR9170_USB_REG_BASE + 0x114)
+
+
+
+#define AR9170_MAC_REG_BASE                     0x1c3000
+
+#define AR9170_MAC_REG_TSF_L                    (AR9170_MAC_REG_BASE + 0x514)
+#define AR9170_MAC_REG_TSF_H                    (AR9170_MAC_REG_BASE + 0x518)
+
+#define AR9170_MAC_REG_ATIM_WINDOW              (AR9170_MAC_REG_BASE + 0x51C)
+#define AR9170_MAC_REG_BCN_PERIOD               (AR9170_MAC_REG_BASE + 0x520)
+#define AR9170_MAC_REG_PRETBTT                  (AR9170_MAC_REG_BASE + 0x524)
+
+#define AR9170_MAC_REG_MAC_ADDR_L               (AR9170_MAC_REG_BASE + 0x610)
+#define AR9170_MAC_REG_MAC_ADDR_H               (AR9170_MAC_REG_BASE + 0x614)
+#define AR9170_MAC_REG_BSSID_L                  (AR9170_MAC_REG_BASE + 0x618)
+#define AR9170_MAC_REG_BSSID_H                  (AR9170_MAC_REG_BASE + 0x61c)
+
+#define AR9170_MAC_REG_GROUP_HASH_TBL_L         (AR9170_MAC_REG_BASE + 0x624)
+#define AR9170_MAC_REG_GROUP_HASH_TBL_H         (AR9170_MAC_REG_BASE + 0x628)
+
+#define AR9170_MAC_REG_RX_TIMEOUT               (AR9170_MAC_REG_BASE + 0x62C)
+
+#define AR9170_MAC_REG_BASIC_RATE               (AR9170_MAC_REG_BASE + 0x630)
+#define AR9170_MAC_REG_MANDATORY_RATE           (AR9170_MAC_REG_BASE + 0x634)
+#define AR9170_MAC_REG_RTS_CTS_RATE             (AR9170_MAC_REG_BASE + 0x638)
+#define AR9170_MAC_REG_BACKOFF_PROTECT          (AR9170_MAC_REG_BASE + 0x63c)
+#define AR9170_MAC_REG_RX_THRESHOLD             (AR9170_MAC_REG_BASE + 0x640)
+#define AR9170_MAC_REG_RX_PE_DELAY              (AR9170_MAC_REG_BASE + 0x64C)
+
+#define AR9170_MAC_REG_DYNAMIC_SIFS_ACK         (AR9170_MAC_REG_BASE + 0x658)
+#define AR9170_MAC_REG_SNIFFER                  (AR9170_MAC_REG_BASE + 0x674)
+#define         AR9170_MAC_REG_SNIFFER_ENABLE_PROMISC   BIT(0)
+#define         AR9170_MAC_REG_SNIFFER_DEFAULTS         0x02000000
+#define AR9170_MAC_REG_ENCRYPTION               (AR9170_MAC_REG_BASE + 0x678)
+#define         AR9170_MAC_REG_ENCRYPTION_RX_SOFTWARE   BIT(3)
+#define         AR9170_MAC_REG_ENCRYPTION_DEFAULTS      0x70
+
+#define AR9170_MAC_REG_MISC_680                 (AR9170_MAC_REG_BASE + 0x680)
+#define AR9170_MAC_REG_TX_UNDERRUN              (AR9170_MAC_REG_BASE + 0x688)
+
+#define AR9170_MAC_REG_FRAMETYPE_FILTER         (AR9170_MAC_REG_BASE + 0x68c)
+#define         AR9170_MAC_REG_FTF_ASSOC_REQ            BIT(0)
+#define         AR9170_MAC_REG_FTF_ASSOC_RESP           BIT(1)
+#define         AR9170_MAC_REG_FTF_REASSOC_REQ          BIT(2)
+#define         AR9170_MAC_REG_FTF_REASSOC_RESP         BIT(3)
+#define         AR9170_MAC_REG_FTF_PRB_REQ              BIT(4)
+#define         AR9170_MAC_REG_FTF_PRB_RESP             BIT(5)
+#define         AR9170_MAC_REG_FTF_BIT6                 BIT(6)
+#define         AR9170_MAC_REG_FTF_BIT7                 BIT(7)
+#define         AR9170_MAC_REG_FTF_BEACON               BIT(8)
+#define         AR9170_MAC_REG_FTF_ATIM                 BIT(9)
+#define         AR9170_MAC_REG_FTF_DEASSOC              BIT(10)
+#define         AR9170_MAC_REG_FTF_AUTH                 BIT(11)
+#define         AR9170_MAC_REG_FTF_DEAUTH               BIT(12)
+#define         AR9170_MAC_REG_FTF_BIT13                BIT(13)
+#define         AR9170_MAC_REG_FTF_BIT14                BIT(14)
+#define         AR9170_MAC_REG_FTF_BIT15                BIT(15)
+#define         AR9170_MAC_REG_FTF_BAR                  BIT(24)
+#define         AR9170_MAC_REG_FTF_BIT25                BIT(25)
+#define         AR9170_MAC_REG_FTF_PSPOLL               BIT(26)
+#define         AR9170_MAC_REG_FTF_RTS                  BIT(27)
+#define         AR9170_MAC_REG_FTF_CTS                  BIT(28)
+#define         AR9170_MAC_REG_FTF_ACK                  BIT(29)
+#define         AR9170_MAC_REG_FTF_CFE                  BIT(30)
+#define         AR9170_MAC_REG_FTF_CFE_ACK              BIT(31)
+#define         AR9170_MAC_REG_FTF_DEFAULTS             0x0500ffff
+#define         AR9170_MAC_REG_FTF_MONITOR              0xfd00ffff
+
+#define AR9170_MAC_REG_RX_TOTAL                 (AR9170_MAC_REG_BASE + 0x6A0)
+#define AR9170_MAC_REG_RX_CRC32                 (AR9170_MAC_REG_BASE + 0x6A4)
+#define AR9170_MAC_REG_RX_CRC16                 (AR9170_MAC_REG_BASE + 0x6A8)
+#define AR9170_MAC_REG_RX_ERR_DECRYPTION_UNI    (AR9170_MAC_REG_BASE + 0x6AC)
+#define AR9170_MAC_REG_RX_OVERRUN               (AR9170_MAC_REG_BASE + 0x6B0)
+#define AR9170_MAC_REG_RX_ERR_DECRYPTION_MUL    (AR9170_MAC_REG_BASE + 0x6BC)
+#define AR9170_MAC_REG_TX_RETRY                 (AR9170_MAC_REG_BASE + 0x6CC)
+#define AR9170_MAC_REG_TX_TOTAL                 (AR9170_MAC_REG_BASE + 0x6F4)
+
+
+#define AR9170_MAC_REG_ACK_EXTENSION            (AR9170_MAC_REG_BASE + 0x690)
+#define AR9170_MAC_REG_EIFS_AND_SIFS            (AR9170_MAC_REG_BASE + 0x698)
+
+#define AR9170_MAC_REG_SLOT_TIME                (AR9170_MAC_REG_BASE + 0x6F0)
+
+#define AR9170_MAC_REG_POWERMANAGEMENT          (AR9170_MAC_REG_BASE + 0x700)
+#define         AR9170_MAC_REG_POWERMGT_IBSS            0xe0
+#define         AR9170_MAC_REG_POWERMGT_AP              0xa1
+#define         AR9170_MAC_REG_POWERMGT_STA             0x2
+#define         AR9170_MAC_REG_POWERMGT_AP_WDS          0x3
+#define         AR9170_MAC_REG_POWERMGT_DEFAULTS        (0xf << 24)
+
+#define AR9170_MAC_REG_ROLL_CALL_TBL_L          (AR9170_MAC_REG_BASE + 0x704)
+#define AR9170_MAC_REG_ROLL_CALL_TBL_H          (AR9170_MAC_REG_BASE + 0x708)
+
+#define AR9170_MAC_REG_AC0_CW                   (AR9170_MAC_REG_BASE + 0xB00)
+#define AR9170_MAC_REG_AC1_CW                   (AR9170_MAC_REG_BASE + 0xB04)
+#define AR9170_MAC_REG_AC2_CW                   (AR9170_MAC_REG_BASE + 0xB08)
+#define AR9170_MAC_REG_AC3_CW                   (AR9170_MAC_REG_BASE + 0xB0C)
+#define AR9170_MAC_REG_AC4_CW                   (AR9170_MAC_REG_BASE + 0xB10)
+#define AR9170_MAC_REG_AC1_AC0_AIFS             (AR9170_MAC_REG_BASE + 0xB14)
+#define AR9170_MAC_REG_AC3_AC2_AIFS             (AR9170_MAC_REG_BASE + 0xB18)
+
+#define AR9170_MAC_REG_RETRY_MAX                (AR9170_MAC_REG_BASE + 0xB28)
+
+#define AR9170_MAC_REG_FCS_SELECT               (AR9170_MAC_REG_BASE + 0xBB0)
+#define         AR9170_MAC_FCS_SWFCS            0x1
+#define         AR9170_MAC_FCS_FIFO_PROT        0x4
+
+
+#define AR9170_MAC_REG_TXOP_NOT_ENOUGH_IND      (AR9170_MAC_REG_BASE + 0xB30)
+
+#define AR9170_MAC_REG_AC1_AC0_TXOP             (AR9170_MAC_REG_BASE + 0xB44)
+#define AR9170_MAC_REG_AC3_AC2_TXOP             (AR9170_MAC_REG_BASE + 0xB48)
+
+#define AR9170_MAC_REG_ACK_TABLE                (AR9170_MAC_REG_BASE + 0xC00)
+#define AR9170_MAC_REG_AMPDU_RX_THRESH          (AR9170_MAC_REG_BASE + 0xC50)
+
+#define AR9170_MAC_REG_TXRX_MPI                 (AR9170_MAC_REG_BASE + 0xD7C)
+#define         AR9170_MAC_TXRX_MPI_TX_MPI_MASK 0x0000000f
+#define         AR9170_MAC_TXRX_MPI_TX_TO_MASK  0x0000fff0
+#define         AR9170_MAC_TXRX_MPI_RX_MPI_MASK 0x000f0000
+#define         AR9170_MAC_TXRX_MPI_RX_TO_MASK  0xfff00000
+
+#define AR9170_MAC_REG_BCN_ADDR                 (AR9170_MAC_REG_BASE + 0xD84)
+#define AR9170_MAC_REG_BCN_LENGTH               (AR9170_MAC_REG_BASE + 0xD88)
+#define AR9170_MAC_REG_BCN_PLCP                 (AR9170_MAC_REG_BASE + 0xD90)
+#define AR9170_MAC_REG_BCN_CTRL                 (AR9170_MAC_REG_BASE + 0xD94)
+#define AR9170_MAC_REG_BCN_HT1                  (AR9170_MAC_REG_BASE + 0xDA0)
+#define AR9170_MAC_REG_BCN_HT2                  (AR9170_MAC_REG_BASE + 0xDA4)
+
+
+#define AR9170_PWR_REG_BASE                     0x1D4000
+
+#define AR9170_PWR_REG_CLOCK_SEL                (AR9170_PWR_REG_BASE + 0x008)
+#define         AR9170_PWR_CLK_AHB_40MHZ        0
+#define         AR9170_PWR_CLK_AHB_20_22MHZ     1
+#define         AR9170_PWR_CLK_AHB_40_44MHZ     2
+#define         AR9170_PWR_CLK_AHB_80_88MHZ     3
+#define         AR9170_PWR_CLK_DAC_160_INV_DLY  0x70
+
+
+/* put beacon here in memory */
+#define AR9170_BEACON_BUFFER_ADDRESS            0x117900
+
+
+struct ar9170_tx_control {
+        __le16 length;
+        __le16 mac_control;
+        __le32 phy_control;
+        u8 frame_data[0];
+} __packed;
+
+/* these are either-or */
+#define AR9170_TX_MAC_PROT_RTS                  0x0001
+#define AR9170_TX_MAC_PROT_CTS                  0x0002
+
+#define AR9170_TX_MAC_NO_ACK                    0x0004
+/* if unset, MAC will only do SIFS space before frame */
+#define AR9170_TX_MAC_BACKOFF                   0x0008
+#define AR9170_TX_MAC_BURST                     0x0010
+#define AR9170_TX_MAC_AGGR                      0x0020
+
+/* encryption is a two-bit field */
+#define AR9170_TX_MAC_ENCR_NONE                 0x0000
+#define AR9170_TX_MAC_ENCR_RC4                  0x0040
+#define AR9170_TX_MAC_ENCR_CENC                 0x0080
+#define AR9170_TX_MAC_ENCR_AES                  0x00c0
+
+#define AR9170_TX_MAC_MMIC                      0x0100
+#define AR9170_TX_MAC_HW_DURATION               0x0200
+#define AR9170_TX_MAC_QOS_SHIFT                 10
+#define AR9170_TX_MAC_QOS_MASK                  (3 << AR9170_TX_MAC_QOS_SHIFT)
+#define AR9170_TX_MAC_AGGR_QOS_BIT1             0x0400
+#define AR9170_TX_MAC_AGGR_QOS_BIT2             0x0800
+#define AR9170_TX_MAC_DISABLE_TXOP              0x1000
+#define AR9170_TX_MAC_TXOP_RIFS                 0x2000
+#define AR9170_TX_MAC_IMM_AMPDU                 0x4000
+#define AR9170_TX_MAC_RATE_PROBE                0x8000
+
+/* either-or */
+#define AR9170_TX_PHY_MOD_CCK                   0x00000000
+#define AR9170_TX_PHY_MOD_OFDM                  0x00000001
+#define AR9170_TX_PHY_MOD_HT                    0x00000002
+
+/* depends on modulation */
+#define AR9170_TX_PHY_SHORT_PREAMBLE            0x00000004
+#define AR9170_TX_PHY_GREENFIELD                0x00000004
+
+#define AR9170_TX_PHY_BW_SHIFT                  3
+#define AR9170_TX_PHY_BW_MASK                   (3 << AR9170_TX_PHY_BW_SHIFT)
+#define AR9170_TX_PHY_BW_20MHZ                  0
+#define AR9170_TX_PHY_BW_40MHZ                  2
+#define AR9170_TX_PHY_BW_40MHZ_DUP              3
+
+#define AR9170_TX_PHY_TX_HEAVY_CLIP_SHIFT       6
+#define AR9170_TX_PHY_TX_HEAVY_CLIP_MASK        (7 << AR9170_TX_PHY_TX_HEAVY_CLIP_SHIFT)
+
+#define AR9170_TX_PHY_TX_PWR_SHIFT              9
+#define AR9170_TX_PHY_TX_PWR_MASK               (0x3f << AR9170_TX_PHY_TX_PWR_SHIFT)
+
+/* not part of the hw-spec */
+#define AR9170_TX_PHY_QOS_SHIFT                 25
+#define AR9170_TX_PHY_QOS_MASK                  (3 << AR9170_TX_PHY_QOS_SHIFT)
+
+#define AR9170_TX_PHY_TXCHAIN_SHIFT             15
+#define AR9170_TX_PHY_TXCHAIN_MASK              (7 << AR9170_TX_PHY_TXCHAIN_SHIFT)
+#define AR9170_TX_PHY_TXCHAIN_1                 1
+/* use for cck, ofdm 6/9/12/18/24 and HT if capable */
+#define AR9170_TX_PHY_TXCHAIN_2                 5
+
+#define AR9170_TX_PHY_MCS_SHIFT                 18
+#define AR9170_TX_PHY_MCS_MASK                  (0x7f << AR9170_TX_PHY_MCS_SHIFT)
+
+#define AR9170_TX_PHY_SHORT_GI                  0x80000000
+
+struct ar9170_rx_head {
+        u8 plcp[12];
+};
+
+struct ar9170_rx_tail {
+        union {
+                struct {
+                        u8 rssi_ant0, rssi_ant1, rssi_ant2,
+                           rssi_ant0x, rssi_ant1x, rssi_ant2x,
+                           rssi_combined;
+                };
+                u8 rssi[7];
+        };
+
+        u8 evm_stream0[6], evm_stream1[6];
+        u8 phy_err;
+        u8 SAidx, DAidx;
+        u8 error;
+        u8 status;
+};
+
+#define AR9170_ENC_ALG_NONE                     0x0
+#define AR9170_ENC_ALG_WEP64                    0x1
+#define AR9170_ENC_ALG_TKIP                     0x2
+#define AR9170_ENC_ALG_AESCCMP                  0x4
+#define AR9170_ENC_ALG_WEP128                   0x5
+#define AR9170_ENC_ALG_WEP256                   0x6
+#define AR9170_ENC_ALG_CENC                     0x7
+
+#define AR9170_RX_ENC_SOFTWARE                  0x8
+
+static inline u8 ar9170_get_decrypt_type(struct ar9170_rx_tail *t)
+{
+        return (t->SAidx & 0xc0) >> 4 |
+               (t->DAidx & 0xc0) >> 6;
+}
+
+#define AR9170_RX_STATUS_MODULATION_MASK        0x03
+#define AR9170_RX_STATUS_MODULATION_CCK         0x00
+#define AR9170_RX_STATUS_MODULATION_OFDM        0x01
+#define AR9170_RX_STATUS_MODULATION_HT          0x02
+#define AR9170_RX_STATUS_MODULATION_DUPOFDM     0x03
+
+/* depends on modulation */
+#define AR9170_RX_STATUS_SHORT_PREAMBLE         0x08
+#define AR9170_RX_STATUS_GREENFIELD             0x08
+
+#define AR9170_RX_STATUS_MPDU_MASK              0x30
+#define AR9170_RX_STATUS_MPDU_SINGLE            0x00
+#define AR9170_RX_STATUS_MPDU_FIRST             0x10
+#define AR9170_RX_STATUS_MPDU_MIDDLE            0x20
+#define AR9170_RX_STATUS_MPDU_LAST              0x30
+
+
+#define AR9170_RX_ERROR_RXTO                    0x01
+#define AR9170_RX_ERROR_OVERRUN                 0x02
+#define AR9170_RX_ERROR_DECRYPT                 0x04
+#define AR9170_RX_ERROR_FCS                     0x08
+#define AR9170_RX_ERROR_WRONG_RA                0x10
+#define AR9170_RX_ERROR_PLCP                    0x20
+#define AR9170_RX_ERROR_MMIC                    0x40
+
+struct ar9170_cmd_tx_status {
+        __le16 unkn;
+        u8 dst[ETH_ALEN];
+        __le32 rate;
+        __le16 status;
+} __packed;
+
+#define AR9170_TX_STATUS_COMPLETE               0x00
+#define AR9170_TX_STATUS_RETRY                  0x01
+#define AR9170_TX_STATUS_FAILED                 0x02
+
+struct ar9170_cmd_ba_failed_count {
+        __le16 failed;
+        __le16 rate;
+} __packed;
+
+struct ar9170_cmd_response {
+        u8 flag;
+        u8 type;
+
+        union {
+                struct ar9170_cmd_tx_status             tx_status;
+                struct ar9170_cmd_ba_failed_count       ba_fail_cnt;
+                u8 data[0];
+        };
+} __packed;
+
+/* QoS */
+
+/* mac80211 queue to HW/FW map */
+static const u8 ar9170_qos_hwmap[4] = { 3, 2, 0, 1 };
+
+/* HW/FW queue to mac80211 map */
+static const u8 ar9170_qos_mac80211map[4] = { 2, 3, 1, 0 };
+
+enum ar9170_txq {
+        AR9170_TXQ_BE,
+        AR9170_TXQ_BK,
+        AR9170_TXQ_VI,
+        AR9170_TXQ_VO,
+
+        __AR9170_NUM_TXQ,
+};
+
+#endif /* __AR9170_HW_H */
diff --git a/drivers/net/wireless/ar9170/led.c b/drivers/net/wireless/ar9170/led.c
new file mode 100644
index 000000000000..341cead7f606
--- /dev/null
+++ b/drivers/net/wireless/ar9170/led.c
@@ -0,0 +1,171 @@
+/*
+ * Atheros AR9170 driver
+ *
+ * LED handling
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ar9170.h"
+#include "cmd.h"
+
+int ar9170_set_leds_state(struct ar9170 *ar, u32 led_state)
+{
+        return ar9170_write_reg(ar, AR9170_GPIO_REG_DATA, led_state);
+}
+
+int ar9170_init_leds(struct ar9170 *ar)
+{
+        int err;
+
+        /* disable LEDs */
+        /* GPIO [0/1 mode: output, 2/3: input] */
+        err = ar9170_write_reg(ar, AR9170_GPIO_REG_PORT_TYPE, 3);
+        if (err)
+                goto out;
+
+        /* GPIO 0/1 value: off */
+        err = ar9170_set_leds_state(ar, 0);
+
+out:
+        return err;
+}
+
+#ifdef CONFIG_AR9170_LEDS
+static void ar9170_update_leds(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170, led_work.work);
+        int i, tmp, blink_delay = 1000;
+        u32 led_val = 0;
+        bool rerun = false;
+
+        if (unlikely(!IS_ACCEPTING_CMD(ar)))
+                return ;
+
+        mutex_lock(&ar->mutex);
+        for (i = 0; i < AR9170_NUM_LEDS; i++)
+                if (ar->leds[i].toggled) {
+                        led_val |= 1 << i;
+
+                        tmp = 70 + 200 / (ar->leds[i].toggled);
+                        if (tmp < blink_delay)
+                                blink_delay = tmp;
+
+                        if (ar->leds[i].toggled > 1)
+                                ar->leds[i].toggled = 0;
+
+                        rerun = true;
+                }
+
+        ar9170_set_leds_state(ar, led_val);
+        mutex_unlock(&ar->mutex);
+
+        if (rerun)
+                queue_delayed_work(ar->hw->workqueue, &ar->led_work,
+                                   msecs_to_jiffies(blink_delay));
+}
+
+static void ar9170_led_brightness_set(struct led_classdev *led,
+                                      enum led_brightness brightness)
+{
+        struct ar9170_led *arl = container_of(led, struct ar9170_led, l);
+        struct ar9170 *ar = arl->ar;
+
+        arl->toggled++;
+
+        if (likely(IS_ACCEPTING_CMD(ar) && brightness))
+                queue_delayed_work(ar->hw->workqueue, &ar->led_work, HZ/10);
+}
+
+static int ar9170_register_led(struct ar9170 *ar, int i, char *name,
+                               char *trigger)
+{
+        int err;
+
+        snprintf(ar->leds[i].name, sizeof(ar->leds[i].name),
+                 "ar9170-%s::%s", wiphy_name(ar->hw->wiphy), name);
+
+        ar->leds[i].ar = ar;
+        ar->leds[i].l.name = ar->leds[i].name;
+        ar->leds[i].l.brightness_set = ar9170_led_brightness_set;
+        ar->leds[i].l.brightness = 0;
+        ar->leds[i].l.default_trigger = trigger;
+
+        err = led_classdev_register(wiphy_dev(ar->hw->wiphy),
+                                    &ar->leds[i].l);
+        if (err)
+                printk(KERN_ERR "%s: failed to register %s LED (%d).\n",
+                       wiphy_name(ar->hw->wiphy), ar->leds[i].name, err);
+        else
+                ar->leds[i].registered = true;
+
+        return err;
+}
+
+void ar9170_unregister_leds(struct ar9170 *ar)
+{
+        int i;
+
+        cancel_delayed_work_sync(&ar->led_work);
+
+        for (i = 0; i < AR9170_NUM_LEDS; i++)
+                if (ar->leds[i].registered) {
+                        led_classdev_unregister(&ar->leds[i].l);
+                        ar->leds[i].registered = false;
+                }
+}
+
+int ar9170_register_leds(struct ar9170 *ar)
+{
+        int err;
+
+        INIT_DELAYED_WORK(&ar->led_work, ar9170_update_leds);
+
+        err = ar9170_register_led(ar, 0, "tx",
+                                  ieee80211_get_tx_led_name(ar->hw));
+        if (err)
+                goto fail;
+
+        err = ar9170_register_led(ar, 1, "assoc",
+                                 ieee80211_get_assoc_led_name(ar->hw));
+        if (err)
+                goto fail;
+
+        return 0;
+
+fail:
+        ar9170_unregister_leds(ar);
+        return err;
+}
+
+#endif /* CONFIG_AR9170_LEDS */
diff --git a/drivers/net/wireless/ar9170/mac.c b/drivers/net/wireless/ar9170/mac.c
new file mode 100644
index 000000000000..c8fa3073169f
--- /dev/null
+++ b/drivers/net/wireless/ar9170/mac.c
@@ -0,0 +1,452 @@
+/*
+ * Atheros AR9170 driver
+ *
+ * MAC programming
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include "ar9170.h"
+#include "cmd.h"
+
+int ar9170_set_qos(struct ar9170 *ar)
+{
+        ar9170_regwrite_begin(ar);
+
+        ar9170_regwrite(AR9170_MAC_REG_AC0_CW, ar->edcf[0].cw_min |
+                        (ar->edcf[0].cw_max << 16));
+        ar9170_regwrite(AR9170_MAC_REG_AC1_CW, ar->edcf[1].cw_min |
+                        (ar->edcf[1].cw_max << 16));
+        ar9170_regwrite(AR9170_MAC_REG_AC2_CW, ar->edcf[2].cw_min |
+                        (ar->edcf[2].cw_max << 16));
+        ar9170_regwrite(AR9170_MAC_REG_AC3_CW, ar->edcf[3].cw_min |
+                        (ar->edcf[3].cw_max << 16));
+        ar9170_regwrite(AR9170_MAC_REG_AC4_CW, ar->edcf[4].cw_min |
+                        (ar->edcf[4].cw_max << 16));
+
+        ar9170_regwrite(AR9170_MAC_REG_AC1_AC0_AIFS,
+                        ((ar->edcf[0].aifs * 9 + 10)) |
+                        ((ar->edcf[1].aifs * 9 + 10) << 12) |
+                        ((ar->edcf[2].aifs * 9 + 10) << 24));
+        ar9170_regwrite(AR9170_MAC_REG_AC3_AC2_AIFS,
+                        ((ar->edcf[2].aifs * 9 + 10) >> 8) |
+                        ((ar->edcf[3].aifs * 9 + 10) << 4) |
+                        ((ar->edcf[4].aifs * 9 + 10) << 16));
+
+        ar9170_regwrite(AR9170_MAC_REG_AC1_AC0_TXOP,
+                        ar->edcf[0].txop | ar->edcf[1].txop << 16);
+        ar9170_regwrite(AR9170_MAC_REG_AC3_AC2_TXOP,
+                        ar->edcf[1].txop | ar->edcf[3].txop << 16);
+
+        ar9170_regwrite_finish();
+
+        return ar9170_regwrite_result();
+}
+
+int ar9170_init_mac(struct ar9170 *ar)
+{
+        ar9170_regwrite_begin(ar);
+
+        ar9170_regwrite(AR9170_MAC_REG_ACK_EXTENSION, 0x40);
+
+        ar9170_regwrite(AR9170_MAC_REG_RETRY_MAX, 0);
+
+        /* enable MMIC */
+        ar9170_regwrite(AR9170_MAC_REG_SNIFFER,
+                        AR9170_MAC_REG_SNIFFER_DEFAULTS);
+
+        ar9170_regwrite(AR9170_MAC_REG_RX_THRESHOLD, 0xc1f80);
+
+        ar9170_regwrite(AR9170_MAC_REG_RX_PE_DELAY, 0x70);
+        ar9170_regwrite(AR9170_MAC_REG_EIFS_AND_SIFS, 0xa144000);
+        ar9170_regwrite(AR9170_MAC_REG_SLOT_TIME, 9 << 10);
+
+        /* CF-END mode */
+        ar9170_regwrite(0x1c3b2c, 0x19000000);
+
+        /* NAV protects ACK only (in TXOP) */
+        ar9170_regwrite(0x1c3b38, 0x201);
+
+        /* Set Beacon PHY CTRL's TPC to 0x7, TA1=1 */
+        /* OTUS set AM to 0x1 */
+        ar9170_regwrite(AR9170_MAC_REG_BCN_HT1, 0x8000170);
+
+        ar9170_regwrite(AR9170_MAC_REG_BACKOFF_PROTECT, 0x105);
+
+        /* AGG test code*/
+        /* Aggregation MAX number and timeout */
+        ar9170_regwrite(0x1c3b9c, 0x10000a);
+
+        ar9170_regwrite(AR9170_MAC_REG_FRAMETYPE_FILTER,
+                        AR9170_MAC_REG_FTF_DEFAULTS);
+
+        /* Enable deaggregator, response in sniffer mode */
+        ar9170_regwrite(0x1c3c40, 0x1 | 1<<30);
+
+        /* rate sets */
+        ar9170_regwrite(AR9170_MAC_REG_BASIC_RATE, 0x150f);
+        ar9170_regwrite(AR9170_MAC_REG_MANDATORY_RATE, 0x150f);
+        ar9170_regwrite(AR9170_MAC_REG_RTS_CTS_RATE, 0x10b01bb);
+
+        /* MIMO response control */
+        ar9170_regwrite(0x1c3694, 0x4003C1E);/* bit 26~28  otus-AM */
+
+        /* switch MAC to OTUS interface */
+        ar9170_regwrite(0x1c3600, 0x3);
+
+        ar9170_regwrite(AR9170_MAC_REG_AMPDU_RX_THRESH, 0xffff);
+
+        /* set PHY register read timeout (??) */
+        ar9170_regwrite(AR9170_MAC_REG_MISC_680, 0xf00008);
+
+        /* Disable Rx TimeOut, workaround for BB. */
+        ar9170_regwrite(AR9170_MAC_REG_RX_TIMEOUT, 0x0);
+
+        /* Set CPU clock frequency to 88/80MHz */
+        ar9170_regwrite(AR9170_PWR_REG_CLOCK_SEL,
+                        AR9170_PWR_CLK_AHB_80_88MHZ |
+                        AR9170_PWR_CLK_DAC_160_INV_DLY);
+
+        /* Set WLAN DMA interrupt mode: generate int per packet */
+        ar9170_regwrite(AR9170_MAC_REG_TXRX_MPI, 0x110011);
+
+        ar9170_regwrite(AR9170_MAC_REG_FCS_SELECT,
+                        AR9170_MAC_FCS_FIFO_PROT);
+
+        /* Disables the CF_END frame, undocumented register */
+        ar9170_regwrite(AR9170_MAC_REG_TXOP_NOT_ENOUGH_IND,
+                        0x141E0F48);
+
+        ar9170_regwrite_finish();
+
+        return ar9170_regwrite_result();
+}
+
+static int ar9170_set_mac_reg(struct ar9170 *ar, const u32 reg, const u8 *mac)
+{
+        static const u8 zero[ETH_ALEN] = { 0 };
+
+        if (!mac)
+                mac = zero;
+
+        ar9170_regwrite_begin(ar);
+
+        ar9170_regwrite(reg,
+                        (mac[3] << 24) | (mac[2] << 16) |
+                        (mac[1] << 8) | mac[0]);
+
+        ar9170_regwrite(reg + 4, (mac[5] << 8) | mac[4]);
+
+        ar9170_regwrite_finish();
+
+        return ar9170_regwrite_result();
+}
+
+int ar9170_update_multicast(struct ar9170 *ar)
+{
+        int err;
+
+        ar9170_regwrite_begin(ar);
+        ar9170_regwrite(AR9170_MAC_REG_GROUP_HASH_TBL_H,
+                ar->want_mc_hash >> 32);
+        ar9170_regwrite(AR9170_MAC_REG_GROUP_HASH_TBL_L,
+                ar->want_mc_hash);
+
+        ar9170_regwrite_finish();
+        err = ar9170_regwrite_result();
+
+        if (err)
+                return err;
+
+        ar->cur_mc_hash = ar->want_mc_hash;
+
+        return 0;
+}
+
+int ar9170_update_frame_filter(struct ar9170 *ar)
+{
+        int err;
+
+        err = ar9170_write_reg(ar, AR9170_MAC_REG_FRAMETYPE_FILTER,
+                               ar->want_filter);
+
+        if (err)
+                return err;
+
+        ar->cur_filter = ar->want_filter;
+
+        return 0;
+}
+
+static int ar9170_set_promiscouous(struct ar9170 *ar)
+{
+        u32 encr_mode, sniffer;
+        int err;
+
+        err = ar9170_read_reg(ar, AR9170_MAC_REG_SNIFFER, &sniffer);
+        if (err)
+                return err;
+
+        err = ar9170_read_reg(ar, AR9170_MAC_REG_ENCRYPTION, &encr_mode);
+        if (err)
+                return err;
+
+        if (ar->sniffer_enabled) {
+                sniffer |= AR9170_MAC_REG_SNIFFER_ENABLE_PROMISC;
+
+                /*
+                 * Rx decryption works in place.
+                 *
+                 * If we don't disable it, the hardware will render all
+                 * encrypted frames which are encrypted with an unknown
+                 * key useless.
+                 */
+
+                encr_mode |= AR9170_MAC_REG_ENCRYPTION_RX_SOFTWARE;
+                ar->sniffer_enabled = true;
+        } else {
+                sniffer &= ~AR9170_MAC_REG_SNIFFER_ENABLE_PROMISC;
+
+                if (ar->rx_software_decryption)
+                        encr_mode |= AR9170_MAC_REG_ENCRYPTION_RX_SOFTWARE;
+                else
+                        encr_mode &= ~AR9170_MAC_REG_ENCRYPTION_RX_SOFTWARE;
+        }
+
+        ar9170_regwrite_begin(ar);
+        ar9170_regwrite(AR9170_MAC_REG_ENCRYPTION, encr_mode);
+        ar9170_regwrite(AR9170_MAC_REG_SNIFFER, sniffer);
+        ar9170_regwrite_finish();
+
+        return ar9170_regwrite_result();
+}
+
+int ar9170_set_operating_mode(struct ar9170 *ar)
+{
+        u32 pm_mode = AR9170_MAC_REG_POWERMGT_DEFAULTS;
+        u8 *mac_addr, *bssid;
+        int err;
+
+        if (ar->vif) {
+                mac_addr = ar->mac_addr;
+                bssid = ar->bssid;
+
+                switch (ar->vif->type) {
+                case NL80211_IFTYPE_MESH_POINT:
+                case NL80211_IFTYPE_ADHOC:
+                        pm_mode |= AR9170_MAC_REG_POWERMGT_IBSS;
+                        break;
+/*              case NL80211_IFTYPE_AP:
+                        pm_mode |= AR9170_MAC_REG_POWERMGT_AP;
+                        break;*/
+                case NL80211_IFTYPE_WDS:
+                        pm_mode |= AR9170_MAC_REG_POWERMGT_AP_WDS;
+                        break;
+                case NL80211_IFTYPE_MONITOR:
+                        ar->sniffer_enabled = true;
+                        ar->rx_software_decryption = true;
+                        break;
+                default:
+                        pm_mode |= AR9170_MAC_REG_POWERMGT_STA;
+                        break;
+                }
+        } else {
+                mac_addr = NULL;
+                bssid = NULL;
+        }
+
+        err = ar9170_set_mac_reg(ar, AR9170_MAC_REG_MAC_ADDR_L, mac_addr);
+        if (err)
+                return err;
+
+        err = ar9170_set_mac_reg(ar, AR9170_MAC_REG_BSSID_L, bssid);
+        if (err)
+                return err;
+
+        err = ar9170_set_promiscouous(ar);
+        if (err)
+                return err;
+
+        ar9170_regwrite_begin(ar);
+
+        ar9170_regwrite(AR9170_MAC_REG_POWERMANAGEMENT, pm_mode);
+        ar9170_regwrite_finish();
+
+        return ar9170_regwrite_result();
+}
+
+int ar9170_set_hwretry_limit(struct ar9170 *ar, unsigned int max_retry)
+{
+        u32 tmp = min_t(u32, 0x33333, max_retry * 0x11111);
+
+        return ar9170_write_reg(ar, AR9170_MAC_REG_RETRY_MAX, tmp);
+}
+
+int ar9170_set_beacon_timers(struct ar9170 *ar)
+{
+        u32 v = 0;
+        u32 pretbtt = 0;
+
+        v |= ar->hw->conf.beacon_int;
+
+        if (ar->vif) {
+                switch (ar->vif->type) {
+                case NL80211_IFTYPE_MESH_POINT:
+                case NL80211_IFTYPE_ADHOC:
+                        v |= BIT(25);
+                        break;
+                case NL80211_IFTYPE_AP:
+                        v |= BIT(24);
+                        pretbtt = (ar->hw->conf.beacon_int - 6) << 16;
+                        break;
+                default:
+                        break;
+                }
+
+                v |= ar->vif->bss_conf.dtim_period << 16;
+        }
+
+        ar9170_regwrite_begin(ar);
+
+        ar9170_regwrite(AR9170_MAC_REG_PRETBTT, pretbtt);
+        ar9170_regwrite(AR9170_MAC_REG_BCN_PERIOD, v);
+        ar9170_regwrite_finish();
+        return ar9170_regwrite_result();
+}
+
+int ar9170_update_beacon(struct ar9170 *ar)
+{
+        struct sk_buff *skb;
+        __le32 *data, *old = NULL;
+        u32 word;
+        int i;
+
+        skb = ieee80211_beacon_get(ar->hw, ar->vif);
+        if (!skb)
+                return -ENOMEM;
+
+        data = (__le32 *)skb->data;
+        if (ar->beacon)
+                old = (__le32 *)ar->beacon->data;
+
+        ar9170_regwrite_begin(ar);
+        for (i = 0; i < DIV_ROUND_UP(skb->len, 4); i++) {
+                /*
+                 * XXX: This accesses beyond skb data for up
+                 *      to the last 3 bytes!!
+                 */
+
+                if (old && (data[i] == old[i]))
+                        continue;
+
+                word = le32_to_cpu(data[i]);
+                ar9170_regwrite(AR9170_BEACON_BUFFER_ADDRESS + 4 * i, word);
+        }
+
+        /* XXX: use skb->cb info */
+        if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ)
+                ar9170_regwrite(AR9170_MAC_REG_BCN_PLCP,
+                                ((skb->len + 4) << (3+16)) + 0x0400);
+        else
+                ar9170_regwrite(AR9170_MAC_REG_BCN_PLCP,
+                                ((skb->len + 4) << (3+16)) + 0x0400);
+
+        ar9170_regwrite(AR9170_MAC_REG_BCN_LENGTH, skb->len + 4);
+        ar9170_regwrite(AR9170_MAC_REG_BCN_ADDR, AR9170_BEACON_BUFFER_ADDRESS);
+        ar9170_regwrite(AR9170_MAC_REG_BCN_CTRL, 1);
+
+        ar9170_regwrite_finish();
+
+        dev_kfree_skb(ar->beacon);
+        ar->beacon = skb;
+
+        return ar9170_regwrite_result();
+}
+
+void ar9170_new_beacon(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170,
+                                         beacon_work);
+        struct sk_buff *skb;
+
+        if (unlikely(!IS_STARTED(ar)))
+                return ;
+
+        mutex_lock(&ar->mutex);
+
+        if (!ar->vif)
+                goto out;
+
+        ar9170_update_beacon(ar);
+
+        rcu_read_lock();
+        while ((skb = ieee80211_get_buffered_bc(ar->hw, ar->vif)))
+                ar9170_op_tx(ar->hw, skb);
+
+        rcu_read_unlock();
+
+ out:
+        mutex_unlock(&ar->mutex);
+}
+
+int ar9170_upload_key(struct ar9170 *ar, u8 id, const u8 *mac, u8 ktype,
+                      u8 keyidx, u8 *keydata, int keylen)
+{
+        __le32 vals[7];
+        static const u8 bcast[ETH_ALEN] =
+                { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+        u8 dummy;
+
+        mac = mac ? : bcast;
+
+        vals[0] = cpu_to_le32((keyidx << 16) + id);
+        vals[1] = cpu_to_le32(mac[1] << 24 | mac[0] << 16 | ktype);
+        vals[2] = cpu_to_le32(mac[5] << 24 | mac[4] << 16 |
+                              mac[3] << 8 | mac[2]);
+        memset(&vals[3], 0, 16);
+        if (keydata)
+                memcpy(&vals[3], keydata, keylen);
+
+        return ar->exec_cmd(ar, AR9170_CMD_EKEY,
+                            sizeof(vals), (u8 *)vals,
+                            1, &dummy);
+}
+
+int ar9170_disable_key(struct ar9170 *ar, u8 id)
+{
+        __le32 val = cpu_to_le32(id);
+        u8 dummy;
+
+        return ar->exec_cmd(ar, AR9170_CMD_EKEY,
+                            sizeof(val), (u8 *)&val,
+                            1, &dummy);
+}
diff --git a/drivers/net/wireless/ar9170/main.c b/drivers/net/wireless/ar9170/main.c
new file mode 100644
index 000000000000..5996ff9f7f47
--- /dev/null
+++ b/drivers/net/wireless/ar9170/main.c
@@ -0,0 +1,1671 @@
+/*
+ * Atheros AR9170 driver
+ *
+ * mac80211 interaction code
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, Christian Lamparter <chunkeey@web.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <net/mac80211.h>
+#include "ar9170.h"
+#include "hw.h"
+#include "cmd.h"
+
+static int modparam_nohwcrypt;
+module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
+MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
+
+#define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
+        .bitrate        = (_bitrate),                   \
+        .flags          = (_flags),                     \
+        .hw_value       = (_hw_rate) | (_txpidx) << 4,  \
+}
+
+static struct ieee80211_rate __ar9170_ratetable[] = {
+        RATE(10, 0, 0, 0),
+        RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(60, 0xb, 0, 0),
+        RATE(90, 0xf, 0, 0),
+        RATE(120, 0xa, 0, 0),
+        RATE(180, 0xe, 0, 0),
+        RATE(240, 0x9, 0, 0),
+        RATE(360, 0xd, 1, 0),
+        RATE(480, 0x8, 2, 0),
+        RATE(540, 0xc, 3, 0),
+};
+#undef RATE
+
+#define ar9170_g_ratetable      (__ar9170_ratetable + 0)
+#define ar9170_g_ratetable_size 12
+#define ar9170_a_ratetable      (__ar9170_ratetable + 4)
+#define ar9170_a_ratetable_size 8
+
+/*
+ * NB: The hw_value is used as an index into the ar9170_phy_freq_params
+ *     array in phy.c so that we don't have to do frequency lookups!
+ */
+#define CHAN(_freq, _idx) {             \
+        .center_freq    = (_freq),      \
+        .hw_value       = (_idx),       \
+        .max_power      = 18, /* XXX */ \
+}
+
+static struct ieee80211_channel ar9170_2ghz_chantable[] = {
+        CHAN(2412,  0),
+        CHAN(2417,  1),
+        CHAN(2422,  2),
+        CHAN(2427,  3),
+        CHAN(2432,  4),
+        CHAN(2437,  5),
+        CHAN(2442,  6),
+        CHAN(2447,  7),
+        CHAN(2452,  8),
+        CHAN(2457,  9),
+        CHAN(2462, 10),
+        CHAN(2467, 11),
+        CHAN(2472, 12),
+        CHAN(2484, 13),
+};
+
+static struct ieee80211_channel ar9170_5ghz_chantable[] = {
+        CHAN(4920, 14),
+        CHAN(4940, 15),
+        CHAN(4960, 16),
+        CHAN(4980, 17),
+        CHAN(5040, 18),
+        CHAN(5060, 19),
+        CHAN(5080, 20),
+        CHAN(5180, 21),
+        CHAN(5200, 22),
+        CHAN(5220, 23),
+        CHAN(5240, 24),
+        CHAN(5260, 25),
+        CHAN(5280, 26),
+        CHAN(5300, 27),
+        CHAN(5320, 28),
+        CHAN(5500, 29),
+        CHAN(5520, 30),
+        CHAN(5540, 31),
+        CHAN(5560, 32),
+        CHAN(5580, 33),
+        CHAN(5600, 34),
+        CHAN(5620, 35),
+        CHAN(5640, 36),
+        CHAN(5660, 37),
+        CHAN(5680, 38),
+        CHAN(5700, 39),
+        CHAN(5745, 40),
+        CHAN(5765, 41),
+        CHAN(5785, 42),
+        CHAN(5805, 43),
+        CHAN(5825, 44),
+        CHAN(5170, 45),
+        CHAN(5190, 46),
+        CHAN(5210, 47),
+        CHAN(5230, 48),
+};
+#undef CHAN
+
+static struct ieee80211_supported_band ar9170_band_2GHz = {
+        .channels       = ar9170_2ghz_chantable,
+        .n_channels     = ARRAY_SIZE(ar9170_2ghz_chantable),
+        .bitrates       = ar9170_g_ratetable,
+        .n_bitrates     = ar9170_g_ratetable_size,
+};
+
+#ifdef AR9170_QUEUE_DEBUG
+/*
+ * In case some wants works with AR9170's crazy tx_status queueing techniques.
+ * He might need this rather useful probing function.
+ *
+ * NOTE: caller must hold the queue's spinlock!
+ */
+
+static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct ar9170_tx_control *txc = (void *) skb->data;
+        struct ieee80211_hdr *hdr = (void *)txc->frame_data;
+
+        printk(KERN_DEBUG "%s: => FRAME [skb:%p, queue:%d, DA:[%pM] "
+                          "mac_control:%04x, phy_control:%08x]\n",
+               wiphy_name(ar->hw->wiphy), skb, skb_get_queue_mapping(skb),
+               ieee80211_get_DA(hdr), le16_to_cpu(txc->mac_control),
+               le32_to_cpu(txc->phy_control));
+}
+
+static void ar9170_dump_station_tx_status_queue(struct ar9170 *ar,
+                                                struct sk_buff_head *queue)
+{
+        struct sk_buff *skb;
+        int i = 0;
+
+        printk(KERN_DEBUG "---[ cut here ]---\n");
+        printk(KERN_DEBUG "%s: %d entries in tx_status queue.\n",
+               wiphy_name(ar->hw->wiphy), skb_queue_len(queue));
+
+        skb_queue_walk(queue, skb) {
+                struct ar9170_tx_control *txc = (void *) skb->data;
+                struct ieee80211_hdr *hdr = (void *)txc->frame_data;
+
+                printk(KERN_DEBUG "index:%d => \n", i);
+                ar9170_print_txheader(ar, skb);
+        }
+        printk(KERN_DEBUG "---[ end ]---\n");
+}
+#endif /* AR9170_QUEUE_DEBUG */
+
+static struct ieee80211_supported_band ar9170_band_5GHz = {
+        .channels       = ar9170_5ghz_chantable,
+        .n_channels     = ARRAY_SIZE(ar9170_5ghz_chantable),
+        .bitrates       = ar9170_a_ratetable,
+        .n_bitrates     = ar9170_a_ratetable_size,
+};
+
+void ar9170_handle_tx_status(struct ar9170 *ar, struct sk_buff *skb,
+                             bool valid_status, u16 tx_status)
+{
+        struct ieee80211_tx_info *txinfo;
+        unsigned int retries = 0, queue = skb_get_queue_mapping(skb);
+        unsigned long flags;
+
+        spin_lock_irqsave(&ar->tx_stats_lock, flags);
+        ar->tx_stats[queue].len--;
+        if (ieee80211_queue_stopped(ar->hw, queue))
+                ieee80211_wake_queue(ar->hw, queue);
+        spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
+
+        txinfo = IEEE80211_SKB_CB(skb);
+        ieee80211_tx_info_clear_status(txinfo);
+
+        switch (tx_status) {
+        case AR9170_TX_STATUS_RETRY:
+                retries = 2;
+        case AR9170_TX_STATUS_COMPLETE:
+                txinfo->flags |= IEEE80211_TX_STAT_ACK;
+                break;
+
+        case AR9170_TX_STATUS_FAILED:
+                retries = ar->hw->conf.long_frame_max_tx_count;
+                break;
+
+        default:
+                printk(KERN_ERR "%s: invalid tx_status response (%x).\n",
+                       wiphy_name(ar->hw->wiphy), tx_status);
+                break;
+        }
+
+        if (valid_status)
+                txinfo->status.rates[0].count = retries + 1;
+
+        skb_pull(skb, sizeof(struct ar9170_tx_control));
+        ieee80211_tx_status_irqsafe(ar->hw, skb);
+}
+
+static struct sk_buff *ar9170_find_skb_in_queue(struct ar9170 *ar,
+                                                const u8 *mac,
+                                                const u32 queue,
+                                                struct sk_buff_head *q)
+{
+        unsigned long flags;
+        struct sk_buff *skb;
+
+        spin_lock_irqsave(&q->lock, flags);
+        skb_queue_walk(q, skb) {
+                struct ar9170_tx_control *txc = (void *) skb->data;
+                struct ieee80211_hdr *hdr = (void *) txc->frame_data;
+                u32 txc_queue = (le32_to_cpu(txc->phy_control) &
+                                AR9170_TX_PHY_QOS_MASK) >>
+                                AR9170_TX_PHY_QOS_SHIFT;
+
+                if  ((queue != txc_queue) ||
+                     (compare_ether_addr(ieee80211_get_DA(hdr), mac)))
+                        continue;
+
+                __skb_unlink(skb, q);
+                spin_unlock_irqrestore(&q->lock, flags);
+                return skb;
+        }
+        spin_unlock_irqrestore(&q->lock, flags);
+        return NULL;
+}
+
+static struct sk_buff *ar9170_find_queued_skb(struct ar9170 *ar, const u8 *mac,
+                                              const u32 queue)
+{
+        struct ieee80211_sta *sta;
+        struct sk_buff *skb;
+
+        /*
+         * Unfortunately, the firmware does not tell to which (queued) frame
+         * this transmission status report belongs to.
+         *
+         * So we have to make risky guesses - with the scarce information
+         * the firmware provided (-> destination MAC, and phy_control) -
+         * and hope that we picked the right one...
+         */
+        rcu_read_lock();
+        sta = ieee80211_find_sta(ar->hw, mac);
+
+        if (likely(sta)) {
+                struct ar9170_sta_info *sta_priv = (void *) sta->drv_priv;
+                skb = skb_dequeue(&sta_priv->tx_status[queue]);
+                rcu_read_unlock();
+                if (likely(skb))
+                        return skb;
+        } else
+                rcu_read_unlock();
+
+        /* scan the waste queue for candidates */
+        skb = ar9170_find_skb_in_queue(ar, mac, queue,
+                                       &ar->global_tx_status_waste);
+        if (!skb) {
+                /* so it still _must_ be in the global list. */
+                skb = ar9170_find_skb_in_queue(ar, mac, queue,
+                                               &ar->global_tx_status);
+        }
+
+#ifdef AR9170_QUEUE_DEBUG
+        if (unlikely((!skb) && net_ratelimit())) {
+                printk(KERN_ERR "%s: ESS:[%pM] does not have any "
+                                "outstanding frames in this queue (%d).\n",
+                                wiphy_name(ar->hw->wiphy), mac, queue);
+        }
+#endif /* AR9170_QUEUE_DEBUG */
+        return skb;
+}
+
+/*
+ * This worker tries to keep the global tx_status queue empty.
+ * So we can guarantee that incoming tx_status reports for
+ * unregistered stations are always synced with the actual
+ * frame - which we think - belongs to.
+ */
+
+static void ar9170_tx_status_janitor(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170,
+                                         tx_status_janitor.work);
+        struct sk_buff *skb;
+
+        if (unlikely(!IS_STARTED(ar)))
+                return ;
+
+        mutex_lock(&ar->mutex);
+        /* recycle the garbage back to mac80211... one by one. */
+        while ((skb = skb_dequeue(&ar->global_tx_status_waste))) {
+#ifdef AR9170_QUEUE_DEBUG
+                printk(KERN_DEBUG "%s: dispose queued frame =>\n",
+                       wiphy_name(ar->hw->wiphy));
+                ar9170_print_txheader(ar, skb);
+#endif /* AR9170_QUEUE_DEBUG */
+                ar9170_handle_tx_status(ar, skb, false,
+                                        AR9170_TX_STATUS_FAILED);
+        }
+
+        while ((skb = skb_dequeue(&ar->global_tx_status))) {
+#ifdef AR9170_QUEUE_DEBUG
+                printk(KERN_DEBUG "%s: moving frame into waste queue =>\n",
+                       wiphy_name(ar->hw->wiphy));
+
+                ar9170_print_txheader(ar, skb);
+#endif /* AR9170_QUEUE_DEBUG */
+                skb_queue_tail(&ar->global_tx_status_waste, skb);
+        }
+
+        /* recall the janitor in 100ms - if there's garbage in the can. */
+        if (skb_queue_len(&ar->global_tx_status_waste) > 0)
+                queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
+                                   msecs_to_jiffies(100));
+
+        mutex_unlock(&ar->mutex);
+}
+
+static void ar9170_handle_command_response(struct ar9170 *ar,
+                                           void *buf, u32 len)
+{
+        struct ar9170_cmd_response *cmd = (void *) buf;
+
+        if ((cmd->type & 0xc0) != 0xc0) {
+                ar->callback_cmd(ar, len, buf);
+                return;
+        }
+
+        /* hardware event handlers */
+        switch (cmd->type) {
+        case 0xc1: {
+                /*
+                 * TX status notification:
+                 * bytes: 0c c1 XX YY M1 M2 M3 M4 M5 M6 R4 R3 R2 R1 S2 S1
+                 *
+                 * XX always 81
+                 * YY always 00
+                 * M1-M6 is the MAC address
+                 * R1-R4 is the transmit rate
+                 * S1-S2 is the transmit status
+                 */
+
+                struct sk_buff *skb;
+                u32 queue = (le32_to_cpu(cmd->tx_status.rate) &
+                            AR9170_TX_PHY_QOS_MASK) >> AR9170_TX_PHY_QOS_SHIFT;
+
+                skb = ar9170_find_queued_skb(ar, cmd->tx_status.dst, queue);
+                if (unlikely(!skb))
+                        return ;
+
+                ar9170_handle_tx_status(ar, skb, true,
+                                        le16_to_cpu(cmd->tx_status.status));
+                break;
+                }
+
+        case 0xc0:
+                /*
+                 * pre-TBTT event
+                 */
+                if (ar->vif && ar->vif->type == NL80211_IFTYPE_AP)
+                        queue_work(ar->hw->workqueue, &ar->beacon_work);
+                break;
+
+        case 0xc2:
+                /*
+                 * (IBSS) beacon send notification
+                 * bytes: 04 c2 XX YY B4 B3 B2 B1
+                 *
+                 * XX always 80
+                 * YY always 00
+                 * B1-B4 "should" be the number of send out beacons.
+                 */
+                break;
+
+        case 0xc3:
+                /* End of Atim Window */
+                break;
+
+        case 0xc4:
+        case 0xc5:
+                /* BlockACK events */
+                break;
+
+        case 0xc6:
+                /* Watchdog Interrupt */
+                break;
+
+        case 0xc9:
+                /* retransmission issue / SIFS/EIFS collision ?! */
+                break;
+
+        default:
+                printk(KERN_INFO "received unhandled event %x\n", cmd->type);
+                print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
+                break;
+        }
+}
+
+/*
+ * If the frame alignment is right (or the kernel has
+ * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
+ * is only a single MPDU in the USB frame, then we can
+ * submit to mac80211 the SKB directly. However, since
+ * there may be multiple packets in one SKB in stream
+ * mode, and we need to observe the proper ordering,
+ * this is non-trivial.
+ */
+static void ar9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
+{
+        struct sk_buff *skb;
+        struct ar9170_rx_head *head = (void *)buf;
+        struct ar9170_rx_tail *tail;
+        struct ieee80211_rx_status status;
+        int mpdu_len, i;
+        u8 error, antennas = 0, decrypt;
+        __le16 fc;
+        int reserved;
+
+        if (unlikely(!IS_STARTED(ar)))
+                return ;
+
+        /* Received MPDU */
+        mpdu_len = len;
+        mpdu_len -= sizeof(struct ar9170_rx_head);
+        mpdu_len -= sizeof(struct ar9170_rx_tail);
+        BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
+        BUILD_BUG_ON(sizeof(struct ar9170_rx_tail) != 24);
+
+        if (mpdu_len <= FCS_LEN)
+                return;
+
+        tail = (void *)(buf + sizeof(struct ar9170_rx_head) + mpdu_len);
+
+        for (i = 0; i < 3; i++)
+                if (tail->rssi[i] != 0x80)
+                        antennas |= BIT(i);
+
+        /* post-process RSSI */
+        for (i = 0; i < 7; i++)
+                if (tail->rssi[i] & 0x80)
+                        tail->rssi[i] = ((tail->rssi[i] & 0x7f) + 1) & 0x7f;
+
+        memset(&status, 0, sizeof(status));
+
+        status.band = ar->channel->band;
+        status.freq = ar->channel->center_freq;
+        status.signal = ar->noise[0] + tail->rssi_combined;
+        status.noise = ar->noise[0];
+        status.antenna = antennas;
+
+        switch (tail->status & AR9170_RX_STATUS_MODULATION_MASK) {
+        case AR9170_RX_STATUS_MODULATION_CCK:
+                if (tail->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
+                        status.flag |= RX_FLAG_SHORTPRE;
+                switch (head->plcp[0]) {
+                case 0x0a:
+                        status.rate_idx = 0;
+                        break;
+                case 0x14:
+                        status.rate_idx = 1;
+                        break;
+                case 0x37:
+                        status.rate_idx = 2;
+                        break;
+                case 0x6e:
+                        status.rate_idx = 3;
+                        break;
+                default:
+                        if ((!ar->sniffer_enabled) && (net_ratelimit()))
+                                printk(KERN_ERR "%s: invalid plcp cck rate "
+                                       "(%x).\n", wiphy_name(ar->hw->wiphy),
+                                       head->plcp[0]);
+                        return;
+                }
+                break;
+        case AR9170_RX_STATUS_MODULATION_OFDM:
+                switch (head->plcp[0] & 0xF) {
+                case 0xB:
+                        status.rate_idx = 0;
+                        break;
+                case 0xF:
+                        status.rate_idx = 1;
+                        break;
+                case 0xA:
+                        status.rate_idx = 2;
+                        break;
+                case 0xE:
+                        status.rate_idx = 3;
+                        break;
+                case 0x9:
+                        status.rate_idx = 4;
+                        break;
+                case 0xD:
+                        status.rate_idx = 5;
+                        break;
+                case 0x8:
+                        status.rate_idx = 6;
+                        break;
+                case 0xC:
+                        status.rate_idx = 7;
+                        break;
+                default:
+                        if ((!ar->sniffer_enabled) && (net_ratelimit()))
+                                printk(KERN_ERR "%s: invalid plcp ofdm rate "
+                                       "(%x).\n", wiphy_name(ar->hw->wiphy),
+                                       head->plcp[0]);
+                        return;
+                }
+                if (status.band == IEEE80211_BAND_2GHZ)
+                        status.rate_idx += 4;
+                break;
+        case AR9170_RX_STATUS_MODULATION_HT:
+        case AR9170_RX_STATUS_MODULATION_DUPOFDM:
+                /* XXX */
+
+                if (net_ratelimit())
+                        printk(KERN_ERR "%s: invalid modulation\n",
+                               wiphy_name(ar->hw->wiphy));
+                return;
+        }
+
+        error = tail->error;
+
+        if (error & AR9170_RX_ERROR_MMIC) {
+                status.flag |= RX_FLAG_MMIC_ERROR;
+                error &= ~AR9170_RX_ERROR_MMIC;
+        }
+
+        if (error & AR9170_RX_ERROR_PLCP) {
+                status.flag |= RX_FLAG_FAILED_PLCP_CRC;
+                error &= ~AR9170_RX_ERROR_PLCP;
+        }
+
+        if (error & AR9170_RX_ERROR_FCS) {
+                status.flag |= RX_FLAG_FAILED_FCS_CRC;
+                error &= ~AR9170_RX_ERROR_FCS;
+        }
+
+        decrypt = ar9170_get_decrypt_type(tail);
+        if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
+            decrypt != AR9170_ENC_ALG_NONE)
+                status.flag |= RX_FLAG_DECRYPTED;
+
+        /* ignore wrong RA errors */
+        error &= ~AR9170_RX_ERROR_WRONG_RA;
+
+        if (error & AR9170_RX_ERROR_DECRYPT) {
+                error &= ~AR9170_RX_ERROR_DECRYPT;
+
+                /*
+                 * Rx decryption is done in place,
+                 * the original data is lost anyway.
+                 */
+                return ;
+        }
+
+        /* drop any other error frames */
+        if ((error) && (net_ratelimit())) {
+                printk(KERN_DEBUG "%s: errors: %#x\n",
+                       wiphy_name(ar->hw->wiphy), error);
+                return;
+        }
+
+        buf += sizeof(struct ar9170_rx_head);
+        fc = *(__le16 *)buf;
+
+        if (ieee80211_is_data_qos(fc) ^ ieee80211_has_a4(fc))
+                reserved = 32 + 2;
+        else
+                reserved = 32;
+
+        skb = dev_alloc_skb(mpdu_len + reserved);
+        if (!skb)
+                return;
+
+        skb_reserve(skb, reserved);
+        memcpy(skb_put(skb, mpdu_len), buf, mpdu_len);
+        ieee80211_rx_irqsafe(ar->hw, skb, &status);
+}
+
+void ar9170_rx(struct ar9170 *ar, struct sk_buff *skb)
+{
+        unsigned int i, tlen, resplen;
+        u8 *tbuf, *respbuf;
+
+        tbuf = skb->data;
+        tlen = skb->len;
+
+        while (tlen >= 4) {
+                int clen = tbuf[1] << 8 | tbuf[0];
+                int wlen = (clen + 3) & ~3;
+
+                /*
+                 * parse stream (if any)
+                 */
+                if (tbuf[2] != 0 || tbuf[3] != 0x4e) {
+                        printk(KERN_ERR "%s: missing tag!\n",
+                               wiphy_name(ar->hw->wiphy));
+                        return ;
+                }
+                if (wlen > tlen - 4) {
+                        printk(KERN_ERR "%s: invalid RX (%d, %d, %d)\n",
+                               wiphy_name(ar->hw->wiphy), clen, wlen, tlen);
+                        print_hex_dump(KERN_DEBUG, "data: ",
+                                       DUMP_PREFIX_OFFSET,
+                                       16, 1, tbuf, tlen, true);
+                        return ;
+                }
+                resplen = clen;
+                respbuf = tbuf + 4;
+                tbuf += wlen + 4;
+                tlen -= wlen + 4;
+
+                i = 0;
+
+                /* weird thing, but this is the same in the original driver */
+                while (resplen > 2 && i < 12 &&
+                       respbuf[0] == 0xff && respbuf[1] == 0xff) {
+                        i += 2;
+                        resplen -= 2;
+                        respbuf += 2;
+                }
+
+                if (resplen < 4)
+                        continue;
+
+                /* found the 6 * 0xffff marker? */
+                if (i == 12)
+                        ar9170_handle_command_response(ar, respbuf, resplen);
+                else
+                        ar9170_handle_mpdu(ar, respbuf, resplen);
+        }
+
+        if (tlen)
+                printk(KERN_ERR "%s: buffer remains!\n",
+                       wiphy_name(ar->hw->wiphy));
+}
+
+#define AR9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)            \
+do {                                                                    \
+        queue.aifs = ai_fs;                                             \
+        queue.cw_min = cwmin;                                           \
+        queue.cw_max = cwmax;                                           \
+        queue.txop = _txop;                                             \
+} while (0)
+
+static int ar9170_op_start(struct ieee80211_hw *hw)
+{
+        struct ar9170 *ar = hw->priv;
+        int err, i;
+
+        mutex_lock(&ar->mutex);
+
+        /* reinitialize queues statistics */
+        memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
+        for (i = 0; i < ARRAY_SIZE(ar->tx_stats); i++)
+                ar->tx_stats[i].limit = 8;
+
+        /* reset QoS defaults */
+        AR9170_FILL_QUEUE(ar->edcf[0], 3, 15, 1023,  0); /* BEST EFFORT*/
+        AR9170_FILL_QUEUE(ar->edcf[1], 7, 15, 1023,  0); /* BACKGROUND */
+        AR9170_FILL_QUEUE(ar->edcf[2], 2, 7,    15, 94); /* VIDEO */
+        AR9170_FILL_QUEUE(ar->edcf[3], 2, 3,     7, 47); /* VOICE */
+        AR9170_FILL_QUEUE(ar->edcf[4], 2, 3,     7,  0); /* SPECIAL */
+
+        err = ar->open(ar);
+        if (err)
+                goto out;
+
+        err = ar9170_init_mac(ar);
+        if (err)
+                goto out;
+
+        err = ar9170_set_qos(ar);
+        if (err)
+                goto out;
+
+        err = ar9170_init_phy(ar, IEEE80211_BAND_2GHZ);
+        if (err)
+                goto out;
+
+        err = ar9170_init_rf(ar);
+        if (err)
+                goto out;
+
+        /* start DMA */
+        err = ar9170_write_reg(ar, 0x1c3d30, 0x100);
+        if (err)
+                goto out;
+
+        ar->state = AR9170_STARTED;
+
+out:
+        mutex_unlock(&ar->mutex);
+        return err;
+}
+
+static void ar9170_op_stop(struct ieee80211_hw *hw)
+{
+        struct ar9170 *ar = hw->priv;
+
+        if (IS_STARTED(ar))
+                ar->state = AR9170_IDLE;
+
+        mutex_lock(&ar->mutex);
+
+        cancel_delayed_work_sync(&ar->tx_status_janitor);
+        cancel_work_sync(&ar->filter_config_work);
+        cancel_work_sync(&ar->beacon_work);
+        skb_queue_purge(&ar->global_tx_status_waste);
+        skb_queue_purge(&ar->global_tx_status);
+
+        if (IS_ACCEPTING_CMD(ar)) {
+                ar9170_set_leds_state(ar, 0);
+
+                /* stop DMA */
+                ar9170_write_reg(ar, 0x1c3d30, 0);
+                ar->stop(ar);
+        }
+
+        mutex_unlock(&ar->mutex);
+}
+
+int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct ar9170 *ar = hw->priv;
+        struct ieee80211_hdr *hdr;
+        struct ar9170_tx_control *txc;
+        struct ieee80211_tx_info *info;
+        struct ieee80211_rate *rate = NULL;
+        struct ieee80211_tx_rate *txrate;
+        unsigned int queue = skb_get_queue_mapping(skb);
+        unsigned long flags = 0;
+        struct ar9170_sta_info *sta_info = NULL;
+        u32 power, chains;
+        u16 keytype = 0;
+        u16 len, icv = 0;
+        int err;
+        bool tx_status;
+
+        if (unlikely(!IS_STARTED(ar)))
+                goto err_free;
+
+        hdr = (void *)skb->data;
+        info = IEEE80211_SKB_CB(skb);
+        len = skb->len;
+
+        spin_lock_irqsave(&ar->tx_stats_lock, flags);
+        if (ar->tx_stats[queue].limit < ar->tx_stats[queue].len) {
+                spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
+                return NETDEV_TX_OK;
+        }
+
+        ar->tx_stats[queue].len++;
+        ar->tx_stats[queue].count++;
+        if (ar->tx_stats[queue].limit == ar->tx_stats[queue].len)
+                ieee80211_stop_queue(hw, queue);
+
+        spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
+
+        txc = (void *)skb_push(skb, sizeof(*txc));
+
+        tx_status = (((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) != 0) ||
+                    ((info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) != 0));
+
+        if (info->control.hw_key) {
+                icv = info->control.hw_key->icv_len;
+
+                switch (info->control.hw_key->alg) {
+                case ALG_WEP:
+                        keytype = AR9170_TX_MAC_ENCR_RC4;
+                        break;
+                case ALG_TKIP:
+                        keytype = AR9170_TX_MAC_ENCR_RC4;
+                        break;
+                case ALG_CCMP:
+                        keytype = AR9170_TX_MAC_ENCR_AES;
+                        break;
+                default:
+                        WARN_ON(1);
+                        goto err_dequeue;
+                }
+        }
+
+        /* Length */
+        txc->length = cpu_to_le16(len + icv + 4);
+
+        txc->mac_control = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
+                                       AR9170_TX_MAC_BACKOFF);
+        txc->mac_control |= cpu_to_le16(ar9170_qos_hwmap[queue] <<
+                                        AR9170_TX_MAC_QOS_SHIFT);
+        txc->mac_control |= cpu_to_le16(keytype);
+        txc->phy_control = cpu_to_le32(0);
+
+        if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+                txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_NO_ACK);
+
+        if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
+
+        txrate = &info->control.rates[0];
+
+        if (txrate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
+                txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
+        else if (txrate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
+                txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
+
+        if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
+                txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_GREENFIELD);
+
+        if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
+                txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_PREAMBLE);
+
+        if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ);
+        /* this works because 40 MHz is 2 and dup is 3 */
+        if (txrate->flags & IEEE80211_TX_RC_DUP_DATA)
+                txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ_DUP);
+
+        if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
+                txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_GI);
+
+        if (txrate->flags & IEEE80211_TX_RC_MCS) {
+                u32 r = txrate->idx;
+                u8 *txpower;
+
+                r <<= AR9170_TX_PHY_MCS_SHIFT;
+                if (WARN_ON(r & ~AR9170_TX_PHY_MCS_MASK))
+                        goto err_dequeue;
+                txc->phy_control |= cpu_to_le32(r & AR9170_TX_PHY_MCS_MASK);
+                txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_MOD_HT);
+
+                if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
+                        if (info->band == IEEE80211_BAND_5GHZ)
+                                txpower = ar->power_5G_ht40;
+                        else
+                                txpower = ar->power_2G_ht40;
+                } else {
+                        if (info->band == IEEE80211_BAND_5GHZ)
+                                txpower = ar->power_5G_ht20;
+                        else
+                                txpower = ar->power_2G_ht20;
+                }
+
+                power = txpower[(txrate->idx) & 7];
+        } else {
+                u8 *txpower;
+                u32 mod;
+                u32 phyrate;
+                u8 idx = txrate->idx;
+
+                if (info->band != IEEE80211_BAND_2GHZ) {
+                        idx += 4;
+                        txpower = ar->power_5G_leg;
+                        mod = AR9170_TX_PHY_MOD_OFDM;
+                } else {
+                        if (idx < 4) {
+                                txpower = ar->power_2G_cck;
+                                mod = AR9170_TX_PHY_MOD_CCK;
+                        } else {
+                                mod = AR9170_TX_PHY_MOD_OFDM;
+                                txpower = ar->power_2G_ofdm;
+                        }
+                }
+
+                rate = &__ar9170_ratetable[idx];
+
+                phyrate = rate->hw_value & 0xF;
+                power = txpower[(rate->hw_value & 0x30) >> 4];
+                phyrate <<= AR9170_TX_PHY_MCS_SHIFT;
+
+                txc->phy_control |= cpu_to_le32(mod);
+                txc->phy_control |= cpu_to_le32(phyrate);
+        }
+
+        power <<= AR9170_TX_PHY_TX_PWR_SHIFT;
+        power &= AR9170_TX_PHY_TX_PWR_MASK;
+        txc->phy_control |= cpu_to_le32(power);
+
+        /* set TX chains */
+        if (ar->eeprom.tx_mask == 1) {
+                chains = AR9170_TX_PHY_TXCHAIN_1;
+        } else {
+                chains = AR9170_TX_PHY_TXCHAIN_2;
+
+                /* >= 36M legacy OFDM - use only one chain */
+                if (rate && rate->bitrate >= 360)
+                        chains = AR9170_TX_PHY_TXCHAIN_1;
+        }
+        txc->phy_control |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_SHIFT);
+
+        if (tx_status) {
+                txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
+                /*
+                 * WARNING:
+                 * Putting the QoS queue bits into an unexplored territory is
+                 * certainly not elegant.
+                 *
+                 * In my defense: This idea provides a reasonable way to
+                 * smuggle valuable information to the tx_status callback.
+                 * Also, the idea behind this bit-abuse came straight from
+                 * the original driver code.
+                 */
+
+                txc->phy_control |=
+                        cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
+
+                if (info->control.sta) {
+                        sta_info = (void *) info->control.sta->drv_priv;
+                        skb_queue_tail(&sta_info->tx_status[queue], skb);
+                } else {
+                        skb_queue_tail(&ar->global_tx_status, skb);
+
+                        queue_delayed_work(ar->hw->workqueue,
+                                           &ar->tx_status_janitor,
+                                           msecs_to_jiffies(100));
+                }
+        }
+
+        err = ar->tx(ar, skb, tx_status, 0);
+        if (unlikely(tx_status && err)) {
+                if (info->control.sta)
+                        skb_unlink(skb, &sta_info->tx_status[queue]);
+                else
+                        skb_unlink(skb, &ar->global_tx_status);
+        }
+
+        return NETDEV_TX_OK;
+
+err_dequeue:
+        spin_lock_irqsave(&ar->tx_stats_lock, flags);
+        ar->tx_stats[queue].len--;
+        ar->tx_stats[queue].count--;
+        spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
+
+err_free:
+        dev_kfree_skb(skb);
+        return NETDEV_TX_OK;
+}
+
+static int ar9170_op_add_interface(struct ieee80211_hw *hw,
+                                   struct ieee80211_if_init_conf *conf)
+{
+        struct ar9170 *ar = hw->priv;
+        int err = 0;
+
+        mutex_lock(&ar->mutex);
+
+        if (ar->vif) {
+                err = -EBUSY;
+                goto unlock;
+        }
+
+        ar->vif = conf->vif;
+        memcpy(ar->mac_addr, conf->mac_addr, ETH_ALEN);
+
+        if (modparam_nohwcrypt || (ar->vif->type != NL80211_IFTYPE_STATION)) {
+                ar->rx_software_decryption = true;
+                ar->disable_offload = true;
+        }
+
+        ar->cur_filter = 0;
+        ar->want_filter = AR9170_MAC_REG_FTF_DEFAULTS;
+        err = ar9170_update_frame_filter(ar);
+        if (err)
+                goto unlock;
+
+        err = ar9170_set_operating_mode(ar);
+
+unlock:
+        mutex_unlock(&ar->mutex);
+        return err;
+}
+
+static void ar9170_op_remove_interface(struct ieee80211_hw *hw,
+                                       struct ieee80211_if_init_conf *conf)
+{
+        struct ar9170 *ar = hw->priv;
+
+        mutex_lock(&ar->mutex);
+        ar->vif = NULL;
+        ar->want_filter = 0;
+        ar9170_update_frame_filter(ar);
+        ar9170_set_beacon_timers(ar);
+        dev_kfree_skb(ar->beacon);
+        ar->beacon = NULL;
+        ar->sniffer_enabled = false;
+        ar->rx_software_decryption = false;
+        ar9170_set_operating_mode(ar);
+        mutex_unlock(&ar->mutex);
+}
+
+static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
+{
+        struct ar9170 *ar = hw->priv;
+        int err = 0;
+
+        mutex_lock(&ar->mutex);
+
+        if (changed & IEEE80211_CONF_CHANGE_RADIO_ENABLED) {
+                /* TODO */
+                err = 0;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
+                /* TODO */
+                err = 0;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_PS) {
+                /* TODO */
+                err = 0;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_POWER) {
+                /* TODO */
+                err = 0;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
+                /*
+                 * is it long_frame_max_tx_count or short_frame_max_tx_count?
+                 */
+
+                err = ar9170_set_hwretry_limit(ar,
+                        ar->hw->conf.long_frame_max_tx_count);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_BEACON_INTERVAL) {
+                err = ar9170_set_beacon_timers(ar);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+                err = ar9170_set_channel(ar, hw->conf.channel,
+                                         AR9170_RFI_NONE, AR9170_BW_20);
+                if (err)
+                        goto out;
+                /* adjust slot time for 5 GHz */
+                if (hw->conf.channel->band == IEEE80211_BAND_5GHZ)
+                        err = ar9170_write_reg(ar, AR9170_MAC_REG_SLOT_TIME,
+                                               9 << 10);
+        }
+
+out:
+        mutex_unlock(&ar->mutex);
+        return err;
+}
+
+static int ar9170_op_config_interface(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
+                                      struct ieee80211_if_conf *conf)
+{
+        struct ar9170 *ar = hw->priv;
+        int err = 0;
+
+        mutex_lock(&ar->mutex);
+
+        if (conf->changed & IEEE80211_IFCC_BSSID) {
+                memcpy(ar->bssid, conf->bssid, ETH_ALEN);
+                err = ar9170_set_operating_mode(ar);
+        }
+
+        if (conf->changed & IEEE80211_IFCC_BEACON) {
+                err = ar9170_update_beacon(ar);
+
+                if (err)
+                        goto out;
+                err = ar9170_set_beacon_timers(ar);
+        }
+
+out:
+        mutex_unlock(&ar->mutex);
+        return err;
+}
+
+static void ar9170_set_filters(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170,
+                                         filter_config_work);
+        int err;
+
+        mutex_lock(&ar->mutex);
+        if (unlikely(!IS_STARTED(ar)))
+                goto unlock;
+
+        if (ar->filter_changed & AR9170_FILTER_CHANGED_PROMISC) {
+                err = ar9170_set_operating_mode(ar);
+                if (err)
+                        goto unlock;
+        }
+
+        if (ar->filter_changed & AR9170_FILTER_CHANGED_MULTICAST) {
+                err = ar9170_update_multicast(ar);
+                if (err)
+                        goto unlock;
+        }
+
+        if (ar->filter_changed & AR9170_FILTER_CHANGED_FRAMEFILTER)
+                err = ar9170_update_frame_filter(ar);
+
+unlock:
+        mutex_unlock(&ar->mutex);
+}
+
+static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
+                                       unsigned int changed_flags,
+                                       unsigned int *new_flags,
+                                       int mc_count, struct dev_mc_list *mclist)
+{
+        struct ar9170 *ar = hw->priv;
+
+        /* mask supported flags */
+        *new_flags &= FIF_ALLMULTI | FIF_CONTROL | FIF_BCN_PRBRESP_PROMISC |
+                      FIF_PROMISC_IN_BSS;
+
+        /*
+         * We can support more by setting the sniffer bit and
+         * then checking the error flags, later.
+         */
+
+        if (changed_flags & FIF_ALLMULTI) {
+                if (*new_flags & FIF_ALLMULTI) {
+                        ar->want_mc_hash = ~0ULL;
+                } else {
+                        u64 mchash;
+                        int i;
+
+                        /* always get broadcast frames */
+                        mchash = 1ULL << (0xff>>2);
+
+                        for (i = 0; i < mc_count; i++) {
+                                if (WARN_ON(!mclist))
+                                        break;
+                                mchash |= 1ULL << (mclist->dmi_addr[5] >> 2);
+                                mclist = mclist->next;
+                        }
+                ar->want_mc_hash = mchash;
+                }
+                ar->filter_changed |= AR9170_FILTER_CHANGED_MULTICAST;
+        }
+
+        if (changed_flags & FIF_CONTROL) {
+                u32 filter = AR9170_MAC_REG_FTF_PSPOLL |
+                             AR9170_MAC_REG_FTF_RTS |
+                             AR9170_MAC_REG_FTF_CTS |
+                             AR9170_MAC_REG_FTF_ACK |
+                             AR9170_MAC_REG_FTF_CFE |
+                             AR9170_MAC_REG_FTF_CFE_ACK;
+
+                if (*new_flags & FIF_CONTROL)
+                        ar->want_filter = ar->cur_filter | filter;
+                else
+                        ar->want_filter = ar->cur_filter & ~filter;
+
+                ar->filter_changed |= AR9170_FILTER_CHANGED_FRAMEFILTER;
+        }
+
+        if (changed_flags & FIF_PROMISC_IN_BSS) {
+                ar->sniffer_enabled = ((*new_flags) & FIF_PROMISC_IN_BSS) != 0;
+                ar->filter_changed |= AR9170_FILTER_CHANGED_PROMISC;
+        }
+
+        if (likely(IS_STARTED(ar)))
+                queue_work(ar->hw->workqueue, &ar->filter_config_work);
+}
+
+static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       struct ieee80211_bss_conf *bss_conf,
+                                       u32 changed)
+{
+        struct ar9170 *ar = hw->priv;
+        int err = 0;
+
+        mutex_lock(&ar->mutex);
+
+        ar9170_regwrite_begin(ar);
+
+        if (changed & BSS_CHANGED_ASSOC) {
+                ar->state = bss_conf->assoc ? AR9170_ASSOCIATED : ar->state;
+
+#ifndef CONFIG_AR9170_LEDS
+                /* enable assoc LED. */
+                err = ar9170_set_leds_state(ar, bss_conf->assoc ? 2 : 0);
+#endif /* CONFIG_AR9170_LEDS */
+        }
+
+        if (changed & BSS_CHANGED_HT) {
+                /* TODO */
+                err = 0;
+        }
+
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                u32 slottime = 20;
+
+                if (bss_conf->use_short_slot)
+                        slottime = 9;
+
+                ar9170_regwrite(AR9170_MAC_REG_SLOT_TIME, slottime << 10);
+        }
+
+        if (changed & BSS_CHANGED_BASIC_RATES) {
+                u32 cck, ofdm;
+
+                if (hw->conf.channel->band == IEEE80211_BAND_5GHZ) {
+                        ofdm = bss_conf->basic_rates;
+                        cck = 0;
+                } else {
+                        /* four cck rates */
+                        cck = bss_conf->basic_rates & 0xf;
+                        ofdm = bss_conf->basic_rates >> 4;
+                }
+                ar9170_regwrite(AR9170_MAC_REG_BASIC_RATE,
+                                ofdm << 8 | cck);
+        }
+
+        ar9170_regwrite_finish();
+        err = ar9170_regwrite_result();
+        mutex_unlock(&ar->mutex);
+}
+
+static u64 ar9170_op_get_tsf(struct ieee80211_hw *hw)
+{
+        struct ar9170 *ar = hw->priv;
+        int err;
+        u32 tsf_low;
+        u32 tsf_high;
+        u64 tsf;
+
+        mutex_lock(&ar->mutex);
+        err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_L, &tsf_low);
+        if (!err)
+                err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_H, &tsf_high);
+        mutex_unlock(&ar->mutex);
+
+        if (WARN_ON(err))
+                return 0;
+
+        tsf = tsf_high;
+        tsf = (tsf << 32) | tsf_low;
+        return tsf;
+}
+
+static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                          struct ieee80211_vif *vif, struct ieee80211_sta *sta,
+                          struct ieee80211_key_conf *key)
+{
+        struct ar9170 *ar = hw->priv;
+        int err = 0, i;
+        u8 ktype;
+
+        if ((!ar->vif) || (ar->disable_offload))
+                return -EOPNOTSUPP;
+
+        switch (key->alg) {
+        case ALG_WEP:
+                if (key->keylen == LEN_WEP40)
+                        ktype = AR9170_ENC_ALG_WEP64;
+                else
+                        ktype = AR9170_ENC_ALG_WEP128;
+                break;
+        case ALG_TKIP:
+                ktype = AR9170_ENC_ALG_TKIP;
+                break;
+        case ALG_CCMP:
+                ktype = AR9170_ENC_ALG_AESCCMP;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        mutex_lock(&ar->mutex);
+        if (cmd == SET_KEY) {
+                if (unlikely(!IS_STARTED(ar))) {
+                        err = -EOPNOTSUPP;
+                        goto out;
+                }
+
+                /* group keys need all-zeroes address */
+                if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                        sta = NULL;
+
+                if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
+                        for (i = 0; i < 64; i++)
+                                if (!(ar->usedkeys & BIT(i)))
+                                        break;
+                        if (i == 64) {
+                                ar->rx_software_decryption = true;
+                                ar9170_set_operating_mode(ar);
+                                err = -ENOSPC;
+                                goto out;
+                        }
+                } else {
+                        i = 64 + key->keyidx;
+                }
+
+                key->hw_key_idx = i;
+
+                err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL, ktype, 0,
+                                        key->key, min_t(u8, 16, key->keylen));
+                if (err)
+                        goto out;
+
+                if (key->alg == ALG_TKIP) {
+                        err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL,
+                                                ktype, 1, key->key + 16, 16);
+                        if (err)
+                                goto out;
+
+                        /*
+                         * hardware is not capable generating the MMIC
+                         * for fragmented frames!
+                         */
+                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
+                }
+
+                if (i < 64)
+                        ar->usedkeys |= BIT(i);
+
+                key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+        } else {
+                if (unlikely(!IS_STARTED(ar))) {
+                        /* The device is gone... together with the key ;-) */
+                        err = 0;
+                        goto out;
+                }
+
+                err = ar9170_disable_key(ar, key->hw_key_idx);
+                if (err)
+                        goto out;
+
+                if (key->hw_key_idx < 64) {
+                        ar->usedkeys &= ~BIT(key->hw_key_idx);
+                } else {
+                        err = ar9170_upload_key(ar, key->hw_key_idx, NULL,
+                                                AR9170_ENC_ALG_NONE, 0,
+                                                NULL, 0);
+                        if (err)
+                                goto out;
+
+                        if (key->alg == ALG_TKIP) {
+                                err = ar9170_upload_key(ar, key->hw_key_idx,
+                                                        NULL,
+                                                        AR9170_ENC_ALG_NONE, 1,
+                                                        NULL, 0);
+                                if (err)
+                                        goto out;
+                        }
+
+                }
+        }
+
+        ar9170_regwrite_begin(ar);
+        ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_L, ar->usedkeys);
+        ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_H, ar->usedkeys >> 32);
+        ar9170_regwrite_finish();
+        err = ar9170_regwrite_result();
+
+out:
+        mutex_unlock(&ar->mutex);
+
+        return err;
+}
+
+static void ar9170_sta_notify(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              enum sta_notify_cmd cmd,
+                              struct ieee80211_sta *sta)
+{
+        struct ar9170 *ar = hw->priv;
+        struct ar9170_sta_info *info = (void *) sta->drv_priv;
+        struct sk_buff *skb;
+        unsigned int i;
+
+        switch (cmd) {
+        case STA_NOTIFY_ADD:
+                for (i = 0; i < ar->hw->queues; i++)
+                        skb_queue_head_init(&info->tx_status[i]);
+                break;
+
+        case STA_NOTIFY_REMOVE:
+
+                /*
+                 * transfer all outstanding frames that need a tx_status
+                 * reports to the global tx_status queue
+                 */
+
+                for (i = 0; i < ar->hw->queues; i++) {
+                        while ((skb = skb_dequeue(&info->tx_status[i]))) {
+#ifdef AR9170_QUEUE_DEBUG
+                                printk(KERN_DEBUG "%s: queueing frame in "
+                                          "global tx_status queue =>\n",
+                                       wiphy_name(ar->hw->wiphy));
+
+                                ar9170_print_txheader(ar, skb);
+#endif /* AR9170_QUEUE_DEBUG */
+                                skb_queue_tail(&ar->global_tx_status, skb);
+                        }
+                }
+                queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
+                                   msecs_to_jiffies(100));
+                break;
+
+        default:
+                break;
+        }
+}
+
+static int ar9170_get_stats(struct ieee80211_hw *hw,
+                            struct ieee80211_low_level_stats *stats)
+{
+        struct ar9170 *ar = hw->priv;
+        u32 val;
+        int err;
+
+        mutex_lock(&ar->mutex);
+        err = ar9170_read_reg(ar, AR9170_MAC_REG_TX_RETRY, &val);
+        ar->stats.dot11ACKFailureCount += val;
+
+        memcpy(stats, &ar->stats, sizeof(*stats));
+        mutex_unlock(&ar->mutex);
+
+        return 0;
+}
+
+static int ar9170_get_tx_stats(struct ieee80211_hw *hw,
+                               struct ieee80211_tx_queue_stats *tx_stats)
+{
+        struct ar9170 *ar = hw->priv;
+
+        spin_lock_bh(&ar->tx_stats_lock);
+        memcpy(tx_stats, ar->tx_stats, sizeof(tx_stats[0]) * hw->queues);
+        spin_unlock_bh(&ar->tx_stats_lock);
+
+        return 0;
+}
+
+static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
+                          const struct ieee80211_tx_queue_params *param)
+{
+        struct ar9170 *ar = hw->priv;
+        int ret;
+
+        mutex_lock(&ar->mutex);
+        if ((param) && !(queue > ar->hw->queues)) {
+                memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
+                       param, sizeof(*param));
+
+                ret = ar9170_set_qos(ar);
+        } else
+                ret = -EINVAL;
+
+        mutex_unlock(&ar->mutex);
+        return ret;
+}
+
+static const struct ieee80211_ops ar9170_ops = {
+        .start                  = ar9170_op_start,
+        .stop                   = ar9170_op_stop,
+        .tx                     = ar9170_op_tx,
+        .add_interface          = ar9170_op_add_interface,
+        .remove_interface       = ar9170_op_remove_interface,
+        .config                 = ar9170_op_config,
+        .config_interface       = ar9170_op_config_interface,
+        .configure_filter       = ar9170_op_configure_filter,
+        .conf_tx                = ar9170_conf_tx,
+        .bss_info_changed       = ar9170_op_bss_info_changed,
+        .get_tsf                = ar9170_op_get_tsf,
+        .set_key                = ar9170_set_key,
+        .sta_notify             = ar9170_sta_notify,
+        .get_stats              = ar9170_get_stats,
+        .get_tx_stats           = ar9170_get_tx_stats,
+};
+
+void *ar9170_alloc(size_t priv_size)
+{
+        struct ieee80211_hw *hw;
+        struct ar9170 *ar;
+        int i;
+
+        hw = ieee80211_alloc_hw(priv_size, &ar9170_ops);
+        if (!hw)
+                return ERR_PTR(-ENOMEM);
+
+        ar = hw->priv;
+        ar->hw = hw;
+
+        mutex_init(&ar->mutex);
+        spin_lock_init(&ar->cmdlock);
+        spin_lock_init(&ar->tx_stats_lock);
+        skb_queue_head_init(&ar->global_tx_status);
+        skb_queue_head_init(&ar->global_tx_status_waste);
+        INIT_WORK(&ar->filter_config_work, ar9170_set_filters);
+        INIT_WORK(&ar->beacon_work, ar9170_new_beacon);
+        INIT_DELAYED_WORK(&ar->tx_status_janitor, ar9170_tx_status_janitor);
+
+        /* all hw supports 2.4 GHz, so set channel to 1 by default */
+        ar->channel = &ar9170_2ghz_chantable[0];
+
+        /* first part of wiphy init */
+        ar->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                         BIT(NL80211_IFTYPE_WDS) |
+                                         BIT(NL80211_IFTYPE_ADHOC);
+        ar->hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
+                         IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
+                         IEEE80211_HW_SIGNAL_DBM |
+                         IEEE80211_HW_NOISE_DBM;
+
+        ar->hw->queues = __AR9170_NUM_TXQ;
+        ar->hw->extra_tx_headroom = 8;
+        ar->hw->sta_data_size = sizeof(struct ar9170_sta_info);
+
+        ar->hw->max_rates = 1;
+        ar->hw->max_rate_tries = 3;
+
+        for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
+                ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
+
+        return ar;
+}
+
+static int ar9170_read_eeprom(struct ar9170 *ar)
+{
+#define RW      8       /* number of words to read at once */
+#define RB      (sizeof(u32) * RW)
+        DECLARE_MAC_BUF(mbuf);
+        u8 *eeprom = (void *)&ar->eeprom;
+        u8 *addr = ar->eeprom.mac_address;
+        __le32 offsets[RW];
+        int i, j, err, bands = 0;
+
+        BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
+
+        BUILD_BUG_ON(RB > AR9170_MAX_CMD_LEN - 4);
+#ifndef __CHECKER__
+        /* don't want to handle trailing remains */
+        BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
+#endif
+
+        for (i = 0; i < sizeof(ar->eeprom)/RB; i++) {
+                for (j = 0; j < RW; j++)
+                        offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
+                                                 RB * i + 4 * j);
+
+                err = ar->exec_cmd(ar, AR9170_CMD_RREG,
+                                   RB, (u8 *) &offsets,
+                                   RB, eeprom + RB * i);
+                if (err)
+                        return err;
+        }
+
+#undef RW
+#undef RB
+
+        if (ar->eeprom.length == cpu_to_le16(0xFFFF))
+                return -ENODATA;
+
+        if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
+                ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar9170_band_2GHz;
+                bands++;
+        }
+        if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
+                ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &ar9170_band_5GHz;
+                bands++;
+        }
+        /*
+         * I measured this, a bandswitch takes roughly
+         * 135 ms and a frequency switch about 80.
+         *
+         * FIXME: measure these values again once EEPROM settings
+         *        are used, that will influence them!
+         */
+        if (bands == 2)
+                ar->hw->channel_change_time = 135 * 1000;
+        else
+                ar->hw->channel_change_time = 80 * 1000;
+
+        /* second part of wiphy init */
+        SET_IEEE80211_PERM_ADDR(ar->hw, addr);
+
+        return bands ? 0 : -EINVAL;
+}
+
+int ar9170_register(struct ar9170 *ar, struct device *pdev)
+{
+        int err;
+
+        /* try to read EEPROM, init MAC addr */
+        err = ar9170_read_eeprom(ar);
+        if (err)
+                goto err_out;
+
+        err = ieee80211_register_hw(ar->hw);
+        if (err)
+                goto err_out;
+
+        err = ar9170_init_leds(ar);
+        if (err)
+                goto err_unreg;
+
+#ifdef CONFIG_AR9170_LEDS
+        err = ar9170_register_leds(ar);
+        if (err)
+                goto err_unreg;
+#endif /* CONFIG_AR9170_LEDS */
+
+        dev_info(pdev, "Atheros AR9170 is registered as '%s'\n",
+                 wiphy_name(ar->hw->wiphy));
+
+        return err;
+
+err_unreg:
+        ieee80211_unregister_hw(ar->hw);
+
+err_out:
+        return err;
+}
+
+void ar9170_unregister(struct ar9170 *ar)
+{
+#ifdef CONFIG_AR9170_LEDS
+        ar9170_unregister_leds(ar);
+#endif /* CONFIG_AR9170_LEDS */
+
+        ieee80211_unregister_hw(ar->hw);
+        mutex_destroy(&ar->mutex);
+}
diff --git a/drivers/net/wireless/ar9170/phy.c b/drivers/net/wireless/ar9170/phy.c
new file mode 100644
index 000000000000..6ce20754b8e7
--- /dev/null
+++ b/drivers/net/wireless/ar9170/phy.c
@@ -0,0 +1,1240 @@
+/*
+ * Atheros AR9170 driver
+ *
+ * PHY and RF code
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/bitrev.h>
+#include "ar9170.h"
+#include "cmd.h"
+
+static int ar9170_init_power_cal(struct ar9170 *ar)
+{
+        ar9170_regwrite_begin(ar);
+
+        ar9170_regwrite(0x1bc000 + 0x993c, 0x7f);
+        ar9170_regwrite(0x1bc000 + 0x9934, 0x3f3f3f3f);
+        ar9170_regwrite(0x1bc000 + 0x9938, 0x3f3f3f3f);
+        ar9170_regwrite(0x1bc000 + 0xa234, 0x3f3f3f3f);
+        ar9170_regwrite(0x1bc000 + 0xa238, 0x3f3f3f3f);
+        ar9170_regwrite(0x1bc000 + 0xa38c, 0x3f3f3f3f);
+        ar9170_regwrite(0x1bc000 + 0xa390, 0x3f3f3f3f);
+        ar9170_regwrite(0x1bc000 + 0xa3cc, 0x3f3f3f3f);
+        ar9170_regwrite(0x1bc000 + 0xa3d0, 0x3f3f3f3f);
+        ar9170_regwrite(0x1bc000 + 0xa3d4, 0x3f3f3f3f);
+
+        ar9170_regwrite_finish();
+        return ar9170_regwrite_result();
+}
+
+struct ar9170_phy_init {
+        u32 reg, _5ghz_20, _5ghz_40, _2ghz_40, _2ghz_20;
+};
+
+static struct ar9170_phy_init ar5416_phy_init[] = {
+        { 0x1c5800, 0x00000007, 0x00000007, 0x00000007, 0x00000007, },
+        { 0x1c5804, 0x00000300, 0x000003c4, 0x000003c4, 0x00000300, },
+        { 0x1c5808, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c580c, 0xad848e19, 0xad848e19, 0xad848e19, 0xad848e19, },
+        { 0x1c5810, 0x7d14e000, 0x7d14e000, 0x7d14e000, 0x7d14e000, },
+        { 0x1c5814, 0x9c0a9f6b, 0x9c0a9f6b, 0x9c0a9f6b, 0x9c0a9f6b, },
+        { 0x1c5818, 0x00000090, 0x00000090, 0x00000090, 0x00000090, },
+        { 0x1c581c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5820, 0x02020200, 0x02020200, 0x02020200, 0x02020200, },
+        { 0x1c5824, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, },
+        { 0x1c5828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, },
+        { 0x1c582c, 0x0000a000, 0x0000a000, 0x0000a000, 0x0000a000, },
+        { 0x1c5830, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5834, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, },
+        { 0x1c5838, 0x00000007, 0x00000007, 0x00000007, 0x00000007, },
+        { 0x1c583c, 0x00200400, 0x00200400, 0x00200400, 0x00200400, },
+        { 0x1c5840, 0x206a002e, 0x206a002e, 0x206a002e, 0x206a002e, },
+        { 0x1c5844, 0x1372161e, 0x13721c1e, 0x13721c24, 0x137216a4, },
+        { 0x1c5848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, },
+        { 0x1c584c, 0x1284233c, 0x1284233c, 0x1284233c, 0x1284233c, },
+        { 0x1c5850, 0x6c48b4e4, 0x6c48b4e4, 0x6c48b0e4, 0x6c48b0e4, },
+        { 0x1c5854, 0x00000859, 0x00000859, 0x00000859, 0x00000859, },
+        { 0x1c5858, 0x7ec80d2e, 0x7ec80d2e, 0x7ec80d2e, 0x7ec80d2e, },
+        { 0x1c585c, 0x31395c5e, 0x31395c5e, 0x31395c5e, 0x31395c5e, },
+        { 0x1c5860, 0x0004dd10, 0x0004dd10, 0x0004dd20, 0x0004dd20, },
+        { 0x1c5868, 0x409a4190, 0x409a4190, 0x409a4190, 0x409a4190, },
+        { 0x1c586c, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081, },
+        { 0x1c5900, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5904, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5908, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c590c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5914, 0x000007d0, 0x000007d0, 0x00000898, 0x00000898, },
+        { 0x1c5918, 0x00000118, 0x00000230, 0x00000268, 0x00000134, },
+        { 0x1c591c, 0x10000fff, 0x10000fff, 0x10000fff, 0x10000fff, },
+        { 0x1c5920, 0x0510081c, 0x0510081c, 0x0510001c, 0x0510001c, },
+        { 0x1c5924, 0xd0058a15, 0xd0058a15, 0xd0058a15, 0xd0058a15, },
+        { 0x1c5928, 0x00000001, 0x00000001, 0x00000001, 0x00000001, },
+        { 0x1c592c, 0x00000004, 0x00000004, 0x00000004, 0x00000004, },
+        { 0x1c5934, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c5938, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c593c, 0x0000007f, 0x0000007f, 0x0000007f, 0x0000007f, },
+        { 0x1c5944, 0xdfb81020, 0xdfb81020, 0xdfb81020, 0xdfb81020, },
+        { 0x1c5948, 0x9280b212, 0x9280b212, 0x9280b212, 0x9280b212, },
+        { 0x1c594c, 0x00020028, 0x00020028, 0x00020028, 0x00020028, },
+        { 0x1c5954, 0x5d50e188, 0x5d50e188, 0x5d50e188, 0x5d50e188, },
+        { 0x1c5958, 0x00081fff, 0x00081fff, 0x00081fff, 0x00081fff, },
+        { 0x1c5960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, },
+        { 0x1c5964, 0x00001120, 0x00001120, 0x00001120, 0x00001120, },
+        { 0x1c5970, 0x190fb515, 0x190fb515, 0x190fb515, 0x190fb515, },
+        { 0x1c5974, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5978, 0x00000001, 0x00000001, 0x00000001, 0x00000001, },
+        { 0x1c597c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5980, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5984, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5988, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c598c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5990, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5994, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5998, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c599c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59a0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59a4, 0x00000007, 0x00000007, 0x00000007, 0x00000007, },
+        { 0x1c59a8, 0x001fff00, 0x001fff00, 0x001fff00, 0x001fff00, },
+        { 0x1c59ac, 0x006f00c4, 0x006f00c4, 0x006f00c4, 0x006f00c4, },
+        { 0x1c59b0, 0x03051000, 0x03051000, 0x03051000, 0x03051000, },
+        { 0x1c59b4, 0x00000820, 0x00000820, 0x00000820, 0x00000820, },
+        { 0x1c59c0, 0x038919be, 0x038919be, 0x038919be, 0x038919be, },
+        { 0x1c59c4, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77, },
+        { 0x1c59c8, 0x60f6532c, 0x60f6532c, 0x60f6532c, 0x60f6532c, },
+        { 0x1c59cc, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8, },
+        { 0x1c59d0, 0x00046384, 0x00046384, 0x00046384, 0x00046384, },
+        { 0x1c59d4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59dc, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59e0, 0x00000200, 0x00000200, 0x00000200, 0x00000200, },
+        { 0x1c59e4, 0x64646464, 0x64646464, 0x64646464, 0x64646464, },
+        { 0x1c59e8, 0x3c787878, 0x3c787878, 0x3c787878, 0x3c787878, },
+        { 0x1c59ec, 0x000000aa, 0x000000aa, 0x000000aa, 0x000000aa, },
+        { 0x1c59f0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59fc, 0x00001042, 0x00001042, 0x00001042, 0x00001042, },
+        { 0x1c5a00, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5a04, 0x00000040, 0x00000040, 0x00000040, 0x00000040, },
+        { 0x1c5a08, 0x00000080, 0x00000080, 0x00000080, 0x00000080, },
+        { 0x1c5a0c, 0x000001a1, 0x000001a1, 0x00000141, 0x00000141, },
+        { 0x1c5a10, 0x000001e1, 0x000001e1, 0x00000181, 0x00000181, },
+        { 0x1c5a14, 0x00000021, 0x00000021, 0x000001c1, 0x000001c1, },
+        { 0x1c5a18, 0x00000061, 0x00000061, 0x00000001, 0x00000001, },
+        { 0x1c5a1c, 0x00000168, 0x00000168, 0x00000041, 0x00000041, },
+        { 0x1c5a20, 0x000001a8, 0x000001a8, 0x000001a8, 0x000001a8, },
+        { 0x1c5a24, 0x000001e8, 0x000001e8, 0x000001e8, 0x000001e8, },
+        { 0x1c5a28, 0x00000028, 0x00000028, 0x00000028, 0x00000028, },
+        { 0x1c5a2c, 0x00000068, 0x00000068, 0x00000068, 0x00000068, },
+        { 0x1c5a30, 0x00000189, 0x00000189, 0x000000a8, 0x000000a8, },
+        { 0x1c5a34, 0x000001c9, 0x000001c9, 0x00000169, 0x00000169, },
+        { 0x1c5a38, 0x00000009, 0x00000009, 0x000001a9, 0x000001a9, },
+        { 0x1c5a3c, 0x00000049, 0x00000049, 0x000001e9, 0x000001e9, },
+        { 0x1c5a40, 0x00000089, 0x00000089, 0x00000029, 0x00000029, },
+        { 0x1c5a44, 0x00000170, 0x00000170, 0x00000069, 0x00000069, },
+        { 0x1c5a48, 0x000001b0, 0x000001b0, 0x00000190, 0x00000190, },
+        { 0x1c5a4c, 0x000001f0, 0x000001f0, 0x000001d0, 0x000001d0, },
+        { 0x1c5a50, 0x00000030, 0x00000030, 0x00000010, 0x00000010, },
+        { 0x1c5a54, 0x00000070, 0x00000070, 0x00000050, 0x00000050, },
+        { 0x1c5a58, 0x00000191, 0x00000191, 0x00000090, 0x00000090, },
+        { 0x1c5a5c, 0x000001d1, 0x000001d1, 0x00000151, 0x00000151, },
+        { 0x1c5a60, 0x00000011, 0x00000011, 0x00000191, 0x00000191, },
+        { 0x1c5a64, 0x00000051, 0x00000051, 0x000001d1, 0x000001d1, },
+        { 0x1c5a68, 0x00000091, 0x00000091, 0x00000011, 0x00000011, },
+        { 0x1c5a6c, 0x000001b8, 0x000001b8, 0x00000051, 0x00000051, },
+        { 0x1c5a70, 0x000001f8, 0x000001f8, 0x00000198, 0x00000198, },
+        { 0x1c5a74, 0x00000038, 0x00000038, 0x000001d8, 0x000001d8, },
+        { 0x1c5a78, 0x00000078, 0x00000078, 0x00000018, 0x00000018, },
+        { 0x1c5a7c, 0x00000199, 0x00000199, 0x00000058, 0x00000058, },
+        { 0x1c5a80, 0x000001d9, 0x000001d9, 0x00000098, 0x00000098, },
+        { 0x1c5a84, 0x00000019, 0x00000019, 0x00000159, 0x00000159, },
+        { 0x1c5a88, 0x00000059, 0x00000059, 0x00000199, 0x00000199, },
+        { 0x1c5a8c, 0x00000099, 0x00000099, 0x000001d9, 0x000001d9, },
+        { 0x1c5a90, 0x000000d9, 0x000000d9, 0x00000019, 0x00000019, },
+        { 0x1c5a94, 0x000000f9, 0x000000f9, 0x00000059, 0x00000059, },
+        { 0x1c5a98, 0x000000f9, 0x000000f9, 0x00000099, 0x00000099, },
+        { 0x1c5a9c, 0x000000f9, 0x000000f9, 0x000000d9, 0x000000d9, },
+        { 0x1c5aa0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5aa4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5aa8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5aac, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ab0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ab4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ab8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5abc, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ac0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ac4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ac8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5acc, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ad0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ad4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ad8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5adc, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ae0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ae4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ae8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5aec, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5af0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5af4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5af8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5afc, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5b00, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5b04, 0x00000001, 0x00000001, 0x00000001, 0x00000001, },
+        { 0x1c5b08, 0x00000002, 0x00000002, 0x00000002, 0x00000002, },
+        { 0x1c5b0c, 0x00000003, 0x00000003, 0x00000003, 0x00000003, },
+        { 0x1c5b10, 0x00000004, 0x00000004, 0x00000004, 0x00000004, },
+        { 0x1c5b14, 0x00000005, 0x00000005, 0x00000005, 0x00000005, },
+        { 0x1c5b18, 0x00000008, 0x00000008, 0x00000008, 0x00000008, },
+        { 0x1c5b1c, 0x00000009, 0x00000009, 0x00000009, 0x00000009, },
+        { 0x1c5b20, 0x0000000a, 0x0000000a, 0x0000000a, 0x0000000a, },
+        { 0x1c5b24, 0x0000000b, 0x0000000b, 0x0000000b, 0x0000000b, },
+        { 0x1c5b28, 0x0000000c, 0x0000000c, 0x0000000c, 0x0000000c, },
+        { 0x1c5b2c, 0x0000000d, 0x0000000d, 0x0000000d, 0x0000000d, },
+        { 0x1c5b30, 0x00000010, 0x00000010, 0x00000010, 0x00000010, },
+        { 0x1c5b34, 0x00000011, 0x00000011, 0x00000011, 0x00000011, },
+        { 0x1c5b38, 0x00000012, 0x00000012, 0x00000012, 0x00000012, },
+        { 0x1c5b3c, 0x00000013, 0x00000013, 0x00000013, 0x00000013, },
+        { 0x1c5b40, 0x00000014, 0x00000014, 0x00000014, 0x00000014, },
+        { 0x1c5b44, 0x00000015, 0x00000015, 0x00000015, 0x00000015, },
+        { 0x1c5b48, 0x00000018, 0x00000018, 0x00000018, 0x00000018, },
+        { 0x1c5b4c, 0x00000019, 0x00000019, 0x00000019, 0x00000019, },
+        { 0x1c5b50, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a, },
+        { 0x1c5b54, 0x0000001b, 0x0000001b, 0x0000001b, 0x0000001b, },
+        { 0x1c5b58, 0x0000001c, 0x0000001c, 0x0000001c, 0x0000001c, },
+        { 0x1c5b5c, 0x0000001d, 0x0000001d, 0x0000001d, 0x0000001d, },
+        { 0x1c5b60, 0x00000020, 0x00000020, 0x00000020, 0x00000020, },
+        { 0x1c5b64, 0x00000021, 0x00000021, 0x00000021, 0x00000021, },
+        { 0x1c5b68, 0x00000022, 0x00000022, 0x00000022, 0x00000022, },
+        { 0x1c5b6c, 0x00000023, 0x00000023, 0x00000023, 0x00000023, },
+        { 0x1c5b70, 0x00000024, 0x00000024, 0x00000024, 0x00000024, },
+        { 0x1c5b74, 0x00000025, 0x00000025, 0x00000025, 0x00000025, },
+        { 0x1c5b78, 0x00000028, 0x00000028, 0x00000028, 0x00000028, },
+        { 0x1c5b7c, 0x00000029, 0x00000029, 0x00000029, 0x00000029, },
+        { 0x1c5b80, 0x0000002a, 0x0000002a, 0x0000002a, 0x0000002a, },
+        { 0x1c5b84, 0x0000002b, 0x0000002b, 0x0000002b, 0x0000002b, },
+        { 0x1c5b88, 0x0000002c, 0x0000002c, 0x0000002c, 0x0000002c, },
+        { 0x1c5b8c, 0x0000002d, 0x0000002d, 0x0000002d, 0x0000002d, },
+        { 0x1c5b90, 0x00000030, 0x00000030, 0x00000030, 0x00000030, },
+        { 0x1c5b94, 0x00000031, 0x00000031, 0x00000031, 0x00000031, },
+        { 0x1c5b98, 0x00000032, 0x00000032, 0x00000032, 0x00000032, },
+        { 0x1c5b9c, 0x00000033, 0x00000033, 0x00000033, 0x00000033, },
+        { 0x1c5ba0, 0x00000034, 0x00000034, 0x00000034, 0x00000034, },
+        { 0x1c5ba4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5ba8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bac, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bb0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bb4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bb8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bbc, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bc0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bc4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bc8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bcc, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bd0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bd4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bd8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bdc, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5be0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5be4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5be8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bec, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bf0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bf4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bf8, 0x00000010, 0x00000010, 0x00000010, 0x00000010, },
+        { 0x1c5bfc, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a, },
+        { 0x1c5c00, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c0c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c10, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c14, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c18, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c1c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c20, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c24, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c28, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c2c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c30, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c34, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c38, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c3c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5cf0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5cf4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5cf8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5cfc, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6200, 0x00000008, 0x00000008, 0x0000000e, 0x0000000e, },
+        { 0x1c6204, 0x00000440, 0x00000440, 0x00000440, 0x00000440, },
+        { 0x1c6208, 0xd6be4788, 0xd6be4788, 0xd03e4788, 0xd03e4788, },
+        { 0x1c620c, 0x012e8160, 0x012e8160, 0x012a8160, 0x012a8160, },
+        { 0x1c6210, 0x40806333, 0x40806333, 0x40806333, 0x40806333, },
+        { 0x1c6214, 0x00106c10, 0x00106c10, 0x00106c10, 0x00106c10, },
+        { 0x1c6218, 0x009c4060, 0x009c4060, 0x009c4060, 0x009c4060, },
+        { 0x1c621c, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a, },
+        { 0x1c6220, 0x018830c6, 0x018830c6, 0x018830c6, 0x018830c6, },
+        { 0x1c6224, 0x00000400, 0x00000400, 0x00000400, 0x00000400, },
+        { 0x1c6228, 0x000009b5, 0x000009b5, 0x000009b5, 0x000009b5, },
+        { 0x1c622c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6230, 0x00000108, 0x00000210, 0x00000210, 0x00000108, },
+        { 0x1c6234, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c6238, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c623c, 0x13c889af, 0x13c889af, 0x13c889af, 0x13c889af, },
+        { 0x1c6240, 0x38490a20, 0x38490a20, 0x38490a20, 0x38490a20, },
+        { 0x1c6244, 0x00007bb6, 0x00007bb6, 0x00007bb6, 0x00007bb6, },
+        { 0x1c6248, 0x0fff3ffc, 0x0fff3ffc, 0x0fff3ffc, 0x0fff3ffc, },
+        { 0x1c624c, 0x00000001, 0x00000001, 0x00000001, 0x00000001, },
+        { 0x1c6250, 0x0000a000, 0x0000a000, 0x0000a000, 0x0000a000, },
+        { 0x1c6254, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6258, 0x0cc75380, 0x0cc75380, 0x0cc75380, 0x0cc75380, },
+        { 0x1c625c, 0x0f0f0f01, 0x0f0f0f01, 0x0f0f0f01, 0x0f0f0f01, },
+        { 0x1c6260, 0xdfa91f01, 0xdfa91f01, 0xdfa91f01, 0xdfa91f01, },
+        { 0x1c6264, 0x00418a11, 0x00418a11, 0x00418a11, 0x00418a11, },
+        { 0x1c6268, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c626c, 0x09249126, 0x09249126, 0x09249126, 0x09249126, },
+        { 0x1c6274, 0x0a1a9caa, 0x0a1a9caa, 0x0a1a7caa, 0x0a1a7caa, },
+        { 0x1c6278, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, },
+        { 0x1c627c, 0x051701ce, 0x051701ce, 0x051701ce, 0x051701ce, },
+        { 0x1c6300, 0x18010000, 0x18010000, 0x18010000, 0x18010000, },
+        { 0x1c6304, 0x30032602, 0x30032602, 0x2e032402, 0x2e032402, },
+        { 0x1c6308, 0x48073e06, 0x48073e06, 0x4a0a3c06, 0x4a0a3c06, },
+        { 0x1c630c, 0x560b4c0a, 0x560b4c0a, 0x621a540b, 0x621a540b, },
+        { 0x1c6310, 0x641a600f, 0x641a600f, 0x764f6c1b, 0x764f6c1b, },
+        { 0x1c6314, 0x7a4f6e1b, 0x7a4f6e1b, 0x845b7a5a, 0x845b7a5a, },
+        { 0x1c6318, 0x8c5b7e5a, 0x8c5b7e5a, 0x950f8ccf, 0x950f8ccf, },
+        { 0x1c631c, 0x9d0f96cf, 0x9d0f96cf, 0xa5cf9b4f, 0xa5cf9b4f, },
+        { 0x1c6320, 0xb51fa69f, 0xb51fa69f, 0xbddfaf1f, 0xbddfaf1f, },
+        { 0x1c6324, 0xcb3fbd07, 0xcb3fbcbf, 0xd1ffc93f, 0xd1ffc93f, },
+        { 0x1c6328, 0x0000d7bf, 0x0000d7bf, 0x00000000, 0x00000000, },
+        { 0x1c632c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6330, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6334, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6338, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c633c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6340, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6344, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6348, 0x3fffffff, 0x3fffffff, 0x3fffffff, 0x3fffffff, },
+        { 0x1c634c, 0x3fffffff, 0x3fffffff, 0x3fffffff, 0x3fffffff, },
+        { 0x1c6350, 0x3fffffff, 0x3fffffff, 0x3fffffff, 0x3fffffff, },
+        { 0x1c6354, 0x0003ffff, 0x0003ffff, 0x0003ffff, 0x0003ffff, },
+        { 0x1c6358, 0x79a8aa1f, 0x79a8aa1f, 0x79a8aa1f, 0x79a8aa1f, },
+        { 0x1c6388, 0x08000000, 0x08000000, 0x08000000, 0x08000000, },
+        { 0x1c638c, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c6390, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c6394, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, },
+        { 0x1c6398, 0x000001ce, 0x000001ce, 0x000001ce, 0x000001ce, },
+        { 0x1c639c, 0x00000007, 0x00000007, 0x00000007, 0x00000007, },
+        { 0x1c63a0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63a4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63a8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63ac, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63b0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63b4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63b8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63bc, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63c0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63c4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63cc, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c63d0, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c63d4, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c63d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63dc, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, },
+        { 0x1c63e0, 0x000000c0, 0x000000c0, 0x000000c0, 0x000000c0, },
+        { 0x1c6848, 0x00180a65, 0x00180a65, 0x00180a68, 0x00180a68, },
+        { 0x1c6920, 0x0510001c, 0x0510001c, 0x0510001c, 0x0510001c, },
+        { 0x1c6960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, },
+        { 0x1c720c, 0x012e8160, 0x012e8160, 0x012a8160, 0x012a8160, },
+        { 0x1c726c, 0x09249126, 0x09249126, 0x09249126, 0x09249126, },
+        { 0x1c7848, 0x00180a65, 0x00180a65, 0x00180a68, 0x00180a68, },
+        { 0x1c7920, 0x0510001c, 0x0510001c, 0x0510001c, 0x0510001c, },
+        { 0x1c7960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, },
+        { 0x1c820c, 0x012e8160, 0x012e8160, 0x012a8160, 0x012a8160, },
+        { 0x1c826c, 0x09249126, 0x09249126, 0x09249126, 0x09249126, },
+/*      { 0x1c8864, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00, }, */
+        { 0x1c8864, 0x0001c600, 0x0001c600, 0x0001c600, 0x0001c600, },
+        { 0x1c895c, 0x004b6a8e, 0x004b6a8e, 0x004b6a8e, 0x004b6a8e, },
+        { 0x1c8968, 0x000003ce, 0x000003ce, 0x000003ce, 0x000003ce, },
+        { 0x1c89bc, 0x00181400, 0x00181400, 0x00181400, 0x00181400, },
+        { 0x1c9270, 0x00820820, 0x00820820, 0x00820820, 0x00820820, },
+        { 0x1c935c, 0x066c420f, 0x066c420f, 0x066c420f, 0x066c420f, },
+        { 0x1c9360, 0x0f282207, 0x0f282207, 0x0f282207, 0x0f282207, },
+        { 0x1c9364, 0x17601685, 0x17601685, 0x17601685, 0x17601685, },
+        { 0x1c9368, 0x1f801104, 0x1f801104, 0x1f801104, 0x1f801104, },
+        { 0x1c936c, 0x37a00c03, 0x37a00c03, 0x37a00c03, 0x37a00c03, },
+        { 0x1c9370, 0x3fc40883, 0x3fc40883, 0x3fc40883, 0x3fc40883, },
+        { 0x1c9374, 0x57c00803, 0x57c00803, 0x57c00803, 0x57c00803, },
+        { 0x1c9378, 0x5fd80682, 0x5fd80682, 0x5fd80682, 0x5fd80682, },
+        { 0x1c937c, 0x7fe00482, 0x7fe00482, 0x7fe00482, 0x7fe00482, },
+        { 0x1c9380, 0x7f3c7bba, 0x7f3c7bba, 0x7f3c7bba, 0x7f3c7bba, },
+        { 0x1c9384, 0xf3307ff0, 0xf3307ff0, 0xf3307ff0, 0xf3307ff0, }
+};
+
+int ar9170_init_phy(struct ar9170 *ar, enum ieee80211_band band)
+{
+        int i, err;
+        u32 val;
+        bool is_2ghz = band == IEEE80211_BAND_2GHZ;
+        bool is_40mhz = false; /* XXX: for now */
+
+        ar9170_regwrite_begin(ar);
+
+        for (i = 0; i < ARRAY_SIZE(ar5416_phy_init); i++) {
+                if (is_40mhz) {
+                        if (is_2ghz)
+                                val = ar5416_phy_init[i]._2ghz_40;
+                        else
+                                val = ar5416_phy_init[i]._5ghz_40;
+                } else {
+                        if (is_2ghz)
+                                val = ar5416_phy_init[i]._2ghz_20;
+                        else
+                                val = ar5416_phy_init[i]._5ghz_20;
+                }
+
+                ar9170_regwrite(ar5416_phy_init[i].reg, val);
+        }
+
+        ar9170_regwrite_finish();
+        err = ar9170_regwrite_result();
+        if (err)
+                return err;
+
+        /* XXX: use EEPROM data here! */
+
+        err = ar9170_init_power_cal(ar);
+        if (err)
+                return err;
+
+        /* XXX: remove magic! */
+        if (is_2ghz)
+                err = ar9170_write_reg(ar, 0x1d4014, 0x5163);
+        else
+                err = ar9170_write_reg(ar, 0x1d4014, 0x5143);
+
+        return err;
+}
+
+struct ar9170_rf_init {
+        u32 reg, _5ghz, _2ghz;
+};
+
+static struct ar9170_rf_init ar9170_rf_init[] = {
+     /* bank 0 */
+     { 0x1c58b0,  0x1e5795e5,  0x1e5795e5},
+     { 0x1c58e0,  0x02008020,  0x02008020},
+     /* bank 1 */
+     { 0x1c58b0,  0x02108421,  0x02108421},
+     { 0x1c58ec,  0x00000008,  0x00000008},
+     /* bank 2 */
+     { 0x1c58b0,  0x0e73ff17,  0x0e73ff17},
+     { 0x1c58e0,  0x00000420,  0x00000420},
+     /* bank 3 */
+     { 0x1c58f0,  0x01400018,  0x01c00018},
+     /* bank 4 */
+     { 0x1c58b0,  0x000001a1,  0x000001a1},
+     { 0x1c58e8,  0x00000001,  0x00000001},
+     /* bank 5 */
+     { 0x1c58b0,  0x00000013,  0x00000013},
+     { 0x1c58e4,  0x00000002,  0x00000002},
+     /* bank 6 */
+     { 0x1c58b0,  0x00000000,  0x00000000},
+     { 0x1c58b0,  0x00000000,  0x00000000},
+     { 0x1c58b0,  0x00000000,  0x00000000},
+     { 0x1c58b0,  0x00000000,  0x00000000},
+     { 0x1c58b0,  0x00000000,  0x00000000},
+     { 0x1c58b0,  0x00004000,  0x00004000},
+     { 0x1c58b0,  0x00006c00,  0x00006c00},
+     { 0x1c58b0,  0x00002c00,  0x00002c00},
+     { 0x1c58b0,  0x00004800,  0x00004800},
+     { 0x1c58b0,  0x00004000,  0x00004000},
+     { 0x1c58b0,  0x00006000,  0x00006000},
+     { 0x1c58b0,  0x00001000,  0x00001000},
+     { 0x1c58b0,  0x00004000,  0x00004000},
+     { 0x1c58b0,  0x00007c00,  0x00007c00},
+     { 0x1c58b0,  0x00007c00,  0x00007c00},
+     { 0x1c58b0,  0x00007c00,  0x00007c00},
+     { 0x1c58b0,  0x00007c00,  0x00007c00},
+     { 0x1c58b0,  0x00007c00,  0x00007c00},
+     { 0x1c58b0,  0x00087c00,  0x00087c00},
+     { 0x1c58b0,  0x00007c00,  0x00007c00},
+     { 0x1c58b0,  0x00005400,  0x00005400},
+     { 0x1c58b0,  0x00000c00,  0x00000c00},
+     { 0x1c58b0,  0x00001800,  0x00001800},
+     { 0x1c58b0,  0x00007c00,  0x00007c00},
+     { 0x1c58b0,  0x00006c00,  0x00006c00},
+     { 0x1c58b0,  0x00006c00,  0x00006c00},
+     { 0x1c58b0,  0x00007c00,  0x00007c00},
+     { 0x1c58b0,  0x00002c00,  0x00002c00},
+     { 0x1c58b0,  0x00003c00,  0x00003c00},
+     { 0x1c58b0,  0x00003800,  0x00003800},
+     { 0x1c58b0,  0x00001c00,  0x00001c00},
+     { 0x1c58b0,  0x00000800,  0x00000800},
+     { 0x1c58b0,  0x00000408,  0x00000408},
+     { 0x1c58b0,  0x00004c15,  0x00004c15},
+     { 0x1c58b0,  0x00004188,  0x00004188},
+     { 0x1c58b0,  0x0000201e,  0x0000201e},
+     { 0x1c58b0,  0x00010408,  0x00010408},
+     { 0x1c58b0,  0x00000801,  0x00000801},
+     { 0x1c58b0,  0x00000c08,  0x00000c08},
+     { 0x1c58b0,  0x0000181e,  0x0000181e},
+     { 0x1c58b0,  0x00001016,  0x00001016},
+     { 0x1c58b0,  0x00002800,  0x00002800},
+     { 0x1c58b0,  0x00004010,  0x00004010},
+     { 0x1c58b0,  0x0000081c,  0x0000081c},
+     { 0x1c58b0,  0x00000115,  0x00000115},
+     { 0x1c58b0,  0x00000015,  0x00000015},
+     { 0x1c58b0,  0x00000066,  0x00000066},
+     { 0x1c58b0,  0x0000001c,  0x0000001c},
+     { 0x1c58b0,  0x00000000,  0x00000000},
+     { 0x1c58b0,  0x00000004,  0x00000004},
+     { 0x1c58b0,  0x00000015,  0x00000015},
+     { 0x1c58b0,  0x0000001f,  0x0000001f},
+     { 0x1c58e0,  0x00000000,  0x00000400},
+     /* bank 7 */
+     { 0x1c58b0,  0x000000a0,  0x000000a0},
+     { 0x1c58b0,  0x00000000,  0x00000000},
+     { 0x1c58b0,  0x00000040,  0x00000040},
+     { 0x1c58f0,  0x0000001c,  0x0000001c},
+};
+
+static int ar9170_init_rf_banks_0_7(struct ar9170 *ar, bool band5ghz)
+{
+        int err, i;
+
+        ar9170_regwrite_begin(ar);
+
+        for (i = 0; i < ARRAY_SIZE(ar9170_rf_init); i++)
+                ar9170_regwrite(ar9170_rf_init[i].reg,
+                                band5ghz ? ar9170_rf_init[i]._5ghz
+                                         : ar9170_rf_init[i]._2ghz);
+
+        ar9170_regwrite_finish();
+        err = ar9170_regwrite_result();
+        if (err)
+                printk(KERN_ERR "%s: rf init failed\n",
+                       wiphy_name(ar->hw->wiphy));
+        return err;
+}
+
+static int ar9170_init_rf_bank4_pwr(struct ar9170 *ar, bool band5ghz,
+                                    u32 freq, enum ar9170_bw bw)
+{
+        int err;
+        u32 d0, d1, td0, td1, fd0, fd1;
+        u8 chansel;
+        u8 refsel0 = 1, refsel1 = 0;
+        u8 lf_synth = 0;
+
+        switch (bw) {
+        case AR9170_BW_40_ABOVE:
+                freq += 10;
+                break;
+        case AR9170_BW_40_BELOW:
+                freq -= 10;
+                break;
+        case AR9170_BW_20:
+                break;
+        case __AR9170_NUM_BW:
+                BUG();
+        }
+
+        if (band5ghz) {
+                if (freq % 10) {
+                        chansel = (freq - 4800) / 5;
+                } else {
+                        chansel = ((freq - 4800) / 10) * 2;
+                        refsel0 = 0;
+                        refsel1 = 1;
+                }
+                chansel = byte_rev_table[chansel];
+        } else {
+                if (freq == 2484) {
+                        chansel = 10 + (freq - 2274) / 5;
+                        lf_synth = 1;
+                } else
+                        chansel = 16 + (freq - 2272) / 5;
+                chansel *= 4;
+                chansel = byte_rev_table[chansel];
+        }
+
+        d1 =    chansel;
+        d0 =    0x21 |
+                refsel0 << 3 |
+                refsel1 << 2 |
+                lf_synth << 1;
+        td0 =   d0 & 0x1f;
+        td1 =   d1 & 0x1f;
+        fd0 =   td1 << 5 | td0;
+
+        td0 =   (d0 >> 5) & 0x7;
+        td1 =   (d1 >> 5) & 0x7;
+        fd1 =   td1 << 5 | td0;
+
+        ar9170_regwrite_begin(ar);
+
+        ar9170_regwrite(0x1c58b0, fd0);
+        ar9170_regwrite(0x1c58e8, fd1);
+
+        ar9170_regwrite_finish();
+        err = ar9170_regwrite_result();
+        if (err)
+                return err;
+
+        msleep(10);
+
+        return 0;
+}
+
+struct ar9170_phy_freq_params {
+        u8 coeff_exp;
+        u16 coeff_man;
+        u8 coeff_exp_shgi;
+        u16 coeff_man_shgi;
+};
+
+struct ar9170_phy_freq_entry {
+        u16 freq;
+        struct ar9170_phy_freq_params params[__AR9170_NUM_BW];
+};
+
+/* NB: must be in sync with channel tables in main! */
+static const struct ar9170_phy_freq_entry ar9170_phy_freq_params[] = {
+/*
+ *      freq,
+ *              20MHz,
+ *              40MHz (below),
+ *              40Mhz (above),
+ */
+        { 2412, {
+                { 3, 21737, 3, 19563, },
+                { 3, 21827, 3, 19644, },
+                { 3, 21647, 3, 19482, },
+        } },
+        { 2417, {
+                { 3, 21692, 3, 19523, },
+                { 3, 21782, 3, 19604, },
+                { 3, 21602, 3, 19442, },
+        } },
+        { 2422, {
+                { 3, 21647, 3, 19482, },
+                { 3, 21737, 3, 19563, },
+                { 3, 21558, 3, 19402, },
+        } },
+        { 2427, {
+                { 3, 21602, 3, 19442, },
+                { 3, 21692, 3, 19523, },
+                { 3, 21514, 3, 19362, },
+        } },
+        { 2432, {
+                { 3, 21558, 3, 19402, },
+                { 3, 21647, 3, 19482, },
+                { 3, 21470, 3, 19323, },
+        } },
+        { 2437, {
+                { 3, 21514, 3, 19362, },
+                { 3, 21602, 3, 19442, },
+                { 3, 21426, 3, 19283, },
+        } },
+        { 2442, {
+                { 3, 21470, 3, 19323, },
+                { 3, 21558, 3, 19402, },
+                { 3, 21382, 3, 19244, },
+        } },
+        { 2447, {
+                { 3, 21426, 3, 19283, },
+                { 3, 21514, 3, 19362, },
+                { 3, 21339, 3, 19205, },
+        } },
+        { 2452, {
+                { 3, 21382, 3, 19244, },
+                { 3, 21470, 3, 19323, },
+                { 3, 21295, 3, 19166, },
+        } },
+        { 2457, {
+                { 3, 21339, 3, 19205, },
+                { 3, 21426, 3, 19283, },
+                { 3, 21252, 3, 19127, },
+        } },
+        { 2462, {
+                { 3, 21295, 3, 19166, },
+                { 3, 21382, 3, 19244, },
+                { 3, 21209, 3, 19088, },
+        } },
+        { 2467, {
+                { 3, 21252, 3, 19127, },
+                { 3, 21339, 3, 19205, },
+                { 3, 21166, 3, 19050, },
+        } },
+        { 2472, {
+                { 3, 21209, 3, 19088, },
+                { 3, 21295, 3, 19166, },
+                { 3, 21124, 3, 19011, },
+        } },
+        { 2484, {
+                { 3, 21107, 3, 18996, },
+                { 3, 21192, 3, 19073, },
+                { 3, 21022, 3, 18920, },
+        } },
+        { 4920, {
+                { 4, 21313, 4, 19181, },
+                { 4, 21356, 4, 19220, },
+                { 4, 21269, 4, 19142, },
+        } },
+        { 4940, {
+                { 4, 21226, 4, 19104, },
+                { 4, 21269, 4, 19142, },
+                { 4, 21183, 4, 19065, },
+        } },
+        { 4960, {
+                { 4, 21141, 4, 19027, },
+                { 4, 21183, 4, 19065, },
+                { 4, 21098, 4, 18988, },
+        } },
+        { 4980, {
+                { 4, 21056, 4, 18950, },
+                { 4, 21098, 4, 18988, },
+                { 4, 21014, 4, 18912, },
+        } },
+        { 5040, {
+                { 4, 20805, 4, 18725, },
+                { 4, 20846, 4, 18762, },
+                { 4, 20764, 4, 18687, },
+        } },
+        { 5060, {
+                { 4, 20723, 4, 18651, },
+                { 4, 20764, 4, 18687, },
+                { 4, 20682, 4, 18614, },
+        } },
+        { 5080, {
+                { 4, 20641, 4, 18577, },
+                { 4, 20682, 4, 18614, },
+                { 4, 20601, 4, 18541, },
+        } },
+        { 5180, {
+                { 4, 20243, 4, 18219, },
+                { 4, 20282, 4, 18254, },
+                { 4, 20204, 4, 18183, },
+        } },
+        { 5200, {
+                { 4, 20165, 4, 18148, },
+                { 4, 20204, 4, 18183, },
+                { 4, 20126, 4, 18114, },
+        } },
+        { 5220, {
+                { 4, 20088, 4, 18079, },
+                { 4, 20126, 4, 18114, },
+                { 4, 20049, 4, 18044, },
+        } },
+        { 5240, {
+                { 4, 20011, 4, 18010, },
+                { 4, 20049, 4, 18044, },
+                { 4, 19973, 4, 17976, },
+        } },
+        { 5260, {
+                { 4, 19935, 4, 17941, },
+                { 4, 19973, 4, 17976, },
+                { 4, 19897, 4, 17907, },
+        } },
+        { 5280, {
+                { 4, 19859, 4, 17873, },
+                { 4, 19897, 4, 17907, },
+                { 4, 19822, 4, 17840, },
+        } },
+        { 5300, {
+                { 4, 19784, 4, 17806, },
+                { 4, 19822, 4, 17840, },
+                { 4, 19747, 4, 17772, },
+        } },
+        { 5320, {
+                { 4, 19710, 4, 17739, },
+                { 4, 19747, 4, 17772, },
+                { 4, 19673, 4, 17706, },
+        } },
+        { 5500, {
+                { 4, 19065, 4, 17159, },
+                { 4, 19100, 4, 17190, },
+                { 4, 19030, 4, 17127, },
+        } },
+        { 5520, {
+                { 4, 18996, 4, 17096, },
+                { 4, 19030, 4, 17127, },
+                { 4, 18962, 4, 17065, },
+        } },
+        { 5540, {
+                { 4, 18927, 4, 17035, },
+                { 4, 18962, 4, 17065, },
+                { 4, 18893, 4, 17004, },
+        } },
+        { 5560, {
+                { 4, 18859, 4, 16973, },
+                { 4, 18893, 4, 17004, },
+                { 4, 18825, 4, 16943, },
+        } },
+        { 5580, {
+                { 4, 18792, 4, 16913, },
+                { 4, 18825, 4, 16943, },
+                { 4, 18758, 4, 16882, },
+        } },
+        { 5600, {
+                { 4, 18725, 4, 16852, },
+                { 4, 18758, 4, 16882, },
+                { 4, 18691, 4, 16822, },
+        } },
+        { 5620, {
+                { 4, 18658, 4, 16792, },
+                { 4, 18691, 4, 16822, },
+                { 4, 18625, 4, 16762, },
+        } },
+        { 5640, {
+                { 4, 18592, 4, 16733, },
+                { 4, 18625, 4, 16762, },
+                { 4, 18559, 4, 16703, },
+        } },
+        { 5660, {
+                { 4, 18526, 4, 16673, },
+                { 4, 18559, 4, 16703, },
+                { 4, 18493, 4, 16644, },
+        } },
+        { 5680, {
+                { 4, 18461, 4, 16615, },
+                { 4, 18493, 4, 16644, },
+                { 4, 18428, 4, 16586, },
+        } },
+        { 5700, {
+                { 4, 18396, 4, 16556, },
+                { 4, 18428, 4, 16586, },
+                { 4, 18364, 4, 16527, },
+        } },
+        { 5745, {
+                { 4, 18252, 4, 16427, },
+                { 4, 18284, 4, 16455, },
+                { 4, 18220, 4, 16398, },
+        } },
+        { 5765, {
+                { 4, 18189, 5, 32740, },
+                { 4, 18220, 4, 16398, },
+                { 4, 18157, 5, 32683, },
+        } },
+        { 5785, {
+                { 4, 18126, 5, 32626, },
+                { 4, 18157, 5, 32683, },
+                { 4, 18094, 5, 32570, },
+        } },
+        { 5805, {
+                { 4, 18063, 5, 32514, },
+                { 4, 18094, 5, 32570, },
+                { 4, 18032, 5, 32458, },
+        } },
+        { 5825, {
+                { 4, 18001, 5, 32402, },
+                { 4, 18032, 5, 32458, },
+                { 4, 17970, 5, 32347, },
+        } },
+        { 5170, {
+                { 4, 20282, 4, 18254, },
+                { 4, 20321, 4, 18289, },
+                { 4, 20243, 4, 18219, },
+        } },
+        { 5190, {
+                { 4, 20204, 4, 18183, },
+                { 4, 20243, 4, 18219, },
+                { 4, 20165, 4, 18148, },
+        } },
+        { 5210, {
+                { 4, 20126, 4, 18114, },
+                { 4, 20165, 4, 18148, },
+                { 4, 20088, 4, 18079, },
+        } },
+        { 5230, {
+                { 4, 20049, 4, 18044, },
+                { 4, 20088, 4, 18079, },
+                { 4, 20011, 4, 18010, },
+        } },
+};
+
+static const struct ar9170_phy_freq_params *
+ar9170_get_hw_dyn_params(struct ieee80211_channel *channel,
+                         enum ar9170_bw bw)
+{
+        unsigned int chanidx = 0;
+        u16 freq = 2412;
+
+        if (channel) {
+                chanidx = channel->hw_value;
+                freq = channel->center_freq;
+        }
+
+        BUG_ON(chanidx >= ARRAY_SIZE(ar9170_phy_freq_params));
+
+        BUILD_BUG_ON(__AR9170_NUM_BW != 3);
+
+        WARN_ON(ar9170_phy_freq_params[chanidx].freq != freq);
+
+        return &ar9170_phy_freq_params[chanidx].params[bw];
+}
+
+
+int ar9170_init_rf(struct ar9170 *ar)
+{
+        const struct ar9170_phy_freq_params *freqpar;
+        __le32 cmd[7];
+        int err;
+
+        err = ar9170_init_rf_banks_0_7(ar, false);
+        if (err)
+                return err;
+
+        err = ar9170_init_rf_bank4_pwr(ar, false, 2412, AR9170_BW_20);
+        if (err)
+                return err;
+
+        freqpar = ar9170_get_hw_dyn_params(NULL, AR9170_BW_20);
+
+        cmd[0] = cpu_to_le32(2412 * 1000);
+        cmd[1] = cpu_to_le32(0);
+        cmd[2] = cpu_to_le32(1);
+        cmd[3] = cpu_to_le32(freqpar->coeff_exp);
+        cmd[4] = cpu_to_le32(freqpar->coeff_man);
+        cmd[5] = cpu_to_le32(freqpar->coeff_exp_shgi);
+        cmd[6] = cpu_to_le32(freqpar->coeff_man_shgi);
+
+        /* RF_INIT echoes the command back to us */
+        err = ar->exec_cmd(ar, AR9170_CMD_RF_INIT,
+                           sizeof(cmd), (u8 *)cmd,
+                           sizeof(cmd), (u8 *)cmd);
+        if (err)
+                return err;
+
+        msleep(1000);
+
+        return ar9170_echo_test(ar, 0xaabbccdd);
+}
+
+static int ar9170_find_freq_idx(int nfreqs, u8 *freqs, u8 f)
+{
+        int idx = nfreqs - 2;
+
+        while (idx >= 0) {
+                if (f >= freqs[idx])
+                        return idx;
+                idx--;
+        }
+
+        return 0;
+}
+
+static s32 ar9170_interpolate_s32(s32 x, s32 x1, s32 y1, s32 x2, s32 y2)
+{
+        /* nothing to interpolate, it's horizontal */
+        if (y2 == y1)
+                return y1;
+
+        /* check if we hit one of the edges */
+        if (x == x1)
+                return y1;
+        if (x == x2)
+                return y2;
+
+        /* x1 == x2 is bad, hopefully == x */
+        if (x2 == x1)
+                return y1;
+
+        return y1 + (((y2 - y1) * (x - x1)) / (x2 - x1));
+}
+
+static u8 ar9170_interpolate_u8(u8 x, u8 x1, u8 y1, u8 x2, u8 y2)
+{
+#define SHIFT           8
+        s32 y;
+
+        y = ar9170_interpolate_s32(x << SHIFT,
+                                   x1 << SHIFT, y1 << SHIFT,
+                                   x2 << SHIFT, y2 << SHIFT);
+
+        /*
+         * XXX: unwrap this expression
+         *      Isn't it just DIV_ROUND_UP(y, 1<<SHIFT)?
+         *      Can we rely on the compiler to optimise away the div?
+         */
+        return (y >> SHIFT) + ((y & (1<<(SHIFT-1))) >> (SHIFT - 1));
+#undef SHIFT
+}
+
+static int ar9170_set_power_cal(struct ar9170 *ar, u32 freq, enum ar9170_bw bw)
+{
+        struct ar9170_calibration_target_power_legacy *ctpl;
+        struct ar9170_calibration_target_power_ht *ctph;
+        u8 *ctpres;
+        int ntargets;
+        int idx, i, n;
+        u8 ackpower, ackchains, f;
+        u8 pwr_freqs[AR5416_MAX_NUM_TGT_PWRS];
+
+        if (freq < 3000)
+                f = freq - 2300;
+        else
+                f = (freq - 4800)/5;
+
+        /*
+         * cycle through the various modes
+         *
+         * legacy modes first: 5G, 2G CCK, 2G OFDM
+         */
+        for (i = 0; i < 3; i++) {
+                switch (i) {
+                case 0: /* 5 GHz legacy */
+                        ctpl = &ar->eeprom.cal_tgt_pwr_5G[0];
+                        ntargets = AR5416_NUM_5G_TARGET_PWRS;
+                        ctpres = ar->power_5G_leg;
+                        break;
+                case 1: /* 2.4 GHz CCK */
+                        ctpl = &ar->eeprom.cal_tgt_pwr_2G_cck[0];
+                        ntargets = AR5416_NUM_2G_CCK_TARGET_PWRS;
+                        ctpres = ar->power_2G_cck;
+                        break;
+                case 2: /* 2.4 GHz OFDM */
+                        ctpl = &ar->eeprom.cal_tgt_pwr_2G_ofdm[0];
+                        ntargets = AR5416_NUM_2G_OFDM_TARGET_PWRS;
+                        ctpres = ar->power_2G_ofdm;
+                        break;
+                default:
+                        BUG();
+                }
+
+                for (n = 0; n < ntargets; n++) {
+                        if (ctpl[n].freq == 0xff)
+                                break;
+                        pwr_freqs[n] = ctpl[n].freq;
+                }
+                ntargets = n;
+                idx = ar9170_find_freq_idx(ntargets, pwr_freqs, f);
+                for (n = 0; n < 4; n++)
+                        ctpres[n] = ar9170_interpolate_u8(
+                                        f,
+                                        ctpl[idx + 0].freq,
+                                        ctpl[idx + 0].power[n],
+                                        ctpl[idx + 1].freq,
+                                        ctpl[idx + 1].power[n]);
+        }
+
+        /*
+         * HT modes now: 5G HT20, 5G HT40, 2G CCK, 2G OFDM, 2G HT20, 2G HT40
+         */
+        for (i = 0; i < 4; i++) {
+                switch (i) {
+                case 0: /* 5 GHz HT 20 */
+                        ctph = &ar->eeprom.cal_tgt_pwr_5G_ht20[0];
+                        ntargets = AR5416_NUM_5G_TARGET_PWRS;
+                        ctpres = ar->power_5G_ht20;
+                        break;
+                case 1: /* 5 GHz HT 40 */
+                        ctph = &ar->eeprom.cal_tgt_pwr_5G_ht40[0];
+                        ntargets = AR5416_NUM_5G_TARGET_PWRS;
+                        ctpres = ar->power_5G_ht40;
+                        break;
+                case 2: /* 2.4 GHz HT 20 */
+                        ctph = &ar->eeprom.cal_tgt_pwr_2G_ht20[0];
+                        ntargets = AR5416_NUM_2G_OFDM_TARGET_PWRS;
+                        ctpres = ar->power_2G_ht20;
+                        break;
+                case 3: /* 2.4 GHz HT 40 */
+                        ctph = &ar->eeprom.cal_tgt_pwr_2G_ht40[0];
+                        ntargets = AR5416_NUM_2G_OFDM_TARGET_PWRS;
+                        ctpres = ar->power_2G_ht40;
+                        break;
+                default:
+                        BUG();
+                }
+
+                for (n = 0; n < ntargets; n++) {
+                        if (ctph[n].freq == 0xff)
+                                break;
+                        pwr_freqs[n] = ctph[n].freq;
+                }
+                ntargets = n;
+                idx = ar9170_find_freq_idx(ntargets, pwr_freqs, f);
+                for (n = 0; n < 8; n++)
+                        ctpres[n] = ar9170_interpolate_u8(
+                                        f,
+                                        ctph[idx + 0].freq,
+                                        ctph[idx + 0].power[n],
+                                        ctph[idx + 1].freq,
+                                        ctph[idx + 1].power[n]);
+        }
+
+        /* set ACK/CTS TX power */
+        ar9170_regwrite_begin(ar);
+
+        if (ar->eeprom.tx_mask != 1)
+                ackchains = AR9170_TX_PHY_TXCHAIN_2;
+        else
+                ackchains = AR9170_TX_PHY_TXCHAIN_1;
+
+        if (freq < 3000)
+                ackpower = ar->power_2G_ofdm[0] & 0x3f;
+        else
+                ackpower = ar->power_5G_leg[0] & 0x3f;
+
+        ar9170_regwrite(0x1c3694, ackpower << 20 | ackchains << 26);
+        ar9170_regwrite(0x1c3bb4, ackpower << 5 | ackchains << 11 |
+                                  ackpower << 21 | ackchains << 27);
+
+        ar9170_regwrite_finish();
+        return ar9170_regwrite_result();
+}
+
+static int ar9170_calc_noise_dbm(u32 raw_noise)
+{
+        if (raw_noise & 0x100)
+                return ~((raw_noise & 0x0ff) >> 1);
+        else
+                return (raw_noise & 0xff) >> 1;
+}
+
+int ar9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
+                       enum ar9170_rf_init_mode rfi, enum ar9170_bw bw)
+{
+        const struct ar9170_phy_freq_params *freqpar;
+        u32 cmd, tmp, offs;
+        __le32 vals[8];
+        int i, err;
+        bool bandswitch;
+
+        /* clear BB heavy clip enable */
+        err = ar9170_write_reg(ar, 0x1c59e0, 0x200);
+        if (err)
+                return err;
+
+        /* may be NULL at first setup */
+        if (ar->channel)
+                bandswitch = ar->channel->band != channel->band;
+        else
+                bandswitch = true;
+
+        /* HW workaround */
+        if (!ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] &&
+            channel->center_freq <= 2417)
+                bandswitch = true;
+
+        err = ar->exec_cmd(ar, AR9170_CMD_FREQ_START, 0, NULL, 0, NULL);
+        if (err)
+                return err;
+
+        if (rfi != AR9170_RFI_NONE || bandswitch) {
+                u32 val = 0x400;
+
+                if (rfi == AR9170_RFI_COLD)
+                        val = 0x800;
+
+                /* warm/cold reset BB/ADDA */
+                err = ar9170_write_reg(ar, 0x1d4004, val);
+                if (err)
+                        return err;
+
+                err = ar9170_write_reg(ar, 0x1d4004, 0x0);
+                if (err)
+                        return err;
+
+                err = ar9170_init_phy(ar, channel->band);
+                if (err)
+                        return err;
+
+                err = ar9170_init_rf_banks_0_7(ar,
+                        channel->band == IEEE80211_BAND_5GHZ);
+                if (err)
+                        return err;
+
+                cmd = AR9170_CMD_RF_INIT;
+        } else {
+                cmd = AR9170_CMD_FREQUENCY;
+        }
+
+        err = ar9170_init_rf_bank4_pwr(ar,
+                channel->band == IEEE80211_BAND_5GHZ,
+                channel->center_freq, bw);
+        if (err)
+                return err;
+
+        switch (bw) {
+        case AR9170_BW_20:
+                tmp = 0x240;
+                offs = 0;
+                break;
+        case AR9170_BW_40_BELOW:
+                tmp = 0x2c4;
+                offs = 3;
+                break;
+        case AR9170_BW_40_ABOVE:
+                tmp = 0x2d4;
+                offs = 1;
+                break;
+        default:
+                BUG();
+                return -ENOSYS;
+        }
+
+        if (0 /* 2 streams capable */)
+                tmp |= 0x100;
+
+        err = ar9170_write_reg(ar, 0x1c5804, tmp);
+        if (err)
+                return err;
+
+        err = ar9170_set_power_cal(ar, channel->center_freq, bw);
+        if (err)
+                return err;
+
+        freqpar = ar9170_get_hw_dyn_params(channel, bw);
+
+        vals[0] = cpu_to_le32(channel->center_freq * 1000);
+        vals[1] = cpu_to_le32(bw == AR9170_BW_20 ? 0 : 1);
+        vals[2] = cpu_to_le32(offs << 2 | 1);
+        vals[3] = cpu_to_le32(freqpar->coeff_exp);
+        vals[4] = cpu_to_le32(freqpar->coeff_man);
+        vals[5] = cpu_to_le32(freqpar->coeff_exp_shgi);
+        vals[6] = cpu_to_le32(freqpar->coeff_man_shgi);
+        vals[7] = cpu_to_le32(1000);
+
+        err = ar->exec_cmd(ar, cmd, sizeof(vals), (u8 *)vals,
+                           sizeof(vals), (u8 *)vals);
+        if (err)
+                return err;
+
+        for (i = 0; i < 2; i++) {
+                ar->noise[i] = ar9170_calc_noise_dbm(
+                                (le32_to_cpu(vals[2 + i]) >> 19) & 0x1ff);
+
+                ar->noise[i + 2] = ar9170_calc_noise_dbm(
+                                    (le32_to_cpu(vals[5 + i]) >> 23) & 0x1ff);
+        }
+
+        ar->channel = channel;
+        return 0;
+}
diff --git a/drivers/net/wireless/ar9170/usb.c b/drivers/net/wireless/ar9170/usb.c
new file mode 100644
index 000000000000..ad296840893e
--- /dev/null
+++ b/drivers/net/wireless/ar9170/usb.c
@@ -0,0 +1,748 @@
+/*
+ * Atheros AR9170 driver
+ *
+ * USB - frontend
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, Christian Lamparter <chunkeey@web.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/firmware.h>
+#include <linux/etherdevice.h>
+#include <net/mac80211.h>
+#include "ar9170.h"
+#include "cmd.h"
+#include "hw.h"
+#include "usb.h"
+
+MODULE_AUTHOR("Johannes Berg <johannes@sipsolutions.net>");
+MODULE_AUTHOR("Christian Lamparter <chunkeey@web.de>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Atheros AR9170 802.11n USB wireless");
+MODULE_FIRMWARE("ar9170-1.fw");
+MODULE_FIRMWARE("ar9170-2.fw");
+
+static struct usb_device_id ar9170_usb_ids[] = {
+        /* Atheros 9170 */
+        { USB_DEVICE(0x0cf3, 0x9170) },
+        /* Atheros TG121N */
+        { USB_DEVICE(0x0cf3, 0x1001) },
+        /* D-Link DWA 160A */
+        { USB_DEVICE(0x07d1, 0x3c10) },
+        /* Netgear WNDA3100 */
+        { USB_DEVICE(0x0846, 0x9010) },
+        /* Netgear WN111 v2 */
+        { USB_DEVICE(0x0846, 0x9001) },
+        /* Zydas ZD1221 */
+        { USB_DEVICE(0x0ace, 0x1221) },
+        /* Z-Com UB81 BG */
+        { USB_DEVICE(0x0cde, 0x0023) },
+        /* Z-Com UB82 ABG */
+        { USB_DEVICE(0x0cde, 0x0026) },
+        /* Arcadyan WN7512 */
+        { USB_DEVICE(0x083a, 0xf522) },
+        /* Planex GWUS300 */
+        { USB_DEVICE(0x2019, 0x5304) },
+        /* IO-Data WNGDNUS2 */
+        { USB_DEVICE(0x04bb, 0x093f) },
+
+        /* terminate */
+        {}
+};
+MODULE_DEVICE_TABLE(usb, ar9170_usb_ids);
+
+static void ar9170_usb_tx_urb_complete_free(struct urb *urb)
+{
+        struct sk_buff *skb = urb->context;
+        struct ar9170_usb *aru = (struct ar9170_usb *)
+              usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+
+        if (!aru) {
+                dev_kfree_skb_irq(skb);
+                return ;
+        }
+
+        ar9170_handle_tx_status(&aru->common, skb, false,
+                                AR9170_TX_STATUS_COMPLETE);
+}
+
+static void ar9170_usb_tx_urb_complete(struct urb *urb)
+{
+}
+
+static void ar9170_usb_irq_completed(struct urb *urb)
+{
+        struct ar9170_usb *aru = urb->context;
+
+        switch (urb->status) {
+        /* everything is fine */
+        case 0:
+                break;
+
+        /* disconnect */
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                goto free;
+
+        default:
+                goto resubmit;
+        }
+
+        print_hex_dump_bytes("ar9170 irq: ", DUMP_PREFIX_OFFSET,
+                             urb->transfer_buffer, urb->actual_length);
+
+resubmit:
+        usb_anchor_urb(urb, &aru->rx_submitted);
+        if (usb_submit_urb(urb, GFP_ATOMIC)) {
+                usb_unanchor_urb(urb);
+                goto free;
+        }
+
+        return;
+
+free:
+        usb_buffer_free(aru->udev, 64, urb->transfer_buffer, urb->transfer_dma);
+}
+
+static void ar9170_usb_rx_completed(struct urb *urb)
+{
+        struct sk_buff *skb = urb->context;
+        struct ar9170_usb *aru = (struct ar9170_usb *)
+                usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+        int err;
+
+        if (!aru)
+                goto free;
+
+        switch (urb->status) {
+        /* everything is fine */
+        case 0:
+                break;
+
+        /* disconnect */
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                goto free;
+
+        default:
+                goto resubmit;
+        }
+
+        skb_put(skb, urb->actual_length);
+        ar9170_rx(&aru->common, skb);
+
+resubmit:
+        skb_reset_tail_pointer(skb);
+        skb_trim(skb, 0);
+
+        usb_anchor_urb(urb, &aru->rx_submitted);
+        err = usb_submit_urb(urb, GFP_ATOMIC);
+        if (err) {
+                usb_unanchor_urb(urb);
+                dev_kfree_skb_irq(skb);
+        }
+
+        return ;
+
+free:
+        dev_kfree_skb_irq(skb);
+        return;
+}
+
+static int ar9170_usb_prep_rx_urb(struct ar9170_usb *aru,
+                                  struct urb *urb, gfp_t gfp)
+{
+        struct sk_buff *skb;
+
+        skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE + 32, gfp);
+        if (!skb)
+                return -ENOMEM;
+
+        /* reserve some space for mac80211's radiotap */
+        skb_reserve(skb, 32);
+
+        usb_fill_bulk_urb(urb, aru->udev,
+                          usb_rcvbulkpipe(aru->udev, AR9170_EP_RX),
+                          skb->data, min(skb_tailroom(skb),
+                          AR9170_MAX_RX_BUFFER_SIZE),
+                          ar9170_usb_rx_completed, skb);
+
+        return 0;
+}
+
+static int ar9170_usb_alloc_rx_irq_urb(struct ar9170_usb *aru)
+{
+        struct urb *urb = NULL;
+        void *ibuf;
+        int err = -ENOMEM;
+
+        /* initialize interrupt endpoint */
+        urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (!urb)
+                goto out;
+
+        ibuf = usb_buffer_alloc(aru->udev, 64, GFP_KERNEL, &urb->transfer_dma);
+        if (!ibuf)
+                goto out;
+
+        usb_fill_int_urb(urb, aru->udev,
+                         usb_rcvintpipe(aru->udev, AR9170_EP_IRQ), ibuf,
+                         64, ar9170_usb_irq_completed, aru, 1);
+        urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+        usb_anchor_urb(urb, &aru->rx_submitted);
+        err = usb_submit_urb(urb, GFP_KERNEL);
+        if (err) {
+                usb_unanchor_urb(urb);
+                usb_buffer_free(aru->udev, 64, urb->transfer_buffer,
+                                urb->transfer_dma);
+        }
+
+out:
+        usb_free_urb(urb);
+        return err;
+}
+
+static int ar9170_usb_alloc_rx_bulk_urbs(struct ar9170_usb *aru)
+{
+        struct urb *urb;
+        int i;
+        int err = -EINVAL;
+
+        for (i = 0; i < AR9170_NUM_RX_URBS; i++) {
+                err = -ENOMEM;
+                urb = usb_alloc_urb(0, GFP_KERNEL);
+                if (!urb)
+                        goto err_out;
+
+                err = ar9170_usb_prep_rx_urb(aru, urb, GFP_KERNEL);
+                if (err) {
+                        usb_free_urb(urb);
+                        goto err_out;
+                }
+
+                usb_anchor_urb(urb, &aru->rx_submitted);
+                err = usb_submit_urb(urb, GFP_KERNEL);
+                if (err) {
+                        usb_unanchor_urb(urb);
+                        dev_kfree_skb_any((void *) urb->transfer_buffer);
+                        usb_free_urb(urb);
+                        goto err_out;
+                }
+                usb_free_urb(urb);
+        }
+
+        /* the device now waiting for a firmware. */
+        aru->common.state = AR9170_IDLE;
+        return 0;
+
+err_out:
+
+        usb_kill_anchored_urbs(&aru->rx_submitted);
+        return err;
+}
+
+static void ar9170_usb_cancel_urbs(struct ar9170_usb *aru)
+{
+        int ret;
+
+        aru->common.state = AR9170_UNKNOWN_STATE;
+
+        usb_unlink_anchored_urbs(&aru->tx_submitted);
+
+        /* give the LED OFF command and the deauth frame a chance to air. */
+        ret = usb_wait_anchor_empty_timeout(&aru->tx_submitted,
+                                            msecs_to_jiffies(100));
+        if (ret == 0)
+                dev_err(&aru->udev->dev, "kill pending tx urbs.\n");
+        usb_poison_anchored_urbs(&aru->tx_submitted);
+
+        usb_poison_anchored_urbs(&aru->rx_submitted);
+}
+
+static int ar9170_usb_exec_cmd(struct ar9170 *ar, enum ar9170_cmd cmd,
+                               unsigned int plen, void *payload,
+                               unsigned int outlen, void *out)
+{
+        struct ar9170_usb *aru = (void *) ar;
+        struct urb *urb = NULL;
+        unsigned long flags;
+        int err = -ENOMEM;
+
+        if (unlikely(!IS_ACCEPTING_CMD(ar)))
+                return -EPERM;
+
+        if (WARN_ON(plen > AR9170_MAX_CMD_LEN - 4))
+                return -EINVAL;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (unlikely(!urb))
+                goto err_free;
+
+        ar->cmdbuf[0] = cpu_to_le32(plen);
+        ar->cmdbuf[0] |= cpu_to_le32(cmd << 8);
+        /* writing multiple regs fills this buffer already */
+        if (plen && payload != (u8 *)(&ar->cmdbuf[1]))
+                memcpy(&ar->cmdbuf[1], payload, plen);
+
+        spin_lock_irqsave(&aru->common.cmdlock, flags);
+        aru->readbuf = (u8 *)out;
+        aru->readlen = outlen;
+        spin_unlock_irqrestore(&aru->common.cmdlock, flags);
+
+        usb_fill_int_urb(urb, aru->udev,
+                         usb_sndbulkpipe(aru->udev, AR9170_EP_CMD),
+                         aru->common.cmdbuf, plen + 4,
+                         ar9170_usb_tx_urb_complete, NULL, 1);
+
+        usb_anchor_urb(urb, &aru->tx_submitted);
+        err = usb_submit_urb(urb, GFP_ATOMIC);
+        if (err) {
+                usb_unanchor_urb(urb);
+                usb_free_urb(urb);
+                goto err_unbuf;
+        }
+        usb_free_urb(urb);
+
+        err = wait_for_completion_timeout(&aru->cmd_wait, HZ);
+        if (err == 0) {
+                err = -ETIMEDOUT;
+                goto err_unbuf;
+        }
+
+        if (outlen >= 0 && aru->readlen != outlen) {
+                err = -EMSGSIZE;
+                goto err_unbuf;
+        }
+
+        return 0;
+
+err_unbuf:
+        /* Maybe the device was removed in the second we were waiting? */
+        if (IS_STARTED(ar)) {
+                dev_err(&aru->udev->dev, "no command feedback "
+                                         "received (%d).\n", err);
+
+                /* provide some maybe useful debug information */
+                print_hex_dump_bytes("ar9170 cmd: ", DUMP_PREFIX_NONE,
+                                     aru->common.cmdbuf, plen + 4);
+                dump_stack();
+        }
+
+        /* invalidate to avoid completing the next prematurely */
+        spin_lock_irqsave(&aru->common.cmdlock, flags);
+        aru->readbuf = NULL;
+        aru->readlen = 0;
+        spin_unlock_irqrestore(&aru->common.cmdlock, flags);
+
+err_free:
+
+        return err;
+}
+
+static int ar9170_usb_tx(struct ar9170 *ar, struct sk_buff *skb,
+                         bool txstatus_needed, unsigned int extra_len)
+{
+        struct ar9170_usb *aru = (struct ar9170_usb *) ar;
+        struct urb *urb;
+        int err;
+
+        if (unlikely(!IS_STARTED(ar))) {
+                /* Seriously, what were you drink... err... thinking!? */
+                return -EPERM;
+        }
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (unlikely(!urb))
+                return -ENOMEM;
+
+        usb_fill_bulk_urb(urb, aru->udev,
+                          usb_sndbulkpipe(aru->udev, AR9170_EP_TX),
+                          skb->data, skb->len + extra_len, (txstatus_needed ?
+                          ar9170_usb_tx_urb_complete :
+                          ar9170_usb_tx_urb_complete_free), skb);
+        urb->transfer_flags |= URB_ZERO_PACKET;
+
+        usb_anchor_urb(urb, &aru->tx_submitted);
+        err = usb_submit_urb(urb, GFP_ATOMIC);
+        if (unlikely(err))
+                usb_unanchor_urb(urb);
+
+        usb_free_urb(urb);
+        return err;
+}
+
+static void ar9170_usb_callback_cmd(struct ar9170 *ar, u32 len , void *buffer)
+{
+        struct ar9170_usb *aru = (void *) ar;
+        unsigned long flags;
+        u32 in, out;
+
+        if (!buffer)
+                return ;
+
+        in = le32_to_cpup((__le32 *)buffer);
+        out = le32_to_cpu(ar->cmdbuf[0]);
+
+        /* mask off length byte */
+        out &= ~0xFF;
+
+        if (aru->readlen >= 0) {
+                /* add expected length */
+                out |= aru->readlen;
+        } else {
+                /* add obtained length */
+                out |= in & 0xFF;
+        }
+
+        /*
+         * Some commands (e.g: AR9170_CMD_FREQUENCY) have a variable response
+         * length and we cannot predict the correct length in advance.
+         * So we only check if we provided enough space for the data.
+         */
+        if (unlikely(out < in)) {
+                dev_warn(&aru->udev->dev, "received invalid command response "
+                                          "got %d bytes, instead of %d bytes "
+                                          "and the resp length is %d bytes\n",
+                         in, out, len);
+                print_hex_dump_bytes("ar9170 invalid resp: ",
+                                     DUMP_PREFIX_OFFSET, buffer, len);
+                /*
+                 * Do not complete, then the command times out,
+                 * and we get a stack trace from there.
+                 */
+                return ;
+        }
+
+        spin_lock_irqsave(&aru->common.cmdlock, flags);
+        if (aru->readbuf && len > 0) {
+                memcpy(aru->readbuf, buffer + 4, len - 4);
+                aru->readbuf = NULL;
+        }
+        complete(&aru->cmd_wait);
+        spin_unlock_irqrestore(&aru->common.cmdlock, flags);
+}
+
+static int ar9170_usb_upload(struct ar9170_usb *aru, const void *data,
+                             size_t len, u32 addr, bool complete)
+{
+        int transfer, err;
+        u8 *buf = kmalloc(4096, GFP_KERNEL);
+
+        if (!buf)
+                return -ENOMEM;
+
+        while (len) {
+                transfer = min_t(int, len, 4096);
+                memcpy(buf, data, transfer);
+
+                err = usb_control_msg(aru->udev, usb_sndctrlpipe(aru->udev, 0),
+                                      0x30 /* FW DL */, 0x40 | USB_DIR_OUT,
+                                      addr >> 8, 0, buf, transfer, 1000);
+
+                if (err < 0) {
+                        kfree(buf);
+                        return err;
+                }
+
+                len -= transfer;
+                data += transfer;
+                addr += transfer;
+        }
+        kfree(buf);
+
+        if (complete) {
+                err = usb_control_msg(aru->udev, usb_sndctrlpipe(aru->udev, 0),
+                                      0x31 /* FW DL COMPLETE */,
+                                      0x40 | USB_DIR_OUT, 0, 0, NULL, 0, 5000);
+        }
+
+        return 0;
+}
+
+static int ar9170_usb_request_firmware(struct ar9170_usb *aru)
+{
+        int err = 0;
+
+        err = request_firmware(&aru->init_values, "ar9170-1.fw",
+                               &aru->udev->dev);
+        if (err) {
+                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                return err;
+        }
+
+        err = request_firmware(&aru->firmware, "ar9170-2.fw", &aru->udev->dev);
+        if (err) {
+                release_firmware(aru->init_values);
+                dev_err(&aru->udev->dev, "firmware file not found.\n");
+                return err;
+        }
+
+        return err;
+}
+
+static int ar9170_usb_reset(struct ar9170_usb *aru)
+{
+        int ret, lock = (aru->intf->condition != USB_INTERFACE_BINDING);
+
+        if (lock) {
+                ret = usb_lock_device_for_reset(aru->udev, aru->intf);
+                if (ret < 0) {
+                        dev_err(&aru->udev->dev, "unable to lock device "
+                                "for reset (%d).\n", ret);
+                        return ret;
+                }
+        }
+
+        ret = usb_reset_device(aru->udev);
+        if (lock)
+                usb_unlock_device(aru->udev);
+
+        /* let it rest - for a second - */
+        msleep(1000);
+
+        return ret;
+}
+
+static int ar9170_usb_upload_firmware(struct ar9170_usb *aru)
+{
+        int err;
+
+        /* First, upload initial values to device RAM */
+        err = ar9170_usb_upload(aru, aru->init_values->data,
+                                aru->init_values->size, 0x102800, false);
+        if (err) {
+                dev_err(&aru->udev->dev, "firmware part 1 "
+                        "upload failed (%d).\n", err);
+                return err;
+        }
+
+        /* Then, upload the firmware itself and start it */
+        return ar9170_usb_upload(aru, aru->firmware->data, aru->firmware->size,
+                                0x200000, true);
+}
+
+static int ar9170_usb_init_transport(struct ar9170_usb *aru)
+{
+        struct ar9170 *ar = (void *) &aru->common;
+        int err;
+
+        ar9170_regwrite_begin(ar);
+
+        /* Set USB Rx stream mode MAX packet number to 2 */
+        ar9170_regwrite(AR9170_USB_REG_MAX_AGG_UPLOAD, 0x4);
+
+        /* Set USB Rx stream mode timeout to 10us */
+        ar9170_regwrite(AR9170_USB_REG_UPLOAD_TIME_CTL, 0x80);
+
+        ar9170_regwrite_finish();
+
+        err = ar9170_regwrite_result();
+        if (err)
+                dev_err(&aru->udev->dev, "USB setup failed (%d).\n", err);
+
+        return err;
+}
+
+static void ar9170_usb_stop(struct ar9170 *ar)
+{
+        struct ar9170_usb *aru = (void *) ar;
+        int ret;
+
+        if (IS_ACCEPTING_CMD(ar))
+                aru->common.state = AR9170_STOPPED;
+
+        /* lets wait a while until the tx - queues are dried out */
+        ret = usb_wait_anchor_empty_timeout(&aru->tx_submitted,
+                                            msecs_to_jiffies(1000));
+        if (ret == 0)
+                dev_err(&aru->udev->dev, "kill pending tx urbs.\n");
+
+        usb_poison_anchored_urbs(&aru->tx_submitted);
+
+        /*
+         * Note:
+         * So far we freed all tx urbs, but we won't dare to touch any rx urbs.
+         * Else we would end up with a unresponsive device...
+         */
+}
+
+static int ar9170_usb_open(struct ar9170 *ar)
+{
+        struct ar9170_usb *aru = (void *) ar;
+        int err;
+
+        usb_unpoison_anchored_urbs(&aru->tx_submitted);
+        err = ar9170_usb_init_transport(aru);
+        if (err) {
+                usb_poison_anchored_urbs(&aru->tx_submitted);
+                return err;
+        }
+
+        aru->common.state = AR9170_IDLE;
+        return 0;
+}
+
+static int ar9170_usb_probe(struct usb_interface *intf,
+                        const struct usb_device_id *id)
+{
+        struct ar9170_usb *aru;
+        struct ar9170 *ar;
+        struct usb_device *udev;
+        int err;
+
+        aru = ar9170_alloc(sizeof(*aru));
+        if (IS_ERR(aru)) {
+                err = PTR_ERR(aru);
+                goto out;
+        }
+
+        udev = interface_to_usbdev(intf);
+        usb_get_dev(udev);
+        aru->udev = udev;
+        aru->intf = intf;
+        ar = &aru->common;
+
+        usb_set_intfdata(intf, aru);
+        SET_IEEE80211_DEV(ar->hw, &udev->dev);
+
+        init_usb_anchor(&aru->rx_submitted);
+        init_usb_anchor(&aru->tx_submitted);
+        init_completion(&aru->cmd_wait);
+
+        aru->common.stop = ar9170_usb_stop;
+        aru->common.open = ar9170_usb_open;
+        aru->common.tx = ar9170_usb_tx;
+        aru->common.exec_cmd = ar9170_usb_exec_cmd;
+        aru->common.callback_cmd = ar9170_usb_callback_cmd;
+
+        err = ar9170_usb_reset(aru);
+        if (err)
+                goto err_unlock;
+
+        err = ar9170_usb_request_firmware(aru);
+        if (err)
+                goto err_unlock;
+
+        err = ar9170_usb_alloc_rx_irq_urb(aru);
+        if (err)
+                goto err_freefw;
+
+        err = ar9170_usb_alloc_rx_bulk_urbs(aru);
+        if (err)
+                goto err_unrx;
+
+        err = ar9170_usb_upload_firmware(aru);
+        if (err) {
+                err = ar9170_echo_test(&aru->common, 0x60d43110);
+                if (err) {
+                        /* force user invention, by disabling the device */
+                        err = usb_driver_set_configuration(aru->udev, -1);
+                        dev_err(&aru->udev->dev, "device is in a bad state. "
+                                                 "please reconnect it!\n");
+                        goto err_unrx;
+                }
+        }
+
+        err = ar9170_usb_open(ar);
+        if (err)
+                goto err_unrx;
+
+        err = ar9170_register(ar, &udev->dev);
+
+        ar9170_usb_stop(ar);
+        if (err)
+                goto err_unrx;
+
+        return 0;
+
+err_unrx:
+        ar9170_usb_cancel_urbs(aru);
+
+err_freefw:
+        release_firmware(aru->init_values);
+        release_firmware(aru->firmware);
+
+err_unlock:
+        usb_set_intfdata(intf, NULL);
+        usb_put_dev(udev);
+        ieee80211_free_hw(ar->hw);
+out:
+        return err;
+}
+
+static void ar9170_usb_disconnect(struct usb_interface *intf)
+{
+        struct ar9170_usb *aru = usb_get_intfdata(intf);
+
+        if (!aru)
+                return;
+
+        aru->common.state = AR9170_IDLE;
+        ar9170_unregister(&aru->common);
+        ar9170_usb_cancel_urbs(aru);
+
+        release_firmware(aru->init_values);
+        release_firmware(aru->firmware);
+
+        usb_put_dev(aru->udev);
+        usb_set_intfdata(intf, NULL);
+        ieee80211_free_hw(aru->common.hw);
+}
+
+static struct usb_driver ar9170_driver = {
+        .name = "ar9170usb",
+        .probe = ar9170_usb_probe,
+        .disconnect = ar9170_usb_disconnect,
+        .id_table = ar9170_usb_ids,
+        .soft_unbind = 1,
+};
+
+static int __init ar9170_init(void)
+{
+        return usb_register(&ar9170_driver);
+}
+
+static void __exit ar9170_exit(void)
+{
+        usb_deregister(&ar9170_driver);
+}
+
+module_init(ar9170_init);
+module_exit(ar9170_exit);
diff --git a/drivers/net/wireless/ar9170/usb.h b/drivers/net/wireless/ar9170/usb.h
new file mode 100644
index 000000000000..f5852924cd64
--- /dev/null
+++ b/drivers/net/wireless/ar9170/usb.h
@@ -0,0 +1,74 @@
+/*
+ * Atheros AR9170 USB driver
+ *
+ * Driver specific definitions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, Christian Lamparter <chunkeey@web.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __USB_H
+#define __USB_H
+
+#include <linux/usb.h>
+#include <linux/completion.h>
+#include <linux/spinlock.h>
+#include <linux/leds.h>
+#include <net/wireless.h>
+#include <net/mac80211.h>
+#include <linux/firmware.h>
+#include "eeprom.h"
+#include "hw.h"
+#include "ar9170.h"
+
+#define AR9170_NUM_RX_URBS                      16
+
+struct firmware;
+
+struct ar9170_usb {
+        struct ar9170 common;
+        struct usb_device *udev;
+        struct usb_interface *intf;
+
+        struct usb_anchor rx_submitted;
+        struct usb_anchor tx_submitted;
+
+        spinlock_t cmdlock;
+        struct completion cmd_wait;
+        int readlen;
+        u8 *readbuf;
+
+        const struct firmware *init_values;
+        const struct firmware *firmware;
+};
+
+#endif /* __USB_H */
diff --git a/drivers/net/wireless/arlan-main.c b/drivers/net/wireless/arlan-main.c
index 14c11656e82c..a54a67c425c8 100644
--- a/drivers/net/wireless/arlan-main.c
+++ b/drivers/net/wireless/arlan-main.c
@@ -1030,7 +1030,17 @@ static int arlan_mac_addr(struct net_device *dev, void *p)
         return 0;
 }
 
-
+static const struct net_device_ops arlan_netdev_ops = {
+        .ndo_open               = arlan_open,
+        .ndo_stop               = arlan_close,
+        .ndo_start_xmit         = arlan_tx,
+        .ndo_get_stats          = arlan_statistics,
+        .ndo_set_multicast_list = arlan_set_multicast,
+        .ndo_change_mtu         = arlan_change_mtu,
+        .ndo_set_mac_address    = arlan_mac_addr,
+        .ndo_tx_timeout         = arlan_tx_timeout,
+        .ndo_validate_addr      = eth_validate_addr,
+};
 
 static int __init arlan_setup_device(struct net_device *dev, int num)
 {
@@ -1042,14 +1052,7 @@ static int __init arlan_setup_device(struct net_device *dev, int num)
         ap->conf = (struct arlan_shmem *)(ap+1);
 
         dev->tx_queue_len = tx_queue_len;
-        dev->open = arlan_open;
-        dev->stop = arlan_close;
-        dev->hard_start_xmit = arlan_tx;
-        dev->get_stats = arlan_statistics;
-        dev->set_multicast_list = arlan_set_multicast;
-        dev->change_mtu = arlan_change_mtu;
-        dev->set_mac_address = arlan_mac_addr;
-        dev->tx_timeout = arlan_tx_timeout;
+        dev->netdev_ops = &arlan_netdev_ops;
         dev->watchdog_timeo = 3*HZ;
         
         ap->irq_test_done = 0;
diff --git a/drivers/net/wireless/ath5k/ath5k.h b/drivers/net/wireless/ath5k/ath5k.h
index 0dc2c7321c8b..0b616e72fe05 100644
--- a/drivers/net/wireless/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath5k/ath5k.h
@@ -204,9 +204,9 @@
 #define AR5K_TUNE_CWMAX_11B                     1023
 #define AR5K_TUNE_CWMAX_XR                      7
 #define AR5K_TUNE_NOISE_FLOOR                   -72
-#define AR5K_TUNE_MAX_TXPOWER                   60
-#define AR5K_TUNE_DEFAULT_TXPOWER               30
-#define AR5K_TUNE_TPC_TXPOWER                   true
+#define AR5K_TUNE_MAX_TXPOWER                   63
+#define AR5K_TUNE_DEFAULT_TXPOWER               25
+#define AR5K_TUNE_TPC_TXPOWER                   false
 #define AR5K_TUNE_ANT_DIVERSITY                 true
 #define AR5K_TUNE_HWTXTRIES                     4
 
@@ -551,11 +551,11 @@ enum ath5k_pkt_type {
  */
 #define AR5K_TXPOWER_OFDM(_r, _v)       (                       \
         ((0 & 1) << ((_v) + 6)) |                               \
-        (((ah->ah_txpower.txp_rates[(_r)]) & 0x3f) << (_v))     \
+        (((ah->ah_txpower.txp_rates_power_table[(_r)]) & 0x3f) << (_v)) \
 )
 
 #define AR5K_TXPOWER_CCK(_r, _v)        (                       \
-        (ah->ah_txpower.txp_rates[(_r)] & 0x3f) << (_v) \
+        (ah->ah_txpower.txp_rates_power_table[(_r)] & 0x3f) << (_v)     \
 )
 
 /*
@@ -1085,13 +1085,25 @@ struct ath5k_hw {
         struct ath5k_gain       ah_gain;
         u8                      ah_offset[AR5K_MAX_RF_BANKS];
 
+
         struct {
-                u16             txp_pcdac[AR5K_EEPROM_POWER_TABLE_SIZE];
-                u16             txp_rates[AR5K_MAX_RATES];
-                s16             txp_min;
-                s16             txp_max;
+                /* Temporary tables used for interpolation */
+                u8              tmpL[AR5K_EEPROM_N_PD_GAINS]
+                                        [AR5K_EEPROM_POWER_TABLE_SIZE];
+                u8              tmpR[AR5K_EEPROM_N_PD_GAINS]
+                                        [AR5K_EEPROM_POWER_TABLE_SIZE];
+                u8              txp_pd_table[AR5K_EEPROM_POWER_TABLE_SIZE * 2];
+                u16             txp_rates_power_table[AR5K_MAX_RATES];
+                u8              txp_min_idx;
                 bool            txp_tpc;
+                /* Values in 0.25dB units */
+                s16             txp_min_pwr;
+                s16             txp_max_pwr;
+                s16             txp_offset;
                 s16             txp_ofdm;
+                /* Values in dB units */
+                s16             txp_cck_ofdm_pwr_delta;
+                s16             txp_cck_ofdm_gainf_delta;
         } ah_txpower;
 
         struct {
@@ -1161,6 +1173,7 @@ extern void ath5k_hw_update_mib_counters(struct ath5k_hw *ah, struct ieee80211_l
 
 /* EEPROM access functions */
 extern int ath5k_eeprom_init(struct ath5k_hw *ah);
+extern void ath5k_eeprom_detach(struct ath5k_hw *ah);
 extern int ath5k_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac);
 extern bool ath5k_eeprom_is_hb63(struct ath5k_hw *ah);
 
@@ -1256,8 +1269,8 @@ extern void ath5k_hw_set_def_antenna(struct ath5k_hw *ah, unsigned int ant);
 extern unsigned int ath5k_hw_get_def_antenna(struct ath5k_hw *ah);
 extern int ath5k_hw_phy_disable(struct ath5k_hw *ah);
 /* TX power setup */
-extern int ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel, unsigned int txpower);
-extern int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, unsigned int power);
+extern int ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel, u8 ee_mode, u8 txpower);
+extern int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, u8 ee_mode, u8 txpower);
 
 /*
  * Functions used internaly
diff --git a/drivers/net/wireless/ath5k/attach.c b/drivers/net/wireless/ath5k/attach.c
index 656cb9dc833b..70d376c63aac 100644
--- a/drivers/net/wireless/ath5k/attach.c
+++ b/drivers/net/wireless/ath5k/attach.c
@@ -341,6 +341,8 @@ void ath5k_hw_detach(struct ath5k_hw *ah)
         if (ah->ah_rf_banks != NULL)
                 kfree(ah->ah_rf_banks);
 
+        ath5k_eeprom_detach(ah);
+
         /* assume interrupts are down */
         kfree(ah);
 }
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index cad3ccf61b00..5d57d774e466 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -685,13 +685,6 @@ ath5k_pci_resume(struct pci_dev *pdev)
         if (err)
                 return err;
 
-        /*
-         * Suspend/Resume resets the PCI configuration space, so we have to
-         * re-disable the RETRY_TIMEOUT register (0x41) to keep
-         * PCI Tx retries from interfering with C3 CPU state
-         */
-        pci_write_config_byte(pdev, 0x41, 0);
-
         err = request_irq(pdev->irq, ath5k_intr, IRQF_SHARED, "ath", sc);
         if (err) {
                 ATH5K_ERR(sc, "request_irq failed\n");
@@ -1095,9 +1088,18 @@ ath5k_mode_setup(struct ath5k_softc *sc)
 static inline int
 ath5k_hw_to_driver_rix(struct ath5k_softc *sc, int hw_rix)
 {
-        WARN(hw_rix < 0 || hw_rix >= AR5K_MAX_RATES,
-                        "hw_rix out of bounds: %x\n", hw_rix);
-        return sc->rate_idx[sc->curband->band][hw_rix];
+        int rix;
+
+        /* return base rate on errors */
+        if (WARN(hw_rix < 0 || hw_rix >= AR5K_MAX_RATES,
+                        "hw_rix out of bounds: %x\n", hw_rix))
+                return 0;
+
+        rix = sc->rate_idx[sc->curband->band][hw_rix];
+        if (WARN(rix < 0, "invalid hw_rix: %x\n", hw_rix))
+                rix = 0;
+
+        return rix;
 }
 
 /***************\
@@ -1216,6 +1218,9 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
 
         pktlen = skb->len;
 
+        /* FIXME: If we are in g mode and rate is a CCK rate
+         * subtract ah->ah_txpower.txp_cck_ofdm_pwr_delta
+         * from tx power (value is in dB units already) */
         if (info->control.hw_key) {
                 keyidx = info->control.hw_key->hw_key_idx;
                 pktlen += info->control.hw_key->icv_len;
@@ -2044,6 +2049,9 @@ ath5k_beacon_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
                         antenna = sc->bsent & 4 ? 2 : 1;
         }
 
+        /* FIXME: If we are in g mode and rate is a CCK rate
+         * subtract ah->ah_txpower.txp_cck_ofdm_pwr_delta
+         * from tx power (value is in dB units already) */
         ds->ds_data = bf->skbaddr;
         ret = ah->ah_setup_tx_desc(ah, ds, skb->len,
                         ieee80211_get_hdrlen_from_skb(skb),
@@ -2305,7 +2313,7 @@ ath5k_init(struct ath5k_softc *sc)
         sc->curband = &sc->sbands[sc->curchan->band];
         sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
                 AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
-                AR5K_INT_FATAL | AR5K_INT_GLOBAL | AR5K_INT_MIB;
+                AR5K_INT_FATAL | AR5K_INT_GLOBAL;
         ret = ath5k_reset(sc, false, false);
         if (ret)
                 goto done;
@@ -2554,7 +2562,7 @@ ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 if (skb_headroom(skb) < padsize) {
                         ATH5K_ERR(sc, "tx hdrlen not %%4: %d not enough"
                                   " headroom to pad %d\n", hdrlen, padsize);
-                        return NETDEV_TX_BUSY;
+                        goto drop_packet;
                 }
                 skb_push(skb, padsize);
                 memmove(skb->data, skb->data+padsize, hdrlen);
@@ -2565,7 +2573,7 @@ ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 ATH5K_ERR(sc, "no further txbuf available, dropping packet\n");
                 spin_unlock_irqrestore(&sc->txbuflock, flags);
                 ieee80211_stop_queue(hw, skb_get_queue_mapping(skb));
-                return NETDEV_TX_BUSY;
+                goto drop_packet;
         }
         bf = list_first_entry(&sc->txbuf, struct ath5k_buf, list);
         list_del(&bf->list);
@@ -2582,10 +2590,12 @@ ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 list_add_tail(&bf->list, &sc->txbuf);
                 sc->txbuf_len++;
                 spin_unlock_irqrestore(&sc->txbuflock, flags);
-                dev_kfree_skb_any(skb);
-                return NETDEV_TX_OK;
+                goto drop_packet;
         }
+        return NETDEV_TX_OK;
 
+drop_packet:
+        dev_kfree_skb_any(skb);
         return NETDEV_TX_OK;
 }
 
@@ -2608,12 +2618,6 @@ ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel)
                 goto err;
         }
 
-        /*
-         * This is needed only to setup initial state
-         * but it's best done after a reset.
-         */
-        ath5k_hw_set_txpower_limit(sc->ah, 0);
-
         ret = ath5k_rx_start(sc);
         if (ret) {
                 ATH5K_ERR(sc, "can't start recv logic\n");
diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h
index 20e0d14b41ec..822956114cd7 100644
--- a/drivers/net/wireless/ath5k/base.h
+++ b/drivers/net/wireless/ath5k/base.h
@@ -112,7 +112,7 @@ struct ath5k_softc {
         struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
         struct ieee80211_channel channels[ATH_CHAN_MAX];
         struct ieee80211_rate   rates[IEEE80211_NUM_BANDS][AR5K_MAX_RATES];
-        u8                      rate_idx[IEEE80211_NUM_BANDS][AR5K_MAX_RATES];
+        s8                      rate_idx[IEEE80211_NUM_BANDS][AR5K_MAX_RATES];
         enum nl80211_iftype     opmode;
         struct ath5k_hw         *ah;            /* Atheros HW */
 
diff --git a/drivers/net/wireless/ath5k/desc.c b/drivers/net/wireless/ath5k/desc.c
index b40a9287a39a..dc30a2b70a6b 100644
--- a/drivers/net/wireless/ath5k/desc.c
+++ b/drivers/net/wireless/ath5k/desc.c
@@ -194,6 +194,10 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
                 return -EINVAL;
         }
 
+        tx_power += ah->ah_txpower.txp_offset;
+        if (tx_power > AR5K_TUNE_MAX_TXPOWER)
+                tx_power = AR5K_TUNE_MAX_TXPOWER;
+
         /* Clear descriptor */
         memset(&desc->ud.ds_tx5212, 0, sizeof(struct ath5k_hw_5212_tx_desc));
 
diff --git a/drivers/net/wireless/ath5k/eeprom.c b/drivers/net/wireless/ath5k/eeprom.c
index ac45ca47ca87..c0fb3b09ba45 100644
--- a/drivers/net/wireless/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath5k/eeprom.c
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2004-2008 Reyk Floeter <reyk@openbsd.org>
- * Copyright (c) 2006-2008 Nick Kossifidis <mickflemm@gmail.com>
- * Copyright (c) 2008 Felix Fietkau <nbd@openwrt.org>
+ * Copyright (c) 2006-2009 Nick Kossifidis <mickflemm@gmail.com>
+ * Copyright (c) 2008-2009 Felix Fietkau <nbd@openwrt.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -98,11 +98,6 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
         int ret;
         u16 val;
 
-        /* Initial TX thermal adjustment values */
-        ee->ee_tx_clip = 4;
-        ee->ee_pwd_84 = ee->ee_pwd_90 = 1;
-        ee->ee_gain_select = 1;
-
         /*
          * Read values from EEPROM and store them in the capability structure
          */
@@ -241,22 +236,22 @@ static int ath5k_eeprom_read_modes(struct ath5k_hw *ah, u32 *offset,
         ee->ee_adc_desired_size[mode]   = (s8)((val >> 8) & 0xff);
         switch(mode) {
         case AR5K_EEPROM_MODE_11A:
-                ee->ee_ob[mode][3]              = (val >> 5) & 0x7;
-                ee->ee_db[mode][3]              = (val >> 2) & 0x7;
-                ee->ee_ob[mode][2]              = (val << 1) & 0x7;
+                ee->ee_ob[mode][3]      = (val >> 5) & 0x7;
+                ee->ee_db[mode][3]      = (val >> 2) & 0x7;
+                ee->ee_ob[mode][2]      = (val << 1) & 0x7;
 
                 AR5K_EEPROM_READ(o++, val);
-                ee->ee_ob[mode][2]              |= (val >> 15) & 0x1;
-                ee->ee_db[mode][2]              = (val >> 12) & 0x7;
-                ee->ee_ob[mode][1]              = (val >> 9) & 0x7;
-                ee->ee_db[mode][1]              = (val >> 6) & 0x7;
-                ee->ee_ob[mode][0]              = (val >> 3) & 0x7;
-                ee->ee_db[mode][0]              = val & 0x7;
+                ee->ee_ob[mode][2]      |= (val >> 15) & 0x1;
+                ee->ee_db[mode][2]      = (val >> 12) & 0x7;
+                ee->ee_ob[mode][1]      = (val >> 9) & 0x7;
+                ee->ee_db[mode][1]      = (val >> 6) & 0x7;
+                ee->ee_ob[mode][0]      = (val >> 3) & 0x7;
+                ee->ee_db[mode][0]      = val & 0x7;
                 break;
         case AR5K_EEPROM_MODE_11G:
         case AR5K_EEPROM_MODE_11B:
-                ee->ee_ob[mode][1]              = (val >> 4) & 0x7;
-                ee->ee_db[mode][1]              = val & 0x7;
+                ee->ee_ob[mode][1]      = (val >> 4) & 0x7;
+                ee->ee_db[mode][1]      = val & 0x7;
                 break;
         }
 
@@ -504,35 +499,6 @@ ath5k_eeprom_init_modes(struct ath5k_hw *ah)
         return 0;
 }
 
-/* Used to match PCDAC steps with power values on RF5111 chips
- * (eeprom versions < 4). For RF5111 we have 10 pre-defined PCDAC
- * steps that match with the power values we read from eeprom. On
- * older eeprom versions (< 3.2) these steps are equaly spaced at
- * 10% of the pcdac curve -until the curve reaches it's maximum-
- * (10 steps from 0 to 100%) but on newer eeprom versions (>= 3.2)
- * these 10 steps are spaced in a different way. This function returns
- * the pcdac steps based on eeprom version and curve min/max so that we
- * can have  pcdac/pwr points.
- */
-static inline void
-ath5k_get_pcdac_intercepts(struct ath5k_hw *ah, u8 min, u8 max, u8 *vp)
-{
-        static const u16 intercepts3[] =
-                { 0, 5, 10, 20, 30, 50, 70, 85, 90, 95, 100 };
-        static const u16 intercepts3_2[] =
-                { 0, 10, 20, 30, 40, 50, 60, 70, 80, 90, 100 };
-        const u16 *ip;
-        int i;
-
-        if (ah->ah_ee_version >= AR5K_EEPROM_VERSION_3_2)
-                ip = intercepts3_2;
-        else
-                ip = intercepts3;
-
-        for (i = 0; i < ARRAY_SIZE(intercepts3); i++)
-                *vp++ = (ip[i] * max + (100 - ip[i]) * min) / 100;
-}
-
 /* Read the frequency piers for each mode (mostly used on newer eeproms with 0xff
  * frequency mask) */
 static inline int
@@ -546,26 +512,25 @@ ath5k_eeprom_read_freq_list(struct ath5k_hw *ah, int *offset, int max,
         int ret;
         u16 val;
 
+        ee->ee_n_piers[mode] = 0;
         while(i < max) {
                 AR5K_EEPROM_READ(o++, val);
 
-                freq1 = (val >> 8) & 0xff;
-                freq2 = val & 0xff;
-
-                if (freq1) {
-                        pc[i++].freq = ath5k_eeprom_bin2freq(ee,
-                                        freq1, mode);
-                        ee->ee_n_piers[mode]++;
-                }
+                freq1 = val & 0xff;
+                if (!freq1)
+                        break;
 
-                if (freq2) {
-                        pc[i++].freq = ath5k_eeprom_bin2freq(ee,
-                                        freq2, mode);
-                        ee->ee_n_piers[mode]++;
-                }
+                pc[i++].freq = ath5k_eeprom_bin2freq(ee,
+                                freq1, mode);
+                ee->ee_n_piers[mode]++;
 
-                if (!freq1 || !freq2)
+                freq2 = (val >> 8) & 0xff;
+                if (!freq2)
                         break;
+
+                pc[i++].freq = ath5k_eeprom_bin2freq(ee,
+                                freq2, mode);
+                ee->ee_n_piers[mode]++;
         }
 
         /* return new offset */
@@ -652,13 +617,122 @@ ath5k_eeprom_init_11bg_2413(struct ath5k_hw *ah, unsigned int mode, int offset)
         return 0;
 }
 
-/* Read power calibration for RF5111 chips
+/*
+ * Read power calibration for RF5111 chips
+ *
  * For RF5111 we have an XPD -eXternal Power Detector- curve
- * for each calibrated channel. Each curve has PCDAC steps on
- * x axis and power on y axis and looks like a logarithmic
- * function. To recreate the curve and pass the power values
- * on the pcdac table, we read 10 points here and interpolate later.
+ * for each calibrated channel. Each curve has 0,5dB Power steps
+ * on x axis and PCDAC steps (offsets) on y axis and looks like an
+ * exponential function. To recreate the curve we read 11 points
+ * here and interpolate later.
  */
+
+/* Used to match PCDAC steps with power values on RF5111 chips
+ * (eeprom versions < 4). For RF5111 we have 11 pre-defined PCDAC
+ * steps that match with the power values we read from eeprom. On
+ * older eeprom versions (< 3.2) these steps are equaly spaced at
+ * 10% of the pcdac curve -until the curve reaches it's maximum-
+ * (11 steps from 0 to 100%) but on newer eeprom versions (>= 3.2)
+ * these 11 steps are spaced in a different way. This function returns
+ * the pcdac steps based on eeprom version and curve min/max so that we
+ * can have pcdac/pwr points.
+ */
+static inline void
+ath5k_get_pcdac_intercepts(struct ath5k_hw *ah, u8 min, u8 max, u8 *vp)
+{
+        const static u16 intercepts3[] =
+                { 0, 5, 10, 20, 30, 50, 70, 85, 90, 95, 100 };
+        const static u16 intercepts3_2[] =
+                { 0, 10, 20, 30, 40, 50, 60, 70, 80, 90, 100 };
+        const u16 *ip;
+        int i;
+
+        if (ah->ah_ee_version >= AR5K_EEPROM_VERSION_3_2)
+                ip = intercepts3_2;
+        else
+                ip = intercepts3;
+
+        for (i = 0; i < ARRAY_SIZE(intercepts3); i++)
+                vp[i] = (ip[i] * max + (100 - ip[i]) * min) / 100;
+}
+
+/* Convert RF5111 specific data to generic raw data
+ * used by interpolation code */
+static int
+ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode,
+                                struct ath5k_chan_pcal_info *chinfo)
+{
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        struct ath5k_chan_pcal_info_rf5111 *pcinfo;
+        struct ath5k_pdgain_info *pd;
+        u8 pier, point, idx;
+        u8 *pdgain_idx = ee->ee_pdc_to_idx[mode];
+
+        /* Fill raw data for each calibration pier */
+        for (pier = 0; pier < ee->ee_n_piers[mode]; pier++) {
+
+                pcinfo = &chinfo[pier].rf5111_info;
+
+                /* Allocate pd_curves for this cal pier */
+                chinfo[pier].pd_curves =
+                        kcalloc(AR5K_EEPROM_N_PD_CURVES,
+                                sizeof(struct ath5k_pdgain_info),
+                                GFP_KERNEL);
+
+                if (!chinfo[pier].pd_curves)
+                        return -ENOMEM;
+
+                /* Only one curve for RF5111
+                 * find out which one and place
+                 * in in pd_curves.
+                 * Note: ee_x_gain is reversed here */
+                for (idx = 0; idx < AR5K_EEPROM_N_PD_CURVES; idx++) {
+
+                        if (!((ee->ee_x_gain[mode] >> idx) & 0x1)) {
+                                pdgain_idx[0] = idx;
+                                break;
+                        }
+                }
+
+                ee->ee_pd_gains[mode] = 1;
+
+                pd = &chinfo[pier].pd_curves[idx];
+
+                pd->pd_points = AR5K_EEPROM_N_PWR_POINTS_5111;
+
+                /* Allocate pd points for this curve */
+                pd->pd_step = kcalloc(AR5K_EEPROM_N_PWR_POINTS_5111,
+                                        sizeof(u8), GFP_KERNEL);
+                if (!pd->pd_step)
+                        return -ENOMEM;
+
+                pd->pd_pwr = kcalloc(AR5K_EEPROM_N_PWR_POINTS_5111,
+                                        sizeof(s16), GFP_KERNEL);
+                if (!pd->pd_pwr)
+                        return -ENOMEM;
+
+                /* Fill raw dataset
+                 * (convert power to 0.25dB units
+                 * for RF5112 combatibility) */
+                for (point = 0; point < pd->pd_points; point++) {
+
+                        /* Absolute values */
+                        pd->pd_pwr[point] = 2 * pcinfo->pwr[point];
+
+                        /* Already sorted */
+                        pd->pd_step[point] = pcinfo->pcdac[point];
+                }
+
+                /* Set min/max pwr */
+                chinfo[pier].min_pwr = pd->pd_pwr[0];
+                chinfo[pier].max_pwr = pd->pd_pwr[10];
+
+        }
+
+        return 0;
+}
+
+/* Parse EEPROM data */
 static int
 ath5k_eeprom_read_pcal_info_5111(struct ath5k_hw *ah, int mode)
 {
@@ -747,30 +821,165 @@ ath5k_eeprom_read_pcal_info_5111(struct ath5k_hw *ah, int mode)
                         cdata->pcdac_max, cdata->pcdac);
         }
 
-        return 0;
+        return ath5k_eeprom_convert_pcal_info_5111(ah, mode, pcal);
 }
 
-/* Read power calibration for RF5112 chips
+
+/*
+ * Read power calibration for RF5112 chips
+ *
  * For RF5112 we have 4 XPD -eXternal Power Detector- curves
  * for each calibrated channel on 0, -6, -12 and -18dbm but we only
- * use the higher (3) and the lower (0) curves. Each curve has PCDAC
- * steps on x axis and power on y axis and looks like a linear
- * function. To recreate the curve and pass the power values
- * on the pcdac table, we read 4 points for xpd 0 and 3 points
- * for xpd 3 here and interpolate later.
+ * use the higher (3) and the lower (0) curves. Each curve has 0.5dB
+ * power steps on x axis and PCDAC steps on y axis and looks like a
+ * linear function. To recreate the curve and pass the power values
+ * on hw, we read 4 points for xpd 0 (lower gain -> max power)
+ * and 3 points for xpd 3 (higher gain -> lower power) here and
+ * interpolate later.
  *
  * Note: Many vendors just use xpd 0 so xpd 3 is zeroed.
  */
+
+/* Convert RF5112 specific data to generic raw data
+ * used by interpolation code */
+static int
+ath5k_eeprom_convert_pcal_info_5112(struct ath5k_hw *ah, int mode,
+                                struct ath5k_chan_pcal_info *chinfo)
+{
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        struct ath5k_chan_pcal_info_rf5112 *pcinfo;
+        u8 *pdgain_idx = ee->ee_pdc_to_idx[mode];
+        unsigned int pier, pdg, point;
+
+        /* Fill raw data for each calibration pier */
+        for (pier = 0; pier < ee->ee_n_piers[mode]; pier++) {
+
+                pcinfo = &chinfo[pier].rf5112_info;
+
+                /* Allocate pd_curves for this cal pier */
+                chinfo[pier].pd_curves =
+                                kcalloc(AR5K_EEPROM_N_PD_CURVES,
+                                        sizeof(struct ath5k_pdgain_info),
+                                        GFP_KERNEL);
+
+                if (!chinfo[pier].pd_curves)
+                        return -ENOMEM;
+
+                /* Fill pd_curves */
+                for (pdg = 0; pdg < ee->ee_pd_gains[mode]; pdg++) {
+
+                        u8 idx = pdgain_idx[pdg];
+                        struct ath5k_pdgain_info *pd =
+                                        &chinfo[pier].pd_curves[idx];
+
+                        /* Lowest gain curve (max power) */
+                        if (pdg == 0) {
+                                /* One more point for better accuracy */
+                                pd->pd_points = AR5K_EEPROM_N_XPD0_POINTS;
+
+                                /* Allocate pd points for this curve */
+                                pd->pd_step = kcalloc(pd->pd_points,
+                                                sizeof(u8), GFP_KERNEL);
+
+                                if (!pd->pd_step)
+                                        return -ENOMEM;
+
+                                pd->pd_pwr = kcalloc(pd->pd_points,
+                                                sizeof(s16), GFP_KERNEL);
+
+                                if (!pd->pd_pwr)
+                                        return -ENOMEM;
+
+
+                                /* Fill raw dataset
+                                 * (all power levels are in 0.25dB units) */
+                                pd->pd_step[0] = pcinfo->pcdac_x0[0];
+                                pd->pd_pwr[0] = pcinfo->pwr_x0[0];
+
+                                for (point = 1; point < pd->pd_points;
+                                point++) {
+                                        /* Absolute values */
+                                        pd->pd_pwr[point] =
+                                                pcinfo->pwr_x0[point];
+
+                                        /* Deltas */
+                                        pd->pd_step[point] =
+                                                pd->pd_step[point - 1] +
+                                                pcinfo->pcdac_x0[point];
+                                }
+
+                                /* Set min power for this frequency */
+                                chinfo[pier].min_pwr = pd->pd_pwr[0];
+
+                        /* Highest gain curve (min power) */
+                        } else if (pdg == 1) {
+
+                                pd->pd_points = AR5K_EEPROM_N_XPD3_POINTS;
+
+                                /* Allocate pd points for this curve */
+                                pd->pd_step = kcalloc(pd->pd_points,
+                                                sizeof(u8), GFP_KERNEL);
+
+                                if (!pd->pd_step)
+                                        return -ENOMEM;
+
+                                pd->pd_pwr = kcalloc(pd->pd_points,
+                                                sizeof(s16), GFP_KERNEL);
+
+                                if (!pd->pd_pwr)
+                                        return -ENOMEM;
+
+                                /* Fill raw dataset
+                                 * (all power levels are in 0.25dB units) */
+                                for (point = 0; point < pd->pd_points;
+                                point++) {
+                                        /* Absolute values */
+                                        pd->pd_pwr[point] =
+                                                pcinfo->pwr_x3[point];
+
+                                        /* Fixed points */
+                                        pd->pd_step[point] =
+                                                pcinfo->pcdac_x3[point];
+                                }
+
+                                /* Since we have a higher gain curve
+                                 * override min power */
+                                chinfo[pier].min_pwr = pd->pd_pwr[0];
+                        }
+                }
+        }
+
+        return 0;
+}
+
+/* Parse EEPROM data */
 static int
 ath5k_eeprom_read_pcal_info_5112(struct ath5k_hw *ah, int mode)
 {
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
         struct ath5k_chan_pcal_info_rf5112 *chan_pcal_info;
         struct ath5k_chan_pcal_info *gen_chan_info;
+        u8 *pdgain_idx = ee->ee_pdc_to_idx[mode];
         u32 offset;
-        unsigned int i, c;
+        u8 i, c;
         u16 val;
         int ret;
+        u8 pd_gains = 0;
+
+        /* Count how many curves we have and
+         * identify them (which one of the 4
+         * available curves we have on each count).
+         * Curves are stored from lower (x0) to
+         * higher (x3) gain */
+        for (i = 0; i < AR5K_EEPROM_N_PD_CURVES; i++) {
+                /* ee_x_gain[mode] is x gain mask */
+                if ((ee->ee_x_gain[mode] >> i) & 0x1)
+                        pdgain_idx[pd_gains++] = i;
+        }
+        ee->ee_pd_gains[mode] = pd_gains;
+
+        if (pd_gains == 0 || pd_gains > 2)
+                return -EINVAL;
 
         switch (mode) {
         case AR5K_EEPROM_MODE_11A:
@@ -808,13 +1017,13 @@ ath5k_eeprom_read_pcal_info_5112(struct ath5k_hw *ah, int mode)
         for (i = 0; i < ee->ee_n_piers[mode]; i++) {
                 chan_pcal_info = &gen_chan_info[i].rf5112_info;
 
-                /* Power values in dBm * 4
+                /* Power values in quarter dB
                  * for the lower xpd gain curve
                  * (0 dBm -> higher output power) */
                 for (c = 0; c < AR5K_EEPROM_N_XPD0_POINTS; c++) {
                         AR5K_EEPROM_READ(offset++, val);
-                        chan_pcal_info->pwr_x0[c] = (val & 0xff);
-                        chan_pcal_info->pwr_x0[++c] = ((val >> 8) & 0xff);
+                        chan_pcal_info->pwr_x0[c] = (s8) (val & 0xff);
+                        chan_pcal_info->pwr_x0[++c] = (s8) ((val >> 8) & 0xff);
                 }
 
                 /* PCDAC steps
@@ -825,12 +1034,12 @@ ath5k_eeprom_read_pcal_info_5112(struct ath5k_hw *ah, int mode)
                 chan_pcal_info->pcdac_x0[2] = ((val >> 5) & 0x1f);
                 chan_pcal_info->pcdac_x0[3] = ((val >> 10) & 0x1f);
 
-                /* Power values in dBm * 4
+                /* Power values in quarter dB
                  * for the higher xpd gain curve
                  * (18 dBm -> lower output power) */
                 AR5K_EEPROM_READ(offset++, val);
-                chan_pcal_info->pwr_x3[0] = (val & 0xff);
-                chan_pcal_info->pwr_x3[1] = ((val >> 8) & 0xff);
+                chan_pcal_info->pwr_x3[0] = (s8) (val & 0xff);
+                chan_pcal_info->pwr_x3[1] = (s8) ((val >> 8) & 0xff);
 
                 AR5K_EEPROM_READ(offset++, val);
                 chan_pcal_info->pwr_x3[2] = (val & 0xff);
@@ -843,24 +1052,36 @@ ath5k_eeprom_read_pcal_info_5112(struct ath5k_hw *ah, int mode)
                 chan_pcal_info->pcdac_x3[2] = 63;
 
                 if (ee->ee_version >= AR5K_EEPROM_VERSION_4_3) {
-                        chan_pcal_info->pcdac_x0[0] = ((val >> 8) & 0xff);
+                        chan_pcal_info->pcdac_x0[0] = ((val >> 8) & 0x3f);
 
                         /* Last xpd0 power level is also channel maximum */
                         gen_chan_info[i].max_pwr = chan_pcal_info->pwr_x0[3];
                 } else {
                         chan_pcal_info->pcdac_x0[0] = 1;
-                        gen_chan_info[i].max_pwr = ((val >> 8) & 0xff);
+                        gen_chan_info[i].max_pwr = (s8) ((val >> 8) & 0xff);
                 }
 
-                /* Recreate pcdac_x0 table for this channel using pcdac steps */
-                chan_pcal_info->pcdac_x0[1] += chan_pcal_info->pcdac_x0[0];
-                chan_pcal_info->pcdac_x0[2] += chan_pcal_info->pcdac_x0[1];
-                chan_pcal_info->pcdac_x0[3] += chan_pcal_info->pcdac_x0[2];
         }
 
-        return 0;
+        return ath5k_eeprom_convert_pcal_info_5112(ah, mode, gen_chan_info);
 }
 
+
+/*
+ * Read power calibration for RF2413 chips
+ *
+ * For RF2413 we have a Power to PDDAC table (Power Detector)
+ * instead of a PCDAC and 4 pd gain curves for each calibrated channel.
+ * Each curve has power on x axis in 0.5 db steps and PDDADC steps on y
+ * axis and looks like an exponential function like the RF5111 curve.
+ *
+ * To recreate the curves we read here the points and interpolate
+ * later. Note that in most cases only 2 (higher and lower) curves are
+ * used (like RF5112) but vendors have the oportunity to include all
+ * 4 curves on eeprom. The final curve (higher power) has an extra
+ * point for better accuracy like RF5112.
+ */
+
 /* For RF2413 power calibration data doesn't start on a fixed location and
  * if a mode is not supported, it's section is missing -not zeroed-.
  * So we need to calculate the starting offset for each section by using
@@ -890,13 +1111,15 @@ ath5k_cal_data_offset_2413(struct ath5k_eeprom_info *ee, int mode)
         switch(mode) {
         case AR5K_EEPROM_MODE_11G:
                 if (AR5K_EEPROM_HDR_11B(ee->ee_header))
-                        offset += ath5k_pdgains_size_2413(ee, AR5K_EEPROM_MODE_11B) +
-                                                        AR5K_EEPROM_N_2GHZ_CHAN_2413 / 2;
+                        offset += ath5k_pdgains_size_2413(ee,
+                                        AR5K_EEPROM_MODE_11B) +
+                                        AR5K_EEPROM_N_2GHZ_CHAN_2413 / 2;
                 /* fall through */
         case AR5K_EEPROM_MODE_11B:
                 if (AR5K_EEPROM_HDR_11A(ee->ee_header))
-                        offset += ath5k_pdgains_size_2413(ee, AR5K_EEPROM_MODE_11A) +
-                                                        AR5K_EEPROM_N_5GHZ_CHAN / 2;
+                        offset += ath5k_pdgains_size_2413(ee,
+                                        AR5K_EEPROM_MODE_11A) +
+                                        AR5K_EEPROM_N_5GHZ_CHAN / 2;
                 /* fall through */
         case AR5K_EEPROM_MODE_11A:
                 break;
@@ -907,37 +1130,118 @@ ath5k_cal_data_offset_2413(struct ath5k_eeprom_info *ee, int mode)
         return offset;
 }
 
-/* Read power calibration for RF2413 chips
- * For RF2413 we have a PDDAC table (Power Detector) instead
- * of a PCDAC and 4 pd gain curves for each calibrated channel.
- * Each curve has PDDAC steps on x axis and power on y axis and
- * looks like an exponential function. To recreate the curves
- * we read here the points and interpolate later. Note that
- * in most cases only higher and lower curves are used (like
- * RF5112) but vendors have the oportunity to include all 4
- * curves on eeprom. The final curve (higher power) has an extra
- * point for better accuracy like RF5112.
- */
+/* Convert RF2413 specific data to generic raw data
+ * used by interpolation code */
+static int
+ath5k_eeprom_convert_pcal_info_2413(struct ath5k_hw *ah, int mode,
+                                struct ath5k_chan_pcal_info *chinfo)
+{
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        struct ath5k_chan_pcal_info_rf2413 *pcinfo;
+        u8 *pdgain_idx = ee->ee_pdc_to_idx[mode];
+        unsigned int pier, pdg, point;
+
+        /* Fill raw data for each calibration pier */
+        for (pier = 0; pier < ee->ee_n_piers[mode]; pier++) {
+
+                pcinfo = &chinfo[pier].rf2413_info;
+
+                /* Allocate pd_curves for this cal pier */
+                chinfo[pier].pd_curves =
+                                kcalloc(AR5K_EEPROM_N_PD_CURVES,
+                                        sizeof(struct ath5k_pdgain_info),
+                                        GFP_KERNEL);
+
+                if (!chinfo[pier].pd_curves)
+                        return -ENOMEM;
+
+                /* Fill pd_curves */
+                for (pdg = 0; pdg < ee->ee_pd_gains[mode]; pdg++) {
+
+                        u8 idx = pdgain_idx[pdg];
+                        struct ath5k_pdgain_info *pd =
+                                        &chinfo[pier].pd_curves[idx];
+
+                        /* One more point for the highest power
+                         * curve (lowest gain) */
+                        if (pdg == ee->ee_pd_gains[mode] - 1)
+                                pd->pd_points = AR5K_EEPROM_N_PD_POINTS;
+                        else
+                                pd->pd_points = AR5K_EEPROM_N_PD_POINTS - 1;
+
+                        /* Allocate pd points for this curve */
+                        pd->pd_step = kcalloc(pd->pd_points,
+                                        sizeof(u8), GFP_KERNEL);
+
+                        if (!pd->pd_step)
+                                return -ENOMEM;
+
+                        pd->pd_pwr = kcalloc(pd->pd_points,
+                                        sizeof(s16), GFP_KERNEL);
+
+                        if (!pd->pd_pwr)
+                                return -ENOMEM;
+
+                        /* Fill raw dataset
+                         * convert all pwr levels to
+                         * quarter dB for RF5112 combatibility */
+                        pd->pd_step[0] = pcinfo->pddac_i[pdg];
+                        pd->pd_pwr[0] = 4 * pcinfo->pwr_i[pdg];
+
+                        for (point = 1; point < pd->pd_points; point++) {
+
+                                pd->pd_pwr[point] = pd->pd_pwr[point - 1] +
+                                        2 * pcinfo->pwr[pdg][point - 1];
+
+                                pd->pd_step[point] = pd->pd_step[point - 1] +
+                                                pcinfo->pddac[pdg][point - 1];
+
+                        }
+
+                        /* Highest gain curve -> min power */
+                        if (pdg == 0)
+                                chinfo[pier].min_pwr = pd->pd_pwr[0];
+
+                        /* Lowest gain curve -> max power */
+                        if (pdg == ee->ee_pd_gains[mode] - 1)
+                                chinfo[pier].max_pwr =
+                                        pd->pd_pwr[pd->pd_points - 1];
+                }
+        }
+
+        return 0;
+}
+
+/* Parse EEPROM data */
 static int
 ath5k_eeprom_read_pcal_info_2413(struct ath5k_hw *ah, int mode)
 {
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
-        struct ath5k_chan_pcal_info_rf2413 *chan_pcal_info;
-        struct ath5k_chan_pcal_info *gen_chan_info;
-        unsigned int i, c;
+        struct ath5k_chan_pcal_info_rf2413 *pcinfo;
+        struct ath5k_chan_pcal_info *chinfo;
+        u8 *pdgain_idx = ee->ee_pdc_to_idx[mode];
         u32 offset;
-        int ret;
+        int idx, i, ret;
         u16 val;
         u8 pd_gains = 0;
 
-        if (ee->ee_x_gain[mode] & 0x1) pd_gains++;
-        if ((ee->ee_x_gain[mode] >> 1) & 0x1) pd_gains++;
-        if ((ee->ee_x_gain[mode] >> 2) & 0x1) pd_gains++;
-        if ((ee->ee_x_gain[mode] >> 3) & 0x1) pd_gains++;
+        /* Count how many curves we have and
+         * identify them (which one of the 4
+         * available curves we have on each count).
+         * Curves are stored from higher to
+         * lower gain so we go backwards */
+        for (idx = AR5K_EEPROM_N_PD_CURVES - 1; idx >= 0; idx--) {
+                /* ee_x_gain[mode] is x gain mask */
+                if ((ee->ee_x_gain[mode] >> idx) & 0x1)
+                        pdgain_idx[pd_gains++] = idx;
+
+        }
         ee->ee_pd_gains[mode] = pd_gains;
 
+        if (pd_gains == 0)
+                return -EINVAL;
+
         offset = ath5k_cal_data_offset_2413(ee, mode);
-        ee->ee_n_piers[mode] = 0;
         switch (mode) {
         case AR5K_EEPROM_MODE_11A:
                 if (!AR5K_EEPROM_HDR_11A(ee->ee_header))
@@ -945,7 +1249,7 @@ ath5k_eeprom_read_pcal_info_2413(struct ath5k_hw *ah, int mode)
 
                 ath5k_eeprom_init_11a_pcal_freq(ah, offset);
                 offset += AR5K_EEPROM_N_5GHZ_CHAN / 2;
-                gen_chan_info = ee->ee_pwr_cal_a;
+                chinfo = ee->ee_pwr_cal_a;
                 break;
         case AR5K_EEPROM_MODE_11B:
                 if (!AR5K_EEPROM_HDR_11B(ee->ee_header))
@@ -953,7 +1257,7 @@ ath5k_eeprom_read_pcal_info_2413(struct ath5k_hw *ah, int mode)
 
                 ath5k_eeprom_init_11bg_2413(ah, mode, offset);
                 offset += AR5K_EEPROM_N_2GHZ_CHAN_2413 / 2;
-                gen_chan_info = ee->ee_pwr_cal_b;
+                chinfo = ee->ee_pwr_cal_b;
                 break;
         case AR5K_EEPROM_MODE_11G:
                 if (!AR5K_EEPROM_HDR_11G(ee->ee_header))
@@ -961,41 +1265,35 @@ ath5k_eeprom_read_pcal_info_2413(struct ath5k_hw *ah, int mode)
 
                 ath5k_eeprom_init_11bg_2413(ah, mode, offset);
                 offset += AR5K_EEPROM_N_2GHZ_CHAN_2413 / 2;
-                gen_chan_info = ee->ee_pwr_cal_g;
+                chinfo = ee->ee_pwr_cal_g;
                 break;
         default:
                 return -EINVAL;
         }
 
-        if (pd_gains == 0)
-                return 0;
-
         for (i = 0; i < ee->ee_n_piers[mode]; i++) {
-                chan_pcal_info = &gen_chan_info[i].rf2413_info;
+                pcinfo = &chinfo[i].rf2413_info;
 
                 /*
                  * Read pwr_i, pddac_i and the first
                  * 2 pd points (pwr, pddac)
                  */
                 AR5K_EEPROM_READ(offset++, val);
-                chan_pcal_info->pwr_i[0] = val & 0x1f;
-                chan_pcal_info->pddac_i[0] = (val >> 5) & 0x7f;
-                chan_pcal_info->pwr[0][0] =
-                                        (val >> 12) & 0xf;
+                pcinfo->pwr_i[0] = val & 0x1f;
+                pcinfo->pddac_i[0] = (val >> 5) & 0x7f;
+                pcinfo->pwr[0][0] = (val >> 12) & 0xf;
 
                 AR5K_EEPROM_READ(offset++, val);
-                chan_pcal_info->pddac[0][0] = val & 0x3f;
-                chan_pcal_info->pwr[0][1] = (val >> 6) & 0xf;
-                chan_pcal_info->pddac[0][1] =
-                                        (val >> 10) & 0x3f;
+                pcinfo->pddac[0][0] = val & 0x3f;
+                pcinfo->pwr[0][1] = (val >> 6) & 0xf;
+                pcinfo->pddac[0][1] = (val >> 10) & 0x3f;
 
                 AR5K_EEPROM_READ(offset++, val);
-                chan_pcal_info->pwr[0][2] = val & 0xf;
-                chan_pcal_info->pddac[0][2] =
-                                        (val >> 4) & 0x3f;
+                pcinfo->pwr[0][2] = val & 0xf;
+                pcinfo->pddac[0][2] = (val >> 4) & 0x3f;
 
-                chan_pcal_info->pwr[0][3] = 0;
-                chan_pcal_info->pddac[0][3] = 0;
+                pcinfo->pwr[0][3] = 0;
+                pcinfo->pddac[0][3] = 0;
 
                 if (pd_gains > 1) {
                         /*
@@ -1003,44 +1301,36 @@ ath5k_eeprom_read_pcal_info_2413(struct ath5k_hw *ah, int mode)
                          * so it only has 2 pd points.
                          * Continue wih pd gain 1.
                          */
-                        chan_pcal_info->pwr_i[1] = (val >> 10) & 0x1f;
+                        pcinfo->pwr_i[1] = (val >> 10) & 0x1f;
 
-                        chan_pcal_info->pddac_i[1] = (val >> 15) & 0x1;
+                        pcinfo->pddac_i[1] = (val >> 15) & 0x1;
                         AR5K_EEPROM_READ(offset++, val);
-                        chan_pcal_info->pddac_i[1] |= (val & 0x3F) << 1;
+                        pcinfo->pddac_i[1] |= (val & 0x3F) << 1;
 
-                        chan_pcal_info->pwr[1][0] = (val >> 6) & 0xf;
-                        chan_pcal_info->pddac[1][0] =
-                                                (val >> 10) & 0x3f;
+                        pcinfo->pwr[1][0] = (val >> 6) & 0xf;
+                        pcinfo->pddac[1][0] = (val >> 10) & 0x3f;
 
                         AR5K_EEPROM_READ(offset++, val);
-                        chan_pcal_info->pwr[1][1] = val & 0xf;
-                        chan_pcal_info->pddac[1][1] =
-                                                (val >> 4) & 0x3f;
-                        chan_pcal_info->pwr[1][2] =
-                                                (val >> 10) & 0xf;
-
-                        chan_pcal_info->pddac[1][2] =
-                                                (val >> 14) & 0x3;
+                        pcinfo->pwr[1][1] = val & 0xf;
+                        pcinfo->pddac[1][1] = (val >> 4) & 0x3f;
+                        pcinfo->pwr[1][2] = (val >> 10) & 0xf;
+
+                        pcinfo->pddac[1][2] = (val >> 14) & 0x3;
                         AR5K_EEPROM_READ(offset++, val);
-                        chan_pcal_info->pddac[1][2] |=
-                                                (val & 0xF) << 2;
+                        pcinfo->pddac[1][2] |= (val & 0xF) << 2;
 
-                        chan_pcal_info->pwr[1][3] = 0;
-                        chan_pcal_info->pddac[1][3] = 0;
+                        pcinfo->pwr[1][3] = 0;
+                        pcinfo->pddac[1][3] = 0;
                 } else if (pd_gains == 1) {
                         /*
                          * Pd gain 0 is the last one so
                          * read the extra point.
                          */
-                        chan_pcal_info->pwr[0][3] =
-                                                (val >> 10) & 0xf;
+                        pcinfo->pwr[0][3] = (val >> 10) & 0xf;
 
-                        chan_pcal_info->pddac[0][3] =
-                                                (val >> 14) & 0x3;
+                        pcinfo->pddac[0][3] = (val >> 14) & 0x3;
                         AR5K_EEPROM_READ(offset++, val);
-                        chan_pcal_info->pddac[0][3] |=
-                                                (val & 0xF) << 2;
+                        pcinfo->pddac[0][3] |= (val & 0xF) << 2;
                 }
 
                 /*
@@ -1048,105 +1338,65 @@ ath5k_eeprom_read_pcal_info_2413(struct ath5k_hw *ah, int mode)
                  * as above.
                  */
                 if (pd_gains > 2) {
-                        chan_pcal_info->pwr_i[2] = (val >> 4) & 0x1f;
-                        chan_pcal_info->pddac_i[2] = (val >> 9) & 0x7f;
+                        pcinfo->pwr_i[2] = (val >> 4) & 0x1f;
+                        pcinfo->pddac_i[2] = (val >> 9) & 0x7f;
 
                         AR5K_EEPROM_READ(offset++, val);
-                        chan_pcal_info->pwr[2][0] =
-                                                (val >> 0) & 0xf;
-                        chan_pcal_info->pddac[2][0] =
-                                                (val >> 4) & 0x3f;
-                        chan_pcal_info->pwr[2][1] =
-                                                (val >> 10) & 0xf;
-
-                        chan_pcal_info->pddac[2][1] =
-                                                (val >> 14) & 0x3;
+                        pcinfo->pwr[2][0] = (val >> 0) & 0xf;
+                        pcinfo->pddac[2][0] = (val >> 4) & 0x3f;
+                        pcinfo->pwr[2][1] = (val >> 10) & 0xf;
+
+                        pcinfo->pddac[2][1] = (val >> 14) & 0x3;
                         AR5K_EEPROM_READ(offset++, val);
-                        chan_pcal_info->pddac[2][1] |=
-                                                (val & 0xF) << 2;
+                        pcinfo->pddac[2][1] |= (val & 0xF) << 2;
 
-                        chan_pcal_info->pwr[2][2] =
-                                                (val >> 4) & 0xf;
-                        chan_pcal_info->pddac[2][2] =
-                                                (val >> 8) & 0x3f;
+                        pcinfo->pwr[2][2] = (val >> 4) & 0xf;
+                        pcinfo->pddac[2][2] = (val >> 8) & 0x3f;
 
-                        chan_pcal_info->pwr[2][3] = 0;
-                        chan_pcal_info->pddac[2][3] = 0;
+                        pcinfo->pwr[2][3] = 0;
+                        pcinfo->pddac[2][3] = 0;
                 } else if (pd_gains == 2) {
-                        chan_pcal_info->pwr[1][3] =
-                                                (val >> 4) & 0xf;
-                        chan_pcal_info->pddac[1][3] =
-                                                (val >> 8) & 0x3f;
+                        pcinfo->pwr[1][3] = (val >> 4) & 0xf;
+                        pcinfo->pddac[1][3] = (val >> 8) & 0x3f;
                 }
 
                 if (pd_gains > 3) {
-                        chan_pcal_info->pwr_i[3] = (val >> 14) & 0x3;
+                        pcinfo->pwr_i[3] = (val >> 14) & 0x3;
                         AR5K_EEPROM_READ(offset++, val);
-                        chan_pcal_info->pwr_i[3] |= ((val >> 0) & 0x7) << 2;
+                        pcinfo->pwr_i[3] |= ((val >> 0) & 0x7) << 2;
 
-                        chan_pcal_info->pddac_i[3] = (val >> 3) & 0x7f;
-                        chan_pcal_info->pwr[3][0] =
-                                                (val >> 10) & 0xf;
-                        chan_pcal_info->pddac[3][0] =
-                                                (val >> 14) & 0x3;
+                        pcinfo->pddac_i[3] = (val >> 3) & 0x7f;
+                        pcinfo->pwr[3][0] = (val >> 10) & 0xf;
+                        pcinfo->pddac[3][0] = (val >> 14) & 0x3;
 
                         AR5K_EEPROM_READ(offset++, val);
-                        chan_pcal_info->pddac[3][0] |=
-                                                (val & 0xF) << 2;
-                        chan_pcal_info->pwr[3][1] =
-                                                (val >> 4) & 0xf;
-                        chan_pcal_info->pddac[3][1] =
-                                                (val >> 8) & 0x3f;
-
-                        chan_pcal_info->pwr[3][2] =
-                                                (val >> 14) & 0x3;
+                        pcinfo->pddac[3][0] |= (val & 0xF) << 2;
+                        pcinfo->pwr[3][1] = (val >> 4) & 0xf;
+                        pcinfo->pddac[3][1] = (val >> 8) & 0x3f;
+
+                        pcinfo->pwr[3][2] = (val >> 14) & 0x3;
                         AR5K_EEPROM_READ(offset++, val);
-                        chan_pcal_info->pwr[3][2] |=
-                                                ((val >> 0) & 0x3) << 2;
+                        pcinfo->pwr[3][2] |= ((val >> 0) & 0x3) << 2;
 
-                        chan_pcal_info->pddac[3][2] =
-                                                (val >> 2) & 0x3f;
-                        chan_pcal_info->pwr[3][3] =
-                                                (val >> 8) & 0xf;
+                        pcinfo->pddac[3][2] = (val >> 2) & 0x3f;
+                        pcinfo->pwr[3][3] = (val >> 8) & 0xf;
 
-                        chan_pcal_info->pddac[3][3] =
-                                                (val >> 12) & 0xF;
+                        pcinfo->pddac[3][3] = (val >> 12) & 0xF;
                         AR5K_EEPROM_READ(offset++, val);
-                        chan_pcal_info->pddac[3][3] |=
-                                                ((val >> 0) & 0x3) << 4;
+                        pcinfo->pddac[3][3] |= ((val >> 0) & 0x3) << 4;
                 } else if (pd_gains == 3) {
-                        chan_pcal_info->pwr[2][3] =
-                                                (val >> 14) & 0x3;
+                        pcinfo->pwr[2][3] = (val >> 14) & 0x3;
                         AR5K_EEPROM_READ(offset++, val);
-                        chan_pcal_info->pwr[2][3] |=
-                                                ((val >> 0) & 0x3) << 2;
-
-                        chan_pcal_info->pddac[2][3] =
-                                                (val >> 2) & 0x3f;
-                }
+                        pcinfo->pwr[2][3] |= ((val >> 0) & 0x3) << 2;
 
-                for (c = 0; c < pd_gains; c++) {
-                        /* Recreate pwr table for this channel using pwr steps */
-                        chan_pcal_info->pwr[c][0] += chan_pcal_info->pwr_i[c] * 2;
-                        chan_pcal_info->pwr[c][1] += chan_pcal_info->pwr[c][0];
-                        chan_pcal_info->pwr[c][2] += chan_pcal_info->pwr[c][1];
-                        chan_pcal_info->pwr[c][3] += chan_pcal_info->pwr[c][2];
-                        if (chan_pcal_info->pwr[c][3] == chan_pcal_info->pwr[c][2])
-                                chan_pcal_info->pwr[c][3] = 0;
-
-                        /* Recreate pddac table for this channel using pddac steps */
-                        chan_pcal_info->pddac[c][0] += chan_pcal_info->pddac_i[c];
-                        chan_pcal_info->pddac[c][1] += chan_pcal_info->pddac[c][0];
-                        chan_pcal_info->pddac[c][2] += chan_pcal_info->pddac[c][1];
-                        chan_pcal_info->pddac[c][3] += chan_pcal_info->pddac[c][2];
-                        if (chan_pcal_info->pddac[c][3] == chan_pcal_info->pddac[c][2])
-                                chan_pcal_info->pddac[c][3] = 0;
+                        pcinfo->pddac[2][3] = (val >> 2) & 0x3f;
                 }
         }
 
-        return 0;
+        return ath5k_eeprom_convert_pcal_info_2413(ah, mode, chinfo);
 }
 
+
 /*
  * Read per rate target power (this is the maximum tx power
  * supported by the card). This info is used when setting
@@ -1154,11 +1404,12 @@ ath5k_eeprom_read_pcal_info_2413(struct ath5k_hw *ah, int mode)
  *
  * This also works for v5 EEPROMs.
  */
-static int ath5k_eeprom_read_target_rate_pwr_info(struct ath5k_hw *ah, unsigned int mode)
+static int
+ath5k_eeprom_read_target_rate_pwr_info(struct ath5k_hw *ah, unsigned int mode)
 {
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
         struct ath5k_rate_pcal_info *rate_pcal_info;
-        u16 *rate_target_pwr_num;
+        u8 *rate_target_pwr_num;
         u32 offset;
         u16 val;
         int ret, i;
@@ -1264,7 +1515,9 @@ ath5k_eeprom_read_pcal_info(struct ath5k_hw *ah)
         else
                 read_pcal = ath5k_eeprom_read_pcal_info_5111;
 
-        for (mode = AR5K_EEPROM_MODE_11A; mode <= AR5K_EEPROM_MODE_11G; mode++) {
+
+        for (mode = AR5K_EEPROM_MODE_11A; mode <= AR5K_EEPROM_MODE_11G;
+        mode++) {
                 err = read_pcal(ah, mode);
                 if (err)
                         return err;
@@ -1277,6 +1530,62 @@ ath5k_eeprom_read_pcal_info(struct ath5k_hw *ah)
         return 0;
 }
 
+static int
+ath5k_eeprom_free_pcal_info(struct ath5k_hw *ah, int mode)
+{
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        struct ath5k_chan_pcal_info *chinfo;
+        u8 pier, pdg;
+
+        switch (mode) {
+        case AR5K_EEPROM_MODE_11A:
+                if (!AR5K_EEPROM_HDR_11A(ee->ee_header))
+                        return 0;
+                chinfo = ee->ee_pwr_cal_a;
+                break;
+        case AR5K_EEPROM_MODE_11B:
+                if (!AR5K_EEPROM_HDR_11B(ee->ee_header))
+                        return 0;
+                chinfo = ee->ee_pwr_cal_b;
+                break;
+        case AR5K_EEPROM_MODE_11G:
+                if (!AR5K_EEPROM_HDR_11G(ee->ee_header))
+                        return 0;
+                chinfo = ee->ee_pwr_cal_g;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        for (pier = 0; pier < ee->ee_n_piers[mode]; pier++) {
+                if (!chinfo[pier].pd_curves)
+                        continue;
+
+                for (pdg = 0; pdg < ee->ee_pd_gains[mode]; pdg++) {
+                        struct ath5k_pdgain_info *pd =
+                                        &chinfo[pier].pd_curves[pdg];
+
+                        if (pd != NULL) {
+                                kfree(pd->pd_step);
+                                kfree(pd->pd_pwr);
+                        }
+                }
+
+                kfree(chinfo[pier].pd_curves);
+        }
+
+        return 0;
+}
+
+void
+ath5k_eeprom_detach(struct ath5k_hw *ah)
+{
+        u8 mode;
+
+        for (mode = AR5K_EEPROM_MODE_11A; mode <= AR5K_EEPROM_MODE_11G; mode++)
+                ath5k_eeprom_free_pcal_info(ah, mode);
+}
+
 /* Read conformance test limits used for regulatory control */
 static int
 ath5k_eeprom_read_ctl_info(struct ath5k_hw *ah)
@@ -1457,3 +1766,4 @@ bool ath5k_eeprom_is_hb63(struct ath5k_hw *ah)
         else
                 return false;
 }
+
diff --git a/drivers/net/wireless/ath5k/eeprom.h b/drivers/net/wireless/ath5k/eeprom.h
index 1deebc0257d4..b0c0606dea0b 100644
--- a/drivers/net/wireless/ath5k/eeprom.h
+++ b/drivers/net/wireless/ath5k/eeprom.h
@@ -173,6 +173,7 @@
 #define AR5K_EEPROM_N_5GHZ_CHAN         10
 #define AR5K_EEPROM_N_2GHZ_CHAN         3
 #define AR5K_EEPROM_N_2GHZ_CHAN_2413    4
+#define AR5K_EEPROM_N_2GHZ_CHAN_MAX     4
 #define AR5K_EEPROM_MAX_CHAN            10
 #define AR5K_EEPROM_N_PWR_POINTS_5111   11
 #define AR5K_EEPROM_N_PCDAC             11
@@ -193,7 +194,7 @@
 #define AR5K_EEPROM_SCALE_OC_DELTA(_x)  (((_x) * 2) / 10)
 #define AR5K_EEPROM_N_CTLS(_v)          AR5K_EEPROM_OFF(_v, 16, 32)
 #define AR5K_EEPROM_MAX_CTLS            32
-#define AR5K_EEPROM_N_XPD_PER_CHANNEL   4
+#define AR5K_EEPROM_N_PD_CURVES         4
 #define AR5K_EEPROM_N_XPD0_POINTS       4
 #define AR5K_EEPROM_N_XPD3_POINTS       3
 #define AR5K_EEPROM_N_PD_GAINS          4
@@ -232,7 +233,7 @@ enum ath5k_ctl_mode {
         AR5K_CTL_11B = 1,
         AR5K_CTL_11G = 2,
         AR5K_CTL_TURBO = 3,
-        AR5K_CTL_108G = 4,
+        AR5K_CTL_TURBOG = 4,
         AR5K_CTL_2GHT20 = 5,
         AR5K_CTL_5GHT20 = 6,
         AR5K_CTL_2GHT40 = 7,
@@ -240,65 +241,114 @@ enum ath5k_ctl_mode {
         AR5K_CTL_MODE_M = 15,
 };
 
+/* Default CTL ids for the 3 main reg domains.
+ * Atheros only uses these by default but vendors
+ * can have up to 32 different CTLs for different
+ * scenarios. Note that theese values are ORed with
+ * the mode id (above) so we can have up to 24 CTL
+ * datasets out of these 3 main regdomains. That leaves
+ * 8 ids that can be used by vendors and since 0x20 is
+ * missing from HAL sources i guess this is the set of
+ * custom CTLs vendors can use. */
+#define AR5K_CTL_FCC    0x10
+#define AR5K_CTL_CUSTOM 0x20
+#define AR5K_CTL_ETSI   0x30
+#define AR5K_CTL_MKK    0x40
+
+/* Indicates a CTL with only mode set and
+ * no reg domain mapping, such CTLs are used
+ * for world roaming domains or simply when
+ * a reg domain is not set */
+#define AR5K_CTL_NO_REGDOMAIN   0xf0
+
+/* Indicates an empty (invalid) CTL */
+#define AR5K_CTL_NO_CTL         0xff
+
 /* Per channel calibration data, used for power table setup */
 struct ath5k_chan_pcal_info_rf5111 {
         /* Power levels in half dbm units
          * for one power curve. */
-        u8              pwr[AR5K_EEPROM_N_PWR_POINTS_5111];
+        u8 pwr[AR5K_EEPROM_N_PWR_POINTS_5111];
         /* PCDAC table steps
          * for the above values */
-        u8              pcdac[AR5K_EEPROM_N_PWR_POINTS_5111];
+        u8 pcdac[AR5K_EEPROM_N_PWR_POINTS_5111];
         /* Starting PCDAC step */
-        u8              pcdac_min;
+        u8 pcdac_min;
         /* Final PCDAC step */
-        u8              pcdac_max;
+        u8 pcdac_max;
 };
 
 struct ath5k_chan_pcal_info_rf5112 {
         /* Power levels in quarter dBm units
          * for lower (0) and higher (3)
-         * level curves */
-        s8              pwr_x0[AR5K_EEPROM_N_XPD0_POINTS];
-        s8              pwr_x3[AR5K_EEPROM_N_XPD3_POINTS];
+         * level curves in 0.25dB units */
+        s8 pwr_x0[AR5K_EEPROM_N_XPD0_POINTS];
+        s8 pwr_x3[AR5K_EEPROM_N_XPD3_POINTS];
         /* PCDAC table steps
          * for the above values */
-        u8      pcdac_x0[AR5K_EEPROM_N_XPD0_POINTS];
-        u8      pcdac_x3[AR5K_EEPROM_N_XPD3_POINTS];
+        u8 pcdac_x0[AR5K_EEPROM_N_XPD0_POINTS];
+        u8 pcdac_x3[AR5K_EEPROM_N_XPD3_POINTS];
 };
 
 struct ath5k_chan_pcal_info_rf2413 {
         /* Starting pwr/pddac values */
-        s8              pwr_i[AR5K_EEPROM_N_PD_GAINS];
-        u8      pddac_i[AR5K_EEPROM_N_PD_GAINS];
-        /* (pwr,pddac) points */
-        s8              pwr[AR5K_EEPROM_N_PD_GAINS]
-                                [AR5K_EEPROM_N_PD_POINTS];
-        u8      pddac[AR5K_EEPROM_N_PD_GAINS]
-                                [AR5K_EEPROM_N_PD_POINTS];
+        s8 pwr_i[AR5K_EEPROM_N_PD_GAINS];
+        u8 pddac_i[AR5K_EEPROM_N_PD_GAINS];
+        /* (pwr,pddac) points
+         * power levels in 0.5dB units */
+        s8 pwr[AR5K_EEPROM_N_PD_GAINS]
+                [AR5K_EEPROM_N_PD_POINTS];
+        u8 pddac[AR5K_EEPROM_N_PD_GAINS]
+                [AR5K_EEPROM_N_PD_POINTS];
+};
+
+enum ath5k_powertable_type {
+        AR5K_PWRTABLE_PWR_TO_PCDAC = 0,
+        AR5K_PWRTABLE_LINEAR_PCDAC = 1,
+        AR5K_PWRTABLE_PWR_TO_PDADC = 2,
+};
+
+struct ath5k_pdgain_info {
+        u8 pd_points;
+        u8 *pd_step;
+        /* Power values are in
+         * 0.25dB units */
+        s16 *pd_pwr;
 };
 
 struct ath5k_chan_pcal_info {
         /* Frequency */
         u16     freq;
-        /* Max available power */
-        s8              max_pwr;
+        /* Tx power boundaries */
+        s16     max_pwr;
+        s16     min_pwr;
         union {
                 struct ath5k_chan_pcal_info_rf5111 rf5111_info;
                 struct ath5k_chan_pcal_info_rf5112 rf5112_info;
                 struct ath5k_chan_pcal_info_rf2413 rf2413_info;
         };
+        /* Raw values used by phy code
+         * Curves are stored in order from lower
+         * gain to higher gain (max txpower -> min txpower) */
+        struct ath5k_pdgain_info *pd_curves;
 };
 
-/* Per rate calibration data for each mode, used for power table setup */
+/* Per rate calibration data for each mode,
+ * used for rate power table setup.
+ * Note: Values in 0.5dB units */
 struct ath5k_rate_pcal_info {
         u16     freq; /* Frequency */
-        /* Power level for 6-24Mbit/s rates */
+        /* Power level for 6-24Mbit/s rates or
+         * 1Mb rate */
         u16     target_power_6to24;
-        /* Power level for 36Mbit rate */
+        /* Power level for 36Mbit rate or
+         * 2Mb rate */
         u16     target_power_36;
-        /* Power level for 48Mbit rate */
+        /* Power level for 48Mbit rate or
+         * 5.5Mbit rate */
         u16     target_power_48;
-        /* Power level for 54Mbit rate */
+        /* Power level for 54Mbit rate or
+         * 11Mbit rate */
         u16     target_power_54;
 };
 
@@ -330,12 +380,6 @@ struct ath5k_eeprom_info {
         u16     ee_cck_ofdm_power_delta;
         u16     ee_scaled_cck_delta;
 
-        /* Used for tx thermal adjustment (eeprom_init, rfregs) */
-        u16     ee_tx_clip;
-        u16     ee_pwd_84;
-        u16     ee_pwd_90;
-        u16     ee_gain_select;
-
         /* RF Calibration settings (reset, rfregs) */
         u16     ee_i_cal[AR5K_EEPROM_N_MODES];
         u16     ee_q_cal[AR5K_EEPROM_N_MODES];
@@ -363,23 +407,25 @@ struct ath5k_eeprom_info {
         /* Power calibration data */
         u16     ee_false_detect[AR5K_EEPROM_N_MODES];
 
-        /* Number of pd gain curves per mode (RF2413) */
-        u8 ee_pd_gains[AR5K_EEPROM_N_MODES];
+        /* Number of pd gain curves per mode */
+        u8      ee_pd_gains[AR5K_EEPROM_N_MODES];
+        /* Back mapping pdcurve number -> pdcurve index in pd->pd_curves */
+        u8      ee_pdc_to_idx[AR5K_EEPROM_N_MODES][AR5K_EEPROM_N_PD_GAINS];
 
-        u8 ee_n_piers[AR5K_EEPROM_N_MODES];
+        u8      ee_n_piers[AR5K_EEPROM_N_MODES];
         struct ath5k_chan_pcal_info     ee_pwr_cal_a[AR5K_EEPROM_N_5GHZ_CHAN];
-        struct ath5k_chan_pcal_info     ee_pwr_cal_b[AR5K_EEPROM_N_2GHZ_CHAN];
-        struct ath5k_chan_pcal_info     ee_pwr_cal_g[AR5K_EEPROM_N_2GHZ_CHAN];
+        struct ath5k_chan_pcal_info     ee_pwr_cal_b[AR5K_EEPROM_N_2GHZ_CHAN_MAX];
+        struct ath5k_chan_pcal_info     ee_pwr_cal_g[AR5K_EEPROM_N_2GHZ_CHAN_MAX];
 
         /* Per rate target power levels */
-        u16     ee_rate_target_pwr_num[AR5K_EEPROM_N_MODES];
+        u8      ee_rate_target_pwr_num[AR5K_EEPROM_N_MODES];
         struct ath5k_rate_pcal_info     ee_rate_tpwr_a[AR5K_EEPROM_N_5GHZ_CHAN];
-        struct ath5k_rate_pcal_info     ee_rate_tpwr_b[AR5K_EEPROM_N_2GHZ_CHAN];
-        struct ath5k_rate_pcal_info     ee_rate_tpwr_g[AR5K_EEPROM_N_2GHZ_CHAN];
+        struct ath5k_rate_pcal_info     ee_rate_tpwr_b[AR5K_EEPROM_N_2GHZ_CHAN_MAX];
+        struct ath5k_rate_pcal_info     ee_rate_tpwr_g[AR5K_EEPROM_N_2GHZ_CHAN_MAX];
 
         /* Conformance test limits (Unused) */
-        u16     ee_ctls;
-        u16     ee_ctl[AR5K_EEPROM_MAX_CTLS];
+        u8      ee_ctls;
+        u8      ee_ctl[AR5K_EEPROM_MAX_CTLS];
         struct ath5k_edge_power ee_ctl_pwr[AR5K_EEPROM_N_EDGES * AR5K_EEPROM_MAX_CTLS];
 
         /* Noise Floor Calibration settings */
diff --git a/drivers/net/wireless/ath5k/initvals.c b/drivers/net/wireless/ath5k/initvals.c
index 44886434187b..61fb621ed20d 100644
--- a/drivers/net/wireless/ath5k/initvals.c
+++ b/drivers/net/wireless/ath5k/initvals.c
@@ -1510,8 +1510,8 @@ int ath5k_hw_write_initvals(struct ath5k_hw *ah, u8 mode, bool change_channel)
                                         rf2425_ini_mode_end, mode);
 
                         ath5k_hw_ini_registers(ah,
-                                        ARRAY_SIZE(rf2413_ini_common_end),
-                                        rf2413_ini_common_end, change_channel);
+                                        ARRAY_SIZE(rf2425_ini_common_end),
+                                        rf2425_ini_common_end, change_channel);
 
                         ath5k_hw_ini_registers(ah,
                                         ARRAY_SIZE(rf5112_ini_bbgain),
diff --git a/drivers/net/wireless/ath5k/led.c b/drivers/net/wireless/ath5k/led.c
index 0686e12738b3..19555fb79c9b 100644
--- a/drivers/net/wireless/ath5k/led.c
+++ b/drivers/net/wireless/ath5k/led.c
@@ -65,6 +65,8 @@ static const struct pci_device_id ath5k_led_devices[] = {
         { ATH_SDEVICE(PCI_VENDOR_ID_AMBIT, 0x0422), ATH_LED(1, 1) },
         /* E-machines E510 (tuliom@gmail.com) */
         { ATH_SDEVICE(PCI_VENDOR_ID_AMBIT, 0x0428), ATH_LED(3, 0) },
+        /* Acer Extensa 5620z (nekoreeve@gmail.com) */
+        { ATH_SDEVICE(PCI_VENDOR_ID_QMI, 0x0105), ATH_LED(3, 0) },
         { }
 };
 
diff --git a/drivers/net/wireless/ath5k/phy.c b/drivers/net/wireless/ath5k/phy.c
index 81f5bebc48b1..9e2faae5ae94 100644
--- a/drivers/net/wireless/ath5k/phy.c
+++ b/drivers/net/wireless/ath5k/phy.c
@@ -4,6 +4,7 @@
  * Copyright (c) 2004-2007 Reyk Floeter <reyk@openbsd.org>
  * Copyright (c) 2006-2009 Nick Kossifidis <mickflemm@gmail.com>
  * Copyright (c) 2007-2008 Jiri Slaby <jirislaby@gmail.com>
+ * Copyright (c) 2008-2009 Felix Fietkau <nbd@openwrt.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -183,7 +184,9 @@ static void ath5k_hw_request_rfgain_probe(struct ath5k_hw *ah)
         if (ah->ah_gain.g_state != AR5K_RFGAIN_ACTIVE)
                 return;
 
-        ath5k_hw_reg_write(ah, AR5K_REG_SM(ah->ah_txpower.txp_max,
+        /* Send the packet with 2dB below max power as
+         * patent doc suggest */
+        ath5k_hw_reg_write(ah, AR5K_REG_SM(ah->ah_txpower.txp_max_pwr - 4,
                         AR5K_PHY_PAPD_PROBE_TXPOWER) |
                         AR5K_PHY_PAPD_PROBE_TX_NEXT, AR5K_PHY_PAPD_PROBE);
 
@@ -1433,93 +1436,1120 @@ unsigned int ath5k_hw_get_def_antenna(struct ath5k_hw *ah)
         return false; /*XXX: What do we return for 5210 ?*/
 }
 
+
+/****************\
+* TX power setup *
+\****************/
+
+/*
+ * Helper functions
+ */
+
+/*
+ * Do linear interpolation between two given (x, y) points
+ */
+static s16
+ath5k_get_interpolated_value(s16 target, s16 x_left, s16 x_right,
+                                        s16 y_left, s16 y_right)
+{
+        s16 ratio, result;
+
+        /* Avoid divide by zero and skip interpolation
+         * if we have the same point */
+        if ((x_left == x_right) || (y_left == y_right))
+                return y_left;
+
+        /*
+         * Since we use ints and not fps, we need to scale up in
+         * order to get a sane ratio value (or else we 'll eg. get
+         * always 1 instead of 1.25, 1.75 etc). We scale up by 100
+         * to have some accuracy both for 0.5 and 0.25 steps.
+         */
+        ratio = ((100 * y_right - 100 * y_left)/(x_right - x_left));
+
+        /* Now scale down to be in range */
+        result = y_left + (ratio * (target - x_left) / 100);
+
+        return result;
+}
+
+/*
+ * Find vertical boundary (min pwr) for the linear PCDAC curve.
+ *
+ * Since we have the top of the curve and we draw the line below
+ * until we reach 1 (1 pcdac step) we need to know which point
+ * (x value) that is so that we don't go below y axis and have negative
+ * pcdac values when creating the curve, or fill the table with zeroes.
+ */
+static s16
+ath5k_get_linear_pcdac_min(const u8 *stepL, const u8 *stepR,
+                                const s16 *pwrL, const s16 *pwrR)
+{
+        s8 tmp;
+        s16 min_pwrL, min_pwrR;
+        s16 pwr_i = pwrL[0];
+
+        do {
+                pwr_i--;
+                tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+                                                pwrL[0], pwrL[1],
+                                                stepL[0], stepL[1]);
+
+        } while (tmp > 1);
+
+        min_pwrL = pwr_i;
+
+        pwr_i = pwrR[0];
+        do {
+                pwr_i--;
+                tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+                                                pwrR[0], pwrR[1],
+                                                stepR[0], stepR[1]);
+
+        } while (tmp > 1);
+
+        min_pwrR = pwr_i;
+
+        /* Keep the right boundary so that it works for both curves */
+        return max(min_pwrL, min_pwrR);
+}
+
+/*
+ * Interpolate (pwr,vpd) points to create a Power to PDADC or a
+ * Power to PCDAC curve.
+ *
+ * Each curve has power on x axis (in 0.5dB units) and PCDAC/PDADC
+ * steps (offsets) on y axis. Power can go up to 31.5dB and max
+ * PCDAC/PDADC step for each curve is 64 but we can write more than
+ * one curves on hw so we can go up to 128 (which is the max step we
+ * can write on the final table).
+ *
+ * We write y values (PCDAC/PDADC steps) on hw.
+ */
+static void
+ath5k_create_power_curve(s16 pmin, s16 pmax,
+                        const s16 *pwr, const u8 *vpd,
+                        u8 num_points,
+                        u8 *vpd_table, u8 type)
+{
+        u8 idx[2] = { 0, 1 };
+        s16 pwr_i = 2*pmin;
+        int i;
+
+        if (num_points < 2)
+                return;
+
+        /* We want the whole line, so adjust boundaries
+         * to cover the entire power range. Note that
+         * power values are already 0.25dB so no need
+         * to multiply pwr_i by 2 */
+        if (type == AR5K_PWRTABLE_LINEAR_PCDAC) {
+                pwr_i = pmin;
+                pmin = 0;
+                pmax = 63;
+        }
+
+        /* Find surrounding turning points (TPs)
+         * and interpolate between them */
+        for (i = 0; (i <= (u16) (pmax - pmin)) &&
+        (i < AR5K_EEPROM_POWER_TABLE_SIZE); i++) {
+
+                /* We passed the right TP, move to the next set of TPs
+                 * if we pass the last TP, extrapolate above using the last
+                 * two TPs for ratio */
+                if ((pwr_i > pwr[idx[1]]) && (idx[1] < num_points - 1)) {
+                        idx[0]++;
+                        idx[1]++;
+                }
+
+                vpd_table[i] = (u8) ath5k_get_interpolated_value(pwr_i,
+                                                pwr[idx[0]], pwr[idx[1]],
+                                                vpd[idx[0]], vpd[idx[1]]);
+
+                /* Increase by 0.5dB
+                 * (0.25 dB units) */
+                pwr_i += 2;
+        }
+}
+
+/*
+ * Get the surrounding per-channel power calibration piers
+ * for a given frequency so that we can interpolate between
+ * them and come up with an apropriate dataset for our current
+ * channel.
+ */
+static void
+ath5k_get_chan_pcal_surrounding_piers(struct ath5k_hw *ah,
+                        struct ieee80211_channel *channel,
+                        struct ath5k_chan_pcal_info **pcinfo_l,
+                        struct ath5k_chan_pcal_info **pcinfo_r)
+{
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        struct ath5k_chan_pcal_info *pcinfo;
+        u8 idx_l, idx_r;
+        u8 mode, max, i;
+        u32 target = channel->center_freq;
+
+        idx_l = 0;
+        idx_r = 0;
+
+        if (!(channel->hw_value & CHANNEL_OFDM)) {
+                pcinfo = ee->ee_pwr_cal_b;
+                mode = AR5K_EEPROM_MODE_11B;
+        } else if (channel->hw_value & CHANNEL_2GHZ) {
+                pcinfo = ee->ee_pwr_cal_g;
+                mode = AR5K_EEPROM_MODE_11G;
+        } else {
+                pcinfo = ee->ee_pwr_cal_a;
+                mode = AR5K_EEPROM_MODE_11A;
+        }
+        max = ee->ee_n_piers[mode] - 1;
+
+        /* Frequency is below our calibrated
+         * range. Use the lowest power curve
+         * we have */
+        if (target < pcinfo[0].freq) {
+                idx_l = idx_r = 0;
+                goto done;
+        }
+
+        /* Frequency is above our calibrated
+         * range. Use the highest power curve
+         * we have */
+        if (target > pcinfo[max].freq) {
+                idx_l = idx_r = max;
+                goto done;
+        }
+
+        /* Frequency is inside our calibrated
+         * channel range. Pick the surrounding
+         * calibration piers so that we can
+         * interpolate */
+        for (i = 0; i <= max; i++) {
+
+                /* Frequency matches one of our calibration
+                 * piers, no need to interpolate, just use
+                 * that calibration pier */
+                if (pcinfo[i].freq == target) {
+                        idx_l = idx_r = i;
+                        goto done;
+                }
+
+                /* We found a calibration pier that's above
+                 * frequency, use this pier and the previous
+                 * one to interpolate */
+                if (target < pcinfo[i].freq) {
+                        idx_r = i;
+                        idx_l = idx_r - 1;
+                        goto done;
+                }
+        }
+
+done:
+        *pcinfo_l = &pcinfo[idx_l];
+        *pcinfo_r = &pcinfo[idx_r];
+
+        return;
+}
+
+/*
+ * Get the surrounding per-rate power calibration data
+ * for a given frequency and interpolate between power
+ * values to set max target power supported by hw for
+ * each rate.
+ */
+static void
+ath5k_get_rate_pcal_data(struct ath5k_hw *ah,
+                        struct ieee80211_channel *channel,
+                        struct ath5k_rate_pcal_info *rates)
+{
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        struct ath5k_rate_pcal_info *rpinfo;
+        u8 idx_l, idx_r;
+        u8 mode, max, i;
+        u32 target = channel->center_freq;
+
+        idx_l = 0;
+        idx_r = 0;
+
+        if (!(channel->hw_value & CHANNEL_OFDM)) {
+                rpinfo = ee->ee_rate_tpwr_b;
+                mode = AR5K_EEPROM_MODE_11B;
+        } else if (channel->hw_value & CHANNEL_2GHZ) {
+                rpinfo = ee->ee_rate_tpwr_g;
+                mode = AR5K_EEPROM_MODE_11G;
+        } else {
+                rpinfo = ee->ee_rate_tpwr_a;
+                mode = AR5K_EEPROM_MODE_11A;
+        }
+        max = ee->ee_rate_target_pwr_num[mode] - 1;
+
+        /* Get the surrounding calibration
+         * piers - same as above */
+        if (target < rpinfo[0].freq) {
+                idx_l = idx_r = 0;
+                goto done;
+        }
+
+        if (target > rpinfo[max].freq) {
+                idx_l = idx_r = max;
+                goto done;
+        }
+
+        for (i = 0; i <= max; i++) {
+
+                if (rpinfo[i].freq == target) {
+                        idx_l = idx_r = i;
+                        goto done;
+                }
+
+                if (target < rpinfo[i].freq) {
+                        idx_r = i;
+                        idx_l = idx_r - 1;
+                        goto done;
+                }
+        }
+
+done:
+        /* Now interpolate power value, based on the frequency */
+        rates->freq = target;
+
+        rates->target_power_6to24 =
+                ath5k_get_interpolated_value(target, rpinfo[idx_l].freq,
+                                        rpinfo[idx_r].freq,
+                                        rpinfo[idx_l].target_power_6to24,
+                                        rpinfo[idx_r].target_power_6to24);
+
+        rates->target_power_36 =
+                ath5k_get_interpolated_value(target, rpinfo[idx_l].freq,
+                                        rpinfo[idx_r].freq,
+                                        rpinfo[idx_l].target_power_36,
+                                        rpinfo[idx_r].target_power_36);
+
+        rates->target_power_48 =
+                ath5k_get_interpolated_value(target, rpinfo[idx_l].freq,
+                                        rpinfo[idx_r].freq,
+                                        rpinfo[idx_l].target_power_48,
+                                        rpinfo[idx_r].target_power_48);
+
+        rates->target_power_54 =
+                ath5k_get_interpolated_value(target, rpinfo[idx_l].freq,
+                                        rpinfo[idx_r].freq,
+                                        rpinfo[idx_l].target_power_54,
+                                        rpinfo[idx_r].target_power_54);
+}
+
+/*
+ * Get the max edge power for this channel if
+ * we have such data from EEPROM's Conformance Test
+ * Limits (CTL), and limit max power if needed.
+ *
+ * FIXME: Only works for world regulatory domains
+ */
+static void
+ath5k_get_max_ctl_power(struct ath5k_hw *ah,
+                        struct ieee80211_channel *channel)
+{
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        struct ath5k_edge_power *rep = ee->ee_ctl_pwr;
+        u8 *ctl_val = ee->ee_ctl;
+        s16 max_chan_pwr = ah->ah_txpower.txp_max_pwr / 4;
+        s16 edge_pwr = 0;
+        u8 rep_idx;
+        u8 i, ctl_mode;
+        u8 ctl_idx = 0xFF;
+        u32 target = channel->center_freq;
+
+        /* Find out a CTL for our mode that's not mapped
+         * on a specific reg domain.
+         *
+         * TODO: Map our current reg domain to one of the 3 available
+         * reg domain ids so that we can support more CTLs. */
+        switch (channel->hw_value & CHANNEL_MODES) {
+        case CHANNEL_A:
+                ctl_mode = AR5K_CTL_11A | AR5K_CTL_NO_REGDOMAIN;
+                break;
+        case CHANNEL_G:
+                ctl_mode = AR5K_CTL_11G | AR5K_CTL_NO_REGDOMAIN;
+                break;
+        case CHANNEL_B:
+                ctl_mode = AR5K_CTL_11B | AR5K_CTL_NO_REGDOMAIN;
+                break;
+        case CHANNEL_T:
+                ctl_mode = AR5K_CTL_TURBO | AR5K_CTL_NO_REGDOMAIN;
+                break;
+        case CHANNEL_TG:
+                ctl_mode = AR5K_CTL_TURBOG | AR5K_CTL_NO_REGDOMAIN;
+                break;
+        case CHANNEL_XR:
+                /* Fall through */
+        default:
+                return;
+        }
+
+        for (i = 0; i < ee->ee_ctls; i++) {
+                if (ctl_val[i] == ctl_mode) {
+                        ctl_idx = i;
+                        break;
+                }
+        }
+
+        /* If we have a CTL dataset available grab it and find the
+         * edge power for our frequency */
+        if (ctl_idx == 0xFF)
+                return;
+
+        /* Edge powers are sorted by frequency from lower
+         * to higher. Each CTL corresponds to 8 edge power
+         * measurements. */
+        rep_idx = ctl_idx * AR5K_EEPROM_N_EDGES;
+
+        /* Don't do boundaries check because we
+         * might have more that one bands defined
+         * for this mode */
+
+        /* Get the edge power that's closer to our
+         * frequency */
+        for (i = 0; i < AR5K_EEPROM_N_EDGES; i++) {
+                rep_idx += i;
+                if (target <= rep[rep_idx].freq)
+                        edge_pwr = (s16) rep[rep_idx].edge;
+        }
+
+        if (edge_pwr)
+                ah->ah_txpower.txp_max_pwr = 4*min(edge_pwr, max_chan_pwr);
+}
+
+
+/*
+ * Power to PCDAC table functions
+ */
+
 /*
- * TX power setup
+ * Fill Power to PCDAC table on RF5111
+ *
+ * No further processing is needed for RF5111, the only thing we have to
+ * do is fill the values below and above calibration range since eeprom data
+ * may not cover the entire PCDAC table.
  */
+static void
+ath5k_fill_pwr_to_pcdac_table(struct ath5k_hw *ah, s16* table_min,
+                                                        s16 *table_max)
+{
+        u8      *pcdac_out = ah->ah_txpower.txp_pd_table;
+        u8      *pcdac_tmp = ah->ah_txpower.tmpL[0];
+        u8      pcdac_0, pcdac_n, pcdac_i, pwr_idx, i;
+        s16     min_pwr, max_pwr;
+
+        /* Get table boundaries */
+        min_pwr = table_min[0];
+        pcdac_0 = pcdac_tmp[0];
+
+        max_pwr = table_max[0];
+        pcdac_n = pcdac_tmp[table_max[0] - table_min[0]];
+
+        /* Extrapolate below minimum using pcdac_0 */
+        pcdac_i = 0;
+        for (i = 0; i < min_pwr; i++)
+                pcdac_out[pcdac_i++] = pcdac_0;
+
+        /* Copy values from pcdac_tmp */
+        pwr_idx = min_pwr;
+        for (i = 0 ; pwr_idx <= max_pwr &&
+        pcdac_i < AR5K_EEPROM_POWER_TABLE_SIZE; i++) {
+                pcdac_out[pcdac_i++] = pcdac_tmp[i];
+                pwr_idx++;
+        }
+
+        /* Extrapolate above maximum */
+        while (pcdac_i < AR5K_EEPROM_POWER_TABLE_SIZE)
+                pcdac_out[pcdac_i++] = pcdac_n;
+
+}
 
 /*
- * Initialize the tx power table (not fully implemented)
+ * Combine available XPD Curves and fill Linear Power to PCDAC table
+ * on RF5112
+ *
+ * RFX112 can have up to 2 curves (one for low txpower range and one for
+ * higher txpower range). We need to put them both on pcdac_out and place
+ * them in the correct location. In case we only have one curve available
+ * just fit it on pcdac_out (it's supposed to cover the entire range of
+ * available pwr levels since it's always the higher power curve). Extrapolate
+ * below and above final table if needed.
  */
-static void ath5k_txpower_table(struct ath5k_hw *ah,
-                struct ieee80211_channel *channel, s16 max_power)
+static void
+ath5k_combine_linear_pcdac_curves(struct ath5k_hw *ah, s16* table_min,
+                                                s16 *table_max, u8 pdcurves)
 {
-        unsigned int i, min, max, n;
-        u16 txpower, *rates;
-
-        rates = ah->ah_txpower.txp_rates;
-
-        txpower = AR5K_TUNE_DEFAULT_TXPOWER * 2;
-        if (max_power > txpower)
-                txpower = max_power > AR5K_TUNE_MAX_TXPOWER ?
-                    AR5K_TUNE_MAX_TXPOWER : max_power;
-
-        for (i = 0; i < AR5K_MAX_RATES; i++)
-                rates[i] = txpower;
-
-        /* XXX setup target powers by rate */
-
-        ah->ah_txpower.txp_min = rates[7];
-        ah->ah_txpower.txp_max = rates[0];
-        ah->ah_txpower.txp_ofdm = rates[0];
-
-        /* Calculate the power table */
-        n = ARRAY_SIZE(ah->ah_txpower.txp_pcdac);
-        min = AR5K_EEPROM_PCDAC_START;
-        max = AR5K_EEPROM_PCDAC_STOP;
-        for (i = 0; i < n; i += AR5K_EEPROM_PCDAC_STEP)
-                ah->ah_txpower.txp_pcdac[i] =
-#ifdef notyet
-                min + ((i * (max - min)) / n);
-#else
-                min;
+        u8      *pcdac_out = ah->ah_txpower.txp_pd_table;
+        u8      *pcdac_low_pwr;
+        u8      *pcdac_high_pwr;
+        u8      *pcdac_tmp;
+        u8      pwr;
+        s16     max_pwr_idx;
+        s16     min_pwr_idx;
+        s16     mid_pwr_idx = 0;
+        /* Edge flag turs on the 7nth bit on the PCDAC
+         * to delcare the higher power curve (force values
+         * to be greater than 64). If we only have one curve
+         * we don't need to set this, if we have 2 curves and
+         * fill the table backwards this can also be used to
+         * switch from higher power curve to lower power curve */
+        u8      edge_flag;
+        int     i;
+
+        /* When we have only one curve available
+         * that's the higher power curve. If we have
+         * two curves the first is the high power curve
+         * and the next is the low power curve. */
+        if (pdcurves > 1) {
+                pcdac_low_pwr = ah->ah_txpower.tmpL[1];
+                pcdac_high_pwr = ah->ah_txpower.tmpL[0];
+                mid_pwr_idx = table_max[1] - table_min[1] - 1;
+                max_pwr_idx = (table_max[0] - table_min[0]) / 2;
+
+                /* If table size goes beyond 31.5dB, keep the
+                 * upper 31.5dB range when setting tx power.
+                 * Note: 126 = 31.5 dB in quarter dB steps */
+                if (table_max[0] - table_min[1] > 126)
+                        min_pwr_idx = table_max[0] - 126;
+                else
+                        min_pwr_idx = table_min[1];
+
+                /* Since we fill table backwards
+                 * start from high power curve */
+                pcdac_tmp = pcdac_high_pwr;
+
+                edge_flag = 0x40;
+#if 0
+                /* If both min and max power limits are in lower
+                 * power curve's range, only use the low power curve.
+                 * TODO: min/max levels are related to target
+                 * power values requested from driver/user
+                 * XXX: Is this really needed ? */
+                if (min_pwr < table_max[1] &&
+                max_pwr < table_max[1]) {
+                        edge_flag = 0;
+                        pcdac_tmp = pcdac_low_pwr;
+                        max_pwr_idx = (table_max[1] - table_min[1])/2;
+                }
 #endif
+        } else {
+                pcdac_low_pwr = ah->ah_txpower.tmpL[1]; /* Zeroed */
+                pcdac_high_pwr = ah->ah_txpower.tmpL[0];
+                min_pwr_idx = table_min[0];
+                max_pwr_idx = (table_max[0] - table_min[0]) / 2;
+                pcdac_tmp = pcdac_high_pwr;
+                edge_flag = 0;
+        }
+
+        /* This is used when setting tx power*/
+        ah->ah_txpower.txp_min_idx = min_pwr_idx/2;
+
+        /* Fill Power to PCDAC table backwards */
+        pwr = max_pwr_idx;
+        for (i = 63; i >= 0; i--) {
+                /* Entering lower power range, reset
+                 * edge flag and set pcdac_tmp to lower
+                 * power curve.*/
+                if (edge_flag == 0x40 &&
+                (2*pwr <= (table_max[1] - table_min[0]) || pwr == 0)) {
+                        edge_flag = 0x00;
+                        pcdac_tmp = pcdac_low_pwr;
+                        pwr = mid_pwr_idx/2;
+                }
+
+                /* Don't go below 1, extrapolate below if we have
+                 * already swithced to the lower power curve -or
+                 * we only have one curve and edge_flag is zero
+                 * anyway */
+                if (pcdac_tmp[pwr] < 1 && (edge_flag == 0x00)) {
+                        while (i >= 0) {
+                                pcdac_out[i] = pcdac_out[i + 1];
+                                i--;
+                        }
+                        break;
+                }
+
+                pcdac_out[i] = pcdac_tmp[pwr] | edge_flag;
+
+                /* Extrapolate above if pcdac is greater than
+                 * 126 -this can happen because we OR pcdac_out
+                 * value with edge_flag on high power curve */
+                if (pcdac_out[i] > 126)
+                        pcdac_out[i] = 126;
+
+                /* Decrease by a 0.5dB step */
+                pwr--;
+        }
 }
 
+/* Write PCDAC values on hw */
+static void
+ath5k_setup_pcdac_table(struct ath5k_hw *ah)
+{
+        u8      *pcdac_out = ah->ah_txpower.txp_pd_table;
+        int     i;
+
+        /*
+         * Write TX power values
+         */
+        for (i = 0; i < (AR5K_EEPROM_POWER_TABLE_SIZE / 2); i++) {
+                ath5k_hw_reg_write(ah,
+                        (((pcdac_out[2*i + 0] << 8 | 0xff) & 0xffff) << 0) |
+                        (((pcdac_out[2*i + 1] << 8 | 0xff) & 0xffff) << 16),
+                        AR5K_PHY_PCDAC_TXPOWER(i));
+        }
+}
+
+
 /*
- * Set transmition power
+ * Power to PDADC table functions
  */
-int /*O.K. - txpower_table is unimplemented so this doesn't work*/
-ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
-                unsigned int txpower)
+
+/*
+ * Set the gain boundaries and create final Power to PDADC table
+ *
+ * We can have up to 4 pd curves, we need to do a simmilar process
+ * as we do for RF5112. This time we don't have an edge_flag but we
+ * set the gain boundaries on a separate register.
+ */
+static void
+ath5k_combine_pwr_to_pdadc_curves(struct ath5k_hw *ah,
+                        s16 *pwr_min, s16 *pwr_max, u8 pdcurves)
 {
-        bool tpc = ah->ah_txpower.txp_tpc;
-        unsigned int i;
+        u8 gain_boundaries[AR5K_EEPROM_N_PD_GAINS];
+        u8 *pdadc_out = ah->ah_txpower.txp_pd_table;
+        u8 *pdadc_tmp;
+        s16 pdadc_0;
+        u8 pdadc_i, pdadc_n, pwr_step, pdg, max_idx, table_size;
+        u8 pd_gain_overlap;
+
+        /* Note: Register value is initialized on initvals
+         * there is no feedback from hw.
+         * XXX: What about pd_gain_overlap from EEPROM ? */
+        pd_gain_overlap = (u8) ath5k_hw_reg_read(ah, AR5K_PHY_TPC_RG5) &
+                AR5K_PHY_TPC_RG5_PD_GAIN_OVERLAP;
+
+        /* Create final PDADC table */
+        for (pdg = 0, pdadc_i = 0; pdg < pdcurves; pdg++) {
+                pdadc_tmp = ah->ah_txpower.tmpL[pdg];
+
+                if (pdg == pdcurves - 1)
+                        /* 2 dB boundary stretch for last
+                         * (higher power) curve */
+                        gain_boundaries[pdg] = pwr_max[pdg] + 4;
+                else
+                        /* Set gain boundary in the middle
+                         * between this curve and the next one */
+                        gain_boundaries[pdg] =
+                                (pwr_max[pdg] + pwr_min[pdg + 1]) / 2;
+
+                /* Sanity check in case our 2 db stretch got out of
+                 * range. */
+                if (gain_boundaries[pdg] > AR5K_TUNE_MAX_TXPOWER)
+                        gain_boundaries[pdg] = AR5K_TUNE_MAX_TXPOWER;
+
+                /* For the first curve (lower power)
+                 * start from 0 dB */
+                if (pdg == 0)
+                        pdadc_0 = 0;
+                else
+                        /* For the other curves use the gain overlap */
+                        pdadc_0 = (gain_boundaries[pdg - 1] - pwr_min[pdg]) -
+                                                        pd_gain_overlap;
 
-        ATH5K_TRACE(ah->ah_sc);
-        if (txpower > AR5K_TUNE_MAX_TXPOWER) {
-                ATH5K_ERR(ah->ah_sc, "invalid tx power: %u\n", txpower);
-                return -EINVAL;
+                /* Force each power step to be at least 0.5 dB */
+                if ((pdadc_tmp[1] - pdadc_tmp[0]) > 1)
+                        pwr_step = pdadc_tmp[1] - pdadc_tmp[0];
+                else
+                        pwr_step = 1;
+
+                /* If pdadc_0 is negative, we need to extrapolate
+                 * below this pdgain by a number of pwr_steps */
+                while ((pdadc_0 < 0) && (pdadc_i < 128)) {
+                        s16 tmp = pdadc_tmp[0] + pdadc_0 * pwr_step;
+                        pdadc_out[pdadc_i++] = (tmp < 0) ? 0 : (u8) tmp;
+                        pdadc_0++;
+                }
+
+                /* Set last pwr level, using gain boundaries */
+                pdadc_n = gain_boundaries[pdg] + pd_gain_overlap - pwr_min[pdg];
+                /* Limit it to be inside pwr range */
+                table_size = pwr_max[pdg] - pwr_min[pdg];
+                max_idx = (pdadc_n < table_size) ? pdadc_n : table_size;
+
+                /* Fill pdadc_out table */
+                while (pdadc_0 < max_idx)
+                        pdadc_out[pdadc_i++] = pdadc_tmp[pdadc_0++];
+
+                /* Need to extrapolate above this pdgain? */
+                if (pdadc_n <= max_idx)
+                        continue;
+
+                /* Force each power step to be at least 0.5 dB */
+                if ((pdadc_tmp[table_size - 1] - pdadc_tmp[table_size - 2]) > 1)
+                        pwr_step = pdadc_tmp[table_size - 1] -
+                                                pdadc_tmp[table_size - 2];
+                else
+                        pwr_step = 1;
+
+                /* Extrapolate above */
+                while ((pdadc_0 < (s16) pdadc_n) &&
+                (pdadc_i < AR5K_EEPROM_POWER_TABLE_SIZE * 2)) {
+                        s16 tmp = pdadc_tmp[table_size - 1] +
+                                        (pdadc_0 - max_idx) * pwr_step;
+                        pdadc_out[pdadc_i++] = (tmp > 127) ? 127 : (u8) tmp;
+                        pdadc_0++;
+                }
         }
 
+        while (pdg < AR5K_EEPROM_N_PD_GAINS) {
+                gain_boundaries[pdg] = gain_boundaries[pdg - 1];
+                pdg++;
+        }
+
+        while (pdadc_i < AR5K_EEPROM_POWER_TABLE_SIZE * 2) {
+                pdadc_out[pdadc_i] = pdadc_out[pdadc_i - 1];
+                pdadc_i++;
+        }
+
+        /* Set gain boundaries */
+        ath5k_hw_reg_write(ah,
+                AR5K_REG_SM(pd_gain_overlap,
+                        AR5K_PHY_TPC_RG5_PD_GAIN_OVERLAP) |
+                AR5K_REG_SM(gain_boundaries[0],
+                        AR5K_PHY_TPC_RG5_PD_GAIN_BOUNDARY_1) |
+                AR5K_REG_SM(gain_boundaries[1],
+                        AR5K_PHY_TPC_RG5_PD_GAIN_BOUNDARY_2) |
+                AR5K_REG_SM(gain_boundaries[2],
+                        AR5K_PHY_TPC_RG5_PD_GAIN_BOUNDARY_3) |
+                AR5K_REG_SM(gain_boundaries[3],
+                        AR5K_PHY_TPC_RG5_PD_GAIN_BOUNDARY_4),
+                AR5K_PHY_TPC_RG5);
+
+        /* Used for setting rate power table */
+        ah->ah_txpower.txp_min_idx = pwr_min[0];
+
+}
+
+/* Write PDADC values on hw */
+static void
+ath5k_setup_pwr_to_pdadc_table(struct ath5k_hw *ah,
+                        u8 pdcurves, u8 *pdg_to_idx)
+{
+        u8 *pdadc_out = ah->ah_txpower.txp_pd_table;
+        u32 reg;
+        u8 i;
+
+        /* Select the right pdgain curves */
+
+        /* Clear current settings */
+        reg = ath5k_hw_reg_read(ah, AR5K_PHY_TPC_RG1);
+        reg &= ~(AR5K_PHY_TPC_RG1_PDGAIN_1 |
+                AR5K_PHY_TPC_RG1_PDGAIN_2 |
+                AR5K_PHY_TPC_RG1_PDGAIN_3 |
+                AR5K_PHY_TPC_RG1_NUM_PD_GAIN);
+
         /*
-         * RF2413 for some reason can't
-         * transmit anything if we call
-         * this funtion, so we skip it
-         * until we fix txpower.
+         * Use pd_gains curve from eeprom
          *
-         * XXX: Assume same for RF2425
-         * to be safe.
+         * This overrides the default setting from initvals
+         * in case some vendors (e.g. Zcomax) don't use the default
+         * curves. If we don't honor their settings we 'll get a
+         * 5dB (1 * gain overlap ?) drop.
          */
-        if ((ah->ah_radio == AR5K_RF2413) || (ah->ah_radio == AR5K_RF2425))
-                return 0;
+        reg |= AR5K_REG_SM(pdcurves, AR5K_PHY_TPC_RG1_NUM_PD_GAIN);
 
-        /* Reset TX power values */
-        memset(&ah->ah_txpower, 0, sizeof(ah->ah_txpower));
-        ah->ah_txpower.txp_tpc = tpc;
-
-        /* Initialize TX power table */
-        ath5k_txpower_table(ah, channel, txpower);
+        switch (pdcurves) {
+        case 3:
+                reg |= AR5K_REG_SM(pdg_to_idx[2], AR5K_PHY_TPC_RG1_PDGAIN_3);
+                /* Fall through */
+        case 2:
+                reg |= AR5K_REG_SM(pdg_to_idx[1], AR5K_PHY_TPC_RG1_PDGAIN_2);
+                /* Fall through */
+        case 1:
+                reg |= AR5K_REG_SM(pdg_to_idx[0], AR5K_PHY_TPC_RG1_PDGAIN_1);
+                break;
+        }
+        ath5k_hw_reg_write(ah, reg, AR5K_PHY_TPC_RG1);
 
         /*
          * Write TX power values
          */
         for (i = 0; i < (AR5K_EEPROM_POWER_TABLE_SIZE / 2); i++) {
                 ath5k_hw_reg_write(ah,
-                        ((((ah->ah_txpower.txp_pcdac[(i << 1) + 1] << 8) | 0xff) & 0xffff) << 16) |
-                        (((ah->ah_txpower.txp_pcdac[(i << 1)    ] << 8) | 0xff) & 0xffff),
-                        AR5K_PHY_PCDAC_TXPOWER(i));
+                        ((pdadc_out[4*i + 0] & 0xff) << 0) |
+                        ((pdadc_out[4*i + 1] & 0xff) << 8) |
+                        ((pdadc_out[4*i + 2] & 0xff) << 16) |
+                        ((pdadc_out[4*i + 3] & 0xff) << 24),
+                        AR5K_PHY_PDADC_TXPOWER(i));
+        }
+}
+
+
+/*
+ * Common code for PCDAC/PDADC tables
+ */
+
+/*
+ * This is the main function that uses all of the above
+ * to set PCDAC/PDADC table on hw for the current channel.
+ * This table is used for tx power calibration on the basband,
+ * without it we get weird tx power levels and in some cases
+ * distorted spectral mask
+ */
+static int
+ath5k_setup_channel_powertable(struct ath5k_hw *ah,
+                        struct ieee80211_channel *channel,
+                        u8 ee_mode, u8 type)
+{
+        struct ath5k_pdgain_info *pdg_L, *pdg_R;
+        struct ath5k_chan_pcal_info *pcinfo_L;
+        struct ath5k_chan_pcal_info *pcinfo_R;
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        u8 *pdg_curve_to_idx = ee->ee_pdc_to_idx[ee_mode];
+        s16 table_min[AR5K_EEPROM_N_PD_GAINS];
+        s16 table_max[AR5K_EEPROM_N_PD_GAINS];
+        u8 *tmpL;
+        u8 *tmpR;
+        u32 target = channel->center_freq;
+        int pdg, i;
+
+        /* Get surounding freq piers for this channel */
+        ath5k_get_chan_pcal_surrounding_piers(ah, channel,
+                                                &pcinfo_L,
+                                                &pcinfo_R);
+
+        /* Loop over pd gain curves on
+         * surounding freq piers by index */
+        for (pdg = 0; pdg < ee->ee_pd_gains[ee_mode]; pdg++) {
+
+                /* Fill curves in reverse order
+                 * from lower power (max gain)
+                 * to higher power. Use curve -> idx
+                 * backmaping we did on eeprom init */
+                u8 idx = pdg_curve_to_idx[pdg];
+
+                /* Grab the needed curves by index */
+                pdg_L = &pcinfo_L->pd_curves[idx];
+                pdg_R = &pcinfo_R->pd_curves[idx];
+
+                /* Initialize the temp tables */
+                tmpL = ah->ah_txpower.tmpL[pdg];
+                tmpR = ah->ah_txpower.tmpR[pdg];
+
+                /* Set curve's x boundaries and create
+                 * curves so that they cover the same
+                 * range (if we don't do that one table
+                 * will have values on some range and the
+                 * other one won't have any so interpolation
+                 * will fail) */
+                table_min[pdg] = min(pdg_L->pd_pwr[0],
+                                        pdg_R->pd_pwr[0]) / 2;
+
+                table_max[pdg] = max(pdg_L->pd_pwr[pdg_L->pd_points - 1],
+                                pdg_R->pd_pwr[pdg_R->pd_points - 1]) / 2;
+
+                /* Now create the curves on surrounding channels
+                 * and interpolate if needed to get the final
+                 * curve for this gain on this channel */
+                switch (type) {
+                case AR5K_PWRTABLE_LINEAR_PCDAC:
+                        /* Override min/max so that we don't loose
+                         * accuracy (don't divide by 2) */
+                        table_min[pdg] = min(pdg_L->pd_pwr[0],
+                                                pdg_R->pd_pwr[0]);
+
+                        table_max[pdg] =
+                                max(pdg_L->pd_pwr[pdg_L->pd_points - 1],
+                                        pdg_R->pd_pwr[pdg_R->pd_points - 1]);
+
+                        /* Override minimum so that we don't get
+                         * out of bounds while extrapolating
+                         * below. Don't do this when we have 2
+                         * curves and we are on the high power curve
+                         * because table_min is ok in this case */
+                        if (!(ee->ee_pd_gains[ee_mode] > 1 && pdg == 0)) {
+
+                                table_min[pdg] =
+                                        ath5k_get_linear_pcdac_min(pdg_L->pd_step,
+                                                                pdg_R->pd_step,
+                                                                pdg_L->pd_pwr,
+                                                                pdg_R->pd_pwr);
+
+                                /* Don't go too low because we will
+                                 * miss the upper part of the curve.
+                                 * Note: 126 = 31.5dB (max power supported)
+                                 * in 0.25dB units */
+                                if (table_max[pdg] - table_min[pdg] > 126)
+                                        table_min[pdg] = table_max[pdg] - 126;
+                        }
+
+                        /* Fall through */
+                case AR5K_PWRTABLE_PWR_TO_PCDAC:
+                case AR5K_PWRTABLE_PWR_TO_PDADC:
+
+                        ath5k_create_power_curve(table_min[pdg],
+                                                table_max[pdg],
+                                                pdg_L->pd_pwr,
+                                                pdg_L->pd_step,
+                                                pdg_L->pd_points, tmpL, type);
+
+                        /* We are in a calibration
+                         * pier, no need to interpolate
+                         * between freq piers */
+                        if (pcinfo_L == pcinfo_R)
+                                continue;
+
+                        ath5k_create_power_curve(table_min[pdg],
+                                                table_max[pdg],
+                                                pdg_R->pd_pwr,
+                                                pdg_R->pd_step,
+                                                pdg_R->pd_points, tmpR, type);
+                        break;
+                default:
+                        return -EINVAL;
+                }
+
+                /* Interpolate between curves
+                 * of surounding freq piers to
+                 * get the final curve for this
+                 * pd gain. Re-use tmpL for interpolation
+                 * output */
+                for (i = 0; (i < (u16) (table_max[pdg] - table_min[pdg])) &&
+                (i < AR5K_EEPROM_POWER_TABLE_SIZE); i++) {
+                        tmpL[i] = (u8) ath5k_get_interpolated_value(target,
+                                                        (s16) pcinfo_L->freq,
+                                                        (s16) pcinfo_R->freq,
+                                                        (s16) tmpL[i],
+                                                        (s16) tmpR[i]);
+                }
         }
 
+        /* Now we have a set of curves for this
+         * channel on tmpL (x range is table_max - table_min
+         * and y values are tmpL[pdg][]) sorted in the same
+         * order as EEPROM (because we've used the backmaping).
+         * So for RF5112 it's from higher power to lower power
+         * and for RF2413 it's from lower power to higher power.
+         * For RF5111 we only have one curve. */
+
+        /* Fill min and max power levels for this
+         * channel by interpolating the values on
+         * surounding channels to complete the dataset */
+        ah->ah_txpower.txp_min_pwr = ath5k_get_interpolated_value(target,
+                                        (s16) pcinfo_L->freq,
+                                        (s16) pcinfo_R->freq,
+                                        pcinfo_L->min_pwr, pcinfo_R->min_pwr);
+
+        ah->ah_txpower.txp_max_pwr = ath5k_get_interpolated_value(target,
+                                        (s16) pcinfo_L->freq,
+                                        (s16) pcinfo_R->freq,
+                                        pcinfo_L->max_pwr, pcinfo_R->max_pwr);
+
+        /* We are ready to go, fill PCDAC/PDADC
+         * table and write settings on hardware */
+        switch (type) {
+        case AR5K_PWRTABLE_LINEAR_PCDAC:
+                /* For RF5112 we can have one or two curves
+                 * and each curve covers a certain power lvl
+                 * range so we need to do some more processing */
+                ath5k_combine_linear_pcdac_curves(ah, table_min, table_max,
+                                                ee->ee_pd_gains[ee_mode]);
+
+                /* Set txp.offset so that we can
+                 * match max power value with max
+                 * table index */
+                ah->ah_txpower.txp_offset = 64 - (table_max[0] / 2);
+
+                /* Write settings on hw */
+                ath5k_setup_pcdac_table(ah);
+                break;
+        case AR5K_PWRTABLE_PWR_TO_PCDAC:
+                /* We are done for RF5111 since it has only
+                 * one curve, just fit the curve on the table */
+                ath5k_fill_pwr_to_pcdac_table(ah, table_min, table_max);
+
+                /* No rate powertable adjustment for RF5111 */
+                ah->ah_txpower.txp_min_idx = 0;
+                ah->ah_txpower.txp_offset = 0;
+
+                /* Write settings on hw */
+                ath5k_setup_pcdac_table(ah);
+                break;
+        case AR5K_PWRTABLE_PWR_TO_PDADC:
+                /* Set PDADC boundaries and fill
+                 * final PDADC table */
+                ath5k_combine_pwr_to_pdadc_curves(ah, table_min, table_max,
+                                                ee->ee_pd_gains[ee_mode]);
+
+                /* Write settings on hw */
+                ath5k_setup_pwr_to_pdadc_table(ah, pdg, pdg_curve_to_idx);
+
+                /* Set txp.offset, note that table_min
+                 * can be negative */
+                ah->ah_txpower.txp_offset = table_min[0];
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+
+/*
+ * Per-rate tx power setting
+ *
+ * This is the code that sets the desired tx power (below
+ * maximum) on hw for each rate (we also have TPC that sets
+ * power per packet). We do that by providing an index on the
+ * PCDAC/PDADC table we set up.
+ */
+
+/*
+ * Set rate power table
+ *
+ * For now we only limit txpower based on maximum tx power
+ * supported by hw (what's inside rate_info). We need to limit
+ * this even more, based on regulatory domain etc.
+ *
+ * Rate power table contains indices to PCDAC/PDADC table (0.5dB steps)
+ * and is indexed as follows:
+ * rates[0] - rates[7] -> OFDM rates
+ * rates[8] - rates[14] -> CCK rates
+ * rates[15] -> XR rates (they all have the same power)
+ */
+static void
+ath5k_setup_rate_powertable(struct ath5k_hw *ah, u16 max_pwr,
+                        struct ath5k_rate_pcal_info *rate_info,
+                        u8 ee_mode)
+{
+        unsigned int i;
+        u16 *rates;
+
+        /* max_pwr is power level we got from driver/user in 0.5dB
+         * units, switch to 0.25dB units so we can compare */
+        max_pwr *= 2;
+        max_pwr = min(max_pwr, (u16) ah->ah_txpower.txp_max_pwr) / 2;
+
+        /* apply rate limits */
+        rates = ah->ah_txpower.txp_rates_power_table;
+
+        /* OFDM rates 6 to 24Mb/s */
+        for (i = 0; i < 5; i++)
+                rates[i] = min(max_pwr, rate_info->target_power_6to24);
+
+        /* Rest OFDM rates */
+        rates[5] = min(rates[0], rate_info->target_power_36);
+        rates[6] = min(rates[0], rate_info->target_power_48);
+        rates[7] = min(rates[0], rate_info->target_power_54);
+
+        /* CCK rates */
+        /* 1L */
+        rates[8] = min(rates[0], rate_info->target_power_6to24);
+        /* 2L */
+        rates[9] = min(rates[0], rate_info->target_power_36);
+        /* 2S */
+        rates[10] = min(rates[0], rate_info->target_power_36);
+        /* 5L */
+        rates[11] = min(rates[0], rate_info->target_power_48);
+        /* 5S */
+        rates[12] = min(rates[0], rate_info->target_power_48);
+        /* 11L */
+        rates[13] = min(rates[0], rate_info->target_power_54);
+        /* 11S */
+        rates[14] = min(rates[0], rate_info->target_power_54);
+
+        /* XR rates */
+        rates[15] = min(rates[0], rate_info->target_power_6to24);
+
+        /* CCK rates have different peak to average ratio
+         * so we have to tweak their power so that gainf
+         * correction works ok. For this we use OFDM to
+         * CCK delta from eeprom */
+        if ((ee_mode == AR5K_EEPROM_MODE_11G) &&
+        (ah->ah_phy_revision < AR5K_SREV_PHY_5212A))
+                for (i = 8; i <= 15; i++)
+                        rates[i] -= ah->ah_txpower.txp_cck_ofdm_gainf_delta;
+
+        ah->ah_txpower.txp_min_pwr = rates[7];
+        ah->ah_txpower.txp_max_pwr = rates[0];
+        ah->ah_txpower.txp_ofdm = rates[7];
+}
+
+
+/*
+ * Set transmition power
+ */
+int
+ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
+                u8 ee_mode, u8 txpower)
+{
+        struct ath5k_rate_pcal_info rate_info;
+        u8 type;
+        int ret;
+
+        ATH5K_TRACE(ah->ah_sc);
+        if (txpower > AR5K_TUNE_MAX_TXPOWER) {
+                ATH5K_ERR(ah->ah_sc, "invalid tx power: %u\n", txpower);
+                return -EINVAL;
+        }
+        if (txpower == 0)
+                txpower = AR5K_TUNE_DEFAULT_TXPOWER;
+
+        /* Reset TX power values */
+        memset(&ah->ah_txpower, 0, sizeof(ah->ah_txpower));
+        ah->ah_txpower.txp_tpc = AR5K_TUNE_TPC_TXPOWER;
+        ah->ah_txpower.txp_min_pwr = 0;
+        ah->ah_txpower.txp_max_pwr = AR5K_TUNE_MAX_TXPOWER;
+
+        /* Initialize TX power table */
+        switch (ah->ah_radio) {
+        case AR5K_RF5111:
+                type = AR5K_PWRTABLE_PWR_TO_PCDAC;
+                break;
+        case AR5K_RF5112:
+                type = AR5K_PWRTABLE_LINEAR_PCDAC;
+                break;
+        case AR5K_RF2413:
+        case AR5K_RF5413:
+        case AR5K_RF2316:
+        case AR5K_RF2317:
+        case AR5K_RF2425:
+                type = AR5K_PWRTABLE_PWR_TO_PDADC;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        /* FIXME: Only on channel/mode change */
+        ret = ath5k_setup_channel_powertable(ah, channel, ee_mode, type);
+        if (ret)
+                return ret;
+
+        /* Limit max power if we have a CTL available */
+        ath5k_get_max_ctl_power(ah, channel);
+
+        /* FIXME: Tx power limit for this regdomain
+         * XXX: Mac80211/CRDA will do that anyway ? */
+
+        /* FIXME: Antenna reduction stuff */
+
+        /* FIXME: Limit power on turbo modes */
+
+        /* FIXME: TPC scale reduction */
+
+        /* Get surounding channels for per-rate power table
+         * calibration */
+        ath5k_get_rate_pcal_data(ah, channel, &rate_info);
+
+        /* Setup rate power table */
+        ath5k_setup_rate_powertable(ah, txpower, &rate_info, ee_mode);
+
+        /* Write rate power table on hw */
         ath5k_hw_reg_write(ah, AR5K_TXPOWER_OFDM(3, 24) |
                 AR5K_TXPOWER_OFDM(2, 16) | AR5K_TXPOWER_OFDM(1, 8) |
                 AR5K_TXPOWER_OFDM(0, 0), AR5K_PHY_TXPOWER_RATE1);
@@ -1536,26 +2566,34 @@ ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                 AR5K_TXPOWER_CCK(13, 16) | AR5K_TXPOWER_CCK(12, 8) |
                 AR5K_TXPOWER_CCK(11, 0), AR5K_PHY_TXPOWER_RATE4);
 
-        if (ah->ah_txpower.txp_tpc)
+        /* FIXME: TPC support */
+        if (ah->ah_txpower.txp_tpc) {
                 ath5k_hw_reg_write(ah, AR5K_PHY_TXPOWER_RATE_MAX_TPC_ENABLE |
                         AR5K_TUNE_MAX_TXPOWER, AR5K_PHY_TXPOWER_RATE_MAX);
-        else
+
+                ath5k_hw_reg_write(ah,
+                        AR5K_REG_MS(AR5K_TUNE_MAX_TXPOWER, AR5K_TPC_ACK) |
+                        AR5K_REG_MS(AR5K_TUNE_MAX_TXPOWER, AR5K_TPC_CTS) |
+                        AR5K_REG_MS(AR5K_TUNE_MAX_TXPOWER, AR5K_TPC_CHIRP),
+                        AR5K_TPC);
+        } else {
                 ath5k_hw_reg_write(ah, AR5K_PHY_TXPOWER_RATE_MAX |
                         AR5K_TUNE_MAX_TXPOWER, AR5K_PHY_TXPOWER_RATE_MAX);
+        }
 
         return 0;
 }
 
-int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, unsigned int power)
+int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, u8 mode, u8 txpower)
 {
         /*Just a try M.F.*/
         struct ieee80211_channel *channel = &ah->ah_current_channel;
 
         ATH5K_TRACE(ah->ah_sc);
         ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_TXPOWER,
-                "changing txpower to %d\n", power);
+                "changing txpower to %d\n", txpower);
 
-        return ath5k_hw_txpower(ah, channel, power);
+        return ath5k_hw_txpower(ah, channel, mode, txpower);
 }
 
 #undef _ATH5K_PHY
diff --git a/drivers/net/wireless/ath5k/reg.h b/drivers/net/wireless/ath5k/reg.h
index 2dc008e10226..7070d1543cdc 100644
--- a/drivers/net/wireless/ath5k/reg.h
+++ b/drivers/net/wireless/ath5k/reg.h
@@ -1554,6 +1554,19 @@
 /*===5212 Specific PCU registers===*/
 
 /*
+ * Transmit power control register
+ */
+#define AR5K_TPC                        0x80e8
+#define AR5K_TPC_ACK                    0x0000003f      /* ack frames */
+#define AR5K_TPC_ACK_S                  0
+#define AR5K_TPC_CTS                    0x00003f00      /* cts frames */
+#define AR5K_TPC_CTS_S                  8
+#define AR5K_TPC_CHIRP                  0x003f0000      /* chirp frames */
+#define AR5K_TPC_CHIRP_S                16
+#define AR5K_TPC_DOPPLER                0x0f000000      /* doppler chirp span */
+#define AR5K_TPC_DOPPLER_S              24
+
+/*
  * XR (eXtended Range) mode register
  */
 #define AR5K_XRMODE                     0x80c0                  /* Register Address */
@@ -2550,6 +2563,12 @@
 #define AR5K_PHY_TPC_RG1                0xa258
 #define AR5K_PHY_TPC_RG1_NUM_PD_GAIN    0x0000c000
 #define AR5K_PHY_TPC_RG1_NUM_PD_GAIN_S  14
+#define AR5K_PHY_TPC_RG1_PDGAIN_1       0x00030000
+#define AR5K_PHY_TPC_RG1_PDGAIN_1_S     16
+#define AR5K_PHY_TPC_RG1_PDGAIN_2       0x000c0000
+#define AR5K_PHY_TPC_RG1_PDGAIN_2_S     18
+#define AR5K_PHY_TPC_RG1_PDGAIN_3       0x00300000
+#define AR5K_PHY_TPC_RG1_PDGAIN_3_S     20
 
 #define AR5K_PHY_TPC_RG5                        0xa26C
 #define AR5K_PHY_TPC_RG5_PD_GAIN_OVERLAP        0x0000000F
diff --git a/drivers/net/wireless/ath5k/reset.c b/drivers/net/wireless/ath5k/reset.c
index 685dc213edae..7a17d31b2fd9 100644
--- a/drivers/net/wireless/ath5k/reset.c
+++ b/drivers/net/wireless/ath5k/reset.c
@@ -664,29 +664,35 @@ static void ath5k_hw_commit_eeprom_settings(struct ath5k_hw *ah,
                 struct ieee80211_channel *channel, u8 *ant, u8 ee_mode)
 {
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        s16 cck_ofdm_pwr_delta;
 
-        /* Set CCK to OFDM power delta */
-        if (ah->ah_phy_revision >= AR5K_SREV_PHY_5212A) {
-                int16_t cck_ofdm_pwr_delta;
-
-                /* Adjust power delta for channel 14 */
-                if (channel->center_freq == 2484)
-                        cck_ofdm_pwr_delta =
-                                ((ee->ee_cck_ofdm_power_delta -
-                                ee->ee_scaled_cck_delta) * 2) / 10;
-                else
-                        cck_ofdm_pwr_delta =
-                                (ee->ee_cck_ofdm_power_delta * 2) / 10;
+        /* Adjust power delta for channel 14 */
+        if (channel->center_freq == 2484)
+                cck_ofdm_pwr_delta =
+                        ((ee->ee_cck_ofdm_power_delta -
+                        ee->ee_scaled_cck_delta) * 2) / 10;
+        else
+                cck_ofdm_pwr_delta =
+                        (ee->ee_cck_ofdm_power_delta * 2) / 10;
 
+        /* Set CCK to OFDM power delta on tx power
+         * adjustment register */
+        if (ah->ah_phy_revision >= AR5K_SREV_PHY_5212A) {
                 if (channel->hw_value == CHANNEL_G)
                         ath5k_hw_reg_write(ah,
-                        AR5K_REG_SM((ee->ee_cck_ofdm_power_delta * -1),
+                        AR5K_REG_SM((ee->ee_cck_ofdm_gain_delta * -1),
                                 AR5K_PHY_TX_PWR_ADJ_CCK_GAIN_DELTA) |
                         AR5K_REG_SM((cck_ofdm_pwr_delta * -1),
                                 AR5K_PHY_TX_PWR_ADJ_CCK_PCDAC_INDEX),
                                 AR5K_PHY_TX_PWR_ADJ);
                 else
                         ath5k_hw_reg_write(ah, 0, AR5K_PHY_TX_PWR_ADJ);
+        } else {
+                /* For older revs we scale power on sw during tx power
+                 * setup */
+                ah->ah_txpower.txp_cck_ofdm_pwr_delta = cck_ofdm_pwr_delta;
+                ah->ah_txpower.txp_cck_ofdm_gainf_delta =
+                                                ee->ee_cck_ofdm_gain_delta;
         }
 
         /* Set antenna idle switch table */
@@ -994,7 +1000,8 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                 /*
                  * Set TX power (FIXME)
                  */
-                ret = ath5k_hw_txpower(ah, channel, AR5K_TUNE_DEFAULT_TXPOWER);
+                ret = ath5k_hw_txpower(ah, channel, ee_mode,
+                                        AR5K_TUNE_DEFAULT_TXPOWER);
                 if (ret)
                         return ret;
 
diff --git a/drivers/net/wireless/ath9k/ahb.c b/drivers/net/wireless/ath9k/ahb.c
index 00cc7bb01f2e..0e65c51ba176 100644
--- a/drivers/net/wireless/ath9k/ahb.c
+++ b/drivers/net/wireless/ath9k/ahb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  * Copyright (c) 2009 Gabor Juhos <juhosg@openwrt.org>
  * Copyright (c) 2009 Imre Kaloz <kaloz@openwrt.org>
  *
diff --git a/drivers/net/wireless/ath9k/ani.c b/drivers/net/wireless/ath9k/ani.c
index a39eb760cbb7..6c5e887d50d7 100644
--- a/drivers/net/wireless/ath9k/ani.c
+++ b/drivers/net/wireless/ath9k/ani.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/ani.h b/drivers/net/wireless/ath9k/ani.h
index 7315761f6d74..08b4e7ed5ff0 100644
--- a/drivers/net/wireless/ath9k/ani.h
+++ b/drivers/net/wireless/ath9k/ani.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/ath9k.h b/drivers/net/wireless/ath9k/ath9k.h
index b64be8e9a690..2689a08a2844 100644
--- a/drivers/net/wireless/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath9k/ath9k.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -295,13 +295,9 @@ struct ath_tx_control {
         enum ath9k_internal_frame_type frame_type;
 };
 
-struct ath_xmit_status {
-        int retries;
-        int flags;
 #define ATH_TX_ERROR        0x01
 #define ATH_TX_XRETRY       0x02
 #define ATH_TX_BAR          0x04
-};
 
 /* All RSSI values are noise floor adjusted */
 struct ath_tx_stat {
@@ -390,6 +386,7 @@ void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid
 
 struct ath_vif {
         int av_bslot;
+        __le64 tsf_adjust; /* TSF adjustment for staggered beacons */
         enum nl80211_iftype av_opmode;
         struct ath_buf *av_bcbuf;
         struct ath_tx_control av_btxctl;
@@ -406,7 +403,7 @@ struct ath_vif {
  * number of beacon intervals, the game's up.
  */
 #define BSTUCK_THRESH                   (9 * ATH_BCBUF)
-#define ATH_BCBUF                       1
+#define ATH_BCBUF                       4
 #define ATH_DEFAULT_BINTVAL             100 /* TU */
 #define ATH_DEFAULT_BMISS_LIMIT         10
 #define IEEE80211_MS_TO_TU(x)           (((x) * 1000) / 1024)
diff --git a/drivers/net/wireless/ath9k/beacon.c b/drivers/net/wireless/ath9k/beacon.c
index 039c78136c50..ec995730632d 100644
--- a/drivers/net/wireless/ath9k/beacon.c
+++ b/drivers/net/wireless/ath9k/beacon.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -70,7 +70,8 @@ static void ath_beacon_setup(struct ath_softc *sc, struct ath_vif *avp,
         ds = bf->bf_desc;
         flags = ATH9K_TXDESC_NOACK;
 
-        if (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC &&
+        if (((sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC) ||
+             (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT)) &&
             (ah->caps.hw_caps & ATH9K_HW_CAP_VEOL)) {
                 ds->ds_link = bf->bf_daddr; /* self-linked */
                 flags |= ATH9K_TXDESC_VEOL;
@@ -153,6 +154,8 @@ static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw,
         bf->bf_mpdu = skb;
         if (skb == NULL)
                 return NULL;
+        ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp =
+                avp->tsf_adjust;
 
         info = IEEE80211_SKB_CB(skb);
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
@@ -253,7 +256,6 @@ int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
 {
         struct ath_softc *sc = aphy->sc;
         struct ath_vif *avp;
-        struct ieee80211_hdr *hdr;
         struct ath_buf *bf;
         struct sk_buff *skb;
         __le64 tstamp;
@@ -316,42 +318,33 @@ int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
 
         tstamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
         sc->beacon.bc_tstamp = le64_to_cpu(tstamp);
-
-        /*
-         * Calculate a TSF adjustment factor required for
-         * staggered beacons.  Note that we assume the format
-         * of the beacon frame leaves the tstamp field immediately
-         * following the header.
-         */
+        /* Calculate a TSF adjustment factor required for staggered beacons. */
         if (avp->av_bslot > 0) {
                 u64 tsfadjust;
-                __le64 val;
                 int intval;
 
                 intval = sc->hw->conf.beacon_int ?
                         sc->hw->conf.beacon_int : ATH_DEFAULT_BINTVAL;
 
                 /*
-                 * The beacon interval is in TU's; the TSF in usecs.
-                 * We figure out how many TU's to add to align the
-                 * timestamp then convert to TSF units and handle
-                 * byte swapping before writing it in the frame.
-                 * The hardware will then add this each time a beacon
-                 * frame is sent.  Note that we align vif's 1..N
-                 * and leave vif 0 untouched.  This means vap 0
-                 * has a timestamp in one beacon interval while the
-                 * others get a timestamp aligned to the next interval.
+                 * Calculate the TSF offset for this beacon slot, i.e., the
+                 * number of usecs that need to be added to the timestamp field
+                 * in Beacon and Probe Response frames. Beacon slot 0 is
+                 * processed at the correct offset, so it does not require TSF
+                 * adjustment. Other slots are adjusted to get the timestamp
+                 * close to the TBTT for the BSS.
                  */
-                tsfadjust = (intval * (ATH_BCBUF - avp->av_bslot)) / ATH_BCBUF;
-                val = cpu_to_le64(tsfadjust << 10);     /* TU->TSF */
+                tsfadjust = intval * avp->av_bslot / ATH_BCBUF;
+                avp->tsf_adjust = cpu_to_le64(TU_TO_USEC(tsfadjust));
 
                 DPRINTF(sc, ATH_DBG_BEACON,
                         "stagger beacons, bslot %d intval %u tsfadjust %llu\n",
                         avp->av_bslot, intval, (unsigned long long)tsfadjust);
 
-                hdr = (struct ieee80211_hdr *)skb->data;
-                memcpy(&hdr[1], &val, sizeof(val));
-        }
+                ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp =
+                        avp->tsf_adjust;
+        } else
+                avp->tsf_adjust = cpu_to_le64(0);
 
         bf->bf_mpdu = skb;
         bf->bf_buf_addr = bf->bf_dmacontext =
@@ -447,8 +440,16 @@ void ath_beacon_tasklet(unsigned long data)
         tsf = ath9k_hw_gettsf64(ah);
         tsftu = TSF_TO_TU(tsf>>32, tsf);
         slot = ((tsftu % intval) * ATH_BCBUF) / intval;
-        vif = sc->beacon.bslot[(slot + 1) % ATH_BCBUF];
-        aphy = sc->beacon.bslot_aphy[(slot + 1) % ATH_BCBUF];
+        /*
+         * Reverse the slot order to get slot 0 on the TBTT offset that does
+         * not require TSF adjustment and other slots adding
+         * slot/ATH_BCBUF * beacon_int to timestamp. For example, with
+         * ATH_BCBUF = 4, we process beacon slots as follows: 3 2 1 0 3 2 1 ..
+         * and slot 0 is at correct offset to TBTT.
+         */
+        slot = ATH_BCBUF - slot - 1;
+        vif = sc->beacon.bslot[slot];
+        aphy = sc->beacon.bslot_aphy[slot];
 
         DPRINTF(sc, ATH_DBG_BEACON,
                 "slot %d [tsf %llu tsftu %u intval %u] vif %p\n",
@@ -728,6 +729,7 @@ void ath_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif)
                         ath_beacon_config_ap(sc, &conf, avp);
                         break;
                 case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_MESH_POINT:
                         ath_beacon_config_adhoc(sc, &conf, avp, vif);
                         break;
                 case NL80211_IFTYPE_STATION:
diff --git a/drivers/net/wireless/ath9k/calib.c b/drivers/net/wireless/ath9k/calib.c
index c9446fb6b153..e2d62e97131c 100644
--- a/drivers/net/wireless/ath9k/calib.c
+++ b/drivers/net/wireless/ath9k/calib.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/calib.h b/drivers/net/wireless/ath9k/calib.h
index 32589e0c5018..1c74bd50700d 100644
--- a/drivers/net/wireless/ath9k/calib.h
+++ b/drivers/net/wireless/ath9k/calib.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/debug.c b/drivers/net/wireless/ath9k/debug.c
index 82573cadb1ab..fdf9528fa49b 100644
--- a/drivers/net/wireless/ath9k/debug.c
+++ b/drivers/net/wireless/ath9k/debug.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/debug.h b/drivers/net/wireless/ath9k/debug.h
index 065268b8568f..7b0e5419d2bc 100644
--- a/drivers/net/wireless/ath9k/debug.h
+++ b/drivers/net/wireless/ath9k/debug.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/eeprom.c b/drivers/net/wireless/ath9k/eeprom.c
index 183c949bcca1..ffc36b0361c7 100644
--- a/drivers/net/wireless/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath9k/eeprom.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -342,8 +342,7 @@ static int ath9k_hw_4k_get_eeprom_rev(struct ath_hw *ah)
 static bool ath9k_hw_4k_fill_eeprom(struct ath_hw *ah)
 {
 #define SIZE_EEPROM_4K (sizeof(struct ar5416_eeprom_4k) / sizeof(u16))
-        struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
-        u16 *eep_data;
+        u16 *eep_data = (u16 *)&ah->eeprom.map4k;
         int addr, eep_start_loc = 0;
 
         eep_start_loc = 64;
@@ -353,8 +352,6 @@ static bool ath9k_hw_4k_fill_eeprom(struct ath_hw *ah)
                         "Reading from EEPROM, not flash\n");
         }
 
-        eep_data = (u16 *)eep;
-
         for (addr = 0; addr < SIZE_EEPROM_4K; addr++) {
                 if (!ath9k_hw_nvram_read(ah, addr + eep_start_loc, eep_data)) {
                         DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
@@ -363,6 +360,7 @@ static bool ath9k_hw_4k_fill_eeprom(struct ath_hw *ah)
                 }
                 eep_data++;
         }
+
         return true;
 #undef SIZE_EEPROM_4K
 }
@@ -379,16 +377,15 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
 
 
         if (!ath9k_hw_use_flash(ah)) {
-
                 if (!ath9k_hw_nvram_read(ah, AR5416_EEPROM_MAGIC_OFFSET,
                                          &magic)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
                                 "Reading Magic # failed\n");
                         return false;
                 }
 
                 DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                "Read Magic = 0x%04X\n", magic);
+                        "Read Magic = 0x%04X\n", magic);
 
                 if (magic != AR5416_EEPROM_MAGIC) {
                         magic2 = swab16(magic);
@@ -401,16 +398,9 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
                                         temp = swab16(*eepdata);
                                         *eepdata = temp;
                                         eepdata++;
-
-                                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                                "0x%04X  ", *eepdata);
-
-                                        if (((addr + 1) % 6) == 0)
-                                                DPRINTF(ah->ah_sc,
-                                                        ATH_DBG_EEPROM, "\n");
                                 }
                         } else {
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
                                         "Invalid EEPROM Magic. "
                                         "endianness mismatch.\n");
                                 return -EINVAL;
@@ -426,7 +416,7 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
         else
                 el = ah->eeprom.map4k.baseEepHeader.length;
 
-        if (el > sizeof(struct ar5416_eeprom_def))
+        if (el > sizeof(struct ar5416_eeprom_4k))
                 el = sizeof(struct ar5416_eeprom_4k) / sizeof(u16);
         else
                 el = el / sizeof(u16);
@@ -441,7 +431,7 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
                 u16 word;
 
                 DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "EEPROM Endianness is not native.. Changing \n");
+                        "EEPROM Endianness is not native.. Changing\n");
 
                 word = swab16(eep->baseEepHeader.length);
                 eep->baseEepHeader.length = word;
@@ -483,7 +473,7 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
 
         if (sum != 0xffff || ah->eep_ops->get_eeprom_ver(ah) != AR5416_EEP_VER ||
             ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_NO_BACK_VER) {
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
                         "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
                         sum, ah->eep_ops->get_eeprom_ver(ah));
                 return -EINVAL;
@@ -1203,57 +1193,63 @@ static void ath9k_hw_4k_set_addac(struct ath_hw *ah,
         }
 }
 
-static bool ath9k_hw_4k_set_board_values(struct ath_hw *ah,
-                                         struct ath9k_channel *chan)
+static void ath9k_hw_4k_set_gain(struct ath_hw *ah,
+                                 struct modal_eep_4k_header *pModal,
+                                 struct ar5416_eeprom_4k *eep,
+                                 u8 txRxAttenLocal, int regChainOffset)
 {
-        struct modal_eep_4k_header *pModal;
-        struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
-        int regChainOffset;
-        u8 txRxAttenLocal;
-        u8 ob[5], db1[5], db2[5];
-        u8 ant_div_control1, ant_div_control2;
-        u32 regVal;
-
-
-        pModal = &eep->modalHeader;
-
-        txRxAttenLocal = 23;
-
-        REG_WRITE(ah, AR_PHY_SWITCH_COM,
-                  ah->eep_ops->get_eeprom_antenna_cfg(ah, chan));
-
-        regChainOffset = 0;
         REG_WRITE(ah, AR_PHY_SWITCH_CHAIN_0 + regChainOffset,
                   pModal->antCtrlChain[0]);
 
         REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset,
-                 (REG_READ(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset) &
-                 ~(AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF |
-                 AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF)) |
-                 SM(pModal->iqCalICh[0], AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF) |
-                 SM(pModal->iqCalQCh[0], AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF));
+                  (REG_READ(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset) &
+                   ~(AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF |
+                     AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF)) |
+                  SM(pModal->iqCalICh[0], AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF) |
+                  SM(pModal->iqCalQCh[0], AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF));
 
         if ((eep->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
-                        AR5416_EEP_MINOR_VER_3) {
+            AR5416_EEP_MINOR_VER_3) {
                 txRxAttenLocal = pModal->txRxAttenCh[0];
+
                 REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                        AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN, pModal->bswMargin[0]);
+                              AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN, pModal->bswMargin[0]);
                 REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                        AR_PHY_GAIN_2GHZ_XATTEN1_DB, pModal->bswAtten[0]);
+                              AR_PHY_GAIN_2GHZ_XATTEN1_DB, pModal->bswAtten[0]);
                 REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                        AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN,
-                        pModal->xatten2Margin[0]);
+                              AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN,
+                              pModal->xatten2Margin[0]);
                 REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                        AR_PHY_GAIN_2GHZ_XATTEN2_DB, pModal->xatten2Db[0]);
+                              AR_PHY_GAIN_2GHZ_XATTEN2_DB, pModal->xatten2Db[0]);
         }
 
         REG_RMW_FIELD(ah, AR_PHY_RXGAIN + regChainOffset,
-                        AR9280_PHY_RXGAIN_TXRX_ATTEN, txRxAttenLocal);
+                      AR9280_PHY_RXGAIN_TXRX_ATTEN, txRxAttenLocal);
         REG_RMW_FIELD(ah, AR_PHY_RXGAIN + regChainOffset,
-                        AR9280_PHY_RXGAIN_TXRX_MARGIN, pModal->rxTxMarginCh[0]);
+                      AR9280_PHY_RXGAIN_TXRX_MARGIN, pModal->rxTxMarginCh[0]);
 
         if (AR_SREV_9285_11(ah))
                 REG_WRITE(ah, AR9285_AN_TOP4, (AR9285_AN_TOP4_DEFAULT | 0x14));
+}
+
+static void ath9k_hw_4k_set_board_values(struct ath_hw *ah,
+                                         struct ath9k_channel *chan)
+{
+        struct modal_eep_4k_header *pModal;
+        struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
+        u8 txRxAttenLocal;
+        u8 ob[5], db1[5], db2[5];
+        u8 ant_div_control1, ant_div_control2;
+        u32 regVal;
+
+        pModal = &eep->modalHeader;
+        txRxAttenLocal = 23;
+
+        REG_WRITE(ah, AR_PHY_SWITCH_COM,
+                  ah->eep_ops->get_eeprom_antenna_cfg(ah, chan));
+
+        /* Single chain for 4K EEPROM*/
+        ath9k_hw_4k_set_gain(ah, pModal, eep, txRxAttenLocal, 0);
 
         /* Initialize Ant Diversity settings from EEPROM */
         if (pModal->version == 3) {
@@ -1295,9 +1291,6 @@ static bool ath9k_hw_4k_set_board_values(struct ath_hw *ah,
                 db2[4] = ((pModal->db2_234 >> 8) & 0xf);
 
         } else if (pModal->version == 1) {
-
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "EEPROM Model version is set to 1 \n");
                 ob[0] = (pModal->ob_01 & 0xf);
                 ob[1] = ob[2] = ob[3] = ob[4] = (pModal->ob_01 >> 4) & 0xf;
                 db1[0] = (pModal->db1_01 & 0xf);
@@ -1385,8 +1378,6 @@ static bool ath9k_hw_4k_set_board_values(struct ath_hw *ah,
                                       AR_PHY_SETTLING_SWITCH,
                                       pModal->swSettleHt40);
         }
-
-        return true;
 }
 
 static u16 ath9k_hw_4k_get_eeprom_antenna_cfg(struct ath_hw *ah,
@@ -1464,16 +1455,13 @@ static int ath9k_hw_def_get_eeprom_rev(struct ath_hw *ah)
 static bool ath9k_hw_def_fill_eeprom(struct ath_hw *ah)
 {
 #define SIZE_EEPROM_DEF (sizeof(struct ar5416_eeprom_def) / sizeof(u16))
-        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
-        u16 *eep_data;
+        u16 *eep_data = (u16 *)&ah->eeprom.def;
         int addr, ar5416_eep_start_loc = 0x100;
 
-        eep_data = (u16 *)eep;
-
         for (addr = 0; addr < SIZE_EEPROM_DEF; addr++) {
                 if (!ath9k_hw_nvram_read(ah, addr + ar5416_eep_start_loc,
                                          eep_data)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
                                 "Unable to read eeprom region\n");
                         return false;
                 }
@@ -1492,17 +1480,14 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
         bool need_swap = false;
         int i, addr, size;
 
-        if (!ath9k_hw_nvram_read(ah, AR5416_EEPROM_MAGIC_OFFSET,
-                                 &magic)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "Reading Magic # failed\n");
+        if (!ath9k_hw_nvram_read(ah, AR5416_EEPROM_MAGIC_OFFSET, &magic)) {
+                DPRINTF(ah->ah_sc, ATH_DBG_FATAL, "Reading Magic # failed\n");
                 return false;
         }
 
         if (!ath9k_hw_use_flash(ah)) {
-
                 DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                "Read Magic = 0x%04X\n", magic);
+                        "Read Magic = 0x%04X\n", magic);
 
                 if (magic != AR5416_EEPROM_MAGIC) {
                         magic2 = swab16(magic);
@@ -1516,18 +1501,11 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
                                         temp = swab16(*eepdata);
                                         *eepdata = temp;
                                         eepdata++;
-
-                                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                                "0x%04X  ", *eepdata);
-
-                                        if (((addr + 1) % 6) == 0)
-                                                DPRINTF(ah->ah_sc,
-                                                        ATH_DBG_EEPROM, "\n");
                                 }
                         } else {
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
                                         "Invalid EEPROM Magic. "
-                                        "endianness mismatch.\n");
+                                        "Endianness mismatch.\n");
                                 return -EINVAL;
                         }
                 }
@@ -1556,7 +1534,7 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
                 u16 word;
 
                 DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "EEPROM Endianness is not native.. Changing \n");
+                        "EEPROM Endianness is not native.. Changing.\n");
 
                 word = swab16(eep->baseEepHeader.length);
                 eep->baseEepHeader.length = word;
@@ -1602,7 +1580,7 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
 
         if (sum != 0xffff || ah->eep_ops->get_eeprom_ver(ah) != AR5416_EEP_VER ||
             ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_NO_BACK_VER) {
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
                         "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
                         sum, ah->eep_ops->get_eeprom_ver(ah));
                 return -EINVAL;
@@ -1614,7 +1592,6 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
 static u32 ath9k_hw_def_get_eeprom(struct ath_hw *ah,
                                    enum eeprom_param param)
 {
-#define AR5416_VER_MASK (pBase->version & AR5416_EEP_VER_MINOR_MASK)
         struct ar5416_eeprom_def *eep = &ah->eeprom.def;
         struct modal_eep_header *pModal = eep->modalHeader;
         struct base_eep_header *pBase = &eep->baseEepHeader;
@@ -1681,21 +1658,73 @@ static u32 ath9k_hw_def_get_eeprom(struct ath_hw *ah,
         default:
                 return 0;
         }
-#undef AR5416_VER_MASK
 }
 
-/* XXX: Clean me up, make me more legible */
-static bool ath9k_hw_def_set_board_values(struct ath_hw *ah,
+static void ath9k_hw_def_set_gain(struct ath_hw *ah,
+                                  struct modal_eep_header *pModal,
+                                  struct ar5416_eeprom_def *eep,
+                                  u8 txRxAttenLocal, int regChainOffset, int i)
+{
+        if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_3) {
+                txRxAttenLocal = pModal->txRxAttenCh[i];
+
+                if (AR_SREV_9280_10_OR_LATER(ah)) {
+                        REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                              AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN,
+                              pModal->bswMargin[i]);
+                        REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                              AR_PHY_GAIN_2GHZ_XATTEN1_DB,
+                              pModal->bswAtten[i]);
+                        REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                              AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN,
+                              pModal->xatten2Margin[i]);
+                        REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                              AR_PHY_GAIN_2GHZ_XATTEN2_DB,
+                              pModal->xatten2Db[i]);
+                } else {
+                        REG_WRITE(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                          (REG_READ(ah, AR_PHY_GAIN_2GHZ + regChainOffset) &
+                           ~AR_PHY_GAIN_2GHZ_BSW_MARGIN)
+                          | SM(pModal-> bswMargin[i],
+                               AR_PHY_GAIN_2GHZ_BSW_MARGIN));
+                        REG_WRITE(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                          (REG_READ(ah, AR_PHY_GAIN_2GHZ + regChainOffset) &
+                           ~AR_PHY_GAIN_2GHZ_BSW_ATTEN)
+                          | SM(pModal->bswAtten[i],
+                               AR_PHY_GAIN_2GHZ_BSW_ATTEN));
+                }
+        }
+
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
+                REG_RMW_FIELD(ah,
+                      AR_PHY_RXGAIN + regChainOffset,
+                      AR9280_PHY_RXGAIN_TXRX_ATTEN, txRxAttenLocal);
+                REG_RMW_FIELD(ah,
+                      AR_PHY_RXGAIN + regChainOffset,
+                      AR9280_PHY_RXGAIN_TXRX_MARGIN, pModal->rxTxMarginCh[i]);
+        } else {
+                REG_WRITE(ah,
+                          AR_PHY_RXGAIN + regChainOffset,
+                          (REG_READ(ah, AR_PHY_RXGAIN + regChainOffset) &
+                           ~AR_PHY_RXGAIN_TXRX_ATTEN)
+                          | SM(txRxAttenLocal, AR_PHY_RXGAIN_TXRX_ATTEN));
+                REG_WRITE(ah,
+                          AR_PHY_GAIN_2GHZ + regChainOffset,
+                          (REG_READ(ah, AR_PHY_GAIN_2GHZ + regChainOffset) &
+                           ~AR_PHY_GAIN_2GHZ_RXTX_MARGIN) |
+                          SM(pModal->rxTxMarginCh[i], AR_PHY_GAIN_2GHZ_RXTX_MARGIN));
+        }
+}
+
+static void ath9k_hw_def_set_board_values(struct ath_hw *ah,
                                           struct ath9k_channel *chan)
 {
-#define AR5416_VER_MASK (eep->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK)
         struct modal_eep_header *pModal;
         struct ar5416_eeprom_def *eep = &ah->eeprom.def;
         int i, regChainOffset;
         u8 txRxAttenLocal;
 
         pModal = &(eep->modalHeader[IS_CHAN_2GHZ(chan)]);
-
         txRxAttenLocal = IS_CHAN_2GHZ(chan) ? 23 : 44;
 
         REG_WRITE(ah, AR_PHY_SWITCH_COM,
@@ -1708,8 +1737,7 @@ static bool ath9k_hw_def_set_board_values(struct ath_hw *ah,
                 }
 
                 if (AR_SREV_5416_20_OR_LATER(ah) &&
-                    (ah->rxchainmask == 5 || ah->txchainmask == 5)
-                    && (i != 0))
+                    (ah->rxchainmask == 5 || ah->txchainmask == 5) && (i != 0))
                         regChainOffset = (i == 1) ? 0x2000 : 0x1000;
                 else
                         regChainOffset = i * 0x1000;
@@ -1718,9 +1746,7 @@ static bool ath9k_hw_def_set_board_values(struct ath_hw *ah,
                           pModal->antCtrlChain[i]);
 
                 REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset,
-                          (REG_READ(ah,
-                                    AR_PHY_TIMING_CTRL4(0) +
-                                    regChainOffset) &
+                          (REG_READ(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset) &
                            ~(AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF |
                              AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF)) |
                           SM(pModal->iqCalICh[i],
@@ -1728,87 +1754,9 @@ static bool ath9k_hw_def_set_board_values(struct ath_hw *ah,
                           SM(pModal->iqCalQCh[i],
                              AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF));
 
-                if ((i == 0) || AR_SREV_5416_20_OR_LATER(ah)) {
-                        if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_3) {
-                                txRxAttenLocal = pModal->txRxAttenCh[i];
-                                if (AR_SREV_9280_10_OR_LATER(ah)) {
-                                        REG_RMW_FIELD(ah,
-                                                AR_PHY_GAIN_2GHZ +
-                                                regChainOffset,
-                                                AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN,
-                                                pModal->
-                                                bswMargin[i]);
-                                        REG_RMW_FIELD(ah,
-                                                AR_PHY_GAIN_2GHZ +
-                                                regChainOffset,
-                                                AR_PHY_GAIN_2GHZ_XATTEN1_DB,
-                                                pModal->
-                                                bswAtten[i]);
-                                        REG_RMW_FIELD(ah,
-                                                AR_PHY_GAIN_2GHZ +
-                                                regChainOffset,
-                                                AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN,
-                                                pModal->
-                                                xatten2Margin[i]);
-                                        REG_RMW_FIELD(ah,
-                                                AR_PHY_GAIN_2GHZ +
-                                                regChainOffset,
-                                                AR_PHY_GAIN_2GHZ_XATTEN2_DB,
-                                                pModal->
-                                                xatten2Db[i]);
-                                } else {
-                                        REG_WRITE(ah,
-                                                  AR_PHY_GAIN_2GHZ +
-                                                  regChainOffset,
-                                                  (REG_READ(ah,
-                                                            AR_PHY_GAIN_2GHZ +
-                                                            regChainOffset) &
-                                                   ~AR_PHY_GAIN_2GHZ_BSW_MARGIN)
-                                                  | SM(pModal->
-                                                  bswMargin[i],
-                                                  AR_PHY_GAIN_2GHZ_BSW_MARGIN));
-                                        REG_WRITE(ah,
-                                                  AR_PHY_GAIN_2GHZ +
-                                                  regChainOffset,
-                                                  (REG_READ(ah,
-                                                            AR_PHY_GAIN_2GHZ +
-                                                            regChainOffset) &
-                                                   ~AR_PHY_GAIN_2GHZ_BSW_ATTEN)
-                                                  | SM(pModal->bswAtten[i],
-                                                  AR_PHY_GAIN_2GHZ_BSW_ATTEN));
-                                }
-                        }
-                        if (AR_SREV_9280_10_OR_LATER(ah)) {
-                                REG_RMW_FIELD(ah,
-                                              AR_PHY_RXGAIN +
-                                              regChainOffset,
-                                              AR9280_PHY_RXGAIN_TXRX_ATTEN,
-                                              txRxAttenLocal);
-                                REG_RMW_FIELD(ah,
-                                              AR_PHY_RXGAIN +
-                                              regChainOffset,
-                                              AR9280_PHY_RXGAIN_TXRX_MARGIN,
-                                              pModal->rxTxMarginCh[i]);
-                        } else {
-                                REG_WRITE(ah,
-                                          AR_PHY_RXGAIN + regChainOffset,
-                                          (REG_READ(ah,
-                                                    AR_PHY_RXGAIN +
-                                                    regChainOffset) &
-                                           ~AR_PHY_RXGAIN_TXRX_ATTEN) |
-                                          SM(txRxAttenLocal,
-                                             AR_PHY_RXGAIN_TXRX_ATTEN));
-                                REG_WRITE(ah,
-                                          AR_PHY_GAIN_2GHZ +
-                                          regChainOffset,
-                                          (REG_READ(ah,
-                                                    AR_PHY_GAIN_2GHZ +
-                                                    regChainOffset) &
-                                           ~AR_PHY_GAIN_2GHZ_RXTX_MARGIN) |
-                                          SM(pModal->rxTxMarginCh[i],
-                                             AR_PHY_GAIN_2GHZ_RXTX_MARGIN));
-                        }
-                }
+                if ((i == 0) || AR_SREV_5416_20_OR_LATER(ah))
+                        ath9k_hw_def_set_gain(ah, pModal, eep, txRxAttenLocal,
+                                              regChainOffset, i);
         }
 
         if (AR_SREV_9280_10_OR_LATER(ah)) {
@@ -1855,8 +1803,6 @@ static bool ath9k_hw_def_set_board_values(struct ath_hw *ah,
                                           AR_AN_TOP2_LOCALBIAS,
                                           AR_AN_TOP2_LOCALBIAS_S,
                                           pModal->local_bias);
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM, "ForceXPAon: %d\n",
-                        pModal->force_xpaon);
                 REG_RMW_FIELD(ah, AR_PHY_XPA_CFG, AR_PHY_FORCE_XPA_CFG,
                               pModal->force_xpaon);
         }
@@ -1882,6 +1828,7 @@ static bool ath9k_hw_def_set_board_values(struct ath_hw *ah,
 
         REG_RMW_FIELD(ah, AR_PHY_RF_CTL3, AR_PHY_TX_END_TO_A2_RX_ON,
                       pModal->txEndToRxOn);
+
         if (AR_SREV_9280_10_OR_LATER(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_CCA, AR9280_PHY_CCA_THRESH62,
                               pModal->thresh62);
@@ -1912,10 +1859,10 @@ static bool ath9k_hw_def_set_board_values(struct ath_hw *ah,
         }
 
         if (AR_SREV_9280_20_OR_LATER(ah) &&
-                        AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_19)
+            AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_19)
                 REG_RMW_FIELD(ah, AR_PHY_CCK_TX_CTRL,
-                                AR_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK,
-                                pModal->miscBits);
+                              AR_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK,
+                              pModal->miscBits);
 
 
         if (AR_SREV_9280_20(ah) && AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_20) {
@@ -1926,18 +1873,15 @@ static bool ath9k_hw_def_set_board_values(struct ath_hw *ah,
                         REG_RMW_FIELD(ah, AR_AN_TOP1, AR_AN_TOP1_DACIPMODE, 0);
                 else
                         REG_RMW_FIELD(ah, AR_AN_TOP1, AR_AN_TOP1_DACIPMODE,
-                                        eep->baseEepHeader.dacLpMode);
+                                      eep->baseEepHeader.dacLpMode);
 
                 REG_RMW_FIELD(ah, AR_PHY_FRAME_CTL, AR_PHY_FRAME_CTL_TX_CLIP,
-                                pModal->miscBits >> 2);
+                              pModal->miscBits >> 2);
 
                 REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL9,
-                                AR_PHY_TX_DESIRED_SCALE_CCK,
-                                eep->baseEepHeader.desiredScaleCCK);
+                              AR_PHY_TX_DESIRED_SCALE_CCK,
+                              eep->baseEepHeader.desiredScaleCCK);
         }
-
-        return true;
-#undef AR5416_VER_MASK
 }
 
 static void ath9k_hw_def_set_addac(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath9k/eeprom.h b/drivers/net/wireless/ath9k/eeprom.h
index d6f6108f63c7..25b68c881ff1 100644
--- a/drivers/net/wireless/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath9k/eeprom.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -95,6 +95,7 @@
 #define FREQ2FBIN(x, y)         ((y) ? ((x) - 2300) : (((x) - 4800) / 5))
 #define ath9k_hw_use_flash(_ah) (!(_ah->ah_flags & AH_USE_EEPROM))
 
+#define AR5416_VER_MASK (eep->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK)
 #define OLC_FOR_AR9280_20_LATER (AR_SREV_9280_20_OR_LATER(ah) && \
                                  ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL))
 
@@ -489,7 +490,7 @@ struct eeprom_ops {
         u8 (*get_num_ant_config)(struct ath_hw *hw, enum ieee80211_band band);
         u16 (*get_eeprom_antenna_cfg)(struct ath_hw *hw,
                                       struct ath9k_channel *chan);
-        bool (*set_board_values)(struct ath_hw *hw, struct ath9k_channel *chan);
+        void (*set_board_values)(struct ath_hw *hw, struct ath9k_channel *chan);
         void (*set_addac)(struct ath_hw *hw, struct ath9k_channel *chan);
         int (*set_txpower)(struct ath_hw *hw, struct ath9k_channel *chan,
                            u16 cfgCtl, u8 twiceAntennaReduction,
diff --git a/drivers/net/wireless/ath9k/hw.c b/drivers/net/wireless/ath9k/hw.c
index d494e98ba971..b15eaf8417ff 100644
--- a/drivers/net/wireless/ath9k/hw.c
+++ b/drivers/net/wireless/ath9k/hw.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -588,6 +588,10 @@ static int ath9k_hw_post_attach(struct ath_hw *ah)
         ecode = ath9k_hw_eeprom_attach(ah);
         if (ecode != 0)
                 return ecode;
+
+        DPRINTF(ah->ah_sc, ATH_DBG_CONFIG, "Eeprom VER: %d, REV: %d\n",
+                ah->eep_ops->get_eeprom_ver(ah), ah->eep_ops->get_eeprom_rev(ah));
+
         ecode = ath9k_hw_rfattach(ah);
         if (ecode != 0)
                 return ecode;
@@ -1444,6 +1448,7 @@ static void ath9k_hw_set_operating_mode(struct ath_hw *ah, int opmode)
                 REG_CLR_BIT(ah, AR_CFG, AR_CFG_AP_ADHOC_INDICATION);
                 break;
         case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_MESH_POINT:
                 REG_WRITE(ah, AR_STA_ID1, val | AR_STA_ID1_ADHOC
                           | AR_STA_ID1_KSRCH_MODE);
                 REG_SET_BIT(ah, AR_CFG, AR_CFG_AP_ADHOC_INDICATION);
@@ -2273,11 +2278,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         else
                 ath9k_hw_spur_mitigate(ah, chan);
 
-        if (!ah->eep_ops->set_board_values(ah, chan)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "error setting board options\n");
-                return -EIO;
-        }
+        ah->eep_ops->set_board_values(ah, chan);
 
         ath9k_hw_decrease_chain_power(ah, chan);
 
@@ -3149,6 +3150,7 @@ void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period)
                 flags |= AR_TBTT_TIMER_EN;
                 break;
         case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_MESH_POINT:
                 REG_SET_BIT(ah, AR_TXCFG,
                             AR_TXCFG_ADHOC_BEACON_ATIM_TX_POLICY);
                 REG_WRITE(ah, AR_NEXT_NDP_TIMER,
diff --git a/drivers/net/wireless/ath9k/hw.h b/drivers/net/wireless/ath9k/hw.h
index dc681f011fdf..0b594e0ee260 100644
--- a/drivers/net/wireless/ath9k/hw.h
+++ b/drivers/net/wireless/ath9k/hw.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/initvals.h b/drivers/net/wireless/ath9k/initvals.h
index 1d60c3706f1c..e2f0a34b79a1 100644
--- a/drivers/net/wireless/ath9k/initvals.h
+++ b/drivers/net/wireless/ath9k/initvals.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/mac.c b/drivers/net/wireless/ath9k/mac.c
index f757bc7eec68..e0a6dee45839 100644
--- a/drivers/net/wireless/ath9k/mac.c
+++ b/drivers/net/wireless/ath9k/mac.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/mac.h b/drivers/net/wireless/ath9k/mac.h
index a75f65dae1d7..1176bce8b76c 100644
--- a/drivers/net/wireless/ath9k/mac.h
+++ b/drivers/net/wireless/ath9k/mac.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index 8db75f6de53e..13d4e6756c99 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -940,18 +940,25 @@ static void ath_led_blink_work(struct work_struct *work)
 
         if (!(sc->sc_flags & SC_OP_LED_ASSOCIATED))
                 return;
-        ath9k_hw_set_gpio(sc->sc_ah, ATH_LED_PIN,
-                          (sc->sc_flags & SC_OP_LED_ON) ? 1 : 0);
+
+        if ((sc->led_on_duration == ATH_LED_ON_DURATION_IDLE) ||
+            (sc->led_off_duration == ATH_LED_OFF_DURATION_IDLE))
+                ath9k_hw_set_gpio(sc->sc_ah, ATH_LED_PIN, 0);
+        else
+                ath9k_hw_set_gpio(sc->sc_ah, ATH_LED_PIN,
+                                  (sc->sc_flags & SC_OP_LED_ON) ? 1 : 0);
 
         queue_delayed_work(sc->hw->workqueue, &sc->ath_led_blink_work,
                            (sc->sc_flags & SC_OP_LED_ON) ?
                            msecs_to_jiffies(sc->led_off_duration) :
                            msecs_to_jiffies(sc->led_on_duration));
 
-        sc->led_on_duration =
-                        max((ATH_LED_ON_DURATION_IDLE - sc->led_on_cnt), 25);
-        sc->led_off_duration =
-                        max((ATH_LED_OFF_DURATION_IDLE - sc->led_off_cnt), 10);
+        sc->led_on_duration = sc->led_on_cnt ?
+                        max((ATH_LED_ON_DURATION_IDLE - sc->led_on_cnt), 25) :
+                        ATH_LED_ON_DURATION_IDLE;
+        sc->led_off_duration = sc->led_off_cnt ?
+                        max((ATH_LED_OFF_DURATION_IDLE - sc->led_off_cnt), 10) :
+                        ATH_LED_OFF_DURATION_IDLE;
         sc->led_on_cnt = sc->led_off_cnt = 0;
         if (sc->sc_flags & SC_OP_LED_ON)
                 sc->sc_flags &= ~SC_OP_LED_ON;
@@ -1592,7 +1599,8 @@ void ath_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_AP) |
                 BIT(NL80211_IFTYPE_STATION) |
-                BIT(NL80211_IFTYPE_ADHOC);
+                BIT(NL80211_IFTYPE_ADHOC) |
+                BIT(NL80211_IFTYPE_MESH_POINT);
 
         hw->wiphy->reg_notifier = ath9k_reg_notifier;
         hw->wiphy->strict_regulatory = true;
@@ -2200,18 +2208,13 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                 ic_opmode = NL80211_IFTYPE_STATION;
                 break;
         case NL80211_IFTYPE_ADHOC:
-                if (sc->nbcnvifs >= ATH_BCBUF) {
-                        ret = -ENOBUFS;
-                        goto out;
-                }
-                ic_opmode = NL80211_IFTYPE_ADHOC;
-                break;
         case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_MESH_POINT:
                 if (sc->nbcnvifs >= ATH_BCBUF) {
                         ret = -ENOBUFS;
                         goto out;
                 }
-                ic_opmode = NL80211_IFTYPE_AP;
+                ic_opmode = conf->type;
                 break;
         default:
                 DPRINTF(sc, ATH_DBG_FATAL,
@@ -2247,7 +2250,8 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
          * Note we only do this (at the moment) for station mode.
          */
         if ((conf->type == NL80211_IFTYPE_STATION) ||
-            (conf->type == NL80211_IFTYPE_ADHOC)) {
+            (conf->type == NL80211_IFTYPE_ADHOC) ||
+            (conf->type == NL80211_IFTYPE_MESH_POINT)) {
                 if (ath9k_hw_phycounters(sc->sc_ah))
                         sc->imask |= ATH9K_INT_MIB;
                 sc->imask |= ATH9K_INT_TSFOOR;
@@ -2294,8 +2298,9 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
         del_timer_sync(&sc->ani.timer);
 
         /* Reclaim beacon resources */
-        if (sc->sc_ah->opmode == NL80211_IFTYPE_AP ||
-            sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC) {
+        if ((sc->sc_ah->opmode == NL80211_IFTYPE_AP) ||
+            (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC) ||
+            (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT)) {
                 ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
                 ath_beacon_return(sc, avp);
         }
@@ -2428,6 +2433,7 @@ static int ath9k_config_interface(struct ieee80211_hw *hw,
                 switch (vif->type) {
                 case NL80211_IFTYPE_STATION:
                 case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_MESH_POINT:
                         /* Set BSSID */
                         memcpy(sc->curbssid, conf->bssid, ETH_ALEN);
                         memcpy(avp->bssid, conf->bssid, ETH_ALEN);
@@ -2451,7 +2457,8 @@ static int ath9k_config_interface(struct ieee80211_hw *hw,
         }
 
         if ((vif->type == NL80211_IFTYPE_ADHOC) ||
-            (vif->type == NL80211_IFTYPE_AP)) {
+            (vif->type == NL80211_IFTYPE_AP) ||
+            (vif->type == NL80211_IFTYPE_MESH_POINT)) {
                 if ((conf->changed & IEEE80211_IFCC_BEACON) ||
                     (conf->changed & IEEE80211_IFCC_BEACON_ENABLED &&
                      conf->enable_beacon)) {
@@ -2723,7 +2730,7 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
 
                 ieee80211_stop_tx_ba_cb_irqsafe(hw, sta->addr, tid);
                 break;
-        case IEEE80211_AMPDU_TX_RESUME:
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
                 ath_tx_aggr_resume(sc, sta, tid);
                 break;
         default:
diff --git a/drivers/net/wireless/ath9k/pci.c b/drivers/net/wireless/ath9k/pci.c
index 9a58baabb9ca..6dbc58580abb 100644
--- a/drivers/net/wireless/ath9k/pci.c
+++ b/drivers/net/wireless/ath9k/pci.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -87,7 +87,6 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         struct ath_softc *sc;
         struct ieee80211_hw *hw;
         u8 csz;
-        u32 val;
         int ret = 0;
         struct ath_hw *ah;
 
@@ -134,14 +133,6 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         pci_set_master(pdev);
 
-        /*
-         * Disable the RETRY_TIMEOUT register (0x41) to keep
-         * PCI Tx retries from interfering with C3 CPU state.
-         */
-        pci_read_config_dword(pdev, 0x40, &val);
-        if ((val & 0x0000ff00) != 0)
-                pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
-
         ret = pci_request_region(pdev, 0, "ath9k");
         if (ret) {
                 dev_err(&pdev->dev, "PCI memory region reserve error\n");
@@ -253,21 +244,12 @@ static int ath_pci_resume(struct pci_dev *pdev)
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
-        u32 val;
         int err;
 
         err = pci_enable_device(pdev);
         if (err)
                 return err;
         pci_restore_state(pdev);
-        /*
-         * Suspend/Resume resets the PCI configuration space, so we have to
-         * re-disable the RETRY_TIMEOUT register (0x41) to keep
-         * PCI Tx retries from interfering with C3 CPU state
-         */
-        pci_read_config_dword(pdev, 0x40, &val);
-        if ((val & 0x0000ff00) != 0)
-                pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
 
         /* Enable LED */
         ath9k_hw_cfg_output(sc->sc_ah, ATH_LED_PIN,
diff --git a/drivers/net/wireless/ath9k/phy.c b/drivers/net/wireless/ath9k/phy.c
index e1494bae0f9f..8bcba906929a 100644
--- a/drivers/net/wireless/ath9k/phy.c
+++ b/drivers/net/wireless/ath9k/phy.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/phy.h b/drivers/net/wireless/ath9k/phy.h
index 1eac8c707342..0f7f8e0c9c95 100644
--- a/drivers/net/wireless/ath9k/phy.h
+++ b/drivers/net/wireless/ath9k/phy.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/rc.c b/drivers/net/wireless/ath9k/rc.c
index 832735677a46..824ccbb8b7b8 100644
--- a/drivers/net/wireless/ath9k/rc.c
+++ b/drivers/net/wireless/ath9k/rc.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2004 Video54 Technologies, Inc.
- * Copyright (c) 2004-2008 Atheros Communications, Inc.
+ * Copyright (c) 2004-2009 Atheros Communications, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -864,6 +864,8 @@ static void ath_rc_ratefind(struct ath_softc *sc,
                                           rate_table, nrix, 1, 0);
                 ath_rc_rate_set_series(rate_table, &rates[i++], txrc,
                                        try_per_rate, nrix, 0);
+
+                tx_info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
         } else {
                 try_per_rate = (ATH_11N_TXMAXTRY/4);
                 /* Set the choosen rate. No RTS for first series entry. */
@@ -1468,16 +1470,18 @@ static void ath_rc_init(struct ath_softc *sc,
                 ath_rc_priv->ht_cap);
 }
 
-static u8 ath_rc_build_ht_caps(struct ath_softc *sc, bool is_ht, bool is_cw40,
-                               bool is_sgi40)
+static u8 ath_rc_build_ht_caps(struct ath_softc *sc, struct ieee80211_sta *sta,
+                               bool is_cw40, bool is_sgi40)
 {
         u8 caps = 0;
 
-        if (is_ht) {
+        if (sta->ht_cap.ht_supported) {
                 caps = WLAN_RC_HT_FLAG;
                 if (sc->sc_ah->caps.tx_chainmask != 1 &&
-                    ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_DS, 0, NULL))
-                        caps |= WLAN_RC_DS_FLAG;
+                    ath9k_hw_getcapability(sc->sc_ah, ATH9K_CAP_DS, 0, NULL)) {
+                        if (sta->ht_cap.mcs.rx_mask[1])
+                                caps |= WLAN_RC_DS_FLAG;
+                }
                 if (is_cw40)
                         caps |= WLAN_RC_40_FLAG;
                 if (is_sgi40)
@@ -1615,6 +1619,7 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
         /* Choose rate table first */
 
         if ((sc->sc_ah->opmode == NL80211_IFTYPE_STATION) ||
+            (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT) ||
             (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC)) {
                 rate_table = ath_choose_rate_table(sc, sband->band,
                                                    sta->ht_cap.ht_supported,
@@ -1624,8 +1629,7 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
                 rate_table = sc->cur_rate_table;
         }
 
-        ath_rc_priv->ht_cap = ath_rc_build_ht_caps(sc, sta->ht_cap.ht_supported,
-                                                   is_cw40, is_sgi40);
+        ath_rc_priv->ht_cap = ath_rc_build_ht_caps(sc, sta, is_cw40, is_sgi40);
         ath_rc_init(sc, priv_sta, sband, sta, rate_table);
 }
 
@@ -1659,8 +1663,7 @@ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
                         rate_table = ath_choose_rate_table(sc, sband->band,
                                                    sta->ht_cap.ht_supported,
                                                    oper_cw40);
-                        ath_rc_priv->ht_cap = ath_rc_build_ht_caps(sc,
-                                                   sta->ht_cap.ht_supported,
+                        ath_rc_priv->ht_cap = ath_rc_build_ht_caps(sc, sta,
                                                    oper_cw40, oper_sgi40);
                         ath_rc_init(sc, priv_sta, sband, sta, rate_table);
 
diff --git a/drivers/net/wireless/ath9k/rc.h b/drivers/net/wireless/ath9k/rc.h
index db9b0b9a3431..199a3ce57d64 100644
--- a/drivers/net/wireless/ath9k/rc.h
+++ b/drivers/net/wireless/ath9k/rc.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2004 Sam Leffler, Errno Consulting
  * Copyright (c) 2004 Video54 Technologies, Inc.
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c
index 0bba17662a1f..71cb18d6757d 100644
--- a/drivers/net/wireless/ath9k/recv.c
+++ b/drivers/net/wireless/ath9k/recv.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -344,8 +344,13 @@ void ath_rx_cleanup(struct ath_softc *sc)
 
         list_for_each_entry(bf, &sc->rx.rxbuf, list) {
                 skb = bf->bf_mpdu;
-                if (skb)
+                if (skb) {
+                        dma_unmap_single(sc->dev,
+                                         bf->bf_buf_addr,
+                                         sc->rx.bufsize,
+                                         DMA_FROM_DEVICE);
                         dev_kfree_skb(skb);
+                }
         }
 
         if (sc->rx.rxdma.dd_desc_len != 0)
diff --git a/drivers/net/wireless/ath9k/reg.h b/drivers/net/wireless/ath9k/reg.h
index d86e90e38173..52605246679f 100644
--- a/drivers/net/wireless/ath9k/reg.h
+++ b/drivers/net/wireless/ath9k/reg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/regd.c b/drivers/net/wireless/ath9k/regd.c
index b8f9b6d6bec4..4ca625102291 100644
--- a/drivers/net/wireless/ath9k/regd.c
+++ b/drivers/net/wireless/ath9k/regd.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/regd.h b/drivers/net/wireless/ath9k/regd.h
index 8f885f3bc8df..9f5fbd4eea7a 100644
--- a/drivers/net/wireless/ath9k/regd.h
+++ b/drivers/net/wireless/ath9k/regd.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/regd_common.h b/drivers/net/wireless/ath9k/regd_common.h
index b41d0002f3fe..4d0e298cd1c7 100644
--- a/drivers/net/wireless/ath9k/regd_common.h
+++ b/drivers/net/wireless/ath9k/regd_common.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
index e3f376611f85..689bdbf78808 100644
--- a/drivers/net/wireless/ath9k/xmit.c
+++ b/drivers/net/wireless/ath9k/xmit.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -64,6 +64,10 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
 static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
                              struct list_head *head);
 static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf);
+static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
+                              int txok);
+static void ath_tx_rc_status(struct ath_buf *bf, struct ath_desc *ds,
+                             int nbad, int txok, bool update_rc);
 
 /*********************/
 /* Aggregation logic */
@@ -274,9 +278,10 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         struct ath_buf *bf_next, *bf_last = bf->bf_lastbf;
         struct ath_desc *ds = bf_last->bf_desc;
         struct list_head bf_head, bf_pending;
-        u16 seq_st = 0;
+        u16 seq_st = 0, acked_cnt = 0, txfail_cnt = 0;
         u32 ba[WME_BA_BMP_SIZE >> 5];
-        int isaggr, txfail, txpending, sendbar = 0, needreset = 0;
+        int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
+        bool rc_update = true;
 
         skb = (struct sk_buff *)bf->bf_mpdu;
         hdr = (struct ieee80211_hdr *)skb->data;
@@ -316,6 +321,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         INIT_LIST_HEAD(&bf_pending);
         INIT_LIST_HEAD(&bf_head);
 
+        nbad = ath_tx_num_badfrms(sc, bf, txok);
         while (bf) {
                 txfail = txpending = 0;
                 bf_next = bf->bf_next;
@@ -323,8 +329,10 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                 if (ATH_BA_ISSET(ba, ATH_BA_INDEX(seq_st, bf->bf_seqno))) {
                         /* transmit completion, subframe is
                          * acked by block ack */
+                        acked_cnt++;
                 } else if (!isaggr && txok) {
                         /* transmit completion */
+                        acked_cnt++;
                 } else {
                         if (!(tid->state & AGGR_CLEANUP) &&
                             ds->ds_txstat.ts_flags != ATH9K_TX_SW_ABORTED) {
@@ -335,6 +343,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                                         bf->bf_state.bf_type |= BUF_XRETRY;
                                         txfail = 1;
                                         sendbar = 1;
+                                        txfail_cnt++;
                                 }
                         } else {
                                 /*
@@ -361,6 +370,13 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                         ath_tx_update_baw(sc, tid, bf->bf_seqno);
                         spin_unlock_bh(&txq->axq_lock);
 
+                        if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) {
+                                ath_tx_rc_status(bf, ds, nbad, txok, true);
+                                rc_update = false;
+                        } else {
+                                ath_tx_rc_status(bf, ds, nbad, txok, false);
+                        }
+
                         ath_tx_complete_buf(sc, bf, &bf_head, !txfail, sendbar);
                 } else {
                         /* retry the un-acked ones */
@@ -1734,7 +1750,7 @@ exit:
 /*****************/
 
 static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
-                            struct ath_xmit_status *tx_status)
+                            int tx_flags)
 {
         struct ieee80211_hw *hw = sc->hw;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
@@ -1755,18 +1771,14 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                 tx_info->rate_driver_data[0] = NULL;
         }
 
-        if (tx_status->flags & ATH_TX_BAR) {
+        if (tx_flags & ATH_TX_BAR)
                 tx_info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
-                tx_status->flags &= ~ATH_TX_BAR;
-        }
 
-        if (!(tx_status->flags & (ATH_TX_ERROR | ATH_TX_XRETRY))) {
+        if (!(tx_flags & (ATH_TX_ERROR | ATH_TX_XRETRY))) {
                 /* Frame was ACKed */
                 tx_info->flags |= IEEE80211_TX_STAT_ACK;
         }
 
-        tx_info->status.rates[0].count = tx_status->retries + 1;
-
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
         padsize = hdrlen & 3;
         if (padsize && hdrlen >= 24) {
@@ -1789,29 +1801,22 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
                                 int txok, int sendbar)
 {
         struct sk_buff *skb = bf->bf_mpdu;
-        struct ath_xmit_status tx_status;
         unsigned long flags;
+        int tx_flags = 0;
 
-        /*
-         * Set retry information.
-         * NB: Don't use the information in the descriptor, because the frame
-         * could be software retried.
-         */
-        tx_status.retries = bf->bf_retries;
-        tx_status.flags = 0;
 
         if (sendbar)
-                tx_status.flags = ATH_TX_BAR;
+                tx_flags = ATH_TX_BAR;
 
         if (!txok) {
-                tx_status.flags |= ATH_TX_ERROR;
+                tx_flags |= ATH_TX_ERROR;
 
                 if (bf_isxretried(bf))
-                        tx_status.flags |= ATH_TX_XRETRY;
+                        tx_flags |= ATH_TX_XRETRY;
         }
 
         dma_unmap_single(sc->dev, bf->bf_dmacontext, skb->len, DMA_TO_DEVICE);
-        ath_tx_complete(sc, skb, &tx_status);
+        ath_tx_complete(sc, skb, tx_flags);
 
         /*
          * Return the list of ath_buf of this mpdu to free queue
@@ -1852,27 +1857,40 @@ static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
         return nbad;
 }
 
-static void ath_tx_rc_status(struct ath_buf *bf, struct ath_desc *ds, int nbad)
+static void ath_tx_rc_status(struct ath_buf *bf, struct ath_desc *ds,
+                             int nbad, int txok, bool update_rc)
 {
         struct sk_buff *skb = (struct sk_buff *)bf->bf_mpdu;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ath_tx_info_priv *tx_info_priv = ATH_TX_INFO_PRIV(tx_info);
+        struct ieee80211_hw *hw = tx_info_priv->aphy->hw;
+        u8 i, tx_rateindex;
+
+        if (txok)
+                tx_info->status.ack_signal = ds->ds_txstat.ts_rssi;
 
-        tx_info_priv->update_rc = false;
+        tx_rateindex = ds->ds_txstat.ts_rateindex;
+        WARN_ON(tx_rateindex >= hw->max_rates);
+
+        tx_info_priv->update_rc = update_rc;
         if (ds->ds_txstat.ts_status & ATH9K_TXERR_FILT)
                 tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
 
         if ((ds->ds_txstat.ts_status & ATH9K_TXERR_FILT) == 0 &&
-            (bf->bf_flags & ATH9K_TXDESC_NOACK) == 0) {
+            (bf->bf_flags & ATH9K_TXDESC_NOACK) == 0 && update_rc) {
                 if (ieee80211_is_data(hdr->frame_control)) {
                         memcpy(&tx_info_priv->tx, &ds->ds_txstat,
                                sizeof(tx_info_priv->tx));
                         tx_info_priv->n_frames = bf->bf_nframes;
                         tx_info_priv->n_bad_frames = nbad;
-                        tx_info_priv->update_rc = true;
                 }
         }
+
+        for (i = tx_rateindex + 1; i < hw->max_rates; i++)
+                tx_info->status.rates[i].count = 0;
+
+        tx_info->status.rates[tx_rateindex].count = bf->bf_retries + 1;
 }
 
 static void ath_wake_mac80211_queue(struct ath_softc *sc, struct ath_txq *txq)
@@ -1897,7 +1915,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
         struct ath_buf *bf, *lastbf, *bf_held = NULL;
         struct list_head bf_head;
         struct ath_desc *ds;
-        int txok, nbad = 0;
+        int txok;
         int status;
 
         DPRINTF(sc, ATH_DBG_QUEUE, "tx queue %d (%x), link %p\n",
@@ -1991,13 +2009,9 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                         bf->bf_retries = ds->ds_txstat.ts_longretry;
                         if (ds->ds_txstat.ts_status & ATH9K_TXERR_XRETRY)
                                 bf->bf_state.bf_type |= BUF_XRETRY;
-                        nbad = 0;
-                } else {
-                        nbad = ath_tx_num_badfrms(sc, bf, txok);
+                        ath_tx_rc_status(bf, ds, 0, txok, true);
                 }
 
-                ath_tx_rc_status(bf, ds, nbad);
-
                 if (bf_isampdu(bf))
                         ath_tx_complete_aggr(sc, txq, bf, &bf_head, txok);
                 else
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index b72ef3fd315a..4896e0831114 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -3993,6 +3993,8 @@ static void setup_struct_wldev_for_init(struct b43_wldev *dev)
         dev->irq_reason = 0;
         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
         dev->irq_savedstate = B43_IRQ_MASKTEMPLATE;
+        if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
+                dev->irq_savedstate &= ~B43_IRQ_PHY_TXERR;
 
         dev->mac_suspended = 1;
 
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 0f53c7e5e01e..a63d88841df8 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -50,7 +50,7 @@ static int b43_plcp_get_bitrate_idx_cck(struct b43_plcp_hdr6 *plcp)
 }
 
 /* Extract the bitrate index out of an OFDM PLCP header. */
-static u8 b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy)
+static int b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy)
 {
         int base = aphy ? 0 : 4;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
index 205603d082aa..73f93a0ff2df 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
@@ -233,7 +233,7 @@ struct iwl3945_eeprom {
 #define PCI_CFG_REV_ID_BIT_RTP                      (0x80)      /* bit 7    */
 
 #define TFD_QUEUE_MIN           0
-#define TFD_QUEUE_MAX           6
+#define TFD_QUEUE_MAX           5       /* 4 DATA + 1 CMD */
 
 #define IWL_NUM_SCAN_RATES         (2)
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index f65c308a6714..af6b9d444778 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -124,7 +124,7 @@ static struct iwl3945_tpt_entry iwl3945_tpt_table_g[] = {
 #define IWL39_RATE_HIGH_TH          11520
 #define IWL_SUCCESS_UP_TH          8960
 #define IWL_SUCCESS_DOWN_TH       10880
-#define IWL_RATE_MIN_FAILURE_TH       8
+#define IWL_RATE_MIN_FAILURE_TH       6
 #define IWL_RATE_MIN_SUCCESS_TH       8
 #define IWL_RATE_DECREASE_TH       1920
 #define IWL_RATE_RETRY_TH            15
@@ -488,7 +488,7 @@ static void rs_tx_status(void *priv_rate, struct ieee80211_supported_band *sband
 
         IWL_DEBUG_RATE(priv, "enter\n");
 
-        retries = info->status.rates[0].count - 1;
+        retries = info->status.rates[0].count;
         /* Sanity Check for retries */
         if (retries > IWL_RATE_RETRY_TH)
                 retries = IWL_RATE_RETRY_TH;
@@ -791,16 +791,15 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
         if ((window->success_ratio < IWL_RATE_DECREASE_TH) || !current_tpt) {
                 IWL_DEBUG_RATE(priv, "decrease rate because of low success_ratio\n");
                 scale_action = -1;
-
         /* No throughput measured yet for adjacent rates,
          * try increase */
         } else if ((low_tpt == IWL_INVALID_VALUE) &&
                    (high_tpt == IWL_INVALID_VALUE)) {
 
-                if (high != IWL_RATE_INVALID && window->success_counter >= IWL_RATE_INCREASE_TH)
+                if (high != IWL_RATE_INVALID && window->success_ratio >= IWL_RATE_INCREASE_TH)
                         scale_action = 1;
                 else if (low != IWL_RATE_INVALID)
-                        scale_action = -1;
+                        scale_action = 0;
 
         /* Both adjacent throughputs are measured, but neither one has
          * better throughput; we're using the best rate, don't change
@@ -826,14 +825,14 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
                         else {
                                 IWL_DEBUG_RATE(priv,
                                     "decrease rate because of high tpt\n");
-                                scale_action = -1;
+                                scale_action = 0;
                         }
                 } else if (low_tpt != IWL_INVALID_VALUE) {
                         if (low_tpt > current_tpt) {
                                 IWL_DEBUG_RATE(priv,
                                     "decrease rate because of low tpt\n");
                                 scale_action = -1;
-                        } else if (window->success_counter >= IWL_RATE_INCREASE_TH) {
+                        } else if (window->success_ratio >= IWL_RATE_INCREASE_TH) {
                                 /* Lower rate has better
                                  * throughput,decrease rate */
                                 scale_action = 1;
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index ba7e720e73c1..2399328e8de7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -293,7 +293,7 @@ static void iwl3945_tx_queue_reclaim(struct iwl_priv *priv,
         if (iwl_queue_space(q) > q->low_mark && (txq_id >= 0) &&
                         (txq_id != IWL_CMD_QUEUE_NUM) &&
                         priv->mac80211_registered)
-                ieee80211_wake_queue(priv->hw, txq_id);
+                iwl_wake_queue(priv, txq_id);
 }
 
 /**
@@ -747,11 +747,6 @@ void iwl3945_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq)
         int i;
         int counter;
 
-        /* classify bd */
-        if (txq->q.id == IWL_CMD_QUEUE_NUM)
-                /* nothing to cleanup after for host commands */
-                return;
-
         /* sanity check */
         counter = TFD_CTL_COUNT_GET(le32_to_cpu(tfd->control_flags));
         if (counter > NUM_TFD_CHUNKS) {
@@ -1046,7 +1041,7 @@ static int iwl3945_txq_ctx_reset(struct iwl_priv *priv)
                 goto error;
 
         /* Tx queue(s) */
-        for (txq_id = 0; txq_id < TFD_QUEUE_MAX; txq_id++) {
+        for (txq_id = 0; txq_id <= priv->hw_params.max_txq_num; txq_id++) {
                 slots_num = (txq_id == IWL_CMD_QUEUE_NUM) ?
                                 TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
                 rc = iwl_tx_queue_init(priv, &priv->txq[txq_id], slots_num,
@@ -1184,7 +1179,7 @@ int iwl3945_hw_nic_init(struct iwl_priv *priv)
         IWL_DEBUG_INFO(priv, "HW Revision ID = 0x%X\n", rev_id);
 
         rc = priv->cfg->ops->lib->apm_ops.set_pwr_src(priv, IWL_PWR_SRC_VMAIN);
-        if(rc)
+        if (rc)
                 return rc;
 
         priv->cfg->ops->lib->apm_ops.config(priv);
@@ -1239,8 +1234,12 @@ void iwl3945_hw_txq_ctx_free(struct iwl_priv *priv)
         int txq_id;
 
         /* Tx queues */
-        for (txq_id = 0; txq_id < TFD_QUEUE_MAX; txq_id++)
-                iwl_tx_queue_free(priv, txq_id);
+        for (txq_id = 0; txq_id <= priv->hw_params.max_txq_num; txq_id++)
+                if (txq_id == IWL_CMD_QUEUE_NUM)
+                        iwl_cmd_queue_free(priv);
+                else
+                        iwl_tx_queue_free(priv, txq_id);
+
 }
 
 void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
@@ -1259,7 +1258,7 @@ void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
         iwl_write_prph(priv, ALM_SCD_MODE_REG, 0);
 
         /* reset TFD queues */
-        for (txq_id = 0; txq_id < TFD_QUEUE_MAX; txq_id++) {
+        for (txq_id = 0; txq_id <= priv->hw_params.max_txq_num; txq_id++) {
                 iwl_write_direct32(priv, FH39_TCSR_CONFIG(txq_id), 0x0);
                 iwl_poll_direct_bit(priv, FH39_TSSR_TX_STATUS,
                                 FH39_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(txq_id),
@@ -2488,6 +2487,9 @@ int iwl3945_hw_set_hw_params(struct iwl_priv *priv)
                 return -ENOMEM;
         }
 
+        /* Assign number of Usable TX queues */
+        priv->hw_params.max_txq_num = TFD_QUEUE_MAX;
+
         priv->hw_params.tfd_size = sizeof(struct iwl3945_tfd);
         priv->hw_params.rx_buf_size = IWL_RX_BUF_SIZE_3K;
         priv->hw_params.max_pkt_size = 2342;
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index bd0140be774e..847a6220c5e6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2178,10 +2178,9 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
                             (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA)) {
                                 if (agg->state == IWL_AGG_OFF)
-                                        ieee80211_wake_queue(priv->hw, txq_id);
+                                        iwl_wake_queue(priv, txq_id);
                                 else
-                                        ieee80211_wake_queue(priv->hw,
-                                                             txq->swq_id);
+                                        iwl_wake_queue(priv, txq->swq_id);
                         }
                 }
         } else {
@@ -2205,7 +2204,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
 
                 if (priv->mac80211_registered &&
                     (iwl_queue_space(&txq->q) > txq->q.low_mark))
-                        ieee80211_wake_queue(priv->hw, txq_id);
+                        iwl_wake_queue(priv, txq_id);
         }
 
         if (qc && likely(sta_id != IWL_INVALID_STATION))
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 08c19bea71e3..e5ca2511a81a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -1077,7 +1077,7 @@ static int iwl5000_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
 
         if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
             (IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES <= txq_id)) {
-                IWL_WARN(priv,
+                IWL_ERR(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWL50_FIRST_AMPDU_QUEUE,
                         IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES - 1);
@@ -1295,10 +1295,9 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
                             (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA)) {
                                 if (agg->state == IWL_AGG_OFF)
-                                        ieee80211_wake_queue(priv->hw, txq_id);
+                                        iwl_wake_queue(priv, txq_id);
                                 else
-                                        ieee80211_wake_queue(priv->hw,
-                                                             txq->swq_id);
+                                        iwl_wake_queue(priv, txq->swq_id);
                         }
                 }
         } else {
@@ -1324,7 +1323,7 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
 
                 if (priv->mac80211_registered &&
                     (iwl_queue_space(&txq->q) > txq->q.low_mark))
-                        ieee80211_wake_queue(priv->hw, txq_id);
+                        iwl_wake_queue(priv, txq_id);
         }
 
         if (ieee80211_is_data_qos(tx_resp->frame_ctrl))
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 0db3bc011ac2..663dc83be501 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1567,9 +1567,8 @@ static void iwl_alive_start(struct iwl_priv *priv)
         if (iwl_is_associated(priv)) {
                 struct iwl_rxon_cmd *active_rxon =
                                 (struct iwl_rxon_cmd *)&priv->active_rxon;
-
-                memcpy(&priv->staging_rxon, &priv->active_rxon,
-                       sizeof(priv->staging_rxon));
+                /* apply any changes in staging */
+                priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
                 active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
         } else {
                 /* Initialize our rx_config data */
@@ -2184,110 +2183,112 @@ static int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
         struct iwl_priv *priv = hw->priv;
         const struct iwl_channel_info *ch_info;
         struct ieee80211_conf *conf = &hw->conf;
-        unsigned long flags;
+        unsigned long flags = 0;
         int ret = 0;
-        u16 channel;
+        u16 ch;
+        int scan_active = 0;
 
         mutex_lock(&priv->mutex);
-        IWL_DEBUG_MAC80211(priv, "enter to channel %d\n", conf->channel->hw_value);
+        IWL_DEBUG_MAC80211(priv, "enter to channel %d changed 0x%X\n",
+                                        conf->channel->hw_value, changed);
 
-        priv->current_ht_config.is_ht = conf_is_ht(conf);
-
-        if (conf->radio_enabled && iwl_radio_kill_sw_enable_radio(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF-KILL - waiting for uCode\n");
-                goto out;
+        if (unlikely(!priv->cfg->mod_params->disable_hw_scan &&
+                        test_bit(STATUS_SCANNING, &priv->status))) {
+                scan_active = 1;
+                IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
         }
 
-        if (!conf->radio_enabled)
-                iwl_radio_kill_sw_disable_radio(priv);
 
-        if (!iwl_is_ready(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
-                ret = -EIO;
-                goto out;
-        }
+        /* during scanning mac80211 will delay channel setting until
+         * scan finish with changed = 0
+         */
+        if (!changed || (changed & IEEE80211_CONF_CHANGE_CHANNEL)) {
+                if (scan_active)
+                        goto set_ch_out;
+
+                ch = ieee80211_frequency_to_channel(conf->channel->center_freq);
+                ch_info = iwl_get_channel_info(priv, conf->channel->band, ch);
+                if (!is_channel_valid(ch_info)) {
+                        IWL_DEBUG_MAC80211(priv, "leave - invalid channel\n");
+                        ret = -EINVAL;
+                        goto set_ch_out;
+                }
 
-        if (unlikely(!priv->cfg->mod_params->disable_hw_scan &&
-                     test_bit(STATUS_SCANNING, &priv->status))) {
-                IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
-                mutex_unlock(&priv->mutex);
-                return 0;
-        }
+                if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
+                        !is_channel_ibss(ch_info)) {
+                        IWL_ERR(priv, "channel %d in band %d not "
+                                "IBSS channel\n",
+                                conf->channel->hw_value, conf->channel->band);
+                        ret = -EINVAL;
+                        goto set_ch_out;
+                }
 
-        channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
-        ch_info = iwl_get_channel_info(priv, conf->channel->band, channel);
-        if (!is_channel_valid(ch_info)) {
-                IWL_DEBUG_MAC80211(priv, "leave - invalid channel\n");
-                ret = -EINVAL;
-                goto out;
-        }
+                priv->current_ht_config.is_ht = conf_is_ht(conf);
 
-        if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
-            !is_channel_ibss(ch_info)) {
-                IWL_ERR(priv, "channel %d in band %d not IBSS channel\n",
-                        conf->channel->hw_value, conf->channel->band);
-                ret = -EINVAL;
-                goto out;
-        }
+                spin_lock_irqsave(&priv->lock, flags);
 
-        spin_lock_irqsave(&priv->lock, flags);
 
+                /* if we are switching from ht to 2.4 clear flags
+                 * from any ht related info since 2.4 does not
+                 * support ht */
+                if ((le16_to_cpu(priv->staging_rxon.channel) != ch))
+                        priv->staging_rxon.flags = 0;
 
-        /* if we are switching from ht to 2.4 clear flags
-         * from any ht related info since 2.4 does not
-         * support ht */
-        if ((le16_to_cpu(priv->staging_rxon.channel) != channel)
-#ifdef IEEE80211_CONF_CHANNEL_SWITCH
-            && !(conf->flags & IEEE80211_CONF_CHANNEL_SWITCH)
-#endif
-        )
-                priv->staging_rxon.flags = 0;
+                iwl_set_rxon_channel(priv, conf->channel);
 
-        iwl_set_rxon_channel(priv, conf->channel);
+                iwl_set_flags_for_band(priv, conf->channel->band);
+                spin_unlock_irqrestore(&priv->lock, flags);
+ set_ch_out:
+                /* The list of supported rates and rate mask can be different
+                 * for each band; since the band may have changed, reset
+                 * the rate mask to what mac80211 lists */
+                iwl_set_rate(priv);
+        }
 
-        iwl_set_flags_for_band(priv, conf->channel->band);
+        if (changed & IEEE80211_CONF_CHANGE_PS) {
+                if (conf->flags & IEEE80211_CONF_PS)
+                        ret = iwl_power_set_user_mode(priv, IWL_POWER_INDEX_3);
+                else
+                        ret = iwl_power_set_user_mode(priv, IWL_POWER_MODE_CAM);
+                if (ret)
+                        IWL_DEBUG_MAC80211(priv, "Error setting power level\n");
 
-        /* The list of supported rates and rate mask can be different
-         * for each band; since the band may have changed, reset
-         * the rate mask to what mac80211 lists */
-        iwl_set_rate(priv);
+        }
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        if (changed & IEEE80211_CONF_CHANGE_POWER) {
+                IWL_DEBUG_MAC80211(priv, "TX Power old=%d new=%d\n",
+                        priv->tx_power_user_lmt, conf->power_level);
 
-#ifdef IEEE80211_CONF_CHANNEL_SWITCH
-        if (conf->flags & IEEE80211_CONF_CHANNEL_SWITCH) {
-                iwl_hw_channel_switch(priv, conf->channel);
-                goto out;
+                iwl_set_tx_power(priv, conf->power_level, false);
+        }
+
+        /* call to ensure that 4965 rx_chain is set properly in monitor mode */
+        iwl_set_rxon_chain(priv);
+
+        if (changed & IEEE80211_CONF_CHANGE_RADIO_ENABLED) {
+                if (conf->radio_enabled &&
+                        iwl_radio_kill_sw_enable_radio(priv)) {
+                        IWL_DEBUG_MAC80211(priv, "leave - RF-KILL - "
+                                                "waiting for uCode\n");
+                        goto out;
+                }
+
+                if (!conf->radio_enabled)
+                        iwl_radio_kill_sw_disable_radio(priv);
         }
-#endif
 
         if (!conf->radio_enabled) {
                 IWL_DEBUG_MAC80211(priv, "leave - radio disabled\n");
                 goto out;
         }
 
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF kill\n");
-                ret = -EIO;
+        if (!iwl_is_ready(priv)) {
+                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
                 goto out;
         }
 
-        if (conf->flags & IEEE80211_CONF_PS)
-                ret = iwl_power_set_user_mode(priv, IWL_POWER_INDEX_3);
-        else
-                ret = iwl_power_set_user_mode(priv, IWL_POWER_MODE_CAM);
-        if (ret)
-                IWL_DEBUG_MAC80211(priv, "Error setting power level\n");
-
-        IWL_DEBUG_MAC80211(priv, "TX Power old=%d new=%d\n",
-                           priv->tx_power_user_lmt, conf->power_level);
-
-        iwl_set_tx_power(priv, conf->power_level, false);
-
-        iwl_set_rate(priv);
-
-        /* call to ensure that 4965 rx_chain is set properly in monitor mode */
-        iwl_set_rxon_chain(priv);
+        if (scan_active)
+                goto out;
 
         if (memcmp(&priv->active_rxon,
                    &priv->staging_rxon, sizeof(priv->staging_rxon)))
@@ -2295,9 +2296,9 @@ static int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
         else
                 IWL_DEBUG_INFO(priv, "No re-sending same RXON configuration.\n");
 
-        IWL_DEBUG_MAC80211(priv, "leave\n");
 
 out:
+        IWL_DEBUG_MAC80211(priv, "leave\n");
         mutex_unlock(&priv->mutex);
         return ret;
 }
@@ -2682,6 +2683,7 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
                              struct ieee80211_sta *sta, u16 tid, u16 *ssn)
 {
         struct iwl_priv *priv = hw->priv;
+        int ret;
 
         IWL_DEBUG_HT(priv, "A-MPDU action on addr %pM tid %d\n",
                      sta->addr, tid);
@@ -2695,13 +2697,21 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
                 return iwl_sta_rx_agg_start(priv, sta->addr, tid, *ssn);
         case IEEE80211_AMPDU_RX_STOP:
                 IWL_DEBUG_HT(priv, "stop Rx\n");
-                return iwl_sta_rx_agg_stop(priv, sta->addr, tid);
+                ret = iwl_sta_rx_agg_stop(priv, sta->addr, tid);
+                if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                        return 0;
+                else
+                        return ret;
         case IEEE80211_AMPDU_TX_START:
                 IWL_DEBUG_HT(priv, "start Tx\n");
                 return iwl_tx_agg_start(priv, sta->addr, tid, ssn);
         case IEEE80211_AMPDU_TX_STOP:
                 IWL_DEBUG_HT(priv, "stop Tx\n");
-                return iwl_tx_agg_stop(priv, sta->addr, tid);
+                ret = iwl_tx_agg_stop(priv, sta->addr, tid);
+                if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                        return 0;
+                else
+                        return ret;
         default:
                 IWL_DEBUG_HT(priv, "unknown\n");
                 return -EINVAL;
@@ -3083,11 +3093,6 @@ static ssize_t store_power_level(struct device *d,
 
         mutex_lock(&priv->mutex);
 
-        if (!iwl_is_ready(priv)) {
-                ret = -EAGAIN;
-                goto out;
-        }
-
         ret = strict_strtoul(buf, 10, &mode);
         if (ret)
                 goto out;
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 085e9cf1cac9..c54fb93e9d72 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1298,6 +1298,7 @@ int iwl_setup_mac(struct iwl_priv *priv)
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
                     IEEE80211_HW_NOISE_DBM |
                     IEEE80211_HW_AMPDU_AGGREGATION |
+                    IEEE80211_HW_SPECTRUM_MGMT |
                     IEEE80211_HW_SUPPORTS_PS;
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
@@ -1308,9 +1309,6 @@ int iwl_setup_mac(struct iwl_priv *priv)
 
         /* Default value; 4 EDCA QOS priorities */
         hw->queues = 4;
-        /* queues to support 11n aggregation */
-        if (priv->cfg->sku & IWL_SKU_N)
-                hw->ampdu_queues = priv->cfg->mod_params->num_of_ampdu_queues;
 
         hw->conf.beacon_int = 100;
         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
@@ -1437,6 +1435,10 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
 
         priv->tx_power_user_lmt = tx_power;
 
+        /* if nic is not up don't send command */
+        if (!iwl_is_ready_rf(priv))
+                return ret;
+
         if (force && priv->cfg->ops->lib->send_tx_power)
                 ret = priv->cfg->ops->lib->send_tx_power(priv);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 27310fec2e43..a8eac8c3c1fa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -264,6 +264,7 @@ void iwl_rx_reply_error(struct iwl_priv *priv,
 * RX
 ******************************************************/
 void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
+void iwl_cmd_queue_free(struct iwl_priv *priv);
 int iwl_rx_queue_alloc(struct iwl_priv *priv);
 void iwl_rx_handle(struct iwl_priv *priv);
 int iwl_rx_queue_update_write_ptr(struct iwl_priv *priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 36cfeccfafbc..64eb585f1578 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -425,6 +425,56 @@ static ssize_t iwl_dbgfs_channels_read(struct file *file, char __user *user_buf,
         return ret;
 }
 
+static ssize_t iwl_dbgfs_status_read(struct file *file,
+                                                char __user *user_buf,
+                                                size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        char buf[512];
+        int pos = 0;
+        const size_t bufsz = sizeof(buf);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
+                test_bit(STATUS_HCMD_ACTIVE, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_SYNC_ACTIVE: %d\n",
+                test_bit(STATUS_HCMD_SYNC_ACTIVE, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
+                test_bit(STATUS_INT_ENABLED, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_RF_KILL_HW:\t %d\n",
+                test_bit(STATUS_RF_KILL_HW, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_RF_KILL_SW:\t %d\n",
+                test_bit(STATUS_RF_KILL_SW, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INIT:\t\t %d\n",
+                test_bit(STATUS_INIT, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_ALIVE:\t\t %d\n",
+                test_bit(STATUS_ALIVE, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_READY:\t\t %d\n",
+                test_bit(STATUS_READY, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_TEMPERATURE:\t %d\n",
+                test_bit(STATUS_TEMPERATURE, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_GEO_CONFIGURED:\t %d\n",
+                test_bit(STATUS_GEO_CONFIGURED, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_EXIT_PENDING:\t %d\n",
+                test_bit(STATUS_EXIT_PENDING, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_IN_SUSPEND:\t %d\n",
+                test_bit(STATUS_IN_SUSPEND, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_STATISTICS:\t %d\n",
+                test_bit(STATUS_STATISTICS, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_SCANNING:\t %d\n",
+                test_bit(STATUS_SCANNING, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_SCAN_ABORTING:\t %d\n",
+                test_bit(STATUS_SCAN_ABORTING, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_SCAN_HW:\t\t %d\n",
+                test_bit(STATUS_SCAN_HW, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_POWER_PMI:\t %d\n",
+                test_bit(STATUS_POWER_PMI, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_FW_ERROR:\t %d\n",
+                test_bit(STATUS_FW_ERROR, &priv->status));
+        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_MODE_PENDING:\t %d\n",
+                test_bit(STATUS_MODE_PENDING, &priv->status));
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
 DEBUGFS_READ_WRITE_FILE_OPS(sram);
 DEBUGFS_WRITE_FILE_OPS(log_event);
 DEBUGFS_READ_FILE_OPS(eeprom);
@@ -432,6 +482,7 @@ DEBUGFS_READ_FILE_OPS(stations);
 DEBUGFS_READ_FILE_OPS(rx_statistics);
 DEBUGFS_READ_FILE_OPS(tx_statistics);
 DEBUGFS_READ_FILE_OPS(channels);
+DEBUGFS_READ_FILE_OPS(status);
 
 /*
  * Create the debugfs files and directories
@@ -466,7 +517,7 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(rx_statistics, data);
         DEBUGFS_ADD_FILE(tx_statistics, data);
         DEBUGFS_ADD_FILE(channels, data);
-        DEBUGFS_ADD_X32(status, data, (u32 *)&priv->status);
+        DEBUGFS_ADD_FILE(status, data);
         DEBUGFS_ADD_BOOL(disable_sensitivity, rf, &priv->disable_sens_cal);
         DEBUGFS_ADD_BOOL(disable_chain_noise, rf,
                          &priv->disable_chain_noise_cal);
@@ -496,6 +547,7 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv)
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_log_event);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_stations);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_channels);
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_status);
         DEBUGFS_REMOVE(priv->dbgfs->dir_data);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_sensitivity);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_chain_noise);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 0baae8022824..ec9a13846edd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -996,6 +996,12 @@ struct iwl_priv {
         u8 key_mapping_key;
         unsigned long ucode_key_table;
 
+        /* queue refcounts */
+#define IWL_MAX_HW_QUEUES       32
+        unsigned long queue_stopped[BITS_TO_LONGS(IWL_MAX_HW_QUEUES)];
+        /* for each AC */
+        atomic_t queue_stop_count[4];
+
         /* Indication if ieee80211_ops->open has been called */
         u8 is_open;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
index fb64d297dd4e..a1328c3c81ae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
+++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
@@ -93,4 +93,56 @@ static inline int iwl_alloc_fw_desc(struct pci_dev *pci_dev,
         return (desc->v_addr != NULL) ? 0 : -ENOMEM;
 }
 
+/*
+ * we have 8 bits used like this:
+ *
+ * 7 6 5 4 3 2 1 0
+ * | | | | | | | |
+ * | | | | | | +-+-------- AC queue (0-3)
+ * | | | | | |
+ * | +-+-+-+-+------------ HW A-MPDU queue
+ * |
+ * +---------------------- indicates agg queue
+ */
+static inline u8 iwl_virtual_agg_queue_num(u8 ac, u8 hwq)
+{
+        BUG_ON(ac > 3);   /* only have 2 bits */
+        BUG_ON(hwq > 31); /* only have 5 bits */
+
+        return 0x80 | (hwq << 2) | ac;
+}
+
+static inline void iwl_wake_queue(struct iwl_priv *priv, u8 queue)
+{
+        u8 ac = queue;
+        u8 hwq = queue;
+
+        if (queue & 0x80) {
+                ac = queue & 3;
+                hwq = (queue >> 2) & 0x1f;
+        }
+
+        if (test_and_clear_bit(hwq, priv->queue_stopped))
+                if (atomic_dec_return(&priv->queue_stop_count[ac]) <= 0)
+                        ieee80211_wake_queue(priv->hw, ac);
+}
+
+static inline void iwl_stop_queue(struct iwl_priv *priv, u8 queue)
+{
+        u8 ac = queue;
+        u8 hwq = queue;
+
+        if (queue & 0x80) {
+                ac = queue & 3;
+                hwq = (queue >> 2) & 0x1f;
+        }
+
+        if (!test_and_set_bit(hwq, priv->queue_stopped))
+                if (atomic_inc_return(&priv->queue_stop_count[ac]) > 0)
+                        ieee80211_stop_queue(priv->hw, ac);
+}
+
+#define ieee80211_stop_queue DO_NOT_USE_ieee80211_stop_queue
+#define ieee80211_wake_queue DO_NOT_USE_ieee80211_wake_queue
+
 #endif                          /* __iwl_helpers_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 18b7e4195ea1..47c894530eb5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -273,7 +273,7 @@ int iwl_power_update_mode(struct iwl_priv *priv, bool force)
         if (priv->iw_mode != NL80211_IFTYPE_STATION)
                 final_mode = IWL_POWER_MODE_CAM;
 
-        if (!iwl_is_rfkill(priv) && !setting->power_disabled &&
+        if (iwl_is_ready_rf(priv) && !setting->power_disabled &&
             ((setting->power_mode != final_mode) || force)) {
                 struct iwl_powertable_cmd cmd;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 1684490d93c0..5798fe49c771 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -1138,8 +1138,10 @@ int iwl_sta_rx_agg_stop(struct iwl_priv *priv, const u8 *addr, int tid)
         int sta_id;
 
         sta_id = iwl_find_station(priv, addr);
-        if (sta_id == IWL_INVALID_STATION)
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Invalid station for AGG tid %d\n", tid);
                 return -ENXIO;
+        }
 
         spin_lock_irqsave(&priv->sta_lock, flags);
         priv->stations[sta_id].sta.station_flags_msk = 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index dff60fb70214..1f117a49c569 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -174,7 +174,7 @@ EXPORT_SYMBOL(iwl_tx_queue_free);
  * Free all buffers.
  * 0-fill, but do not free "txq" descriptor structure.
  */
-static void iwl_cmd_queue_free(struct iwl_priv *priv)
+void iwl_cmd_queue_free(struct iwl_priv *priv)
 {
         struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
         struct iwl_queue *q = &txq->q;
@@ -193,12 +193,14 @@ static void iwl_cmd_queue_free(struct iwl_priv *priv)
 
         /* De-alloc circular buffer of TFDs */
         if (txq->q.n_bd)
-                pci_free_consistent(dev, sizeof(struct iwl_tfd) *
+                pci_free_consistent(dev, priv->hw_params.tfd_size *
                                     txq->q.n_bd, txq->tfds, txq->q.dma_addr);
 
         /* 0-fill queue descriptor structure */
         memset(txq, 0, sizeof(*txq));
 }
+EXPORT_SYMBOL(iwl_cmd_queue_free);
+
 /*************** DMA-QUEUE-GENERAL-FUNCTIONS  *****
  * DMA services
  *
@@ -761,8 +763,10 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 hdr->seq_ctrl |= cpu_to_le16(seq_number);
                 seq_number += 0x10;
                 /* aggregation is on for this <sta,tid> */
-                if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                if (info->flags & IEEE80211_TX_CTL_AMPDU) {
                         txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
+                        swq_id = iwl_virtual_agg_queue_num(swq_id, txq_id);
+                }
                 priv->stations[sta_id].tid[tid].tfds_in_queue++;
         }
 
@@ -893,7 +897,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                         iwl_txq_update_write_ptr(priv, txq);
                         spin_unlock_irqrestore(&priv->lock, flags);
                 } else {
-                        ieee80211_stop_queue(priv->hw, txq->swq_id);
+                        iwl_stop_queue(priv, txq->swq_id);
                 }
         }
 
@@ -1221,8 +1225,10 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
 
         sta_id = iwl_find_station(priv, ra);
 
-        if (sta_id == IWL_INVALID_STATION)
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Invalid station for AGG tid %d\n", tid);
                 return -ENXIO;
+        }
 
         if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON)
                 IWL_WARN(priv, "Stopping AGG while state not IWL_AGG_ON\n");
@@ -1429,7 +1435,7 @@ void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
                 if ((iwl_queue_space(&txq->q) > txq->q.low_mark) &&
                     priv->mac80211_registered &&
                     (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA))
-                        ieee80211_wake_queue(priv->hw, txq->swq_id);
+                        iwl_wake_queue(priv, txq->swq_id);
 
                 iwl_txq_check_empty(priv, sta_id, tid, scd_flow);
         }
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 4465320f2735..a71b08ca7c71 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -485,14 +485,14 @@ static int iwl3945_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
         memcpy(priv->stations_39[sta_id].sta.key.key, keyconf->key,
                keyconf->keylen);
 
-        if ((priv->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
+        if ((priv->stations_39[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
                         == STA_KEY_FLG_NO_ENC)
-                priv->stations[sta_id].sta.key.key_offset =
+                priv->stations_39[sta_id].sta.key.key_offset =
                                  iwl_get_free_ucode_key_index(priv);
         /* else, we are overriding an existing key => no need to allocated room
         * in uCode. */
 
-        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+        WARN(priv->stations_39[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
                 "no space for a new key");
 
         priv->stations_39[sta_id].sta.key.key_flags = key_flags;
@@ -560,7 +560,7 @@ static int iwl3945_set_dynamic_key(struct iwl_priv *priv,
                 ret = iwl3945_set_wep_dynamic_key_info(priv, keyconf, sta_id);
                 break;
         default:
-                IWL_ERR(priv,"Unknown alg: %s alg = %d\n", __func__, keyconf->alg);
+                IWL_ERR(priv, "Unknown alg: %s alg = %d\n", __func__, keyconf->alg);
                 ret = -EINVAL;
         }
 
@@ -1168,7 +1168,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                         spin_unlock_irqrestore(&priv->lock, flags);
                 }
 
-                ieee80211_stop_queue(priv->hw, skb_get_queue_mapping(skb));
+                iwl_stop_queue(priv, skb_get_queue_mapping(skb));
         }
 
         return 0;
@@ -3773,15 +3773,19 @@ static int iwl3945_mac_config(struct ieee80211_hw *hw, u32 changed)
         }
 #endif
 
-        if (conf->radio_enabled && iwl_radio_kill_sw_enable_radio(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF-KILL - waiting for uCode\n");
-                goto out;
-        }
+        if (changed & IEEE80211_CONF_CHANGE_RADIO_ENABLED) {
+                if (conf->radio_enabled &&
+                    iwl_radio_kill_sw_enable_radio(priv)) {
+                        IWL_DEBUG_MAC80211(priv, "leave - RF-KILL - "
+                                                 "waiting for uCode\n");
+                        goto out;
+                }
 
-        if (!conf->radio_enabled) {
-                iwl_radio_kill_sw_disable_radio(priv);
-                IWL_DEBUG_MAC80211(priv, "leave - radio disabled\n");
-                goto out;
+                if (!conf->radio_enabled) {
+                        iwl_radio_kill_sw_disable_radio(priv);
+                        IWL_DEBUG_MAC80211(priv, "leave - radio disabled\n");
+                        goto out;
+                }
         }
 
         if (iwl_is_rfkill(priv)) {
@@ -4546,11 +4550,6 @@ static ssize_t store_power_level(struct device *d,
 
         mutex_lock(&priv->mutex);
 
-        if (!iwl_is_ready(priv)) {
-                ret = -EAGAIN;
-                goto out;
-        }
-
         ret = strict_strtoul(buf, 10, &mode);
         if (ret)
                 goto out;
@@ -4905,7 +4904,8 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
 
         /* Tell mac80211 our characteristics */
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                    IEEE80211_HW_NOISE_DBM;
+                    IEEE80211_HW_NOISE_DBM |
+                    IEEE80211_HW_SPECTRUM_MGMT;
 
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
diff --git a/drivers/net/wireless/libertas/radiotap.h b/drivers/net/wireless/libertas/radiotap.h
index f8eb9097ff0a..d16b26416e82 100644
--- a/drivers/net/wireless/libertas/radiotap.h
+++ b/drivers/net/wireless/libertas/radiotap.h
@@ -33,22 +33,12 @@ struct rx_radiotap_hdr {
         struct ieee80211_radiotap_header hdr;
         u8 flags;
         u8 rate;
-        u16 chan_freq;
-        u16 chan_flags;
-        u8 antenna;
         u8 antsignal;
-        u16 rx_flags;
-#if 0
-        u8 pad[IEEE80211_RADIOTAP_HDRLEN - 18];
-#endif
 } __attribute__ ((packed));
 
 #define RX_RADIOTAP_PRESENT (                   \
         (1 << IEEE80211_RADIOTAP_FLAGS) |       \
         (1 << IEEE80211_RADIOTAP_RATE) |        \
-        (1 << IEEE80211_RADIOTAP_CHANNEL) |     \
-        (1 << IEEE80211_RADIOTAP_ANTENNA) |     \
         (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL) |\
-        (1 << IEEE80211_RADIOTAP_RX_FLAGS) |    \
         0)
 
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index 4f60948dde9c..63d7e19ce9bd 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -351,19 +351,11 @@ static int process_rxed_802_11_packet(struct lbs_private *priv,
         radiotap_hdr.hdr.it_pad = 0;
         radiotap_hdr.hdr.it_len = cpu_to_le16 (sizeof(struct rx_radiotap_hdr));
         radiotap_hdr.hdr.it_present = cpu_to_le32 (RX_RADIOTAP_PRESENT);
-        /* unknown values */
-        radiotap_hdr.flags = 0;
-        radiotap_hdr.chan_freq = 0;
-        radiotap_hdr.chan_flags = 0;
-        radiotap_hdr.antenna = 0;
-        /* known values */
+        if (!(prxpd->status & cpu_to_le16(MRVDRV_RXPD_STATUS_OK)))
+                radiotap_hdr.flags |= IEEE80211_RADIOTAP_F_BADFCS;
         radiotap_hdr.rate = convert_mv_rate_to_radiotap(prxpd->rx_rate);
         /* XXX must check no carryout */
         radiotap_hdr.antsignal = prxpd->snr + prxpd->nf;
-        radiotap_hdr.rx_flags = 0;
-        if (!(prxpd->status & cpu_to_le16(MRVDRV_RXPD_STATUS_OK)))
-                radiotap_hdr.rx_flags |= IEEE80211_RADIOTAP_F_RX_BADFCS;
-        //memset(radiotap_hdr.pad, 0x11, IEEE80211_RADIOTAP_HDRLEN - 18);
 
         /* chop the rxpd */
         skb_pull(skb, sizeof(struct rxpd));
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 2368b7f825a2..d4fdc8b7d7d8 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -933,7 +933,6 @@ static int __init init_mac80211_hwsim(void)
                         BIT(NL80211_IFTYPE_STATION) |
                         BIT(NL80211_IFTYPE_AP) |
                         BIT(NL80211_IFTYPE_MESH_POINT);
-                hw->ampdu_queues = 1;
 
                 hw->flags = IEEE80211_HW_MFP_CAPABLE;
 
@@ -1041,6 +1040,9 @@ static int __init init_mac80211_hwsim(void)
                         break;
                 }
 
+                /* give the regulatory workqueue a chance to run */
+                if (regtest)
+                        schedule_timeout_interruptible(1);
                 err = ieee80211_register_hw(hw);
                 if (err < 0) {
                         printk(KERN_DEBUG "mac80211_hwsim: "
diff --git a/drivers/net/wireless/p54/Kconfig b/drivers/net/wireless/p54/Kconfig
index cfc5f41aa136..b45d6a4ed1e8 100644
--- a/drivers/net/wireless/p54/Kconfig
+++ b/drivers/net/wireless/p54/Kconfig
@@ -1,9 +1,10 @@
 config P54_COMMON
         tristate "Softmac Prism54 support"
-        depends on MAC80211 && WLAN_80211 && FW_LOADER && EXPERIMENTAL
+        depends on MAC80211 && WLAN_80211 && EXPERIMENTAL
+        select FW_LOADER
         ---help---
-          This is common code for isl38xx based cards.
-          This module does nothing by itself - the USB/PCI frontends
+          This is common code for isl38xx/stlc45xx based modules.
+          This module does nothing by itself - the USB/PCI/SPI front-ends
           also need to be enabled in order to support any devices.
 
           These devices require softmac firmware which can be found at
@@ -17,31 +18,6 @@ config P54_USB
         select CRC32
         ---help---
           This driver is for USB isl38xx based wireless cards.
-          These are USB based adapters found in devices such as:
-
-          3COM 3CRWE254G72
-          SMC 2862W-G
-          Accton 802.11g WN4501 USB
-          Siemens Gigaset USB
-          Netgear WG121
-          Netgear WG111
-          Medion 40900, Roper Europe
-          Shuttle PN15, Airvast WM168g, IOGear GWU513
-          Linksys WUSB54G
-          Linksys WUSB54G Portable
-          DLink DWL-G120 Spinnaker
-          DLink DWL-G122
-          Belkin F5D7050 ver 1000
-          Cohiba Proto board
-          SMC 2862W-G version 2
-          U.S. Robotics U5 802.11g Adapter
-          FUJITSU E-5400 USB D1700
-          Sagem XG703A
-          DLink DWL-G120 Cohiba
-          Spinnaker Proto board
-          Linksys WUSB54AG
-          Inventel UR054G
-          Spinnaker DUT
 
           These devices require softmac firmware which can be found at
           http://prism54.org/
@@ -64,10 +40,15 @@ config P54_PCI
 
 config P54_SPI
         tristate "Prism54 SPI (stlc45xx) support"
-        depends on P54_COMMON && SPI_MASTER
+        depends on P54_COMMON && SPI_MASTER && GENERIC_HARDIRQS
         ---help---
           This driver is for stlc4550 or stlc4560 based wireless chips.
           This driver is experimental, untested and will probably only work on
           Nokia's N800/N810 Portable Internet Tablet.
 
           If you choose to build a module, it'll be called p54spi.
+
+config P54_LEDS
+        bool
+        depends on P54_COMMON && MAC80211_LEDS && (LEDS_CLASS = y || LEDS_CLASS = P54_COMMON)
+        default y
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 0a989834b70d..0c1b0577d4ee 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -21,9 +21,9 @@
 #include <linux/etherdevice.h>
 
 #include <net/mac80211.h>
-#ifdef CONFIG_MAC80211_LEDS
+#ifdef CONFIG_P54_LEDS
 #include <linux/leds.h>
-#endif /* CONFIG_MAC80211_LEDS */
+#endif /* CONFIG_P54_LEDS */
 
 #include "p54.h"
 #include "p54common.h"
@@ -2420,7 +2420,7 @@ static int p54_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
         return 0;
 }
 
-#ifdef CONFIG_MAC80211_LEDS
+#ifdef CONFIG_P54_LEDS
 static void p54_led_brightness_set(struct led_classdev *led_dev,
                                    enum led_brightness brightness)
 {
@@ -2508,7 +2508,7 @@ static void p54_unregister_leds(struct ieee80211_hw *dev)
         if (priv->assoc_led.registered)
                 led_classdev_unregister(&priv->assoc_led.led_dev);
 }
-#endif /* CONFIG_MAC80211_LEDS */
+#endif /* CONFIG_P54_LEDS */
 
 static const struct ieee80211_ops p54_ops = {
         .tx                     = p54_tx,
@@ -2592,11 +2592,11 @@ int p54_register_common(struct ieee80211_hw *dev, struct device *pdev)
                 return err;
         }
 
-        #ifdef CONFIG_MAC80211_LEDS
+#ifdef CONFIG_P54_LEDS
         err = p54_init_leds(dev);
         if (err)
                 return err;
-        #endif /* CONFIG_MAC80211_LEDS */
+#endif /* CONFIG_P54_LEDS */
 
         dev_info(pdev, "is registered as '%s'\n", wiphy_name(dev->wiphy));
         return 0;
@@ -2610,9 +2610,9 @@ void p54_free_common(struct ieee80211_hw *dev)
         kfree(priv->output_limit);
         kfree(priv->curve_data);
 
-        #ifdef CONFIG_MAC80211_LEDS
+#ifdef CONFIG_P54_LEDS
         p54_unregister_leds(dev);
-        #endif /* CONFIG_MAC80211_LEDS */
+#endif /* CONFIG_P54_LEDS */
 }
 EXPORT_SYMBOL_GPL(p54_free_common);
 
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 24fdfdfee3df..420fff42c0dd 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2425,6 +2425,8 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x0df6, 0x9712), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Surecom */
         { USB_DEVICE(0x0769, 0x31f3), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Tilgin */
+        { USB_DEVICE(0x6933, 0x5001), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Philips */
         { USB_DEVICE(0x0471, 0x200a), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Planex */
diff --git a/drivers/net/wireless/wavelan.c b/drivers/net/wireless/wavelan.c
index b728541f2fb5..3ab3eb957189 100644
--- a/drivers/net/wireless/wavelan.c
+++ b/drivers/net/wireless/wavelan.c
@@ -735,9 +735,9 @@ if (lp->tx_n_in_use > 0)
                 if (tx_status & AC_SFLD_OK) {
                         int ncollisions;
 
-                        lp->stats.tx_packets++;
+                        dev->stats.tx_packets++;
                         ncollisions = tx_status & AC_SFLD_MAXCOL;
-                        lp->stats.collisions += ncollisions;
+                        dev->stats.collisions += ncollisions;
 #ifdef DEBUG_TX_INFO
                         if (ncollisions > 0)
                                 printk(KERN_DEBUG
@@ -745,9 +745,9 @@ if (lp->tx_n_in_use > 0)
                                        dev->name, ncollisions);
 #endif
                 } else {
-                        lp->stats.tx_errors++;
+                        dev->stats.tx_errors++;
                         if (tx_status & AC_SFLD_S10) {
-                                lp->stats.tx_carrier_errors++;
+                                dev->stats.tx_carrier_errors++;
 #ifdef DEBUG_TX_FAIL
                                 printk(KERN_DEBUG
                                        "%s: wv_complete(): tx error: no CS.\n",
@@ -755,7 +755,7 @@ if (lp->tx_n_in_use > 0)
 #endif
                         }
                         if (tx_status & AC_SFLD_S9) {
-                                lp->stats.tx_carrier_errors++;
+                                dev->stats.tx_carrier_errors++;
 #ifdef DEBUG_TX_FAIL
                                 printk(KERN_DEBUG
                                        "%s: wv_complete(): tx error: lost CTS.\n",
@@ -763,7 +763,7 @@ if (lp->tx_n_in_use > 0)
 #endif
                         }
                         if (tx_status & AC_SFLD_S8) {
-                                lp->stats.tx_fifo_errors++;
+                                dev->stats.tx_fifo_errors++;
 #ifdef DEBUG_TX_FAIL
                                 printk(KERN_DEBUG
                                        "%s: wv_complete(): tx error: slow DMA.\n",
@@ -771,7 +771,7 @@ if (lp->tx_n_in_use > 0)
 #endif
                         }
                         if (tx_status & AC_SFLD_S6) {
-                                lp->stats.tx_heartbeat_errors++;
+                                dev->stats.tx_heartbeat_errors++;
 #ifdef DEBUG_TX_FAIL
                                 printk(KERN_DEBUG
                                        "%s: wv_complete(): tx error: heart beat.\n",
@@ -779,7 +779,7 @@ if (lp->tx_n_in_use > 0)
 #endif
                         }
                         if (tx_status & AC_SFLD_S5) {
-                                lp->stats.tx_aborted_errors++;
+                                dev->stats.tx_aborted_errors++;
 #ifdef DEBUG_TX_FAIL
                                 printk(KERN_DEBUG
                                        "%s: wv_complete(): tx error: too many collisions.\n",
@@ -1346,20 +1346,6 @@ static void wv_init_info(struct net_device * dev)
  * or wireless extensions
  */
 
-/*------------------------------------------------------------------*/
-/*
- * Get the current Ethernet statistics. This may be called with the
- * card open or closed.
- * Used when the user read /proc/net/dev
- */
-static en_stats *wavelan_get_stats(struct net_device * dev)
-{
-#ifdef DEBUG_IOCTL_TRACE
-        printk(KERN_DEBUG "%s: <>wavelan_get_stats()\n", dev->name);
-#endif
-
-        return &((net_local *)netdev_priv(dev))->stats;
-}
 
 /*------------------------------------------------------------------*/
 /*
@@ -2466,7 +2452,7 @@ wv_packet_read(struct net_device * dev, u16 buf_off, int sksize)
                        "%s: wv_packet_read(): could not alloc_skb(%d, GFP_ATOMIC).\n",
                        dev->name, sksize);
 #endif
-                lp->stats.rx_dropped++;
+                dev->stats.rx_dropped++;
                 return;
         }
 
@@ -2526,8 +2512,8 @@ wv_packet_read(struct net_device * dev, u16 buf_off, int sksize)
         netif_rx(skb);
 
         /* Keep statistics up to date */
-        lp->stats.rx_packets++;
-        lp->stats.rx_bytes += sksize;
+        dev->stats.rx_packets++;
+        dev->stats.rx_bytes += sksize;
 
 #ifdef DEBUG_RX_TRACE
         printk(KERN_DEBUG "%s: <-wv_packet_read()\n", dev->name);
@@ -2608,7 +2594,7 @@ static void wv_receive(struct net_device * dev)
 #endif
                 } else {        /* If reception was no successful */
 
-                        lp->stats.rx_errors++;
+                        dev->stats.rx_errors++;
 
 #ifdef DEBUG_RX_INFO
                         printk(KERN_DEBUG
@@ -2624,7 +2610,7 @@ static void wv_receive(struct net_device * dev)
 #endif
 
                         if ((fd.fd_status & FD_STATUS_S7) != 0) {
-                                lp->stats.rx_length_errors++;
+                                dev->stats.rx_length_errors++;
 #ifdef DEBUG_RX_FAIL
                                 printk(KERN_DEBUG
                                        "%s: wv_receive(): frame too short.\n",
@@ -2633,7 +2619,7 @@ static void wv_receive(struct net_device * dev)
                         }
 
                         if ((fd.fd_status & FD_STATUS_S8) != 0) {
-                                lp->stats.rx_over_errors++;
+                                dev->stats.rx_over_errors++;
 #ifdef DEBUG_RX_FAIL
                                 printk(KERN_DEBUG
                                        "%s: wv_receive(): rx DMA overrun.\n",
@@ -2642,7 +2628,7 @@ static void wv_receive(struct net_device * dev)
                         }
 
                         if ((fd.fd_status & FD_STATUS_S9) != 0) {
-                                lp->stats.rx_fifo_errors++;
+                                dev->stats.rx_fifo_errors++;
 #ifdef DEBUG_RX_FAIL
                                 printk(KERN_DEBUG
                                        "%s: wv_receive(): ran out of resources.\n",
@@ -2651,7 +2637,7 @@ static void wv_receive(struct net_device * dev)
                         }
 
                         if ((fd.fd_status & FD_STATUS_S10) != 0) {
-                                lp->stats.rx_frame_errors++;
+                                dev->stats.rx_frame_errors++;
 #ifdef DEBUG_RX_FAIL
                                 printk(KERN_DEBUG
                                        "%s: wv_receive(): alignment error.\n",
@@ -2660,7 +2646,7 @@ static void wv_receive(struct net_device * dev)
                         }
 
                         if ((fd.fd_status & FD_STATUS_S11) != 0) {
-                                lp->stats.rx_crc_errors++;
+                                dev->stats.rx_crc_errors++;
 #ifdef DEBUG_RX_FAIL
                                 printk(KERN_DEBUG
                                        "%s: wv_receive(): CRC error.\n",
@@ -2826,7 +2812,7 @@ static int wv_packet_write(struct net_device * dev, void *buf, short length)
         dev->trans_start = jiffies;
 
         /* Keep stats up to date. */
-        lp->stats.tx_bytes += length;
+        dev->stats.tx_bytes += length;
 
         if (lp->tx_first_in_use == I82586NULL)
                 lp->tx_first_in_use = txblock;
@@ -4038,6 +4024,22 @@ static int wavelan_close(struct net_device * dev)
         return 0;
 }
 
+static const struct net_device_ops wavelan_netdev_ops = {
+        .ndo_open               = wavelan_open,
+        .ndo_stop               = wavelan_close,
+        .ndo_start_xmit         = wavelan_packet_xmit,
+        .ndo_set_multicast_list = wavelan_set_multicast_list,
+        .ndo_tx_timeout         = wavelan_watchdog,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_validate_addr      = eth_validate_addr,
+#ifdef SET_MAC_ADDRESS
+        .ndo_set_mac_address    = wavelan_set_mac_address
+#else
+        .ndo_set_mac_address    = eth_mac_addr,
+#endif
+};
+
+
 /*------------------------------------------------------------------*/
 /*
  * Probe an I/O address, and if the WaveLAN is there configure the
@@ -4130,17 +4132,8 @@ static int __init wavelan_config(struct net_device *dev, unsigned short ioaddr)
         /* Init spinlock */
         spin_lock_init(&lp->spinlock);
 
-        dev->open = wavelan_open;
-        dev->stop = wavelan_close;
-        dev->hard_start_xmit = wavelan_packet_xmit;
-        dev->get_stats = wavelan_get_stats;
-        dev->set_multicast_list = &wavelan_set_multicast_list;
-        dev->tx_timeout         = &wavelan_watchdog;
-        dev->watchdog_timeo     = WATCHDOG_JIFFIES;
-#ifdef SET_MAC_ADDRESS
-        dev->set_mac_address = &wavelan_set_mac_address;
-#endif                          /* SET_MAC_ADDRESS */
-
+        dev->netdev_ops = &wavelan_netdev_ops;
+        dev->watchdog_timeo = WATCHDOG_JIFFIES;
         dev->wireless_handlers = &wavelan_handler_def;
         lp->wireless_data.spy_data = &lp->spy_data;
         dev->wireless_data = &lp->wireless_data;
diff --git a/drivers/net/wireless/wavelan.p.h b/drivers/net/wireless/wavelan.p.h
index 44d31bbf39e4..2daa0210d789 100644
--- a/drivers/net/wireless/wavelan.p.h
+++ b/drivers/net/wireless/wavelan.p.h
@@ -459,11 +459,9 @@ static const char	*version	= "wavelan.c : v24 (SMP + wireless extensions) 11/12/
 /****************************** TYPES ******************************/
 
 /* Shortcuts */
-typedef struct net_device_stats en_stats;
 typedef struct iw_statistics    iw_stats;
 typedef struct iw_quality       iw_qual;
-typedef struct iw_freq          iw_freq;
-typedef struct net_local        net_local;
+typedef struct iw_freq          iw_freq;typedef struct net_local        net_local;
 typedef struct timer_list       timer_list;
 
 /* Basic types */
@@ -475,15 +473,12 @@ typedef u_char		mac_addr[WAVELAN_ADDR_SIZE];	/* Hardware address */
  * For each network interface, Linux keeps data in two structures:  "device"
  * keeps the generic data (same format for everybody) and "net_local" keeps
  * additional specific data.
- * Note that some of this specific data is in fact generic (en_stats, for
- * example).
  */
 struct net_local
 {
   net_local *   next;           /* linked list of the devices */
   struct net_device *   dev;            /* reverse link */
   spinlock_t    spinlock;       /* Serialize access to the hardware (SMP) */
-  en_stats      stats;          /* Ethernet interface statistics */
   int           nresets;        /* number of hardware resets */
   u_char        reconfig_82586; /* We need to reconfigure the controller. */
   u_char        promiscuous;    /* promiscuous mode */
@@ -601,8 +596,6 @@ static void
 static inline void
         wv_init_info(struct net_device *);      /* display startup info */
 /* ------------------- IOCTL, STATS & RECONFIG ------------------- */
-static en_stats *
-        wavelan_get_stats(struct net_device *); /* Give stats /proc/net/dev */
 static iw_stats *
         wavelan_get_wireless_stats(struct net_device *);
 static void
diff --git a/drivers/ssb/Kconfig b/drivers/ssb/Kconfig
index b1b947edcf01..540a2948596c 100644
--- a/drivers/ssb/Kconfig
+++ b/drivers/ssb/Kconfig
@@ -53,11 +53,11 @@ config SSB_B43_PCI_BRIDGE
 
 config SSB_PCMCIAHOST_POSSIBLE
         bool
-        depends on SSB && (PCMCIA = y || PCMCIA = SSB) && EXPERIMENTAL
+        depends on SSB && (PCMCIA = y || PCMCIA = SSB)
         default y
 
 config SSB_PCMCIAHOST
-        bool "Support for SSB on PCMCIA-bus host (EXPERIMENTAL)"
+        bool "Support for SSB on PCMCIA-bus host"
         depends on SSB_PCMCIAHOST_POSSIBLE
         select SSB_SPROM
         help
@@ -107,14 +107,14 @@ config SSB_DRIVER_PCICORE
           If unsure, say Y
 
 config SSB_PCICORE_HOSTMODE
-        bool "Hostmode support for SSB PCI core (EXPERIMENTAL)"
-        depends on SSB_DRIVER_PCICORE && SSB_DRIVER_MIPS && EXPERIMENTAL
+        bool "Hostmode support for SSB PCI core"
+        depends on SSB_DRIVER_PCICORE && SSB_DRIVER_MIPS
         help
           PCIcore hostmode operation (external PCI bus).
 
 config SSB_DRIVER_MIPS
-        bool "SSB Broadcom MIPS core driver (EXPERIMENTAL)"
-        depends on SSB && MIPS && EXPERIMENTAL
+        bool "SSB Broadcom MIPS core driver"
+        depends on SSB && MIPS
         select SSB_SERIAL
         help
           Driver for the Sonics Silicon Backplane attached
@@ -129,8 +129,8 @@ config SSB_EMBEDDED
         default y
 
 config SSB_DRIVER_EXTIF
-        bool "SSB Broadcom EXTIF core driver (EXPERIMENTAL)"
-        depends on SSB_DRIVER_MIPS && EXPERIMENTAL
+        bool "SSB Broadcom EXTIF core driver"
+        depends on SSB_DRIVER_MIPS
         help
           Driver for the Sonics Silicon Backplane attached
           Broadcom EXTIF core.
diff --git a/drivers/ssb/b43_pci_bridge.c b/drivers/ssb/b43_pci_bridge.c
index 27a677584a4c..ef9c6a04ad8f 100644
--- a/drivers/ssb/b43_pci_bridge.c
+++ b/drivers/ssb/b43_pci_bridge.c
@@ -18,6 +18,7 @@
 
 static const struct pci_device_id b43_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4301) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4306) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4307) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4311) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4312) },